Ejemplo de clave Shell para el tipo de ficheros “txt”

Entradas en el menú para tipos de ficheros “txt”

Nueva entrada “myentry” añadida al menu contextual de los ficheros “txt”

Entrada añadida “MiEntrada”

Entrada agregada “MiEntrada” como opción por defecto

[HKEY_CLASSES_ROOT\txtfile\shell\myentry]
“MUIVerb”=”Open”
“Position”=”Top”
[HKEY_CLASSES_ROOT\txtfile\shell\myentry\command]
@=”C:\\open.exe \”%1\””

#include <wtypes.h>
#include <winuser.h>
#include <shellapi.h>
 
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE prevInstance, LPSTR lpCmdLine, int nShowCmd)
{
    LPWSTR *szArgList;
    int argCount;
 
    szArgList = CommandLineToArgvW(GetCommandLine(), &argCount);
    if (szArgList == NULL)
    {
       MessageBox(NULL, L"Unable to parse command line", L"Error", MB_OK);
       return 10;
    }
 
    /*Start on index 1 coz index 0 contains my own exe path*/
    for (int i = 1; i < argCount; i++)
    {
       MessageBox(NULL, szArgList[i], L"Execution Intercepted!", MB_OK);
       ShellExecute(NULL, L"open", szArgList[i], NULL, NULL, SW_SHOWNORMAL);
    }
 
    LocalFree(szArgList);
    return 0;
}
 

Mensaje de intercepcion de la ejecución del fichero

• Conversion de plugin automatica
• Versiones soportadas: OllyDbg, Defixed, SND, RAMODBG, diablo2oo2, Shadow, ICE, CiM.
• Conversion de plugin avanzada.
• Permite cambiar imports y exports names manualmente
• Editor hexa integrado

typedef DWORD (__stdcall *pNtUnmapViewOfSection)(HANDLE ProcessHandle, PVOID BaseAddress);
void RunPE(LPSTR, LPSTR);
 
typedef struct {
   PIMAGE_DOS_HEADER dos_header;
   PIMAGE_NT_HEADERS nt_headers;
   PIMAGE_SECTION_HEADER section_header;
   LPBYTE file_data;
} NEW_PROCESS_INFO, *PNEW_PROCESS_INFO;
 
void get_replacement_info(const char* full_file_path, PNEW_PROCESS_INFO new_process_info)
{
   DWORD bytes_read;
 
   HANDLE hFile = CreateFileA(full_file_path,
                              GENERIC_READ,
                              FILE_SHARE_READ,
                              NULL,
                              OPEN_EXISTING,
                              FILE_ATTRIBUTE_NORMAL,
                              NULL);
   //Note: High DWORD ignored, dangerous with >4GB files :-P
   DWORD file_size = GetFileSize(hFile, NULL);
 
   new_process_info->file_data = (LPBYTE)malloc(file_size * sizeof(LPBYTE));
   ReadFile(hFile, new_process_info->file_data, file_size, &bytes_read, 0);
 
   assert(bytes_read == file_size);
   new_process_info->dos_header = (PIMAGE_DOS_HEADER)(&new_process_info->file_data[0]);
   new_process_info->nt_headers = (PIMAGE_NT_HEADERS)(&new_process_info->file_data[new_process_info->dos_header->e_lfanew]);
}
 
void RunPE(LPSTR file, LPSTR host)
{
   NEW_PROCESS_INFO new_process_info;
   PROCESS_INFORMATION process_info;
   STARTUPINFOA startup_info;
 
   RtlZeroMemory(&startup_info, sizeof(STARTUPINFOA));
   pNtUnmapViewOfSection NtUnmapViewOfSection = NULL;
 
   CreateProcessA(NULL,
                  host,
                  NULL,
                  NULL,
                  FALSE,
                  CREATE_SUSPENDED,
                  NULL,
                  NULL,
                  &startup_info,
                  &process_info);
 
   get_replacement_info(file, &new_process_info);
   NtUnmapViewOfSection = (pNtUnmapViewOfSection)(GetProcAddress(GetModuleHandleA("ntdll.dll"),
                                                                                  "NtUnmapViewOfSection"));
   //Remove target memory code
   NtUnmapViewOfSection(process_info.hProcess, (PVOID)new_process_info.nt_headers->OptionalHeader.ImageBase);
   //Allocate memory in target process starting at replacements image base
   VirtualAllocEx(process_info.hProcess,
                  (PVOID)new_process_info.nt_headers->OptionalHeader.ImageBase,
                  new_process_info.nt_headers->OptionalHeader.SizeOfImage,
                  MEM_COMMIT | MEM_RESERVE,
                  PAGE_EXECUTE_READWRITE);
 
   //Copy in PE header of replacement process
   WriteProcessMemory(process_info.hProcess,
                      (PVOID)new_process_info.nt_headers->OptionalHeader.ImageBase,
                      &new_process_info.file_data[0],
                      new_process_info.nt_headers->OptionalHeader.SizeOfHeaders,
                      NULL);
 
   //Write in all sections of the replacement process
   for(int i = 0; i < new_process_info.nt_headers->FileHeader.NumberOfSections; i++)
   {
      //Get offset of section
      int section_offset = new_process_info.dos_header->e_lfanew +
                           sizeof(IMAGE_NT_HEADERS) +
                           (sizeof(IMAGE_SECTION_HEADER) * i);
      new_process_info.section_header = (PIMAGE_SECTION_HEADER)(&new_process_info.file_data[section_offset]);
 
      //Write in section
      WriteProcessMemory(process_info.hProcess,
                         (LPVOID)(new_process_info.nt_headers->OptionalHeader.ImageBase +
                         new_process_info.section_header->VirtualAddress),
                         &new_process_info.file_data[new_process_info.section_header->PointerToRawData],
                         new_process_info.section_header->SizeOfRawData,
                         NULL);
   }
 
   //Get CONTEXT of main thread of suspended process, fix up EAX to point to new entry point
   LPCONTEXT thread_context = (LPCONTEXT)LocalAlloc(LPTR, sizeof(CONTEXT));
   thread_context->ContextFlags = CONTEXT_FULL;
   GetThreadContext(process_info.hThread, thread_context);
   thread_context->Eax = new_process_info.nt_headers->OptionalHeader.ImageBase +
                         new_process_info.nt_headers->OptionalHeader.AddressOfEntryPoint;
   SetThreadContext(process_info.hThread, thread_context);
 
   //Resume the main thread, now holding the replacement processes code
   ResumeThread(process_info.hThread);
   free(new_process_info.file_data);
   LocalFree(thread_context);
}

#include <windows.h>
char mensaje[] = "Hola desde la TLS Callback";
 
void __stdcall tls_callback(void * /*instance*/,
                        DWORD reason,
                        void * /*reserved*/)
{
  if ( reason == DLL_PROCESS_ATTACH )
  {
    MessageBox(NULL, "Proceso Adherido", "TLS Callback", MB_OK);
    OutputDebugStringA(mensaje);
  }
}
 
DWORD _tls_index = 0;
PIMAGE_TLS_CALLBACK callback = tls_callback;
extern "C" IMAGE_TLS_DIRECTORY _tls_used = {0, 0, (DWORD)&_tls_index, (DWORD) &callback, 0, 0};
 
int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
    MessageBox(NULL,"Este es el WinMain!","Hola!",MB_OK);
    return 0;
} 

DWORD dwFlagsAndAttributes

SECURITY_ATTRIBUTES secAttr;
ZeroMemory(&secAttr, sizeof(SECURITY_ATTRIBUTES));
secAttr.nLength = sizeof(SECURITY_ATTRIBUTES);
secAttr.bInheritHandle = true; // Para que sea el mismo handle para todos los procesos
 
HANDLE hFile = CreateFile(filename,
                          GENERIC_ALL, // GENERIC_READ
                          FILE_SHARE_DELETE + FILE_SHARE_READ,
                          &secAttr, // 0
                          OPEN_EXISTING,
                          FILE_FLAG_DELETE_ON_CLOSE, // FILE_ATTRIBUTE_NORMAL
                          NULL);

HANDLE hProcess;

SHELLEXECUTEINFO execInfo;
 
ZeroMemory(&execInfo, sizeof(SHELLEXECUTEINFO));
execInfo.cbSize = sizeof(SHELLEXECUTEINFO);
execInfo.fMask = SEE_MASK_FLAG_DDEWAIT + SEE_MASK_FLAG_NO_UI + SEE_MASK_NOCLOSEPROCESS;
execInfo.lpVerb = "open";
execInfo.lpFile = filename;
execInfo.nShow = SW_SHOWNORMAL;
 
ShellExecuteEx(&execInfo);

//---------------------------------------------------------------------------
class a
{
  private:
    WNDPROC lpPrevProc;
    LRESULT CALLBACK NewProc(HWND, UINT, WPARAM, LPARAM);
 
  public:
    void Hookea (HANDLE);
    ...
};
 
//---------------------------------------------------------------------------
void a::Hookea (HANDLE hWnd)
{
  lpPrevProc = (WNDPROC)GetWindowLong((HWND__*)hWnd, GWL_WNDPROC);
 
  SetWindowLongA((HWND__*)hWnd, GWL_WNDPROC, (DWORD)NewProc);
  // E2235 Member function must be called or its address taken	Compiler error
  // Probe con "(DWORD)&a::RealWinWndProc" pero me dice
  // E2031 Cannot cast from 'type1' to 'type2'	Compiler error
}
 
//---------------------------------------------------------------------------
LRESULT CALLBACK a::NewProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
  switch(uMsg)
  {
    case WM_DESTROY:
      MessageBox(hwnd, "Adios Mundo", "Bye!!!", MB_ICONINFORMATION);
    break;
  }
 
  return CallWindowProc(lpPrevProc, hwnd, uMsg, wParam, lParam);
}
//---------------------------------------------------------------------------

SetWindowLongA(hWnd, GWL_WNDPROC, (DWORD)(&a::NewProc));

SetWindowLongA((HWND__*)hWnd, GWL_WNDPROC, (DWORD)NewProc);