vm.cpp

Ollydbg环境下的一款插件源代码

    if (nRetCode)
        return 2;
    nRetCode = lValue & 0x00ffffff;
    if (nRetCode)
        return 1;

    return 0;
}

int CVM::DoFindOpcode()
{
    int nRetResult = 0;
    int nRetCode;

    long lOpcode;
    unsigned long ulAddr;
    unsigned char cmd[MAXCMDSIZE];
    t_memory *pMem;
    t_disasm da;
    unsigned long ulRange;
    int nOpcodeSize;
    long lOpcode1;
    int nFound = 0;

    nRetCode = Pop((long *)&ulAddr);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lOpcode);
    OM_PROCESS_ERROR(nRetCode);

    pMem = Findmemory(ulAddr);
    OM_PROCESS_ERROR(pMem);

    ulRange = pMem->base + pMem->size;

    nOpcodeSize = GetOpcodeSize(lOpcode);

    do
    {
        nRetCode = Readcommand(ulAddr, (char *)cmd);
        OM_PROCESS_ERROR(nRetCode);

        lOpcode1 = *(long *)&cmd[0];
        switch (nOpcodeSize)
        {
        case 1:
            lOpcode1 = lOpcode1 & 0x000000FF;
            break;
        case 2:
            lOpcode1 = lOpcode1 & 0x0000FFFF;
            FIXENDIAN16(lOpcode1);
            break;
        case 3:
            lOpcode1 = lOpcode1 & 0x00FFFFFF;
            FIXENDIAN24(lOpcode1);
            break;
        }
        if (lOpcode == lOpcode1)
        {
            SetRetVal(ulAddr);
            nFound = 1;
            goto Exit1;
        }

        ulAddr += Disasm(cmd, MAXCMDSIZE, ulAddr, NULL, &da, DISASM_SIZE, 0);
    } while (ulAddr <= ulRange);

Exit1:
    nRetResult = 1;
Exit0:
    if (0 == nFound)
        SetRetVal(-1);
    return nRetResult;
}

int CVM::DoFind()
{
    int nRetResult = 0;
    int nRetCode;

    unsigned long ulAddr;
    long lOpcodeDataOffset;
    char szCode[MAXCMDSIZE * 2];
    unsigned int unCodeLen;
    unsigned char cmd[MAXCMDSIZE];
    t_memory *pMem;
    unsigned long ulRange;
    unsigned char ch;
    char chCode[3];
    unsigned long ulByteValue;
    int nFound = 0;
    unsigned int unIndex;
    unsigned long ulBase;
    unsigned long ulSize;

    nRetCode = Pop((long *)&ulAddr);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lOpcodeDataOffset);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = CheckDataAddrValid(lOpcodeDataOffset);
    if (0 == nRetCode)
    {
        if (NULL != m_listMallocMemAddr.Find(lOpcodeDataOffset))
        {
            unCodeLen = strlen((char *)lOpcodeDataOffset);
            if (
                (unCodeLen >= MAXCMDSIZE * 2) ||
                (unCodeLen % 2)
            )
                goto Exit0;

            strncpy(szCode, (char *)lOpcodeDataOffset, unCodeLen + 1);
        }
        else
            goto Exit0;
    }
    else
    {
        unCodeLen = strlen(&m_Data[lOpcodeDataOffset]);
        if (
            (unCodeLen >= MAXCMDSIZE * 2) ||
            (unCodeLen % 2)
        )
            goto Exit0;

        strncpy(szCode, &m_Data[lOpcodeDataOffset], unCodeLen + 1);
    }

    pMem = Findmemory(ulAddr);
    OM_PROCESS_ERROR(pMem);

    ulBase = pMem->base;
    ulSize = pMem->size;
    ulRange = ulBase + ulSize;

    chCode[2] = '\0';
    do
    {
        nRetCode = Readcommand(ulAddr, (char *)cmd);
        OM_PROCESS_ERROR(nRetCode);

        unIndex = 0;
        do
        {
            *(short *)chCode = *(short *)&szCode[unIndex];
            unIndex += 2;
            if (unIndex > unCodeLen)
            {
                SetRetVal(ulAddr);
                nFound = 1;
                goto Exit1;
            }
            if (('?' == chCode[0]) && ('?' == chCode[1]))
            {
                ulByteValue = ch;
                continue;
            }
            ulByteValue = strtoul(chCode, NULL, 16);
            ch = *(unsigned char *)&cmd[(unIndex - 2) / 2];
        } while (ch == ulByteValue);

//        ulAddr += Disasm(cmd, MAXCMDSIZE, ulAddr, NULL, &da, DISASM_SIZE, 0);
        if (ulAddr >= ulRange)
            break;
        ulAddr = Disassembleforward(NULL, ulBase, ulSize, ulAddr, 1, 0);
    } while (ulAddr <= ulRange);

Exit1:
    nRetResult = 1;
Exit0:
    if (0 == nFound)
        SetRetVal(-1);
    return nRetResult;
}

int CVM::DoReverseFind()
{
    int nRetResult = 0;
    int nRetCode;

    unsigned long ulAddr;
    long lOpcodeDataOffset;
    char szCode[MAXCMDSIZE * 2];
    unsigned int unCodeLen;
    unsigned char cmd[MAXCMDSIZE];
    t_memory *pMem;
    unsigned char ch;
    char chCode[3];
    unsigned long ulByteValue;
    int nFound = 0;
    unsigned int unIndex;
    unsigned long ulBase;
    unsigned long ulSize;

    nRetCode = Pop((long *)&ulAddr);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lOpcodeDataOffset);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = CheckDataAddrValid(lOpcodeDataOffset);
    if (0 == nRetCode)
    {
        if (NULL != m_listMallocMemAddr.Find(lOpcodeDataOffset))
        {
            unCodeLen = strlen((char *)lOpcodeDataOffset);
            if (
                (unCodeLen >= MAXCMDSIZE * 2) ||
                (unCodeLen % 2)
            )
                goto Exit0;

            strncpy(szCode, (char *)lOpcodeDataOffset, unCodeLen + 1);
        }
        else
            goto Exit0;
    }
    else
    {
        unCodeLen = strlen(&m_Data[lOpcodeDataOffset]);
        if (
            (unCodeLen >= MAXCMDSIZE * 2) ||
            (unCodeLen % 2)
        )
            goto Exit0;

        strncpy(szCode, &m_Data[lOpcodeDataOffset], unCodeLen + 1);
    }

    pMem = Findmemory(ulAddr);
    OM_PROCESS_ERROR(pMem);

    ulBase = pMem->base;
    ulSize = pMem->size;

    chCode[2] = '\0';
    do
    {
        nRetCode = Readcommand(ulAddr, (char *)cmd);
        OM_PROCESS_ERROR(nRetCode);

        unIndex = 0;
        do
        {
            *(short *)chCode = *(short *)&szCode[unIndex];
            unIndex += 2;
            if (unIndex > unCodeLen)
            {
                SetRetVal(ulAddr);
                nFound = 1;
                goto Exit1;
            }
            if (('?' == chCode[0]) && ('?' == chCode[1]))
            {
                ulByteValue = ch;
                continue;
            }
            ulByteValue = strtoul(chCode, NULL, 16);
            ch = *(unsigned char *)&cmd[(unIndex - 2) / 2];
        } while (ch == ulByteValue);

        if (ulAddr <= ulBase)
            break;
        ulAddr = Disassembleback(NULL, ulBase, ulSize, ulAddr, 1, 0);
    } while (ulAddr >= ulBase);

Exit1:
    nRetResult = 1;
Exit0:
    if (0 == nFound)
        SetRetVal(-1);
    return nRetResult;
}

int CVM::DoSearch()
{
    int nRetResult = 0;
    int nRetCode;

    unsigned long ulAddr;
    long lOpcodeDataOffset;
    char szCode[MAXCMDSIZE * 2];
    unsigned int unCodeLen;
    unsigned char cmd[MAXCMDSIZE];
    t_memory *pMem;
    unsigned long ulRange;
    unsigned char ch;
    char chCode[3];
    unsigned long ulByteValue;
    int nFound = 0;
    unsigned int unIndex;

    nRetCode = Pop((long *)&ulAddr);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lOpcodeDataOffset);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = CheckDataAddrValid(lOpcodeDataOffset);
    if (0 == nRetCode)
    {
        if (NULL != m_listMallocMemAddr.Find(lOpcodeDataOffset))
        {
            unCodeLen = strlen((char *)lOpcodeDataOffset);
            if (
                (unCodeLen >= MAXCMDSIZE * 2) ||
                (unCodeLen % 2)
            )
                goto Exit0;

            strncpy(szCode, (char *)lOpcodeDataOffset, unCodeLen + 1);
        }
        else
            goto Exit0;
    }
    else
    {
        unCodeLen = strlen(&m_Data[lOpcodeDataOffset]);
        if (
            (unCodeLen >= MAXCMDSIZE * 2) ||
            (unCodeLen % 2)
        )
            goto Exit0;

        strncpy(szCode, &m_Data[lOpcodeDataOffset], unCodeLen + 1);
    }

    pMem = Findmemory(ulAddr);
    OM_PROCESS_ERROR(pMem);

    ulRange = pMem->base + pMem->size;

    chCode[2] = '\0';
    do
    {
        nRetCode = Readcommand(ulAddr, (char *)cmd);
        OM_PROCESS_ERROR(nRetCode);

        unIndex = 0;
        do
        {
            *(short *)chCode = *(short *)&szCode[unIndex];
            unIndex += 2;
            if (unIndex > unCodeLen)
            {
                SetRetVal(ulAddr);
                nFound = 1;
                goto Exit1;
            }
            if (('?' == chCode[0]) && ('?' == chCode[1]))
            {
                ulByteValue = ch;
                continue;
            }
            ulByteValue = strtoul(chCode, NULL, 16);
            ch = *(unsigned char *)&cmd[(unIndex - 2) / 2];
        } while (ch == ulByteValue);

        if (ulAddr >= ulRange)
            break;
        ++ulAddr;
    } while (ulAddr <= ulRange);

Exit1:
    nRetResult = 1;
Exit0:
    if (0 == nFound)
        SetRetVal(-1);
    return nRetResult;
}

int CVM::DoReverseSearch()
{
    int nRetResult = 0;
    int nRetCode;

    unsigned long ulAddr;
    long lOpcodeDataOffset;
    char szCode[MAXCMDSIZE * 2];
    unsigned int unCodeLen;
    unsigned char cmd[MAXCMDSIZE];
    t_memory *pMem;
    unsigned char ch;
    char chCode[3];
    unsigned long ulByteValue;
    int nFound = 0;
    unsigned int unIndex;
    unsigned long ulBase;

    nRetCode = Pop((long *)&ulAddr);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lOpcodeDataOffset);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = CheckDataAddrValid(lOpcodeDataOffset);
    if (0 == nRetCode)
    {
        if (NULL != m_listMallocMemAddr.Find(lOpcodeDataOffset))
        {
            unCodeLen = strlen((char *)lOpcodeDataOffset);
            if (
                (unCodeLen >= MAXCMDSIZE * 2) ||
                (unCodeLen % 2)
            )
                goto Exit0;

            strncpy(szCode, (char *)lOpcodeDataOffset, unCodeLen + 1);
        }
        else
            goto Exit0;
    }
    else
    {
        unCodeLen = strlen(&m_Data[lOpcodeDataOffset]);
        if (
            (unCodeLen >= MAXCMDSIZE * 2) ||
            (unCodeLen % 2)
        )
            goto Exit0;

        strncpy(szCode, &m_Data[lOpcodeDataOffset], unCodeLen + 1);
    }

    pMem = Findmemory(ulAddr);
    OM_PROCESS_ERROR(pMem);

    ulBase = pMem->base;

    chCode[2] = '\0';
    do
    {
        nRetCode = Readcommand(ulAddr, (char *)cmd);
        OM_PROCESS_ERROR(nRetCode);

        unIndex = 0;
        do
        {
            *(short *)chCode = *(short *)&szCode[unIndex];
            unIndex += 2;
            if (unIndex > unCodeLen)
            {
                SetRetVal(ulAddr);
                nFound = 1;
                goto Exit1;
            }
            if (('?' == chCode[0]) && ('?' == chCode[1]))
            {
                ulByteValue = ch;
                continue;
            }
            ulByteValue = strtoul(chCode, NULL, 16);
            ch = *(unsigned char *)&cmd[(unIndex - 2) / 2];
        } while (ch == ulByteValue);

        if (ulAddr <= ulBase)
            break;
        --ulAddr;
    } while (ulAddr >= ulBase);

Exit1:
    nRetResult = 1;
Exit0:
    if (0 == nFound)
        SetRetVal(-1);
    return nRetResult;
}

int CVM::DoReplaceBytes()
{
    int nRetResult = 0;
    int nRetCode;

    unsigned long ulAddr;
    long lFind;
    long lRepl;
    long lLen;
    long i;
    int nIndex = 0;
    t_memory *tmem;
    unsigned long ulRange;
    int nCodeSize;
    long lCode1;
    unsigned char cmd[MAXCMDSIZE];
    int nFound = 0;

    nRetCode = Pop((long *)&ulAddr);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lFind);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lRepl);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lLen);
    OM_PROCESS_ERROR(nRetCode);

    tmem = Findmemory(ulAddr);
    OM_PROCESS_ERROR(tmem);

    ulRange = tmem->base + tmem->size;

    nCodeSize = GetLongSize(lFind);

    do
    {
        nRetCode = Readcommand(ulAddr + nIndex, (char *)cmd);
        OM_PROCESS_ERROR(nRetCode);

        lCode1 = *(long *)&cmd[0];
        switch (nCodeSize)
        {
        case 1:
            lCode1 = lCode1 & 0x000000FF;
            break;
        case 2:
            lCode1 = lCode1 & 0x0000FFFF;
            FIXENDIAN16(lCode1);
            break;
        case 3:
            lCode1 = lCode1 & 0x00FFFFFF;
            FIXENDIAN24(lCode1);
            break;
        }
        if (lFind == lCode1)
        {
            for (i = 0; i < lLen; ++i)
            {
                nRetCode = Writememory(
                    &lRepl,
                    ulAddr + nIndex + nCodeSize * i,
                    nCodeSize,
                    MM_DELANAL | MM_SILENT
                );
                OM_PROCESS_ERROR(nRetCode);
            }
            SetRetVal(ulAddr + nIndex);
            nFound = 1;
            goto Exit1;
        }
        ++nIndex;
    } while (ulAddr + nIndex <= ulRange);

Exit1:
    nRetResult = 1;
Exit0:
    if (0 == nFound)
        SetRetVal(-1);
    return nRetResult;
}

int CVM::DumpMemWithMode(
    /* [in] */  const char *mode
)
{
    int nRetResult = 0;
    int nRetCode;

    long lAddr;
    long lLen;
    long lFileNameOffset;
    FILE *fp_out = NULL;
    unsigned char *buf = NULL;
    char szFileName[MAX_PATH];

    nRetCode = Pop(&lAddr);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lLen);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = Pop(&lFileNameOffset);
    OM_PROCESS_ERROR(nRetCode);

    nRetCode = CheckDataAddrValid(lFileNameOffset);
    if (0 == nRetCode)
    {
        if (NULL != m_listMallocMemAddr.Find(lFileNameOffset))
        {
            strcpy(szFileName, (char *)lFileNameOffset);
        }
        else
            goto Exit0;
    }
    else
    {
        strcpy(szFileName, &m_Data[lFileNameOffset]);
    }

    buf = (unsigned char *)malloc(lLen);
    OM_PROCESS_ERROR(buf);

    nRetCode = Readmemory(buf, lAddr, lLen, MM_SILENT);
    OM_PROCESS_ERROR(nRetCode);

    fp_out = fopen(szFileName, mode);
    OM_PROCESS_ERROR(fp_out);

    fwrite(buf, 1, lLen, fp_out);

    nRetResult = 1;
Exit0:
    if (buf)
    {
        free(buf);
        buf = NULL;