63 lines
2.6 KiB
C
63 lines
2.6 KiB
C
#include "processes.h"
|
|
|
|
const wchar_t* HOOK_BINARIES[] = {
|
|
L"app\\ALLNetProc.exe",
|
|
L"app\\CameraUploader.exe",
|
|
L"app\\GmSync.exe",
|
|
};
|
|
|
|
#define DISABLE_PROC_SPAWNING
|
|
|
|
BOOL WINAPI FakeCreateProcessA(LPCSTR lpApplicationName, LPSTR lpCommandLine,
|
|
LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
|
LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles,
|
|
DWORD dwCreationFlags, LPVOID lpEnvironment,
|
|
LPCSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo,
|
|
LPPROCESS_INFORMATION lpProcessInformation) {
|
|
log_info("spawn", "CreateProcessA %s %s", lpApplicationName, lpCommandLine);
|
|
|
|
HANDLE fake_evt = CreateEvent(NULL, TRUE, FALSE, NULL);
|
|
SetEvent(fake_evt);
|
|
|
|
if (lpProcessInformation) {
|
|
lpProcessInformation->hProcess = fake_evt;
|
|
}
|
|
return TRUE;
|
|
}
|
|
BOOL WINAPI FakeCreateProcessW(LPCWSTR lpApplicationName, LPWSTR lpCommandLine,
|
|
LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
|
LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles,
|
|
DWORD dwCreationFlags, LPVOID lpEnvironment,
|
|
LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo,
|
|
LPPROCESS_INFORMATION lpProcessInformation) {
|
|
// #ifdef DISABLE_PROC_SPAWNING
|
|
// log_error("spawn", "CreateProcessW %ls %ls", lpApplicationName, lpCommandLine);
|
|
// return FALSE;
|
|
// #else
|
|
// log_info("spawn", "CreateProcessW %ls %ls", lpApplicationName, lpCommandLine);
|
|
log_info("spawn", "CreateProcessW %ls", lpApplicationName);
|
|
return TRUE;
|
|
|
|
CHAR applicationName[MAX_PATH + 1];
|
|
WideCharToMultiByte(CP_ACP, 0, lpApplicationName, -1, applicationName, sizeof applicationName,
|
|
NULL, NULL);
|
|
|
|
HANDLE child;
|
|
if (lpCommandLine != NULL) {
|
|
CHAR commandLine[MAX_PATH + 1];
|
|
WideCharToMultiByte(CP_ACP, 0, lpCommandLine, -1, commandLine, sizeof commandLine, NULL,
|
|
NULL);
|
|
child = start_and_inject(applicationName, commandLine, MICELIB, false, 0, NULL);
|
|
} else {
|
|
child = start_and_inject(applicationName, NULL, MICELIB, false, 0, NULL);
|
|
}
|
|
|
|
return !FAILED(child);
|
|
// #endif
|
|
}
|
|
|
|
void hook_processes() {
|
|
hook("Kernel32.dll", "CreateProcessW", FakeCreateProcessW, (void**)&TrueCreateProcessW, 6);
|
|
hook("Kernel32.dll", "CreateProcessA", FakeCreateProcessA, (void**)&TrueCreateProcessA, 6);
|
|
}
|