| 211 | } |
| 212 | |
| 213 | std::wstring GenerateHCode(HookParam hp, DWORD processId) |
| 214 | { |
| 215 | std::wstring HCode = L"H"; |
| 216 | |
| 217 | if (hp.type & USING_UNICODE) |
| 218 | { |
| 219 | if (hp.type & HEX_DUMP) |
| 220 | { |
| 221 | if (hp.type & USING_STRING) HCode += L'M'; |
| 222 | else HCode += L'H'; |
| 223 | } |
| 224 | else |
| 225 | { |
| 226 | if (hp.type & USING_STRING) HCode += L'Q'; |
| 227 | else HCode += L'W'; |
| 228 | } |
| 229 | } |
| 230 | else |
| 231 | { |
| 232 | if (hp.type & USING_STRING) HCode += L'S'; |
| 233 | else if (hp.type & BIG_ENDIAN) HCode += L'A'; |
| 234 | else HCode += L'B'; |
| 235 | } |
| 236 | |
| 237 | if (hp.type & FULL_STRING) HCode += L'F'; |
| 238 | |
| 239 | if (hp.null_length != 0) HCode += std::to_wstring(hp.null_length) + L'<'; |
| 240 | |
| 241 | if (hp.type & NO_CONTEXT) HCode += L'N'; |
| 242 | if (hp.text_fun || hp.filter_fun || hp.hook_fun || hp.length_fun) HCode += L'X'; // no AGTH equivalent |
| 243 | |
| 244 | if (hp.codepage != 0 && !(hp.type & USING_UNICODE)) HCode += std::to_wstring(hp.codepage) + L'#'; |
| 245 | |
| 246 | if (hp.padding) HCode += HexString(hp.padding) + L'+'; |
| 247 | |
| 248 | if (hp.offset < 0) hp.offset += 4; |
| 249 | if (hp.split < 0) hp.split += 4; |
| 250 | |
| 251 | HCode += HexString(hp.offset); |
| 252 | if (hp.type & DATA_INDIRECT) HCode += L'*' + HexString(hp.index); |
| 253 | if (hp.type & USING_SPLIT) HCode += L':' + HexString(hp.split); |
| 254 | if (hp.type & SPLIT_INDIRECT) HCode += L'*' + HexString(hp.split_index); |
| 255 | |
| 256 | // Attempt to make the address relative |
| 257 | if (processId && !(hp.type & MODULE_OFFSET)) |
| 258 | if (AutoHandle<> process = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, FALSE, processId)) |
| 259 | if (MEMORY_BASIC_INFORMATION info = {}; VirtualQueryEx(process, (LPCVOID)hp.address, &info, sizeof(info))) |
| 260 | if (auto moduleName = GetModuleFilename(processId, (HMODULE)info.AllocationBase)) |
| 261 | { |
| 262 | hp.type |= MODULE_OFFSET; |
| 263 | hp.address -= (uint64_t)info.AllocationBase; |
| 264 | wcsncpy_s(hp.module, moduleName->c_str() + moduleName->rfind(L'\\') + 1, MAX_MODULE_SIZE - 1); |
| 265 | } |
| 266 | |
| 267 | HCode += L'@' + HexString(hp.address); |
| 268 | if (hp.type & MODULE_OFFSET) HCode += L':' + std::wstring(hp.module); |
| 269 | if (hp.type & FUNCTION_OFFSET) HCode += L':' + StringToWideString(hp.function); |
| 270 |
no test coverage detected