Added VEH debegguer, functions comments and renamed functions
This commit is contained in:
@@ -7,6 +7,7 @@
|
||||
#include <spdlog/spdlog.h>
|
||||
#include <spdlog/sinks/basic_file_sink.h>
|
||||
#include <iomanip>
|
||||
#include <tlhelp32.h>
|
||||
|
||||
static std::shared_ptr<spdlog::logger> _log;
|
||||
std::unordered_map<void*, Memory::PatchInfo> Memory::patches;
|
||||
@@ -32,7 +33,6 @@ void Memory::PatchBytes(void* address, const char* bytes, size_t len)
|
||||
VirtualProtect(address, len, oldProtect, &oldProtect);
|
||||
}
|
||||
|
||||
//void Memory::RestoreBytes(uintptr_t address)
|
||||
void Memory::RestoreBytes(void *address)
|
||||
{
|
||||
auto it = patches.find(address);
|
||||
@@ -50,7 +50,7 @@ void Memory::RestoreBytes(void *address)
|
||||
}
|
||||
}
|
||||
|
||||
bool Memory::wait_for_module(const std::string& module_name, int timeoutMs = 15000, int intervalMs = 500)
|
||||
bool Memory::WaitForModule(const std::string& module_name, int timeoutMs = 15000, int intervalMs = 500)
|
||||
{
|
||||
const HANDLE hProc = GetCurrentProcess();
|
||||
|
||||
@@ -81,21 +81,21 @@ bool Memory::wait_for_module(const std::string& module_name, int timeoutMs = 150
|
||||
return false;
|
||||
}
|
||||
|
||||
std::string Memory::byteToHexEscaped(const BYTE byte) {
|
||||
std::string Memory::ByteToHexEscaped(const BYTE byte) {
|
||||
std::ostringstream oss;
|
||||
oss << "\\x" << std::uppercase << std::hex << std::setw(2)
|
||||
<< std::setfill('0') << static_cast<int>(byte);
|
||||
return oss.str();
|
||||
}
|
||||
|
||||
uint8_t* Memory::aob_scan(
|
||||
uint8_t* Memory::AOBScan(
|
||||
const std::string& module_name,
|
||||
const std::string& signature,
|
||||
DWORD protect_flags = PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_READWRITE | PAGE_EXECUTE_WRITECOPY,
|
||||
std::shared_ptr<spdlog::logger> log) {
|
||||
|
||||
_log = log;
|
||||
if (!wait_for_module(module_name))
|
||||
if (!WaitForModule(module_name))
|
||||
{
|
||||
if (log) log->warn("Skipping AOB scan because module '{}' is unavailable.", module_name);
|
||||
return nullptr;
|
||||
@@ -181,3 +181,76 @@ uint8_t* Memory::aob_scan(
|
||||
if (log) log->warn("Module '{}' unexpectedly disappeared during scan.", module_name);
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
PVOID Memory::SetupOrClearHardwareBreakPointForAllThreads(uintptr_t targetAddress, PVOID vehHandle, bool enable, PVECTORED_EXCEPTION_HANDLER pVEH, int hwIndex)
|
||||
{
|
||||
DWORD pid = GetCurrentProcessId();
|
||||
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
|
||||
if (snapshot == INVALID_HANDLE_VALUE) return nullptr;
|
||||
|
||||
THREADENTRY32 te;
|
||||
te.dwSize = sizeof(te);
|
||||
|
||||
// Add VectoredExceptionHandler
|
||||
if (enable && !vehHandle && pVEH)
|
||||
{
|
||||
vehHandle = AddVectoredExceptionHandler(1, pVEH);
|
||||
}
|
||||
|
||||
if (Thread32First(snapshot, &te))
|
||||
{
|
||||
do
|
||||
{
|
||||
if (te.th32OwnerProcessID != pid) continue;
|
||||
|
||||
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, te.th32ThreadID);
|
||||
if (!hThread) continue;
|
||||
|
||||
CONTEXT ctx = {};
|
||||
ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;
|
||||
|
||||
if (GetThreadContext(hThread, &ctx))
|
||||
{
|
||||
if (enable)
|
||||
{
|
||||
switch (hwIndex) {
|
||||
case 0: ctx.Dr0 = targetAddress; break; // Set Hardware breakpoint #1
|
||||
case 1: ctx.Dr1 = targetAddress; break; // Set Hardware breakpoint #2
|
||||
case 2: ctx.Dr2 = targetAddress; break; // Set Hardware breakpoint #3
|
||||
case 3: ctx.Dr3 = targetAddress; break; // Set Hardware breakpoint #4
|
||||
default: break;
|
||||
}
|
||||
ctx.Dr7 |= (1ULL << (hwIndex * 2)); // activate hardware breakpoint
|
||||
}
|
||||
else
|
||||
{
|
||||
switch (hwIndex) {
|
||||
case 0: ctx.Dr0 = 0; break; // Unset Hardware breakpoint #1
|
||||
case 1: ctx.Dr1 = 0; break; // Unset Hardware breakpoint #2
|
||||
case 2: ctx.Dr2 = 0; break; // Unset Hardware breakpoint #3
|
||||
case 3: ctx.Dr3 = 0; break; // Unset Hardware breakpoint #4
|
||||
default: break;
|
||||
}
|
||||
ctx.Dr7 &= ~(1ULL << (hwIndex * 2)); // deactivate hardware breakpoint
|
||||
}
|
||||
|
||||
SetThreadContext(hThread, &ctx);
|
||||
}
|
||||
|
||||
CloseHandle(hThread);
|
||||
|
||||
} while (Thread32Next(snapshot, &te));
|
||||
}
|
||||
|
||||
CloseHandle(snapshot);
|
||||
|
||||
// Remove VectoredExceptionHandler
|
||||
if (!enable && vehHandle)
|
||||
{
|
||||
RemoveVectoredExceptionHandler(vehHandle);
|
||||
vehHandle = nullptr;
|
||||
}
|
||||
|
||||
return vehHandle;
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user