diff --git a/main.cpp b/main.cpp index 8258d1b..ee9f685 100644 --- a/main.cpp +++ b/main.cpp @@ -1513,6 +1513,354 @@ return WideToString(stringBuffer); #endif } +/* another massive block +2453128674613097462347362402316408372462317652378652397816478164234 +4237842134623140236403264236492173643219462193487621394612983746973424 +242347623947623987462378462398746239187463298746987462398764728936428379462 +248764923864698723498237698327649823764879264928736482379642713642] + +33424234234 +234234234 +231423423 +4234234 +*/ + +std::string GetWindowTitle(HANDLE hproc) { + // in this function, we will get the window title of the program + // by once again readding the peb + // it will replace the "Process" entry because + // currently its a bit redundant + // this will be a bit more helpful while still being basically instant + // and if its a headless program it doesn't matter much since its going to be the .exe name either way + // which would be the same as not reading the PEB so better to try than nothing +#ifdef _M_X64 + + +BOOL isWow64 = FALSE; +if (!IsWow64Process(hproc, &isWow64)) { + return ""; // in this case, we don't need to return an error code if it fails, we just silently fall back + // to the existing target name we already had so it doesn't matter much +} +bool isWoW64 = isWow64; + +if (!isWoW64) { + +typedef NTSTATUS (WINAPI *pNtQueryInformationProcess)(HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG); +auto queryInfo = (pNtQueryInformationProcess)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryInformationProcess"); +if (!queryInfo) { + return ""; +} + +PROCESS_BASIC_INFORMATION pbi; +if (queryInfo(hproc, ProcessBasicInformation, &pbi, sizeof(pbi), NULL) != 0) { + + return ""; +} + +PVOID procParamPtr = nullptr; +if (!ReadProcessMemory(hproc, (BYTE*)pbi.PebBaseAddress + 0x20, &procParamPtr, sizeof(PVOID), NULL)) { + return ""; +} + +UNICODE_STRING cmdLStruct; +SIZE_T bytesRead2 = 0; +if (!ReadProcessMemory(hproc, (BYTE*)procParamPtr + 0xB0, &cmdLStruct, sizeof(cmdLStruct), &bytesRead2)) { + return ""; +} + +if (cmdLStruct.Length == 0 || (cmdLStruct.Length % sizeof(wchar_t)) != 0 || cmdLStruct.Length > 65534) { + return ""; +} + +size_t wchar_count = cmdLStruct.Length / sizeof(wchar_t); +std::vector buffer(wchar_count + 1, 0); +if (!ReadProcessMemory(hproc, cmdLStruct.Buffer, buffer.data(), cmdLStruct.Length, NULL)) +{ + return ""; +} + +std::wstring stringBuffer = buffer.data(); +return WideToString(stringBuffer); + + +} else { + auto queryInfo = (pNtQueryInformationProcess)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryInformationProcess"); + if (!queryInfo) { + return ""; + } + + ULONG_PTR peb32Address = 0; + NTSTATUS status = queryInfo(hproc, ProcessWow64Information, &peb32Address, sizeof(peb32Address), NULL); + if (status != 0 || peb32Address == 0) { + return ""; + } + + ULONG procParamPtr32 = 0; + if (!ReadProcessMemory(hproc, (BYTE*)peb32Address + 0x10, &procParamPtr32, sizeof(procParamPtr32), NULL)) { + return ""; + } + + UNICODE_STRING32 cmdLStruct32{}; + if (!ReadProcessMemory(hproc, (BYTE*)(ULONG_PTR)procParamPtr32 + 0x70, &cmdLStruct32, sizeof(cmdLStruct32), NULL)) { + return ""; + } + + if (cmdLStruct32.Length == 0 || (cmdLStruct32.Length % sizeof(wchar_t)) != 0 || cmdLStruct32.Length > 65534) { + return ""; + } + + size_t wchar_count = cmdLStruct32.Length / sizeof(wchar_t); + std::vector buffer(wchar_count + 1, 0); + if (!ReadProcessMemory(hproc, (PVOID)(ULONG_PTR)cmdLStruct32.Buffer, buffer.data(), cmdLStruct32.Length, NULL)) + { + return ""; + } + + std::wstring stringBuffer = buffer.data(); + return WideToString(stringBuffer); +} + #elif defined(_M_IX86) + BOOL areWeWoW64 = FALSE; + IsWow64Process(GetCurrentProcess(), &areWeWoW64); + if (!areWeWoW64) { + typedef NTSTATUS (WINAPI *pNtQueryInformationProcess)(HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG); +auto queryInfo = (pNtQueryInformationProcess)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryInformationProcess"); +if (!queryInfo) { + return ""; +} + +PROCESS_BASIC_INFORMATION pbi; +if (queryInfo(hproc, ProcessBasicInformation, &pbi, sizeof(pbi), NULL) != 0) { + + return ""; +} + +PVOID procParamPtr = nullptr; +if (!ReadProcessMemory(hproc, (BYTE*)pbi.PebBaseAddress + 0x10, &procParamPtr, sizeof(PVOID), NULL)) { + return ""; +} + +UNICODE_STRING cmdLStruct; +SIZE_T bytesRead2 = 0; +if (!ReadProcessMemory(hproc, (BYTE*)procParamPtr + 0x70, &cmdLStruct, sizeof(cmdLStruct), &bytesRead2)) { + return ""; +} + +if (cmdLStruct.Length == 0 || (cmdLStruct.Length % sizeof(wchar_t)) != 0 || cmdLStruct.Length > 65534) { + return ""; +} + +size_t wchar_count = cmdLStruct.Length / sizeof(wchar_t); +std::vector buffer(wchar_count + 1, 0); +if (!ReadProcessMemory(hproc, cmdLStruct.Buffer, buffer.data(), cmdLStruct.Length, NULL)) +{ + return ""; +} + +std::wstring stringBuffer = buffer.data(); +return WideToString(stringBuffer); +} else { + + BOOL targetIsWow64 = FALSE; + + IsWow64Process(hproc, &targetIsWow64); + if (targetIsWow64) { + + typedef NTSTATUS (WINAPI *pNtQueryInformationProcess)(HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG); +auto queryInfo = (pNtQueryInformationProcess)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryInformationProcess"); +if (!queryInfo) { + return ""; +} + +PROCESS_BASIC_INFORMATION pbi; +if (queryInfo(hproc, ProcessBasicInformation, &pbi, sizeof(pbi), NULL) != 0) { + + return ""; +} + +PVOID procParamPtr = nullptr; +if (!ReadProcessMemory(hproc, (BYTE*)pbi.PebBaseAddress + 0x10, &procParamPtr, sizeof(PVOID), NULL)) { + return ""; +} + +UNICODE_STRING cmdLStruct; +SIZE_T bytesRead2 = 0; +if (!ReadProcessMemory(hproc, (BYTE*)procParamPtr + 0x70, &cmdLStruct, sizeof(cmdLStruct), &bytesRead2)) { + return ""; +} + +if (cmdLStruct.Length == 0 || (cmdLStruct.Length % sizeof(wchar_t)) != 0 || cmdLStruct.Length > 65534) { + return ""; +} + +size_t wchar_count = cmdLStruct.Length / sizeof(wchar_t); +std::vector buffer(wchar_count + 1, 0); +if (!ReadProcessMemory(hproc, cmdLStruct.Buffer, buffer.data(), cmdLStruct.Length, NULL)) +{ + return ""; +} + +std::wstring stringBuffer = buffer.data(); +return WideToString(stringBuffer); + + } else { + + HMODULE ntdll = GetModuleHandleA("ntdll.dll"); + auto queryInfo64 = (pNtWow64QueryInformationProcess64)GetProcAddress(ntdll, "NtWow64QueryInformationProcess64"); + auto readMem64 = (pNtWow64ReadVirtualMemory64)GetProcAddress(ntdll, "NtWow64ReadVirtualMemory64"); + + if (!queryInfo64 || !readMem64) { + return ""; + } + + HANDLE targetHandle = hproc; + HANDLE openedHandle = NULL; + DWORD targetPid = 0; + if (hproc != NULL) { + targetPid = GetProcessId(hproc); + } + if (targetPid != 0) { + openedHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, targetPid); + if (openedHandle) targetHandle = openedHandle; + } + + PROCESS_BASIC_INFORMATION64 pbi64{}; + ULONG returnLen = 0; + NTSTATUS status = queryInfo64(targetHandle, ProcessBasicInformation, &pbi64, sizeof(pbi64), &returnLen); + ULONG64 peb64Address = pbi64.PebBaseAddress; + if (status != 0 || peb64Address == 0) { + if (openedHandle) CloseHandle(openedHandle); + return ""; + } + + ULONG64 procParamPtr64 = 0; + status = readMem64(targetHandle, peb64Address + 0x20, &procParamPtr64, sizeof(procParamPtr64), NULL); + if (status != 0) { + if (openedHandle) CloseHandle(openedHandle); + return ""; + } + + UNICODE_STRING64 cmdLStruct64; + status = readMem64(targetHandle, procParamPtr64 + 0xB0, &cmdLStruct64, sizeof(cmdLStruct64), NULL); + if (status != 0) { + if (openedHandle) CloseHandle(openedHandle); + return ""; + } + + if (cmdLStruct64.Length == 0 || (cmdLStruct64.Length % sizeof(wchar_t)) != 0 || cmdLStruct64.Length > 65534) { + if (openedHandle) CloseHandle(openedHandle); + return ""; + } + + size_t wchar_count = cmdLStruct64.Length / sizeof(wchar_t); + std::vector buffer(wchar_count + 1, 0); + status = readMem64(targetHandle, cmdLStruct64.Buffer, buffer.data(), cmdLStruct64.Length, NULL); + if (status != 0) { + if (openedHandle) CloseHandle(openedHandle); + return ""; + } + + if (openedHandle) CloseHandle(openedHandle); + std::wstring wstr(buffer.data()); + return WideToString(wstr); + + + + } + +} + #elif defined(_M_ARM64) + + +BOOL isWow64 = FALSE; +if (!IsWow64Process(hproc, &isWow64)) { + return ""; +} +bool isWoW64 = isWow64; + +if (!isWoW64) { + +typedef NTSTATUS (WINAPI *pNtQueryInformationProcess)(HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG); +auto queryInfo = (pNtQueryInformationProcess)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryInformationProcess"); + +if (!queryInfo) { + return ""; +} + +PROCESS_BASIC_INFORMATION pbi; +if (queryInfo(hproc, ProcessBasicInformation, &pbi, sizeof(pbi), NULL) != 0) { + + return ""; +} + +PVOID procParamPtr = nullptr; +if (!ReadProcessMemory(hproc, (BYTE*)pbi.PebBaseAddress + 0x20, &procParamPtr, sizeof(PVOID), NULL)) { + return ""; +} + +UNICODE_STRING cmdLStruct; +SIZE_T bytesRead2 = 0; +if (!ReadProcessMemory(hproc, (BYTE*)procParamPtr + 0xB0, &cmdLStruct, sizeof(cmdLStruct), &bytesRead2)) { + return ""; +} + +if (cmdLStruct.Length == 0 || (cmdLStruct.Length % sizeof(wchar_t)) != 0 || cmdLStruct.Length > 65534) { + return ""; +} + +size_t wchar_count = cmdLStruct.Length / sizeof(wchar_t); +std::vector buffer(wchar_count + 1, 0); +if (!ReadProcessMemory(hproc, cmdLStruct.Buffer, buffer.data(), cmdLStruct.Length, NULL)) +{ + return ""; +} + +std::wstring stringBuffer = buffer.data(); +return WideToString(stringBuffer); + + +} else { + + auto queryInfo = (pNtQueryInformationProcess)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryInformationProcess"); + if (!queryInfo) { + return ""; + } + + ULONG_PTR peb32Address = 0; + NTSTATUS status = queryInfo(hproc, ProcessWow64Information, &peb32Address, sizeof(peb32Address), NULL); + if (status != 0 || peb32Address == 0) { + return ""; + } + + ULONG procParamPtr32 = 0; + if (!ReadProcessMemory(hproc, (BYTE*)peb32Address + 0x10, &procParamPtr32, sizeof(procParamPtr32), NULL)) { + return ""; + } + + UNICODE_STRING32 cmdLStruct32{}; + if (!ReadProcessMemory(hproc, (BYTE*)(ULONG_PTR)procParamPtr32 + 0x70, &cmdLStruct32, sizeof(cmdLStruct32), NULL)) { + return ""; + } + + if (cmdLStruct32.Length == 0 || (cmdLStruct32.Length % sizeof(wchar_t)) != 0 || cmdLStruct32.Length > 65534) { + return ""; + } + + size_t wchar_count = cmdLStruct32.Length / sizeof(wchar_t); + std::vector buffer(wchar_count + 1, 0); + if (!ReadProcessMemory(hproc, (PVOID)(ULONG_PTR)cmdLStruct32.Buffer, buffer.data(), cmdLStruct32.Length, NULL)) + { + return ""; + } + + std::wstring stringBuffer = buffer.data(); + return WideToString(stringBuffer); +} +#else + return ""; +#endif +} + void PrintAncestry(DWORD pid, HANDLE hSnapshot, const std::unordered_map& pidMap) { // now we're geting the name // we're making it slower by adding a bunch of snapshots @@ -1755,22 +2103,7 @@ void PIDinspect(const std::vector& pids, const std::vector& pidMap.emplace(pe32.th32ProcessID, pe32); } while (Process32Next(hshot, &pe32)); } - std::string procName = GetProcessNameFromPid(pid, hshot); - if (virtualTerminalEnabled) { - if (procName == ""){ - std::cout << "\033[34mTarget:\033[0m N/A\n\033[34mProcess:\033[0m N/A\n"; - } else { - std::cout << "\033[34mTarget:\033[0m " << procName << "\033[0m" << std::endl; - std::cout << "\033[34mProcess:\033[0m " << procName << "\033[90m (pid " << std::to_string(pid) << ")\033[0m" << std::endl; - } - } else { - if (procName == ""){ - std::cout << "Target: N/A\nProcess: N/A\n"; - } else { - std::cout << "Target: " << procName << std::endl; - std::cout << "Process: " << procName << " (pid " << std::to_string(pid) << ")" << std::endl; - } - } + @@ -1813,6 +2146,35 @@ void PIDinspect(const std::vector& pids, const std::vector& } + std::string procName = GetProcessNameFromPid(pid, hshot); + std::string process = GetWindowTitle(hProcess); + + + if (virtualTerminalEnabled) { + if (!process.empty()) { + std::cout << "\033[34mTarget:\033[0m " << procName << "\033[0m" << std::endl; + std::cout << "\033[34mProcess:\033[0m " << process << "\033[90m (pid " << std::to_string(pid) << ")\033[0m" << std::endl; + } else + if (procName == "") { + std::cout << "\033[34mTarget:\033[0m N/A\n\033[34mProcess:\033[0m N/A\n"; + } else { + std::cout << "\033[34mTarget:\033[0m " << procName << "\033[0m" << std::endl; + std::cout << "\033[34mProcess:\033[0m " << procName << "\033[90m (pid " << std::to_string(pid) << ")\033[0m" << std::endl; + } + } else { + if (!process.empty()) { + std::cout << "Target: " << procName << std::endl; + std::cout << "Process: " << process << " (pid " << std::to_string(pid) << ")" << std::endl; + } else { + if (procName == ""){ + std::cout << "Target: N/A\nProcess: N/A\n"; + } else { + std::cout << "Target: " << procName << std::endl; + std::cout << "Process: " << procName << " (pid " << std::to_string(pid) << ")" << std::endl; + } + + } + } char exePath[MAX_PATH] = {0}; @@ -2070,6 +2432,8 @@ ProcInfos findMyProc(const char *procname, HANDLE hSnapshot) { int main(int argc, char* argv[]) { + + SetConsoleTitle(TEXT("Windows - Why Is This Running?")); SetConsoleOutputCP(CP_UTF8); virtualTerminalEnabled = IsVirtualTerminalModeEnabled(); for (int i = 0; i < argc; ++i) {