diff --git a/PEParser/PEParser.h b/PEParser/PEParser.h index 1ed7c48..44f8c16 100644 --- a/PEParser/PEParser.h +++ b/PEParser/PEParser.h @@ -50,21 +50,6 @@ enum class CfgFlags :uint32_t { }; DEFINE_ENUM_FLAG_OPERATORS(CfgFlags); -enum class DllCharacteristics :unsigned short { - None = 0, - HighEntropyVA = 0x20, - DynamicBase = 0x40, - ForceIntegrity = 0x80, - NxCompat = 0x100, - NoIsolation = 0x200, - NoSEH = 0x400, - NoBind = 0x800, - AppContainer = 0x1000, - WDMDriver = 0x2000, - ControlFlowGuard = 0x4000, - TerminalServerAware = 0x8000 -}; -DEFINE_ENUM_FLAG_OPERATORS(DllCharacteristics) enum class ImageCharacteristics :unsigned short { None = 0, diff --git a/WinArk/ProcessInlineHookScanDlg.cpp b/WinArk/ProcessInlineHookScanDlg.cpp new file mode 100644 index 0000000..1577c4e --- /dev/null +++ b/WinArk/ProcessInlineHookScanDlg.cpp @@ -0,0 +1 @@ +#include "stdafx.h" \ No newline at end of file diff --git a/WinArk/ProcessInlineHookScanDlg.h b/WinArk/ProcessInlineHookScanDlg.h new file mode 100644 index 0000000..6f70f09 --- /dev/null +++ b/WinArk/ProcessInlineHookScanDlg.h @@ -0,0 +1 @@ +#pragma once diff --git a/WinArk/ProcessInlineHookScanTable.cpp b/WinArk/ProcessInlineHookScanTable.cpp new file mode 100644 index 0000000..795f1dd --- /dev/null +++ b/WinArk/ProcessInlineHookScanTable.cpp @@ -0,0 +1,95 @@ +#include "stdafx.h" +#include "ProcessInlineHookScanTable.h" + +CProcessInlineHookScanTable::CProcessInlineHookScanTable(BarInfo& bars, TableInfo& table) + :CTable(bars, table) { + SetTableWindowInfo(bars.nbar); + +} + +int CProcessInlineHookScanTable::ParseTableEntry(CString& s, char& mask, int& select, InlineHookInfo& info, int column){ + return 0; +} + +bool CProcessInlineHookScanTable::CompareItems(const InlineHookInfo& s1, const InlineHookInfo& s2, int col, bool asc){ + return false; +} + +LRESULT CProcessInlineHookScanTable::OnCreate(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + return 0; +} + +LRESULT CProcessInlineHookScanTable::OnDestroy(UINT uMsg, WPARAM wParam, LPARAM lparam, BOOL&){ + return 0; +} + +LRESULT CProcessInlineHookScanTable::OnPaint(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + PaintTable(m_hWnd); + return 0; +} + +LRESULT CProcessInlineHookScanTable::OnHScroll(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + Tablefunction(m_hWnd, uMsg, wParam, lParam); + return 0; +} + +LRESULT CProcessInlineHookScanTable::OnVScroll(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + Tablefunction(m_hWnd, uMsg, wParam, lParam); + return 0; +} + +LRESULT CProcessInlineHookScanTable::OnUserVabs(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + Tablefunction(m_hWnd, uMsg, wParam, lParam); + return 0; +} + +LRESULT CProcessInlineHookScanTable::OnUserVrel(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + Tablefunction(m_hWnd, uMsg, wParam, lParam); + return 0; +} + +LRESULT CProcessInlineHookScanTable::OnUserChgs(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + Tablefunction(m_hWnd, uMsg, wParam, lParam); + return 0; +} + +LRESULT CProcessInlineHookScanTable::OnMouseWheel(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + int zDelta = GET_WHEEL_DELTA_WPARAM(wParam); + return Tablefunction(m_hWnd, WM_VSCROLL, zDelta >= 0 ? 0 : 1, wParam); +} + +LRESULT CProcessInlineHookScanTable::OnMouseMove(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + return Tablefunction(m_hWnd, uMsg, wParam, lParam); +} + +LRESULT CProcessInlineHookScanTable::OnLBtnDown(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + return Tablefunction(m_hWnd, uMsg, wParam, lParam); +} + +LRESULT CProcessInlineHookScanTable::OnLBtnUp(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + return Tablefunction(m_hWnd, uMsg, wParam, lParam); +} + +LRESULT CProcessInlineHookScanTable::OnRBtnDown(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + return Tablefunction(m_hWnd, uMsg, wParam, lParam); +} + +LRESULT CProcessInlineHookScanTable::OnUserSts(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + return Tablefunction(m_hWnd, uMsg, wParam, lParam); +} + +LRESULT CProcessInlineHookScanTable::OnWindowPosChanged(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + return Tablefunction(m_hWnd, uMsg, wParam, lParam); +} + +LRESULT CProcessInlineHookScanTable::OnKeyDown(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + return Tablefunction(m_hWnd, uMsg, wParam, lParam); +} + +LRESULT CProcessInlineHookScanTable::OnSysKeyDown(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL&){ + return Tablefunction(m_hWnd, uMsg, wParam, lParam); +} + +void CProcessInlineHookScanTable::Refresh() { + +} diff --git a/WinArk/ProcessInlineHookScanTable.h b/WinArk/ProcessInlineHookScanTable.h new file mode 100644 index 0000000..89a7139 --- /dev/null +++ b/WinArk/ProcessInlineHookScanTable.h @@ -0,0 +1,61 @@ +#pragma once +#include "Table.h" +#include "resource.h" + +struct InlineHookInfo { + +}; + +class CProcessInlineHookScanTable : + public CTable, + public CWindowImpl { + +public: + DECLARE_WND_CLASS_EX(NULL, CS_DBLCLKS | CS_VREDRAW | CS_HREDRAW, COLOR_WINDOW); + + CProcessInlineHookScanTable(BarInfo& bars, TableInfo& table); + int ParseTableEntry(CString& s, char& mask, int& select, InlineHookInfo& info, int column); + bool CompareItems(const InlineHookInfo& s1, const InlineHookInfo& s2, int col, bool asc); + + BEGIN_MSG_MAP(CProcessInlineHookScanTable) + MESSAGE_HANDLER(WM_DESTROY, OnDestroy) + MESSAGE_HANDLER(WM_CREATE, OnCreate) + MESSAGE_HANDLER(WM_PAINT, OnPaint) + MESSAGE_HANDLER(WM_HSCROLL, OnHScroll) + MESSAGE_HANDLER(WM_VSCROLL, OnVScroll) + MESSAGE_HANDLER(WM_USER_VABS, OnUserVabs) + MESSAGE_HANDLER(WM_USER_VREL, OnUserVrel) + MESSAGE_HANDLER(WM_USER_CHGS, OnUserChgs) + MESSAGE_HANDLER(WM_MOUSEWHEEL, OnMouseWheel) + MESSAGE_HANDLER(WM_MOUSEMOVE, OnMouseMove) + MESSAGE_HANDLER(WM_LBUTTONDOWN, OnLBtnDown) + MESSAGE_HANDLER(WM_LBUTTONUP, OnLBtnUp) + MESSAGE_HANDLER(WM_USER_STS, OnUserSts) + MESSAGE_HANDLER(WM_WINDOWPOSCHANGED, OnWindowPosChanged) + MESSAGE_HANDLER(WM_KEYDOWN, OnKeyDown) + MESSAGE_HANDLER(WM_SYSKEYDOWN, OnSysKeyDown) + END_MSG_MAP() + + LRESULT OnCreate(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + LRESULT OnDestroy(UINT uMsg, WPARAM wParam, LPARAM lparam, BOOL& /*bHandled*/); + LRESULT OnPaint(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + LRESULT OnHScroll(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + LRESULT OnVScroll(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + LRESULT OnUserVabs(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + LRESULT OnUserVrel(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + LRESULT OnUserChgs(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + LRESULT OnMouseWheel(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + LRESULT OnMouseMove(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + LRESULT OnLBtnDown(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + LRESULT OnLBtnUp(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + LRESULT OnRBtnDown(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + LRESULT OnUserSts(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + LRESULT OnWindowPosChanged(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + LRESULT OnKeyDown(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + LRESULT OnSysKeyDown(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/); + + void Refresh(); + +private: + +}; \ No newline at end of file diff --git a/WinArk/ProcessModuleDlg.cpp b/WinArk/ProcessModuleDlg.cpp index 7f49d93..938d8a8 100644 --- a/WinArk/ProcessModuleDlg.cpp +++ b/WinArk/ProcessModuleDlg.cpp @@ -12,6 +12,8 @@ LRESULT CModuleDlg::OnInitDialog(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM lParam BarDesc bars[] = { {25,"模块名",0}, {8,"类型",0}, + {8,"位数",0}, + {42,"描述",0}, {15,"映像大小",0}, {20,"基地址",0}, {20,"镜像基址",0}, @@ -36,9 +38,14 @@ LRESULT CModuleDlg::OnInitDialog(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM lParam m_ProcModuleTable = new CProcessModuleTable(info, table,pid,m_hWnd); WCHAR proc[25]; _itow(pid, proc, 10); - std::wstring title = L"Process: pid = "; + std::wstring text; + text.reserve(256); + text.resize(GetWindowTextLength()); + GetWindowText(text.data(), 256); + std::wstring title = L" Process: pid = "; title += proc; - SetWindowText(title.c_str()); + text += title; + SetWindowText(text.c_str()); RECT rect; GetClientRect(&rect); m_ProcModuleTable->Create(m_hWnd, rect, nullptr, WS_CHILD | WS_VSCROLL | WS_HSCROLL | WS_BORDER | WS_EX_LAYERED); diff --git a/WinArk/ProcessModuleTable.cpp b/WinArk/ProcessModuleTable.cpp index 6f9ded3..7c1ec4e 100644 --- a/WinArk/ProcessModuleTable.cpp +++ b/WinArk/ProcessModuleTable.cpp @@ -3,6 +3,7 @@ #include #include "SortHelper.h" #include "resource.h" +#include LRESULT CProcessModuleTable::OnCreate(UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& /*bHandled*/) { return 0; @@ -74,15 +75,17 @@ LRESULT CProcessModuleTable::OnGetDlgCode(UINT /*uMsg*/, WPARAM /*wParam*/, LPAR } -CProcessModuleTable::CProcessModuleTable(BarInfo& bars, TableInfo& table,DWORD pid,HWND hwnd) - : CTable(bars, table),m_Tracker(pid),_hDlg(hwnd) { +CProcessModuleTable::CProcessModuleTable(BarInfo& bars, TableInfo& table, DWORD pid, HWND hwnd) + : CTable(bars, table), m_Tracker(pid), _hDlg(hwnd) { SetTableWindowInfo(bars.nbar); + m_Table.data.info.clear(); Refresh(); } CProcessModuleTable::CProcessModuleTable(BarInfo& bars, TableInfo& table, HANDLE hProcess) : CTable(bars, table), m_Tracker(hProcess) { SetTableWindowInfo(bars.nbar); + m_Table.data.info.clear(); //DoRefresh(); } @@ -119,31 +122,56 @@ CString CProcessModuleTable::CharacteristicsToString(WinSys::DllCharacteristics } int CProcessModuleTable::ParseTableEntry(CString& s, char& mask, int& select, std::shared_ptr& info, int column) { - switch (column) { - case 0: - s = info->Name.empty() ? L"" : info->Name.c_str(); - break; - case 1: - s = info->Type == WinSys::MapType::Image ? L"Image" : L"Data"; - break; - case 2: - s.Format(L"0x%08X", info->ModuleSize); - break; - case 3: - s.Format(L"0x%p", info->Base); - break; - case 4: - if (info->Type == WinSys::MapType::Image) - s.Format(L"0x%p", info->ImageBase); - else - s = L"N/A"; - break; - case 5: - s = info->Type == WinSys::MapType::Image ? CharacteristicsToString(info->Characteristics) : CString(); - break; - case 6: - s = info->Path.c_str(); - break; + switch (static_cast(column)) { + case ModuleColumn::ModuleName: + s = info->Name.empty() ? L"" : info->Name.c_str(); + break; + + case ModuleColumn::Type: + s = info->Type == WinSys::MapType::Image ? L"Image" : L"Data"; + break; + + case ModuleColumn::Bit: + if (info->Type == WinSys::MapType::Image) { + PEParser parser(info->Path.c_str()); + s = parser.IsPe64() ? L"x64" : L"x86"; + bool isSystem = parser.IsSystemFile(); + bool isExecutable = parser.IsExecutable(); + parser.GetImports(); + } + else { + s = L"N/A"; + } + break; + + case ModuleColumn::ModuleSize: + s.Format(L"0x%08X", info->ModuleSize); + break; + + case ModuleColumn::Base: + s.Format(L"0x%p", info->Base); + break; + + case ModuleColumn::ImageBase: + if (info->Type == WinSys::MapType::Image) + s.Format(L"0x%p", info->ImageBase); + else + s = L"N/A"; + break; + + case ModuleColumn::Characteristics: + s = info->Type == WinSys::MapType::Image ? CharacteristicsToString(info->Characteristics) : CString(); + break; + + case ModuleColumn::Path: + s = info->Path.c_str(); + break; + + case ModuleColumn::FileDescription: + if (info->Type == WinSys::MapType::Image) { + s = GetFileDescription(info->Path).c_str(); + } + break; } return s.GetLength(); } @@ -161,7 +189,7 @@ CProcessModuleTable::ModuleInfoEx& CProcessModuleTable::GetModuleEx(WinSys::Modu void CProcessModuleTable::Refresh() { if (!m_Tracker.IsRunning()) { - AtlMessageBox(*this, L"Process has terminated", IDS_TITLE, MB_OK|MB_ICONWARNING); + AtlMessageBox(*this, L"Process has terminated", IDS_TITLE, MB_OK | MB_ICONWARNING); EndDialog(_hDlg, 0); return; } @@ -207,4 +235,24 @@ void CProcessModuleTable::Refresh() { m_Table.data.n = count; return; -} \ No newline at end of file +} + +std::wstring CProcessModuleTable::GetFileDescription(std::wstring path) { + BYTE buffer[1 << 12]; + WCHAR* fileDescription = nullptr; + CString filePath = path.c_str(); + if (filePath.Mid(1, 2) == "??") + filePath = filePath.Mid(4); + if (::GetFileVersionInfo(filePath, 0, sizeof(buffer), buffer)) { + WORD* langAndCodePage; + UINT len; + if (::VerQueryValue(buffer, L"\\VarFileInfo\\Translation", (void**)&langAndCodePage, &len)) { + CString text; + text.Format(L"\\StringFileInfo\\%04x%04x\\FileDescription", langAndCodePage[0], langAndCodePage[1]); + + if (::VerQueryValue(buffer, text, (void**)&fileDescription, &len)) + return fileDescription; + } + } + return L""; +} diff --git a/WinArk/ProcessModuleTable.h b/WinArk/ProcessModuleTable.h index 9f2e3dc..7e977a0 100644 --- a/WinArk/ProcessModuleTable.h +++ b/WinArk/ProcessModuleTable.h @@ -62,6 +62,12 @@ public: ModuleInfoEx& GetModuleEx(WinSys::ModuleInfo* mi); CString CharacteristicsToString(WinSys::DllCharacteristics ch); void Refresh(); + + std::wstring GetFileDescription(std::wstring path); + + enum class ModuleColumn { + ModuleName,Type,Bit,FileDescription, ModuleSize,Base, ImageBase, Characteristics,Path + }; private: std::unordered_map m_ModulesEx; WinSys::ProcessModuleTracker m_Tracker; diff --git a/WinArk/ProcessTable.cpp b/WinArk/ProcessTable.cpp index 9e535e7..e9b8737 100644 --- a/WinArk/ProcessTable.cpp +++ b/WinArk/ProcessTable.cpp @@ -337,4 +337,14 @@ LRESULT CProcessTable::OnProcessMemory(WORD /*wNotifyCode*/, WORD /*wID*/, HWND dlg.DoModal(m_hWnd, (LPARAM)p->Id); return 0; -} \ No newline at end of file +} + +LRESULT CProcessTable::OnProcessInlineHookScan(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) { + int selected = m_Table.data.selected; + ATLASSERT(selected >= 0); + auto& p = m_Table.data.info[selected]; + + + + return 0; +} diff --git a/WinArk/ProcessTable.h b/WinArk/ProcessTable.h index f8ffdc7..fc6d08e 100644 --- a/WinArk/ProcessTable.h +++ b/WinArk/ProcessTable.h @@ -37,6 +37,7 @@ public: COMMAND_ID_HANDLER(ID_PROCESS_THREADS,OnProcessThreads) COMMAND_ID_HANDLER(ID_PROCESS_HANDLES,OnProcessHandles) COMMAND_ID_HANDLER(ID_PROCESS_MEMORY,OnProcessMemory) + COMMAND_ID_HANDLER(ID_PROCESS_INLINEHOOKSCAN,OnProcessInlineHookScan) END_MSG_MAP() CProcessTable(BarInfo& bars,TableInfo& table); @@ -74,6 +75,7 @@ public: LRESULT OnProcessThreads(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); LRESULT OnProcessHandles(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); LRESULT OnProcessMemory(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); + LRESULT OnProcessInlineHookScan(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); int GetRowImage(HWND, int row) const; void Refresh(); diff --git a/WinArk/SSDTHookTable.h b/WinArk/SSDTHookTable.h index 23de6bf..3564864 100644 --- a/WinArk/SSDTHookTable.h +++ b/WinArk/SSDTHookTable.h @@ -26,7 +26,7 @@ public: int ParseTableEntry(CString& s, char& mask, int& select, SystemServiceInfo& info, int column); bool CompareItems(const SystemServiceInfo& s1, const SystemServiceInfo& s2, int col, bool asc); - BEGIN_MSG_MAP(CServiceTable) + BEGIN_MSG_MAP(CSSDTHookTable) MESSAGE_HANDLER(WM_DESTROY, OnDestroy) MESSAGE_HANDLER(WM_CREATE, OnCreate) MESSAGE_HANDLER(WM_PAINT, OnPaint) diff --git a/WinArk/WinArk.rc b/WinArk/WinArk.rc index b59cbd2..da437be 100644 --- a/WinArk/WinArk.rc +++ b/WinArk/WinArk.rc @@ -13,7 +13,7 @@ #undef APSTUDIO_READONLY_SYMBOLS ///////////////////////////////////////////////////////////////////////////// -// 中文(简体) resources +// Chinese (Simplified) resources #if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS) LANGUAGE LANG_CHINESE, SUBLANG_NEUTRAL @@ -66,12 +66,12 @@ BEGIN 0 END -#endif // 中文(简体) resources +#endif // Chinese (Simplified) resources ///////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////// -// 中文(简体，中国) resources +// Chinese (Simplified, PRC) resources #if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS) LANGUAGE LANG_CHINESE, SUBLANG_CHINESE_SIMPLIFIED @@ -84,7 +84,7 @@ LANGUAGE LANG_CHINESE, SUBLANG_CHINESE_SIMPLIFIED IDD_MODULES DIALOGEX 0, 0, 619, 280 STYLE DS_SETFONT | DS_FIXEDSYS | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU | WS_THICKFRAME -CAPTION "驱动对象分发例程" +CAPTION "进程模块" FONT 8, "MS Shell Dlg", 400, 0, 0x1 BEGIN END @@ -233,6 +233,13 @@ BEGIN PUSHBUTTON "移除回调",IDC_REMOVE_CALLBACK,326,105,50,14 END +IDD_INLINEHOOKSCAN DIALOGEX 0, 0, 619, 280 +STYLE DS_SETFONT | DS_FIXEDSYS | WS_MINIMIZEBOX | WS_MAXIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU | WS_THICKFRAME +CAPTION "Inline Hook Scan" +FONT 8, "MS Shell Dlg", 400, 0, 0x1 +BEGIN +END + ///////////////////////////////////////////////////////////////////////////// // @@ -337,6 +344,14 @@ BEGIN TOPMARGIN, 6 BOTTOMMARGIN, 372 END + + IDD_INLINEHOOKSCAN, DIALOG + BEGIN + LEFTMARGIN, 7 + RIGHTMARGIN, 612 + TOPMARGIN, 7 + BOTTOMMARGIN, 273 + END END #endif // APSTUDIO_INVOKED @@ -406,6 +421,11 @@ BEGIN 0 END +IDD_INLINEHOOKSCAN AFX_DIALOG_LAYOUT +BEGIN + 0 +END + ///////////////////////////////////////////////////////////////////////////// // @@ -427,6 +447,7 @@ BEGIN MENUITEM "Handles", ID_PROCESS_HANDLES MENUITEM "Memory", ID_PROCESS_MEMORY END + MENUITEM "Inline Hook Scan", ID_PROCESS_INLINEHOOKSCAN END POPUP "listdir" BEGIN @@ -558,12 +579,12 @@ IDR_X64_DRIVER BIN "..\\x64\\Debug\\AntiRootkit.sys IDR_X86_DRIVER BIN "..\\Debug\\AntiRootkit.sys" -#endif // 中文(简体，中国) resources +#endif // Chinese (Simplified, PRC) resources ///////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////// -// 英语(美国) resources +// English (United States) resources #if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_ENU) LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US @@ -912,7 +933,7 @@ BEGIN ATL_IDS_MRU_FILE "Open this document" END -#endif // 英语(美国) resources +#endif // English (United States) resources ///////////////////////////////////////////////////////////////////////////// diff --git a/WinArk/WinArk.vcxproj b/WinArk/WinArk.vcxproj index 30c86fa..4072641 100644 --- a/WinArk/WinArk.vcxproj +++ b/WinArk/WinArk.vcxproj @@ -251,6 +251,8 @@ + + @@ -363,6 +365,8 @@ + + diff --git a/WinArk/WinArk.vcxproj.filters b/WinArk/WinArk.vcxproj.filters index fa958c9..c11b3e2 100644 --- a/WinArk/WinArk.vcxproj.filters +++ b/WinArk/WinArk.vcxproj.filters @@ -345,6 +345,12 @@ Views + + Dialogs + + + Table + @@ -683,6 +689,12 @@ Views + + Dialogs + + + Table + diff --git a/WinArk/resource.h b/WinArk/resource.h index e700888..932b6fc 100644 --- a/WinArk/resource.h +++ b/WinArk/resource.h @@ -1,6 +1,6 @@ //{{NO_DEPENDENCIES}} -// Microsoft Visual C++ 生成的包含文件。 -// 供 WinArk.rc 使用 +// Microsoft Visual C++ generated include file. +// Used by WinArk.rc // #define IDD_ABOUTBOX 100 #define IDR_MAINFRAME 128 @@ -31,6 +31,8 @@ #define IDD_MODULES1 235 #define IDD_ROUTINES 235 #define IDD_CONFIG 236 +#define IDD_MODULES2 237 +#define IDD_INLINEHOOKSCAN 237 #define IDC_VALUE 1001 #define IDC_APPICON 1002 #define IDC_HEX 1002 @@ -177,13 +179,14 @@ #define ID_KERNEL_REFRESH 32879 #define ID_NETWORK_REFRESH 32880 #define ID_KERNEL_REMOVE 32881 +#define ID_PROCESS_INLINEHOOKSCAN 32882 // Next default values for new objects // #ifdef APSTUDIO_INVOKED #ifndef APSTUDIO_READONLY_SYMBOLS #define _APS_NEXT_RESOURCE_VALUE 238 -#define _APS_NEXT_COMMAND_VALUE 32882 +#define _APS_NEXT_COMMAND_VALUE 32883 #define _APS_NEXT_CONTROL_VALUE 1062 #define _APS_NEXT_SYMED_VALUE 101 #endif diff --git a/WinSysCore/ProcessModuleTracker.cpp b/WinSysCore/ProcessModuleTracker.cpp index 59bb2e8..ea2f7c7 100644 --- a/WinSysCore/ProcessModuleTracker.cpp +++ b/WinSysCore/ProcessModuleTracker.cpp @@ -5,6 +5,7 @@ #include #include "Helpers.h" + #pragma comment(lib,"imagehlp") using namespace WinSys; @@ -15,7 +16,7 @@ struct ProcessModuleTracker::Impl { DWORD _pid; wil::unique_handle _handle; BOOL _isWow64; - + explicit Impl(DWORD pid) :_pid(pid) { _handle.reset(::OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | SYNCHRONIZE, FALSE, pid)); if (_handle) @@ -74,6 +75,7 @@ struct ProcessModuleTracker::Impl { } mi->Base = mbi.AllocationBase; mi->Type = mbi.Type == MEM_MAPPED ? MapType::Data : MapType::Image; + return mi; }