x64dbg
/
TitanEngine
mirror of https://github.com/x64dbg/TitanEngine
1
0
Fork 0
Code Releases Activity

- updated readme (basically it says: LUA, Python and MASM are not tested with these updates) 

- re-added UE_HIDE_PEBONLY (thanks to cypherpunk for the report)
This commit is contained in:
mr.exodia 2013-10-13 23:39:06 +02:00
parent 071841d3da
commit 0a2d5747b6
10 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
Release/x32/TitanEngine.dll
View File

Binary file not shown.

BIN
Release/x32/TitanEngine.exp
View File

Binary file not shown.

BIN
Release/x32/TitanEngine.lib
View File

Binary file not shown.

BIN
Release/x64/TitanEngine.dll
View File

Binary file not shown.

BIN
Release/x64/TitanEngine.exp
View File

Binary file not shown.

BIN
Release/x64/TitanEngine.lib
View File

Binary file not shown.

1
SDK/C/TitanEngine.h
View File

@ -17,6 +17,7 @@
#define UE_ACCESS_WRITE 1 #define UE_ACCESS_WRITE 1
#define UE_ACCESS_ALL 2 #define UE_ACCESS_ALL 2
#define UE_HIDE_PEBONLY 0
#define UE_HIDE_BASIC 1 #define UE_HIDE_BASIC 1
#define UE_PLUGIN_CALL_REASON_PREDEBUG 1 #define UE_PLUGIN_CALL_REASON_PREDEBUG 1

1
SDK/CPP/TitanEngine.h
View File

@ -17,6 +17,7 @@ const BYTE UE_ACCESS_READ = 0;
const BYTE UE_ACCESS_WRITE = 1; const BYTE UE_ACCESS_WRITE = 1;
const BYTE UE_ACCESS_ALL = 2; const BYTE UE_ACCESS_ALL = 2;
const BYTE UE_HIDE_PEBONLY = 0;
const BYTE UE_HIDE_BASIC = 1; const BYTE UE_HIDE_BASIC = 1;
const BYTE UE_PLUGIN_CALL_REASON_PREDEBUG = 1; const BYTE UE_PLUGIN_CALL_REASON_PREDEBUG = 1;

5
TitanEngine/TitanEngine.cpp
View File

@ -10439,7 +10439,6 @@ __declspec(dllexport) bool TITCALL IsFileDLLW(wchar_t* szFileName, ULONG_PTR Fil
// Global.Engine.Hider.functions: // Global.Engine.Hider.functions:
bool ChangeHideDebuggerState(HANDLE hProcess, DWORD PatchAPILevel, bool Hide) bool ChangeHideDebuggerState(HANDLE hProcess, DWORD PatchAPILevel, bool Hide)
{ {
ULONG_PTR AddressOfPEB = NULL; ULONG_PTR AddressOfPEB = NULL;
ULONG_PTR ueNumberOfBytesRead = NULL; ULONG_PTR ueNumberOfBytesRead = NULL;
BYTE patchCheckRemoteDebuggerPresent[5] = {0x33, 0xC0, 0xC2, 0x08, 0x00}; BYTE patchCheckRemoteDebuggerPresent[5] = {0x33, 0xC0, 0xC2, 0x08, 0x00};
@ -10460,7 +10459,7 @@ bool ChangeHideDebuggerState(HANDLE hProcess, DWORD PatchAPILevel, bool Hide)
myPEB.NtGlobalFlag = NULL; myPEB.NtGlobalFlag = NULL;
if(WriteProcessMemory(hProcess, (void*)AddressOfPEB, (void*)&myPEB, sizeof NTPEB, &ueNumberOfBytesRead)) if(WriteProcessMemory(hProcess, (void*)AddressOfPEB, (void*)&myPEB, sizeof NTPEB, &ueNumberOfBytesRead))
{ {
if(PatchAPILevel >= 1) if(PatchAPILevel == UE_HIDE_BASIC)
{ {
APIPatchAddress = (ULONG_PTR)EngineGlobalAPIHandler(hProcess, NULL, (ULONG_PTR)GetProcAddress(GetModuleHandleA("kernel32.dll"),"CheckRemoteDebuggerPresent"), NULL, UE_OPTION_IMPORTER_REALIGN_APIADDRESS); APIPatchAddress = (ULONG_PTR)EngineGlobalAPIHandler(hProcess, NULL, (ULONG_PTR)GetProcAddress(GetModuleHandleA("kernel32.dll"),"CheckRemoteDebuggerPresent"), NULL, UE_OPTION_IMPORTER_REALIGN_APIADDRESS);
VirtualQueryEx(dbgProcessInformation.hProcess, (LPVOID)APIPatchAddress, &MemInfo, sizeof MEMORY_BASIC_INFORMATION); VirtualQueryEx(dbgProcessInformation.hProcess, (LPVOID)APIPatchAddress, &MemInfo, sizeof MEMORY_BASIC_INFORMATION);
@ -10486,7 +10485,7 @@ bool ChangeHideDebuggerState(HANDLE hProcess, DWORD PatchAPILevel, bool Hide)
myPEB.BeingDebugged = true; myPEB.BeingDebugged = true;
if(WriteProcessMemory(hProcess, (void*)AddressOfPEB, (void*)&myPEB, sizeof NTPEB, &ueNumberOfBytesRead)) if(WriteProcessMemory(hProcess, (void*)AddressOfPEB, (void*)&myPEB, sizeof NTPEB, &ueNumberOfBytesRead))
{ {
if(PatchAPILevel >= 1) if(PatchAPILevel == UE_HIDE_BASIC)
{ {
APIPatchAddress = (ULONG_PTR)EngineGlobalAPIHandler(hProcess, NULL, (ULONG_PTR)GetProcAddress(GetModuleHandleA("kernel32.dll"),"CheckRemoteDebuggerPresent"), NULL, UE_OPTION_IMPORTER_REALIGN_APIADDRESS); APIPatchAddress = (ULONG_PTR)EngineGlobalAPIHandler(hProcess, NULL, (ULONG_PTR)GetProcAddress(GetModuleHandleA("kernel32.dll"),"CheckRemoteDebuggerPresent"), NULL, UE_OPTION_IMPORTER_REALIGN_APIADDRESS);
VirtualQueryEx(dbgProcessInformation.hProcess, (LPVOID)APIPatchAddress, &MemInfo, sizeof MEMORY_BASIC_INFORMATION); VirtualQueryEx(dbgProcessInformation.hProcess, (LPVOID)APIPatchAddress, &MemInfo, sizeof MEMORY_BASIC_INFORMATION);

2
readme.txt
View File

@ -14,3 +14,5 @@ The following things have been fixed/added (list might be incomplete):
- supports multiple calling conventions (including the callbacks) - supports multiple calling conventions (including the callbacks)
- MinGW import libraries - MinGW import libraries
- fixed exception handling - fixed exception handling
NOTE: LUA, Python, MASM and Delphi might not work correctly.