diff --git a/SDK/C/TitanEngine.h b/SDK/C/TitanEngine.h index 3cbbcfb..4f8e118 100644 --- a/SDK/C/TitanEngine.h +++ b/SDK/C/TitanEngine.h @@ -639,7 +639,6 @@ __declspec(dllexport) bool TITCALL ThreaderIsThreadActive(HANDLE hThread); __declspec(dllexport) bool TITCALL ThreaderIsAnyThreadActive(); __declspec(dllexport) bool TITCALL ThreaderExecuteOnlyInjectedThreads(); __declspec(dllexport) long long TITCALL ThreaderGetOpenHandleForThread(DWORD ThreadId); -__declspec(dllexport) void* TITCALL ThreaderGetThreadData(); __declspec(dllexport) bool TITCALL ThreaderIsExceptionInMainThread(); // TitanEngine.Debugger.functions: __declspec(dllexport) void* TITCALL StaticDisassembleEx(ULONG_PTR DisassmStart, LPVOID DisassmAddress); diff --git a/SDK/CPP/TitanEngine.h b/SDK/CPP/TitanEngine.h index a99eb31..6bda2fc 100644 --- a/SDK/CPP/TitanEngine.h +++ b/SDK/CPP/TitanEngine.h @@ -638,7 +638,6 @@ __declspec(dllimport) bool TITCALL ThreaderIsThreadActive(HANDLE hThread); __declspec(dllimport) bool TITCALL ThreaderIsAnyThreadActive(); __declspec(dllimport) bool TITCALL ThreaderExecuteOnlyInjectedThreads(); __declspec(dllimport) long long TITCALL ThreaderGetOpenHandleForThread(DWORD ThreadId); -__declspec(dllimport) void* TITCALL ThreaderGetThreadData(); __declspec(dllimport) bool TITCALL ThreaderIsExceptionInMainThread(); // TitanEngine.Debugger.functions: __declspec(dllimport) void* TITCALL StaticDisassembleEx(ULONG_PTR DisassmStart, LPVOID DisassmAddress); diff --git a/SDK/CPP/TitanEngine.hpp b/SDK/CPP/TitanEngine.hpp index ab3d763..31be8fb 100644 --- a/SDK/CPP/TitanEngine.hpp +++ b/SDK/CPP/TitanEngine.hpp @@ -1122,10 +1122,6 @@ public: { return UE::ThreaderGetOpenHandleForThread(ThreadId); } - static const THREAD_ITEM_DATA* GetThreadData() - { - return (const THREAD_ITEM_DATA*)UE::ThreaderGetThreadData(); - } static bool IsExceptionInMainThread() { return UE::ThreaderIsExceptionInMainThread(); diff --git a/SDK/Delphi/TitanEngine.pas b/SDK/Delphi/TitanEngine.pas index bfa36ab..a026e88 100644 --- a/SDK/Delphi/TitanEngine.pas +++ b/SDK/Delphi/TitanEngine.pas @@ -496,7 +496,6 @@ const function ThreaderIsAnyThreadActive():boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderIsAnyThreadActive'; function ThreaderExecuteOnlyInjectedThreads():boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderExecuteOnlyInjectedThreads'; function ThreaderGetOpenHandleForThread(ThreadId:LongInt):THandle; stdcall; external 'TitanEngine.dll' name 'ThreaderGetOpenHandleForThread'; - function ThreaderGetThreadData():Pointer; stdcall; external 'TitanEngine.dll' name 'ThreaderGetThreadData'; function ThreaderIsExceptionInMainThread():boolean; stdcall; external 'TitanEngine.dll' name 'ThreaderIsExceptionInMainThread'; {TitanEngine.Debugger.functions} function StaticDisassembleEx(DisassmStart:LongInt; DisassmAddress:Pointer):PAnsiChar; stdcall; external 'TitanEngine.dll' name 'StaticDisassembleEx'; diff --git a/SDK/LUA/TitanEngine.lua b/SDK/LUA/TitanEngine.lua index 4321b73..a886d75 100644 --- a/SDK/LUA/TitanEngine.lua +++ b/SDK/LUA/TitanEngine.lua @@ -747,9 +747,6 @@ PROCESS_INFORMATION = alien.defstruct{ -- __declspec(dllexport) long long __stdcall ThreaderGetOpenHandleForThread(DWORD ThreadId); TitanEngine.ThreaderGetOpenHandleForThread:types {"long",abi="stdcall",ret="long"} TE_ThreaderGetOpenHandleForThread = TitanEngine.ThreaderGetOpenHandleForThread --- __declspec(dllexport) void* __stdcall ThreaderGetThreadData(); - TitanEngine.ThreaderGetThreadData:types {abi="stdcall",ret="pointer"} - TE_ThreaderGetThreadData = TitanEngine.ThreaderGetThreadData -- __declspec(dllexport) bool __stdcall ThreaderIsExceptionInMainThread(); TitanEngine.ThreaderIsExceptionInMainThread:types {abi="stdcall",ret="byte"} TE_ThreaderIsExceptionInMainThread = TitanEngine.ThreaderIsExceptionInMainThread diff --git a/SDK/MASM/TitanEngine.INC b/SDK/MASM/TitanEngine.INC index 8d80c59..f759ab4 100644 --- a/SDK/MASM/TitanEngine.INC +++ b/SDK/MASM/TitanEngine.INC @@ -549,7 +549,6 @@ ThreaderIsThreadActive proto stdcall :HANDLE ThreaderIsAnyThreadActive proto stdcall ThreaderExecuteOnlyInjectedThreads proto stdcall ThreaderGetOpenHandleForThread proto stdcall :DWORD -ThreaderGetThreadData proto stdcall ThreaderIsExceptionInMainThread proto stdcall StaticDisassembleEx proto stdcall :DWORD, :LPVOID StaticDisassemble proto stdcall :LPVOID diff --git a/SDK/Python/TitanEngine.py b/SDK/Python/TitanEngine.py index bac2fd2..4d0e93d 100644 --- a/SDK/Python/TitanEngine.py +++ b/SDK/Python/TitanEngine.py @@ -644,7 +644,6 @@ TE.GetPEBLocation.restype = c_void_p TE.GetPEBLocation64.restype = c_void_p TE.ThreaderGetThreadInfo.restype = POINTER(THREAD_ITEM_DATA) -TE.ThreaderGetThreadData.restype = POINTER(THREAD_ITEM_DATA) TE.InitDebug.restype = POINTER(PROCESS_INFORMATION) TE.InitDebugW.restype = POINTER(PROCESS_INFORMATION) diff --git a/TitanEngine/Global.Threader.cpp b/TitanEngine/Global.Threader.cpp index 86725a7..ff3887b 100644 --- a/TitanEngine/Global.Threader.cpp +++ b/TitanEngine/Global.Threader.cpp @@ -2,4 +2,9 @@ #include "definitions.h" #include "Global.Threader.h" -LPVOID hListThread = 0; \ No newline at end of file +std::vector hListThread; + +void ClearThreadList() +{ + std::vector().swap(hListThread); +} diff --git a/TitanEngine/Global.Threader.h b/TitanEngine/Global.Threader.h index b6ca0d1..ca2a2a0 100644 --- a/TitanEngine/Global.Threader.h +++ b/TitanEngine/Global.Threader.h @@ -1,6 +1,10 @@ #ifndef _GLOBAL_THREADER_H #define _GLOBAL_THREADER_H -extern LPVOID hListThread; +#include -#endif //_GLOBAL_THREADER_H \ No newline at end of file +extern std::vector hListThread; + +void ClearThreadList(); + +#endif //_GLOBAL_THREADER_H diff --git a/TitanEngine/TitanEngine.Debugger.Control.cpp b/TitanEngine/TitanEngine.Debugger.Control.cpp index eeb343e..6a0f701 100644 --- a/TitanEngine/TitanEngine.Debugger.Control.cpp +++ b/TitanEngine/TitanEngine.Debugger.Control.cpp @@ -4,6 +4,7 @@ #include "Global.Handle.h" #include "Global.Threader.h" #include "Global.Librarian.h" +#include __declspec(dllexport) void TITCALL ForceClose() { @@ -12,7 +13,7 @@ __declspec(dllexport) void TITCALL ForceClose() PPROCESS_ITEM_DATA hListProcessPtr = NULL; PTHREAD_ITEM_DATA hListThreadPtr = NULL; PLIBRARY_ITEM_DATAW hListLibraryPtr = NULL; - + //manage lists if(hListProcess != NULL) { hListProcessPtr = (PPROCESS_ITEM_DATA)hListProcess; @@ -31,35 +32,12 @@ __declspec(dllexport) void TITCALL ForceClose() } RtlZeroMemory(hListProcess, MAX_DEBUG_DATA * sizeof PROCESS_ITEM_DATA); } - if(hListThread != NULL) - { - hListThreadPtr = (PTHREAD_ITEM_DATA)hListThread; - while(hListThreadPtr->hThread != NULL) - { - if(hListThreadPtr->hThread != (HANDLE)-1) - { - __try - { - if(EngineCloseHandle(hListThreadPtr->hThread)) - { - hListThreadPtr->hThread = NULL; - hListThreadPtr->dwThreadId = NULL; - hListThreadPtr->ThreadLocalBase = NULL; - hListThreadPtr->ThreadStartAddress = NULL; - } - } - __except(EXCEPTION_EXECUTE_HANDLER) - { - hListThreadPtr->hThread = NULL; - hListThreadPtr->dwThreadId = NULL; - hListThreadPtr->ThreadLocalBase = NULL; - hListThreadPtr->ThreadStartAddress = NULL; - } - } - hListThreadPtr = (PTHREAD_ITEM_DATA)((ULONG_PTR)hListThreadPtr + sizeof THREAD_ITEM_DATA); - } - RtlZeroMemory(hListThread, MAX_DEBUG_DATA * sizeof THREAD_ITEM_DATA); - } + + int threadcount=hListThread.size(); + for(int i=threadcount-1; i>-1; i--) + EngineCloseHandle(hListThread.at(i).hThread); + ClearThreadList(); + if(hListLibrary != NULL) { hListLibraryPtr = (PLIBRARY_ITEM_DATAW)hListLibrary; @@ -70,23 +48,9 @@ __declspec(dllexport) void TITCALL ForceClose() if(hListLibraryPtr->hFileMappingView != NULL) { UnmapViewOfFile(hListLibraryPtr->hFileMappingView); - __try - { - EngineCloseHandle(hListLibraryPtr->hFileMapping); - } - __except(EXCEPTION_EXECUTE_HANDLER) - { - - } - } - __try - { - EngineCloseHandle(hListLibraryPtr->hFile); - } - __except(EXCEPTION_EXECUTE_HANDLER) - { - + EngineCloseHandle(hListLibraryPtr->hFileMapping); } + EngineCloseHandle(hListLibraryPtr->hFile); } hListLibraryPtr = (PLIBRARY_ITEM_DATAW)((ULONG_PTR)hListLibraryPtr + sizeof LIBRARY_ITEM_DATAW); } @@ -197,4 +161,4 @@ __declspec(dllexport) void TITCALL SetNextDbgContinueStatus(DWORD SetDbgCode) { DBGCode = DBG_CONTINUE; } -} \ No newline at end of file +} diff --git a/TitanEngine/TitanEngine.Debugger.DebugLoop.cpp b/TitanEngine/TitanEngine.Debugger.DebugLoop.cpp index c752272..9d1d461 100644 --- a/TitanEngine/TitanEngine.Debugger.DebugLoop.cpp +++ b/TitanEngine/TitanEngine.Debugger.DebugLoop.cpp @@ -32,7 +32,7 @@ __declspec(dllexport) void TITCALL DebugLoop() bool hListThreadFirst = true; bool hListLibraryFirst = true; PPROCESS_ITEM_DATA hListProcessPtr = NULL; - PTHREAD_ITEM_DATA hListThreadPtr = NULL; + //PTHREAD_ITEM_DATA hListThreadPtr = NULL; PLIBRARY_ITEM_DATAW hListLibraryPtr = NULL; PLIBRARY_ITEM_DATAW hLoadedLibData = NULL; PLIBRARY_BREAK_DATA ptrLibrarianData = NULL; @@ -142,17 +142,9 @@ __declspec(dllexport) void TITCALL DebugLoop() RtlZeroMemory(hListProcess, MAX_DEBUG_DATA * sizeof PROCESS_ITEM_DATA); } } - if(hListThread == NULL) - { - hListThread = VirtualAlloc(NULL, MAX_DEBUG_DATA * sizeof THREAD_ITEM_DATA, MEM_COMMIT, PAGE_READWRITE); - } - else - { - if(hListThreadFirst == true) - { - RtlZeroMemory(hListThread, MAX_DEBUG_DATA * sizeof THREAD_ITEM_DATA); - } - } + if(hListThreadFirst) //clear thread list + ClearThreadList(); + hListProcessPtr = (PPROCESS_ITEM_DATA)hListProcess; hListProcessPtr->hFile = DBGEvent.u.CreateProcessInfo.hFile; hListProcessPtr->hProcess = DBGEvent.u.CreateProcessInfo.hProcess; @@ -163,11 +155,13 @@ __declspec(dllexport) void TITCALL DebugLoop() hListProcessPtr->ThreadStartAddress = (void*)DBGEvent.u.CreateProcessInfo.lpStartAddress; hListProcessPtr->ThreadLocalBase = (void*)DBGEvent.u.CreateProcessInfo.lpThreadLocalBase; - hListThreadPtr = (PTHREAD_ITEM_DATA)hListThread; - hListThreadPtr->dwThreadId = DBGEvent.dwThreadId; - hListThreadPtr->hThread = DBGEvent.u.CreateProcessInfo.hThread; - hListThreadPtr->ThreadStartAddress = (void*)DBGEvent.u.CreateProcessInfo.lpStartAddress; - hListThreadPtr->ThreadLocalBase = (void*)DBGEvent.u.CreateProcessInfo.lpThreadLocalBase; + THREAD_ITEM_DATA NewThreadData; + memset(&NewThreadData, 0, sizeof(THREAD_ITEM_DATA)); + NewThreadData.dwThreadId = DBGEvent.dwThreadId; + NewThreadData.hThread = DBGEvent.u.CreateProcessInfo.hThread; + NewThreadData.ThreadStartAddress = (void*)DBGEvent.u.CreateProcessInfo.lpStartAddress; + NewThreadData.ThreadLocalBase = (void*)DBGEvent.u.CreateProcessInfo.lpThreadLocalBase; + hListThread.push_back(NewThreadData); hListThreadFirst = false; } else //we have a valid handle already (which means a child process started) @@ -233,26 +227,13 @@ __declspec(dllexport) void TITCALL DebugLoop() case CREATE_THREAD_DEBUG_EVENT: { //maintain thread list - if(hListThread == NULL) - { - hListThread = VirtualAlloc(NULL, MAX_DEBUG_DATA * sizeof THREAD_ITEM_DATA, MEM_COMMIT, PAGE_READWRITE); - } - hListThreadPtr = (PTHREAD_ITEM_DATA)hListThread; - __try - { - while(hListThreadPtr->hThread != NULL) - { - hListThreadPtr = (PTHREAD_ITEM_DATA)((ULONG_PTR)hListThreadPtr + sizeof THREAD_ITEM_DATA); - } - hListThreadPtr->dwThreadId = DBGEvent.dwThreadId; - hListThreadPtr->hThread = DBGEvent.u.CreateThread.hThread; - hListThreadPtr->ThreadStartAddress = (void*)DBGEvent.u.CreateThread.lpStartAddress; - hListThreadPtr->ThreadLocalBase = (void*)DBGEvent.u.CreateThread.lpThreadLocalBase; - } - __except(EXCEPTION_EXECUTE_HANDLER) - { - - } + THREAD_ITEM_DATA NewThreadData; + memset(&NewThreadData, 0, sizeof(THREAD_ITEM_DATA)); + NewThreadData.dwThreadId = DBGEvent.dwThreadId; + NewThreadData.hThread = DBGEvent.u.CreateThread.hThread; + NewThreadData.ThreadStartAddress = (void*)DBGEvent.u.CreateThread.lpStartAddress; + NewThreadData.ThreadLocalBase = (void*)DBGEvent.u.CreateThread.lpThreadLocalBase; + hListThread.push_back(NewThreadData); //custom handler if(DBGCustomHandler->chCreateThread != NULL) @@ -300,17 +281,15 @@ __declspec(dllexport) void TITCALL DebugLoop() } //maintain thread list - hListThreadPtr = (PTHREAD_ITEM_DATA)hListThread; - while(hListThreadPtr->hThread != NULL && hListThreadPtr->dwThreadId != DBGEvent.dwThreadId) + int threadcount=hListThread.size(); + for(int i=0; idwThreadId == DBGEvent.dwThreadId) - { - hListThreadPtr->hThread = (HANDLE)-1; - hListThreadPtr->dwThreadId = NULL; - hListThreadPtr->ThreadLocalBase = NULL; - hListThreadPtr->ThreadStartAddress = NULL; + if(hListThread.at(i).dwThreadId == DBGEvent.dwThreadId) //found the thread to remove + { + //TODO: close handle? + hListThread.erase(hListThread.begin()+i); + break; + } } } break; @@ -590,16 +569,8 @@ __declspec(dllexport) void TITCALL DebugLoop() myDBGContext.ContextFlags = CONTEXT_CONTROL; GetThreadContext(hActiveThread, &myDBGContext); if(FoundBreakPoint.BreakPointType != UE_SINGLESHOOT) - { - if(!(myDBGContext.EFlags & 0x100)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x100; - } - } - if(!(myDBGContext.EFlags & 0x10000)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x10000; - } + myDBGContext.EFlags |= UE_TRAP_FLAG; + myDBGContext.EFlags |= UE_RESUME_FLAG; #if defined(_WIN64) myDBGContext.Rip = myDBGContext.Rip - FoundBreakPoint.BreakPointSize; #else @@ -748,10 +719,7 @@ __declspec(dllexport) void TITCALL DebugLoop() hActiveThread = OpenThread(THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, false, DBGEvent.dwThreadId); myDBGContext.ContextFlags = CONTEXT_CONTROL; GetThreadContext(hActiveThread, &myDBGContext); - if(!(myDBGContext.EFlags & 0x100)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x100; - } + myDBGContext.EFlags |= UE_TRAP_FLAG; SetThreadContext(hActiveThread, &myDBGContext); EngineCloseHandle(hActiveThread); } @@ -846,10 +814,7 @@ __declspec(dllexport) void TITCALL DebugLoop() if(DebugRegister[0].DrxEnabled) { DBGCode = DBG_CONTINUE; - if(!(myDBGContext.EFlags & 0x100)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x100; - } + myDBGContext.EFlags |= UE_TRAP_FLAG; SetThreadContext(hActiveThread, &myDBGContext); myCustomHandler = (fCustomHandler)(DebugRegister[0].DrxCallBack); __try @@ -876,10 +841,7 @@ __declspec(dllexport) void TITCALL DebugLoop() if(DebugRegister[1].DrxEnabled) { DBGCode = DBG_CONTINUE; - if(!(myDBGContext.EFlags & 0x100)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x100; - } + myDBGContext.EFlags |= UE_TRAP_FLAG; SetThreadContext(hActiveThread, &myDBGContext); myCustomHandler = (fCustomHandler)(DebugRegister[1].DrxCallBack); __try @@ -906,10 +868,7 @@ __declspec(dllexport) void TITCALL DebugLoop() if(DebugRegister[2].DrxEnabled) { DBGCode = DBG_CONTINUE; - if(!(myDBGContext.EFlags & 0x100)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x100; - } + myDBGContext.EFlags |= UE_TRAP_FLAG; SetThreadContext(hActiveThread, &myDBGContext); myCustomHandler = (fCustomHandler)(DebugRegister[2].DrxCallBack); __try @@ -936,10 +895,7 @@ __declspec(dllexport) void TITCALL DebugLoop() if(DebugRegister[3].DrxEnabled) { DBGCode = DBG_CONTINUE; - if(!(myDBGContext.EFlags & 0x100)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x100; - } + myDBGContext.EFlags |= UE_TRAP_FLAG; SetThreadContext(hActiveThread, &myDBGContext); myCustomHandler = (fCustomHandler)(DebugRegister[3].DrxCallBack); __try @@ -1023,10 +979,7 @@ __declspec(dllexport) void TITCALL DebugLoop() } else { - if(!(myDBGContext.EFlags & 0x100)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x100; - } + myDBGContext.EFlags |= UE_TRAP_FLAG; SetThreadContext(hActiveThread, &myDBGContext); ResetMemBPXAddress = FoundBreakPoint.BreakPointAddress; ResetMemBPXSize = FoundBreakPoint.BreakPointSize; @@ -1051,10 +1004,7 @@ __declspec(dllexport) void TITCALL DebugLoop() } else //restore the memory breakpoint { - if(!(myDBGContext.EFlags & 0x100)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x100; - } + myDBGContext.EFlags |= UE_TRAP_FLAG; SetThreadContext(hActiveThread, &myDBGContext); ResetMemBPXAddress = FoundBreakPoint.BreakPointAddress; ResetMemBPXSize = FoundBreakPoint.BreakPointSize; @@ -1074,10 +1024,7 @@ __declspec(dllexport) void TITCALL DebugLoop() } else //no read operation, restore breakpoint { - if(!(myDBGContext.EFlags & 0x100)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x100; - } + myDBGContext.EFlags |= UE_TRAP_FLAG; SetThreadContext(hActiveThread, &myDBGContext); ResetMemBPXAddress = FoundBreakPoint.BreakPointAddress; ResetMemBPXSize = FoundBreakPoint.BreakPointSize; @@ -1093,10 +1040,7 @@ __declspec(dllexport) void TITCALL DebugLoop() } else //restore breakpoint after trap flag { - if(!(myDBGContext.EFlags & 0x100)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x100; - } + myDBGContext.EFlags |= UE_TRAP_FLAG; SetThreadContext(hActiveThread, &myDBGContext); ResetMemBPXAddress = FoundBreakPoint.BreakPointAddress; ResetMemBPXSize = FoundBreakPoint.BreakPointSize; @@ -1116,10 +1060,7 @@ __declspec(dllexport) void TITCALL DebugLoop() } else //no write operation, restore breakpoint { - if(!(myDBGContext.EFlags & 0x100)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x100; - } + myDBGContext.EFlags |= UE_TRAP_FLAG; SetThreadContext(hActiveThread, &myDBGContext); ResetMemBPXAddress = FoundBreakPoint.BreakPointAddress; ResetMemBPXSize = FoundBreakPoint.BreakPointSize; @@ -1136,10 +1077,7 @@ __declspec(dllexport) void TITCALL DebugLoop() } else { - if(!(myDBGContext.EFlags & 0x100)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x100; - } + myDBGContext.EFlags |= UE_TRAP_FLAG; SetThreadContext(hActiveThread, &myDBGContext); ResetMemBPXAddress = FoundBreakPoint.BreakPointAddress; ResetMemBPXSize = FoundBreakPoint.BreakPointSize; @@ -1160,10 +1098,7 @@ __declspec(dllexport) void TITCALL DebugLoop() } else //no execute operation, restore breakpoint { - if(!(myDBGContext.EFlags & 0x100)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x100; - } + myDBGContext.EFlags |= UE_TRAP_FLAG; SetThreadContext(hActiveThread, &myDBGContext); ResetMemBPXAddress = FoundBreakPoint.BreakPointAddress; ResetMemBPXSize = FoundBreakPoint.BreakPointSize; @@ -1241,16 +1176,8 @@ __declspec(dllexport) void TITCALL DebugLoop() myDBGContext.ContextFlags = CONTEXT_CONTROL; GetThreadContext(hActiveThread, &myDBGContext); if(FoundBreakPoint.BreakPointType != UE_SINGLESHOOT) - { - if(!(myDBGContext.EFlags & 0x100)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x100; - } - } - if(!(myDBGContext.EFlags & 0x10000)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x10000; - } + myDBGContext.EFlags |= UE_TRAP_FLAG; + myDBGContext.EFlags |= UE_RESUME_FLAG; SetThreadContext(hActiveThread, &myDBGContext); EngineCloseHandle(hActiveThread); VirtualProtectEx(dbgProcessInformation.hProcess, (LPVOID)FoundBreakPoint.BreakPointAddress, FoundBreakPoint.BreakPointSize, OldProtect, &OldProtect); diff --git a/TitanEngine/TitanEngine.Debugger.cpp b/TitanEngine/TitanEngine.Debugger.cpp index 1c1a7b7..116abc2 100644 --- a/TitanEngine/TitanEngine.Debugger.cpp +++ b/TitanEngine/TitanEngine.Debugger.cpp @@ -307,39 +307,22 @@ __declspec(dllexport) bool TITCALL DetachDebugger(DWORD ProcessId) __declspec(dllexport) bool TITCALL DetachDebuggerEx(DWORD ProcessId) { - - HANDLE hActiveThread; - CONTEXT myDBGContext; - PTHREAD_ITEM_DATA hListThreadPtr = (PTHREAD_ITEM_DATA)hListThread; - - if(hListThreadPtr != NULL) + ThreaderPauseProcess(); + int threadcount=hListThread.size(); + for(int i=0; ihThread != NULL) - { - hActiveThread = OpenThread(THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION, false, hListThreadPtr->dwThreadId); - myDBGContext.ContextFlags = CONTEXT_CONTROL; - GetThreadContext(hActiveThread, &myDBGContext); - if((myDBGContext.EFlags & 0x100)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x100; - } - if(!(myDBGContext.EFlags & 0x10000)) - { - myDBGContext.EFlags = myDBGContext.EFlags ^ 0x10000; - } - SetThreadContext(hActiveThread, &myDBGContext); - EngineCloseHandle(hActiveThread); - hListThreadPtr = (PTHREAD_ITEM_DATA)((ULONG_PTR)hListThreadPtr + sizeof THREAD_ITEM_DATA); - } - ContinueDebugEvent(DBGEvent.dwProcessId, DBGEvent.dwThreadId, DBG_CONTINUE); - ThreaderResumeProcess(); - return(DetachDebugger(ProcessId)); - } - else - { - return false; + HANDLE hActiveThread = OpenThread(THREAD_GET_CONTEXT|THREAD_SET_CONTEXT, false, hListThread.at(i).dwThreadId); + CONTEXT myDBGContext; + myDBGContext.ContextFlags = CONTEXT_CONTROL; + GetThreadContext(hActiveThread, &myDBGContext); + myDBGContext.EFlags &= ~UE_TRAP_FLAG; + myDBGContext.EFlags &= ~UE_RESUME_FLAG; + SetThreadContext(hActiveThread, &myDBGContext); + EngineCloseHandle(hActiveThread); } + ContinueDebugEvent(DBGEvent.dwProcessId, DBGEvent.dwThreadId, DBG_CONTINUE); + ThreaderResumeProcess(); + return DetachDebugger(ProcessId); } __declspec(dllexport) void TITCALL AutoDebugEx(char* szFileName, bool ReserveModuleBase, char* szCommandLine, char* szCurrentFolder, DWORD TimeOut, LPVOID EntryCallBack) diff --git a/TitanEngine/TitanEngine.Handler.cpp b/TitanEngine/TitanEngine.Handler.cpp index 3d1a20b..3aac3d9 100644 --- a/TitanEngine/TitanEngine.Handler.cpp +++ b/TitanEngine/TitanEngine.Handler.cpp @@ -6,945 +6,945 @@ __declspec(dllexport) long TITCALL HandlerGetActiveHandleCount(DWORD ProcessId) { - int HandleCount = NULL; - LPVOID QuerySystemBuffer; - ULONG QuerySystemBufferSize = 0x2000; - ULONG RequiredSize = NULL; - ULONG TotalHandleCount = NULL; + int HandleCount = NULL; + LPVOID QuerySystemBuffer; + ULONG QuerySystemBufferSize = 0x2000; + ULONG RequiredSize = NULL; + ULONG TotalHandleCount = NULL; - PNTDLL_QUERY_HANDLE_INFO HandleInfo; + PNTDLL_QUERY_HANDLE_INFO HandleInfo; - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) - { - QuerySystemBufferSize = RequiredSize; - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - } - RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); - QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; - while(TotalHandleCount > NULL) - { - if(HandleInfo->ProcessId == ProcessId) - { - HandleCount++; - } - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); - TotalHandleCount--; - } - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - return(HandleCount); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) + { + QuerySystemBufferSize = RequiredSize; + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + } + RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); + QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; + while(TotalHandleCount > NULL) + { + if(HandleInfo->ProcessId == ProcessId) + { + HandleCount++; + } + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); + TotalHandleCount--; + } + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + return(HandleCount); - return(NULL); + return(NULL); } __declspec(dllexport) bool TITCALL HandlerIsHandleOpen(DWORD ProcessId, HANDLE hHandle) { - bool HandleActive = false; - LPVOID QuerySystemBuffer; - ULONG QuerySystemBufferSize = 0x2000; - ULONG RequiredSize = NULL; - ULONG TotalHandleCount = NULL; - PNTDLL_QUERY_HANDLE_INFO HandleInfo; + bool HandleActive = false; + LPVOID QuerySystemBuffer; + ULONG QuerySystemBufferSize = 0x2000; + ULONG RequiredSize = NULL; + ULONG TotalHandleCount = NULL; + PNTDLL_QUERY_HANDLE_INFO HandleInfo; - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) - { - QuerySystemBufferSize = RequiredSize; - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - } - RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); - QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; - while(TotalHandleCount > NULL) - { - if(HandleInfo->ProcessId == ProcessId && (HANDLE)HandleInfo->hHandle == hHandle) - { - HandleActive = true; - break; - } - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); - TotalHandleCount--; - } - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - if(HandleActive) - { - return true; - } + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) + { + QuerySystemBufferSize = RequiredSize; + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + } + RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); + QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; + while(TotalHandleCount > NULL) + { + if(HandleInfo->ProcessId == ProcessId && (HANDLE)HandleInfo->hHandle == hHandle) + { + HandleActive = true; + break; + } + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); + TotalHandleCount--; + } + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + if(HandleActive) + { + return true; + } - return false; + return false; } __declspec(dllexport) void* TITCALL HandlerGetHandleName(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName) { - bool NameFound = false; - HANDLE myHandle = NULL; - LPVOID QuerySystemBuffer; - ULONG QuerySystemBufferSize = 0x2000; - ULONG RequiredSize = NULL; - ULONG TotalHandleCount = NULL; - PNTDLL_QUERY_HANDLE_INFO HandleInfo; - PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo; - LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE); - PPUBLIC_OBJECT_NAME_INFORMATION pObjectNameInfo = (PPUBLIC_OBJECT_NAME_INFORMATION)ObjectNameInfo; - LPVOID HandleFullName = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); - LPVOID tmpHandleFullName = NULL; + bool NameFound = false; + HANDLE myHandle = NULL; + LPVOID QuerySystemBuffer; + ULONG QuerySystemBufferSize = 0x2000; + ULONG RequiredSize = NULL; + ULONG TotalHandleCount = NULL; + PNTDLL_QUERY_HANDLE_INFO HandleInfo; + PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo; + LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE); + PPUBLIC_OBJECT_NAME_INFORMATION pObjectNameInfo = (PPUBLIC_OBJECT_NAME_INFORMATION)ObjectNameInfo; + LPVOID HandleFullName = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); + LPVOID tmpHandleFullName = NULL; - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) - { - QuerySystemBufferSize = RequiredSize; - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - } - RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); - QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; - while(TotalHandleCount > NULL) - { - if(HandleInfo->ProcessId == ProcessId && (HANDLE)HandleInfo->hHandle == hHandle) - { - //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ - if(HandleInfo->GrantedAccess != 0x0012019F) - { - if(DuplicateHandle(hProcess, hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) - { - RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION); - NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize); - NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize); - NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize); - RtlZeroMemory(HandleFullName, 0x1000); - if(pObjectNameInfo->Name.Length != NULL) - { - WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectNameInfo->Name.Buffer, -1, (LPSTR)HandleFullName, 0x1000, NULL, NULL); - NameFound = true; - if(TranslateName) - { - tmpHandleFullName = TranslateNativeName((char*)HandleFullName); - if(tmpHandleFullName != NULL) - { - VirtualFree(HandleFullName, NULL, MEM_RELEASE); - HandleFullName = tmpHandleFullName; - } - } - } - EngineCloseHandle(myHandle); - break; - } - } - } - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); - TotalHandleCount--; - } - VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - if(!NameFound) - { - VirtualFree(HandleFullName, NULL, MEM_RELEASE); - return(NULL); - } - else - { - return(HandleFullName); - } + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) + { + QuerySystemBufferSize = RequiredSize; + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + } + RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); + QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; + while(TotalHandleCount > NULL) + { + if(HandleInfo->ProcessId == ProcessId && (HANDLE)HandleInfo->hHandle == hHandle) + { + //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ + if(HandleInfo->GrantedAccess != 0x0012019F) + { + if(DuplicateHandle(hProcess, hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) + { + RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION); + NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize); + NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize); + NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize); + RtlZeroMemory(HandleFullName, 0x1000); + if(pObjectNameInfo->Name.Length != NULL) + { + WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectNameInfo->Name.Buffer, -1, (LPSTR)HandleFullName, 0x1000, NULL, NULL); + NameFound = true; + if(TranslateName) + { + tmpHandleFullName = TranslateNativeName((char*)HandleFullName); + if(tmpHandleFullName != NULL) + { + VirtualFree(HandleFullName, NULL, MEM_RELEASE); + HandleFullName = tmpHandleFullName; + } + } + } + EngineCloseHandle(myHandle); + break; + } + } + } + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); + TotalHandleCount--; + } + VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + if(!NameFound) + { + VirtualFree(HandleFullName, NULL, MEM_RELEASE); + return(NULL); + } + else + { + return(HandleFullName); + } - VirtualFree(HandleFullName, NULL, MEM_RELEASE); - VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); - return(NULL); + VirtualFree(HandleFullName, NULL, MEM_RELEASE); + VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); + return(NULL); } __declspec(dllexport) void* TITCALL HandlerGetHandleNameW(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, bool TranslateName) { - bool NameFound = false; - HANDLE myHandle = NULL; - LPVOID QuerySystemBuffer; - ULONG QuerySystemBufferSize = 0x2000; - ULONG RequiredSize = NULL; - ULONG TotalHandleCount = NULL; - PNTDLL_QUERY_HANDLE_INFO HandleInfo; - PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo; - LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE); - PPUBLIC_OBJECT_NAME_INFORMATION pObjectNameInfo = (PPUBLIC_OBJECT_NAME_INFORMATION)ObjectNameInfo; - LPVOID HandleFullName = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); - LPVOID tmpHandleFullName = NULL; + bool NameFound = false; + HANDLE myHandle = NULL; + LPVOID QuerySystemBuffer; + ULONG QuerySystemBufferSize = 0x2000; + ULONG RequiredSize = NULL; + ULONG TotalHandleCount = NULL; + PNTDLL_QUERY_HANDLE_INFO HandleInfo; + PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo; + LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE); + PPUBLIC_OBJECT_NAME_INFORMATION pObjectNameInfo = (PPUBLIC_OBJECT_NAME_INFORMATION)ObjectNameInfo; + LPVOID HandleFullName = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); + LPVOID tmpHandleFullName = NULL; - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) - { - QuerySystemBufferSize = RequiredSize; - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - } - RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); - QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; - while(TotalHandleCount > NULL) - { - if(HandleInfo->ProcessId == ProcessId && (HANDLE)HandleInfo->hHandle == hHandle) - { - //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ - if(HandleInfo->GrantedAccess != 0x0012019F) - { - if(DuplicateHandle(hProcess, hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) - { - RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION); - NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize); - NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize); - NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize); - RtlZeroMemory(HandleFullName, 0x1000); - if(pObjectNameInfo->Name.Length != NULL) - { - //WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectNameInfo->Name.Buffer, -1, (LPSTR)HandleFullName, 0x1000, NULL, NULL); - NameFound = true; - lstrcpyW((wchar_t*)HandleFullName, (wchar_t*)pObjectNameInfo->Name.Buffer); - if(TranslateName) - { - tmpHandleFullName = TranslateNativeNameW((wchar_t*)HandleFullName); - if(tmpHandleFullName != NULL) - { - VirtualFree(HandleFullName, NULL, MEM_RELEASE); - HandleFullName = tmpHandleFullName; - } - } - } - EngineCloseHandle(myHandle); - break; - } - } - } - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); - TotalHandleCount--; - } - VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - if(!NameFound) - { - VirtualFree(HandleFullName, NULL, MEM_RELEASE); - return(NULL); - } - else - { - return(HandleFullName); - } + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) + { + QuerySystemBufferSize = RequiredSize; + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + } + RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); + QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; + while(TotalHandleCount > NULL) + { + if(HandleInfo->ProcessId == ProcessId && (HANDLE)HandleInfo->hHandle == hHandle) + { + //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ + if(HandleInfo->GrantedAccess != 0x0012019F) + { + if(DuplicateHandle(hProcess, hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) + { + RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION); + NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize); + NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize); + NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize); + RtlZeroMemory(HandleFullName, 0x1000); + if(pObjectNameInfo->Name.Length != NULL) + { + //WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectNameInfo->Name.Buffer, -1, (LPSTR)HandleFullName, 0x1000, NULL, NULL); + NameFound = true; + lstrcpyW((wchar_t*)HandleFullName, (wchar_t*)pObjectNameInfo->Name.Buffer); + if(TranslateName) + { + tmpHandleFullName = TranslateNativeNameW((wchar_t*)HandleFullName); + if(tmpHandleFullName != NULL) + { + VirtualFree(HandleFullName, NULL, MEM_RELEASE); + HandleFullName = tmpHandleFullName; + } + } + } + EngineCloseHandle(myHandle); + break; + } + } + } + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); + TotalHandleCount--; + } + VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + if(!NameFound) + { + VirtualFree(HandleFullName, NULL, MEM_RELEASE); + return(NULL); + } + else + { + return(HandleFullName); + } - VirtualFree(HandleFullName, NULL, MEM_RELEASE); - VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); - return(NULL); + VirtualFree(HandleFullName, NULL, MEM_RELEASE); + VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); + return(NULL); } __declspec(dllexport) long TITCALL HandlerEnumerateOpenHandles(DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount) { - HANDLE myHandle = NULL; - LPVOID QuerySystemBuffer; - ULONG RequiredSize = NULL; - ULONG TotalHandleCount = NULL; - unsigned int HandleCount = NULL; - ULONG QuerySystemBufferSize = 0x2000; - PNTDLL_QUERY_HANDLE_INFO HandleInfo; + HANDLE myHandle = NULL; + LPVOID QuerySystemBuffer; + ULONG RequiredSize = NULL; + ULONG TotalHandleCount = NULL; + unsigned int HandleCount = NULL; + ULONG QuerySystemBufferSize = 0x2000; + PNTDLL_QUERY_HANDLE_INFO HandleInfo; - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) - { - QuerySystemBufferSize = RequiredSize; - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - } - RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); - QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; - while(TotalHandleCount > NULL) - { - if(HandleInfo->ProcessId == ProcessId && HandleCount < MaxHandleCount) - { - myHandle = (HANDLE)HandleInfo->hHandle; - RtlMoveMemory(HandleBuffer, &myHandle, sizeof HANDLE); - HandleBuffer = (LPVOID)((ULONG_PTR)HandleBuffer + sizeof HANDLE); - HandleCount++; - } - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); - TotalHandleCount--; - } - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - return(HandleCount); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) + { + QuerySystemBufferSize = RequiredSize; + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + } + RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); + QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; + while(TotalHandleCount > NULL) + { + if(HandleInfo->ProcessId == ProcessId && HandleCount < MaxHandleCount) + { + myHandle = (HANDLE)HandleInfo->hHandle; + RtlMoveMemory(HandleBuffer, &myHandle, sizeof HANDLE); + HandleBuffer = (LPVOID)((ULONG_PTR)HandleBuffer + sizeof HANDLE); + HandleCount++; + } + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); + TotalHandleCount--; + } + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + return(HandleCount); - return(NULL); + return(NULL); } __declspec(dllexport) long long TITCALL HandlerGetHandleDetails(HANDLE hProcess, DWORD ProcessId, HANDLE hHandle, DWORD InformationReturn) { - HANDLE myHandle = NULL; - LPVOID QuerySystemBuffer; - ULONG QuerySystemBufferSize = 0x2000; - ULONG RequiredSize = NULL; - ULONG TotalHandleCount = NULL; - PNTDLL_QUERY_HANDLE_INFO HandleInfo; - PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo; - LPVOID HandleFullData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); - LPVOID HandleNameData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); - PPUBLIC_OBJECT_TYPE_INFORMATION pObjectTypeInfo = (PPUBLIC_OBJECT_TYPE_INFORMATION)HandleFullData; - bool DontFreeStringMemory = false; - ULONG_PTR ReturnData = NULL; + HANDLE myHandle = NULL; + LPVOID QuerySystemBuffer; + ULONG QuerySystemBufferSize = 0x2000; + ULONG RequiredSize = NULL; + ULONG TotalHandleCount = NULL; + PNTDLL_QUERY_HANDLE_INFO HandleInfo; + PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo; + LPVOID HandleFullData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); + LPVOID HandleNameData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); + PPUBLIC_OBJECT_TYPE_INFORMATION pObjectTypeInfo = (PPUBLIC_OBJECT_TYPE_INFORMATION)HandleFullData; + bool DontFreeStringMemory = false; + ULONG_PTR ReturnData = NULL; - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) - { - QuerySystemBufferSize = RequiredSize; - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - } - RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); - QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; - while(TotalHandleCount > NULL) - { - if(HandleInfo->ProcessId == ProcessId && (HANDLE)HandleInfo->hHandle == hHandle) - { - if(DuplicateHandle(hProcess, hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) - { - RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION); - NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize); - if(InformationReturn == UE_OPTION_HANDLER_RETURN_HANDLECOUNT) - { - ReturnData = (ULONG_PTR)ObjectBasicInfo.HandleCount; - } - else if(InformationReturn == UE_OPTION_HANDLER_RETURN_ACCESS) - { - ReturnData = (ULONG_PTR)HandleInfo->GrantedAccess; - } - else if(InformationReturn == UE_OPTION_HANDLER_RETURN_FLAGS) - { - ReturnData = (ULONG_PTR)HandleInfo->Flags; - } - else if(InformationReturn == UE_OPTION_HANDLER_RETURN_TYPENAME) - { - //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ - if(HandleInfo->GrantedAccess != 0x0012019F) - { - RtlZeroMemory(HandleFullData, 0x1000); - NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize); - NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize); - RtlZeroMemory(HandleNameData, 0x1000); - if(pObjectTypeInfo->TypeName.Length != NULL) - { - WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectTypeInfo->TypeName.Buffer, -1, (LPSTR)HandleNameData, 0x1000, NULL, NULL); - ReturnData = (ULONG_PTR)HandleNameData; - DontFreeStringMemory = true; - } - } - } - else if(InformationReturn == UE_OPTION_HANDLER_RETURN_TYPENAME_UNICODE) - { - //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ - if(HandleInfo->GrantedAccess != 0x0012019F) - { - RtlZeroMemory(HandleFullData, 0x1000); - NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize); - NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize); - RtlZeroMemory(HandleNameData, 0x1000); - if(pObjectTypeInfo->TypeName.Length != NULL) - { - //WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectTypeInfo->TypeName.Buffer, -1, (LPSTR)HandleNameData, 0x1000, NULL, NULL); - lstrcpyW((wchar_t*)HandleNameData, (wchar_t*)pObjectTypeInfo->TypeName.Buffer); - ReturnData = (ULONG_PTR)HandleNameData; - DontFreeStringMemory = true; - } - } - } - EngineCloseHandle(myHandle); - break; - } - } - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); - TotalHandleCount--; - } - if(!DontFreeStringMemory) - { - VirtualFree(HandleNameData, NULL, MEM_RELEASE); - } - VirtualFree(HandleFullData, NULL, MEM_RELEASE); - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - return(ReturnData); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) + { + QuerySystemBufferSize = RequiredSize; + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + } + RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); + QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; + while(TotalHandleCount > NULL) + { + if(HandleInfo->ProcessId == ProcessId && (HANDLE)HandleInfo->hHandle == hHandle) + { + if(DuplicateHandle(hProcess, hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) + { + RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION); + NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize); + if(InformationReturn == UE_OPTION_HANDLER_RETURN_HANDLECOUNT) + { + ReturnData = (ULONG_PTR)ObjectBasicInfo.HandleCount; + } + else if(InformationReturn == UE_OPTION_HANDLER_RETURN_ACCESS) + { + ReturnData = (ULONG_PTR)HandleInfo->GrantedAccess; + } + else if(InformationReturn == UE_OPTION_HANDLER_RETURN_FLAGS) + { + ReturnData = (ULONG_PTR)HandleInfo->Flags; + } + else if(InformationReturn == UE_OPTION_HANDLER_RETURN_TYPENAME) + { + //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ + if(HandleInfo->GrantedAccess != 0x0012019F) + { + RtlZeroMemory(HandleFullData, 0x1000); + NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize); + NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize); + RtlZeroMemory(HandleNameData, 0x1000); + if(pObjectTypeInfo->TypeName.Length != NULL) + { + WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectTypeInfo->TypeName.Buffer, -1, (LPSTR)HandleNameData, 0x1000, NULL, NULL); + ReturnData = (ULONG_PTR)HandleNameData; + DontFreeStringMemory = true; + } + } + } + else if(InformationReturn == UE_OPTION_HANDLER_RETURN_TYPENAME_UNICODE) + { + //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ + if(HandleInfo->GrantedAccess != 0x0012019F) + { + RtlZeroMemory(HandleFullData, 0x1000); + NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize); + NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize); + RtlZeroMemory(HandleNameData, 0x1000); + if(pObjectTypeInfo->TypeName.Length != NULL) + { + //WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectTypeInfo->TypeName.Buffer, -1, (LPSTR)HandleNameData, 0x1000, NULL, NULL); + lstrcpyW((wchar_t*)HandleNameData, (wchar_t*)pObjectTypeInfo->TypeName.Buffer); + ReturnData = (ULONG_PTR)HandleNameData; + DontFreeStringMemory = true; + } + } + } + EngineCloseHandle(myHandle); + break; + } + } + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); + TotalHandleCount--; + } + if(!DontFreeStringMemory) + { + VirtualFree(HandleNameData, NULL, MEM_RELEASE); + } + VirtualFree(HandleFullData, NULL, MEM_RELEASE); + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + return(ReturnData); - if(!DontFreeStringMemory) - { - VirtualFree(HandleNameData, NULL, MEM_RELEASE); - } - VirtualFree(HandleFullData, NULL, MEM_RELEASE); - return(NULL); + if(!DontFreeStringMemory) + { + VirtualFree(HandleNameData, NULL, MEM_RELEASE); + } + VirtualFree(HandleFullData, NULL, MEM_RELEASE); + return(NULL); } __declspec(dllexport) bool TITCALL HandlerCloseRemoteHandle(HANDLE hProcess, HANDLE hHandle) { - HANDLE myHandle; + HANDLE myHandle; - if(hProcess != NULL) - { - DuplicateHandle(hProcess, hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_CLOSE_SOURCE); - EngineCloseHandle(myHandle); - } - return false; + if(hProcess != NULL) + { + DuplicateHandle(hProcess, hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_CLOSE_SOURCE); + EngineCloseHandle(myHandle); + } + return false; } __declspec(dllexport) long TITCALL HandlerEnumerateLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount) { - wchar_t uniFileOrFolderName[MAX_PATH] = {}; + wchar_t uniFileOrFolderName[MAX_PATH] = {}; - if(szFileOrFolderName != NULL) - { - MultiByteToWideChar(CP_ACP, NULL, szFileOrFolderName, lstrlenA(szFileOrFolderName)+1, uniFileOrFolderName, sizeof(uniFileOrFolderName)/(sizeof(uniFileOrFolderName[0]))); - return(HandlerEnumerateLockHandlesW(uniFileOrFolderName, NameIsFolder, NameIsTranslated, HandleDataBuffer, MaxHandleCount)); - } - else - { - return(NULL); - } + if(szFileOrFolderName != NULL) + { + MultiByteToWideChar(CP_ACP, NULL, szFileOrFolderName, lstrlenA(szFileOrFolderName)+1, uniFileOrFolderName, sizeof(uniFileOrFolderName)/(sizeof(uniFileOrFolderName[0]))); + return(HandlerEnumerateLockHandlesW(uniFileOrFolderName, NameIsFolder, NameIsTranslated, HandleDataBuffer, MaxHandleCount)); + } + else + { + return(NULL); + } } __declspec(dllexport) long TITCALL HandlerEnumerateLockHandlesW(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated, LPVOID HandleDataBuffer, DWORD MaxHandleCount) { - int FoundHandles = NULL; - HANDLE hProcess = NULL; - HANDLE myHandle = NULL; - HANDLE CopyHandle = NULL; - LPVOID QuerySystemBuffer; - ULONG QuerySystemBufferSize = 0x2000; - ULONG RequiredSize = NULL; - ULONG TotalHandleCount = NULL; - DWORD LastProcessId = NULL; + int FoundHandles = NULL; + HANDLE hProcess = NULL; + HANDLE myHandle = NULL; + HANDLE CopyHandle = NULL; + LPVOID QuerySystemBuffer; + ULONG QuerySystemBufferSize = 0x2000; + ULONG RequiredSize = NULL; + ULONG TotalHandleCount = NULL; + DWORD LastProcessId = NULL; - PNTDLL_QUERY_HANDLE_INFO HandleInfo; - PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo; - LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE); - PPUBLIC_OBJECT_NAME_INFORMATION pObjectNameInfo = (PPUBLIC_OBJECT_NAME_INFORMATION)ObjectNameInfo; - LPVOID HandleFullName = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); - int LenFileOrFolderName = lstrlenW(szFileOrFolderName); - LPVOID tmpHandleFullName = NULL; + PNTDLL_QUERY_HANDLE_INFO HandleInfo; + PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo; + LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE); + PPUBLIC_OBJECT_NAME_INFORMATION pObjectNameInfo = (PPUBLIC_OBJECT_NAME_INFORMATION)ObjectNameInfo; + LPVOID HandleFullName = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); + int LenFileOrFolderName = lstrlenW(szFileOrFolderName); + LPVOID tmpHandleFullName = NULL; - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) - { - QuerySystemBufferSize = RequiredSize; - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - } - RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); - QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; - while(TotalHandleCount > NULL) - { - if(LastProcessId != HandleInfo->ProcessId) - { - if(hProcess != NULL) - { - EngineCloseHandle(hProcess); - } - hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE, false, HandleInfo->ProcessId); - LastProcessId = HandleInfo->ProcessId; - } - if(hProcess != NULL) - { - //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ - if(HandleInfo->GrantedAccess != 0x0012019F) - { - if(DuplicateHandle(hProcess, (HANDLE)HandleInfo->hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) - { - RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION); - NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize); - NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize); - NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize); - RtlZeroMemory(HandleFullName, 0x1000); - if(pObjectNameInfo->Name.Length != NULL) - { - //WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectNameInfo->Name.Buffer, -1, (LPSTR)HandleFullName, 0x1000, NULL, NULL); - lstrcpyW((wchar_t*)HandleFullName, (wchar_t*)pObjectNameInfo->Name.Buffer); - if(NameIsTranslated) - { - tmpHandleFullName = TranslateNativeNameW((wchar_t*)HandleFullName); - if(tmpHandleFullName != NULL) - { - VirtualFree(HandleFullName, NULL, MEM_RELEASE); - HandleFullName = tmpHandleFullName; - } - } - if(NameIsFolder) - { - if(lstrlenW((LPCWSTR)HandleFullName) > LenFileOrFolderName) - { - RtlZeroMemory((LPVOID)((ULONG_PTR)HandleFullName + LenFileOrFolderName * 2), 2); - } - } - if(lstrcmpiW((LPCWSTR)HandleFullName, szFileOrFolderName) == NULL && MaxHandleCount > NULL) - { - RtlMoveMemory(HandleDataBuffer, &HandleInfo->ProcessId, sizeof ULONG); - HandleDataBuffer = (LPVOID)((ULONG_PTR)HandleDataBuffer + sizeof ULONG); - CopyHandle = (HANDLE)HandleInfo->hHandle; - RtlMoveMemory(HandleDataBuffer, &CopyHandle, sizeof HANDLE); - HandleDataBuffer = (LPVOID)((ULONG_PTR)HandleDataBuffer + sizeof HANDLE); - FoundHandles++; - MaxHandleCount--; - } - } - EngineCloseHandle(myHandle); - } - } - } - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); - TotalHandleCount--; - } - VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - VirtualFree(HandleFullName, NULL, MEM_RELEASE); - return(FoundHandles); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) + { + QuerySystemBufferSize = RequiredSize; + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + } + RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); + QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; + while(TotalHandleCount > NULL) + { + if(LastProcessId != HandleInfo->ProcessId) + { + if(hProcess != NULL) + { + EngineCloseHandle(hProcess); + } + hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE, false, HandleInfo->ProcessId); + LastProcessId = HandleInfo->ProcessId; + } + if(hProcess != NULL) + { + //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ + if(HandleInfo->GrantedAccess != 0x0012019F) + { + if(DuplicateHandle(hProcess, (HANDLE)HandleInfo->hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) + { + RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION); + NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize); + NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize); + NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize); + RtlZeroMemory(HandleFullName, 0x1000); + if(pObjectNameInfo->Name.Length != NULL) + { + //WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectNameInfo->Name.Buffer, -1, (LPSTR)HandleFullName, 0x1000, NULL, NULL); + lstrcpyW((wchar_t*)HandleFullName, (wchar_t*)pObjectNameInfo->Name.Buffer); + if(NameIsTranslated) + { + tmpHandleFullName = TranslateNativeNameW((wchar_t*)HandleFullName); + if(tmpHandleFullName != NULL) + { + VirtualFree(HandleFullName, NULL, MEM_RELEASE); + HandleFullName = tmpHandleFullName; + } + } + if(NameIsFolder) + { + if(lstrlenW((LPCWSTR)HandleFullName) > LenFileOrFolderName) + { + RtlZeroMemory((LPVOID)((ULONG_PTR)HandleFullName + LenFileOrFolderName * 2), 2); + } + } + if(lstrcmpiW((LPCWSTR)HandleFullName, szFileOrFolderName) == NULL && MaxHandleCount > NULL) + { + RtlMoveMemory(HandleDataBuffer, &HandleInfo->ProcessId, sizeof ULONG); + HandleDataBuffer = (LPVOID)((ULONG_PTR)HandleDataBuffer + sizeof ULONG); + CopyHandle = (HANDLE)HandleInfo->hHandle; + RtlMoveMemory(HandleDataBuffer, &CopyHandle, sizeof HANDLE); + HandleDataBuffer = (LPVOID)((ULONG_PTR)HandleDataBuffer + sizeof HANDLE); + FoundHandles++; + MaxHandleCount--; + } + } + EngineCloseHandle(myHandle); + } + } + } + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); + TotalHandleCount--; + } + VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + VirtualFree(HandleFullName, NULL, MEM_RELEASE); + return(FoundHandles); } __declspec(dllexport) bool TITCALL HandlerCloseAllLockHandles(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated) { - wchar_t uniFileOrFolderName[MAX_PATH] = {}; + wchar_t uniFileOrFolderName[MAX_PATH] = {}; - if(szFileOrFolderName != NULL) - { - MultiByteToWideChar(CP_ACP, NULL, szFileOrFolderName, lstrlenA(szFileOrFolderName)+1, uniFileOrFolderName, sizeof(uniFileOrFolderName)/(sizeof(uniFileOrFolderName[0]))); - return(HandlerCloseAllLockHandlesW(uniFileOrFolderName, NameIsFolder, NameIsTranslated)); - } - else - { - return false; - } + if(szFileOrFolderName != NULL) + { + MultiByteToWideChar(CP_ACP, NULL, szFileOrFolderName, lstrlenA(szFileOrFolderName)+1, uniFileOrFolderName, sizeof(uniFileOrFolderName)/(sizeof(uniFileOrFolderName[0]))); + return(HandlerCloseAllLockHandlesW(uniFileOrFolderName, NameIsFolder, NameIsTranslated)); + } + else + { + return false; + } } __declspec(dllexport) bool TITCALL HandlerCloseAllLockHandlesW(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated) { - bool AllHandled = true; - HANDLE hProcess = NULL; - HANDLE myHandle = NULL; - HANDLE CopyHandle = NULL; - LPVOID QuerySystemBuffer; - ULONG QuerySystemBufferSize = 0x2000; - ULONG RequiredSize = NULL; - ULONG TotalHandleCount = NULL; - DWORD LastProcessId = NULL; - PNTDLL_QUERY_HANDLE_INFO HandleInfo; - PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo; - LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE); - PPUBLIC_OBJECT_NAME_INFORMATION pObjectNameInfo = (PPUBLIC_OBJECT_NAME_INFORMATION)ObjectNameInfo; - LPVOID HandleFullName = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); - int LenFileOrFolderName = lstrlenW(szFileOrFolderName); - LPVOID tmpHandleFullName = NULL; + bool AllHandled = true; + HANDLE hProcess = NULL; + HANDLE myHandle = NULL; + HANDLE CopyHandle = NULL; + LPVOID QuerySystemBuffer; + ULONG QuerySystemBufferSize = 0x2000; + ULONG RequiredSize = NULL; + ULONG TotalHandleCount = NULL; + DWORD LastProcessId = NULL; + PNTDLL_QUERY_HANDLE_INFO HandleInfo; + PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo; + LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE); + PPUBLIC_OBJECT_NAME_INFORMATION pObjectNameInfo = (PPUBLIC_OBJECT_NAME_INFORMATION)ObjectNameInfo; + LPVOID HandleFullName = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); + int LenFileOrFolderName = lstrlenW(szFileOrFolderName); + LPVOID tmpHandleFullName = NULL; - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) - { - QuerySystemBufferSize = RequiredSize; - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - } - RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); - QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; - while(TotalHandleCount > NULL) - { - if(LastProcessId != HandleInfo->ProcessId) - { - if(hProcess != NULL) - { - EngineCloseHandle(hProcess); - } - hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE, false, HandleInfo->ProcessId); - LastProcessId = HandleInfo->ProcessId; - } - if(hProcess != NULL) - { - //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ - if(HandleInfo->GrantedAccess != 0x0012019F) - { - if(DuplicateHandle(hProcess, (HANDLE)HandleInfo->hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) - { - RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION); - NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize); - NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize); - NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize); - RtlZeroMemory(HandleFullName, 0x1000); - if(pObjectNameInfo->Name.Length != NULL) - { - //WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectNameInfo->Name.Buffer, -1, (LPSTR)HandleFullName, 0x1000, NULL, NULL); - lstrcpyW((wchar_t*)HandleFullName, (wchar_t*)pObjectNameInfo->Name.Buffer); - if(NameIsTranslated) - { - tmpHandleFullName = TranslateNativeNameW((wchar_t*)HandleFullName); - if(tmpHandleFullName != NULL) - { - VirtualFree(HandleFullName, NULL, MEM_RELEASE); - HandleFullName = tmpHandleFullName; - } - } - if(NameIsFolder) - { - if(lstrlenW((LPCWSTR)HandleFullName) > LenFileOrFolderName) - { - RtlZeroMemory((LPVOID)((ULONG_PTR)HandleFullName + LenFileOrFolderName * 2), 2); - } - } - if(lstrcmpiW((LPCWSTR)HandleFullName, szFileOrFolderName) == NULL) - { - if(!HandlerCloseRemoteHandle(hProcess, (HANDLE)HandleInfo->hHandle)) - { - AllHandled = false; - } - } - } - EngineCloseHandle(myHandle); - } - } - } - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); - TotalHandleCount--; - } - VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - VirtualFree(HandleFullName, NULL, MEM_RELEASE); - if(AllHandled) - { - return true; - } - else - { - return false; - } + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) + { + QuerySystemBufferSize = RequiredSize; + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + } + RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); + QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; + while(TotalHandleCount > NULL) + { + if(LastProcessId != HandleInfo->ProcessId) + { + if(hProcess != NULL) + { + EngineCloseHandle(hProcess); + } + hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE, false, HandleInfo->ProcessId); + LastProcessId = HandleInfo->ProcessId; + } + if(hProcess != NULL) + { + //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ + if(HandleInfo->GrantedAccess != 0x0012019F) + { + if(DuplicateHandle(hProcess, (HANDLE)HandleInfo->hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) + { + RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION); + NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize); + NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize); + NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize); + RtlZeroMemory(HandleFullName, 0x1000); + if(pObjectNameInfo->Name.Length != NULL) + { + //WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectNameInfo->Name.Buffer, -1, (LPSTR)HandleFullName, 0x1000, NULL, NULL); + lstrcpyW((wchar_t*)HandleFullName, (wchar_t*)pObjectNameInfo->Name.Buffer); + if(NameIsTranslated) + { + tmpHandleFullName = TranslateNativeNameW((wchar_t*)HandleFullName); + if(tmpHandleFullName != NULL) + { + VirtualFree(HandleFullName, NULL, MEM_RELEASE); + HandleFullName = tmpHandleFullName; + } + } + if(NameIsFolder) + { + if(lstrlenW((LPCWSTR)HandleFullName) > LenFileOrFolderName) + { + RtlZeroMemory((LPVOID)((ULONG_PTR)HandleFullName + LenFileOrFolderName * 2), 2); + } + } + if(lstrcmpiW((LPCWSTR)HandleFullName, szFileOrFolderName) == NULL) + { + if(!HandlerCloseRemoteHandle(hProcess, (HANDLE)HandleInfo->hHandle)) + { + AllHandled = false; + } + } + } + EngineCloseHandle(myHandle); + } + } + } + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); + TotalHandleCount--; + } + VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + VirtualFree(HandleFullName, NULL, MEM_RELEASE); + if(AllHandled) + { + return true; + } + else + { + return false; + } } __declspec(dllexport) bool TITCALL HandlerIsFileLocked(char* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated) { - wchar_t uniFileOrFolderName[MAX_PATH] = {}; + wchar_t uniFileOrFolderName[MAX_PATH] = {}; - if(szFileOrFolderName != NULL) - { - MultiByteToWideChar(CP_ACP, NULL, szFileOrFolderName, lstrlenA(szFileOrFolderName)+1, uniFileOrFolderName, sizeof(uniFileOrFolderName)/(sizeof(uniFileOrFolderName[0]))); - return(HandlerIsFileLockedW(uniFileOrFolderName, NameIsFolder, NameIsTranslated)); - } - else - { - return false; - } + if(szFileOrFolderName != NULL) + { + MultiByteToWideChar(CP_ACP, NULL, szFileOrFolderName, lstrlenA(szFileOrFolderName)+1, uniFileOrFolderName, sizeof(uniFileOrFolderName)/(sizeof(uniFileOrFolderName[0]))); + return(HandlerIsFileLockedW(uniFileOrFolderName, NameIsFolder, NameIsTranslated)); + } + else + { + return false; + } } __declspec(dllexport) bool TITCALL HandlerIsFileLockedW(wchar_t* szFileOrFolderName, bool NameIsFolder, bool NameIsTranslated) { - HANDLE hProcess = NULL; - HANDLE myHandle = NULL; - HANDLE CopyHandle = NULL; - LPVOID QuerySystemBuffer; - ULONG QuerySystemBufferSize = 0x2000; - ULONG RequiredSize = NULL; - ULONG TotalHandleCount = NULL; - DWORD LastProcessId = NULL; + HANDLE hProcess = NULL; + HANDLE myHandle = NULL; + HANDLE CopyHandle = NULL; + LPVOID QuerySystemBuffer; + ULONG QuerySystemBufferSize = 0x2000; + ULONG RequiredSize = NULL; + ULONG TotalHandleCount = NULL; + DWORD LastProcessId = NULL; - PNTDLL_QUERY_HANDLE_INFO HandleInfo; - PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo; - LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE); - PPUBLIC_OBJECT_NAME_INFORMATION pObjectNameInfo = (PPUBLIC_OBJECT_NAME_INFORMATION)ObjectNameInfo; - LPVOID HandleFullName = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); - int LenFileOrFolderName = lstrlenW(szFileOrFolderName); - LPVOID tmpHandleFullName = NULL; + PNTDLL_QUERY_HANDLE_INFO HandleInfo; + PUBLIC_OBJECT_BASIC_INFORMATION ObjectBasicInfo; + LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE); + PPUBLIC_OBJECT_NAME_INFORMATION pObjectNameInfo = (PPUBLIC_OBJECT_NAME_INFORMATION)ObjectNameInfo; + LPVOID HandleFullName = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); + int LenFileOrFolderName = lstrlenW(szFileOrFolderName); + LPVOID tmpHandleFullName = NULL; - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) - { - QuerySystemBufferSize = RequiredSize; - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - } - RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); - QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; - while(TotalHandleCount > NULL) - { - if(LastProcessId != HandleInfo->ProcessId) - { - if(hProcess != NULL) - { - EngineCloseHandle(hProcess); - } - hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE, false, HandleInfo->ProcessId); - LastProcessId = HandleInfo->ProcessId; - } - if(hProcess != NULL) - { - //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ - if(HandleInfo->GrantedAccess != 0x0012019F) - { - if(DuplicateHandle(hProcess, (HANDLE)HandleInfo->hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) - { - RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION); - NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize); - NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize); - NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize); - RtlZeroMemory(HandleFullName, 0x1000); - if(pObjectNameInfo->Name.Length != NULL) - { - //WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectNameInfo->Name.Buffer, -1, (LPSTR)HandleFullName, 0x1000, NULL, NULL); - lstrcpyW((wchar_t*)HandleFullName, (wchar_t*)pObjectNameInfo->Name.Buffer); - if(NameIsTranslated) - { - tmpHandleFullName = TranslateNativeNameW((wchar_t*)HandleFullName); - if(tmpHandleFullName != NULL) - { - VirtualFree(HandleFullName, NULL, MEM_RELEASE); - HandleFullName = tmpHandleFullName; - } - } - if(NameIsFolder) - { - if(lstrlenW((LPCWSTR)HandleFullName) > LenFileOrFolderName) - { - RtlZeroMemory((LPVOID)((ULONG_PTR)HandleFullName + LenFileOrFolderName * 2), 2); - } - } - if(lstrcmpiW((LPCWSTR)HandleFullName, szFileOrFolderName) == NULL) - { - VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - VirtualFree(HandleFullName, NULL, MEM_RELEASE); - EngineCloseHandle(myHandle); - return true; - } - } - EngineCloseHandle(myHandle); - } - } - } - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); - TotalHandleCount--; - } - VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - VirtualFree(HandleFullName, NULL, MEM_RELEASE); - return false; + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) + { + QuerySystemBufferSize = RequiredSize; + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + } + RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); + QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; + while(TotalHandleCount > NULL) + { + if(LastProcessId != HandleInfo->ProcessId) + { + if(hProcess != NULL) + { + EngineCloseHandle(hProcess); + } + hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE, false, HandleInfo->ProcessId); + LastProcessId = HandleInfo->ProcessId; + } + if(hProcess != NULL) + { + //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ + if(HandleInfo->GrantedAccess != 0x0012019F) + { + if(DuplicateHandle(hProcess, (HANDLE)HandleInfo->hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) + { + RtlZeroMemory(&ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION); + NtQueryObject(myHandle, ObjectBasicInformation, &ObjectBasicInfo, sizeof PUBLIC_OBJECT_BASIC_INFORMATION, &RequiredSize); + NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize); + NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize); + RtlZeroMemory(HandleFullName, 0x1000); + if(pObjectNameInfo->Name.Length != NULL) + { + //WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectNameInfo->Name.Buffer, -1, (LPSTR)HandleFullName, 0x1000, NULL, NULL); + lstrcpyW((wchar_t*)HandleFullName, (wchar_t*)pObjectNameInfo->Name.Buffer); + if(NameIsTranslated) + { + tmpHandleFullName = TranslateNativeNameW((wchar_t*)HandleFullName); + if(tmpHandleFullName != NULL) + { + VirtualFree(HandleFullName, NULL, MEM_RELEASE); + HandleFullName = tmpHandleFullName; + } + } + if(NameIsFolder) + { + if(lstrlenW((LPCWSTR)HandleFullName) > LenFileOrFolderName) + { + RtlZeroMemory((LPVOID)((ULONG_PTR)HandleFullName + LenFileOrFolderName * 2), 2); + } + } + if(lstrcmpiW((LPCWSTR)HandleFullName, szFileOrFolderName) == NULL) + { + VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + VirtualFree(HandleFullName, NULL, MEM_RELEASE); + EngineCloseHandle(myHandle); + return true; + } + } + EngineCloseHandle(myHandle); + } + } + } + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); + TotalHandleCount--; + } + VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + VirtualFree(HandleFullName, NULL, MEM_RELEASE); + return false; } // TitanEngine.Handler[Mutex].functions: __declspec(dllexport) long TITCALL HandlerEnumerateOpenMutexes(HANDLE hProcess, DWORD ProcessId, LPVOID HandleBuffer, DWORD MaxHandleCount) { - HANDLE myHandle = NULL; - HANDLE copyHandle = NULL; - LPVOID QuerySystemBuffer; - ULONG RequiredSize = NULL; - ULONG TotalHandleCount = NULL; - unsigned int HandleCount = NULL; - ULONG QuerySystemBufferSize = 0x2000; + HANDLE myHandle = NULL; + HANDLE copyHandle = NULL; + LPVOID QuerySystemBuffer; + ULONG RequiredSize = NULL; + ULONG TotalHandleCount = NULL; + unsigned int HandleCount = NULL; + ULONG QuerySystemBufferSize = 0x2000; - PNTDLL_QUERY_HANDLE_INFO HandleInfo; - LPVOID HandleFullData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); - LPVOID HandleNameData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); - PPUBLIC_OBJECT_TYPE_INFORMATION pObjectTypeInfo = (PPUBLIC_OBJECT_TYPE_INFORMATION)HandleFullData; + PNTDLL_QUERY_HANDLE_INFO HandleInfo; + LPVOID HandleFullData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); + LPVOID HandleNameData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); + PPUBLIC_OBJECT_TYPE_INFORMATION pObjectTypeInfo = (PPUBLIC_OBJECT_TYPE_INFORMATION)HandleFullData; - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) - { - QuerySystemBufferSize = RequiredSize; - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - } - RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); - QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; - while(TotalHandleCount > NULL) - { - if(HandleInfo->ProcessId == ProcessId && HandleCount < MaxHandleCount) - { - //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ - if(HandleInfo->GrantedAccess != 0x0012019F) - { - if(DuplicateHandle(hProcess, (HANDLE)HandleInfo->hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) - { - RtlZeroMemory(HandleFullData, 0x1000); - NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize); - NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize); - RtlZeroMemory(HandleNameData, 0x1000); - if(pObjectTypeInfo->TypeName.Length != NULL) - { - WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectTypeInfo->TypeName.Buffer, -1, (LPSTR)HandleNameData, 0x1000, NULL, NULL); - if(lstrcmpiA((LPCSTR)HandleNameData, "Mutant") == NULL) - { - copyHandle = (HANDLE)HandleInfo->hHandle; - RtlMoveMemory(HandleBuffer, ©Handle, sizeof HANDLE); - HandleBuffer = (LPVOID)((ULONG_PTR)HandleBuffer + sizeof HANDLE); - HandleCount++; - } - } - EngineCloseHandle(myHandle); - } - } - } - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); - TotalHandleCount--; - } - VirtualFree(HandleFullData, NULL, MEM_RELEASE); - VirtualFree(HandleNameData, NULL, MEM_RELEASE); - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - return(HandleCount); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) + { + QuerySystemBufferSize = RequiredSize; + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + } + RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); + QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; + while(TotalHandleCount > NULL) + { + if(HandleInfo->ProcessId == ProcessId && HandleCount < MaxHandleCount) + { + //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ + if(HandleInfo->GrantedAccess != 0x0012019F) + { + if(DuplicateHandle(hProcess, (HANDLE)HandleInfo->hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) + { + RtlZeroMemory(HandleFullData, 0x1000); + NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize); + NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize); + RtlZeroMemory(HandleNameData, 0x1000); + if(pObjectTypeInfo->TypeName.Length != NULL) + { + WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectTypeInfo->TypeName.Buffer, -1, (LPSTR)HandleNameData, 0x1000, NULL, NULL); + if(lstrcmpiA((LPCSTR)HandleNameData, "Mutant") == NULL) + { + copyHandle = (HANDLE)HandleInfo->hHandle; + RtlMoveMemory(HandleBuffer, ©Handle, sizeof HANDLE); + HandleBuffer = (LPVOID)((ULONG_PTR)HandleBuffer + sizeof HANDLE); + HandleCount++; + } + } + EngineCloseHandle(myHandle); + } + } + } + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); + TotalHandleCount--; + } + VirtualFree(HandleFullData, NULL, MEM_RELEASE); + VirtualFree(HandleNameData, NULL, MEM_RELEASE); + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + return(HandleCount); } __declspec(dllexport) long long TITCALL HandlerGetOpenMutexHandle(HANDLE hProcess, DWORD ProcessId, char* szMutexString) { - wchar_t uniMutexString[MAX_PATH] = {}; + wchar_t uniMutexString[MAX_PATH] = {}; - if(szMutexString != NULL) - { - MultiByteToWideChar(CP_ACP, NULL, szMutexString, lstrlenA(szMutexString)+1, uniMutexString, sizeof(uniMutexString)/(sizeof(uniMutexString[0]))); - return((ULONG_PTR)HandlerGetOpenMutexHandleW(hProcess, ProcessId, uniMutexString)); - } - else - { - return(NULL); - } + if(szMutexString != NULL) + { + MultiByteToWideChar(CP_ACP, NULL, szMutexString, lstrlenA(szMutexString)+1, uniMutexString, sizeof(uniMutexString)/(sizeof(uniMutexString[0]))); + return((ULONG_PTR)HandlerGetOpenMutexHandleW(hProcess, ProcessId, uniMutexString)); + } + else + { + return(NULL); + } } __declspec(dllexport) long long TITCALL HandlerGetOpenMutexHandleW(HANDLE hProcess, DWORD ProcessId, wchar_t* szMutexString) { - if(!szMutexString || lstrlenW(szMutexString)>=512) - return 0; - int i; - HANDLE myHandle; - LPVOID HandleBuffer = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); - LPVOID cHandleBuffer = HandleBuffer; - int OpenHandleCount = HandlerEnumerateOpenMutexes(hProcess, ProcessId, HandleBuffer, 0x1000 / sizeof HANDLE); - wchar_t RealMutexName[512] = L"\\BaseNamedObjects\\"; - wchar_t* HandleName; + if(!szMutexString || lstrlenW(szMutexString)>=512) + return 0; + int i; + HANDLE myHandle; + LPVOID HandleBuffer = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); + LPVOID cHandleBuffer = HandleBuffer; + int OpenHandleCount = HandlerEnumerateOpenMutexes(hProcess, ProcessId, HandleBuffer, 0x1000 / sizeof HANDLE); + wchar_t RealMutexName[512] = L"\\BaseNamedObjects\\"; + wchar_t* HandleName; - if(OpenHandleCount > NULL) - { - lstrcatW(RealMutexName, szMutexString); - for(i = 0; i < OpenHandleCount; i++) - { - RtlMoveMemory(&myHandle, cHandleBuffer, sizeof HANDLE); - HandleName = (wchar_t*)HandlerGetHandleNameW(hProcess, ProcessId, myHandle, true); - if(HandleName != NULL) - { - if(lstrcmpiW(HandleName, RealMutexName) == NULL) - { - VirtualFree(HandleBuffer, NULL, MEM_RELEASE); - return((ULONG_PTR)myHandle); - } - } - cHandleBuffer = (LPVOID)((ULONG_PTR)cHandleBuffer + sizeof HANDLE); - } - } - VirtualFree(HandleBuffer, NULL, MEM_RELEASE); - return(NULL); + if(OpenHandleCount > NULL) + { + lstrcatW(RealMutexName, szMutexString); + for(i = 0; i < OpenHandleCount; i++) + { + RtlMoveMemory(&myHandle, cHandleBuffer, sizeof HANDLE); + HandleName = (wchar_t*)HandlerGetHandleNameW(hProcess, ProcessId, myHandle, true); + if(HandleName != NULL) + { + if(lstrcmpiW(HandleName, RealMutexName) == NULL) + { + VirtualFree(HandleBuffer, NULL, MEM_RELEASE); + return((ULONG_PTR)myHandle); + } + } + cHandleBuffer = (LPVOID)((ULONG_PTR)cHandleBuffer + sizeof HANDLE); + } + } + VirtualFree(HandleBuffer, NULL, MEM_RELEASE); + return(NULL); } __declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutex(char* szMutexString) { - wchar_t uniMutexString[MAX_PATH] = {}; + wchar_t uniMutexString[MAX_PATH] = {}; - if(szMutexString != NULL) - { - MultiByteToWideChar(CP_ACP, NULL, szMutexString, lstrlenA(szMutexString)+1, uniMutexString, sizeof(uniMutexString)/(sizeof(uniMutexString[0]))); - return(HandlerGetProcessIdWhichCreatedMutexW(uniMutexString)); - } - else - { - return(NULL); - } + if(szMutexString != NULL) + { + MultiByteToWideChar(CP_ACP, NULL, szMutexString, lstrlenA(szMutexString)+1, uniMutexString, sizeof(uniMutexString)/(sizeof(uniMutexString[0]))); + return(HandlerGetProcessIdWhichCreatedMutexW(uniMutexString)); + } + else + { + return(NULL); + } } __declspec(dllexport) long TITCALL HandlerGetProcessIdWhichCreatedMutexW(wchar_t* szMutexString) { - if(!szMutexString || lstrlenW(szMutexString)>=512) - return 0; - HANDLE hProcess = NULL; - DWORD ReturnData = NULL; - HANDLE myHandle = NULL; - LPVOID QuerySystemBuffer; - ULONG RequiredSize = NULL; - DWORD LastProcessId = NULL; - ULONG TotalHandleCount = NULL; - ULONG QuerySystemBufferSize = 0x2000; - PNTDLL_QUERY_HANDLE_INFO HandleInfo; - LPVOID HandleFullData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); - LPVOID HandleNameData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); - PPUBLIC_OBJECT_TYPE_INFORMATION pObjectTypeInfo = (PPUBLIC_OBJECT_TYPE_INFORMATION)HandleFullData; - LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE); - PPUBLIC_OBJECT_NAME_INFORMATION pObjectNameInfo = (PPUBLIC_OBJECT_NAME_INFORMATION)ObjectNameInfo; - wchar_t RealMutexName[512] = L"\\BaseNamedObjects\\"; + if(!szMutexString || lstrlenW(szMutexString)>=512) + return 0; + HANDLE hProcess = NULL; + DWORD ReturnData = NULL; + HANDLE myHandle = NULL; + LPVOID QuerySystemBuffer; + ULONG RequiredSize = NULL; + DWORD LastProcessId = NULL; + ULONG TotalHandleCount = NULL; + ULONG QuerySystemBufferSize = 0x2000; + PNTDLL_QUERY_HANDLE_INFO HandleInfo; + LPVOID HandleFullData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); + LPVOID HandleNameData = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); + PPUBLIC_OBJECT_TYPE_INFORMATION pObjectTypeInfo = (PPUBLIC_OBJECT_TYPE_INFORMATION)HandleFullData; + LPVOID ObjectNameInfo = VirtualAlloc(NULL, 0x2000, MEM_COMMIT, PAGE_READWRITE); + PPUBLIC_OBJECT_NAME_INFORMATION pObjectNameInfo = (PPUBLIC_OBJECT_NAME_INFORMATION)ObjectNameInfo; + wchar_t RealMutexName[512] = L"\\BaseNamedObjects\\"; - lstrcatW(RealMutexName, szMutexString); - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) - { - QuerySystemBufferSize = RequiredSize; - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); - } - RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); - QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; - while(TotalHandleCount > NULL) - { - if(LastProcessId != HandleInfo->ProcessId) - { - if(hProcess != NULL) - { - EngineCloseHandle(hProcess); - } - hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE, false, HandleInfo->ProcessId); - LastProcessId = HandleInfo->ProcessId; - } - if(hProcess != NULL) - { - //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ - if(HandleInfo->GrantedAccess != 0x0012019F) - { - if(DuplicateHandle(hProcess, (HANDLE)HandleInfo->hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) - { - RtlZeroMemory(HandleFullData, 0x1000); - NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize); - NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize); - RtlZeroMemory(HandleNameData, 0x1000); - if(pObjectTypeInfo->TypeName.Length != NULL) - { - //WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectTypeInfo->TypeName.Buffer, -1, (LPSTR)HandleNameData, 0x1000, NULL, NULL); - lstrcpyW((wchar_t*)HandleNameData, (wchar_t*)pObjectNameInfo->Name.Buffer); - if(lstrcmpiW((LPCWSTR)HandleNameData, L"Mutant") == NULL) - { - NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize); - NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize); - RtlZeroMemory(HandleNameData, 0x1000); - if(pObjectNameInfo->Name.Length != NULL) - { - RtlZeroMemory(HandleNameData, 0x1000); - //WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectNameInfo->Name.Buffer, -1, (LPSTR)HandleNameData, 0x1000, NULL, NULL); - lstrcpyW((wchar_t*)HandleNameData, (wchar_t*)pObjectNameInfo->Name.Buffer); - if(lstrcmpiW((LPCWSTR)HandleNameData, RealMutexName) == NULL) - { - ReturnData = HandleInfo->ProcessId; - break; - } - } - } - } - EngineCloseHandle(myHandle); - } - } - } - HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); - TotalHandleCount--; - } - VirtualFree(HandleFullData, NULL, MEM_RELEASE); - VirtualFree(HandleNameData, NULL, MEM_RELEASE); - VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); - VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); - return(ReturnData); + lstrcatW(RealMutexName, szMutexString); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + while(NtQuerySystemInformation(SystemHandleInformation, QuerySystemBuffer, QuerySystemBufferSize, &RequiredSize) == (NTSTATUS)0xC0000004L) + { + QuerySystemBufferSize = RequiredSize; + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + QuerySystemBuffer = VirtualAlloc(NULL, QuerySystemBufferSize, MEM_COMMIT, PAGE_READWRITE); + } + RtlMoveMemory(&TotalHandleCount, QuerySystemBuffer, sizeof ULONG); + QuerySystemBuffer = (LPVOID)((ULONG_PTR)QuerySystemBuffer + 4); + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)QuerySystemBuffer; + while(TotalHandleCount > NULL) + { + if(LastProcessId != HandleInfo->ProcessId) + { + if(hProcess != NULL) + { + EngineCloseHandle(hProcess); + } + hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE, false, HandleInfo->ProcessId); + LastProcessId = HandleInfo->ProcessId; + } + if(hProcess != NULL) + { + //if(!(HandleInfo->GrantedAccess & SYNCHRONIZE) || ((HandleInfo->GrantedAccess & SYNCHRONIZE) && ((WORD)HandleInfo->GrantedAccess != 0x19F9))){// && (WORD)HandleInfo->GrantedAccess != 0x89))){ + if(HandleInfo->GrantedAccess != 0x0012019F) + { + if(DuplicateHandle(hProcess, (HANDLE)HandleInfo->hHandle, GetCurrentProcess(), &myHandle, NULL, false, DUPLICATE_SAME_ACCESS)) + { + RtlZeroMemory(HandleFullData, 0x1000); + NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, 8, &RequiredSize); + NtQueryObject(myHandle, ObjectTypeInformation, HandleFullData, RequiredSize, &RequiredSize); + RtlZeroMemory(HandleNameData, 0x1000); + if(pObjectTypeInfo->TypeName.Length != NULL) + { + //WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectTypeInfo->TypeName.Buffer, -1, (LPSTR)HandleNameData, 0x1000, NULL, NULL); + lstrcpyW((wchar_t*)HandleNameData, (wchar_t*)pObjectNameInfo->Name.Buffer); + if(lstrcmpiW((LPCWSTR)HandleNameData, L"Mutant") == NULL) + { + NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, 8, &RequiredSize); + NtQueryObject(myHandle, ObjectNameInformation, ObjectNameInfo, RequiredSize, &RequiredSize); + RtlZeroMemory(HandleNameData, 0x1000); + if(pObjectNameInfo->Name.Length != NULL) + { + RtlZeroMemory(HandleNameData, 0x1000); + //WideCharToMultiByte(CP_ACP, NULL, (LPCWSTR)pObjectNameInfo->Name.Buffer, -1, (LPSTR)HandleNameData, 0x1000, NULL, NULL); + lstrcpyW((wchar_t*)HandleNameData, (wchar_t*)pObjectNameInfo->Name.Buffer); + if(lstrcmpiW((LPCWSTR)HandleNameData, RealMutexName) == NULL) + { + ReturnData = HandleInfo->ProcessId; + break; + } + } + } + } + EngineCloseHandle(myHandle); + } + } + } + HandleInfo = (PNTDLL_QUERY_HANDLE_INFO)((ULONG_PTR)HandleInfo + sizeof NTDLL_QUERY_HANDLE_INFO); + TotalHandleCount--; + } + VirtualFree(HandleFullData, NULL, MEM_RELEASE); + VirtualFree(HandleNameData, NULL, MEM_RELEASE); + VirtualFree(ObjectNameInfo, NULL, MEM_RELEASE); + VirtualFree(QuerySystemBuffer, NULL, MEM_RELEASE); + return(ReturnData); } diff --git a/TitanEngine/TitanEngine.Hider.cpp b/TitanEngine/TitanEngine.Hider.cpp index 36a0e1c..ed9deb0 100644 --- a/TitanEngine/TitanEngine.Hider.cpp +++ b/TitanEngine/TitanEngine.Hider.cpp @@ -5,28 +5,28 @@ // TitanEngine.Hider.functions: __declspec(dllexport) void* TITCALL GetPEBLocation(HANDLE hProcess) { - ULONG RequiredLen = 0; - void * PebAddress = 0; - PPROCESS_BASIC_INFORMATION myProcessBasicInformation = (PPROCESS_BASIC_INFORMATION)VirtualAlloc(NULL, sizeof(PROCESS_BASIC_INFORMATION) * 4, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE); + ULONG RequiredLen = 0; + void * PebAddress = 0; + PPROCESS_BASIC_INFORMATION myProcessBasicInformation = (PPROCESS_BASIC_INFORMATION)VirtualAlloc(NULL, sizeof(PROCESS_BASIC_INFORMATION) * 4, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE); - if(!myProcessBasicInformation) - return 0; + if(!myProcessBasicInformation) + return 0; - if(NtQueryInformationProcess(hProcess, ProcessBasicInformation, myProcessBasicInformation, sizeof(PROCESS_BASIC_INFORMATION), &RequiredLen) == STATUS_SUCCESS) - { - PebAddress = (void*)myProcessBasicInformation->PebBaseAddress; - } - else - { - if(NtQueryInformationProcess(hProcess, ProcessBasicInformation, myProcessBasicInformation, RequiredLen, &RequiredLen) == STATUS_SUCCESS) - { - PebAddress = (void*)myProcessBasicInformation->PebBaseAddress; - } - } + if(NtQueryInformationProcess(hProcess, ProcessBasicInformation, myProcessBasicInformation, sizeof(PROCESS_BASIC_INFORMATION), &RequiredLen) == STATUS_SUCCESS) + { + PebAddress = (void*)myProcessBasicInformation->PebBaseAddress; + } + else + { + if(NtQueryInformationProcess(hProcess, ProcessBasicInformation, myProcessBasicInformation, RequiredLen, &RequiredLen) == STATUS_SUCCESS) + { + PebAddress = (void*)myProcessBasicInformation->PebBaseAddress; + } + } - VirtualFree(myProcessBasicInformation, 0, MEM_RELEASE); - return PebAddress; + VirtualFree(myProcessBasicInformation, 0, MEM_RELEASE); + return PebAddress; } __declspec(dllexport) void* TITCALL GetPEBLocation64(HANDLE hProcess) @@ -36,11 +36,11 @@ __declspec(dllexport) void* TITCALL GetPEBLocation64(HANDLE hProcess) { //Only WOW64 processes have 2 PEBs DWORD peb32 = (DWORD)GetPEBLocation(hProcess); - if (peb32) - { - peb32 += 0x1000; //PEB64 after PEB32 - return (void *)peb32; - } + if (peb32) + { + peb32 += 0x1000; //PEB64 after PEB32 + return (void *)peb32; + } } #endif //_WIN64 return 0; diff --git a/TitanEngine/TitanEngine.Hooks.cpp b/TitanEngine/TitanEngine.Hooks.cpp index e9bcbeb..e9c52ba 100644 --- a/TitanEngine/TitanEngine.Hooks.cpp +++ b/TitanEngine/TitanEngine.Hooks.cpp @@ -28,66 +28,51 @@ static bool ProcessHookScanAddNewHook(PHOOK_ENTRY HookDetails, void* ptrOriginal // Global.Engine.Hook.functions: __declspec(dllexport) bool TITCALL HooksSafeTransitionEx(LPVOID HookAddressArray, int NumberOfHooks, bool TransitionStart) { - - int i; - ULONG_PTR CurrentIP; - ULONG_PTR HookAddress; - PTHREAD_ITEM_DATA hListThreadPtr = (PTHREAD_ITEM_DATA)hListThread; - PMEMORY_COMPARE_HANDLER myHookAddressArray; - - if(dbgProcessInformation.hProcess == NULL) + if(dbgProcessInformation.hProcess == NULL) //TODO: check { if(!TransitionStart || ThreaderImportRunningThreadData(GetCurrentProcessId())) { - hListThreadPtr = (PTHREAD_ITEM_DATA)hListThread; - if(hListThreadPtr != NULL) + int threadcount=hListThread.size(); + for(int i=0; ihThread != NULL) + PTHREAD_ITEM_DATA hListThreadPtr=&hListThread.at(i); + if(hListThreadPtr->hThread != INVALID_HANDLE_VALUE) { - if(hListThreadPtr->hThread != INVALID_HANDLE_VALUE) + if(TransitionStart) { - if(TransitionStart) + if(hListThreadPtr->dwThreadId != GetCurrentThreadId()) { - if(hListThreadPtr->dwThreadId != GetCurrentThreadId()) + SuspendThread(hListThreadPtr->hThread); + ULONG_PTR CurrentIP = (ULONG_PTR)GetContextDataEx(hListThreadPtr->hThread, UE_CIP); + PMEMORY_COMPARE_HANDLER myHookAddressArray = (PMEMORY_COMPARE_HANDLER)HookAddressArray; + for(int j=0; jhThread); - CurrentIP = (ULONG_PTR)GetContextDataEx(hListThreadPtr->hThread, UE_CIP); - myHookAddressArray = (PMEMORY_COMPARE_HANDLER)HookAddressArray; - for(i = 0; i < NumberOfHooks; i++) - { #if defined (_WIN64) - HookAddress = (ULONG_PTR)myHookAddressArray->Array.qwArrayEntry[0]; - myHookAddressArray = (PMEMORY_COMPARE_HANDLER)((ULONG_PTR)myHookAddressArray + sizeof ULONG_PTR); + ULONG_PTR HookAddress = (ULONG_PTR)myHookAddressArray->Array.qwArrayEntry[0]; + myHookAddressArray = (PMEMORY_COMPARE_HANDLER)((ULONG_PTR)myHookAddressArray + sizeof ULONG_PTR); #else - HookAddress = (ULONG_PTR)myHookAddressArray->Array.dwArrayEntry[0]; - myHookAddressArray = (PMEMORY_COMPARE_HANDLER)((ULONG_PTR)myHookAddressArray + sizeof ULONG_PTR); + ULONG_PTR HookAddress = (ULONG_PTR)myHookAddressArray->Array.dwArrayEntry[0]; + myHookAddressArray = (PMEMORY_COMPARE_HANDLER)((ULONG_PTR)myHookAddressArray + sizeof ULONG_PTR); #endif - while(CurrentIP >= (ULONG_PTR)HookAddress && CurrentIP <= (ULONG_PTR)HookAddress + 5) - { - ResumeThread(hListThreadPtr->hThread); - Sleep(5); - SuspendThread(hListThreadPtr->hThread); - CurrentIP = (ULONG_PTR)GetContextDataEx(hListThreadPtr->hThread, UE_CIP); - i = 0; - } + while(CurrentIP >= (ULONG_PTR)HookAddress && CurrentIP <= (ULONG_PTR)HookAddress + 5) + { + ResumeThread(hListThreadPtr->hThread); + Sleep(5); + SuspendThread(hListThreadPtr->hThread); + CurrentIP = (ULONG_PTR)GetContextDataEx(hListThreadPtr->hThread, UE_CIP); + j = 0; } } } - else - { - ResumeThread(hListThreadPtr->hThread); - EngineCloseHandle(hListThreadPtr->hThread); - } } - hListThreadPtr = (PTHREAD_ITEM_DATA)((ULONG_PTR)hListThreadPtr + sizeof THREAD_ITEM_DATA); + else + { + ResumeThread(hListThreadPtr->hThread); + EngineCloseHandle(hListThreadPtr->hThread); + } } - if(!TransitionStart) - { - VirtualFree(hListThread, NULL, MEM_RELEASE); - hListThread = NULL; - } - return true; } + return true; } else { diff --git a/TitanEngine/TitanEngine.Injector.cpp b/TitanEngine/TitanEngine.Injector.cpp index c5400c0..b67e9a6 100644 --- a/TitanEngine/TitanEngine.Injector.cpp +++ b/TitanEngine/TitanEngine.Injector.cpp @@ -185,7 +185,7 @@ __declspec(dllexport) bool TITCALL RemoteFreeLibraryW(HANDLE hProcess, HMODULE h if(WaitForThreadExit) { hThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)remCodeData, remStringData, CREATE_SUSPENDED, &ThreadId); - NtSetInformationThread(hThread, ThreadHideFromDebugger, NULL, NULL); + NtSetInformationThread(hThread, ThreadHideFromDebugger, NULL, NULL); ResumeThread(hThread); WaitForSingleObject(hThread, INFINITE); VirtualFreeEx(hProcess, remCodeData, NULL, MEM_RELEASE); diff --git a/TitanEngine/TitanEngine.Threader.cpp b/TitanEngine/TitanEngine.Threader.cpp index 525bc10..9b27c5d 100644 --- a/TitanEngine/TitanEngine.Threader.cpp +++ b/TitanEngine/TitanEngine.Threader.cpp @@ -9,365 +9,201 @@ // TitanEngine.Threader.functions: __declspec(dllexport) bool TITCALL ThreaderImportRunningThreadData(DWORD ProcessId) { - - HANDLE hSnapShot; + if(dbgProcessInformation.hProcess != NULL || ProcessId == NULL) + return false; + std::vector().swap(hListThread); //clear thread list THREADENTRY32 ThreadEntry = {}; - PTHREAD_ITEM_DATA hListThreadPtr = NULL; - - if(dbgProcessInformation.hProcess == NULL && ProcessId != NULL) + ThreadEntry.dwSize = sizeof THREADENTRY32; + HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, ProcessId); + if(hSnapShot != INVALID_HANDLE_VALUE) { - if(hListThread == NULL) + if(Thread32First(hSnapShot, &ThreadEntry)) { - hListThread = VirtualAlloc(NULL, MAX_DEBUG_DATA * sizeof THREAD_ITEM_DATA, MEM_COMMIT, PAGE_READWRITE); - } - else - { - RtlZeroMemory(hListThread, MAX_DEBUG_DATA * sizeof THREAD_ITEM_DATA); - } - ThreadEntry.dwSize = sizeof THREADENTRY32; - hListThreadPtr = (PTHREAD_ITEM_DATA)hListThread; - hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, ProcessId); - if(hSnapShot != INVALID_HANDLE_VALUE) - { - if(Thread32First(hSnapShot, &ThreadEntry)) + do { - do + if(ThreadEntry.th32OwnerProcessID == ProcessId) { - if(ThreadEntry.th32OwnerProcessID == ProcessId) - { - hListThreadPtr->dwThreadId = ThreadEntry.th32ThreadID; - hListThreadPtr->hThread = OpenThread(THREAD_GET_CONTEXT|THREAD_SET_CONTEXT|THREAD_QUERY_INFORMATION|THREAD_SUSPEND_RESUME, false, hListThreadPtr->dwThreadId); - hListThreadPtr = (PTHREAD_ITEM_DATA)((ULONG_PTR)hListThreadPtr + sizeof THREAD_ITEM_DATA); - } + THREAD_ITEM_DATA NewThreadData; + memset(&NewThreadData, 0, sizeof(THREAD_ITEM_DATA)); + NewThreadData.dwThreadId = ThreadEntry.th32ThreadID; + NewThreadData.hThread = OpenThread(THREAD_ALL_ACCESS, false, NewThreadData.dwThreadId); + hListThread.push_back(NewThreadData); } - while(Thread32Next(hSnapShot, &ThreadEntry)); } - EngineCloseHandle(hSnapShot); - return true; + while(Thread32Next(hSnapShot, &ThreadEntry)); } + EngineCloseHandle(hSnapShot); + return true; } return false; } + __declspec(dllexport) void* TITCALL ThreaderGetThreadInfo(HANDLE hThread, DWORD ThreadId) { - - PTHREAD_ITEM_DATA hListThreadPtr = (PTHREAD_ITEM_DATA)hListThread; - - if(hListThreadPtr != NULL) - { - if(hThread != NULL) + if(!hThread && !ThreadId) + return NULL; + static THREAD_ITEM_DATA ThreadData; + memset(&ThreadData, 0, sizeof(THREAD_ITEM_DATA)); + int threadcount=hListThread.size(); + for(int i=0; ihThread != NULL && hListThreadPtr->hThread != hThread) - { - hListThreadPtr = (PTHREAD_ITEM_DATA)((ULONG_PTR)hListThreadPtr + sizeof THREAD_ITEM_DATA); - } - if(hListThreadPtr->hThread == hThread) - { - return((void*)hListThreadPtr); - } + memcpy(&ThreadData, &hListThread.at(i), sizeof(THREAD_ITEM_DATA)); + return &ThreadData; } - else if(ThreadId != NULL) - { - while(hListThreadPtr->hThread != NULL && hListThreadPtr->dwThreadId != ThreadId) - { - hListThreadPtr = (PTHREAD_ITEM_DATA)((ULONG_PTR)hListThreadPtr + sizeof THREAD_ITEM_DATA); - } - if(hListThreadPtr->dwThreadId == ThreadId) - { - return((void*)hListThreadPtr); - } - } - } - return(NULL); + return NULL; } + __declspec(dllexport) void TITCALL ThreaderEnumThreadInfo(void* EnumCallBack) { - - PTHREAD_ITEM_DATA hListThreadPtr = (PTHREAD_ITEM_DATA)hListThread; typedef void(TITCALL *fEnumCallBack)(LPVOID fThreadDetail); fEnumCallBack myEnumCallBack = (fEnumCallBack)EnumCallBack; - - if(hListThreadPtr != NULL) + int threadcount=hListThread.size(); + for(int i=0; ihThread != NULL) + __try { - if(hListThreadPtr->hThread != NULL) - { - __try - { - myEnumCallBack((void*)hListThreadPtr); - } - __except(EXCEPTION_EXECUTE_HANDLER) - { - EnumCallBack = NULL; - } - } - hListThreadPtr = (PTHREAD_ITEM_DATA)((ULONG_PTR)hListThreadPtr + sizeof THREAD_ITEM_DATA); + myEnumCallBack(&hListThread.at(i)); + } + __except(EXCEPTION_EXECUTE_HANDLER) + { + break; } } } + __declspec(dllexport) bool TITCALL ThreaderPauseThread(HANDLE hThread) { - - PTHREAD_ITEM_DATA hListThreadPtr = (PTHREAD_ITEM_DATA)hListThread; - - if(hListThreadPtr != NULL) - { - if(hThread != NULL) - { - while(hListThreadPtr->hThread != NULL && hListThreadPtr->hThread != hThread) - { - hListThreadPtr = (PTHREAD_ITEM_DATA)((ULONG_PTR)hListThreadPtr + sizeof THREAD_ITEM_DATA); - } - if(hListThreadPtr->hThread == hThread) - { - if(SuspendThread(hThread) != -1) - { - return true; - } - else - { - return false; - } - } - else - { - return false; - } - } - } + int threadcount=hListThread.size(); + for(int i=0; ihThread != NULL && hListThreadPtr->hThread != hThread) - { - hListThreadPtr = (PTHREAD_ITEM_DATA)((ULONG_PTR)hListThreadPtr + sizeof THREAD_ITEM_DATA); - } - if(hListThreadPtr->hThread == hThread) - { - if(ResumeThread(hThread) != -1) - { - return true; - } - else - { - return false; - } - } - else - { - return false; - } - } - } + int threadcount=hListThread.size(); + for(int i=0; ihThread != NULL && hListThreadPtr->hThread != hThread) - { - hListThreadPtr = (PTHREAD_ITEM_DATA)((ULONG_PTR)hListThreadPtr + sizeof THREAD_ITEM_DATA); - } - if(hListThreadPtr->hThread == hThread) - { - if(TerminateThread(hThread, ThreadExitCode) != NULL) - { - hListThreadPtr->hThread = (HANDLE)-1; - hListThreadPtr->dwThreadId = NULL; - hListThreadPtr->ThreadLocalBase = NULL; - hListThreadPtr->ThreadStartAddress = NULL; - return true; - } - else - { - return false; - } - } - else - { - return false; - } - } - } - return false; -} -__declspec(dllexport) bool TITCALL ThreaderPauseAllThreads(bool LeaveMainRunning) -{ - - PTHREAD_ITEM_DATA hListThreadPtr = (PTHREAD_ITEM_DATA)hListThread; - - if(hListThreadPtr != NULL) - { - while(hListThreadPtr->hThread != NULL) - { - if(LeaveMainRunning) - { - if(hListThreadPtr->hThread != dbgProcessInformation.hThread) - { - SuspendThread((HANDLE)hListThreadPtr->hThread); - } - } - else - { - SuspendThread(hListThreadPtr->hThread); - } - hListThreadPtr = (PTHREAD_ITEM_DATA)((ULONG_PTR)hListThreadPtr + sizeof THREAD_ITEM_DATA); - } - return true; - } - return false; -} -__declspec(dllexport) bool TITCALL ThreaderResumeAllThreads(bool LeaveMainPaused) -{ - - PTHREAD_ITEM_DATA hListThreadPtr = (PTHREAD_ITEM_DATA)hListThread; - - if(hListThreadPtr != NULL) - { - while(hListThreadPtr->hThread != NULL) - { - if(LeaveMainPaused) - { - if(hListThreadPtr->hThread != dbgProcessInformation.hThread) - { - ResumeThread(hListThreadPtr->hThread); - } - } - else - { - ResumeThread(hListThreadPtr->hThread); - } - hListThreadPtr = (PTHREAD_ITEM_DATA)((ULONG_PTR)hListThreadPtr + sizeof THREAD_ITEM_DATA); - } - return true; - } - return false; -} -__declspec(dllexport) bool TITCALL ThreaderPauseProcess() -{ - return(ThreaderPauseAllThreads(false)); -} -__declspec(dllexport) bool TITCALL ThreaderResumeProcess() -{ - return(ThreaderResumeAllThreads(false)); -} -__declspec(dllexport) long long TITCALL ThreaderCreateRemoteThread(ULONG_PTR ThreadStartAddress, bool AutoCloseTheHandle, LPVOID ThreadPassParameter, LPDWORD ThreadId) -{ - - HANDLE myThread; - - if(dbgProcessInformation.hProcess != NULL) - { - if(!AutoCloseTheHandle) - { - return((ULONG_PTR)CreateRemoteThread(dbgProcessInformation.hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)ThreadStartAddress, ThreadPassParameter, NULL, ThreadId)); - } - else - { - myThread = CreateRemoteThread(dbgProcessInformation.hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)ThreadStartAddress, ThreadPassParameter, NULL, ThreadId); - EngineCloseHandle(myThread); - return(NULL); - } - } - return(NULL); -} -__declspec(dllexport) bool TITCALL ThreaderInjectAndExecuteCode(LPVOID InjectCode, DWORD StartDelta, DWORD InjectSize) -{ - - LPVOID ThreadBase = 0; - ULONG_PTR ueNumberOfBytesRead = 0; - - if(dbgProcessInformation.hProcess != NULL) - { - ThreadBase = VirtualAllocEx(dbgProcessInformation.hProcess, NULL, InjectSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); - if(WriteProcessMemory(dbgProcessInformation.hProcess, ThreadBase, InjectCode, InjectSize, &ueNumberOfBytesRead)) - { - ThreaderCreateRemoteThread((ULONG_PTR)((ULONG_PTR)InjectCode + StartDelta), true, NULL, NULL); + hListThread.erase(hListThread.begin()+i); return true; } - else - { - return false; - } - } return false; } + +__declspec(dllexport) bool TITCALL ThreaderPauseAllThreads(bool LeaveMainRunning) +{ + bool ret=true; + int threadcount=hListThread.size(); + for(int i=0; ihThread != NULL) - { - if(hListThreadPtr->hThread != (HANDLE)-1) - { - if(ThreaderIsThreadActive(hListThreadPtr->hThread)) - { - return true; - } - } - hListThreadPtr = (PTHREAD_ITEM_DATA)((ULONG_PTR)hListThreadPtr + sizeof THREAD_ITEM_DATA); - } - } - return false; + int threadcount=hListThread.size(); + for(int i=0; ihThread != NULL) - { - if(hListThreadPtr->hThread != (HANDLE)-1 && hListThreadPtr->dwThreadId == ThreadId) - { - return((ULONG_PTR)hListThreadPtr->hThread); - } - hListThreadPtr = (PTHREAD_ITEM_DATA)((ULONG_PTR)hListThreadPtr + sizeof THREAD_ITEM_DATA); - } - } - return(NULL); -} -__declspec(dllexport) void* TITCALL ThreaderGetThreadData() -{ - return(hListThread); + int threadcount=hListThread.size(); + for(int i=0; idwThreadId == dbgProcessInformation.dwThreadId) - { - return true; - } - return false; + return (myDBGEvent->dwThreadId == dbgProcessInformation.dwThreadId); } diff --git a/TitanEngine/TitanEngine.cbp b/TitanEngine/TitanEngine.cbp index 9d4c449..8e8f10b 100644 --- a/TitanEngine/TitanEngine.cbp +++ b/TitanEngine/TitanEngine.cbp @@ -139,6 +139,7 @@ + diff --git a/TitanEngine/TitanEngine.def b/TitanEngine/TitanEngine.def index 75eb787..af01955 100644 --- a/TitanEngine/TitanEngine.def +++ b/TitanEngine/TitanEngine.def @@ -324,7 +324,6 @@ ThreaderIsThreadActive ThreaderIsAnyThreadActive ThreaderExecuteOnlyInjectedThreads ThreaderGetOpenHandleForThread -ThreaderGetThreadData StaticFileLoad StaticFileLoadW StaticFileUnload diff --git a/TitanEngine/aplib.h b/TitanEngine/aplib.h index 4a4341a..65aa2cc 100644 --- a/TitanEngine/aplib.h +++ b/TitanEngine/aplib.h @@ -29,11 +29,11 @@ extern "C" { #endif unsigned int APLIB_CONVENTION aP_pack(const void *source, - void *destination, - unsigned int length, - void *workmem, - int (__cdecl *callback)(unsigned int, unsigned int, unsigned int, void *), - void *cbparam); + void *destination, + unsigned int length, + void *workmem, + int (__cdecl *callback)(unsigned int, unsigned int, unsigned int, void *), + void *cbparam); unsigned int APLIB_CONVENTION aP_workmem_size(unsigned int inputsize); @@ -44,27 +44,27 @@ unsigned int APLIB_CONVENTION aP_depack_asm(const void *source, void *destinatio unsigned int APLIB_CONVENTION aP_depack_asm_fast(const void *source, void *destination); unsigned int APLIB_CONVENTION aP_depack_asm_safe(const void *source, - unsigned int srclen, - void *destination, - unsigned int dstlen); + unsigned int srclen, + void *destination, + unsigned int dstlen); unsigned int APLIB_CONVENTION aP_crc32(const void *source, unsigned int length); unsigned int APLIB_CONVENTION aPsafe_pack(const void *source, - void *destination, - unsigned int length, - void *workmem, - int (__cdecl *callback)(unsigned int, unsigned int, unsigned int, void *), - void *cbparam); + void *destination, + unsigned int length, + void *workmem, + int (__cdecl *callback)(unsigned int, unsigned int, unsigned int, void *), + void *cbparam); unsigned int APLIB_CONVENTION aPsafe_check(const void *source); unsigned int APLIB_CONVENTION aPsafe_get_orig_size(const void *source); unsigned int APLIB_CONVENTION aPsafe_depack(const void *source, - unsigned int srclen, - void *destination, - unsigned int dstlen); + unsigned int srclen, + void *destination, + unsigned int dstlen); #ifdef __cplusplus } /* extern "C" */ diff --git a/TitanEngine/definitions.h b/TitanEngine/definitions.h index 80757cc..ba2bc5e 100644 --- a/TitanEngine/definitions.h +++ b/TitanEngine/definitions.h @@ -145,7 +145,6 @@ __declspec(dllexport) bool TITCALL ThreaderIsThreadActive(HANDLE hThread); __declspec(dllexport) bool TITCALL ThreaderIsAnyThreadActive(); __declspec(dllexport) bool TITCALL ThreaderExecuteOnlyInjectedThreads(); __declspec(dllexport) long long TITCALL ThreaderGetOpenHandleForThread(DWORD ThreadId); -__declspec(dllexport) void* TITCALL ThreaderGetThreadData(); __declspec(dllexport) bool TITCALL ThreaderIsExceptionInMainThread(); // TitanEngine.Debugger.functions: __declspec(dllexport) void* TITCALL StaticDisassembleEx(ULONG_PTR DisassmStart, LPVOID DisassmAddress); diff --git a/TitanEngine/ntdll.h b/TitanEngine/ntdll.h index 49c6fc1..e45d6eb 100644 --- a/TitanEngine/ntdll.h +++ b/TitanEngine/ntdll.h @@ -1,260 +1,266 @@ -#pragma once - -#include - -#ifndef _WIN64 -#pragma comment(lib, "ntdll_x86.lib") -#else -#pragma comment(lib, "ntdll_x64.lib") -#endif - - - -typedef LONG NTSTATUS; - -typedef struct _UNICODE_STRING { - USHORT Length; - USHORT MaximumLength; - PWSTR Buffer; -} UNICODE_STRING, *PUNICODE_STRING; - -typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION { - ULONG Attributes; - ACCESS_MASK GrantedAccess; - ULONG HandleCount; - ULONG PointerCount; - - ULONG Reserved[10]; // reserved for internal use - -} PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION; - -typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION { - - UNICODE_STRING TypeName; - - ULONG Reserved [22]; // reserved for internal use - -} PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION; - -typedef struct _PROCESS_BASIC_INFORMATION { - PVOID Reserved1; - PVOID PebBaseAddress; - PVOID Reserved2[2]; - ULONG_PTR UniqueProcessId; - PVOID Reserved3; -} PROCESS_BASIC_INFORMATION; -typedef PROCESS_BASIC_INFORMATION *PPROCESS_BASIC_INFORMATION; - -typedef enum _PROCESSINFOCLASS { - ProcessBasicInformation, - ProcessQuotaLimits, - ProcessIoCounters, - ProcessVmCounters, - ProcessTimes, - ProcessBasePriority, - ProcessRaisePriority, - ProcessDebugPort, - ProcessExceptionPort, - ProcessAccessToken, - ProcessLdtInformation, - ProcessLdtSize, - ProcessDefaultHardErrorMode, - ProcessIoPortHandlers, // Note: this is kernel mode only - ProcessPooledUsageAndLimits, - ProcessWorkingSetWatch, - ProcessUserModeIOPL, - ProcessEnableAlignmentFaultFixup, - ProcessPriorityClass, - ProcessWx86Information, - ProcessHandleCount, - ProcessAffinityMask, - ProcessPriorityBoost, - ProcessDeviceMap, - ProcessSessionInformation, - ProcessForegroundInformation, - ProcessWow64Information, - ProcessImageFileName, - ProcessLUIDDeviceMapsEnabled, - ProcessBreakOnTermination, - ProcessDebugObjectHandle, - ProcessDebugFlags, - ProcessHandleTracing, - ProcessIoPriority, - ProcessExecuteFlags, - ProcessResourceManagement, - ProcessCookie, - ProcessImageInformation, - MaxProcessInfoClass // MaxProcessInfoClass should always be the last enum -} PROCESSINFOCLASS; - -typedef enum _SYSTEM_INFORMATION_CLASS { - SystemBasicInformation, - SystemProcessorInformation, // obsolete...delete - SystemPerformanceInformation, - SystemTimeOfDayInformation, - SystemPathInformation, - SystemProcessInformation, - SystemCallCountInformation, - SystemDeviceInformation, - SystemProcessorPerformanceInformation, - SystemFlagsInformation, - SystemCallTimeInformation, - SystemModuleInformation, - SystemLocksInformation, - SystemStackTraceInformation, - SystemPagedPoolInformation, - SystemNonPagedPoolInformation, - SystemHandleInformation, - SystemObjectInformation, - SystemPageFileInformation, - SystemVdmInstemulInformation, - SystemVdmBopInformation, - SystemFileCacheInformation, - SystemPoolTagInformation, - SystemInterruptInformation, - SystemDpcBehaviorInformation, - SystemFullMemoryInformation, - SystemLoadGdiDriverInformation, - SystemUnloadGdiDriverInformation, - SystemTimeAdjustmentInformation, - SystemSummaryMemoryInformation, - SystemMirrorMemoryInformation, - SystemPerformanceTraceInformation, - SystemObsolete0, - SystemExceptionInformation, - SystemCrashDumpStateInformation, - SystemKernelDebuggerInformation, - SystemContextSwitchInformation, - SystemRegistryQuotaInformation, - SystemExtendServiceTableInformation, - SystemPrioritySeperation, - SystemVerifierAddDriverInformation, - SystemVerifierRemoveDriverInformation, - SystemProcessorIdleInformation, - SystemLegacyDriverInformation, - SystemCurrentTimeZoneInformation, - SystemLookasideInformation, - SystemTimeSlipNotification, - SystemSessionCreate, - SystemSessionDetach, - SystemSessionInformation, - SystemRangeStartInformation, - SystemVerifierInformation, - SystemVerifierThunkExtend, - SystemSessionProcessInformation, - SystemLoadGdiDriverInSystemSpace, - SystemNumaProcessorMap, - SystemPrefetcherInformation, - SystemExtendedProcessInformation, - SystemRecommendedSharedDataAlignment, - SystemComPlusPackage, - SystemNumaAvailableMemory, - SystemProcessorPowerInformation, - SystemEmulationBasicInformation, - SystemEmulationProcessorInformation, - SystemExtendedHandleInformation, - SystemLostDelayedWriteInformation, - SystemBigPoolInformation, - SystemSessionPoolTagInformation, - SystemSessionMappedViewInformation, - SystemHotpatchInformation, - SystemObjectSecurityMode, - SystemWatchdogTimerHandler, - SystemWatchdogTimerInformation, - SystemLogicalProcessorInformation, - SystemWow64SharedInformation, - SystemRegisterFirmwareTableInformationHandler, - SystemFirmwareTableInformation, - SystemModuleInformationEx, - SystemVerifierTriageInformation, - SystemSuperfetchInformation, - SystemMemoryListInformation, - SystemFileCacheInformationEx, - MaxSystemInfoClass // MaxSystemInfoClass should always be the last enum -} SYSTEM_INFORMATION_CLASS; - -typedef enum _OBJECT_INFORMATION_CLASS { - ObjectBasicInformation, - ObjectNameInformation, - ObjectTypeInformation, - ObjectTypesInformation, - ObjectHandleFlagInformation, - ObjectSessionInformation, - MaxObjectInfoClass // MaxObjectInfoClass should always be the last enum -} OBJECT_INFORMATION_CLASS; - -typedef enum _THREADINFOCLASS { - ThreadBasicInformation, - ThreadTimes, - ThreadPriority, - ThreadBasePriority, - ThreadAffinityMask, - ThreadImpersonationToken, - ThreadDescriptorTableEntry, - ThreadEnableAlignmentFaultFixup, - ThreadEventPair_Reusable, - ThreadQuerySetWin32StartAddress, - ThreadZeroTlsCell, - ThreadPerformanceCount, - ThreadAmILastThread, - ThreadIdealProcessor, - ThreadPriorityBoost, - ThreadSetTlsArrayAddress, - ThreadIsIoPending, - ThreadHideFromDebugger, - ThreadBreakOnTermination, - ThreadSwitchLegacyState, - ThreadIsTerminated, - MaxThreadInfoClass -} THREADINFOCLASS; - - -#ifdef __cplusplus -extern "C" { -#endif - - NTSYSCALLAPI - NTSTATUS - NTAPI - NtQueryInformationProcess ( - __in HANDLE ProcessHandle, - __in PROCESSINFOCLASS ProcessInformationClass, - __out_bcount(ProcessInformationLength) PVOID ProcessInformation, - __in ULONG ProcessInformationLength, - __out_opt PULONG ReturnLength - ); - - NTSYSCALLAPI - NTSTATUS - NTAPI - NtQueryObject ( - __in HANDLE Handle, - __in OBJECT_INFORMATION_CLASS ObjectInformationClass, - __out_bcount_opt(ObjectInformationLength) PVOID ObjectInformation, - __in ULONG ObjectInformationLength, - __out_opt PULONG ReturnLength - ); - - NTSYSCALLAPI - NTSTATUS - NTAPI - NtQuerySystemInformation ( - __in SYSTEM_INFORMATION_CLASS SystemInformationClass, - __out_bcount_opt(SystemInformationLength) PVOID SystemInformation, - __in ULONG SystemInformationLength, - __out_opt PULONG ReturnLength - ); - - NTSYSCALLAPI - NTSTATUS - NTAPI - NtSetInformationThread ( - __in HANDLE ThreadHandle, - __in THREADINFOCLASS ThreadInformationClass, - __in_bcount(ThreadInformationLength) PVOID ThreadInformation, - __in ULONG ThreadInformationLength - ); - -#ifdef __cplusplus -}; -#endif +#pragma once + +#include + +#ifndef _WIN64 +#pragma comment(lib, "ntdll_x86.lib") +#else +#pragma comment(lib, "ntdll_x64.lib") +#endif + +typedef LONG NTSTATUS; + +typedef struct _UNICODE_STRING +{ + USHORT Length; + USHORT MaximumLength; + PWSTR Buffer; +} UNICODE_STRING, *PUNICODE_STRING; + +typedef struct _PUBLIC_OBJECT_BASIC_INFORMATION +{ + ULONG Attributes; + ACCESS_MASK GrantedAccess; + ULONG HandleCount; + ULONG PointerCount; + + ULONG Reserved[10]; // reserved for internal use + +} PUBLIC_OBJECT_BASIC_INFORMATION, *PPUBLIC_OBJECT_BASIC_INFORMATION; + +typedef struct __PUBLIC_OBJECT_TYPE_INFORMATION +{ + + UNICODE_STRING TypeName; + + ULONG Reserved [22]; // reserved for internal use + +} PUBLIC_OBJECT_TYPE_INFORMATION, *PPUBLIC_OBJECT_TYPE_INFORMATION; + +typedef struct _PROCESS_BASIC_INFORMATION +{ + PVOID Reserved1; + PVOID PebBaseAddress; + PVOID Reserved2[2]; + ULONG_PTR UniqueProcessId; + PVOID Reserved3; +} PROCESS_BASIC_INFORMATION; +typedef PROCESS_BASIC_INFORMATION *PPROCESS_BASIC_INFORMATION; + +typedef enum _PROCESSINFOCLASS +{ + ProcessBasicInformation, + ProcessQuotaLimits, + ProcessIoCounters, + ProcessVmCounters, + ProcessTimes, + ProcessBasePriority, + ProcessRaisePriority, + ProcessDebugPort, + ProcessExceptionPort, + ProcessAccessToken, + ProcessLdtInformation, + ProcessLdtSize, + ProcessDefaultHardErrorMode, + ProcessIoPortHandlers, // Note: this is kernel mode only + ProcessPooledUsageAndLimits, + ProcessWorkingSetWatch, + ProcessUserModeIOPL, + ProcessEnableAlignmentFaultFixup, + ProcessPriorityClass, + ProcessWx86Information, + ProcessHandleCount, + ProcessAffinityMask, + ProcessPriorityBoost, + ProcessDeviceMap, + ProcessSessionInformation, + ProcessForegroundInformation, + ProcessWow64Information, + ProcessImageFileName, + ProcessLUIDDeviceMapsEnabled, + ProcessBreakOnTermination, + ProcessDebugObjectHandle, + ProcessDebugFlags, + ProcessHandleTracing, + ProcessIoPriority, + ProcessExecuteFlags, + ProcessResourceManagement, + ProcessCookie, + ProcessImageInformation, + MaxProcessInfoClass // MaxProcessInfoClass should always be the last enum +} PROCESSINFOCLASS; + +typedef enum _SYSTEM_INFORMATION_CLASS +{ + SystemBasicInformation, + SystemProcessorInformation, // obsolete...delete + SystemPerformanceInformation, + SystemTimeOfDayInformation, + SystemPathInformation, + SystemProcessInformation, + SystemCallCountInformation, + SystemDeviceInformation, + SystemProcessorPerformanceInformation, + SystemFlagsInformation, + SystemCallTimeInformation, + SystemModuleInformation, + SystemLocksInformation, + SystemStackTraceInformation, + SystemPagedPoolInformation, + SystemNonPagedPoolInformation, + SystemHandleInformation, + SystemObjectInformation, + SystemPageFileInformation, + SystemVdmInstemulInformation, + SystemVdmBopInformation, + SystemFileCacheInformation, + SystemPoolTagInformation, + SystemInterruptInformation, + SystemDpcBehaviorInformation, + SystemFullMemoryInformation, + SystemLoadGdiDriverInformation, + SystemUnloadGdiDriverInformation, + SystemTimeAdjustmentInformation, + SystemSummaryMemoryInformation, + SystemMirrorMemoryInformation, + SystemPerformanceTraceInformation, + SystemObsolete0, + SystemExceptionInformation, + SystemCrashDumpStateInformation, + SystemKernelDebuggerInformation, + SystemContextSwitchInformation, + SystemRegistryQuotaInformation, + SystemExtendServiceTableInformation, + SystemPrioritySeperation, + SystemVerifierAddDriverInformation, + SystemVerifierRemoveDriverInformation, + SystemProcessorIdleInformation, + SystemLegacyDriverInformation, + SystemCurrentTimeZoneInformation, + SystemLookasideInformation, + SystemTimeSlipNotification, + SystemSessionCreate, + SystemSessionDetach, + SystemSessionInformation, + SystemRangeStartInformation, + SystemVerifierInformation, + SystemVerifierThunkExtend, + SystemSessionProcessInformation, + SystemLoadGdiDriverInSystemSpace, + SystemNumaProcessorMap, + SystemPrefetcherInformation, + SystemExtendedProcessInformation, + SystemRecommendedSharedDataAlignment, + SystemComPlusPackage, + SystemNumaAvailableMemory, + SystemProcessorPowerInformation, + SystemEmulationBasicInformation, + SystemEmulationProcessorInformation, + SystemExtendedHandleInformation, + SystemLostDelayedWriteInformation, + SystemBigPoolInformation, + SystemSessionPoolTagInformation, + SystemSessionMappedViewInformation, + SystemHotpatchInformation, + SystemObjectSecurityMode, + SystemWatchdogTimerHandler, + SystemWatchdogTimerInformation, + SystemLogicalProcessorInformation, + SystemWow64SharedInformation, + SystemRegisterFirmwareTableInformationHandler, + SystemFirmwareTableInformation, + SystemModuleInformationEx, + SystemVerifierTriageInformation, + SystemSuperfetchInformation, + SystemMemoryListInformation, + SystemFileCacheInformationEx, + MaxSystemInfoClass // MaxSystemInfoClass should always be the last enum +} SYSTEM_INFORMATION_CLASS; + +typedef enum _OBJECT_INFORMATION_CLASS +{ + ObjectBasicInformation, + ObjectNameInformation, + ObjectTypeInformation, + ObjectTypesInformation, + ObjectHandleFlagInformation, + ObjectSessionInformation, + MaxObjectInfoClass // MaxObjectInfoClass should always be the last enum +} OBJECT_INFORMATION_CLASS; + +typedef enum _THREADINFOCLASS +{ + ThreadBasicInformation, + ThreadTimes, + ThreadPriority, + ThreadBasePriority, + ThreadAffinityMask, + ThreadImpersonationToken, + ThreadDescriptorTableEntry, + ThreadEnableAlignmentFaultFixup, + ThreadEventPair_Reusable, + ThreadQuerySetWin32StartAddress, + ThreadZeroTlsCell, + ThreadPerformanceCount, + ThreadAmILastThread, + ThreadIdealProcessor, + ThreadPriorityBoost, + ThreadSetTlsArrayAddress, + ThreadIsIoPending, + ThreadHideFromDebugger, + ThreadBreakOnTermination, + ThreadSwitchLegacyState, + ThreadIsTerminated, + MaxThreadInfoClass +} THREADINFOCLASS; + + +#ifdef __cplusplus +extern "C" { +#endif + +NTSYSCALLAPI +NTSTATUS +NTAPI +NtQueryInformationProcess ( + __in HANDLE ProcessHandle, + __in PROCESSINFOCLASS ProcessInformationClass, + __out_bcount(ProcessInformationLength) PVOID ProcessInformation, + __in ULONG ProcessInformationLength, + __out_opt PULONG ReturnLength +); + +NTSYSCALLAPI +NTSTATUS +NTAPI +NtQueryObject ( + __in HANDLE Handle, + __in OBJECT_INFORMATION_CLASS ObjectInformationClass, + __out_bcount_opt(ObjectInformationLength) PVOID ObjectInformation, + __in ULONG ObjectInformationLength, + __out_opt PULONG ReturnLength +); + +NTSYSCALLAPI +NTSTATUS +NTAPI +NtQuerySystemInformation ( + __in SYSTEM_INFORMATION_CLASS SystemInformationClass, + __out_bcount_opt(SystemInformationLength) PVOID SystemInformation, + __in ULONG SystemInformationLength, + __out_opt PULONG ReturnLength +); + +NTSYSCALLAPI +NTSTATUS +NTAPI +NtSetInformationThread ( + __in HANDLE ThreadHandle, + __in THREADINFOCLASS ThreadInformationClass, + __in_bcount(ThreadInformationLength) PVOID ThreadInformation, + __in ULONG ThreadInformationLength +); + +#ifdef __cplusplus +}; +#endif diff --git a/TitanEngine/stdafx.h b/TitanEngine/stdafx.h index 5158805..aab2663 100644 --- a/TitanEngine/stdafx.h +++ b/TitanEngine/stdafx.h @@ -31,6 +31,9 @@ #define MAXIMUM_INSTRUCTION_SIZE (40) #define MAX_RET_SEARCH_INSTRUCTIONS (100) +#define UE_TRAP_FLAG (0x100) +#define UE_RESUME_FLAG (0x10000) + #define UE_OPTION_IMPORTER_REALIGN_LOCAL_APIADDRESS 0 #define UE_OPTION_IMPORTER_REALIGN_APIADDRESS 1 #define UE_OPTION_IMPORTER_RETURN_APINAME 2 //no kernelbase @@ -923,7 +926,7 @@ struct _PEB_T T ProcessHeaps; //FULL PEB not needed - /* T GdiSharedHandleTable; + /* T GdiSharedHandleTable; T ProcessStarterHelper; T GdiDCAttributeList; T LoaderLock;