use MinGW now

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@202 21ef857c-d57f-4fe0-8362-d861dc6d29cd
This commit is contained in:
wj32
2008-12-03 06:19:42 +00:00
parent 740fad5c87
commit bcf821070b
3 changed files with 250 additions and 448 deletions
+250 -243
View File
@@ -18,6 +18,8 @@
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#define UNICODE
#include <stdio.h>
#include <tchar.h>
#include <windows.h>
@@ -34,14 +36,14 @@ typedef BOOL (__stdcall *RCreateProcessW)(
LPCWSTR lpCurrentDirectory,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation
);
);
typedef BOOL (__stdcall *RCloseHandle)(HANDLE handle);
typedef BOOL (__stdcall *RExitProcess)(DWORD ExitCode);
#define MAX_STR 4000
#define MAX_CODE 8192
#define STREQ(x,y) (wcscmp((x), _T(y)) == 0)
#define STREQ(x,y) (wcscmp((x), L##y) == 0)
#define MODE_CMDLINE 1
#define MODE_CREATEPROCESSA 2
#define MODE_CREATEPROCESSC 3
@@ -49,13 +51,13 @@ typedef BOOL (__stdcall *RExitProcess)(DWORD ExitCode);
struct data_struct_s
{
DWORD last_error; // error code from thread
RCreateProcessW fCPW;
RCloseHandle fCH;
RExitProcess fEP;
RGetCommandLineW fGCLW;
wchar_t winsta_desktop[64];
wchar_t str[MAX_STR];
DWORD last_error; // error code from thread
RCreateProcessW fCPW;
RCloseHandle fCH;
RExitProcess fEP;
RGetCommandLineW fGCLW;
wchar_t winsta_desktop[64];
wchar_t str[MAX_STR];
};
typedef struct data_struct_s data_struct;
@@ -66,291 +68,296 @@ void Ep(data_struct *data);
DWORD CpApp(data_struct *data);
DWORD CpCmd(data_struct *data);
DWORD GRcl(data_struct *data);
BOOL EnableTokenPrivilege(LPCTSTR pszPrivilege);
BOOL EnableTokenPrivilege(LPWSTR pszPrivilege);
int _tmain(int argc, wchar_t *argv[])
int main()
{
HANDLE handle = 0;
DWORD old_protect;
DWORD pid;
wchar_t *mode_str;
DWORD mode = 0;
void *local_code = 0;
void *remote_code = 0;
data_struct *remote_data = 0;
data_struct local_data;
DWORD return_code = 0;
HMODULE kernel32 = 0;
HANDLE remote_thread = 0;
DWORD rc = 0;
wchar_t *winsta_desktop = GetDesktopName();
if (!EnableTokenPrivilege(SE_DEBUG_NAME))
printf("Could not get debug privilege!\n");
int argc;
wchar_t **argv;
HANDLE handle = 0;
DWORD old_protect;
DWORD pid;
wchar_t *mode_str;
DWORD mode = 0;
void *local_code = 0;
void *remote_code = 0;
data_struct *remote_data = 0;
data_struct local_data;
DWORD return_code = 0;
HMODULE kernel32 = 0;
HANDLE remote_thread = 0;
DWORD rc = 0;
wchar_t *winsta_desktop = GetDesktopName();
argv = CommandLineToArgvW(GetCommandLineW(), &argc);
if (!EnableTokenPrivilege(SE_DEBUG_NAME))
printf("Could not get debug privilege!\n");
if (argc < 3)
{
printf("Need more arguments.\n");
return ERROR_INVALID_PARAMETER;
}
if (argc < 3)
{
printf("Need more arguments.\n");
return ERROR_INVALID_PARAMETER;
}
mode_str = argv[1];
mode_str = argv[1];
if (STREQ(mode_str, "cmdline"))
mode = MODE_CMDLINE;
else if (STREQ(mode_str, "createprocess"))
mode = MODE_CREATEPROCESSA;
else if (STREQ(mode_str, "createprocessa"))
mode = MODE_CREATEPROCESSA;
else if (STREQ(mode_str, "createprocessc"))
mode = MODE_CREATEPROCESSC;
else if (STREQ(mode_str, "exitprocess"))
mode = MODE_EXITPROCESS;
else
{
printf("Invalid mode.\n");
return ERROR_INVALID_PARAMETER;
}
pid = _wtoi(argv[2]);
if (argc > 3)
wcscpy(local_data.str, argv[3]);
else
local_data.str[0] = 0;
if (STREQ(mode_str, "cmdline"))
mode = MODE_CMDLINE;
else if (STREQ(mode_str, "createprocess"))
mode = MODE_CREATEPROCESSA;
else if (STREQ(mode_str, "createprocessa"))
mode = MODE_CREATEPROCESSA;
else if (STREQ(mode_str, "createprocessc"))
mode = MODE_CREATEPROCESSC;
else if (STREQ(mode_str, "exitprocess"))
mode = MODE_EXITPROCESS;
else
{
wprintf(L"Invalid mode %s.\n", mode_str);
return ERROR_INVALID_PARAMETER;
}
pid = _wtoi(argv[2]);
if (argc > 3)
wcscpy(local_data.str, argv[3]);
else
local_data.str[0] = 0;
wcscpy(local_data.winsta_desktop, winsta_desktop);
wcscpy(local_data.winsta_desktop, winsta_desktop);
if (!(handle = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION |
PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, pid)))
{
printf("Could not open process!\n");
return GetLastError();
}
if (!(remote_code = VirtualAllocEx(handle, 0, MAX_CODE, MEM_COMMIT, PAGE_EXECUTE_READWRITE)))
{
printf("Could not allocate memory!\n");
return_code = GetLastError();
goto clean_up;
}
if (!(handle = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION |
PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, pid)))
{
printf("Could not open process!\n");
return GetLastError();
}
if (!(remote_code = VirtualAllocEx(handle, 0, MAX_CODE, MEM_COMMIT, PAGE_EXECUTE_READWRITE)))
{
printf("Could not allocate memory!\n");
return_code = GetLastError();
goto clean_up;
}
if (!(remote_data = (data_struct *)VirtualAllocEx(handle, 0,
sizeof(local_data), MEM_COMMIT, PAGE_READWRITE)))
{
printf("Could not allocate memory!\n");
return_code = GetLastError();
goto clean_up;
}
if (!(remote_data = (data_struct *)VirtualAllocEx(handle, 0,
sizeof(local_data), MEM_COMMIT, PAGE_READWRITE)))
{
printf("Could not allocate memory!\n");
return_code = GetLastError();
goto clean_up;
}
if (mode == MODE_CMDLINE)
local_code = &GRcl;
else if (mode == MODE_CREATEPROCESSA)
local_code = &CpApp;
else if (mode == MODE_CREATEPROCESSC)
local_code = &CpCmd;
else if (mode == MODE_EXITPROCESS)
local_code = &Ep;
if (!WriteProcessMemory(handle, remote_code, local_code, MAX_CODE, 0))
{
printf("Could not write remote code!\n");
return_code = GetLastError();
goto clean_up;
}
if (mode == MODE_CMDLINE)
local_code = &GRcl;
else if (mode == MODE_CREATEPROCESSA)
local_code = &CpApp;
else if (mode == MODE_CREATEPROCESSC)
local_code = &CpCmd;
else if (mode == MODE_EXITPROCESS)
local_code = &Ep;
if (!WriteProcessMemory(handle, remote_code, local_code, MAX_CODE, 0))
{
printf("Could not write remote code!\n");
return_code = GetLastError();
goto clean_up;
}
if (!VirtualProtectEx(handle, remote_code, MAX_CODE, PAGE_EXECUTE, &old_protect))
printf("Warning: could not set page protection on code to PAGE_EXECUTE\n");
if (!VirtualProtectEx(handle, remote_code, MAX_CODE, PAGE_EXECUTE, &old_protect))
printf("Warning: could not set page protection on code to PAGE_EXECUTE\n");
if (!(kernel32 = LoadLibrary(L"kernel32.dll")))
{
printf("Could not load kernel32.dll!\n");
return_code = GetLastError();
goto clean_up;
}
if (!(kernel32 = LoadLibraryW(L"kernel32.dll")))
{
printf("Could not load kernel32.dll!\n");
return_code = GetLastError();
goto clean_up;
}
local_data.last_error = 0;
if (!(local_data.fGCLW = (RGetCommandLineW)GetProcAddress(kernel32, "GetCommandLineW")))
{
printf("Could not get address of GetCommandLineW!\n");
return_code = GetLastError();
goto clean_up;
}
if (!(local_data.fCPW = (RCreateProcessW)GetProcAddress(kernel32, "CreateProcessW")))
{
printf("Could not get address of CreateProcessW!\n");
return_code = GetLastError();
goto clean_up;
}
if (!(local_data.fCH = (RCloseHandle)GetProcAddress(kernel32, "CloseHandle")))
{
printf("Could not get address of CloseHandle!\n");
return_code = GetLastError();
goto clean_up;
}
if (!(local_data.fEP = (RExitProcess)GetProcAddress(kernel32, "ExitProcess")))
{
printf("Could not get address of ExitProcess!\n");
return_code = GetLastError();
goto clean_up;
}
local_data.last_error = 0;
if (!(local_data.fGCLW = (RGetCommandLineW)GetProcAddress(kernel32, "GetCommandLineW")))
{
printf("Could not get address of GetCommandLineW!\n");
return_code = GetLastError();
goto clean_up;
}
if (!(local_data.fCPW = (RCreateProcessW)GetProcAddress(kernel32, "CreateProcessW")))
{
printf("Could not get address of CreateProcessW!\n");
return_code = GetLastError();
goto clean_up;
}
if (!(local_data.fCH = (RCloseHandle)GetProcAddress(kernel32, "CloseHandle")))
{
printf("Could not get address of CloseHandle!\n");
return_code = GetLastError();
goto clean_up;
}
if (!(local_data.fEP = (RExitProcess)GetProcAddress(kernel32, "ExitProcess")))
{
printf("Could not get address of ExitProcess!\n");
return_code = GetLastError();
goto clean_up;
}
if (!WriteProcessMemory(handle, remote_data, &local_data, sizeof(local_data), 0))
{
printf("Could not write remote data!\n");
return_code = GetLastError();
goto clean_up;
}
if (!WriteProcessMemory(handle, remote_data, &local_data, sizeof(local_data), 0))
{
printf("Could not write remote data!\n");
return_code = GetLastError();
goto clean_up;
}
if (!(remote_thread = CreateRemoteThread(handle, 0, 0, (LPTHREAD_START_ROUTINE)remote_code,
remote_data, 0, &rc)))
{
printf("Could not create remote thread!\n");
return_code = GetLastError();
goto clean_up;
}
rc = WaitForSingleObject(remote_thread, 5000);
if (!(remote_thread = CreateRemoteThread(handle, 0, 0, (LPTHREAD_START_ROUTINE)remote_code,
remote_data, 0, &rc)))
{
printf("Could not create remote thread!\n");
return_code = GetLastError();
goto clean_up;
}
rc = WaitForSingleObject(remote_thread, 5000);
if (mode == MODE_CMDLINE)
{
switch (rc)
{
case WAIT_TIMEOUT:
printf("WaitForSingleObject timed out!\n");
goto clean_up;
case WAIT_FAILED:
printf("WaitForSingleObject failed!\n");
return_code = GetLastError();
goto clean_up;
case WAIT_OBJECT_0:
if (!ReadProcessMemory(handle, remote_data, &local_data, sizeof(local_data), 0))
{
printf("Could not read process memory!\n");
return_code = GetLastError();
goto clean_up;
}
if (mode == MODE_CMDLINE)
{
switch (rc)
{
case WAIT_TIMEOUT:
printf("WaitForSingleObject timed out!\n");
goto clean_up;
case WAIT_FAILED:
printf("WaitForSingleObject failed!\n");
return_code = GetLastError();
goto clean_up;
case WAIT_OBJECT_0:
if (!ReadProcessMemory(handle, remote_data, &local_data, sizeof(local_data), 0))
{
printf("Could not read process memory!\n");
return_code = GetLastError();
goto clean_up;
}
if (local_data.last_error != 0)
{
printf("Error in remote thread!\n");
return_code = GetLastError();
goto clean_up;
}
if (local_data.last_error != 0)
{
printf("Error in remote thread!\n");
return_code = GetLastError();
goto clean_up;
}
return_code = 0;
break;
}
return_code = 0;
break;
}
wprintf(_T("%s"), local_data.str);
}
wprintf(L"%s", local_data.str);
}
clean_up:
if (remote_code != 0)
VirtualFreeEx(handle, remote_code, 0, MEM_RELEASE);
if (remote_data != 0)
VirtualFreeEx(handle, remote_data, 0, MEM_RELEASE);
if (remote_code != 0)
VirtualFreeEx(handle, remote_code, 0, MEM_RELEASE);
if (remote_data != 0)
VirtualFreeEx(handle, remote_data, 0, MEM_RELEASE);
return return_code;
return return_code;
}
wchar_t *GetDesktopName()
{
HDESK desktop = GetThreadDesktop(GetCurrentThreadId());
wchar_t *desktop_name = 0;
DWORD required_size = 0;
HDESK desktop = GetThreadDesktop(GetCurrentThreadId());
wchar_t *desktop_name = 0;
DWORD required_size = 0;
GetUserObjectInformation(desktop, UOI_NAME, desktop_name, 0, &required_size);
desktop_name = (wchar_t *)malloc(required_size);
GetUserObjectInformation(desktop, UOI_NAME, desktop_name, required_size, 0);
GetUserObjectInformation(desktop, UOI_NAME, desktop_name, 0, &required_size);
desktop_name = (wchar_t *)malloc(required_size);
GetUserObjectInformation(desktop, UOI_NAME, desktop_name, required_size, 0);
return desktop_name;
return desktop_name;
}
static void Ep(data_struct *data)
void Ep(data_struct *data)
{
data->fEP(0);
data->fEP(0);
}
static DWORD CpApp(data_struct *data)
DWORD CpApp(data_struct *data)
{
STARTUPINFOW startup_info;
PROCESS_INFORMATION proc_info;
startup_info.cb = sizeof(startup_info);
startup_info.lpDesktop = data->winsta_desktop;
startup_info.lpTitle = NULL;
startup_info.dwFlags = STARTF_FORCEONFEEDBACK;
STARTUPINFOW startup_info;
PROCESS_INFORMATION proc_info;
startup_info.cb = sizeof(startup_info);
startup_info.lpDesktop = data->winsta_desktop;
startup_info.lpTitle = NULL;
startup_info.dwFlags = STARTF_FORCEONFEEDBACK;
if (!data->fCPW(data->str, NULL, 0, 0, FALSE, 0, NULL, NULL, &startup_info,
&proc_info))
{
data->last_error = 1;
return 1;
}
if (!data->fCPW(data->str, NULL, 0, 0, FALSE, 0, NULL, NULL, &startup_info,
&proc_info))
{
data->last_error = 1;
return 1;
}
data->fCH(proc_info.hProcess);
data->fCH(proc_info.hThread);
data->fCH(proc_info.hProcess);
data->fCH(proc_info.hThread);
return 0;
return 0;
}
static DWORD CpCmd(data_struct *data)
DWORD CpCmd(data_struct *data)
{
STARTUPINFOW startup_info;
PROCESS_INFORMATION proc_info;
startup_info.cb = sizeof(startup_info);
startup_info.lpDesktop = data->winsta_desktop;
startup_info.lpTitle = NULL;
startup_info.dwFlags = STARTF_FORCEONFEEDBACK;
STARTUPINFOW startup_info;
PROCESS_INFORMATION proc_info;
startup_info.cb = sizeof(startup_info);
startup_info.lpDesktop = data->winsta_desktop;
startup_info.lpTitle = NULL;
startup_info.dwFlags = STARTF_FORCEONFEEDBACK;
if (!data->fCPW(NULL, data->str, 0, 0, FALSE, 0, NULL, NULL, &startup_info,
&proc_info))
{
data->last_error = 1;
return 1;
}
if (!data->fCPW(NULL, data->str, 0, 0, FALSE, 0, NULL, NULL, &startup_info,
&proc_info))
{
data->last_error = 1;
return 1;
}
data->fCH(proc_info.hProcess);
data->fCH(proc_info.hThread);
data->fCH(proc_info.hProcess);
data->fCH(proc_info.hThread);
return 0;
return 0;
}
static DWORD GRcl(data_struct *data)
DWORD GRcl(data_struct *data)
{
const wchar_t *src;
wchar_t *tgt, *end;
const wchar_t *src;
wchar_t *tgt, *end;
src = data->fGCLW();
tgt = data->str;
end = &data->str[MAX_STR - 1];
src = data->fGCLW();
tgt = data->str;
end = &data->str[MAX_STR - 1];
if (src == 0 || tgt == 0 || end == 0)
{
data->last_error = 1;
return 1;
}
if (src == 0 || tgt == 0 || end == 0)
{
data->last_error = 1;
return 1;
}
for (; *src != 0 && tgt < end; ++src, ++tgt)
*tgt = *src;
for (; *src != 0 && tgt < end; ++src, ++tgt)
*tgt = *src;
*tgt = 0;
data->last_error = 0;
*tgt = 0;
data->last_error = 0;
return 0;
return 0;
}
BOOL EnableTokenPrivilege(LPCTSTR privilege)
BOOL EnableTokenPrivilege(LPWSTR privilege)
{
HANDLE token_handle = 0;
TOKEN_PRIVILEGES tkp = {0};
TOKEN_PRIVILEGES tkp = {0};
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &token_handle))
{
@@ -359,11 +366,11 @@ BOOL EnableTokenPrivilege(LPCTSTR privilege)
if (LookupPrivilegeValue(NULL, privilege, &tkp.Privileges[0].Luid))
{
tkp.PrivilegeCount = 1;
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(token_handle, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES)NULL, 0);
CloseHandle(token_handle);
CloseHandle(token_handle);
if (GetLastError() != ERROR_SUCCESS)
return FALSE;
@@ -371,7 +378,7 @@ BOOL EnableTokenPrivilege(LPCTSTR privilege)
return TRUE;
}
CloseHandle(token_handle);
CloseHandle(token_handle);
return FALSE;
}
-20
View File
@@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 10.00
# Visual C++ Express 2008
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Injector", "Injector.vcproj", "{0676E20E-1836-4C31-AA5D-7AF107AB22A7}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Win32 = Debug|Win32
Release|Win32 = Release|Win32
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{0676E20E-1836-4C31-AA5D-7AF107AB22A7}.Debug|Win32.ActiveCfg = Debug|Win32
{0676E20E-1836-4C31-AA5D-7AF107AB22A7}.Debug|Win32.Build.0 = Debug|Win32
{0676E20E-1836-4C31-AA5D-7AF107AB22A7}.Release|Win32.ActiveCfg = Release|Win32
{0676E20E-1836-4C31-AA5D-7AF107AB22A7}.Release|Win32.Build.0 = Release|Win32
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal
-185
View File
@@ -1,185 +0,0 @@
<?xml version="1.0" encoding="Windows-1252"?>
<VisualStudioProject
ProjectType="Visual C++"
Version="9.00"
Name="Injector"
ProjectGUID="{0676E20E-1836-4C31-AA5D-7AF107AB22A7}"
RootNamespace="Injector"
Keyword="Win32Proj"
TargetFrameworkVersion="196613"
>
<Platforms>
<Platform
Name="Win32"
/>
</Platforms>
<ToolFiles>
</ToolFiles>
<Configurations>
<Configuration
Name="Debug|Win32"
OutputDirectory="$(SolutionDir)$(ConfigurationName)"
IntermediateDirectory="$(ConfigurationName)"
ConfigurationType="1"
CharacterSet="1"
>
<Tool
Name="VCPreBuildEventTool"
/>
<Tool
Name="VCCustomBuildTool"
/>
<Tool
Name="VCXMLDataGeneratorTool"
/>
<Tool
Name="VCWebServiceProxyGeneratorTool"
/>
<Tool
Name="VCMIDLTool"
/>
<Tool
Name="VCCLCompilerTool"
Optimization="0"
PreprocessorDefinitions="WIN32;_DEBUG;_CONSOLE"
MinimalRebuild="true"
BasicRuntimeChecks="3"
RuntimeLibrary="3"
UsePrecompiledHeader="0"
WarningLevel="3"
DebugInformationFormat="4"
/>
<Tool
Name="VCManagedResourceCompilerTool"
/>
<Tool
Name="VCResourceCompilerTool"
/>
<Tool
Name="VCPreLinkEventTool"
/>
<Tool
Name="VCLinkerTool"
LinkIncremental="2"
GenerateDebugInformation="true"
SubSystem="1"
TargetMachine="1"
/>
<Tool
Name="VCALinkTool"
/>
<Tool
Name="VCManifestTool"
/>
<Tool
Name="VCXDCMakeTool"
/>
<Tool
Name="VCBscMakeTool"
/>
<Tool
Name="VCFxCopTool"
/>
<Tool
Name="VCAppVerifierTool"
/>
<Tool
Name="VCPostBuildEventTool"
/>
</Configuration>
<Configuration
Name="Release|Win32"
OutputDirectory="$(SolutionDir)$(ConfigurationName)"
IntermediateDirectory="$(ConfigurationName)"
ConfigurationType="1"
CharacterSet="1"
WholeProgramOptimization="1"
>
<Tool
Name="VCPreBuildEventTool"
/>
<Tool
Name="VCCustomBuildTool"
/>
<Tool
Name="VCXMLDataGeneratorTool"
/>
<Tool
Name="VCWebServiceProxyGeneratorTool"
/>
<Tool
Name="VCMIDLTool"
/>
<Tool
Name="VCCLCompilerTool"
Optimization="1"
InlineFunctionExpansion="0"
EnableIntrinsicFunctions="false"
FavorSizeOrSpeed="2"
WholeProgramOptimization="true"
PreprocessorDefinitions="WIN32;NDEBUG;_CONSOLE"
RuntimeLibrary="2"
EnableFunctionLevelLinking="true"
UsePrecompiledHeader="0"
WarningLevel="3"
DebugInformationFormat="3"
CallingConvention="0"
/>
<Tool
Name="VCManagedResourceCompilerTool"
/>
<Tool
Name="VCResourceCompilerTool"
/>
<Tool
Name="VCPreLinkEventTool"
/>
<Tool
Name="VCLinkerTool"
LinkIncremental="1"
GenerateDebugInformation="false"
SubSystem="1"
OptimizeReferences="2"
EnableCOMDATFolding="2"
TargetMachine="1"
/>
<Tool
Name="VCALinkTool"
/>
<Tool
Name="VCManifestTool"
/>
<Tool
Name="VCXDCMakeTool"
/>
<Tool
Name="VCBscMakeTool"
/>
<Tool
Name="VCFxCopTool"
/>
<Tool
Name="VCAppVerifierTool"
/>
<Tool
Name="VCPostBuildEventTool"
/>
</Configuration>
</Configurations>
<References>
</References>
<Files>
<Filter
Name="Source Files"
Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"
UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
>
<File
RelativePath=".\Injector.c"
>
</File>
</Filter>
</Files>
<Globals>
</Globals>
</VisualStudioProject>