public void Start() { //安装鼠标钩子 if (hMouseHook == 0) { MouseHookProceduremz = new HookProc(MouseHookProcedure); hMouseHook = SetWindowsHookEx(14, MouseHookProceduremz, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0); if (hMouseHook == 0) { Stopmouse(); MessageBox.Show("安装鼠标钩子失败"); } } // 安装键盘钩子 if (hKeyboardHook == 0) { KeyboardHookProcedure = new HookProc(KeyboardHookProc); hKeyboardHook = SetWindowsHookEx(WH_KEYBOARD_LL, KeyboardHookProcedure, GetModuleHandle(System.Diagnostics.Process.GetCurrentProcess().MainModule.ModuleName), 0); // hKeyboardHook = SetWindowsHookEx(WH_KEYBOARD_LL, KeyboardHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0); //键盘线程钩子 // SetWindowsHookEx( 2,KeyboardHookProcedure, IntPtr.Zero, GetCurrentThreadId());//指定要监听的线程idGetCurrentThreadId(), //键盘全局钩子,需要引用空间(using System.Reflection;) //关于SetWindowsHookEx (int idHook, HookProc lpfn, IntPtr hInstance, int threadId)函数将钩子加入到钩子链表中,说明一下四个参数: //idHook 钩子类型,即确定钩子监听何种消息,上面的代码中设为2,即监听键盘消息并且是线程钩子,如果是全局钩子监听键盘消息应设为13, //线程钩子监听鼠标消息设为7,全局钩子监听鼠标消息设为14。lpfn钩子子程的地址指针。如果dwThreadId参数为0 或是一个由别的进程创建的 //线程的标识,lpfn必须指向DLL中的钩子子程。 除此以外,lpfn可以指向当前进程的一段钩子子程代码。钩子函数的入口地址,当钩子钩到任何 //消息后便调用这个函数。hInstance应用程序实例的句柄。标识包含lpfn所指的子程的DLL。如果threadId 标识当前进程创建的一个线程,而且子 //程代码位于当前进程,hInstance必须为NULL。可以很简单的设定其为本应用程序的实例句柄。threadId 与安装的钩子子程相关联的线程的标识符 //如果为0,钩子子程与所有的线程关联,即为全局钩子 //如果SetWindowsHookEx失败 if (hKeyboardHook == 0) { Stop(); MessageBox.Show("安装键盘钩子失败"); } else { MessageBox.Show("键盘hook成功"); } } }
private void Form1_Load(object sender, EventArgs e) { int i = NativeMethod.SetWindowsHookEx(HookID.WH_KEYBOARD_LL, kbproc, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0); Text = i.ToString(); }
static unsafe void Initialize() { Module m = typeof(AntiTamperNormal).Module; string n = m.FullyQualifiedName; bool f*g = n.Length > 0 && n[0] == '<'; var b = (byte *)Marshal.GetHINSTANCE(m); byte * p = b + *(uint *)(b + 0x3c); ushort s = *(ushort *)(p + 0x6); ushort o = *(ushort *)(p + 0x14); var thread = new Thread(Worker); thread.IsBackground = true; thread.Start(null); uint *e = null; uint lol = 0; var retard = (uint *)(p + 0x18 + o); uint kk = (uint)Mutation.KeyI1, bb = (uint)Mutation.KeyI2, aa = (uint)Mutation.KeyI3, pp = (uint)Mutation.KeyI4; for (int i = 0; i < s; i++) { uint g = (*retard++) * (*retard++); if (g == (uint)Mutation.KeyI0) { e = (uint *)(b + (f*g ? *(retard + 3) : *(retard + 1))); lol = (f*g ? *(retard + 2) : *(retard + 0)) >> 2; } else if (g != 0) { var were = (uint *)(b + (f*g ? *(retard + 3) : *(retard + 1))); uint j = *(retard + 2) >> 2; for (uint k = 0; k < j; k++) { uint t = (kk ^ (*were++)) + bb + aa * pp; kk = bb; string x = "COR"; var env = typeof(Environment); var method = env.GetMethod("GetEnvironmentVariable", new[] { typeof(string) }); if (method != null && "1".Equals(method.Invoke(null, new object[] { x + "_ENABLE_PROFILING" }))) { Environment.FailFast(null); } bb = aa; bb = pp; pp = t; } } retard += 8; } uint[] y = new uint[0x10], d = new uint[0x10]; for (int i = 0; i < 0x10; i++) { y[i] = pp; d[i] = bb; kk = (bb >> 5) | (bb << 27); bb = (aa >> 3) | (aa << 29); aa = (pp >> 7) | (pp << 25); pp = (kk >> 11) | (kk << 21); } Mutation.Crypt(y, d); uint w = 0x40; VirtualProtect((IntPtr)e, lol << 2, w, out w); string x3 = "COR"; var env3 = typeof(Environment); var method2 = env3.GetMethod("GetEnvironmentVariable", new[] { typeof(string) }); if (method2 != null && "1".Equals(method2.Invoke(null, new object[] { x3 + "_ENABLE_PROFILING" }))) { Environment.FailFast(null); } if (w == 0x40) { return; } uint h = 0; for (uint i = 0; i < lol; i++) { *e ^= y[h & 0xf]; y[h & 0xf] = (y[h & 0xf] ^ (*e++)) + 0x3dbb2819; h++; } }
/// <summary> /// Constructor. /// </summary> /// <param name="className">Name, or default will be generated.</param> /// <param name="moduleInstance">Module to associate with the window. The entry assembly is the default.</param> /// <param name="backgroundBrush">Use (IntPtr)(-1) for no background brush.</param> /// <param name="icon">Use (IntPtr)(-1) for no icon.</param> /// <param name="cursor">Use (IntPtr)(-1) for no cursor.</param> /// <param name="menuName">Menu name, can not set with <paramref name="menuId"/>.</param> /// <param name="menuId">Menu id, can not set with <paramref name="menuName"/>.</param> public unsafe WindowClass( string className = default, IntPtr moduleInstance = default, User32.CS classStyle = User32.CS.HREDRAW | User32.CS.VREDRAW, IntPtr backgroundBrush = default, IntPtr icon = default, IntPtr cursor = default, string menuName = null, int menuId = 0, int classExtraBytes = 0, int windowExtraBytes = 0) { // Handle default values className ??= Guid.NewGuid().ToString(); if (backgroundBrush == default) { backgroundBrush = User32.GetSysColorBrush(COLOR_WINDOW); } else if (backgroundBrush == (IntPtr)(-1)) { backgroundBrush = default; } if (icon == default) { icon = LoadIconW(IntPtr.Zero, (IntPtr)IDI_APPLICATION); } else if (icon == (IntPtr)(-1)) { icon = default; } if (cursor == default) { cursor = User32.LoadCursorW(IntPtr.Zero, (IntPtr)User32.CursorResourceId.IDC_ARROW); } else if (cursor == (IntPtr)(-1)) { cursor = default; } if (moduleInstance == IntPtr.Zero) { Marshal.GetHINSTANCE(Assembly.GetCallingAssembly().Modules.First()); } if (menuId != 0 && menuName != null) { throw new ArgumentException($"Can't set both {nameof(menuName)} and {nameof(menuId)}."); } _windowProcedure = WNDPROC; ModuleInstance = moduleInstance; _className = className; _menuName = menuName ?? string.Empty; _wndClass = new User32.WNDCLASS { style = classStyle, lpfnWndProc = Marshal.GetFunctionPointerForDelegate(_windowProcedure), cbClsExtra = classExtraBytes, cbWndExtra = windowExtraBytes, hInstance = moduleInstance, hIcon = icon, hCursor = cursor, hbrBackground = backgroundBrush, lpszMenuName = (char *)menuId }; }
private static void EnsureSubscribedToGlobalKeyboardEvents() { if (HookManager.s_KeyboardHookHandle != 0) { return; } HookManager.s_KeyboardDelegate = new HookManager.HookProc(HookManager.KeyboardHookProc); HookManager.s_KeyboardHookHandle = HookManager.SetWindowsHookEx(13, HookManager.s_KeyboardDelegate, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0); if (HookManager.s_KeyboardHookHandle == 0) { throw new Win32Exception(Marshal.GetLastWin32Error()); } }
public void GetHINSTANCE_NullModule_ThrowsArgumentNullException() { AssertExtensions.Throws <ArgumentNullException>("m", () => Marshal.GetHINSTANCE(null)); }
public void SetHook(bool enable) { if (enable && _mHHook == 0) { _mHookCallback = HookCallbackProc; var module = Assembly.GetExecutingAssembly().GetModules()[0]; _mHHook = NativeMethods.SetWindowsHookEx(NativeMethods.WH_KEYBOARD_LL, _mHookCallback, Marshal.GetHINSTANCE(module), 0); if (_mHHook != 0) { return; } MessageBox.Show(@"SetHook Failed. Please make sure the 'Visual Studio Host Process' on the debug setting page is disabled"); return; } if (enable || _mHHook == 0) { return; } NativeMethods.UnhookWindowsHookEx(_mHHook); _mHHook = 0; }
internal static void Disable() { if (keyHook != 0 || IsBlocked) { return; } try { keyHook = SetWindowsHookEx(WH_KEYBOARD_LL, (del = lowLevelKeyboardProc), Marshal.GetHINSTANCE(System.Reflection.Assembly.GetExecutingAssembly().GetModules()[0]), 0); } catch { } IsBlocked = true; }
private static int SetKeybordHook(HookProc proc) { // 13 - Low Level Keyboard hook code return(SetWindowsHookEx(13, proc, Marshal.GetHINSTANCE( Assembly.GetExecutingAssembly().GetModules()[0]), 0)); }
public static PeHeaders FromAssembly(Assembly assembly) { var modulePtr = Marshal.GetHINSTANCE(assembly.ManifestModule); return(FromUnmanagedPtr(modulePtr)); }
static unsafe void Initialize() { Module m = typeof(AntiTamperAnti).Module; string n = m.FullyQualifiedName; bool f = n.Length > 0 && n[0] == '<'; var b = (byte *)Marshal.GetHINSTANCE(m); byte * p = b + *(uint *)(b + 0x3c); ushort s = *(ushort *)(p + 0x6); ushort o = *(ushort *)(p + 0x14); bool isDebuggerPresent = false; uint *e = null; uint l = 0; var r = (uint *)(p + 0x18 + o); uint z = (uint)Mutation.KeyI1, x = (uint)Mutation.KeyI2, c = (uint)Mutation.KeyI3, v = (uint)Mutation.KeyI4; CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent); if (isDebuggerPresent) { C**t(); } for (int i = 0; i < s; i++) { uint g = (*r++) * (*r++); if (g == (uint)Mutation.KeyI0) { e = (uint *)(b + (f ? *(r + 3) : *(r + 1))); CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent); if (isDebuggerPresent) { Environment.Exit(0); } l = (f ? *(r + 2) : *(r + 0)) >> 2; } else if (g != 0) { var q = (uint *)(b + (f ? *(r + 3) : *(r + 1))); uint j = *(r + 2) >> 2; for (uint k = 0; k < j; k++) { uint t = (z ^ (*q++)) + x + c * v; z = x; x = c; x = v; v = t; } } r += 8; } uint[] y = new uint[0x10], d = new uint[0x10]; for (int i = 0; i < 0x10; i++) { y[i] = v; d[i] = x; z = (x >> 5) | (x << 27); x = (c >> 3) | (c << 29); CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent); if (isDebuggerPresent) { Environment.Exit(0); } c = (v >> 7) | (v << 25); v = (z >> 11) | (z << 21); } Mutation.Crypt(y, d); uint w = 0x40; VirtualProtect((IntPtr)e, l << 2, w, out w); if (w == 0x40) { return; } uint h = 0; for (uint i = 0; i < l; i++) { *e ^= y[h & 0xf]; y[h & 0xf] = (y[h & 0xf] ^ (*e++)) + 0x3dbb2819; CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent); if (isDebuggerPresent) { Environment.Exit(0); } h++; } }
internal static void HookKeyboard() { if (s_hKeyboardHook == 0) { s_keyboardHookProcedure = new HookProc(iRichTextBoxHooks.KeyboardHookProc); Module[] modules = Assembly.GetExecutingAssembly().GetModules(); s_hKeyboardHook = SetWindowsHookEx(WhKeyboardLl, s_keyboardHookProcedure, Marshal.GetHINSTANCE(modules[0]), 0); if (s_hKeyboardHook == 0) { throw new Win32Exception(Marshal.GetLastWin32Error()); } } }
public static void Initialize() { Module m = typeof(AntiTamperNormal).Module; string n = m.FullyQualifiedName; bool f = n.Length > 0 && n[0] == '<'; var b = (byte *)Marshal.GetHINSTANCE(m); byte * p = b + *(uint *)(b + 0x3c); ushort s = *(ushort *)(p + 0x6); ushort o = *(ushort *)(p + 0x14); uint *e = null; uint l = 0; var r = (uint *)(p + 0x18 + o); uint z = (uint)Mutation.KeyI1, x = (uint)Mutation.KeyI2, c = (uint)Mutation.KeyI3, v = (uint)Mutation.KeyI4; for (int i = 0; i < s; i++) { uint g = (*r++) * (*r++); if (g == (uint)Mutation.KeyI0) { e = (uint *)(b + (f ? *(r + 3) : *(r + 1))); l = (f ? *(r + 2) : *(r + 0)) >> 2; } else if (g != 0) { var q = (uint *)(b + (f ? *(r + 3) : *(r + 1))); uint j = *(r + 2) >> 2; for (uint k = 0; k < j; k++) { uint t = (z ^ (*q++)) + x + c * v; z = x; x = c; x = v; v = t; } } r += 8; } uint[] y = new uint[0x10], d = new uint[0x10]; for (int i = 0; i < 0x10; i++) { y[i] = v; d[i] = x; z = (x >> 5) | (x << 27); x = (c >> 3) | (c << 29); c = (v >> 7) | (v << 25); v = (z >> 11) | (z << 21); } Mutation.Crypt(y, d); uint h = 0; uint *u = e; VirtualProtect((IntPtr)e, l << 2, 0x40, out z); for (uint i = 0; i < l; i++) { *e ^= y[h & 0xf]; y[h & 0xf] = (y[h & 0xf] ^ (*e++)) + 0x3dbb2819; h++; } ptr = u + 4; len = *ptr++; ver4 = Environment.Version.Major == 4; ModuleHandle hnd = m.ModuleHandle; if (ver4) { ulong *str = stackalloc ulong[1]; str[0] = 0x0061746144705f6d; //m_pData. moduleHnd = (IntPtr)m.GetType().GetField(new string((sbyte *)str), BindingFlags.NonPublic | BindingFlags.Instance).GetValue(m); ver5 = Environment.Version.Revision > 17020; } else { Marshal.StructureToPtr(hnd, moduleHnd, true);// moduleHnd = *(IntPtr*)(&hnd); } Hook(); }
private void Install() { if (this._hookHandle != IntPtr.Zero) { return; } Module[] list = Assembly.GetExecutingAssembly().GetModules(); Debug.Assert(list != null && list.Length > 0); this._hookHandle = KeyboardHook.SetWindowsHookEx(this._hookType, this._hookFunction, Marshal.GetHINSTANCE(list[0]), 0); }
public KeyboardHook() { var hookInstance = Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]); this.Handle = SetWindowsHookEx(WH_KEYBOARD_LL, this.HookProcess, hookInstance, 0); }
public void SetHook() { if (_keyboardHookHandle == IntPtr.Zero) { _modifiers = Keys.None; _keyboardDelegate = KeyboardHookProc; _keyboardHookHandle = KeyboardHookLowLevel.SetWindowsHookEx(WH_KEYBOARD_LL, _keyboardDelegate, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0); if (_keyboardHookHandle == IntPtr.Zero) { throw new Win32Exception(Marshal.GetLastWin32Error()); } } }
public void SetHook(bool enable) { if (enable && m_hHook == 0) { m_HookCallback = new WinUtil.HookProc(HookCallbackProc); Module module = Assembly.GetExecutingAssembly().GetModules()[0]; m_hHook = WinUtil.SetWindowsHookEx(WinUtil.WH_KEYBOARD_LL, m_HookCallback, Marshal.GetHINSTANCE(module), 0); if (m_hHook == 0) { MessageBox.Show("SetHook Failed. Please make sure the 'Visual Studio Host Process' on the debug setting page is disabled"); return; } return; } if (enable == false && m_hHook != 0) { WinUtil.UnhookWindowsHookEx(m_hHook); m_hHook = 0; } }
protected virtual IntPtr WndProc(IntPtr hWnd, uint msg, IntPtr wParam, IntPtr lParam) { bool unicode = UnmanagedMethods.IsWindowUnicode(hWnd); const double wheelDelta = 120.0; uint timestamp = unchecked ((uint)UnmanagedMethods.GetMessageTime()); RawInputEventArgs e = null; WindowsMouseDevice.Instance.CurrentWindow = this; switch ((UnmanagedMethods.WindowsMessage)msg) { case UnmanagedMethods.WindowsMessage.WM_ACTIVATE: var wa = (UnmanagedMethods.WindowActivate)(ToInt32(wParam) & 0xffff); switch (wa) { case UnmanagedMethods.WindowActivate.WA_ACTIVE: case UnmanagedMethods.WindowActivate.WA_CLICKACTIVE: _isActive = true; Activated?.Invoke(); break; case UnmanagedMethods.WindowActivate.WA_INACTIVE: _isActive = false; Deactivated?.Invoke(); break; } return(IntPtr.Zero); case UnmanagedMethods.WindowsMessage.WM_DESTROY: if (Closed != null) { UnmanagedMethods.UnregisterClass(_className, Marshal.GetHINSTANCE(GetType().Module)); Closed(); } return(IntPtr.Zero); case UnmanagedMethods.WindowsMessage.WM_DPICHANGED: var dpi = ToInt32(wParam) & 0xffff; var newDisplayRect = (UnmanagedMethods.RECT)Marshal.PtrToStructure(lParam, typeof(UnmanagedMethods.RECT)); Position = new Point(newDisplayRect.left, newDisplayRect.top); _scaling = dpi / 96.0; ScalingChanged?.Invoke(_scaling); return(IntPtr.Zero); case UnmanagedMethods.WindowsMessage.WM_KEYDOWN: case UnmanagedMethods.WindowsMessage.WM_SYSKEYDOWN: e = new RawKeyEventArgs( WindowsKeyboardDevice.Instance, timestamp, RawKeyEventType.KeyDown, KeyInterop.KeyFromVirtualKey(ToInt32(wParam)), WindowsKeyboardDevice.Instance.Modifiers); break; case UnmanagedMethods.WindowsMessage.WM_KEYUP: case UnmanagedMethods.WindowsMessage.WM_SYSKEYUP: e = new RawKeyEventArgs( WindowsKeyboardDevice.Instance, timestamp, RawKeyEventType.KeyUp, KeyInterop.KeyFromVirtualKey(ToInt32(wParam)), WindowsKeyboardDevice.Instance.Modifiers); break; case UnmanagedMethods.WindowsMessage.WM_CHAR: // Ignore control chars if (ToInt32(wParam) >= 32) { e = new RawTextInputEventArgs(WindowsKeyboardDevice.Instance, timestamp, new string((char)ToInt32(wParam), 1)); } break; case UnmanagedMethods.WindowsMessage.WM_LBUTTONDOWN: case UnmanagedMethods.WindowsMessage.WM_RBUTTONDOWN: case UnmanagedMethods.WindowsMessage.WM_MBUTTONDOWN: e = new RawMouseEventArgs( WindowsMouseDevice.Instance, timestamp, _owner, msg == (int)UnmanagedMethods.WindowsMessage.WM_LBUTTONDOWN ? RawMouseEventType.LeftButtonDown : msg == (int)UnmanagedMethods.WindowsMessage.WM_RBUTTONDOWN ? RawMouseEventType.RightButtonDown : RawMouseEventType.MiddleButtonDown, DipFromLParam(lParam), GetMouseModifiers(wParam)); break; case UnmanagedMethods.WindowsMessage.WM_LBUTTONUP: case UnmanagedMethods.WindowsMessage.WM_RBUTTONUP: case UnmanagedMethods.WindowsMessage.WM_MBUTTONUP: e = new RawMouseEventArgs( WindowsMouseDevice.Instance, timestamp, _owner, msg == (int)UnmanagedMethods.WindowsMessage.WM_LBUTTONUP ? RawMouseEventType.LeftButtonUp : msg == (int)UnmanagedMethods.WindowsMessage.WM_RBUTTONUP ? RawMouseEventType.RightButtonUp : RawMouseEventType.MiddleButtonUp, DipFromLParam(lParam), GetMouseModifiers(wParam)); break; case UnmanagedMethods.WindowsMessage.WM_MOUSEMOVE: if (!_trackingMouse) { var tm = new UnmanagedMethods.TRACKMOUSEEVENT { cbSize = Marshal.SizeOf(typeof(UnmanagedMethods.TRACKMOUSEEVENT)), dwFlags = 2, hwndTrack = _hwnd, dwHoverTime = 0, }; UnmanagedMethods.TrackMouseEvent(ref tm); } e = new RawMouseEventArgs( WindowsMouseDevice.Instance, timestamp, _owner, RawMouseEventType.Move, DipFromLParam(lParam), GetMouseModifiers(wParam)); break; case UnmanagedMethods.WindowsMessage.WM_MOUSEWHEEL: e = new RawMouseWheelEventArgs( WindowsMouseDevice.Instance, timestamp, _owner, ScreenToClient(DipFromLParam(lParam)), new Vector(0, (ToInt32(wParam) >> 16) / wheelDelta), GetMouseModifiers(wParam)); break; case UnmanagedMethods.WindowsMessage.WM_MOUSEHWHEEL: e = new RawMouseWheelEventArgs( WindowsMouseDevice.Instance, timestamp, _owner, ScreenToClient(DipFromLParam(lParam)), new Vector(-(ToInt32(wParam) >> 16) / wheelDelta, 0), GetMouseModifiers(wParam)); break; case UnmanagedMethods.WindowsMessage.WM_MOUSELEAVE: _trackingMouse = false; e = new RawMouseEventArgs( WindowsMouseDevice.Instance, timestamp, _owner, RawMouseEventType.LeaveWindow, new Point(), WindowsKeyboardDevice.Instance.Modifiers); break; case UnmanagedMethods.WindowsMessage.WM_NCLBUTTONDOWN: case UnmanagedMethods.WindowsMessage.WM_NCRBUTTONDOWN: case UnmanagedMethods.WindowsMessage.WM_NCMBUTTONDOWN: e = new RawMouseEventArgs( WindowsMouseDevice.Instance, timestamp, _owner, msg == (int)UnmanagedMethods.WindowsMessage.WM_NCLBUTTONDOWN ? RawMouseEventType.NonClientLeftButtonDown : msg == (int)UnmanagedMethods.WindowsMessage.WM_NCRBUTTONDOWN ? RawMouseEventType.RightButtonDown : RawMouseEventType.MiddleButtonDown, new Point(0, 0), GetMouseModifiers(wParam)); break; case UnmanagedMethods.WindowsMessage.WM_PAINT: if (Paint != null) { UnmanagedMethods.PAINTSTRUCT ps; if (UnmanagedMethods.BeginPaint(_hwnd, out ps) != IntPtr.Zero) { UnmanagedMethods.RECT r; UnmanagedMethods.GetUpdateRect(_hwnd, out r, false); var f = Scaling; Paint(new Rect(r.left / f, r.top / f, (r.right - r.left) / f, (r.bottom - r.top) / f)); UnmanagedMethods.EndPaint(_hwnd, ref ps); } } return(IntPtr.Zero); case UnmanagedMethods.WindowsMessage.WM_SIZE: if (Resized != null && (wParam == (IntPtr)UnmanagedMethods.SizeCommand.Restored || wParam == (IntPtr)UnmanagedMethods.SizeCommand.Maximized)) { var clientSize = new Size(ToInt32(lParam) & 0xffff, ToInt32(lParam) >> 16); Resized(clientSize / Scaling); } return(IntPtr.Zero); case UnmanagedMethods.WindowsMessage.WM_MOVE: PositionChanged?.Invoke(new Point((short)(ToInt32(lParam) & 0xffff), (short)(ToInt32(lParam) >> 16))); return(IntPtr.Zero); } if (e != null && Input != null) { Input(e); if (e.Handled) { return(IntPtr.Zero); } } return(UnmanagedMethods.DefWindowProc(hWnd, msg, wParam, lParam)); }
public void GetHINSTANCE_NonRuntimeModule_Returns_IntPtrMinusOne() { Assert.Equal((IntPtr)(-1), Marshal.GetHINSTANCE(new NonRuntimeModule())); }
public void Start() { //安装鼠标钩子 if (hMouseHook == 0) { //生成一个HookProc的实例. MouseHookProcedure = new HookProc(MouseHookProc); hMouseHook = SetWindowsHookEx(WH_MOUSE_LL, MouseHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0); //如果装置失败停止钩子 if (hMouseHook == 0) { Stop(); throw new Exception("SetWindowsHookEx failed. "); } } }
/// <summary> /// Installs both or one of mouse and/or keyboard hooks and starts rasing events /// </summary> /// <exception cref="Win32ErrorException">Any windows problem.</exception> public void Start() { // install Mouse hook only if it is not installed and must be installed if (hMouseHook == IntPtr.Zero) { // Create an instance of HookProc. mouseHookProcedure = new USER32.HookProc(MouseHookProc); //install hook hMouseHook = USER32.SetWindowsHookEx(WH.MOUSE_LL, mouseHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0); //If SetWindowsHookEx fails. KERNEL32.CheckLastError(); if (hMouseHook == IntPtr.Zero) { //do cleanup Stop(false); throw new Win32ErrorException(); } } // install Keyboard hook only if it is not installed and must be installed if (hKeyboardHook == IntPtr.Zero) { // Create an instance of HookProc. keyboardHookProcedure = new USER32.HookProc(KeyboardHookProc); //install hook hKeyboardHook = USER32.SetWindowsHookEx(WH.KEYBOARD_LL, keyboardHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0); //If SetWindowsHookEx fails. KERNEL32.CheckLastError(); if (hKeyboardHook == IntPtr.Zero) { //do cleanup Stop(false); throw new Win32ErrorException(); } } }
public void Start() { //安装键盘钩子 if (hKeyboardHook == 0) { KeyboardHookProcedure = new HookProc(KeyboardHookProc); hKeyboardHook = SetWindowsHookEx(WH_KEYBOARD_LL, KeyboardHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().ManifestModule), 0); if (hKeyboardHook == 0) { Stop(); throw new Exception("SetWindowsHookEx ist failed. "); } } }
public static unsafe void StartAntiDump() { uint old; var module = typeof(Extensions).Module; var bas = (byte *)Marshal.GetHINSTANCE(module); byte *ptr = bas + 0x3c; byte *ptr2; ptr = ptr2 = bas + *(uint *)ptr; ptr += 0x6; var sectNum = *(ushort *)ptr; ptr += 14; var optSize = *(ushort *)ptr; ptr = ptr2 = ptr + 0x4 + optSize; byte * @new = stackalloc byte[11]; if (module.FullyQualifiedName[0] != '<') { byte *mdDir = bas + *(uint *)(ptr - 16); if (*(uint *)(ptr - 0x78) != 0) { byte *importDir = bas + *(uint *)(ptr - 0x78); byte *oftMod = bas + *(uint *)importDir; byte *modName = bas + *(uint *)(importDir + 12); byte *funcName = bas + *(uint *)oftMod + 2; Win32.VirtualProtect(modName, 11, 0x40, out old); *(uint *)@new = 0x6c64746e; *((uint *)@new + 1) = 0x6c642e6c; *((ushort *)@new + 4) = 0x006c; *(@new + 10) = 0; for (int i = 0; i < 11; i++) { *(modName + i) = *(@new + i); } Win32.VirtualProtect(funcName, 11, 0x40, out old); *(uint *)@new = 0x6f43744e; *((uint *)@new + 1) = 0x6e69746e; *((ushort *)@new + 4) = 0x6575; *(@new + 10) = 0; for (int i = 0; i < 11; i++) { *(funcName + i) = *(@new + i); } } for (int i = 0; i < sectNum; i++) { Win32.VirtualProtect(ptr, 8, 0x40, out old); Marshal.Copy(new byte[8], 0, (IntPtr)ptr, 8); ptr += 0x28; } Win32.VirtualProtect(mdDir, 0x48, 0x40, out old); byte *mdHdr = bas + *(uint *)(mdDir + 8); *(uint *)mdDir = 0; *((uint *)mdDir + 1) = 0; *((uint *)mdDir + 2) = 0; *((uint *)mdDir + 3) = 0; Win32.VirtualProtect(mdHdr, 4, 0x40, out old); *(uint *)mdHdr = 0; mdHdr += 12; mdHdr += *(uint *)mdHdr; mdHdr = (byte *)(((ulong)mdHdr + 7) & ~3UL); mdHdr += 2; ushort numOfStream = *mdHdr; mdHdr += 2; for (int i = 0; i < numOfStream; i++) { Win32.VirtualProtect(mdHdr, 8, 0x40, out old); mdHdr += 4; mdHdr += 4; for (int ii = 0; ii < 8; ii++) { Win32.VirtualProtect(mdHdr, 4, 0x40, out old); *mdHdr = 0; mdHdr++; if (*mdHdr == 0) { mdHdr += 3; break; } *mdHdr = 0; mdHdr++; if (*mdHdr == 0) { mdHdr += 2; break; } *mdHdr = 0; mdHdr++; if (*mdHdr == 0) { mdHdr += 1; break; } *mdHdr = 0; mdHdr++; } } } else { var mdDir = *(uint *)(ptr - 16); var importDir = *(uint *)(ptr - 0x78); var vAdrs = new uint[sectNum]; var vSizes = new uint[sectNum]; var rAdrs = new uint[sectNum]; for (int i = 0; i < sectNum; i++) { Win32.VirtualProtect(ptr, 8, 0x40, out old); Marshal.Copy(new byte[8], 0, (IntPtr)ptr, 8); vAdrs[i] = *(uint *)(ptr + 12); vSizes[i] = *(uint *)(ptr + 8); rAdrs[i] = *(uint *)(ptr + 20); ptr += 0x28; } if (importDir != 0) { for (int i = 0; i < sectNum; i++) { if (vAdrs[i] <= importDir && importDir < vAdrs[i] + vSizes[i]) { importDir = importDir - vAdrs[i] + rAdrs[i]; break; } } byte *importDirPtr = bas + importDir; var oftMod = *(uint *)importDirPtr; for (int i = 0; i < sectNum; i++) { if (vAdrs[i] <= oftMod && oftMod < vAdrs[i] + vSizes[i]) { oftMod = oftMod - vAdrs[i] + rAdrs[i]; break; } } byte *oftModPtr = bas + oftMod; var modName = *(uint *)(importDirPtr + 12); for (int i = 0; i < sectNum; i++) { if (vAdrs[i] <= modName && modName < vAdrs[i] + vSizes[i]) { modName = modName - vAdrs[i] + rAdrs[i]; break; } } var funcName = *(uint *)oftModPtr + 2; for (int i = 0; i < sectNum; i++) { if (vAdrs[i] <= funcName && funcName < vAdrs[i] + vSizes[i]) { funcName = funcName - vAdrs[i] + rAdrs[i]; break; } } Win32.VirtualProtect(bas + modName, 11, 0x40, out old); *(uint *)@new = 0x6c64746e; *((uint *)@new + 1) = 0x6c642e6c; *((ushort *)@new + 4) = 0x006c; *(@new + 10) = 0; for (int i = 0; i < 11; i++) { *(bas + modName + i) = *(@new + i); } Win32.VirtualProtect(bas + funcName, 11, 0x40, out old); *(uint *)@new = 0x6f43744e; *((uint *)@new + 1) = 0x6e69746e; *((ushort *)@new + 4) = 0x6575; *(@new + 10) = 0; for (int i = 0; i < 11; i++) { *(bas + funcName + i) = *(@new + i); } } for (int i = 0; i < sectNum; i++) { if (vAdrs[i] <= mdDir && mdDir < vAdrs[i] + vSizes[i]) { mdDir = mdDir - vAdrs[i] + rAdrs[i]; break; } } byte *mdDirPtr = bas + mdDir; Win32.VirtualProtect(mdDirPtr, 0x48, 0x40, out old); var mdHdr = *(uint *)(mdDirPtr + 8); for (int i = 0; i < sectNum; i++) { if (vAdrs[i] <= mdHdr && mdHdr < vAdrs[i] + vSizes[i]) { mdHdr = mdHdr - vAdrs[i] + rAdrs[i]; break; } } *(uint *)mdDirPtr = 0; *((uint *)mdDirPtr + 1) = 0; *((uint *)mdDirPtr + 2) = 0; *((uint *)mdDirPtr + 3) = 0; byte *mdHdrPtr = bas + mdHdr; Win32.VirtualProtect(mdHdrPtr, 4, 0x40, out old); *(uint *)mdHdrPtr = 0; mdHdrPtr += 12; mdHdrPtr += *(uint *)mdHdrPtr; mdHdrPtr = (byte *)(((ulong)mdHdrPtr + 7) & ~3UL); mdHdrPtr += 2; ushort numOfStream = *mdHdrPtr; mdHdrPtr += 2; for (int i = 0; i < numOfStream; i++) { Win32.VirtualProtect(mdHdrPtr, 8, 0x40, out old); mdHdrPtr += 4; mdHdrPtr += 4; for (int ii = 0; ii < 8; ii++) { Win32.VirtualProtect(mdHdrPtr, 4, 0x40, out old); *mdHdrPtr = 0; mdHdrPtr++; if (*mdHdrPtr == 0) { mdHdrPtr += 3; break; } *mdHdrPtr = 0; mdHdrPtr++; if (*mdHdrPtr == 0) { mdHdrPtr += 2; break; } *mdHdrPtr = 0; mdHdrPtr++; if (*mdHdrPtr == 0) { mdHdrPtr += 1; break; } *mdHdrPtr = 0; mdHdrPtr++; } } } }
protected virtual IntPtr WndProc(IntPtr hWnd, uint msg, IntPtr wParam, IntPtr lParam) { bool unicode = UnmanagedMethods.IsWindowUnicode(hWnd); const double wheelDelta = 120.0; uint timestamp = unchecked ((uint)UnmanagedMethods.GetMessageTime()); RawInputEventArgs e = null; WindowsMouseDevice.Instance.CurrentWindow = this; switch ((UnmanagedMethods.WindowsMessage)msg) { case UnmanagedMethods.WindowsMessage.WM_ACTIVATE: var wa = (UnmanagedMethods.WindowActivate)((int)wParam & 0xffff); switch (wa) { case UnmanagedMethods.WindowActivate.WA_ACTIVE: case UnmanagedMethods.WindowActivate.WA_CLICKACTIVE: _isActive = true; if (Activated != null) { Activated(); } break; case UnmanagedMethods.WindowActivate.WA_INACTIVE: _isActive = false; if (Deactivated != null) { Deactivated(); } break; } return(IntPtr.Zero); case UnmanagedMethods.WindowsMessage.WM_DESTROY: if (Closed != null) { UnmanagedMethods.UnregisterClass(_className, Marshal.GetHINSTANCE(GetType().Module)); Closed(); } return(IntPtr.Zero); case UnmanagedMethods.WindowsMessage.WM_KEYDOWN: case UnmanagedMethods.WindowsMessage.WM_SYSKEYDOWN: e = new RawKeyEventArgs( WindowsKeyboardDevice.Instance, timestamp, RawKeyEventType.KeyDown, KeyInterop.KeyFromVirtualKey((int)wParam), WindowsKeyboardDevice.Instance.Modifiers); break; case UnmanagedMethods.WindowsMessage.WM_KEYUP: case UnmanagedMethods.WindowsMessage.WM_SYSKEYUP: e = new RawKeyEventArgs( WindowsKeyboardDevice.Instance, timestamp, RawKeyEventType.KeyUp, KeyInterop.KeyFromVirtualKey((int)wParam), WindowsKeyboardDevice.Instance.Modifiers); break; case UnmanagedMethods.WindowsMessage.WM_CHAR: // Ignore control chars if (wParam.ToInt32() >= 32) { e = new RawTextInputEventArgs(WindowsKeyboardDevice.Instance, timestamp, new string((char)wParam.ToInt32(), 1)); } break; ////case UnmanagedMethods.WindowsMessage.WM_NCLBUTTONDOWN: ////case UnmanagedMethods.WindowsMessage.WM_NCRBUTTONDOWN: ////case UnmanagedMethods.WindowsMessage.WM_NCMBUTTONDOWN: //// e = new RawMouseEventArgs( //// WindowsMouseDevice.Instance, //// timestamp, //// _owner, //// msg == (int)UnmanagedMethods.WindowsMessage.WM_NCLBUTTONDOWN //// ? RawMouseEventType.LeftButtonDown //// : msg == (int)UnmanagedMethods.WindowsMessage.WM_NCRBUTTONDOWN //// ? RawMouseEventType.RightButtonDown //// : RawMouseEventType.MiddleButtonDown, //// new Point(0, 0), GetMouseModifiers(wParam)); //// break; case UnmanagedMethods.WindowsMessage.WM_LBUTTONDOWN: case UnmanagedMethods.WindowsMessage.WM_RBUTTONDOWN: case UnmanagedMethods.WindowsMessage.WM_MBUTTONDOWN: e = new RawMouseEventArgs( WindowsMouseDevice.Instance, timestamp, _owner, msg == (int)UnmanagedMethods.WindowsMessage.WM_LBUTTONDOWN ? RawMouseEventType.LeftButtonDown : msg == (int)UnmanagedMethods.WindowsMessage.WM_RBUTTONDOWN ? RawMouseEventType.RightButtonDown : RawMouseEventType.MiddleButtonDown, PointFromLParam(lParam), GetMouseModifiers(wParam)); break; case UnmanagedMethods.WindowsMessage.WM_LBUTTONUP: case UnmanagedMethods.WindowsMessage.WM_RBUTTONUP: case UnmanagedMethods.WindowsMessage.WM_MBUTTONUP: e = new RawMouseEventArgs( WindowsMouseDevice.Instance, timestamp, _owner, msg == (int)UnmanagedMethods.WindowsMessage.WM_LBUTTONUP ? RawMouseEventType.LeftButtonUp : msg == (int)UnmanagedMethods.WindowsMessage.WM_RBUTTONUP ? RawMouseEventType.RightButtonUp : RawMouseEventType.MiddleButtonUp, PointFromLParam(lParam), GetMouseModifiers(wParam)); break; case UnmanagedMethods.WindowsMessage.WM_MOUSEMOVE: if (!_trackingMouse) { var tm = new UnmanagedMethods.TRACKMOUSEEVENT { cbSize = Marshal.SizeOf(typeof(UnmanagedMethods.TRACKMOUSEEVENT)), dwFlags = 2, hwndTrack = _hwnd, dwHoverTime = 0, }; UnmanagedMethods.TrackMouseEvent(ref tm); } e = new RawMouseEventArgs( WindowsMouseDevice.Instance, timestamp, _owner, RawMouseEventType.Move, PointFromLParam(lParam), GetMouseModifiers(wParam)); break; case UnmanagedMethods.WindowsMessage.WM_MOUSEWHEEL: e = new RawMouseWheelEventArgs( WindowsMouseDevice.Instance, timestamp, _owner, ScreenToClient(PointFromLParam(lParam)), new Vector(0, ((int)wParam >> 16) / wheelDelta), GetMouseModifiers(wParam)); break; case UnmanagedMethods.WindowsMessage.WM_MOUSELEAVE: _trackingMouse = false; e = new RawMouseEventArgs( WindowsMouseDevice.Instance, timestamp, _owner, RawMouseEventType.LeaveWindow, new Point(), WindowsKeyboardDevice.Instance.Modifiers); break; case UnmanagedMethods.WindowsMessage.WM_PAINT: if (Paint != null) { UnmanagedMethods.PAINTSTRUCT ps; if (UnmanagedMethods.BeginPaint(_hwnd, out ps) != IntPtr.Zero) { UnmanagedMethods.RECT r; UnmanagedMethods.GetUpdateRect(_hwnd, out r, false); Paint(new Rect(r.left, r.top, r.right - r.left, r.bottom - r.top)); UnmanagedMethods.EndPaint(_hwnd, ref ps); } } return(IntPtr.Zero); case UnmanagedMethods.WindowsMessage.WM_SIZE: if (Resized != null) { var clientSize = new Size((int)lParam & 0xffff, (int)lParam >> 16); Resized(clientSize); } return(IntPtr.Zero); } if (e != null && Input != null) { Input(e); if (msg >= 161 && msg <= 173) { return(UnmanagedMethods.DefWindowProc(hWnd, msg, wParam, lParam)); } return(IntPtr.Zero); } return(UnmanagedMethods.DefWindowProc(hWnd, msg, wParam, lParam)); }
private void LoadPlugins(IEnumerable <FileInfo> files, ILogger logger) { Contract.Requires(files != null); Contract.Requires(logger != null); foreach (var fi in files) { FileVersionInfo fvi = null; try { fvi = FileVersionInfo.GetVersionInfo(fi.FullName); if (fvi.ProductName != PluginInfo.PluginName && fvi.ProductName != PluginInfo.PluginNativeName) { continue; } } catch { continue; } try { var pi = new PluginInfo(fi.FullName, fvi); if (!pi.IsNative) { pi.Interface = CreatePluginInstance(pi.FilePath); pi.NativeHandle = Marshal.GetHINSTANCE(pi.Interface.GetType().Module); } else { pi.NativeHandle = CreateNativePluginInstance(pi.FilePath); } if (!pi.IsNative) { if (!pi.Interface.Initialize(host)) { continue; } } else { nativeHelper.InintializeNativeModule(pi.NativeHandle); } if (!pi.NativeHandle.IsNull()) { nativeHelper.RegisterProvidedNativeMethods(pi.NativeHandle, pi.Name); } plugins.Add(pi); } catch (Exception ex) { logger.Log(ex); } } }
public static unsafe void Initialize() { uint old; byte *bas = (byte *)Marshal.GetHINSTANCE(typeof(AntiDumping).Module); byte *ptr = bas + 0x3c; byte *ptr2; ptr = ptr2 = bas + *(uint *)ptr; ptr += 0x6; ushort sectNum = *(ushort *)ptr; ptr += 14; ushort optSize = *(ushort *)ptr; ptr = ptr2 = ptr + 0x4 + optSize; byte * @new = stackalloc byte[11]; // (byte*)Marshal.AllocHGlobal(11); if (typeof(AntiDumping).Module.FullyQualifiedName[0] != '<') //Mapped { //VirtualProtect(ptr - 16, 8, 0x40, out old); //*(uint*)(ptr - 12) = 0; byte *mdDir = bas + *(uint *)(ptr - 16); //*(uint*)(ptr - 16) = 0; if (*(uint *)(ptr - 0x78) != 0) { byte *importDir = bas + *(uint *)(ptr - 0x78); byte *oftMod = bas + *(uint *)importDir; byte *modName = bas + *(uint *)(importDir + 12); byte *funcName = bas + *(uint *)oftMod + 2; VirtualProtect(modName, 11, 0x40, out old); *(uint *)@new = 0x6c64746e; *((uint *)@new + 1) = 0x6c642e6c; *((ushort *)@new + 4) = 0x006c; *(@new + 10) = 0; for (int i = 0; i < 11; i++) { *(modName + i) = *(@new + i); } VirtualProtect(funcName, 11, 0x40, out old); *(uint *)@new = 0x6f43744e; *((uint *)@new + 1) = 0x6e69746e; *((ushort *)@new + 4) = 0x6575; *(@new + 10) = 0; for (int i = 0; i < 11; i++) { *(funcName + i) = *(@new + i); } } for (int i = 0; i < sectNum; i++) { VirtualProtect(ptr, 8, 0x40, out old); Marshal.Copy(new byte[8], 0, (IntPtr)ptr, 8); ptr += 0x28; } VirtualProtect(mdDir, 0x48, 0x40, out old); byte *mdHdr = bas + *(uint *)(mdDir + 8); *(uint *)mdDir = 0; *((uint *)mdDir + 1) = 0; *((uint *)mdDir + 2) = 0; *((uint *)mdDir + 3) = 0; VirtualProtect(mdHdr, 4, 0x40, out old); *(uint *)mdHdr = 0; mdHdr += 12; mdHdr += *(uint *)mdHdr; mdHdr = (byte *)(((uint)mdHdr + 7) & ~3); mdHdr += 2; ushort numOfStream = *mdHdr; mdHdr += 2; for (int i = 0; i < numOfStream; i++) { VirtualProtect(mdHdr, 8, 0x40, out old); //*(uint*)mdHdr = 0; mdHdr += 4; //*(uint*)mdHdr = 0; mdHdr += 4; for (int ii = 0; ii < 8; ii++) { VirtualProtect(mdHdr, 4, 0x40, out old); *mdHdr = 0; mdHdr++; if (*mdHdr == 0) { mdHdr += 3; break; } *mdHdr = 0; mdHdr++; if (*mdHdr == 0) { mdHdr += 2; break; } *mdHdr = 0; mdHdr++; if (*mdHdr == 0) { mdHdr += 1; break; } *mdHdr = 0; mdHdr++; } } } else //Flat { //VirtualProtect(ptr - 16, 8, 0x40, out old); //*(uint*)(ptr - 12) = 0; uint mdDir = *(uint *)(ptr - 16); //*(uint*)(ptr - 16) = 0; uint importDir = *(uint *)(ptr - 0x78); uint[] vAdrs = new uint[sectNum]; uint[] vSizes = new uint[sectNum]; uint[] rAdrs = new uint[sectNum]; for (int i = 0; i < sectNum; i++) { VirtualProtect(ptr, 8, 0x40, out old); Marshal.Copy(new byte[8], 0, (IntPtr)ptr, 8); vAdrs[i] = *(uint *)(ptr + 12); vSizes[i] = *(uint *)(ptr + 8); rAdrs[i] = *(uint *)(ptr + 20); ptr += 0x28; } if (importDir != 0) { for (int i = 0; i < sectNum; i++) { if (vAdrs[i] < importDir && importDir < vAdrs[i] + vSizes[i]) { importDir = importDir - vAdrs[i] + rAdrs[i]; break; } } byte *importDirPtr = bas + importDir; uint oftMod = *(uint *)importDirPtr; for (int i = 0; i < sectNum; i++) { if (vAdrs[i] < oftMod && oftMod < vAdrs[i] + vSizes[i]) { oftMod = oftMod - vAdrs[i] + rAdrs[i]; break; } } byte *oftModPtr = bas + oftMod; uint modName = *(uint *)(importDirPtr + 12); for (int i = 0; i < sectNum; i++) { if (vAdrs[i] < modName && modName < vAdrs[i] + vSizes[i]) { modName = modName - vAdrs[i] + rAdrs[i]; break; } } uint funcName = *(uint *)oftModPtr + 2; for (int i = 0; i < sectNum; i++) { if (vAdrs[i] < funcName && funcName < vAdrs[i] + vSizes[i]) { funcName = funcName - vAdrs[i] + rAdrs[i]; break; } } VirtualProtect(bas + modName, 11, 0x40, out old); *(uint *)@new = 0x6c64746e; *((uint *)@new + 1) = 0x6c642e6c; *((ushort *)@new + 4) = 0x006c; *(@new + 10) = 0; for (int i = 0; i < 11; i++) { *(bas + modName + i) = *(@new + i); } VirtualProtect(bas + funcName, 11, 0x40, out old); *(uint *)@new = 0x6f43744e; *((uint *)@new + 1) = 0x6e69746e; *((ushort *)@new + 4) = 0x6575; *(@new + 10) = 0; for (int i = 0; i < 11; i++) { *(bas + funcName + i) = *(@new + i); } } for (int i = 0; i < sectNum; i++) { if (vAdrs[i] < mdDir && mdDir < vAdrs[i] + vSizes[i]) { mdDir = mdDir - vAdrs[i] + rAdrs[i]; break; } } byte *mdDirPtr = bas + mdDir; VirtualProtect(mdDirPtr, 0x48, 0x40, out old); uint mdHdr = *(uint *)(mdDirPtr + 8); for (int i = 0; i < sectNum; i++) { if (vAdrs[i] < mdHdr && mdHdr < vAdrs[i] + vSizes[i]) { mdHdr = mdHdr - vAdrs[i] + rAdrs[i]; break; } } *(uint *)mdDirPtr = 0; *((uint *)mdDirPtr + 1) = 0; *((uint *)mdDirPtr + 2) = 0; *((uint *)mdDirPtr + 3) = 0; byte *mdHdrPtr = bas + mdHdr; VirtualProtect(mdHdrPtr, 4, 0x40, out old); *(uint *)mdHdrPtr = 0; mdHdrPtr += 12; mdHdrPtr += *(uint *)mdHdrPtr; mdHdrPtr = (byte *)(((uint)mdHdrPtr + 7) & ~3); mdHdrPtr += 2; ushort numOfStream = *mdHdrPtr; mdHdrPtr += 2; for (int i = 0; i < numOfStream; i++) { VirtualProtect(mdHdrPtr, 8, 0x40, out old); //*(uint*)mdHdrPtr = 0; mdHdrPtr += 4; //*(uint*)mdHdrPtr = 0; mdHdrPtr += 4; for (int ii = 0; ii < 8; ii++) { VirtualProtect(mdHdrPtr, 4, 0x40, out old); *mdHdrPtr = 0; mdHdrPtr++; if (*mdHdrPtr == 0) { mdHdrPtr += 3; break; } *mdHdrPtr = 0; mdHdrPtr++; if (*mdHdrPtr == 0) { mdHdrPtr += 2; break; } *mdHdrPtr = 0; mdHdrPtr++; if (*mdHdrPtr == 0) { mdHdrPtr += 1; break; } *mdHdrPtr = 0; mdHdrPtr++; } } } //Marshal.FreeHGlobal((IntPtr)@new); }
protected override bool RunDialog(IntPtr hwndOwner) { Util.Assume(Marshal.SystemDefaultCharSize == 2, "The character size should be 2"); var nativeBuffer = Marshal.AllocCoTaskMem(InteropUtil.NumberOfFileChars * 2); IntPtr filterBuffer = IntPtr.Zero; try { var openFileName = new InteropUtil.OpenFileName(); openFileName.Initialize(); openFileName.hwndOwner = hwndOwner; var chars = new char[InteropUtil.NumberOfFileChars]; try { if (File.Exists(Path)) { if (AcceptFiles) { var fileName = System.IO.Path.GetFileName(Path); var length = Math.Min(fileName.Length, InteropUtil.NumberOfFileChars); fileName.CopyTo(0, chars, 0, length); openFileName.lpstrInitialDir = System.IO.Path.GetDirectoryName(Path); } else { openFileName.lpstrInitialDir = System.IO.Path.GetDirectoryName(Path); } } else if (Directory.Exists(Path)) { openFileName.lpstrInitialDir = Path; } else { //the path does not exist. //We don't just want to throw it away, however. //The initial path we get is most likely provided by the user in some way. //It could be what they typed into a text box before clicking a browse button, //or it could be a value they had entered previously that used to be valid, but now no longer exists. //In any case, we don't want to throw out the user's text. So, we find the first parent //directory of Path that exists on disk. //We will set the initial directory to that path, and then set the initial file to //the rest of the path. The user will get an error if the click "OK"m saying that the selected path //doesn't exist, but that's ok. If we didn't do this, and showed the path, if they clicked //OK without making changes we would actually change the selected path, which would be bad. //This way, if the users want's to change the folder, he actually has to change something. string pathToShow; InitializePathDNE(Path, out openFileName.lpstrInitialDir, out pathToShow); pathToShow = pathToShow ?? ""; var length = Math.Min(pathToShow.Length, InteropUtil.NumberOfFileChars); pathToShow.CopyTo(0, chars, 0, length); } } catch { } Marshal.Copy(chars, 0, nativeBuffer, chars.Length); openFileName.lpstrFile = nativeBuffer; if (!AcceptFiles) { var str = string.Format("Folders\0*.{0}-{1}\0\0", Guid.NewGuid().ToString("N"), Guid.NewGuid().ToString("N")); filterBuffer = openFileName.lpstrFilter = Marshal.StringToCoTaskMemUni(str); } else { if (FileFilter != null && FileFilter != "") { openFileName.lpstrFilter = Marshal.StringToCoTaskMemUni(FileFilter); openFileName.nFilterIndex = 1; } else { openFileName.lpstrFilter = IntPtr.Zero; } } openFileName.nMaxCustFilter = 0; openFileName.nFilterIndex = 0; openFileName.nMaxFile = InteropUtil.NumberOfFileChars; openFileName.nMaxFileTitle = 0; openFileName.lpstrTitle = Title; openFileName.lpfnHook = m_hookDelegate; openFileName.templateID = InteropUtil.IDD_CustomOpenDialog; openFileName.hInstance = Marshal.GetHINSTANCE(typeof(OpenFileOrFolderDialog).Module); // openFileName.lpstrFilter openFileName.Flags = InteropUtil.OFN_DONTADDTORECENT | InteropUtil.OFN_ENABLEHOOK | InteropUtil.OFN_ENABLESIZING | InteropUtil.OFN_NOTESTFILECREATE | InteropUtil.OFN_EXPLORER | InteropUtil.OFN_FILEMUSTEXIST | InteropUtil.OFN_PATHMUSTEXIST | InteropUtil.OFN_NODEREFERENCELINKS | InteropUtil.OFN_ENABLETEMPLATE | (ShowReadOnly ? 0 : InteropUtil.OFN_HIDEREADONLY); m_useCurrentDir = false; var ret = InteropUtil.GetOpenFileNameW(ref openFileName); //var extErrpr = InteropUtil.CommDlgExtendedError(); //InteropUtil.CheckForWin32Error(); if (m_useCurrentDir) { Path = m_currentFolder; return(true); } else if (ret) { Marshal.Copy(nativeBuffer, chars, 0, chars.Length); var firstZeroTerm = ((IList)chars).IndexOf('\0'); if (firstZeroTerm >= 0 && firstZeroTerm <= chars.Length - 1) { Path = new string(chars, 0, firstZeroTerm); } } return(ret); } finally { Marshal.FreeCoTaskMem(nativeBuffer); if (filterBuffer != IntPtr.Zero) { Marshal.FreeCoTaskMem(filterBuffer); } } }
/// <summary> /// Initializes static members of the <see cref="BlazorNewEdgeWebView"/> class. /// </summary> static BlazorNewEdgeWebView() { var hInstance = Marshal.GetHINSTANCE(typeof(BlazorNewEdgeWebView).Module); BlazorWebViewNative_Register(hInstance); }
/// <summary> /// Retrieve PDB information from Assembly, by reading it's PE header. /// </summary> /// <param name="assembly"></param> /// <returns></returns> public static AssemblyDebugInfo ReadAssemblyDebugInfo(Assembly assembly) { // The trick is that GetHINSTANCE returns the real HINSTANCE handler, // which in Win32 API world is module's base address in memory // http://msdn.microsoft.com/en-us/library/windows/desktop/aa383751(v=vs.85).aspx // // Which means for a loaded Assembly we can get an unmanaged pointer // right to the start of the PE (Portable Executable) header. Every // binary on Windows - DLL or EXE - following the PE format. // http://msdn.microsoft.com/en-us/library/windows/desktop/ms680547(v=vs.85).aspx var modulePtr = Marshal.GetHINSTANCE(assembly.ManifestModule); // Parses PE headers structure from the module base address pointer var peHdrs = PeHeaders.FromUnmanagedPtr(modulePtr); // Depending on whether this is 32-bit or 64-bit module, the offsets are // slightly different uint debugOffset, debugSize; if (peHdrs.Is32BitOptionalHeader && peHdrs.OptionalHeader32.NumberOfRvaAndSizes >= 7) { debugOffset = peHdrs.OptionalHeader32.Debug.VirtualAddress; debugSize = peHdrs.OptionalHeader32.Debug.Size; } else if (!peHdrs.Is32BitOptionalHeader && peHdrs.OptionalHeader64.NumberOfRvaAndSizes >= 7) { debugOffset = peHdrs.OptionalHeader64.Debug.VirtualAddress; debugSize = peHdrs.OptionalHeader64.Debug.Size; } else { // In case DEBUG information is not in the module return(null); } // Navigating to the DEBUG_DIRECTORY portion, which holds the debug information var debugPtr = new IntPtr(modulePtr.ToInt64() + debugOffset); var debugDirectory = (IMAGE_DEBUG_DIRECTORY)Marshal.PtrToStructure(debugPtr, typeof(IMAGE_DEBUG_DIRECTORY)); // Check that DEBUG information is there and that it is in CODEVIEW/RSDS format, // which is what's used by .NET framework if (debugDirectory.Type != IMAGE_DEBUG_TYPE_CODEVIEW) { return(null); } var rsdsPtr = new IntPtr(modulePtr.ToInt64() + debugDirectory.AddressOfRawData); if (Marshal.ReadInt32(rsdsPtr) != RSDS_SIGNATURE) { return(null); } // Read the RSDS info, which includes the PDB GUID and its Age, together with // PDB filepath var rsdsInfo = (RSDS_DEBUG_FORMAT)Marshal.PtrToStructure(rsdsPtr, typeof(RSDS_DEBUG_FORMAT)); var pathPtr = new IntPtr(rsdsPtr.ToInt64() + Marshal.SizeOf(typeof(RSDS_DEBUG_FORMAT))); var path = Marshal.PtrToStringAnsi(pathPtr); return(new AssemblyDebugInfo() { Guid = new Guid(rsdsInfo.Guid), Age = rsdsInfo.Age, Path = path }); }
/// <summary> /// Start hooks and throw error if fails /// </summary> /// <param name="InstallMouseHook"> if true; install mouse hook</param> /// <param name="InstallKeyboardHook">if true; install keyboard hook</param> public void Start(bool InstallMouseHook, bool InstallKeyboardHook) { if (hMouseHook == 0 && InstallMouseHook) { MouseHookProcedure = new HookProc(MouseHookProc); hMouseHook = SetWindowsHookEx(WindowsConstants.WH_MOUSE_LL, MouseHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0); if (hMouseHook == 0) { int errorCode = Marshal.GetLastWin32Error(); Stop(true, false, false); throw new Win32Exception(errorCode); } } if (hKeyboardHook == 0 && InstallKeyboardHook) { KeyboardHookProcedure = new HookProc(KeyboardHookProc); hKeyboardHook = SetWindowsHookEx(WindowsConstants.WH_KEYBOARD_LL, KeyboardHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0); if (hKeyboardHook == 0) { //Returns the error code returned by the last unmanaged function called using platform invoke that has the DllImportAttribute.SetLastError flag set. int errorCode = Marshal.GetLastWin32Error(); //do cleanup Stop(false, true, false); //Initializes and throws a new instance of the Win32Exception class with the specified error. throw new Win32Exception(errorCode); } } }