Example #1
0
        private void OnFunctionCalled(NktHook hook, NktProcess process, NktHookCallInfo hookCallInfo)
        {
            NktStackTrace    stack  = hookCallInfo.StackTrace();
            NktProcessMemory memory = _spyMgr.ProcessMemoryFromPID(_process.Id);

            UInt32 StackOpcodeSize = 50;

            byte[] StackOpcode = new byte[StackOpcodeSize];

            for (UInt32 n = 0; n < StackOpcodeSize; n++)
            {
                StackOpcode[n] = (byte)memory.Read((IntPtr)((UInt64)stack.Address(0) - StackOpcodeSize + n), eNktDboFundamentalType.ftUnsignedByte);
            }

            UInt64 actualAddr  = (UInt64)hookCallInfo.get_Register(eNktRegister.asmRegEip);
            UInt64 nInstrSize  = (UInt64)GetInstrSize(StackOpcode, StackOpcodeSize);
            UInt64 callingAddr = (UInt64)stack.Address(0) - nInstrSize;

            string str = "From: 0x" + callingAddr.ToString("x") + "    To: 0x" + actualAddr.ToString("x") + "\n";

            Output(str, false);

            actualAddr  -= SecStartAddress;
            callingAddr -= SecStartAddress;

            CROSSREF crossref = new CROSSREF();

            crossref.From = callingAddr;
            crossref.To   = actualAddr;
            CrossRefSet.Add(crossref);
        }
Example #2
0
        private void comboBoxModules_SelectedIndexChanged(object sender, EventArgs e)
        {
            comboBoxModules.Enabled = false;

            int selected = comboBoxModules.SelectedIndex;
            List <NktModule> ModuleList = (List <NktModule>)comboBoxModules.Tag;
            NktModule        module     = ModuleList.ElementAt(selected);

            NktStructPESections sections = module.Sections();
            int nSectionCode             = 0;

            for (int n = 0; n < sections.Count; n++)
            {
                if (sections.get_Name(n) == ".text")
                {
                    nSectionCode = n;
                    break;
                }
            }

            SecStartAddress = (UInt64)sections.get_StartAddress(nSectionCode);
            SecEndAddress   = (UInt64)sections.get_EndAddress(nSectionCode);

            ModStartAddress = (UInt64)GetModuleBase(_process.Name);
            ModEndAddress   = ModStartAddress + (UInt64)GetModuleSize(_process.Name);

            NktProcessMemory memory = _spyMgr.ProcessMemoryFromPID(_process.Id);

            uint  nvtable    = 0;
            ulong tmpAddress = 0;
            VTBL  vtbl;

            vtbl.Address    = 0;
            vtbl.ValuesList = null;

            for (UInt64 CurAddress = ModStartAddress; CurAddress < ModEndAddress; CurAddress++)
            {
                progressBar.Value = (int)(CurAddress * 100 / ModEndAddress);

                UInt32 CurValue = (UInt32)memory.Read((IntPtr)CurAddress, eNktDboFundamentalType.ftUnsignedDoubleWord);

                if (CurValue >= SecStartAddress && CurValue <= SecEndAddress)
                {
                    UInt32 PreOpcodeSize = 50;
                    byte[] PreOpcode     = new byte[PreOpcodeSize];
                    for (UInt32 n = 0; n < PreOpcodeSize; n++)
                    {
                        PreOpcode[n] =
                            (byte)memory.Read((IntPtr)(CurValue - PreOpcodeSize + n), eNktDboFundamentalType.ftUnsignedByte);
                    }

                    UInt32 PostOpcodeSize = 50;
                    byte[] PostOpcode     = new byte[PostOpcodeSize];
                    for (UInt32 n = 0; n < PostOpcodeSize; n++)
                    {
                        PostOpcode[n] =
                            (byte)memory.Read((IntPtr)(CurValue + n), eNktDboFundamentalType.ftUnsignedByte);
                    }

                    if (isValidPreOpCode(PreOpcode, PreOpcodeSize) && isValidPostOpCode(PostOpcode, PostOpcodeSize))
                    {
                        if ((CurAddress - tmpAddress) > 500 || tmpAddress == 0) //este valor lo podemos ir adaptando, lo correcto seria (CurAddress - tmpAddress != 4)
                        {
                            vtbl            = new VTBL();
                            vtbl.Address    = CurAddress;
                            vtbl.ValuesList = new List <UInt64>();
                            VTableList.Add(vtbl);
                            nvtable++;
                        }

                        tmpAddress = CurAddress;

                        vtbl.ValuesList.Add((UInt64)SkipHook((IntPtr)CurValue, _process.Id));
                    }
                }
            }

            progressBar.Value = 100;

            for (int n = 0; n < VTableList.Count; n++)
            {
                string vtblname = "VTBL_" + n.ToString("X") + "_" + VTableList.ElementAt(n).Address.ToString("X") + "_" + VTableList.ElementAt(n).ValuesList.Count;

                listBoxVTBL.Items.Add(vtblname);
            }


            btnHook.Enabled  = true;
            btnClear.Enabled = true;
        }