Skip to content

Commit 01cb7e4

Browse files
KN4CK3RKN4CK3R
committed
Added basic unix support.
1 parent f1e9f52 commit 01cb7e4

16 files changed

+1254
-1
lines changed

‎NativeCore/Unix/CloseRemoteProcess.cpp‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#include "NativeCore.hpp"
2+
3+
extern "C" void CloseRemoteProcess(RC_Pointer handle)
4+
{
5+
6+
}

‎NativeCore/Unix/ControlRemoteProcess.cpp‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
//#include <sys/types.h>
2+
#include <csignal>
3+
4+
#include "NativeCore.hpp"
5+
6+
extern "C" void ControlRemoteProcess(RC_Pointer handle, ControlRemoteProcessAction action)
7+
{
8+
int signal = SIGKILL;
9+
if (action == ControlRemoteProcessAction::Suspend)
10+
{
11+
signal = SIGSTOP;
12+
}
13+
else if (action == ControlRemoteProcessAction::Resume)
14+
{
15+
signal = SIGCONT;
16+
}
17+
18+
kill((pid_t)(intptr_t)handle, signal);
19+
}

‎NativeCore/Unix/Debugger.cpp‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#include "NativeCore.hpp"
2+
3+
extern "C" bool AttachDebuggerToProcess(RC_Pointer id)
4+
{
5+
return false;
6+
}
7+
8+
extern "C" void DetachDebuggerFromProcess(RC_Pointer id)
9+
{
10+
11+
}
12+
13+
extern "C" bool AwaitDebugEvent(DebugEvent* evt, int timeoutInMilliseconds)
14+
{
15+
return false;
16+
}
17+
18+
extern "C" void HandleDebugEvent(DebugEvent* evt)
19+
{
20+
21+
}
22+
23+
extern "C" bool SetHardwareBreakpoint(RC_Pointer id, RC_Pointer address, HardwareBreakpointRegister reg, HardwareBreakpointTrigger type, HardwareBreakpointSize size, bool set)
24+
{
25+
return false;
26+
}

‎NativeCore/Unix/DisassembleCode.cpp‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#include <vector>
2+
#include <cstdint>
3+
//#include <beaengine/BeaEngine.h>
4+
5+
#include "NativeCore.hpp"
6+
7+
extern "C" bool DisassembleCode(RC_Pointer address, RC_Size length, RC_Pointer virtualAddress, InstructionData* instruction)
8+
{
9+
return false;
10+
}

‎NativeCore/Unix/EnumerateProcesses.cpp‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
//#include <experimental/filesystem>
2+
#include <boost/filesystem.hpp>
3+
#include <sstream>
4+
5+
#include "NativeCore.hpp"
6+
7+
//using fs = std::experimental::filesystem;
8+
//using sys = std;
9+
/*using fs = boost::filesystem;
10+
using sys = boost::system;*/
11+
12+
enum class Platform
13+
{
14+
Unknown,
15+
X86,
16+
X64
17+
};
18+
19+
bool is_number(const std::string& s)
20+
{
21+
std::string::const_iterator it = s.begin();
22+
while (it != s.end() && std::isdigit(*it)) ++it;
23+
return !s.empty() && it == s.end();
24+
}
25+
26+
template<typename T>
27+
T parse_type(const std::string& s)
28+
{
29+
std::stringstream ss(s);
30+
31+
T val;
32+
ss >> val;
33+
return val;
34+
}
35+
36+
extern "C" void EnumerateProcesses(EnumerateProcessCallback callbackProcess)
37+
{
38+
//using namespace std::experimental::filesystem;
39+
//using namespace std;
40+
41+
using namespace boost::filesystem;
42+
using namespace boost::system;
43+
44+
if (callbackProcess == nullptr)
45+
{
46+
return;
47+
}
48+
49+
path proc("/proc");
50+
51+
if (is_directory(proc))
52+
{
53+
for (auto& p : directory_iterator(proc))
54+
{
55+
if (is_directory(p))
56+
{
57+
auto processPath = p.path();
58+
59+
auto name = processPath.filename().string();
60+
if (is_number(name))
61+
{
62+
size_t pid = parse_type<size_t>(name);
63+
64+
auto exeSymLink = processPath / "exe";
65+
if (is_symlink(symlink_status(exeSymLink)))
66+
{
67+
error_code ec;
68+
auto e = read_symlink(exeSymLink, ec);
69+
70+
if (!ec)
71+
{
72+
//auto elfHeader = processPath / "";
73+
74+
EnumerateProcessData data = {};
75+
data.Id = pid;
76+
MultiByteToUnicode(e.string().c_str(), data.ModulePath, PATH_MAXIMUM_LENGTH);
77+
78+
callbackProcess(&data);
79+
}
80+
}
81+
}
82+
}
83+
}
84+
}
85+
}

‎NativeCore/Unix/EnumerateRemoteSectionsAndModules.cpp‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
#include <fstream>
2+
#include <sstream>
3+
#include <unordered_map>
4+
5+
#include "NativeCore.hpp"
6+
7+
inline bool operator&(SectionProtection& lhs, SectionProtection rhs)
8+
{
9+
using T = std::underlying_type_t<SectionProtection>;
10+
11+
return (static_cast<T>(lhs) & static_cast<T>(rhs)) == static_cast<T>(rhs);
12+
}
13+
14+
template<typename T>
15+
inline std::istream& skip(std::istream& s)
16+
{
17+
auto f = s.flags();
18+
s >> std::noskipws;
19+
20+
T t;
21+
s >> t;
22+
23+
s.flags(f);
24+
25+
return s;
26+
}
27+
28+
std::istream& operator >> (std::istream& s, SectionProtection& protection)
29+
{
30+
protection = SectionProtection::NoAccess;
31+
32+
if (s.get() == 'r') protection |= SectionProtection::Read;
33+
if (s.get() == 'w') protection |= SectionProtection::Write;
34+
if (s.get() == 'x') protection |= SectionProtection::Execute;
35+
36+
return s;
37+
}
38+
39+
extern "C" void EnumerateRemoteSectionsAndModules(RC_Pointer handle, EnumerateRemoteSectionsCallback callbackSection, EnumerateRemoteModulesCallback callbackModule)
40+
{
41+
if (callbackSection == nullptr && callbackModule == nullptr)
42+
{
43+
return;
44+
}
45+
46+
struct ModuleInfo
47+
{
48+
intptr_t Start = 0;
49+
intptr_t End = 0;
50+
RC_UnicodeChar Path[PATH_MAXIMUM_LENGTH] = {};
51+
};
52+
53+
std::ifstream input(((std::stringstream&)(std::stringstream() << "/proc/" << (intptr_t)handle << "/maps")).str());
54+
55+
std::unordered_map<int, ModuleInfo> modules;
56+
57+
std::string line;
58+
while (std::getline(input, line))
59+
{
60+
std::stringstream ss(line);
61+
62+
intptr_t start;
63+
intptr_t end;
64+
SectionProtection protection;
65+
intptr_t offset;
66+
int dev1, dev2;
67+
int inode;
68+
std::string path;
69+
ss >> std::hex >> start >> skip<char> >> end >> skip<char> >> protection >> skip<char> >> offset >> dev1 >> skip<char> >> dev2 >> std::dec >> inode >> std::skipws >> path;
70+
71+
EnumerateRemoteSectionData section = {};
72+
section.BaseAddress = (RC_Pointer)start;
73+
section.Size = end - start;
74+
section.Protection = protection;
75+
76+
section.Category = SectionCategory::Unknown;
77+
section.Type = SectionType::Unknown;
78+
if (inode != 0)
79+
{
80+
section.Type = SectionType::Image;
81+
82+
if (protection & SectionProtection::Read && protection & SectionProtection::Execute)
83+
{
84+
section.Category = SectionCategory::CODE;
85+
}
86+
else if (protection & SectionProtection::Read && protection & SectionProtection::Write)
87+
{
88+
section.Category = SectionCategory::DATA;
89+
}
90+
91+
MultiByteToUnicode(path.c_str(), section.ModulePath, PATH_MAXIMUM_LENGTH);
92+
93+
auto& module = modules[inode];
94+
module.Start = module.Start != 0 ? std::min(module.Start, start) : start;
95+
module.End = module.End != 0 ? std::max(module.End, end) : end;
96+
if (module.Path[0] == 0)
97+
{
98+
std::memcpy(module.Path, section.ModulePath, PATH_MAXIMUM_LENGTH);
99+
}
100+
}
101+
else
102+
{
103+
section.Type = SectionType::Mapped;
104+
105+
if (protection & SectionProtection::Read || protection & SectionProtection::Write)
106+
{
107+
section.Category = SectionCategory::HEAP;
108+
}
109+
}
110+
111+
if (callbackSection != nullptr)
112+
{
113+
callbackSection(&section);
114+
}
115+
}
116+
117+
if (callbackModule != nullptr)
118+
{
119+
for (auto&& kv : modules)
120+
{
121+
EnumerateRemoteModuleData module = {};
122+
module.BaseAddress = (RC_Pointer)kv.second.Start;
123+
module.Size = kv.second.End - kv.second.Start;
124+
std::memcpy(module.Path, kv.second.Path, PATH_MAXIMUM_LENGTH);
125+
126+
callbackModule(&module);
127+
}
128+
}
129+
}

‎NativeCore/Unix/IsProcessValid.cpp‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#include <sys/types.h>
2+
#include <signal.h>
3+
4+
#include "NativeCore.hpp"
5+
6+
extern "C" bool IsProcessValid(RC_Pointer handle)
7+
{
8+
return kill((pid_t)(intptr_t)handle, 0) == 0;
9+
}

0 commit comments

Comments
 (0)