Пример #1
0
        void MessageHandler_WndProc(ref Message m, ref bool Intercept)
        {
            if (HookTriggered == null)
            {
                return;
            }


            var InfoBoat = (COPYDATASTRUCT)Marshal.PtrToStructure(m.LParam, typeof(COPYDATASTRUCT));
            var HookInfo = (AllHookMSG)Marshal.PtrToStructure(InfoBoat.lpData, typeof(AllHookMSG));

            var time    = new System.DateTime(1970, 1, 1).AddSeconds(HookInfo.Time).ToLocalTime().AddMilliseconds(HookInfo.MilliSecond);
            var process = Process.GetProcessById((int)HookInfo.Process);


            var PassData = new HookArguments();

            PassData.lParam    = HookInfo.lParam;
            PassData.wParam    = HookInfo.wParam;
            PassData.nCode     = HookInfo.nCode;
            PassData.Process   = process;
            PassData.TimeStamp = time;

            // Filter own copydata communication
            if (HookInfo.HookType == (int)HookType.WH_CALLWNDPROC)
            {
                CWPSTRUCT IsWMCOPY = MarshalHelper.GetStructFromProcess <CWPSTRUCT>(process, PassData.lParam);
                if (IsWMCOPY.message == (int)WindowsMessages.WM_COPYDATA)
                {
                    return;
                }
            }

            if (HookInfo.HookType == (int)HookType.WH_CALLWNDPROCRET)
            {
                CWPRETSTRUCT IsWMCOPY = MarshalHelper.GetStructFromProcess <CWPRETSTRUCT>(process, PassData.lParam);
                if (IsWMCOPY.message == (int)WindowsMessages.WM_COPYDATA)
                {
                    return;
                }
            }

            HookTriggered(PassData, ref Intercept);

            if (Intercept == true && HookType == System.Hooks.HookType.WH_GETMESSAGE)
            {
                var Returner = new WH_GETMESSAGE(PassData);
                Returner.Message = Message.Create(Returner.Caller.MainWindowHandle, 0, IntPtr.Zero, IntPtr.Zero);
            }
        }
Пример #2
0
        /// <summary>
        /// Translates Winows message into usable format and extracts all information
        /// </summary>
        public WH_CALLWNDPROC(HookArguments Msg) : base(Msg)
        {
            if (Msg == null)
            {
                return;
            }

            this.Code   = Msg.nCode;
            this.wParam = Msg.wParam;
            this.lParam = Msg.lParam;
            this.Caller = Msg.Process;
            this.Time   = Msg.TimeStamp;

            Attachment = MarshalHelper.GetStructFromProcess <CWPSTRUCT>(Caller, lParam);
        }
Пример #3
0
        public static T GetStructFromProcess <T>(Process Process, IntPtr Address) where T : struct
        {
            IntPtr ProcessHandle = OpenProcess(PROCESS_VM_READ, false, Process.Id);

            int bytesrecieved = 0;

            byte[] buffer = new byte[Marshal.SizeOf(typeof(T))];
            bool   Ok     = ReadProcessMemory(ProcessHandle.ToInt32(), Address.ToInt32(), buffer, buffer.Length, ref bytesrecieved);

            if (!Ok)
            {
                throw new Win32Exception(Marshal.GetLastWin32Error());
            }

            return(MarshalHelper.DeserializeMsg <T>(buffer));
        }
Пример #4
0
        public static T WriteStructToProcess <T>(Process Process, IntPtr Address, T Data) where T : struct
        {
            IntPtr ProcessHandle = OpenProcess(PROCESS_VM_WRITE | PROCESS_VM_OPERATION, false, Process.Id);

            IntPtr byteswritten = IntPtr.Zero;

            byte[] buffer = SerializeMessage <T>(Data);
            bool   Ok     = WriteProcessMemory(ProcessHandle, Address, buffer, buffer.Length, out byteswritten);

            if (!Ok)
            {
                throw new Win32Exception(Marshal.GetLastWin32Error());
            }

            return(MarshalHelper.DeserializeMsg <T>(buffer));
        }
Пример #5
0
        /// <summary>
        /// Translates Winows message into usable format and extracts all information
        /// </summary>
        public WH_GETMESSAGE(HookArguments Msg) : base(Msg)
        {
            if (Msg == null)
            {
                return;
            }

            this.Code   = Msg.nCode;
            this.wParam = Msg.wParam;
            this.lParam = Msg.lParam;
            this.Caller = Msg.Process;
            this.Time   = Msg.TimeStamp;

            var message = MarshalHelper.GetStructFromProcess <MSG>(Caller, lParam);

            _msg = Message.Create(message.hwnd, (int)message.message, message.wParam, message.lParam);
        }
Пример #6
0
        CREATESTRUCT getCreateStruct()
        {
            var CreateWindow = MarshalHelper.GetStructFromProcess <CREATEWND>(Caller, lParam);

            return(MarshalHelper.GetStructFromProcess <CREATESTRUCT>(Caller, CreateWindow.lpcs));
        }