plugin.pas

PhantOm,Ollydbg隐藏调试的辅助插件代码！

  p_extmodels = ^t_extmodels;
  t_extmodels = array[0..NSEQ - 1, 0..NMODELS - 1] of t_extmodel;

function Getlong(title: PChar; data: PULONG; datasize: Integer;
                 letter: Char; mode: Integer): Integer; cdecl;

function Getlongxy(title: PChar; data: PULONG; datasize: Integer;
                   letter: Char; mode: Integer;
                   x: Integer; y: Integer): Integer; cdecl;

function Getregxy(title: PChar; data: PULONG; letter: Char;
                  x: Integer; y: Integer): Integer; cdecl;

function Getline(title: PChar; data: PULONG): Integer; cdecl;

function Getlinexy(title: PChar; data: PULONG; x: Integer; y: Integer): Integer; cdecl;

function Getfloat10(title: PChar; fdata: PExtended; tag: PChar;
                    letter: Char; mode: Integer): Integer; cdecl;

function Getfloat10xy(title: PChar; fdata: PExtended; tag: PChar; letter: Char;
                      mode: Integer; x: Integer; y: Integer): Integer; cdecl;

function Getfloat(title: PChar; fdata: Pointer; size: Integer;
                  letter: Char; mode: Integer): Integer; cdecl;

function Getfloatxy(title: PChar; fdata: Pointer; size: Integer;
                    letter: Char; mode: Integer;
                    x: Integer; y: Integer): Integer; cdecl;

procedure Getasmfindmodel(models: p_asmmodels; letter: Char;
                          searchall: Integer); cdecl;

procedure Getasmfindmodelxy(models: p_asmmodels; letter: Char; searchall: Integer;
                           x: Integer; y: Integer); cdecl;

function Gettext(title: PChar; text: PChar; letter: Char;
                 type_i: Integer; fontindex: Integer): Integer; cdecl;

function Gettextxy(title: PChar; text: PChar; letter: Char;
                   type_i: Integer; fontindex: Integer;
                   x: Integer; y: Integer): Integer; cdecl;

function Gethexstring(title: PChar; phs: p_hexstr; mode: Integer;
                      fontindex: Integer; letter: Char): Integer; cdecl;

function Gethexstringxy(title: PChar; phs: p_hexstr; mode: Integer;
                        fontindex: Integer; letter: Char;
                        x: Integer; y: Integer): Integer; cdecl;

function Getmmx(title: PChar; data: PChar; mode: Integer): Integer; cdecl;

function Getmmxxy(title: PChar; data: PChar; mode: Integer;
                  x: Integer; y: Integer): Integer; cdecl;

function Get3dnow(title: PChar; data: PChar; mode: Integer): Integer; cdecl;

function Get3dnowxy(title: PChar; data: PChar; mode: Integer;
                    x: Integer; y: Integer): Integer; cdecl;

function Browsefilename(title: PChar; name: PChar;
                        defext: PChar; getarguments: Integer): Integer; cdecl;

function OpenEXEfile(path: PChar; dropped: Integer): Integer; cdecl;

function Attachtoactiveprocess(newprocessid: Integer): Integer; cdecl;

procedure Animate(animation: Integer); cdecl;

/////////////////////////////////////////////////////////////////////////////////
///////////////////////////// SORTED DATA FUNCTIONS /////////////////////////////

const
  NBAR              = 17;             // Max allowed number of segments in bar

  BAR_PRESSED       = $01;            // Bar segment pressed, used internally
  BAR_DISABLED      = $02;            // Bar segment disabled
  BAR_NOSORT        = $04;            // Flat bar column, supports no sorting
  BAR_NORESIZE      = $08;            // Bar column cannot be resized
  BAR_BUTTON        = $10;            // Segment sends WM_USER_BAR
  BAR_SHIFTSEL      = $20;            // Selection shifted 1/2 char to left

  CAPT_FREE         = 0;              // Bar and data are not captured

  TABLE_DIR         = $0001;          // Bottom-to-top table
  TABLE_COPYMENU    = $0002;          // Attach copy item
  TABLE_SORTMENU    = $0004;          // Attach sort menu
  TABLE_APPMENU     = $0010;          // Attach appearance menu
  TABLE_WIDECOL     = $0020;          // Attach wide columns menu item
  TABLE_USERAPP     = $0040;          // Attach user-processed appearance menu
  TABLE_USERDEF     = $0080;          // User-drawn table
  TABLE_NOHSCR      = $0100;          // Table contains no horizontal scroll
  TABLE_SAVEPOS     = $0200;          // Save position & appearance to .ini
  TABLE_CPU         = $0400;          // Table belongs to CPU window
  TABLE_FASTSEL     = $0800;          // Update when selection changes
  TABLE_COLSEL      = $1000;          // Column-wide selection
  TABLE_SAVEAPP     = $2000;          // Save multiinstance appearance to .ini
  TABLE_HILMENU     = $4000;          // Attach Syntax highlighting menu

  DRAW_NORMAL       = $0000;          // Normal plain text
  DRAW_GRAY         = $0001;          // Grayed text
  DRAW_HILITE       = $0002;          // Highlighted text
  DRAW_UL           = $0004;          // Underlined text
  DRAW_SELECT       = $0008;          // Selected background
  DRAW_EIP          = $0010;          // Inverted normal text/background
  DRAW_BREAK        = $0020;          // Breakpoint background
  DRAW_GRAPH        = $0040;          // Graphical element
  DRAW_DIRECT       = $0080;          // Direct text colour index (mask only)
  DRAW_MASK         = $0080;          // Use mask to set individual colors
  DRAW_EXTSEL       = $0100;          // Extend mask till end of column
  DRAW_UNICODE      = $0200;          // Text in UNICODE
  DRAW_TOP          = $0400;          // Draw upper half of text
  DRAW_BOTTOM       = $0800;          // Draw lower half of text

  // Symbolic names for graphical characters. Any other character is displayed
  // as space. Use only characters in range [1..0x7F]!
  D_SPACE           = 'N';            // Space
  D_SEP             = ' ';            // Thin separating line
  D_BEGIN           = 'B';            // Begin of procedure or scope
  D_BODY            = 'I';            // Body of procedure or scope
  D_ENTRY           = 'J';            // Loop entry point
  D_LEAF            = 'K';            // Intermediate leaf on a tree
  D_END             = 'E';            // End of procedure or scope
  D_SINGLE          = 'S';            // Single-line scope
  D_ENDBEG          = 'T';            // End and begin of stack scope
  D_POINT           = '.';            // Point
  D_JMPUP           = 'U';            // Jump upstairs
  D_JMPOUT          = '<';            // Jump to same location or out of module
  D_JMPDN           = 'D';            // Jump downstairs
  D_PATHUP          = 'u';            // Jump path upstairs (highlighted)
  D_GRAYUP          = 'v';            // Jump path upstairs (grayed)
  D_PATH            = 'i';            // Jump path through text (highlighted)
  D_GRAYPATH        = 'j';            // Jump path through text (grayed)
  D_PATHDN          = 'd';            // Jump path downstairs (highlighted)
  D_GRAYDN          = 'e';            // Jump path downstairs (grayed)
  D_PATHUPEND       = 'r';            // End of path upstairs (highlighted)
  D_GRAYUPEND       = 's';            // End of path upstairs (grayed)
  D_PATHDNEND       = 'f';            // End of path downstairs (highlighted)
  D_GRAYDNEND       = 'g';            // End of path downstairs (grayed)
  D_SWTOP           = 't';            // Start of switch
  D_SWBODY          = 'b';            // Switch body
  D_CASE            = 'c';            // Intermediate switch case
  D_LASTCASE        = 'l';            // Last switch case

  // Please note: Although types here contain mostly unique bit assignments, it's
  // not really necessary. Same bits, except for reserved general types, can be
  // freely shared between different types of sorted data.
  // General item types:
  TY_NEW            = $00000001;      // Item is new
  TY_CONFIRMED      = $00000002;      // Item still exists
  TY_MAIN           = $00000004;      // Main item (thread or module)
  TY_INVALID        = $00000008;      // Invalid type (item does not exist)
  TY_SELECTED       = $80000000;      // Reserved for multiple selection

  // Module-specific types:
  TY_REPORTED       = $00000010;      // Stop on module was reported

  // Reference-specific types:
  TY_REFERENCE      = $00000020;      // Item is a real reference
  TY_ORIGIN         = $00000040;      // Item is a search origin

  // Breakpoint-specific types:
  TY_STOPAN         = $00000080;      // Stop animation if TY_ONESHOT
  TY_SET            = $00000100;      // Code INT3 is in memory
  TY_ACTIVE         = $00000200;      // Permanent breakpoint
  TY_DISABLED       = $00000400;      // Permanent disabled breakpoint
  TY_ONESHOT        = $00000800;      // Temporary stop
  TY_TEMP           = $00001000;      // Temporary breakpoint
  TY_KEEPCODE       = $00002000;      // Set and keep command code
  TY_KEEPCOND       = $00004000;      // Keep condition unchanged (0: remove)
  TY_NOUPDATE       = $00008000;      // Don't redraw breakpoint window
  TY_RTRACE         = $00010000;      // Pseudotype of run trace breakpoint

  // Namelist-specific types:
  TY_EXPORT         = $00010000;      // Exported name
  TY_IMPORT         = $00020000;      // Imported name
  TY_LIBRARY        = $00040000;      // Name extracted from object file
  TY_LABEL          = $00080000;      // User-defined name
  TY_ANYNAME        = $000F0000;      // Any of the namelist flags above
  TY_KNOWN          = $00100000;      // Name of known function

  // Memory-specific types:
  TY_DEFHEAP        = $00020000;      // Contains default heap
  TY_HEAP           = $00040000;      // Contains non-default heap
  TY_SFX            = $00080000;      // Contains self-extractor
  TY_CODE           = $00100000;      // Contains image of code section
  TY_DATA           = $00200000;      // Contains image of data section
  TY_IMPDATA        = $00400000;      // Memory block includes import data
  TY_EXPDATA        = $00800000;      // Memory block includes export data
  TY_RSRC           = $01000000;      // Memory block includes resources
  TY_RELOC          = $02000000;      // Memory block includes relocation data
  TY_STACK          = $04000000;      // Contains stack of some thread
  TY_THREAD         = $08000000;      // Contains data block of some thread
  TY_HEADER         = $10000000;      // COFF header
  TY_ANYMEM         = $1FFE0000;      // Any of the memory flags above
  TY_GUARDED        = $20000000;      // NT only: guarded memory block

  // Procedure data-specific types:
  TY_PURE           = $00004000;      // No side effects except in stack
  TY_PASCAL         = $00010000;      // Procedure ends with RET nnn
  TY_C              = $00020000;      // ADD ESP,nnn after call to procedure
  TY_NOTENTRY       = $00100000;      // Not necessarily entry point

  // Switch data-specific types.
  TY_CHARSW         = $00100000;      // ASCII switch
  TY_WMSW           = $00200000;      // Window message switch
  TY_EXCEPTSW       = $00400000;      // Exception switch

  // Stack walk data-specific types.
  TY_RELIABLE       = $01000000;      // Reliable call
  TY_GUESSED        = $02000000;      // Not a real entry, just guessed
  TY_BELONGS        = $04000000;      // Not a real entry, just belongs to proc

  // Call tree-specific types.
  TY_RECURSIVE      = $00000100;      // Routine calls self
  TY_TERMINAL       = $00000200;      // Leaf function, doesn't call others
  TY_SYSTEM         = $00000400;      // Function resides in system DLL
  TY_DIRECT         = $00000800;      // Called directly
  TY_NODATA         = $00001000;      // Not analyzed or outside procedure
  TY_DUMMY          = $00002000;      // Consists of single RET command
  TY_NOSIDE         = $00004000;      // No side effects except in stack

type
  t_scheme = packed record            // Color scheme
    name: PChar;                      // Name of the scheme
    textcolor: Integer;               // Colour used to draw text
    hitextcolor: Integer;             // Colour used to draw highlited text
    lowcolor: Integer;                // Colour used to draw auxiliary text
    bkcolor: Integer;                 // Colour used to draw backgrounds
    selbkcolor: Integer;              // Colour used for selecting background
    linecolor: Integer;               // Colour used for separating lines
    auxcolor: Integer;                // Colour used for auxiliary objects
    condbkcolor: Integer;             // Colour used for background of cond brk
  end;

  t_schemeopt = packed record         // Color scheme, alternative form
    name: PChar;                      // Name of the scheme
    color: array[0..7] of Integer;    // Colours used as in t_scheme
  end;

  p_bar = ^t_bar;
  t_bar = packed record               // Number of active columns
    nbar: Integer;                    // Font used for bar segments
    font: Integer;                    // Actual widths of columns, pixels
    dx: array[0..NBAR-1] of Integer;  // Default widths of columns, chars
    defdx:array[0..NBAR-1] of Integer;// Column names (may be NULL)
    name: array[0..NBAR-1] of PChar;  // Combination of BAR_xxx bits
    mode: array[0..NBAR-1] of Char;   // One of CAPT_xxx, set to CAPT_FREE