admin/silverf0x-RpcView
1
0
Fork 0
mirror of https://github.com/silverf0x/RpcView synced 2026-06-08 17:26:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2 from silverf0x/master

Browse Source 
Merge upstream changes
This commit is contained in:
hfiref0x
2019-01-16 04:27:51 +07:00
committed by GitHub
parent 3bdfe86bc6 91bf7750e6
commit 79ea228d3e
12 changed files with 29 additions and 215 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+11 -11
View File
@@ -1,5 +1,4 @@
RpcView
=======
# RpcView
RpcView is an open-source tool to explore and decompile all RPC functionalities present on a Microsoft system.
@@ -7,10 +6,9 @@ You can download the last [automatically built release](https://ci.appveyor.com/
[![Build status](https://ci.appveyor.com/api/projects/status/o5wy6mdk16tuht70?svg=true)](https://ci.appveyor.com/project/silverf0x/rpcview)
**Warning**: you have to install "Microsoft Visual C++ 2015 Redistributable" to use RpcView.
> **Warning**: you have to install "Microsoft Visual C++ 2015 Redistributable" to use RpcView.
How to add a new RPC runtime
----------------------------------
## How to add a new RPC runtime
Basically you have two possibilities to support a new RPC runtime (rpcrt4.dll) version:
@@ -24,8 +22,7 @@ Currently, the supported versions are organized as follows:
- RpcCore3 for Windows 8
- RpcCore4 for Windows 8.1 and 10
Compilation
--------------
## Compilation
Required elements to compiled the project:
@@ -33,11 +30,14 @@ Required elements to compiled the project:
* CMake (at least 3.0.2)
* Qt5 (currently 5.9.1)
Before running CMake you have to set the CMAKE_PREFIX_PATH environment variable with the current Qt path, for instance (x64):
Before running CMake you have to set the CMAKE_PREFIX_PATH environment variable with the Qt **full path**, for instance (x64):
```
set CMAKE_PREFIX_PATH=C:\Qt\Qt5.9.1\5.9.1\msvc2015_64
```
Then you can run CMake to produce the project solution.
Before running CMake to produce the project solution you have to create the buikd directories:
- ```RpcView/Build/x64``` for 64-bit targets
- ```RpcView/Build/x86``` for 32-bit targets.
Here is an example to generate the x64 solution with Visual Studio 2015 from the ```RpcView/Build/x64``` directory:
```cmake
@@ -105,8 +105,8 @@ cmake --build . --config Release
RpcView32 binaries are produced in the ```RpcView/Build/bin/x86``` directory and RpcView64 ones in the ```RpcView/Build/bin/x64```
Acknowledgements
----------------------
## Acknowledgements
* Jeremy
* Julien
* Yoanne
RpcCommon/Misc.c
+3 -71
View File
@@ -50,7 +50,7 @@ BOOL WINAPI EnumProcess(EnumProcessCallbackFn_T EnumProcessCallbackFn,void* pCal
BOOL bContinue=TRUE;
hSnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if (hSnapshot==NULL) goto End;
if (hSnapshot == INVALID_HANDLE_VALUE) goto End;
ProcessEntry.dwSize=sizeof(ProcessEntry);
if (!Process32FirstW(hSnapshot,&ProcessEntry)) goto End;
do
@@ -61,7 +61,7 @@ BOOL WINAPI EnumProcess(EnumProcessCallbackFn_T EnumProcessCallbackFn,void* pCal
}while(Process32NextW(hSnapshot,&ProcessEntry));
End:
if (hSnapshot!=NULL) CloseHandle(hSnapshot);
if (hSnapshot != INVALID_HANDLE_VALUE) CloseHandle(hSnapshot);
return (bResult);
}
@@ -162,74 +162,6 @@ End:
return (bResult);
}
typedef VOID (WINAPI* RtlGetUnloadEventTraceExFn_T)(
_Out_ PULONG *ElementSize,
_Out_ PULONG *ElementCount,
_Out_ PVOID *EventTrace
);
#pragma pack(1)
typedef struct _RTL_UNLOAD_EVENT_TRACE {
void* BaseAddress; // Base address of dll
SIZE_T SizeOfImage; // Size of image
ULONG Sequence; // Sequence number for this event
ULONG TimeDateStamp; // Time and date of image
ULONG CheckSum; // Image checksum
WCHAR ImageName[32]; // Image name
} RTL_UNLOAD_EVENT_TRACE, *PRTL_UNLOAD_EVENT_TRACE;
#pragma pack()
//------------------------------------------------------------------------------
BOOL WINAPI GetUnloadedLocationInfo(HANDLE hProcess, VOID* pAddress, LocationInfo_T* pLocationInfo)
{
RtlGetUnloadEventTraceExFn_T RtlGetUnloadEventTraceExFn = NULL;
ULONG* pElementSize = NULL;
ULONG* pElementCount = NULL;
UCHAR* pEventTrace = NULL;
RTL_UNLOAD_EVENT_TRACE* pUnloadEventTrace = NULL;
ULONG ElementSize = 0;
ULONG ElementCount = 0;
BOOL bResult = FALSE;
ULONG i = 0;
RtlGetUnloadEventTraceExFn = (RtlGetUnloadEventTraceExFn_T)GetProcAddress(GetModuleHandleA("ntdll.dll"), "RtlGetUnloadEventTraceEx");
if (RtlGetUnloadEventTraceExFn == NULL) goto End;
//
// Get addresses of ElementSize, ElementCount and pEventTrace in the ntdll
//
RtlGetUnloadEventTraceExFn(&pElementSize, &pElementCount, &pEventTrace);
//
// Read their values in the target process
//
if (!ReadProcessMemory(hProcess, pElementSize, &ElementSize, sizeof(ElementSize), NULL)) goto End;
pUnloadEventTrace = (RTL_UNLOAD_EVENT_TRACE*)OS_ALLOC(ElementSize);
if (pUnloadEventTrace == NULL) goto End;
if (!ReadProcessMemory(hProcess, pElementCount, &ElementCount, sizeof(ElementCount), NULL)) goto End;
if (!ReadProcessMemory(hProcess, pEventTrace, &pEventTrace, sizeof(pEventTrace), NULL)) goto End;
//
// Look for the unloaded module
//
for (i = 0; i < ElementCount; i++)
{
if (!ReadProcessMemory(hProcess, pEventTrace, pUnloadEventTrace, ElementSize, NULL)) goto End;
if (pUnloadEventTrace->BaseAddress == NULL) break;
if (((SIZE_T)pAddress >= (SIZE_T)pUnloadEventTrace->BaseAddress) &&
((SIZE_T)pAddress < ((SIZE_T)pUnloadEventTrace->BaseAddress + pUnloadEventTrace->SizeOfImage)))
{
pLocationInfo->pBaseAddress = pUnloadEventTrace->BaseAddress;
pLocationInfo->Size = pUnloadEventTrace->SizeOfImage;
memcpy(pLocationInfo->Location, pUnloadEventTrace->ImageName, sizeof(pLocationInfo->Location));
break;
}
pEventTrace += ElementSize;
}
End:
if (pUnloadEventTrace != NULL) OS_FREE(pUnloadEventTrace);
return (bResult);
}
//------------------------------------------------------------------------------
UINT64 WINAPI GetModuleVersion(WCHAR* pModulePath)
{
@@ -375,7 +307,7 @@ BOOL WINAPI GetUserAndDomainName(DWORD Pid, WCHAR* Buffer, ULONG BufferLengthInB
pTokenUser=(TOKEN_USER*)OS_ALLOC(Bytes);
if (pTokenUser==NULL) goto End;
if (!GetTokenInformation(hToken,TokenUser,pTokenUser,Bytes,&Bytes)) goto End;
dwSize=sizeof(UserName);
dwSize=_countof(UserName);
if (!LookupAccountSidW(NULL,pTokenUser->User.Sid,UserName,&dwSize,DomainName,&dwSize,&SidType)) goto End;
StringCbPrintfW(Buffer,BufferLengthInBytes,L"%s\\%s",DomainName,UserName);
bResult=TRUE;
RpcCommon/Misc.h
-3
View File
@@ -36,15 +36,12 @@ BOOL WINAPI AdjustPrivilege(LPCTSTR lpPrivilegeName,BOOL bEnablePrivilege);
BOOL WINAPI GetModuleDescription(WCHAR* pModulePath,WCHAR* pDescription,UINT Bytes);
UINT64 WINAPI GetModuleVersion(WCHAR* pModulePath);
BOOL WINAPI GetLocationInfo(HANDLE hProcess, VOID* pAddress, LocationInfo_T* pLocationInfo);
BOOL WINAPI GetUnloadedLocationInfo(HANDLE hProcess, VOID* pAddress, LocationInfo_T* pLocationInfo);
BOOL WINAPI GetProcessNameFromPid(DWORD Pid,WCHAR* pName,UINT NameSizeInBytes);
BOOL WINAPI GetProcessPath(DWORD Pid, WCHAR* pProcessPath, DWORD ProcessPathLength);
BOOL WINAPI GetProcessPebInfo(HANDLE hProcess,WCHAR* pCmdLine,UINT CmdLineLength,WCHAR* pDesktop,UINT DesktopLength);
BOOL WINAPI GetRegValueData(HKEY hRootKey,WCHAR* pSubkeyName,WCHAR* pValueName,VOID* pData,UINT DataLength);
BOOL WINAPI GetUserAndDomainName(DWORD Pid, WCHAR* Buffer, ULONG BufferLengthInBytes);
BOOL WINAPI IsProcessWow64(ULONG Pid);
VOID WINAPI PrintUUID(UUID* pUUID);
HANDLE WINAPI KphOpenProcess(_In_ DWORD dwDesiredAccess, _In_ BOOL bInheritHandle, _In_ DWORD dwProcessId);
typedef BOOL (WINAPI* EnumProcessCallbackFn_T)(DWORD Pid, DWORD Ppid, VOID* pContext, BOOL* pbContinue);
BOOL WINAPI EnumProcess(EnumProcessCallbackFn_T EnumProcessCallbackFn, void* pCallbackCtxt);
RpcCore/RpcCore.c
+2 -1
View File
@@ -226,6 +226,7 @@ BOOL WINAPI GetRpcServerAddressInProcess(DWORD Pid,RpcCoreInternalCtxt_T* pRpcCo
EnumProcessModulesEx(hProcess, NULL, 0, &cbSize, LIST_MODULES_ALL);
if (cbSize == 0) goto End;
pHmodule = (HMODULE*)malloc(cbSize);
if (pHmodule == NULL) goto End;
EnumProcessModulesEx(hProcess, pHmodule, cbSize, &cbSize, LIST_MODULES_ALL);
for(ULONG i=0;i<cbSize/sizeof(*pHmodule);i++)
@@ -289,7 +290,7 @@ VOID* __fastcall RpcCoreInit(BOOL bForce)
if (GetSystemDirectoryW(RpcRuntimePath,_countof(RpcRuntimePath))==0) goto End;
StringCbPrintfW(RpcRuntimePath,sizeof(RpcRuntimePath),L"%s\\rpcrt4.dll",RpcRuntimePath);
RuntimVersion=GetModuleVersion(RpcRuntimePath);
for (i = 0; i < sizeof(RPC_CORE_RUNTIME_VERSION); i++)
for (i = 0; i < _countof(RPC_CORE_RUNTIME_VERSION); i++)
{
if (bForce && ((RuntimVersion & 0xFFFFFFFF00000000) == (RPC_CORE_RUNTIME_VERSION[i] & 0xFFFFFFFF00000000)))
{
RpcCore/RpcCore2_32bits/RpcInternals.h
+2 -1
View File
@@ -20,7 +20,8 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = {
0x600011DB15D6BLL, //6.1.7601.23915
0x600011DB15E35LL, //6.1.7601.24117
0x600011DB15EC4LL, //6.1.7601.24260
0x600011DB15EE3LL //6.1.7601.24291
0x600011DB15EE3LL, //6.1.7601.24291
0x600011DB15EF4LL //6.1.7601.24308
};
#ifdef _WIN64
RpcCore/RpcCore2_64bits/RpcInternals.h
+2 -1
View File
@@ -19,7 +19,8 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = {
0x600011DB15D6BLL, //6.1.7601.23915
0x600011DB15E35LL, //6.1.7601.24117
0x600011DB15EC4LL, //6.1.7601.24260
0x600011DB15EE3LL //6.1.7601.24291
0x600011DB15EE3LL, //6.1.7601.24291
0x600011DB15EF4LL //6.1.7601.24308
};
#define RPC_CORE_DESCRIPTION "Windows 7 SP1 64bits runtime core"
RpcCore/RpcCore4_32bits/RpcInternals.h
+1
View File
@@ -33,6 +33,7 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = {
0xA00003FAB0173LL, //10.0.16299.371
0xA00003FAB01ECLL, //10.0.16299.492
0xA00003FAB02D6LL, //10.0.16299.726
0xA00003FAB034ELL, //10.0.16299.846
0xA0000427903E8LL, //10.0.17017.1000
0xA0000428103E8LL, //10.0.17025.1000
0xA000042B203EALL, //10.0.17074.1002
RpcCore/RpcCore4_64bits/RpcInternals.h
+1
View File
@@ -33,6 +33,7 @@ static UINT64 RPC_CORE_RUNTIME_VERSION[] = {
0xA00003FAB0173LL, //10.0.16299.371
0xA00003FAB01ECLL, //10.0.16299.492
0xA00003FAB02D6LL, //10.0.16299.726
0xA00003FAB034ELL, //10.0.16299.846
0xA0000427903E8LL, //10.0.17017.1000
0xA0000428103E8LL, //10.0.17025.1000
0xA000042B203EALL, //10.0.17074.1002
RpcDecompiler/InternalComplexTypesMisc.cpp
+1 -1
View File
@@ -546,7 +546,7 @@ BOOL __fastcall processCorrelationDescriptorNaked(
ss << "StructMember"<<std::dec<<uCorrDescMember;
strCorrelationItem = ss.str();
}
else if(confDesc.corrDesc.correlation_type & FC_POINTER_CONFORMANCE) // case of FC_TOP_LEVEL_MULTID_CONFORMANCE
else if(confDesc.corrDesc.correlation_type & FC_TOP_LEVEL_MULTID_CONFORMANCE) // case of FC_TOP_LEVEL_MULTID_CONFORMANCE
{
// currently not implemented
oss<<"/*FC_TOP_LEVEL_MULTID_CONFORMANCE not implemented */)]";
RpcDecompiler/RpcDecompiler.cpp
-123
View File
@@ -39,7 +39,6 @@ extern "C" {
BOOL __fastcall RpcDecompilerPrintOneProcedure(VOID* pRpcDecompilerCtxt, UINT ProcIndex, std::list<TypeToDefine>& listProcType, std::ostringstream& ossProc);
BOOL __fastcall RpcDecompilerDecodeOneProcedureInlined(VOID* pContext, UINT ProcIndex, IdlFunctionDesc& IdlFunctionDesc, std::list<TypeToDefine>& listProcType);
BOOL __fastcall RpcDecompilerPrintOneProcedureInlined(VOID* pContext, UINT ProcOffset, IdlFunctionDesc& IdlFunctionDesc, std::list<TypeToDefine>& listProcType, std::ostringstream& ossProc);
BOOL __fastcall RpcDecompilerPrintHiddenFUProcedure(VOID* pRpcDecompilerCtxt, UINT * procOffset, std::list<TypeToDefine>& listProcType, std::ostringstream& ossProc);
BOOL __fastcall RpcDecompilerPrintAllProceduresNew(VOID* pRpcDecompilerCtxt);
@@ -445,128 +444,6 @@ End:
return (bResult);
}
BOOL __fastcall RpcDecompilerPrintHiddenFUProcedure(VOID* pContext, UINT * procOffset, std::list<TypeToDefine>& listProcType, std::ostringstream& ossProc)
{
UINT paramSizeInBytes = RPC_DECOMPILER_INVALID_PARAM_SIZE;
BOOL bResult = FALSE;
RpcDecompilerCtxt_T* pRpcDecompilerCtxt = (RpcDecompilerCtxt_T*)pContext;
UINT paramOffset = 0;
UINT numParam = 0;
BOOL isReturnParam = FALSE;
BOOL nextIsReturnParam = FALSE;
UINT sizeOfProcDescr = 0;
IdlFunctionDesc IdlFunctionDesc;
if (pRpcDecompilerCtxt == NULL) goto End;
if (pRpcDecompilerCtxt->pRpcViewHelper == NULL) goto End;
if (pRpcDecompilerCtxt->pRpcDecompilerInfo == NULL) goto End;
if (pRpcDecompilerCtxt->pRpcDecompilerInfo->pProcFormatString == NULL) goto End;
RVA_T pFunction = pRpcDecompilerCtxt->pRpcDecompilerInfo->pProcFormatString + *procOffset;
// carriage return before display function
//ossProc << "\t/* Function 0x" << std::hex << ProcIndex<< " */"<< std::endl;
ossProc << std::endl;
//RpcDecompilerPrintFunctionDbgInfo(pContext, *procOffset, ossProc);
ossProc << "\t /* Function index : 0x" << std::hex << *procOffset;
ossProc << "\t Module Base : 0x" << (unsigned long) pRpcDecompilerCtxt->pRpcDecompilerInfo->pModuleBase;
ossProc << "\t RVA of proc in format string : 0x" << (unsigned long) ((UINT64)pFunction - pRpcDecompilerCtxt->pRpcDecompilerInfo->pModuleBase);
ossProc << " */"<<std::endl;
//todo
bResult = RpcDecompilerDecodeAndPrintPrototypeReturnType(
/* in */ pRpcDecompilerCtxt,
/* in */ *procOffset,
/* out */ &paramOffset,
/* out */ &sizeOfProcDescr,
/* out */ IdlFunctionDesc,
/* in/out */listProcType,
/* in/out */ ossProc);
if (bResult == FALSE) goto End;
ossProc << " _HiddenFunction_" << std::dec << *procOffset << "(";
// Increment procOffset to read the next procedure description
*procOffset += sizeOfProcDescr;
if (bResult == FALSE) goto End;
RPC_DEBUG_FN((UCHAR*)"\nRpcDecompilerPrintProcedure: RpcDecompilerPrintPrototypeName returned nbParamToPrint = %d\n", IdlFunctionDesc.getNbParam());
if(IdlFunctionDesc.getNbParam() == 0)
{
//No parameter to be printed
ossProc << " void ";
}
//Print each parameter
while( (numParam < IdlFunctionDesc.getNbParam()) )
{
RPC_DEBUG_FN((UCHAR*)"\nRpcDecompilerPrintProcedure: numParam = 0x%x on total to print = 0x%x\n", numParam, IdlFunctionDesc.getNbParam());
bResult = RpcDecompilerGetReturnParamInfo(/* in */ pRpcDecompilerCtxt, /* in */ paramOffset, /* in */ paramDescrOif, /* out */ &isReturnParam);
if (bResult == FALSE) goto End;
if( ! isReturnParam)
{
//Print the parameter
bResult = RpcDecompilerPrintParam(
/* in */ pRpcDecompilerCtxt,
/* in */ paramOffset,
/* in */ paramDescrOif,
/* out */ &paramSizeInBytes,
/* in */ IdlFunctionDesc,
listProcType,
ossProc); //TODO : décompiler paramDescrOi en plus de paramDescrOif
if (bResult == FALSE || paramSizeInBytes == RPC_DECOMPILER_INVALID_PARAM_SIZE)
{
displayErrorMessage(ossProc, "RpcDecompilerPrintOneProcedure : unable to decode param");
goto End;
}
}
else
{
paramSizeInBytes = OIF_PARAM_SIZE; //TODO : traiter le cas où codage pas OIF
}
paramOffset += paramSizeInBytes;//paramSizeInBytes;
numParam++;
RPC_DEBUG_FN((UCHAR*)"\nRpcDecompilerPrintProcedure: paramOffset = %d, numParam = %d\n", paramOffset, numParam);
//Is there one additionnal parameter to be printed ?
if ( (! isReturnParam) && (numParam < IdlFunctionDesc.getNbParam()) )
{
//The last parameter has been printed because it was not a return parameter
//There is still at least 1 parameter to be printed
bResult = RpcDecompilerGetReturnParamInfo(/* in */ pRpcDecompilerCtxt, /* in */ paramOffset, /* in */ paramDescrOif, /* out */ &nextIsReturnParam);
if (bResult == FALSE) goto End;
if (! nextIsReturnParam)
{
//The next parameter will have to be printed because it is not a return parameter
ossProc << ", ";
}
}
}//while(numParam <= IdlFunctionDesc.getNbParam());
// Print the end of the procedure prototype
ossProc<<");"<<std::endl;
bResult = TRUE;
End:
return (bResult);
}
//------------------------------------------------------------------------------
VOID __fastcall RpcDecompilerPrintFunctionDbgInfo(VOID* pContext, UINT procIndex, std::ostringstream& oss)
{
RpcDecompiler/internalComplexTypesArrays.cpp
+2 -1
View File
@@ -1043,7 +1043,7 @@ BOOL __fastcall processComplexArray(
oss<<" /* ";
for(j; j<i; j++){
if(callbacksCalled[j] != -1)
if(callbacksCalled[j] != (UINT16)-1)
{
oss<<" callback_"<<std::dec<<callbacksCalled[j]<<" used, ";
}
@@ -1104,6 +1104,7 @@ UINT __fastcall getArrayMemorySize(
case FC_LGVARRAY:
RPC_GET_PROCESS_DATA(pType, &longArray, sizeof(LGFixedSizedArrayHeader_t));
arraySize = longArray.totalSize;
break;
default:
arraySize = POINTER_SIZE;
break;
RpcView/RpcView.cpp
+4 -2
View File
@@ -328,12 +328,12 @@ End:
HICON hMainIcon;
UCHAR CurrentDirectory[MAX_PATH];
UCHAR* pSeparator;
int ret = 0;
int ret = 0;
#ifdef _DEBUG
_CrtSetReportMode(_CRT_WARN, _CRTDBG_MODE_FILE);
_CrtSetReportFile(_CRT_WARN, _CRTDBG_FILE_STDOUT);
#else
int argc = 0;
int argc = 0;
UNREFERENCED_PARAMETER(hInstance);
UNREFERENCED_PARAMETER(hPrevInstance);
@@ -343,6 +343,8 @@ End:
LPWSTR* argvw = CommandLineToArgvW(pCmdLine, &argc);
char** argv = (char**)malloc(argc*sizeof(char*));
if (argv == NULL) return ret;
for (int i = 0; i < argc; i++)
{
size_t tmpSize = lstrlenW(argvw[i]) * 2 + 2;