|
OLE api is Win32/C, and every C compiler (including msvc of VC6) can handle it.
Nuclear launch detected
|
|
|
|
|
Hello once again,I have been working on some project for a while now and I needed to hook a creation of processes,I have that code(hook/detour)
BOOL WINAPI CreateProcH::CreateProcessInternalW ( HANDLE hToken,
LPCWSTR lpApplicationName,
LPWSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCWSTR lpCurrentDirectory,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation,
PHANDLE hNewToken
)
clogf("start %x ref: %x",realCreateProcessInternalW,&realCreateProcessInternalW);
BOOL res = FALSE;
res = realCreateProcessInternalW(hToken,lpApplicationName,lpCommandLine,lpProcessAttributes,lpThreadAttributes,bInheritHandles,dwCreationFlags,lpEnvironment,lpCurrentDirectory,lpStartupInfo,lpProcessInformation,hNewToken);
if(res == FALSE)
return res;
Sleep(100);
vector<wchar_t*> ::iterator it;
for(it = pubvPaths.begin(); it < pubvPaths.end(); it++)
{
if(!CDetour::InjectDll(lpProcessInformation->hProcess,*it))
clogf("InjectDll(lpProcessInformation->hProcess,*it) FAILED!");
clogf("Strlen %d Injecting dll: %ls",lstrlenW(*it),*it);
}
clogf("hThread: %d hProcess: %d dwThreadId: %d dwProcessId: %d",lpProcessInformation->hThread,lpProcessInformation->hProcess,lpProcessInformation->dwThreadId,lpProcessInformation->dwProcessId);
return res;
};
LOG:
[Fri Nov 30 20:22:20 2012] CreateProcH::CreateProcessInternalW reported: start 7d843e8 ref: 741285ac
[Fri Nov 30 20:22:20 2012] CreateProcH::CreateProcessInternalW reported: Strlen 103 Injecting dll: C:/Users/JEAN/SplitPLayGUI-build-desktop-Qt_4_8_1_for_Desktop_-_MSVC2010__Qt_SDK__Debug/CreateProcH.dll
[Fri Nov 30 20:22:20 2012] CreateProcH::CreateProcessInternalW reported: hThread: 5360 hProcess: 5376 dwThreadId: 8376 dwProcessId: 1388
but the process fails to create or crashes not sure what is wrong,
So I just commented out
if(!CDetour::InjectDll(lpProcessInformation->hProcess,*it))
clogf("InjectDll(lpProcessInformation->hProcess,*it) FAILED!");
and everything logged the same way but the process actually created and ran, here is CDetour::InjectDll
bool CDetour::InjectDll(HANDLE hProcess ,wchar_t * pwstrDll)
{
LPVOID RemoteString, LoadLibAddy;
if(!hProcess)
return false;
LoadLibAddy = (LPVOID)GetProcAddress(GetModuleHandle(L"kernel32.dll"), "LoadLibraryW");
if(!LoadLibAddy)
{
clogf("GetProcAddress(GetModuleHandle(L\"kernel32.dll\"), \"LoadLibraryW\") FAILED WITH %d!",GetLastError());
return false;
}
RemoteString = (LPVOID)VirtualAllocEx(hProcess, NULL, (lstrlenW(pwstrDll)*2)+2, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE);
if(!RemoteString)
{
clogf("VirtualAllocEx(hProcess, NULL, lstrlenW(pwstrDll)+2, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE); FAILED WITH %d!",GetLastError());
return false;
}
if(WriteProcessMemory(hProcess, (LPVOID)RemoteString, pwstrDll,(lstrlenW(pwstrDll)*2)+2, NULL) == 0)
{
clogf("WriteProcessMemory(hProcess, (LPVOID)RemoteString, pwstrDll,lstrlenW(pwstrDll)+2, NULL) FAILED WITH %d!",GetLastError());
return false;
}
if(CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibAddy, (LPVOID)RemoteString, NULL, NULL) == NULL)
{
clogf("CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibAddy, (LPVOID)RemoteString, NULL, NULL) FAILED WITH %d!",GetLastError());
return false;
}
return true;
}
I hope someone else could figure it out ,thanks in advance 
|
|
|
|
|
Since nobody replied I made a much deeper research on my own, and found out that I can't really use the same DLL injection way that is used when the process is already loaded.
|
|
|
|
|
this simple program supposed to run the command ls
but the output is 1 and 2.can someone explain to me why ls not working ?
#include <stdio.h>
main()
{
int pid,stat;
if((pid=fork())==0)
{
execl("/bin/","ls",NULL);
printf("1");
exit(1);
}
else
{
wait(&stat);
printf("2");
}
}
|
|
|
|
|
The first argument to execl should contain the full path to the executable you want to run:
execl("/bin/ls","ls",NULL);
|
|
|
|
|
i understant that if i have parameters i shoud write
execl("/bin/date", "date", "-u", NULL);
how can i write the same thing with execv ?
|
|
|
|
|
Also execl returns a value that can help you tell why it isn't working.
Such as '2' which seems to pretty much always mean that it couldn't find the file it needed to execute.
|
|
|
|
|
Hello Friends
I am having a file in binary mode.Now, I want to read it So that I can get the format of that File.
Is ther any way in MFC or Win32 to reverse it ?
Thanks In Advance.
regards
yogesh
|
|
|
|
|
Unless you know the format of the file contents there is not really any way to do it. You can try some guesswork and logical tests (I have done similar in the past) but it is really down to looking at the content, and figuring out what each byte or set of bytes is supposed to represent.
One of these days I'm going to think of a really clever signature.
|
|
|
|
|
What do you mean with getting the format? If it's a binary file and you don't know how to interpret its contents, I don't think you can get a format.
Regarding the reversion, thats quite easy, although I don't see the point in doing it. You could use the functions fread(), frwite() and the like to read it into a large enough char array, loop through it from back to front and write it byte by byte into a new file (assuming is is small enough to fit into memory).
|
|
|
|
|
thanks Guys For your valuable replies.
|
|
|
|
|
yogeshs wrote:
Is ther any way in MFC or Win32 to reverse it ?
Reverse engineer, or reverse the contents?
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"Show me a community that obeys the Ten Commandments and I'll show you a less crowded prison system." - Anonymous
|
|
|
|
|
There is a free game development tool called "Wolf RPG Editor". Details on the following site,
http://www.silversecond.com/WolfRPGEditor/[^]
The problem is that its been written in Japanese. Using Resource Hacker[^] I managed to translate one of the configuration tools that came with it. For reference here are screenshots of my efforts,
BEFORE,
http://img507.imageshack.us/img507/4545/configjapanese.jpg[^]
AFTER,
http://img811.imageshack.us/img811/3365/configenglish.jpg[^]
My next plan is to try and work with a few friends to translate the rest of the tool. Basically, it revolves around changing the text in the dialog boxes. The problem I'm facing is how to manage such a team effort.
Does anyone know a way (or utility) to extract the resources from a windows executable, split it into different files and then merge it all back together?
As useful as Resource Hacker is, its essentially a one-man tool. I'm looking for something that would let me work with a version control system for this.
On the legal side of things, I've been led to understand that the original developer has granted permission for translation efforts (admittedly, hearsay from others). The way I see things, since its a free tool and because I'm only translating it, there shouldn't be any trouble.
-chronodekar
|
|
|
|
|
There's a bunch of commercially availble tools for the job, you could check out Deja Vu, SDL Passolo or Idiom. If you google around for Flexytrans, you may find that one (it should be for free if you manage to find it).
The more elaborate tools have loads of functions for working in teams. For the simpler ones, use the Clipboard to export the strings to text files.
|
|
|
|
|
Compile same code twice, why the result(exe) is not same。both release mode and debug mode exist the same problem。if want to get same result, how to setting to the project, such as compile option。
|
|
|
|
|
What did you do, exactly, to get to this observation? Usually, when you build a project, you overwrite the previous build, so there's nothing to compare it to.
|
|
|
|
|
The differences are probably superficial. For example, an exe or dll contains a date-time stamp which specifies the time it was linked.
Steve
|
|
|
|
|
Can you explain little more please. What do you mean that result is not same? output?you just clear all in build option and rebuild the solution again.
|
|
|
|
|
I suppose you are compiling with VS. What differs is a timestamp added by compiler (more precisely, by linker). I don't remember where, but I think is somewhere in IAT. You can patch those bytes (I think is a __int64, most likely a FILETIME) either by patching the binary or by setting system time (not sure since you don't know when exactly the linking occurs).
Nuclear launch detected
|
|
|
|
|
Hello every body
how can we add two different or more images in a same row using CListCtrl MFC.
Best Regards
Sarfaraz
|
|
|
|
|
Please don't repost the same question. You have already asked this in the Q&A section.
|
|
|
|
|
Is it possible in C++ to declare a pointer as long?( like long int).
I'm reading some string from a XML file and assigning it to a <code>const char*</code> variable.
But the application crashes, when string is huge. Is there any maximum limit for char * variable?
How to avoid the crash,when the string is huge?
|
|
|
|
|
pix_programmer wrote: Is it possible in C++ to declare a pointer as long?( like long int).
On most platforms, both are 32-bit so there would be no difference.
pix_programmer wrote: Is there any maximum limit for char * variable?
A pointer just points to something.
pix_programmer wrote: How to avoid the crash,when the string is huge?
Showing the relevant code, for starters.
"One man's wage rise is another man's price increase." - Harold Wilson
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
"Show me a community that obeys the Ten Commandments and I'll show you a less crowded prison system." - Anonymous
|
|
|
|
|
A pointer is a pointer is a pointer; it is a fixed size and has nothing to do with the length of the item(s) that it is pointing to. You need to use your debugger to investigate why your program is crashing.
One of these days I'm going to think of a really clever signature.
|
|
|
|
|
pix_programmer wrote: I'm reading some string from a XML file and assigning it to a <code>const char*</code> variable.
That doesn't make sense. A pointer can only be sensibly initialized within the program, at runtime, because only then does the computer know where in memeory every object lies. Therefore it doesn't make sense to either store or restore a pointer to/from a file!
What you need to do instead is:
1. read that string from your file
2. Allocate a char array on the heap that is big enough to contain that string (including the terminating NULL character!)
3. Assign that array to your pointer
4. Store the string in that char array.
Of course, if you use std::string, that would save you some of that efort.
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
