Max/djhackersdev_bemanitools
1
0
Fork 0
Code Issues 72 Pull Requests 15 Actions Packages Projects Releases 20 Wiki Activity

chore: Apply code formatting

Browse Source
This commit is contained in:
icex2
2024-02-19 23:27:11 +01:00
parent 60b2c23333
commit b8439ba60b
4 changed files with 236 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/procmon-lib/procmon.c
+16 -7
View File
@@ -7,10 +7,10 @@
#include "procmon-lib/procmon.h"
#define PROCMON_LIB "procmon.dll"
#define CONCAT(x, y) x ## y
#define LOAD_FUNC(lib_func, module, path, func_name) \
lib_func = (CONCAT(func_name, _t)) GetProcAddress(module, #func_name); \
if (lib_func == NULL) { \
#define CONCAT(x, y) x##y
#define LOAD_FUNC(lib_func, module, path, func_name) \
lib_func = (CONCAT(func_name, _t)) GetProcAddress(module, #func_name); \
if (lib_func == NULL) { \
log_fatal("Failed to load function '%s' from '%s'", #func_name, path); \
}
@@ -74,9 +74,18 @@ void procmon_load(struct procmon *procmon)
LOAD_FUNC(procmon->set_loggers, module, PROCMON_LIB, procmon_set_loggers);
LOAD_FUNC(procmon->init, module, PROCMON_LIB, procmon_init);
LOAD_FUNC(procmon->file_mon_enable, module, PROCMON_LIB, procmon_file_mon_enable);
LOAD_FUNC(procmon->module_mon_enable, module, PROCMON_LIB, procmon_module_mon_enable);
LOAD_FUNC(procmon->thread_mon_enable, module, PROCMON_LIB, procmon_thread_mon_enable);
LOAD_FUNC(
procmon->file_mon_enable, module, PROCMON_LIB, procmon_file_mon_enable);
LOAD_FUNC(
procmon->module_mon_enable,
module,
PROCMON_LIB,
procmon_module_mon_enable);
LOAD_FUNC(
procmon->thread_mon_enable,
module,
PROCMON_LIB,
procmon_thread_mon_enable);
}
void procmon_free(struct procmon *procmon)
src/main/procmon/file.c
+69 -14
View File
@@ -8,7 +8,7 @@
#include "util/str.h"
static HANDLE (STDCALL *real_CreateFileW)(
static HANDLE(STDCALL *real_CreateFileW)(
const wchar_t *lpFileName,
uint32_t dwDesiredAccess,
uint32_t dwShareMode,
@@ -16,7 +16,7 @@ static HANDLE (STDCALL *real_CreateFileW)(
uint32_t dwCreationDisposition,
uint32_t dwFlagsAndAttributes,
HANDLE hTemplateFile);
static HANDLE (STDCALL *real_CreateFileA)(
static HANDLE(STDCALL *real_CreateFileA)(
const char *lpFileName,
uint32_t dwDesiredAccess,
uint32_t dwShareMode,
@@ -70,13 +70,37 @@ static HANDLE STDCALL my_CreateFileW(
wstr_narrow(lpFileName, &tmp);
log_misc("CreateFileW(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile %p)",
tmp, dwDesiredAccess, dwShareMode, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
log_misc(
"CreateFileW(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, "
"dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile "
"%p)",
tmp,
dwDesiredAccess,
dwShareMode,
dwCreationDisposition,
dwFlagsAndAttributes,
hTemplateFile);
result = real_CreateFileW(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
result = real_CreateFileW(
lpFileName,
dwDesiredAccess,
dwShareMode,
lpSecurityAttributes,
dwCreationDisposition,
dwFlagsAndAttributes,
hTemplateFile);
log_misc("CreateFileW(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile %p) = %p",
tmp, dwDesiredAccess, dwShareMode, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, result);
log_misc(
"CreateFileW(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, "
"dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile "
"%p) = %p",
tmp,
dwDesiredAccess,
dwShareMode,
dwCreationDisposition,
dwFlagsAndAttributes,
hTemplateFile,
result);
free(tmp);
@@ -94,13 +118,37 @@ static HANDLE STDCALL my_CreateFileA(
{
HANDLE result;
log_misc("CreateFileA(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile %p)",
lpFileName, dwDesiredAccess, dwShareMode, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
log_misc(
"CreateFileA(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, "
"dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile "
"%p)",
lpFileName,
dwDesiredAccess,
dwShareMode,
dwCreationDisposition,
dwFlagsAndAttributes,
hTemplateFile);
result = real_CreateFileA(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
result = real_CreateFileA(
lpFileName,
dwDesiredAccess,
dwShareMode,
lpSecurityAttributes,
dwCreationDisposition,
dwFlagsAndAttributes,
hTemplateFile);
log_misc("CreateFileA(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile %p) = %p",
lpFileName, dwDesiredAccess, dwShareMode, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, result);
log_misc(
"CreateFileA(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, "
"dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile "
"%p) = %p",
lpFileName,
dwDesiredAccess,
dwShareMode,
dwCreationDisposition,
dwFlagsAndAttributes,
hTemplateFile,
result);
return result;
}
@@ -108,14 +156,21 @@ static HANDLE STDCALL my_CreateFileA(
void procmon_file_init()
{
hook_table_apply(
NULL, "kernel32.dll", _procmon_file_hook_syms, lengthof(_procmon_file_hook_syms));
NULL,
"kernel32.dll",
_procmon_file_hook_syms,
lengthof(_procmon_file_hook_syms));
log_misc("init");
}
void procmon_file_fini()
{
hook_table_revert(NULL, "kernel32.dll", _procmon_file_hook_syms, lengthof(_procmon_file_hook_syms));
hook_table_revert(
NULL,
"kernel32.dll",
_procmon_file_hook_syms,
lengthof(_procmon_file_hook_syms));
log_misc("fini");
}
src/main/procmon/module.c
+89 -30
View File
@@ -8,25 +8,34 @@
#include "util/str.h"
static HMODULE (STDCALL *real_GetModuleHandleA)(LPCSTR lpModuleName);
static BOOL (STDCALL *real_GetModuleHandleExA)(DWORD dwFlags, LPCSTR lpModuleName, HMODULE *phModule);
static BOOL (STDCALL *real_GetModuleHandleExW)(DWORD dwFlags, LPCWSTR lpModuleName, HMODULE *phModule);
static HMODULE (STDCALL *real_GetModuleHandleW)(LPCWSTR lpModuleName);
static HMODULE (STDCALL *real_LoadLibraryA)(LPCSTR lpLibFileName);
static HMODULE (STDCALL *real_LoadLibraryW)(LPCWSTR lpLibFileName);
static HMODULE (STDCALL *real_LoadLibraryExA)(LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags);
static HMODULE (STDCALL *real_LoadLibraryExW)(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags);
static FARPROC (STDCALL *real_GetProcAddress)(HMODULE hModule, LPCSTR lpProcName);
static HMODULE(STDCALL *real_GetModuleHandleA)(LPCSTR lpModuleName);
static BOOL(STDCALL *real_GetModuleHandleExA)(
DWORD dwFlags, LPCSTR lpModuleName, HMODULE *phModule);
static BOOL(STDCALL *real_GetModuleHandleExW)(
DWORD dwFlags, LPCWSTR lpModuleName, HMODULE *phModule);
static HMODULE(STDCALL *real_GetModuleHandleW)(LPCWSTR lpModuleName);
static HMODULE(STDCALL *real_LoadLibraryA)(LPCSTR lpLibFileName);
static HMODULE(STDCALL *real_LoadLibraryW)(LPCWSTR lpLibFileName);
static HMODULE(STDCALL *real_LoadLibraryExA)(
LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags);
static HMODULE(STDCALL *real_LoadLibraryExW)(
LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags);
static FARPROC(STDCALL *real_GetProcAddress)(
HMODULE hModule, LPCSTR lpProcName);
static HMODULE STDCALL my_GetModuleHandleA(LPCSTR lpModuleName);
static BOOL STDCALL my_GetModuleHandleExA(DWORD dwFlags, LPCSTR lpModuleName, HMODULE *phModule);
static BOOL STDCALL my_GetModuleHandleExW(DWORD dwFlags, LPCWSTR lpModuleName, HMODULE *phModule);
static BOOL STDCALL
my_GetModuleHandleExA(DWORD dwFlags, LPCSTR lpModuleName, HMODULE *phModule);
static BOOL STDCALL
my_GetModuleHandleExW(DWORD dwFlags, LPCWSTR lpModuleName, HMODULE *phModule);
static HMODULE STDCALL my_GetModuleHandleW(LPCWSTR lpModuleName);
static HMODULE STDCALL my_LoadLibraryA(LPCSTR lpLibFileName);
static HMODULE STDCALL my_LoadLibraryW(LPCWSTR lpLibFileName);
static HMODULE STDCALL my_LoadLibraryExA(LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags);
static HMODULE STDCALL my_LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags);
static FARPROC STDCALL my_GetProcAddress(HMODULE hModule, LPCSTR lpProcName);
static HMODULE STDCALL
my_LoadLibraryExA(LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags);
static HMODULE STDCALL
my_LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags);
static FARPROC STDCALL my_GetProcAddress(HMODULE hModule, LPCSTR lpProcName);
static const struct hook_symbol _procmon_module_hook_syms[] = {
{
@@ -89,31 +98,51 @@ static HMODULE STDCALL my_GetModuleHandleA(LPCSTR lpModuleName)
return result;
}
static BOOL STDCALL my_GetModuleHandleExA(DWORD dwFlags, LPCSTR lpModuleName, HMODULE *phModule)
static BOOL STDCALL
my_GetModuleHandleExA(DWORD dwFlags, LPCSTR lpModuleName, HMODULE *phModule)
{
BOOL result;
log_misc("GetModuleHandleExA(dwFlags %lu, lpModuleName %s, phModule %p)", dwFlags, lpModuleName, phModule);
log_misc(
"GetModuleHandleExA(dwFlags %lu, lpModuleName %s, phModule %p)",
dwFlags,
lpModuleName,
phModule);
result = real_GetModuleHandleExA(dwFlags, lpModuleName, phModule);
log_misc("GetModuleHandleExA(dwFlags %lu, lpModuleName %s, phModule %p) = %d", dwFlags, lpModuleName, phModule, result);
log_misc(
"GetModuleHandleExA(dwFlags %lu, lpModuleName %s, phModule %p) = %d",
dwFlags,
lpModuleName,
phModule,
result);
return result;
}
static BOOL STDCALL my_GetModuleHandleExW(DWORD dwFlags, LPCWSTR lpModuleName, HMODULE *phModule)
static BOOL STDCALL
my_GetModuleHandleExW(DWORD dwFlags, LPCWSTR lpModuleName, HMODULE *phModule)
{
BOOL result;
char *tmp;
wstr_narrow(lpModuleName, &tmp);
log_misc("GetModuleHandleExW(dwFlags %lu, lpModuleName %s, phModule %p)", dwFlags, tmp, phModule);
log_misc(
"GetModuleHandleExW(dwFlags %lu, lpModuleName %s, phModule %p)",
dwFlags,
tmp,
phModule);
result = real_GetModuleHandleExW(dwFlags, lpModuleName, phModule);
log_misc("GetModuleHandleExW(dwFlags %lu, lpModuleName %s, phModule %p) = %d", dwFlags, tmp, phModule, result);
log_misc(
"GetModuleHandleExW(dwFlags %lu, lpModuleName %s, phModule %p) = %d",
dwFlags,
tmp,
phModule,
result);
free(tmp);
@@ -169,31 +198,51 @@ static HMODULE STDCALL my_LoadLibraryW(LPCWSTR lpLibFileName)
return result;
}
static HMODULE STDCALL my_LoadLibraryExA(LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
static HMODULE STDCALL
my_LoadLibraryExA(LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
{
HMODULE result;
log_misc("LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu)", lpLibFileName, hFile, dwFlags);
log_misc(
"LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu)",
lpLibFileName,
hFile,
dwFlags);
result = real_LoadLibraryExA(lpLibFileName, hFile, dwFlags);
log_misc("LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu) = %p", lpLibFileName, hFile, dwFlags, result);
log_misc(
"LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu) = %p",
lpLibFileName,
hFile,
dwFlags,
result);
return result;
}
static HMODULE STDCALL my_LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
static HMODULE STDCALL
my_LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
{
HMODULE result;
char *tmp;
wstr_narrow(lpLibFileName, &tmp);
log_misc("LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu)", tmp, hFile, dwFlags);
log_misc(
"LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu)",
tmp,
hFile,
dwFlags);
result = real_LoadLibraryExW(lpLibFileName, hFile, dwFlags);
log_misc("LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu) = %p", tmp, hFile, dwFlags, result);
log_misc(
"LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu) = %p",
tmp,
hFile,
dwFlags,
result);
free(tmp);
@@ -208,7 +257,11 @@ static FARPROC STDCALL my_GetProcAddress(HMODULE hModule, LPCSTR lpProcName)
result = real_GetProcAddress(hModule, lpProcName);
log_misc("GetProcAddress(hModule %p, lpProcName %s = %p", hModule, lpProcName, result);
log_misc(
"GetProcAddress(hModule %p, lpProcName %s = %p",
hModule,
lpProcName,
result);
return result;
}
@@ -216,7 +269,10 @@ static FARPROC STDCALL my_GetProcAddress(HMODULE hModule, LPCSTR lpProcName)
void procmon_module_init()
{
hook_table_apply(
NULL, "kernel32.dll", _procmon_module_hook_syms, lengthof(_procmon_module_hook_syms));
NULL,
"kernel32.dll",
_procmon_module_hook_syms,
lengthof(_procmon_module_hook_syms));
log_misc("init");
}
@@ -224,7 +280,10 @@ void procmon_module_init()
void procmon_module_fini()
{
hook_table_revert(
NULL, "kernel32.dll", _procmon_module_hook_syms, lengthof(_procmon_module_hook_syms));
NULL,
"kernel32.dll",
_procmon_module_hook_syms,
lengthof(_procmon_module_hook_syms));
log_misc("fini");
}
src/main/procmon/thread.c
+62 -15
View File
@@ -7,16 +7,26 @@
#include "hook/table.h"
#ifdef _WIN64
#define SIZE_T_FORMAT_SPECIFIER "llu"
#define SIZE_T_FORMAT_SPECIFIER "llu"
#else
#define SIZE_T_FORMAT_SPECIFIER "lu"
#define SIZE_T_FORMAT_SPECIFIER "lu"
#endif
static HANDLE (STDCALL *real_CreateThread)(LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize,
LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId);
static HANDLE(STDCALL *real_CreateThread)(
LPSECURITY_ATTRIBUTES lpThreadAttributes,
SIZE_T dwStackSize,
LPTHREAD_START_ROUTINE lpStartAddress,
LPVOID lpParameter,
DWORD dwCreationFlags,
LPDWORD lpThreadId);
static HANDLE STDCALL my_CreateThread(LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize,
LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId);
static HANDLE STDCALL my_CreateThread(
LPSECURITY_ATTRIBUTES lpThreadAttributes,
SIZE_T dwStackSize,
LPTHREAD_START_ROUTINE lpStartAddress,
LPVOID lpParameter,
DWORD dwCreationFlags,
LPDWORD lpThreadId);
static const struct hook_symbol _procmon_thread_hook_syms[] = {
{
@@ -26,18 +36,49 @@ static const struct hook_symbol _procmon_thread_hook_syms[] = {
},
};
static HANDLE STDCALL my_CreateThread(LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize,
LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId)
static HANDLE STDCALL my_CreateThread(
LPSECURITY_ATTRIBUTES lpThreadAttributes,
SIZE_T dwStackSize,
LPTHREAD_START_ROUTINE lpStartAddress,
LPVOID lpParameter,
DWORD dwCreationFlags,
LPDWORD lpThreadId)
{
HANDLE result;
log_misc("CreateThread(lpThreadAttributes %p, dwStackSize %" SIZE_T_FORMAT_SPECIFIER ", lpStartAddress %p, lpParameter %p, dwCreationFlags %lu, lpThreadId %p)",
lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId);
log_misc(
"CreateThread(lpThreadAttributes %p, dwStackSize "
"%" SIZE_T_FORMAT_SPECIFIER
", lpStartAddress %p, lpParameter %p, dwCreationFlags %lu, lpThreadId "
"%p)",
lpThreadAttributes,
dwStackSize,
lpStartAddress,
lpParameter,
dwCreationFlags,
lpThreadId);
result = real_CreateThread(lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId);
result = real_CreateThread(
lpThreadAttributes,
dwStackSize,
lpStartAddress,
lpParameter,
dwCreationFlags,
lpThreadId);
log_misc("CreateThread(lpThreadAttributes %p, dwStackSize %" SIZE_T_FORMAT_SPECIFIER ", lpStartAddress %p, lpParameter %p, dwCreationFlags %lu, lpThreadId %p) = %p, tid %lu",
lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId, result, lpThreadId ? *lpThreadId : -1);
log_misc(
"CreateThread(lpThreadAttributes %p, dwStackSize "
"%" SIZE_T_FORMAT_SPECIFIER
", lpStartAddress %p, lpParameter %p, dwCreationFlags %lu, lpThreadId "
"%p) = %p, tid %lu",
lpThreadAttributes,
dwStackSize,
lpStartAddress,
lpParameter,
dwCreationFlags,
lpThreadId,
result,
lpThreadId ? *lpThreadId : -1);
return result;
}
@@ -45,7 +86,10 @@ static HANDLE STDCALL my_CreateThread(LPSECURITY_ATTRIBUTES lpThreadAttributes,
void procmon_thread_init()
{
hook_table_apply(
NULL, "kernel32.dll", _procmon_thread_hook_syms, lengthof(_procmon_thread_hook_syms));
NULL,
"kernel32.dll",
_procmon_thread_hook_syms,
lengthof(_procmon_thread_hook_syms));
log_misc("init");
}
@@ -53,7 +97,10 @@ void procmon_thread_init()
void procmon_thread_fini()
{
hook_table_revert(
NULL, "kernel32.dll", _procmon_thread_hook_syms, lengthof(_procmon_thread_hook_syms));
NULL,
"kernel32.dll",
_procmon_thread_hook_syms,
lengthof(_procmon_thread_hook_syms));
log_misc("fini");
}