admin/mirror-processhacker
1
0
Fork 0
mirror of https://github.com/mirror/processhacker synced 2026-06-08 16:03:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

various fixes to injector

Browse Source 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@166 21ef857c-d57f-4fe0-8362-d861dc6d29cd
This commit is contained in:
wj32
2008-11-30 04:13:48 +00:00
parent 08c6863d67
commit 882b8ab4ea
3 changed files with 824 additions and 737 deletions
Download Patch File Download Diff File Expand all files Collapse all files
trunk/Injector/Injector.cpp
+70 -6
View File
@@ -39,7 +39,8 @@ typedef BOOL (__stdcall *RCloseHandle)(HANDLE handle);
#define MAX_CODE 8192
#define MODE_CMDLINE 1
#define MODE_CREATEPROCESS 2
#define MODE_CREATEPROCESSA 2
#define MODE_CREATEPROCESSC 3
struct data_struct
{
@@ -52,13 +53,15 @@ struct data_struct
};
wchar_t *GetWinStaDesktop();
DWORD __stdcall Cp(data_struct *data);
DWORD __stdcall CpApp(data_struct *data);
DWORD __stdcall CpCmd(data_struct *data);
DWORD __stdcall GRcl(data_struct *data);
BOOL EnableTokenPrivilege(LPCTSTR pszPrivilege);
int _tmain(int argc, wchar_t *argv[])
{
HANDLE handle = 0;
DWORD old_protect;
DWORD pid;
wchar_t *mode_str;
DWORD mode = 0;
@@ -86,7 +89,11 @@ int _tmain(int argc, wchar_t *argv[])
if (wcscmp(mode_str, _T("cmdline")) == 0)
mode = MODE_CMDLINE;
else if (wcscmp(mode_str, _T("createprocess")) == 0)
mode = MODE_CREATEPROCESS;
mode = MODE_CREATEPROCESSA;
else if (wcscmp(mode_str, _T("createprocessa")) == 0)
mode = MODE_CREATEPROCESSA;
else if (wcscmp(mode_str, _T("createprocessc")) == 0)
mode = MODE_CREATEPROCESSC;
else
{
printf("Invalid mode");
@@ -126,8 +133,10 @@ int _tmain(int argc, wchar_t *argv[])
if (mode == MODE_CMDLINE)
local_code = &GRcl;
else if (mode == MODE_CREATEPROCESS)
local_code = &Cp;
else if (mode == MODE_CREATEPROCESSA)
local_code = &CpApp;
else if (mode == MODE_CREATEPROCESSC)
local_code = &CpCmd;
if (!WriteProcessMemory(handle, remote_code, local_code, MAX_CODE, 0))
{
@@ -136,6 +145,9 @@ int _tmain(int argc, wchar_t *argv[])
goto clean_up;
}
if (!VirtualProtectEx(handle, remote_code, MAX_CODE, PAGE_EXECUTE, &old_protect))
printf("Warning: could not set page protection on code to PAGE_EXECUTE\n");
if (!(kernel32 = LoadLibrary(L"kernel32.dll")))
{
printf("Could not load kernel32.dll!");
@@ -251,11 +263,63 @@ wchar_t *GetWinStaDesktop()
return result;
}
DWORD __stdcall Cp(data_struct *data)
DWORD __stdcall CpApp(data_struct *data)
{
STARTUPINFOW startup_info;
PROCESS_INFORMATION proc_info;
startup_info.cbReserved2 = 0;
startup_info.dwFillAttribute = 0;
startup_info.dwX = 0;
startup_info.dwXCountChars = 0;
startup_info.dwXSize = 0;
startup_info.dwY = 0;
startup_info.dwYCountChars = 0;
startup_info.dwYSize = 0;
startup_info.hStdError = 0;
startup_info.hStdInput = 0;
startup_info.hStdOutput = 0;
startup_info.lpReserved = 0;
startup_info.lpReserved2 = 0;
startup_info.lpTitle = 0;
startup_info.wShowWindow = 0;
startup_info.cb = sizeof(startup_info);
startup_info.lpDesktop = data->winsta_desktop;
startup_info.dwFlags = STARTF_FORCEONFEEDBACK;
if (!data->fCPW(data->str, NULL, 0, 0, FALSE, 0, NULL, NULL, &startup_info,
&proc_info))
{
data->last_error = 1;
return 1;
}
data->fCH(proc_info.hProcess);
data->fCH(proc_info.hThread);
return 0;
}
DWORD __stdcall CpCmd(data_struct *data)
{
STARTUPINFOW startup_info;
PROCESS_INFORMATION proc_info;
startup_info.cbReserved2 = 0;
startup_info.dwFillAttribute = 0;
startup_info.dwX = 0;
startup_info.dwXCountChars = 0;
startup_info.dwXSize = 0;
startup_info.dwY = 0;
startup_info.dwYCountChars = 0;
startup_info.dwYSize = 0;
startup_info.hStdError = 0;
startup_info.hStdInput = 0;
startup_info.hStdOutput = 0;
startup_info.lpReserved = 0;
startup_info.lpReserved2 = 0;
startup_info.lpTitle = 0;
startup_info.wShowWindow = 0;
startup_info.cb = sizeof(startup_info);
startup_info.lpDesktop = data->winsta_desktop;
startup_info.dwFlags = STARTF_FORCEONFEEDBACK;
trunk/ProcessHacker/Forms/HackerWindow.Designer.cs
Generated
+740 -731
View File
File diff suppressed because it is too large Load Diff
trunk/ProcessHacker/Forms/HackerWindow.cs
+14
View File
@@ -322,6 +322,20 @@ namespace ProcessHacker
}
}
private void getSNFAMenuItem_Click(object sender, EventArgs e)
{
PromptBox box = new PromptBox();
if (box.ShowDialog() == DialogResult.OK)
{
int address = (int)BaseConverter.ToNumberParse(box.Value);
InformationBox infoBox = new InformationBox(Symbols.GetNameFromAddress(address));
infoBox.ShowDialog();
}
}
private void inspectPEFileMenuItem_Click(object sender, EventArgs e)
{
OpenFileDialog ofd = new OpenFileDialog();