Skip to content

Commit 339163e

Browse files
zhutingxfzhutingxf
committed
源代码
1 parent 9250f97 commit 339163e

14 files changed

+1947
-0
lines changed

‎InfinityHookPro.sln

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 16
4+
VisualStudioVersion = 16.0.31624.102
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "InfinityHookPro", "InfinityHookPro\InfinityHookPro.vcxproj", "{E753FDB6-774D-41ED-9E07-A09B837BE1CC}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|x64 = Debug|x64
11+
Debug|x86 = Debug|x86
12+
Release|x64 = Release|x64
13+
Release|x86 = Release|x86
14+
EndGlobalSection
15+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16+
{E753FDB6-774D-41ED-9E07-A09B837BE1CC}.Debug|x64.ActiveCfg = Debug|x64
17+
{E753FDB6-774D-41ED-9E07-A09B837BE1CC}.Debug|x64.Build.0 = Debug|x64
18+
{E753FDB6-774D-41ED-9E07-A09B837BE1CC}.Debug|x64.Deploy.0 = Debug|x64
19+
{E753FDB6-774D-41ED-9E07-A09B837BE1CC}.Debug|x86.ActiveCfg = Debug|Win32
20+
{E753FDB6-774D-41ED-9E07-A09B837BE1CC}.Debug|x86.Build.0 = Debug|Win32
21+
{E753FDB6-774D-41ED-9E07-A09B837BE1CC}.Debug|x86.Deploy.0 = Debug|Win32
22+
{E753FDB6-774D-41ED-9E07-A09B837BE1CC}.Release|x64.ActiveCfg = Release|x64
23+
{E753FDB6-774D-41ED-9E07-A09B837BE1CC}.Release|x64.Build.0 = Release|x64
24+
{E753FDB6-774D-41ED-9E07-A09B837BE1CC}.Release|x64.Deploy.0 = Release|x64
25+
{E753FDB6-774D-41ED-9E07-A09B837BE1CC}.Release|x86.ActiveCfg = Release|Win32
26+
{E753FDB6-774D-41ED-9E07-A09B837BE1CC}.Release|x86.Build.0 = Release|Win32
27+
{E753FDB6-774D-41ED-9E07-A09B837BE1CC}.Release|x86.Deploy.0 = Release|Win32
28+
EndGlobalSection
29+
GlobalSection(SolutionProperties) = preSolution
30+
HideSolutionNode = FALSE
31+
EndGlobalSection
32+
GlobalSection(ExtensibilityGlobals) = postSolution
33+
SolutionGuid = {8521F805-BDD3-4285-9628-2DB2EB48602B}
34+
EndGlobalSection
35+
EndGlobal

‎InfinityHookPro/InfinityHookPro.vcxproj

+130
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
14+
<Platform>x64</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<ProjectGuid>{E753FDB6-774D-41ED-9E07-A09B837BE1CC}</ProjectGuid>
23+
<TemplateGuid>{dd38f7fc-d7bd-488b-9242-7d8754cde80d}</TemplateGuid>
24+
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
25+
<MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
26+
<Configuration>Debug</Configuration>
27+
<Platform Condition="'$(Platform)' == ''">Win32</Platform>
28+
<RootNamespace>infinity_hook_pro</RootNamespace>
29+
</PropertyGroup>
30+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
31+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
32+
<TargetVersion>Windows10</TargetVersion>
33+
<UseDebugLibraries>true</UseDebugLibraries>
34+
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
35+
<ConfigurationType>Driver</ConfigurationType>
36+
<DriverType>WDM</DriverType>
37+
</PropertyGroup>
38+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
39+
<TargetVersion>Windows10</TargetVersion>
40+
<UseDebugLibraries>false</UseDebugLibraries>
41+
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
42+
<ConfigurationType>Driver</ConfigurationType>
43+
<DriverType>WDM</DriverType>
44+
</PropertyGroup>
45+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
46+
<TargetVersion>
47+
</TargetVersion>
48+
<UseDebugLibraries>true</UseDebugLibraries>
49+
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
50+
<ConfigurationType>Driver</ConfigurationType>
51+
<DriverType>WDM</DriverType>
52+
<DriverTargetPlatform>Desktop</DriverTargetPlatform>
53+
</PropertyGroup>
54+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
55+
<TargetVersion>
56+
</TargetVersion>
57+
<UseDebugLibraries>false</UseDebugLibraries>
58+
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
59+
<ConfigurationType>Driver</ConfigurationType>
60+
<DriverType>WDM</DriverType>
61+
<Driver_SpectreMitigation>false</Driver_SpectreMitigation>
62+
<DriverTargetPlatform>Desktop</DriverTargetPlatform>
63+
</PropertyGroup>
64+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
65+
<ImportGroup Label="ExtensionSettings">
66+
</ImportGroup>
67+
<ImportGroup Label="PropertySheets">
68+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
69+
</ImportGroup>
70+
<PropertyGroup Label="UserMacros" />
71+
<PropertyGroup />
72+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
73+
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
74+
</PropertyGroup>
75+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
76+
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
77+
</PropertyGroup>
78+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
79+
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
80+
</PropertyGroup>
81+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
82+
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
83+
<EnableInf2cat>false</EnableInf2cat>
84+
</PropertyGroup>
85+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
86+
<ClCompile>
87+
<TreatWarningAsError>false</TreatWarningAsError>
88+
<BufferSecurityCheck>false</BufferSecurityCheck>
89+
<ControlFlowGuard>false</ControlFlowGuard>
90+
<DebugInformationFormat>None</DebugInformationFormat>
91+
<InlineFunctionExpansion>AnySuitable</InlineFunctionExpansion>
92+
</ClCompile>
93+
<Inf>
94+
<SpecifyArchitecture>false</SpecifyArchitecture>
95+
</Inf>
96+
<Link>
97+
<GenerateDebugInformation>false</GenerateDebugInformation>
98+
<EntryPointSymbol>DriverEntry</EntryPointSymbol>
99+
</Link>
100+
</ItemDefinitionGroup>
101+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
102+
<DriverSign>
103+
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
104+
</DriverSign>
105+
<Link>
106+
<EntryPointSymbol>DriverEntry</EntryPointSymbol>
107+
</Link>
108+
</ItemDefinitionGroup>
109+
<ItemGroup>
110+
<FilesToPackage Include="$(TargetPath)" />
111+
</ItemGroup>
112+
<ItemGroup>
113+
<ClCompile Include="hde\hde64.cpp" />
114+
<ClCompile Include="hook.cpp" />
115+
<ClCompile Include="main.cpp" />
116+
</ItemGroup>
117+
<ItemGroup>
118+
<ClInclude Include="defines.h" />
119+
<ClInclude Include="hde\hde64.h" />
120+
<ClInclude Include="hde\pstdint.h" />
121+
<ClInclude Include="hde\table64.h" />
122+
<ClInclude Include="headers.hpp" />
123+
<ClInclude Include="hook.hpp" />
124+
<ClInclude Include="imports.hpp" />
125+
<ClInclude Include="utils.hpp" />
126+
</ItemGroup>
127+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
128+
<ImportGroup Label="ExtensionTargets">
129+
</ImportGroup>
130+
</Project>

‎InfinityHookPro/InfinityHookPro.vcxproj.user

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
4+
<SignMode>Off</SignMode>
5+
</PropertyGroup>
6+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
7+
<SignMode>Off</SignMode>
8+
</PropertyGroup>
9+
</Project>

‎InfinityHookPro/defines.h

+152
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
#pragma once
2+
#include "headers.hpp"
3+
4+
/* 微软官方文档定义
5+
* https://docs.microsoft.com/en-us/windows/win32/etw/wnode-header
6+
*/
7+
//typedef struct _WNODE_HEADER
8+
//{
9+
// ULONG BufferSize;
10+
// ULONG ProviderId;
11+
// union {
12+
// ULONG64 HistoricalContext;
13+
// struct {
14+
// ULONG Version;
15+
// ULONG Linkage;
16+
// };
17+
// };
18+
// union {
19+
// HANDLE KernelHandle;
20+
// LARGE_INTEGER TimeStamp;
21+
// };
22+
// GUID Guid;
23+
// ULONG ClientContext;
24+
// ULONG Flags;
25+
//} WNODE_HEADER, * PWNODE_HEADER;
26+
27+
/* 微软文档定义
28+
* https://docs.microsoft.com/en-us/windows/win32/api/evntrace/ns-evntrace-event_trace_properties
29+
*/
30+
typedef struct _EVENT_TRACE_PROPERTIES
31+
{
32+
WNODE_HEADER Wnode;
33+
ULONG BufferSize;
34+
ULONG MinimumBuffers;
35+
ULONG MaximumBuffers;
36+
ULONG MaximumFileSize;
37+
ULONG LogFileMode;
38+
ULONG FlushTimer;
39+
ULONG EnableFlags;
40+
union {
41+
LONG AgeLimit;
42+
LONG FlushThreshold;
43+
} DUMMYUNIONNAME;
44+
ULONG NumberOfBuffers;
45+
ULONG FreeBuffers;
46+
ULONG EventsLost;
47+
ULONG BuffersWritten;
48+
ULONG LogBuffersLost;
49+
ULONG RealTimeBuffersLost;
50+
HANDLE LoggerThreadId;
51+
ULONG LogFileNameOffset;
52+
ULONG LoggerNameOffset;
53+
} EVENT_TRACE_PROPERTIES, * PEVENT_TRACE_PROPERTIES;
54+
55+
/*
56+
* 这结构是大佬逆向出来的
57+
*/
58+
typedef struct _CKCL_TRACE_PROPERIES : EVENT_TRACE_PROPERTIES
59+
{
60+
ULONG64 Unknown[3];
61+
UNICODE_STRING ProviderName;
62+
} CKCL_TRACE_PROPERTIES, * PCKCL_TRACE_PROPERTIES;
63+
64+
/*
65+
* 操作类型
66+
*/
67+
typedef enum _ETWP_TRACE_TYPE
68+
{
69+
EtwpStartTrace = 1,
70+
EtwpStopTrace = 2,
71+
EtwpQueryTrace = 3,
72+
EtwpUpdateTrace = 4,
73+
EtwpFlushTrace = 5
74+
}ETWP_TRACE_TYPE;
75+
76+
77+
typedef enum _SYSTEM_INFORMATION_CLASS {
78+
SystemBasicInformation = 0,
79+
SystemProcessorInformation = 1,
80+
SystemPerformanceInformation = 2,
81+
SystemTimeOfDayInformation = 3,
82+
SystemPathInformation = 4,
83+
SystemProcessInformation = 5,
84+
SystemCallCountInformation = 6,
85+
SystemDeviceInformation = 7,
86+
SystemProcessorPerformanceInformation = 8,
87+
SystemFlagsInformation = 9,
88+
SystemCallTimeInformation = 10,
89+
SystemModuleInformation = 11,
90+
SystemLocksInformation = 12,
91+
SystemStackTraceInformation = 13,
92+
SystemPagedPoolInformation = 14,
93+
SystemNonPagedPoolInformation = 15,
94+
SystemHandleInformation = 16,
95+
SystemObjectInformation = 17,
96+
SystemPageFileInformation = 18,
97+
SystemVdmInstemulInformation = 19,
98+
SystemVdmBopInformation = 20,
99+
SystemFileCacheInformation = 21,
100+
SystemPoolTagInformation = 22
101+
} SYSTEM_INFORMATION_CLASS;
102+
103+
typedef struct _SYSTEM_MODULE_INFORMATION_ENTRY
104+
{
105+
HANDLE Section;
106+
PVOID MappedBase;
107+
PVOID Base;
108+
ULONG Size;
109+
ULONG Flags;
110+
USHORT Index;
111+
USHORT Unknown;
112+
USHORT LoadCount;
113+
USHORT ModuleNameOffset;
114+
CHAR ImageName[256];
115+
} SYSTEM_MODULE_INFORMATION_ENTRY, * PSYSTEM_MODULE_INFORMATION_ENTRY;
116+
117+
typedef struct _SYSTEM_MODULE_INFORMATION
118+
{
119+
ULONG_PTR ulModuleCount;
120+
SYSTEM_MODULE_INFORMATION_ENTRY Modules[1];
121+
} SYSTEM_MODULE_INFORMATION, * PSYSTEM_MODULE_INFORMATION;
122+
123+
typedef void(__fastcall* InfinityCallbackPtr)(unsigned long nCallIndex, PVOID* pCallAddress);
124+
typedef __int64 (*HvlGetQpcBiasPtr)();
125+
typedef NTSTATUS(*NtCreateFilePtr)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PIO_STATUS_BLOCK, PLARGE_INTEGER, ULONG, ULONG, ULONG, ULONG, PVOID, ULONG);
126+
typedef NTSTATUS(NTAPI* NtTraceControlPtr)(ULONG, PVOID, ULONG, PVOID, ULONG, PULONG);
127+
128+
//typedef struct _GLOBAL_INFORMATION
129+
//{
130+
// bool DetectThreadTerminated;
131+
// CLIENT_ID ClientId;
132+
// InfinityCallbackPtr InfinityCallback;
133+
// unsigned long BuildNumber;
134+
// void* SystemCallTable;
135+
// void* EtwpDebuggerData;
136+
// void* CkclWmiLoggerContext;
137+
// void** EtwpDebuggerDataSilo;
138+
// void** GetCpuClock;
139+
// PETHREAD DetectThreadObject;
140+
// unsigned long long OriginalGetCpuClock;
141+
// unsigned long long HvlpReferenceTscPage;
142+
// unsigned long long HvlGetQpcBias;
143+
// unsigned long long HvlpGetReferenceTimeUsingTscPage;
144+
// unsigned long long HalpPerformanceCounter;
145+
// unsigned long long HalpOriginalPerformanceCounter;
146+
// unsigned long long HalpOriginalPerformanceCounterCopy;
147+
// unsigned long* HalpPerformanceCounterType;
148+
// unsigned char VmHalpPerformanceCounterType;
149+
// unsigned long OriginalHalpPerformanceCounterType;
150+
// unsigned long long OriginalHvlpGetReferenceTimeUsingTscPage;
151+
// HvlGetQpcBiasPtr OriginalHvlGetQpcBias;
152+
//}GLOBAL_INFORMATION;

0 commit comments

Comments
 (0)