Added launcher
This commit is contained in:
AeonLucid
@@ -0,0 +1,15 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ImportGroup Label="PropertySheets" />
|
||||
<PropertyGroup Label="UserMacros">
|
||||
<UESDK>E:\RE\UE-SDKs\Prospect\211021.0949</UESDK>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup />
|
||||
<ItemDefinitionGroup />
|
||||
<ItemGroup>
|
||||
<BuildMacro Include="UESDK">
|
||||
<Value>$(UESDK)</Value>
|
||||
<EnvironmentVariable>true</EnvironmentVariable>
|
||||
</BuildMacro>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,107 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<VCProjectVersion>16.0</VCProjectVersion>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
<ProjectGuid>{a9ba7d25-f239-4320-a0dc-85e8001fd669}</ProjectGuid>
|
||||
<RootNamespace>ProspectAgent</RootNamespace>
|
||||
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<ConfigurationType>DynamicLibrary</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>v142</PlatformToolset>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>Unicode</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="Shared">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
<Import Project="PropertySheet.props" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
<Import Project="PropertySheet.props" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<LinkIncremental>true</LinkIncremental>
|
||||
<OutDir>$(ProjectDir)bin\$(Platform)\$(Configuration)\</OutDir>
|
||||
<IntDir>$(ProjectDir)bin\intermediate\$(Platform)\$(Configuration)\</IntDir>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
<OutDir>$(ProjectDir)bin\$(Platform)\$(Configuration)\</OutDir>
|
||||
<IntDir>$(ProjectDir)bin\intermediate\$(Platform)\$(Configuration)\</IntDir>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>_DEBUG;PROSPECTAGENT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<PrecompiledHeader>NotUsing</PrecompiledHeader>
|
||||
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
|
||||
<AdditionalIncludeDirectories>$(ProjectDir)libs\detours\;$(UESDK);%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Windows</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<EnableUAC>false</EnableUAC>
|
||||
<AdditionalDependencies>detours.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>true</IntrinsicFunctions>
|
||||
<SDLCheck>true</SDLCheck>
|
||||
<PreprocessorDefinitions>NDEBUG;PROSPECTAGENT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<ConformanceMode>true</ConformanceMode>
|
||||
<PrecompiledHeader>NotUsing</PrecompiledHeader>
|
||||
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
|
||||
<AdditionalIncludeDirectories>$(ProjectDir)libs\detours\;$(UESDK);%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Windows</SubSystem>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<EnableUAC>false</EnableUAC>
|
||||
<AdditionalDependencies>detours.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="logger.h" />
|
||||
<ClInclude Include="main.h" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="logger.cpp" />
|
||||
<ClCompile Include="main.cpp" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,33 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="main.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="logger.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="main.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="logger.cpp">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -0,0 +1,616 @@
|
||||
//////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
// File: detours.h
|
||||
// Module: detours.lib
|
||||
//
|
||||
// Detours for binary functions. Version 1.5 (Build 46)
|
||||
//
|
||||
// Copyright 1995-2001, Microsoft Corporation
|
||||
//
|
||||
|
||||
#pragma once
|
||||
#ifndef _DETOURS_H_
|
||||
#define _DETOURS_H_
|
||||
|
||||
#pragma comment(lib, "detours")
|
||||
|
||||
//////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
#ifndef GUID_DEFINED
|
||||
#define GUID_DEFINED
|
||||
typedef struct _GUID
|
||||
{
|
||||
DWORD Data1;
|
||||
WORD Data2;
|
||||
WORD Data3;
|
||||
BYTE Data4[ 8 ];
|
||||
} GUID;
|
||||
#endif // !GUID_DEFINED
|
||||
|
||||
#if defined(__cplusplus)
|
||||
#ifndef _REFGUID_DEFINED
|
||||
#define _REFGUID_DEFINED
|
||||
#define REFGUID const GUID &
|
||||
#endif // !_REFGUID_DEFINED
|
||||
#else // !__cplusplus
|
||||
#ifndef _REFGUID_DEFINED
|
||||
#define _REFGUID_DEFINED
|
||||
#define REFGUID const GUID * const
|
||||
#endif // !_REFGUID_DEFINED
|
||||
#endif // !__cplusplus
|
||||
//
|
||||
//////////////////////////////////////////////////////////////////////////////
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif // __cplusplus
|
||||
|
||||
/////////////////////////////////////////////////// Instruction Target Macros.
|
||||
//
|
||||
#define DETOUR_INSTRUCTION_TARGET_NONE ((PBYTE)0)
|
||||
#define DETOUR_INSTRUCTION_TARGET_DYNAMIC ((PBYTE)~0ul)
|
||||
|
||||
/////////////////////////////////////////////////////////// Trampoline Macros.
|
||||
//
|
||||
// DETOUR_TRAMPOLINE(trampoline_prototype, target_name)
|
||||
//
|
||||
// The naked trampoline must be at least DETOUR_TRAMPOLINE_SIZE bytes.
|
||||
//
|
||||
#define DETOUR_TRAMPOLINE_SIZE 32
|
||||
#define DETOUR_SECTION_HEADER_SIGNATURE 0x00727444 // "Dtr\0"
|
||||
|
||||
#define DETOUR_TRAMPOLINE(trampoline,target) \
|
||||
static PVOID __fastcall _Detours_GetVA_##target(VOID) \
|
||||
{ \
|
||||
return ⌖ \
|
||||
} \
|
||||
\
|
||||
__declspec(naked) trampoline \
|
||||
{ \
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { call _Detours_GetVA_##target };\
|
||||
__asm { jmp eax };\
|
||||
__asm { ret };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
}
|
||||
|
||||
#define DETOUR_TRAMPOLINE_EMPTY(trampoline) \
|
||||
__declspec(naked) trampoline \
|
||||
{ \
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { xor eax, eax };\
|
||||
__asm { mov eax, [eax] };\
|
||||
__asm { ret };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
__asm { nop };\
|
||||
}
|
||||
|
||||
/////////////////////////////////////////////////////////// Binary Structures.
|
||||
//
|
||||
#pragma pack(push, 8)
|
||||
typedef struct _DETOUR_SECTION_HEADER
|
||||
{
|
||||
DWORD cbHeaderSize;
|
||||
DWORD nSignature;
|
||||
DWORD nDataOffset;
|
||||
DWORD cbDataSize;
|
||||
|
||||
DWORD nOriginalImportVirtualAddress;
|
||||
DWORD nOriginalImportSize;
|
||||
DWORD nOriginalBoundImportVirtualAddress;
|
||||
DWORD nOriginalBoundImportSize;
|
||||
|
||||
DWORD nOriginalIatVirtualAddress;
|
||||
DWORD nOriginalIatSize;
|
||||
DWORD nOriginalSizeOfImage;
|
||||
DWORD nReserve;
|
||||
} DETOUR_SECTION_HEADER, *PDETOUR_SECTION_HEADER;
|
||||
|
||||
typedef struct _DETOUR_SECTION_RECORD
|
||||
{
|
||||
DWORD cbBytes;
|
||||
DWORD nReserved;
|
||||
GUID guid;
|
||||
} DETOUR_SECTION_RECORD, *PDETOUR_SECTION_RECORD;
|
||||
#pragma pack(pop)
|
||||
|
||||
#define DETOUR_SECTION_HEADER_DECLARE(cbSectionSize) \
|
||||
{ \
|
||||
sizeof(DETOUR_SECTION_HEADER),\
|
||||
DETOUR_SECTION_HEADER_SIGNATURE,\
|
||||
sizeof(DETOUR_SECTION_HEADER),\
|
||||
(cbSectionSize),\
|
||||
\
|
||||
0,\
|
||||
0,\
|
||||
0,\
|
||||
0,\
|
||||
\
|
||||
0,\
|
||||
0,\
|
||||
0,\
|
||||
0,\
|
||||
}
|
||||
|
||||
///////////////////////////////////////////////////////////// Binary Typedefs.
|
||||
//
|
||||
typedef BOOL (CALLBACK *PF_DETOUR_BINARY_BYWAY_CALLBACK)(PVOID pContext,
|
||||
PCHAR pszFile,
|
||||
PCHAR *ppszOutFile);
|
||||
typedef BOOL (CALLBACK *PF_DETOUR_BINARY_FILE_CALLBACK)(PVOID pContext,
|
||||
PCHAR pszOrigFile,
|
||||
PCHAR pszFile,
|
||||
PCHAR *ppszOutFile);
|
||||
typedef BOOL (CALLBACK *PF_DETOUR_BINARY_SYMBOL_CALLBACK)(PVOID pContext,
|
||||
DWORD nOrdinal,
|
||||
PCHAR pszOrigSymbol,
|
||||
PCHAR pszSymbol,
|
||||
PCHAR *ppszOutSymbol);
|
||||
typedef BOOL (CALLBACK *PF_DETOUR_BINARY_FINAL_CALLBACK)(PVOID pContext);
|
||||
typedef BOOL (CALLBACK *PF_DETOUR_BINARY_EXPORT_CALLBACK)(PVOID pContext,
|
||||
DWORD nOrdinal,
|
||||
PCHAR pszName,
|
||||
PBYTE pbCode);
|
||||
|
||||
typedef VOID * PDETOUR_BINARY;
|
||||
typedef VOID * PDETOUR_LOADED_BINARY;
|
||||
|
||||
//////////////////////////////////////////////////////// Trampoline Functions.
|
||||
//
|
||||
PBYTE WINAPI DetourFunction(PBYTE pbTargetFunction,
|
||||
PBYTE pbDetourFunction);
|
||||
|
||||
BOOL WINAPI DetourFunctionWithEmptyTrampoline(PBYTE pbTrampoline,
|
||||
PBYTE pbTarget,
|
||||
PBYTE pbDetour);
|
||||
|
||||
BOOL WINAPI DetourFunctionWithEmptyTrampolineEx(PBYTE pbTrampoline,
|
||||
PBYTE pbTarget,
|
||||
PBYTE pbDetour,
|
||||
PBYTE *ppbRealTrampoline,
|
||||
PBYTE *ppbRealTarget,
|
||||
PBYTE *ppbRealDetour);
|
||||
|
||||
BOOL WINAPI DetourFunctionWithTrampoline(PBYTE pbTrampoline,
|
||||
PBYTE pbDetour);
|
||||
|
||||
BOOL WINAPI DetourFunctionWithTrampolineEx(PBYTE pbTrampoline,
|
||||
PBYTE pbDetour,
|
||||
PBYTE *ppbRealTrampoline,
|
||||
PBYTE *ppbRealTarget);
|
||||
|
||||
BOOL WINAPI DetourRemove(PBYTE pbTrampoline, PBYTE pbDetour);
|
||||
|
||||
////////////////////////////////////////////////////////////// Code Functions.
|
||||
//
|
||||
PBYTE WINAPI DetourFindFunction(PCHAR pszModule, PCHAR pszFunction);
|
||||
PBYTE WINAPI DetourGetFinalCode(PBYTE pbCode, BOOL fSkipJmp);
|
||||
|
||||
PBYTE WINAPI DetourCopyInstruction(PBYTE pbDst, PBYTE pbSrc, PBYTE *ppbTarget);
|
||||
PBYTE WINAPI DetourCopyInstructionEx(PBYTE pbDst,
|
||||
PBYTE pbSrc,
|
||||
PBYTE *ppbTarget,
|
||||
LONG *plExtra);
|
||||
|
||||
///////////////////////////////////////////////////// Loaded Binary Functions.
|
||||
//
|
||||
HMODULE WINAPI DetourEnumerateModules(HMODULE hModuleLast);
|
||||
PBYTE WINAPI DetourGetEntryPoint(HMODULE hModule);
|
||||
BOOL WINAPI DetourEnumerateExports(HMODULE hModule,
|
||||
PVOID pContext,
|
||||
PF_DETOUR_BINARY_EXPORT_CALLBACK pfExport);
|
||||
|
||||
PBYTE WINAPI DetourFindPayload(HMODULE hModule, REFGUID rguid, DWORD *pcbData);
|
||||
DWORD WINAPI DetourGetSizeOfPayloads(HMODULE hModule);
|
||||
|
||||
///////////////////////////////////////////////// Persistent Binary Functions.
|
||||
//
|
||||
BOOL WINAPI DetourBinaryBindA(PCHAR pszFile, PCHAR pszDll, PCHAR pszPath);
|
||||
BOOL WINAPI DetourBinaryBindW(PWCHAR pwzFile, PWCHAR pwzDll, PWCHAR pwzPath);
|
||||
#ifdef UNICODE
|
||||
#define DetourBinaryBind DetourBinaryBindW
|
||||
#else
|
||||
#define DetourBinaryBind DetourBinaryBindA
|
||||
#endif // !UNICODE
|
||||
|
||||
PDETOUR_BINARY WINAPI DetourBinaryOpen(HANDLE hFile);
|
||||
PBYTE WINAPI DetourBinaryEnumeratePayloads(PDETOUR_BINARY pBinary,
|
||||
GUID *pGuid,
|
||||
DWORD *pcbData,
|
||||
DWORD *pnIterator);
|
||||
PBYTE WINAPI DetourBinaryFindPayload(PDETOUR_BINARY pBinary,
|
||||
REFGUID rguid,
|
||||
DWORD *pcbData);
|
||||
PBYTE WINAPI DetourBinarySetPayload(PDETOUR_BINARY pBinary,
|
||||
REFGUID rguid,
|
||||
PBYTE pbData,
|
||||
DWORD cbData);
|
||||
BOOL WINAPI DetourBinaryDeletePayload(PDETOUR_BINARY pBinary, REFGUID rguid);
|
||||
BOOL WINAPI DetourBinaryPurgePayloads(PDETOUR_BINARY pBinary);
|
||||
BOOL WINAPI DetourBinaryResetImports(PDETOUR_BINARY pBinary);
|
||||
BOOL WINAPI DetourBinaryEditImports(PDETOUR_BINARY pBinary,
|
||||
PVOID pContext,
|
||||
PF_DETOUR_BINARY_BYWAY_CALLBACK pfByway,
|
||||
PF_DETOUR_BINARY_FILE_CALLBACK pfFile,
|
||||
PF_DETOUR_BINARY_SYMBOL_CALLBACK pfSymbol,
|
||||
PF_DETOUR_BINARY_FINAL_CALLBACK pfFinal);
|
||||
BOOL WINAPI DetourBinaryWrite(PDETOUR_BINARY pBinary, HANDLE hFile);
|
||||
BOOL WINAPI DetourBinaryClose(PDETOUR_BINARY pBinary);
|
||||
|
||||
/////////////////////////////////////////////// First Chance Exception Filter.
|
||||
//
|
||||
LPTOP_LEVEL_EXCEPTION_FILTER WINAPI
|
||||
DetourFirstChanceExceptionFilter(LPTOP_LEVEL_EXCEPTION_FILTER lpTopLevelFilter);
|
||||
|
||||
///////////////////////////////////////////////// Create Process & Inject Dll.
|
||||
//
|
||||
typedef BOOL (WINAPI *PDETOUR_CREATE_PROCESS_ROUTINEA)
|
||||
(LPCSTR lpApplicationName,
|
||||
LPSTR lpCommandLine,
|
||||
LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
||||
LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
||||
BOOL bInheritHandles,
|
||||
DWORD dwCreationFlags,
|
||||
LPVOID lpEnvironment,
|
||||
LPCSTR lpCurrentDirectory,
|
||||
LPSTARTUPINFOA lpStartupInfo,
|
||||
LPPROCESS_INFORMATION lpProcessInformation);
|
||||
|
||||
typedef BOOL (WINAPI *PDETOUR_CREATE_PROCESS_ROUTINEW)
|
||||
(LPCWSTR lpApplicationName,
|
||||
LPWSTR lpCommandLine,
|
||||
LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
||||
LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
||||
BOOL bInheritHandles,
|
||||
DWORD dwCreationFlags,
|
||||
LPVOID lpEnvironment,
|
||||
LPCWSTR lpCurrentDirectory,
|
||||
LPSTARTUPINFOW lpStartupInfo,
|
||||
LPPROCESS_INFORMATION lpProcessInformation);
|
||||
|
||||
BOOL WINAPI DetourCreateProcessWithDllA(LPCSTR lpApplicationName,
|
||||
LPSTR lpCommandLine,
|
||||
LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
||||
LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
||||
BOOL bInheritHandles,
|
||||
DWORD dwCreationFlags,
|
||||
LPVOID lpEnvironment,
|
||||
LPCSTR lpCurrentDirectory,
|
||||
LPSTARTUPINFOA lpStartupInfo,
|
||||
LPPROCESS_INFORMATION lpProcessInformation,
|
||||
LPCSTR lpDllName,
|
||||
PDETOUR_CREATE_PROCESS_ROUTINEA
|
||||
pfCreateProcessA);
|
||||
|
||||
BOOL WINAPI DetourCreateProcessWithDllW(LPCWSTR lpApplicationName,
|
||||
LPWSTR lpCommandLine,
|
||||
LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
||||
LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
||||
BOOL bInheritHandles,
|
||||
DWORD dwCreationFlags,
|
||||
LPVOID lpEnvironment,
|
||||
LPCWSTR lpCurrentDirectory,
|
||||
LPSTARTUPINFOW lpStartupInfo,
|
||||
LPPROCESS_INFORMATION lpProcessInformation,
|
||||
LPCWSTR lpDllName,
|
||||
PDETOUR_CREATE_PROCESS_ROUTINEW
|
||||
pfCreateProcessW);
|
||||
|
||||
#ifdef UNICODE
|
||||
#define DetourCreateProcessWithDll DetourCreateProcessWithDllW
|
||||
#define PDETOUR_CREATE_PROCESS_ROUTINE PDETOUR_CREATE_PROCESS_ROUTINEW
|
||||
#else
|
||||
#define DetourCreateProcessWithDll DetourCreateProcessWithDllA
|
||||
#define PDETOUR_CREATE_PROCESS_ROUTINE PDETOUR_CREATE_PROCESS_ROUTINEA
|
||||
#endif // !UNICODE
|
||||
|
||||
BOOL WINAPI DetourContinueProcessWithDllA(HANDLE hProcess, LPCSTR lpDllName);
|
||||
BOOL WINAPI DetourContinueProcessWithDllW(HANDLE hProcess, LPCWSTR lpDllName);
|
||||
|
||||
#ifdef UNICODE
|
||||
#define DetourContinueProcessWithDll DetourContinueProcessWithDllW
|
||||
#else
|
||||
#define DetourContinueProcessWithDll DetourContinueProcessWithDllA
|
||||
#endif // !UNICODE
|
||||
//
|
||||
//////////////////////////////////////////////////////////////////////////////
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif // __cplusplus
|
||||
|
||||
/////////////////////////////////////////////////////////////////// Old Names.
|
||||
//
|
||||
#define ContinueProcessWithDll DetourContinueProcessWithDll
|
||||
#define ContinueProcessWithDllA DetourContinueProcessWithDllA
|
||||
#define ContinueProcessWithDllW DetourContinueProcessWithDllW
|
||||
#define CreateProcessWithDll DetourCreateProcessWithDll
|
||||
#define CreateProcessWithDllA DetourCreateProcessWithDllA
|
||||
#define CreateProcessWithDllW DetourCreateProcessWithDllW
|
||||
#define DETOUR_TRAMPOLINE_WO_TARGET DETOUR_TRAMPOLINE_EMPTY
|
||||
#define DetourBinaryPurgePayload DetourBinaryPurgePayloads
|
||||
#define DetourEnumerateExportsForInstance DetourEnumerateExports
|
||||
#define DetourEnumerateInstances DetourEnumerateModules
|
||||
#define DetourFindEntryPointForInstance DetourGetEntryPoint
|
||||
#define DetourFindFinalCode DetourGetFinalCode
|
||||
#define DetourFindPayloadInBinary DetourFindPayload
|
||||
#define DetourGetSizeOfBinary DetourGetSizeOfPayloads
|
||||
#define DetourRemoveWithTrampoline DetourRemove
|
||||
#define PCREATE_PROCESS_ROUTINE PDETOUR_CREATE_PROCESS_ROUTINE
|
||||
#define PCREATE_PROCESS_ROUTINEA PDETOUR_CREATE_PROCESS_ROUTINEA
|
||||
#define PCREATE_PROCESS_ROUTINEW PDETOUR_CREATE_PROCESS_ROUTINEW
|
||||
//
|
||||
|
||||
//////////////////////////////////////////////// Detours Internal Definitions.
|
||||
//
|
||||
#ifdef __cplusplus
|
||||
#ifdef DETOURS_INTERNAL
|
||||
|
||||
//////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
#ifdef IMAGEAPI // defined by IMAGEHLP.H
|
||||
typedef LPAPI_VERSION (NTAPI *PF_ImagehlpApiVersionEx)(LPAPI_VERSION AppVersion);
|
||||
|
||||
typedef BOOL (NTAPI *PF_SymInitialize)(IN HANDLE hProcess,
|
||||
IN LPSTR UserSearchPath,
|
||||
IN BOOL fInvadeProcess);
|
||||
typedef DWORD (NTAPI *PF_SymSetOptions)(IN DWORD SymOptions);
|
||||
typedef DWORD (NTAPI *PF_SymGetOptions)(VOID);
|
||||
typedef BOOL (NTAPI *PF_SymLoadModule)(IN HANDLE hProcess,
|
||||
IN HANDLE hFile,
|
||||
IN PSTR ImageName,
|
||||
IN PSTR ModuleName,
|
||||
IN DWORD BaseOfDll,
|
||||
IN DWORD SizeOfDll);
|
||||
typedef BOOL (NTAPI *PF_SymGetModuleInfo)(IN HANDLE hProcess,
|
||||
IN DWORD dwAddr,
|
||||
OUT PIMAGEHLP_MODULE ModuleInfo);
|
||||
typedef BOOL (NTAPI *PF_SymGetSymFromName)(IN HANDLE hProcess,
|
||||
IN LPSTR Name,
|
||||
OUT PIMAGEHLP_SYMBOL Symbol);
|
||||
typedef BOOL (NTAPI *PF_BindImage)(IN LPSTR pszImageName,
|
||||
IN LPSTR pszDllPath,
|
||||
IN LPSTR pszSymbolPath);
|
||||
|
||||
typedef struct _DETOUR_SYM_INFO
|
||||
{
|
||||
HANDLE hProcess;
|
||||
HMODULE hImageHlp;
|
||||
PF_ImagehlpApiVersionEx pfImagehlpApiVersionEx;
|
||||
PF_SymInitialize pfSymInitialize;
|
||||
PF_SymSetOptions pfSymSetOptions;
|
||||
PF_SymGetOptions pfSymGetOptions;
|
||||
PF_SymLoadModule pfSymLoadModule;
|
||||
PF_SymGetModuleInfo pfSymGetModuleInfo;
|
||||
PF_SymGetSymFromName pfSymGetSymFromName;
|
||||
PF_BindImage pfBindImage;
|
||||
} DETOUR_SYM_INFO, *PDETOUR_SYM_INFO;
|
||||
|
||||
PDETOUR_SYM_INFO DetourLoadImageHlp(VOID);
|
||||
|
||||
#endif // IMAGEAPI
|
||||
|
||||
//////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
class CDetourEnableWriteOnCodePage
|
||||
{
|
||||
public:
|
||||
CDetourEnableWriteOnCodePage(PBYTE pbCode, LONG cbCode = DETOUR_TRAMPOLINE_SIZE)
|
||||
{
|
||||
m_pbCode = pbCode;
|
||||
m_cbCode = cbCode;
|
||||
m_dwOldPerm = 0;
|
||||
m_hProcess = GetCurrentProcess();
|
||||
|
||||
if (m_pbCode && m_cbCode) {
|
||||
if (!FlushInstructionCache(m_hProcess, pbCode, cbCode)) {
|
||||
return;
|
||||
}
|
||||
if (!VirtualProtect(pbCode,
|
||||
cbCode,
|
||||
PAGE_EXECUTE_READWRITE,
|
||||
&m_dwOldPerm)) {
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
~CDetourEnableWriteOnCodePage()
|
||||
{
|
||||
if (m_dwOldPerm && m_pbCode && m_cbCode) {
|
||||
DWORD dwTemp = 0;
|
||||
if (!FlushInstructionCache(m_hProcess, m_pbCode, m_cbCode)) {
|
||||
return;
|
||||
}
|
||||
if (!VirtualProtect(m_pbCode, m_cbCode, m_dwOldPerm, &dwTemp)) {
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
BOOL SetPermission(DWORD dwPerms)
|
||||
{
|
||||
if (m_dwOldPerm && m_pbCode && m_cbCode) {
|
||||
m_dwOldPerm = dwPerms;
|
||||
return TRUE;
|
||||
}
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
BOOL IsValid(VOID)
|
||||
{
|
||||
return m_pbCode && m_cbCode && m_dwOldPerm;
|
||||
}
|
||||
|
||||
private:
|
||||
HANDLE m_hProcess;
|
||||
PBYTE m_pbCode;
|
||||
LONG m_cbCode;
|
||||
DWORD m_dwOldPerm;
|
||||
};
|
||||
|
||||
//////////////////////////////////////////////////////////////////////////////
|
||||
//
|
||||
inline PBYTE DetourGenMovEax(PBYTE pbCode, UINT32 nValue)
|
||||
{
|
||||
*pbCode++ = 0xB8;
|
||||
*((UINT32*&)pbCode)++ = nValue;
|
||||
return pbCode;
|
||||
}
|
||||
|
||||
inline PBYTE DetourGenMovEbx(PBYTE pbCode, UINT32 nValue)
|
||||
{
|
||||
*pbCode++ = 0xBB;
|
||||
*((UINT32*&)pbCode)++ = nValue;
|
||||
return pbCode;
|
||||
}
|
||||
|
||||
inline PBYTE DetourGenMovEcx(PBYTE pbCode, UINT32 nValue)
|
||||
{
|
||||
*pbCode++ = 0xB9;
|
||||
*((UINT32*&)pbCode)++ = nValue;
|
||||
return pbCode;
|
||||
}
|
||||
|
||||
inline PBYTE DetourGenMovEdx(PBYTE pbCode, UINT32 nValue)
|
||||
{
|
||||
*pbCode++ = 0xBA;
|
||||
*((UINT32*&)pbCode)++ = nValue;
|
||||
return pbCode;
|
||||
}
|
||||
|
||||
inline PBYTE DetourGenMovEsi(PBYTE pbCode, UINT32 nValue)
|
||||
{
|
||||
*pbCode++ = 0xBE;
|
||||
*((UINT32*&)pbCode)++ = nValue;
|
||||
return pbCode;
|
||||
}
|
||||
|
||||
inline PBYTE DetourGenMovEdi(PBYTE pbCode, UINT32 nValue)
|
||||
{
|
||||
*pbCode++ = 0xBF;
|
||||
*((UINT32*&)pbCode)++ = nValue;
|
||||
return pbCode;
|
||||
}
|
||||
|
||||
inline PBYTE DetourGenMovEbp(PBYTE pbCode, UINT32 nValue)
|
||||
{
|
||||
*pbCode++ = 0xBD;
|
||||
*((UINT32*&)pbCode)++ = nValue;
|
||||
return pbCode;
|
||||
}
|
||||
|
||||
inline PBYTE DetourGenMovEsp(PBYTE pbCode, UINT32 nValue)
|
||||
{
|
||||
*pbCode++ = 0xBC;
|
||||
*((UINT32*&)pbCode)++ = nValue;
|
||||
return pbCode;
|
||||
}
|
||||
|
||||
inline PBYTE DetourGenPush(PBYTE pbCode, UINT32 nValue)
|
||||
{
|
||||
*pbCode++ = 0x68;
|
||||
*((UINT32*&)pbCode)++ = nValue;
|
||||
return pbCode;
|
||||
}
|
||||
|
||||
inline PBYTE DetourGenPushad(PBYTE pbCode)
|
||||
{
|
||||
*pbCode++ = 0x60;
|
||||
return pbCode;
|
||||
}
|
||||
|
||||
inline PBYTE DetourGenPopad(PBYTE pbCode)
|
||||
{
|
||||
*pbCode++ = 0x61;
|
||||
return pbCode;
|
||||
}
|
||||
|
||||
inline PBYTE DetourGenJmp(PBYTE pbCode, PBYTE pbJmpDst, PBYTE pbJmpSrc = 0)
|
||||
{
|
||||
if (pbJmpSrc == 0) {
|
||||
pbJmpSrc = pbCode;
|
||||
}
|
||||
*pbCode++ = 0xE9;
|
||||
*((INT32*&)pbCode)++ = pbJmpDst - (pbJmpSrc + 5);
|
||||
return pbCode;
|
||||
}
|
||||
|
||||
inline PBYTE DetourGenCall(PBYTE pbCode, PBYTE pbJmpDst, PBYTE pbJmpSrc = 0)
|
||||
{
|
||||
if (pbJmpSrc == 0) {
|
||||
pbJmpSrc = pbCode;
|
||||
}
|
||||
*pbCode++ = 0xE8;
|
||||
*((INT32*&)pbCode)++ = pbJmpDst - (pbJmpSrc + 5);
|
||||
return pbCode;
|
||||
}
|
||||
|
||||
inline PBYTE DetourGenBreak(PBYTE pbCode)
|
||||
{
|
||||
*pbCode++ = 0xcc;
|
||||
return pbCode;
|
||||
}
|
||||
|
||||
inline PBYTE DetourGenRet(PBYTE pbCode)
|
||||
{
|
||||
*pbCode++ = 0xc3;
|
||||
return pbCode;
|
||||
}
|
||||
|
||||
inline PBYTE DetourGenNop(PBYTE pbCode)
|
||||
{
|
||||
*pbCode++ = 0x90;
|
||||
return pbCode;
|
||||
}
|
||||
#endif DETOURS_INTERAL
|
||||
#endif // __cplusplus
|
||||
|
||||
#endif // _DETOURS_H_
|
||||
//
|
||||
//////////////////////////////////////////////////////////////// End of File.
|
||||
Binary file not shown.
@@ -0,0 +1,82 @@
|
||||
#include "logger.h"
|
||||
|
||||
HANDLE h_out = nullptr, h_old_out = nullptr;
|
||||
HANDLE h_err = nullptr, h_old_err = nullptr;
|
||||
HANDLE h_in = nullptr, h_old_in = nullptr;
|
||||
|
||||
namespace logger
|
||||
{
|
||||
void Attach()
|
||||
{
|
||||
h_old_out = GetStdHandle(STD_OUTPUT_HANDLE);
|
||||
h_old_err = GetStdHandle(STD_ERROR_HANDLE);
|
||||
h_old_in = GetStdHandle(STD_INPUT_HANDLE);
|
||||
|
||||
AllocConsole() && AttachConsole(GetCurrentProcessId());
|
||||
|
||||
h_out = GetStdHandle(STD_OUTPUT_HANDLE);
|
||||
h_err = GetStdHandle(STD_ERROR_HANDLE);
|
||||
h_in = GetStdHandle(STD_INPUT_HANDLE);
|
||||
|
||||
SetConsoleMode(h_out,
|
||||
ENABLE_PROCESSED_OUTPUT | ENABLE_WRAP_AT_EOL_OUTPUT);
|
||||
|
||||
SetConsoleMode(h_in,
|
||||
ENABLE_INSERT_MODE | ENABLE_EXTENDED_FLAGS |
|
||||
ENABLE_PROCESSED_INPUT | ENABLE_QUICK_EDIT_MODE);
|
||||
}
|
||||
|
||||
void Detach()
|
||||
{
|
||||
if (h_out && h_err && h_in) {
|
||||
FreeConsole();
|
||||
|
||||
if (h_old_out)
|
||||
{
|
||||
SetStdHandle(STD_OUTPUT_HANDLE, h_old_out);
|
||||
}
|
||||
|
||||
if (h_old_err)
|
||||
{
|
||||
SetStdHandle(STD_ERROR_HANDLE, h_old_err);
|
||||
}
|
||||
|
||||
if (h_old_in)
|
||||
{
|
||||
SetStdHandle(STD_INPUT_HANDLE, h_old_in);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
bool Print(const char* fmt, ...)
|
||||
{
|
||||
if (!h_out)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
char buf[1024];
|
||||
va_list va;
|
||||
|
||||
va_start(va, fmt);
|
||||
_vsnprintf_s(buf, 1024, fmt, va);
|
||||
va_end(va);
|
||||
|
||||
return !!WriteConsoleA(h_out, buf, static_cast<DWORD>(strlen(buf)), nullptr, nullptr);
|
||||
}
|
||||
|
||||
char ReadKey()
|
||||
{
|
||||
if (!h_in)
|
||||
{
|
||||
return -1;
|
||||
}
|
||||
|
||||
auto key = char{ 0 };
|
||||
auto keysread = DWORD{ 0 };
|
||||
|
||||
ReadConsoleA(h_in, &key, 1, &keysread, nullptr);
|
||||
|
||||
return key;
|
||||
}
|
||||
};
|
||||
@@ -0,0 +1,15 @@
|
||||
#pragma once
|
||||
|
||||
#include <cstdio>
|
||||
#include <Windows.h>
|
||||
|
||||
namespace logger
|
||||
{
|
||||
void Attach();
|
||||
|
||||
void Detach();
|
||||
|
||||
bool Print(const char* fmt, ...);
|
||||
|
||||
char ReadKey();
|
||||
};
|
||||
@@ -0,0 +1,36 @@
|
||||
#include <cstdio>
|
||||
#include "main.h"
|
||||
#include "logger.h"
|
||||
#include <detours.h>
|
||||
|
||||
DWORD WINAPI OnDllAttach(LPVOID base)
|
||||
{
|
||||
logger::Attach();
|
||||
logger::Print("[Agent] DLL Attached\n");
|
||||
|
||||
// TODO: Patch.
|
||||
|
||||
logger::Print("[Agent] DLL Exit\n");
|
||||
FreeLibraryAndExitThread(static_cast<HMODULE>(base), 1);
|
||||
}
|
||||
|
||||
BOOL WINAPI DllMain(
|
||||
const _In_ HINSTANCE hinstDll,
|
||||
const _In_ DWORD fdwReason,
|
||||
const _In_opt_ LPVOID lpvReserved
|
||||
)
|
||||
{
|
||||
if (fdwReason == DLL_PROCESS_ATTACH)
|
||||
{
|
||||
DisableThreadLibraryCalls(hinstDll);
|
||||
|
||||
// Allocate a console.
|
||||
AllocConsole();
|
||||
freopen_s(reinterpret_cast<FILE**>(stdout), "CONOUT$", "w", stdout);
|
||||
|
||||
// Spawn thread.
|
||||
CreateThread(nullptr, 0, OnDllAttach, hinstDll, 0, nullptr);
|
||||
}
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
@@ -0,0 +1,4 @@
|
||||
#pragma once
|
||||
|
||||
#define WIN32_LEAN_AND_MEAN
|
||||
#include <windows.h>
|
||||
Reference in New Issue
Block a user