Skip to content

Commit cee0615

Browse files
redcodesredcodes
committed
Modify
1 parent 79bfaf6 commit cee0615

File tree

8 files changed

+194
-123
lines changed

8 files changed

+194
-123
lines changed

‎Test.cpp

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -411,7 +411,7 @@ void TestService()
411411
UninstallService(SERVICE_NAME);
412412
}
413413

414-
class CCallback : public ICallBack
414+
class CCallback : public IRequestHandler
415415
{
416416
public:
417417
CCallback()
@@ -446,12 +446,13 @@ class CCallback : public ICallBack
446446
}
447447
};
448448

449-
static ICallBack* g_Callback = NULL;
449+
static IRequestHandler* g_Callback = NULL;
450450

451451
DWORD TestKeyboardHook(LPVOID lpParam)
452452
{
453453
CKeyboardHook keyboardHook(g_Callback);
454454
keyboardHook.Install(GetCurrentProcessId());
455+
455456
keyboardHook.UnInstall();
456457
return TRUE;
457458
}

‎include/IProcess.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ namespace CODELIB
1515
{
1616
public:
1717
virtual ~IProcess() = 0 {};
18+
virtual BOOL IsOpened()=0;
1819
virtual BOOL Open(DWORD dwPID) = 0;
1920
virtual void Close() = 0;
2021
virtual BOOL Terminate() = 0;
@@ -24,5 +25,6 @@ namespace CODELIB
2425
virtual LPCTSTR GetFullPathName() = 0;
2526
virtual BOOL GetIntegrityLevel(INTEGRITYLEVEL* pLevel) = 0;
2627
virtual HANDLE GetHandle() = 0;
28+
virtual SIZE_T VirtualQueryEx(LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength) = 0;
2729
};
2830
}

‎src/ConsoleDebug.h

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#pragma once
2+
#include <windows.h>
3+
#include <stdio.h>
4+
#include <iostream>
5+
6+
class CConsoleDebug
7+
{
8+
public:
9+
CConsoleDebug(): m_pFile(NULL)
10+
{
11+
#ifdef _DEBUG
12+
AllocConsole();
13+
freopen_s(&m_pFile, "CONOUT$", "w", stdout);
14+
HANDLE hCon = GetStdHandle(STD_OUTPUT_HANDLE);
15+
// SetConsoleTextAttribute(hCon, FOREGROUND_INTENSITY);
16+
COORD size;
17+
size.X=80;
18+
size.Y=3000;
19+
::SetConsoleScreenBufferSize(hCon, size);
20+
std::ios_base::sync_with_stdio();
21+
#endif
22+
}
23+
24+
virtual ~CConsoleDebug()
25+
{
26+
#ifdef _DEBUG
27+
fclose(m_pFile);
28+
m_pFile = NULL;
29+
FreeConsole();
30+
#endif
31+
}
32+
private:
33+
FILE* m_pFile;
34+
};

‎src/ICallBack.h

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@
33

44
typedef enum REQUEST_TYPE
55
{
6-
REQUEST_KEYBOARDHOOK
6+
REQUEST_KEYBOARDHOOK,
7+
REQUEST_MEMSCAN
78
};
89

910
class IRequest
@@ -12,9 +13,25 @@ class IRequest
1213
virtual ~IRequest() = 0 {};
1314
virtual REQUEST_TYPE GetType() = 0;
1415
};
15-
class ICallBack
16+
17+
class CRequestBase : public IRequest
18+
{
19+
public:
20+
CRequestBase(REQUEST_TYPE requestType): m_requestType(requestType) {}
21+
22+
virtual ~CRequestBase() {}
23+
24+
virtual REQUEST_TYPE GetType()
25+
{
26+
return m_requestType;
27+
}
28+
29+
private:
30+
REQUEST_TYPE m_requestType;
31+
};
32+
class IRequestHandler
1633
{
1734
public:
18-
virtual ~ICallBack() = 0 {};
35+
virtual ~IRequestHandler() = 0 {};
1936
virtual BOOL HandleRequest(IRequest* pRequest) = 0;
2037
};

‎src/Keyboard.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
#include "CommonFunc.h"
44

55
HHOOK CKeyboardHook::m_hHook = NULL;
6-
CKeyboardHook::CKeyboardHook(ICallBack* pCallback): m_pCallback(pCallback), m_pRequest(NULL)
6+
CKeyboardHook::CKeyboardHook(IRequestHandler* pCallback): m_pCallback(pCallback), m_pRequest(NULL)
77
{
88
m_pRequest = new CKeyboardHookRequest;
99
}

‎src/Keyboard.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ class CKeyboardHookRequest : public IRequest
2121
class CKeyboardHook
2222
{
2323
public:
24-
CKeyboardHook(ICallBack* pCallback);
24+
CKeyboardHook(IRequestHandler* pCallback);
2525
virtual ~CKeyboardHook();
2626

2727
BOOL Install(DWORD dwPID);
@@ -30,7 +30,7 @@ class CKeyboardHook
3030
void PrintDebugInfo(LPCTSTR lpszInfo);
3131
static LRESULT CALLBACK _HookProc(int nCode, WPARAM wParam, LPARAM lParam);
3232
private:
33-
ICallBack* m_pCallback;
33+
IRequestHandler* m_pCallback;
3434
CKeyboardHookRequest* m_pRequest;
3535
static HHOOK m_hHook;
3636
};

‎src/ProcessImpl.cpp

Lines changed: 128 additions & 113 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
#include <assert.h>
44
#include <Psapi.h>
55
#include <tlhelp32.h>
6-
6+
#pragma comment(lib,"Psapi.lib")
77
namespace CODELIB
88
{
99
CProcessImpl::CProcessImpl(void): m_dwPID(-1), m_hProcess(NULL)
@@ -171,120 +171,135 @@ namespace CODELIB
171171
return dwPID;
172172
}
173173

174-
BOOL CProcessImpl::EnumProcess( std::vector<PROCESSENTRY32>& proVec )
175-
{
176-
PROCESSENTRY32 pe32 = {sizeof(pe32)};
177-
HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
178-
179-
if(INVALID_HANDLE_VALUE == hProcessSnap) return FALSE;
180-
181-
if(Process32First(hProcessSnap, &pe32))
182-
{
183-
do
184-
{
185-
proVec.push_back(pe32);
186-
}
187-
while(Process32Next(hProcessSnap, &pe32));
188-
}
189-
190-
CloseHandle(hProcessSnap);
191-
hProcessSnap = NULL;
192-
return TRUE;
193-
}
194-
195-
BOOL CProcessImpl::CreateLowIntegrityProcess(PWSTR pszCommandLine)
196-
{
197-
DWORD dwError = ERROR_SUCCESS;
198-
HANDLE hToken = NULL;
199-
HANDLE hNewToken = NULL;
200-
SID_IDENTIFIER_AUTHORITY MLAuthority = SECURITY_MANDATORY_LABEL_AUTHORITY;
201-
PSID pIntegritySid = NULL;
202-
TOKEN_MANDATORY_LABEL tml = { 0 };
203-
STARTUPINFO si = { sizeof(si) };
204-
PROCESS_INFORMATION pi = { 0 };
205-
206-
// Open the primary access token of the process.
207-
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE | TOKEN_QUERY |
208-
TOKEN_ADJUST_DEFAULT | TOKEN_ASSIGN_PRIMARY, &hToken))
209-
{
210-
dwError = GetLastError();
211-
goto Cleanup;
212-
}
213-
214-
// Duplicate the primary token of the current process.
215-
if (!DuplicateTokenEx(hToken, 0, NULL, SecurityImpersonation,
216-
TokenPrimary, &hNewToken))
217-
{
218-
dwError = GetLastError();
219-
goto Cleanup;
220-
}
221-
222-
// Create the low integrity SID.
223-
if (!AllocateAndInitializeSid(&MLAuthority, 1, SECURITY_MANDATORY_LOW_RID,
224-
0, 0, 0, 0, 0, 0, 0, &pIntegritySid))
225-
{
226-
dwError = GetLastError();
227-
goto Cleanup;
228-
}
229-
230-
tml.Label.Attributes = SE_GROUP_INTEGRITY;
231-
tml.Label.Sid = pIntegritySid;
232-
233-
// Set the integrity level in the access token to low.
234-
if (!SetTokenInformation(hNewToken, TokenIntegrityLevel, &tml,
235-
(sizeof(tml) + GetLengthSid(pIntegritySid))))
236-
{
237-
dwError = GetLastError();
238-
goto Cleanup;
239-
}
240-
241-
// Create the new process at the Low integrity level.
242-
if (!CreateProcessAsUser(hNewToken, NULL, pszCommandLine, NULL, NULL,
243-
FALSE, 0, NULL, NULL, &si, &pi))
244-
{
245-
dwError = GetLastError();
246-
goto Cleanup;
247-
}
174+
BOOL CProcessImpl::EnumProcess(std::vector<PROCESSENTRY32>& proVec)
175+
{
176+
PROCESSENTRY32 pe32 = {sizeof(pe32)};
177+
HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
178+
179+
if(INVALID_HANDLE_VALUE == hProcessSnap) return FALSE;
180+
181+
if(Process32First(hProcessSnap, &pe32))
182+
{
183+
do
184+
{
185+
proVec.push_back(pe32);
186+
}
187+
while(Process32Next(hProcessSnap, &pe32));
188+
}
189+
190+
CloseHandle(hProcessSnap);
191+
hProcessSnap = NULL;
192+
return TRUE;
193+
}
194+
195+
BOOL CProcessImpl::CreateLowIntegrityProcess(PWSTR pszCommandLine)
196+
{
197+
DWORD dwError = ERROR_SUCCESS;
198+
HANDLE hToken = NULL;
199+
HANDLE hNewToken = NULL;
200+
SID_IDENTIFIER_AUTHORITY MLAuthority = SECURITY_MANDATORY_LABEL_AUTHORITY;
201+
PSID pIntegritySid = NULL;
202+
TOKEN_MANDATORY_LABEL tml = { 0 };
203+
STARTUPINFO si = { sizeof(si) };
204+
PROCESS_INFORMATION pi = { 0 };
205+
206+
// Open the primary access token of the process.
207+
if(!OpenProcessToken(GetCurrentProcess(), TOKEN_DUPLICATE | TOKEN_QUERY |
208+
TOKEN_ADJUST_DEFAULT | TOKEN_ASSIGN_PRIMARY, &hToken))
209+
{
210+
dwError = GetLastError();
211+
goto Cleanup;
212+
}
213+
214+
// Duplicate the primary token of the current process.
215+
if(!DuplicateTokenEx(hToken, 0, NULL, SecurityImpersonation,
216+
TokenPrimary, &hNewToken))
217+
{
218+
dwError = GetLastError();
219+
goto Cleanup;
220+
}
221+
222+
// Create the low integrity SID.
223+
if(!AllocateAndInitializeSid(&MLAuthority, 1, SECURITY_MANDATORY_LOW_RID,
224+
0, 0, 0, 0, 0, 0, 0, &pIntegritySid))
225+
{
226+
dwError = GetLastError();
227+
goto Cleanup;
228+
}
229+
230+
tml.Label.Attributes = SE_GROUP_INTEGRITY;
231+
tml.Label.Sid = pIntegritySid;
232+
233+
// Set the integrity level in the access token to low.
234+
if(!SetTokenInformation(hNewToken, TokenIntegrityLevel, &tml,
235+
(sizeof(tml) + GetLengthSid(pIntegritySid))))
236+
{
237+
dwError = GetLastError();
238+
goto Cleanup;
239+
}
240+
241+
// Create the new process at the Low integrity level.
242+
if(!CreateProcessAsUser(hNewToken, NULL, pszCommandLine, NULL, NULL,
243+
FALSE, 0, NULL, NULL, &si, &pi))
244+
{
245+
dwError = GetLastError();
246+
goto Cleanup;
247+
}
248248

249249
Cleanup:
250-
// Centralized cleanup for all allocated resources.
251-
if (hToken)
252-
{
253-
CloseHandle(hToken);
254-
hToken = NULL;
255-
}
256-
if (hNewToken)
257-
{
258-
CloseHandle(hNewToken);
259-
hNewToken = NULL;
260-
}
261-
if (pIntegritySid)
262-
{
263-
FreeSid(pIntegritySid);
264-
pIntegritySid = NULL;
265-
}
266-
if (pi.hProcess)
267-
{
268-
CloseHandle(pi.hProcess);
269-
pi.hProcess = NULL;
270-
}
271-
if (pi.hThread)
272-
{
273-
CloseHandle(pi.hThread);
274-
pi.hThread = NULL;
275-
}
276-
277-
if (ERROR_SUCCESS != dwError)
278-
{
279-
// Make sure that the error code is set for failure.
280-
SetLastError(dwError);
281-
return FALSE;
282-
}
283-
else
284-
{
285-
return TRUE;
286-
}
287-
}
250+
251+
// Centralized cleanup for all allocated resources.
252+
if(hToken)
253+
{
254+
CloseHandle(hToken);
255+
hToken = NULL;
256+
}
257+
258+
if(hNewToken)
259+
{
260+
CloseHandle(hNewToken);
261+
hNewToken = NULL;
262+
}
263+
264+
if(pIntegritySid)
265+
{
266+
FreeSid(pIntegritySid);
267+
pIntegritySid = NULL;
268+
}
269+
270+
if(pi.hProcess)
271+
{
272+
CloseHandle(pi.hProcess);
273+
pi.hProcess = NULL;
274+
}
275+
276+
if(pi.hThread)
277+
{
278+
CloseHandle(pi.hThread);
279+
pi.hThread = NULL;
280+
}
281+
282+
if(ERROR_SUCCESS != dwError)
283+
{
284+
// Make sure that the error code is set for failure.
285+
SetLastError(dwError);
286+
return FALSE;
287+
}
288+
else
289+
{
290+
return TRUE;
291+
}
292+
}
293+
294+
SIZE_T CProcessImpl::VirtualQueryEx(LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength)
295+
{
296+
return ::VirtualQueryEx(m_hProcess, lpAddress, lpBuffer, dwLength);
297+
}
298+
299+
BOOL CProcessImpl::IsOpened()
300+
{
301+
return (NULL != m_hProcess);
302+
}
288303

289304
}
290305

0 commit comments

Comments
 (0)