Skip to content

Commit

Permalink
fixed compiler warning, gave usch poc more useful output
Browse files Browse the repository at this point in the history
  • Loading branch information
jbremer committed May 16, 2012
1 parent 7c87352 commit 75e1d08
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 4 deletions.
4 changes: 2 additions & 2 deletions rreat.c
Expand Up @@ -1001,8 +1001,8 @@ rreat_syshook_t *rreat_syshook_init(rreat_t *rr)
// instruction, therefore we have to add 4 to a few instructions.
OSVERSIONINFOEX OsVersion = {0};
OsVersion.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
if(GetVersionEx(&OsVersion) && OsVersion.dwMajorVersion == 6 &&
OsVersion.dwMinorVersion == 1) {
if(GetVersionEx((OSVERSIONINFO *) &OsVersion) &&
OsVersion.dwMajorVersion == 6 && OsVersion.dwMinorVersion == 1) {
bytes[0x33] += 4;
bytes[0x37] += 4;
bytes[0x43] += 4;
Expand Down
9 changes: 7 additions & 2 deletions usch-poc/parent.c
Expand Up @@ -84,12 +84,14 @@ void hook_ZwCreateFile(rreat_syshook_t *syshook, unsigned long *args,
rreat_read(syshook->_rr, (addr_t) ObjectName.Buffer, wszFileName, len);
wszFileName[len >> 1] = 0;

fprintf(stderr, "Opening File: \"%S\" :)\n", wszFileName);
fprintf(stderr, "Child %d opens file: \"%S\".\n",
syshook->_rr->process_id, wszFileName);
}
else {
CONTEXT ctx; rreat_context_get(syshook->_rr, thread_id, &ctx,
CONTEXT_FULL);
fprintf(stderr, "Return Value: 0x%08x %d\n", ctx.Eax, ctx.Eax);
fprintf(stderr, "Child %d return value: 0x%08x %d\n",
syshook->_rr->process_id, ctx.Eax, ctx.Eax);
}
}

Expand All @@ -116,6 +118,9 @@ int main(int argc, char *argv[])
// we place a hook at an API of choice.
rreat_syshook_set_hook(syshook, "ZwCreateFile", &hook_ZwCreateFile);

fprintf(stderr, "Started hooking child with process identifier: %d\n",
rr->process_id);

// resume the childs main thread, with a hook for ZwCreateFile()
rreat_thread_resume(rr, 0);

Expand Down

0 comments on commit 75e1d08

Please sign in to comment.