C++博客-紫雨轩 C++-随笔分类-Win32 SDK

权限提升代码

紫雨轩 C++ — Tue, 21 Aug 2007 16:04:00 GMT

void AdjustPrivilege(int pid, BOOL bEnable)
{
    HANDLE    hProcess;
  HANDLE    hToken=0;
    TOKEN_PRIVILEGES tkp;
  tkp.PrivilegeCount = 1;
  tkp.Privileges[0].Attributes = 0;
  if (bEnable)
    tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
  if (LookupPrivilegeValue(NULL, "SeDebugPrivilege", &tkp.Privileges[0].Luid))
  {
    if (hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid))
    {
      if (OpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY, &hToken))
      {
        if (AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, NULL, NULL))
        {
          CloseHandle(hToken);
        }
      }
      CloseHandle(hProcess);
    }
  }
}

紫雨轩 C++ 2007-08-22 00:04 发表评论

防止注入的代码

紫雨轩 C++ — Tue, 21 Aug 2007 16:03:00 GMT

#define PROTECTED_DACL_SECURITY_INFORMATION (0x80000000L)

BOOL Lock_CurrentProcess()
{
  HANDLE hProcess = ::GetCurrentProcess();
  SID_IDENTIFIER_AUTHORITY sia = SECURITY_WORLD_SID_AUTHORITY;
  PSID pSid;
  BOOL bSus = FALSE;
  bSus = ::AllocateAndInitializeSid(&sia,1,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,&pSid);
  if(!bSus) goto Cleanup;
  HANDLE hToken;
  bSus = ::OpenProcessToken(hProcess,TOKEN_QUERY,&hToken);
  if(!bSus) goto Cleanup;
  DWORD dwReturnLength;
  ::GetTokenInformation(hToken,TokenUser,NULL,NULL,&dwReturnLength);
  if(dwReturnLength > 0x400) goto Cleanup;
  LPVOID TokenInformation;
  TokenInformation = ::LocalAlloc(LPTR,0x400);//这里就引用SDK的函数不引用CRT的了
  DWORD dw;
  bSus = ::GetTokenInformation(hToken,TokenUser,TokenInformation,0x400,&dw);
  if(!bSus) goto Cleanup;
  PTOKEN_USER pTokenUser = (PTOKEN_USER)TokenInformation;
  BYTE Buf[0x200];
  PACL pAcl = (PACL)&Buf;
  bSus = ::InitializeAcl(pAcl,1024,ACL_REVISION);
  if(!bSus) goto Cleanup;
  bSus = ::AddAccessDeniedAce(pAcl,ACL_REVISION,0x000000FA,pSid);
  if(!bSus) goto Cleanup;
  bSus = ::AddAccessAllowedAce(pAcl,ACL_REVISION,0x00100701,pTokenUser->User.Sid);
  if(!bSus) goto Cleanup;
  if(::SetSecurityInfo(hProcess,SE_KERNEL_OBJECT,DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION,NULL,NULL,pAcl,NULL) == 0)
    bSus = TRUE;
Cleanup:
  if(hProcess != NULL)
    ::CloseHandle(hProcess);
  if(pSid != NULL)
    ::FreeSid(pSid);
  return bSus;
}

这段代码就可以锁住其他进程打开本进程,当然也就防止了注入,和读写内存.

可以更绝点Denied ALL ACCESS(0xFFFFFFFF)就连结束都不可能了

::AllocateAndInitializeSid 可以换成 :: InitializeSid .因为我们并不需要初始化子Sid.
另外.
  bSus = ::AddAccessDeniedAce(pAcl,ACL_REVISION,0x000000FA,pSid);
  if(!bSus) goto Cleanup;
  bSus = ::AddAccessAllowedAce(pAcl,ACL_REVISION,0x00100701,pTokenUser->User.Sid);
实际上只需要下面的一句,或者干脆把它去掉,因为如果不添加Ace默认就是没有权限.既然这样上面的那句话AllocateAndInitializeSid 也可以省掉,也似乎有些多余

紫雨轩 C++ 2007-08-22 00:03 发表评论

解决Vista下文件名中带Update不能通过UAC认证的问题

紫雨轩 C++ — Tue, 21 Aug 2007 15:58:00 GMT

       processorArchitecture="X86"
     name="IsUserAdmin"
     type="win32"/>
  QQUpdateCenter

                  level="asInvoker"
          uiAccess="false"/>




这段代码放到manifest资源中。

紫雨轩 C++ 2007-08-21 23:58 发表评论

utf8 编码方式

紫雨轩 C++ — Fri, 14 Jul 2006 17:13:00 GMT

编码方式
编码方式
下面的字节串用来表示一个字符。用什么串依照该字符在 UCS 编码中的序号来定：
0x00000000 - 0x0000007F:
0xxxxxxx
0x00000080 - 0x000007FF:
110xxxxx 10xxxxxx
0x00000800 - 0x0000FFFF:
1110xxxx 10xxxxxx 10xxxxxx
0x00010000 - 0x001FFFFF:
11110xxx 10xxxxxx 10xxxxxx 10xxxxxx
0x00200000 - 0x03FFFFFF:
111110xx 10xxxxxx 10xxxxxx 10xxxxxx 10xxxxxx
0x04000000 - 0x7FFFFFFF:
1111110x 10xxxxxx 10xxxxxx 10xxxxxx 10xxxxxx 10xxxxxx
这里 xxx 的位置二进制位形式的字符编码填入。只用最短的那个足够表达一个字符编码数的多字节串。

举例说明
Unicode 字符 0xa9 = 1010 1001 (版权所有的符号) 在 UTF-8 中被编码为：

11000010 10101001 = 0xc2 0xa9
字符0x2260 = 0010 0010 0110 0000 (“不等于”符号)被编码为：

11100010 10001001 10100000 = 0xe2 0x89 0xa0

''encode - 转成16进制符

For i = 1 To Len(strIN)
s = CStr(Hex(Asc(Mid(strIN, i, 1)))) ''是不是太~~~快了~~
If Len(s) = 1 Then s = "0" & s ''解出小于F的值就在前面加 0
strOUT = strOUT & "%" & s
Next i

txtOUT.Text = strOUT ''这里就是输出了
___________________________________________________________

''decode - 解码, 比较麻烦点

For i = 1 To Len(strIN) Step 3 '' Step 3 因为格式是 %XX 三位一个字符
s1 = UCase(Mid(strIN, i + 1, 1)) ''得到第2位的16进制数字
s2 = UCase(Mid(strIN, i + 2, 1)) ''得到第1位的16进制数字

select Case s1 '' 进制转换
Case "A" To "F"
n = (10 + 5 - (Asc("F") - Asc(s1))) * 16
Case Else
n = Val(s1) * 16
End select

select Case s2
Case "A" To "F"
n = n + (10 + 5 - (Asc("F") - Asc(s2)))
Case Else
n = n + Val(s2)
End select

s = ChrW$(n) '' 转为字符
strOUT = strOUT & s
Next i
txtOUT.Text = strOUT


怎么把字符串转成UTF-8格式？？？？

下面的代码不成功：
WCHAR  wstr[10];
char  cstr[20];
memset(  wstr,  0,  sizeof(wstr)  );
MultiByteToWideChar(CP_UTF8,  0,  "我是小于",  -1,  wstr,  sizeof(wstr));
WideCharToMultiByte(CP_ACP,  0,  wstr,  -1,  cstr,  -1,  "",  0);

求助。。。。
---------------------------------------------------------------

int    main(void)
{
           char    str    [    256    ]    =    "唐志国"    ;        //一段UTF-8编码
           WCHAR*    strA;
           int    i=    MultiByteToWideChar    (  CP_ACP      ,    0    ,(char*)    str    ,-1    ,NULL,0);
           strA    =    new    WCHAR[i];
           MultiByteToWideChar    (    CP_ACP    ,    0    ,(    char    *    )    str,    -1,    strA    ,    i);

           i=    WideCharToMultiByte(CP_UTF8,0,strA,-1,NULL,0,NULL,NULL);
           char    *strB=new    char[i];
           WideCharToMultiByte    (CP_UTF8,0,strA,-1,strB,i,NULL,NULL);
           //strB即为所求
           delete    []strA;
           delete    []strB;
           return    0;
}

---------------------------------------------------------------

这是转换函数：
           int            CodePageConvert(UINT  SrcCodePage,  LPCTSTR  pBuff,  int  iBuffLen,  UINT  DestCodePage,  char*  &lpCodePage)
           {
                       int  iWideCharCnt  =  ::MultiByteToWideChar(SrcCodePage,  0,  pBuff,  iBuffLen,  NULL,  0);
                       LPWSTR  lpszWideChar  =  new  wchar_t[iWideCharCnt  +  1];
                       memset(lpszWideChar,  0,  (iWideCharCnt  +  1)  *  sizeof(WCHAR));
                       iWideCharCnt  =  MultiByteToWideChar(SrcCodePage,  0,  pBuff,  iBuffLen,  lpszWideChar,  iWideCharCnt);

                       if(DestCodePage  ==  54936
                                               &&  !IsValidCodePage(54936))
                                   DestCodePage  =  936;

                       int  iDestCnt  =  WideCharToMultiByte(DestCodePage,  0,  lpszWideChar,  iWideCharCnt,  NULL,  0,  NULL,  NULL);
                       lpCodePage  =  new  char[iDestCnt  +  1];
                       memset(lpCodePage,  0,  iDestCnt  +  1);
                       iDestCnt  =  WideCharToMultiByte(DestCodePage,  0,  lpszWideChar,  iWideCharCnt,  lpCodePage,  iDestCnt,  NULL,  NULL);

                       delete  []lpszWideChar;
                       return  iDestCnt;
           }
下面是调用方法：
     utf-8  到  gbk
           int  nLen  =  CodePageConvertUnix("UTF-8",_T("标准"),2,"GBK",lpOut);
     gbk  到utf-8
int  nLen  =  CodePageConvertUnix("UTF-8",_T("标准"),2,"GBK",lpOut);

紫雨轩 C++ 2006-07-15 01:13 发表评论

VC中有没有DoEvents类似的函数?

紫雨轩 C++ — Fri, 14 Jul 2006 17:05:00 GMT

使用这样的函数：
    BOOL CheckMessageQueue()
    {
     MSG msg;

      while (PeekMessage( & msg, NULL, 0 , 0 , PM_REMOVE)){
      if (msg.message == WM_QUIT)
      return FALSE;
     TranslateMessage( & msg);
     DispatchMessage( & msg);
     }
      return TRUE;
    }

该函数可以实现DoEvents的效果。但有一点不同，如果该函数返回FALSE，说明用户按下了关闭按钮。

紫雨轩 C++ 2006-07-15 01:05 发表评论

获取指定内存所在的模块、当前模块、当前函数的返回模块

紫雨轩 C++ — Fri, 14 Jul 2006 17:04:00 GMT

利用一个函数VirtualQuery可以获取指定内存所在的模块：

inline HMODULE GetModuleFromAddr(PVOID p)
{
    MEMORY_BASIC_INFORMATION m = { 0 };
    VirtualQuery(p, &m, sizeof(MEMORY_BASIC_INFORMATION));
    return (HMODULE) m.AllocationBase;
}

有了上面的函数，就非常容易获取当前模块的句柄（比如在静态LIB链接到DLL的项目中，需要知道模块句柄的情况）：

HMODULE hThisModule = GetModuleFromAddr(当前模块中的任意函数或变量地址);

更进一步的应用，假如我们需要知道那个模块在调用自己，可以结合_ReturnAddress() intrinsic来实现：

全局声明：EXTERN_C PVOID _ReturnAddress();

调用：HMODULE hCallerModule = GetModuleFromAddr(_ReturnAddress());

紫雨轩 C++ 2006-07-15 01:04 发表评论

加载DLL注入到目标进程

紫雨轩 C++ — Fri, 14 Jul 2006 17:03:00 GMT

DWORD Bind(HANDLE hProcess, PCTSTR ptzPath)
{
    DWORD dwResult = 0 ;
    PVOID pvRemote = NULL;
    HANDLE hThread = NULL;
     do
    {
         if (hProcess == NULL)
        {
            dwResult = 1 ;
             break ;
        }

        DWORD dwSize = (lstrlen(ptzPath) + 1 ) * sizeof (TCHAR);
        pvRemote = VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE);
         if (pvRemote == NULL)
        {
            dwResult = 2 ;
             break ;
        }

         if ( ! WriteProcessMemory(hProcess, pvRemote, ptzPath, dwSize, NULL))
        {
            dwResult = 3 ;
             break ;
        }

        PTHREAD_START_ROUTINE pfnLoadLibraryW =
            (PTHREAD_START_ROUTINE) GetProcAddress(GetModuleHandle(TEXT( " Kernel32.dll " )), STR_LoadLibrary);
         if (pfnLoadLibraryW == NULL)
        {
            dwResult = 4 ;
             break ;
        }

        hThread = CreateRemoteThread(hProcess, NULL, 0 , pfnLoadLibraryW, pvRemote, 0 , NULL);
         if (hThread == NULL)
        {
            dwResult = 5 ;
             break ;
        }

        WaitForSingleObject(hThread, INFINITE);
    }
     while (FALSE);

     if (hThread)
    {
        CloseHandle(hThread);
    }
     if (pvRemote)
    {
        VirtualFreeEx(hProcess, pvRemote, 0 , MEM_RELEASE);
    }
     if (hProcess)
    {
        CloseHandle(hProcess);
    }

     return dwResult;
}

紫雨轩 C++ 2006-07-15 01:03 发表评论

get the PIII processor serial number (psn)

紫雨轩 C++ — Fri, 14 Jul 2006 16:57:00 GMT

CString GetProcessorSeialNumbet( bool withSeparator)
{
DWORD  t,m,b; // top,middle,botttom
DWORD * serial;
  _asm
  {
    mov   eax, 1 // programmer: I need a Service ?
          // processor: what type baby?
       // eax = 3 -->
        // eax: top 32 bits are the processor signature bits


        // programmer:this
    cpuid      // _emit 0x0f |cpuid mean this tow instruction
           // _emit 0xa2 |instead of writing them
        //
     // mean:the sevice i want the processor serial number

mov   t,eax // top 32 bits are the processor signature bits
            /*
          eax = 3 -->
        ecx: middle 32 bits are the processor signature bits
         edx: bottom 32 bits are the processor signature bits
       */
    mov   eax, 3
    cpuid
    mov   m,edx // middle 32 bits are the processor signature bits
    mov   b,ecx // bottom 32 bits are the processor signature bits
  }

   // copy the locals into the pointer variables passed in
  serial[ 0 ] = b;
  serial[ 1 ] = m;
  serial[ 2 ] = t;

CString temp,SN;
SN.Empty();
static char hex_chars[ 16 ] = { ' 0 ' , ' 1 ' , ' 2 ' , ' 3 ' , ' 4 ' , ' 5 ' , ' 6 ' , ' 7 ' ,
                  ' 8 ' , ' 9 ' , ' A ' , ' B ' , ' C ' , ' D ' , ' E ' , ' F ' };
for ( int dw_count = 2 ; dw_count >= 0 ; dw_count -- )
  {
     for ( int bp = 28 ; bp >= 0 ; bp -= 4 )
    {
      DWORD nibble = (serial[dw_count] >> bp) & 0x0f ;
      temp.Format( " %c " , hex_chars[nibble]);
   SN += temp;
       if ((bp == 16 ) || ((bp == 0 ) && (dw_count != 0 )) )
     if (withSeparator)SN += " - " ;
    }
  }
return SN;
}

紫雨轩 C++ 2006-07-15 00:57 发表评论

GetActiveWindow函数GetForegroundWindow

紫雨轩 C++ — Fri, 14 Jul 2006 16:51:00 GMT

GetActiveWindow返回线程的活动窗口，而不是系统的活动窗口。如果要得到用户正在激活的窗口，应该使用 GetForegroundWindow。

紫雨轩 C++ 2006-07-15 00:51 发表评论