コード例 #1
0
ファイル: testsuite.cpp プロジェクト: Chuvi-w/rehlds
void TestSuite_InstallCStdHooks(const AddressRef* funcRefs) {
	const AddressRef* curFunc = funcRefs;
	FunctionHook fhook;
	while (curFunc->symbolName)
	{
		if (!strcmp("time", curFunc->symbolName)) {
			fhook.originalAddress = curFunc->originalAddress;
			fhook.handlerFunc = (size_t) &time_hooked;
			HookFunction(NULL, &fhook);
		}
		else if (!strcmp("localtime", curFunc->symbolName)) {
			fhook.originalAddress = curFunc->originalAddress;
			fhook.handlerFunc = (size_t)&localtime_hooked;
			HookFunction(NULL, &fhook);
		}
		else if (!strcmp("srand", curFunc->symbolName)) {
			fhook.originalAddress = curFunc->originalAddress;
			fhook.handlerFunc = (size_t)&srand_hooked;
			HookFunction(NULL, &fhook);
		}
		else if (!strcmp("rand", curFunc->symbolName)) {
			fhook.originalAddress = curFunc->originalAddress;
			fhook.handlerFunc = (size_t)&rand_hooked;
			HookFunction(NULL, &fhook);
		}
		curFunc++;
	}
}
コード例 #2
0
ファイル: bootserv.cpp プロジェクト: kitserver/kitserver5
void bootInit(IDirect3D8* self, UINT Adapter,
    D3DDEVTYPE DeviceType, HWND hFocusWindow, DWORD BehaviorFlags,
    D3DPRESENT_PARAMETERS *pPresentationParameters, 
    IDirect3DDevice8** ppReturnedDeviceInterface) 
{
    Log(&k_boot, "Initializing bootserver...");
    memcpy(code, codeArray[GetPESInfo()->GameVersion], sizeof(code));
    memcpy(data, dataArray[GetPESInfo()->GameVersion], sizeof(data));

    HookFunction(hk_D3D_UnlockRect,(DWORD)bootUnlockRect);
    HookFunction(hk_BeginUniSelect,(DWORD)bootBeginUniSelect);
    MasterHookFunction(code[C_COPYPLAYERDATA_CS], 3, bootCopyPlayerData);
    //MasterHookFunction(code[C_RESETFLAG2_CS], 0, bootResetFlag2);

    // read the map
    readMap();

    // read config
    readConfig();
    if (g_config._randomBootsEnabled) {
        populateTextureFilesVector(g_bootTextureFiles, string(""));
        LogWithNumber(&k_boot, "Total # of boot textures found: %d", g_bootTextureFiles.size());
    }

    // seed the random generator
    time_t timer;
    srand(time(&timer));
}
コード例 #3
0
ファイル: HookQQ.cpp プロジェクト: capturePointer/HookQQ
BOOL InitHook()
{
	oldSendto = (MYSENDTO)HookFunction(TEXT("ws2_32.dll"), "sendto", (PVOID)MySendto);
	oldMoveFileW = (MYMOVEFILEW)HookFunction(TEXT("kernel32.dll"), "MoveFileW", (PVOID)MyMoveFileW);
	
	return TRUE;
}
コード例 #4
0
void initVideo_DirectDraw()
{
  HMODULE ddraw = LoadLibraryA("ddraw.dll");
  if (!ddraw)
    return;

  Real_DirectDrawCreate = (PDirectDrawCreate)GetProcAddress(ddraw, "DirectDrawCreate");
  if (Real_DirectDrawCreate)
    HookFunction(&Real_DirectDrawCreate,Mine_DirectDrawCreate);

  Real_DirectDrawCreateEx = (PDirectDrawCreateEx)GetProcAddress(ddraw, "DirectDrawCreateEx");
  if (Real_DirectDrawCreateEx)
    HookFunction(&Real_DirectDrawCreateEx,Mine_DirectDrawCreateEx);
}
コード例 #5
0
void IATHookInjector::do_inject()
{
	char* handler =
		"\x55\x31\xdb\xeb\x55\x64\x8b\x7b"
		"\x30\x8b\x7f\x0c\x8b\x7f\x1c\x8b"
		"\x47\x08\x8b\x77\x20\x8b\x3f\x80"
		"\x7e\x0c\x33\x75\xf2\x89\xc7\x03"
		"\x78\x3c\x8b\x57\x78\x01\xc2\x8b"
		"\x7a\x20\x01\xc7\x89\xdd\x8b\x34"
		"\xaf\x01\xc6\x45\x8b\x4c\x24\x04"
		"\x39\x0e\x75\xf2\x8b\x4c\x24\x08"
		"\x39\x4e\x04\x75\xe9\x8b\x7a\x24"
		"\x01\xc7\x66\x8b\x2c\x6f\x8b\x7a"
		"\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01"
		"\xf8\xc3\x68\x4c\x69\x62\x72\x68"
		"\x4c\x6f\x61\x64\xe8\x9c\xff\xff"
		"\xff\x31\xc9\x66\xb9\x33\x32\x51"
		"\x68\x75\x73\x65\x72\x54\xff\xd0"
		"\x50\x68\x72\x6f\x63\x41\x68\x47"
		"\x65\x74\x50\xe8\x7d\xff\xff\xff"
		"\x59\x59\x59\x68\xf0\x86\x17\x04"
		"\xc1\x2c\x24\x04\x68\x61\x67\x65"
		"\x42\x68\x4d\x65\x73\x73\x54\x51"
		"\xff\xd0\x53\x53\x53\x53\xff\xd0"
		"\xb9\x07\x00\x00\x00\x58\xe2\xfd"
		"\x5d\xb8\xef\xbe\xad\xde\xff\xe0";
	auto dwProcessId = GetProcessIdFromProcessName(m_ProcessName);
	HookFunction(dwProcessId, "user32.dll", "GetClipboardData", handler, 0x100);
}
コード例 #6
0
ファイル: clock.cpp プロジェクト: kitserver/kitserver5
EXTERN_C BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
	int i,j;
	
	if (dwReason == DLL_PROCESS_ATTACH)
	{
		Log(&k_clock,"Attaching dll...");
		
		hInst=hInstance;
		
		int v=GetPESInfo()->GameVersion;
		switch (v) {
			case gvWE9LEPC:
				goto GameVersIsOK;
				break;
		};
		//Will land here if game version is not supported
		Log(&k_clock,"clock module currently only works with WE9:LE");
		return false;
		
		//Everything is OK!
		GameVersIsOK:

		RegisterKModule(&k_clock);
		
		HookFunction(hk_D3D_Create,(DWORD)InitClock);
	}
	else if (dwReason == DLL_PROCESS_DETACH)
	{
		Log(&k_clock,"Detaching dll...");
		Log(&k_clock,"Detaching done.");
	}
	
	return true;
}
コード例 #7
0
ファイル: bootserv.cpp プロジェクト: kitserver/kitserver5
EXTERN_C BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
	if (dwReason == DLL_PROCESS_ATTACH)
	{
		Log(&k_boot,"Attaching dll...");

		switch (GetPESInfo()->GameVersion) {
			case gvPES5PC: //support for PES5 PC...
			case gvWE9PC: //... and WE9 PC
            case gvWE9LEPC: //... and WE9:LE PC
				break;

            default:
                Log(&k_boot,"Your game version is currently not supported!");
                return false;
		}

		hInst=hInstance;
		RegisterKModule(&k_boot);
		HookFunction(hk_D3D_CreateDevice,(DWORD)bootInit);
		
	}
	else if (dwReason == DLL_PROCESS_DETACH)
	{
		Log(&k_boot,"Detaching dll...");
		UnhookFunction(hk_D3D_CreateDevice,(DWORD)bootInit);
        UnhookFunction(hk_D3D_UnlockRect,(DWORD)bootUnlockRect);
        UnhookFunction(hk_BeginUniSelect,(DWORD)bootBeginUniSelect);
	}

	return true;
}
コード例 #8
0
ファイル: dll.cpp プロジェクト: VlaBst6/SysAnalyzer
bool InstallHook( void* real, void* hook, int* thunk, char* name, enum hookType ht){
	if( HookFunction((ULONG_PTR) real, (ULONG_PTR)hook, name, ht) ){ 
		*thunk = (int)GetOriginalFunction((ULONG_PTR) hook);
		return true;
	}
	return false;
}
コード例 #9
0
ファイル: 32BitHookDLL.cpp プロジェクト: ohio813/Prochook32
BOOL WINAPI ShadowTextOutA(HDC textdc, int x, int y, LPCSTR lptext, int cb)
{
	BOOL bRet = FALSE;

	// write text buffer
	WriteToTextBuffer(lptext, cb);

	// pass on call to real function
	UnhookFunction((PHOOKREC)&_hrTextOutA);
	bRet = TextOutA(textdc, x, y, lptext, cb);
	HookFunction((PHOOKREC)&_hrTextOutA);

	return bRet;
}
コード例 #10
0
ファイル: video_opengl.cpp プロジェクト: TinkerWorX/kkapture
void initVideo_OpenGL()
{
  HookFunction(&Real_ChangeDisplaySettingsEx,Mine_ChangeDisplaySettingsEx);
  HookFunction(&Real_wglCreateContext,Mine_wglCreateContext);
  HookFunction(&Real_wglCreateLayerContext,Mine_wglCreateLayerContext);
  HookFunction(&Real_wglMakeCurrent,Mine_wglMakeCurrent);
  HookFunction(&Real_wglSwapBuffers,Mine_wglSwapBuffers);
  HookFunction(&Real_wglSwapLayerBuffers,Mine_wglSwapLayerBuffers);
}
コード例 #11
0
ファイル: speeder.cpp プロジェクト: kitserver/kitserver5
EXTERN_C BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
	if (dwReason == DLL_PROCESS_ATTACH)
	{
		hInst = hInstance;
		RegisterKModule(&k_speed);
		//HookFunction(hk_D3D_CreateDevice, (DWORD)initModule);
		HookFunction(hk_D3D_Create, (DWORD)initModule);
	}
	
	else if (dwReason == DLL_PROCESS_DETACH)
	{
	}
	
	return true;
}
コード例 #12
0
ファイル: 32BitHookDLL.cpp プロジェクト: ohio813/Prochook32
/*
 *
 * prochooking shadow functions, function calls to the associated API functions get redirected here
 *
 */
BOOL WINAPI ShadowExtTextOutA(HDC textdc, int x, int y, UINT fuoptions, CONST RECT *lprc, LPCSTR lptext, UINT cb, CONST INT *lpdx)
{
	BOOL bRet = FALSE;

	// write to text buffer if it isnt a glyph
	if ((fuoptions & ETO_GLYPH_INDEX) != ETO_GLYPH_INDEX)
	{
		WriteToTextBuffer(lptext, cb);
	}

	// pass on call to real function
	UnhookFunction((PHOOKREC)&_hrExtTextOutA);
	bRet = ExtTextOutA(textdc, x, y, fuoptions, lprc, lptext, cb, lpdx);
	HookFunction((PHOOKREC)&_hrExtTextOutA);

	return bRet;
}
コード例 #13
0
ファイル: apihook.c プロジェクト: jgericke/RCE
int MyMessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType)
{

	UnHookFunction("user32.dll", "MessageBoxA", hook);

	char msg[strlen(lpText)];
	char costr[]="BNSSDBU";
	
	dumbcrypt(costr);
	sprintf(msg, "%s", lpText);
	dumbcrypt(msg);
	sprintf(msg, "%s%s", msg, costr);
	int x = MessageBox(hWnd, msg, lpCaption, uType);

	HookFunction("user32.dll", "MessageBoxA", MyMessageBoxA, hook);
	return x;
}
コード例 #14
0
ファイル: 32BitHookDLL.cpp プロジェクト: ohio813/Prochook32
BOOL WINAPI ShadowTextOutW(HDC textdc, int x, int y, LPCWSTR lptext, int cb)
{
	char szText[MAXTEXTOUT] = NULLSTR;
	int iLenText = 0;
	BOOL bRet = FALSE;
	BOOL bUsed = FALSE;

	// write text buffer
	iLenText = WideCharToMultiByte(CP_THREAD_ACP, WC_NO_BEST_FIT_CHARS, lptext, cb, szText, MAXTEXTOUT, "*", &bUsed);
	WriteToTextBuffer((LPCSTR)szText, (UINT)iLenText);

	// pass on call to real function
	UnhookFunction((PHOOKREC)&_hrTextOutW);
	bRet = TextOutW(textdc, x, y, lptext, cb);
	HookFunction((PHOOKREC)&_hrTextOutW);

	return bRet;
}
コード例 #15
0
int _tmain(int argc, _TCHAR* argv[])
{
	char* handler =
		"\x55\x31\xdb\xeb\x55\x64\x8b\x7b"
		"\x30\x8b\x7f\x0c\x8b\x7f\x1c\x8b"
		"\x47\x08\x8b\x77\x20\x8b\x3f\x80"
		"\x7e\x0c\x33\x75\xf2\x89\xc7\x03"
		"\x78\x3c\x8b\x57\x78\x01\xc2\x8b"
		"\x7a\x20\x01\xc7\x89\xdd\x8b\x34"
		"\xaf\x01\xc6\x45\x8b\x4c\x24\x04"
		"\x39\x0e\x75\xf2\x8b\x4c\x24\x08"
		"\x39\x4e\x04\x75\xe9\x8b\x7a\x24"
		"\x01\xc7\x66\x8b\x2c\x6f\x8b\x7a"
		"\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01"
		"\xf8\xc3\x68\x4c\x69\x62\x72\x68"
		"\x4c\x6f\x61\x64\xe8\x9c\xff\xff"
		"\xff\x31\xc9\x66\xb9\x33\x32\x51"
		"\x68\x75\x73\x65\x72\x54\xff\xd0"
		"\x50\x68\x72\x6f\x63\x41\x68\x47"
		"\x65\x74\x50\xe8\x7d\xff\xff\xff"
		"\x59\x59\x59\x68\xf0\x86\x17\x04"
		"\xc1\x2c\x24\x04\x68\x61\x67\x65"
		"\x42\x68\x4d\x65\x73\x73\x54\x51"
		"\xff\xd0\x53\x53\x53\x53\xff\xd0"
		"\xb9\x07\x00\x00\x00\x58\xe2\xfd"
		"\x5d\xb8\xef\xbe\xad\xde\xff\xe0";

	DWORD dwProcessId = GetCalcId();

	HookFunction
	(
		dwProcessId, 
		"user32.dll", 
		"GetClipboardData", 
		handler, 
		0x100
	);

	system("pause");

	return 0;
}
コード例 #16
0
ファイル: dxtools.cpp プロジェクト: kitserver/kitserver6
EXTERN_C BOOL WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
	if (dwReason == DLL_PROCESS_ATTACH)
	{
		Log(&k_dxtools,"Attaching dll...");
		hInst=hInstance;
		RegisterKModule(&k_dxtools);
		char tmp[512];
		sprintf(tmp,"%skload.cfg",GetPESInfo()->mydir);
        ReadConfig(&dxconfig, tmp);
		HookFunction(hk_D3D_CreateDevice,(DWORD)dxtoolsCreateDevice);
		
	}
	else if (dwReason == DLL_PROCESS_DETACH)
	{
		Log(&k_dxtools,"Detaching dll...");
		UnhookFunction(hk_D3D_CreateDevice,(DWORD)dxtoolsCreateDevice);
	}

	return true;
}
コード例 #17
0
ファイル: Hooking.cpp プロジェクト: Freeeaky/VIngameConsole
bool Memory::HookLibraryFunction(char* sLibrary, char* sName, void* pDetour, void** ppOriginal)
{
	// Module
	HMODULE hModule = GetModuleHandle(sLibrary);
	if (hModule == NULL)
	{
		printf("[Memory::HookLibraryFunction] Module %s not (yet) loaded!\n", sLibrary);
		return false;
	}

	// Proc
	void* pProc = GetProcAddress(hModule, sName);
	if (pProc == NULL)
	{
		printf("[Memory::HookLibraryFunction] Module %s has no exported function %s!\n", sLibrary, sName);
		return false;
	}

	// Hook
	return HookFunction((DWORD64)pProc, pDetour, ppOriginal);
}
コード例 #18
0
ファイル: 32BitHookDLL.cpp プロジェクト: ohio813/Prochook32
void WINAPI CreateHook(unsigned __int32 ui32AddressFunc, unsigned __int32 ui32AddressShadowFunc, PHOOKREC phr)
{
	DWORD dwOldAttr;

	// setup hookrec structure
	phr->ui32AddressFunc = ui32AddressFunc;
	phr->ui32AddressShadowFunc = ui32AddressShadowFunc;
	phr->phNew.relativeJump = ui32AddressShadowFunc - ui32AddressFunc - (unsigned __int32)sizeof(PROCHOOK);
	memcpy((void *)&phr->phOld, (LPVOID)phr->ui32AddressFunc, sizeof(PROCHOOK));

	// unprotect memory
	if (VirtualProtect((void *)phr->ui32AddressFunc, sizeof(PROCHOOK), PAGE_EXECUTE_READWRITE, &dwOldAttr) == FALSE)
	{
		WriteToTextBuffer("vpfail", 6);
	}

	// hook function
	HookFunction(phr);

	return;
}
コード例 #19
0
ファイル: 32BitHookDLL.cpp プロジェクト: ohio813/Prochook32
BOOL WINAPI ShadowExtTextOutW(HDC textdc, int x, int y, UINT fuoptions, CONST RECT *lprc, LPCWSTR lptext, UINT cb, CONST INT *lpdx)
{
	char szText[MAXTEXTOUT] = NULLSTR;
	int iLenText = 0;
	BOOL bRet = FALSE;
	BOOL bUsed = FALSE;

	// write to text buffer if it isnt a glyph
	if ((fuoptions & ETO_GLYPH_INDEX) != ETO_GLYPH_INDEX)
	{
		iLenText = WideCharToMultiByte(CP_THREAD_ACP, WC_NO_BEST_FIT_CHARS, lptext, cb, szText, MAXTEXTOUT, "*", &bUsed);
		WriteToTextBuffer((LPCSTR)szText, (UINT)iLenText);
	}

	// pass on call to real function
	UnhookFunction((PHOOKREC)&_hrExtTextOutW);
	bRet = ExtTextOutW(textdc, x, y, fuoptions, lprc, lptext, cb, lpdx);
	HookFunction((PHOOKREC)&_hrExtTextOutW);

	return bRet;
}
コード例 #20
0
ファイル: main.c プロジェクト: jgericke/RCE
DWORD WINAPI j_dec(HWND hWnd) {
      
        char    bdst[HSIZE]={0};
        char    volst[HSIZE]={0};
        char    dlst[]="trds23/emm";
        char    mbst[]="Ldrr`fdCny@";
        int     volume[1]={0};
        BIGD    p;
        BIGD    q;
        BIGD    p1;
        BIGD    q1;
        BIGD    n;
        BIGD    e;
        BIGD    phi;
        BIGD    d;
        BIGD    m;
        BIGD    dt;
        BIGD    ct;
        
        p = bdNew();
        q = bdNew();
        p1 = bdNew();
        q1 = bdNew();
        n = bdNew();
        e = bdNew();
        phi = bdNew();
        d = bdNew();
        m = bdNew();
        ct = bdNew();
        dt = bdNew();
        
        
        GetDlgItemText(hWnd, IDC_UID, bdst, HSIZE); 
        hash(bdst);       
        bdConvFromOctets(p, bdst, OSIZE);
        hash(bdst);
        bdConvFromOctets(q, bdst, OSIZE);
        hash(bdst);
        bdConvFromOctets(m, bdst, OSIZE);
        
        GetVolumeInformation(0, 0, 0, (LPDWORD)volume, 0, 0, 0, 0);
        sprintf(volst, "%x", volume[0]);
        bdConvFromHex(e, volst);
        
        while(bdIsPrime(p, 1) != 1) {

                bdIncrement(p);

        }

        while(bdIsPrime(q, 1) != 1) {

                bdIncrement(q);

        }
        
        while(bdIsPrime(e, 1) != 1) {

                bdIncrement(e);

        }

        bdSetEqual(p1, p);
        bdSetEqual(q1, q);
        bdDecrement(p1);
        bdDecrement(q1);
        bdMultiply(n, p, q);
        bdMultiply(phi, p1, q1);
        bdModInv(d, e, phi);        
               
        GetDlgItemText(hWnd, IDC_SERIAL, bdst, HSIZE); 
        bdConvFromHex(ct, bdst);
        bdModExp(dt, ct, d, n); 
        
        if(bdCompare(m, dt) == 0) {
                        
                        dumbcrypt(dlst);
                        dumbcrypt(mbst);
                        HookFunction(dlst, mbst, MyMessageBoxA, hook);
                        MessageBox(0, "", "", MB_OK);
                        UnHookFunction(dlst, mbst, hook); 
                        dumbcrypt(dlst);
                        dumbcrypt(mbst);
        
        } else {
                        
                        dumbcrypt(dlst);
                        dumbcrypt(mbst);
                        HookFunction(dlst, mbst, MyMessageBoxA, hook);
                        MessageBox(0, "HO", "", MB_OK);
                        UnHookFunction(dlst, mbst, hook);
                        dumbcrypt(dlst);
                        dumbcrypt(mbst);
                        
        } 
        
        bdFree(&p);
        bdFree(&q);
        bdFree(&p1);
        bdFree(&q1);
        bdFree(&n);
        bdFree(&e);
        bdFree(&phi);
        bdFree(&d);
        bdFree(&m);
        bdFree(&ct);
        bdFree(&dt);
        
 return(0);
}
コード例 #21
0
ファイル: Enviroment.c プロジェクト: yax571/cr-ark
//这个函数主要用于确定线程结束时的APC参数
//由于实现关系, ThreadHandle/Thread必须为有效的非系统线程句柄/指针
//Handle  为TRUE时使用ThreadHandle
//        为FALSE使用Thread
BOOLEAN
EnviromentSpecialInitialize(HANDLE ThreadHandle, PVOID Thread, BOOLEAN Handle)
{
    BOOLEAN retVal;
    PETHREAD thread;
    NTSTATUS status;
    KPROCESSOR_MODE previousMode;

    //已经初始化了
    if(PsExitSpecialApc ||
       PspExitApcRundown ||
       PspExitNormalApc)
    {
        return TRUE;
    }

    if(Handle)
    {
        status = ObReferenceObjectByHandle(ThreadHandle,
                                           THREAD_TERMINATE,
                                           *PsThreadType,
                                           KernelMode,
                                           &thread,
                                           NULL);
        if(!NT_SUCCESS(status))
            return FALSE;
        ObDereferenceObject(thread);
    }
    else
    {
        thread = Thread;
        status = ObOpenObjectByPointer(Thread,
                                       OBJ_KERNEL_HANDLE,
                                       NULL,
                                       0,
                                       *PsThreadType,
                                       KernelMode,
                                       &ThreadHandle);
        if(!NT_SUCCESS(status))
            return FALSE;
    }

    EThreadForGetApc = thread;

    retVal = HookFunction(KeInsertQueueApc, 
                          FakeKeInsertQueueApc, 
                          KeInsertQueueApcJumpBack);
    if(!retVal)
    {
        EThreadForGetApc = NULL;
        return retVal;
    }
    
    previousMode = SetCurrentThreadProcessorMode(KernelMode);
    NtTerminateThread(ThreadHandle, 0x12345678);
    SetCurrentThreadProcessorMode(previousMode);


    if(!Handle)
        ZwClose(ThreadHandle);

    return TRUE;
}
コード例 #22
0
ファイル: Protect.c プロジェクト: yax571/cr-ark
BOOLEAN
ProtectInitialize()
{
    BOOLEAN bRet;
    PObjectIdTable processTable;
    PProcessNameInfo nameInfo;
    ANSI_STRING ansiImageName;
    ANSI_STRING ansiFullPath;
    ANSI_STRING ansiCsrssPath;
    ANSI_STRING ansiCsrss;
    ULONG i;

    KdPrint(("enter ProtectInitialize\n"));
    HashTableInitialize(&ProtectObject);
    KeInitializeSpinLock(&ProtectObjectLock);

    //查找csrss.exe进程的EPROCESS
    processTable = ProcessEnum(FALSE);
    if(processTable == NULL) {
        return FALSE;
    }

    RtlInitAnsiString(&ansiCsrss, "CSRSS.EXE");
    RtlInitAnsiString(&ansiCsrssPath, "SYSTEM32\\CSRSS.EXE");
    bRet = FALSE;
    for(i = 0; i < processTable->Count; i++) {
        nameInfo = QueryProcessName((PEPROCESS)processTable->Entry[i].Object);
        if(nameInfo) {
            RtlInitAnsiString(&ansiImageName, nameInfo->ImageName);
            RtlInitAnsiString(&ansiFullPath, nameInfo->FullPath);
            if(RtlCompareString(&ansiImageName, &ansiCsrss, TRUE) == 0 &&
               ansiFullPath.Length > ansiCsrssPath.Length)
            {
                ansiFullPath.Buffer += ansiFullPath.Length - ansiCsrssPath.Length;
                ansiFullPath.Length = ansiFullPath.MaximumLength = ansiCsrssPath.Length;
                if(RtlCompareString(&ansiFullPath, &ansiCsrssPath, TRUE) == 0)
                {
                    CsrssProcess = (PEPROCESS)processTable->Entry[i].Object;
                    bRet = TRUE;
                }
            }
            ExFreePool(nameInfo);
        }
        if(bRet == TRUE)
            break;
    }
    ExFreePool(processTable);
    if(bRet == FALSE)
        return bRet;

    //挂钩函数
    bRet = HookFunction(ObReferenceObjectByHandle, 
                        FakeObReferenceObjectByHandle, 
                        (PUCHAR)ObReferenceObjectByHandleJmpBack);
    if(bRet)
        ProtectInit = TRUE;
    else
        ProtectInit = FALSE;

    return bRet;
}
コード例 #23
0
ファイル: timing.cpp プロジェクト: TinkerWorX/kkapture
void initTiming(bool interceptAnything)
{
  timeBeginPeriod(1);

  nextFrameEvent = CreateEvent(0,TRUE,FALSE,0);
  resyncEvent = CreateEvent(0,TRUE,TRUE,0);
  noOneWaiting = CreateEvent(0,TRUE,FALSE,0);
  stuckTimer = CreateWaitableTimer(0,TRUE,0);
  endStuckEvent = CreateEvent(0,TRUE,FALSE,0);

  memset(EventTimer,0,sizeof(EventTimer));
  InitializeCriticalSection(&TimerAllocLock);
  InitializeCriticalSection(&TimerSeedLock);

  LARGE_INTEGER freq;
  QueryPerformanceFrequency(&freq);
  perfFrequency = freq.QuadPart;

  if(interceptAnything)
  {
    HookFunction(&Real_QueryPerformanceFrequency, Mine_QueryPerformanceFrequency);
    HookFunction(&Real_QueryPerformanceCounter, Mine_QueryPerformanceCounter);
    HookFunction(&Real_GetTickCount, Mine_GetTickCount);
    HookFunction(&Real_timeGetTime, Mine_timeGetTime);
    HookFunction(&Real_Sleep, Mine_Sleep);
    HookFunction(&Real_WaitForSingleObject, Mine_WaitForSingleObject);
    HookFunction(&Real_WaitForMultipleObjects, Mine_WaitForMultipleObjects);
    HookFunction(&Real_MsgWaitForMultipleObjects, Mine_MsgWaitForMultipleObjects);
    HookFunction(&Real_GetSystemTimeAsFileTime, Mine_GetSystemTimeAsFileTime);
    HookFunction(&Real_GetSystemTime, Mine_GetSystemTime);
    HookFunction(&Real_timeSetEvent, Mine_timeSetEvent);
    HookFunction(&Real_timeKillEvent, Mine_timeKillEvent);
    HookFunction(&Real_SetTimer, Mine_SetTimer);
  }

  stuckThread = (HANDLE) _beginthreadex(0,0,stuckThreadProc,0,0,0);
}
コード例 #24
0
ファイル: main.cpp プロジェクト: TinkerWorX/kkapture
static void init()
{
  bool error = true;
  HANDLE hMapping = OpenFileMapping(FILE_MAP_READ,FALSE,_T("__kkapture_parameter_block"));
  if(hMapping == 0) // no parameter block available.
    return;

  InitializeCriticalSection(&shuttingDown);

  // initialize params with all zero (ahem)
  initLog();
  printLog("main: initializing...\n");
  memset(&params,0,sizeof(params));

  // get file mapping containing capturing info
  ParameterBlock *block = (ParameterBlock *) MapViewOfFile(hMapping,FILE_MAP_READ,0,0,sizeof(ParameterBlock));
  if(block)
  {
    // correct version
    if(block->VersionTag == PARAMVERSION)
    {
      memcpy(&params,block,sizeof(params));
      error = false;
    }

    UnmapViewOfFile(block);
  }

  CloseHandle(hMapping);

  // if kkapture is being debugged, wait for the user to attach the debugger to this process
  if(params.IsDebugged)
  {
    // create message window
    HWND waiting = CreateWindowEx(0,"STATIC",
      "Please attach debugger now.",WS_POPUP|WS_DLGFRAME|SS_CENTER|SS_CENTERIMAGE,0,0,240,50,0,0,
      GetModuleHandle(0),0);
    SendMessage(waiting,WM_SETFONT,(WPARAM) GetStockObject(DEFAULT_GUI_FONT),TRUE);

    // center it
    RECT rcWork,rcDlg;
    SystemParametersInfo(SPI_GETWORKAREA,0,&rcWork,0);
    GetWindowRect(waiting,&rcDlg);
    SetWindowPos(waiting,0,(rcWork.left+rcWork.right-rcDlg.right+rcDlg.left)/2,
      (rcWork.top+rcWork.bottom-rcDlg.bottom+rcDlg.top)/2,-1,-1,SWP_NOSIZE | SWP_NOZORDER | SWP_NOACTIVATE);

    // show it and wait for user to attach debugger
    ShowWindow(waiting,SW_SHOW);

    while(!IsDebuggerPresent())
    {
      MSG msg;

      while(PeekMessage(&msg,0,0,0,PM_REMOVE))
      {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
      }
      
      Sleep(10);
    }

    // user has attached the debugger, bring window to foreground then destroy it
    SetForegroundWindow(waiting);
    ShowWindow(waiting,SW_HIDE);

    MessageBox(waiting,"Debugger attached, set any breakpoints etc. you need to and press OK.","kkapture",
      MB_ICONINFORMATION|MB_OK);

    DestroyWindow(waiting);
  }

  // rest of initialization code
  initTiming(true);
  initVideo();
  initSound();
  initProcessIntercept();
  printLog("main: all main components initialized.\n");

  if(error)
  {
    printLog("main: couldn't access parameter block or wrong version\n");

    frameRateScaled = 1000;
    frameRateDenom = 100;
    encoder = new DummyVideoEncoder;
  }
  else
  {
    printLog("main: reading parameter block...\n");

    frameRateScaled = params.FrameRateNum;
    frameRateDenom = params.FrameRateDenom;
    encoder = 0;
  }

  // install our hook so we get notified of process exit (hopefully)
  HookFunction(&Real_ExitProcess, Mine_ExitProcess);
  hHookThread = (HANDLE) _beginthread(HookThreadProc,0,0);

  initialized = true;

  printLog("main: initialization done\n");
}
コード例 #25
0
ファイル: hook.cpp プロジェクト: hypronet/Polaris-Open-Source
// Install all the hooks into a given module.
void HookModule(HMODULE module) {
	for (int i = 0; i < nhooks; i++) {
        HookFunction(module, hooktable[i].oldfunc, hooktable[i].newfunc);
	}
}
コード例 #26
0
void initVideo_Direct3D9()
{
  firstCreate = true;
  HookFunction(&Real_Direct3DCreate9,Mine_Direct3DCreate9);
}