Skip to content

Commit 86b71e2

Browse files
KN4CK3RKN4CK3R
committed
Sync with ReClass.NET changes.
1 parent 5dcc024 commit 86b71e2

File tree

6 files changed

+189
-46
lines changed

6 files changed

+189
-46
lines changed

‎PipeServer/MemoryHelper.cpp

+13-2
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ bool WriteMemory(LPVOID address, const std::vector<uint8_t>& buffer)
7474
return false;
7575
}
7676
//---------------------------------------------------------------------------
77-
void EnumerateRemoteSectionsAndModules(const std::function<void(RC_Pointer, RC_Pointer, std::wstring&&)>& moduleCallback, const std::function<void(RC_Pointer, RC_Pointer, SectionType, SectionProtection, std::wstring&&, std::wstring&&)>& sectionCallback)
77+
void EnumerateRemoteSectionsAndModules(const std::function<void(RC_Pointer, RC_Pointer, std::wstring&&)>& moduleCallback, const std::function<void(RC_Pointer, RC_Pointer, SectionType, SectionCategory, SectionProtection, std::wstring&&, std::wstring&&)>& sectionCallback)
7878
{
7979
std::vector<EnumerateRemoteSectionData> sections;
8080

@@ -131,6 +131,8 @@ void EnumerateRemoteSectionsAndModules(const std::function<void(RC_Pointer, RC_P
131131
break;
132132
}
133133

134+
section.Category = section.Type == SectionType::Private ? SectionCategory::HEAP : SectionCategory::Unknown;
135+
134136
sections.push_back(std::move(section));
135137
}
136138
address = (size_t)memInfo.BaseAddress + memInfo.RegionSize;
@@ -212,6 +214,15 @@ void EnumerateRemoteSectionsAndModules(const std::function<void(RC_Pointer, RC_P
212214
char buffer[IMAGE_SIZEOF_SHORT_NAME + 1] = { 0 };
213215
std::memcpy(buffer, sectionHeader->Name, IMAGE_SIZEOF_SHORT_NAME);
214216

217+
if (std::strcmp(buffer, ".text") == 0 || std::strcmp(buffer, "code") == 0)
218+
{
219+
j->Category = SectionCategory::CODE;
220+
}
221+
else if (std::strcmp(buffer, ".data") == 0 || std::strcmp(buffer, "data") == 0 || std::strcmp(buffer, ".rdata") == 0 || std::strcmp(buffer, ".idata") == 0)
222+
{
223+
j->Category = SectionCategory::DATA;
224+
}
225+
215226
size_t convertedChars = 0;
216227
mbstowcs_s(&convertedChars, j->Name, IMAGE_SIZEOF_SHORT_NAME, buffer, _TRUNCATE);
217228
std::memcpy(j->ModulePath, ldr->FullDllName.Buffer, sizeof(EnumerateRemoteSectionData::ModulePath));
@@ -225,7 +236,7 @@ void EnumerateRemoteSectionsAndModules(const std::function<void(RC_Pointer, RC_P
225236

226237
for (auto&& section : sections)
227238
{
228-
sectionCallback(section.BaseAddress, (RC_Pointer)section.Size, section.Type, section.Protection, section.Name, section.ModulePath);
239+
sectionCallback(section.BaseAddress, (RC_Pointer)section.Size, section.Type, section.Category, section.Protection, section.Name, section.ModulePath);
229240
}
230241
}
231242
//---------------------------------------------------------------------------

‎PipeServer/Messages.cpp

+2-2
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
extern bool ReadMemory(LPCVOID, std::vector<uint8_t>&);
55
extern bool WriteMemory(LPVOID, const std::vector<uint8_t>&);
6-
extern void EnumerateRemoteSectionsAndModules(const std::function<void(RC_Pointer, RC_Pointer, std::wstring&&)>&, const std::function<void(RC_Pointer, RC_Pointer, SectionType, SectionProtection, std::wstring&&, std::wstring&&)>&);
6+
extern void EnumerateRemoteSectionsAndModules(const std::function<void(RC_Pointer, RC_Pointer, std::wstring&&)>&, const std::function<void(RC_Pointer, RC_Pointer, SectionType, SectionCategory, SectionProtection, std::wstring&&, std::wstring&&)>&);
77

88
bool OpenProcessMessage::Handle(MessageClient& client)
99
{
@@ -56,7 +56,7 @@ bool EnumerateRemoteSectionsAndModulesMessage::Handle(MessageClient& client)
5656
{
5757
EnumerateRemoteSectionsAndModules(
5858
[&](auto p1, auto p2, auto p3) { client.Send(EnumerateRemoteModuleCallbackMessage(p1, p2, std::move(p3))); },
59-
[&](auto p1, auto p2, auto p3, auto p4, auto p5, auto p6) { client.Send(EnumerateRemoteSectionCallbackMessage(p1, p2, p3, p4, std::move(p5), std::move(p6))); }
59+
[&](auto p1, auto p2, auto p3, auto p4, auto p5, auto p6, auto p7) { client.Send(EnumerateRemoteSectionCallbackMessage(p1, p2, p3, p4, p5, std::move(p6), std::move(p7))); }
6060
);
6161

6262
// Report enumeration complete to client.

‎PipeServer/Messages.hpp

+7-1
Original file line numberDiff line numberDiff line change
@@ -261,6 +261,7 @@ class EnumerateRemoteSectionCallbackMessage : public IMessage
261261
RC_Pointer GetBaseAddress() const { return baseAddress; }
262262
RC_Pointer GetRegionSize() const { return size; }
263263
SectionType GetType() const { return type; }
264+
SectionCategory GetCategory() const { return category; }
264265
SectionProtection GetProtection() const { return protection; }
265266
const std::wstring& GetName() const { return name; }
266267
const std::wstring& GetModulePath() const { return modulePath; }
@@ -269,15 +270,17 @@ class EnumerateRemoteSectionCallbackMessage : public IMessage
269270
: baseAddress(0),
270271
size(0),
271272
type(SectionType::Unknown),
273+
category(SectionCategory::Unknown),
272274
protection(SectionProtection::NoAccess)
273275
{
274276

275277
}
276278

277-
EnumerateRemoteSectionCallbackMessage(RC_Pointer _baseAddress, RC_Pointer _size, SectionType _type, SectionProtection _protection, std::wstring&& _name, std::wstring&& _modulePath)
279+
EnumerateRemoteSectionCallbackMessage(RC_Pointer _baseAddress, RC_Pointer _size, SectionType _type, SectionCategory _category, SectionProtection _protection, std::wstring&& _name, std::wstring&& _modulePath)
278280
: baseAddress(_baseAddress),
279281
size(_size),
280282
type(_type),
283+
category(_category),
281284
protection(_protection),
282285
name(std::move(_name)),
283286
modulePath(std::move(_modulePath))
@@ -290,6 +293,7 @@ class EnumerateRemoteSectionCallbackMessage : public IMessage
290293
baseAddress = reader.ReadIntPtr();
291294
size = reader.ReadIntPtr();
292295
type = (SectionType)reader.ReadInt32();
296+
category = (SectionCategory)reader.ReadInt32();
293297
protection = (SectionProtection)reader.ReadInt32();
294298
name = reader.ReadString();
295299
modulePath = reader.ReadString();
@@ -300,6 +304,7 @@ class EnumerateRemoteSectionCallbackMessage : public IMessage
300304
writer.Write(baseAddress);
301305
writer.Write(size);
302306
writer.Write((int)type);
307+
writer.Write((int)category);
303308
writer.Write((int)protection);
304309
writer.Write(name);
305310
writer.Write(modulePath);
@@ -309,6 +314,7 @@ class EnumerateRemoteSectionCallbackMessage : public IMessage
309314
RC_Pointer baseAddress;
310315
RC_Pointer size;
311316
SectionType type;
317+
SectionCategory category;
312318
SectionProtection protection;
313319
std::wstring name;
314320
std::wstring modulePath;

‎PipeServer/ReClassNET_Plugin.hpp

+161-40
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
#pragma once
22

33
#include <type_traits>
4+
#include <cstdint>
45

56
// Types
67

@@ -14,35 +15,13 @@ const int PATH_MAXIMUM_LENGTH = 260;
1415

1516
// Enumerations
1617

17-
enum class RequestFunction
18-
{
19-
IsProcessValid,
20-
OpenRemoteProcess,
21-
CloseRemoteProcess,
22-
ReadRemoteMemory,
23-
WriteRemoteMemory,
24-
EnumerateProcesses,
25-
EnumerateRemoteSectionsAndModules,
26-
DisassembleCode,
27-
ControlRemoteProcess
28-
};
29-
3018
enum class ProcessAccess
3119
{
3220
Read,
3321
Write,
3422
Full
3523
};
3624

37-
enum class SectionType
38-
{
39-
Unknown,
40-
41-
Private,
42-
Mapped,
43-
Image
44-
};
45-
4625
enum class SectionProtection
4726
{
4827
NoAccess = 0,
@@ -66,19 +45,80 @@ inline SectionProtection& operator|=(SectionProtection& lhs, SectionProtection r
6645
using T = std::underlying_type_t<SectionProtection>;
6746

6847
lhs = static_cast<SectionProtection>(static_cast<T>(lhs) | static_cast<T>(rhs));
69-
48+
7049
return lhs;
7150
}
7251

52+
enum class SectionType
53+
{
54+
Unknown,
55+
56+
Private,
57+
Mapped,
58+
Image
59+
};
60+
61+
enum class SectionCategory
62+
{
63+
Unknown,
64+
CODE,
65+
DATA,
66+
HEAP
67+
};
68+
7369
enum class ControlRemoteProcessAction
7470
{
7571
Suspend,
7672
Resume,
7773
Terminate
7874
};
7975

76+
enum class DebugContinueStatus
77+
{
78+
Handled,
79+
NotHandled
80+
};
81+
82+
enum class HardwareBreakpointRegister
83+
{
84+
InvalidRegister,
85+
86+
Dr0,
87+
Dr1,
88+
Dr2,
89+
Dr3
90+
};
91+
92+
enum class HardwareBreakpointTrigger
93+
{
94+
Execute,
95+
Access,
96+
Write,
97+
};
98+
99+
enum class HardwareBreakpointSize
100+
{
101+
Size1 = 1,
102+
Size2 = 2,
103+
Size4 = 4,
104+
Size8 = 8
105+
};
106+
107+
enum class DebugEventType
108+
{
109+
CreateProcess,
110+
ExitProcess,
111+
CreateThread,
112+
ExitThread,
113+
LoadDll,
114+
UnloadDll,
115+
Exception
116+
};
117+
80118
// Structures
81119

120+
#pragma pack(push, 1)
121+
82122
struct EnumerateProcessData
83123
{
84124
RC_Size Id;
@@ -88,6 +128,7 @@ struct EnumerateProcessData
88128
struct InstructionData
89129
{
90130
int Length;
131+
uint8_t Data[15];
91132
RC_UnicodeChar Instruction[64];
92133
};
93134

@@ -96,6 +137,7 @@ struct EnumerateRemoteSectionData
96137
RC_Pointer BaseAddress;
97138
RC_Size Size;
98139
SectionType Type;
140+
SectionCategory Category;
99141
SectionProtection Protection;
100142
RC_UnicodeChar Name[16];
101143
RC_UnicodeChar ModulePath[PATH_MAXIMUM_LENGTH];
@@ -108,31 +150,110 @@ struct EnumerateRemoteModuleData
108150
RC_UnicodeChar Path[PATH_MAXIMUM_LENGTH];
109151
};
110152

111-
// Callbacks
112-
113-
typedef RC_Pointer(__stdcall *RequestFunctionPtrCallback)(RequestFunction request);
114-
115-
typedef void(__stdcall *EnumerateProcessCallback)(EnumerateProcessData* data);
153+
struct CreateProcessDebugInfo
154+
{
155+
RC_Pointer FileHandle;
156+
RC_Pointer ProcessHandle;
157+
};
116158

117-
typedef void(__stdcall EnumerateRemoteSectionsCallback)(EnumerateRemoteSectionData* data);
118-
typedef void(__stdcall EnumerateRemoteModulesCallback)(EnumerateRemoteModuleData* data);
159+
struct ExitProcessDebugInfo
160+
{
161+
RC_Size ExitCode;
162+
};
119163

120-
// Delegates
164+
struct CreateThreadDebugInfo
165+
{
166+
RC_Pointer ThreadHandle;
167+
};
121168

122-
typedef bool(__stdcall *IsProcessValid_Delegate)(RC_Pointer handle);
169+
struct ExitThreadDebugInfo
170+
{
171+
RC_Size ExitCode;
172+
};
123173

124-
typedef RC_Pointer(__stdcall *OpenRemoteProcess_Delegate)(RC_Size processId, ProcessAccess desiredAccess);
174+
struct LoadDllDebugInfo
175+
{
176+
RC_Pointer FileHandle;
177+
RC_Pointer BaseOfDll;
178+
};
125179

126-
typedef void(__stdcall *CloseRemoteProcess_Delegate)(RC_Pointer handle);
180+
struct UnloadDllDebugInfo
181+
{
182+
RC_Pointer BaseOfDll;
183+
};
127184

128-
typedef bool(__stdcall *ReadRemoteMemory_Delegate)(RC_Pointer handle, RC_Pointer address, RC_Pointer buffer, RC_Size size);
185+
struct ExceptionDebugInfo
186+
{
187+
RC_Size ExceptionCode;
188+
RC_Size ExceptionFlags;
189+
RC_Pointer ExceptionAddress;
190+
191+
HardwareBreakpointRegister CausedBy;
192+
193+
bool IsFirstChance;
194+
195+
struct RegisterInfo
196+
{
197+
#ifdef _WIN64
198+
RC_Pointer Rax;
199+
RC_Pointer Rbx;
200+
RC_Pointer Rcx;
201+
RC_Pointer Rdx;
202+
RC_Pointer Rdi;
203+
RC_Pointer Rsi;
204+
RC_Pointer Rsp;
205+
RC_Pointer Rbp;
206+
RC_Pointer Rip;
207+
208+
RC_Pointer R8;
209+
RC_Pointer R9;
210+
RC_Pointer R10;
211+
RC_Pointer R11;
212+
RC_Pointer R12;
213+
RC_Pointer R13;
214+
RC_Pointer R14;
215+
RC_Pointer R15;
216+
#else
217+
RC_Pointer Eax;
218+
RC_Pointer Ebx;
219+
RC_Pointer Ecx;
220+
RC_Pointer Edx;
221+
RC_Pointer Edi;
222+
RC_Pointer Esi;
223+
RC_Pointer Esp;
224+
RC_Pointer Ebp;
225+
RC_Pointer Eip;
226+
#endif
227+
};
228+
RegisterInfo Registers;
229+
};
129230

130-
typedef bool(__stdcall *WriteRemoteMemory_Delegate)(RC_Pointer handle, RC_Pointer address, RC_Pointer buffer, RC_Size size);
231+
struct DebugEvent
232+
{
233+
DebugContinueStatus ContinueStatus;
234+
235+
RC_Pointer ProcessId;
236+
RC_Pointer ThreadId;
237+
238+
DebugEventType Type;
239+
240+
union
241+
{
242+
CreateProcessDebugInfo CreateProcessInfo;
243+
ExitProcessDebugInfo ExitProcessInfo;
244+
CreateThreadDebugInfo CreateThreadInfo;
245+
ExitThreadDebugInfo ExitThreadInfo;
246+
LoadDllDebugInfo LoadDllInfo;
247+
UnloadDllDebugInfo UnloadDllInfo;
248+
ExceptionDebugInfo ExceptionInfo;
249+
};
250+
};
131251

132-
typedef void(__stdcall *EnumerateProcesses_Delegate)(EnumerateProcessCallback callbackProcess);
252+
#pragma pack(pop)
133253

134-
typedef void(__stdcall *EnumerateRemoteSectionsAndModules_Delegate)(RC_Pointer handle, EnumerateRemoteSectionsCallback callbackSection, EnumerateRemoteModulesCallback callbackModule);
254+
// Callbacks
135255

136-
typedef bool(__stdcall *DisassembleCode_Delegate)(RC_Pointer address, RC_Size length, RC_Pointer virtualAddress, InstructionData* instruction);
256+
typedef void(__stdcall *EnumerateProcessCallback)(EnumerateProcessData* data);
137257

138-
typedef void(__stdcall *ControlRemoteProcess_Delegate)(RC_Pointer handle, ControlRemoteProcessAction action);
258+
typedef void(__stdcall EnumerateRemoteSectionsCallback)(EnumerateRemoteSectionData* data);
259+
typedef void(__stdcall EnumerateRemoteModulesCallback)(EnumerateRemoteModuleData* data);

‎Plugin/MemoryPipePluginExt.cs

+1
Original file line numberDiff line numberDiff line change
@@ -378,6 +378,7 @@ public void EnumerateRemoteSectionsAndModules(IntPtr process, EnumerateRemoteSec
378378
BaseAddress = callbackSectionMessage.BaseAddress,
379379
Size = callbackSectionMessage.Size,
380380
Type = callbackSectionMessage.Type,
381+
Category = callbackSectionMessage.Category,
381382
Protection = callbackSectionMessage.Protection,
382383
Name = callbackSectionMessage.Name,
383384
ModulePath = callbackSectionMessage.ModulePath

0 commit comments

Comments
 (0)