diff --git a/Scylla/TreeImportExport.cpp b/Scylla/TreeImportExport.cpp new file mode 100644 index 0000000..9b49148 --- /dev/null +++ b/Scylla/TreeImportExport.cpp @@ -0,0 +1,157 @@ + +#include "TreeImportExport.h" +#include "definitions.h" + +bool TreeImportExport::exportTreeList(const WCHAR * targetXmlFile, std::map & moduleList, const Process * process, const DWORD_PTR addressOEP, const DWORD_PTR addressIAT, const DWORD sizeIAT) +{ + TiXmlDocument doc; + + TiXmlDeclaration * decl = new TiXmlDeclaration( "1.0", "", "" ); + doc.LinkEndChild(decl); + + TiXmlElement * rootElement = new TiXmlElement("target"); + + setTargetInformation(rootElement, process,addressOEP,addressIAT,sizeIAT); + + addModuleListToRootElement(rootElement, moduleList); + + doc.LinkEndChild(rootElement); + + return saveXmlToFile(doc,targetXmlFile); +} + +void TreeImportExport::setTargetInformation(TiXmlElement * rootElement, const Process * process, const DWORD_PTR addressOEP, const DWORD_PTR addressIAT, const DWORD sizeIAT) +{ + size_t stringLength = 0; + + wcstombs_s(&stringLength, xmlStringBuffer, (size_t)_countof(xmlStringBuffer), process->filename, (size_t)_countof(process->filename)); + + + rootElement->SetAttribute("filename", xmlStringBuffer); + + DwordPtrToString(addressOEP); + rootElement->SetAttribute("oep_va",xmlStringBuffer); + + DwordPtrToString(addressIAT); + rootElement->SetAttribute("iat_va",xmlStringBuffer); + + DwordPtrToString(sizeIAT); + rootElement->SetAttribute("iat_size",xmlStringBuffer); +} + +bool TreeImportExport::saveXmlToFile(TiXmlDocument doc, const WCHAR * xmlFilePath) +{ + FILE * pFile = 0; + + if (_wfopen_s(&pFile,xmlFilePath,L"w") == NULL) + { + doc.Print(pFile); + fclose (pFile); + return true; + } + else + { + return false; + } +} + +void TreeImportExport::addModuleListToRootElement( TiXmlElement * rootElement, std::map & moduleList ) +{ + std::map::iterator mapIt; + std::map::iterator mapIt2; + ImportModuleThunk * importModuleThunk = 0; + ImportThunk * importThunk = 0; + + TiXmlElement * moduleElement; + TiXmlElement * importElement; + + for ( mapIt = moduleList.begin() ; mapIt != moduleList.end(); mapIt++ ) + { + importModuleThunk = &((*mapIt).second); + + moduleElement = getModuleXmlElement(importModuleThunk); + + for ( mapIt2 = (*mapIt).second.thunkList.begin() ; mapIt2 != (*mapIt).second.thunkList.end(); mapIt2++ ) + { + importThunk = &((*mapIt2).second); + + importElement = getImportXmlElement(importThunk); + moduleElement->LinkEndChild(importElement); + } + + rootElement->LinkEndChild(moduleElement); + } +} + +TiXmlElement * TreeImportExport::getModuleXmlElement(const ImportModuleThunk * importModuleThunk) +{ + size_t stringLength = 0; + TiXmlElement * moduleElement = new TiXmlElement("module"); + + wcstombs_s(&stringLength, xmlStringBuffer, (size_t)_countof(xmlStringBuffer), importModuleThunk->moduleName, (size_t)_countof(importModuleThunk->moduleName)); + + moduleElement->SetAttribute("filename", xmlStringBuffer); + + DwordPtrToString(importModuleThunk->getFirstThunk()); + moduleElement->SetAttribute("first_thunk_rva",xmlStringBuffer); + + return moduleElement; +} + +TiXmlElement * TreeImportExport::getImportXmlElement(const ImportThunk * importThunk) +{ + TiXmlElement * importElement = 0; + + if (importThunk->valid) + { + importElement = new TiXmlElement("import_valid"); + + if(importThunk->name[0] != '\0') + { + importElement->SetAttribute("name",importThunk->name); + } + + WordToString(importThunk->ordinal); + importElement->SetAttribute("ordinal",xmlStringBuffer); + + WordToString(importThunk->hint); + importElement->SetAttribute("hint",xmlStringBuffer); + + boolToString(importThunk->suspect); + importElement->SetAttribute("suspect", xmlStringBuffer); + } + else + { + importElement = new TiXmlElement("import_invalid"); + } + + DwordPtrToString(importThunk->rva); + importElement->SetAttribute("iat_rva", xmlStringBuffer); + + DwordPtrToString(importThunk->apiAddressVA); + importElement->SetAttribute("address_va",xmlStringBuffer); + + return importElement; +} + +void TreeImportExport::boolToString(const bool boolValue) +{ + if (boolValue) + { + strcpy_s(xmlStringBuffer,_countof(xmlStringBuffer),"1"); + } + else + { + strcpy_s(xmlStringBuffer,_countof(xmlStringBuffer),"0"); + } +} + +void TreeImportExport::DwordPtrToString(const DWORD_PTR dwValue) +{ + sprintf_s(xmlStringBuffer, _countof(xmlStringBuffer), PRINTF_DWORD_PTR_FULL, dwValue); +} + +void TreeImportExport::WordToString(const WORD dwValue) +{ + sprintf_s(xmlStringBuffer, _countof(xmlStringBuffer), "%04X", dwValue); +} \ No newline at end of file diff --git a/Scylla/TreeImportExport.h b/Scylla/TreeImportExport.h new file mode 100644 index 0000000..d1c6a16 --- /dev/null +++ b/Scylla/TreeImportExport.h @@ -0,0 +1,27 @@ + +#pragma once + +#include +#include "ProcessLister.h" +#include "Thunks.h" +#include "tinyxml.h" + +class TreeImportExport +{ +public: + bool exportTreeList(const WCHAR * targetXmlFile, std::map & moduleList, const Process * process, const DWORD_PTR addressOEP, const DWORD_PTR addressIAT, const DWORD sizeIAT); + +private: + + char xmlStringBuffer[100]; + + void addModuleListToRootElement( TiXmlElement * rootElement, std::map & moduleList ); + TiXmlElement * getModuleXmlElement(const ImportModuleThunk * importModuleThunk); + TiXmlElement * getImportXmlElement(const ImportThunk * importThunk); + bool saveXmlToFile(TiXmlDocument doc, const WCHAR * xmlFilePath); + void setTargetInformation(TiXmlElement * rootElement, const Process * process, const DWORD_PTR addressOEP, const DWORD_PTR addressIAT, const DWORD sizeIAT); + + void boolToString(const bool boolValue); + void WordToString(const WORD dwValue); + void DwordPtrToString(const DWORD_PTR dwValue); +}; \ No newline at end of file diff --git a/tinyxml/tinyxml.sln b/tinyxml/tinyxml.sln new file mode 100644 index 0000000..f4bef1e --- /dev/null +++ b/tinyxml/tinyxml.sln @@ -0,0 +1,26 @@ + +Microsoft Visual Studio Solution File, Format Version 11.00 +# Visual Studio 2010 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "tinyxml", "tinyxml_lib.vcxproj", "{C406DAEC-0886-4771-8DEA-9D7329B46CC1}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Debug|x64 = Debug|x64 + Release|Win32 = Release|Win32 + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {C406DAEC-0886-4771-8DEA-9D7329B46CC1}.Debug|Win32.ActiveCfg = Debug|Win32 + {C406DAEC-0886-4771-8DEA-9D7329B46CC1}.Debug|Win32.Build.0 = Debug|Win32 + {C406DAEC-0886-4771-8DEA-9D7329B46CC1}.Debug|x64.ActiveCfg = Debug|x64 + {C406DAEC-0886-4771-8DEA-9D7329B46CC1}.Debug|x64.Build.0 = Debug|x64 + {C406DAEC-0886-4771-8DEA-9D7329B46CC1}.Release|Win32.ActiveCfg = Release|Win32 + {C406DAEC-0886-4771-8DEA-9D7329B46CC1}.Release|Win32.Build.0 = Release|Win32 + {C406DAEC-0886-4771-8DEA-9D7329B46CC1}.Release|x64.ActiveCfg = Release|x64 + {C406DAEC-0886-4771-8DEA-9D7329B46CC1}.Release|x64.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/tinyxml/tinyxml_lib.vcxproj b/tinyxml/tinyxml_lib.vcxproj new file mode 100644 index 0000000..daf443a --- /dev/null +++ b/tinyxml/tinyxml_lib.vcxproj @@ -0,0 +1,212 @@ + + + + + Debug + Win32 + + + Debug + x64 + + + Release + Win32 + + + Release + x64 + + + + tinyxml + {C406DAEC-0886-4771-8DEA-9D7329B46CC1} + + + + StaticLibrary + false + MultiByte + + + StaticLibrary + false + MultiByte + + + StaticLibrary + false + MultiByte + + + StaticLibrary + false + MultiByte + + + + + + + + + + + + + + + + + + + + + + + <_ProjectFileVersion>10.0.30319.1 + $(IncludePath) + $(IncludePath) + $(LibraryPath) + $(LibraryPath) + $(IncludePath) + $(IncludePath) + $(LibraryPath) + $(LibraryPath) + $(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\ + $(SolutionDir)$(Platform)\$(Configuration)\ + $(SolutionDir)$(Platform)\$(Configuration)\ + $(SolutionDir)$(Platform)\$(Configuration)\ + $(SolutionDir)$(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\ + + + + MaxSpeed + OnlyExplicitInline + WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions) + true + MultiThreaded + true + Level3 + true + + + NDEBUG;%(PreprocessorDefinitions) + 0x0407 + + + true + + + true + + + + + MaxSpeed + OnlyExplicitInline + WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions) + true + MultiThreaded + true + Level3 + true + + + NDEBUG;%(PreprocessorDefinitions) + 0x0407 + + + true + + + true + + + + + Disabled + WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions) + true + EnableFastChecks + MultiThreadedDebug + true + Level4 + true + EditAndContinue + + + _DEBUG;%(PreprocessorDefinitions) + 0x0407 + + + true + + + true + + + + + Disabled + WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions) + EnableFastChecks + MultiThreadedDebug + true + Level4 + true + ProgramDatabase + + + _DEBUG;%(PreprocessorDefinitions) + 0x0407 + + + true + + + true + + + + + %(PreprocessorDefinitions) + %(PreprocessorDefinitions) + %(PreprocessorDefinitions) + %(PreprocessorDefinitions) + + + %(PreprocessorDefinitions) + %(PreprocessorDefinitions) + %(PreprocessorDefinitions) + %(PreprocessorDefinitions) + + + %(PreprocessorDefinitions) + %(PreprocessorDefinitions) + %(PreprocessorDefinitions) + %(PreprocessorDefinitions) + + + %(PreprocessorDefinitions) + %(PreprocessorDefinitions) + %(PreprocessorDefinitions) + %(PreprocessorDefinitions) + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/tinyxml/tinyxml_lib.vcxproj.user b/tinyxml/tinyxml_lib.vcxproj.user new file mode 100644 index 0000000..ace9a86 --- /dev/null +++ b/tinyxml/tinyxml_lib.vcxproj.user @@ -0,0 +1,3 @@ + + + \ No newline at end of file