开通博客赚积分
发布资源赚积分
分类

源码开发语言/平台
当前位置：首页 > 源码/资料 > Internet/网络编程 > PlugIns编程 > 查看源码
NtGlobalFlag.c
资源名称：OllyPlugins.zip　[点击查看]
上传用户：haohao_zhu
上传日期：2014-08-15
资源大小：2446k
文件大小：10k
源码类别：

PlugIns编程

开发平台：

Visual C++

NtGlobalFlag.c：源码内容
  1. #include <windows.h>
  2. #include <winbase.h>
  3. #include <shlwapi.h>
  4. #include <winternl.h>
  5. #include <stdlib.h>
  6. #include "plugin.h"
  9. NTSTATUS (WINAPI *ntdll_NtQueryInformationProcess)(HANDLE,PROCESSINFOCLASS,PVOID,ULONG,PULONG);
  12.  
  13. HINSTANCE         hinst;
  14. HINSTANCE   Dll_Handle;
  17. FARPROC ntdll_DbgBreakPoint;
  18. FARPROC ntdll_RtlRaiseException;
  20. void * status;
  21. void * glob;
  22. void * data;
  23. void * debesp;
  24. void * debespplus;
  25. void * hProcess;
  27. char * mySecPointer;
  29. LPVOID  dlah;
  31. ulong myPointer;
  33. long elah;
  34. long  isSet;
  35. long  isUnset;
  37. int  type;
  38. int  pid;
  39. int  answer;
  40. int noofitems;
  41. int  breakname;
  42. int lenofbreakname;
  43. int debstrlen;
  44. int  breakontlscallback;
  45. int  breakondllinitrout;
  47. PROCESS_BASIC_INFORMATION  pbi;
  48. MEMORY_BASIC_INFORMATION mbi;
  49. DEBUG_EVENT debev;
  50. t_table  valref;
  51. t_reg currentreg;
  53. DWORD lpOld;
  54. DWORD Curr_Pid;
  56. HANDLE Curr_Proc_Pseudo;
  57. HANDLE debproc;
  59. HWND              hwmain; 
  60. HWND seqwindow;
  61. HWND editwindow;
  62. HWND buttwindow;
  63. HWND asswindow;
  64. HWND asseditwindow;
  65. HWND assbuttwindow;
  66. HWND asscombo;
  67. HWND asscancel;
  69. char  clah[4] = {0x00,0x00,0x00,0x00};
  70. char              NtGlobalFlagwinclass[32];
  71. char  spattern[] = {"MOV DWORD PTR DS:[RA+CONST],40010006"};
  72. char  mystring[200]; 
  73. char  asstext[200];
  74. char  trim[200];
  75. char debugstring[400];
  76. char tlscallback[10];
  78. int myfunc (int flag);
  79. DWORD WINAPI ThreadProcFirst( LPVOID lpParam );
  80. DWORD WINAPI ThreadProcSecond( LPVOID lpParam );
  83. #pragma argsused
  84. BOOL WINAPI DllEntryPoint(HINSTANCE hi,DWORD reason,LPVOID reserved)
  85. {
  86.    if (reason==DLL_PROCESS_ATTACH)
  87.      hinst=hi;                            // Mark plugin instance
  88.    return 1;                            // Report success
  89. };
  95. #pragma argsused
  96. extc int _export cdecl ODBG_Plugindata(char shortname[32])
  98. {
  99. strcpy(shortname,"NtGlobalFlag");       // Name of plugin
  100. return PLUGIN_VERSION;
  101. };
  105. #pragma argsused
  106. extc int _export cdecl ODBG_Plugininit(int ollydbgversion,HWND hw,ulong *features)
  108. {
  109.    // Check that version of OllyDbg is correct.
  110.    if (ollydbgversion<PLUGIN_VERSION)
  111.      return -1;
  112.   // Keep handle of main OllyDbg window. This handle is necessary, for example,
  113.    // to display message box.
  114.    hwmain=hw;
  115. Addtolist(0,0,"NtGlobalFlag Plugin v1.10");
  116.    Addtolist(0, 1,"  Dedicated to oleh yuschuk author of this Debugger");
  117. Addtolist(0,-1,"    authored by stingduk");
  118. Addtolist(0, 1,"      and thanks to Detten for cing my asm ");
  119. return 0;
  120. };
  126. #pragma argsused
  127. int ODBG_Pausedex(int reason, int extdata, t_reg *reg, DEBUG_EVENT *debugevent)
  128. {
  130. if (reg != 0)
  131. {
  132. if(debugevent !=0)
  133. {
  135. debev = *debugevent;
  136. currentreg = *reg;
  138. if(debev.u.Exception.ExceptionRecord.ExceptionCode != EXCEPTION_BREAKPOINT)
  139. {
  140. return 0;
  141. }
  142. Dll_Handle = GetModuleHandle("ntdll.dll");
  143. if(Dll_Handle ==0)
  144. {
  145. MessageBox(hwmain,"error","LoadLibFailed",MB_OK);
  146. return 0;
  147. }
  148. ntdll_DbgBreakPoint = GetProcAddress(Dll_Handle,"DbgBreakPoint");
  149. if(ntdll_DbgBreakPoint == 0)
  150. {
  151. return 0;
  152. }
  153. ntdll_RtlRaiseException = GetProcAddress(Dll_Handle,"RtlRaiseException");
  154. if(ntdll_RtlRaiseException == 0)
  155. {
  156. return 0;
  157. }
  160. if (debev.u.Exception.ExceptionRecord.ExceptionAddress == ntdll_DbgBreakPoint)
  161. { 
  163. *(FARPROC *)&ntdll_NtQueryInformationProcess = GetProcAddress(Dll_Handle,"NtQueryInformationProcess");
  164. if(ntdll_NtQueryInformationProcess == 0)
  165. {
  166. MessageBox(hwmain,"error","GetProcFailed",MB_OK);
  167. return 0;
  168. }
  170. pid = Plugingetvalue(VAL_PROCESSID);
  171. debproc = OpenProcess(PROCESS_ALL_ACCESS,FALSE,pid);
  172. ntdll_NtQueryInformationProcess(debproc,ProcessBasicInformation,&pbi,sizeof(pbi),NULL);
  173. status = pbi.PebBaseAddress;
  174. (byte *)status += 0x68;
  175. VirtualQueryEx(debproc,status,&mbi,sizeof(mbi));
  176. VirtualProtectEx(debproc,mbi.BaseAddress,mbi.RegionSize,PAGE_EXECUTE_READWRITE,&lpOld);
  177. ReadProcessMemory(debproc,status,&dlah,4,NULL);
  178. elah = (long)dlah;
  179. elah |= 0x02;
  180. WriteProcessMemory(debproc,status,&elah,4,NULL);
  181. noofitems = 0;
  182. while (noofitems < 2)
  183. {
  184. CreateThread(NULL,NULL,ThreadProcFirst,NULL,NULL,NULL);
  185. Sendshortcut(PM_DISASM,0,WM_KEYDOWN,1,0,'S');
  186. Sendshortcut(PM_DISASM,0,WM_KEYDOWN,1,0,'R');
  187. valref = *(t_table *)Plugingetvalue(VAL_REFERENCES);
  188. noofitems = valref.data.n;
  189. }
  190. valref = *(t_table *)Plugingetvalue(VAL_REFERENCES);
  191. data = valref.data.data;
  192. Setdisasm(*(ulong *)data,1,CPU_ASMCENTER|CPU_ASMFOCUS);
  193. memset(mystring,0,200);
  194. wsprintf(mystring,"Assemble at %x",*(ulong *)data);
  195. CreateThread(NULL,NULL,ThreadProcSecond,NULL,NULL,NULL);
  196. Sendshortcut(PM_DISASM,*(ulong *)data,WM_CHAR,0,0,' ');
  197. Insertname((ulong)ntdll_RtlRaiseException,NM_BREAK,"STRING [[[esp+4]+18h]] == "LDR: Calling Tls Callback Imagebase" | STRING [[[esp+4]+18h]] == " - Calling"");
  198. Setbreakpointext((ulong)ntdll_RtlRaiseException,TY_ACTIVE|TY_KEEPCOND,0,0);
  199. Sendshortcut(PM_MAIN,0,WM_KEYDOWN,0,0,VK_F9);
  200. VirtualProtectEx(debproc,mbi.BaseAddress,mbi.RegionSize,lpOld,&lpOld);
  201. CloseHandle(debproc);
  202. return 0;
  203. }
  204. else if (debev.u.Exception.ExceptionRecord.ExceptionAddress == ntdll_RtlRaiseException)
  205. {
  207. myPointer = currentreg.r[4];
  208. myPointer += 0x4;
  209. hProcess = (void *)Plugingetvalue(VAL_HPROCESS);
  210. ReadProcessMemory(hProcess,(const void *)myPointer,&debesp,4,NULL);
  211. (byte *)debesp += 0x18;
  212. ReadProcessMemory(hProcess,(const void *)debesp,&debespplus,4,NULL);
  213. ReadProcessMemory(hProcess,(const void *)debespplus,&debugstring,0x400,NULL);
  214. debstrlen = lstrlen(debugstring);
  215. mySecPointer = strrchr(debugstring,0x20);
  216. if(StrCmpN(" - Calling",debugstring,10) == 0)
  217. {
  218. if(breakondllinitrout == 1)
  219. {
  220. Setbreakpointext(strtol((unsigned char *)mySecPointer,NULL,16),TY_ONESHOT,0,0);
  221. Sendshortcut(PM_MAIN,0,WM_KEYDOWN,0,0,VK_F9);
  222. return 0;
  223. }
  224. Sendshortcut(PM_MAIN,0,WM_KEYDOWN,0,0,VK_F9);
  225. return 0;
  226. }
  227. if(breakontlscallback == 1)
  228. {
  229. Setbreakpointext(strtol((unsigned char *)mySecPointer,NULL,16),TY_ONESHOT,0,0);
  230. Sendshortcut(PM_MAIN,0,WM_KEYDOWN,0,0,VK_F9);
  231. return 0;
  232. }
  233. Sendshortcut(PM_MAIN,0,WM_KEYDOWN,0,0,VK_F9);
  234. return 0;
  235. }
  236. else 
  237. {
  238. return 0;
  239. }
  240. }
  242. }
  243. return 0;
  244. };
  248. #pragma argsused
  249. extc int _export cdecl ODBG_Pluginmenu(int origin,char data[4096],void *item)
  251. {
  252. switch (origin)
  253. {
  254. case PM_MAIN:                      // Plugin menu in main window
  255.        strcpy(data,"0 &SET LDR_SHOW_SNAPS|1 &UNSET LDR_SHOW_SNAPS|3 &SetTempBreak on Tls cllabacks |4 &SetTempbreak on all DllInit Routines|2 &About");
  256. return 1;
  257. default: break;                    // Any other window
  258. };
  259.    return 0;                           // Window not supported by plugin
  260. };
  265. #pragma argsused
  266. extc void _export cdecl ODBG_Pluginaction(int origin,int action,void *item)
  268. {
  269. if (origin==PM_MAIN)
  270.  {
  271.     switch (action)
  272.     {
  273.    case 2:
  274.   MessageBox(hwmain,
  275.            "NtGlobalFlag v1.10n"
  276.    "thanks to oleh yuschuk for making this wonderful Debuggern"
  277.    "thanks to Detten for converting my crazy asm code and ideasn"
  278.    " into c and compiling this plugin",
  279.    "NtGLobalFlag",
  280.             MB_OK|MB_ICONINFORMATION);
  281.          break;
  283. case 0:
  284. isSet = myfunc (2);
  285. if(isSet == 1)
  286. MessageBox(hwmain,"LDR_SHOW_SNAPS was successfully SETn"
  287.   "RESTART DEBUGEE nn"
  288.   "YES DEBUGGEE NOT DEBUGGER :)n",
  289.   "         Success",
  290.    MB_OK|MB_ICONINFORMATION);
  291. else
  292. MessageBox(hwmain,"         ERROR","LDR_SHOW_SNAPS could not be SET",MB_OK|MB_ICONEXCLAMATION);
  293. break;
  294. case 1:
  295. isUnset = myfunc (0);
  296. if(isUnset == 1)
  297. MessageBox(hwmain,"         Success","LDR_SHOW_SNAPS was successfully UNSET",MB_OK|MB_ICONINFORMATION);
  298. else
  299. MessageBox(hwmain,"         ERROR","LDR_SHOW_SNAPS could not be UNSET",MB_OK|MB_ICONEXCLAMATION);
  300. break;
  301. case 3:
  302. breakontlscallback = 1;
  303. break;
  304. case 4:
  305. breakondllinitrout = 1;
  306. break;
  308.       default: break;
  309. };
  310.  }
  311. };
  318. int myfunc(int flag)
  319. {
  320. Curr_Pid  = GetCurrentProcessId();
  321. Curr_Proc_Pseudo = OpenProcess(PROCESS_ALL_ACCESS,FALSE,Curr_Pid); 
  322. type = Plugingetvalue(VAL_FONTHEIGHTS); 
  323. (int)glob = type+0x2a2C;
  324. if (flag == 2)
  325. {
  326. clah[0] = 0;
  327. }
  328. else
  329. {
  330. clah[0] = 2;
  331. }
  332. if(WriteProcessMemory(Curr_Proc_Pseudo,glob,&clah,1,NULL))
  333. {
  334. CloseHandle(Curr_Proc_Pseudo);
  335.                         return 1;
  336. }
  337. CloseHandle(Curr_Proc_Pseudo);
  338. return -1;
  339. }
  347. #pragma argsused
  348. DWORD WINAPI ThreadProcFirst( LPVOID lpParam )
  350. {
  351. seqwindow =0;
  352. editwindow = 0;
  353. buttwindow =0;
  355. while (seqwindow == 0)
  356. {
  357. seqwindow = FindWindow("#32770","Find sequence of commands");
  358. }
  360. while (editwindow == 0)
  361. {
  362. editwindow = FindWindowEx(seqwindow,NULL,"EDIT",NULL);
  363. }
  364. SendMessage(editwindow,WM_SETTEXT,NULL,(long)&spattern);
  366. while (buttwindow == 0)
  367. {
  368. buttwindow = FindWindowEx(seqwindow,NULL,"BUTTON","Find");
  369. }
  370. SendMessage(buttwindow,BM_CLICK,NULL,NULL);
  371. return 0;
  372. }
  375. #pragma argsused
  376. DWORD WINAPI ThreadProcSecond( LPVOID lpParam )
  378. {
  379. memset(asstext,0,200);
  380. memset(trim,0,200);
  381. memcpy(trim,"JMP ",4);
  382. asswindow = 0;
  383. asseditwindow =0;
  384. assbuttwindow =0;
  385. asscombo = 0;
  386. asscancel = 0;
  387. while (asswindow == 0)
  388. {
  389. asswindow = FindWindow("#32770",mystring);
  390. }
  392. while (asscombo ==0)
  393. {
  394. asscombo = FindWindowEx(asswindow,NULL,"ComboBox",NULL);
  395. }
  397. while (asseditwindow == 0)
  398. {
  399. asseditwindow = FindWindowEx(asscombo,NULL,"EDIT",NULL);
  400. }
  401. SendMessage(asseditwindow,WM_GETTEXT,100,(long)&asstext);
  402. if(StrCmpN("JNZ ",asstext,4) != 0)
  403. {
  404. MessageBox(hwmain,"strings are not equal","NtGlobalFlag",MB_OK);
  405. return 0;
  406. }
  407. StrCat(trim,asstext+4);
  408. SendMessage(asseditwindow,WM_SETTEXT,NULL,(long)&trim);
  410. while (assbuttwindow == 0)
  411. {
  412. assbuttwindow =FindWindowEx(asswindow,NULL,"BUTTON","Assemble");
  413. }
  414. SendMessage(assbuttwindow,BM_CLICK,NULL,NULL);
  416. while (asscancel ==0)
  417. {
  418. asscancel = FindWindowEx(asswindow,NULL,"BUTTON","Cancel");
  419. }
  420. SendMessage(asscancel,BM_CLICK,NULL,NULL);
  421. return 0;
  422. }