diff --git a/SDK/C/TitanEngine.h b/SDK/C/TitanEngine.h index e6d5ef4..2780061 100644 --- a/SDK/C/TitanEngine.h +++ b/SDK/C/TitanEngine.h @@ -743,6 +743,7 @@ __declspec(dllexport) long long TITCALL ImporterFindOrdinalAPIWriteLocation(ULON __declspec(dllexport) long long TITCALL ImporterFindAPIByWriteLocation(ULONG_PTR APIWriteLocation); __declspec(dllexport) long long TITCALL ImporterFindDLLByWriteLocation(ULONG_PTR APIWriteLocation); __declspec(dllexport) void* TITCALL ImporterGetDLLName(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameW(ULONG_PTR APIAddress); __declspec(dllexport) void* TITCALL ImporterGetAPIName(ULONG_PTR APIAddress); __declspec(dllexport) long long TITCALL ImporterGetAPIOrdinalNumber(ULONG_PTR APIAddress); __declspec(dllexport) void* TITCALL ImporterGetAPINameEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); diff --git a/SDK/CPP/TitanEngine.h b/SDK/CPP/TitanEngine.h index e648e01..cf36aff 100644 --- a/SDK/CPP/TitanEngine.h +++ b/SDK/CPP/TitanEngine.h @@ -742,6 +742,7 @@ __declspec(dllimport) long long TITCALL ImporterFindOrdinalAPIWriteLocation(ULON __declspec(dllimport) long long TITCALL ImporterFindAPIByWriteLocation(ULONG_PTR APIWriteLocation); __declspec(dllimport) long long TITCALL ImporterFindDLLByWriteLocation(ULONG_PTR APIWriteLocation); __declspec(dllimport) void* TITCALL ImporterGetDLLName(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameW(ULONG_PTR APIAddress); __declspec(dllimport) void* TITCALL ImporterGetAPIName(ULONG_PTR APIAddress); __declspec(dllimport) long long TITCALL ImporterGetAPIOrdinalNumber(ULONG_PTR APIAddress); __declspec(dllimport) void* TITCALL ImporterGetAPINameEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList); diff --git a/SDK/CPP/TitanEngine.hpp b/SDK/CPP/TitanEngine.hpp index 603a486..6acee5b 100644 --- a/SDK/CPP/TitanEngine.hpp +++ b/SDK/CPP/TitanEngine.hpp @@ -1689,6 +1689,10 @@ protected: { return (const char*)UE::ImporterGetDLLName(APIAddress); } + static const wchar_t* GetDLLNameW(ULONG_PTR APIAddress) + { + return (const wchar_t*)UE::ImporterGetDLLNameW(APIAddress); + } static const char* GetAPIName(ULONG_PTR APIAddress) { return (const char*)UE::ImporterGetAPIName(APIAddress); @@ -1737,14 +1741,14 @@ protected: { return UE::ImporterGetRemoteDLLBase(hProcess, LocalModuleBase); } - static long long GetRemoteDLLBaseEx(HANDLE hProcess, char* szModuleName) - { - return UE::ImporterGetRemoteDLLBaseEx(hProcess, szModuleName); - } - static void* GetRemoteDLLBaseExW(HANDLE hProcess, WCHAR* szModuleName) - { - return UE::ImporterGetRemoteDLLBaseExW(hProcess, szModuleName); - } + static long long GetRemoteDLLBaseEx(HANDLE hProcess, char* szModuleName) + { + return UE::ImporterGetRemoteDLLBaseEx(hProcess, szModuleName); + } + static void* GetRemoteDLLBaseExW(HANDLE hProcess, WCHAR* szModuleName) + { + return UE::ImporterGetRemoteDLLBaseExW(hProcess, szModuleName); + } static bool IsForwardedAPI(HANDLE hProcess, ULONG_PTR APIAddress) { return UE::ImporterIsForwardedAPI(hProcess, APIAddress); @@ -1876,6 +1880,7 @@ public: using ImporterX::FindAPIByWriteLocation; using ImporterX::FindDLLByWriteLocation; using ImporterX::GetDLLName; + using ImporterX::GetDLLNameW; using ImporterX::GetAPIName; using ImporterX::GetAPIOrdinalNumber; using ImporterX::GetAPINameEx; diff --git a/TitanEngine/Global.Engine.Importer.cpp b/TitanEngine/Global.Engine.Importer.cpp index 463899f..42e6d0d 100644 --- a/TitanEngine/Global.Engine.Importer.cpp +++ b/TitanEngine/Global.Engine.Importer.cpp @@ -8,62 +8,47 @@ ULONG_PTR EngineGetProcAddressRemote(HANDLE hProcess, const WCHAR * szDLLName, c { if(!hProcess) //no process specified { - if(dbgProcessInformation.hProcess == 0) - { + if(!dbgProcessInformation.hProcess) hProcess = GetCurrentProcess(); - } else - { hProcess = dbgProcessInformation.hProcess; - } } - DWORD cbNeeded = 0; - HMODULE EnumeratedModules[1024] = {0}; - WCHAR RemoteDLLPath[MAX_PATH] = {0}; - HMODULE hModuleLocal = GetModuleHandleW(szDLLName); - WCHAR * dllName; - - if(EnumProcessModules(hProcess, EnumeratedModules, sizeof(EnumeratedModules), &cbNeeded)) + DWORD cbNeeded=0; + if(EnumProcessModules(hProcess, 0, 0, &cbNeeded)) { - for(int i = 0; i < (int)(cbNeeded / sizeof(HMODULE)); i++) + HMODULE* hMods=(HMODULE*)malloc(cbNeeded*sizeof(HMODULE)); + if(EnumProcessModules(hProcess, hMods, cbNeeded, &cbNeeded)) { - RemoteDLLPath[0] = 0; - if(GetModuleFileNameExW(hProcess, EnumeratedModules[i], RemoteDLLPath, _countof(RemoteDLLPath)) > 0) + for(unsigned int i=0; i=start && APIAddress @@ -16,6 +17,7 @@ __declspec(dllexport) void TITCALL ImporterAddNewDll(char* szDLLName, ULONG_PTR scylla_addModule(uniDLLName, FirstThunk); } + __declspec(dllexport) void TITCALL ImporterAddNewAPI(char* szAPIName, ULONG_PTR ThunkValue) { wchar_t uniAPIName[MAX_PATH] = {}; @@ -24,88 +26,106 @@ __declspec(dllexport) void TITCALL ImporterAddNewAPI(char* szAPIName, ULONG_PTR scylla_addImport(uniAPIName, ThunkValue); } + __declspec(dllexport) void TITCALL ImporterAddNewOrdinalAPI(ULONG_PTR OrdinalNumber, ULONG_PTR ThunkValue) { - - if(OrdinalNumber & IMAGE_ORDINAL_FLAG) - { - OrdinalNumber = OrdinalNumber ^ IMAGE_ORDINAL_FLAG; - ImporterAddNewAPI((char*)OrdinalNumber, ThunkValue); - } - else - { - ImporterAddNewAPI((char*)OrdinalNumber, ThunkValue); - } + ImporterAddNewAPI((char*)(OrdinalNumber&~IMAGE_ORDINAL_FLAG), ThunkValue); } + __declspec(dllexport) long TITCALL ImporterGetAddedDllCount() { return scylla_getModuleCount(); } + __declspec(dllexport) long TITCALL ImporterGetAddedAPICount() { return scylla_getImportCount(); } + __declspec(dllexport) bool TITCALL ImporterExportIAT(ULONG_PTR StorePlace, ULONG_PTR FileMapVA, HANDLE hFileMap) { - if(scylla_fixMappedDump(StorePlace, FileMapVA, hFileMap) != SCY_ERROR_SUCCESS) - { - return false; - } - - return true; + return (scylla_fixMappedDump(StorePlace, FileMapVA, hFileMap) == SCY_ERROR_SUCCESS); } + __declspec(dllexport) long TITCALL ImporterEstimatedSize() { return scylla_estimatedIATSize(); } + __declspec(dllexport) bool TITCALL ImporterExportIATEx(char* szDumpFileName, char* szExportFileName, char* szSectionName) { - wchar_t uniExportFileName[MAX_PATH] = {}; wchar_t uniDumpFileName[MAX_PATH] = {}; wchar_t uniSectionName[MAX_PATH] = {}; - if(szExportFileName != NULL && szDumpFileName != NULL) { MultiByteToWideChar(CP_ACP, NULL, szExportFileName, lstrlenA(szExportFileName)+1, uniExportFileName, sizeof(uniExportFileName)/(sizeof(uniExportFileName[0]))); MultiByteToWideChar(CP_ACP, NULL, szDumpFileName, lstrlenA(szDumpFileName)+1, uniDumpFileName, sizeof(uniDumpFileName)/(sizeof(uniDumpFileName[0]))); MultiByteToWideChar(CP_ACP, NULL, szSectionName, lstrlenA(szSectionName)+1, uniSectionName, sizeof(uniSectionName)/(sizeof(uniSectionName[0]))); - return(ImporterExportIATExW(uniDumpFileName, uniExportFileName, uniSectionName)); - } - else - { - return false; + return ImporterExportIATExW(uniDumpFileName, uniExportFileName, uniSectionName); } + return false; } + __declspec(dllexport) bool TITCALL ImporterExportIATExW(wchar_t* szDumpFileName, wchar_t* szExportFileName, wchar_t* szSectionName) { - if(scylla_fixDump(szDumpFileName, szExportFileName, szSectionName) != SCY_ERROR_SUCCESS) - { - return false; - } - - return true; + return (scylla_fixDump(szDumpFileName, szExportFileName, szSectionName) == SCY_ERROR_SUCCESS); } + __declspec(dllexport) long long TITCALL ImporterFindAPIWriteLocation(char* szAPIName) { - return(scylla_findImportWriteLocation(szAPIName)); + return scylla_findImportWriteLocation(szAPIName); } + __declspec(dllexport) long long TITCALL ImporterFindOrdinalAPIWriteLocation(ULONG_PTR OrdinalNumber) { - return(scylla_findOrdinalImportWriteLocation(OrdinalNumber)); + return scylla_findOrdinalImportWriteLocation(OrdinalNumber); } + __declspec(dllexport) long long TITCALL ImporterFindAPIByWriteLocation(ULONG_PTR APIWriteLocation) { - return(scylla_findImportNameByWriteLocation(APIWriteLocation)); + return scylla_findImportNameByWriteLocation(APIWriteLocation); } + __declspec(dllexport) long long TITCALL ImporterFindDLLByWriteLocation(ULONG_PTR APIWriteLocation) { return scylla_findModuleNameByWriteLocation(APIWriteLocation); } + __declspec(dllexport) void* TITCALL ImporterGetDLLName(ULONG_PTR APIAddress) { - return((LPVOID)EngineGlobalAPIHandler(NULL, NULL, APIAddress, NULL, UE_OPTION_IMPORTER_RETURN_DLLNAME)); + HANDLE hProcess; + if(!dbgProcessInformation.hProcess) + hProcess = GetCurrentProcess(); + else + hProcess = dbgProcessInformation.hProcess; + ULONG_PTR moduleBase=EngineGetModuleBaseRemote(hProcess, APIAddress); + if(moduleBase) + { + static char szModuleName[MAX_PATH]=""; + if(GetModuleFileNameExA(hProcess, (HMODULE)moduleBase, szModuleName, _countof(szModuleName))) + return szModuleName; + } + return 0; } + +__declspec(dllexport) void* TITCALL ImporterGetDLLNameW(ULONG_PTR APIAddress) +{ + HANDLE hProcess; + if(!dbgProcessInformation.hProcess) + hProcess = GetCurrentProcess(); + else + hProcess = dbgProcessInformation.hProcess; + ULONG_PTR moduleBase=EngineGetModuleBaseRemote(hProcess, APIAddress); + if(moduleBase) + { + static wchar_t szModuleName[MAX_PATH]=L""; + if(GetModuleFileNameExW(hProcess, (HMODULE)moduleBase, szModuleName, _countof(szModuleName))) + return szModuleName; + } + return 0; +} + __declspec(dllexport) void* TITCALL ImporterGetAPIName(ULONG_PTR APIAddress) { return((LPVOID)EngineGlobalAPIHandler(NULL, NULL, APIAddress, NULL, UE_OPTION_IMPORTER_RETURN_APINAME)); diff --git a/TitanEngine/definitions.h b/TitanEngine/definitions.h index f6075c9..00d0578 100644 --- a/TitanEngine/definitions.h +++ b/TitanEngine/definitions.h @@ -249,6 +249,7 @@ __declspec(dllexport) long long TITCALL ImporterFindOrdinalAPIWriteLocation(ULON __declspec(dllexport) long long TITCALL ImporterFindAPIByWriteLocation(ULONG_PTR APIWriteLocation); __declspec(dllexport) long long TITCALL ImporterFindDLLByWriteLocation(ULONG_PTR APIWriteLocation); __declspec(dllexport) void* TITCALL ImporterGetDLLName(ULONG_PTR APIAddress); +__declspec(dllexport) void* TITCALL ImporterGetDLLNameW(ULONG_PTR APIAddress); __declspec(dllexport) void* TITCALL ImporterGetAPIName(ULONG_PTR APIAddress); __declspec(dllexport) long long TITCALL ImporterGetAPIOrdinalNumber(ULONG_PTR APIAddress); __declspec(dllexport) void* TITCALL ImporterGetAPINameEx(ULONG_PTR APIAddress, ULONG_PTR DLLBasesList);