diff --git a/ScyllaDllTest/ScyllaDllTest.sln b/ScyllaDllTest/ScyllaDllTest.sln new file mode 100644 index 0000000..a630aa5 --- /dev/null +++ b/ScyllaDllTest/ScyllaDllTest.sln @@ -0,0 +1,28 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio 2013 +VisualStudioVersion = 12.0.21005.1 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ScyllaDllTest", "ScyllaDllTest\ScyllaDllTest.vcxproj", "{D7886EB7-3C3B-4AA7-B983-DD85E72798DD}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ScyllaTestExe", "ScyllaTestExe\ScyllaTestExe.vcxproj", "{756E4AF7-342C-417F-86DC-3B2A78E782C9}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Release|Win32 = Release|Win32 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {D7886EB7-3C3B-4AA7-B983-DD85E72798DD}.Debug|Win32.ActiveCfg = Debug|Win32 + {D7886EB7-3C3B-4AA7-B983-DD85E72798DD}.Debug|Win32.Build.0 = Debug|Win32 + {D7886EB7-3C3B-4AA7-B983-DD85E72798DD}.Release|Win32.ActiveCfg = Release|Win32 + {D7886EB7-3C3B-4AA7-B983-DD85E72798DD}.Release|Win32.Build.0 = Release|Win32 + {756E4AF7-342C-417F-86DC-3B2A78E782C9}.Debug|Win32.ActiveCfg = Release|Win32 + {756E4AF7-342C-417F-86DC-3B2A78E782C9}.Debug|Win32.Build.0 = Release|Win32 + {756E4AF7-342C-417F-86DC-3B2A78E782C9}.Release|Win32.ActiveCfg = Release|Win32 + {756E4AF7-342C-417F-86DC-3B2A78E782C9}.Release|Win32.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/ScyllaDllTest/ScyllaDllTest/ScyllaDllTest.vcxproj b/ScyllaDllTest/ScyllaDllTest/ScyllaDllTest.vcxproj new file mode 100644 index 0000000..ecfbe50 --- /dev/null +++ b/ScyllaDllTest/ScyllaDllTest/ScyllaDllTest.vcxproj @@ -0,0 +1,84 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + + {D7886EB7-3C3B-4AA7-B983-DD85E72798DD} + Win32Proj + ScyllaDllTest + + + + Application + true + v120 + Unicode + + + Application + false + v120 + true + Unicode + + + + + + + + + + + + + true + + + false + + + + + + Level3 + Disabled + WIN32;_DEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) + + + Console + true + + + + + Level3 + + + MaxSpeed + true + true + WIN32;NDEBUG;_CONSOLE;_LIB;%(PreprocessorDefinitions) + + + Console + true + true + true + + + + + + + + + \ No newline at end of file diff --git a/ScyllaDllTest/ScyllaDllTest/Source.cpp b/ScyllaDllTest/ScyllaDllTest/Source.cpp new file mode 100644 index 0000000..1be4057 --- /dev/null +++ b/ScyllaDllTest/ScyllaDllTest/Source.cpp @@ -0,0 +1,118 @@ +#define _CRT_SECURE_NO_WARNINGS +#include +#include +#include +#include +#include + + +typedef const WCHAR * (WINAPI * def_ScyllaVersionInformationW)(); +typedef const char * (WINAPI * def_ScyllaVersionInformationA)(); +typedef DWORD (WINAPI * def_ScyllaVersionInformationDword)(); +typedef int (WINAPI * def_ScyllaIatSearch)(DWORD dwProcessId, DWORD_PTR * iatStart, DWORD * iatSize, DWORD_PTR searchStart, BOOL advancedSearch); +typedef int (WINAPI * def_ScyllaStartGui)(DWORD dwProcessId, HINSTANCE mod); + +def_ScyllaIatSearch ScyllaIatSearch = 0; +def_ScyllaStartGui ScyllaStartGui = 0; +def_ScyllaVersionInformationW ScyllaVersionInformationW = 0; +def_ScyllaVersionInformationA ScyllaVersionInformationA = 0; +def_ScyllaVersionInformationDword ScyllaVersionInformationDword = 0; + + +void testGui(); +void testIatSearch(); +DWORD_PTR GetExeModuleBase(DWORD dwProcessId); + + +STARTUPINFOW si = { 0 }; +PROCESS_INFORMATION pi = { 0 }; +WCHAR target[] = L"ScyllaTestExe.exe"; +HMODULE hScylla = 0; + +int main(int argc, char *argv[]) +{ +#ifdef _WIN64 + hScylla = LoadLibraryW(L"ScyllaDLLx64.dll"); +#else + hScylla = LoadLibraryW(L"ScyllaDLLx86.dll"); +#endif + + if (hScylla) + { + ScyllaIatSearch = (def_ScyllaIatSearch)GetProcAddress(hScylla, "ScyllaIatSearch"); + ScyllaStartGui = (def_ScyllaStartGui)GetProcAddress(hScylla, "ScyllaStartGui"); + + ScyllaVersionInformationW = (def_ScyllaVersionInformationW)GetProcAddress(hScylla, "ScyllaVersionInformationW"); + ScyllaVersionInformationA = (def_ScyllaVersionInformationA)GetProcAddress(hScylla, "ScyllaVersionInformationA"); + ScyllaVersionInformationDword = (def_ScyllaVersionInformationDword)GetProcAddress(hScylla, "ScyllaVersionInformationDword"); + + printf("Scylla DLL: %s - %08X\n", ScyllaVersionInformationA(), ScyllaVersionInformationDword()); + + testIatSearch(); + //testGui(); + } + + getchar(); + return 0; +} + +void testGui() +{ + printf("----------------\nGUI TEST\n----------------\n"); + + si.cb = sizeof(STARTUPINFOW); + + if (CreateProcessW(0, target, 0, 0, TRUE, 0, 0, 0, &si, &pi)) + { + Sleep(1000); + + + DWORD_PTR hMod = GetExeModuleBase(pi.dwProcessId); + printf("GetExeModuleBase %X\n", hMod); + + ScyllaStartGui(pi.dwProcessId, 0); + + TerminateProcess(pi.hProcess, 0); + CloseHandle(pi.hThread); + CloseHandle(pi.hProcess); + } +} + + +void testIatSearch() +{ + printf("----------------\nIAT Search Test\n----------------\n"); + + si.cb = sizeof(STARTUPINFOW); + + if (CreateProcessW(0, target, 0, 0, TRUE, 0, 0, 0, &si, &pi)) + { + Sleep(1000); + + DWORD_PTR iatStart = 0; + DWORD iatSize = 0; + + DWORD_PTR hMod = GetExeModuleBase(pi.dwProcessId); + printf("GetExeModuleBase %X\n", hMod); + + int error = ScyllaIatSearch(pi.dwProcessId, &iatStart, &iatSize, hMod + 0x00001028, FALSE); + + printf("error %d iatStart %X iatSize %X\n", error, iatStart, iatSize); + + TerminateProcess(pi.hProcess, 0); + CloseHandle(pi.hThread); + CloseHandle(pi.hProcess); + } +} + +DWORD_PTR GetExeModuleBase(DWORD dwProcessId) +{ + MODULEENTRY32 lpModuleEntry = { 0 }; + HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId); + lpModuleEntry.dwSize = sizeof(lpModuleEntry); + Module32First(hSnapShot, &lpModuleEntry); + + CloseHandle(hSnapShot); + + return (DWORD_PTR)lpModuleEntry.modBaseAddr; +} \ No newline at end of file diff --git a/ScyllaDllTest/ScyllaTestExe/ScyllaTestExe.vcxproj b/ScyllaDllTest/ScyllaTestExe/ScyllaTestExe.vcxproj new file mode 100644 index 0000000..463c01e --- /dev/null +++ b/ScyllaDllTest/ScyllaTestExe/ScyllaTestExe.vcxproj @@ -0,0 +1,86 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + + {756E4AF7-342C-417F-86DC-3B2A78E782C9} + Win32Proj + ScyllaTestExe + + + + Application + true + v120 + Unicode + + + Application + false + v120 + true + Unicode + + + + + + + + + + + + + true + + + false + false + + + + + + Level3 + Disabled + WIN32;_DEBUG;_WINDOWS;%(PreprocessorDefinitions) + + + Windows + true + + + + + Level3 + + + MaxSpeed + true + true + WIN32;NDEBUG;_WINDOWS;%(PreprocessorDefinitions) + MultiThreaded + + + Windows + false + true + true + + + + + + + + + \ No newline at end of file diff --git a/ScyllaDllTest/ScyllaTestExe/main.cpp b/ScyllaDllTest/ScyllaTestExe/main.cpp new file mode 100644 index 0000000..cfaf248 --- /dev/null +++ b/ScyllaDllTest/ScyllaTestExe/main.cpp @@ -0,0 +1,14 @@ +#include + + + +int CALLBACK WinMain( + _In_ HINSTANCE hInstance, + _In_ HINSTANCE hPrevInstance, + _In_ LPSTR lpCmdLine, + _In_ int nCmdShow + ) +{ + MessageBoxW(0, L"Test", L"Test", MB_OK); + return 0; +} \ No newline at end of file