Some stuff since I'm bored... menu

Shout-Out

User Tag List

Page 1 of 2 12 LastLast
Results 1 to 15 of 16
  1. #1
    Apoc's Avatar Angry Penguin
    Reputation
    1388
    Join Date
    Jan 2008
    Posts
    2,750
    Thanks G/R
    0/13
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Some stuff since I'm bored...

    Got bored. Created an NtQueryVirtualMemory hook, and VEH wrapper for C#.

    Yes. I was THAT bored.

    At any rate; here you go, for the leechers!

    Code:
    using System;
    using System.Runtime.InteropServices;
    
    using WhiteMagic;
    
    using Win32InternalHooks.Win32;
    
    namespace Win32InternalHooks
    {
        public enum MemoryInformationClass : uint
        {
            MemoryBasicInformation = 0,
            MemoryWorkingSetList = 1,
            MemorySectionName = 2,
            MemoryBasicVlmInformation = 3
        }
    
        public class QueryVirtualMemory : IDisposable
        {
            #region Delegates
    
            [UnmanagedFunctionPointer(CallingConvention.Winapi)]
            public delegate int NtQueryVirtualMemoryDelegate(
                IntPtr processHandle, IntPtr baseAddress, MemoryInformationClass memoryInformationClass,
                IntPtr buffer, uint length, IntPtr returnLength);
    
            #endregion
    
            private readonly Magic _magic;
            private readonly IntPtr _ntdll;
            private readonly IntPtr _queryVirtualMemory;
    
            public QueryVirtualMemory()
            {
                _magic = new Magic();
    
                _ntdll = LibraryImports.GetModuleHandle("ntdll.dll");
                if (_ntdll == IntPtr.Zero)
                {
                    Console.WriteLine("Could not find a handle to ntdll, loading the library!");
                    _ntdll = LibraryImports.LoadLibrary("ntdll.dll");
                }
                _queryVirtualMemory = LibraryImports.GetProcAddress(_ntdll, "NtQueryVirtualMemory");
    
                NtQueryVirtualMemory = _magic.RegisterDelegate<NtQueryVirtualMemoryDelegate>(_queryVirtualMemory);
                NtQueryVirtualMemoryHook = NtQueryVirtualMemoryHookHandler;
                _magic.Detours.CreateAndApply(NtQueryVirtualMemory, NtQueryVirtualMemoryHook, "NtQueryVirtualMemory");
            }
    
            private NtQueryVirtualMemoryDelegate NtQueryVirtualMemory { get; set; }
            private NtQueryVirtualMemoryDelegate NtQueryVirtualMemoryHook { get; set; }
    
            public IntPtr QueryVirtualMemoryAddress { get { return _queryVirtualMemory; } }
    
            #region IDisposable Members
    
            public void Dispose()
            {
                _magic.Detours.RemoveAll();
                GC.SuppressFinalize(this);
            }
    
            #endregion
    
            private int NtQueryVirtualMemoryHookHandler(IntPtr processhandle, IntPtr baseaddress,
                                                        MemoryInformationClass memoryinformationclass, IntPtr buffer, uint length,
                                                        IntPtr returnlength)
            {
                string msg = string.Format("ProcessHandle: {0}, BaseAddress: {1}, MIC: {2}, Buffer: {3}, Length: {4}, ReturnLength: {5}",
                                           processhandle.ToString("X"), baseaddress.ToString("X"), memoryinformationclass,
                                           buffer.ToString("X"), length, returnlength);
                Console.WriteLine(msg);
    
                return
                    (int)
                    _magic.Detours["NtQueryVirtualMemory"].CallOriginal(processhandle, baseaddress, memoryinformationclass, buffer, length,
                                                                        returnlength);
            }
    
            ~QueryVirtualMemory()
            {
                Dispose();
            }
        }
    }
    Code:
    using System;
    using System.Runtime.InteropServices;
    
    using Win32InternalHooks.Structs;
    
    namespace Win32InternalHooks
    {
        public class VectoredExceptionHandler : IDisposable
        {
            #region Delegates
    
            /// <summary>
            /// A callback handler for a vectored exception.
            /// </summary>
            /// <param name="exceptionPointers">A pointer to a <see cref="ExceptionPointers"/> struct instance.</param>
            /// <returns>-1 if you wish to return control back to where the exception occurred, 0 if you want to continue the handler search. [Typically, return -1]</returns>
            [UnmanagedFunctionPointer(CallingConvention.Winapi)]
            public delegate int VectoredHandler(IntPtr exceptionPointers);
    
            #endregion
    
            public VectoredExceptionHandler(VectoredHandler handler)
            {
                IntPtr handle = AddVectoredExceptionHandler(1, Marshal.GetFunctionPointerForDelegate(handler));
    
                if (handle == IntPtr.Zero)
                {
                    throw new Exception("Failed to set the VEH!");
                }
    
                Handle = handle;
            }
    
            public IntPtr Handle { get; private set; }
    
            #region IDisposable Members
    
            public void Dispose()
            {
                Remove();
                GC.SuppressFinalize(this);
            }
    
            #endregion
    
            public ExceptionPointers GetExceptionPointers(IntPtr address)
            {
                return (ExceptionPointers) Marshal.PtrToStructure(address, typeof (ExceptionPointers));
            }
    
            [DllImport("kernel32.dll")]
            private static extern IntPtr AddVectoredExceptionHandler(uint firstHandler, IntPtr vectoredHandler);
    
            [DllImport("kernel32.dll")]
            private static extern uint RemoveVectoredExceptionHandler(IntPtr handler);
    
            public void Remove()
            {
                if (Handle != IntPtr.Zero)
                {
                    RemoveVectoredExceptionHandler(Handle);
                }
            }
    
            ~VectoredExceptionHandler()
            {
                Dispose();
            }
        }
    }
    Code:
        [StructLayout(LayoutKind.Sequential)]
        public struct ExceptionPointers
        {
            public IntPtr ExceptionRecord;
            public IntPtr ContextRecord;
    
            public ExceptionRecord GetExceptionRecord()
            {
                return (ExceptionRecord)Marshal.PtrToStructure(ExceptionRecord, typeof(ExceptionRecord));
            }
    
            public Context GetContextRecord()
            {
                return (Context)Marshal.PtrToStructure(ContextRecord, typeof(Context));
            }
        }
    
        [StructLayout(LayoutKind.Sequential)]
        public struct Context
        {
            public uint ContextFlags;
            public uint Dr0;
            public uint Dr1;
            public uint Dr2;
            public uint Dr3;
            public uint Dr6;
            public uint Dr7;
            public FloatingSaveArea FloatSave;
            public uint SegGs;
            public uint SegFs;
            public uint SegEs;
            public uint SegDs;
            public uint Edi;
            public uint Esi;
            public uint Ebx;
            public uint Edx;
            public uint Ecx;
            public uint Eax;
            public uint Ebp;
            public uint Eip;
            public uint SegCs;
            public uint EFlags;
            public uint Esp;
            public uint SegSs;
    
            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 512, ArraySubType = UnmanagedType.I1)]
            public byte[] ExtendedRegisters;
        }
    
        [StructLayout(LayoutKind.Sequential)]
        public struct FloatingSaveArea
        {
            public uint ControlWord;
            public uint StatusWord;
            public uint TagWord;
            public uint ErrorOffset;
            public uint ErrorSelector;
            public uint DataOffset;
            public uint DataSelector;
    
            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 80, ArraySubType = UnmanagedType.I1)]
            public byte[] RegisterArea;
    
            public uint Cr0NpxState;
        }
    
        [StructLayout(LayoutKind.Sequential)]
        public struct MemoryBasicInformation
        {
            public IntPtr BaseAddress;
            public IntPtr AllocationBase;
            public uint AllocationProtect;
            public uint RegionSize;
            public uint State;
            public uint Protect;
            public uint Type;
        }
    
        [StructLayout(LayoutKind.Explicit)]
        public struct ProcessorInfoUnion
        {
            [FieldOffset(0)]
            internal uint OemId;
            [FieldOffset(0)]
            internal ushort ProcessorArchitecture;
            [FieldOffset(2)]
            internal ushort Reserved;
        }
    
        [StructLayout(LayoutKind.Sequential)]
        public struct SystemInfo
        {
            public ProcessorInfoUnion ProcessorInfoUnion;
            public uint PageSize;
            public uint MinimumApplicationAddress;
            public uint MaximumApplicationAddress;
            public uint ActiveProcessorMask;
            public uint NumberOfProcessors;
            public uint ProcessorType;
            public uint AllocationGranularity;
            public uint ProcessorLevel;
            public uint ProcessorRevision;
        }
    Code:
    using System;
    using System.Runtime.InteropServices;
    
    namespace Win32InternalHooks.Win32
    {
        class LibraryImports
        {
            [DllImport("kernel32", SetLastError = true)]
            public static extern IntPtr LoadLibrary(string lpFileName);
    
            [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
            public static extern IntPtr GetModuleHandle(string lpModuleName);
    
            [DllImport("kernel32.dll", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
            public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
    
            [DllImport("kernel32.dll", SetLastError = true)]
            public static extern bool FreeLibrary(IntPtr hModule);
        }
    }
    Enjoy you leeching ****s!

    Some stuff since I'm bored...
  2. #2
    Cypher's Avatar Kynox's Sister's Pimp
    Reputation
    1358
    Join Date
    Apr 2006
    Posts
    5,368
    Thanks G/R
    0/6
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Failure.

    Why don't you actually implement the NtQueryVirtualMemory hook if you're so bored? Noob.

    At least then I'll be able to complain too because you're bound to make mistakes.

  3. #3
    Robske's Avatar Contributor
    Reputation
    305
    Join Date
    May 2007
    Posts
    1,062
    Thanks G/R
    3/4
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Nomnomnmonomnonmonm

    Robske uses leech.

    It was super effective!

    Thanks for C#haring.
    "Always code as if the guy who ends up maintaining your code will be a violent psychopath who knows where you live." - Martin Golding
    "I cried a little earlier when I had to poop" - Sku

  4. #4
    Cypher's Avatar Kynox's Sister's Pimp
    Reputation
    1358
    Join Date
    Apr 2006
    Posts
    5,368
    Thanks G/R
    0/6
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by Robske View Post

    Thanks for C#haring.
    Oh god, that was painful to even read. >_>

  5. #5
    flo8464's Avatar Active Member
    Reputation
    30
    Join Date
    Apr 2009
    Posts
    434
    Thanks G/R
    0/0
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    I think a thread for code snippets would make sense, imo even more than the Screenshots-thread.

    Besides Cypher who makes at least one thread per month with some neat code, there are also other sharing stuff. I also would share some of my stuff, I only don't really want to open a thread for things for which I don't know if someone cares.

    The rest of this subforum is kinda degenerated, reversing WoW doesn't offer many secrets anymore so most threads are about general coding/repition of old questions anyway.
    Hey, it compiles! Ship it!

  6. #6
    namreeb's Avatar Legendary

    Reputation
    668
    Join Date
    Sep 2008
    Posts
    1,029
    Thanks G/R
    8/222
    Trade Feedback
    0 (0%)
    Mentioned
    9 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by Cypher View Post
    Failure.

    Why don't you actually implement the NtQueryVirtualMemory hook if you're so bored? Noob.

    At least then I'll be able to complain too because you're bound to make mistakes.
    This post is evidence you don't need a reason to complain.

  7. #7
    Cypher's Avatar Kynox's Sister's Pimp
    Reputation
    1358
    Join Date
    Apr 2006
    Posts
    5,368
    Thanks G/R
    0/6
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by bierstud View Post
    This post is evidence you don't need a reason to complain.
    Who needs evidence? I never claimed otherwise.

  8. #8
    dekz's Avatar Member
    Reputation
    5
    Join Date
    Jan 2008
    Posts
    37
    Thanks G/R
    0/0
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by flo8464 View Post
    I think a thread for code snippets would make sense, imo even more than the Screenshots-thread.

    Besides Cypher who makes at least one thread per month with some neat code, there are also other sharing stuff. I also would share some of my stuff, I only don't really want to open a thread for things for which I don't know if someone cares.

    The rest of this subforum is kinda degenerated, reversing WoW doesn't offer many secrets anymore so most threads are about general coding/repition of old questions anyway.
    Or you could just write a crawler to grab every code tag? Lets not make it easier for leechers?

  9. #9
    wraithZX's Avatar Active Member
    Reputation
    43
    Join Date
    May 2007
    Posts
    122
    Thanks G/R
    0/1
    Trade Feedback
    1 (100%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    If you're still bored, watch this and try not to laugh:

    [ame=http://www.youtube.com/watch?v=8zEQhhaJsU4]YouTube - Steve Ballmer - developers musicvideo[/ame]

  10. #10
    Cypher's Avatar Kynox's Sister's Pimp
    Reputation
    1358
    Join Date
    Apr 2006
    Posts
    5,368
    Thanks G/R
    0/6
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by wraithZX View Post
    If you're still bored, watch this and try not to laugh:

    YouTube - Steve Ballmer - developers musicvideo
    Steve Ballmer is my hero.

    True story.

  11. #11
    snigelmannen's Avatar Member
    Reputation
    27
    Join Date
    Jul 2007
    Posts
    318
    Thanks G/R
    0/0
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    How can he get so sweaty and motivated to represent a company that still haven't found a better solution to BSOD?
    Last edited by snigelmannen; 11-15-2009 at 11:57 AM.
    " Spy sappin mah sentry! "

  12. #12
    Xeranor's Avatar Member
    Reputation
    71
    Join Date
    Aug 2009
    Posts
    32
    Thanks G/R
    0/0
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by wraithZX View Post
    If you're still bored, watch this and try not to laugh:

    YouTube - Steve Ballmer - developers musicvideo
    its impossible

  13. #13
    lanman92's Avatar Active Member
    Reputation
    50
    Join Date
    Mar 2007
    Posts
    1,033
    Thanks G/R
    0/1
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Off-topic(somewhat), but is there any chance you'll show us how to hook functions with vararg parameters? Without writing native code to hook it.

  14. #14
    Robske's Avatar Contributor
    Reputation
    305
    Join Date
    May 2007
    Posts
    1,062
    Thanks G/R
    3/4
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by lanman92 View Post
    Off-topic(somewhat), but is there any chance you'll show us how to hook functions with vararg parameters? Without writing native code to hook it.
    I've hooked Framescript_SignalEvents succesfully, but my methods to do so are very alarming. (It screams YOUR DOIN IT WRONG)

    Code:
            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
            protected delegate int Framescript_SignalEvent(int Event, IntPtr pFormat, SArguments Args);
    pFormat points to a string that contains the formatting for the passed arguments, seperated by the % char. (Example: %s%d%d%s%f would indicate 5 arguments: String Int Int String Double)
    If it's null, there obviously aren't any arguments to that event.

    SArguments is... and brace your self for ugly:

    Code:
                [StructLayout(LayoutKind.Sequential)]
                public struct SArguments
                {
                    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 14)]
                    public uint[] Arguments;
                }
    Believe me when I say this really was my last resort.
    Last edited by Robske; 11-15-2009 at 08:10 PM.
    "Always code as if the guy who ends up maintaining your code will be a violent psychopath who knows where you live." - Martin Golding
    "I cried a little earlier when I had to poop" - Sku

  15. #15
    Cypher's Avatar Kynox's Sister's Pimp
    Reputation
    1358
    Join Date
    Apr 2006
    Posts
    5,368
    Thanks G/R
    0/6
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by snigelmannen View Post
    How can he get so sweaty and motivated to represent a company that still haven't found a better solution to BSOD?
    What the **** are you talking about? Most BSODs are caused by poorly written drivers, NOT Microsoft's code.

    You can go look up the statistics if you don't believe me.

    Besides, I haven't had a single BSOD caused by Windows (only BSODs caused by me ****ing with the kernel in ways I shouldn't be) since upgrading to Vista (and then 7).

Page 1 of 2 12 LastLast

Similar Threads

  1. Need help with some stuff
    By jordy in forum World of Warcraft Emulator Servers
    Replies: 15
    Last Post: 06-14-2008, 04:17 AM
  2. Help with some stuff plz
    By Minichili in forum World of Warcraft Emulator Servers
    Replies: 20
    Last Post: 04-03-2008, 12:56 PM
  3. [Collection]Some Stuff from my HD
    By Grindelo in forum World of Warcraft Model Editing
    Replies: 1
    Last Post: 01-21-2008, 11:00 AM
  4. [Spell Swaps] Pally spells to some stuff
    By mmmyowned in forum World of Warcraft Model Editing
    Replies: 0
    Last Post: 12-06-2007, 09:49 PM
  5. Need some stuff for private server
    By xredzx01 in forum World of Warcraft General
    Replies: 2
    Last Post: 08-11-2006, 06:31 PM
All times are GMT -5. The time now is 02:01 AM. Powered by vBulletin® Version 4.2.3
Copyright © 2025 vBulletin Solutions, Inc. All rights reserved. User Alert System provided by Advanced User Tagging (Pro) - vBulletin Mods & Addons Copyright © 2025 DragonByte Technologies Ltd.
Google Authenticator verification provided by Two-Factor Authentication (Free) - vBulletin Mods & Addons Copyright © 2025 DragonByte Technologies Ltd.
Digital Point modules: Sphinx-based search