diff --git a/src/main/procmon-lib/procmon.c b/src/main/procmon-lib/procmon.c index 5048ea6..787aa2e 100644 --- a/src/main/procmon-lib/procmon.c +++ b/src/main/procmon-lib/procmon.c @@ -7,10 +7,10 @@ #include "procmon-lib/procmon.h" #define PROCMON_LIB "procmon.dll" -#define CONCAT(x, y) x ## y -#define LOAD_FUNC(lib_func, module, path, func_name) \ - lib_func = (CONCAT(func_name, _t)) GetProcAddress(module, #func_name); \ - if (lib_func == NULL) { \ +#define CONCAT(x, y) x##y +#define LOAD_FUNC(lib_func, module, path, func_name) \ + lib_func = (CONCAT(func_name, _t)) GetProcAddress(module, #func_name); \ + if (lib_func == NULL) { \ log_fatal("Failed to load function '%s' from '%s'", #func_name, path); \ } @@ -74,9 +74,18 @@ void procmon_load(struct procmon *procmon) LOAD_FUNC(procmon->set_loggers, module, PROCMON_LIB, procmon_set_loggers); LOAD_FUNC(procmon->init, module, PROCMON_LIB, procmon_init); - LOAD_FUNC(procmon->file_mon_enable, module, PROCMON_LIB, procmon_file_mon_enable); - LOAD_FUNC(procmon->module_mon_enable, module, PROCMON_LIB, procmon_module_mon_enable); - LOAD_FUNC(procmon->thread_mon_enable, module, PROCMON_LIB, procmon_thread_mon_enable); + LOAD_FUNC( + procmon->file_mon_enable, module, PROCMON_LIB, procmon_file_mon_enable); + LOAD_FUNC( + procmon->module_mon_enable, + module, + PROCMON_LIB, + procmon_module_mon_enable); + LOAD_FUNC( + procmon->thread_mon_enable, + module, + PROCMON_LIB, + procmon_thread_mon_enable); } void procmon_free(struct procmon *procmon) diff --git a/src/main/procmon/file.c b/src/main/procmon/file.c index 10aa82f..229455d 100644 --- a/src/main/procmon/file.c +++ b/src/main/procmon/file.c @@ -8,7 +8,7 @@ #include "util/str.h" -static HANDLE (STDCALL *real_CreateFileW)( +static HANDLE(STDCALL *real_CreateFileW)( const wchar_t *lpFileName, uint32_t dwDesiredAccess, uint32_t dwShareMode, @@ -16,7 +16,7 @@ static HANDLE (STDCALL *real_CreateFileW)( uint32_t dwCreationDisposition, uint32_t dwFlagsAndAttributes, HANDLE hTemplateFile); -static HANDLE (STDCALL *real_CreateFileA)( +static HANDLE(STDCALL *real_CreateFileA)( const char *lpFileName, uint32_t dwDesiredAccess, uint32_t dwShareMode, @@ -70,13 +70,37 @@ static HANDLE STDCALL my_CreateFileW( wstr_narrow(lpFileName, &tmp); - log_misc("CreateFileW(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile %p)", - tmp, dwDesiredAccess, dwShareMode, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile); + log_misc( + "CreateFileW(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, " + "dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile " + "%p)", + tmp, + dwDesiredAccess, + dwShareMode, + dwCreationDisposition, + dwFlagsAndAttributes, + hTemplateFile); - result = real_CreateFileW(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile); + result = real_CreateFileW( + lpFileName, + dwDesiredAccess, + dwShareMode, + lpSecurityAttributes, + dwCreationDisposition, + dwFlagsAndAttributes, + hTemplateFile); - log_misc("CreateFileW(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile %p) = %p", - tmp, dwDesiredAccess, dwShareMode, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, result); + log_misc( + "CreateFileW(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, " + "dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile " + "%p) = %p", + tmp, + dwDesiredAccess, + dwShareMode, + dwCreationDisposition, + dwFlagsAndAttributes, + hTemplateFile, + result); free(tmp); @@ -94,13 +118,37 @@ static HANDLE STDCALL my_CreateFileA( { HANDLE result; - log_misc("CreateFileA(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile %p)", - lpFileName, dwDesiredAccess, dwShareMode, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile); + log_misc( + "CreateFileA(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, " + "dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile " + "%p)", + lpFileName, + dwDesiredAccess, + dwShareMode, + dwCreationDisposition, + dwFlagsAndAttributes, + hTemplateFile); - result = real_CreateFileA(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile); + result = real_CreateFileA( + lpFileName, + dwDesiredAccess, + dwShareMode, + lpSecurityAttributes, + dwCreationDisposition, + dwFlagsAndAttributes, + hTemplateFile); - log_misc("CreateFileA(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile %p) = %p", - lpFileName, dwDesiredAccess, dwShareMode, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile, result); + log_misc( + "CreateFileA(lpFileName %s, dwDesiredAccess 0x%X, dwShareMode 0x%X, " + "dwCreationDisposition 0x%X, dwFlagsAndAttributes 0x%X, hTemplateFile " + "%p) = %p", + lpFileName, + dwDesiredAccess, + dwShareMode, + dwCreationDisposition, + dwFlagsAndAttributes, + hTemplateFile, + result); return result; } @@ -108,14 +156,21 @@ static HANDLE STDCALL my_CreateFileA( void procmon_file_init() { hook_table_apply( - NULL, "kernel32.dll", _procmon_file_hook_syms, lengthof(_procmon_file_hook_syms)); + NULL, + "kernel32.dll", + _procmon_file_hook_syms, + lengthof(_procmon_file_hook_syms)); log_misc("init"); } void procmon_file_fini() { - hook_table_revert(NULL, "kernel32.dll", _procmon_file_hook_syms, lengthof(_procmon_file_hook_syms)); + hook_table_revert( + NULL, + "kernel32.dll", + _procmon_file_hook_syms, + lengthof(_procmon_file_hook_syms)); log_misc("fini"); } \ No newline at end of file diff --git a/src/main/procmon/module.c b/src/main/procmon/module.c index 768629c..3a130ac 100644 --- a/src/main/procmon/module.c +++ b/src/main/procmon/module.c @@ -8,25 +8,34 @@ #include "util/str.h" -static HMODULE (STDCALL *real_GetModuleHandleA)(LPCSTR lpModuleName); -static BOOL (STDCALL *real_GetModuleHandleExA)(DWORD dwFlags, LPCSTR lpModuleName, HMODULE *phModule); -static BOOL (STDCALL *real_GetModuleHandleExW)(DWORD dwFlags, LPCWSTR lpModuleName, HMODULE *phModule); -static HMODULE (STDCALL *real_GetModuleHandleW)(LPCWSTR lpModuleName); -static HMODULE (STDCALL *real_LoadLibraryA)(LPCSTR lpLibFileName); -static HMODULE (STDCALL *real_LoadLibraryW)(LPCWSTR lpLibFileName); -static HMODULE (STDCALL *real_LoadLibraryExA)(LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags); -static HMODULE (STDCALL *real_LoadLibraryExW)(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags); -static FARPROC (STDCALL *real_GetProcAddress)(HMODULE hModule, LPCSTR lpProcName); +static HMODULE(STDCALL *real_GetModuleHandleA)(LPCSTR lpModuleName); +static BOOL(STDCALL *real_GetModuleHandleExA)( + DWORD dwFlags, LPCSTR lpModuleName, HMODULE *phModule); +static BOOL(STDCALL *real_GetModuleHandleExW)( + DWORD dwFlags, LPCWSTR lpModuleName, HMODULE *phModule); +static HMODULE(STDCALL *real_GetModuleHandleW)(LPCWSTR lpModuleName); +static HMODULE(STDCALL *real_LoadLibraryA)(LPCSTR lpLibFileName); +static HMODULE(STDCALL *real_LoadLibraryW)(LPCWSTR lpLibFileName); +static HMODULE(STDCALL *real_LoadLibraryExA)( + LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags); +static HMODULE(STDCALL *real_LoadLibraryExW)( + LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags); +static FARPROC(STDCALL *real_GetProcAddress)( + HMODULE hModule, LPCSTR lpProcName); static HMODULE STDCALL my_GetModuleHandleA(LPCSTR lpModuleName); -static BOOL STDCALL my_GetModuleHandleExA(DWORD dwFlags, LPCSTR lpModuleName, HMODULE *phModule); -static BOOL STDCALL my_GetModuleHandleExW(DWORD dwFlags, LPCWSTR lpModuleName, HMODULE *phModule); +static BOOL STDCALL +my_GetModuleHandleExA(DWORD dwFlags, LPCSTR lpModuleName, HMODULE *phModule); +static BOOL STDCALL +my_GetModuleHandleExW(DWORD dwFlags, LPCWSTR lpModuleName, HMODULE *phModule); static HMODULE STDCALL my_GetModuleHandleW(LPCWSTR lpModuleName); static HMODULE STDCALL my_LoadLibraryA(LPCSTR lpLibFileName); static HMODULE STDCALL my_LoadLibraryW(LPCWSTR lpLibFileName); -static HMODULE STDCALL my_LoadLibraryExA(LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags); -static HMODULE STDCALL my_LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags); -static FARPROC STDCALL my_GetProcAddress(HMODULE hModule, LPCSTR lpProcName); +static HMODULE STDCALL +my_LoadLibraryExA(LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags); +static HMODULE STDCALL +my_LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags); +static FARPROC STDCALL my_GetProcAddress(HMODULE hModule, LPCSTR lpProcName); static const struct hook_symbol _procmon_module_hook_syms[] = { { @@ -89,31 +98,51 @@ static HMODULE STDCALL my_GetModuleHandleA(LPCSTR lpModuleName) return result; } -static BOOL STDCALL my_GetModuleHandleExA(DWORD dwFlags, LPCSTR lpModuleName, HMODULE *phModule) +static BOOL STDCALL +my_GetModuleHandleExA(DWORD dwFlags, LPCSTR lpModuleName, HMODULE *phModule) { BOOL result; - log_misc("GetModuleHandleExA(dwFlags %lu, lpModuleName %s, phModule %p)", dwFlags, lpModuleName, phModule); + log_misc( + "GetModuleHandleExA(dwFlags %lu, lpModuleName %s, phModule %p)", + dwFlags, + lpModuleName, + phModule); result = real_GetModuleHandleExA(dwFlags, lpModuleName, phModule); - log_misc("GetModuleHandleExA(dwFlags %lu, lpModuleName %s, phModule %p) = %d", dwFlags, lpModuleName, phModule, result); + log_misc( + "GetModuleHandleExA(dwFlags %lu, lpModuleName %s, phModule %p) = %d", + dwFlags, + lpModuleName, + phModule, + result); return result; } -static BOOL STDCALL my_GetModuleHandleExW(DWORD dwFlags, LPCWSTR lpModuleName, HMODULE *phModule) +static BOOL STDCALL +my_GetModuleHandleExW(DWORD dwFlags, LPCWSTR lpModuleName, HMODULE *phModule) { BOOL result; char *tmp; wstr_narrow(lpModuleName, &tmp); - log_misc("GetModuleHandleExW(dwFlags %lu, lpModuleName %s, phModule %p)", dwFlags, tmp, phModule); + log_misc( + "GetModuleHandleExW(dwFlags %lu, lpModuleName %s, phModule %p)", + dwFlags, + tmp, + phModule); result = real_GetModuleHandleExW(dwFlags, lpModuleName, phModule); - log_misc("GetModuleHandleExW(dwFlags %lu, lpModuleName %s, phModule %p) = %d", dwFlags, tmp, phModule, result); + log_misc( + "GetModuleHandleExW(dwFlags %lu, lpModuleName %s, phModule %p) = %d", + dwFlags, + tmp, + phModule, + result); free(tmp); @@ -169,31 +198,51 @@ static HMODULE STDCALL my_LoadLibraryW(LPCWSTR lpLibFileName) return result; } -static HMODULE STDCALL my_LoadLibraryExA(LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags) +static HMODULE STDCALL +my_LoadLibraryExA(LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags) { HMODULE result; - log_misc("LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu)", lpLibFileName, hFile, dwFlags); + log_misc( + "LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu)", + lpLibFileName, + hFile, + dwFlags); result = real_LoadLibraryExA(lpLibFileName, hFile, dwFlags); - log_misc("LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu) = %p", lpLibFileName, hFile, dwFlags, result); + log_misc( + "LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu) = %p", + lpLibFileName, + hFile, + dwFlags, + result); return result; } -static HMODULE STDCALL my_LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags) +static HMODULE STDCALL +my_LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags) { HMODULE result; char *tmp; wstr_narrow(lpLibFileName, &tmp); - log_misc("LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu)", tmp, hFile, dwFlags); + log_misc( + "LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu)", + tmp, + hFile, + dwFlags); result = real_LoadLibraryExW(lpLibFileName, hFile, dwFlags); - log_misc("LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu) = %p", tmp, hFile, dwFlags, result); + log_misc( + "LoadLibraryExA(lpLibFileName %s, hFile %p, dwFlags %lu) = %p", + tmp, + hFile, + dwFlags, + result); free(tmp); @@ -208,7 +257,11 @@ static FARPROC STDCALL my_GetProcAddress(HMODULE hModule, LPCSTR lpProcName) result = real_GetProcAddress(hModule, lpProcName); - log_misc("GetProcAddress(hModule %p, lpProcName %s = %p", hModule, lpProcName, result); + log_misc( + "GetProcAddress(hModule %p, lpProcName %s = %p", + hModule, + lpProcName, + result); return result; } @@ -216,7 +269,10 @@ static FARPROC STDCALL my_GetProcAddress(HMODULE hModule, LPCSTR lpProcName) void procmon_module_init() { hook_table_apply( - NULL, "kernel32.dll", _procmon_module_hook_syms, lengthof(_procmon_module_hook_syms)); + NULL, + "kernel32.dll", + _procmon_module_hook_syms, + lengthof(_procmon_module_hook_syms)); log_misc("init"); } @@ -224,7 +280,10 @@ void procmon_module_init() void procmon_module_fini() { hook_table_revert( - NULL, "kernel32.dll", _procmon_module_hook_syms, lengthof(_procmon_module_hook_syms)); - + NULL, + "kernel32.dll", + _procmon_module_hook_syms, + lengthof(_procmon_module_hook_syms)); + log_misc("fini"); } \ No newline at end of file diff --git a/src/main/procmon/thread.c b/src/main/procmon/thread.c index 06093df..790925f 100644 --- a/src/main/procmon/thread.c +++ b/src/main/procmon/thread.c @@ -7,16 +7,26 @@ #include "hook/table.h" #ifdef _WIN64 - #define SIZE_T_FORMAT_SPECIFIER "llu" +#define SIZE_T_FORMAT_SPECIFIER "llu" #else - #define SIZE_T_FORMAT_SPECIFIER "lu" +#define SIZE_T_FORMAT_SPECIFIER "lu" #endif -static HANDLE (STDCALL *real_CreateThread)(LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, -LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId); +static HANDLE(STDCALL *real_CreateThread)( + LPSECURITY_ATTRIBUTES lpThreadAttributes, + SIZE_T dwStackSize, + LPTHREAD_START_ROUTINE lpStartAddress, + LPVOID lpParameter, + DWORD dwCreationFlags, + LPDWORD lpThreadId); -static HANDLE STDCALL my_CreateThread(LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, -LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId); +static HANDLE STDCALL my_CreateThread( + LPSECURITY_ATTRIBUTES lpThreadAttributes, + SIZE_T dwStackSize, + LPTHREAD_START_ROUTINE lpStartAddress, + LPVOID lpParameter, + DWORD dwCreationFlags, + LPDWORD lpThreadId); static const struct hook_symbol _procmon_thread_hook_syms[] = { { @@ -26,18 +36,49 @@ static const struct hook_symbol _procmon_thread_hook_syms[] = { }, }; -static HANDLE STDCALL my_CreateThread(LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, - LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId) +static HANDLE STDCALL my_CreateThread( + LPSECURITY_ATTRIBUTES lpThreadAttributes, + SIZE_T dwStackSize, + LPTHREAD_START_ROUTINE lpStartAddress, + LPVOID lpParameter, + DWORD dwCreationFlags, + LPDWORD lpThreadId) { HANDLE result; - log_misc("CreateThread(lpThreadAttributes %p, dwStackSize %" SIZE_T_FORMAT_SPECIFIER ", lpStartAddress %p, lpParameter %p, dwCreationFlags %lu, lpThreadId %p)", - lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId); + log_misc( + "CreateThread(lpThreadAttributes %p, dwStackSize " + "%" SIZE_T_FORMAT_SPECIFIER + ", lpStartAddress %p, lpParameter %p, dwCreationFlags %lu, lpThreadId " + "%p)", + lpThreadAttributes, + dwStackSize, + lpStartAddress, + lpParameter, + dwCreationFlags, + lpThreadId); - result = real_CreateThread(lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId); + result = real_CreateThread( + lpThreadAttributes, + dwStackSize, + lpStartAddress, + lpParameter, + dwCreationFlags, + lpThreadId); - log_misc("CreateThread(lpThreadAttributes %p, dwStackSize %" SIZE_T_FORMAT_SPECIFIER ", lpStartAddress %p, lpParameter %p, dwCreationFlags %lu, lpThreadId %p) = %p, tid %lu", - lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId, result, lpThreadId ? *lpThreadId : -1); + log_misc( + "CreateThread(lpThreadAttributes %p, dwStackSize " + "%" SIZE_T_FORMAT_SPECIFIER + ", lpStartAddress %p, lpParameter %p, dwCreationFlags %lu, lpThreadId " + "%p) = %p, tid %lu", + lpThreadAttributes, + dwStackSize, + lpStartAddress, + lpParameter, + dwCreationFlags, + lpThreadId, + result, + lpThreadId ? *lpThreadId : -1); return result; } @@ -45,7 +86,10 @@ static HANDLE STDCALL my_CreateThread(LPSECURITY_ATTRIBUTES lpThreadAttributes, void procmon_thread_init() { hook_table_apply( - NULL, "kernel32.dll", _procmon_thread_hook_syms, lengthof(_procmon_thread_hook_syms)); + NULL, + "kernel32.dll", + _procmon_thread_hook_syms, + lengthof(_procmon_thread_hook_syms)); log_misc("init"); } @@ -53,7 +97,10 @@ void procmon_thread_init() void procmon_thread_fini() { hook_table_revert( - NULL, "kernel32.dll", _procmon_thread_hook_syms, lengthof(_procmon_thread_hook_syms)); + NULL, + "kernel32.dll", + _procmon_thread_hook_syms, + lengthof(_procmon_thread_hook_syms)); log_misc("fini"); } \ No newline at end of file