Comments (7)
The second variation should work although, on my machine, the export is: ?Get@CWbemObject@@UEAAJPEBGJPEAUtagVARIANT@@PEAJ2@Z
BUT the is no definition of the function/class method on the default database so you have to:
a) add the class/interface and rebuild the db or
b) use the raw parameters (analyze the stack on x86 and registers on x64)
from deviare2.
@mxmauro Can you give some more insight on rebuilding the DB? I added wbemcli.h
to Database\HeaderBuilder\Base\headers.h
and regenerated preprocessed64W.h
, but even without, invoking build_db64.bat ..\HeaderBuilder\Base\output\preprocessed64W.h
fails with a syntax error:
D:\ProjekteOS\Deviare2\Database\HeaderBuilder\Base\output\preprocessed64W.h:4439: error: expected identifier before ':' token
This corresponds to
enum : bool { __the_value = false };
I am on VS 2019.
from deviare2.
Hi @kunom ,
The database builder uses GCC-Xml to build the database. Might be the current version is not compatible with the new features introduced on VS 2019.
I usually recommend to create a simple header file a copy there required api's and structs.
Regards.
from deviare2.
Thanks @mxmauro. That's exactly what I thought: GCC-XML is pretty dated, and C++ has evolved quite a bit lately. But since no preprocessed64W.h
(generated by HeaderBuilder) is committed to GIT and generation of that file on my machine is not compatible with the included GCC-XML, I don't see an option to "just add the required API's" somewhere.
So, ignoring the obvious option to try to replace GCC-XML with its declared successor CastXML, I fell back to implementing parts of Microsoft's x64 calling convention by myself. This was new to me, but not too hard to achieve.
The resulting code, if anyone is interested in (for IWbemClassObject::Next
btw.):
@hooking.intercepts("fastprox.dll!?Next@CWbemObject@@UEAAJJPEAPEAGPEAUtagVARIANT@@PEAJ2@Z")
def handler(callInfo: hooking.CallInfoWrapper):
# (see https://docs.microsoft.com/en-us/windows/win32/api/wbemcli/nf-wbemcli-iwbemclassobject-next)
# HRESULT Next(
# [hidden] this,
# long lFlags,
# BSTR *strName,
# VARIANT *pVal,
# CIMTYPE *pType,
# long *plFlavor
# );
# fastprox.dll is not in the Deviare DB, so we have to manually extract the parameters
if callInfo.IsPreCall:
namePtrPtr = callInfo.RawIntParam(2) # resolves to Register(asmRegR8)
variantPtr = callInfo.RawIntParam(3) # resolves to Register(asmRegR9)
callInfo.IntercallData = (namePtrPtr, variantPtr)
else:
retval = callInfo.RawResult # resolves to Register(asmRegRax)
if retval:
return # non-success
namePtrPtr, variantPtr = callInfo.IntercallData
if not namePtrPtr or not variantPtr:
return # nothing to intepret
# [...]
from deviare2.
Thanks @mxmauro. That's exactly what I thought: GCC-XML is pretty dated, and C++ has evolved quite a bit lately. But since no
preprocessed64W.h
(generated by HeaderBuilder) is committed to GIT and generation of that file on my machine is not compatible with the included GCC-XML, I don't see an option to "just add the required API's" somewhere.So, ignoring the obvious option to try to replace GCC-XML with its declared successor CastXML, I fell back to implementing parts of Microsoft's x64 calling convention by myself. This was new to me, but not too hard to achieve.
The resulting code, if anyone is interested in (for
IWbemClassObject::Next
btw.):@hooking.intercepts("fastprox.dll!?Next@CWbemObject@@UEAAJJPEAPEAGPEAUtagVARIANT@@PEAJ2@Z") def handler(callInfo: hooking.CallInfoWrapper): # (see https://docs.microsoft.com/en-us/windows/win32/api/wbemcli/nf-wbemcli-iwbemclassobject-next) # HRESULT Next( # [hidden] this, # long lFlags, # BSTR *strName, # VARIANT *pVal, # CIMTYPE *pType, # long *plFlavor # ); # fastprox.dll is not in the Deviare DB, so we have to manually extract the parameters if callInfo.IsPreCall: namePtrPtr = callInfo.RawIntParam(2) # resolves to Register(asmRegR8) variantPtr = callInfo.RawIntParam(3) # resolves to Register(asmRegR9) callInfo.IntercallData = (namePtrPtr, variantPtr) else: retval = callInfo.RawResult # resolves to Register(asmRegRax) if retval: return # non-success namePtrPtr, variantPtr = callInfo.IntercallData if not namePtrPtr or not variantPtr: return # nothing to intepret # [...]
@kunom , Could you please explain more on how to change IWbemClassObject::Next output? As I figured out, it is not like Get@CWbemObject. Thanks
from deviare2.
@sadward Replace the three dots in my code above at the end of the else
branch with the code below.
My goal was to intercept the following powershell snippet (Get-CimInstance -ClassName win32_operatingsystem).LastBootUptime
, for which I was unable to find out the underlying win32 API.
I cannot follow you in how IWbemClassObject::Get()
should be fundamentally different from IWbemClassObject::Next()
(i.e. other than parameter ordering).
In hindsight, I would also propose to put some more effort into applying @mxmauro's instructions on how to rebuild the DB. That would save you from a lot of manual implementation work.
# check the property name
memory = callInfo.Process().Memory()
namePtr = memory.SSizeTVal(namePtrPtr)
if not namePtr:
return
name = memory.ReadString(namePtr, False)
if name != "LastBootUpTime":
return
# parse the VARIANT value
# (see https://docs.microsoft.com/de-ch/windows/win32/api/oaidl/ns-oaidl-variant)
vt = memory.LongVal(variantPtr)
if vt != 8: # we receive 1=NULL and 8=String
return
valuePtr = memory.SSizeTVal(variantPtr + 8)
value = memory.ReadString(valuePtr, False) # e.g. "20200415075414.500000+120"
# adjust
if not value.startswith(lastBootTimeString):
newValue = lastBootTimeString + value[len(lastBootTimeString):]
memory.WriteString(valuePtr, newValue, False, False)
from deviare2.
Thanks @kunom. Based on https://docs.microsoft.com/en-us/windows/win32/api/wbemcli/nf-wbemcli-iwbemclassobject-next The order of the properties returned during the enumeration is not defined. Does this make any problem? I m sorry, could you please check your email. If did not receive, really appreciate it dropping an email to sadward110 at gmail
from deviare2.
Related Issues (20)
- winword hangs at startup HOT 12
- Missing external. HOT 1
- Placing hooks from .net dll cause hook connection to die
- Nektra.Deviare2 not found HOT 2
- logging/printing all api calls of a hooked process
- Hooking undocumented functions and adding new functions into nektra's database HOT 21
- NktSpyMgr does not return process HOT 6
- Antivirus blocks hooking HOT 3
- Question about Deviare-InProc HOT 1
- How to Hook a process as soon as it starts and check if the hook is active.
- online documentation gone
- contacts page does not work HOT 1
- Deviare DB rebuilt error HOT 1
- appcrash on "Remove All Hooks" with CSharpConsole HOT 5
- CNktDbModuleImpl::DbFunctions
- sample project of external file access monitor HOT 1
- How to hook `sublime` function? HOT 1
- [Python] how to use CreateHookForAddress? HOT 1
- Compiling 'CRegistryPlugin' for 'x86'
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from deviare2.