diff --git a/TitanEngine/Global.Debugger.cpp b/TitanEngine/Global.Debugger.cpp index 96e6c16..f273b31 100644 --- a/TitanEngine/Global.Debugger.cpp +++ b/TitanEngine/Global.Debugger.cpp @@ -2,6 +2,7 @@ #include "definitions.h" #include "Global.Debugger.h" #include "Global.Engine.h" +#include "Global.Breakpoints.h" HARDWARE_DATA DebugRegister[4] = {}; PROCESS_INFORMATION dbgProcessInformation = {}; @@ -17,6 +18,7 @@ ULONG_PTR DebugAttachedProcessCallBack = NULL; ULONG_PTR DebugReserveModuleBase = NULL; ULONG_PTR DebugDebuggingMainModuleBase = NULL; ULONG_PTR DebugDebuggingDLLBase = NULL; +HANDLE DebugDLLFileMapping; bool DebugAttachedToProcess = false; bool DebugRemoveDebugPrivilege = false; bool DebugDebuggingDLL = false; @@ -45,7 +47,7 @@ long DebugLoopInSecondThread(LPVOID InputParameter) { __try { - if(InputParameter == NULL) + if(InputParameter == NULL) //IsFileDll { InitDebugExW(expertDebug.szFileName, expertDebug.szCommandLine, expertDebug.szCurrentFolder, expertDebug.EntryCallBack); } @@ -68,6 +70,7 @@ void DebuggerReset() { RtlZeroMemory(&myDBGCustomHandler, sizeof CustomHandler); } + std::vector().swap(BreakPointBuffer); } void ClearProcessList() diff --git a/TitanEngine/Global.Debugger.h b/TitanEngine/Global.Debugger.h index b7490a5..93da947 100644 --- a/TitanEngine/Global.Debugger.h +++ b/TitanEngine/Global.Debugger.h @@ -19,6 +19,7 @@ extern bool DebugRemoveDebugPrivilege; extern ULONG_PTR DebugReserveModuleBase; extern ULONG_PTR DebugDebuggingMainModuleBase; extern ULONG_PTR DebugDebuggingDLLBase; +extern HANDLE DebugDLLFileMapping; extern bool DebugDebuggingDLL; extern wchar_t* DebugDebuggingDLLFullFileName; extern wchar_t* DebugDebuggingDLLFileName; diff --git a/TitanEngine/TitanEngine.Debugger.DebugLoop.cpp b/TitanEngine/TitanEngine.Debugger.DebugLoop.cpp index 0d78a69..da10cc7 100644 --- a/TitanEngine/TitanEngine.Debugger.DebugLoop.cpp +++ b/TitanEngine/TitanEngine.Debugger.DebugLoop.cpp @@ -127,12 +127,6 @@ __declspec(dllexport) void TITCALL DebugLoop() DLLPatchAddress = (ULONG_PTR)DBGEvent.u.CreateProcessInfo.lpBaseOfImage; DLLPatchAddress = (ULONG_PTR)DLLPatchAddress + UE_MODULEx86; #endif - if(!WriteProcessMemory(DBGEvent.u.CreateProcessInfo.hProcess, (LPVOID)DLLPatchAddress, DebugDebuggingDLLFullFileName, lstrlenW(DebugDebuggingDLLFullFileName) * 2, &NumberOfBytesReadWritten)) - { - StopDebug(); - EngineCloseHandle(DBGFileHandle); //close file handle - return; - } if(DebugReserveModuleBase) //reserve original image base { VirtualAllocEx(dbgProcessInformation.hProcess, (void*)DebugReserveModuleBase, 0x1000, MEM_RESERVE, PAGE_READWRITE); //return value nt used, yea just ignore. return value doesnt matter and there is no possible fix when failed :D this is only used to make sure DLL loads on another image base @@ -325,6 +319,7 @@ __declspec(dllexport) void TITCALL DebugLoop() { if(lstrcmpiW(&DLLDebugFileName[i+1], DebugDebuggingDLLFileName) == NULL) { + CloseHandle(DebugDLLFileMapping); //close file mapping handle SetBPX(DebugModuleEntryPoint + (ULONG_PTR)DBGEvent.u.LoadDll.lpBaseOfDll, UE_SINGLESHOOT, DebugModuleEntryPointCallBack); DebugDebuggingDLLBase = (ULONG_PTR)DBGEvent.u.LoadDll.lpBaseOfDll; } diff --git a/TitanEngine/TitanEngine.Debugger.cpp b/TitanEngine/TitanEngine.Debugger.cpp index 3f12a1b..eb99de2 100644 --- a/TitanEngine/TitanEngine.Debugger.cpp +++ b/TitanEngine/TitanEngine.Debugger.cpp @@ -3,7 +3,6 @@ #include "Global.Debugger.h" #include "Global.Engine.h" #include "Global.Handle.h" -#include "Global.Breakpoints.h" #include "Global.Threader.h" static wchar_t szBackupDebuggedFileName[512]; @@ -44,68 +43,56 @@ __declspec(dllexport) void* TITCALL InitDebug(char* szFileName, char* szCommandL } __declspec(dllexport) void* TITCALL InitDebugW(wchar_t* szFileName, wchar_t* szCommandLine, wchar_t* szCurrentFolder) { - wchar_t szCreateWithCmdLine[1024]; int DebugConsoleFlag = NULL; DebuggerReset(); - if(engineRemoveConsoleForDebugee) + if(DebugDebuggingDLL) + { + DebugConsoleFlag = CREATE_NO_WINDOW|CREATE_SUSPENDED; + } + else if(engineRemoveConsoleForDebugee) { DebugConsoleFlag = CREATE_NO_WINDOW; } - std::vector().swap(BreakPointBuffer); + if(engineEnableDebugPrivilege) { EngineSetDebugPrivilege(GetCurrentProcess(), true); DebugRemoveDebugPrivilege = true; } + wchar_t* szFileNameCreateProcess; + wchar_t* szCommandLineCreateProcess; if(szCommandLine == NULL || !lstrlenW(szCommandLine)) { - if(CreateProcessW(szFileName, NULL, NULL, NULL, false, DEBUG_PROCESS|DEBUG_ONLY_THIS_PROCESS|DebugConsoleFlag|CREATE_NEW_CONSOLE, NULL, szCurrentFolder, &dbgStartupInfo, &dbgProcessInformation)) - { - if(engineEnableDebugPrivilege) - EngineSetDebugPrivilege(GetCurrentProcess(), false); - DebugAttachedToProcess = false; - DebugAttachedProcessCallBack = NULL; - std::vector().swap(BreakPointBuffer); - return &dbgProcessInformation; - } - else - { - DWORD lastError = GetLastError(); - if(engineEnableDebugPrivilege) - { - EngineSetDebugPrivilege(GetCurrentProcess(), false); - DebugRemoveDebugPrivilege = false; - } - memset(&dbgProcessInformation, 0, sizeof(PROCESS_INFORMATION)); - SetLastError(lastError); - return 0; - } + szCommandLineCreateProcess=0; + szFileNameCreateProcess=szFileName; } else { + wchar_t szCreateWithCmdLine[1024]; wsprintfW(szCreateWithCmdLine, L"\"%s\" %s", szFileName, szCommandLine); - if(CreateProcessW(NULL, szCreateWithCmdLine, NULL, NULL, false, DEBUG_PROCESS|DEBUG_ONLY_THIS_PROCESS|DebugConsoleFlag|CREATE_NEW_CONSOLE, NULL, szCurrentFolder, &dbgStartupInfo, &dbgProcessInformation)) + szCommandLineCreateProcess=szCreateWithCmdLine; + szFileNameCreateProcess=0; + } + if(CreateProcessW(szFileNameCreateProcess, szCommandLineCreateProcess, NULL, NULL, false, DEBUG_PROCESS|DEBUG_ONLY_THIS_PROCESS|DebugConsoleFlag|CREATE_NEW_CONSOLE, NULL, szCurrentFolder, &dbgStartupInfo, &dbgProcessInformation)) + { + if(engineEnableDebugPrivilege) + EngineSetDebugPrivilege(GetCurrentProcess(), false); + DebugAttachedToProcess = false; + DebugAttachedProcessCallBack = NULL; + return &dbgProcessInformation; + } + else + { + DWORD lastError = GetLastError(); + if(engineEnableDebugPrivilege) { - if(engineEnableDebugPrivilege) - EngineSetDebugPrivilege(GetCurrentProcess(), false); - DebugAttachedToProcess = false; - DebugAttachedProcessCallBack = NULL; - std::vector().swap(BreakPointBuffer); - return &dbgProcessInformation; - } - else - { - DWORD lastError = GetLastError(); - if(engineEnableDebugPrivilege) - { - EngineSetDebugPrivilege(GetCurrentProcess(), false); - DebugRemoveDebugPrivilege = false; - } - memset(&dbgProcessInformation, 0, sizeof(PROCESS_INFORMATION)); - SetLastError(lastError); - return 0; + EngineSetDebugPrivilege(GetCurrentProcess(), false); + DebugRemoveDebugPrivilege = false; } + memset(&dbgProcessInformation, 0, sizeof(PROCESS_INFORMATION)); + SetLastError(lastError); + return 0; } } @@ -158,25 +145,17 @@ __declspec(dllexport) void* TITCALL InitDLLDebug(char* szFileName, bool ReserveM __declspec(dllexport) void* TITCALL InitDLLDebugW(wchar_t* szFileName, bool ReserveModuleBase, wchar_t* szCommandLine, wchar_t* szCurrentFolder, LPVOID EntryCallBack) { - - int i = NULL; - int j = NULL; - bool ReturnData = false; - DebugReserveModuleBase = NULL; - - RtlZeroMemory(&szDebuggerName, sizeof szDebuggerName); - if(lstrlenW(szFileName) < 512) + memset(szDebuggerName, 0, sizeof(szDebuggerName)); + if(lstrlenW(szFileName) < sizeof(szDebuggerName)) { - RtlZeroMemory(&szBackupDebuggedFileName, sizeof szBackupDebuggedFileName); + memset(szBackupDebuggedFileName, 0, sizeof(szBackupDebuggedFileName)); lstrcpyW(szBackupDebuggedFileName, szFileName); szFileName = &szBackupDebuggedFileName[0]; } lstrcpyW(szDebuggerName, szFileName); - i = lstrlenW(szDebuggerName); + int i = lstrlenW(szDebuggerName); while(szDebuggerName[i] != '\\' && i) - { i--; - } wchar_t DLLLoaderName[64]=L""; #ifdef _WIN64 wsprintfW(DLLLoaderName, L"DLLLoader64_%.4X.exe", GetTickCount()&0xFFFF); @@ -189,27 +168,40 @@ __declspec(dllexport) void* TITCALL InitDLLDebugW(wchar_t* szFileName, bool Rese lstrcpyW(szDebuggerName, DLLLoaderName); #if defined(_WIN64) - ReturnData = EngineExtractResource("LOADERX64", szDebuggerName); + if(EngineExtractResource("LOADERX64", szDebuggerName)) #else - ReturnData = EngineExtractResource("LOADERX86", szDebuggerName); + if(EngineExtractResource("LOADERX86", szDebuggerName)) #endif - if(ReturnData) { DebugDebuggingDLL = true; - i = lstrlenW(szFileName); - while(szFileName[i] != 0x5C && i >= NULL) - { + int i = lstrlenW(szFileName); + while(szFileName[i] != '\\' && i) i--; - } DebugDebuggingDLLBase = NULL; DebugDebuggingMainModuleBase = NULL; DebugDebuggingDLLFullFileName = szFileName; DebugDebuggingDLLFileName = &szFileName[i+1]; DebugModuleImageBase = (ULONG_PTR)GetPE32DataW(szFileName, NULL, UE_IMAGEBASE); - DebugReserveModuleBase = DebugModuleImageBase; DebugModuleEntryPoint = (ULONG_PTR)GetPE32DataW(szFileName, NULL, UE_OEP); DebugModuleEntryPointCallBack = EntryCallBack; - return InitDebugW(szDebuggerName, szCommandLine, szCurrentFolder); + DebugReserveModuleBase = 0; + if(ReserveModuleBase) + DebugReserveModuleBase = DebugModuleImageBase; + PPROCESS_INFORMATION ReturnValue = (PPROCESS_INFORMATION)InitDebugW(szDebuggerName, szCommandLine, szCurrentFolder); + wchar_t szName[256]=L""; + swprintf(szName, L"Global\\szLibraryName%X", (unsigned int)ReturnValue->dwProcessId); + DebugDLLFileMapping=CreateFileMappingW(INVALID_HANDLE_VALUE, 0, PAGE_READWRITE, 0, 512*sizeof(wchar_t), szName); + if(DebugDLLFileMapping) + { + wchar_t* szLibraryPathMapping=(wchar_t*)MapViewOfFile(DebugDLLFileMapping, FILE_MAP_ALL_ACCESS, 0, 0, 512*sizeof(wchar_t)); + if(szLibraryPathMapping) + { + wcscpy(szLibraryPathMapping, DebugDebuggingDLLFullFileName); + UnmapViewOfFile(szLibraryPathMapping); + } + } + ResumeThread(ReturnValue->hThread); + return ReturnValue; } return 0; } @@ -234,7 +226,7 @@ __declspec(dllexport) bool TITCALL AttachDebugger(DWORD ProcessId, bool KillOnEx if(ProcessId != NULL && dbgProcessInformation.hProcess == NULL) { - std::vector().swap(BreakPointBuffer); + DebuggerReset(); if(engineEnableDebugPrivilege) { EngineSetDebugPrivilege(GetCurrentProcess(), true); @@ -253,7 +245,6 @@ __declspec(dllexport) bool TITCALL AttachDebugger(DWORD ProcessId, bool KillOnEx myDebugSetProcessKillOnExit(KillOnExit); } } - std::vector().swap(BreakPointBuffer); DebugDebuggingDLL = false; DebugAttachedToProcess = true; DebugAttachedProcessCallBack = (ULONG_PTR)CallBack; @@ -353,7 +344,7 @@ __declspec(dllexport) void TITCALL AutoDebugEx(char* szFileName, bool ReserveMod __declspec(dllexport) void TITCALL AutoDebugExW(wchar_t* szFileName, bool ReserveModuleBase, wchar_t* szCommandLine, wchar_t* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack) { - DebugReserveModuleBase = NULL; + DebugReserveModuleBase = 0; DWORD ThreadId; DWORD ExitCode = 0; HANDLE hSecondThread; diff --git a/TitanEngineLoaders/LibraryLoader/LibraryLoader.cpp b/TitanEngineLoaders/LibraryLoader/LibraryLoader.cpp new file mode 100644 index 0000000..73cd528 --- /dev/null +++ b/TitanEngineLoaders/LibraryLoader/LibraryLoader.cpp @@ -0,0 +1,24 @@ +#include + +wchar_t szLibraryPath[512]; + +int main() +{ + memset(szLibraryPath, 0, sizeof(szLibraryPath)); + wchar_t szName[256]=L""; + wsprintfW(szName, L"Global\\szLibraryName%X", (unsigned int)GetCurrentProcessId()); + HANDLE hMapFile=OpenFileMappingW(FILE_MAP_READ, false, szName); + if(hMapFile) + { + const wchar_t* szLibraryPathMapping=(const wchar_t*)MapViewOfFile(hMapFile, FILE_MAP_READ, 0, 0, sizeof(szLibraryPath)); + if(szLibraryPathMapping) + { + lstrcpyW(szLibraryPath, szLibraryPathMapping); + UnmapViewOfFile(szLibraryPathMapping); + } + CloseHandle(hMapFile); + } + if(szLibraryPath[0]) + return (LoadLibraryW(szLibraryPath)!=NULL); + return 0; +} \ No newline at end of file diff --git a/TitanEngineLoaders/LibraryLoader/LibraryLoader.sln b/TitanEngineLoaders/LibraryLoader/LibraryLoader.sln new file mode 100644 index 0000000..2ca8284 --- /dev/null +++ b/TitanEngineLoaders/LibraryLoader/LibraryLoader.sln @@ -0,0 +1,20 @@ + +Microsoft Visual Studio Solution File, Format Version 11.00 +# Visual Studio 2010 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "LibraryLoader", "LibraryLoader.vcxproj", "{92C90AAD-036E-474D-902C-CFD1E7422899}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Release|Win32 = Release|Win32 + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {92C90AAD-036E-474D-902C-CFD1E7422899}.Release|Win32.ActiveCfg = Release|Win32 + {92C90AAD-036E-474D-902C-CFD1E7422899}.Release|Win32.Build.0 = Release|Win32 + {92C90AAD-036E-474D-902C-CFD1E7422899}.Release|x64.ActiveCfg = Release|x64 + {92C90AAD-036E-474D-902C-CFD1E7422899}.Release|x64.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/TitanEngineLoaders/LibraryLoader/LibraryLoader.vcxproj b/TitanEngineLoaders/LibraryLoader/LibraryLoader.vcxproj new file mode 100644 index 0000000..288c6d6 --- /dev/null +++ b/TitanEngineLoaders/LibraryLoader/LibraryLoader.vcxproj @@ -0,0 +1,164 @@ + + + + + Debug + Win32 + + + Debug + x64 + + + Release + Win32 + + + Release + x64 + + + + + + + {92C90AAD-036E-474D-902C-CFD1E7422899} + Win32Proj + LibraryLoader + + + + Application + true + v100 + Unicode + + + Application + true + v100 + Unicode + + + Application + false + v100 + true + Unicode + + + Application + false + v100 + true + Unicode + + + + + + + + + + + + + + + + + + + true + + + true + + + false + $(ProjectName) + $(ProjectDir)x32\ + false + + + false + $(ProjectName) + $(ProjectDir)x64\ + false + + + + + + Level3 + Disabled + WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) + + + Console + true + $(SolutionDir)ntdll;%(AdditionalLibraryDirectories) + + + + + + + Level3 + Disabled + WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) + 1Byte + + + Console + true + $(SolutionDir)ntdll;%(AdditionalLibraryDirectories) + + + + + Level3 + + + MinSpace + true + true + WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) + MultiThreaded + 1Byte + + + Console + false + true + true + false + $(SolutionDir)ntdll;%(AdditionalLibraryDirectories) + + + + + Level3 + + + MinSpace + true + true + WIN32;DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) + MultiThreaded + 1Byte + false + + + Console + false + true + true + $(SolutionDir)ntdll;%(AdditionalLibraryDirectories) + + + + + + \ No newline at end of file diff --git a/TitanEngineLoaders/LibraryLoader/LibraryLoader.vcxproj.filters b/TitanEngineLoaders/LibraryLoader/LibraryLoader.vcxproj.filters new file mode 100644 index 0000000..0d694c7 --- /dev/null +++ b/TitanEngineLoaders/LibraryLoader/LibraryLoader.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;hm;inl;inc;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + \ No newline at end of file diff --git a/TitanEngineLoaders/LibraryLoader/x32/LibraryLoader.asm b/TitanEngineLoaders/LibraryLoader/x32/LibraryLoader.asm deleted file mode 100644 index 071dae1..0000000 --- a/TitanEngineLoaders/LibraryLoader/x32/LibraryLoader.asm +++ /dev/null @@ -1,31 +0,0 @@ -format PE GUI -entry start - -section '.text' code readable executable - start: - push szLibraryName - call [LoadLibraryW] - cmp eax,1 - sbb ecx,ecx - and ecx,61703078h - push ecx - call [ExitProcess] - -section '.data' data readable writeable - szLibraryName dw 512 dup (?) - -section '.idata' import data readable writeable - dd 0,0,0,rva kernel_name,rva kernel_table - dd 0,0,0,0,0 - - kernel_table: - ExitProcess dd rva _ExitProcess - LoadLibraryW dd rva _LoadLibraryW - dd 0 - - kernel_name db 'kernel32.dll',0 - - _ExitProcess dw 0 - db 'ExitProcess',0 - _LoadLibraryW dw 0 - db 'LoadLibraryW',0 \ No newline at end of file diff --git a/TitanEngineLoaders/LibraryLoader/x32/LibraryLoader.exe b/TitanEngineLoaders/LibraryLoader/x32/LibraryLoader.exe index 0d738b1..8e6c575 100644 Binary files a/TitanEngineLoaders/LibraryLoader/x32/LibraryLoader.exe and b/TitanEngineLoaders/LibraryLoader/x32/LibraryLoader.exe differ diff --git a/TitanEngineLoaders/LibraryLoader/x64/LibraryLoader.asm b/TitanEngineLoaders/LibraryLoader/x64/LibraryLoader.asm deleted file mode 100644 index e12bf24..0000000 --- a/TitanEngineLoaders/LibraryLoader/x64/LibraryLoader.asm +++ /dev/null @@ -1,31 +0,0 @@ -format PE64 GUI -entry start - -section '.text' code readable executable - start: - sub rsp,8*5 - lea rcx,[szLibraryName] - call [LoadLibraryW] - cmp rax,1 - sbb ecx,ecx - and ecx,61703078h - call [ExitProcess] - -section '.data' data readable writeable - szLibraryName dw 512 dup (?) - -section '.idata' import data readable writeable - dd 0,0,0,rva kernel_name,rva kernel_table - dd 0,0,0,0,0 - - kernel_table: - ExitProcess dq rva _ExitProcess - LoadLibraryW dq rva _LoadLibraryW - dq 0 - - kernel_name db 'KERNEL32.DLL',0 - - _ExitProcess dw 0 - db 'ExitProcess',0 - _LoadLibraryW dw 0 - db 'LoadLibraryW',0 \ No newline at end of file diff --git a/TitanEngineLoaders/LibraryLoader/x64/LibraryLoader.exe b/TitanEngineLoaders/LibraryLoader/x64/LibraryLoader.exe index 398fc1b..081c04c 100644 Binary files a/TitanEngineLoaders/LibraryLoader/x64/LibraryLoader.exe and b/TitanEngineLoaders/LibraryLoader/x64/LibraryLoader.exe differ