diff --git a/archive/gmh5225/cheat-attack-thread-slemu.txt b/archive/gmh5225/cheat-attack-thread-slemu.txt new file mode 100644 index 00000000..5c5a1446 --- /dev/null +++ b/archive/gmh5225/cheat-attack-thread-slemu.txt @@ -0,0 +1,513 @@ +Project Path: arc_gmh5225_cheat-attack-thread-slemu_rgp01uhf + +Source Tree: + +```txt +arc_gmh5225_cheat-attack-thread-slemu_rgp01uhf +├── README.md +├── bytes.h +├── emulator.h +├── entry.cpp +├── imports.h +├── process.h +├── slemu.vcxproj +├── slemu.vcxproj.filters +├── slemu.vcxproj.user +├── thread.h +└── utils.h + +``` + +`README.md`: + +```md +# slemu +A simple SCP-SL Anti-cheat usermode emulator + +https://www.unknowncheats.me/forum/anti-cheat-bypass/507676-scp-sl-anti-cheat-emulator.html#post3481160 + +``` + +`bytes.h`: + +```h +namespace bytes +{ + unsigned char loop[] = + { + 0x48, 0x83, 0xEC, 0x28, + 0xB9, 0x64, 0x00, 0x00, 0x00, + 0xFF, 0x15, 0x02, 0x00, 0x00, 0x00, 0xEB, 0x08, + 0xA0, 0xAD, 0x3B, 0x74, 0xFB, 0x7F, 0x00, 0x00, + 0xEB, 0xEE + }; +} +``` + +`emulator.h`: + +```h +namespace emulator +{ + auto emulate( const wchar_t* process_name, const wchar_t* module_name ) -> bool + { + const auto process = utils::get_process( process_name ); + + if ( !process ) + { + dbg( "%S not found", process_name ); + return false; + } + dbg( "%S: %i", process_name, process->get_id( ) ); + + const auto module = process->get_module_entry( module_name ); + + if ( !module.modBaseAddr ) + { + dbg( "%S not found", module_name ); + return false; + } + dbg( "%S base: 0x%llx", module_name, module.modBaseAddr ); + + for ( auto &thread : process->get_threads( ) ) + { + const auto win32_start_address = thread->get_win32_start_address( ); + + if ( win32_start_address > reinterpret_cast< std::uintptr_t > ( module.modBaseAddr ) + module.modBaseSize || + win32_start_address < reinterpret_cast< std::uintptr_t > ( module.modBaseAddr ) ) + { + continue; + } + dbg( "%S thread found 0x%llx", module_name, win32_start_address ); + + const auto local_kernel_base = utils::get_module( L"KERNELBASE.dll" ); + const auto local_sleep_ex = reinterpret_cast< std::uintptr_t > ( GetProcAddress( local_kernel_base, "SleepEx" ) ); + + const auto remote_kernel_base = process->get_module_entry( L"KERNELBASE.dll" ).modBaseAddr; + dbg( "%S's kernelbase.dll: 0x%llx", process_name, remote_kernel_base ); + + const auto remote_sleep_ex = remote_kernel_base + local_sleep_ex - reinterpret_cast< std::uintptr_t > ( local_kernel_base ); + + *reinterpret_cast< void ** >( &bytes::loop[17] ) = remote_sleep_ex; + dbg( "prepared shellcode [SleepEx: 0x%llx]", remote_sleep_ex ); + + const auto shellcode = process->allocate( sizeof( bytes::loop ), PAGE_EXECUTE_READWRITE ); + process->write( shellcode, bytes::loop, sizeof( bytes::loop ) ); + dbg( "shellcode created: 0x%llx", shellcode ); + + auto ctx = thread->get_ctx( ); + ctx.Rip = shellcode; + + thread->set_ctx( ctx ); + dbg( "shellcode executed" ); + + thread->close( ); + dbg( "thread trapped" ); + } + + process->close( ); + + return true; + } +} +``` + +`entry.cpp`: + +```cpp +#include "imports.h" + +auto main( ) -> int +{ + dbg ( "emuation status: %d", emulator::emulate( L"SCPSL.exe", L"SL-AC.dll" ) ); + + return std::cin.get( ); +} +``` + +`imports.h`: + +```h +#include +#include +#include +#include +#include +#include +#include +#include + +#define dbg(content, ...) printf( "[+] " content "\n", __VA_ARGS__) + +#include "thread.h" +#include "process.h" +#include "utils.h" +#include "bytes.h" +#include "emulator.h" +``` + +`process.h`: + +```h +class c_process +{ +public: + + auto get_id( ) -> std::uint32_t + { + return GetProcessId( reinterpret_cast< HANDLE >( this ) ); + } + + auto get_module_entry( const wchar_t* name ) -> MODULEENTRY32 + { + const auto snapshot = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, this->get_id( ) ); + + MODULEENTRY32 module_entry = { 0 }; + module_entry.dwSize = sizeof( module_entry ); + + Module32First( snapshot, &module_entry ); + + do + { + if ( wcscmp( module_entry.szModule, name ) ) + { + continue; + } + + CloseHandle( snapshot ); + return module_entry; + + } while ( Module32Next( snapshot, &module_entry ) ); + + CloseHandle( snapshot ); + + return { 0 }; + } + + auto close( ) -> bool + { + return CloseHandle( reinterpret_cast< HANDLE >( this ) ); + } + + auto get_threads( ) -> std::vector + { + std::vector threads; + threads.clear( ); + + THREADENTRY32 thread_entry; + thread_entry.dwSize = sizeof( thread_entry ); + + const auto snapshot = CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 ); + + Thread32First( snapshot, &thread_entry ); + + do + { + if ( thread_entry.dwSize < FIELD_OFFSET( THREADENTRY32, th32OwnerProcessID ) + sizeof( thread_entry.th32OwnerProcessID ) || GetProcessId(reinterpret_cast( this ) ) != thread_entry.th32OwnerProcessID ) + { + continue; + } + + threads.push_back( reinterpret_cast< c_thread * > ( OpenThread( THREAD_ALL_ACCESS, 0, thread_entry.th32ThreadID ) ) ); + + thread_entry.dwSize = sizeof( thread_entry ); + } while ( Thread32Next( snapshot, &thread_entry ) ); + + CloseHandle( snapshot ); + + return threads; + } + + auto write( std::uintptr_t address, void* buffer, std::size_t size ) -> bool + { + std::size_t bytes; + if ( !WriteProcessMemory( reinterpret_cast< HANDLE >( this ), ( void * )address, buffer, size, &bytes ) || bytes != size ) + { + return false; + } + + return true; + } + + auto allocate( const std::size_t size, unsigned long protection ) -> std::uintptr_t + { + return reinterpret_cast< std::uintptr_t> ( VirtualAllocEx( reinterpret_cast ( this ), 0, size, MEM_COMMIT | MEM_RESERVE, protection ) ); + } +}; +``` + +`slemu.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + + + + + + + + + + + + 16.0 + Win32Proj + {1d563729-318f-4414-8973-6e6216efc458} + emu + 10.0 + + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + Application + true + v142 + Unicode + + + Application + false + v142 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + $(SolutionDir)bin\ + $(SolutionDir)bin\intermediates\ + $(ProjectName)_x64 + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + false + true + NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) + true + stdcpp20 + stdc17 + OnlyExplicitInline + Speed + + + Console + true + true + false + RequireAdministrator + ntdll.lib;%(AdditionalDependencies) + + + + + + +``` + +`slemu.vcxproj.filters`: + +```filters + + + + + + + + + + + + + + +``` + +`slemu.vcxproj.user`: + +```user + + + + +``` + +`thread.h`: + +```h +class c_thread +{ +public: + + auto get_id( ) -> uint32_t + { + return GetThreadId( reinterpret_cast< HANDLE >( this ) ); + } + + auto get_ctx( ) -> CONTEXT + { + CONTEXT ctx { 0 }; + ctx.ContextFlags = CONTEXT_FULL; + GetThreadContext( reinterpret_cast< HANDLE >( this ), &ctx ); + + return ctx; + } + + auto close( ) -> bool + { + return CloseHandle( reinterpret_cast< HANDLE >( this ) ); + } + + auto set_ctx( CONTEXT ctx ) -> bool + { + return SetThreadContext( reinterpret_cast< HANDLE >( this ), &ctx ); + } + + auto get_win32_start_address( ) -> uintptr_t + { + uintptr_t win32_start_address; + + NtQueryInformationThread( reinterpret_cast< HANDLE > ( this ), static_cast ( 9 ), &win32_start_address, sizeof( DWORD64 ), 0 ); + + return win32_start_address; + } +}; +``` + +`utils.h`: + +```h +namespace utils +{ + auto get_process( const wchar_t *name ) -> c_process * + { + PROCESSENTRY32 process_info; + process_info.dwSize = sizeof( process_info ); + + const auto snapshot = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 ); + + Process32First( snapshot, &process_info ); + do + { + if ( wcscmp( process_info.szExeFile, name ) == 0 ) + { + CloseHandle( snapshot ); + + return reinterpret_cast( OpenProcess( PROCESS_ALL_ACCESS, 0, process_info.th32ProcessID ) ); + } + } while ( Process32Next( snapshot, &process_info ) ); + + CloseHandle( snapshot ); + + return nullptr; + } + + auto get_module( const wchar_t* name ) -> HMODULE + { + const auto handle = GetModuleHandle( name ); + + return ( handle ? handle : LoadLibrary( name ) ); + } +} +``` \ No newline at end of file diff --git a/archive/liors619/TtdAntiDebugging.txt b/archive/liors619/TtdAntiDebugging.txt new file mode 100644 index 00000000..e18bfbdd --- /dev/null +++ b/archive/liors619/TtdAntiDebugging.txt @@ -0,0 +1,8491 @@ +Project Path: arc_liors619_TtdAntiDebugging_4r2kkzzy + +Source Tree: + +```txt +arc_liors619_TtdAntiDebugging_4r2kkzzy +├── BeingDebuggedFlag +│ ├── BeingDebuggedFlag.cpp +│ ├── BeingDebuggedFlag.vcxproj +│ └── BeingDebuggedFlag.vcxproj.filters +├── CheckRemoteDebuggerPresent +│ ├── CheckRemoteDebuggerPresent.cpp +│ ├── CheckRemoteDebuggerPresent.vcxproj +│ └── CheckRemoteDebuggerPresent.vcxproj.filters +├── CheckRunningPermission +│ ├── CheckRunningPermission.cpp +│ ├── CheckRunningPermission.vcxproj +│ └── CheckRunningPermission.vcxproj.filters +├── CloseHandleException +│ ├── CloseHandleException.cpp +│ ├── CloseHandleException.vcxproj +│ └── CloseHandleException.vcxproj.filters +├── Dll8 +│ ├── Dll8.vcxproj +│ ├── Dll8.vcxproj.filters +│ ├── dllmain.cpp +│ ├── framework.h +│ ├── packages.config +│ ├── pch.cpp +│ └── pch.h +├── DllInjectorByDigitalWhisper +│ ├── DllInjectorByDigitalWhisper.cpp +│ ├── DllInjectorByDigitalWhisper.vcxproj +│ └── DllInjectorByDigitalWhisper.vcxproj.filters +├── EndlessLoopProject +│ ├── EndlessLoopProject.cpp +│ ├── EndlessLoopProject.vcxproj +│ └── EndlessLoopProject.vcxproj.filters +├── FindRecordFile +│ ├── FindRecordFile.cpp +│ ├── FindRecordFile.vcxproj +│ └── FindRecordFile.vcxproj.filters +├── FindWindow +│ ├── FindWindow.cpp +│ ├── FindWindow.vcxproj +│ └── FindWindow.vcxproj.filters +├── GetParentProcessName +│ ├── GetParentProcessName.cpp +│ ├── GetParentProcessName.vcxproj +│ └── GetParentProcessName.vcxproj.filters +├── Heap Flags and ForceFlags +│ ├── Heap Flags and ForceFlags.vcxproj +│ ├── Heap Flags and ForceFlags.vcxproj.filters +│ └── HeapFlagsAndForceFlags.cpp +├── HidingThreadFromDebugger +│ ├── HidingThreadFromDebugger.cpp +│ ├── HidingThreadFromDebugger.vcxproj +│ └── HidingThreadFromDebugger.vcxproj.filters +├── HookProcess32Next +│ ├── Dll8.dll +│ ├── HookProcess32Next.cpp +│ ├── HookProcess32Next.vcxproj +│ ├── HookProcess32Next.vcxproj.filters +│ └── packages.config +├── IsDebuggerPresent +│ ├── IsDebuggerPresent.cpp +│ ├── IsDebuggerPresent.vcxproj +│ └── IsDebuggerPresent.vcxproj.filters +├── IsTrapFlagOn +│ ├── IsTrapFlagOn.cpp +│ ├── IsTrapFlagOn.vcxproj +│ └── IsTrapFlagOn.vcxproj.filters +├── IsTtdProcessRunning +│ ├── IsTtdProcessRunning.cpp +│ ├── IsTtdProcessRunning.vcxproj +│ └── IsTtdProcessRunning.vcxproj.filters +├── KillTtdProcess +│ ├── KillTtdProcess.vcxproj +│ ├── KillTtdProcess.vcxproj.filters +│ └── KillTtdProcessAndRemoveRecordFile.cpp +├── MiddleParentProcess +│ ├── MiddleParentProcess.cpp +│ ├── MiddleParentProcess.vcxproj +│ └── MiddleParentProcess.vcxproj.filters +├── NtGlobalFlag +│ ├── NtGlobalFlag.cpp +│ ├── NtGlobalFlag.vcxproj +│ └── NtGlobalFlag.vcxproj.filters +├── NtProcessDebugFlags +│ ├── NtProcessDebugFlags.cpp +│ ├── NtProcessDebugFlags.vcxproj +│ └── NtProcessDebugFlags.vcxproj.filters +├── NtProcessDebugObjectHandle +│ ├── NtProcessDebugObjectHandle.cpp +│ ├── NtProcessDebugObjectHandle.vcxproj +│ └── NtProcessDebugObjectHandle.vcxproj.filters +├── RecordFileWeightExperiment +│ ├── RecordFileWeightExperiment.cpp +│ ├── RecordFileWeightExperiment.vcxproj +│ ├── RecordFileWeightExperiment.vcxproj.filters +│ └── example.txt +├── RemoveRecordFileWithAnotherProcess +│ ├── RemoveRecordFileWithAnotherProcess.cpp +│ ├── RemoveRecordFileWithAnotherProcess.vcxproj +│ └── RemoveRecordFileWithAnotherProcess.vcxproj.filters +├── RestartAndRemoveRecordFiles +│ ├── RestartAndRemoveRecordFiles.cpp +│ ├── RestartAndRemoveRecordFiles.vcxproj +│ └── RestartAndRemoveRecordFiles.vcxproj.filters +├── RunAnotherExeExperiment +│ ├── RunAnotherExeExperiment.cpp +│ ├── RunAnotherExeExperiment.vcxproj +│ └── RunAnotherExeExperiment.vcxproj.filters +├── TimingIsRecordedImplementation +│ ├── TimingIsRecordedImplementation.cpp +│ ├── TimingIsRecordedImplementation.vcxproj +│ └── TimingIsRecordedImplementation.vcxproj.filters +├── TimingsOpenDialog +│ ├── TimingsOpenDialog.cpp +│ ├── TimingsOpenDialog.vcxproj +│ └── TimingsOpenDialog.vcxproj.filters +├── TimingsOtherOperations +│ ├── TimingsOtherOperations.cpp +│ ├── TimingsOtherOperations.h +│ ├── TimingsOtherOperations.vcxproj +│ ├── TimingsOtherOperations.vcxproj.filters +│ └── example.txt +├── TtdSolution.sln +├── isRecordedByInjectedDll +│ ├── isRecordedByInjectedDll.cpp +│ ├── isRecordedByInjectedDll.vcxproj +│ └── isRecordedByInjectedDll.vcxproj.filters +└── zzzStringConversions + ├── zzzStringConversions.cpp + ├── zzzStringConversions.vcxproj + └── zzzStringConversions.vcxproj.filters + +``` + +`BeingDebuggedFlag/BeingDebuggedFlag.cpp`: + +```cpp + + +#include +#include +#include +#include + +#include +#include + +using namespace std; +int IsDebugged(); + +int main() +{ + system("pause"); + auto is_debugged = IsDebugged(); + if (is_debugged == 1) { + cout << "debugger found" << endl; + } + else if (is_debugged == 0) { + cout << "debugger not found" << endl; + } + else { + cout << "an error occurred" << endl; + } + system("pause"); +} + +// return 0 when no debugger found +// return 0 when debugger found +// return -1 when an error occurred +int IsDebugged() { + PPEB pPeb = (PPEB)__readgsqword(0x60); + + if (pPeb->BeingDebugged) + return 1; + else + return 0; +} + + + +``` + +`BeingDebuggedFlag/BeingDebuggedFlag.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {7e0409e2-0ab1-486e-af8a-0f606cfa930e} + BeingDebuggedFlag + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`BeingDebuggedFlag/BeingDebuggedFlag.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`CheckRemoteDebuggerPresent/CheckRemoteDebuggerPresent.cpp`: + +```cpp +#include +#include +#include + +using namespace std; +int IsDebugged(); + +int main() +{ + system("pause"); + auto is_debugged = IsDebugged(); + if (is_debugged == 1) { + cout << "debugger found" << endl; + } + else if (is_debugged == 0) { + cout << "debugger not found" << endl; + } + else { + cout << "an error occurred" << endl; + } + system("pause"); +} + +// return 0 when no debugger found +// return 0 when debugger found +// return -1 when an error occurred +int IsDebugged() { + BOOL is_debugged; + if (CheckRemoteDebuggerPresent(GetCurrentProcess(), &is_debugged) == 0) + return -1; + else + return is_debugged; +} + +``` + +`CheckRemoteDebuggerPresent/CheckRemoteDebuggerPresent.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {ba4d7f4b-407c-43fe-908f-b233ebf62524} + CheckRemoteDebuggerPresent + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`CheckRemoteDebuggerPresent/CheckRemoteDebuggerPresent.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`CheckRunningPermission/CheckRunningPermission.cpp`: + +```cpp +// CheckRunningPermission.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include + +BOOL IsUserAdmin2() +/*++ +Routine Description: This routine returns TRUE if the caller's +process is a member of the Administrators local group. Caller is NOT +expected to be impersonating anyone and is expected to be able to +open its own process and process token. +Arguments: None. +Return Value: + TRUE - Caller has Administrators local group. + FALSE - Caller does not have Administrators local group. -- +*/ +{ + BOOL b; + SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY; + PSID AdministratorsGroup; + b = AllocateAndInitializeSid( + &NtAuthority, + 2, + SECURITY_BUILTIN_DOMAIN_RID, + DOMAIN_ALIAS_RID_ADMINS, + 0, 0, 0, 0, 0, 0, + &AdministratorsGroup); + if (b) + { + if (!CheckTokenMembership(NULL, AdministratorsGroup, &b)) + { + b = FALSE; + } + FreeSid(AdministratorsGroup); + } + + return(b); +} + +using namespace std; + +int main() +{ + auto isAdmin = IsUserAdmin2(); + if (isAdmin == TRUE) { + cout << "running as administrator - TTD recording found!" << endl; + } + else if (isAdmin == FALSE) { + cout << "not running as administrator" << endl; + } + + system("pause"); +} + + +``` + +`CheckRunningPermission/CheckRunningPermission.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {a72d3028-146e-425c-8ac8-6079523140ff} + CheckRunningPermission + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`CheckRunningPermission/CheckRunningPermission.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`CloseHandleException/CloseHandleException.cpp`: + +```cpp + +#include +#include + +using namespace std; + +bool Check() +{ + __try + { + CloseHandle((HANDLE)0xDEADC0DE); + return false; + } + __except (EXCEPTION_INVALID_HANDLE == GetExceptionCode()) + { + return true; + } +} + +int main() +{ + bool b = Check(); + if (b) + cout << "Debugger Found\n"; + else + cout << "Debugger not found\n"; +} + +``` + +`CloseHandleException/CloseHandleException.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {822b24fd-2ba2-46d4-b91b-abc3bb416d0a} + CloseHandleException + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`CloseHandleException/CloseHandleException.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`Dll8/Dll8.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {edc0f2b3-544b-4b2f-b13d-59d0e3466c40} + Dll8 + 10.0 + + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;DLL8_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + WIN32;NDEBUG;DLL8_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + Level3 + true + _DEBUG;DLL8_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + false + + + + + Level3 + true + true + true + NDEBUG;DLL8_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) + true + Use + pch.h + + + Windows + true + true + true + false + + + + + + + + + + Create + Create + Create + Create + + + + + + + + + + + + This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. + + + + +``` + +`Dll8/Dll8.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Header Files + + + Header Files + + + + + Source Files + + + Source Files + + + + + + +``` + +`Dll8/dllmain.cpp`: + +```cpp +/* + +// dllmain.cpp : Defines the entry point for the DLL application. +#include "pch.h" +#include +#include + +#include +#include +#include +#include +#include +#include +#include + +//int (WINAPI* Real_Send)(SOCKET s, const char* buf, int len, int flags) = send; +//int (WINAPI* Real_Recv)(SOCKET s, char* buf, int len, int flags) = recv; +//int WINAPI Mine_Send(SOCKET s, const char* buf, int len, int flags); +//int WINAPI Mine_Recv(SOCKET s, char* buf, int len, int flags); + +static BOOL (WINAPI* RealProcessNext)(HANDLE hSnapshot, LPPROCESSENTRY32 lppe) = Process32Next; + +using namespace std; +BOOL WINAPI OurProcess32Next(HANDLE hSnapshot, LPPROCESSENTRY32 lppe) { + cout << "yo" << endl; + return TRUE; +} + + +BOOL WINAPI DllMain(HINSTANCE, DWORD dwReason, LPVOID) { + cout << "version 1.01" << endl; + cout << dwReason << endl; + + if (DetourIsHelperProcess()) { + return TRUE; + } + + if (dwReason == DLL_PROCESS_ATTACH) { + DetourRestoreAfterWith(); + + DetourTransactionBegin(); + DetourUpdateThread(GetCurrentThread()); + DetourAttach(&(PVOID&)RealProcessNext, OurProcess32Next); + DetourTransactionCommit(); + } + else if (dwReason == DLL_PROCESS_DETACH) { + DetourTransactionBegin(); + DetourUpdateThread(GetCurrentThread()); + DetourDetach(&(PVOID&)RealProcessNext, OurProcess32Next); + DetourTransactionCommit(); + } + return TRUE; +} +*/ +#include "pch.h" + + +#include +#include +#include + +static LONG dwSlept = 0; + +// Target pointer for the uninstrumented Sleep API. +// +static VOID(WINAPI* TrueSleep)(DWORD dwMilliseconds) = Sleep; +static BOOL(WINAPI* RealProcessNext)(HANDLE hSnapshot, LPPROCESSENTRY32 lppe) = Process32NextW; +static HWND(WINAPI* TrueFindWindowA)(LPCSTR lpClassName, LPCSTR lpWindowName) = FindWindowA; + +HWND WINAPI OurFindWindowA(LPCSTR lpClassName, LPCSTR lpWindowName) { + printf("our find window method :)\n"); + return NULL; +} + +// Detour function that replaces the Sleep API. +// +VOID WINAPI TimedSleep(DWORD dwMilliseconds) +{ + printf("our sleep :)\n"); + // Save the before and after times around calling the Sleep API. + DWORD dwBeg = GetTickCount(); + TrueSleep(dwMilliseconds); + DWORD dwEnd = GetTickCount(); + + InterlockedExchangeAdd(&dwSlept, dwEnd - dwBeg); +} + + +BOOL WINAPI OurProcess32Next(HANDLE hSnapshot, LPPROCESSENTRY32 lppe) { + printf("our processNext :)\n"); + return Process32NextW(hSnapshot, lppe); +} + +// DllMain function attaches and detaches the TimedSleep detour to the +// Sleep target function. The Sleep target function is referred to +// through the TrueSleep target pointer. + +BOOL WINAPI DllMain(HINSTANCE hinst, DWORD dwReason, LPVOID reserved) +{ + //printf("inject version 1.02\n"); + if (DetourIsHelperProcess()) { + return TRUE; + } + + if (dwReason == DLL_PROCESS_ATTACH) { + DetourRestoreAfterWith(); + + DetourTransactionBegin(); + DetourUpdateThread(GetCurrentThread()); + DetourAttach(&(PVOID&)RealProcessNext, OurProcess32Next); + DetourAttach(&(PVOID&)TrueFindWindowA, OurFindWindowA); + DetourAttach(&(PVOID&)TrueSleep, TimedSleep); + DetourTransactionCommit(); + } + else if (dwReason == DLL_PROCESS_DETACH) { + DetourTransactionBegin(); + DetourUpdateThread(GetCurrentThread()); + DetourDetach(&(PVOID&)RealProcessNext, OurProcess32Next); + DetourDetach(&(PVOID&)TrueFindWindowA, OurFindWindowA); + DetourDetach(&(PVOID&)TrueSleep, TimedSleep); + DetourTransactionCommit(); + } + return TRUE; +} +``` + +`Dll8/framework.h`: + +```h +#pragma once + +#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers +// Windows Header Files +#include + +``` + +`Dll8/packages.config`: + +```config + + + + +``` + +`Dll8/pch.cpp`: + +```cpp +// pch.cpp: source file corresponding to the pre-compiled header + +#include "pch.h" + +// When you are using pre-compiled headers, this source file is necessary for compilation to succeed. + +``` + +`Dll8/pch.h`: + +```h +// pch.h: This is a precompiled header file. +// Files listed below are compiled only once, improving build performance for future builds. +// This also affects IntelliSense performance, including code completion and many code browsing features. +// However, files listed here are ALL re-compiled if any one of them is updated between builds. +// Do not add files here that you will be updating frequently as this negates the performance advantage. + +#ifndef PCH_H +#define PCH_H + +// add headers that you want to pre-compile here +#include "framework.h" + +#endif //PCH_H + +``` + +`DllInjectorByDigitalWhisper/DllInjectorByDigitalWhisper.cpp`: + +```cpp +// DllInjectorByDigitalWhisper.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include +#include +#include +#include +#include // you will need this + +#define WIN32_LEAN_AND_MEAN +#define DLL_QUERY_HMODULE 6 +#define DEREF( name )*(UINT_PTR *)(name) +#define DEREF_64( name )*(DWORD64 *)(name) +#define DEREF_32( name )*(DWORD *)(name) +#define DEREF_16( name )*(WORD *)(name) +#define DEREF_8( name )*(BYTE *)(name) +typedef BOOL(WINAPI* DLLMAIN)(HINSTANCE, DWORD, LPVOID); +#define DLLEXPORT __declspec( dllexport ) + +using namespace std; + +// Your wchar_t* +string convFunc(WCHAR* input) { + wstring ws(input); + // your new String + string str(ws.begin(), ws.end()); + // Show String + return str; +} + +DWORD GetProcIdByName(LPCSTR name); +HANDLE WINAPI LoadRemoteLibraryR(HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter); +DWORD GetReflectiveLoaderOffset(VOID* lpReflectiveDllBuffer); +DWORD Rva2Offset(DWORD dwRva, UINT_PTR uiBaseAddress); + +int main(int argc, char** argv) +{ + HANDLE hFile = NULL; + HANDLE hTargetProcess = NULL; + HANDLE hModule = NULL; + DWORD dwLength = NULL; + DWORD dwBytesRead = 0; + DWORD dwTargetProcessID = NULL; + LPVOID lpBuffer = NULL; + string dllFullPath = "D:\\Users\\Lior\\Downloads\\D_downloads\\TtdSolution\\x64\\Debug\\Dll8.dll"; + string targetProcessName = "IsTtdProcessRunning.exe"; + + dwTargetProcessID = GetProcIdByName(targetProcessName.c_str()); + if (!dwTargetProcessID) { + ERROR("Could not find target process, maybe it is not running"); + return 0; + } + hFile = CreateFileA(dllFullPath.c_str(), GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); + if (hFile == INVALID_HANDLE_VALUE) { + cout << "Failed to open the DLL file" << endl; + return 0; + } + dwLength = GetFileSize(hFile, NULL); + if (dwLength == INVALID_FILE_SIZE || dwLength == 0) + { + cout << "Failed to get the DLL file size" << endl; + return 0; + } + + lpBuffer = HeapAlloc(GetProcessHeap(), 0, dwLength); + if (!lpBuffer) { + cout << "Failed to alloc a buffer!" << endl; + return 0; + } + + if (ReadFile(hFile, lpBuffer, dwLength, &dwBytesRead, NULL) == FALSE) { + cout << "Failed to read dll raw data" << endl; + return 0; + } + + hTargetProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | + PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, dwTargetProcessID); + if (!hTargetProcess) + { + cout << "Failed to open the target process" << endl; + return 0; + } + + hModule = LoadRemoteLibraryR(hTargetProcess, lpBuffer, dwLength, NULL); + if (!hModule) { + cout << "Failed to inject the DLL" << endl; + return 0; + } + + printf("[+] Injected the '%s' DLL into process %d.", dllFullPath, dwTargetProcessID); + WaitForSingleObject(hModule, -1); + return 1; +} + +DWORD GetProcIdByName(LPCSTR name) { + HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD | TH32CS_SNAPPROCESS, NULL); + PROCESSENTRY32 processEntry = { sizeof(PROCESSENTRY32) }; + if (hSnapshot == INVALID_HANDLE_VALUE) + { + CloseHandle(hSnapshot); + cout << "Could not create snapshot" << endl; + return 0; + } + + string targetProcessName = string("IsTtdProcessRunning.exe"); + if (Process32First(hSnapshot, &processEntry)) + { + do + { + if (!Process32Next(hSnapshot, &processEntry)) + { + cout << "Could not get next process" << endl; + return 0; + } + + } while (convFunc(processEntry.szExeFile).compare(targetProcessName) != 0); + } + else + { + cout << "Could not get first process in snapshot" << endl; + return 0; + } + return processEntry.th32ProcessID; +} + +HANDLE WINAPI LoadRemoteLibraryR(HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter) +{ + BOOL bSuccess = FALSE; + LPVOID lpRemoteLibraryBuffer = NULL; + LPTHREAD_START_ROUTINE lpReflectiveLoader = NULL; + HANDLE hThread = NULL; + DWORD dwReflectiveLoaderOffset = 0; + DWORD dwThreadId = 0; + dwReflectiveLoaderOffset = GetReflectiveLoaderOffset(lpBuffer); + if (!dwReflectiveLoaderOffset) + return hThread; + lpRemoteLibraryBuffer = VirtualAllocEx(hProcess, NULL, dwLength, MEM_RESERVE | MEM_COMMIT, + PAGE_EXECUTE_READWRITE); + if (!lpRemoteLibraryBuffer) + return hThread; + if (!WriteProcessMemory(hProcess, lpRemoteLibraryBuffer, lpBuffer, dwLength, NULL)) + return hThread; + + lpReflectiveLoader = (LPTHREAD_START_ROUTINE)((ULONG_PTR)lpRemoteLibraryBuffer + + dwReflectiveLoaderOffset); + + hThread = CreateRemoteThread(hProcess, NULL, 1024 * 1024, lpReflectiveLoader, lpParameter, + (DWORD)NULL, &dwThreadId); + return hThread; +} + + +DWORD GetReflectiveLoaderOffset(VOID* lpReflectiveDllBuffer) +{ + UINT_PTR uiBaseAddress = 0; + UINT_PTR uiExportDir = 0; + UINT_PTR uiNameArray = 0; + UINT_PTR uiAddressArray = 0; + UINT_PTR uiNameOrdinals = 0; + DWORD dwCounter = 0; + uiBaseAddress = (UINT_PTR)lpReflectiveDllBuffer; + uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew; + uiNameArray = (UINT_PTR) & ((PIMAGE_NT_HEADERS)uiExportDir) -> OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]; + uiExportDir = uiBaseAddress + Rva2Offset(((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress, + uiBaseAddress); + uiNameArray = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNames, + uiBaseAddress); + uiAddressArray = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir) -> AddressOfFunctions, uiBaseAddress); + uiNameOrdinals = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir) -> AddressOfNameOrdinals, uiBaseAddress); + dwCounter = ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->NumberOfNames; + while (dwCounter--) + { + char* cpExportedFunctionName = (char*)(uiBaseAddress + Rva2Offset(DEREF_32(uiNameArray), + uiBaseAddress)); + if (strstr(cpExportedFunctionName, "ReflectiveLoader") != NULL) + { + uiAddressArray = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir) -> AddressOfFunctions, uiBaseAddress); + uiAddressArray += (DEREF_16(uiNameOrdinals) * sizeof(DWORD)); + return Rva2Offset(DEREF_32(uiAddressArray), uiBaseAddress); + } + + uiNameArray += sizeof(DWORD); + uiNameOrdinals += sizeof(WORD); + } + return 0; +} + +DWORD Rva2Offset(DWORD dwRva, UINT_PTR uiBaseAddress) +{ + WORD wIndex = 0; + PIMAGE_SECTION_HEADER pSectionHeader = NULL; + PIMAGE_NT_HEADERS pNtHeaders = NULL; + pNtHeaders = (PIMAGE_NT_HEADERS)(uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew); + pSectionHeader = (PIMAGE_SECTION_HEADER)((UINT_PTR)(&pNtHeaders->OptionalHeader) + pNtHeaders -> FileHeader.SizeOfOptionalHeader); + if (dwRva < pSectionHeader[0].PointerToRawData) + return dwRva; + for (wIndex = 0; wIndex < pNtHeaders->FileHeader.NumberOfSections; wIndex++) + { + if (dwRva >= pSectionHeader[wIndex].VirtualAddress && dwRva < + (pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].SizeOfRawData)) + return (dwRva - pSectionHeader[wIndex].VirtualAddress + + pSectionHeader[wIndex].PointerToRawData); + } + return 0; +} + +``` + +`DllInjectorByDigitalWhisper/DllInjectorByDigitalWhisper.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {6c69fe8d-c874-488b-b8eb-07dec99b2d72} + DllInjectorByDigitalWhisper + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`DllInjectorByDigitalWhisper/DllInjectorByDigitalWhisper.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`EndlessLoopProject/EndlessLoopProject.cpp`: + +```cpp +// EndlessLoopProject.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include + +int main() +{ + while (true) { + printf("something\n"); + Sleep(1000); + } +} + +// Run program: Ctrl + F5 or Debug > Start Without Debugging menu +// Debug program: F5 or Debug > Start Debugging menu + +// Tips for Getting Started: +// 1. Use the Solution Explorer window to add/manage files +// 2. Use the Team Explorer window to connect to source control +// 3. Use the Output window to see build output and other messages +// 4. Use the Error List window to view errors +// 5. Go to Project > Add New Item to create new code files, or Project > Add Existing Item to add existing code files to the project +// 6. In the future, to open this project again, go to File > Open > Project and select the .sln file + +``` + +`EndlessLoopProject/EndlessLoopProject.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {a821a3d2-25ed-4783-93d0-9e8cf3b9a026} + EndlessLoopProject + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`EndlessLoopProject/EndlessLoopProject.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`FindRecordFile/FindRecordFile.cpp`: + +```cpp +// FindRecordFile.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include +#include +#include +#include + +using recursive_directory_iterator = std::filesystem::recursive_directory_iterator; +using namespace std; + +string GetCurrentExecutableNameWithoutExtension() { + char processExeName[MAX_PATH]; + GetModuleBaseNameA(GetCurrentProcess(), 0, processExeName, MAX_PATH); + string processExeNameAsString(processExeName); + return processExeNameAsString.substr(0, processExeNameAsString.find_last_of('.')); +} + +int main() +{ + string exeNameWithoutExtension = GetCurrentExecutableNameWithoutExtension(); + + for (const auto& dirEntry : recursive_directory_iterator("D:\\", filesystem::directory_options::skip_permission_denied)) { + try { + // we can check what our process name so researcher could not change it + if (dirEntry.path().filename().string()._Starts_with(exeNameWithoutExtension) && + dirEntry.path().filename().extension().string() == ".run") { + cout << dirEntry.path() << endl; + system("pause"); + } + } + catch(exception &ex) { } + } +} +``` + +`FindRecordFile/FindRecordFile.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {139efcba-ad7d-4948-9aff-904660b7c18e} + FindRecordFile + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp17 + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`FindRecordFile/FindRecordFile.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`FindWindow/FindWindow.cpp`: + +```cpp +// FindWindow.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include +#include + +using namespace std; + +int main() +{ + if (NULL != FindWindowA(NULL, "Recording")) { + cout << "recording found" << endl; + } + else { + cout << "recording not found" << endl; + } + + system("pause"); +} + +``` + +`FindWindow/FindWindow.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {9c7fb4fa-aad2-47c5-8fbe-aced4d6282a1} + FindWindow + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`FindWindow/FindWindow.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`GetParentProcessName/GetParentProcessName.cpp`: + +```cpp +#include +#include +#include +#include +#include +#include + + +using namespace std; + +DWORD getParentPID(DWORD pid) +{ + HANDLE h = NULL; + PROCESSENTRY32 pe = { 0 }; + DWORD ppid = 0; + pe.dwSize = sizeof(PROCESSENTRY32); + h = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); + if (Process32First(h, &pe)) + { + do + { + if (pe.th32ProcessID == pid) + { + ppid = pe.th32ParentProcessID; + break; + } + } while (Process32Next(h, &pe)); + } + CloseHandle(h); + return (ppid); +} + +int main(int argc, char* argv[]) +{ + system("pause"); + DWORD pid, parentProcessPid; + int e; + char fname[MAX_PATH] = { 0 }; + pid = GetCurrentProcessId(); + parentProcessPid = getParentPID(pid); + + //e = getProcessName(GetCurrentProcessId(), (LPWSTR)fname, MAX_PATH); + + HANDLE Handle = OpenProcess( + PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, + FALSE, + parentProcessPid /* This is the PID, you can find one from windows task manager */ + ); + if (Handle) + { + char Buffer[MAX_PATH]; + if (GetModuleBaseNameA(Handle, 0, Buffer, MAX_PATH)) + { + // At this point, buffer contains the full path to the executable + //printf("PPID=%d Err=%d EXE={%s}\n", ppid, 1, Buffer); + //wstring ws(Buffer); + // your new String + //string str(ws.begin(), ws.end()); + // Show String + cout << string(Buffer) << endl; + } + else + { + cout << "shouldnt be here" << endl; + cout << GetLastError() << endl; + // You better call GetLastError() here + } + CloseHandle(Handle); + } + system("pause"); +} +``` + +`GetParentProcessName/GetParentProcessName.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {9a9a1f9f-6474-4d67-a572-fde38715f077} + GetParentProcessName + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`GetParentProcessName/GetParentProcessName.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`Heap Flags and ForceFlags/Heap Flags and ForceFlags.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {7fc4b158-7224-4b90-990d-925d8ce6542e} + HeapFlagsandForceFlags + 10.0 + HeapFlagsAndForceFlags + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`Heap Flags and ForceFlags/Heap Flags and ForceFlags.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`Heap Flags and ForceFlags/HeapFlagsAndForceFlags.cpp`: + +```cpp + +#include +#include +#include +#include +#include +#include +#include +#include + +using namespace std; +bool check() { + PPEB pPeb = (PPEB)__readgsqword(0x60); + PVOID pHeapBase = (PVOID)(*(PDWORD_PTR)((PBYTE)pPeb + 0x30)); + DWORD dwHeapFlagsOffset = 0x70; + DWORD dwHeapForceFlagsOffset = 0x74; + + PDWORD pdwHeapFlags = (PDWORD)((PBYTE)pHeapBase + dwHeapFlagsOffset); + PDWORD pdwHeapForceFlags = (PDWORD)((PBYTE)pHeapBase + dwHeapForceFlagsOffset); + return (*pdwHeapFlags & ~HEAP_GROWABLE) || (*pdwHeapForceFlags != 0); +} + + +int main() +{ + system("pause"); + auto is_debugged = check(); + if (is_debugged) { + cout << "debugger found" << endl; + } + else { + cout << "debugger not found" << endl; + } + system("pause"); +} + +``` + +`HidingThreadFromDebugger/HidingThreadFromDebugger.cpp`: + +```cpp +// HidingThreadFromDebugger.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include +#include + +void threadFunc(); + + +typedef enum _THREADINFOCLASS { + + ThreadHideFromDebugger = 17 + +} THREADINFOCLASS; + +extern "C" ULONG __stdcall NtSetInformationThread( + __in HANDLE ThreadHandle, + __in THREADINFOCLASS ThreadInformationClass, + __in_bcount(ThreadInformationLength) PVOID ThreadInformation, + __in ULONG ThreadInformationLength +); + +// HideThread will attempt to use +// NtSetInformationThread to hide a thread +// from the debugger, Passing NULL for +// hThread will cause the function to hide the thread +// the function is running in. Also, the function returns +// false on failure and true on success +inline bool HideThread(HANDLE hThread) +{ + typedef NTSTATUS(NTAPI* pNtSetInformationThread) + (HANDLE, UINT, PVOID, ULONG); + NTSTATUS Status; + + // Get NtSetInformationThread + pNtSetInformationThread NtSIT = (pNtSetInformationThread) + GetProcAddress(GetModuleHandle(TEXT("ntdll.dll")), + "NtSetInformationThread"); + + // Shouldn't fail + if (NtSIT == NULL) + return false; + + // Set the thread info + if (hThread == NULL) + Status = NtSIT(GetCurrentThread(), + 0x11, // HideThreadFromDebugger + 0, 0); + else + Status = NtSIT(hThread, 0x11, 0, 0); + + if (Status != 0x00000000) + return false; + else + return true; +} + +int main() +{ + system("pause"); + std::thread t1(threadFunc); + t1.join(); + system("pause"); +} + +void threadFunc() { + HideThread(NULL); + // if the method success we should not see the "sometimes" prints + printf("something\n"); + printf("something\n"); + printf("something\n"); +} + +// Run program: Ctrl + F5 or Debug > Start Without Debugging menu +// Debug program: F5 or Debug > Start Debugging menu + +// Tips for Getting Started: +// 1. Use the Solution Explorer window to add/manage files +// 2. Use the Team Explorer window to connect to source control +// 3. Use the Output window to see build output and other messages +// 4. Use the Error List window to view errors +// 5. Go to Project > Add New Item to create new code files, or Project > Add Existing Item to add existing code files to the project +// 6. In the future, to open this project again, go to File > Open > Project and select the .sln file + +``` + +`HidingThreadFromDebugger/HidingThreadFromDebugger.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {db9643cc-9800-4858-a565-b04534e74f6c} + HidingThreadFromDebugger + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`HidingThreadFromDebugger/HidingThreadFromDebugger.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`HookProcess32Next/HookProcess32Next.cpp`: + +```cpp +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include // you will need this + +using namespace std; + +std::wstring s2ws(const std::string& s) +{ + int len; + int slength = (int)s.length() + 1; + len = MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, 0, 0); + wchar_t* buf = new wchar_t[len]; + MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, buf, len); + std::wstring r(buf); + delete[] buf; + return r; +} + +PROCESS_INFORMATION CreateProcessInPauseMode(std::string exePath, WCHAR* argv[]) +{ + STARTUPINFOW si; + PROCESS_INFORMATION pi; + + ZeroMemory(&si, sizeof(si)); + si.cb = sizeof(si); + ZeroMemory(&pi, sizeof(pi)); + + // Start the child process. + if (!CreateProcessW( + s2ws(exePath).c_str(), // No module name (use command line) + argv[1], // Command line + NULL, // Process handle not inheritable + NULL, // Thread handle not inheritable + FALSE, // Set handle inheritance to FALSE + CREATE_SUSPENDED | CREATE_NEW_CONSOLE, // No creation flags + NULL, // Use parent's environment block + NULL, // Use parent's starting directory + &si, // Pointer to STARTUPINFO structure + &pi) // Pointer to PROCESS_INFORMATION structure + ) + { + printf("CreateProcess failed (%d).\n", GetLastError()); + } + + return pi; +} + +void EnableDebugPriv() { + HANDLE hToken; + LUID luid; + TOKEN_PRIVILEGES tkp; + + OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken); + + LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid); + + tkp.PrivilegeCount = 1; + tkp.Privileges[0].Luid = luid; + tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; + + AdjustTokenPrivileges(hToken, false, &tkp, sizeof(tkp), NULL, NULL); + + CloseHandle(hToken); +} + +const char* ConvertToConstCharP(WCHAR* wc){ + _bstr_t b(wc); + const char* c = b; + return c; +} + +LPWSTR ConvertToConstCharP(char* text) { + wchar_t wtext[20]; + mbstowcs(wtext, text, strlen(text) + 1);//Plus null + LPWSTR ptr = wtext; + return ptr; +} + +wchar_t* convertCharArrayToLPCWSTR(const char* charArray) +{ + wchar_t* wString = new wchar_t[4096]; + MultiByteToWideChar(CP_ACP, 0, charArray, -1, wString, 4096); + return wString; +} + +int main(int, WCHAR* argv[]) { + PROCESS_INFORMATION pi = CreateProcessInPauseMode("D:\\Users\\Lior\\Downloads\\D_downloads\\TtdSolution\\x64\\Debug\\FindWindow.exe", argv); + + PROCESSENTRY32 entry; + entry.dwSize = sizeof(PROCESSENTRY32); + + HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL); + + if (Process32First(snapshot, &entry) == TRUE) { + while (Process32Next(snapshot, &entry) == TRUE) { + if (_stricmp(entry.szExeFile, "FindWindow.exe") == 0 || _stricmp(entry.szExeFile, "IsTtdProcessRunning.exe") == 0) { + cout << "find process to inject the dll to: " << entry.szExeFile << endl; + EnableDebugPriv(); + + char dirPath[MAX_PATH]; + char fullPath[MAX_PATH]; + GetCurrentDirectory(MAX_PATH, dirPath); + sprintf_s(fullPath, MAX_PATH, "D:\\Users\\Lior\\Downloads\\D_downloads\\TtdSolution\\x64\\Debug\\Dll8.dll", dirPath); + + HANDLE hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, FALSE, entry.th32ProcessID); + LPVOID libAddr = (LPVOID)GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA"); + LPVOID llParam = (LPVOID)VirtualAllocEx(hProcess, NULL, strlen(fullPath), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE); + + BOOL writeMemorySuccess = WriteProcessMemory(hProcess, llParam, fullPath, strlen(fullPath), NULL); + HANDLE createThredSucceed = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)libAddr, llParam, NULL, NULL); + + CloseHandle(hProcess); + cout << "done injection" << endl; + } + } + } + + CloseHandle(snapshot); + + system("pause"); + ResumeThread(pi.hThread); + + // Wait until child process exits. + WaitForSingleObject(pi.hProcess, INFINITE); + + // Close process and thread handles. + CloseHandle(pi.hProcess); + CloseHandle(pi.hThread); + + return 0; +} +``` + +`HookProcess32Next/HookProcess32Next.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {09a1f5eb-7cc6-48a2-b7a8-5c39b1792e64} + HookProcess32Next + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _CRT_SECURE_NO_WARNINGS + true + NotUsing + true + + + Console + true + + + + + Level3 + true + true + true + _CRT_SECURE_NO_WARNINGS + true + + + Console + true + true + true + + + + + + + + + + + + + + + + + This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. + + + + + + +``` + +`HookProcess32Next/HookProcess32Next.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + + + + +``` + +`HookProcess32Next/packages.config`: + +```config + + + + + + + +``` + +`IsDebuggerPresent/IsDebuggerPresent.cpp`: + +```cpp +#include +#include +#include + +using namespace std; +int IsDebugged(); + +int main() +{ + system("pause"); + auto is_debugged = IsDebugged(); + if (is_debugged == 1) { + cout << "debugger found" << endl; + } + else if (is_debugged == 0) { + cout << "debugger not found" << endl; + } + else { + cout << "an error occurred" << endl; + } + system("pause"); +} + +// return 0 when no debugger found +// return 0 when debugger found +// return -1 when an error occurred +int IsDebugged() { + return IsDebuggerPresent(); +} + +``` + +`IsDebuggerPresent/IsDebuggerPresent.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {afdafa21-da59-46c3-9fe0-020137b2440e} + IsDebuggerPresent + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`IsDebuggerPresent/IsDebuggerPresent.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`IsTrapFlagOn/IsTrapFlagOn.cpp`: + +```cpp +//#include +// +//BOOL isDebugged = TRUE; +//__try +//{ +// __asm +// { +// pushfd +// or dword ptr[esp], 0x100 // set the Trap Flag +// popfd // Load the value into EFLAGS register +// nop +// } +//} +//__except (EXCEPTION_EXECUTE_HANDLER) +//{ +// // If an exception has been raised – debugger is not present +// isDebugged = FALSE; +//} +//if (isDebugged) +//{ +// std::cout << "Stop debugging program!" << std::endl; +// exit(-1); +//} It was originally published on https ://www.apriorit.com/ + + +``` + +`IsTrapFlagOn/IsTrapFlagOn.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {480ce0e0-ac2e-49ae-afd2-c99c9c562f68} + IsTrapFlagOn + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`IsTrapFlagOn/IsTrapFlagOn.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`IsTtdProcessRunning/IsTtdProcessRunning.cpp`: + +```cpp + +// IsTtdProcessRunning.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include +#include +#include +#include + +using namespace std; + +bool IsProcessRunning(string executableName) { + PROCESSENTRY32 entry; + entry.dwSize = sizeof(PROCESSENTRY32); + + const auto snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL); + + if (!Process32First(snapshot, &entry)) { + CloseHandle(snapshot); + return false; + } + + do { + TCHAR* currentProcessName = entry.szExeFile; + //_tprintf(TEXT("%s\n"), currentProcessName); + bool same = true; + for (int i = 0; i < 7; i++) { + if (executableName[i] != currentProcessName[i]) { + same = false; + } + } + if (same) { + CloseHandle(snapshot); + return true; + } + } while (Process32Next(snapshot, &entry)); + + CloseHandle(snapshot); + return false; +} + +int main() +{ + bool b = IsProcessRunning("TTD.exe"); + if (b) + cout << "TTD.exe found\n"; + else + cout << "TTD.exe not found\n"; + system("pause"); +} + + +``` + +`IsTtdProcessRunning/IsTtdProcessRunning.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {59dc2360-ff30-4d5b-a8a0-ab5b482c5a58} + IsTtdProcessRunning + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`IsTtdProcessRunning/IsTtdProcessRunning.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`KillTtdProcess/KillTtdProcess.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {067ddcf4-328d-4f0b-8b76-6ea2349ac9dc} + KillTtdProcess + 10.0 + KillTtdProcessAndRemoveRecordFile + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp17 + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + {a93be0ed-4f81-420d-a0c8-a636511a3cb3} + + + + + + +``` + +`KillTtdProcess/KillTtdProcess.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`KillTtdProcess/KillTtdProcessAndRemoveRecordFile.cpp`: + +```cpp + +// IsTtdProcessRunning.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +using recursive_directory_iterator = std::filesystem::recursive_directory_iterator; +using namespace std; + + + + +string str2; + +std::wstring s2ws(const std::string& s) +{ + int len; + int slength = (int)s.length() + 1; + len = MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, 0, 0); + wchar_t* buf = new wchar_t[len]; + MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, buf, len); + std::wstring r(buf); + delete[] buf; + return r; +} + +VOID startup(std::string exePath, TCHAR* argv[]) +{ + // additional information + STARTUPINFO si; + PROCESS_INFORMATION pi; + + // set the size of the structures + ZeroMemory(&si, sizeof(si)); + si.cb = sizeof(si); + ZeroMemory(&pi, sizeof(pi)); + + std::string str = ""; + LPSTR args = const_cast(str.c_str()); + + + // start the program up + CreateProcess( + s2ws(exePath).c_str(), // the path + argv[1], // Command line + NULL, // Process handle not inheritable + NULL, // Thread handle not inheritable + FALSE, // Set handle inheritance to FALSE + 0, // No creation flags + NULL, // Use parent's environment block + NULL, // Use parent's starting directory + &si, // Pointer to STARTUPINFO structure + &pi // Pointer to PROCESS_INFORMATION structure (removed extra parentheses) + ); + // Close process and thread handles. + CloseHandle(pi.hProcess); + CloseHandle(pi.hThread); +} + +using namespace std; + +int GetPid(string executableName) { + PROCESSENTRY32 entry; + entry.dwSize = sizeof(PROCESSENTRY32); + + const auto snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL); + + if (!Process32First(snapshot, &entry)) { + CloseHandle(snapshot); + return false; + } + + do { + TCHAR* currentProcessName = entry.szExeFile; + //_tprintf(TEXT("%s\n"), currentProcessName); + bool same = true; + for (int i = 0; i < 7; i++) { + if (executableName[i] != currentProcessName[i]) { + same = false; + } + } + if (same) { + CloseHandle(snapshot); + return entry.th32ProcessID; + } + } while (Process32Next(snapshot, &entry)); + + CloseHandle(snapshot); + return false; +} + +void KillProcess(string executableName) { + int process_id = GetPid(executableName); + const auto process_to_kill = OpenProcess(PROCESS_TERMINATE, false, process_id); + TerminateProcess(process_to_kill, 1); + CloseHandle(process_to_kill); +} + +bool IsFileExists(const std::string& name) { + ifstream f(name.c_str()); + return f.good(); +} + +string GetCurrentExecutableNameWithoutExtension() { + char processExeName[MAX_PATH]; + GetModuleBaseNameA(GetCurrentProcess(), 0, processExeName, MAX_PATH); + string processExeNameAsString(processExeName); + return processExeNameAsString.substr(0, processExeNameAsString.find_last_of('.')); +} + +void DeleteRecordFiles(string recordedProgramName) { + string exeNameWithoutExtension = GetCurrentExecutableNameWithoutExtension(); + + for (const auto& dirEntry : recursive_directory_iterator("D:\\", filesystem::directory_options::skip_permission_denied)) { + try { + // we can check what our process name so researcher could not change it + if (dirEntry.path().filename().string()._Starts_with(recordedProgramName) && + dirEntry.path().filename().extension().string() == ".run") { + std::remove(dirEntry.path().string().c_str()); + } + } + catch (exception& ex) {} + } +} + +int main(int argc, char* argv[]) +{ + std::string recordedProgramName(argv[1]); + + Sleep(1000); + KillProcess("DbgX.Shell.exe"); //kill windbg process + Sleep(1000); + DeleteRecordFiles(recordedProgramName); +} + + +``` + +`MiddleParentProcess/MiddleParentProcess.cpp`: + +```cpp +// MiddleParentProcess.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include +#include + +std::wstring s2ws(const std::string& s) +{ + int len; + int slength = (int)s.length() + 1; + len = MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, 0, 0); + wchar_t* buf = new wchar_t[len]; + MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, buf, len); + std::wstring r(buf); + delete[] buf; + return r; +} + +VOID startup(std::string exePath, TCHAR* argv[]) +{ + // additional information + STARTUPINFO si; + PROCESS_INFORMATION pi; + + // set the size of the structures + ZeroMemory(&si, sizeof(si)); + si.cb = sizeof(si); + ZeroMemory(&pi, sizeof(pi)); + + std::string str = ""; + LPSTR args = const_cast(str.c_str()); + + + // start the program up + CreateProcess( + s2ws(exePath).c_str(), // the path + argv[1], // Command line + NULL, // Process handle not inheritable + NULL, // Thread handle not inheritable + FALSE, // Set handle inheritance to FALSE + 0, // No creation flags + NULL, // Use parent's environment block + NULL, // Use parent's starting directory + &si, // Pointer to STARTUPINFO structure + &pi // Pointer to PROCESS_INFORMATION structure (removed extra parentheses) + ); + // Close process and thread handles. + CloseHandle(pi.hProcess); + CloseHandle(pi.hThread); +} + +int main(int argc, TCHAR* argv[]) +{ + // options one: can choose the name so probably the best one + startup("C:\\Users\\Lior\\source\\repos\\TtdSolution\\x64\\Debug\\GetParentProcessName.exe", argv); + system("pause"); //dont work without the waiting + + // second options: parent process name will be "cmd" and cannot be changed + //system("C:\\Users\\Lior\\source\\repos\\TtdSolution\\x64\\Debug\\GetParentProcessName.exe"); + + // third option - doesnt work, cant find parent process + //the child process cant find the parent and its not good to us cause we cant choose its name + //HWND dummyHWND = ::CreateWindowA("STATIC", "dummy", WS_VISIBLE, 0, 0, 100, 100, NULL, NULL, NULL, NULL); + //::SetWindowTextA(dummyHWND, "Dummy Window!"); + //ShellExecute(dummyHWND, (s2ws("open")).c_str(), s2ws("C:\\Users\\Lior\\source\\repos\\TtdSolution\\x64\\Debug\\GetParentProcessName.exe").c_str(), NULL, NULL, SW_SHOWDEFAULT); +} + +``` + +`MiddleParentProcess/MiddleParentProcess.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {96f75d5a-9c0d-4e46-9f70-079ab3210006} + MiddleParentProcess + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`MiddleParentProcess/MiddleParentProcess.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`NtGlobalFlag/NtGlobalFlag.cpp`: + +```cpp +#include + +#include +#include +#include +#include +#include +#include +#define FLG_HEAP_ENABLE_TAIL_CHECK 0x10 +#define FLG_HEAP_ENABLE_FREE_CHECK 0x20 +#define FLG_HEAP_VALIDATE_PARAMETERS 0x40 +#define NT_GLOBAL_FLAG_DEBUGGED (FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS) + + +#include +#include +#include + +using namespace std; +int IsDebugged(); + +int main() +{ + system("pause"); + auto is_debugged = IsDebugged(); + if (is_debugged == 1) { + cout << "debugger found" << endl; + } + else if (is_debugged == 0) { + cout << "debugger not found" << endl; + } + else { + cout << "an error occurred" << endl; + } + system("pause"); +} + +// return 0 when no debugger found +// return 0 when debugger found +// return -1 when an error occurred +int IsDebugged() { + using namespace std; + typedef NTSTATUS(NTAPI* TNtQueryInformationProcess)( + IN HANDLE ProcessHandle, + IN DWORD ProcessInformationClass, + OUT PVOID ProcessInformation, + IN ULONG ProcessInformationLength, + OUT PULONG ReturnLength + ); + + HMODULE hNtdll = LoadLibraryA("ntdll.dll"); + if (hNtdll) + { + auto pfnNtQueryInformationProcess = (TNtQueryInformationProcess)GetProcAddress( + hNtdll, "NtQueryInformationProcess"); + + if (pfnNtQueryInformationProcess) + { + PROCESS_BASIC_INFORMATION pbi; + + DWORD dwProcessDebugFlags, dwReturned; + NTSTATUS status = pfnNtQueryInformationProcess( + GetCurrentProcess(), + ProcessBasicInformation, + &pbi, + sizeof(PROCESS_BASIC_INFORMATION), + &dwReturned); + + if (NT_SUCCESS(status)) + { + PPEB peb_addr = pbi.PebBaseAddress; + PDWORD NtGlobalFlag = (PDWORD)(((PBYTE)peb_addr) + 0xBC); + DWORD NtGlobalFlagValue = *NtGlobalFlag; + cout << "NtGlobalFlag value is: " << NtGlobalFlagValue << endl; + if (NtGlobalFlagValue == 0) + return 0; + else if (NtGlobalFlagValue & NT_GLOBAL_FLAG_DEBUGGED) + return 1; + else + return -1; + } + else { + return -1; + } + system("pause"); + } + } +} + +``` + +`NtGlobalFlag/NtGlobalFlag.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {6aa19589-2452-4141-a461-6954f37483db} + NtGlobalFlag + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`NtGlobalFlag/NtGlobalFlag.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`NtProcessDebugFlags/NtProcessDebugFlags.cpp`: + +```cpp +#include +#include +#include +#include +#include + +#include +#include + +using namespace std; +int IsDebugged(); + +int main() +{ + system("pause"); + auto is_debugged = IsDebugged(); + if (is_debugged == 1) { + cout << "debugger found" << endl; + } + else if (is_debugged == 0) { + cout << "debugger not found" << endl; + } + else { + cout << "an error occurred" << endl; + } + system("pause"); +} + +// return 0 when no debugger found +// return 0 when debugger found +// return -1 when an error occurred +int IsDebugged() { + typedef NTSTATUS(NTAPI* TNtQueryInformationProcess)( + IN HANDLE ProcessHandle, + IN DWORD ProcessInformationClass, + OUT PVOID ProcessInformation, + IN ULONG ProcessInformationLength, + OUT PULONG ReturnLength + ); + + HMODULE hNtdll = LoadLibraryA("ntdll.dll"); + if (hNtdll) + { + auto pfnNtQueryInformationProcess = (TNtQueryInformationProcess)GetProcAddress( + hNtdll, "NtQueryInformationProcess"); + + if (pfnNtQueryInformationProcess) + { + DWORD dwProcessDebugFlags, dwReturned; + const DWORD ProcessDebugFlags = 0x1f; + NTSTATUS status = pfnNtQueryInformationProcess( + GetCurrentProcess(), + ProcessDebugFlags, + &dwProcessDebugFlags, + sizeof(DWORD), + &dwReturned); + + if (NT_SUCCESS(status) && (0 == dwProcessDebugFlags)) + return 1; + else + return 0; + } + else + return -1; + } +} + + + +``` + +`NtProcessDebugFlags/NtProcessDebugFlags.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {980e764a-7931-4555-91f3-5860bf29b04f} + NtProcessDebugFlags + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`NtProcessDebugFlags/NtProcessDebugFlags.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`NtProcessDebugObjectHandle/NtProcessDebugObjectHandle.cpp`: + +```cpp +#include +#include +#include +#include +#include + +#include +#include + +using namespace std; +int IsDebugged(); + +int main() +{ + system("pause"); + auto is_debugged = IsDebugged(); + if (is_debugged == 1) { + cout << "debugger found" << endl; + } + else if (is_debugged == 0) { + cout << "debugger not found" << endl; + } + else { + cout << "an error occurred" << endl; + } + system("pause"); +} + +// return 0 when no debugger found +// return 0 when debugger found +// return -1 when an error occurred +int IsDebugged() { + typedef NTSTATUS(NTAPI* TNtQueryInformationProcess)( + IN HANDLE ProcessHandle, + IN DWORD ProcessInformationClass, + OUT PVOID ProcessInformation, + IN ULONG ProcessInformationLength, + OUT PULONG ReturnLength + ); + + HMODULE hNtdll = LoadLibraryA("ntdll.dll"); + if (hNtdll) + { + auto pfnNtQueryInformationProcess = (TNtQueryInformationProcess)GetProcAddress( + hNtdll, "NtQueryInformationProcess"); + + if (pfnNtQueryInformationProcess) + { + DWORD dwReturned; + HANDLE hProcessDebugObject = 0; + const DWORD ProcessDebugObjectHandle = 0x1e; + NTSTATUS status = pfnNtQueryInformationProcess( + GetCurrentProcess(), + ProcessDebugObjectHandle, + &hProcessDebugObject, + sizeof(HANDLE), + &dwReturned); + + if (NT_SUCCESS(status) && (0 != hProcessDebugObject)) + return 1; + else return 0; + } + } + return -1; +} + + + +``` + +`NtProcessDebugObjectHandle/NtProcessDebugObjectHandle.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {db728db3-1d1e-4379-a7b5-2220e258e283} + NtProcessDebugObjectHandle + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`NtProcessDebugObjectHandle/NtProcessDebugObjectHandle.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`RecordFileWeightExperiment/RecordFileWeightExperiment.cpp`: + +```cpp +// TimingsOtherOperations.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include +#include +#include +#include + +using namespace std; + +int SecondsForEachMethod = 5; + + +void RunExceptionThrowing() { + std::chrono::steady_clock::time_point startTime = std::chrono::steady_clock::now(); + std::chrono::duration elapsed_seconds; + + elapsed_seconds = std::chrono::steady_clock::now() - startTime; + while (elapsed_seconds.count() < SecondsForEachMethod) { + try { + throw exception("message"); + } + catch (exception& e) {} + elapsed_seconds = std::chrono::steady_clock::now() - startTime; + } +} + +void NewAndDelete() { + std::chrono::steady_clock::time_point startTime = std::chrono::steady_clock::now(); + std::chrono::duration elapsed_seconds; + + elapsed_seconds = std::chrono::steady_clock::now() - startTime; + while (elapsed_seconds.count() < SecondsForEachMethod) { + int* intP = new int; + delete intP; + elapsed_seconds = std::chrono::steady_clock::now() - startTime; + } +} + +void OpenAndCloseFiles() { + std::chrono::steady_clock::time_point startTime = std::chrono::steady_clock::now(); + std::chrono::duration elapsed_seconds; + + elapsed_seconds = std::chrono::steady_clock::now() - startTime; + while (elapsed_seconds.count() < SecondsForEachMethod) { + ofstream myfile; + myfile.open("example.txt", 2); + myfile.close(); + elapsed_seconds = std::chrono::steady_clock::now() - startTime; + } +} + +void LoadAndUnloadLibraries() { + std::chrono::steady_clock::time_point startTime = std::chrono::steady_clock::now(); + std::chrono::duration elapsed_seconds; + + elapsed_seconds = std::chrono::steady_clock::now() - startTime; + while (elapsed_seconds.count() < SecondsForEachMethod) { + HMODULE hNtdll = LoadLibraryA("ntdll.dll"); + int unloadResult = FreeLibrary(hNtdll); + if (unloadResult == 0) + printf("an error occured\n"); + elapsed_seconds = std::chrono::steady_clock::now() - startTime; + } +} + +void methodForNewThread() { + int* intP = new int; + delete intP; +} + +void CreateAndRunThreads() { + std::chrono::steady_clock::time_point startTime = std::chrono::steady_clock::now(); + std::chrono::duration elapsed_seconds; + + elapsed_seconds = std::chrono::steady_clock::now() - startTime; + while(elapsed_seconds.count() < SecondsForEachMethod) + { + std::thread t1(methodForNewThread); + t1.join(); + elapsed_seconds = std::chrono::steady_clock::now() - startTime; + } +} + +int main() +{ + while (true) { + std::chrono::duration elapsed_seconds; + std::chrono::steady_clock::time_point startTime; + std::chrono::steady_clock::time_point endTime; + + startTime = std::chrono::steady_clock::now(); + CreateAndRunThreads(); + endTime = std::chrono::steady_clock::now(); + elapsed_seconds = endTime - startTime; + cout << "threads time in seconds: " << elapsed_seconds.count() << endl; + + printf("\n\n"); + } +} + + + +``` + +`RecordFileWeightExperiment/RecordFileWeightExperiment.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {da23dbc1-00c8-4871-a37b-146bdeb024c7} + RecordFileWeightExperiment + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`RecordFileWeightExperiment/RecordFileWeightExperiment.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`RemoveRecordFileWithAnotherProcess/RemoveRecordFileWithAnotherProcess.cpp`: + +```cpp +// RemoveRecordFileWithAnotherProcess.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include +#include +#include + +using namespace std; + + + + +std::wstring s2ws(const std::string& s) +{ + int len; + int slength = (int)s.length() + 1; + len = MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, 0, 0); + wchar_t* buf = new wchar_t[len]; + MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, buf, len); + std::wstring r(buf); + delete[] buf; + return r; +} + +VOID startup(std::string exePath, TCHAR* argv[]) +{ + // additional information + STARTUPINFO si; + PROCESS_INFORMATION pi; + + // set the size of the structures + ZeroMemory(&si, sizeof(si)); + si.cb = sizeof(si); + ZeroMemory(&pi, sizeof(pi)); + + std::string str = ""; + LPSTR args = const_cast(str.c_str()); + + + // start the program up + CreateProcess( + s2ws(exePath).c_str(), // the path + argv[1], // Command line + NULL, // Process handle not inheritable + NULL, // Thread handle not inheritable + FALSE, // Set handle inheritance to FALSE + 0, // No creation flags + NULL, // Use parent's environment block + NULL, // Use parent's starting directory + &si, // Pointer to STARTUPINFO structure + &pi // Pointer to PROCESS_INFORMATION structure (removed extra parentheses) + ); + // Close process and thread handles. + CloseHandle(pi.hProcess); + CloseHandle(pi.hThread); +} + +string GetCurrentExecutableNameWithoutExtension() { + char processExeName[MAX_PATH]; + GetModuleBaseNameA(GetCurrentProcess(), 0, processExeName, MAX_PATH); + string processExeNameAsString(processExeName); + return processExeNameAsString.substr(0, processExeNameAsString.find_last_of('.')); +} + +bool IsRecorded() { + return FindWindowA(NULL, "Recording") != NULL; +} + +void RestartAndRemoveRecordFile() { + HWND dummyHWND = ::CreateWindowA("STATIC", "dummy", WS_VISIBLE, 0, 0, 100, 100, NULL, NULL, NULL, NULL); + ShellExecute(dummyHWND, (s2ws("open")).c_str(), s2ws("D:\\Users\\Lior\\Downloads\\D_downloads\\TtdSolutions\\x64\\Debug\\KillTtdProcessAndRemoveRecordFile.exe").c_str(), s2ws(GetCurrentExecutableNameWithoutExtension()).c_str(), NULL, SW_SHOWDEFAULT); +} + + +int main(int argc, TCHAR* argv[]) +{ + std::cout << "Hello World!\n"; + system("pause"); + if (IsRecorded()) + RestartAndRemoveRecordFile(); + + return 0; +} + +``` + +`RemoveRecordFileWithAnotherProcess/RemoveRecordFileWithAnotherProcess.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {a93be0ed-4f81-420d-a0c8-a636511a3cb3} + RemoveRecordFileWithAnotherProcess + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`RemoveRecordFileWithAnotherProcess/RemoveRecordFileWithAnotherProcess.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`RestartAndRemoveRecordFiles/RestartAndRemoveRecordFiles.cpp`: + +```cpp +// RemoveRecordFileWithAnotherProcess.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include +#include +#include +#include + +#include +#include + +#define SOME_TIME_TO_WAIT 8000 + +using recursive_directory_iterator = std::filesystem::recursive_directory_iterator; +using namespace std; + +wstring s2ws(const std::string& s) +{ + int len; + int slength = (int)s.length() + 1; + len = MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, 0, 0); + wchar_t* buf = new wchar_t[len]; + MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, buf, len); + std::wstring r(buf); + delete[] buf; + return r; +} + +int GetPid(string executableName) { + PROCESSENTRY32 entry; + entry.dwSize = sizeof(PROCESSENTRY32); + + const auto snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL); + + if (!Process32First(snapshot, &entry)) { + CloseHandle(snapshot); + return false; + } + + do { + TCHAR* currentProcessName = entry.szExeFile; + //_tprintf(TEXT("%s\n"), currentProcessName); + bool same = true; + for (int i = 0; i < 7; i++) { + if (executableName[i] != currentProcessName[i]) { + same = false; + } + } + if (same) { + CloseHandle(snapshot); + return entry.th32ProcessID; + } + } while (Process32Next(snapshot, &entry)); + + CloseHandle(snapshot); + return false; +} + +void KillProcess(string executableName) { + int process_id = GetPid(executableName); + const auto process_to_kill = OpenProcess(PROCESS_TERMINATE, false, process_id); + TerminateProcess(process_to_kill, 1); + CloseHandle(process_to_kill); +} + +LPWSTR converConstCharPointerToLpwstr(const char* str) +{ + wchar_t wtext[4096]; + size_t size = 4097; + mbstowcs_s(&size, wtext, str, strlen(str) + 1);//Plus null + LPWSTR ptr = wtext; + return ptr; +} + +void LoadAndUnloadLibraries() { + for (size_t i = 0; i < 50000; i++) + { + HMODULE hNtdll = LoadLibraryA("ntdll.dll"); + int unloadResult = FreeLibrary(hNtdll); + if (unloadResult == 0) + printf("an error occured\n"); + } +} + +bool IsRecorded() { + std::chrono::steady_clock::time_point startTime = std::chrono::steady_clock::now(); + LoadAndUnloadLibraries(); + std::chrono::steady_clock::time_point endTime = std::chrono::steady_clock::now(); + std::chrono::duration elapsed_seconds = endTime - startTime; + + cout << "load and unload libraries time in seconds: " << elapsed_seconds.count() << endl; + if (elapsed_seconds.count() >= 1) + return true; + else + return false; +} + +bool IsFileExists(const std::string& name) { + ifstream f(name.c_str()); + return f.good(); +} + +// we can remove only ".run" file to remove the recording +// we remove the ".out" file so the next time they try to record our program it'll get the number 01 +void DeleteFile(string fileName) { + if (IsFileExists(fileName.c_str())) { + if (std::remove(fileName.c_str()) == 0) { + cout << "file deleted: " << fileName << endl; + } + else { + cout << "remove method failed." << endl; + } + } + else { + cout << "file not found.\n" << endl; + } +} + +bool IsNotFirstCall(int mainArgc) { + return mainArgc > 1; +} + +string GetCurrentExecutableNameWithoutExtension() { + char processExeName[MAX_PATH]; + GetModuleBaseNameA(GetCurrentProcess(), 0, processExeName, MAX_PATH); + string processExeNameAsString(processExeName); + return processExeNameAsString.substr(0, processExeNameAsString.find_last_of('.')); +} + +void FindAndDeleteRecordFiles() +{ + string exeNameWithoutExtension = GetCurrentExecutableNameWithoutExtension(); + + for (const auto& dirEntry : recursive_directory_iterator("D:\\", std::filesystem::directory_options::skip_permission_denied)) { + try { + string fileName = dirEntry.path().filename().string(); + string extension = dirEntry.path().filename().extension().string(); + // we can check what our process name so researcher could not change it + if (fileName._Starts_with(exeNameWithoutExtension) && + (extension == ".run" || extension == ".out" || extension == ".idx")) { + DeleteFile(dirEntry.path().string()); + } + } + catch (exception& ex) {} + } +} + +void KillWinDbgAndDeleteRecordFiles() +{ + cout << "kill windbg process..." << endl; + Sleep(1000); + // there can be more than 1 windbg + KillProcess("DbgX.Shell.exe"); //kill windbg process + Sleep(1000); + cout << "search for recordFiles..." << endl; + FindAndDeleteRecordFiles(); +} + +void RestartAndRemoveRecordFile() { + HWND dummyHWND = ::CreateWindowA("STATIC", "dummy", WS_VISIBLE, 0, 0, 100, 100, NULL, NULL, NULL, NULL); + ShellExecute(dummyHWND, (s2ws("open")).c_str(), s2ws("D:\\Users\\Lior\\Downloads\\D_downloads\\TtdSolution\\x64\\Debug\\RestartAndRemoveRecordFiles.exe").c_str(), s2ws("secondRun").c_str(), NULL, SW_SHOWDEFAULT); + exit(0); +} + +int main(int argc, TCHAR* argv[]) +{ + if (IsNotFirstCall(argc)) + KillWinDbgAndDeleteRecordFiles(); + + while (true) { + Sleep(SOME_TIME_TO_WAIT); + + if (IsRecorded()) { + RestartAndRemoveRecordFile(); + return 0; + } + } +} + +``` + +`RestartAndRemoveRecordFiles/RestartAndRemoveRecordFiles.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {7e239b39-c625-476b-aad4-1af862d6da65} + RestartAndRemoveRecordFiles + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp17 + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp17 + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`RestartAndRemoveRecordFiles/RestartAndRemoveRecordFiles.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`RunAnotherExeExperiment/RunAnotherExeExperiment.cpp`: + +```cpp +// MiddleParentProcess.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include +#include + +std::wstring s2ws(const std::string& s) +{ + int len; + int slength = (int)s.length() + 1; + len = MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, 0, 0); + wchar_t* buf = new wchar_t[len]; + MultiByteToWideChar(CP_ACP, 0, s.c_str(), slength, buf, len); + std::wstring r(buf); + delete[] buf; + return r; +} + +VOID startup(std::string exePath, TCHAR* argv[]) +{ + // additional information + STARTUPINFO si; + PROCESS_INFORMATION pi; + + // set the size of the structures + ZeroMemory(&si, sizeof(si)); + si.cb = sizeof(si); + ZeroMemory(&pi, sizeof(pi)); + + std::string str = ""; + LPSTR args = const_cast(str.c_str()); + + + // start the program up + CreateProcess( + s2ws(exePath).c_str(), // the path + argv[1], // Command line + NULL, // Process handle not inheritable + NULL, // Thread handle not inheritable + FALSE, // Set handle inheritance to FALSE + 0, // No creation flags + NULL, // Use parent's environment block + NULL, // Use parent's starting directory + &si, // Pointer to STARTUPINFO structure + &pi // Pointer to PROCESS_INFORMATION structure (removed extra parentheses) + ); + // Close process and thread handles. + CloseHandle(pi.hProcess); + CloseHandle(pi.hThread); +} + +int main(int argc, TCHAR* argv[]) +{ + // options one: can choose the name so probably the best one + startup("D:\\Users\\Lior\\Downloads\\D_downloads\\TtdSolution\\x64\\Debug\\EndlessLoopProject.exe", argv); + system("pause"); //dont work without the waiting + + // second options: parent process name will be "cmd" and cannot be changed + //system("C:\\Users\\Lior\\source\\repos\\TtdSolution\\x64\\Debug\\GetParentProcessName.exe"); + + // third option - doesnt work, cant find parent process + //the child process cant find the parent and its not good to us cause we cant choose its name + //HWND dummyHWND = ::CreateWindowA("STATIC", "dummy", WS_VISIBLE, 0, 0, 100, 100, NULL, NULL, NULL, NULL); + //::SetWindowTextA(dummyHWND, "Dummy Window!"); + //ShellExecute(dummyHWND, (s2ws("open")).c_str(), s2ws("C:\\Users\\Lior\\source\\repos\\TtdSolution\\x64\\Debug\\GetParentProcessName.exe").c_str(), NULL, NULL, SW_SHOWDEFAULT); +} +``` + +`RunAnotherExeExperiment/RunAnotherExeExperiment.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {7ddd25c3-52ff-4cdd-b540-410891e39287} + RunAnotherExeExperiment + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`RunAnotherExeExperiment/RunAnotherExeExperiment.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`TimingIsRecordedImplementation/TimingIsRecordedImplementation.cpp`: + +```cpp +// TimingIsRecordedImplementation.cpp : This file contains the 'main' function. Program execution begins and ends there. + + +#include +#include +#include + +using namespace std; + +void LoadAndUnloadLibraries() { + for (size_t i = 0; i < 50000; i++) + { + HMODULE hNtdll = LoadLibraryA("ntdll.dll"); + int unloadResult = FreeLibrary(hNtdll); + if (unloadResult == 0) + printf("an error occured\n"); + } +} + +// 1 recorded +// 0 not recorded +// other - error occurred +int IsRecorded() { + std::chrono::steady_clock::time_point startTime = std::chrono::steady_clock::now(); + LoadAndUnloadLibraries(); + std::chrono::steady_clock::time_point endTime = std::chrono::steady_clock::now(); + std::chrono::duration elapsed_seconds = endTime - startTime; + + cout << "load and unload libraries time in seconds: " << elapsed_seconds.count() << endl; + if (elapsed_seconds.count() >= 1) + return 1; + else + return 0; +} + +int main() +{ + auto is_debugged = IsRecorded(); + if (is_debugged == 1) { + cout << "TTD found" << endl; + } + else if (is_debugged == 0) { + cout << "TTD not found" << endl; + } + else { + cout << "an error occurred" << endl; + } + system("pause"); +} + + +``` + +`TimingIsRecordedImplementation/TimingIsRecordedImplementation.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {a009fb7b-2eee-4281-8f12-00806d12f894} + TimingIsRecordedImplementation + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`TimingIsRecordedImplementation/TimingIsRecordedImplementation.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`TimingsOpenDialog/TimingsOpenDialog.cpp`: + +```cpp +// TimingsOpenDialog.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +using namespace std; + +// Returns an empty string if dialog is canceled +#include +#include +#include +#include +#include +#include + +using namespace std; + +wchar_t* convertCharArrayToLPCWSTR(const char* charArray) +{ + wchar_t* wString = new wchar_t[4096]; + MultiByteToWideChar(CP_ACP, 0, charArray, -1, wString, 4096); + return wString; +} + +LPWSTR converConstCharPointerToLpwstr(const char* str) +{ + wchar_t wtext[4096]; + size_t size = 4097; + mbstowcs_s(&size, wtext, str, strlen(str) + 1);//Plus null + LPWSTR ptr = wtext; + return ptr; +} + +int WINAPI wWinMain(HINSTANCE hInstance, HINSTANCE, PWSTR pCmdLine, int nCmdShow) +{ + HRESULT hr = CoInitializeEx(NULL, COINIT_APARTMENTTHREADED | + COINIT_DISABLE_OLE1DDE); + + /* + if (SUCCEEDED(hr)) + { + IFileOpenDialog* pFileOpen; + + // Create the FileOpenDialog object. + hr = CoCreateInstance(CLSID_FileOpenDialog, NULL, CLSCTX_ALL, + IID_IFileOpenDialog, reinterpret_cast(&pFileOpen)); + + if (SUCCEEDED(hr)) + { + // Show the Open dialog box. + hr = pFileOpen->Show(NULL); + // Get the file name from the dialog box. + if (SUCCEEDED(hr)) + { + IShellItem* pItem; + hr = pFileOpen->GetResult(&pItem); + if (SUCCEEDED(hr)) + { + PWSTR pszFilePath; + hr = pItem->GetDisplayName(SIGDN_FILESYSPATH, &pszFilePath); + + // Display the file name to the user. + if (SUCCEEDED(hr)) + { + cout << "yo!" << endl; + MessageBoxW(NULL, pszFilePath, L"File Path", MB_OK); + cout << "yo!" << endl; + CoTaskMemFree(pszFilePath); + } + pItem->Release(); + } + } + pFileOpen->Release(); + } + CoUninitialize(); + } + */ + return 0; +} + +int main() +{ + auto startTime = std::chrono::steady_clock::now(); + wWinMain(NULL, NULL, NULL, 0); + auto endTime = std::chrono::steady_clock::now(); + + std::chrono::duration elapsed_seconds = endTime - startTime; + // the number of seconds we check, decided by observasions.. (when recorded the logic takes about 10x times) + if (elapsed_seconds.count() > 0.01) { + cout << "process recorded" << endl; + } + else { + cout << "process not recorded" << endl; + } + + cout << "seconds: " << elapsed_seconds.count() << endl; + system("pause"); +} + + + +``` + +`TimingsOpenDialog/TimingsOpenDialog.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {d540a73e-4165-490b-b006-e707ff345f58} + TimingsOpenDialog + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`TimingsOpenDialog/TimingsOpenDialog.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`TimingsOtherOperations/TimingsOtherOperations.cpp`: + +```cpp +// TimingsOtherOperations.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include +#include +#include +#include + +using namespace std; + +void RunExceptionThrowing() { + for (size_t i = 0; i < 10000; i++) + { + try { + throw exception("message"); + } + catch (exception &e) { } + } +} + +void NewAndDelete() { + for (size_t i = 1; i < 10000; i++) + { + int* intP = new int; + delete intP; + } +} + +void OpenAndCloseFiles() { + for (size_t i = 0; i < 10000; i++) + { + ofstream myfile; + myfile.open("example.txt", 2); + myfile.close(); + } +} + +void LoadAndUnloadLibraries() { + for (size_t i = 0; i < 10000; i++) + { + HMODULE hNtdll = LoadLibraryA("ntdll.dll"); + int unloadResult = FreeLibrary(hNtdll); + if (unloadResult == 0) + printf("an error occured\n"); + } +} + +void methodForNewThread() { + int* intP = new int; + delete intP; +} + +void CreateAndRunThreadsWithNews() { + for (size_t i = 0; i < 10000; i++) + { + std::thread t1(methodForNewThread); + t1.join(); + } +} + +int main() +{ + system("pause"); + while (true) { + std::chrono::duration elapsed_seconds; + std::chrono::steady_clock::time_point startTime; + std::chrono::steady_clock::time_point endTime; + + system("pause"); + startTime = std::chrono::steady_clock::now(); + RunExceptionThrowing(); + endTime = std::chrono::steady_clock::now(); + elapsed_seconds = endTime - startTime; + cout << "exception time in seconds: " << elapsed_seconds.count() << endl; + + system("pause"); + startTime = std::chrono::steady_clock::now(); + NewAndDelete(); + endTime = std::chrono::steady_clock::now(); + elapsed_seconds = endTime - startTime; + cout << "create and delete objects time in seconds: " << elapsed_seconds.count() << endl; + + system("pause"); + startTime = std::chrono::steady_clock::now(); + OpenAndCloseFiles(); + endTime = std::chrono::steady_clock::now(); + elapsed_seconds = endTime - startTime; + auto elapsed_ticks = endTime - startTime; + cout << "open and close files time in seconds: " << elapsed_seconds.count() << endl; + + system("pause"); + startTime = std::chrono::steady_clock::now(); + LoadAndUnloadLibraries(); + endTime = std::chrono::steady_clock::now(); + elapsed_seconds = endTime - startTime; + cout << "load and unload libraries time in seconds: " << elapsed_seconds.count() << endl; + + system("pause"); + startTime = std::chrono::steady_clock::now(); + CreateAndRunThreadsWithNews(); + endTime = std::chrono::steady_clock::now(); + elapsed_seconds = endTime - startTime; + cout << "threads time in seconds: " << elapsed_seconds.count() << endl; + + system("pause"); + printf("\n\n"); + } +} + + + +``` + +`TimingsOtherOperations/TimingsOtherOperations.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {af5964ac-cfe8-4653-bea1-3a1cb60f8862} + TimingsOtherOperations + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + + + + +``` + +`TimingsOtherOperations/TimingsOtherOperations.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + + + Header Files + + + +``` + +`TtdSolution.sln`: + +```sln + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.0.31919.166 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "IsDebuggerPresent", "IsDebuggerPresent\IsDebuggerPresent.vcxproj", "{AFDAFA21-DA59-46C3-9FE0-020137B2440E}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CheckRemoteDebuggerPresent", "CheckRemoteDebuggerPresent\CheckRemoteDebuggerPresent.vcxproj", "{BA4D7F4B-407C-43FE-908F-B233EBF62524}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "NtGlobalFlag", "NtGlobalFlag\NtGlobalFlag.vcxproj", "{6AA19589-2452-4141-A461-6954F37483DB}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "HeapFlagsAndForceFlags", "Heap Flags and ForceFlags\Heap Flags and ForceFlags.vcxproj", "{7FC4B158-7224-4B90-990D-925D8CE6542E}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "NtProcessDebugFlags", "NtProcessDebugFlags\NtProcessDebugFlags.vcxproj", "{980E764A-7931-4555-91F3-5860BF29B04F}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "NtProcessDebugObjectHandle", "NtProcessDebugObjectHandle\NtProcessDebugObjectHandle.vcxproj", "{DB728DB3-1D1E-4379-A7B5-2220E258E283}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "BeingDebuggedFlag", "BeingDebuggedFlag\BeingDebuggedFlag.vcxproj", "{7E0409E2-0AB1-486E-AF8A-0F606CFA930E}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "GetParentProcessName", "GetParentProcessName\GetParentProcessName.vcxproj", "{9A9A1F9F-6474-4D67-A572-FDE38715F077}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "IsTtdProcessRunning", "IsTtdProcessRunning\IsTtdProcessRunning.vcxproj", "{59DC2360-FF30-4D5B-A8A0-AB5B482C5A58}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "IsTrapFlagOn", "IsTrapFlagOn\IsTrapFlagOn.vcxproj", "{480CE0E0-AC2E-49AE-AFD2-C99C9C562F68}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "HidingThreadFromDebugger", "HidingThreadFromDebugger\HidingThreadFromDebugger.vcxproj", "{DB9643CC-9800-4858-A565-B04534E74F6C}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CloseHandleException", "CloseHandleException\CloseHandleException.vcxproj", "{822B24FD-2BA2-46D4-B91B-ABC3BB416D0A}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MiddleParentProcess", "MiddleParentProcess\MiddleParentProcess.vcxproj", "{96F75D5A-9C0D-4E46-9F70-079AB3210006}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "HookProcess32Next", "HookProcess32Next\HookProcess32Next.vcxproj", "{09A1F5EB-7CC6-48A2-B7A8-5C39B1792E64}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Dll8", "Dll8\Dll8.vcxproj", "{EDC0F2B3-544B-4B2F-B13D-59D0E3466C40}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "isRecordedByInjectedDll", "isRecordedByInjectedDll\isRecordedByInjectedDll.vcxproj", "{CFB4CDF8-4CFE-44F1-8F2A-A2EA478DA690}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CheckRunningPermission", "CheckRunningPermission\CheckRunningPermission.vcxproj", "{A72D3028-146E-425C-8AC8-6079523140FF}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TimingsOpenDialog", "TimingsOpenDialog\TimingsOpenDialog.vcxproj", "{D540A73E-4165-490B-B006-E707FF345F58}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "zzzStringConversions", "zzzStringConversions\zzzStringConversions.vcxproj", "{6E5678DD-2714-43CF-AB84-B33B3C662F08}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TimingsOtherOperations", "TimingsOtherOperations\TimingsOtherOperations.vcxproj", "{AF5964AC-CFE8-4653-BEA1-3A1CB60F8862}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "FindWindow", "FindWindow\FindWindow.vcxproj", "{9C7FB4FA-AAD2-47C5-8FBE-ACED4D6282A1}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "KillTtdProcessAndRemoveRecordFile", "KillTtdProcess\KillTtdProcess.vcxproj", "{067DDCF4-328D-4F0B-8B76-6EA2349AC9DC}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "RunAnotherExeExperiment", "RunAnotherExeExperiment\RunAnotherExeExperiment.vcxproj", "{7DDD25C3-52FF-4CDD-B540-410891E39287}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "EndlessLoopProject", "EndlessLoopProject\EndlessLoopProject.vcxproj", "{A821A3D2-25ED-4783-93D0-9E8CF3B9A026}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "RemoveRecordFileWithAnotherProcess", "RemoveRecordFileWithAnotherProcess\RemoveRecordFileWithAnotherProcess.vcxproj", "{A93BE0ED-4F81-420D-A0C8-A636511A3CB3}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "FindRecordFile", "FindRecordFile\FindRecordFile.vcxproj", "{139EFCBA-AD7D-4948-9AFF-904660B7C18E}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "RestartAndRemoveRecordFiles", "RestartAndRemoveRecordFiles\RestartAndRemoveRecordFiles.vcxproj", "{7E239B39-C625-476B-AAD4-1AF862D6DA65}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "RecordFileWeightExperiment", "RecordFileWeightExperiment\RecordFileWeightExperiment.vcxproj", "{DA23DBC1-00C8-4871-A37B-146BDEB024C7}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TimingIsRecordedImplementation", "TimingIsRecordedImplementation\TimingIsRecordedImplementation.vcxproj", "{A009FB7B-2EEE-4281-8F12-00806D12F894}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Any CPU = Debug|Any CPU + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|Any CPU = Release|Any CPU + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {AFDAFA21-DA59-46C3-9FE0-020137B2440E}.Debug|Any CPU.ActiveCfg = Debug|x64 + {AFDAFA21-DA59-46C3-9FE0-020137B2440E}.Debug|Any CPU.Build.0 = Debug|x64 + {AFDAFA21-DA59-46C3-9FE0-020137B2440E}.Debug|x64.ActiveCfg = Debug|x64 + {AFDAFA21-DA59-46C3-9FE0-020137B2440E}.Debug|x64.Build.0 = Debug|x64 + {AFDAFA21-DA59-46C3-9FE0-020137B2440E}.Debug|x86.ActiveCfg = Debug|Win32 + {AFDAFA21-DA59-46C3-9FE0-020137B2440E}.Debug|x86.Build.0 = Debug|Win32 + {AFDAFA21-DA59-46C3-9FE0-020137B2440E}.Release|Any CPU.ActiveCfg = Release|x64 + {AFDAFA21-DA59-46C3-9FE0-020137B2440E}.Release|Any CPU.Build.0 = Release|x64 + {AFDAFA21-DA59-46C3-9FE0-020137B2440E}.Release|x64.ActiveCfg = Release|x64 + {AFDAFA21-DA59-46C3-9FE0-020137B2440E}.Release|x64.Build.0 = Release|x64 + {AFDAFA21-DA59-46C3-9FE0-020137B2440E}.Release|x86.ActiveCfg = Release|Win32 + {AFDAFA21-DA59-46C3-9FE0-020137B2440E}.Release|x86.Build.0 = Release|Win32 + {BA4D7F4B-407C-43FE-908F-B233EBF62524}.Debug|Any CPU.ActiveCfg = Debug|x64 + {BA4D7F4B-407C-43FE-908F-B233EBF62524}.Debug|Any CPU.Build.0 = Debug|x64 + {BA4D7F4B-407C-43FE-908F-B233EBF62524}.Debug|x64.ActiveCfg = Debug|x64 + {BA4D7F4B-407C-43FE-908F-B233EBF62524}.Debug|x64.Build.0 = Debug|x64 + {BA4D7F4B-407C-43FE-908F-B233EBF62524}.Debug|x86.ActiveCfg = Debug|Win32 + {BA4D7F4B-407C-43FE-908F-B233EBF62524}.Debug|x86.Build.0 = Debug|Win32 + {BA4D7F4B-407C-43FE-908F-B233EBF62524}.Release|Any CPU.ActiveCfg = Release|x64 + {BA4D7F4B-407C-43FE-908F-B233EBF62524}.Release|Any CPU.Build.0 = Release|x64 + {BA4D7F4B-407C-43FE-908F-B233EBF62524}.Release|x64.ActiveCfg = Release|x64 + {BA4D7F4B-407C-43FE-908F-B233EBF62524}.Release|x64.Build.0 = Release|x64 + {BA4D7F4B-407C-43FE-908F-B233EBF62524}.Release|x86.ActiveCfg = Release|Win32 + {BA4D7F4B-407C-43FE-908F-B233EBF62524}.Release|x86.Build.0 = Release|Win32 + {6AA19589-2452-4141-A461-6954F37483DB}.Debug|Any CPU.ActiveCfg = Debug|x64 + {6AA19589-2452-4141-A461-6954F37483DB}.Debug|Any CPU.Build.0 = Debug|x64 + {6AA19589-2452-4141-A461-6954F37483DB}.Debug|x64.ActiveCfg = Debug|x64 + {6AA19589-2452-4141-A461-6954F37483DB}.Debug|x64.Build.0 = Debug|x64 + {6AA19589-2452-4141-A461-6954F37483DB}.Debug|x86.ActiveCfg = Debug|Win32 + {6AA19589-2452-4141-A461-6954F37483DB}.Debug|x86.Build.0 = Debug|Win32 + {6AA19589-2452-4141-A461-6954F37483DB}.Release|Any CPU.ActiveCfg = Release|x64 + {6AA19589-2452-4141-A461-6954F37483DB}.Release|Any CPU.Build.0 = Release|x64 + {6AA19589-2452-4141-A461-6954F37483DB}.Release|x64.ActiveCfg = Release|x64 + {6AA19589-2452-4141-A461-6954F37483DB}.Release|x64.Build.0 = Release|x64 + {6AA19589-2452-4141-A461-6954F37483DB}.Release|x86.ActiveCfg = Release|Win32 + {6AA19589-2452-4141-A461-6954F37483DB}.Release|x86.Build.0 = Release|Win32 + {7FC4B158-7224-4B90-990D-925D8CE6542E}.Debug|Any CPU.ActiveCfg = Debug|x64 + {7FC4B158-7224-4B90-990D-925D8CE6542E}.Debug|Any CPU.Build.0 = Debug|x64 + {7FC4B158-7224-4B90-990D-925D8CE6542E}.Debug|x64.ActiveCfg = Debug|x64 + {7FC4B158-7224-4B90-990D-925D8CE6542E}.Debug|x64.Build.0 = Debug|x64 + {7FC4B158-7224-4B90-990D-925D8CE6542E}.Debug|x86.ActiveCfg = Debug|Win32 + {7FC4B158-7224-4B90-990D-925D8CE6542E}.Debug|x86.Build.0 = Debug|Win32 + {7FC4B158-7224-4B90-990D-925D8CE6542E}.Release|Any CPU.ActiveCfg = Release|x64 + {7FC4B158-7224-4B90-990D-925D8CE6542E}.Release|Any CPU.Build.0 = Release|x64 + {7FC4B158-7224-4B90-990D-925D8CE6542E}.Release|x64.ActiveCfg = Release|x64 + {7FC4B158-7224-4B90-990D-925D8CE6542E}.Release|x64.Build.0 = Release|x64 + {7FC4B158-7224-4B90-990D-925D8CE6542E}.Release|x86.ActiveCfg = Release|Win32 + {7FC4B158-7224-4B90-990D-925D8CE6542E}.Release|x86.Build.0 = Release|Win32 + {980E764A-7931-4555-91F3-5860BF29B04F}.Debug|Any CPU.ActiveCfg = Debug|x64 + {980E764A-7931-4555-91F3-5860BF29B04F}.Debug|Any CPU.Build.0 = Debug|x64 + {980E764A-7931-4555-91F3-5860BF29B04F}.Debug|x64.ActiveCfg = Debug|x64 + {980E764A-7931-4555-91F3-5860BF29B04F}.Debug|x64.Build.0 = Debug|x64 + {980E764A-7931-4555-91F3-5860BF29B04F}.Debug|x86.ActiveCfg = Debug|Win32 + {980E764A-7931-4555-91F3-5860BF29B04F}.Debug|x86.Build.0 = Debug|Win32 + {980E764A-7931-4555-91F3-5860BF29B04F}.Release|Any CPU.ActiveCfg = Release|x64 + {980E764A-7931-4555-91F3-5860BF29B04F}.Release|Any CPU.Build.0 = Release|x64 + {980E764A-7931-4555-91F3-5860BF29B04F}.Release|x64.ActiveCfg = Release|x64 + {980E764A-7931-4555-91F3-5860BF29B04F}.Release|x64.Build.0 = Release|x64 + {980E764A-7931-4555-91F3-5860BF29B04F}.Release|x86.ActiveCfg = Release|Win32 + {980E764A-7931-4555-91F3-5860BF29B04F}.Release|x86.Build.0 = Release|Win32 + {DB728DB3-1D1E-4379-A7B5-2220E258E283}.Debug|Any CPU.ActiveCfg = Debug|x64 + {DB728DB3-1D1E-4379-A7B5-2220E258E283}.Debug|Any CPU.Build.0 = Debug|x64 + {DB728DB3-1D1E-4379-A7B5-2220E258E283}.Debug|x64.ActiveCfg = Debug|x64 + {DB728DB3-1D1E-4379-A7B5-2220E258E283}.Debug|x64.Build.0 = Debug|x64 + {DB728DB3-1D1E-4379-A7B5-2220E258E283}.Debug|x86.ActiveCfg = Debug|Win32 + {DB728DB3-1D1E-4379-A7B5-2220E258E283}.Debug|x86.Build.0 = Debug|Win32 + {DB728DB3-1D1E-4379-A7B5-2220E258E283}.Release|Any CPU.ActiveCfg = Release|x64 + {DB728DB3-1D1E-4379-A7B5-2220E258E283}.Release|Any CPU.Build.0 = Release|x64 + {DB728DB3-1D1E-4379-A7B5-2220E258E283}.Release|x64.ActiveCfg = Release|x64 + {DB728DB3-1D1E-4379-A7B5-2220E258E283}.Release|x64.Build.0 = Release|x64 + {DB728DB3-1D1E-4379-A7B5-2220E258E283}.Release|x86.ActiveCfg = Release|Win32 + {DB728DB3-1D1E-4379-A7B5-2220E258E283}.Release|x86.Build.0 = Release|Win32 + {7E0409E2-0AB1-486E-AF8A-0F606CFA930E}.Debug|Any CPU.ActiveCfg = Debug|x64 + {7E0409E2-0AB1-486E-AF8A-0F606CFA930E}.Debug|Any CPU.Build.0 = Debug|x64 + {7E0409E2-0AB1-486E-AF8A-0F606CFA930E}.Debug|x64.ActiveCfg = Debug|x64 + {7E0409E2-0AB1-486E-AF8A-0F606CFA930E}.Debug|x64.Build.0 = Debug|x64 + {7E0409E2-0AB1-486E-AF8A-0F606CFA930E}.Debug|x86.ActiveCfg = Debug|Win32 + {7E0409E2-0AB1-486E-AF8A-0F606CFA930E}.Debug|x86.Build.0 = Debug|Win32 + {7E0409E2-0AB1-486E-AF8A-0F606CFA930E}.Release|Any CPU.ActiveCfg = Release|x64 + {7E0409E2-0AB1-486E-AF8A-0F606CFA930E}.Release|Any CPU.Build.0 = Release|x64 + {7E0409E2-0AB1-486E-AF8A-0F606CFA930E}.Release|x64.ActiveCfg = Release|x64 + {7E0409E2-0AB1-486E-AF8A-0F606CFA930E}.Release|x64.Build.0 = Release|x64 + {7E0409E2-0AB1-486E-AF8A-0F606CFA930E}.Release|x86.ActiveCfg = Release|Win32 + {7E0409E2-0AB1-486E-AF8A-0F606CFA930E}.Release|x86.Build.0 = Release|Win32 + {9A9A1F9F-6474-4D67-A572-FDE38715F077}.Debug|Any CPU.ActiveCfg = Debug|x64 + {9A9A1F9F-6474-4D67-A572-FDE38715F077}.Debug|Any CPU.Build.0 = Debug|x64 + {9A9A1F9F-6474-4D67-A572-FDE38715F077}.Debug|x64.ActiveCfg = Debug|x64 + {9A9A1F9F-6474-4D67-A572-FDE38715F077}.Debug|x64.Build.0 = Debug|x64 + {9A9A1F9F-6474-4D67-A572-FDE38715F077}.Debug|x86.ActiveCfg = Debug|Win32 + {9A9A1F9F-6474-4D67-A572-FDE38715F077}.Debug|x86.Build.0 = Debug|Win32 + {9A9A1F9F-6474-4D67-A572-FDE38715F077}.Release|Any CPU.ActiveCfg = Release|x64 + {9A9A1F9F-6474-4D67-A572-FDE38715F077}.Release|Any CPU.Build.0 = Release|x64 + {9A9A1F9F-6474-4D67-A572-FDE38715F077}.Release|x64.ActiveCfg = Release|x64 + {9A9A1F9F-6474-4D67-A572-FDE38715F077}.Release|x64.Build.0 = Release|x64 + {9A9A1F9F-6474-4D67-A572-FDE38715F077}.Release|x86.ActiveCfg = Release|Win32 + {9A9A1F9F-6474-4D67-A572-FDE38715F077}.Release|x86.Build.0 = Release|Win32 + {59DC2360-FF30-4D5B-A8A0-AB5B482C5A58}.Debug|Any CPU.ActiveCfg = Debug|x64 + {59DC2360-FF30-4D5B-A8A0-AB5B482C5A58}.Debug|Any CPU.Build.0 = Debug|x64 + {59DC2360-FF30-4D5B-A8A0-AB5B482C5A58}.Debug|x64.ActiveCfg = Debug|x64 + {59DC2360-FF30-4D5B-A8A0-AB5B482C5A58}.Debug|x64.Build.0 = Debug|x64 + {59DC2360-FF30-4D5B-A8A0-AB5B482C5A58}.Debug|x86.ActiveCfg = Debug|Win32 + {59DC2360-FF30-4D5B-A8A0-AB5B482C5A58}.Debug|x86.Build.0 = Debug|Win32 + {59DC2360-FF30-4D5B-A8A0-AB5B482C5A58}.Release|Any CPU.ActiveCfg = Release|x64 + {59DC2360-FF30-4D5B-A8A0-AB5B482C5A58}.Release|Any CPU.Build.0 = Release|x64 + {59DC2360-FF30-4D5B-A8A0-AB5B482C5A58}.Release|x64.ActiveCfg = Release|x64 + {59DC2360-FF30-4D5B-A8A0-AB5B482C5A58}.Release|x64.Build.0 = Release|x64 + {59DC2360-FF30-4D5B-A8A0-AB5B482C5A58}.Release|x86.ActiveCfg = Release|Win32 + {59DC2360-FF30-4D5B-A8A0-AB5B482C5A58}.Release|x86.Build.0 = Release|Win32 + {480CE0E0-AC2E-49AE-AFD2-C99C9C562F68}.Debug|Any CPU.ActiveCfg = Debug|x64 + {480CE0E0-AC2E-49AE-AFD2-C99C9C562F68}.Debug|Any CPU.Build.0 = Debug|x64 + {480CE0E0-AC2E-49AE-AFD2-C99C9C562F68}.Debug|x64.ActiveCfg = Debug|x64 + {480CE0E0-AC2E-49AE-AFD2-C99C9C562F68}.Debug|x64.Build.0 = Debug|x64 + {480CE0E0-AC2E-49AE-AFD2-C99C9C562F68}.Debug|x86.ActiveCfg = Debug|Win32 + {480CE0E0-AC2E-49AE-AFD2-C99C9C562F68}.Debug|x86.Build.0 = Debug|Win32 + {480CE0E0-AC2E-49AE-AFD2-C99C9C562F68}.Release|Any CPU.ActiveCfg = Release|x64 + {480CE0E0-AC2E-49AE-AFD2-C99C9C562F68}.Release|Any CPU.Build.0 = Release|x64 + {480CE0E0-AC2E-49AE-AFD2-C99C9C562F68}.Release|x64.ActiveCfg = Release|x64 + {480CE0E0-AC2E-49AE-AFD2-C99C9C562F68}.Release|x64.Build.0 = Release|x64 + {480CE0E0-AC2E-49AE-AFD2-C99C9C562F68}.Release|x86.ActiveCfg = Release|Win32 + {480CE0E0-AC2E-49AE-AFD2-C99C9C562F68}.Release|x86.Build.0 = Release|Win32 + {DB9643CC-9800-4858-A565-B04534E74F6C}.Debug|Any CPU.ActiveCfg = Debug|x64 + {DB9643CC-9800-4858-A565-B04534E74F6C}.Debug|Any CPU.Build.0 = Debug|x64 + {DB9643CC-9800-4858-A565-B04534E74F6C}.Debug|x64.ActiveCfg = Debug|x64 + {DB9643CC-9800-4858-A565-B04534E74F6C}.Debug|x64.Build.0 = Debug|x64 + {DB9643CC-9800-4858-A565-B04534E74F6C}.Debug|x86.ActiveCfg = Debug|Win32 + {DB9643CC-9800-4858-A565-B04534E74F6C}.Debug|x86.Build.0 = Debug|Win32 + {DB9643CC-9800-4858-A565-B04534E74F6C}.Release|Any CPU.ActiveCfg = Release|x64 + {DB9643CC-9800-4858-A565-B04534E74F6C}.Release|Any CPU.Build.0 = Release|x64 + {DB9643CC-9800-4858-A565-B04534E74F6C}.Release|x64.ActiveCfg = Release|x64 + {DB9643CC-9800-4858-A565-B04534E74F6C}.Release|x64.Build.0 = Release|x64 + {DB9643CC-9800-4858-A565-B04534E74F6C}.Release|x86.ActiveCfg = Release|Win32 + {DB9643CC-9800-4858-A565-B04534E74F6C}.Release|x86.Build.0 = Release|Win32 + {822B24FD-2BA2-46D4-B91B-ABC3BB416D0A}.Debug|Any CPU.ActiveCfg = Debug|x64 + {822B24FD-2BA2-46D4-B91B-ABC3BB416D0A}.Debug|Any CPU.Build.0 = Debug|x64 + {822B24FD-2BA2-46D4-B91B-ABC3BB416D0A}.Debug|x64.ActiveCfg = Debug|x64 + {822B24FD-2BA2-46D4-B91B-ABC3BB416D0A}.Debug|x64.Build.0 = Debug|x64 + {822B24FD-2BA2-46D4-B91B-ABC3BB416D0A}.Debug|x86.ActiveCfg = Debug|Win32 + {822B24FD-2BA2-46D4-B91B-ABC3BB416D0A}.Debug|x86.Build.0 = Debug|Win32 + {822B24FD-2BA2-46D4-B91B-ABC3BB416D0A}.Release|Any CPU.ActiveCfg = Release|x64 + {822B24FD-2BA2-46D4-B91B-ABC3BB416D0A}.Release|Any CPU.Build.0 = Release|x64 + {822B24FD-2BA2-46D4-B91B-ABC3BB416D0A}.Release|x64.ActiveCfg = Release|x64 + {822B24FD-2BA2-46D4-B91B-ABC3BB416D0A}.Release|x64.Build.0 = Release|x64 + {822B24FD-2BA2-46D4-B91B-ABC3BB416D0A}.Release|x86.ActiveCfg = Release|Win32 + {822B24FD-2BA2-46D4-B91B-ABC3BB416D0A}.Release|x86.Build.0 = Release|Win32 + {96F75D5A-9C0D-4E46-9F70-079AB3210006}.Debug|Any CPU.ActiveCfg = Debug|x64 + {96F75D5A-9C0D-4E46-9F70-079AB3210006}.Debug|Any CPU.Build.0 = Debug|x64 + {96F75D5A-9C0D-4E46-9F70-079AB3210006}.Debug|x64.ActiveCfg = Debug|x64 + {96F75D5A-9C0D-4E46-9F70-079AB3210006}.Debug|x64.Build.0 = Debug|x64 + {96F75D5A-9C0D-4E46-9F70-079AB3210006}.Debug|x86.ActiveCfg = Debug|Win32 + {96F75D5A-9C0D-4E46-9F70-079AB3210006}.Debug|x86.Build.0 = Debug|Win32 + {96F75D5A-9C0D-4E46-9F70-079AB3210006}.Release|Any CPU.ActiveCfg = Release|x64 + {96F75D5A-9C0D-4E46-9F70-079AB3210006}.Release|Any CPU.Build.0 = Release|x64 + {96F75D5A-9C0D-4E46-9F70-079AB3210006}.Release|x64.ActiveCfg = Release|x64 + {96F75D5A-9C0D-4E46-9F70-079AB3210006}.Release|x64.Build.0 = Release|x64 + {96F75D5A-9C0D-4E46-9F70-079AB3210006}.Release|x86.ActiveCfg = Release|Win32 + {96F75D5A-9C0D-4E46-9F70-079AB3210006}.Release|x86.Build.0 = Release|Win32 + {09A1F5EB-7CC6-48A2-B7A8-5C39B1792E64}.Debug|Any CPU.ActiveCfg = Debug|x64 + {09A1F5EB-7CC6-48A2-B7A8-5C39B1792E64}.Debug|Any CPU.Build.0 = Debug|x64 + {09A1F5EB-7CC6-48A2-B7A8-5C39B1792E64}.Debug|x64.ActiveCfg = Debug|x64 + {09A1F5EB-7CC6-48A2-B7A8-5C39B1792E64}.Debug|x64.Build.0 = Debug|x64 + {09A1F5EB-7CC6-48A2-B7A8-5C39B1792E64}.Debug|x86.ActiveCfg = Debug|Win32 + {09A1F5EB-7CC6-48A2-B7A8-5C39B1792E64}.Debug|x86.Build.0 = Debug|Win32 + {09A1F5EB-7CC6-48A2-B7A8-5C39B1792E64}.Release|Any CPU.ActiveCfg = Release|x64 + {09A1F5EB-7CC6-48A2-B7A8-5C39B1792E64}.Release|Any CPU.Build.0 = Release|x64 + {09A1F5EB-7CC6-48A2-B7A8-5C39B1792E64}.Release|x64.ActiveCfg = Release|x64 + {09A1F5EB-7CC6-48A2-B7A8-5C39B1792E64}.Release|x64.Build.0 = Release|x64 + {09A1F5EB-7CC6-48A2-B7A8-5C39B1792E64}.Release|x86.ActiveCfg = Release|Win32 + {09A1F5EB-7CC6-48A2-B7A8-5C39B1792E64}.Release|x86.Build.0 = Release|Win32 + {EDC0F2B3-544B-4B2F-B13D-59D0E3466C40}.Debug|Any CPU.ActiveCfg = Debug|x64 + {EDC0F2B3-544B-4B2F-B13D-59D0E3466C40}.Debug|Any CPU.Build.0 = Debug|x64 + {EDC0F2B3-544B-4B2F-B13D-59D0E3466C40}.Debug|x64.ActiveCfg = Debug|x64 + {EDC0F2B3-544B-4B2F-B13D-59D0E3466C40}.Debug|x64.Build.0 = Debug|x64 + {EDC0F2B3-544B-4B2F-B13D-59D0E3466C40}.Debug|x86.ActiveCfg = Debug|Win32 + {EDC0F2B3-544B-4B2F-B13D-59D0E3466C40}.Debug|x86.Build.0 = Debug|Win32 + {EDC0F2B3-544B-4B2F-B13D-59D0E3466C40}.Release|Any CPU.ActiveCfg = Release|x64 + {EDC0F2B3-544B-4B2F-B13D-59D0E3466C40}.Release|Any CPU.Build.0 = Release|x64 + {EDC0F2B3-544B-4B2F-B13D-59D0E3466C40}.Release|x64.ActiveCfg = Release|x64 + {EDC0F2B3-544B-4B2F-B13D-59D0E3466C40}.Release|x64.Build.0 = Release|x64 + {EDC0F2B3-544B-4B2F-B13D-59D0E3466C40}.Release|x86.ActiveCfg = Release|Win32 + {EDC0F2B3-544B-4B2F-B13D-59D0E3466C40}.Release|x86.Build.0 = Release|Win32 + {CFB4CDF8-4CFE-44F1-8F2A-A2EA478DA690}.Debug|Any CPU.ActiveCfg = Debug|x64 + {CFB4CDF8-4CFE-44F1-8F2A-A2EA478DA690}.Debug|Any CPU.Build.0 = Debug|x64 + {CFB4CDF8-4CFE-44F1-8F2A-A2EA478DA690}.Debug|x64.ActiveCfg = Debug|x64 + {CFB4CDF8-4CFE-44F1-8F2A-A2EA478DA690}.Debug|x64.Build.0 = Debug|x64 + {CFB4CDF8-4CFE-44F1-8F2A-A2EA478DA690}.Debug|x86.ActiveCfg = Debug|Win32 + {CFB4CDF8-4CFE-44F1-8F2A-A2EA478DA690}.Debug|x86.Build.0 = Debug|Win32 + {CFB4CDF8-4CFE-44F1-8F2A-A2EA478DA690}.Release|Any CPU.ActiveCfg = Release|x64 + {CFB4CDF8-4CFE-44F1-8F2A-A2EA478DA690}.Release|Any CPU.Build.0 = Release|x64 + {CFB4CDF8-4CFE-44F1-8F2A-A2EA478DA690}.Release|x64.ActiveCfg = Release|x64 + {CFB4CDF8-4CFE-44F1-8F2A-A2EA478DA690}.Release|x64.Build.0 = Release|x64 + {CFB4CDF8-4CFE-44F1-8F2A-A2EA478DA690}.Release|x86.ActiveCfg = Release|Win32 + {CFB4CDF8-4CFE-44F1-8F2A-A2EA478DA690}.Release|x86.Build.0 = Release|Win32 + {A72D3028-146E-425C-8AC8-6079523140FF}.Debug|Any CPU.ActiveCfg = Debug|x64 + {A72D3028-146E-425C-8AC8-6079523140FF}.Debug|Any CPU.Build.0 = Debug|x64 + {A72D3028-146E-425C-8AC8-6079523140FF}.Debug|x64.ActiveCfg = Debug|x64 + {A72D3028-146E-425C-8AC8-6079523140FF}.Debug|x64.Build.0 = Debug|x64 + {A72D3028-146E-425C-8AC8-6079523140FF}.Debug|x86.ActiveCfg = Debug|Win32 + {A72D3028-146E-425C-8AC8-6079523140FF}.Debug|x86.Build.0 = Debug|Win32 + {A72D3028-146E-425C-8AC8-6079523140FF}.Release|Any CPU.ActiveCfg = Release|x64 + {A72D3028-146E-425C-8AC8-6079523140FF}.Release|Any CPU.Build.0 = Release|x64 + {A72D3028-146E-425C-8AC8-6079523140FF}.Release|x64.ActiveCfg = Release|x64 + {A72D3028-146E-425C-8AC8-6079523140FF}.Release|x64.Build.0 = Release|x64 + {A72D3028-146E-425C-8AC8-6079523140FF}.Release|x86.ActiveCfg = Release|Win32 + {A72D3028-146E-425C-8AC8-6079523140FF}.Release|x86.Build.0 = Release|Win32 + {D540A73E-4165-490B-B006-E707FF345F58}.Debug|Any CPU.ActiveCfg = Debug|x64 + {D540A73E-4165-490B-B006-E707FF345F58}.Debug|Any CPU.Build.0 = Debug|x64 + {D540A73E-4165-490B-B006-E707FF345F58}.Debug|x64.ActiveCfg = Debug|x64 + {D540A73E-4165-490B-B006-E707FF345F58}.Debug|x64.Build.0 = Debug|x64 + {D540A73E-4165-490B-B006-E707FF345F58}.Debug|x86.ActiveCfg = Debug|Win32 + {D540A73E-4165-490B-B006-E707FF345F58}.Debug|x86.Build.0 = Debug|Win32 + {D540A73E-4165-490B-B006-E707FF345F58}.Release|Any CPU.ActiveCfg = Release|x64 + {D540A73E-4165-490B-B006-E707FF345F58}.Release|Any CPU.Build.0 = Release|x64 + {D540A73E-4165-490B-B006-E707FF345F58}.Release|x64.ActiveCfg = Release|x64 + {D540A73E-4165-490B-B006-E707FF345F58}.Release|x64.Build.0 = Release|x64 + {D540A73E-4165-490B-B006-E707FF345F58}.Release|x86.ActiveCfg = Release|Win32 + {D540A73E-4165-490B-B006-E707FF345F58}.Release|x86.Build.0 = Release|Win32 + {6E5678DD-2714-43CF-AB84-B33B3C662F08}.Debug|Any CPU.ActiveCfg = Debug|x64 + {6E5678DD-2714-43CF-AB84-B33B3C662F08}.Debug|Any CPU.Build.0 = Debug|x64 + {6E5678DD-2714-43CF-AB84-B33B3C662F08}.Debug|x64.ActiveCfg = Debug|x64 + {6E5678DD-2714-43CF-AB84-B33B3C662F08}.Debug|x64.Build.0 = Debug|x64 + {6E5678DD-2714-43CF-AB84-B33B3C662F08}.Debug|x86.ActiveCfg = Debug|Win32 + {6E5678DD-2714-43CF-AB84-B33B3C662F08}.Debug|x86.Build.0 = Debug|Win32 + {6E5678DD-2714-43CF-AB84-B33B3C662F08}.Release|Any CPU.ActiveCfg = Release|x64 + {6E5678DD-2714-43CF-AB84-B33B3C662F08}.Release|Any CPU.Build.0 = Release|x64 + {6E5678DD-2714-43CF-AB84-B33B3C662F08}.Release|x64.ActiveCfg = Release|x64 + {6E5678DD-2714-43CF-AB84-B33B3C662F08}.Release|x64.Build.0 = Release|x64 + {6E5678DD-2714-43CF-AB84-B33B3C662F08}.Release|x86.ActiveCfg = Release|Win32 + {6E5678DD-2714-43CF-AB84-B33B3C662F08}.Release|x86.Build.0 = Release|Win32 + {AF5964AC-CFE8-4653-BEA1-3A1CB60F8862}.Debug|Any CPU.ActiveCfg = Debug|x64 + {AF5964AC-CFE8-4653-BEA1-3A1CB60F8862}.Debug|Any CPU.Build.0 = Debug|x64 + {AF5964AC-CFE8-4653-BEA1-3A1CB60F8862}.Debug|x64.ActiveCfg = Debug|x64 + {AF5964AC-CFE8-4653-BEA1-3A1CB60F8862}.Debug|x64.Build.0 = Debug|x64 + {AF5964AC-CFE8-4653-BEA1-3A1CB60F8862}.Debug|x86.ActiveCfg = Debug|Win32 + {AF5964AC-CFE8-4653-BEA1-3A1CB60F8862}.Debug|x86.Build.0 = Debug|Win32 + {AF5964AC-CFE8-4653-BEA1-3A1CB60F8862}.Release|Any CPU.ActiveCfg = Release|x64 + {AF5964AC-CFE8-4653-BEA1-3A1CB60F8862}.Release|Any CPU.Build.0 = Release|x64 + {AF5964AC-CFE8-4653-BEA1-3A1CB60F8862}.Release|x64.ActiveCfg = Release|x64 + {AF5964AC-CFE8-4653-BEA1-3A1CB60F8862}.Release|x64.Build.0 = Release|x64 + {AF5964AC-CFE8-4653-BEA1-3A1CB60F8862}.Release|x86.ActiveCfg = Release|Win32 + {AF5964AC-CFE8-4653-BEA1-3A1CB60F8862}.Release|x86.Build.0 = Release|Win32 + {9C7FB4FA-AAD2-47C5-8FBE-ACED4D6282A1}.Debug|Any CPU.ActiveCfg = Debug|x64 + {9C7FB4FA-AAD2-47C5-8FBE-ACED4D6282A1}.Debug|Any CPU.Build.0 = Debug|x64 + {9C7FB4FA-AAD2-47C5-8FBE-ACED4D6282A1}.Debug|x64.ActiveCfg = Debug|x64 + {9C7FB4FA-AAD2-47C5-8FBE-ACED4D6282A1}.Debug|x64.Build.0 = Debug|x64 + {9C7FB4FA-AAD2-47C5-8FBE-ACED4D6282A1}.Debug|x86.ActiveCfg = Debug|Win32 + {9C7FB4FA-AAD2-47C5-8FBE-ACED4D6282A1}.Debug|x86.Build.0 = Debug|Win32 + {9C7FB4FA-AAD2-47C5-8FBE-ACED4D6282A1}.Release|Any CPU.ActiveCfg = Release|x64 + {9C7FB4FA-AAD2-47C5-8FBE-ACED4D6282A1}.Release|Any CPU.Build.0 = Release|x64 + {9C7FB4FA-AAD2-47C5-8FBE-ACED4D6282A1}.Release|x64.ActiveCfg = Release|x64 + {9C7FB4FA-AAD2-47C5-8FBE-ACED4D6282A1}.Release|x64.Build.0 = Release|x64 + {9C7FB4FA-AAD2-47C5-8FBE-ACED4D6282A1}.Release|x86.ActiveCfg = Release|Win32 + {9C7FB4FA-AAD2-47C5-8FBE-ACED4D6282A1}.Release|x86.Build.0 = Release|Win32 + {067DDCF4-328D-4F0B-8B76-6EA2349AC9DC}.Debug|Any CPU.ActiveCfg = Debug|x64 + {067DDCF4-328D-4F0B-8B76-6EA2349AC9DC}.Debug|Any CPU.Build.0 = Debug|x64 + {067DDCF4-328D-4F0B-8B76-6EA2349AC9DC}.Debug|x64.ActiveCfg = Debug|x64 + {067DDCF4-328D-4F0B-8B76-6EA2349AC9DC}.Debug|x64.Build.0 = Debug|x64 + {067DDCF4-328D-4F0B-8B76-6EA2349AC9DC}.Debug|x86.ActiveCfg = Debug|Win32 + {067DDCF4-328D-4F0B-8B76-6EA2349AC9DC}.Debug|x86.Build.0 = Debug|Win32 + {067DDCF4-328D-4F0B-8B76-6EA2349AC9DC}.Release|Any CPU.ActiveCfg = Release|x64 + {067DDCF4-328D-4F0B-8B76-6EA2349AC9DC}.Release|Any CPU.Build.0 = Release|x64 + {067DDCF4-328D-4F0B-8B76-6EA2349AC9DC}.Release|x64.ActiveCfg = Release|x64 + {067DDCF4-328D-4F0B-8B76-6EA2349AC9DC}.Release|x64.Build.0 = Release|x64 + {067DDCF4-328D-4F0B-8B76-6EA2349AC9DC}.Release|x86.ActiveCfg = Release|Win32 + {067DDCF4-328D-4F0B-8B76-6EA2349AC9DC}.Release|x86.Build.0 = Release|Win32 + {7DDD25C3-52FF-4CDD-B540-410891E39287}.Debug|Any CPU.ActiveCfg = Debug|x64 + {7DDD25C3-52FF-4CDD-B540-410891E39287}.Debug|Any CPU.Build.0 = Debug|x64 + {7DDD25C3-52FF-4CDD-B540-410891E39287}.Debug|x64.ActiveCfg = Debug|x64 + {7DDD25C3-52FF-4CDD-B540-410891E39287}.Debug|x64.Build.0 = Debug|x64 + {7DDD25C3-52FF-4CDD-B540-410891E39287}.Debug|x86.ActiveCfg = Debug|Win32 + {7DDD25C3-52FF-4CDD-B540-410891E39287}.Debug|x86.Build.0 = Debug|Win32 + {7DDD25C3-52FF-4CDD-B540-410891E39287}.Release|Any CPU.ActiveCfg = Release|x64 + {7DDD25C3-52FF-4CDD-B540-410891E39287}.Release|Any CPU.Build.0 = Release|x64 + {7DDD25C3-52FF-4CDD-B540-410891E39287}.Release|x64.ActiveCfg = Release|x64 + {7DDD25C3-52FF-4CDD-B540-410891E39287}.Release|x64.Build.0 = Release|x64 + {7DDD25C3-52FF-4CDD-B540-410891E39287}.Release|x86.ActiveCfg = Release|Win32 + {7DDD25C3-52FF-4CDD-B540-410891E39287}.Release|x86.Build.0 = Release|Win32 + {A821A3D2-25ED-4783-93D0-9E8CF3B9A026}.Debug|Any CPU.ActiveCfg = Debug|x64 + {A821A3D2-25ED-4783-93D0-9E8CF3B9A026}.Debug|Any CPU.Build.0 = Debug|x64 + {A821A3D2-25ED-4783-93D0-9E8CF3B9A026}.Debug|x64.ActiveCfg = Debug|x64 + {A821A3D2-25ED-4783-93D0-9E8CF3B9A026}.Debug|x64.Build.0 = Debug|x64 + {A821A3D2-25ED-4783-93D0-9E8CF3B9A026}.Debug|x86.ActiveCfg = Debug|Win32 + {A821A3D2-25ED-4783-93D0-9E8CF3B9A026}.Debug|x86.Build.0 = Debug|Win32 + {A821A3D2-25ED-4783-93D0-9E8CF3B9A026}.Release|Any CPU.ActiveCfg = Release|x64 + {A821A3D2-25ED-4783-93D0-9E8CF3B9A026}.Release|Any CPU.Build.0 = Release|x64 + {A821A3D2-25ED-4783-93D0-9E8CF3B9A026}.Release|x64.ActiveCfg = Release|x64 + {A821A3D2-25ED-4783-93D0-9E8CF3B9A026}.Release|x64.Build.0 = Release|x64 + {A821A3D2-25ED-4783-93D0-9E8CF3B9A026}.Release|x86.ActiveCfg = Release|Win32 + {A821A3D2-25ED-4783-93D0-9E8CF3B9A026}.Release|x86.Build.0 = Release|Win32 + {A93BE0ED-4F81-420D-A0C8-A636511A3CB3}.Debug|Any CPU.ActiveCfg = Debug|x64 + {A93BE0ED-4F81-420D-A0C8-A636511A3CB3}.Debug|Any CPU.Build.0 = Debug|x64 + {A93BE0ED-4F81-420D-A0C8-A636511A3CB3}.Debug|x64.ActiveCfg = Debug|x64 + {A93BE0ED-4F81-420D-A0C8-A636511A3CB3}.Debug|x64.Build.0 = Debug|x64 + {A93BE0ED-4F81-420D-A0C8-A636511A3CB3}.Debug|x86.ActiveCfg = Debug|Win32 + {A93BE0ED-4F81-420D-A0C8-A636511A3CB3}.Debug|x86.Build.0 = Debug|Win32 + {A93BE0ED-4F81-420D-A0C8-A636511A3CB3}.Release|Any CPU.ActiveCfg = Release|x64 + {A93BE0ED-4F81-420D-A0C8-A636511A3CB3}.Release|Any CPU.Build.0 = Release|x64 + {A93BE0ED-4F81-420D-A0C8-A636511A3CB3}.Release|x64.ActiveCfg = Release|x64 + {A93BE0ED-4F81-420D-A0C8-A636511A3CB3}.Release|x64.Build.0 = Release|x64 + {A93BE0ED-4F81-420D-A0C8-A636511A3CB3}.Release|x86.ActiveCfg = Release|Win32 + {A93BE0ED-4F81-420D-A0C8-A636511A3CB3}.Release|x86.Build.0 = Release|Win32 + {139EFCBA-AD7D-4948-9AFF-904660B7C18E}.Debug|Any CPU.ActiveCfg = Debug|x64 + {139EFCBA-AD7D-4948-9AFF-904660B7C18E}.Debug|Any CPU.Build.0 = Debug|x64 + {139EFCBA-AD7D-4948-9AFF-904660B7C18E}.Debug|x64.ActiveCfg = Debug|x64 + {139EFCBA-AD7D-4948-9AFF-904660B7C18E}.Debug|x64.Build.0 = Debug|x64 + {139EFCBA-AD7D-4948-9AFF-904660B7C18E}.Debug|x86.ActiveCfg = Debug|Win32 + {139EFCBA-AD7D-4948-9AFF-904660B7C18E}.Debug|x86.Build.0 = Debug|Win32 + {139EFCBA-AD7D-4948-9AFF-904660B7C18E}.Release|Any CPU.ActiveCfg = Release|x64 + {139EFCBA-AD7D-4948-9AFF-904660B7C18E}.Release|Any CPU.Build.0 = Release|x64 + {139EFCBA-AD7D-4948-9AFF-904660B7C18E}.Release|x64.ActiveCfg = Release|x64 + {139EFCBA-AD7D-4948-9AFF-904660B7C18E}.Release|x64.Build.0 = Release|x64 + {139EFCBA-AD7D-4948-9AFF-904660B7C18E}.Release|x86.ActiveCfg = Release|Win32 + {139EFCBA-AD7D-4948-9AFF-904660B7C18E}.Release|x86.Build.0 = Release|Win32 + {7E239B39-C625-476B-AAD4-1AF862D6DA65}.Debug|Any CPU.ActiveCfg = Debug|x64 + {7E239B39-C625-476B-AAD4-1AF862D6DA65}.Debug|Any CPU.Build.0 = Debug|x64 + {7E239B39-C625-476B-AAD4-1AF862D6DA65}.Debug|x64.ActiveCfg = Debug|x64 + {7E239B39-C625-476B-AAD4-1AF862D6DA65}.Debug|x64.Build.0 = Debug|x64 + {7E239B39-C625-476B-AAD4-1AF862D6DA65}.Debug|x86.ActiveCfg = Debug|Win32 + {7E239B39-C625-476B-AAD4-1AF862D6DA65}.Debug|x86.Build.0 = Debug|Win32 + {7E239B39-C625-476B-AAD4-1AF862D6DA65}.Release|Any CPU.ActiveCfg = Release|x64 + {7E239B39-C625-476B-AAD4-1AF862D6DA65}.Release|Any CPU.Build.0 = Release|x64 + {7E239B39-C625-476B-AAD4-1AF862D6DA65}.Release|x64.ActiveCfg = Release|x64 + {7E239B39-C625-476B-AAD4-1AF862D6DA65}.Release|x64.Build.0 = Release|x64 + {7E239B39-C625-476B-AAD4-1AF862D6DA65}.Release|x86.ActiveCfg = Release|Win32 + {7E239B39-C625-476B-AAD4-1AF862D6DA65}.Release|x86.Build.0 = Release|Win32 + {DA23DBC1-00C8-4871-A37B-146BDEB024C7}.Debug|Any CPU.ActiveCfg = Debug|x64 + {DA23DBC1-00C8-4871-A37B-146BDEB024C7}.Debug|Any CPU.Build.0 = Debug|x64 + {DA23DBC1-00C8-4871-A37B-146BDEB024C7}.Debug|x64.ActiveCfg = Debug|x64 + {DA23DBC1-00C8-4871-A37B-146BDEB024C7}.Debug|x64.Build.0 = Debug|x64 + {DA23DBC1-00C8-4871-A37B-146BDEB024C7}.Debug|x86.ActiveCfg = Debug|Win32 + {DA23DBC1-00C8-4871-A37B-146BDEB024C7}.Debug|x86.Build.0 = Debug|Win32 + {DA23DBC1-00C8-4871-A37B-146BDEB024C7}.Release|Any CPU.ActiveCfg = Release|x64 + {DA23DBC1-00C8-4871-A37B-146BDEB024C7}.Release|Any CPU.Build.0 = Release|x64 + {DA23DBC1-00C8-4871-A37B-146BDEB024C7}.Release|x64.ActiveCfg = Release|x64 + {DA23DBC1-00C8-4871-A37B-146BDEB024C7}.Release|x64.Build.0 = Release|x64 + {DA23DBC1-00C8-4871-A37B-146BDEB024C7}.Release|x86.ActiveCfg = Release|Win32 + {DA23DBC1-00C8-4871-A37B-146BDEB024C7}.Release|x86.Build.0 = Release|Win32 + {A009FB7B-2EEE-4281-8F12-00806D12F894}.Debug|Any CPU.ActiveCfg = Debug|x64 + {A009FB7B-2EEE-4281-8F12-00806D12F894}.Debug|Any CPU.Build.0 = Debug|x64 + {A009FB7B-2EEE-4281-8F12-00806D12F894}.Debug|x64.ActiveCfg = Debug|x64 + {A009FB7B-2EEE-4281-8F12-00806D12F894}.Debug|x64.Build.0 = Debug|x64 + {A009FB7B-2EEE-4281-8F12-00806D12F894}.Debug|x86.ActiveCfg = Debug|Win32 + {A009FB7B-2EEE-4281-8F12-00806D12F894}.Debug|x86.Build.0 = Debug|Win32 + {A009FB7B-2EEE-4281-8F12-00806D12F894}.Release|Any CPU.ActiveCfg = Release|x64 + {A009FB7B-2EEE-4281-8F12-00806D12F894}.Release|Any CPU.Build.0 = Release|x64 + {A009FB7B-2EEE-4281-8F12-00806D12F894}.Release|x64.ActiveCfg = Release|x64 + {A009FB7B-2EEE-4281-8F12-00806D12F894}.Release|x64.Build.0 = Release|x64 + {A009FB7B-2EEE-4281-8F12-00806D12F894}.Release|x86.ActiveCfg = Release|Win32 + {A009FB7B-2EEE-4281-8F12-00806D12F894}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {C95EABB5-1B48-4A6D-96BC-E571A7984FE8} + EndGlobalSection +EndGlobal + +``` + +`isRecordedByInjectedDll/isRecordedByInjectedDll.cpp`: + +```cpp +#include +#include +#include +#include +#include +#include + +using namespace std; + +int IsModuleLoaded(DWORD processID, string moduleName) +{ + HMODULE hMods[1024]; + HANDLE hProcess; + DWORD cbNeeded; + + // Get a handle to the process. + hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | + PROCESS_VM_READ, + FALSE, processID); + if (NULL == hProcess) + return -1; + + // Get a list of all the modules in this process. + if (EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded)) + { + for (unsigned int i = 0; i < (cbNeeded / sizeof(HMODULE)); i++) + { + TCHAR szModName[MAX_PATH]; + + // Get the base name of the module. + if (GetModuleBaseName(hProcess, hMods[i], szModName, + sizeof(szModName) / sizeof(TCHAR))) + { + char nameAsChars[1024]; + size_t nNumCharConverted; + wcstombs_s(&nNumCharConverted, nameAsChars, 1024, szModName, 1024); + + if (strcmp(nameAsChars, moduleName.c_str()) == 0) + return 1; + } + } + } + + // Release the handle to the process. + CloseHandle(hProcess); + return 0; +} + +int main(void) +{ + int res = IsModuleLoaded(GetCurrentProcessId(), "TTDRecordCPU.dll"); + if (res == 1) + cout << "ttd found!" << endl; + else if (res == 0) + cout << "ttd not found." << endl; + else + cout << "unexpected error." << endl; + + system("pause"); + return 0; +} +``` + +`isRecordedByInjectedDll/isRecordedByInjectedDll.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {cfb4cdf8-4cfe-44f1-8f2a-a2ea478da690} + isRecordedByInjectedDll + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`isRecordedByInjectedDll/isRecordedByInjectedDll.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` + +`zzzStringConversions/zzzStringConversions.cpp`: + +```cpp +// zzzStringConversions.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include +#include +#include + +// const char* to LPCWSTR +wchar_t* convertCharArrayToLPCWSTR(const char* charArray) +{ + wchar_t* wString = new wchar_t[4096]; + MultiByteToWideChar(CP_ACP, 0, charArray, -1, wString, 4096); + return wString; +} + +LPWSTR converConstCharPointerToLpwstr(const char* str) +{ + wchar_t wtext[4096]; + size_t size = 4097; + mbstowcs_s(&size, wtext, str, strlen(str) + 1);//Plus null + LPWSTR ptr = wtext; + return ptr; +} + + +int main() +{ + std::cout << "Hello World!\n"; +} + +// Run program: Ctrl + F5 or Debug > Start Without Debugging menu +// Debug program: F5 or Debug > Start Debugging menu + +// Tips for Getting Started: +// 1. Use the Solution Explorer window to add/manage files +// 2. Use the Team Explorer window to connect to source control +// 3. Use the Output window to see build output and other messages +// 4. Use the Error List window to view errors +// 5. Go to Project > Add New Item to create new code files, or Project > Add Existing Item to add existing code files to the project +// 6. In the future, to open this project again, go to File > Open > Project and select the .sln file + +``` + +`zzzStringConversions/zzzStringConversions.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 16.0 + Win32Proj + {6e5678dd-2714-43cf-ab84-b33b3c662f08} + zzzStringConversions + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + true + + + false + + + true + + + false + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + +``` + +`zzzStringConversions/zzzStringConversions.vcxproj.filters`: + +```filters + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + +``` \ No newline at end of file diff --git a/archive/nkga/cheat-driver.txt b/archive/nkga/cheat-driver.txt new file mode 100644 index 00000000..91f5cad7 --- /dev/null +++ b/archive/nkga/cheat-driver.txt @@ -0,0 +1,565 @@ +Project Path: arc_nkga_cheat-driver_tcye1wo3 + +Source Tree: + +```txt +arc_nkga_cheat-driver_tcye1wo3 +├── LICENSE.txt +├── README.MD +├── cheat-driver.sln +└── src + ├── driver.c + ├── driver.vcxproj + ├── driver.vcxproj.filters + ├── driver_codes.h + └── driver_config.h + +``` + +`LICENSE.txt`: + +```txt +Copyright (c) 2016 nkga + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +``` + +`README.MD`: + +```MD +# cheat-driver + +Simple WDM kernel mode driver for handling read/write memory requests into +arbitrary processes. + +### Background + +Kernel based anti-cheat drivers (EAC, BattleEye) block or monitor requests for +interfacing with the memory from the game process. The simplest way to bypass anti-cheat protections from the kernel is to use your own kernel mode driver. + +### Building + +1. Install [Visual Studio](https://www.visualstudio.com/). +2. Install the [Windows Driver Kit](https://docs.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk). +3. Set the solution configuration to `x64` and `Release` and build the solution. + +### Usage + +For practical use you will need a driver signing certificate. For development +purposes you can enable [test-signing mode](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/the-testsigning-boot-configuration-option). + +You will need to either install and run the driver as a service with `CreateService` or use a function like `NtLoadDriver`. +Once the driver is loaded, you can open a handle to the driver: + +```cpp +#include "driver_config.h" +#include "driver_codes.h" + +HANDLE driver = CreateFileW( + DRIVER_DEVICE_PATH, + GENERIC_READ | GENERIC_WRITE, + FILE_SHARE_READ | FILE_SHARE_WRITE, + 0, + OPEN_EXISTING, + 0, 0); +``` + +To issue read or write requests, you send the driver a control code: + +```cpp +DRIVER_COPY_MEMORY copy = {}; +copy.ProcessId = processId; +copy.Source = sourceBufferPtr; +copy.Target = targetAddressPtr; +copy.Size = bytesToRead; +copy.Write = FALSE; + +DeviceIoControl( + driver, + IOCTL_DRIVER_COPY_MEMORY, + ©, + sizeof(copy), + ©, + sizeof(copy), + 0, 0) +``` + +The target and source parameters should be reversed if issuing a write request. +``` + +`cheat-driver.sln`: + +```sln + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 15 +VisualStudioVersion = 15.0.27703.2000 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "driver", "src\driver.vcxproj", "{E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF}.Debug|x64.ActiveCfg = Debug|x64 + {E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF}.Debug|x64.Build.0 = Debug|x64 + {E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF}.Debug|x64.Deploy.0 = Debug|x64 + {E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF}.Release|x64.ActiveCfg = Release|x64 + {E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF}.Release|x64.Build.0 = Release|x64 + {E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF}.Release|x64.Deploy.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {569B6580-CAF4-4273-BFF7-EC37D6538BF5} + EndGlobalSection +EndGlobal + +``` + +`src/driver.c`: + +```c +#include +#include +#include "driver_codes.h" +#include "driver_config.h" + +// Copies virtual memory from one process to another. +NTKERNELAPI NTSTATUS NTAPI MmCopyVirtualMemory( + IN PEPROCESS FromProcess, + IN PVOID FromAddress, + IN PEPROCESS ToProcess, + OUT PVOID ToAddress, + IN SIZE_T BufferSize, + IN KPROCESSOR_MODE PreviousMode, + OUT PSIZE_T NumberOfBytesCopied +); + +// Forward declaration for suppressing code analysis warnings. +DRIVER_INITIALIZE DriverEntry; + +// Dispatch function. +_Dispatch_type_(IRP_MJ_CREATE) +_Dispatch_type_(IRP_MJ_CLOSE) +_Dispatch_type_(IRP_MJ_DEVICE_CONTROL) +DRIVER_DISPATCH DriverDispatch; + +// Performs a memory copy request. +NTSTATUS DriverCopy(IN PDRIVER_COPY_MEMORY copy) { + NTSTATUS status = STATUS_SUCCESS; + PEPROCESS process; + + status = PsLookupProcessByProcessId((HANDLE)copy->ProcessId, &process); + + if (NT_SUCCESS(status)) { + PEPROCESS sourceProcess, targetProcess; + PVOID sourcePtr, targetPtr; + + if (copy->Write == FALSE) { + sourceProcess = process; + targetProcess = PsGetCurrentProcess(); + sourcePtr = (PVOID)copy->Target; + targetPtr = (PVOID)copy->Source; + } else { + sourceProcess = PsGetCurrentProcess(); + targetProcess = process; + sourcePtr = (PVOID)copy->Source; + targetPtr = (PVOID)copy->Target; + } + + SIZE_T bytes; + status = MmCopyVirtualMemory(sourceProcess, sourcePtr, targetProcess, targetPtr, copy->Size, KernelMode, &bytes); + + ObDereferenceObject(process); + } + + return status; +} + +// Handles a IRP request. +NTSTATUS DriverDispatch(_In_ PDEVICE_OBJECT DeviceObject, _Inout_ PIRP Irp) { + UNREFERENCED_PARAMETER(DeviceObject); + + Irp->IoStatus.Status = STATUS_SUCCESS; + Irp->IoStatus.Information = 0; + + PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp); + PVOID ioBuffer = Irp->AssociatedIrp.SystemBuffer; + ULONG inputLength = irpStack->Parameters.DeviceIoControl.InputBufferLength; + + if (irpStack->MajorFunction == IRP_MJ_DEVICE_CONTROL) { + ULONG ioControlCode = irpStack->Parameters.DeviceIoControl.IoControlCode; + + if (ioControlCode == IOCTL_DRIVER_COPY_MEMORY) { + if (ioBuffer && inputLength >= sizeof(DRIVER_COPY_MEMORY)) { + Irp->IoStatus.Status = DriverCopy((PDRIVER_COPY_MEMORY)ioBuffer); + Irp->IoStatus.Information = sizeof(DRIVER_COPY_MEMORY); + } else { + Irp->IoStatus.Status = STATUS_INFO_LENGTH_MISMATCH; + } + } else { + Irp->IoStatus.Status = STATUS_INVALID_PARAMETER; + } + } + + NTSTATUS status = Irp->IoStatus.Status; + IoCompleteRequest(Irp, IO_NO_INCREMENT); + + return status; +} + +// Unloads the driver. +VOID DriverUnload(IN PDRIVER_OBJECT DriverObject) { + UNICODE_STRING dosDeviceName; + RtlUnicodeStringInit(&dosDeviceName, DRIVER_DOS_DEVICE_NAME); + + IoDeleteSymbolicLink(&dosDeviceName); + IoDeleteDevice(DriverObject->DeviceObject); +} + +// Entry point for the driver. +NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath) { + NTSTATUS status = STATUS_SUCCESS; + + UNREFERENCED_PARAMETER(RegistryPath); + + UNICODE_STRING deviceName; + RtlUnicodeStringInit(&deviceName, DRIVER_DEVICE_NAME); + + PDEVICE_OBJECT deviceObject = NULL; + status = IoCreateDevice(DriverObject, 0, &deviceName, DRIVER_DEVICE_TYPE, 0, FALSE, &deviceObject); + + if (!NT_SUCCESS(status)) { + return status; + } + + DriverObject->MajorFunction[IRP_MJ_CREATE] = DriverDispatch; + DriverObject->MajorFunction[IRP_MJ_CLOSE] = DriverDispatch; + DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DriverDispatch; + DriverObject->DriverUnload = DriverUnload; + + UNICODE_STRING dosDeviceName; + RtlUnicodeStringInit(&dosDeviceName, DRIVER_DOS_DEVICE_NAME); + + status = IoCreateSymbolicLink(&dosDeviceName, &deviceName); + + if (!NT_SUCCESS(status)) { + IoDeleteDevice(deviceObject); + } + + return status; +} + +``` + +`src/driver.vcxproj`: + +```vcxproj + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + Debug + ARM + + + Release + ARM + + + Debug + ARM64 + + + Release + ARM64 + + + + {E1F91302-CD35-4B3A-9F01-7CC5BF8C24CF} + {497e31cb-056b-4f31-abb8-447fd55ee5a5} + v4.5 + 12.0 + Debug + Win32 + driver + $(LatestTargetPlatformVersion) + + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + WDM + Desktop + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + WDM + Desktop + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + Windows10 + true + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + Windows10 + false + WindowsKernelModeDriver10.0 + Driver + KMDF + Universal + + + + + + + + + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + ..\..\..\Program Files (x86)\Windows Kits\10\CodeAnalysis\DriverMinimumRules.ruleset + false + $(SolutionDir)bin\$(Configuration)\ + $(SolutionDir)tmp\$(ProjectName)\$(Configuration)\ + + + DbgengKernelDebugger + ..\..\..\Program Files (x86)\Windows Kits\10\CodeAnalysis\DriverMinimumRules.ruleset + false + $(SolutionDir)bin\$(Configuration)\ + $(SolutionDir)tmp\$(ProjectName)\$(Configuration)\ + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + DbgengKernelDebugger + + + + true + true + trace.h + true + + + + + true + true + trace.h + true + + + + + true + trace.h + true + stdcpplatest + false + + + + + true + trace.h + true + MaxSpeed + AnySuitable + Speed + stdcpplatest + false + + + + + true + true + trace.h + true + + + + + true + true + trace.h + true + + + + + true + true + trace.h + true + + + + + true + true + trace.h + true + + + + + + + + + + + + + + + + +``` + +`src/driver.vcxproj.filters`: + +```filters + + + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;hm;inl;inc;xsd + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + + + source + + + + + include + + + include + + + +``` + +`src/driver_codes.h`: + +```h +#pragma once +// #include +#include "driver_codes.h" + +// Request for read/writing memory from/to a process. +#define IOCTL_DRIVER_COPY_MEMORY ((ULONG)CTL_CODE(DRIVER_DEVICE_TYPE, 0x808, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)) + +// Copy requeest data. +typedef struct _DRIVER_COPY_MEMORY { + ULONGLONG Source; // Source buffer address. + ULONGLONG Target; // Target buffer address. + ULONGLONG Size; // Buffer size. + ULONG ProcessId; // Target process ID. + BOOLEAN Write; // TRUE if writing, FALSE if reading. +} DRIVER_COPY_MEMORY, *PDRIVER_COPY_MEMORY; + +``` + +`src/driver_config.h`: + +```h +#pragma once + +#define DRIVER_NAME L"MemoryDriver" +#define DRIVER_DEVICE_NAME L"\\Device\\MemoryDriver" +#define DRIVER_DOS_DEVICE_NAME L"\\DosDevices\\MemoryDriver" +#define DRIVER_DEVICE_PATH L"\\\\.\\MemoryDriver" +#define DRIVER_DEVICE_TYPE 0x00000022 + +``` \ No newline at end of file