gsar.h

此为破解装载器一书中的源代码,在看雪论坛下载的,

/* gsar.h ***************************************** UPDATED: 2002-11-07 20:19 TT
 *
 * Description : Header file for gsar
 * Author      : Tormod Tjaberg
 *
 * Changes Shub-Nigurrath:
 * - converted to C++ sources
 * - added Memorysearch functions
 * - added base class support CAccessMemory
 * - modified the Control classes
 *
 * Currently compiles under :
 * Turbo C 2.0, Turbo C++ 1.0, Turbo C++ 3.0, Zortech C++ 3.0,
 * Watcom C 386 8.0, Ultrix ANSI C, Microsoft 6.0, GCC
 */


/* System type defined upon the following
 * __TURBOC__ : All Borland C/C++ versions
 * __ZTC__    : Zortech/Symantec
 * __DJGPP__  : DJ Delorie's GNU port to the PC
 * __WATCOMC__: Watcom C/C++
 * __MINGW32__: MinGW
 * MSDOS      : Set by various DOS compilers... ( Watcom 386, Microsoft )
 */

#ifndef GCSAR_H
#define _GCSAR_H

#include <afxwin.h>

#include "AccessMemory.h"

#if defined(__TURBOC__) || defined(__ZTC__) || defined(MSDOS) || defined(__DJGPP__) || defined (__WATCOMC__) || defined (__MINGW32__)
#ifndef MSDOS
#define MSDOS     5
#endif
#else
#ifndef __UNIX__
#define __UNIX__  3
#endif
#endif

#ifndef BUFSIZ                            /* ANSI C predefined constant */
#ifdef  MSDOS
#define BUFSIZ 1024                       /* size of search buffer */
#else             /* its __UNIX__ */
#define BUFSIZ 4048                       /* size of search buffer */
#endif
#endif

#define TXT_CONTEXT 80      /* length of textual context     */
#define HEX_CONTEXT 64      /* amount of hex bytes displayed */
#define PAT_BUFSIZ  128     /* buffer limit < unsigned short */

#define LARGE  (BUFSIZ + PAT_BUFSIZ)  /* overshoot purposes */

class OUTPUT_CTRL_BASE {
public:
   signed char fVerbose;    /* true if we are to be verbose */
   signed char fTextual;    /* display context textual */
   signed char fHex;        /* display contents in hex */
   FILE *fpMsg;             /* message stream */
   unsigned short Context;  /* length of context to display */
   unsigned long fLastOffset;		/* file offset of the last found matching pattern */
};

class OUTPUT_CTRL: public OUTPUT_CTRL_BASE
{
public:
   signed char fByteOffset; /* display byte offset in file */
   signed char fFileSpec;   /* display filespec */
   char *pInputFile;        /* current input file name */
   FILE *fpIn;              /* input stream */
   FILE *fpOut;             /* output stream */
} ;

class BMG_gsar: public CAccessMemory {

private:

	/* Variables needed to perform the BMG search. 
	*/
	int            BMG_Patlen;                        /* length of pattern */
	unsigned char  BMG_Pattern[PAT_BUFSIZ];           /* actual pattern */
	int            BMG_Delta0[256];                   /* ascii only */
	unsigned char  BMG_Buffer[BUFSIZ + PAT_BUFSIZ];   /* search buffer */
	unsigned char  BMG_Cmap[256];
	
	void VerboseBase(OUTPUT_CTRL_BASE *pCtrl, unsigned long FileOfs, int BufOfs,
              unsigned char *pStart, unsigned char *pEnd);
	void Verbose(OUTPUT_CTRL *pCtrl, unsigned long FileOfs, int BufOfs,
              unsigned char *pStart, unsigned char *pEnd);


public:
	/* function prototypes
	 */
	BMG_gsar();
	void BMG_Setup(char *pat, int PatLen, char fFolded);
	
	long BMG_Search(OUTPUT_CTRL *pCtrl);
	long BMG_SearchReplace(OUTPUT_CTRL *pCtrl, char *pReplaceBuf, unsigned short nReplace);
	
	long BMG_MemorySearch(OUTPUT_CTRL_BASE *pCtrl, HANDLE hProcess, 
						DWORD startAddr, DWORD endAddr);
	long BMG_MemorySearchReplace(OUTPUT_CTRL_BASE *pCtrl, HANDLE hProcess, 
								DWORD startAddr, DWORD endAddr, 
								char *pReplaceBuf, unsigned short nReplace);

	//These are utility functions used by the caller to do some extra things on the used
	//search pattern.
	int GetCurrentPatlen() { return BMG_Patlen; } 
	const unsigned char* GetCurrentPattern() { return BMG_Pattern; }

};

#endif //_GCSAR_H