ODbgScript源碼學習(二十二)

HelperFunctions.h:

#pragma once

// General functions
string ToLower(string in);//到低位
int searchx(char *SearchBuff, int BuffSize, char *SearchString, int StringLen, char wc);//搜索char
bool GetWildcardBytePositions(string bytestring, vector<int>* wildcardpos);//獲取通配符字節指針
bool RgchContains(char* container, uint containerlen, char* containee, uint containeelen);
bool is_hex(string& s);//判斷hex
bool is_hexwild(string& s);//判斷hexwild
bool is_dec(string &s);//判斷dec
bool is_float(string &s);//判斷float
DWORD rev(DWORD dw);
bool split(vector<string> &vec, const string &str, const char delim);
char GetWildcard(string &s);//獲取通配符
int Str2Rgch(string &s, char* arr, uint size);//轉換字符串到rgch
int Str2RgchWithWC(string &s, char* arr, uint size, char wc);//轉換字符串到rgchWithWC
string trim(const string& sData);//去除前後空格字符
bool UnquoteString(string& s, char cstart, char cend);//結束字符串
void MsgBox(string sMsg, string sTitle);//消息框
void DbgMsg(int n, char* title);//調試消息
void DbgMsg(int n,string title="");
void DbgMsgHex(int n, char* title);
void DbgMsgHex(int n,string title="");
int Str2Hex(string &s, string &dst);//字符串轉換為Hex
int Str2Hex(string &s, string &dst, ulong size);
long double strtof(string &s);
int Int2Hex(DWORD dw, string &dst);//整型到hex
void ReplaceString(string &s, char* what, char* with);//替換字符串
string CleanString(string &s);//清除字符串
string Str2Unicode(char* s,ulong len);//轉換字符串到Unicode
string Str2Unicode(string &s);

bool ESPRun(void);//ESP運行

HWND hwndOllyDbg();//ollydbg句柄
HINSTANCE hinstModule();//模塊句柄
HWND FindHandle(DWORD dwThreadId, string wdwClass, long x, long y);//尋找句柄

// PE Dumper
bool SaveDump(string fileName, DWORD ep);//保存轉儲
bool GetPEInfo(DWORD ep);//獲取pe信息

DWORD  resizeDW(DWORD dw, DWORD size);//重設大小雙字節
void resizeSTR(string &str, DWORD size);//重設大小字符串

string StrLastError(void);//最後錯誤
LARGE_INTEGER MyGetTickCount(ULONGLONG oldValue, bool bUseTickCount=0);//獲取Tick數

ODbgScript源碼學習(二十一)

void initLogWindow() {

//初始化記錄窗口

   if (ollylang->wndLog.bar.nbar==0) {//如果語言工具條為空

ollylang->wndLog.bar.name[0]="Address"; //顯示地址字符串

    ollylang->wndLog.bar.defdx[0]=9; //索引

    ollylang->wndLog.bar.mode[0]=BAR_NOSORT; //模式為非分類

ollylang->wndLog.bar.name[1]="Message"; //消息

    ollylang->wndLog.bar.defdx[1]=130; //索引

    ollylang->wndLog.bar.mode[1]=BAR_NOSORT; //費分離

ollylang->wndLog.bar.nbar=2; //設置為2

    ollylang->wndLog.mode=TABLE_COPYMENU|TABLE_APPMENU|TABLE_SAVEPOS|TABLE_ONTOP|TABLE_HILMENU; //模式為標籤複製菜單|添加菜單|保存指針|非頂部|HIL菜單

    ollylang->wndLog.drawfunc=wndlog_get_text; //重畫函數為獲取文本

}

Quicktablewindow(&ollylang->wndLog,15,2,wndlogclass,"Script Log Window");

//快速表窗口

if (ollylang->wndLog.hw) { //如果句柄存在

HICON ico=LoadIcon(hinstModule(),MAKEINTRESOURCE(IDI_ICON_LOG));//加載圖標

SendMessage(ollylang->wndLog.hw,WM_SETICON,false,(long)ico);//發送設置圖標消息

// CloseHandle(ico);//關閉

}

}

int wndlog_sort_function(const t_sortheader *p1,const t_sortheader *p2,const int sort) {//分類函數

t_wndlog_data *lline1 = (t_wndlog_data *)p1; //行為分類頭數據指針

t_wndlog_data *lline2 = (t_wndlog_data *)p2;//行為分類頭數據指針

if (lline1->line > lline2->line)//如果行1大於行2

return 1; //則返回1

else if (lline1->line < lline2->line)

return -1;//否則返回-1

return 0; //默認返回0

}

int wndlog_get_text(char *s, char *mask, int *select, t_sortheader *ph, int column) {//獲取文本

unsigned int ret;

t_wndlog_data *lline = (t_wndlog_data *)ph;

t_dump *cpuasm; //定義轉儲類型變量

int p;

cpuasm = (t_dump *)Plugingetvalue(VAL_CPUDASM); //獲取插件值

    ret = sprintf(s,"");

switch (column) {

case 0: //打印不同類型

ret = sprintf(s, "%X", lline->eip);

break;

case 1:

ret = sprintf(s, "%s", lline->message);

break;

}

if (!ret) ret=strlen(s); //如果打印長度不為0,賦值s的長度后返回

return ret;

}

void clearLogLines() {

if (!ollylang->tLogLines.empty()) {//如果數據不為空

Deletesorteddatarange(&(ollylang->wndLog.data),0,0xffffffff);//釋放記錄窗口數據0-0xffffffff

ollylang->tLogLines.clear(); //清除行

if (ollylang->wndLog.hw!=NULL) InvalidateRect(ollylang->wndLog.hw, NULL, FALSE); //重畫記錄窗口

}

}

int add2log(char* message) { //添加記錄

t_dump *cpuasm;

t_wndlog_data lline={0};

cpuasm = (t_dump *)Plugingetvalue(VAL_CPUDASM);

lline.line = ollylang->tLogLines.size()+1; //行為語言行大小加1

lline.eip = cpuasm->sel0;

lline.size = 1;

strncpy(lline.message,message,LOG_MSG_LEN-1);

ollylang->tLogLines.push_back(lline); //入棧

Addsorteddata(&(ollylang->wndLog.data),&(ollylang->tLogLines.back()));//添加數據

if (ollylang->wndLog.hw!=NULL) {

Selectandscroll(&ollylang->wndLog,lline.line-1,2);

InvalidateRect(ollylang->wndLog.hw, NULL, FALSE);

}

return 1;

}

int add2log(string & message) {

return add2log((char*)message.c_str());

}

int add2logMasked(char* message,char* mask) {

return 1;

}

ODbgScript源碼學習(二十)

LogWindows.cpp:
LRESULT CALLBACK wndlog_winproc(HWND hw,UINT msg,WPARAM wp,LPARAM lp) {
t_logwnd_data *pll; //記錄數據結構定義
HMENU menu; //菜單
int i,shiftkey,controlkey;

switch (msg) {
case WM_DESTROY: //如果消息是
case WM_MOUSEMOVE:
case WM_LBUTTONDOWN:
case WM_LBUTTONDBLCLK:
case WM_LBUTTONUP:
case WM_RBUTTONDOWN:
case WM_RBUTTONDBLCLK:
case WM_HSCROLL:
case WM_VSCROLL:
case WM_TIMER:
case WM_SYSKEYDOWN: //如果是系統按鍵消息
Tablefunction(&ollylang->wndLog,hw,msg,wp,lp); //建立表函數
break;                           // 中斷Pass message to DefMDIChildProc()
// Custom messages responsible for scrolling and selection. User-drawn
// windows must process them, standard OllyDbg windows without extra
// functionality pass them to Tablefunction()
case WM_USER_SCR:
case WM_USER_VABS:
case WM_USER_VREL:
case WM_USER_VBYTE:
case WM_USER_STS:
case WM_USER_CNTS:
case WM_USER_CHGS:
case WM_WINDOWPOSCHANGED: //如果消息是重載
return Tablefunction(&ollylang->wndLog,hw,msg,wp,lp);//返回表函數
case WM_USER_MENU:
menu=CreatePopupMenu(); //如果是用戶菜單建立菜單

// AppendMenu(menu,MF_SEPARATOR,0,"-");//應用菜單

pll=(t_logwnd_data *)Getsortedbyselection(&(ollylang->wndLog.data),ollylang->wndLog.data.selected);//由選擇獲取分類數據
if (menu!=NULL && pll!=NULL) { //如果菜單句柄和記錄數據不為空
AppendMenu(menu,MF_DEFAULT, 10,"Clear");//增加清除菜單
// AppendMenu(menu,MF_STRING, 32,"Toggle Script BP\tF2");//增加中斷菜單
};

// Even when menu is NULL, call to Tablefunction is still meaningful.
i=Tablefunction(&ollylang->wndLog,hw,WM_USER_MENU,0,(LPARAM)menu);//表函數

if (menu!=NULL) DestroyMenu(menu);//釋放菜單
switch (i) {
case 10:
clearLogLines();//清除行
InvalidateRect(hw, NULL, FALSE);//重設客戶區
return 1;
default:;
}
return 0;

case WM_USER_DBLCLK:
pll=(t_wndlog_data *)Getsortedbyselection(&(ollylang->wndLog.data),ollylang->wndLog.data.selected);//獲取數據
if (pll!=NULL) {
if (pll->line) Setcpu(0,pll->line,0,0,CPU_ASMHIST|CPU_ASMCENTER|CPU_ASMFOCUS);//設置CPU窗口
InvalidateRect(hw, NULL, FALSE);//重設客戶區
return 1;
}

case WM_KEYDOWN:
shiftkey=GetKeyState(VK_SHIFT) & 0x8000;//獲取按鍵碼
controlkey=GetKeyState(VK_CONTROL) & 0x8000;
if (wp==VK_RETURN && shiftkey==0 && controlkey==0) {
// Return key follows in Disassembler.
pll=(t_wndlog_data *)Getsortedbyselection(&(ollylang->wndLog.data),ollylang->wndLog.data.selected);
if (pll!=NULL) {
if (pll->line) Setcpu(0,pll->line,0,0,CPU_ASMHIST|CPU_ASMCENTER|CPU_ASMFOCUS);//設置CPU窗口
InvalidateRect(hw, NULL, FALSE);
}
}
// else if (wp==VK_F2) { // && shiftkey==0 && controlkey==0) {

Tablefunction(&ollylang->wndLog,hw,msg,wp,lp);//表函數
break;
        case WM_USER_CHALL:
        case WM_USER_CHMEM:
            InvalidateRect(hw, NULL, FALSE);
            return 0;
        case WM_PAINT:
            Painttable(hw, &ollylang->wndLog, wndlog_get_text);//重畫表
return 0;
default:
break;
}
return DefMDIChildProc(hw,msg,wp,lp); //默認處理
}

ODbgScript源碼學習(十九)

LogWindows.h:

#define LOG_MSG_LEN TEXTLEN //定義記錄消息長度

// 腳本執行表This is the table for Script Execution
typedef struct t_wndlog_data {

unsigned long line; //行
unsigned long size;             // 在地址空間由元素佔用大小Size occupied by element in address space
unsigned long type;             // 數據元素類型Type of data element, TY_xxx
unsigned long eip; //當前地址eip
char     message[LOG_MSG_LEN];

} t_logwnd_data; //記錄窗口數據結構

LRESULT CALLBACK wndlog_winproc(HWND hw,UINT msg,WPARAM wp,LPARAM lp); //指針回調函數記錄窗口的過程

void initLogWindow(); //初始化記錄窗口

int wndlog_sort_function(const t_sortheader *p1,const t_sortheader *p2,const int sort); //記錄窗口分類函數
int wndlog_get_text(char *s, char *mask, int *select, t_sortheader *ph, int column); //獲取文本

int add2log(string & command); //添加到記錄(字符串型)
int add2log(char * command); //添加到記錄(char型)

int add2logMasked(char* message,char* mask); //添加到記錄

void clearLogLines(); //清除記錄行

ODbgScript源碼學習(十八)

int setProgLineResult(int line, DWORD result)  //

{

char buf[17];

sprintf(buf, "%X", result); //打印

string str(buf);

return setProgLineResult(line, str); //使用字符串設置行

}

int setProgLineResultFloat(int line, long double result) {

char buf[128];

sprintf(buf, "%lf", result);

string str(buf);

while (true) 

{

if (str.length() <= 3) break;  //如果長度小於等於3,中斷

if (str[str.length()-1] == '0') //如果最後一個字符為0

str.erase(str.length()-1,1); //清除

else 

break; //中斷

}

return setProgLineResult(line, str); //設置行

}

int setProgLineResult(int line, string& result) //設置行返回值

{

if (line>ollylang->script.size()) return 0; //參數大於腳本大小,返回0

char values[PROG_VAL_LEN]; 

t_wndprog_data *ppl;

ppl = (t_wndprog_data *) Getsortedbyselection(&(ollylang->wndProg.data),line); //獲取分類數據

if (ppl->type & PROG_TYPE_LABEL) //類型為標籤,返回失敗

return false;

strncpy(ppl->result,CleanString(result).c_str(),PROG_RES_LEN);

if (strcmp(ppl->values,"")) 

{

if (ppl->values[0] != ',') 

{

strcpy(values,ppl->values);

strncpy(&ppl->values[1],values,PROG_VAL_LEN-2);

ppl->values[0]=',';

}

}

return true;

}

void clearProgLines()

{

ollylang->pgr_scriptpos=0;

if (!ollylang->tProgLines.empty()) //如果行不為空

{

Deletesorteddatarange(&(ollylang->wndProg.data),0,0xffffffff); //傷處分類數據域

ollylang->tProgLines.clear(); //清除行

InvalidateProgWindow();

}

}

void resetProgLines()

{

vector<t_wndprog_data>::iterator iter=ollylang->tProgLines.begin(); //使用容器vector 定義一個開始

int line=0;

t_wndprog_data *ppl;

while (iter!=ollylang->tProgLines.end()) //黨不等於結束時

{

ppl = (t_wndprog_data *) Getsortedbyselection(&(ollylang->wndProg.data),line); //獲取分類數據

//reset executed color

if ((ppl->type & PROG_TYPE_COMMAND)) //忽略標籤和註釋ignore labels/comments

ppl->type &= PROG_TYPE_COMMAND;

strcpy(ppl->result,"");

strcpy(ppl->values,"");

//ppl->jumpto = 0;

ppl->eip = 0;

line++;

iter++;

}

InvalidateProgWindow();

}

int getProgLineType(int line)  //獲取行類型

{

t_wndprog_data *ppl;

ppl = (t_wndprog_data *) Getsortedbyselection(&(ollylang->wndProg.data),line);

if (ppl==NULL)

return false; 

return (ppl->type & PROG_TYPE);

}

int setProgLineAttr(int line,int type) 

{

t_wndprog_data *ppl;

ppl = (t_wndprog_data *) Getsortedbyselection(&(ollylang->wndProg.data),line);

if (ppl==NULL)

return false;

ppl->type &= PROG_TYPE;

ppl->type |= type;

return true;

}

int isProgLineComment(int line) 

{

t_wndprog_data *ppl;

ppl = (t_wndprog_data *) Getsortedbyselection(&(ollylang->wndProg.data),line);

if (ppl==NULL)

return false;

if (ppl->type & PROG_TYPE_COMMENT) 

{

return true;

}

return false;

}

int isProgLineBP(int line) 

{

t_wndprog_data *ppl;

ppl = (t_wndprog_data *) Getsortedbyselection(&(ollylang->wndProg.data),line);

if (ppl==NULL)

return false;

if (ppl->pause && ollylang->wndProg.hw) 

{

focusonstop=4;

}

return ppl->pause;

}

ODbgScript源碼學習(十七)

//Change type to 2 to hilite executed commands

int setProgLineEIP(int line, int eip)  //設置行EIP

{

if (line>ollylang->script.size()) return false; //如果參數line大於腳本大小返回假

t_wndprog_data *ppl;

ppl = (t_wndprog_data *) Getsortedbyselection(&(ollylang->wndProg.data),line); //獲取分類數據

if (!(ppl->type & PROG_TYPE_ASM)) //如果類型為彙編

ppl->type |= PROG_ATTR_EXECUTED; //執行

//if (!(ppl->type & PROG_TYPE_COMMAND) //命令

// return true; //返回真

    ppl->eip = eip; //eip指向參數eip

if (ollylang->wndProg.hw!=NULL)

{

if (!ollylang->require_ollyloop) { //如果不是循環

Selectandscroll(&ollylang->wndProg,ollylang->pgr_scriptpos,2); //選擇scroll

InvalidateProgWindow();

}

}

return true;

}

int setProgLineValue(int line, DWORD value)   //設置行值

{

char buf[17];

sprintf(buf, "%X", value); //打印值

string str(buf);

return setProgLineValue(line, str); //重載setProgLineValue

}

int setProgLineValue(int line, string  &value) 

{

if (line>ollylang->script.size()) return 0;  //參數line大於腳本大小返回0

t_wndprog_data *ppl;

ppl = (t_wndprog_data *) Getsortedbyselection(&(ollylang->wndProg.data),line);

if (!(ppl->type & PROG_TYPE_COMMAND))

return 1;

string values;

values = CleanString(value); //清除字符串

//變量歷史Variable History

if (ollylang->showVarHistory && strcmp(ppl->values,"")) { //顯示歷史

if ( values.length() < PROG_VAL_LEN-2) {

if (ppl->values[0] != ',' && ppl->values[0] != '?' && value.compare("?") != 0)

values += " ";

values.append(ppl->values);

}

}

strncpy(ppl->values,values.c_str(),PROG_VAL_LEN-1); //拷貝串

ppl->values[PROG_VAL_LEN-1] = 0;

InvalidateProgWindow();

return 1;

}

int setProgLineValueFloat(int line, long double value)  //設置行值

{

char buf[128];

sprintf(buf, "%lf", value); //打印

string str(buf); //定義字符串

while (true) //如果為真

{

if (str.length() <= 3) break;  //如果長度小於3,中斷

if (str[str.length()-1] == '0') //字符串最後一位為0

str.erase(str.length()-1,1); //刪除最後一個字符

else 

break;

}

return setProgLineValue(line, str); //設置行值

}

int setProgLineResult(int line, var& result) //設置行返回值

{

if (result.vt == DW) //如果參數var類型的vt為雙字節

setProgLineResult(line,result.dw); //調用DWORD類型的setProgLineResult

else if (result.vt == FLT)

setProgLineResultFloat(line,result.flt);

else {

if(result.str.length() && !result.isbuf)

setProgLineResult(line,"\""+result.str+"\"");

else {

setProgLineResult(line,result.str);

}

}

InvalidateProgWindow();

return true;

}