From 1ca83942f68f457f881dc604526a124a9ea934c0 Mon Sep 17 00:00:00 2001 From: Johann Kempter Date: Fri, 14 Mar 2014 08:16:46 +0100 Subject: [PATCH 1/2] changed FindEx to use MemoryReadSafe, see #32 --- TitanEngine/TitanEngine.Debugger.Memory.cpp | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/TitanEngine/TitanEngine.Debugger.Memory.cpp b/TitanEngine/TitanEngine.Debugger.Memory.cpp index 8157259..b67e8d1 100644 --- a/TitanEngine/TitanEngine.Debugger.Memory.cpp +++ b/TitanEngine/TitanEngine.Debugger.Memory.cpp @@ -62,6 +62,7 @@ __declspec(dllexport) bool TITCALL MatchPatternEx(HANDLE hProcess, void* MemoryT return true; } + __declspec(dllexport) bool TITCALL MatchPattern(void* MemoryToCheck, int SizeOfMemoryToCheck, void* PatternToMatch, int SizeOfPatternToMatch, PBYTE WildCard) { @@ -74,6 +75,7 @@ __declspec(dllexport) bool TITCALL MatchPattern(void* MemoryToCheck, int SizeOfM return(MatchPatternEx(GetCurrentProcess(), MemoryToCheck, SizeOfMemoryToCheck, PatternToMatch, SizeOfPatternToMatch, WildCard)); } } + __declspec(dllexport) long long TITCALL FindEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, LPBYTE WildCard) { if(!hProcess || !MemoryStart ||!MemorySize || !SearchPattern || !PatternSize) @@ -98,14 +100,14 @@ __declspec(dllexport) long long TITCALL FindEx(HANDLE hProcess, LPVOID MemorySta if(hProcess != GetCurrentProcess()) { ueReadBuffer = ueReadBuf.Allocate(MemorySize); - if(ueReadBuffer && !ReadProcessMemory(hProcess, MemoryStart, ueReadBuffer, MemorySize, &ueNumberOfBytesRead)) + if(ueReadBuffer && !MemoryReadSafe(hProcess, MemoryStart, ueReadBuffer, MemorySize, &ueNumberOfBytesRead)) { if(ueNumberOfBytesRead == NULL) { if(VirtualQueryEx(hProcess, MemoryStart, &memoryInformation, sizeof memoryInformation) != NULL) { MemorySize = (DWORD)((ULONG_PTR)memoryInformation.BaseAddress + memoryInformation.RegionSize - (ULONG_PTR)MemoryStart); - if(!ReadProcessMemory(hProcess, MemoryStart, ueReadBuffer, MemorySize, &ueNumberOfBytesRead)) + if(!MemoryReadSafe(hProcess, MemoryStart, ueReadBuffer, MemorySize, &ueNumberOfBytesRead)) { return 0; } @@ -186,6 +188,7 @@ __declspec(dllexport) bool TITCALL FillEx(HANDLE hProcess, LPVOID MemoryStart, D } return false; } + __declspec(dllexport) bool TITCALL Fill(LPVOID MemoryStart, DWORD MemorySize, PBYTE FillByte) { @@ -198,6 +201,7 @@ __declspec(dllexport) bool TITCALL Fill(LPVOID MemoryStart, DWORD MemorySize, PB return(FillEx(GetCurrentProcess(), MemoryStart, MemorySize, FillByte)); } } + __declspec(dllexport) bool TITCALL PatchEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP) { @@ -251,6 +255,7 @@ __declspec(dllexport) bool TITCALL PatchEx(HANDLE hProcess, LPVOID MemoryStart, } return false; } + __declspec(dllexport) bool TITCALL Patch(LPVOID MemoryStart, DWORD MemorySize, LPVOID ReplacePattern, DWORD ReplaceSize, bool AppendNOP, bool PrependNOP) { @@ -263,6 +268,7 @@ __declspec(dllexport) bool TITCALL Patch(LPVOID MemoryStart, DWORD MemorySize, L return(PatchEx(GetCurrentProcess(), MemoryStart, MemorySize, ReplacePattern, ReplaceSize, AppendNOP, PrependNOP)); } } + __declspec(dllexport) bool TITCALL ReplaceEx(HANDLE hProcess, LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard) { @@ -303,6 +309,7 @@ __declspec(dllexport) bool TITCALL ReplaceEx(HANDLE hProcess, LPVOID MemoryStart return true; } } + __declspec(dllexport) bool TITCALL Replace(LPVOID MemoryStart, DWORD MemorySize, LPVOID SearchPattern, DWORD PatternSize, DWORD NumberOfRepetitions, LPVOID ReplacePattern, DWORD ReplaceSize, PBYTE WildCard) { From 3e0950d72eef982761cbcc1eaab1658780dfe893 Mon Sep 17 00:00:00 2001 From: Johann Kempter Date: Fri, 14 Mar 2014 10:56:27 +0100 Subject: [PATCH 2/2] fixed enumeration in LibrarianRemoveBreakPoint some style fixes --- TitanEngine/TitanEngine.Hooks.cpp | 37 ++++++++-------- TitanEngine/TitanEngine.Librarian.cpp | 53 +++++++++++++++++------ TitanEngine/TitanEngine.Relocator.cpp | 16 +++++++ TitanEngine/TitanEngine.TranslateName.cpp | 3 +- 4 files changed, 75 insertions(+), 34 deletions(-) diff --git a/TitanEngine/TitanEngine.Hooks.cpp b/TitanEngine/TitanEngine.Hooks.cpp index d91e68b..69bffb3 100644 --- a/TitanEngine/TitanEngine.Hooks.cpp +++ b/TitanEngine/TitanEngine.Hooks.cpp @@ -15,7 +15,6 @@ static void* buffPatchedEntry; // Internal.Engine.Hook.functions: static bool ProcessHookScanAddNewHook(PHOOK_ENTRY HookDetails, void* ptrOriginalInstructions, PLIBRARY_ITEM_DATAW ModuleInformation, DWORD SizeOfImage) { - HOOK_ENTRY MyhookEntry = {}; RtlMoveMemory(&MyhookEntry, HookDetails, sizeof HOOK_ENTRY); @@ -79,17 +78,17 @@ __declspec(dllexport) bool TITCALL HooksSafeTransitionEx(LPVOID HookAddressArray } return false; } + __declspec(dllexport) bool TITCALL HooksSafeTransition(LPVOID HookAddress, bool TransitionStart) { - void* aHookAddress[1]; aHookAddress[0] = HookAddress; return(HooksSafeTransitionEx(&aHookAddress[0], sizeof aHookAddress, TransitionStart)); } + __declspec(dllexport) bool TITCALL HooksIsAddressRedirected(LPVOID HookAddress) { - for(unsigned int i = 0; i < hookEntry.size(); i++) { if(hookEntry[i].HookAddress == HookAddress && hookEntry[i].IATHook == false && hookEntry[i].HookIsEnabled == true) @@ -99,9 +98,9 @@ __declspec(dllexport) bool TITCALL HooksIsAddressRedirected(LPVOID HookAddress) } return false; } + __declspec(dllexport) void* TITCALL HooksGetTrampolineAddress(LPVOID HookAddress) { - for(unsigned int i = 0; i < hookEntry.size(); i++) { if(hookEntry[i].HookAddress == HookAddress) @@ -111,9 +110,9 @@ __declspec(dllexport) void* TITCALL HooksGetTrampolineAddress(LPVOID HookAddress } return(NULL); } + __declspec(dllexport) void* TITCALL HooksGetHookEntryDetails(LPVOID HookAddress) { - for(unsigned int i = 0; i < hookEntry.size(); i++) { if(hookEntry[i].HookAddress == HookAddress) @@ -123,9 +122,9 @@ __declspec(dllexport) void* TITCALL HooksGetHookEntryDetails(LPVOID HookAddress) } return(NULL); } + __declspec(dllexport) bool TITCALL HooksInsertNewRedirection(LPVOID HookAddress, LPVOID RedirectTo, int HookType) { - #if !defined(_WIN64) int j; unsigned int i; @@ -411,6 +410,7 @@ __declspec(dllexport) bool TITCALL HooksInsertNewRedirection(LPVOID HookAddress, } return false; } + __declspec(dllexport) bool TITCALL HooksInsertNewIATRedirectionEx(ULONG_PTR FileMapVA, ULONG_PTR LoadedModuleBase, char* szHookFunction, LPVOID RedirectTo) { @@ -561,9 +561,9 @@ __declspec(dllexport) bool TITCALL HooksInsertNewIATRedirectionEx(ULONG_PTR File } return false; } + __declspec(dllexport) bool TITCALL HooksInsertNewIATRedirection(char* szModuleName, char* szHookFunction, LPVOID RedirectTo) { - HANDLE FileHandle; DWORD FileSize; HANDLE FileMap; @@ -590,9 +590,9 @@ __declspec(dllexport) bool TITCALL HooksInsertNewIATRedirection(char* szModuleNa } return false; } + __declspec(dllexport) bool TITCALL HooksRemoveRedirection(LPVOID HookAddress, bool RemoveAll) { - DWORD OldProtect = PAGE_READONLY; if(!RemoveAll) @@ -626,9 +626,9 @@ __declspec(dllexport) bool TITCALL HooksRemoveRedirection(LPVOID HookAddress, bo return true; } } + __declspec(dllexport) bool TITCALL HooksRemoveRedirectionsForModule(HMODULE ModuleBase) { - int j = NULL; unsigned int i = (unsigned int)hookEntry.size(); DWORD OldProtect = PAGE_READONLY; @@ -661,9 +661,9 @@ __declspec(dllexport) bool TITCALL HooksRemoveRedirectionsForModule(HMODULE Modu } return true; } + __declspec(dllexport) bool TITCALL HooksRemoveIATRedirection(char* szModuleName, char* szHookFunction, bool RemoveAll) { - unsigned int i = (unsigned int)hookEntry.size() - 1; DWORD OldProtect = PAGE_READONLY; HMODULE ModuleBase = GetModuleHandleA(szModuleName); @@ -687,9 +687,9 @@ __declspec(dllexport) bool TITCALL HooksRemoveIATRedirection(char* szModuleName, } return false; } + __declspec(dllexport) bool TITCALL HooksDisableRedirection(LPVOID HookAddress, bool DisableAll) { - DWORD OldProtect = PAGE_READONLY; if(!DisableAll) @@ -723,9 +723,9 @@ __declspec(dllexport) bool TITCALL HooksDisableRedirection(LPVOID HookAddress, b return true; } } + __declspec(dllexport) bool TITCALL HooksDisableRedirectionsForModule(HMODULE ModuleBase) { - int j = NULL; unsigned int i = (unsigned int)hookEntry.size(); DWORD OldProtect = PAGE_READONLY; @@ -758,9 +758,9 @@ __declspec(dllexport) bool TITCALL HooksDisableRedirectionsForModule(HMODULE Mod } return true; } + __declspec(dllexport) bool TITCALL HooksDisableIATRedirection(char* szModuleName, char* szHookFunction, bool DisableAll) { - unsigned int i = (unsigned int)hookEntry.size() - 1; DWORD OldProtect = PAGE_READONLY; HMODULE ModuleBase = GetModuleHandleA(szModuleName); @@ -787,9 +787,9 @@ __declspec(dllexport) bool TITCALL HooksDisableIATRedirection(char* szModuleName } return false; } + __declspec(dllexport) bool TITCALL HooksEnableRedirection(LPVOID HookAddress, bool EnableAll) { - DWORD OldProtect = PAGE_READONLY; if(!EnableAll) @@ -823,9 +823,9 @@ __declspec(dllexport) bool TITCALL HooksEnableRedirection(LPVOID HookAddress, bo return true; } } + __declspec(dllexport) bool TITCALL HooksEnableRedirectionsForModule(HMODULE ModuleBase) { - int j = NULL; unsigned int i = (unsigned int)hookEntry.size(); DWORD OldProtect = PAGE_READONLY; @@ -858,9 +858,9 @@ __declspec(dllexport) bool TITCALL HooksEnableRedirectionsForModule(HMODULE Modu } return true; } + __declspec(dllexport) bool TITCALL HooksEnableIATRedirection(char* szModuleName, char* szHookFunction, bool EnableAll) { - unsigned int i = (unsigned int)hookEntry.size() - 1; DWORD OldProtect = PAGE_READONLY; HMODULE ModuleBase = GetModuleHandleA(szModuleName); @@ -887,9 +887,9 @@ __declspec(dllexport) bool TITCALL HooksEnableIATRedirection(char* szModuleName, } return false; } + __declspec(dllexport) void TITCALL HooksScanModuleMemory(HMODULE ModuleBase, LPVOID CallBack) { - unsigned int i; bool FileIs64 = false; bool FileError = false; @@ -1106,9 +1106,9 @@ __declspec(dllexport) void TITCALL HooksScanModuleMemory(HMODULE ModuleBase, LPV } } } + __declspec(dllexport) void TITCALL HooksScanEntireProcessMemory(LPVOID CallBack) { - unsigned int i; DWORD cbNeeded = 0; HMODULE EnumeratedModules[1024] = {0}; @@ -1122,6 +1122,7 @@ __declspec(dllexport) void TITCALL HooksScanEntireProcessMemory(LPVOID CallBack) } } } + __declspec(dllexport) void TITCALL HooksScanEntireProcessMemoryEx() { HooksScanEntireProcessMemory(&ProcessHookScanAddNewHook); diff --git a/TitanEngine/TitanEngine.Librarian.cpp b/TitanEngine/TitanEngine.Librarian.cpp index 9ea8342..63e9d45 100644 --- a/TitanEngine/TitanEngine.Librarian.cpp +++ b/TitanEngine/TitanEngine.Librarian.cpp @@ -14,17 +14,20 @@ __declspec(dllexport) bool TITCALL LibrarianSetBreakPoint(char* szLibraryName, D NewLibrarianData.bpxSingleShoot = SingleShoot; NewLibrarianData.bpxType = bpxType; LibrarianData.push_back(NewLibrarianData); + return true; } __declspec(dllexport) bool TITCALL LibrarianRemoveBreakPoint(char* szLibraryName, DWORD bpxType) { - int libbpcount=LibrarianData.size(); - for(int i=libbpcount=1; i>-1; i--) + for(int i = LibrarianData.size() - 1; i >- 1; i--) + { if(!lstrcmpiA(szLibraryName, LibrarianData.at(i).szLibraryName) && (LibrarianData.at(i).bpxType == bpxType || bpxType == UE_ON_LIB_ALL)) { - LibrarianData.erase(LibrarianData.begin()+i); + LibrarianData.erase(LibrarianData.begin() + i); } + } + return true; } @@ -32,6 +35,7 @@ __declspec(dllexport) void* TITCALL LibrarianGetLibraryInfo(char* szLibraryName) { if(!szLibraryName) return NULL; + wchar_t uniLibraryName[MAX_PATH] = {}; PLIBRARY_ITEM_DATAW LibInfo; MultiByteToWideChar(CP_ACP, NULL, szLibraryName, lstrlenA(szLibraryName)+1, uniLibraryName, sizeof(uniLibraryName)/(sizeof(uniLibraryName[0]))); @@ -45,22 +49,28 @@ __declspec(dllexport) void* TITCALL LibrarianGetLibraryInfo(char* szLibraryName) LibraryInfoData.hFileMappingView = LibInfo->hFileMappingView; WideCharToMultiByte(CP_ACP, NULL, LibInfo->szLibraryName, -1, &LibraryInfoData.szLibraryName[0], sizeof LibraryInfoData.szLibraryName, NULL, NULL); WideCharToMultiByte(CP_ACP, NULL, LibInfo->szLibraryPath, -1, &LibraryInfoData.szLibraryPath[0], sizeof LibraryInfoData.szLibraryPath, NULL, NULL); + return((void*)&LibraryInfoData); } - return(NULL); + + return NULL; } __declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoW(wchar_t* szLibraryName) { static LIBRARY_ITEM_DATAW LibraryInfo; memset(&LibraryInfo, 0, sizeof(LIBRARY_ITEM_DATAW)); - int libcount=hListLibrary.size(); - for(int i=0; ihFileMappingView; WideCharToMultiByte(CP_ACP, NULL, LibInfo->szLibraryName, -1, &LibraryInfoData.szLibraryName[0], sizeof LibraryInfoData.szLibraryName, NULL, NULL); WideCharToMultiByte(CP_ACP, NULL, LibInfo->szLibraryPath, -1, &LibraryInfoData.szLibraryPath[0], sizeof LibraryInfoData.szLibraryPath, NULL, NULL); - return((void*)&LibraryInfoData); + + return (void*)&LibraryInfoData; } - return(NULL); + + return NULL; } __declspec(dllexport) void* TITCALL LibrarianGetLibraryInfoExW(void* BaseOfDll) { static LIBRARY_ITEM_DATAW LibraryData; memset(&LibraryData, 0, sizeof(LIBRARY_ITEM_DATAW)); - int libcount=hListLibrary.size(); - for(int i=0; i