📄 cachereader.cpp
字号:
#include "stdafx.h"
#include "cachereader.h"
HANDLE OpenCacheFile(TCHAR* szCacheFilePath)
{
//open the file in shared mode so IE can use it at the same time
return CreateFile(szCacheFilePath,GENERIC_READ,FILE_SHARE_READ|FILE_SHARE_WRITE,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);;
}
WORD GetCacheFolderNum(HANDLE hFile)
{
WORD wFolders=0;
//move the file pointer to the start of the folders area
if (SetFilePointer(hFile,CACHE_FOLDERNUM,NULL,FILE_BEGIN) == CACHE_FOLDERNUM)
{
DWORD dwRead=0;
//read the number of folders
ReadFile(hFile,&wFolders,sizeof(WORD),&dwRead,NULL);
}
//return folder count
return wFolders;
}
void GetCacheFolders(HANDLE hFile, WORD wFolders,LPCACHEFOLDERS& pFolders)
{
//move file pointer to start of folder names
if (SetFilePointer(hFile,CACHE_FOLDERNAMES,NULL,FILE_BEGIN) == CACHE_FOLDERNAMES)
{
DWORD dwRead=0;
//allocate memory for the folders
pFolders = (CacheFolders*)CoTaskMemAlloc(sizeof(CacheFolders));
pFolders->folders = (CacheFolder*)CoTaskMemAlloc((sizeof(CacheFolder)+(sizeof(char)*9)+sizeof(DWORD))*wFolders);
//store folder count
pFolders->nNumOfFolders = wFolders;
//loop through folders
for (;wFolders > 0; wFolders--)
{
//get pointer to next folder structure
CacheFolder *lpFolder = (&pFolders->folders[pFolders->nNumOfFolders-wFolders]);
//read folder name
ReadFile(hFile,&lpFolder->szFolderName,CACHEFOLDER_NAMESIZE,&dwRead,NULL);
//append '\0' to make it a string
lpFolder->szFolderName[8] = '\0';
//return folder dword - unknown what this is for
ReadFile(hFile,&lpFolder->dwData,sizeof(DWORD),&dwRead,NULL);
}
}
}
CString GetFolderName(LPCACHEFOLDERS pFolders, WORD wFolderNum)
{
//takes a folder structure, and returns the folder name from within the structure.
CString str;
CacheFolder lpFolder = (pFolders->folders[wFolderNum-1]);
str = lpFolder.szFolderName;
return str;
}
DWORD GetFirstCacheEntry(HANDLE hFile,DWORD* lpdwOffset)
{
//this function simply sets the file pointer to the correct place for a call to ReadCache*Entry
//and returns the cache entry type
DWORD dwType=0;
//set file pointer to first cache entry
if (SetFilePointer(hFile,CACHE_FOLDERNUM,NULL,FILE_BEGIN) == CACHE_FOLDERNUM)
{
DWORD dwRead=0;
while (dwType != HASH_ID)//we do not want a hash entry, so keep looking until something else is found
{
ReadFile(hFile,&dwType,sizeof(DWORD),&dwRead,NULL);
}
ReadFile(hFile,&dwType,sizeof(DWORD),&dwRead,NULL);//Read size of DataBlock
if ((*lpdwOffset = SetFilePointer(hFile,(dwType*BLOCK_SIZE)-(sizeof(DWORD)*2),NULL,FILE_CURRENT)) > 0)//SetPointer to end of HASH_ID
{
ReadFile(hFile,&dwType,sizeof(DWORD),&dwRead,NULL);//Read first type after the end of the HASH_ID
}
else
*lpdwOffset = 0;//Invalid data
}
return dwType;
}
DWORD GetNextCacheEntry(HANDLE hFile,DWORD* lpdwOffset)//Takes a current offset, returns new offset
{
//this function simply sets the file pointer to the correct place for a call to ReadCache*Entry
//and returns the cache entry type
DWORD dwType=0;
//set file pointer to next data block
if (SetFilePointer(hFile,*lpdwOffset,NULL,FILE_BEGIN) == *lpdwOffset)
{
DWORD dwRead=0;
//read data type
ReadFile(hFile,&dwType,sizeof(DWORD),&dwRead,NULL);//Read size of ID
//loop until we found something we recognized
while ((dwType != URL_ID) && (dwType != LEAK_ID) && (dwType != REDR_ID) && (dwType != HASH_ID))
{
//Bad Block so move to next block and try to read its ID
*lpdwOffset = SetFilePointer(hFile,BLOCK_SIZE-(sizeof(DWORD)),NULL,FILE_CURRENT);
if (*lpdwOffset >= GetFileSize(hFile,&dwRead))
{
//pointer at end of file so return type 0
dwType = 0;
break;
}
if (ReadFile(hFile,&dwType,sizeof(DWORD),&dwRead,NULL) != TRUE)//Read size of ID
{
//unable to read type so return 0
dwType = 0;
break;
}
}
if ((*lpdwOffset = SetFilePointer(hFile,-(sizeof(DWORD)),NULL,FILE_CURRENT)) > 0)//SetPointer to begining of recognized block
{
}
else
*lpdwOffset = 0;//Invalid data
}//tell debugger where we are looking
TRACE("Offset=%d\n",*lpdwOffset);
//return type found
return dwType;
}
void ReadCacheEntry(HANDLE hFile, DWORD* lpdwOffset, LPURLENTRY& lpData)
{
//reads a url entry
//make sure file pointer is at correct place
if (SetFilePointer(hFile,*lpdwOffset,NULL,FILE_BEGIN) == *lpdwOffset)
{
DWORD dwRead=0;
DWORD dwType=0;
ReadFile(hFile,&dwType,sizeof(DWORD),&dwRead,NULL);//Read size of ID
ReadFile(hFile,&dwType,sizeof(DWORD),&dwRead,NULL);//Read size of DataBlock
if ((*lpdwOffset = SetFilePointer(hFile,-(sizeof(DWORD)*2),NULL,FILE_CURRENT)) > 0)//SetPointer to beggining of structure
{
//allocate memory for url structure
lpData = (UrlEntry*)CoTaskMemAlloc(dwType*BLOCK_SIZE);
//read the entire structure at once
ReadFile(hFile,lpData,(dwType*BLOCK_SIZE),&dwRead,NULL);//Read actual datablock
//change offset to end of structure
*lpdwOffset += (dwType*BLOCK_SIZE);
}
else
*lpdwOffset = 0;//Invalid data
}
}
void ReadCacheLeakEntry(HANDLE hFile, DWORD* lpdwOffset, LPLEAKENTRY& lpData)
{
//the leak entry is the same as a url entry, so just recast it
ReadCacheEntry(hFile,lpdwOffset,(LPURLENTRY&)lpData);
}
void ReadCacheRedrEntry(HANDLE hFile, DWORD* lpdwOffset, LPREDRENTRY& lpData)
{//these redr's are by far the most common entry in the cache that I have found
//make sure file pointer is at correct place
if (SetFilePointer(hFile,*lpdwOffset,NULL,FILE_BEGIN) == *lpdwOffset)
{
DWORD dwRead=0;
DWORD dwType=0;
ReadFile(hFile,&dwType,sizeof(DWORD),&dwRead,NULL);//Read size of ID
ReadFile(hFile,&dwType,sizeof(DWORD),&dwRead,NULL);//Read size of DataBlock
if ((*lpdwOffset = SetFilePointer(hFile,-(sizeof(DWORD)*2),NULL,FILE_CURRENT)) > 0)//SetPointer to beggining of structure
{
//allocate memory for structure
lpData = (RedrEntry*)CoTaskMemAlloc(dwType*BLOCK_SIZE);
ReadFile(hFile,lpData,(dwType*BLOCK_SIZE),&dwRead,NULL);//Read actual datablock
//set file pointer to end of block
*lpdwOffset += (dwType*BLOCK_SIZE);
}
else
*lpdwOffset = 0;//Invalid data
}
}
void ReadCacheHashEntry(HANDLE hFile, DWORD* lpdwOffset, LPHASHENTRY& lpData)
{
//there are a lot of those, and no one seems to know what they actually contain
//however if we want our url, leak,redr data we have to read them anyways and
//just discard the data
//set file pointer to correct place
if (SetFilePointer(hFile,*lpdwOffset,NULL,FILE_BEGIN) == *lpdwOffset)
{
DWORD dwRead=0;
DWORD dwType=0;
ReadFile(hFile,&dwType,sizeof(DWORD),&dwRead,NULL);//Read size of ID
ReadFile(hFile,&dwType,sizeof(DWORD),&dwRead,NULL);//Read size of DataBlock
if ((*lpdwOffset = SetFilePointer(hFile,-(sizeof(DWORD)*2),NULL,FILE_CURRENT)) > 0)//SetPointer to end of HASH_ID
{
//allocate memory for structure
lpData = (HashEntry*)CoTaskMemAlloc(dwType*BLOCK_SIZE);
ReadFile(hFile,lpData,(dwType*BLOCK_SIZE),&dwRead,NULL);//Read actual datablock
//set file pointer to end of block
*lpdwOffset += (dwType*BLOCK_SIZE);
}
else
*lpdwOffset = 0;//Invalid data
}
}
HANDLE GetFirstInetCacheEntry(LPINTERNET_CACHE_ENTRY_INFO lpCacheEntry, DWORD &dwEntrySize/*=4096*/)
{
//uses winInet functions to enumerate the cache
//handle to cache to be used in the GetNextInet* call...
HANDLE hCacheDir = NULL;
again:
//attempt to get the first entry
if (!(hCacheDir = FindFirstUrlCacheEntry(NULL,lpCacheEntry,&dwEntrySize)))
{
switch(GetLastError())
{
//no more items so restore cursor and close file
case ERROR_NO_MORE_ITEMS:
FindCloseUrlCache(hCacheDir);
SetCursor(LoadCursor(NULL,IDC_ARROW));
return NULL;
break;
case ERROR_INSUFFICIENT_BUFFER:
//maybe the structure size was not big enough so delete it then reallocate it and try again
delete[]lpCacheEntry;
lpCacheEntry = (LPINTERNET_CACHE_ENTRY_INFO)
new char[dwEntrySize];
lpCacheEntry->dwStructSize = dwEntrySize;
goto again;
break;
default:
//dont know what happened so close the file, and restore normal cursor
FindCloseUrlCache(hCacheDir);
SetCursor(LoadCursor(NULL,IDC_ARROW));
return NULL;
}
}
//return handle to cache
return hCacheDir;
}
BOOL GetNextInetCacheEntry(HANDLE &hCacheDir, LPINTERNET_CACHE_ENTRY_INFO lpCacheEntry, DWORD &dwEntrySize/*=4096*/)
{
//this uses the handle returned by the GetFirstInet* call.
retry:
//attempt to get next cache entry
if (!FindNextUrlCacheEntry(hCacheDir,lpCacheEntry, &dwEntrySize))
{
switch(GetLastError())
{
//nothing to read so close file
case ERROR_NO_MORE_ITEMS:
FindCloseUrlCache(hCacheDir);
return TRUE;
break;
//buffer not correct so resize it and try again
case ERROR_INSUFFICIENT_BUFFER:
delete[]lpCacheEntry;
lpCacheEntry = (LPINTERNET_CACHE_ENTRY_INFO)
new char[dwEntrySize];
lpCacheEntry->dwStructSize = dwEntrySize;
goto retry;
break;
default:
//dont know what happened so close file
FindCloseUrlCache(hCacheDir);
return FALSE;
}
}
//return success
return TRUE;
}
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -