From 7b6964eb1bcf30a0ae7ed3391adce30565b262b4 Mon Sep 17 00:00:00 2001 From: ladevieq Date: Sun, 12 Jul 2026 00:47:54 +0200 Subject: Load functions by hand --- src/events.c | 284 +++++++++++++++++++++++++++++------------------------------ 1 file changed, 142 insertions(+), 142 deletions(-) (limited to 'src/events.c') diff --git a/src/events.c b/src/events.c index 1886617..fd96966 100644 --- a/src/events.c +++ b/src/events.c @@ -114,68 +114,68 @@ typedef struct _DEBUG_EVENT { #define FILE_NAME_NORMALIZED 0x0 //default #define FILE_NAME_OPENED 0x8 -#define STATUS_WAIT_0 ((u32 )0x00000000L) -#define STATUS_ABANDONED_WAIT_0 ((u32 )0x00000080L) -#define STATUS_USER_APC ((u32 )0x000000C0L) -#define STATUS_TIMEOUT ((u32 )0x00000102L) -#define STATUS_PENDING ((u32 )0x00000103L) -#define DBG_EXCEPTION_HANDLED ((u32 )0x00010001L) -#define DBG_CONTINUE ((u32 )0x00010002L) -#define STATUS_SEGMENT_NOTIFICATION ((u32 )0x40000005L) -#define STATUS_FATAL_APP_EXIT ((u32 )0x40000015L) -#define DBG_REPLY_LATER ((u32 )0x40010001L) -#define DBG_TERMINATE_THREAD ((u32 )0x40010003L) -#define DBG_TERMINATE_PROCESS ((u32 )0x40010004L) -#define DBG_CONTROL_C ((u32 )0x40010005L) -#define DBG_PRINTEXCEPTION_C ((u32 )0x40010006L) -#define DBG_RIPEXCEPTION ((u32 )0x40010007L) -#define DBG_CONTROL_BREAK ((u32 )0x40010008L) -#define DBG_COMMAND_EXCEPTION ((u32 )0x40010009L) -#define DBG_PRINTEXCEPTION_WIDE_C ((u32 )0x4001000AL) -#define STATUS_GUARD_PAGE_VIOLATION ((u32 )0x80000001L) -#define STATUS_DATATYPE_MISALIGNMENT ((u32 )0x80000002L) -#define STATUS_BREAKPOINT ((u32 )0x80000003L) -#define STATUS_SINGLE_STEP ((u32 )0x80000004L) -#define STATUS_LONGJUMP ((u32 )0x80000026L) -#define STATUS_UNWIND_CONSOLIDATE ((u32 )0x80000029L) -#define DBG_EXCEPTION_NOT_HANDLED ((u32 )0x80010001L) -#define STATUS_ACCESS_VIOLATION ((u32 )0xC0000005L) -#define STATUS_IN_PAGE_ERROR ((u32 )0xC0000006L) -#define STATUS_INVALID_HANDLE ((u32 )0xC0000008L) -#define STATUS_INVALID_PARAMETER ((u32 )0xC000000DL) -#define STATUS_NO_MEMORY ((u32 )0xC0000017L) -#define STATUS_ILLEGAL_INSTRUCTION ((u32 )0xC000001DL) -#define STATUS_NONCONTINUABLE_EXCEPTION ((u32 )0xC0000025L) -#define STATUS_INVALID_DISPOSITION ((u32 )0xC0000026L) -#define STATUS_ARRAY_BOUNDS_EXCEEDED ((u32 )0xC000008CL) -#define STATUS_FLOAT_DENORMAL_OPERAND ((u32 )0xC000008DL) -#define STATUS_FLOAT_DIVIDE_BY_ZERO ((u32 )0xC000008EL) -#define STATUS_FLOAT_INEXACT_RESULT ((u32 )0xC000008FL) -#define STATUS_FLOAT_INVALID_OPERATION ((u32 )0xC0000090L) -#define STATUS_FLOAT_OVERFLOW ((u32 )0xC0000091L) -#define STATUS_FLOAT_STACK_CHECK ((u32 )0xC0000092L) -#define STATUS_FLOAT_UNDERFLOW ((u32 )0xC0000093L) -#define STATUS_INTEGER_DIVIDE_BY_ZERO ((u32 )0xC0000094L) -#define STATUS_INTEGER_OVERFLOW ((u32 )0xC0000095L) -#define STATUS_PRIVILEGED_INSTRUCTION ((u32 )0xC0000096L) -#define STATUS_STACK_OVERFLOW ((u32 )0xC00000FDL) -#define STATUS_DLL_NOT_FOUND ((u32 )0xC0000135L) -#define STATUS_ORDINAL_NOT_FOUND ((u32 )0xC0000138L) -#define STATUS_ENTRYPOINT_NOT_FOUND ((u32 )0xC0000139L) -#define STATUS_CONTROL_C_EXIT ((u32 )0xC000013AL) -#define STATUS_DLL_INIT_FAILED ((u32 )0xC0000142L) -#define STATUS_CONTROL_STACK_VIOLATION ((u32 )0xC00001B2L) -#define STATUS_FLOAT_MULTIPLE_FAULTS ((u32 )0xC00002B4L) -#define STATUS_FLOAT_MULTIPLE_TRAPS ((u32 )0xC00002B5L) -#define STATUS_REG_NAT_CONSUMPTION ((u32 )0xC00002C9L) -#define STATUS_HEAP_CORRUPTION ((u32 )0xC0000374L) -#define STATUS_STACK_BUFFER_OVERRUN ((u32 )0xC0000409L) -#define STATUS_INVALID_CRUNTIME_PARAMETER ((u32 )0xC0000417L) -#define STATUS_ASSERTION_FAILURE ((u32 )0xC0000420L) -#define STATUS_ENCLAVE_VIOLATION ((u32 )0xC00004A2L) -#define STATUS_INTERRUPTED ((u32 )0xC0000515L) -#define STATUS_THREAD_NOT_RUNNING ((u32 )0xC0000516L) -#define STATUS_ALREADY_REGISTERED ((u32 )0xC0000718L) +#define STATUS_WAIT_0 ((u32 )0x00000000L) +#define STATUS_ABANDONED_WAIT_0 ((u32 )0x00000080L) +#define STATUS_USER_APC ((u32 )0x000000C0L) +#define STATUS_TIMEOUT ((u32 )0x00000102L) +#define STATUS_PENDING ((u32 )0x00000103L) +#define DBG_EXCEPTION_HANDLED ((u32 )0x00010001L) +#define DBG_CONTINUE ((u32 )0x00010002L) +#define STATUS_SEGMENT_NOTIFICATION ((u32 )0x40000005L) +#define STATUS_FATAL_APP_EXIT ((u32 )0x40000015L) +#define DBG_REPLY_LATER ((u32 )0x40010001L) +#define DBG_TERMINATE_THREAD ((u32 )0x40010003L) +#define DBG_TERMINATE_PROCESS ((u32 )0x40010004L) +#define DBG_CONTROL_C ((u32 )0x40010005L) +#define DBG_PRINTEXCEPTION_C ((u32 )0x40010006L) +#define DBG_RIPEXCEPTION ((u32 )0x40010007L) +#define DBG_CONTROL_BREAK ((u32 )0x40010008L) +#define DBG_COMMAND_EXCEPTION ((u32 )0x40010009L) +#define DBG_PRINTEXCEPTION_WIDE_C ((u32 )0x4001000AL) +#define STATUS_GUARD_PAGE_VIOLATION ((u32 )0x80000001L) +#define STATUS_DATATYPE_MISALIGNMENT ((u32 )0x80000002L) +#define STATUS_BREAKPOINT ((u32 )0x80000003L) +#define STATUS_SINGLE_STEP ((u32 )0x80000004L) +#define STATUS_LONGJUMP ((u32 )0x80000026L) +#define STATUS_UNWIND_CONSOLIDATE ((u32 )0x80000029L) +#define DBG_EXCEPTION_NOT_HANDLED ((u32 )0x80010001L) +#define STATUS_ACCESS_VIOLATION ((u32 )0xC0000005L) +#define STATUS_IN_PAGE_ERROR ((u32 )0xC0000006L) +#define STATUS_INVALID_HANDLE ((u32 )0xC0000008L) +#define STATUS_INVALID_PARAMETER ((u32 )0xC000000DL) +#define STATUS_NO_MEMORY ((u32 )0xC0000017L) +#define STATUS_ILLEGAL_INSTRUCTION ((u32 )0xC000001DL) +#define STATUS_NONCONTINUABLE_EXCEPTION ((u32 )0xC0000025L) +#define STATUS_INVALID_DISPOSITION ((u32 )0xC0000026L) +#define STATUS_ARRAY_BOUNDS_EXCEEDED ((u32 )0xC000008CL) +#define STATUS_FLOAT_DENORMAL_OPERAND ((u32 )0xC000008DL) +#define STATUS_FLOAT_DIVIDE_BY_ZERO ((u32 )0xC000008EL) +#define STATUS_FLOAT_INEXACT_RESULT ((u32 )0xC000008FL) +#define STATUS_FLOAT_INVALID_OPERATION ((u32 )0xC0000090L) +#define STATUS_FLOAT_OVERFLOW ((u32 )0xC0000091L) +#define STATUS_FLOAT_STACK_CHECK ((u32 )0xC0000092L) +#define STATUS_FLOAT_UNDERFLOW ((u32 )0xC0000093L) +#define STATUS_INTEGER_DIVIDE_BY_ZERO ((u32 )0xC0000094L) +#define STATUS_INTEGER_OVERFLOW ((u32 )0xC0000095L) +#define STATUS_PRIVILEGED_INSTRUCTION ((u32 )0xC0000096L) +#define STATUS_STACK_OVERFLOW ((u32 )0xC00000FDL) +#define STATUS_DLL_NOT_FOUND ((u32 )0xC0000135L) +#define STATUS_ORDINAL_NOT_FOUND ((u32 )0xC0000138L) +#define STATUS_ENTRYPOINT_NOT_FOUND ((u32 )0xC0000139L) +#define STATUS_CONTROL_C_EXIT ((u32 )0xC000013AL) +#define STATUS_DLL_INIT_FAILED ((u32 )0xC0000142L) +#define STATUS_CONTROL_STACK_VIOLATION ((u32 )0xC00001B2L) +#define STATUS_FLOAT_MULTIPLE_FAULTS ((u32 )0xC00002B4L) +#define STATUS_FLOAT_MULTIPLE_TRAPS ((u32 )0xC00002B5L) +#define STATUS_REG_NAT_CONSUMPTION ((u32 )0xC00002C9L) +#define STATUS_HEAP_CORRUPTION ((u32 )0xC0000374L) +#define STATUS_STACK_BUFFER_OVERRUN ((u32 )0xC0000409L) +#define STATUS_INVALID_CRUNTIME_PARAMETER ((u32 )0xC0000417L) +#define STATUS_ASSERTION_FAILURE ((u32 )0xC0000420L) +#define STATUS_ENCLAVE_VIOLATION ((u32 )0xC00004A2L) +#define STATUS_INTERRUPTED ((u32 )0xC0000515L) +#define STATUS_THREAD_NOT_RUNNING ((u32 )0xC0000516L) +#define STATUS_ALREADY_REGISTERED ((u32 )0xC0000718L) /* compatibility macros */ #define STILL_ACTIVE STATUS_PENDING @@ -276,84 +276,84 @@ extern u32 GetLastError(void); #define CP_UTF7 65000 // UTF-7 translation #define CP_UTF8 65001 // UTF-8 translation -extern i32 WideCharToMultiByte(u32 CodePage, u32 dwFlags, const u16* lpWideCharStr, i32 cchWideChar, i8* lpMultiByteStr, i32 cbMultiByte, const i8* lpDefaultChar, i32* lpUsedDefaultChar); +extern i32 WideCharToMultiByte(u32 CodePage, u32 dwFlags, const u16* lpWideCharStr, i32 cchWideChar, i8* lpMultiByteStr, i32 cbMultiByte, i8* lpDefaultChar, i32* lpUsedDefaultChar); extern u32 GetFinalPathNameByHandleA(void* hFile, i8* lpszFilePath, u32 cchFilePath, u32 dwFlags); -#define PAGE_NOACCESS 0x01 -#define PAGE_READONLY 0x02 -#define PAGE_READWRITE 0x04 -#define PAGE_WRITECOPY 0x08 -#define PAGE_EXECUTE 0x10 -#define PAGE_EXECUTE_READ 0x20 -#define PAGE_EXECUTE_READWRITE 0x40 -#define PAGE_EXECUTE_WRITECOPY 0x80 -#define PAGE_GUARD 0x100 -#define PAGE_NOCACHE 0x200 -#define PAGE_WRITECOMBINE 0x400 -#define PAGE_GRAPHICS_NOACCESS 0x0800 -#define PAGE_GRAPHICS_READONLY 0x1000 -#define PAGE_GRAPHICS_READWRITE 0x2000 -#define PAGE_GRAPHICS_EXECUTE 0x4000 -#define PAGE_GRAPHICS_EXECUTE_READ 0x8000 -#define PAGE_GRAPHICS_EXECUTE_READWRITE 0x10000 -#define PAGE_GRAPHICS_COHERENT 0x20000 -#define PAGE_GRAPHICS_NOCACHE 0x40000 -#define PAGE_ENCLAVE_THREAD_CONTROL 0x80000000 -#define PAGE_REVERT_TO_FILE_MAP 0x80000000 -#define PAGE_TARGETS_NO_UPDATE 0x40000000 -#define PAGE_TARGETS_INVALID 0x40000000 -#define PAGE_ENCLAVE_UNVALIDATED 0x20000000 -#define PAGE_ENCLAVE_MASK 0x10000000 -#define PAGE_ENCLAVE_DECOMMIT (PAGE_ENCLAVE_MASK | 0) -#define PAGE_ENCLAVE_SS_FIRST (PAGE_ENCLAVE_MASK | 1) -#define PAGE_ENCLAVE_SS_REST (PAGE_ENCLAVE_MASK | 2) -#define MEM_COMMIT 0x00001000 -#define MEM_RESERVE 0x00002000 -#define MEM_REPLACE_PLACEHOLDER 0x00004000 -#define MEM_RESERVE_PLACEHOLDER 0x00040000 -#define MEM_RESET 0x00080000 -#define MEM_TOP_DOWN 0x00100000 -#define MEM_WRITE_WATCH 0x00200000 -#define MEM_PHYSICAL 0x00400000 -#define MEM_ROTATE 0x00800000 -#define MEM_DIFFERENT_IMAGE_BASE_OK 0x00800000 -#define MEM_RESET_UNDO 0x01000000 -#define MEM_LARGE_PAGES 0x20000000 -#define MEM_4MB_PAGES 0x80000000 -#define MEM_64K_PAGES (MEM_LARGE_PAGES | MEM_PHYSICAL) -#define MEM_UNMAP_WITH_TRANSIENT_BOOST 0x00000001 -#define MEM_COALESCE_PLACEHOLDERS 0x00000001 -#define MEM_PRESERVE_PLACEHOLDER 0x00000002 -#define MEM_DECOMMIT 0x00004000 -#define MEM_RELEASE 0x00008000 -#define MEM_FREE 0x00010000 -#define MEM_EXTENDED_PARAMETER_GRAPHICS 0x00000001 -#define MEM_EXTENDED_PARAMETER_NONPAGED 0x00000002 -#define MEM_EXTENDED_PARAMETER_ZERO_PAGES_OPTIONAL 0x00000004 -#define MEM_EXTENDED_PARAMETER_NONPAGED_LARGE 0x00000008 -#define MEM_EXTENDED_PARAMETER_NONPAGED_HUGE 0x00000010 -#define MEM_EXTENDED_PARAMETER_SOFT_FAULT_PAGES 0x00000020 -#define MEM_EXTENDED_PARAMETER_EC_CODE 0x00000040 -#define MEM_EXTENDED_PARAMETER_NUMA_NODE_MANDATORY MINLONG64 +#define PAGE_NOACCESS 0x01 +#define PAGE_READONLY 0x02 +#define PAGE_READWRITE 0x04 +#define PAGE_WRITECOPY 0x08 +#define PAGE_EXECUTE 0x10 +#define PAGE_EXECUTE_READ 0x20 +#define PAGE_EXECUTE_READWRITE 0x40 +#define PAGE_EXECUTE_WRITECOPY 0x80 +#define PAGE_GUARD 0x100 +#define PAGE_NOCACHE 0x200 +#define PAGE_WRITECOMBINE 0x400 +#define PAGE_GRAPHICS_NOACCESS 0x0800 +#define PAGE_GRAPHICS_READONLY 0x1000 +#define PAGE_GRAPHICS_READWRITE 0x2000 +#define PAGE_GRAPHICS_EXECUTE 0x4000 +#define PAGE_GRAPHICS_EXECUTE_READ 0x8000 +#define PAGE_GRAPHICS_EXECUTE_READWRITE 0x10000 +#define PAGE_GRAPHICS_COHERENT 0x20000 +#define PAGE_GRAPHICS_NOCACHE 0x40000 +#define PAGE_ENCLAVE_THREAD_CONTROL 0x80000000 +#define PAGE_REVERT_TO_FILE_MAP 0x80000000 +#define PAGE_TARGETS_NO_UPDATE 0x40000000 +#define PAGE_TARGETS_INVALID 0x40000000 +#define PAGE_ENCLAVE_UNVALIDATED 0x20000000 +#define PAGE_ENCLAVE_MASK 0x10000000 +#define PAGE_ENCLAVE_DECOMMIT (PAGE_ENCLAVE_MASK | 0) +#define PAGE_ENCLAVE_SS_FIRST (PAGE_ENCLAVE_MASK | 1) +#define PAGE_ENCLAVE_SS_REST (PAGE_ENCLAVE_MASK | 2) +#define MEM_COMMIT 0x00001000 +#define MEM_RESERVE 0x00002000 +#define MEM_REPLACE_PLACEHOLDER 0x00004000 +#define MEM_RESERVE_PLACEHOLDER 0x00040000 +#define MEM_RESET 0x00080000 +#define MEM_TOP_DOWN 0x00100000 +#define MEM_WRITE_WATCH 0x00200000 +#define MEM_PHYSICAL 0x00400000 +#define MEM_ROTATE 0x00800000 +#define MEM_DIFFERENT_IMAGE_BASE_OK 0x00800000 +#define MEM_RESET_UNDO 0x01000000 +#define MEM_LARGE_PAGES 0x20000000 +#define MEM_4MB_PAGES 0x80000000 +#define MEM_64K_PAGES (MEM_LARGE_PAGES | MEM_PHYSICAL) +#define MEM_UNMAP_WITH_TRANSIENT_BOOST 0x00000001 +#define MEM_COALESCE_PLACEHOLDERS 0x00000001 +#define MEM_PRESERVE_PLACEHOLDER 0x00000002 +#define MEM_DECOMMIT 0x00004000 +#define MEM_RELEASE 0x00008000 +#define MEM_FREE 0x00010000 +#define MEM_EXTENDED_PARAMETER_GRAPHICS 0x00000001 +#define MEM_EXTENDED_PARAMETER_NONPAGED 0x00000002 +#define MEM_EXTENDED_PARAMETER_ZERO_PAGES_OPTIONAL 0x00000004 +#define MEM_EXTENDED_PARAMETER_NONPAGED_LARGE 0x00000008 +#define MEM_EXTENDED_PARAMETER_NONPAGED_HUGE 0x00000010 +#define MEM_EXTENDED_PARAMETER_SOFT_FAULT_PAGES 0x00000020 +#define MEM_EXTENDED_PARAMETER_EC_CODE 0x00000040 +#define MEM_EXTENDED_PARAMETER_NUMA_NODE_MANDATORY MINLONG64 extern void* VirtualAlloc(void* lpAddress, size_t dwSize, u32 flAllocationType, u32 flProtect); extern i32 VirtualFree(void* lpAddress, size_t dwSize, u32 dwFreeType); -#define PROCESS_TERMINATE (0x0001) -#define PROCESS_CREATE_THREAD (0x0002) -#define PROCESS_SET_SESSIONID (0x0004) -#define PROCESS_VM_OPERATION (0x0008) -#define PROCESS_VM_READ (0x0010) -#define PROCESS_VM_WRITE (0x0020) -#define PROCESS_DUP_HANDLE (0x0040) -#define PROCESS_CREATE_PROCESS (0x0080) -#define PROCESS_SET_QUOTA (0x0100) -#define PROCESS_SET_INFORMATION (0x0200) -#define PROCESS_QUERY_INFORMATION (0x0400) -#define PROCESS_SUSPEND_RESUME (0x0800) -#define PROCESS_QUERY_LIMITED_INFORMATION (0x1000) -#define PROCESS_SET_LIMITED_INFORMATION (0x2000) +#define PROCESS_TERMINATE (0x0001) +#define PROCESS_CREATE_THREAD (0x0002) +#define PROCESS_SET_SESSIONID (0x0004) +#define PROCESS_VM_OPERATION (0x0008) +#define PROCESS_VM_READ (0x0010) +#define PROCESS_VM_WRITE (0x0020) +#define PROCESS_DUP_HANDLE (0x0040) +#define PROCESS_CREATE_PROCESS (0x0080) +#define PROCESS_SET_QUOTA (0x0100) +#define PROCESS_SET_INFORMATION (0x0200) +#define PROCESS_QUERY_INFORMATION (0x0400) +#define PROCESS_SUSPEND_RESUME (0x0800) +#define PROCESS_QUERY_LIMITED_INFORMATION (0x1000) +#define PROCESS_SET_LIMITED_INFORMATION (0x2000) extern void* OpenProcess(u32 dwDesiredAccess, i32 bInheritHandle, u32 dwProcessId); extern i32 TerminateProcess(void* hProcess, u32 uExitCode); @@ -707,7 +707,7 @@ void load_symbols(const void* base_addr, struct module* module) { VirtualFree(exception_table, exception_entry.Size, MEM_RELEASE); } -void handle_create_process() { +void handle_create_process(void) { print("%s\n", "CreateProcessDebugEvent"); CREATE_PROCESS_DEBUG_INFO proc_dbg_info = dbg_event.u.CreateProcessInfo; @@ -728,11 +728,11 @@ void handle_create_process() { load_symbols((const void*)proc_dbg_info.lpBaseOfImage, module); } -void handle_create_thread() { +void handle_create_thread(void) { print("%s\n", "CreateThreadDebugEvent"); } -void handle_exception() { +void handle_exception(void) { extern u32 continue_status; print("%s : ", "ExceptionDebugEvent"); @@ -749,16 +749,16 @@ void handle_exception() { } } -void handle_exit_process() { +void handle_exit_process(void) { print("%s\n", "ExitProcessDebugEvent"); TerminateProcess(NULL, 0U); } -void handle_exit_thread() { +void handle_exit_thread(void) { print("%s\n", "ExitThreadDebugEvent"); } -void handle_load_dll() { +void handle_load_dll(void) { LOAD_DLL_DEBUG_INFO dll_info = dbg_event.u.LoadDll; const void* dll_name_addr = dll_info.lpImageName; void* dll_base_addr = dll_info.lpBaseOfDll; @@ -776,11 +776,11 @@ void handle_load_dll() { load_symbols(dll_base_addr, module); } -void handle_unload_dll() { +void handle_unload_dll(void) { print("%s\n", "UnloadDLLDebugEvent"); } -void handle_output_debug_string() { +void handle_output_debug_string(void) { OUTPUT_DEBUG_STRING_INFO dbg_str_event = dbg_event.u.DebugString; char* str_addr = dbg_str_event.lpDebugStringData; size_t str_size = (size_t)dbg_str_event.nDebugStringLength; @@ -808,6 +808,6 @@ void handle_output_debug_string() { } } -void handle_rip() { +void handle_rip(void) { print("%s\n", "RIPEvent"); } -- cgit v1.3