ollymachine.cpp

Ollydbg环境下的一款插件源代码

    case WM_HSCROLL:
    case WM_VSCROLL:
    case WM_TIMER:
    case WM_SYSKEYDOWN:
        Tablefunction(&g_windowRecentFile,hw,msg,wp,lp);
        break;                           // Pass message to DefMDIChildProc()
        // Custom messages responsible for scrolling and selection. User-drawn
        // windows must process them, standard OllyDbg windows without extra
        // functionality pass them to Tablefunction().
    case WM_USER_SCR:
    case WM_USER_VABS:
    case WM_USER_VREL:
    case WM_USER_VBYTE:
    case WM_USER_STS:
    case WM_USER_CNTS:
    case WM_USER_CHGS:
        return Tablefunction(&g_windowRecentFile,hw,msg,wp,lp);
    case WM_USER_MENU:
    {
        menu = CreatePopupMenu();
        // Find selected bookmark. Any operations with bookmarks make sense
        // only if at least one bookmark exists and is selected. Note that
        // sorted data has special sort index table which is updated only
        // when necessary. Getsortedbyselection() does this; some other
        // sorted data functions don't and you must call Sortsorteddata().
        // Read documentation!
        pb = (RECENTFILE *)Getsortedbyselection(
            &(g_windowRecentFile.data),
            g_windowRecentFile.data.selected
        );
        if ((NULL != menu) && (NULL != pb)) 
        {
            AppendMenu(menu,MF_STRING, 1, "&Run\tEnter");
            AppendMenu(menu,MF_STRING, 2, "&Delete from list\tDel"); 
            AppendMenu(menu,MF_STRING, 3, "&Modify it by Notepad");
        }
        // Even when menu is NULL, call to Tablefunction is still meaningful.
        i = Tablefunction(
            &g_windowRecentFile,
            hw,
            WM_USER_MENU,
            0,
            (LPARAM)menu
        );
        if (NULL != menu)
            DestroyMenu(menu);

        CString strCommand;
        switch (i)
        {
        case 1:
            RunOMFile(pb->szFileName);
            break;
        case 2:
            // Delete bookmark
            Deletesorteddata(&(g_windowRecentFile.data), pb->index);
            ReSortOtherData(pb->index);
            // There is no automatical window update, do it yourself.
            InvalidateRect(hw, NULL, FALSE); 
            break;
        case 3:
            strCommand = "notepad.exe ";
            strCommand += pb->szFileName;
            WinExec(strCommand, SW_NORMAL);
            break;
        }
        return 0;
    }
    case WM_KEYDOWN:
    {
        // Processing of WM_KEYDOWN messages is - surprise, surprise - very
        // similar to that of corresponding menu entries.
        shiftkey = GetKeyState(VK_SHIFT) & 0x8000;
        controlkey = GetKeyState(VK_CONTROL) & 0x8000;    
        if ((VK_DELETE == wp) && (0 == shiftkey) && (0 == controlkey))
        {
            // DEL key deletes bookmark.
            pb = (RECENTFILE *)Getsortedbyselection(
                &(g_windowRecentFile.data),
                g_windowRecentFile.data.selected
            );
            if (NULL != pb)
            {
                Deletesorteddata(&(g_windowRecentFile.data), pb->index);
                ReSortOtherData(pb->index);
                InvalidateRect(hw, NULL, FALSE);
            }
        }
        else if(
            (0x0d == wp)/*enter key*/ &&
            (shiftkey == 0) &&
            (controlkey == 0)
        )
        {
            // Enter to execute script
            pb = (RECENTFILE *)Getsortedbyselection(
                &(g_windowRecentFile.data),
                g_windowRecentFile.data.selected
            );
            if (NULL != pb)
                RunOMFile(pb->szFileName);          
        }
        else
        {
            // Add all this arrow, home and pageup functionality.
            Tablefunction(&g_windowRecentFile, hw, msg, wp, lp);
        }
    }
      break;
    case WM_USER_DBLCLK:
        pb = (RECENTFILE *)Getsortedbyselection(
            &(g_windowRecentFile.data),
            g_windowRecentFile.data.selected
        );
        if (NULL != pb)
        {
            RunOMFile(pb->szFileName);          
        }
        return 1;                        // Doubleclick processed
    case WM_USER_CHALL:
    case WM_USER_CHMEM:
        // Something is changed, redraw window.
        InvalidateRect(hw, NULL, FALSE);
        return 0;
    case WM_PAINT:
        // Painting of all OllyDbg windows is done by Painttable(). Make custom
        // drawing only if you have important reasons to do this.
        Painttable(hw, &g_windowRecentFile, GetRecentFileText);
        return 0;
    default:
        break;
    }
    return DefMDIChildProc(hw, msg, wp, lp);
}

static void ShowAboutInfo()
{
    char szInfo[400];

    sprintf(
        szInfo,
        "OllyMachine plugin v%d.%02d\n"
        "Compiled on " __DATE__ ", " __TIME__ "\n\n"
        "Author  : Luo Cong\n"
        "Country : China\n"
        "Employer: Kingsoft Antivirus Engine Team\n"
        "Homepage: http://www.luocong.com\n"
        "E-Mail  : [e-mail]\n\n"
        "Special thanks to:\n"
        "\tSHaG, OllyScript's author\n"
        "\tBlue, wrote the PE dumpper\n"
        "\tpll621, wrote the \"Recent Files\"\n"
        "\nCopyLeft (C) All rights NOT reserved. ^_^",
        VERSIONHI,
        VERSIONLO
    );

    MessageBox(
        g_hWndMain,
        szInfo,
        g_szPluginName,
        MB_OK | MB_ICONINFORMATION
    );
}

extc int _export cdecl ODBG_Plugindata(char shortname[32])
{
//    AFX_MANAGE_STATE(AfxGetStaticModuleState());

    strcpy(shortname, g_szPluginName);
    return PLUGIN_VERSION;
}

extc int _export cdecl ODBG_Plugininit(
    int ollydbgversion,
    HWND hw,
    ulong *features
)
{
//    AFX_MANAGE_STATE(AfxGetStaticModuleState());

    int nRetCode;
    int nRetResult = 0;

    if (ollydbgversion < PLUGIN_VERSION)
    {
        nRetResult = -1;
        goto Exit0;
    }

    g_hWndMain = hw;

    nRetCode = Registerpluginclass(
        g_szOllyMachineClass,
        NULL,
        g_hInstance,
        OllyMachineWndProc
    );
    if (nRetCode < 0)
    {
        nRetResult = -1;
        goto Exit0;
    }

    // Report plugin in the log window.
    Addtolist(0, 0, "OllyMachine v%d.%02d", VERSIONHI, VERSIONLO);
    Addtolist(0, -1, "  Written by Luo Cong");
    Addtolist(0, -1, "  Compiled on " __DATE__ " " __TIME__);

    nRetCode = Createsorteddata(
        &(g_windowRecentFile.data),
        g_OM_RecentFiles,
        sizeof(RECENTFILE),
        NUM_OF_RECENT_FILE,
        (SORTFUNC *)RecentFileSortFunc,
        NULL
    );
    if (0 != nRetCode)
    {
        return -1;  // Unable to allocate recent file data
    }
    ReadAllRecentFileFormIni();

Exit0:
    return nRetResult;
}

extc void _export cdecl ODBG_Plugindestroy(void)
{
//    AFX_MANAGE_STATE(AfxGetStaticModuleState());
    Unregisterpluginclass(g_szOllyMachineClass);
}

extc int _export cdecl ODBG_Pluginmenu(int origin, char data[4096], void *item)
{
//    AFX_MANAGE_STATE(AfxGetStaticModuleState());
    if (PM_MAIN == origin)
    {
        strcpy(
            data,
            "0 &1 Run, 1 &2 Resume | 2 &3 Compile | 3 &4 About | "
            "4 &5 Recent Files\tAlt+R"
        );
        return 1;
    }
    return 0;
}

extc void _export cdecl ODBG_Pluginaction(int origin, int action, void *item)
{
//    AFX_MANAGE_STATE(AfxGetStaticModuleState());

    switch (origin)
    {
    case PM_MAIN:
        switch (action)
        {
        case 0:     // Run
            Run();
            break;
        case 1:     // Resume
            if (MCS_PAUSE == VM.GetStatus())
            {
                VM.SetStatus(MCS_RUNNING);
                VM.Execute();
            }
            break;
        case 2:     // Compile
            Compile();
            break;
        case 3:     // About
            ShowAboutInfo();
            break;
        case 4:     // Recent files
            CreateRecentFileWindow();
            break;
        default:
            break;
        }
        break;
    }
}

extc void _export cdecl ODBG_Pluginreset()
{
    VM.Reset();
}

extc int _export cdecl ODBG_Pluginclose()
{
    SaveAllRecentFileToIni();
    return 0;
}

extc int _export cdecl ODBG_Pausedex(
    int reason,
    int extdata,
    t_reg *reg,
    DEBUG_EVENT *debugevent
)
{
    MCSTATUS VM_status;

    VM_status = VM.GetStatus();

    if (MCS_BACKTOOD != VM_status)
        goto Exit0;

    switch (reason)
    {
    case PP_SINGLESTEP:
        VM.Execute();
        break;
    case PP_MEMBREAK:
        VM.JumpToMemBreakpointLable();
        VM.Execute();
        break;
    case PP_INT3BREAK:
        VM.JumpToInt3BreakpointLabel();
        VM.Execute();
        break;
    case PP_HWBREAK:
        VM.JumpToHWBreakpointLabel();
        VM.Execute();
        break;
    case PP_BYPROGRAM | PP_INT3BREAK:
        VM.JumpToInt3BreakpointLabel();
        VM.Execute();
        break;
    case PP_BYPROGRAM | PP_GUARDED:
    case PP_BYPROGRAM | PP_ACCESS:
    case PP_BYPROGRAM | PP_EXCEPTION:
        VM.JumpToExceptionLabel();
        VM.Execute();
    }

Exit0:
    return 0;
}

extern "C" int APIENTRY
DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
    // Remove this if you use lpReserved
    UNREFERENCED_PARAMETER(lpReserved);

    if (dwReason == DLL_PROCESS_ATTACH)
    {
        TRACE0("OLLYMACHINE.DLL Initializing!\n");
        g_hInstance = hInstance;

        GetModuleFileName(hInstance, g_szIniFilePathName, MAX_PATH);
        // Extension DLL one-time initialization
        if (!AfxInitExtensionModule(OllyMachineDLL, hInstance))
            return 0;

        // Insert this DLL into the resource chain
        // NOTE: If this Extension DLL is being implicitly linked to by
        //  an MFC Regular DLL (such as an ActiveX Control)
        //  instead of an MFC application, then you will want to
        //  remove this line from DllMain and put it in a separate
        //  function exported from this Extension DLL.  The Regular DLL
        //  that uses this Extension DLL should then explicitly call that
        //  function to initialize this Extension DLL.  Otherwise,
        //  the CDynLinkLibrary object will not be attached to the
        //  Regular DLL's resource chain, and serious problems will
        //  result.

        new CDynLinkLibrary(OllyMachineDLL);
    }
    else if (dwReason == DLL_PROCESS_DETACH)
    {
        TRACE0("OLLYMACHINE.DLL Terminating!\n");
       // Terminate the library before destructors are called
        AfxTermExtensionModule(OllyMachineDLL);
    }
    return 1;   // ok
}