Skip to content

Commit

Permalink
+ added NtQuerySystemInformation
Browse files Browse the repository at this point in the history 
+ added NtSetDebugFilterState
+ fixed small memory leaks
+ changed version numbers (automatic set to build date of plugins)
  • Loading branch information
@zer0fl4g
zer0fl4g committed Jul 28, 2012
1 parent 636da1f commit 308f7db
Show file tree
Hide file tree
Showing 91 changed files with 755 additions and 123 deletions.
65 changes: 65 additions & 0 deletions DD.Plugin.CheckHeapMemory/DD.Plugin.CheckHeapMemory.vcxproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,10 +5,18 @@
<Configuration>Debug</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Debug|x64">
<Configuration>Debug</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|Win32">
<Configuration>Release</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|x64">
<Configuration>Release</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
</ItemGroup>
<PropertyGroup Label="Globals">
<ProjectGuid>{F712449E-CD06-437F-9419-122EC5FDDE9E}</ProjectGuid>
Expand All @@ -21,35 +29,73 @@
<UseDebugLibraries>true</UseDebugLibraries>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<LinkIncremental>true</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<LinkIncremental>true</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<LinkIncremental>false</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<LinkIncremental>false</LinkIncremental>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<ClCompile>
<PrecompiledHeader>
</PrecompiledHeader>
<WarningLevel>Level3</WarningLevel>
<Optimization>Disabled</Optimization>
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;DDPLUGINCHECKHEAPMEMORY_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile>
<PrecompiledHeader>
</PrecompiledHeader>
<WarningLevel>Level3</WarningLevel>
<Optimization>Disabled</Optimization>
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;DDPLUGINCHECKHEAPMEMORY_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
Expand All @@ -65,6 +111,25 @@
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;DDPLUGINCHECKHEAPMEMORY_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<PrecompiledHeader>
</PrecompiledHeader>
<Optimization>MaxSpeed</Optimization>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;DDPLUGINCHECKHEAPMEMORY_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
Expand Down
35 changes: 21 additions & 14 deletions DD.Plugin.CheckHeapMemory/DLLMain.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,10 @@ __declspec(dllexport) TCHAR* __cdecl PluginName(void)
{
return L"CheckHeapMemory";
}
__declspec(dllexport) TCHAR* __cdecl PluginVersion(void)

__declspec(dllexport) char* __cdecl PluginVersion(void)
{
return L"0.1";
return __DATE__;
}

__declspec(dllexport) TCHAR* __cdecl PluginErrorMessage(void)
Expand All @@ -28,40 +29,46 @@ __declspec(dllexport) DWORD __cdecl PluginDebugCheck(int iWinVer)
return -1;
}

TCHAR *pHeapBuffer = (TCHAR*)HeapAlloc(hHeap,NULL,30),
*sTemp = (TCHAR*)malloc(4 * sizeof(TCHAR)),
*sTempCat = (TCHAR*)malloc(16 * sizeof(TCHAR));
TCHAR *pHeapBuffer = (TCHAR*)HeapAlloc(hHeap,NULL,30),
*sTemp = new TCHAR[4 * sizeof(TCHAR)], //(TCHAR*)malloc(4 * sizeof(TCHAR)),
*sTempCat = new TCHAR[20 * sizeof(TCHAR)]; //(TCHAR*)malloc(20 * sizeof(TCHAR));
if(pHeapBuffer == NULL || sTemp == NULL || sTempCat == NULL)
{
sErrorMessage = TEXT("HeapAlloc || malloc: failed to alloc memory");
return -1;
}

bool bDebugged = false;
int iHeapCount = 0,
iHeapCatCount = 0;
bool bDebugged = false;
int iHeapCount = 0,
iHeapCatCount = 0;

memset(sTempCat,0,16);
memset(sTempCat,0,20 * sizeof(TCHAR));
while(!bDebugged && iHeapCount <= 30)
{
if(iHeapCatCount <= 4)
if(iHeapCatCount <= 5)
{
wsprintf(sTemp,L"%04X",*(pHeapBuffer + iHeapCount));
if(wcsstr(sTemp,L"ABAB") != NULL || wcsstr(sTemp,L"FEEE") != NULL)
swprintf_s(sTemp,4 * sizeof(TCHAR),L"%04X",*(pHeapBuffer + iHeapCount));
if(wcsstr(sTemp,L"ABAB") != NULL || wcsstr(sTemp,L"FEEE") != NULL || wcsstr(sTemp,L"FDFD") != NULL)
{
wcscat(sTempCat,sTemp);
wcscat_s(sTempCat,20 * sizeof(TCHAR),sTemp);
iHeapCatCount++;
}
iHeapCount++;
}
else
{
if(wcsstr(sTempCat,L"FEEEABABABABABABABAB") != NULL)
if(wcsstr(sTempCat,L"FDFDFDFDABABABABABABABAB") != NULL)
bDebugged = true;
else if(wcsstr(sTempCat,L"FEEEABABABABABABABABFEEE") != NULL)
bDebugged = true;
}
}

HeapFree(hHeap,NULL,pHeapBuffer);
delete [] sTemp;
delete [] sTempCat;
//free(sTemp);
//free(sTempCat);
HeapDestroy(hHeap);

if(bDebugged)
Expand Down
3 changes: 2 additions & 1 deletion DD.Plugin.CheckHeapMemory/DLLMain.h
View file
Original file line number Diff line number Diff line change
@@ -1,11 +1,12 @@
#include <Windows.h>
#include <stdio.h>

#ifdef __cplusplus
extern "C" {
#endif

__declspec(dllexport) TCHAR* __cdecl PluginName(void);
__declspec(dllexport) TCHAR* __cdecl PluginVersion(void);
__declspec(dllexport) char* __cdecl PluginVersion(void);
__declspec(dllexport) TCHAR* __cdecl PluginErrorMessage(void);
__declspec(dllexport) DWORD __cdecl PluginDebugCheck(int iWinVer);

Expand Down
1 change: 1 addition & 0 deletions DD.Plugin.CheckRemoteDebuggerPresent/DD.Plugin.CheckRemoteDebuggerPresent.vcxproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@
<WarningLevel>Level3</WarningLevel>
<Optimization>Disabled</Optimization>
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;DDPLUGINCHECKREMOTEDEBUGGERPRESENT_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
Expand Down
4 changes: 2 additions & 2 deletions DD.Plugin.CheckRemoteDebuggerPresent/DLLMain.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ __declspec(dllexport) TCHAR* __cdecl PluginName(void)
{
return L"CheckRemoteDebuggerPresent";
}
__declspec(dllexport) TCHAR* __cdecl PluginVersion(void)
__declspec(dllexport) char* __cdecl PluginVersion(void)
{
return L"0.1";
return __DATE__;
}

__declspec(dllexport) TCHAR* __cdecl PluginErrorMessage(void)
Expand Down
2 changes: 1 addition & 1 deletion DD.Plugin.CheckRemoteDebuggerPresent/DLLMain.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ extern "C" {
#endif

__declspec(dllexport) TCHAR* __cdecl PluginName(void);
__declspec(dllexport) TCHAR* __cdecl PluginVersion(void);
__declspec(dllexport) char* __cdecl PluginVersion(void);
__declspec(dllexport) TCHAR* __cdecl PluginErrorMessage(void);
__declspec(dllexport) DWORD __cdecl PluginDebugCheck(int iWinVer);

Expand Down
1 change: 1 addition & 0 deletions DD.Plugin.DebugObject/DD.Plugin.DebugObject.vcxproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@
<WarningLevel>Level3</WarningLevel>
<Optimization>Disabled</Optimization>
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;DDPLUGINDEBUGOBJECT_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
Expand Down
4 changes: 2 additions & 2 deletions DD.Plugin.DebugObject/DLLMain.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,9 @@ __declspec(dllexport) TCHAR* __cdecl PluginName(void)
return L"DebugObject";
}

__declspec(dllexport) TCHAR* __cdecl PluginVersion(void)
__declspec(dllexport) char* __cdecl PluginVersion(void)
{
return L"0.1";
return __DATE__;
}

__declspec(dllexport) TCHAR* __cdecl PluginErrorMessage(void)
Expand Down
2 changes: 1 addition & 1 deletion DD.Plugin.DebugObject/DLLMain.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ extern "C" {
#endif

__declspec(dllexport) TCHAR* __cdecl PluginName(void);
__declspec(dllexport) TCHAR* __cdecl PluginVersion(void);
__declspec(dllexport) char* __cdecl PluginVersion(void);
__declspec(dllexport) TCHAR* __cdecl PluginErrorMessage(void);
__declspec(dllexport) DWORD __cdecl PluginDebugCheck(int iWinVer);

Expand Down
1 change: 1 addition & 0 deletions DD.Plugin.FindBadDrivers/DD.Plugin.FindBadDrivers.vcxproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@
<WarningLevel>Level3</WarningLevel>
<Optimization>Disabled</Optimization>
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;DDPLUGINFINDBADDRIVERS_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
Expand Down
4 changes: 2 additions & 2 deletions DD.Plugin.FindBadDrivers/DLLMain.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,9 @@ __declspec(dllexport) TCHAR* __cdecl PluginName(void)
return L"BadDriversList";
}

__declspec(dllexport) TCHAR* __cdecl PluginVersion(void)
__declspec(dllexport) char* __cdecl PluginVersion(void)
{
return L"0.1";
return __DATE__;
}

__declspec(dllexport) TCHAR* __cdecl PluginErrorMessage(void)
Expand Down
2 changes: 1 addition & 1 deletion DD.Plugin.FindBadDrivers/DLLMain.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ extern "C" {
#endif

__declspec(dllexport) TCHAR* __cdecl PluginName(void);
__declspec(dllexport) TCHAR* __cdecl PluginVersion(void);
__declspec(dllexport) char* __cdecl PluginVersion(void);
__declspec(dllexport) TCHAR* __cdecl PluginErrorMessage(void);
__declspec(dllexport) DWORD __cdecl PluginDebugCheck(int iWinVer);

Expand Down
1 change: 1 addition & 0 deletions DD.Plugin.FindBadProcesses/DD.Plugin.FindBadProcesses.vcxproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@
<WarningLevel>Level3</WarningLevel>
<Optimization>Disabled</Optimization>
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;DDPLUGINFINDBADPROCESSES_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
Expand Down
5 changes: 3 additions & 2 deletions DD.Plugin.FindBadProcesses/DLLMain.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,9 @@ __declspec(dllexport) TCHAR* __cdecl PluginName(void)
return L"BadProcessList";
}

__declspec(dllexport) TCHAR* __cdecl PluginVersion(void)
__declspec(dllexport) char* __cdecl PluginVersion(void)
{
return L"0.1";
return __DATE__;
}

__declspec(dllexport) TCHAR* __cdecl PluginErrorMessage(void)
Expand All @@ -28,6 +28,7 @@ __declspec(dllexport) DWORD __cdecl PluginDebugCheck(int iWinVer)
vProcList.push_back(L"windbg.exe");
vProcList.push_back(L"devenv.exe");
vProcList.push_back(L"ImmunityDebugger.exe");
vProcList.push_back(L"idaq.exe");

HANDLE hProcessSnap = NULL,hProc = NULL;
PROCESSENTRY32W pe32w;
Expand Down
2 changes: 1 addition & 1 deletion DD.Plugin.FindBadProcesses/DLLMain.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ extern "C" {
#endif

__declspec(dllexport) TCHAR* __cdecl PluginName(void);
__declspec(dllexport) TCHAR* __cdecl PluginVersion(void);
__declspec(dllexport) char* __cdecl PluginVersion(void);
__declspec(dllexport) TCHAR* __cdecl PluginErrorMessage(void);
__declspec(dllexport) DWORD __cdecl PluginDebugCheck(int iWinVer);

Expand Down
1 change: 1 addition & 0 deletions DD.Plugin.FindBadWindows/DD.Plugin.FindBadWindows.vcxproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@
<WarningLevel>Level3</WarningLevel>
<Optimization>Disabled</Optimization>
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;DDPLUGINFINDBADWINDOWS_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
Expand Down
9 changes: 5 additions & 4 deletions DD.Plugin.FindBadWindows/DLLMain.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,9 @@ __declspec(dllexport) TCHAR* __cdecl PluginName(void)
return L"BadWindowsList";
}

__declspec(dllexport) TCHAR* __cdecl PluginVersion(void)
__declspec(dllexport) char* __cdecl PluginVersion(void)
{
return L"0.1";
return __DATE__;
}

__declspec(dllexport) TCHAR* __cdecl PluginErrorMessage(void)
Expand All @@ -38,7 +38,7 @@ __declspec(dllexport) DWORD __cdecl PluginDebugCheck(int iWinVer)
BOOL CALLBACK EnumWindowsProc(HWND hwnd,LPARAM lParam)
{
vector<wstring> vWindowList;
TCHAR* sTitel = (TCHAR*)malloc(255);
TCHAR* sTitel = (TCHAR*)malloc(MAX_PATH);
bool* bDebugged = (bool*)lParam;

vWindowList.push_back(L"Immunity Debugger");
Expand All @@ -48,8 +48,9 @@ BOOL CALLBACK EnumWindowsProc(HWND hwnd,LPARAM lParam)
vWindowList.push_back(L"PhantOm");
vWindowList.push_back(L"o_O -");
vWindowList.push_back(L"Visual Studio");
vWindowList.push_back(L"WinDbgFrameClass");

GetWindowText(hwnd,sTitel,255);
GetWindowText(hwnd,sTitel,MAX_PATH);

for(size_t i = 0;i < vWindowList.size(); i++)
{
Expand Down
2 changes: 1 addition & 1 deletion DD.Plugin.FindBadWindows/DLLMain.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ extern "C" {
#endif

__declspec(dllexport) TCHAR* __cdecl PluginName(void);
__declspec(dllexport) TCHAR* __cdecl PluginVersion(void);
__declspec(dllexport) char* __cdecl PluginVersion(void);
__declspec(dllexport) TCHAR* __cdecl PluginErrorMessage(void);
__declspec(dllexport) DWORD __cdecl PluginDebugCheck(int iWinVer);

Expand Down
1 change: 1 addition & 0 deletions DD.Plugin.HardwareBreakpoint/DD.Plugin.HardwareBreakpoint.vcxproj
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@
<WarningLevel>Level3</WarningLevel>
<Optimization>Disabled</Optimization>
<PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;DDPLUGINHARDWAREBREAKPOINT_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
Expand Down
4 changes: 2 additions & 2 deletions DD.Plugin.HardwareBreakpoint/DLLMain.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,9 @@ __declspec(dllexport) TCHAR* __cdecl PluginName(void)
return L"Hardware Breakpoints";
}

__declspec(dllexport) TCHAR* __cdecl PluginVersion(void)
__declspec(dllexport) char* __cdecl PluginVersion(void)
{
return L"0.1";
return __DATE__;
}

__declspec(dllexport) TCHAR* __cdecl PluginErrorMessage(void)
Expand Down
Loading

0 comments on commit 308f7db

Please sign in to comment.