예제 #1
0
    public int OnWriteFile(INktHookInfo hookInfo, int chainIndex, INktHookCallInfoPlugin callInfo)
    {
        System.Diagnostics.Trace.WriteLine("MyFilePlugin::OnWriteFile called [Hook: " + hookInfo.FunctionName + " @ 0x" + hookInfo.Address.ToString("X") + " / Chain:" + chainIndex.ToString() + "]");
        try
        {
            if (callInfo.IsPreCall != false)
            {
                IntPtr fileHandle = callInfo.Params().GetAt(0).SizeTVal;
                string s;

                lock (handleMap)
                {
                    if (handleMap.TryGetValue(fileHandle, out s) != false)
                    {
                        callInfo.AddString("WriteFile", s);
                    }
                }
            }
        }
        catch (System.Exception ex)
        {
            System.Diagnostics.Trace.WriteLine(ex.ToString());
        }
        return(0);
    }
예제 #2
0
    //called when a hooked function is called
    public int OnFunctionCall(INktHookInfo hookInfo, int chainIndex, INktHookCallInfoPlugin callInfo)
    {
        System.Diagnostics.Trace.WriteLine("MyRegistryPlugin::OnFunctionCall called [Hook: " + hookInfo.FunctionName + " @ 0x" + hookInfo.Address.ToString("X") + " / Chain:" + chainIndex.ToString() + "]");
        INktParamsEnum pms;

        callInfo.AddString("sample name", "HKEY extractor sample");
        pms = callInfo.Params();
        for (int i = 0; i < pms.Count; i++)
        {
            INktParam p = pms.GetAt(i);
            if (p.IsPointer)
                p = p.Evaluate();
            if (p != null && p.TypeName == "HKEY")
            {
                callInfo.AddSizeT("param#" + i.ToString(), p.SizeTVal);
            }
        }
        return 0;
    }
예제 #3
0
    //called when a hooked function is called
    public int OnFunctionCall(INktHookInfo hookInfo, int chainIndex, INktHookCallInfoPlugin callInfo)
    {
        System.Diagnostics.Trace.WriteLine("MyRegistryPlugin::OnFunctionCall called [Hook: " + hookInfo.FunctionName + " @ 0x" + hookInfo.Address.ToString("X") + " / Chain:" + chainIndex.ToString() + "]");
        INktParamsEnum pms;

        callInfo.AddString("sample name", "HKEY extractor sample");
        pms = callInfo.Params();
        for (int i = 0; i < pms.Count; i++)
        {
            INktParam p = pms.GetAt(i);
            if (p.IsPointer)
            {
                p = p.Evaluate();
            }
            if (p != null && p.TypeName == "HKEY")
            {
                callInfo.AddSizeT("param#" + i.ToString(), p.SizeTVal);
            }
        }
        return(0);
    }
예제 #4
0
    public int OnWriteFile(INktHookInfo hookInfo, int chainIndex, INktHookCallInfoPlugin callInfo)
    {
        System.Diagnostics.Trace.WriteLine("MyFilePlugin::OnWriteFile called [Hook: " + hookInfo.FunctionName + " @ 0x" + hookInfo.Address.ToString("X") + " / Chain:" + chainIndex.ToString() + "]");
        try
        {
            if (callInfo.IsPreCall != false)
            {
                IntPtr fileHandle = callInfo.Params().GetAt(0).SizeTVal;
                string s;

                lock (handleMap)
                {
                    if (handleMap.TryGetValue(fileHandle, out s) != false)
                    {
                        callInfo.AddString("WriteFile", s);
                    }
                }
            }
        }
        catch (System.Exception ex)
        {
            System.Diagnostics.Trace.WriteLine(ex.ToString());
        }
        return 0;
    }