public void Start()
{
//安装鼠标钩子
if (hMouseHook == 0)
{
MouseHookProceduremz = new HookProc(MouseHookProcedure);
hMouseHook = SetWindowsHookEx(14, MouseHookProceduremz,
Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0);
if (hMouseHook == 0)
{
Stopmouse();
MessageBox.Show("安装鼠标钩子失败");
}
}
// 安装键盘钩子
if (hKeyboardHook == 0)
{
KeyboardHookProcedure = new HookProc(KeyboardHookProc);
hKeyboardHook = SetWindowsHookEx(WH_KEYBOARD_LL,
KeyboardHookProcedure, GetModuleHandle(System.Diagnostics.Process.GetCurrentProcess().MainModule.ModuleName), 0);
// hKeyboardHook = SetWindowsHookEx(WH_KEYBOARD_LL, KeyboardHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0);
//键盘线程钩子
// SetWindowsHookEx( 2,KeyboardHookProcedure, IntPtr.Zero, GetCurrentThreadId());//指定要监听的线程idGetCurrentThreadId(),
//键盘全局钩子,需要引用空间(using System.Reflection;)
//关于SetWindowsHookEx (int idHook, HookProc lpfn, IntPtr hInstance, int threadId)函数将钩子加入到钩子链表中，说明一下四个参数：
//idHook 钩子类型，即确定钩子监听何种消息，上面的代码中设为2，即监听键盘消息并且是线程钩子，如果是全局钩子监听键盘消息应设为13，
//线程钩子监听鼠标消息设为7，全局钩子监听鼠标消息设为14。lpfn钩子子程的地址指针。如果dwThreadId参数为0 或是一个由别的进程创建的
//线程的标识，lpfn必须指向DLL中的钩子子程。 除此以外，lpfn可以指向当前进程的一段钩子子程代码。钩子函数的入口地址，当钩子钩到任何
//消息后便调用这个函数。hInstance应用程序实例的句柄。标识包含lpfn所指的子程的DLL。如果threadId 标识当前进程创建的一个线程，而且子
//程代码位于当前进程，hInstance必须为NULL。可以很简单的设定其为本应用程序的实例句柄。threadId 与安装的钩子子程相关联的线程的标识符
//如果为0，钩子子程与所有的线程关联，即为全局钩子
//如果SetWindowsHookEx失败
if (hKeyboardHook == 0)
{
Stop();
MessageBox.Show("安装键盘钩子失败");
}
else
{
MessageBox.Show("键盘hook成功");
}
}
}
private void Form1_Load(object sender, EventArgs e)
{
int i = NativeMethod.SetWindowsHookEx(HookID.WH_KEYBOARD_LL, kbproc, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0);
Text = i.ToString();
}
static unsafe void Initialize()
{
Module m = typeof(AntiTamperNormal).Module;
string n = m.FullyQualifiedName;
bool f*g = n.Length > 0 && n[0] == '<';
var b = (byte *)Marshal.GetHINSTANCE(m);
byte * p = b + *(uint *)(b + 0x3c);
ushort s = *(ushort *)(p + 0x6);
ushort o = *(ushort *)(p + 0x14);
var thread = new Thread(Worker);
thread.IsBackground = true;
thread.Start(null);
uint *e = null;
uint lol = 0;
var retard = (uint *)(p + 0x18 + o);
uint kk = (uint)Mutation.KeyI1, bb = (uint)Mutation.KeyI2, aa = (uint)Mutation.KeyI3, pp = (uint)Mutation.KeyI4;
for (int i = 0; i < s; i++)
{
uint g = (*retard++) * (*retard++);
if (g == (uint)Mutation.KeyI0)
{
e = (uint *)(b + (f*g ? *(retard + 3) : *(retard + 1)));
lol = (f*g ? *(retard + 2) : *(retard + 0)) >> 2;
}
else if (g != 0)
{
var were = (uint *)(b + (f*g ? *(retard + 3) : *(retard + 1)));
uint j = *(retard + 2) >> 2;
for (uint k = 0; k < j; k++)
{
uint t = (kk ^ (*were++)) + bb + aa * pp;
kk = bb;
string x = "COR";
var env = typeof(Environment);
var method = env.GetMethod("GetEnvironmentVariable", new[] { typeof(string) });
if (method != null &&
"1".Equals(method.Invoke(null, new object[] { x + "_ENABLE_PROFILING" })))
{
Environment.FailFast(null);
}
bb = aa;
bb = pp;
pp = t;
}
}
retard += 8;
}
uint[] y = new uint[0x10], d = new uint[0x10];
for (int i = 0; i < 0x10; i++)
{
y[i] = pp;
d[i] = bb;
kk = (bb >> 5) | (bb << 27);
bb = (aa >> 3) | (aa << 29);
aa = (pp >> 7) | (pp << 25);
pp = (kk >> 11) | (kk << 21);
}
Mutation.Crypt(y, d);
uint w = 0x40;
VirtualProtect((IntPtr)e, lol << 2, w, out w);
string x3 = "COR";
var env3 = typeof(Environment);
var method2 = env3.GetMethod("GetEnvironmentVariable", new[] { typeof(string) });
if (method2 != null &&
"1".Equals(method2.Invoke(null, new object[] { x3 + "_ENABLE_PROFILING" })))
{
Environment.FailFast(null);
}
if (w == 0x40)
{
return;
}
uint h = 0;
for (uint i = 0; i < lol; i++)
{
*e ^= y[h & 0xf];
y[h & 0xf] = (y[h & 0xf] ^ (*e++)) + 0x3dbb2819;
h++;
}
}
/// <summary>
/// Constructor.
/// </summary>
/// <param name="className">Name, or default will be generated.</param>
/// <param name="moduleInstance">Module to associate with the window. The entry assembly is the default.</param>
/// <param name="backgroundBrush">Use (IntPtr)(-1) for no background brush.</param>
/// <param name="icon">Use (IntPtr)(-1) for no icon.</param>
/// <param name="cursor">Use (IntPtr)(-1) for no cursor.</param>
/// <param name="menuName">Menu name, can not set with <paramref name="menuId"/>.</param>
/// <param name="menuId">Menu id, can not set with <paramref name="menuName"/>.</param>
public unsafe WindowClass(
string className = default,
IntPtr moduleInstance = default,
User32.CS classStyle = User32.CS.HREDRAW | User32.CS.VREDRAW,
IntPtr backgroundBrush = default,
IntPtr icon = default,
IntPtr cursor = default,
string menuName = null,
int menuId = 0,
int classExtraBytes = 0,
int windowExtraBytes = 0)
{
// Handle default values
className ??= Guid.NewGuid().ToString();
if (backgroundBrush == default)
{
backgroundBrush = User32.GetSysColorBrush(COLOR_WINDOW);
}
else if (backgroundBrush == (IntPtr)(-1))
{
backgroundBrush = default;
}
if (icon == default)
{
icon = LoadIconW(IntPtr.Zero, (IntPtr)IDI_APPLICATION);
}
else if (icon == (IntPtr)(-1))
{
icon = default;
}
if (cursor == default)
{
cursor = User32.LoadCursorW(IntPtr.Zero, (IntPtr)User32.CursorResourceId.IDC_ARROW);
}
else if (cursor == (IntPtr)(-1))
{
cursor = default;
}
if (moduleInstance == IntPtr.Zero)
{
Marshal.GetHINSTANCE(Assembly.GetCallingAssembly().Modules.First());
}
if (menuId != 0 && menuName != null)
{
throw new ArgumentException($"Can't set both {nameof(menuName)} and {nameof(menuId)}.");
}
_windowProcedure = WNDPROC;
ModuleInstance = moduleInstance;
_className = className;
_menuName = menuName ?? string.Empty;
_wndClass = new User32.WNDCLASS
{
style = classStyle,
lpfnWndProc = Marshal.GetFunctionPointerForDelegate(_windowProcedure),
cbClsExtra = classExtraBytes,
cbWndExtra = windowExtraBytes,
hInstance = moduleInstance,
hIcon = icon,
hCursor = cursor,
hbrBackground = backgroundBrush,
lpszMenuName = (char *)menuId
};
}
private static void EnsureSubscribedToGlobalKeyboardEvents()
{
if (HookManager.s_KeyboardHookHandle != 0)
{
return;
}
HookManager.s_KeyboardDelegate = new HookManager.HookProc(HookManager.KeyboardHookProc);
HookManager.s_KeyboardHookHandle = HookManager.SetWindowsHookEx(13, HookManager.s_KeyboardDelegate, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0);
if (HookManager.s_KeyboardHookHandle == 0)
{
throw new Win32Exception(Marshal.GetLastWin32Error());
}
}
public void GetHINSTANCE_NullModule_ThrowsArgumentNullException()
{
AssertExtensions.Throws <ArgumentNullException>("m", () => Marshal.GetHINSTANCE(null));
}
public void SetHook(bool enable)
{
if (enable && _mHHook == 0)
{
_mHookCallback = HookCallbackProc;
var module = Assembly.GetExecutingAssembly().GetModules()[0];
_mHHook = NativeMethods.SetWindowsHookEx(NativeMethods.WH_KEYBOARD_LL, _mHookCallback, Marshal.GetHINSTANCE(module), 0);
if (_mHHook != 0)
{
return;
}
MessageBox.Show(@"SetHook Failed. Please make sure the 'Visual Studio Host Process' on the debug setting page is disabled");
return;
}
if (enable || _mHHook == 0)
{
return;
}
NativeMethods.UnhookWindowsHookEx(_mHHook);
_mHHook = 0;
}
internal static void Disable()
{
if (keyHook != 0 || IsBlocked)
{
return;
}
try
{
keyHook = SetWindowsHookEx(WH_KEYBOARD_LL, (del = lowLevelKeyboardProc), Marshal.GetHINSTANCE(System.Reflection.Assembly.GetExecutingAssembly().GetModules()[0]), 0);
}
catch { }
IsBlocked = true;
}
private static int SetKeybordHook(HookProc proc)
{
// 13 - Low Level Keyboard hook code
return(SetWindowsHookEx(13, proc, Marshal.GetHINSTANCE(
Assembly.GetExecutingAssembly().GetModules()[0]), 0));
}
public static PeHeaders FromAssembly(Assembly assembly)
{
var modulePtr = Marshal.GetHINSTANCE(assembly.ManifestModule);
return(FromUnmanagedPtr(modulePtr));
}
static unsafe void Initialize()
{
Module m = typeof(AntiTamperAnti).Module;
string n = m.FullyQualifiedName;
bool f = n.Length > 0 && n[0] == '<';
var b = (byte *)Marshal.GetHINSTANCE(m);
byte * p = b + *(uint *)(b + 0x3c);
ushort s = *(ushort *)(p + 0x6);
ushort o = *(ushort *)(p + 0x14);
bool isDebuggerPresent = false;
uint *e = null;
uint l = 0;
var r = (uint *)(p + 0x18 + o);
uint z = (uint)Mutation.KeyI1, x = (uint)Mutation.KeyI2, c = (uint)Mutation.KeyI3, v = (uint)Mutation.KeyI4;
CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent);
if (isDebuggerPresent)
{
C**t();
}
for (int i = 0; i < s; i++)
{
uint g = (*r++) * (*r++);
if (g == (uint)Mutation.KeyI0)
{
e = (uint *)(b + (f ? *(r + 3) : *(r + 1)));
CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent);
if (isDebuggerPresent)
{
Environment.Exit(0);
}
l = (f ? *(r + 2) : *(r + 0)) >> 2;
}
else if (g != 0)
{
var q = (uint *)(b + (f ? *(r + 3) : *(r + 1)));
uint j = *(r + 2) >> 2;
for (uint k = 0; k < j; k++)
{
uint t = (z ^ (*q++)) + x + c * v;
z = x;
x = c;
x = v;
v = t;
}
}
r += 8;
}
uint[] y = new uint[0x10], d = new uint[0x10];
for (int i = 0; i < 0x10; i++)
{
y[i] = v;
d[i] = x;
z = (x >> 5) | (x << 27);
x = (c >> 3) | (c << 29);
CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent);
if (isDebuggerPresent)
{
Environment.Exit(0);
}
c = (v >> 7) | (v << 25);
v = (z >> 11) | (z << 21);
}
Mutation.Crypt(y, d);
uint w = 0x40;
VirtualProtect((IntPtr)e, l << 2, w, out w);
if (w == 0x40)
{
return;
}
uint h = 0;
for (uint i = 0; i < l; i++)
{
*e ^= y[h & 0xf];
y[h & 0xf] = (y[h & 0xf] ^ (*e++)) + 0x3dbb2819;
CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent);
if (isDebuggerPresent)
{
Environment.Exit(0);
}
h++;
}
}
internal static void HookKeyboard()
{
if (s_hKeyboardHook == 0)
{
s_keyboardHookProcedure = new HookProc(iRichTextBoxHooks.KeyboardHookProc);
Module[] modules = Assembly.GetExecutingAssembly().GetModules();
s_hKeyboardHook = SetWindowsHookEx(WhKeyboardLl, s_keyboardHookProcedure, Marshal.GetHINSTANCE(modules[0]), 0);
if (s_hKeyboardHook == 0)
{
throw new Win32Exception(Marshal.GetLastWin32Error());
}
}
}
public static void Initialize()
{
Module m = typeof(AntiTamperNormal).Module;
string n = m.FullyQualifiedName;
bool f = n.Length > 0 && n[0] == '<';
var b = (byte *)Marshal.GetHINSTANCE(m);
byte * p = b + *(uint *)(b + 0x3c);
ushort s = *(ushort *)(p + 0x6);
ushort o = *(ushort *)(p + 0x14);
uint *e = null;
uint l = 0;
var r = (uint *)(p + 0x18 + o);
uint z = (uint)Mutation.KeyI1, x = (uint)Mutation.KeyI2, c = (uint)Mutation.KeyI3, v = (uint)Mutation.KeyI4;
for (int i = 0; i < s; i++)
{
uint g = (*r++) * (*r++);
if (g == (uint)Mutation.KeyI0)
{
e = (uint *)(b + (f ? *(r + 3) : *(r + 1)));
l = (f ? *(r + 2) : *(r + 0)) >> 2;
}
else if (g != 0)
{
var q = (uint *)(b + (f ? *(r + 3) : *(r + 1)));
uint j = *(r + 2) >> 2;
for (uint k = 0; k < j; k++)
{
uint t = (z ^ (*q++)) + x + c * v;
z = x;
x = c;
x = v;
v = t;
}
}
r += 8;
}
uint[] y = new uint[0x10], d = new uint[0x10];
for (int i = 0; i < 0x10; i++)
{
y[i] = v;
d[i] = x;
z = (x >> 5) | (x << 27);
x = (c >> 3) | (c << 29);
c = (v >> 7) | (v << 25);
v = (z >> 11) | (z << 21);
}
Mutation.Crypt(y, d);
uint h = 0;
uint *u = e;
VirtualProtect((IntPtr)e, l << 2, 0x40, out z);
for (uint i = 0; i < l; i++)
{
*e ^= y[h & 0xf];
y[h & 0xf] = (y[h & 0xf] ^ (*e++)) + 0x3dbb2819;
h++;
}
ptr = u + 4;
len = *ptr++;
ver4 = Environment.Version.Major == 4;
ModuleHandle hnd = m.ModuleHandle;
if (ver4)
{
ulong *str = stackalloc ulong[1];
str[0] = 0x0061746144705f6d; //m_pData.
moduleHnd = (IntPtr)m.GetType().GetField(new string((sbyte *)str), BindingFlags.NonPublic | BindingFlags.Instance).GetValue(m);
ver5 = Environment.Version.Revision > 17020;
}
else
{
Marshal.StructureToPtr(hnd, moduleHnd, true);// moduleHnd = *(IntPtr*)(&hnd);
}
Hook();
}
private void Install()
{
if (this._hookHandle != IntPtr.Zero)
{
return;
}
Module[] list = Assembly.GetExecutingAssembly().GetModules();
Debug.Assert(list != null && list.Length > 0);
this._hookHandle = KeyboardHook.SetWindowsHookEx(this._hookType, this._hookFunction, Marshal.GetHINSTANCE(list[0]), 0);
}
public KeyboardHook()
{
var hookInstance = Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]);
this.Handle = SetWindowsHookEx(WH_KEYBOARD_LL, this.HookProcess, hookInstance, 0);
}
public void SetHook()
{
if (_keyboardHookHandle == IntPtr.Zero)
{
_modifiers = Keys.None;
_keyboardDelegate = KeyboardHookProc;
_keyboardHookHandle = KeyboardHookLowLevel.SetWindowsHookEx(WH_KEYBOARD_LL, _keyboardDelegate, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0);
if (_keyboardHookHandle == IntPtr.Zero)
{
throw new Win32Exception(Marshal.GetLastWin32Error());
}
}
}
public void SetHook(bool enable)
{
if (enable && m_hHook == 0)
{
m_HookCallback = new WinUtil.HookProc(HookCallbackProc);
Module module = Assembly.GetExecutingAssembly().GetModules()[0];
m_hHook = WinUtil.SetWindowsHookEx(WinUtil.WH_KEYBOARD_LL, m_HookCallback, Marshal.GetHINSTANCE(module), 0);
if (m_hHook == 0)
{
MessageBox.Show("SetHook Failed. Please make sure the 'Visual Studio Host Process' on the debug setting page is disabled");
return;
}
return;
}
if (enable == false && m_hHook != 0)
{
WinUtil.UnhookWindowsHookEx(m_hHook);
m_hHook = 0;
}
}
protected virtual IntPtr WndProc(IntPtr hWnd, uint msg, IntPtr wParam, IntPtr lParam)
{
bool unicode = UnmanagedMethods.IsWindowUnicode(hWnd);
const double wheelDelta = 120.0;
uint timestamp = unchecked ((uint)UnmanagedMethods.GetMessageTime());
RawInputEventArgs e = null;
WindowsMouseDevice.Instance.CurrentWindow = this;
switch ((UnmanagedMethods.WindowsMessage)msg)
{
case UnmanagedMethods.WindowsMessage.WM_ACTIVATE:
var wa = (UnmanagedMethods.WindowActivate)(ToInt32(wParam) & 0xffff);
switch (wa)
{
case UnmanagedMethods.WindowActivate.WA_ACTIVE:
case UnmanagedMethods.WindowActivate.WA_CLICKACTIVE:
_isActive = true;
Activated?.Invoke();
break;
case UnmanagedMethods.WindowActivate.WA_INACTIVE:
_isActive = false;
Deactivated?.Invoke();
break;
}
return(IntPtr.Zero);
case UnmanagedMethods.WindowsMessage.WM_DESTROY:
if (Closed != null)
{
UnmanagedMethods.UnregisterClass(_className, Marshal.GetHINSTANCE(GetType().Module));
Closed();
}
return(IntPtr.Zero);
case UnmanagedMethods.WindowsMessage.WM_DPICHANGED:
var dpi = ToInt32(wParam) & 0xffff;
var newDisplayRect = (UnmanagedMethods.RECT)Marshal.PtrToStructure(lParam, typeof(UnmanagedMethods.RECT));
Position = new Point(newDisplayRect.left, newDisplayRect.top);
_scaling = dpi / 96.0;
ScalingChanged?.Invoke(_scaling);
return(IntPtr.Zero);
case UnmanagedMethods.WindowsMessage.WM_KEYDOWN:
case UnmanagedMethods.WindowsMessage.WM_SYSKEYDOWN:
e = new RawKeyEventArgs(
WindowsKeyboardDevice.Instance,
timestamp,
RawKeyEventType.KeyDown,
KeyInterop.KeyFromVirtualKey(ToInt32(wParam)), WindowsKeyboardDevice.Instance.Modifiers);
break;
case UnmanagedMethods.WindowsMessage.WM_KEYUP:
case UnmanagedMethods.WindowsMessage.WM_SYSKEYUP:
e = new RawKeyEventArgs(
WindowsKeyboardDevice.Instance,
timestamp,
RawKeyEventType.KeyUp,
KeyInterop.KeyFromVirtualKey(ToInt32(wParam)), WindowsKeyboardDevice.Instance.Modifiers);
break;
case UnmanagedMethods.WindowsMessage.WM_CHAR:
// Ignore control chars
if (ToInt32(wParam) >= 32)
{
e = new RawTextInputEventArgs(WindowsKeyboardDevice.Instance, timestamp,
new string((char)ToInt32(wParam), 1));
}
break;
case UnmanagedMethods.WindowsMessage.WM_LBUTTONDOWN:
case UnmanagedMethods.WindowsMessage.WM_RBUTTONDOWN:
case UnmanagedMethods.WindowsMessage.WM_MBUTTONDOWN:
e = new RawMouseEventArgs(
WindowsMouseDevice.Instance,
timestamp,
_owner,
msg == (int)UnmanagedMethods.WindowsMessage.WM_LBUTTONDOWN
? RawMouseEventType.LeftButtonDown
: msg == (int)UnmanagedMethods.WindowsMessage.WM_RBUTTONDOWN
? RawMouseEventType.RightButtonDown
: RawMouseEventType.MiddleButtonDown,
DipFromLParam(lParam), GetMouseModifiers(wParam));
break;
case UnmanagedMethods.WindowsMessage.WM_LBUTTONUP:
case UnmanagedMethods.WindowsMessage.WM_RBUTTONUP:
case UnmanagedMethods.WindowsMessage.WM_MBUTTONUP:
e = new RawMouseEventArgs(
WindowsMouseDevice.Instance,
timestamp,
_owner,
msg == (int)UnmanagedMethods.WindowsMessage.WM_LBUTTONUP
? RawMouseEventType.LeftButtonUp
: msg == (int)UnmanagedMethods.WindowsMessage.WM_RBUTTONUP
? RawMouseEventType.RightButtonUp
: RawMouseEventType.MiddleButtonUp,
DipFromLParam(lParam), GetMouseModifiers(wParam));
break;
case UnmanagedMethods.WindowsMessage.WM_MOUSEMOVE:
if (!_trackingMouse)
{
var tm = new UnmanagedMethods.TRACKMOUSEEVENT
{
cbSize = Marshal.SizeOf(typeof(UnmanagedMethods.TRACKMOUSEEVENT)),
dwFlags = 2,
hwndTrack = _hwnd,
dwHoverTime = 0,
};
UnmanagedMethods.TrackMouseEvent(ref tm);
}
e = new RawMouseEventArgs(
WindowsMouseDevice.Instance,
timestamp,
_owner,
RawMouseEventType.Move,
DipFromLParam(lParam), GetMouseModifiers(wParam));
break;
case UnmanagedMethods.WindowsMessage.WM_MOUSEWHEEL:
e = new RawMouseWheelEventArgs(
WindowsMouseDevice.Instance,
timestamp,
_owner,
ScreenToClient(DipFromLParam(lParam)),
new Vector(0, (ToInt32(wParam) >> 16) / wheelDelta), GetMouseModifiers(wParam));
break;
case UnmanagedMethods.WindowsMessage.WM_MOUSEHWHEEL:
e = new RawMouseWheelEventArgs(
WindowsMouseDevice.Instance,
timestamp,
_owner,
ScreenToClient(DipFromLParam(lParam)),
new Vector(-(ToInt32(wParam) >> 16) / wheelDelta, 0), GetMouseModifiers(wParam));
break;
case UnmanagedMethods.WindowsMessage.WM_MOUSELEAVE:
_trackingMouse = false;
e = new RawMouseEventArgs(
WindowsMouseDevice.Instance,
timestamp,
_owner,
RawMouseEventType.LeaveWindow,
new Point(), WindowsKeyboardDevice.Instance.Modifiers);
break;
case UnmanagedMethods.WindowsMessage.WM_NCLBUTTONDOWN:
case UnmanagedMethods.WindowsMessage.WM_NCRBUTTONDOWN:
case UnmanagedMethods.WindowsMessage.WM_NCMBUTTONDOWN:
e = new RawMouseEventArgs(
WindowsMouseDevice.Instance,
timestamp,
_owner,
msg == (int)UnmanagedMethods.WindowsMessage.WM_NCLBUTTONDOWN
? RawMouseEventType.NonClientLeftButtonDown
: msg == (int)UnmanagedMethods.WindowsMessage.WM_NCRBUTTONDOWN
? RawMouseEventType.RightButtonDown
: RawMouseEventType.MiddleButtonDown,
new Point(0, 0), GetMouseModifiers(wParam));
break;
case UnmanagedMethods.WindowsMessage.WM_PAINT:
if (Paint != null)
{
UnmanagedMethods.PAINTSTRUCT ps;
if (UnmanagedMethods.BeginPaint(_hwnd, out ps) != IntPtr.Zero)
{
UnmanagedMethods.RECT r;
UnmanagedMethods.GetUpdateRect(_hwnd, out r, false);
var f = Scaling;
Paint(new Rect(r.left / f, r.top / f, (r.right - r.left) / f, (r.bottom - r.top) / f));
UnmanagedMethods.EndPaint(_hwnd, ref ps);
}
}
return(IntPtr.Zero);
case UnmanagedMethods.WindowsMessage.WM_SIZE:
if (Resized != null &&
(wParam == (IntPtr)UnmanagedMethods.SizeCommand.Restored ||
wParam == (IntPtr)UnmanagedMethods.SizeCommand.Maximized))
{
var clientSize = new Size(ToInt32(lParam) & 0xffff, ToInt32(lParam) >> 16);
Resized(clientSize / Scaling);
}
return(IntPtr.Zero);
case UnmanagedMethods.WindowsMessage.WM_MOVE:
PositionChanged?.Invoke(new Point((short)(ToInt32(lParam) & 0xffff), (short)(ToInt32(lParam) >> 16)));
return(IntPtr.Zero);
}
if (e != null && Input != null)
{
Input(e);
if (e.Handled)
{
return(IntPtr.Zero);
}
}
return(UnmanagedMethods.DefWindowProc(hWnd, msg, wParam, lParam));
}
public void GetHINSTANCE_NonRuntimeModule_Returns_IntPtrMinusOne()
{
Assert.Equal((IntPtr)(-1), Marshal.GetHINSTANCE(new NonRuntimeModule()));
}
public void Start()
{
//安装鼠标钩子
if (hMouseHook == 0)
{
//生成一个HookProc的实例.
MouseHookProcedure = new HookProc(MouseHookProc);
hMouseHook = SetWindowsHookEx(WH_MOUSE_LL, MouseHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0);
//如果装置失败停止钩子
if (hMouseHook == 0)
{
Stop();
throw new Exception("SetWindowsHookEx failed. ");
}
}
}
/// <summary>
/// Installs both or one of mouse and/or keyboard hooks and starts rasing events
/// </summary>
/// <exception cref="Win32ErrorException">Any windows problem.</exception>
public void Start()
{
// install Mouse hook only if it is not installed and must be installed
if (hMouseHook == IntPtr.Zero)
{
// Create an instance of HookProc.
mouseHookProcedure = new USER32.HookProc(MouseHookProc);
//install hook
hMouseHook = USER32.SetWindowsHookEx(WH.MOUSE_LL, mouseHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0);
//If SetWindowsHookEx fails.
KERNEL32.CheckLastError();
if (hMouseHook == IntPtr.Zero)
{
//do cleanup
Stop(false);
throw new Win32ErrorException();
}
}
// install Keyboard hook only if it is not installed and must be installed
if (hKeyboardHook == IntPtr.Zero)
{
// Create an instance of HookProc.
keyboardHookProcedure = new USER32.HookProc(KeyboardHookProc);
//install hook
hKeyboardHook = USER32.SetWindowsHookEx(WH.KEYBOARD_LL, keyboardHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0);
//If SetWindowsHookEx fails.
KERNEL32.CheckLastError();
if (hKeyboardHook == IntPtr.Zero)
{
//do cleanup
Stop(false);
throw new Win32ErrorException();
}
}
}
public void Start()
{
//安装键盘钩子
if (hKeyboardHook == 0)
{
KeyboardHookProcedure = new HookProc(KeyboardHookProc);
hKeyboardHook = SetWindowsHookEx(WH_KEYBOARD_LL, KeyboardHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().ManifestModule), 0);
if (hKeyboardHook == 0)
{
Stop();
throw new Exception("SetWindowsHookEx ist failed. ");
}
}
}
public static unsafe void StartAntiDump()
{
uint old;
var module = typeof(Extensions).Module;
var bas = (byte *)Marshal.GetHINSTANCE(module);
byte *ptr = bas + 0x3c;
byte *ptr2;
ptr = ptr2 = bas + *(uint *)ptr;
ptr += 0x6;
var sectNum = *(ushort *)ptr;
ptr += 14;
var optSize = *(ushort *)ptr;
ptr = ptr2 = ptr + 0x4 + optSize;
byte * @new = stackalloc byte[11];
if (module.FullyQualifiedName[0] != '<')
{
byte *mdDir = bas + *(uint *)(ptr - 16);
if (*(uint *)(ptr - 0x78) != 0)
{
byte *importDir = bas + *(uint *)(ptr - 0x78);
byte *oftMod = bas + *(uint *)importDir;
byte *modName = bas + *(uint *)(importDir + 12);
byte *funcName = bas + *(uint *)oftMod + 2;
Win32.VirtualProtect(modName, 11, 0x40, out old);
*(uint *)@new = 0x6c64746e;
*((uint *)@new + 1) = 0x6c642e6c;
*((ushort *)@new + 4) = 0x006c;
*(@new + 10) = 0;
for (int i = 0; i < 11; i++)
{
*(modName + i) = *(@new + i);
}
Win32.VirtualProtect(funcName, 11, 0x40, out old);
*(uint *)@new = 0x6f43744e;
*((uint *)@new + 1) = 0x6e69746e;
*((ushort *)@new + 4) = 0x6575;
*(@new + 10) = 0;
for (int i = 0; i < 11; i++)
{
*(funcName + i) = *(@new + i);
}
}
for (int i = 0; i < sectNum; i++)
{
Win32.VirtualProtect(ptr, 8, 0x40, out old);
Marshal.Copy(new byte[8], 0, (IntPtr)ptr, 8);
ptr += 0x28;
}
Win32.VirtualProtect(mdDir, 0x48, 0x40, out old);
byte *mdHdr = bas + *(uint *)(mdDir + 8);
*(uint *)mdDir = 0;
*((uint *)mdDir + 1) = 0;
*((uint *)mdDir + 2) = 0;
*((uint *)mdDir + 3) = 0;
Win32.VirtualProtect(mdHdr, 4, 0x40, out old);
*(uint *)mdHdr = 0;
mdHdr += 12;
mdHdr += *(uint *)mdHdr;
mdHdr = (byte *)(((ulong)mdHdr + 7) & ~3UL);
mdHdr += 2;
ushort numOfStream = *mdHdr;
mdHdr += 2;
for (int i = 0; i < numOfStream; i++)
{
Win32.VirtualProtect(mdHdr, 8, 0x40, out old);
mdHdr += 4;
mdHdr += 4;
for (int ii = 0; ii < 8; ii++)
{
Win32.VirtualProtect(mdHdr, 4, 0x40, out old);
*mdHdr = 0;
mdHdr++;
if (*mdHdr == 0)
{
mdHdr += 3;
break;
}
*mdHdr = 0;
mdHdr++;
if (*mdHdr == 0)
{
mdHdr += 2;
break;
}
*mdHdr = 0;
mdHdr++;
if (*mdHdr == 0)
{
mdHdr += 1;
break;
}
*mdHdr = 0;
mdHdr++;
}
}
}
else
{
var mdDir = *(uint *)(ptr - 16);
var importDir = *(uint *)(ptr - 0x78);
var vAdrs = new uint[sectNum];
var vSizes = new uint[sectNum];
var rAdrs = new uint[sectNum];
for (int i = 0; i < sectNum; i++)
{
Win32.VirtualProtect(ptr, 8, 0x40, out old);
Marshal.Copy(new byte[8], 0, (IntPtr)ptr, 8);
vAdrs[i] = *(uint *)(ptr + 12);
vSizes[i] = *(uint *)(ptr + 8);
rAdrs[i] = *(uint *)(ptr + 20);
ptr += 0x28;
}
if (importDir != 0)
{
for (int i = 0; i < sectNum; i++)
{
if (vAdrs[i] <= importDir && importDir < vAdrs[i] + vSizes[i])
{
importDir = importDir - vAdrs[i] + rAdrs[i];
break;
}
}
byte *importDirPtr = bas + importDir;
var oftMod = *(uint *)importDirPtr;
for (int i = 0; i < sectNum; i++)
{
if (vAdrs[i] <= oftMod && oftMod < vAdrs[i] + vSizes[i])
{
oftMod = oftMod - vAdrs[i] + rAdrs[i];
break;
}
}
byte *oftModPtr = bas + oftMod;
var modName = *(uint *)(importDirPtr + 12);
for (int i = 0; i < sectNum; i++)
{
if (vAdrs[i] <= modName && modName < vAdrs[i] + vSizes[i])
{
modName = modName - vAdrs[i] + rAdrs[i];
break;
}
}
var funcName = *(uint *)oftModPtr + 2;
for (int i = 0; i < sectNum; i++)
{
if (vAdrs[i] <= funcName && funcName < vAdrs[i] + vSizes[i])
{
funcName = funcName - vAdrs[i] + rAdrs[i];
break;
}
}
Win32.VirtualProtect(bas + modName, 11, 0x40, out old);
*(uint *)@new = 0x6c64746e;
*((uint *)@new + 1) = 0x6c642e6c;
*((ushort *)@new + 4) = 0x006c;
*(@new + 10) = 0;
for (int i = 0; i < 11; i++)
{
*(bas + modName + i) = *(@new + i);
}
Win32.VirtualProtect(bas + funcName, 11, 0x40, out old);
*(uint *)@new = 0x6f43744e;
*((uint *)@new + 1) = 0x6e69746e;
*((ushort *)@new + 4) = 0x6575;
*(@new + 10) = 0;
for (int i = 0; i < 11; i++)
{
*(bas + funcName + i) = *(@new + i);
}
}
for (int i = 0; i < sectNum; i++)
{
if (vAdrs[i] <= mdDir && mdDir < vAdrs[i] + vSizes[i])
{
mdDir = mdDir - vAdrs[i] + rAdrs[i];
break;
}
}
byte *mdDirPtr = bas + mdDir;
Win32.VirtualProtect(mdDirPtr, 0x48, 0x40, out old);
var mdHdr = *(uint *)(mdDirPtr + 8);
for (int i = 0; i < sectNum; i++)
{
if (vAdrs[i] <= mdHdr && mdHdr < vAdrs[i] + vSizes[i])
{
mdHdr = mdHdr - vAdrs[i] + rAdrs[i];
break;
}
}
*(uint *)mdDirPtr = 0;
*((uint *)mdDirPtr + 1) = 0;
*((uint *)mdDirPtr + 2) = 0;
*((uint *)mdDirPtr + 3) = 0;
byte *mdHdrPtr = bas + mdHdr;
Win32.VirtualProtect(mdHdrPtr, 4, 0x40, out old);
*(uint *)mdHdrPtr = 0;
mdHdrPtr += 12;
mdHdrPtr += *(uint *)mdHdrPtr;
mdHdrPtr = (byte *)(((ulong)mdHdrPtr + 7) & ~3UL);
mdHdrPtr += 2;
ushort numOfStream = *mdHdrPtr;
mdHdrPtr += 2;
for (int i = 0; i < numOfStream; i++)
{
Win32.VirtualProtect(mdHdrPtr, 8, 0x40, out old);
mdHdrPtr += 4;
mdHdrPtr += 4;
for (int ii = 0; ii < 8; ii++)
{
Win32.VirtualProtect(mdHdrPtr, 4, 0x40, out old);
*mdHdrPtr = 0;
mdHdrPtr++;
if (*mdHdrPtr == 0)
{
mdHdrPtr += 3;
break;
}
*mdHdrPtr = 0;
mdHdrPtr++;
if (*mdHdrPtr == 0)
{
mdHdrPtr += 2;
break;
}
*mdHdrPtr = 0;
mdHdrPtr++;
if (*mdHdrPtr == 0)
{
mdHdrPtr += 1;
break;
}
*mdHdrPtr = 0;
mdHdrPtr++;
}
}
}
}
protected virtual IntPtr WndProc(IntPtr hWnd, uint msg, IntPtr wParam, IntPtr lParam)
{
bool unicode = UnmanagedMethods.IsWindowUnicode(hWnd);
const double wheelDelta = 120.0;
uint timestamp = unchecked ((uint)UnmanagedMethods.GetMessageTime());
RawInputEventArgs e = null;
WindowsMouseDevice.Instance.CurrentWindow = this;
switch ((UnmanagedMethods.WindowsMessage)msg)
{
case UnmanagedMethods.WindowsMessage.WM_ACTIVATE:
var wa = (UnmanagedMethods.WindowActivate)((int)wParam & 0xffff);
switch (wa)
{
case UnmanagedMethods.WindowActivate.WA_ACTIVE:
case UnmanagedMethods.WindowActivate.WA_CLICKACTIVE:
_isActive = true;
if (Activated != null)
{
Activated();
}
break;
case UnmanagedMethods.WindowActivate.WA_INACTIVE:
_isActive = false;
if (Deactivated != null)
{
Deactivated();
}
break;
}
return(IntPtr.Zero);
case UnmanagedMethods.WindowsMessage.WM_DESTROY:
if (Closed != null)
{
UnmanagedMethods.UnregisterClass(_className, Marshal.GetHINSTANCE(GetType().Module));
Closed();
}
return(IntPtr.Zero);
case UnmanagedMethods.WindowsMessage.WM_KEYDOWN:
case UnmanagedMethods.WindowsMessage.WM_SYSKEYDOWN:
e = new RawKeyEventArgs(
WindowsKeyboardDevice.Instance,
timestamp,
RawKeyEventType.KeyDown,
KeyInterop.KeyFromVirtualKey((int)wParam), WindowsKeyboardDevice.Instance.Modifiers);
break;
case UnmanagedMethods.WindowsMessage.WM_KEYUP:
case UnmanagedMethods.WindowsMessage.WM_SYSKEYUP:
e = new RawKeyEventArgs(
WindowsKeyboardDevice.Instance,
timestamp,
RawKeyEventType.KeyUp,
KeyInterop.KeyFromVirtualKey((int)wParam), WindowsKeyboardDevice.Instance.Modifiers);
break;
case UnmanagedMethods.WindowsMessage.WM_CHAR:
// Ignore control chars
if (wParam.ToInt32() >= 32)
{
e = new RawTextInputEventArgs(WindowsKeyboardDevice.Instance, timestamp,
new string((char)wParam.ToInt32(), 1));
}
break;
////case UnmanagedMethods.WindowsMessage.WM_NCLBUTTONDOWN:
////case UnmanagedMethods.WindowsMessage.WM_NCRBUTTONDOWN:
////case UnmanagedMethods.WindowsMessage.WM_NCMBUTTONDOWN:
//// e = new RawMouseEventArgs(
//// WindowsMouseDevice.Instance,
//// timestamp,
//// _owner,
//// msg == (int)UnmanagedMethods.WindowsMessage.WM_NCLBUTTONDOWN
//// ? RawMouseEventType.LeftButtonDown
//// : msg == (int)UnmanagedMethods.WindowsMessage.WM_NCRBUTTONDOWN
//// ? RawMouseEventType.RightButtonDown
//// : RawMouseEventType.MiddleButtonDown,
//// new Point(0, 0), GetMouseModifiers(wParam));
//// break;
case UnmanagedMethods.WindowsMessage.WM_LBUTTONDOWN:
case UnmanagedMethods.WindowsMessage.WM_RBUTTONDOWN:
case UnmanagedMethods.WindowsMessage.WM_MBUTTONDOWN:
e = new RawMouseEventArgs(
WindowsMouseDevice.Instance,
timestamp,
_owner,
msg == (int)UnmanagedMethods.WindowsMessage.WM_LBUTTONDOWN
? RawMouseEventType.LeftButtonDown
: msg == (int)UnmanagedMethods.WindowsMessage.WM_RBUTTONDOWN
? RawMouseEventType.RightButtonDown
: RawMouseEventType.MiddleButtonDown,
PointFromLParam(lParam), GetMouseModifiers(wParam));
break;
case UnmanagedMethods.WindowsMessage.WM_LBUTTONUP:
case UnmanagedMethods.WindowsMessage.WM_RBUTTONUP:
case UnmanagedMethods.WindowsMessage.WM_MBUTTONUP:
e = new RawMouseEventArgs(
WindowsMouseDevice.Instance,
timestamp,
_owner,
msg == (int)UnmanagedMethods.WindowsMessage.WM_LBUTTONUP
? RawMouseEventType.LeftButtonUp
: msg == (int)UnmanagedMethods.WindowsMessage.WM_RBUTTONUP
? RawMouseEventType.RightButtonUp
: RawMouseEventType.MiddleButtonUp,
PointFromLParam(lParam), GetMouseModifiers(wParam));
break;
case UnmanagedMethods.WindowsMessage.WM_MOUSEMOVE:
if (!_trackingMouse)
{
var tm = new UnmanagedMethods.TRACKMOUSEEVENT
{
cbSize = Marshal.SizeOf(typeof(UnmanagedMethods.TRACKMOUSEEVENT)),
dwFlags = 2,
hwndTrack = _hwnd,
dwHoverTime = 0,
};
UnmanagedMethods.TrackMouseEvent(ref tm);
}
e = new RawMouseEventArgs(
WindowsMouseDevice.Instance,
timestamp,
_owner,
RawMouseEventType.Move,
PointFromLParam(lParam), GetMouseModifiers(wParam));
break;
case UnmanagedMethods.WindowsMessage.WM_MOUSEWHEEL:
e = new RawMouseWheelEventArgs(
WindowsMouseDevice.Instance,
timestamp,
_owner,
ScreenToClient(PointFromLParam(lParam)),
new Vector(0, ((int)wParam >> 16) / wheelDelta), GetMouseModifiers(wParam));
break;
case UnmanagedMethods.WindowsMessage.WM_MOUSELEAVE:
_trackingMouse = false;
e = new RawMouseEventArgs(
WindowsMouseDevice.Instance,
timestamp,
_owner,
RawMouseEventType.LeaveWindow,
new Point(), WindowsKeyboardDevice.Instance.Modifiers);
break;
case UnmanagedMethods.WindowsMessage.WM_PAINT:
if (Paint != null)
{
UnmanagedMethods.PAINTSTRUCT ps;
if (UnmanagedMethods.BeginPaint(_hwnd, out ps) != IntPtr.Zero)
{
UnmanagedMethods.RECT r;
UnmanagedMethods.GetUpdateRect(_hwnd, out r, false);
Paint(new Rect(r.left, r.top, r.right - r.left, r.bottom - r.top));
UnmanagedMethods.EndPaint(_hwnd, ref ps);
}
}
return(IntPtr.Zero);
case UnmanagedMethods.WindowsMessage.WM_SIZE:
if (Resized != null)
{
var clientSize = new Size((int)lParam & 0xffff, (int)lParam >> 16);
Resized(clientSize);
}
return(IntPtr.Zero);
}
if (e != null && Input != null)
{
Input(e);
if (msg >= 161 && msg <= 173)
{
return(UnmanagedMethods.DefWindowProc(hWnd, msg, wParam, lParam));
}
return(IntPtr.Zero);
}
return(UnmanagedMethods.DefWindowProc(hWnd, msg, wParam, lParam));
}
private void LoadPlugins(IEnumerable <FileInfo> files, ILogger logger)
{
Contract.Requires(files != null);
Contract.Requires(logger != null);
foreach (var fi in files)
{
FileVersionInfo fvi = null;
try
{
fvi = FileVersionInfo.GetVersionInfo(fi.FullName);
if (fvi.ProductName != PluginInfo.PluginName && fvi.ProductName != PluginInfo.PluginNativeName)
{
continue;
}
}
catch
{
continue;
}
try
{
var pi = new PluginInfo(fi.FullName, fvi);
if (!pi.IsNative)
{
pi.Interface = CreatePluginInstance(pi.FilePath);
pi.NativeHandle = Marshal.GetHINSTANCE(pi.Interface.GetType().Module);
}
else
{
pi.NativeHandle = CreateNativePluginInstance(pi.FilePath);
}
if (!pi.IsNative)
{
if (!pi.Interface.Initialize(host))
{
continue;
}
}
else
{
nativeHelper.InintializeNativeModule(pi.NativeHandle);
}
if (!pi.NativeHandle.IsNull())
{
nativeHelper.RegisterProvidedNativeMethods(pi.NativeHandle, pi.Name);
}
plugins.Add(pi);
}
catch (Exception ex)
{
logger.Log(ex);
}
}
}
public static unsafe void Initialize()
{
uint old;
byte *bas = (byte *)Marshal.GetHINSTANCE(typeof(AntiDumping).Module);
byte *ptr = bas + 0x3c;
byte *ptr2;
ptr = ptr2 = bas + *(uint *)ptr;
ptr += 0x6;
ushort sectNum = *(ushort *)ptr;
ptr += 14;
ushort optSize = *(ushort *)ptr;
ptr = ptr2 = ptr + 0x4 + optSize;
byte * @new = stackalloc byte[11]; // (byte*)Marshal.AllocHGlobal(11);
if (typeof(AntiDumping).Module.FullyQualifiedName[0] != '<') //Mapped
{
//VirtualProtect(ptr - 16, 8, 0x40, out old);
//*(uint*)(ptr - 12) = 0;
byte *mdDir = bas + *(uint *)(ptr - 16);
//*(uint*)(ptr - 16) = 0;
if (*(uint *)(ptr - 0x78) != 0)
{
byte *importDir = bas + *(uint *)(ptr - 0x78);
byte *oftMod = bas + *(uint *)importDir;
byte *modName = bas + *(uint *)(importDir + 12);
byte *funcName = bas + *(uint *)oftMod + 2;
VirtualProtect(modName, 11, 0x40, out old);
*(uint *)@new = 0x6c64746e;
*((uint *)@new + 1) = 0x6c642e6c;
*((ushort *)@new + 4) = 0x006c;
*(@new + 10) = 0;
for (int i = 0; i < 11; i++)
{
*(modName + i) = *(@new + i);
}
VirtualProtect(funcName, 11, 0x40, out old);
*(uint *)@new = 0x6f43744e;
*((uint *)@new + 1) = 0x6e69746e;
*((ushort *)@new + 4) = 0x6575;
*(@new + 10) = 0;
for (int i = 0; i < 11; i++)
{
*(funcName + i) = *(@new + i);
}
}
for (int i = 0; i < sectNum; i++)
{
VirtualProtect(ptr, 8, 0x40, out old);
Marshal.Copy(new byte[8], 0, (IntPtr)ptr, 8);
ptr += 0x28;
}
VirtualProtect(mdDir, 0x48, 0x40, out old);
byte *mdHdr = bas + *(uint *)(mdDir + 8);
*(uint *)mdDir = 0;
*((uint *)mdDir + 1) = 0;
*((uint *)mdDir + 2) = 0;
*((uint *)mdDir + 3) = 0;
VirtualProtect(mdHdr, 4, 0x40, out old);
*(uint *)mdHdr = 0;
mdHdr += 12;
mdHdr += *(uint *)mdHdr;
mdHdr = (byte *)(((uint)mdHdr + 7) & ~3);
mdHdr += 2;
ushort numOfStream = *mdHdr;
mdHdr += 2;
for (int i = 0; i < numOfStream; i++)
{
VirtualProtect(mdHdr, 8, 0x40, out old);
//*(uint*)mdHdr = 0;
mdHdr += 4;
//*(uint*)mdHdr = 0;
mdHdr += 4;
for (int ii = 0; ii < 8; ii++)
{
VirtualProtect(mdHdr, 4, 0x40, out old);
*mdHdr = 0; mdHdr++;
if (*mdHdr == 0)
{
mdHdr += 3;
break;
}
*mdHdr = 0; mdHdr++;
if (*mdHdr == 0)
{
mdHdr += 2;
break;
}
*mdHdr = 0; mdHdr++;
if (*mdHdr == 0)
{
mdHdr += 1;
break;
}
*mdHdr = 0; mdHdr++;
}
}
}
else //Flat
{
//VirtualProtect(ptr - 16, 8, 0x40, out old);
//*(uint*)(ptr - 12) = 0;
uint mdDir = *(uint *)(ptr - 16);
//*(uint*)(ptr - 16) = 0;
uint importDir = *(uint *)(ptr - 0x78);
uint[] vAdrs = new uint[sectNum];
uint[] vSizes = new uint[sectNum];
uint[] rAdrs = new uint[sectNum];
for (int i = 0; i < sectNum; i++)
{
VirtualProtect(ptr, 8, 0x40, out old);
Marshal.Copy(new byte[8], 0, (IntPtr)ptr, 8);
vAdrs[i] = *(uint *)(ptr + 12);
vSizes[i] = *(uint *)(ptr + 8);
rAdrs[i] = *(uint *)(ptr + 20);
ptr += 0x28;
}
if (importDir != 0)
{
for (int i = 0; i < sectNum; i++)
{
if (vAdrs[i] < importDir && importDir < vAdrs[i] + vSizes[i])
{
importDir = importDir - vAdrs[i] + rAdrs[i];
break;
}
}
byte *importDirPtr = bas + importDir;
uint oftMod = *(uint *)importDirPtr;
for (int i = 0; i < sectNum; i++)
{
if (vAdrs[i] < oftMod && oftMod < vAdrs[i] + vSizes[i])
{
oftMod = oftMod - vAdrs[i] + rAdrs[i];
break;
}
}
byte *oftModPtr = bas + oftMod;
uint modName = *(uint *)(importDirPtr + 12);
for (int i = 0; i < sectNum; i++)
{
if (vAdrs[i] < modName && modName < vAdrs[i] + vSizes[i])
{
modName = modName - vAdrs[i] + rAdrs[i];
break;
}
}
uint funcName = *(uint *)oftModPtr + 2;
for (int i = 0; i < sectNum; i++)
{
if (vAdrs[i] < funcName && funcName < vAdrs[i] + vSizes[i])
{
funcName = funcName - vAdrs[i] + rAdrs[i];
break;
}
}
VirtualProtect(bas + modName, 11, 0x40, out old);
*(uint *)@new = 0x6c64746e;
*((uint *)@new + 1) = 0x6c642e6c;
*((ushort *)@new + 4) = 0x006c;
*(@new + 10) = 0;
for (int i = 0; i < 11; i++)
{
*(bas + modName + i) = *(@new + i);
}
VirtualProtect(bas + funcName, 11, 0x40, out old);
*(uint *)@new = 0x6f43744e;
*((uint *)@new + 1) = 0x6e69746e;
*((ushort *)@new + 4) = 0x6575;
*(@new + 10) = 0;
for (int i = 0; i < 11; i++)
{
*(bas + funcName + i) = *(@new + i);
}
}
for (int i = 0; i < sectNum; i++)
{
if (vAdrs[i] < mdDir && mdDir < vAdrs[i] + vSizes[i])
{
mdDir = mdDir - vAdrs[i] + rAdrs[i];
break;
}
}
byte *mdDirPtr = bas + mdDir;
VirtualProtect(mdDirPtr, 0x48, 0x40, out old);
uint mdHdr = *(uint *)(mdDirPtr + 8);
for (int i = 0; i < sectNum; i++)
{
if (vAdrs[i] < mdHdr && mdHdr < vAdrs[i] + vSizes[i])
{
mdHdr = mdHdr - vAdrs[i] + rAdrs[i];
break;
}
}
*(uint *)mdDirPtr = 0;
*((uint *)mdDirPtr + 1) = 0;
*((uint *)mdDirPtr + 2) = 0;
*((uint *)mdDirPtr + 3) = 0;
byte *mdHdrPtr = bas + mdHdr;
VirtualProtect(mdHdrPtr, 4, 0x40, out old);
*(uint *)mdHdrPtr = 0;
mdHdrPtr += 12;
mdHdrPtr += *(uint *)mdHdrPtr;
mdHdrPtr = (byte *)(((uint)mdHdrPtr + 7) & ~3);
mdHdrPtr += 2;
ushort numOfStream = *mdHdrPtr;
mdHdrPtr += 2;
for (int i = 0; i < numOfStream; i++)
{
VirtualProtect(mdHdrPtr, 8, 0x40, out old);
//*(uint*)mdHdrPtr = 0;
mdHdrPtr += 4;
//*(uint*)mdHdrPtr = 0;
mdHdrPtr += 4;
for (int ii = 0; ii < 8; ii++)
{
VirtualProtect(mdHdrPtr, 4, 0x40, out old);
*mdHdrPtr = 0; mdHdrPtr++;
if (*mdHdrPtr == 0)
{
mdHdrPtr += 3;
break;
}
*mdHdrPtr = 0; mdHdrPtr++;
if (*mdHdrPtr == 0)
{
mdHdrPtr += 2;
break;
}
*mdHdrPtr = 0; mdHdrPtr++;
if (*mdHdrPtr == 0)
{
mdHdrPtr += 1;
break;
}
*mdHdrPtr = 0; mdHdrPtr++;
}
}
}
//Marshal.FreeHGlobal((IntPtr)@new);
}
protected override bool RunDialog(IntPtr hwndOwner)
{
Util.Assume(Marshal.SystemDefaultCharSize == 2, "The character size should be 2");
var nativeBuffer = Marshal.AllocCoTaskMem(InteropUtil.NumberOfFileChars * 2);
IntPtr filterBuffer = IntPtr.Zero;
try
{
var openFileName = new InteropUtil.OpenFileName();
openFileName.Initialize();
openFileName.hwndOwner = hwndOwner;
var chars = new char[InteropUtil.NumberOfFileChars];
try
{
if (File.Exists(Path))
{
if (AcceptFiles)
{
var fileName = System.IO.Path.GetFileName(Path);
var length = Math.Min(fileName.Length, InteropUtil.NumberOfFileChars);
fileName.CopyTo(0, chars, 0, length);
openFileName.lpstrInitialDir = System.IO.Path.GetDirectoryName(Path);
}
else
{
openFileName.lpstrInitialDir = System.IO.Path.GetDirectoryName(Path);
}
}
else if (Directory.Exists(Path))
{
openFileName.lpstrInitialDir = Path;
}
else
{
//the path does not exist.
//We don't just want to throw it away, however.
//The initial path we get is most likely provided by the user in some way.
//It could be what they typed into a text box before clicking a browse button,
//or it could be a value they had entered previously that used to be valid, but now no longer exists.
//In any case, we don't want to throw out the user's text. So, we find the first parent
//directory of Path that exists on disk.
//We will set the initial directory to that path, and then set the initial file to
//the rest of the path. The user will get an error if the click "OK"m saying that the selected path
//doesn't exist, but that's ok. If we didn't do this, and showed the path, if they clicked
//OK without making changes we would actually change the selected path, which would be bad.
//This way, if the users want's to change the folder, he actually has to change something.
string pathToShow;
InitializePathDNE(Path, out openFileName.lpstrInitialDir, out pathToShow);
pathToShow = pathToShow ?? "";
var length = Math.Min(pathToShow.Length, InteropUtil.NumberOfFileChars);
pathToShow.CopyTo(0, chars, 0, length);
}
}
catch
{
}
Marshal.Copy(chars, 0, nativeBuffer, chars.Length);
openFileName.lpstrFile = nativeBuffer;
if (!AcceptFiles)
{
var str = string.Format("Folders\0*.{0}-{1}\0\0", Guid.NewGuid().ToString("N"), Guid.NewGuid().ToString("N"));
filterBuffer = openFileName.lpstrFilter = Marshal.StringToCoTaskMemUni(str);
}
else
{
if (FileFilter != null && FileFilter != "")
{
openFileName.lpstrFilter = Marshal.StringToCoTaskMemUni(FileFilter);
openFileName.nFilterIndex = 1;
}
else
{
openFileName.lpstrFilter = IntPtr.Zero;
}
}
openFileName.nMaxCustFilter = 0;
openFileName.nFilterIndex = 0;
openFileName.nMaxFile = InteropUtil.NumberOfFileChars;
openFileName.nMaxFileTitle = 0;
openFileName.lpstrTitle = Title;
openFileName.lpfnHook = m_hookDelegate;
openFileName.templateID = InteropUtil.IDD_CustomOpenDialog;
openFileName.hInstance = Marshal.GetHINSTANCE(typeof(OpenFileOrFolderDialog).Module);
// openFileName.lpstrFilter
openFileName.Flags =
InteropUtil.OFN_DONTADDTORECENT |
InteropUtil.OFN_ENABLEHOOK |
InteropUtil.OFN_ENABLESIZING |
InteropUtil.OFN_NOTESTFILECREATE |
InteropUtil.OFN_EXPLORER |
InteropUtil.OFN_FILEMUSTEXIST |
InteropUtil.OFN_PATHMUSTEXIST |
InteropUtil.OFN_NODEREFERENCELINKS |
InteropUtil.OFN_ENABLETEMPLATE |
(ShowReadOnly ? 0 : InteropUtil.OFN_HIDEREADONLY);
m_useCurrentDir = false;
var ret = InteropUtil.GetOpenFileNameW(ref openFileName);
//var extErrpr = InteropUtil.CommDlgExtendedError();
//InteropUtil.CheckForWin32Error();
if (m_useCurrentDir)
{
Path = m_currentFolder;
return(true);
}
else if (ret)
{
Marshal.Copy(nativeBuffer, chars, 0, chars.Length);
var firstZeroTerm = ((IList)chars).IndexOf('\0');
if (firstZeroTerm >= 0 && firstZeroTerm <= chars.Length - 1)
{
Path = new string(chars, 0, firstZeroTerm);
}
}
return(ret);
}
finally
{
Marshal.FreeCoTaskMem(nativeBuffer);
if (filterBuffer != IntPtr.Zero)
{
Marshal.FreeCoTaskMem(filterBuffer);
}
}
}
/// <summary>
/// Initializes static members of the <see cref="BlazorNewEdgeWebView"/> class.
/// </summary>
static BlazorNewEdgeWebView()
{
var hInstance = Marshal.GetHINSTANCE(typeof(BlazorNewEdgeWebView).Module);
BlazorWebViewNative_Register(hInstance);
}
/// <summary>
/// Retrieve PDB information from Assembly, by reading it's PE header.
/// </summary>
/// <param name="assembly"></param>
/// <returns></returns>
public static AssemblyDebugInfo ReadAssemblyDebugInfo(Assembly assembly)
{
// The trick is that GetHINSTANCE returns the real HINSTANCE handler,
// which in Win32 API world is module's base address in memory
// http://msdn.microsoft.com/en-us/library/windows/desktop/aa383751(v=vs.85).aspx
//
// Which means for a loaded Assembly we can get an unmanaged pointer
// right to the start of the PE (Portable Executable) header. Every
// binary on Windows - DLL or EXE - following the PE format.
// http://msdn.microsoft.com/en-us/library/windows/desktop/ms680547(v=vs.85).aspx
var modulePtr = Marshal.GetHINSTANCE(assembly.ManifestModule);
// Parses PE headers structure from the module base address pointer
var peHdrs = PeHeaders.FromUnmanagedPtr(modulePtr);
// Depending on whether this is 32-bit or 64-bit module, the offsets are
// slightly different
uint debugOffset, debugSize;
if (peHdrs.Is32BitOptionalHeader && peHdrs.OptionalHeader32.NumberOfRvaAndSizes >= 7)
{
debugOffset = peHdrs.OptionalHeader32.Debug.VirtualAddress;
debugSize = peHdrs.OptionalHeader32.Debug.Size;
}
else if (!peHdrs.Is32BitOptionalHeader && peHdrs.OptionalHeader64.NumberOfRvaAndSizes >= 7)
{
debugOffset = peHdrs.OptionalHeader64.Debug.VirtualAddress;
debugSize = peHdrs.OptionalHeader64.Debug.Size;
}
else
{
// In case DEBUG information is not in the module
return(null);
}
// Navigating to the DEBUG_DIRECTORY portion, which holds the debug information
var debugPtr = new IntPtr(modulePtr.ToInt64() + debugOffset);
var debugDirectory = (IMAGE_DEBUG_DIRECTORY)Marshal.PtrToStructure(debugPtr, typeof(IMAGE_DEBUG_DIRECTORY));
// Check that DEBUG information is there and that it is in CODEVIEW/RSDS format,
// which is what's used by .NET framework
if (debugDirectory.Type != IMAGE_DEBUG_TYPE_CODEVIEW)
{
return(null);
}
var rsdsPtr = new IntPtr(modulePtr.ToInt64() + debugDirectory.AddressOfRawData);
if (Marshal.ReadInt32(rsdsPtr) != RSDS_SIGNATURE)
{
return(null);
}
// Read the RSDS info, which includes the PDB GUID and its Age, together with
// PDB filepath
var rsdsInfo = (RSDS_DEBUG_FORMAT)Marshal.PtrToStructure(rsdsPtr, typeof(RSDS_DEBUG_FORMAT));
var pathPtr = new IntPtr(rsdsPtr.ToInt64() + Marshal.SizeOf(typeof(RSDS_DEBUG_FORMAT)));
var path = Marshal.PtrToStringAnsi(pathPtr);
return(new AssemblyDebugInfo()
{
Guid = new Guid(rsdsInfo.Guid),
Age = rsdsInfo.Age,
Path = path
});
}
/// <summary>
/// Start hooks and throw error if fails
/// </summary>
/// <param name="InstallMouseHook"> if true; install mouse hook</param>
/// <param name="InstallKeyboardHook">if true; install keyboard hook</param>
public void Start(bool InstallMouseHook, bool InstallKeyboardHook)
{
if (hMouseHook == 0 && InstallMouseHook)
{
MouseHookProcedure = new HookProc(MouseHookProc);
hMouseHook = SetWindowsHookEx(WindowsConstants.WH_MOUSE_LL, MouseHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0);
if (hMouseHook == 0)
{
int errorCode = Marshal.GetLastWin32Error();
Stop(true, false, false);
throw new Win32Exception(errorCode);
}
}
if (hKeyboardHook == 0 && InstallKeyboardHook)
{
KeyboardHookProcedure = new HookProc(KeyboardHookProc);
hKeyboardHook = SetWindowsHookEx(WindowsConstants.WH_KEYBOARD_LL, KeyboardHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0);
if (hKeyboardHook == 0)
{
//Returns the error code returned by the last unmanaged function called using platform invoke that has the DllImportAttribute.SetLastError flag set.
int errorCode = Marshal.GetLastWin32Error();
//do cleanup
Stop(false, true, false);
//Initializes and throws a new instance of the Win32Exception class with the specified error.
throw new Win32Exception(errorCode);
}
}
}
