// process_util.h : include utilities for manage folders // // Author: Gongbing // // Date: 2016-09-25 #pragma once #include #include #ifndef _INCLUDED_REF_ #define _INCLUDED_REF_ #include "../ref/ref.h" #endif #define STATUS_SUCCESS 0x00000000 #define STATUS_BUFFER_OVERFLOW 0x80000005 #define STATUS_INFO_LENGTH_MISMATCH 0xC0000004 // process utils namespace process_util { PORT_API(int) start_program(const wchar_t* prog_file, const wchar_t* param, bool show_wnd, DWORD* pid = NULL, bool as_admin = false, const wchar_t* path_dll = NULL); PORT_API(bool) is_me_in_admin(void); PORT_API(int) try_me_in_admin(bool show_wnd, DWORD *pid = NULL, const wchar_t* append_param = NULL); PORT_API(int) start_program_as_current_user(const wchar_t* prog_file, const wchar_t* param, bool show_wnd, unsigned* proc_id = NULL, bool merge_pe_2_param = true, const wchar_t* path_dll = NULL); PORT_API(bool) start_program_by_cmd(const wchar_t* prog_file, const wchar_t* param); PORT_API(bool) query_acting_user_token(HANDLE* aut); PORT_API(int) enable_privilege(const wchar_t* privilege_name, bool enabled); PORT_API(bool) kill_process_by_name(const wchar_t* proc_name, const wchar_t* taskkill_path = NULL); PORT_API(bool) is_process_living(const wchar_t* proc_name, DWORD* pid = NULL); // parameter of result: // data: (wchar_t*)pe_path_file // len: process id // total: parent process id PORT_API(void) enum_processes(inter_module_data::set_data result, void* param); // parameter of result: // data: (wchar_t*)module path file // len: base address // total: module size PORT_API(void) enum_modules(DWORD proc_id, inter_module_data::set_data result, void* param); PORT_API(bool) module_pe_from_run_address(void* addr, wchar_t path_name[MAX_PATH], void** base_addr = NULL); PORT_API(int) find_resource(HINSTANCE inst, const wchar_t* res_type, UINT res_id, inter_module_data::set_data result, void* param); PORT_API(bool) is_pe_checksum_ok(const wchar_t* pe_path_file, DWORD* lppe_chksum = NULL, DWORD* lpfile_chksum = NULL); PORT_API(bool) get_module_info(HMODULE module, void** base, void** entry, size_t* size); PORT_API(bool) get_process_time(DWORD proc_id, LPFILETIME start = NULL, LPFILETIME kern = NULL, LPFILETIME user = NULL); PORT_API(DWORD) get_parent_process(DWORD proc_id); PORT_API(int) get_process_name(DWORD proc_id, wchar_t path_name[MAX_PATH]); PORT_API(int) get_self_pathname(wchar_t path_name[MAX_PATH], bool call_module = false/*default to get exe pathname*/); PORT_API(void) quit_and_delete_self(void); PORT_API(char*) set_command_lineA(char* cmda); // the return buffer need not free PORT_API(wchar_t*) set_command_lineW(wchar_t* cmda, bool is_setpeb); // the return buffer need not free PORT_API(void) set_peb_command_lineW(wchar_t* cmda); PORT_API(HANDLE) get_file_handle_by_name(const wchar_t* filename, ULONG *pid = NULL); PORT_API(BOOL) is_wow64_process(DWORD proc_id); PORT_API(HMODULE) load_system_dll(const wchar_t* dll); PORT_API(void*) write_to_process(HANDLE proc, const void* src, int bytes); PORT_API(void*) write_to_process(DWORD proc_id, const void* src, int bytes); PORT_API(int) read_process_memory(DWORD proc_id, void* base_addr, int read_bytes, unsigned char* buf); // read proc_id [base_addr, base_addr] contents into buf, return error code, 0 is success // function: create a remote thread in given process // proc_id: the target process ID // code_bytes: remote thread code size in bytes // susbend: whether to supspend this thread when create it // parameter_size: remote thread parameter size // tid: to receive the remote thread id // thread: to receive the remote thread handle // fill: to fill the thread code and parameter in this callback // data: unused, always be NULL // len: (LPVOID), the memory address in process proc_id // total: (unsigned char*), to receive the content // flag: write code when DATA_FLAG_REMOTE_THREAD_INSTRUCT, or parameter when DATA_FLAG_REMOTE_THREAD_PARAMETER if parameter_bytes was great than ZERO // param: the same as 'param' // param: parameter 'param' of callback fill // return: error code, 0 is success PORT_API(int) create_remote_thread(DWORD proc_id, int code_bytes, inter_module_data::set_data fill, void* param, bool suspend = false , int parameter_bytes = 0, DWORD* tid = NULL, HANDLE* thread = NULL); // code and param: [in] - the source code or parameter buffer; [out] - remote code or parameter buffer PORT_API(int) create_remote_thread(DWORD proc_id, const unsigned char **code, int code_bytes, bool suspend = false , const unsigned char** param = NULL, int param_bytes = 0, DWORD* tid = NULL, HANDLE* thread = NULL); PORT_API(bool) get_api_in_process(DWORD proc_id, const wchar_t* dll, const char* apis/*GetTickCount\0CreateFileW\0\0*/, FARPROC* api_addrs/*length as same as apis*/); PORT_API(HMODULE) load_dll_in_process(DWORD proc_id, const wchar_t* path_dll); // return the loaded dll handle in the process PORT_API(HMODULE) free_dll_in_process(DWORD proc_id, const wchar_t* path_dll); // return the dll in the process enum _inst_statu { INST_STATU_FIRST = 0, // 0 - I am the FIRST instance INST_STATU_FAILED_CREATE, // 1 - no instance existing and failed to create the singleton instance INST_STATU_INFO_FIRST, // 2 - an instance is already existing and informed my parameter INST_STATU_FAILED_INFO_FIRST, // 3 - an instance is already existing and failed in informing my parameter INST_STATU_ID_USED, // 4 - the name is used by other object INST_STATU_UNKNOWN = 10, // unknown error }; __declspec(novtable) struct ISingleton : public ref_util::IRef { COM_API_DECLARE(_inst_statu, statu(void)); COM_API_DECLARE(bool, set_max_run_seconds(DWORD seconds = -1)); // quit after seconds when not -1 }; __declspec(novtable) struct ICmd : public ref_util::IRef { COM_API_DECLARE(void, reset(const wchar_t* cmdline = NULL)); // reset command line string, use GetCommandLineW if cmd_line was NULL COM_API_DECLARE(long, count(void)); // return parameter count, if has key-val pair, then count them as 2 // function: whether the command line has 'param' // case_sens: is case sensitive // ind: to receive the index in command line if has COM_API_DECLARE(bool, has(const wchar_t* param, bool case_sens = false, int *ind = NULL)); COM_API_DECLARE(bool, is_first_main_pe(void)); // return whether the first parameter is main-pe COM_API_DECLARE(const wchar_t*, parameter(int index)); // ZERO-based index, should not free the return buffer but use it immediately // key: the key for the parameter // case_sens: whether the 'key' is case sensitive // return: return im.exe of key '/im' in "taskkill /f /im im.exe", should not free but use it immediately COM_API_DECLARE(const wchar_t*, parameter(const wchar_t* key, bool case_sens = false)); COM_API_DECLARE(const wchar_t*, main_pe(void)); // DO NOT free the return buffer but use it immediately COM_API_DECLARE(int, add(const wchar_t* param, bool case_sens = false, int index = -1)); COM_API_DECLARE(int, add(const wchar_t* key, const wchar_t* val, bool case_sens = false, int index = -1)); // if as_key was true, then remove param and the next item to it COM_API_DECLARE(int, remove(const wchar_t* param, bool case_sens = false, bool as_key = false)); COM_API_DECLARE(int, remove(int index)); // function: convert to a command line string // buf: to receive the string, can be NULL // len: [in] - count of buf, [out] - content length in buf, if buf was NULL or len is small, then contains the minimum length and return ERROR_INSUFFICIENT_BUFFER // return: ERROR_SUCCESS if buf is length enough, or ERROR_INSUFFICIENT_BUFFER if len was less than required, COM_API_DECLARE(int, to_command_line(wchar_t* buf, int* len)); // data: (const wchar_t*) // len: bytes of 'data' // total: unused, be ZERO // flag: inter_module_data::DATA_FLAG_FINAL // param: same as 'user' COM_API_DECLARE(int, to_command_line(INTER_MODULE_CALLBACK_VAR(got_result), void* user)); }; PORT_API(long) invoke_api(FARPROC func, bool stdcall_, int param_count, void** params, int* ret_val = NULL); PORT_API(long) invoke_api(const wchar_t* path_module, const char* api, bool stdcall_, int param_count, void** params, int* ret_val = NULL); // parameter of result: // data: (const wchar_t*)command line // len: length of (const wchar_t*)data // total: as same as len // flag: DATA_FLAG_FINAL in commonplace, or DATA_FLAG_UNKNOWN to quit // param: like 'param' PORT_API(ISingleton*) create_singleton(const wchar_t* inst_id, inter_module_data::set_data result, void* param); PORT_API(ICmd*) create_command_line(const wchar_t* cmd = NULL); enum _console_attr { CA_FOREGROUND_BLUE = FOREGROUND_BLUE, CA_FOREGROUND_GREEN = FOREGROUND_GREEN, CA_FOREGROUND_RED = FOREGROUND_RED, CA_FOREGROUND_INTENSITY = FOREGROUND_INTENSITY, CA_BACKGROUND_BLUE = BACKGROUND_BLUE, CA_BACKGROUND_GREEN = BACKGROUND_GREEN, CA_BACKGROUND_RED = BACKGROUND_RED, CA_BACKGROUND_INTENSITY = BACKGROUND_INTENSITY, }; PORT_API(WORD) set_console_attribute(WORD attr); PORT_API(ICmd*) from_console(const wchar_t* tips = L"input"); PORT_API(ICmd*) from_console(const char* tips = "input"); }