2010-12-04 15:19:36 +10:00
|
|
|
/*
|
2014-02-05 00:21:42 +10:00
|
|
|
Test for a valid process (i386 for x86; that or AMD64 for x64). We can get
|
|
|
|
|
that info from the image header, which means getting the process's base
|
|
|
|
|
address (which we need anyway, to modify the imports). The simplest way to
|
|
|
|
|
do that is to enumerate the pages, looking for an executable image.
|
2010-12-04 15:19:36 +10:00
|
|
|
*/
|
|
|
|
|
|
2010-12-12 21:58:35 +10:00
|
|
|
#include "ansicon.h"
|
2010-12-04 15:19:36 +10:00
|
|
|
|
|
|
|
|
|
2014-02-05 00:21:42 +10:00
|
|
|
int ProcessType( LPPROCESS_INFORMATION ppi, PBYTE* pBase, BOOL* gui )
|
2010-12-04 15:19:36 +10:00
|
|
|
{
|
2014-02-05 00:21:42 +10:00
|
|
|
PBYTE ptr;
|
2010-12-04 15:19:36 +10:00
|
|
|
MEMORY_BASIC_INFORMATION minfo;
|
Exclude modules from being hooked; hook only selected GUI programs.
Added environment variable ANSICON_EXC to specify modules that should not be
hooked. This should work around the nvd3d9wrap.dll issue. Since it helps to
know what the modules are, logging is now always available, controlled by -l
or ANSICON_LOG. A side-effect caused debugstr.c to move to util.c.
GUI programs are once again not hooked, unless run by "ansicon" directly or in
the ANSICON_GUI environment variable. Since not hooking still leaves ANSICON in
the environment, created ANSICON_VER as a dynamic-only variable, which can also
serve as a version check.
Due to an email requesting a reverse video option, realised I always take the
current attributes as default. This means if you turned on reverse and ran a
program, it would take the reverse as its default. Created ANSICON_DEF variable
to explicitly set the default attribute, using the current if it doesn't exist.
The reverse video option is done via a "negative" attribute (e.g. "-m-f0" is
reversed black on white, meaning you'll get white on black, with foreground
sequences changing the background). (The difference from "\e[7m" is that it
won't be reset on "\e[m".)
A child program will inherit the parent's modes (but not shift); the parent will
read the child's modes on exit (but not unload). The exception is "ansicon",
which will always start with the default modes and leave the parent unchanged.
Improved the AutoRun entry, only running "ansicon" if ANSICON_VER doesn't exist.
The "ansicon" command is always first.
Stopped -u implying -p; return the program's exit code; don't restore the
original color when just using -p; output error messages to stderr.
2011-12-14 20:53:51 +10:00
|
|
|
IMAGE_DOS_HEADER dos_header;
|
|
|
|
|
IMAGE_NT_HEADERS nt_header;
|
2010-12-04 15:19:36 +10:00
|
|
|
|
2014-02-05 00:21:42 +10:00
|
|
|
*pBase = NULL;
|
Exclude modules from being hooked; hook only selected GUI programs.
Added environment variable ANSICON_EXC to specify modules that should not be
hooked. This should work around the nvd3d9wrap.dll issue. Since it helps to
know what the modules are, logging is now always available, controlled by -l
or ANSICON_LOG. A side-effect caused debugstr.c to move to util.c.
GUI programs are once again not hooked, unless run by "ansicon" directly or in
the ANSICON_GUI environment variable. Since not hooking still leaves ANSICON in
the environment, created ANSICON_VER as a dynamic-only variable, which can also
serve as a version check.
Due to an email requesting a reverse video option, realised I always take the
current attributes as default. This means if you turned on reverse and ran a
program, it would take the reverse as its default. Created ANSICON_DEF variable
to explicitly set the default attribute, using the current if it doesn't exist.
The reverse video option is done via a "negative" attribute (e.g. "-m-f0" is
reversed black on white, meaning you'll get white on black, with foreground
sequences changing the background). (The difference from "\e[7m" is that it
won't be reset on "\e[m".)
A child program will inherit the parent's modes (but not shift); the parent will
read the child's modes on exit (but not unload). The exception is "ansicon",
which will always start with the default modes and leave the parent unchanged.
Improved the AutoRun entry, only running "ansicon" if ANSICON_VER doesn't exist.
The "ansicon" command is always first.
Stopped -u implying -p; return the program's exit code; don't restore the
original color when just using -p; output error messages to stderr.
2011-12-14 20:53:51 +10:00
|
|
|
*gui = FALSE;
|
2014-02-05 00:21:42 +10:00
|
|
|
|
Exclude modules from being hooked; hook only selected GUI programs.
Added environment variable ANSICON_EXC to specify modules that should not be
hooked. This should work around the nvd3d9wrap.dll issue. Since it helps to
know what the modules are, logging is now always available, controlled by -l
or ANSICON_LOG. A side-effect caused debugstr.c to move to util.c.
GUI programs are once again not hooked, unless run by "ansicon" directly or in
the ANSICON_GUI environment variable. Since not hooking still leaves ANSICON in
the environment, created ANSICON_VER as a dynamic-only variable, which can also
serve as a version check.
Due to an email requesting a reverse video option, realised I always take the
current attributes as default. This means if you turned on reverse and ran a
program, it would take the reverse as its default. Created ANSICON_DEF variable
to explicitly set the default attribute, using the current if it doesn't exist.
The reverse video option is done via a "negative" attribute (e.g. "-m-f0" is
reversed black on white, meaning you'll get white on black, with foreground
sequences changing the background). (The difference from "\e[7m" is that it
won't be reset on "\e[m".)
A child program will inherit the parent's modes (but not shift); the parent will
read the child's modes on exit (but not unload). The exception is "ansicon",
which will always start with the default modes and leave the parent unchanged.
Improved the AutoRun entry, only running "ansicon" if ANSICON_VER doesn't exist.
The "ansicon" command is always first.
Stopped -u implying -p; return the program's exit code; don't restore the
original color when just using -p; output error messages to stderr.
2011-12-14 20:53:51 +10:00
|
|
|
for (ptr = NULL;
|
2014-02-05 00:21:42 +10:00
|
|
|
VirtualQueryEx( ppi->hProcess, ptr, &minfo, sizeof(minfo) );
|
Exclude modules from being hooked; hook only selected GUI programs.
Added environment variable ANSICON_EXC to specify modules that should not be
hooked. This should work around the nvd3d9wrap.dll issue. Since it helps to
know what the modules are, logging is now always available, controlled by -l
or ANSICON_LOG. A side-effect caused debugstr.c to move to util.c.
GUI programs are once again not hooked, unless run by "ansicon" directly or in
the ANSICON_GUI environment variable. Since not hooking still leaves ANSICON in
the environment, created ANSICON_VER as a dynamic-only variable, which can also
serve as a version check.
Due to an email requesting a reverse video option, realised I always take the
current attributes as default. This means if you turned on reverse and ran a
program, it would take the reverse as its default. Created ANSICON_DEF variable
to explicitly set the default attribute, using the current if it doesn't exist.
The reverse video option is done via a "negative" attribute (e.g. "-m-f0" is
reversed black on white, meaning you'll get white on black, with foreground
sequences changing the background). (The difference from "\e[7m" is that it
won't be reset on "\e[m".)
A child program will inherit the parent's modes (but not shift); the parent will
read the child's modes on exit (but not unload). The exception is "ansicon",
which will always start with the default modes and leave the parent unchanged.
Improved the AutoRun entry, only running "ansicon" if ANSICON_VER doesn't exist.
The "ansicon" command is always first.
Stopped -u implying -p; return the program's exit code; don't restore the
original color when just using -p; output error messages to stderr.
2011-12-14 20:53:51 +10:00
|
|
|
ptr += minfo.RegionSize)
|
2010-12-04 15:19:36 +10:00
|
|
|
{
|
2014-02-05 00:21:42 +10:00
|
|
|
if (minfo.BaseAddress == minfo.AllocationBase
|
|
|
|
|
&& ReadProcVar( minfo.BaseAddress, &dos_header )
|
|
|
|
|
&& dos_header.e_magic == IMAGE_DOS_SIGNATURE
|
|
|
|
|
&& ReadProcVar( (PBYTE)minfo.BaseAddress + dos_header.e_lfanew,
|
|
|
|
|
&nt_header )
|
|
|
|
|
&& nt_header.Signature == IMAGE_NT_SIGNATURE
|
|
|
|
|
&& !(nt_header.FileHeader.Characteristics & IMAGE_FILE_DLL))
|
2010-12-04 15:19:36 +10:00
|
|
|
{
|
2014-02-05 00:21:42 +10:00
|
|
|
// Don't load into ansicon.exe, it wants to do that itself.
|
|
|
|
|
if (nt_header.OptionalHeader.MajorImageVersion == 20033 &&
|
|
|
|
|
nt_header.OptionalHeader.MinorImageVersion == 18771)
|
|
|
|
|
return -1;
|
|
|
|
|
|
|
|
|
|
*pBase = minfo.BaseAddress;
|
|
|
|
|
if (nt_header.OptionalHeader.Subsystem == IMAGE_SUBSYSTEM_WINDOWS_GUI)
|
|
|
|
|
*gui = TRUE;
|
|
|
|
|
if (*gui ||
|
|
|
|
|
nt_header.OptionalHeader.Subsystem == IMAGE_SUBSYSTEM_WINDOWS_CUI)
|
2010-12-04 15:19:36 +10:00
|
|
|
{
|
2014-02-05 00:21:42 +10:00
|
|
|
if (nt_header.FileHeader.Machine == IMAGE_FILE_MACHINE_I386)
|
|
|
|
|
{
|
|
|
|
|
DEBUGSTR( 1, L" 32-bit %s (base = %.8X)",
|
|
|
|
|
(*gui) ? L"GUI" : L"console",
|
|
|
|
|
PtrToUint( minfo.BaseAddress ) );
|
|
|
|
|
return 32;
|
|
|
|
|
}
|
|
|
|
|
if (nt_header.FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64)
|
2010-12-04 15:19:36 +10:00
|
|
|
{
|
|
|
|
|
#ifdef _WIN64
|
2014-02-05 00:21:42 +10:00
|
|
|
DEBUGSTR( 1, L" 64-bit %s (base = %.8X_%.8X)",
|
|
|
|
|
(*gui) ? L"GUI" : L"console",
|
|
|
|
|
(DWORD)((DWORD_PTR)minfo.BaseAddress >> 32),
|
|
|
|
|
PtrToUint( minfo.BaseAddress ) );
|
|
|
|
|
return 64;
|
2012-04-10 15:39:58 +10:00
|
|
|
#elif defined(W32ON64)
|
2014-02-05 00:21:42 +10:00
|
|
|
// Console will log due to -P, but GUI may be ignored (if not,
|
|
|
|
|
// this'll show up twice).
|
|
|
|
|
if (*gui)
|
|
|
|
|
DEBUGSTR( 1, L" 64-bit GUI (base = 00000000_%.8X)",
|
|
|
|
|
PtrToUint( minfo.BaseAddress ) );
|
|
|
|
|
return 64;
|
|
|
|
|
#else
|
|
|
|
|
DEBUGSTR( 1, L" 64-bit %s (base = 00000000_%.8X)",
|
|
|
|
|
(*gui) ? L"GUI" : L"console",
|
|
|
|
|
PtrToUint( minfo.BaseAddress ) );
|
|
|
|
|
DEBUGSTR( 1, L" Unsupported (use x64\\ansicon)" );
|
|
|
|
|
return 0;
|
2010-12-04 15:19:36 +10:00
|
|
|
#endif
|
|
|
|
|
}
|
2014-02-05 00:21:42 +10:00
|
|
|
DEBUGSTR( 1, L" Ignoring unsupported machine (0x%X)",
|
|
|
|
|
nt_header.FileHeader.Machine );
|
|
|
|
|
}
|
|
|
|
|
else
|
|
|
|
|
{
|
|
|
|
|
DEBUGSTR( 1, L" Ignoring unsupported subsystem (%u)",
|
|
|
|
|
nt_header.OptionalHeader.Subsystem );
|
2010-12-04 15:19:36 +10:00
|
|
|
}
|
2014-02-05 00:21:42 +10:00
|
|
|
return 0;
|
2010-12-04 15:19:36 +10:00
|
|
|
}
|
2013-09-21 01:11:53 +10:00
|
|
|
#ifndef _WIN64
|
2013-09-20 03:15:05 +10:00
|
|
|
// If a 32-bit process loads a 64-bit one, we may miss the base
|
|
|
|
|
// address. If the pointer overflows, assume 64-bit.
|
2014-02-05 00:21:42 +10:00
|
|
|
if (((DWORD)ptr >> 12) + ((DWORD)minfo.RegionSize >> 12) >= 0x100000)
|
2012-02-05 11:31:39 +10:00
|
|
|
{
|
2012-04-10 15:39:58 +10:00
|
|
|
#ifdef W32ON64
|
2014-02-05 00:21:42 +10:00
|
|
|
DEBUGSTR( 1, L" Pointer overflow: assuming 64-bit" );
|
2012-04-10 15:39:58 +10:00
|
|
|
return 64;
|
|
|
|
|
#else
|
2014-02-05 00:21:42 +10:00
|
|
|
DEBUGSTR( 1, L" Ignoring apparent 64-bit process (use x64\\ansicon)" );
|
2012-02-05 11:31:39 +10:00
|
|
|
return 0;
|
2012-04-10 15:39:58 +10:00
|
|
|
#endif
|
2012-02-05 11:31:39 +10:00
|
|
|
}
|
|
|
|
|
#endif
|
2010-12-04 15:19:36 +10:00
|
|
|
}
|
|
|
|
|
|
Exclude modules from being hooked; hook only selected GUI programs.
Added environment variable ANSICON_EXC to specify modules that should not be
hooked. This should work around the nvd3d9wrap.dll issue. Since it helps to
know what the modules are, logging is now always available, controlled by -l
or ANSICON_LOG. A side-effect caused debugstr.c to move to util.c.
GUI programs are once again not hooked, unless run by "ansicon" directly or in
the ANSICON_GUI environment variable. Since not hooking still leaves ANSICON in
the environment, created ANSICON_VER as a dynamic-only variable, which can also
serve as a version check.
Due to an email requesting a reverse video option, realised I always take the
current attributes as default. This means if you turned on reverse and ran a
program, it would take the reverse as its default. Created ANSICON_DEF variable
to explicitly set the default attribute, using the current if it doesn't exist.
The reverse video option is done via a "negative" attribute (e.g. "-m-f0" is
reversed black on white, meaning you'll get white on black, with foreground
sequences changing the background). (The difference from "\e[7m" is that it
won't be reset on "\e[m".)
A child program will inherit the parent's modes (but not shift); the parent will
read the child's modes on exit (but not unload). The exception is "ansicon",
which will always start with the default modes and leave the parent unchanged.
Improved the AutoRun entry, only running "ansicon" if ANSICON_VER doesn't exist.
The "ansicon" command is always first.
Stopped -u implying -p; return the program's exit code; don't restore the
original color when just using -p; output error messages to stderr.
2011-12-14 20:53:51 +10:00
|
|
|
DEBUGSTR( 1, L" Ignoring non-Windows process" );
|
2010-12-12 21:58:35 +10:00
|
|
|
return 0;
|
2010-12-04 15:19:36 +10:00
|
|
|
}
|