diff --git a/SDK/C/TitanEngine.h b/SDK/C/TitanEngine.h index 2780061..62b0cfa 100644 --- a/SDK/C/TitanEngine.h +++ b/SDK/C/TitanEngine.h @@ -751,6 +751,7 @@ __declspec(dllexport) long long TITCALL ImporterGetRemoteAPIAddress(HANDLE hProc __declspec(dllexport) long long TITCALL ImporterGetRemoteAPIAddressEx(char* szDLLName, char* szAPIName); __declspec(dllexport) long long TITCALL ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugeeW(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) void* TITCALL ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) long long TITCALL ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) long TITCALL ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); diff --git a/SDK/CPP/TitanEngine.h b/SDK/CPP/TitanEngine.h index cf36aff..7617623 100644 --- a/SDK/CPP/TitanEngine.h +++ b/SDK/CPP/TitanEngine.h @@ -750,6 +750,7 @@ __declspec(dllimport) long long TITCALL ImporterGetRemoteAPIAddress(HANDLE hProc __declspec(dllimport) long long TITCALL ImporterGetRemoteAPIAddressEx(char* szDLLName, char* szAPIName); __declspec(dllimport) long long TITCALL ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllimport) void* TITCALL ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugeeW(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllimport) void* TITCALL ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllimport) long long TITCALL ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllimport) long TITCALL ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); diff --git a/SDK/CPP/TitanEngine.hpp b/SDK/CPP/TitanEngine.hpp index 6acee5b..e7c53ea 100644 --- a/SDK/CPP/TitanEngine.hpp +++ b/SDK/CPP/TitanEngine.hpp @@ -1721,6 +1721,10 @@ protected: { return (const char*)UE::ImporterGetDLLNameFromDebugee(hProcess, APIAddress); } + static const wchar_t* GetDLLNameFromDebugeeW(HANDLE hProcess, ULONG_PTR APIAddress) + { + return (const wchar_t*)UE::ImporterGetDLLNameFromDebugeeW(hProcess, APIAddress); + } static const char* GetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress) { return (const char*)UE::ImporterGetAPINameFromDebugee(hProcess, APIAddress); @@ -1888,6 +1892,7 @@ public: using ImporterX::GetRemoteAPIAddressEx; using ImporterX::GetLocalAPIAddress; using ImporterX::GetDLLNameFromDebugee; + using ImporterX::GetDLLNameFromDebugeeW; using ImporterX::GetAPINameFromDebugee; using ImporterX::GetAPIOrdinalNumberFromDebugee; using ImporterX::GetDLLIndexEx; diff --git a/TitanEngine/Global.Engine.Importer.cpp b/TitanEngine/Global.Engine.Importer.cpp index 42e6d0d..eff9145 100644 --- a/TitanEngine/Global.Engine.Importer.cpp +++ b/TitanEngine/Global.Engine.Importer.cpp @@ -4,7 +4,7 @@ #include "Global.Debugger.h" #include -ULONG_PTR EngineGetProcAddressRemote(HANDLE hProcess, const WCHAR * szDLLName, const char* szAPIName) +ULONG_PTR EngineGetProcAddressRemote(HANDLE hProcess, const wchar_t* szDLLName, const char* szAPIName) { if(!hProcess) //no process specified { @@ -52,12 +52,7 @@ ULONG_PTR EngineGetProcAddressRemote(HANDLE hProcess, const WCHAR * szDLLName, c return 0; } -ULONG_PTR EngineGetProcAddressRemote(const WCHAR * szDLLName, const char* szAPIName) -{ - return EngineGetProcAddressRemote(0, szDLLName, szAPIName); -} - -ULONG_PTR EngineGetProcAddressRemote(HANDLE hProcess, const char * szDLLName, const char* szAPIName) +ULONG_PTR EngineGetProcAddressRemote(HANDLE hProcess, const char* szDLLName, const char* szAPIName) { WCHAR uniDLLName[MAX_PATH] = {0}; if (MultiByteToWideChar(CP_ACP, NULL, szDLLName, -1, uniDLLName, _countof(uniDLLName))) @@ -70,11 +65,6 @@ ULONG_PTR EngineGetProcAddressRemote(HANDLE hProcess, const char * szDLLName, co } } -ULONG_PTR EngineGetProcAddressRemote(const char * szDLLName, const char* szAPIName) -{ - return EngineGetProcAddressRemote(0, szDLLName, szAPIName); -} - ULONG_PTR EngineGetModuleBaseRemote(HANDLE hProcess, ULONG_PTR APIAddress) { if(!hProcess) //no process specified @@ -107,3 +97,101 @@ ULONG_PTR EngineGetModuleBaseRemote(HANDLE hProcess, ULONG_PTR APIAddress) } return 0; } + +ULONG_PTR EngineGetModuleBaseRemote(HANDLE hProcess, const wchar_t* szDLLName) +{ + if(!hProcess) //no process specified + { + if(!dbgProcessInformation.hProcess) + hProcess = GetCurrentProcess(); + else + hProcess = dbgProcessInformation.hProcess; + } + DWORD cbNeeded=0; + if(EnumProcessModules(hProcess, 0, 0, &cbNeeded)) + { + HMODULE* hMods=(HMODULE*)malloc(cbNeeded*sizeof(HMODULE)); + if(EnumProcessModules(hProcess, hMods, cbNeeded, &cbNeeded)) + { + for(unsigned int i=0; i NULL) - { - if(_wcsicmp(RemoteDLLName, szModuleName) == 0) - { - return (void*)EnumeratedModules[i]; - } - } - } - } - return 0; -} -__declspec(dllexport) long long TITCALL ImporterGetRemoteDLLBaseEx(HANDLE hProcess, char* szModuleName) -{ - WCHAR uniModuleName[MAX_PATH] = {0}; - if (MultiByteToWideChar(CP_ACP, NULL, szModuleName, -1, uniModuleName, _countof(uniModuleName))) - { - return (long long)ImporterGetRemoteDLLBaseExW(hProcess, uniModuleName); - } - else - { - return 0; - } -} __declspec(dllexport) bool TITCALL ImporterIsForwardedAPI(HANDLE hProcess, ULONG_PTR APIAddress) { diff --git a/TitanEngine/definitions.h b/TitanEngine/definitions.h index 00d0578..4dbf099 100644 --- a/TitanEngine/definitions.h +++ b/TitanEngine/definitions.h @@ -257,6 +257,7 @@ __declspec(dllexport) long long TITCALL ImporterGetRemoteAPIAddress(HANDLE hProc __declspec(dllexport) long long TITCALL ImporterGetRemoteAPIAddressEx(char* szDLLName, char* szAPIName); __declspec(dllexport) long long TITCALL ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugeeW(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) void* TITCALL ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) long long TITCALL ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) long TITCALL ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);