You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
220 lines
5.8 KiB
220 lines
5.8 KiB
#include <windows.h>
|
|
#include "view.h"
|
|
#include "except.h"
|
|
#include "thread.h"
|
|
#include "dump.h"
|
|
#include "memory.h"
|
|
#include "profiler.h"
|
|
#include "filter.h"
|
|
|
|
static CRITICAL_SECTION filterCritSec;
|
|
static PMODULEFILTER pFilterHead = 0;
|
|
static PMODULEFILTER pLBFilterHead = 0;
|
|
static char *pszModules[] = {"ntdll.dll",
|
|
"kernel32.dll",
|
|
"gdi32.dll",
|
|
"user32.dll",
|
|
"shell32.dll",
|
|
"shlwapi.dll",
|
|
"msvcrt.dll",
|
|
"msvcirt.dll",
|
|
"advapi32.dll",
|
|
"ddraw.dll",
|
|
"dsound.dll",
|
|
"ole32.dll",
|
|
"rpcrt4.dll",
|
|
"oleaut32.dll",
|
|
"winmm.dll",
|
|
"comctl32.dll",
|
|
"comdlg32.dll",
|
|
"riched20.dll",
|
|
"dinput.dll",
|
|
"wdmaud.drv",
|
|
NAME_OF_DLL_TO_INJECT};
|
|
|
|
BOOL
|
|
InitializeFilterList(VOID)
|
|
{
|
|
HMODULE hTemp;
|
|
PIMAGE_NT_HEADERS pHeaders;
|
|
DWORD dwModStart;
|
|
DWORD dwModEnd;
|
|
DWORD dwCounter;
|
|
DWORD dwCount;
|
|
BOOL bResult;
|
|
|
|
InitializeCriticalSection(&filterCritSec);
|
|
|
|
dwCount = sizeof(pszModules) / sizeof(char *);
|
|
|
|
for (dwCounter = 0; dwCounter < dwCount; dwCounter++) {
|
|
//
|
|
// Build the filter list
|
|
//
|
|
hTemp = GetModuleHandleA(pszModules[dwCounter]);
|
|
|
|
|
|
if (0 == hTemp) {
|
|
bResult = AddModuleToFilterList(pszModules[dwCounter],
|
|
0,
|
|
0,
|
|
TRUE);
|
|
if (FALSE == bResult) {
|
|
return FALSE;
|
|
}
|
|
}
|
|
else {
|
|
//
|
|
// Dig out the PE information
|
|
//
|
|
pHeaders = ImageNtHeader2((PVOID)hTemp);
|
|
|
|
dwModStart = (DWORD)hTemp;
|
|
dwModEnd = dwModStart + pHeaders->OptionalHeader.SizeOfImage;
|
|
|
|
bResult = AddModuleToFilterList(pszModules[dwCounter],
|
|
dwModStart,
|
|
dwModEnd,
|
|
FALSE);
|
|
if (FALSE == bResult) {
|
|
return FALSE;
|
|
}
|
|
}
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
BOOL
|
|
AddModuleToFilterList(CHAR *pszModuleName,
|
|
DWORD dwStartAddress,
|
|
DWORD dwEndAddress,
|
|
BOOL bLateBound)
|
|
{
|
|
PMODULEFILTER pModuleFilter;
|
|
|
|
//
|
|
// Allocate entry
|
|
//
|
|
pModuleFilter = AllocMem(sizeof(MODULEFILTER));
|
|
if (0 == pModuleFilter) {
|
|
return FALSE;
|
|
}
|
|
|
|
if (pszModuleName) {
|
|
strcpy(pModuleFilter->szModuleName, pszModuleName);
|
|
}
|
|
pModuleFilter->dwModuleStart = dwStartAddress;
|
|
pModuleFilter->dwModuleEnd = dwEndAddress;
|
|
pModuleFilter->pNextFilter = 0;
|
|
|
|
EnterCriticalSection(&filterCritSec);
|
|
|
|
if (FALSE == bLateBound) {
|
|
//
|
|
// Add DLL to the normal filter list
|
|
//
|
|
if (0 == pFilterHead) {
|
|
pFilterHead = pModuleFilter;
|
|
}
|
|
else {
|
|
pModuleFilter->pNextFilter = pFilterHead;
|
|
pFilterHead = pModuleFilter;
|
|
}
|
|
}
|
|
else {
|
|
//
|
|
// Add DLL to the late bound list
|
|
//
|
|
if (0 == pLBFilterHead) {
|
|
pLBFilterHead = pModuleFilter;
|
|
}
|
|
else {
|
|
pModuleFilter->pNextFilter = pLBFilterHead;
|
|
pLBFilterHead = pModuleFilter;
|
|
}
|
|
}
|
|
|
|
LeaveCriticalSection(&filterCritSec);
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
BOOL
|
|
IsAddressFiltered(DWORD dwAddress)
|
|
{
|
|
PMODULEFILTER pModuleFilter;
|
|
|
|
EnterCriticalSection(&filterCritSec);
|
|
|
|
//
|
|
// Walk both lists and see if we have an address to filter
|
|
//
|
|
pModuleFilter = pFilterHead;
|
|
while (pModuleFilter) {
|
|
if ((dwAddress >= pModuleFilter->dwModuleStart) &&
|
|
(dwAddress <= pModuleFilter->dwModuleEnd)) {
|
|
LeaveCriticalSection(&filterCritSec);
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
pModuleFilter = pModuleFilter->pNextFilter;
|
|
}
|
|
|
|
pModuleFilter = pLBFilterHead;
|
|
while (pModuleFilter) {
|
|
if ((dwAddress >= pModuleFilter->dwModuleStart) &&
|
|
(dwAddress <= pModuleFilter->dwModuleEnd)) {
|
|
LeaveCriticalSection(&filterCritSec);
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
pModuleFilter = pModuleFilter->pNextFilter;
|
|
}
|
|
|
|
LeaveCriticalSection(&filterCritSec);
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
VOID
|
|
RefreshFilterList(VOID)
|
|
{
|
|
PMODULEFILTER pModuleFilter;
|
|
HMODULE hTemp;
|
|
PIMAGE_NT_HEADERS pHeaders;
|
|
DWORD dwModStart;
|
|
DWORD dwModEnd;
|
|
|
|
//
|
|
// Walk the LB list and refresh the start and end module addresses
|
|
//
|
|
|
|
EnterCriticalSection(&filterCritSec);
|
|
|
|
pModuleFilter = pLBFilterHead;
|
|
while (pModuleFilter) {
|
|
//
|
|
// Grab the module base address
|
|
//
|
|
hTemp = GetModuleHandleA(pModuleFilter->szModuleName);
|
|
if (hTemp) {
|
|
//
|
|
// This module is loaded - do refresh
|
|
//
|
|
pHeaders = ImageNtHeader2((PVOID)hTemp);
|
|
|
|
dwModStart = (DWORD)hTemp;
|
|
dwModEnd = dwModStart + pHeaders->OptionalHeader.SizeOfImage;
|
|
|
|
pModuleFilter->dwModuleStart = dwModStart;
|
|
pModuleFilter->dwModuleEnd = dwModEnd;
|
|
}
|
|
|
|
pModuleFilter = pModuleFilter->pNextFilter;
|
|
}
|
|
|
|
LeaveCriticalSection(&filterCritSec);
|
|
}
|