1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
|
#include <iostream>
#include <vector>
#include <string>
#include <windows.h>
#include <algorithm>
#include <iterator>
#include <TlHelp32.h>
#ifdef _AMD64_
#define _MAX_VALUE ((PVOID)0x000F000000000000)
#define _VALUE ULONG_PTR
#define _Allign 0x7
#else
#define _MAX_VALUE ((PVOID)0xFFE00000)
#define _VALUE ULONG
#define _Allign 0x3
#endif
#define BUFFER_SIZE 40000
bool invalidChar(char c)
{
return !isprint(static_cast<unsigned char>(c));
}
void stripUnicode(std::string & str)
{
str.erase(remove_if(str.begin(), str.end(), invalidChar), str.end());
}
int main(int argc, char **argv)
{
HANDLE process;
SIZE_T bytes_read;
PROCESSENTRY32 processEntry = { 0 };
MODULEENTRY32 me32{ sizeof(MODULEENTRY32) };
DWORD pid = -1;
std::string targetProcess;
std::string pattern;
size_t max_char = 64;
//Get Target Process name
targetProcess = "explorer.exe";
HANDLE snapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (snapShot == INVALID_HANDLE_VALUE)
{
std::cout << "[!] Failed to CreateToolHelp32Snapshot" << std::endl;
exit(-1);
}
processEntry.dwSize = sizeof(PROCESSENTRY32);
if (Process32First(snapShot, &processEntry))
{
do
{
if (strcmp(processEntry.szExeFile, targetProcess.c_str()) == 0)
{
//process found
CloseHandle(snapShot);
pid = processEntry.th32ProcessID;
break;
}
} while (Process32Next(snapShot, &processEntry));
}
if (pid == -1)
{
std::cout << "[!] Process not found" << std::endl;
Sleep(2000);
exit(-1);
}
HANDLE snapModule = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pid);
if (!snapModule || !::Module32First(snapModule, &me32))
{
::CloseHandle(snapModule);
return 0;
}
std::cout << "[+] Process Base Addr : 0x" << std::hex << reinterpret_cast<_VALUE>(me32.modBaseAddr) << std::endl;
std::cout << "[+] Process Base Size : 0x" << std::hex << (me32.modBaseSize) << std::endl;
std::cout << "[+] PID : " << pid << std::endl;;
process = OpenProcess(PROCESS_VM_READ, FALSE, pid);
if (!process)
{
std::cout << "[!] Failed To open Process" << std::endl;
exit(-1);
}
std::cout << "[+] Search strings beginning by : ";
std::getline(std::cin, pattern);
std::cout << "[+] Max Size : ";
std::cin >> max_char;
char* p = 0;
std::vector<char> buffer(BUFFER_SIZE);
char* displayBuffer = new char[max_char];
std::cout << "[+] Scanning Started ! " << std::endl;
while (p < (char *)(_MAX_VALUE))
{
ReadProcessMemory(process, (LPVOID)p, &buffer[0], BUFFER_SIZE, &bytes_read);
for (auto pos = buffer.begin(); buffer.end() != (pos = std::search(pos, buffer.end(), pattern.begin(), pattern.end())); ++pos)
{
std::string s(pos, pos + max_char);
stripUnicode(s);
std::cout << s << std::endl;
};
p += BUFFER_SIZE;
}
delete displayBuffer;
std::cout << "[+] Scanning Finished!" << std::endl;
return 0;
}
|
