Snipd http://snipd.net Handy snippets of code Sat, 12 May 2012 11:40:09 +0000 en hourly 1 (Python) ARC4 http://snipd.net/python-arc4 http://snipd.net/python-arc4#comments Thu, 10 May 2012 12:10:04 +0000 SnipBot http://snipd.net/?p=10728 This is a pure Python implementation of raw ARC4, sans any improvements. For instance, it could take a nonce, use multiple state spaces (parallelizable), automatically discard the first 4K of the state space(s), use a more complex transformation than a simple swap, limit the # of bytes encrypted per nonce, etc.. The size of the state space is a parameter–the size of the key must not exceed the size of the state space.

  1. #!/usr/bin/env python
  2.  
  3. def prepare_state(key, state_size=256):
  4.     key_size    = len(key)
  5.     state       = [i for i in range(state_size)]
  6.     j           = 0
  7.  
  8.     for i in range(state_size):
  9.         j = (j + state[i] + key[i % key_size]) % state_size
  10.  
  11.         state[i] ^= state[j]
  12.         state[j] ^= state[i]
  13.         state[i] ^= state[j]
  14.  
  15.     return state
  16.  
  17. def pseudorandom_generator(state):
  18.     size    = len(state)
  19.     i       = 0
  20.     j       = 0
  21.  
  22.     while True:
  23.         i = (i + 1) % size
  24.         j = (j + state[i]) % size
  25.  
  26.         state[i] ^= state[j]
  27.         state[j] ^= state[i]
  28.         state[i] ^= state[j]
  29.  
  30.         yield state[(state[i] + state[j]) % size]
  31.  
  32. def ARC4(key, text):
  33.     state       = prepare_state(key)
  34.     keystream   = pseudorandom_generator(state)
  35.  
  36.     for key_byte, text_byte in zip(keystream, text):
  37.         yield key_byte ^ text_byte
  38.  
  39. if (__name__ == "__main__"):
  40.     from pprint import pprint as pp
  41.  
  42.     encryption  = ARC4(b‘Key’, b‘Plaintext’)
  43.     ciphertext  = bytes([next(encryption) for i in range(len(b‘Plaintext’))])
  44.     pp(ciphertext)
  45.  
  46.     decryption  = ARC4(b‘Key’, ciphertext)
  47.     plaintext   = bytes([next(decryption) for i in range(len(ciphertext))])
  48.     pp(plaintext)
]]> http://snipd.net/python-arc4/feed 0 (Python) All-Or-Nothing Transform http://snipd.net/python-all-or-nothing-transform http://snipd.net/python-all-or-nothing-transform#comments Tue, 08 May 2012 19:20:02 +0000 SnipBot http://snipd.net/?p=10725 Performs an all-or-nothing transform on a stream of chunks. The data can only be decrypted if every block is present to generate an HMAC for. The list of HMACs is then XOR’d against the final block from the transform, yielding the decryption key for the blocks.

Currently uses the HMAC key for encryption as well (TODO: change this). Reports a hash of the encrypted chunk for storage/retrieval without needing to calculate HMAC until decryption.

Needs a lot of cleanup and some fixes. Makes a lot of assumptions, for instance, that current_block, total_blocks, and data_size only occupy 1 byte apiece. Currently doesn’t strip padding after decoding, and doesn’t convert original integers for current_block, total_blocks, and data_size back from bytes.

  1. from stream import chunk
  2. from hmac import HMAC, pad_key
  3. from Crypto.Random import random
  4.  
  5. def bytearray_to_bytes(a_bytearray):
  6.     return bytes([a_byte for a_byte in a_bytearray])
  7.  
  8. def encode(a_hash, hmac_key, a_cipher, data, block_size, block_key=None):
  9.     if not block_key:
  10.         block_key = bytes([random.randint(0, 255) for i in range(a_hash.digest_size)])
  11.  
  12.     hmac_key    = pad_key(a_hash, hmac_key)
  13.     block_key   = pad_key(a_hash, block_key)
  14.     encrypter   = a_cipher.new(block_key)
  15.     final_block = bytearray(block_key)
  16.  
  17.     for a_block in chunk(data, block_size):
  18.         a_hasher                = a_hash.new()
  19.         a_block                 = bytearray(a_block[0:3]) + a_block[3]
  20.         encrypted_block         = bytearray(encrypter.encrypt(bytearray_to_bytes(a_block)))
  21.         encrypted_block_hmac    = HMAC(a_hash, hmac_key, encrypted_block)
  22.         final_block             = bytearray(x[0] ^ x[1] for x in zip(final_block, encrypted_block_hmac))
  23.         a_hasher.update(bytearray_to_bytes(encrypted_block))
  24.  
  25.         yield [encrypted_block, a_hasher.digest()]
  26.  
  27.     a_hasher = a_hash.new()
  28.     a_hasher.update(bytearray_to_bytes(final_block))
  29.  
  30.     yield [final_block, a_hasher.digest()]
  31.  
  32. def decode(a_hash, hmac_key, a_cipher, blocks, block_size):
  33.     hmac_key    = pad_key(a_hash, hmac_key)
  34.     block_key   = blocks[-1]
  35.     blocks      = blocks[:-1]
  36.  
  37.     for a_block in blocks:
  38.         block_key = bytearray(x[0] ^ x[1] for x in zip(block_key, HMAC(a_hash, hmac_key, a_block)))
  39.     a_decrypter = a_cipher.new(bytearray_to_bytes(block_key))
  40.  
  41.     for a_block in blocks:
  42.         a_decrypted_block   = bytearray(a_decrypter.decrypt(bytearray_to_bytes(a_block)))
  43.         plaintext           = a_decrypted_block[-block_size:]
  44.         data_size           = a_decrypted_block[-block_size-1:-block_size]
  45.         total_blocks        = a_decrypted_block[-block_size-2:-block_size-1]
  46.         current_block       = a_decrypted_block[-block_size-3:-block_size-2]
  47.  
  48.         yield [current_block, total_blocks, data_size, plaintext]
  49.  
  50.  
  51.  
  52.  
  53.  
  54. if (__name__ == ‘__main__’):
  55.     from Crypto.Hash import RIPEMD
  56.     from Crypto.Cipher import ARC4
  57.    
  58.     import pprint
  59.     pp = pprint.pprint
  60.  
  61.     data = b"all your base are belong to us"
  62.    
  63.     pp(data)
  64.     print(‘\n‘)
  65.  
  66.     blocks = [a_block for a_block in encode(RIPEMD, b‘an_hmac_key’, ARC4, data, 8)]
  67.    
  68.     pp(blocks)
  69.     print(‘\n‘)
  70.  
  71.     hashes      = [a_block[1] for a_block in blocks]
  72.     blocks      = [a_block[0] for a_block in blocks]
  73.  
  74.     pp([a_block for a_block in decode(RIPEMD, b‘an_hmac_key’, ARC4, blocks, 8)])
]]> http://snipd.net/python-all-or-nothing-transform/feed 0 (Python) Chunk Data for Streaming http://snipd.net/python-chunk-data-for-streaming http://snipd.net/python-chunk-data-for-streaming#comments Tue, 08 May 2012 19:10:02 +0000 SnipBot http://snipd.net/?p=10724 Chunks data into block_size blocks for streaming, adds null padding.

  1. import math
  2.  
  3. is_debug = False
  4.  
  5. def chunk(data, block_size, padding=b‘\x00′):
  6.     data_size       = len(data)
  7.     padding_size    = block_size – (data_size % block_size) if (data_size > block_size) else (block_size – data_size)
  8.     is_padded       = (padding_size > 0) and (padding_size != block_size)
  9.     total_blocks    = math.ceil(data_size / block_size)
  10.     current_block   = 0
  11.     block_slice     = [(block_size * current_block), (block_size * (current_block + 1))]
  12.  
  13.     if is_debug:
  14.         print("data_size: %d" % (data_size,))
  15.         print("padding_size: %d" % (padding_size,))
  16.         print("is_padded: %s" % (is_padded,))
  17.         print("total_blocks: %d\n" % (total_blocks,))
  18.  
  19.     while current_block < total_blocks:
  20.         a_block = slice(block_slice[0], block_slice[1])
  21.  
  22.         if (is_padded and (current_block == (total_blocks – 1))):
  23.             yield [current_block, total_blocks, data_size, data[a_block] + (padding_size * padding)]
  24.             return
  25.  
  26.         yield [current_block, total_blocks, data_size, data[a_block]]
  27.  
  28.         current_block   += 1
  29.         block_slice[0]  += block_size
  30.         block_slice[1]  += block_size
]]> http://snipd.net/python-chunk-data-for-streaming/feed 0 (Python) HMAC http://snipd.net/python-hmac http://snipd.net/python-hmac#comments Tue, 08 May 2012 19:10:02 +0000 SnipBot http://snipd.net/?p=10723 HMAC, pass a hash from Crypto.Hash in PyCrypto. Key should be a bytes object. Returns a bytearray.

  1. def pad_key(a_hash, a_key):
  2.     block_size = a_hash.digest_size
  3.  
  4.     if (len(a_key) > block_size):
  5.         a_hasher = a_hash.new()
  6.         a_hash.update(a_key)
  7.         return a_hasher.digest()
  8.     elif (len(a_key) < block_size):
  9.         return a_key + (b‘\x00′ * (block_size – len(a_key)))
  10.  
  11.     return a_key
  12.  
  13. def HMAC(a_hash, a_key, data):
  14.     block_size  = a_hash.digest_size
  15.     a_key       = pad_key(a_hash, a_key)
  16.     block_range = bytearray([i for i in range(block_size)])
  17.     xor_5c      = bytearray.maketrans(block_range, bytearray([i ^ 0x5c for i in range(block_size)]))
  18.     xor_36      = bytearray.maketrans(block_range, bytearray([i ^ 0×36 for i in range(block_size)]))
  19.  
  20.     inner_hasher = a_hash.new()
  21.     outer_hasher = inner_hasher.copy()
  22.     final_hasher = inner_hasher.copy()
  23.  
  24.     inner_hasher.update(a_key.translate(xor_36) + data)
  25.     outer_hasher.update(a_key.translate(xor_5c) + inner_hasher.digest())
  26.     final_hasher.update(outer_hasher.digest())
  27.  
  28.     return bytearray(final_hasher.digest())
]]> http://snipd.net/python-hmac/feed 0 (Java) Quicksort in Java, with Enforced Suckitude http://snipd.net/java-quicksort-in-java-with-enforced-suckitude http://snipd.net/java-quicksort-in-java-with-enforced-suckitude#comments Mon, 07 May 2012 14:10:03 +0000 SnipBot http://snipd.net/?p=10713 It’s no fun implementing QuickSort unless you can force it out of its blister-fast, O(n log n) speed and humiliate it with its worst-case, O(n^2) runtime. So that’s what I set out to do.

My naive partition simply pivots around the low item, but my randomized partition defeats the sucky inputs by choosing a random pivot. (If you’re interested in checking out a QuickSort which naively partitions until it hits an attempt to get it to run in quadratic time, check out IntroSort — which simply fails over to Merge Sort when it exceeds its optimal recursion depth.)

  1. import java.io.IOException;
  2. import java.text.SimpleDateFormat;
  3. import java.util.Date;
  4. import java.util.Random;
  5.  
  6. /**
  7.  *
  8.  */
  9.  
  10. /**
  11.  * @author Roger
  12.  *
  13.  */
  14. public class MyQuickSort {
  15.    
  16.     /**
  17.      * @param args
  18.      */
  19.     public static void main(String[] args) throws IOException {
  20.         String[] files = { "lincoln2.txt", "lincoln.txt", "twain2.txt",
  21.                 "twain3.txt", "twain.txt", "eliot.txt", "tolstoy.txt" };
  22.         //String[] files = { "lincoln2.txt", "lincoln.txt", "twain2.txt"};
  23.        
  24.         MyQuickSort sort = new MyQuickSort();
  25.        
  26.         SimpleDateFormat format =
  27.             new SimpleDateFormat("EEE MMM dd HH:mm:ss-SSS zzz yyyy");
  28.         String[] sortTest = null;
  29.         String[] suckySortTest = null;
  30.        
  31.         System.out.println("———TEST QUICK SORT ————");
  32.         for (int x = 0; x < files.length; x++) {
  33.             String[] testCase = MergeTest.readFile(files[x]);
  34.            
  35.             long start = System.currentTimeMillis();
  36.             Date now = new Date(start);
  37.             System.out.println("File: " + files[x]);
  38.             System.out.println("Total words: " + testCase.length);
  39.             System.out.println("begin test: " + format.format(now));    
  40.            
  41.             sortTest = sort.quickSort(testCase, 0, testCase.length-1);
  42.  
  43.             long end = System.currentTimeMillis();
  44.             now = new Date(end);
  45.             System.out.println("end test: " + format.format(now));
  46.             System.out.println("total time: " + (end - start));
  47.             System.out.println("————————–\n\n");
  48.            
  49.             // Make it suck…
  50.             String[] reverseTest = new String[sortTest.length];
  51.             for (int i = sortTest.length - 1, j = 0; i >= 0; i–, j++) {
  52.                 reverseTest[j] = sortTest[i];
  53.             }
  54.            
  55.             start = System.currentTimeMillis();
  56.             now = new Date(start);
  57.             System.out.println("——-SUCKY VERSION———-");
  58.             System.out.println("File: " + files[x]);
  59.             System.out.println("Total words: " + testCase.length);
  60.             System.out.println("begin test: " + format.format(now));
  61.          
  62.             suckySortTest = sort.quickSort(testCase, 0, testCase.length-1);
  63.            
  64.             end = System.currentTimeMillis();
  65.             now = new Date(end);
  66.             System.out.println("end test: " + format.format(now));
  67.             System.out.println("total time: " + (end - start));
  68.             System.out.println("————————–\n\n");
  69.         }
  70.              
  71.        
  72.         //for (int i = 0; i < sortTest.length; i++) {
  73.         //    System.out.println(sortTest[i]);
  74.         //}
  75.  
  76.     }
  77.    
  78.     private String[] quickSort(String[] list, int low, int high) {
  79.         if (high <= low) return list;
  80.         //int pivot =  partition(list, low, high);
  81.         int pivot =  nonSuckyPartition(list, low, high);
  82.         quickSort(list, low, pivot-1);
  83.         quickSort(list, pivot+1, high);
  84.        
  85.         return list;
  86.     }
  87.    
  88.     /**
  89.      * Sucky version of partition — it uses the first element as the partition.
  90.      * @param list
  91.      * @param low
  92.      * @param high
  93.      * @return
  94.      */
  95.     private int partition(String[] list, int low, int high) {
  96.         int i = low - 1;
  97.         int j = high;
  98.         while (i < high) {
  99.             while (list[++i].compareTo(list[high]) < 0) ; // do nothing
  100.             while (list[high].compareTo(list[–j]) < 0) {
  101.                 if (j == low) break;
  102.             }
  103.             if (i >= j) break;
  104.             swap(list, i, j);
  105.         }
  106.         swap(list, i, high);
  107.         return i;
  108.     }
  109.    
  110.     private int nonSuckyPartition(String[] list, int low, int high) {
  111.         int i = low - 1;
  112.         int j = high;
  113.         int partition = randomizeInRange(low, high);
  114.         while (i < high) {
  115.             while (list[++i].compareTo(list[partition]) < 0) ; // do nothing
  116.             while (list[partition].compareTo(list[–j]) < 0) {
  117.                 if (j == low) break;
  118.             }
  119.             if (i >= j) break;
  120.             swap(list, i, j);
  121.         }
  122.         swap(list, i, high);
  123.         return i;
  124.     }
  125.    
  126.     private void swap(String[] list, int i, int j) {
  127.         String swap = list[i];
  128.         list[i] = list[j];
  129.         list[j] = swap;
  130.     }
  131.    
  132.     private int randomizeInRange(int low, int high) {
  133.         assert (low < high);
  134.         int retval = 0;
  135.         Random rand = new Random();
  136.         // get the range value
  137.         long range = (long)high - (long)low + 1;
  138.         long fraction = (long)(range * rand.nextDouble());
  139.         retval = (int)(fraction + low);
  140.        
  141.         return retval;
  142.     }
  143.  
  144.  
  145. }
]]> http://snipd.net/java-quicksort-in-java-with-enforced-suckitude/feed 0 (PHP) auto complete like google suggestion http://snipd.net/php-auto-complete-like-google-suggestion http://snipd.net/php-auto-complete-like-google-suggestion#comments Mon, 07 May 2012 07:20:09 +0000 SnipBot http://snipd.net/?p=10712 auto complete code snippet like google suggestions

  1. <link href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/base/jquery-ui.css" rel="stylesheet" type="text/css"/>
  2.   <script src="http://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js"></script>
  3.   <script src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js"></script>
  4.  
  5.   <script>
  6.   $(document).ready(function() {
  7.     $("input#s").autocomplete({
  8.     source: ["Sydney", "Wollongong", "Whyalla", "Warrnambool", "Wagga Wagga", "Traralgon"
  9.              , "Townsville", "Toowoomba", "Tewantin-Noosa", "Taree", "Tamworth", "Sunshine Coast",
  10.              "Sunbury", "Shoalhaven", "Shoalhaven", "Shepparton-Mooroopna", "Roebourne", "Rockhampton",
  11.              "Richmond-Windsor", "Queanbeyan", "Port Macquarie", "Perth" ,
  12.              "Palmerston", "Newcastle", "Mount Isa", "Mount Gambier"]
  13.     });
  14.   });
  15.   /** get enty http://wwp.greenwichmeantime.com/time-zone/australia/city/index.htm **/
  16.   </script>
  17.  
  18.  
  19.  
  20. /*************************************************************/
  21. /*************************** POINT 2 *************************/
  22. /*************************************************************/
  23.  
  24.  
  25. <script type="text/javascript">
  26. $(function() {
  27.         $(‘input#s’).autocomplete({
  28.                 source: [ "Melbourne",
  29.                                  "Kyneton",
  30.                                  "Edinburgh",
  31.                                  "Castlemaine",
  32.                                  "Ballarat",
  33.                                  "Bendigo",
  34.                                  "New York",
  35.                                  "Tokyo",
  36.                                  "Beijing",
  37.                                  "London"
  38.                                 ],
  39.                 minLength: 0
  40.         }).focus(function(){            
  41.                 $(this).data("autocomplete").search($(this).val());
  42.         });
  43. });
  44. </script>
]]> http://snipd.net/php-auto-complete-like-google-suggestion/feed 0 Custom prolog and epilog for a function in C++ http://snipd.net/custom-prolog-and-epilog-for-a-function-in-c http://snipd.net/custom-prolog-and-epilog-for-a-function-in-c#comments Sun, 15 Apr 2012 19:34:29 +0000 FY http://snipd.net/?p=10466 Traditionally, the compiler is responsible for creating the prolog and epilog of a function. However, custom prolog and epilog code can be written if a function has been declared with the naked attribute.

The snippet below demonstrates a naked function with custom prolog and epilog code.

__declspec(naked) void foo(){

	// Prolog
	__asm {
		push ebp		// Push the Extended Base Pointer
		mov ebp, esp		// Set frame pointer
		sub esp, __LOCAL_SIZE	// Reserve space for local variables
		pushad			// Push all general-purpose registers
	}

	// Do stuff

	// Epilog
	__asm {
		popad			// Pop all general-purpose registers
		mov esp, ebp		// Restore stack pointer
		pop ebp			// Restore the Extended Base Pointer
		retn			// Return
	}

}

The __LOCAL_SIZE symbol can be used to let the compiler determine the amount of space needed for variables.

]]> http://snipd.net/custom-prolog-and-epilog-for-a-function-in-c/feed 0 Hooking with the Microsoft Detours library in C++ http://snipd.net/hooking-with-the-microsoft-detours-library-in-c http://snipd.net/hooking-with-the-microsoft-detours-library-in-c#comments Mon, 09 Apr 2012 17:12:10 +0000 FY http://snipd.net/?p=10331 The DLL Injection example described how to inject a DLL into an existing process. The snippets below demonstrate a combination of hooking and DLL injection in C++ with the Microsoft Detours library.

Quote:

In computer programming, the term hooking covers a range of techniques used to alter or augment the behavior of an operating system, of applications, or of other software components by intercepting function calls or messages or events passed between software components. Code that handles such intercepted function calls, events or messages is called a “hook”.

The RegOpenKeyExW function within kernel32.dll is responsible for opening a specified registry key. To demonstrate hooking, the RegOpenKeyExW function will be intercepted within the Google Chrome process. A message will be logged at each call of RegOpenKeyExW. These messages can be viewed with DebugView.

DLLInjector.cpp: Responsible for launching Google Chrome and injecting the specified DLL into the process

// DLLInjector.cpp : Defines the entry point for the console application.
//
#include <windows.h>
#include <stdio.h>
#include <iostream>
#include <Psapi.h>
#include <string.h>
#include "stdafx.h"
#include "detours.h"

#pragma comment(lib, "detours.lib")

#define DLL_PATH "\\..\\Debug\\exampledll.dll" // The DLL we would like to inject
#define PROC_DIR "C:\\Users\\Ferhat\\AppData\\Local\\Google\\Chrome\\Application"
#define PROC_PATH "C:\\Users\\Ferhat\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe" // Google Chrome

int _tmain(int argc, _TCHAR* argv[])
{
	STARTUPINFO si;
	PROCESS_INFORMATION pi;

	ZeroMemory( &si, sizeof(si) );
	si.cb = sizeof(si);
	ZeroMemory( &pi, sizeof(pi) );

	TCHAR currentDir[MAX_PATH];
	TCHAR dllDir[MAX_PATH];
	GetCurrentDirectory(MAX_PATH,currentDir);

	strcpy(dllDir,currentDir);
	strcat(dllDir,DLL_PATH);

	printf("Current directory: %s\n", currentDir);
	printf("DLL path: %s\n", dllDir);
	printf("Process path: %s\n", PROC_PATH);

	bool detourProcess = DetourCreateProcessWithDll(PROC_PATH,"",0,0,FALSE,CREATE_DEFAULT_ERROR_MODE,0,PROC_DIR,&si,&pi, dllDir, NULL);

	if(detourProcess){
		printf("Injected DLL: %s\n", dllDir);
	} else {
		printf("Failed to inject DLL: %s\n", dllDir);
		system("PAUSE");
	}

	return 0;
}

FunctionHook: represents a hook

Header file

#pragma once

#include <Windows.h>
#include <string>

using namespace std;

// Used for detouring class virtual member functions
#define Naked __declspec( naked )

class FunctionHook
{
public:
	FunctionHook(void);
	~FunctionHook(void);

	// Used for fetching the hook (e.g. "CPlayer::ctor" or "sprintf")
	string Identifier;

	// Optional module (e.g. "msvcrt.dll")
	string Module;

	// Signature of the function in memory
	string Signature;

	// Mask
	string Mask;

	// The original address of the function
	DWORD OriginalAddress;

	// The detour function
	PBYTE Detour;

	// The address of the detour function
	DWORD DetourAddress;
};

CPP file

#include "FunctionHook.h"

FunctionHook::FunctionHook(void)
{
	this->Identifier = "";
	this->Module = "";
	this->Mask = "";
	this->Signature = "";
	this->DetourAddress = 0;
	this->OriginalAddress = 0;
}

FunctionHook::~FunctionHook(void)
{
}

HookManager: responsible for hooking, retrieving hooks and keeping a list of active hooks

Header file

#pragma once

#include <Windows.h>
#include <vector>
#include "FunctionHook.h"
#include "Hook.h"
#include "detours.h"
#include "Log.h"

#pragma comment(lib, "ws2_32.lib")
#pragma comment(lib, "psapi.lib")
#pragma comment(lib, "dbghelp.lib")
#pragma comment(lib, "detours.lib")

using namespace std;

typedef std::tr1::shared_ptr<FunctionHook> fhPtr;

class HookManager
{
public:
	HookManager(void);
	~HookManager(void);
	vector<fhPtr> Hooks;
	FunctionHook* GetHook(char* identifier);
	void CreateHook(FunctionHook* hook);
	static HookManager* Instance();
};

CPP file

#include "HookManager.h"

static HookManager* instance;

HookManager::HookManager(void)
{

}

HookManager::~HookManager(void)
{
}

HookManager* HookManager::Instance(){
	if(!instance){
		instance = new HookManager();
	}

	return instance;
}

void SignatureToByteArray(char* signature, BYTE* bytes){
	int tmp;
	for(int i=0;i<strlen(signature)/2;i++){
		sscanf(signature+2*i,"%2x",&tmp);
		bytes[i] = tmp;
	}
}

void HookManager::CreateHook(FunctionHook* hook){
	DWORD functionAddress;
	DWORD detouredAddress;
	PBYTE foundAddress;

	FunctionHook* hookInst = new FunctionHook();
	hookInst->Detour = hook->Detour;
	hookInst->DetourAddress = hook->DetourAddress;
	hookInst->Identifier = hook->Identifier;
	hookInst->Mask = hook->Mask;
	hookInst->Module = hook->Module;
	hookInst->OriginalAddress = hook->OriginalAddress;
	hookInst->Signature = hook->Signature;

	if(strlen(hookInst->Module.c_str()) <= 0){
		BYTE* sigArray = new BYTE[strlen(hookInst->Signature.c_str())/2];
		SignatureToByteArray(const_cast<char*>(hookInst->Signature.c_str()), sigArray);
		functionAddress = sigFindPattern(getMainModule(), sigArray, const_cast<char*>(hookInst->Mask.c_str()));
		hookInst->OriginalAddress = functionAddress;
		LogDebug("Hooking %s at @0x%08X\n", const_cast<char*>(hookInst->Identifier.c_str()), hookInst->OriginalAddress);
		detouredAddress = (DWORD)DetourFunction((PBYTE)functionAddress, hookInst->Detour);
		hookInst->DetourAddress = detouredAddress;
	} else {
		foundAddress = DetourFindFunction(const_cast<char*>(hookInst->Module.c_str()),const_cast<char*>(hookInst->Identifier.c_str()));
		hookInst->OriginalAddress = reinterpret_cast<DWORD>(foundAddress);
		LogDebug("Hooking %s at @0x%08X\n", const_cast<char*>(hookInst->Identifier.c_str()), hookInst->OriginalAddress);
		detouredAddress = (DWORD)DetourFunction(foundAddress, hookInst->Detour);
		hookInst->DetourAddress = detouredAddress;
	}

	// Add the hook to the list of hooks
	HookManager::Instance()->Hooks.push_back(fhPtr(hookInst));
}

FunctionHook* HookManager::GetHook(char* identifier){
	for(int i=0;i<HookManager::Instance()->Hooks.size();i++){
		FunctionHook* functionHook = HookManager::Instance()->Hooks[i].get();
		if(functionHook != NULL){
			if(functionHook->Identifier == identifier){
				return functionHook;
			}
		}
	}

	LogDebug("Hook not found\n");
	return NULL;
}

Log: responsible for debug messages

Header file

#pragma once

#include "stdafx.h"

#ifndef LOG_H
#define LOG_H

void LogDebug(const char *format, ...);

void LogMsgBox(const char *format, ...);

void LogClearScreen();
void LogScreen(const char *format, ...);
void LogDraw();
void LogPrintScreen(int posX, int posY, int width, const char *format, ...);

#endif

CPP file

#define _CRT_SECURE_NO_WARNINGS
#include <Windows.h>
#include <cstdio>
#include <string>
#include "Log.h"

using namespace std;

string screenlogbuffer;

void LogScreen(const char *format, ...)
{
	va_list args;
	va_start(args, format);
	char tmp[1024];
	vsprintf(tmp, format, args);
	va_end(args);
	screenlogbuffer.append(tmp);
}

void LogDebug(const char *format, ...)
{
	char msgBuf[4096];
	va_list args;
	va_start(args, format);
	vsprintf(msgBuf, format, args);
	va_end(args);
	OutputDebugString(msgBuf);
}

DLLMain: The DLL injected into the Google Chrome process

CPP file

// dllmain.cpp : Defines the entry point for the DLL application.
#define _CRT_SECURE_NO_WARNINGS
#include <WinSock2.h>
#include <Windows.h>
#include <intrin.h>
#include <cstdio>
#include <cmath>
#include <ctime>
#include <set>
#include <vector>

#include "HookManager.h"

#pragma comment(lib, "ws2_32.lib")
#pragma comment(lib, "psapi.lib")
#pragma comment(lib, "dbghelp.lib")
#pragma comment(lib, "detours.lib")

typedef LSTATUS (__stdcall* pRegOpenKeyExW)(HKEY, LPCWSTR, DWORD, REGSAM, PHKEY);
pRegOpenKeyExW pOriginalRegOpenKeyExW;

LSTATUS __stdcall MyRegOpenKeyExW(HKEY hKey, LPCWSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY phkResult){
	LogDebug("RegOpenKeyExW called: %S\n", lpSubKey);
	return pOriginalRegOpenKeyExW(hKey, lpSubKey, ulOptions, samDesired, phkResult);
}

void main()
{
	FunctionHook* regOpenKeyExWHook = new FunctionHook();
	regOpenKeyExWHook->Identifier = "RegOpenKeyExW";
	regOpenKeyExWHook->Module = "kernel32.dll";
	regOpenKeyExWHook->Detour = (PBYTE)MyRegOpenKeyExW;
	HookManager::Instance()->CreateHook(regOpenKeyExWHook);
	pOriginalRegOpenKeyExW = (pRegOpenKeyExW)(HookManager::Instance()->GetHook("RegOpenKeyExW")->DetourAddress);
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
	int processId = GetCurrentProcessId();

	if(fdwReason == DLL_PROCESS_ATTACH)
	{
		DWORD id;
		LogDebug("Attach...\n");
		LogDebug("Process ID: %d\n", processId);
		CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)main, NULL, 0, &id);
	}
	if(fdwReason == DLL_PROCESS_DETACH)
	{
		char buffer[40];
		_strtime(buffer);
		LogDebug("Detach...\n");
		LogDebug("Time:%s\n", buffer);
	}
	return TRUE;
}

The function MyRegOpenKeyExW represents the hook for RegOpenKeyExW. It prints a debug message and calls the original RegOpenKeyExW function.

DebugView output

DebugView output

The archive containing the VC++ source code can be downloaded from here.

]]> http://snipd.net/hooking-with-the-microsoft-detours-library-in-c/feed 0 (Bash) Download Directory with scp http://snipd.net/bash-download-directory-with-scp http://snipd.net/bash-download-directory-with-scp#comments Wed, 04 Apr 2012 23:30:03 +0000 SnipBot http://snipd.net/?p=10179 download directory to localhost home folder new-dir-name

  1. $ scp -r yourusername@yourserver:~/public_html/directory/ ~/Downloads/new-dir-name
]]> http://snipd.net/bash-download-directory-with-scp/feed 0 Assembling with nasm and disassembling with ndisasm http://snipd.net/assembling-with-nasm-and-disassembling-with-ndisasm http://snipd.net/assembling-with-nasm-and-disassembling-with-ndisasm#comments Sun, 25 Mar 2012 15:40:09 +0000 FY http://snipd.net/?p=10025 The following commands demonstrate assembling with nasm and disassembling with ndisasm.

$ cat example.s
mov eax,0
test eax,eax
$ nasm example.s
$ ndisasm example
00000000  66B800000000      mov eax,0x0
00000006  6685C0            test eax,eax

The first column of the disassembly contains the file offset, the second column contains the opcodes and the third contains the assembly instructions.

 

]]> http://snipd.net/assembling-with-nasm-and-disassembling-with-ndisasm/feed 0