aboutsummaryrefslogtreecommitdiff
path: root/MemDriverLib
diff options
context:
space:
mode:
authorToni Uhlig <matzeton@googlemail.com>2019-06-27 21:07:21 +0200
committerToni Uhlig <matzeton@googlemail.com>2019-06-27 21:07:21 +0200
commitc4a6681b2796b9ea6bbd15e6a9870f1d3b10c5c2 (patch)
treee946d2c03c517b41a296ebe0f02088ada502c742 /MemDriverLib
parentbd3ecb39a53d02e65ea635261faad799538a59c0 (diff)
MemDriverLib + MemDriverWeb skeletons
Diffstat (limited to 'MemDriverLib')
-rw-r--r--MemDriverLib/KInterface.h120
-rw-r--r--MemDriverLib/MemDriverLib.vcxproj2
-rw-r--r--MemDriverLib/MemDriverLib.vcxproj.filters4
3 files changed, 3 insertions, 123 deletions
diff --git a/MemDriverLib/KInterface.h b/MemDriverLib/KInterface.h
deleted file mode 100644
index a8a7ee2..0000000
--- a/MemDriverLib/KInterface.h
+++ /dev/null
@@ -1,120 +0,0 @@
-#pragma once
-
-#include "Driver.h"
-
-#include <vector>
-#include <Windows.h>
-
-#define DEFAULT_TIMEOUT 2500
-#define INVALID_NTSTATUS (UINT32)-1
-
-typedef enum SendRecvReturn {
- SRR_INVALID = 0, SRR_SIGNALED, SRR_TIMEOUT, SRR_ERR_UEVENT, SRR_ERR_KEVENT, SRR_ERR_HEADER
-} SendRecvReturn;
-
-class KInterface
-{
-public:
- static KInterface& getInstance()
- {
- static KInterface instance;
- return instance;
- }
- KInterface();
- KInterface(KInterface const&) = delete;
- void operator=(KInterface const&) = delete;
-
- bool Init();
- bool Handshake();
- bool Ping();
- bool Pages(HANDLE targetPID,
- std::vector<MEMORY_BASIC_INFORMATION>& dest,
- PVOID start_address = NULL);
- bool Modules(HANDLE targetPID,
- std::vector<MODULE_DATA>& dest);
- bool Exit();
- bool RPM(HANDLE targetPID, PVOID address, BYTE *buf, SIZE_T size,
- PKERNEL_READ_REQUEST result);
- bool WPM(HANDLE targetPID, PVOID address, BYTE *buf, SIZE_T size,
- PKERNEL_WRITE_REQUEST result);
-
- PVOID getBuffer();
- HANDLE getKHandle();
- HANDLE getUHandle();
- UINT32 getLastPingValue();
- UINT32 getLastNtStatus();
- SendRecvReturn RecvWait(DWORD timeout = DEFAULT_TIMEOUT);
-
-private:
- SendRecvReturn SendRecvWait(UINT32 type, DWORD timeout = DEFAULT_TIMEOUT);
-
- PVOID m_shmem = NULL;
- HANDLE m_kevent = NULL, m_uevent = NULL;
-
- UINT32 m_last_ping_value = 0;
- UINT32 m_last_ntstatus = INVALID_NTSTATUS;
-};
-
-class KMemory
-{
-public:
- template <class T>
- static T Rpm(HANDLE targetPID, PVOID address) {
- T buf;
- if (!KInterface::getInstance().RPM(targetPID, address, (BYTE*)&buf, sizeof buf, NULL))
- throw std::runtime_error("KMemory RPM failed");
- return buf;
- }
- template <class T>
- static void Wpm(HANDLE targetPID, PVOID address, T *buf) {
- if (!KInterface::getInstance().WPM(targetPID, address, (BYTE*)buf, sizeof *buf, NULL))
- throw std::runtime_error("KMemory WPM failed");
- }
-};
-
-class KMemoryBuf
-{
-public:
- template <size_t SIZE>
- static SSIZE_T Rpm(HANDLE targetPID, PVOID address, BYTE *dest) {
- KERNEL_READ_REQUEST rr = { 0 };
- if (!KInterface::getInstance().RPM(targetPID, address, &dest[0], SIZE, &rr))
- return -1;
- return rr.SizeRes;
- }
- template <size_t SIZE>
- static SSIZE_T Wpm(HANDLE targetPID, PVOID address, BYTE *dest) {
- KERNEL_WRITE_REQUEST wr = { 0 };
- if (!KInterface::getInstance().WPM(targetPID, address, &dest[0], SIZE, &wr))
- return -1;
- return wr.SizeRes;
- }
-};
-
-template <SIZE_T SIZE>
-struct Diff {
- BYTE current_buffer[SIZE];
- BYTE old_buffer[SIZE];
- std::vector<std::pair<SIZE_T, SIZE_T>> diffs;
-};
-
-class KScan
-{
-public:
- template <typename T, SIZE_T SIZE>
- static SSIZE_T ScanSimple(HANDLE targetPID, PVOID start_address, SIZE_T max_scansize, T(&a)[SIZE])
- {
- return KScanSimple(targetPID, start_address, max_scansize, a, sizeof T * SIZE);
- }
- template <SIZE_T SIZE>
- static SSIZE_T BinDiffSimple(HANDLE targetPID, PVOID start_address, Diff<SIZE> *diff)
- {
- return KBinDiffSimple(targetPID, start_address, diff->current_buffer,
- diff->old_buffer, SIZE, &diff->diffs);
- }
-private:
- static SSIZE_T KScanSimple(HANDLE targetPID, PVOID start_address, SIZE_T max_scansize,
- PVOID scanbuf, SIZE_T scanbuf_size);
- static SSIZE_T KBinDiffSimple(HANDLE targetPid, PVOID start_address,
- BYTE *curbuf, BYTE *oldbuf, SIZE_T siz, std::vector<std::pair<SIZE_T, SIZE_T>> *diffs);
-}; \ No newline at end of file
diff --git a/MemDriverLib/MemDriverLib.vcxproj b/MemDriverLib/MemDriverLib.vcxproj
index cd962af..578e5e8 100644
--- a/MemDriverLib/MemDriverLib.vcxproj
+++ b/MemDriverLib/MemDriverLib.vcxproj
@@ -150,7 +150,7 @@
</ItemDefinitionGroup>
<ItemGroup>
<ClInclude Include="..\include\Driver.h" />
- <ClInclude Include="KInterface.h" />
+ <ClInclude Include="..\include\KInterface.h" />
<ClInclude Include="stdafx.h" />
<ClInclude Include="targetver.h" />
</ItemGroup>
diff --git a/MemDriverLib/MemDriverLib.vcxproj.filters b/MemDriverLib/MemDriverLib.vcxproj.filters
index 0afe07b..b674adc 100644
--- a/MemDriverLib/MemDriverLib.vcxproj.filters
+++ b/MemDriverLib/MemDriverLib.vcxproj.filters
@@ -21,10 +21,10 @@
<ClInclude Include="targetver.h">
<Filter>Header Files</Filter>
</ClInclude>
- <ClInclude Include="KInterface.h">
+ <ClInclude Include="..\include\Driver.h">
<Filter>Header Files</Filter>
</ClInclude>
- <ClInclude Include="..\include\Driver.h">
+ <ClInclude Include="..\include\KInterface.h">
<Filter>Header Files</Filter>
</ClInclude>
</ItemGroup>