repos_assist/天使插件源码/TSPlug/TSMemoryAPI.h

#pragma once

#include "ASM/MgAsmCom.h"
#include "ASM/MgAsmComDef.h"
#include <string>

#define  FINDDATATYPE_FINDDATAEX		1	
#define  FINDDATATYPE_FINDDOUBLEEX		2
#define  FINDDATATYPE_FINDFLOATEX		3
#define  FINDDATATYPE_FINDINTEX			4
#define  FINDDATATYPE_FINDSTRINGEX		5

typedef struct  _FindDataInfo //线程传参数结构体
	{
		HANDLE hprocess;
		DWORD dwncount;	//要找的地址数据个数
		int count;//记录个数
		double double_value_min;
		double double_value_max;
		float float_value_min;
		float float_value_max;
		LONG int_value_min;
		LONG int_value_max;
		BYTE FindIntType;//找0:32位,1:16位,2:8位
		LONG FindDataType;//找数据的类型
		wchar_t Findstring[MAX_PATH];
		DWORD Finddata[MAX_PATH];  //要找的数据字符串
		DWORD dwbegin[MAX_PATH*10];
		DWORD dwend[MAX_PATH*10];
		bool bfindindex[MAX_PATH*10];//做地址标志位,标识多线程要处理的地址
		wchar_t *retstr;
		CRITICAL_SECTION m_mutex;//多线程临界区
	   _FindDataInfo()
		   {
			  hprocess=NULL;
			  retstr=NULL;
			  dwncount=0;
			  count=0;
			  double_value_min=0;
			  double_value_max=0;
			  float_value_min=0;
			  float_value_max=0;
			  int_value_min=0;
			  int_value_max=0;
			  FindIntType=-1;//找0:32位,1:16位,2:8位
			  FindDataType=-1;//找数据的类型
			  memset(Finddata,0,MAX_PATH*sizeof(DWORD));
			  memset(Findstring,0,MAX_PATH);
			  memset(dwbegin,0,MAX_PATH*10);
			  memset(dwend,0,MAX_PATH*10);
			  memset(bfindindex,0,MAX_PATH*10);	//模式为false
		   }
	}FindDataInfo, *PFindDataInfo;

typedef struct {
	unsigned short Length;
	unsigned short MaximumLength;
	unsigned short *Buffer;
	} UNICODE_STRING;
typedef UNICODE_STRING *PUNICODE_STRING;

typedef struct _CLIENT_ID {
	HANDLE UniqueProcess;
	HANDLE UniqueThread;
	} CLIENT_ID;
typedef CLIENT_ID *PCLIENT_ID;

typedef struct _OBJECT_ATTRIBUTES {
	ULONG  Length;
	HANDLE  RootDirectory;
	PUNICODE_STRING  ObjectName;
	ULONG  Attributes;
	PVOID  SecurityDescriptor;
	PVOID  SecurityQualityOfService;
	} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;
typedef CONST OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES;



typedef struct {
	unsigned long AllocationSize;
	unsigned long ActualSize;
	unsigned long Flags;
	unsigned long Unknown1;
	UNICODE_STRING Unknown2;
	void *InputHandle;
	void *OutputHandle;
	void *ErrorHandle;
	UNICODE_STRING CurrentDirectory;
	void *CurrentDirectoryHandle;
	UNICODE_STRING SearchPaths;
	UNICODE_STRING ApplicationName;
	UNICODE_STRING CommandLine;
	void *EnvironmentBlock;
	unsigned long Unknown[9];
	UNICODE_STRING Unknown3;
	UNICODE_STRING Unknown4;
	UNICODE_STRING Unknown5;
	UNICODE_STRING Unknown6;
	} PROCESS_PARAMETERS;

typedef struct {
	unsigned long AllocationSize;
	unsigned long Unknown1;
	void *ProcessHinstance;
	void *ListDlls;
	PROCESS_PARAMETERS *ProcessParameters;
	unsigned long Unknown2;
	void *Heap;
	} PEB;

typedef struct {
	unsigned int ExitStatus;
	PEB *PebBaseAddress;
	unsigned int AffinityMask;
	unsigned int BasePriority;
	unsigned long UniqueProcessId;
	unsigned long InheritedFromUniqueProcessId;
	} PROCESS_BASIC_INFORMATION;


class TSMemoryAPI
	{
	public:
		TSMemoryAPI(void);
		~TSMemoryAPI(void);
	CMgAsmBase tsasm;
	CMgDisasmBase tsdsm;
	public:
		bool TSValueTypeToData(int type,wchar_t *retstr,double dvalue=NULL,float fvalue=NULL,int ivalue=0,wchar_t *svalue=NULL,int type1=0);
		bool TSFindData(LONG hwnd,wchar_t * addr_range,wchar_t *data,wchar_t *retstr,bool threadtype=false);
		bool TSFindDouble(LONG hwnd,wchar_t * addr_range,wchar_t *retstr,double double_value_min,double double_value_max,bool threadtype=false);
		bool TSFindFloat(LONG hwnd,wchar_t * addr_range,wchar_t *retstr,FLOAT float_value_min, FLOAT float_value_max,bool threadtype=false);
		bool TSFindInt(LONG hwnd,wchar_t * addr_range,wchar_t *retstr,LONG int_value_min, LONG int_value_max,LONG type,bool threadtype=false);
		bool TSFindString(LONG hwnd,wchar_t * addr_range,wchar_t *retstr,wchar_t*string_value,LONG type,bool threadtype=false);
		bool TSReadData(LONG hwnd,wchar_t*addr,wchar_t *retstr,LONG len);
		bool TSReadDouble(LONG hwnd,wchar_t*addr,double &dvalue,float &fvalue,int type=0); //type0:DOUBLE,1:FLOAT
		bool TSReadInt(LONG hwnd,wchar_t*addr,int &ivalue,short &svalue,BYTE &bvalue,int type);
		bool TSReadString(LONG hwnd,wchar_t*addr,wchar_t *retstr,LONG len,int type);
		bool TSTerminateProcess(LONG pid);
		bool TSVirtualAllocEx(LONG hwnd,LONG &addr,LONG size,LONG type);
		bool TSVirtualFreeEx(LONG hwnd,LONG addr);
		bool TSWriteData(LONG hwnd,wchar_t * addr,wchar_t *data);
		bool TSWriteDouble(LONG hwnd,wchar_t *addr,DOUBLE dvalue=0,FLOAT fvlaue=0);
		bool TSWriteInt(LONG hwnd,wchar_t *addr,int ivalue=0,short svalue=0,BYTE bvalue=0);
		bool TSWriteString(LONG hwnd,wchar_t*addr,wchar_t* strvalue,LONG type);
		bool TSGetCmdLine(LONG hwnd,wchar_t *retstr);
		bool TSAsmAdd(wchar_t*asm_ins);
		bool TSAsmCall(LONG hwnd,LONG mode);
		bool TSAsmClear();
		bool TSAsmCode(LONG base_addr,wchar_t *retstr);
		bool TSAssemble(wchar_t * asm_code,LONG base_addr,LONG is_upper,wchar_t *retstr);
		bool TSFreeProcessMemory(LONG hwnd);
	private:
	DWORD nPid;
	int retstringlen;//线程函数返回地址的长度
	CMgAsmBase::t_asmmodel  am;
	std::string asmcodearry;//存储AsmAdd的指令
	char Asmcalladdr[MAX_PATH]; //记录保存CALL指令
	LPVOID allocatememory;
	
	
	DWORD TSGetFindDataAddr(wchar_t* strs, DWORD pid);//读取要读写的多层级别的地址指针
	bool TSGetaddr_range(wchar_t* strs,LONG &begin,LONG &end,DWORD *addr_range,int &nconut); //读取要找的地址集合
	bool TSGetDataValue(wchar_t* strs,DWORD *Data_range,int &nconut);
	//void FindDataThread(void *para);
	bool GetFindaddr(HANDLE hprocess,PVOID  lpbegin,PVOID lpend,DWORD *ibegin,DWORD *ipend,int &ncount);

	DWORD GetCallstartData(DWORD Allocaddr,DWORD * startaddr,char *code=NULL);//获取CALL地址前的汇编指令
	};