No OneTemporary
Actions

Size

49 KB

Subscribers

None

View Options

	diff --git a/Scylla/ApiReader.cpp b/Scylla/ApiReader.cpp
	index 66a7b4a..4a4dd0a 100644
	--- a/Scylla/ApiReader.cpp
	+++ b/Scylla/ApiReader.cpp
	@@ -1,1209 +1,1225 @@

	#include "ApiReader.h"

	#include "Scylla.h"
	#include "Architecture.h"
	#include "SystemInformation.h"
	#include "StringConversion.h"
	#include "PeParser.h"

	stdext::hash_multimap<DWORD_PTR, ApiInfo *> ApiReader::apiList; //api look up table
	std::map<DWORD_PTR, ImportModuleThunk> * ApiReader::moduleThunkList; //store found apis

	DWORD_PTR ApiReader::minApiAddress = 0xFFFFFFFF;
	DWORD_PTR ApiReader::maxApiAddress = 0;

	-#define DEBUG_COMMENTS
	+//#define DEBUG_COMMENTS

	void ApiReader::readApisFromModuleList()
	{
	+ if (Scylla::config[APIS_ALWAYS_FROM_DISK].isTrue())
	+ {
	+ readExportTableAlwaysFromDisk = true;
	+ }
	+ else
	+ {
	+ readExportTableAlwaysFromDisk = false;
	+ }
	+
	for (unsigned int i = 0; i < moduleList.size();i++)
	{
	setModulePriority(&moduleList[i]);

	if (moduleList[i].modBaseAddr + moduleList[i].modBaseSize > maxValidAddress)
	{
	maxValidAddress = moduleList[i].modBaseAddr + moduleList[i].modBaseSize;
	}

	Scylla::windowLog.log(L"Module parsing: %s",moduleList[i].fullPath);

	if (!moduleList[i].isAlreadyParsed)
	{
	parseModule(&moduleList[i]);
	}
	}

	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"Address Min " PRINTF_DWORD_PTR_FULL L" Max " PRINTF_DWORD_PTR_FULL L"\nimagebase " PRINTF_DWORD_PTR_FULL L" maxValidAddress " PRINTF_DWORD_PTR_FULL, minApiAddress, maxApiAddress, targetImageBase ,maxValidAddress);
	#endif
	}

	void ApiReader::parseModule(ModuleInfo *module)
	{
	module->parsing = true;

	if (isWinSxSModule(module))
	{
	parseModuleWithMapping(module);
	}
	- else if (isModuleLoadedInOwnProcess(module))
	+ else if (isModuleLoadedInOwnProcess(module)) //this is always ok
	{
	parseModuleWithOwnProcess(module);
	}
	else
	{
	- parseModuleWithProcess(module);
	+ if (readExportTableAlwaysFromDisk)
	+ {
	+ parseModuleWithMapping(module);
	+ }
	+ else
	+ {
	+ parseModuleWithProcess(module);
	+ }
	}

	module->isAlreadyParsed = true;
	}

	void ApiReader::parseModuleWithMapping(ModuleInfo *moduleInfo)
	{
	LPVOID fileMapping = 0;
	PIMAGE_NT_HEADERS pNtHeader = 0;
	PIMAGE_DOS_HEADER pDosHeader = 0;

	fileMapping = createFileMappingViewRead(moduleInfo->fullPath);

	if (fileMapping == 0)
	return;

	pDosHeader = (PIMAGE_DOS_HEADER)fileMapping;
	pNtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)fileMapping + (DWORD_PTR)(pDosHeader->e_lfanew));

	if (isPeAndExportTableValid(pNtHeader))
	{
	parseExportTable(moduleInfo, pNtHeader, (PIMAGE_EXPORT_DIRECTORY)((DWORD_PTR)fileMapping + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress), (DWORD_PTR)fileMapping);
	}


	UnmapViewOfFile(fileMapping);

	}

	inline bool ApiReader::isApiForwarded(DWORD_PTR rva, PIMAGE_NT_HEADERS pNtHeader)
	{
	if ((rva > pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress) && (rva < (pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size)))
	{
	return true;
	}
	else
	{
	return false;
	}
	}

	void ApiReader::handleForwardedApi(DWORD_PTR vaStringPointer,char * functionNameParent, DWORD_PTR rvaParent, WORD ordinalParent, ModuleInfo *moduleParent)
	{
	size_t dllNameLength = 0;
	WORD ordinal = 0;
	ModuleInfo *module = 0;
	DWORD_PTR vaApi = 0;
	DWORD_PTR rvaApi = 0;
	char dllName[100] = {0};
	WCHAR dllNameW[100] = {0};
	char fordwardedString = (char )vaStringPointer;
	char *searchFunctionName = strchr(fordwardedString, '.');


	if (!searchFunctionName)
	return;

	dllNameLength = searchFunctionName - fordwardedString;

	if (dllNameLength >= 99)
	{
	return;
	}
	else
	{
	strncpy_s(dllName, fordwardedString, dllNameLength);
	}

	searchFunctionName++;

	//Windows 7
	if (!strncmp(dllName,"api-ms-win-", 11))
	{
	/*
	Info: http://www.nirsoft.net/articles/windows_7_kernel_architecture_changes.html
	*/

	FARPROC addy = GetProcAddress(GetModuleHandleA(dllName), searchFunctionName);

	if (addy != 0)
	{
	addApi(functionNameParent,0, ordinalParent, (DWORD_PTR)addy, (DWORD_PTR)addy - (DWORD_PTR)GetModuleHandleA(dllName), true, moduleParent);
	}

	return;
	}

	strcat_s(dllName, ".dll");

	StringConversion::ToUTF16(dllName, dllNameW, _countof(dllNameW));

	if (!_wcsicmp(dllNameW, moduleParent->getFilename()))
	{
	module = moduleParent;
	}
	else
	{
	module = findModuleByName(dllNameW);
	}

	if (module != 0) // module == 0 -> can be ignored
	{
	/*if ((module->isAlreadyParsed == false) && (module != moduleParent))
	{
	//do API extract

	if (module->parsing == true)
	{
	//some stupid circle dependency
	printf("stupid circle dependency %s\n",module->getFilename());
	}
	else
	{
	parseModule(module);
	}
	}*/

	if (strchr(searchFunctionName,'#'))
	{
	//forwarding by ordinal
	searchFunctionName++;
	ordinal = (WORD)atoi(searchFunctionName);
	findApiByModuleAndOrdinal(module, ordinal, &vaApi, &rvaApi);
	}
	else
	{
	findApiByModuleAndName(module, searchFunctionName, &vaApi, &rvaApi);
	}

	if (rvaApi == 0)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"handleForwardedApi :: Api not found, this is really BAD! %S",fordwardedString);
	#endif
	}
	else
	{
	addApi(functionNameParent,0, ordinalParent, vaApi, rvaApi, true, moduleParent);
	}
	}

	}

	ModuleInfo * ApiReader::findModuleByName(WCHAR *name)
	{
	for (unsigned int i = 0; i < moduleList.size(); i++) {
	if (!_wcsicmp(moduleList[i].getFilename(), name))
	{
	return &moduleList[i];
	}
	}

	return 0;
	}

	void ApiReader::addApiWithoutName(WORD ordinal, DWORD_PTR va, DWORD_PTR rva,bool isForwarded, ModuleInfo *moduleInfo)
	{
	addApi(0, 0, ordinal, va, rva, isForwarded, moduleInfo);
	}

	void ApiReader::addApi(char functionName, WORD hint, WORD ordinal, DWORD_PTR va, DWORD_PTR rva, bool isForwarded, ModuleInfo moduleInfo)
	{
	ApiInfo *apiInfo = new ApiInfo();

	if ((functionName != 0) && (strlen(functionName) < _countof(apiInfo->name)))
	{
	strcpy_s(apiInfo->name, functionName);
	}
	else
	{
	apiInfo->name[0] = 0x00;
	}

	apiInfo->ordinal = ordinal;
	apiInfo->isForwarded = isForwarded;
	apiInfo->module = moduleInfo;
	apiInfo->rva = rva;
	apiInfo->va = va;
	apiInfo->hint = hint;

	setMinMaxApiAddress(va);

	moduleInfo->apiList.push_back(apiInfo);

	apiList.insert(API_Pair(va, apiInfo));
	}

	BYTE * ApiReader::getHeaderFromProcess(ModuleInfo * module)
	{
	BYTE *bufferHeader = 0;
	DWORD readSize = 0;

	if (module->modBaseSize < PE_HEADER_BYTES_COUNT)
	{
	readSize = module->modBaseSize;
	}
	else
	{
	readSize = PE_HEADER_BYTES_COUNT;
	}

	bufferHeader = new BYTE[readSize];

	if(!readMemoryFromProcess(module->modBaseAddr, readSize, bufferHeader))
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"getHeaderFromProcess :: Error reading header");
	#endif
	delete[] bufferHeader;
	return 0;
	}
	else
	{
	return bufferHeader;
	}
	}

	BYTE * ApiReader::getExportTableFromProcess(ModuleInfo * module, PIMAGE_NT_HEADERS pNtHeader)
	{
	DWORD readSize = 0;
	BYTE *bufferExportTable = 0;

	readSize = pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size;

	if (readSize < (sizeof(IMAGE_EXPORT_DIRECTORY) + 8))
	{
	//Something is wrong with the PE Header
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"Something is wrong with the PE Header here Export table size %d", readSize);
	#endif
	readSize = sizeof(IMAGE_EXPORT_DIRECTORY) + 100;
	}

	if (readSize)
	{
	bufferExportTable = new BYTE[readSize];

	if (!bufferExportTable)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"Something is wrong with the PE Header here Export table size %d", readSize);
	#endif
	return 0;
	}

	if(!readMemoryFromProcess(module->modBaseAddr + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress, readSize, bufferExportTable))
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"getExportTableFromProcess :: Error reading export table from process");
	#endif
	delete[] bufferExportTable;
	return 0;
	}
	else
	{
	return bufferExportTable;
	}
	}
	else
	{
	return 0;
	}
	}

	void ApiReader::parseModuleWithProcess(ModuleInfo * module)
	{
	PIMAGE_NT_HEADERS pNtHeader = 0;
	PIMAGE_DOS_HEADER pDosHeader = 0;
	BYTE *bufferHeader = 0;
	BYTE *bufferExportTable = 0;
	- PeParser peParser(module->fullPath, false);
	+ PeParser peParser(module->modBaseAddr, false);

	if (!peParser.isValidPeFile())
	return;

	pNtHeader = peParser.getCurrentNtHeader();

	if (peParser.hasExportDirectory())
	{
	bufferExportTable = getExportTableFromProcess(module, pNtHeader);

	if(bufferExportTable)
	{
	parseExportTable(module,pNtHeader,(PIMAGE_EXPORT_DIRECTORY)bufferExportTable, (DWORD_PTR)bufferExportTable - pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
	delete[] bufferExportTable;
	}
	}
	}

	void ApiReader::parseExportTable(ModuleInfo *module, PIMAGE_NT_HEADERS pNtHeader, PIMAGE_EXPORT_DIRECTORY pExportDir, DWORD_PTR deltaAddress)
	{
	DWORD addressOfFunctionsArray = 0,addressOfNamesArray = 0;
	WORD *addressOfNameOrdinalsArray = 0;
	char *functionName = 0;
	DWORD_PTR RVA = 0, VA = 0;
	WORD ordinal = 0;
	WORD i = 0, j = 0;
	bool withoutName;


	addressOfFunctionsArray = (DWORD *)((DWORD_PTR)pExportDir->AddressOfFunctions + deltaAddress);
	addressOfNamesArray = (DWORD *)((DWORD_PTR)pExportDir->AddressOfNames + deltaAddress);
	addressOfNameOrdinalsArray = (WORD *)((DWORD_PTR)pExportDir->AddressOfNameOrdinals + deltaAddress);

	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"parseExportTable :: module %s NumberOfNames %X", module->fullPath, pExportDir->NumberOfNames);
	#endif

	for (i = 0; i < pExportDir->NumberOfNames; i++)
	{
	functionName = (char*)(addressOfNamesArray[i] + deltaAddress);
	ordinal = (WORD)(addressOfNameOrdinalsArray[i] + pExportDir->Base);
	RVA = addressOfFunctionsArray[addressOfNameOrdinalsArray[i]];
	VA = addressOfFunctionsArray[addressOfNameOrdinalsArray[i]] + module->modBaseAddr;

	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"parseExportTable :: api %S ordinal %d imagebase " PRINTF_DWORD_PTR_FULL L" RVA " PRINTF_DWORD_PTR_FULL L" VA " PRINTF_DWORD_PTR_FULL, functionName, ordinal, module->modBaseAddr, RVA, VA);
	#endif
	if (!isApiBlacklisted(functionName))
	{
	if (!isApiForwarded(RVA,pNtHeader))
	{
	addApi(functionName, i, ordinal,VA,RVA,false,module);
	}
	else
	{
	//printf("Forwarded: %s\n",functionName);
	handleForwardedApi(RVA + deltaAddress,functionName,RVA,ordinal,module);
	}
	}

	}

	/Exports without name/
	if (pExportDir->NumberOfNames != pExportDir->NumberOfFunctions)
	{
	for (i = 0; i < pExportDir->NumberOfFunctions; i++)
	{
	withoutName = true;
	for (j = 0; j < pExportDir->NumberOfNames; j++)
	{
	if(addressOfNameOrdinalsArray[j] == i)
	{
	withoutName = false;
	break;
	}
	}
	if (withoutName && addressOfFunctionsArray[i] != 0)
	{
	ordinal = (WORD)(i+pExportDir->Base);
	RVA = addressOfFunctionsArray[i];
	VA = (addressOfFunctionsArray[i] + module->modBaseAddr);


	if (!isApiForwarded(RVA,pNtHeader))
	{
	addApiWithoutName(ordinal,VA,RVA,false,module);
	}
	else
	{
	handleForwardedApi(RVA + deltaAddress,0,RVA,ordinal,module);
	}

	}
	}
	}
	}

	void ApiReader::findApiByModuleAndOrdinal(ModuleInfo * module, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi)
	{
	findApiByModule(module,0,ordinal,vaApi,rvaApi);
	}

	void ApiReader::findApiByModuleAndName(ModuleInfo * module, char * searchFunctionName, DWORD_PTR * vaApi, DWORD_PTR * rvaApi)
	{
	findApiByModule(module,searchFunctionName,0,vaApi,rvaApi);
	}

	void ApiReader::findApiByModule(ModuleInfo * module, char * searchFunctionName, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi)
	{
	if (isModuleLoadedInOwnProcess(module))
	{
	HMODULE hModule = GetModuleHandle(module->getFilename());

	if (hModule)
	{
	if (vaApi)
	{
	if (ordinal)
	{
	*vaApi = (DWORD_PTR)GetProcAddress(hModule, (LPCSTR)ordinal);
	}
	else
	{
	*vaApi = (DWORD_PTR)GetProcAddress(hModule, searchFunctionName);
	}

	rvaApi = (vaApi) - (DWORD_PTR)hModule;
	vaApi = (rvaApi) + module->modBaseAddr;
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"findApiByModule :: vaApi == NULL, should never happen %S", searchFunctionName);
	#endif
	}
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"findApiByModule :: hModule == NULL, should never happen %s", module->getFilename());
	#endif
	}
	}
	else
	{
	//search api in extern process
	findApiInProcess(module,searchFunctionName,ordinal,vaApi,rvaApi);
	}
	}

	bool ApiReader::isModuleLoadedInOwnProcess(ModuleInfo * module)
	{
	for (unsigned int i = 0; i < ownModuleList.size(); i++)
	{
	if (!_wcsicmp(module->fullPath, ownModuleList[i].fullPath))
	{
	//printf("isModuleLoadedInOwnProcess :: %s %s\n",module->fullPath,ownModuleList[i].fullPath);
	return true;
	}
	}
	return false;
	}

	void ApiReader::parseModuleWithOwnProcess( ModuleInfo * module )
	{
	PIMAGE_NT_HEADERS pNtHeader = 0;
	PIMAGE_DOS_HEADER pDosHeader = 0;
	HMODULE hModule = GetModuleHandle(module->getFilename());

	if (hModule)
	{
	pDosHeader = (PIMAGE_DOS_HEADER)hModule;
	pNtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)hModule + (DWORD_PTR)(pDosHeader->e_lfanew));

	if (isPeAndExportTableValid(pNtHeader))
	{
	parseExportTable(module, pNtHeader, (PIMAGE_EXPORT_DIRECTORY)((DWORD_PTR)hModule + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress), (DWORD_PTR)hModule);
	}
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"parseModuleWithOwnProcess :: hModule is NULL");
	#endif
	}
	}

	bool ApiReader::isPeAndExportTableValid(PIMAGE_NT_HEADERS pNtHeader)
	{
	if (pNtHeader->Signature != IMAGE_NT_SIGNATURE)
	{
	Scylla::windowLog.log(L"-> IMAGE_NT_SIGNATURE doesn't match.");
	return false;
	}
	else if ((pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress == 0) \|\| (pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size == 0))
	{
	Scylla::windowLog.log(L"-> No export table.");
	return false;
	}
	else
	{
	return true;
	}
	}

	void ApiReader::findApiInProcess(ModuleInfo * module, char * searchFunctionName, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi)
	{
	PIMAGE_NT_HEADERS pNtHeader = 0;
	PIMAGE_DOS_HEADER pDosHeader = 0;
	BYTE *bufferHeader = 0;
	BYTE *bufferExportTable = 0;


	bufferHeader = getHeaderFromProcess(module);

	if (bufferHeader == 0)
	return;

	pDosHeader = (PIMAGE_DOS_HEADER)bufferHeader;
	pNtHeader = (PIMAGE_NT_HEADERS)((DWORD_PTR)bufferHeader + (DWORD_PTR)(pDosHeader->e_lfanew));

	if (isPeAndExportTableValid(pNtHeader))
	{
	bufferExportTable = getExportTableFromProcess(module, pNtHeader);

	if(bufferExportTable)
	{
	findApiInExportTable(module,(PIMAGE_EXPORT_DIRECTORY)bufferExportTable, (DWORD_PTR)bufferExportTable - pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress,searchFunctionName,ordinal,vaApi,rvaApi);
	delete[] bufferExportTable;
	}
	}

	delete[] bufferHeader;
	}

	bool ApiReader::findApiInExportTable(ModuleInfo module, PIMAGE_EXPORT_DIRECTORY pExportDir, DWORD_PTR deltaAddress, char searchFunctionName, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi)
	{
	DWORD addressOfFunctionsArray = 0,addressOfNamesArray = 0;
	WORD *addressOfNameOrdinalsArray = 0;
	char *functionName = 0;
	DWORD i = 0, j = 0;

	addressOfFunctionsArray = (DWORD *)((DWORD_PTR)pExportDir->AddressOfFunctions + deltaAddress);
	addressOfNamesArray = (DWORD *)((DWORD_PTR)pExportDir->AddressOfNames + deltaAddress);
	addressOfNameOrdinalsArray = (WORD *)((DWORD_PTR)pExportDir->AddressOfNameOrdinals + deltaAddress);

	if (searchFunctionName)
	{
	for (i = 0; i < pExportDir->NumberOfNames; i++)
	{
	functionName = (char*)(addressOfNamesArray[i] + deltaAddress);

	if (!strcmp(functionName,searchFunctionName))
	{
	*rvaApi = addressOfFunctionsArray[addressOfNameOrdinalsArray[i]];
	*vaApi = addressOfFunctionsArray[addressOfNameOrdinalsArray[i]] + module->modBaseAddr;
	return true;
	}
	}
	}
	else
	{
	for (i = 0; i < pExportDir->NumberOfFunctions; i++)
	{
	if (ordinal == (i+pExportDir->Base))
	{
	*rvaApi = addressOfFunctionsArray[i];
	*vaApi = (addressOfFunctionsArray[i] + module->modBaseAddr);
	return true;
	}
	}
	}

	return false;
	}


	void ApiReader::setModulePriority(ModuleInfo * module)
	{
	const WCHAR *moduleFileName = module->getFilename();

	//imports by kernelbase don't exist
	if (!_wcsicmp(moduleFileName, L"kernelbase.dll"))
	{
	module->priority = -1;
	}
	else if (!_wcsicmp(moduleFileName, L"ntdll.dll"))
	{
	module->priority = 0;
	}
	else if (!_wcsicmp(moduleFileName, L"shlwapi.dll"))
	{
	module->priority = 0;
	}
	else if (!_wcsicmp(moduleFileName, L"ShimEng.dll"))
	{
	module->priority = 0;
	}
	else if (!_wcsicmp(moduleFileName, L"kernel32.dll"))
	{
	module->priority = 2;
	}
	else if (!_wcsnicmp(moduleFileName, L"api-ms-win-", 11))
	{
	module->priority = 0;
	}
	else
	{
	module->priority = 1;
	}
	}

	bool ApiReader::isApiAddressValid(DWORD_PTR virtualAddress)
	{
	return apiList.count(virtualAddress) > 0;
	}

	ApiInfo * ApiReader::getApiByVirtualAddress(DWORD_PTR virtualAddress, bool * isSuspect)
	{
	stdext::hash_multimap<DWORD_PTR, ApiInfo *>::iterator it1, it2;
	size_t c = 0;
	size_t countDuplicates = apiList.count(virtualAddress);
	int countHighPriority = 0;
	ApiInfo *apiFound = 0;


	if (countDuplicates == 0)
	{
	return 0;
	}
	else if (countDuplicates == 1)
	{
	//API is 100% correct
	*isSuspect = false;
	it1 = apiList.find(virtualAddress); // Find first match.
	return (ApiInfo )((it1).second);
	}
	else
	{
	it1 = apiList.find(virtualAddress); // Find first match.

	//any high priority with a name
	apiFound = getScoredApi(it1,countDuplicates,true,false,false,true,false,false,false,false);

	if (apiFound)
	return apiFound;

	*isSuspect = true;

	//high priority with a name and ansi/unicode name
	apiFound = getScoredApi(it1,countDuplicates,true,true,false,true,false,false,false,false);

	if (apiFound)
	return apiFound;

	//priority 2 with no underline in name
	apiFound = getScoredApi(it1,countDuplicates,true,false,true,false,false,false,true,false);

	if (apiFound)
	return apiFound;

	//priority 1 with a name
	apiFound = getScoredApi(it1,countDuplicates,true,false,false,false,false,true,false,false);

	if (apiFound)
	return apiFound;

	//With a name
	apiFound = getScoredApi(it1,countDuplicates,true,false,false,false,false,false,false,false);

	if (apiFound)
	return apiFound;

	//any with priority, name, ansi/unicode
	apiFound = getScoredApi(it1,countDuplicates,true,true,false,true,false,false,false,true);

	if (apiFound)
	return apiFound;

	//any with priority
	apiFound = getScoredApi(it1,countDuplicates,false,false,false,true,false,false,false,true);

	if (apiFound)
	return apiFound;

	//has prio 0 and name
	apiFound = getScoredApi(it1,countDuplicates,false,false,false,false,true,false,false,true);

	if (apiFound)
	return apiFound;
	}

	//is never reached
	Scylla::windowLog.log(L"getApiByVirtualAddress :: There is a api resolving bug, VA: " PRINTF_DWORD_PTR_FULL, virtualAddress);
	for (size_t c = 0; c < countDuplicates; c++, it1++)
	{
	apiFound = (ApiInfo )((it1).second);
	Scylla::windowLog.log(L"-> Possible API: %S ord: %d ", apiFound->name, apiFound->ordinal);
	}
	return (ApiInfo *) 1;
	}

	ApiInfo * ApiReader::getScoredApi(stdext::hash_multimap<DWORD_PTR, ApiInfo *>::iterator it1,size_t countDuplicates, bool hasName, bool hasUnicodeAnsiName, bool hasNoUnderlineInName, bool hasPrioDll,bool hasPrio0Dll,bool hasPrio1Dll, bool hasPrio2Dll, bool firstWin )
	{
	ApiInfo * foundApi = 0;
	ApiInfo * foundMatchingApi = 0;
	int countFoundApis = 0;
	int scoreNeeded = 0;
	int scoreValue = 0;
	size_t apiNameLength = 0;

	if (hasUnicodeAnsiName \|\| hasNoUnderlineInName)
	{
	hasName = true;
	}

	if (hasName)
	scoreNeeded++;

	if (hasUnicodeAnsiName)
	scoreNeeded++;

	if (hasNoUnderlineInName)
	scoreNeeded++;

	if (hasPrioDll)
	scoreNeeded++;

	if (hasPrio0Dll)
	scoreNeeded++;

	if (hasPrio1Dll)
	scoreNeeded++;

	if (hasPrio2Dll)
	scoreNeeded++;

	for (size_t c = 0; c < countDuplicates; c++, it1++)
	{
	foundApi = (ApiInfo )((it1).second);
	scoreValue = 0;

	if (hasName)
	{
	if (foundApi->name[0] != 0x00)
	{
	scoreValue++;

	if (hasUnicodeAnsiName)
	{
	apiNameLength = strlen(foundApi->name);

	if ((foundApi->name[apiNameLength - 1] == 'W') \|\| (foundApi->name[apiNameLength - 1] == 'A'))
	{
	scoreValue++;
	}
	}

	if (hasNoUnderlineInName)
	{
	if (!strrchr(foundApi->name, '_'))
	{
	scoreValue++;
	}
	}
	}
	}

	if (hasPrioDll)
	{
	if (foundApi->module->priority >= 1)
	{
	scoreValue++;
	}
	}

	if (hasPrio0Dll)
	{
	if (foundApi->module->priority == 0)
	{
	scoreValue++;
	}
	}

	if (hasPrio1Dll)
	{
	if (foundApi->module->priority == 1)
	{
	scoreValue++;
	}
	}

	if (hasPrio2Dll)
	{
	if (foundApi->module->priority == 2)
	{
	scoreValue++;
	}
	}


	if (scoreValue == scoreNeeded)
	{
	foundMatchingApi = foundApi;
	countFoundApis++;

	if (firstWin)
	{
	return foundMatchingApi;
	}
	}
	}

	if (countFoundApis == 1)
	{
	return foundMatchingApi;
	}
	else
	{
	return (ApiInfo *)0;
	}

	}

	void ApiReader::setMinMaxApiAddress(DWORD_PTR virtualAddress)
	{
	if (virtualAddress < minApiAddress)
	{
	minApiAddress = virtualAddress - 1;
	}
	if (virtualAddress > maxApiAddress)
	{
	maxApiAddress = virtualAddress + 1;
	}
	}

	void ApiReader::readAndParseIAT(DWORD_PTR addressIAT, DWORD sizeIAT, std::map<DWORD_PTR, ImportModuleThunk> &moduleListNew)
	{
	moduleThunkList = &moduleListNew;
	BYTE *dataIat = new BYTE[sizeIAT];
	if (readMemoryFromProcess(addressIAT,sizeIAT,dataIat))
	{
	parseIAT(addressIAT,dataIat,sizeIAT);
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"ApiReader::readAndParseIAT :: error reading iat " PRINTF_DWORD_PTR_FULL, addressIAT);
	#endif
	}

	delete[] dataIat;
	}

	void ApiReader::parseIAT(DWORD_PTR addressIAT, BYTE * iatBuffer, SIZE_T size)
	{
	ApiInfo *apiFound = 0;
	ModuleInfo *module = 0;
	bool isSuspect = false;
	int countApiFound = 0, countApiNotFound = 0;
	DWORD_PTR * pIATAddress = (DWORD_PTR *)iatBuffer;
	SIZE_T sizeIAT = size / sizeof(DWORD_PTR);

	for (SIZE_T i = 0; i < sizeIAT; i++)
	{
	//Scylla::windowLog.log(L"%08X %08X %d von %d", addressIAT + (DWORD_PTR)&pIATAddress[i] - (DWORD_PTR)iatBuffer, pIATAddress[i],i,sizeIAT);

	if (!isInvalidMemoryForIat(pIATAddress[i]))
	{
	if ( (pIATAddress[i] > minApiAddress) && (pIATAddress[i] < maxApiAddress) )
	{

	apiFound = getApiByVirtualAddress(pIATAddress[i], &isSuspect);
	if (apiFound == 0)
	{
	Scylla::windowLog.log(L"getApiByVirtualAddress :: No Api found " PRINTF_DWORD_PTR_FULL, pIATAddress[i]);
	}
	if (apiFound == (ApiInfo *)1)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"apiFound == (ApiInfo *)1 -> " PRINTF_DWORD_PTR_FULL, pIATAddress[i]);
	#endif
	}
	else if (apiFound)
	{
	countApiFound++;
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(PRINTF_DWORD_PTR_FULL L" %s %d %s", apiFound->va, apiFound->module->getFilename(), apiFound->ordinal, apiFound->name);
	#endif
	if (module != apiFound->module)
	{
	module = apiFound->module;
	addFoundApiToModuleList(addressIAT + (DWORD_PTR)&pIATAddress[i] - (DWORD_PTR)iatBuffer, apiFound, true, isSuspect);
	}
	else
	{
	addFoundApiToModuleList(addressIAT + (DWORD_PTR)&pIATAddress[i] - (DWORD_PTR)iatBuffer, apiFound, false, isSuspect);
	}

	}
	else
	{
	countApiNotFound++;
	addNotFoundApiToModuleList(addressIAT + (DWORD_PTR)&pIATAddress[i] - (DWORD_PTR)iatBuffer, pIATAddress[i]);
	//printf("parseIAT :: API not found %08X\n", pIATAddress[i]);
	}
	}
	else
	{
	//printf("parseIAT :: API not found %08X\n", pIATAddress[i]);
	countApiNotFound++;
	addNotFoundApiToModuleList(addressIAT + (DWORD_PTR)&pIATAddress[i] - (DWORD_PTR)iatBuffer, pIATAddress[i]);
	}
	}

	}

	Scylla::windowLog.log(L"IAT parsing finished, found %d valid APIs, missed %d APIs", countApiFound, countApiNotFound);
	}

	void ApiReader::addFoundApiToModuleList(DWORD_PTR iatAddressVA, ApiInfo * apiFound, bool isNewModule, bool isSuspect)
	{
	if (isNewModule)
	{
	addModuleToModuleList(apiFound->module->getFilename(), iatAddressVA - targetImageBase);
	}
	addFunctionToModuleList(apiFound, iatAddressVA, iatAddressVA - targetImageBase, apiFound->ordinal, true, isSuspect);
	}

	bool ApiReader::addModuleToModuleList(const WCHAR * moduleName, DWORD_PTR firstThunk)
	{
	ImportModuleThunk module;

	module.firstThunk = firstThunk;
	wcscpy_s(module.moduleName, moduleName);

	(*moduleThunkList).insert(std::pair<DWORD_PTR,ImportModuleThunk>(firstThunk,module));

	return true;
	}

	void ApiReader::addUnknownModuleToModuleList(DWORD_PTR firstThunk)
	{
	ImportModuleThunk module;

	module.firstThunk = firstThunk;
	wcscpy_s(module.moduleName, L"?");

	(*moduleThunkList).insert(std::pair<DWORD_PTR,ImportModuleThunk>(firstThunk,module));
	}

	bool ApiReader::addFunctionToModuleList(ApiInfo * apiFound, DWORD_PTR va, DWORD_PTR rva, WORD ordinal, bool valid, bool suspect)
	{
	ImportThunk import;
	ImportModuleThunk * module = 0;
	std::map<DWORD_PTR, ImportModuleThunk>::iterator iterator1;

	if ((*moduleThunkList).size() > 1)
	{
	iterator1 = (*moduleThunkList).begin();
	while (iterator1 != (*moduleThunkList).end())
	{
	if (rva >= iterator1->second.firstThunk)
	{
	iterator1++;
	if (iterator1 == (*moduleThunkList).end())
	{
	iterator1--;
	module = &(iterator1->second);
	break;
	}
	else if (rva < iterator1->second.firstThunk)
	{
	iterator1--;
	module = &(iterator1->second);
	break;
	}
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"Error iterator1 != (*moduleThunkList).end()");
	#endif
	break;
	}
	}
	}
	else
	{
	iterator1 = (*moduleThunkList).begin();
	module = &(iterator1->second);
	}

	if (!module)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"ImportsHandling::addFunction module not found rva " PRINTF_DWORD_PTR_FULL, rva);
	#endif
	return false;
	}


	import.suspect = suspect;
	import.valid = valid;
	import.va = va;
	import.rva = rva;
	import.apiAddressVA = apiFound->va;
	import.ordinal = ordinal;
	import.hint = (WORD)apiFound->hint;

	wcscpy_s(import.moduleName, apiFound->module->getFilename());
	strcpy_s(import.name, apiFound->name);

	module->thunkList.insert(std::pair<DWORD_PTR,ImportThunk>(import.rva, import));

	return true;
	}

	void ApiReader::clearAll()
	{
	minApiAddress = -1;
	maxApiAddress = 0;

	for ( stdext::hash_map<DWORD_PTR, ApiInfo *>::iterator it = apiList.begin(); it != apiList.end(); ++it )
	{
	delete it->second;
	}
	apiList.clear();

	if (moduleThunkList != 0)
	{
	(*moduleThunkList).clear();
	}
	}

	bool ApiReader::addNotFoundApiToModuleList(DWORD_PTR iatAddressVA, DWORD_PTR apiAddress)
	{
	ImportThunk import;
	ImportModuleThunk * module = 0;
	std::map<DWORD_PTR, ImportModuleThunk>::iterator iterator1;
	DWORD_PTR rva = iatAddressVA - targetImageBase;

	if ((*moduleThunkList).size() > 0)
	{
	iterator1 = (*moduleThunkList).begin();
	while (iterator1 != (*moduleThunkList).end())
	{
	if (rva >= iterator1->second.firstThunk)
	{
	iterator1++;
	if (iterator1 == (*moduleThunkList).end())
	{
	iterator1--;
	//new unknown module
	if (iterator1->second.moduleName[0] == L'?')
	{
	module = &(iterator1->second);
	}
	else
	{
	addUnknownModuleToModuleList(rva);
	module = &((*moduleThunkList).find(rva)->second);
	}

	break;
	}
	else if (rva < iterator1->second.firstThunk)
	{
	iterator1--;
	module = &(iterator1->second);
	break;
	}
	}
	else
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"Error iterator1 != (*moduleThunkList).end()\r\n");
	#endif
	break;
	}
	}
	}
	else
	{
	//new unknown module
	addUnknownModuleToModuleList(rva);
	module = &((*moduleThunkList).find(rva)->second);
	}

	if (!module)
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"ImportsHandling::addFunction module not found rva " PRINTF_DWORD_PTR_FULL,rva);
	#endif
	return false;
	}


	import.suspect = true;
	import.valid = false;
	import.va = iatAddressVA;
	import.rva = rva;
	import.apiAddressVA = apiAddress;
	import.ordinal = 0;

	wcscpy_s(import.moduleName, L"?");
	strcpy_s(import.name, "?");

	module->thunkList.insert(std::pair<DWORD_PTR,ImportThunk>(import.rva, import));

	return true;
	}

	bool ApiReader::isApiBlacklisted( const char * functionName )
	{
	if (SystemInformation::currenOS < WIN_VISTA_32)
	{
	if (!strcmp(functionName, "RestoreLastError"))
	{
	return true;
	}
	else
	{
	return false;
	}
	}
	else
	{
	return false;
	}


	/*#ifdef _WIN64
	else if (SystemInformation::currenOS == WIN_XP_64 && !strcmp(functionName, "DecodePointer"))
	{
	return true;
	}
	#endif*/
	}

	bool ApiReader::isWinSxSModule( ModuleInfo * module )
	{
	if (wcsstr(module->fullPath, L"\\WinSxS\\"))
	{
	return true;
	}
	else if (wcsstr(module->fullPath, L"\\winsxs\\"))
	{
	return true;
	}
	else
	{
	return false;
	}
	}

	bool ApiReader::isInvalidMemoryForIat( DWORD_PTR address )
	{
	if (address == 0)
	return true;

	if (address == -1)
	return true;

	MEMORY_BASIC_INFORMATION memBasic = {0};

	if (VirtualQueryEx(ProcessAccessHelp::hProcess, (LPCVOID)address, &memBasic, sizeof(MEMORY_BASIC_INFORMATION)))
	{
	if((memBasic.State == MEM_COMMIT) && ProcessAccessHelp::isPageExecutable(memBasic.Protect))
	{
	return false;
	}
	else
	{
	return true;
	}
	}
	else
	{
	return true;
	}
	}
	diff --git a/Scylla/ApiReader.h b/Scylla/ApiReader.h
	index 955640a..5ebab30 100644
	--- a/Scylla/ApiReader.h
	+++ b/Scylla/ApiReader.h
	@@ -1,75 +1,75 @@
	#pragma once

	#include <windows.h>
	#include <map>
	#include <hash_map>
	#include "ProcessAccessHelp.h"
	#include "Thunks.h"

	typedef std::pair<DWORD_PTR, ApiInfo *> API_Pair;

	class ApiReader : public ProcessAccessHelp
	{
	public:
	static stdext::hash_multimap<DWORD_PTR, ApiInfo *> apiList; //api look up table

	static std::map<DWORD_PTR, ImportModuleThunk> * moduleThunkList; //store found apis

	static DWORD_PTR minApiAddress;
	static DWORD_PTR maxApiAddress;

	/*
	* Read all APIs from target process
	*/
	void readApisFromModuleList();

	bool isApiAddressValid(DWORD_PTR virtualAddress);
	ApiInfo * getApiByVirtualAddress(DWORD_PTR virtualAddress, bool * isSuspect);
	void readAndParseIAT(DWORD_PTR addressIAT, DWORD sizeIAT, std::map<DWORD_PTR, ImportModuleThunk> &moduleListNew );
	void addFoundApiToModuleList(DWORD_PTR iatAddress, ApiInfo * apiFound, bool isNewModule, bool isSuspect);
	void clearAll();
	bool isInvalidMemoryForIat( DWORD_PTR address );
	private:
	-
	+ bool readExportTableAlwaysFromDisk;
	void parseIAT(DWORD_PTR addressIAT, BYTE * iatBuffer, SIZE_T size);

	void addApi(char functionName, WORD hint, WORD ordinal, DWORD_PTR va, DWORD_PTR rva, bool isForwarded, ModuleInfo moduleInfo);
	void addApiWithoutName(WORD ordinal, DWORD_PTR va, DWORD_PTR rva,bool isForwarded, ModuleInfo *moduleInfo);
	inline bool isApiForwarded(DWORD_PTR rva, PIMAGE_NT_HEADERS pNtHeader);
	void handleForwardedApi(DWORD_PTR vaStringPointer,char functionNameParent,DWORD_PTR rvaParent, WORD ordinalParent, ModuleInfo moduleParent);
	void parseModule(ModuleInfo *module);
	void parseModuleWithProcess(ModuleInfo * module);

	void parseExportTable(ModuleInfo *module, PIMAGE_NT_HEADERS pNtHeader, PIMAGE_EXPORT_DIRECTORY pExportDir, DWORD_PTR deltaAddress);

	ModuleInfo * findModuleByName(WCHAR *name);

	void findApiByModuleAndOrdinal(ModuleInfo * module, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi);
	void findApiByModuleAndName(ModuleInfo * module, char * searchFunctionName, DWORD_PTR * vaApi, DWORD_PTR * rvaApi);
	void findApiByModule(ModuleInfo * module, char * searchFunctionName, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi);

	bool isModuleLoadedInOwnProcess( ModuleInfo * module );
	void parseModuleWithOwnProcess( ModuleInfo * module );
	bool isPeAndExportTableValid(PIMAGE_NT_HEADERS pNtHeader);
	void findApiInProcess( ModuleInfo * module, char * searchFunctionName, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi );
	bool findApiInExportTable(ModuleInfo module, PIMAGE_EXPORT_DIRECTORY pExportDir, DWORD_PTR deltaAddress, char searchFunctionName, WORD ordinal, DWORD_PTR * vaApi, DWORD_PTR * rvaApi);

	BYTE * getHeaderFromProcess(ModuleInfo * module);
	BYTE * getExportTableFromProcess(ModuleInfo * module, PIMAGE_NT_HEADERS pNtHeader);

	void setModulePriority(ModuleInfo * module);
	void setMinMaxApiAddress(DWORD_PTR virtualAddress);

	void parseModuleWithMapping(ModuleInfo *moduleInfo); //not used

	bool addModuleToModuleList(const WCHAR * moduleName, DWORD_PTR firstThunk);
	bool addFunctionToModuleList(ApiInfo * apiFound, DWORD_PTR va, DWORD_PTR rva, WORD ordinal, bool valid, bool suspect);
	bool addNotFoundApiToModuleList(DWORD_PTR iatAddressVA, DWORD_PTR apiAddress);

	void addUnknownModuleToModuleList(DWORD_PTR firstThunk);
	bool isApiBlacklisted( const char * functionName );
	bool isWinSxSModule( ModuleInfo * module );

	ApiInfo * getScoredApi(stdext::hash_map<DWORD_PTR, ApiInfo *>::iterator it1,size_t countDuplicates, bool hasName, bool hasUnicodeAnsiName, bool hasNoUnderlineInName, bool hasPrioDll,bool hasPrio0Dll,bool hasPrio1Dll, bool hasPrio2Dll, bool firstWin );

	};
	diff --git a/Scylla/ConfigurationHolder.cpp b/Scylla/ConfigurationHolder.cpp
	index ca0a579..0fff4a4 100644
	--- a/Scylla/ConfigurationHolder.cpp
	+++ b/Scylla/ConfigurationHolder.cpp
	@@ -1,207 +1,209 @@
	#include "ConfigurationHolder.h"

	#include <shlwapi.h>
	#include "Architecture.h"

	const WCHAR ConfigurationHolder::CONFIG_FILE_SECTION_NAME[] = L"SCYLLA_CONFIG";

	//#define DEBUG_COMMENTS

	ConfigurationHolder::ConfigurationHolder(const WCHAR* fileName)
	{
	config[USE_PE_HEADER_FROM_DISK] = Configuration(L"USE_PE_HEADER_FROM_DISK", Configuration::Boolean);
	config[DEBUG_PRIVILEGE] = Configuration(L"DEBUG_PRIVILEGE", Configuration::Boolean);
	config[CREATE_BACKUP] = Configuration(L"CREATE_BACKUP", Configuration::Boolean);
	config[DLL_INJECTION_AUTO_UNLOAD] = Configuration(L"DLL_INJECTION_AUTO_UNLOAD", Configuration::Boolean);
	config[UPDATE_HEADER_CHECKSUM] = Configuration(L"UPDATE_HEADER_CHECKSUM", Configuration::Boolean);
	config[IAT_SECTION_NAME] = Configuration(L"IAT_SECTION_NAME", Configuration::String);
	config[REMOVE_DOS_HEADER_STUB] = Configuration(L"REMOVE_DOS_HEADER_STUB", Configuration::Boolean);
	config[IAT_FIX_AND_OEP_FIX] = Configuration(L"IAT_FIX_AND_OEP_FIX", Configuration::Boolean);
	config[SUSPEND_PROCESS_FOR_DUMPING] = Configuration(L"SUSPEND_PROCESS_FOR_DUMPING", Configuration::Boolean);
	config[OriginalFirstThunk_SUPPORT] = Configuration(L"OriginalFirstThunk_SUPPORT", Configuration::Boolean);
	config[USE_ADVANCED_IAT_SEARCH] = Configuration(L"USE_ADVANCED_IAT_SEARCH", Configuration::Boolean);
	config[SCAN_DIRECT_IMPORTS] = Configuration(L"SCAN_DIRECT_IMPORTS", Configuration::Boolean);
	config[FIX_DIRECT_IMPORTS_NORMAL] = Configuration(L"FIX_DIRECT_IMPORTS_NORMAL", Configuration::Boolean);
	config[FIX_DIRECT_IMPORTS_UNIVERSAL] = Configuration(L"FIX_DIRECT_IMPORTS_UNIVERSAL", Configuration::Boolean);
	- config[CREATE_NEW_IAT_IN_SECTION] = Configuration(L"CREATE_NEW_IAT_IN_SECTION", Configuration::Boolean);
	+ config[CREATE_NEW_IAT_IN_SECTION] = Configuration(L"CREATE_NEW_IAT_IN_SECTION", Configuration::Boolean);
	+ config[DONT_CREATE_NEW_SECTION] = Configuration(L"DONT_CREATE_NEW_SECTION", Configuration::Boolean);
	+ config[APIS_ALWAYS_FROM_DISK] = Configuration(L"APIS_ALWAYS_FROM_DISK", Configuration::Boolean);
	buildConfigFilePath(fileName);
	}

	bool ConfigurationHolder::loadConfiguration()
	{
	std::map<ConfigOption, Configuration>::iterator mapIter;

	if (configPath[0] == '\0')
	{
	return false;
	}

	for (mapIter = config.begin() ; mapIter != config.end(); mapIter++)
	{
	Configuration& configObject = mapIter->second;
	loadConfig(configObject);
	}

	return true;
	}

	bool ConfigurationHolder::saveConfiguration() const
	{
	std::map<ConfigOption, Configuration>::const_iterator mapIter;

	if (configPath[0] == '\0')
	{
	return false;
	}

	for (mapIter = config.begin() ; mapIter != config.end(); mapIter++)
	{
	const Configuration& configObject = mapIter->second;
	if (!saveConfig(configObject))
	{
	return false;
	}
	}

	return true;
	}

	Configuration& ConfigurationHolder::operator[](ConfigOption option)
	{
	return config[option];
	}

	const Configuration& ConfigurationHolder::operator[](ConfigOption option) const
	{
	static const Configuration dummy;

	std::map<ConfigOption, Configuration>::const_iterator found = config.find(option);
	if(found != config.end())
	{
	return found->second;
	}
	else
	{
	return dummy;
	}
	}

	bool ConfigurationHolder::saveNumericToConfigFile(const Configuration & configObject, int nBase) const
	{
	WCHAR buf[21]; // UINT64_MAX in dec has 20 digits

	if (nBase == 16)
	{
	swprintf_s(buf, PRINTF_DWORD_PTR_FULL, configObject.getNumeric());
	}
	else
	{
	swprintf_s(buf, PRINTF_INTEGER, configObject.getNumeric());
	}

	BOOL ret = WritePrivateProfileString(CONFIG_FILE_SECTION_NAME, configObject.getName(), buf, configPath);
	return !!ret;
	}

	bool ConfigurationHolder::readNumericFromConfigFile(Configuration & configObject, int nBase)
	{
	WCHAR buf[21]; // UINT64_MAX in dec has 20 digits
	DWORD read = GetPrivateProfileString(CONFIG_FILE_SECTION_NAME, configObject.getName(), L"", buf, _countof(buf), configPath);

	if (read > 0 && wcslen(buf) > 0)
	{
	#ifdef _WIN64
	configObject.setNumeric(_wcstoui64(buf, NULL, nBase));
	#else
	configObject.setNumeric(wcstoul(buf, NULL, nBase));
	#endif
	return true;
	}

	return false;
	}

	bool ConfigurationHolder::saveStringToConfigFile(const Configuration & configObject) const
	{
	BOOL ret = WritePrivateProfileString(CONFIG_FILE_SECTION_NAME, configObject.getName(), configObject.getString(), configPath);
	return !!ret;
	}

	bool ConfigurationHolder::readStringFromConfigFile(Configuration & configObject)
	{
	WCHAR buf[Configuration::CONFIG_STRING_LENGTH];
	DWORD read = GetPrivateProfileString(CONFIG_FILE_SECTION_NAME, configObject.getName(), L"", buf, _countof(buf), configPath);
	if(read > 0 && wcslen(buf) > 0)
	{
	configObject.setString(buf);
	return true;
	}

	return false;
	}

	bool ConfigurationHolder::readBooleanFromConfigFile(Configuration & configObject)
	{
	UINT val = GetPrivateProfileInt(CONFIG_FILE_SECTION_NAME, configObject.getName(), 0, configPath);
	configObject.setBool(val != 0);
	return true;
	}

	bool ConfigurationHolder::saveBooleanToConfigFile(const Configuration & configObject) const
	{
	const WCHAR *boolValue = configObject.isTrue() ? L"1" : L"0";
	BOOL ret = WritePrivateProfileString(CONFIG_FILE_SECTION_NAME, configObject.getName(), boolValue, configPath);
	return !!ret;
	}

	bool ConfigurationHolder::loadConfig(Configuration & configObject)
	{
	switch (configObject.getType())
	{
	case Configuration::String:
	return readStringFromConfigFile(configObject);
	case Configuration::Boolean:
	return readBooleanFromConfigFile(configObject);
	case Configuration::Decimal:
	return readNumericFromConfigFile(configObject, 10);
	case Configuration::Hexadecimal:
	return readNumericFromConfigFile(configObject, 16);
	default:
	return false;
	}
	}

	bool ConfigurationHolder::saveConfig(const Configuration & configObject) const
	{
	switch (configObject.getType())
	{
	case Configuration::String:
	return saveStringToConfigFile(configObject);
	case Configuration::Boolean:
	return saveBooleanToConfigFile(configObject);
	case Configuration::Decimal:
	return saveNumericToConfigFile(configObject, 10);
	case Configuration::Hexadecimal:
	return saveNumericToConfigFile(configObject, 16);
	default:
	return false;
	}
	}

	bool ConfigurationHolder::buildConfigFilePath(const WCHAR* fileName)
	{
	ZeroMemory(configPath, sizeof(configPath));

	if (!GetModuleFileName(0, configPath, _countof(configPath)))
	{
	#ifdef DEBUG_COMMENTS
	Scylla::debugLog.log(L"buildConfigFilePath :: GetModuleFileName failed %d", GetLastError());
	#endif
	return false;
	}

	PathRemoveFileSpec(configPath);
	PathAppend(configPath, fileName);

	return true;
	}
	diff --git a/Scylla/ConfigurationHolder.h b/Scylla/ConfigurationHolder.h
	index 8d9149c..a76c074 100644
	--- a/Scylla/ConfigurationHolder.h
	+++ b/Scylla/ConfigurationHolder.h
	@@ -1,57 +1,59 @@
	#pragma once

	#include <windows.h>
	#include <map>
	#include "Configuration.h"

	enum ConfigOption
	{
	USE_PE_HEADER_FROM_DISK,
	DEBUG_PRIVILEGE,
	CREATE_BACKUP,
	DLL_INJECTION_AUTO_UNLOAD,
	IAT_SECTION_NAME,
	UPDATE_HEADER_CHECKSUM,
	REMOVE_DOS_HEADER_STUB,
	IAT_FIX_AND_OEP_FIX,
	SUSPEND_PROCESS_FOR_DUMPING,
	OriginalFirstThunk_SUPPORT,
	USE_ADVANCED_IAT_SEARCH,
	SCAN_DIRECT_IMPORTS,
	FIX_DIRECT_IMPORTS_NORMAL,
	FIX_DIRECT_IMPORTS_UNIVERSAL,
	- CREATE_NEW_IAT_IN_SECTION
	+ CREATE_NEW_IAT_IN_SECTION,
	+ DONT_CREATE_NEW_SECTION,
	+ APIS_ALWAYS_FROM_DISK
	};

	class ConfigurationHolder
	{
	public:

	ConfigurationHolder(const WCHAR* fileName);

	bool loadConfiguration();
	bool saveConfiguration() const;

	Configuration& operator[](ConfigOption option);
	const Configuration& operator[](ConfigOption option) const;

	private:

	static const WCHAR CONFIG_FILE_SECTION_NAME[];

	WCHAR configPath[MAX_PATH];
	std::map<ConfigOption, Configuration> config;

	bool buildConfigFilePath(const WCHAR* fileName);

	bool readStringFromConfigFile(Configuration & configObject);
	bool readBooleanFromConfigFile(Configuration & configObject);
	bool readNumericFromConfigFile(Configuration & configObject, int nBase);

	bool saveStringToConfigFile(const Configuration & configObject) const;
	bool saveBooleanToConfigFile(const Configuration & configObject) const;
	bool saveNumericToConfigFile(const Configuration & configObject, int nBase) const;

	bool loadConfig(Configuration & configObject);
	bool saveConfig(const Configuration & configObject) const;
	};
	diff --git a/Scylla/MainGui.rc b/Scylla/MainGui.rc
	index b219452..7fd62dd 100644
	Binary files a/Scylla/MainGui.rc and b/Scylla/MainGui.rc differ
	diff --git a/Scylla/OptionsGui.cpp b/Scylla/OptionsGui.cpp
	index 51840ac..ab2f2e7 100644
	--- a/Scylla/OptionsGui.cpp
	+++ b/Scylla/OptionsGui.cpp
	@@ -1,68 +1,72 @@
	#include "OptionsGui.h"
	#include "Scylla.h"

	BOOL OptionsGui::OnInitDialog(CWindow wndFocus, LPARAM lInitParam)
	{
	loadOptions();
	DoDataExchange(DDX_LOAD); // show settings

	EditSectionName.LimitText(IMAGE_SIZEOF_SHORT_NAME);

	CenterWindow();

	return TRUE;
	}

	void OptionsGui::OnOK(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	DoDataExchange(DDX_SAVE);
	saveOptions();
	Scylla::config.saveConfiguration();

	EndDialog(0);
	}

	void OptionsGui::OnCancel(UINT uNotifyCode, int nID, CWindow wndCtl)
	{
	EndDialog(0);
	}

	void OptionsGui::saveOptions() const
	{
	Scylla::config[USE_PE_HEADER_FROM_DISK].setBool(usePEHeaderFromDisk);
	Scylla::config[DEBUG_PRIVILEGE].setBool(debugPrivilege);
	Scylla::config[CREATE_BACKUP].setBool(createBackup);
	Scylla::config[DLL_INJECTION_AUTO_UNLOAD].setBool(dllInjectionAutoUnload);
	Scylla::config[UPDATE_HEADER_CHECKSUM].setBool(updateHeaderChecksum);
	Scylla::config[IAT_SECTION_NAME].setString(iatSectionName);
	Scylla::config[REMOVE_DOS_HEADER_STUB].setBool(removeDosHeaderStub);
	Scylla::config[IAT_FIX_AND_OEP_FIX].setBool(fixIatAndOep);
	Scylla::config[SUSPEND_PROCESS_FOR_DUMPING].setBool(suspendProcessForDumping);
	Scylla::config[OriginalFirstThunk_SUPPORT].setBool(oftSupport);
	Scylla::config[USE_ADVANCED_IAT_SEARCH].setBool(useAdvancedIatSearch);
	Scylla::config[SCAN_DIRECT_IMPORTS].setBool(scanDirectImports);
	Scylla::config[FIX_DIRECT_IMPORTS_NORMAL].setBool(fixDirectImportsNormal);
	Scylla::config[FIX_DIRECT_IMPORTS_UNIVERSAL].setBool(fixDirectImportsUniversal);
	Scylla::config[CREATE_NEW_IAT_IN_SECTION].setBool(createNewIatInSection);
	+ Scylla::config[DONT_CREATE_NEW_SECTION].setBool(dontCreateNewSection);
	+ Scylla::config[APIS_ALWAYS_FROM_DISK].setBool(readApisAlwaysFromDisk);
	}

	void OptionsGui::loadOptions()
	{
	usePEHeaderFromDisk = Scylla::config[USE_PE_HEADER_FROM_DISK].getBool();
	debugPrivilege = Scylla::config[DEBUG_PRIVILEGE].getBool();
	createBackup = Scylla::config[CREATE_BACKUP].getBool();
	dllInjectionAutoUnload = Scylla::config[DLL_INJECTION_AUTO_UNLOAD].getBool();
	updateHeaderChecksum = Scylla::config[UPDATE_HEADER_CHECKSUM].getBool();
	wcsncpy_s(iatSectionName, Scylla::config[IAT_SECTION_NAME].getString(), _countof(iatSectionName)-1);
	iatSectionName[_countof(iatSectionName) - 1] = L'\0';

	removeDosHeaderStub = Scylla::config[REMOVE_DOS_HEADER_STUB].getBool();
	fixIatAndOep = Scylla::config[IAT_FIX_AND_OEP_FIX].getBool();
	suspendProcessForDumping = Scylla::config[SUSPEND_PROCESS_FOR_DUMPING].getBool();
	oftSupport = Scylla::config[OriginalFirstThunk_SUPPORT].getBool();
	useAdvancedIatSearch = Scylla::config[USE_ADVANCED_IAT_SEARCH].getBool();
	scanDirectImports = Scylla::config[SCAN_DIRECT_IMPORTS].getBool();
	fixDirectImportsNormal = Scylla::config[FIX_DIRECT_IMPORTS_NORMAL].getBool();
	fixDirectImportsUniversal = Scylla::config[FIX_DIRECT_IMPORTS_UNIVERSAL].getBool();
	createNewIatInSection = Scylla::config[CREATE_NEW_IAT_IN_SECTION].getBool();
	+ dontCreateNewSection = Scylla::config[DONT_CREATE_NEW_SECTION].getBool();
	+ readApisAlwaysFromDisk = Scylla::config[APIS_ALWAYS_FROM_DISK].getBool();
	}
	diff --git a/Scylla/OptionsGui.h b/Scylla/OptionsGui.h
	index ba469aa..654654e 100644
	--- a/Scylla/OptionsGui.h
	+++ b/Scylla/OptionsGui.h
	@@ -1,80 +1,84 @@
	#pragma once

	#include <windows.h>
	#include "resource.h"

	// WTL
	#include <atlbase.h> // base ATL classes
	#include <atlapp.h> // base WTL classes
	#include <atlwin.h> // ATL GUI classes
	#include <atlcrack.h> // WTL enhanced msg map macros
	#include <atlctrls.h> // WTL controls
	#include <atlddx.h> // WTL dialog data exchange

	class OptionsGui : public CDialogImpl<OptionsGui>, public CWinDataExchange<OptionsGui>
	{
	public:
	enum { IDD = IDD_DLG_OPTIONS };

	BEGIN_DDX_MAP(OptionsGui)
	DDX_CONTROL_HANDLE(IDC_OPTIONS_SECTIONNAME, EditSectionName)
	DDX_TEXT(IDC_OPTIONS_SECTIONNAME, iatSectionName)
	DDX_CHECK(IDC_CHECK_HEADER_CHECKSUM, updateHeaderChecksum)
	DDX_CHECK(IDC_CHECK_CREATE_BACKUP, createBackup)
	DDX_CHECK(IDC_CHECK_UNLOAD_DLL, dllInjectionAutoUnload)
	DDX_CHECK(IDC_CHECK_PE_HEADER_FROM_DISK, usePEHeaderFromDisk)
	DDX_CHECK(IDC_CHECK_DEBUG_PRIVILEGES, debugPrivilege)
	DDX_CHECK(IDC_CHECK_REMOVE_DOS_STUB, removeDosHeaderStub)
	DDX_CHECK(IDC_CHECK_FIX_IAT_AND_OEP, fixIatAndOep)
	DDX_CHECK(IDC_CHECK_SUSPEND_PROCESS, suspendProcessForDumping)
	DDX_CHECK(IDC_CHECKOFTSUPPORT, oftSupport)
	DDX_CHECK(IDC_CHECK_USEADVANCEDIATSEARCH, useAdvancedIatSearch)
	DDX_CHECK(IDC_SCANDIRECTIMPORT, scanDirectImports)
	DDX_CHECK(IDC_FIXDIRECTIMPORTSNORMAL, fixDirectImportsNormal)
	DDX_CHECK(IDC_FIXDIRECTIMPORTSUNIVERSAL, fixDirectImportsUniversal)
	DDX_CHECK(IDC_NEWIATINSECTION, createNewIatInSection)
	+ DDX_CHECK(IDC_CHECKNOSECTION, dontCreateNewSection)
	+ DDX_CHECK(IDC_CHECKAPIALWAYSDISK, readApisAlwaysFromDisk)
	END_DDX_MAP()

	BEGIN_MSG_MAP(OptionsGui)
	MSG_WM_INITDIALOG(OnInitDialog)

	COMMAND_ID_HANDLER_EX(IDC_BTN_OPTIONS_OK, OnOK)
	COMMAND_ID_HANDLER_EX(IDC_BTN_OPTIONS_CANCEL, OnCancel)
	COMMAND_ID_HANDLER_EX(IDCANCEL, OnCancel)
	END_MSG_MAP()

	protected:

	// Settings (filled by DDX)

	WCHAR iatSectionName[IMAGE_SIZEOF_SHORT_NAME+1];
	bool updateHeaderChecksum;
	bool createBackup;
	bool dllInjectionAutoUnload;
	bool usePEHeaderFromDisk;
	bool debugPrivilege;
	bool removeDosHeaderStub;
	bool fixIatAndOep;
	bool suspendProcessForDumping;
	bool oftSupport;
	bool useAdvancedIatSearch;
	bool scanDirectImports;
	bool fixDirectImportsNormal;
	bool fixDirectImportsUniversal;
	bool createNewIatInSection;
	+ bool dontCreateNewSection;
	+ bool readApisAlwaysFromDisk;
	// Controls

	CEdit EditSectionName;

	// Message handlers

	BOOL OnInitDialog(CWindow wndFocus, LPARAM lInitParam);

	void OnOK(UINT uNotifyCode, int nID, CWindow wndCtl);
	void OnCancel(UINT uNotifyCode, int nID, CWindow wndCtl);

	// Gui helpers

	void saveOptions() const;
	void loadOptions();
	};
	diff --git a/Scylla/resource.h b/Scylla/resource.h
	index 1d0a826..e876e99 100644
	Binary files a/Scylla/resource.h and b/Scylla/resource.h differ

File Metadata

Mime Type: text/x-diff
Expires: Thu, May 8, 10:51 PM (1 d, 2 h)
Storage Engine: local-disk
Storage Format: Raw Data
Storage Handle: b8/08/140473512eae2c15af9fc5c79bb4

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions