From 085e6ae7a9134d0b01a18d3324e789cf4b4ec3c6 Mon Sep 17 00:00:00 2001 From: "Mr. eXoDia" Date: Tue, 11 Mar 2014 15:25:17 +0100 Subject: [PATCH] - added function ImporterGetDLLNameFromDebugeeW - fixed function ImporterGetDLLNameFromDebugee - added function EngineGetModuleBaseRemote - added function EngineGetAPIAddressRemote - added function EngineGetAPIAddressLocal - fixed a potential bug in SetAPIBreakPoint & DeleteAPIBreakPoint - fixed ImpoerterGetDLLName (this function is used on the local process) - fixed function ImporterGetDLLNameW & ImporterGetDLLName - moved fixed functions up --- SDK/C/TitanEngine.h | 1 + SDK/CPP/TitanEngine.h | 1 + SDK/CPP/TitanEngine.hpp | 5 ++ TitanEngine/Global.Engine.Importer.cpp | 112 +++++++++++++++++++++--- TitanEngine/Global.Engine.Importer.h | 10 ++- TitanEngine/TitanEngine.Breakpoints.cpp | 12 +-- TitanEngine/TitanEngine.Importer.cpp | 106 ++++++++-------------- TitanEngine/definitions.h | 1 + 8 files changed, 157 insertions(+), 91 deletions(-) diff --git a/SDK/C/TitanEngine.h b/SDK/C/TitanEngine.h index 2780061..62b0cfa 100644 --- a/SDK/C/TitanEngine.h +++ b/SDK/C/TitanEngine.h @@ -751,6 +751,7 @@ __declspec(dllexport) long long TITCALL ImporterGetRemoteAPIAddress(HANDLE hProc __declspec(dllexport) long long TITCALL ImporterGetRemoteAPIAddressEx(char* szDLLName, char* szAPIName); __declspec(dllexport) long long TITCALL ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugeeW(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) void* TITCALL ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) long long TITCALL ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) long TITCALL ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); diff --git a/SDK/CPP/TitanEngine.h b/SDK/CPP/TitanEngine.h index cf36aff..7617623 100644 --- a/SDK/CPP/TitanEngine.h +++ b/SDK/CPP/TitanEngine.h @@ -750,6 +750,7 @@ __declspec(dllimport) long long TITCALL ImporterGetRemoteAPIAddress(HANDLE hProc __declspec(dllimport) long long TITCALL ImporterGetRemoteAPIAddressEx(char* szDLLName, char* szAPIName); __declspec(dllimport) long long TITCALL ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllimport) void* TITCALL ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugeeW(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllimport) void* TITCALL ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllimport) long long TITCALL ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllimport) long TITCALL ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); diff --git a/SDK/CPP/TitanEngine.hpp b/SDK/CPP/TitanEngine.hpp index 6acee5b..e7c53ea 100644 --- a/SDK/CPP/TitanEngine.hpp +++ b/SDK/CPP/TitanEngine.hpp @@ -1721,6 +1721,10 @@ protected: { return (const char*)UE::ImporterGetDLLNameFromDebugee(hProcess, APIAddress); } + static const wchar_t* GetDLLNameFromDebugeeW(HANDLE hProcess, ULONG_PTR APIAddress) + { + return (const wchar_t*)UE::ImporterGetDLLNameFromDebugeeW(hProcess, APIAddress); + } static const char* GetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress) { return (const char*)UE::ImporterGetAPINameFromDebugee(hProcess, APIAddress); @@ -1888,6 +1892,7 @@ public: using ImporterX::GetRemoteAPIAddressEx; using ImporterX::GetLocalAPIAddress; using ImporterX::GetDLLNameFromDebugee; + using ImporterX::GetDLLNameFromDebugeeW; using ImporterX::GetAPINameFromDebugee; using ImporterX::GetAPIOrdinalNumberFromDebugee; using ImporterX::GetDLLIndexEx; diff --git a/TitanEngine/Global.Engine.Importer.cpp b/TitanEngine/Global.Engine.Importer.cpp index 42e6d0d..eff9145 100644 --- a/TitanEngine/Global.Engine.Importer.cpp +++ b/TitanEngine/Global.Engine.Importer.cpp @@ -4,7 +4,7 @@ #include "Global.Debugger.h" #include -ULONG_PTR EngineGetProcAddressRemote(HANDLE hProcess, const WCHAR * szDLLName, const char* szAPIName) +ULONG_PTR EngineGetProcAddressRemote(HANDLE hProcess, const wchar_t* szDLLName, const char* szAPIName) { if(!hProcess) //no process specified { @@ -52,12 +52,7 @@ ULONG_PTR EngineGetProcAddressRemote(HANDLE hProcess, const WCHAR * szDLLName, c return 0; } -ULONG_PTR EngineGetProcAddressRemote(const WCHAR * szDLLName, const char* szAPIName) -{ - return EngineGetProcAddressRemote(0, szDLLName, szAPIName); -} - -ULONG_PTR EngineGetProcAddressRemote(HANDLE hProcess, const char * szDLLName, const char* szAPIName) +ULONG_PTR EngineGetProcAddressRemote(HANDLE hProcess, const char* szDLLName, const char* szAPIName) { WCHAR uniDLLName[MAX_PATH] = {0}; if (MultiByteToWideChar(CP_ACP, NULL, szDLLName, -1, uniDLLName, _countof(uniDLLName))) @@ -70,11 +65,6 @@ ULONG_PTR EngineGetProcAddressRemote(HANDLE hProcess, const char * szDLLName, co } } -ULONG_PTR EngineGetProcAddressRemote(const char * szDLLName, const char* szAPIName) -{ - return EngineGetProcAddressRemote(0, szDLLName, szAPIName); -} - ULONG_PTR EngineGetModuleBaseRemote(HANDLE hProcess, ULONG_PTR APIAddress) { if(!hProcess) //no process specified @@ -107,3 +97,101 @@ ULONG_PTR EngineGetModuleBaseRemote(HANDLE hProcess, ULONG_PTR APIAddress) } return 0; } + +ULONG_PTR EngineGetModuleBaseRemote(HANDLE hProcess, const wchar_t* szDLLName) +{ + if(!hProcess) //no process specified + { + if(!dbgProcessInformation.hProcess) + hProcess = GetCurrentProcess(); + else + hProcess = dbgProcessInformation.hProcess; + } + DWORD cbNeeded=0; + if(EnumProcessModules(hProcess, 0, 0, &cbNeeded)) + { + HMODULE* hMods=(HMODULE*)malloc(cbNeeded*sizeof(HMODULE)); + if(EnumProcessModules(hProcess, hMods, cbNeeded, &cbNeeded)) + { + for(unsigned int i=0; i NULL) - { - if(_wcsicmp(RemoteDLLName, szModuleName) == 0) - { - return (void*)EnumeratedModules[i]; - } - } - } - } - return 0; -} -__declspec(dllexport) long long TITCALL ImporterGetRemoteDLLBaseEx(HANDLE hProcess, char* szModuleName) -{ - WCHAR uniModuleName[MAX_PATH] = {0}; - if (MultiByteToWideChar(CP_ACP, NULL, szModuleName, -1, uniModuleName, _countof(uniModuleName))) - { - return (long long)ImporterGetRemoteDLLBaseExW(hProcess, uniModuleName); - } - else - { - return 0; - } -} __declspec(dllexport) bool TITCALL ImporterIsForwardedAPI(HANDLE hProcess, ULONG_PTR APIAddress) { diff --git a/TitanEngine/definitions.h b/TitanEngine/definitions.h index 00d0578..4dbf099 100644 --- a/TitanEngine/definitions.h +++ b/TitanEngine/definitions.h @@ -257,6 +257,7 @@ __declspec(dllexport) long long TITCALL ImporterGetRemoteAPIAddress(HANDLE hProc __declspec(dllexport) long long TITCALL ImporterGetRemoteAPIAddressEx(char* szDLLName, char* szAPIName); __declspec(dllexport) long long TITCALL ImporterGetLocalAPIAddress(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameFromDebugeeW(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) void* TITCALL ImporterGetAPINameFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) long long TITCALL ImporterGetAPIOrdinalNumberFromDebugee(HANDLE hProcess, ULONG_PTR APIAddress); __declspec(dllexport) long TITCALL ImporterGetDLLIndexEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);