diff --git a/.gitignore b/.gitignore index 9491a2f..30aefde 100644 --- a/.gitignore +++ b/.gitignore @@ -360,4 +360,7 @@ MigrationBackup/ .ionide/ # Fody - auto-generated XML schema -FodyWeavers.xsd \ No newline at end of file +FodyWeavers.xsd + +/Build/ +*.ini diff --git a/Build/MemoryReadProject.exe b/Build/MemoryReadProject.exe deleted file mode 100644 index c6e5b08..0000000 Binary files a/Build/MemoryReadProject.exe and /dev/null differ diff --git a/MemoryReadProject.sln b/MemoryReadProject.sln index 3fdc0a0..65bb113 100644 --- a/MemoryReadProject.sln +++ b/MemoryReadProject.sln @@ -5,6 +5,8 @@ VisualStudioVersion = 17.9.34728.123 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MemoryReadProject", "MemoryReadProject\MemoryReadProject.vcxproj", "{9C800F96-AE23-4E5B-80F9-BE36A1631A1A}" EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Test", "Test\Test.vcxproj", "{068A6D2C-1986-435F-B067-455FC8A0BD12}" +EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|x64 = Debug|x64 @@ -21,6 +23,14 @@ Global {9C800F96-AE23-4E5B-80F9-BE36A1631A1A}.Release|x64.Build.0 = Release|x64 {9C800F96-AE23-4E5B-80F9-BE36A1631A1A}.Release|x86.ActiveCfg = Release|Win32 {9C800F96-AE23-4E5B-80F9-BE36A1631A1A}.Release|x86.Build.0 = Release|Win32 + {068A6D2C-1986-435F-B067-455FC8A0BD12}.Debug|x64.ActiveCfg = Debug|x64 + {068A6D2C-1986-435F-B067-455FC8A0BD12}.Debug|x64.Build.0 = Debug|x64 + {068A6D2C-1986-435F-B067-455FC8A0BD12}.Debug|x86.ActiveCfg = Debug|Win32 + {068A6D2C-1986-435F-B067-455FC8A0BD12}.Debug|x86.Build.0 = Debug|Win32 + {068A6D2C-1986-435F-B067-455FC8A0BD12}.Release|x64.ActiveCfg = Release|x64 + {068A6D2C-1986-435F-B067-455FC8A0BD12}.Release|x64.Build.0 = Release|x64 + {068A6D2C-1986-435F-B067-455FC8A0BD12}.Release|x86.ActiveCfg = Release|Win32 + {068A6D2C-1986-435F-B067-455FC8A0BD12}.Release|x86.Build.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE diff --git a/MemoryReadProject/Include/Process.h b/MemoryReadProject/Include/Process.h index 57ba052..5727a53 100644 --- a/MemoryReadProject/Include/Process.h +++ b/MemoryReadProject/Include/Process.h @@ -4,19 +4,46 @@ using PID = DWORD; using PROCESS = HANDLE; struct SelectedProcess { - PID pid{ NULL }; - PROCESS process {nullptr}; -}; + PID pid{ NULL }; + PROCESS process{ nullptr }; + + + ~SelectedProcess() { + if (this->process != nullptr) + CloseHandle(this->process); + } + + void openProcess(); + + template + void ReadMemory(void* start, size_t size, T const &buff); + template + void WriteMemory(void* start, size_t size, T const &buff); + +}; namespace Process { + void EnableDebugPriv(); + + void GetAllProcess(); + inline std::map currentsProcess; + + inline SelectedProcess selectedProcess{ NULL }; - void EnableDebugPriv(); + //Memory Pages Info + inline std::map currentMemoryModulesInfo; + void GetMemoryPages(); + void DrawMemoryPages(const int ¤tDrawPageIndex); - inline std::map currentsProcess; + //Modules Info + inline std::map currentProcessModules; + void GetModules(); + void DrawModules(const int& currentDrawModuleIndex); - inline SelectedProcess selectedProcess{ NULL }; + //Finded Memory + template + inline std::map findedCurrentProcessMemory; - void GetAllProcess(); } //void refindBytePatternInProcessMemory(PROCESS process, void* pattern, size_t patternLen, std::vector& found) diff --git a/MemoryReadProject/imgui.ini b/MemoryReadProject/imgui.ini deleted file mode 100644 index cc304d1..0000000 --- a/MemoryReadProject/imgui.ini +++ /dev/null @@ -1,16 +0,0 @@ -[Window][Debug##Default] -Pos=60,60 -Size=400,400 - -[Window][Dear ImGui Demo] -Pos=650,20 -Size=550,680 - -[Window][Hello, world!] -Pos=60,60 -Size=339,180 - -[Window][MemoryReadyProject] -Pos=366,85 -Size=520,479 - diff --git a/MemoryReadProject/src/MemoryReadProject.cpp b/MemoryReadProject/src/MemoryReadProject.cpp index f0713db..6f91082 100644 --- a/MemoryReadProject/src/MemoryReadProject.cpp +++ b/MemoryReadProject/src/MemoryReadProject.cpp @@ -1,56 +1,195 @@ #include "../Include/global.h" +char ProcessName[128]; +int currentDrawModuleIndex{ 0 }; + + +int FindValueIndex{ 0 }; +const char* FindValueTypes[] +{ + "int", "float" +}; + +char FindValue[60]; + +//template +//GetType(const char* type) { +// switch (type) +// { +// case "int": +// return int; +// +// case "float": +// return float; +// +// default: +// break; +// } +//} + void menu() { if (ImGui::BeginTabBar("##open selector")) { if (ImGui::BeginTabItem("Select Process")) { - if (ImGui::Button("Update Process List")) { - Process::GetAllProcess(); - } + ImGui::InputText("Process Name", ProcessName, IM_ARRAYSIZE(ProcessName)); + + Process::GetAllProcess(); std::map::iterator it = Process::currentsProcess.begin(); ImGui::BeginChild("Process", ImVec2(500, 150)); { - while (it != Process::currentsProcess.end()) { - if (it->second == Process::selectedProcess.pid) { - ImGui::PushStyleColor(ImGuiCol_Text, ImVec4(0, 1, 0, 1)); + int ProcessNameCount = 0; + for (int i = 0; i < ProcessName[i] != '\0'; i++) + { + ++ProcessNameCount; + } + + bool print = false; + for (; it != Process::currentsProcess.end();) { + if (ProcessNameCount > 0) { + for (int i = 0; i < ProcessNameCount;) { + try + { + if (it->first[i] == ProcessName[i]) { + ++i; + } + else + { + break; + } + if (i == ProcessNameCount) { + print = true; + } + } + catch (const std::exception&) + { + print = false; + break; + } + } + + if (print) { + if (it->second == Process::selectedProcess.pid) { + ImGui::PushStyleColor(ImGuiCol_Text, ImVec4(0, 1, 0, 1)); + } + else + { + ImGui::PushStyleColor(ImGuiCol_Text, ImVec4(1, 0, 0, 1)); + } + + ImGui::Text("ProcessName: %ls / PID: %d", it->first.c_str(), it->second); + if (ImGui::IsItemClicked()) { + Process::selectedProcess.pid = it->second; + Process::selectedProcess.openProcess(); + Process::GetMemoryPages(); + Process::GetModules(); + } + ImGui::PopStyleColor(); + print = false; + } + ++it; } else { - ImGui::PushStyleColor(ImGuiCol_Text, ImVec4(1, 0, 0, 1)); + if (it->second == Process::selectedProcess.pid) { + ImGui::PushStyleColor(ImGuiCol_Text, ImVec4(0, 1, 0, 1)); + } + else + { + ImGui::PushStyleColor(ImGuiCol_Text, ImVec4(1, 0, 0, 1)); + } + + ImGui::Text("ProcessName: %ls / PID: %d", it->first.c_str(), it->second); + if (ImGui::IsItemClicked()) { + Process::selectedProcess.pid = it->second; + Process::selectedProcess.openProcess(); + Process::GetMemoryPages(); + Process::GetModules(); + } + ImGui::PopStyleColor(); + ++it; } - ImGui::Text("ProcessName: %ls / PID: %d", it->first.c_str(), it->second); - - ImGui::PopStyleColor(); - - if (ImGui::IsItemClicked()) { - Process::selectedProcess.pid = it->second; - } - ++it; } + }ImGui::EndChild(); ImGui::EndTabItem(); } - if(ImGui::BeginTabItem("Memory")) { - if (Process::selectedProcess.pid != NULL) { + if (Process::selectedProcess.pid) { + //Memory + if (ImGui::BeginTabItem("Memory Page Info")) { + if (ImGui::Button("Update Pages")) { + Process::GetMemoryPages(); + } + + ImGui::Text("Memory Pages"); + ImGui::BeginChild("Memory Page", ImVec2(700, 300)); + { + if (currentDrawModuleIndex * 30 < Process::currentMemoryModulesInfo.size()) { + for (int i = currentDrawModuleIndex * 30, count = 0; + i < Process::currentMemoryModulesInfo.size() && count < 30; + i++, count++) + { + Process::DrawMemoryPages(i); + } + } + }ImGui::EndChild();//Get modules end + + //Memory Pages + ImGui::BeginChild("Memory Pages Count", ImVec2(700, 50), 0, ImGuiWindowFlags_HorizontalScrollbar); + { + for (int i = 0; i < Process::currentMemoryModulesInfo.size() / 30; i++) + { + char buffer[12]; +#pragma warning(suppress: 4996) + std::sprintf(buffer, "%d", i); + if (ImGui::Button(buffer, ImVec2(50, 30))) { + currentDrawModuleIndex = i; + } + ImGui::SameLine(); + } + }ImGui::EndChild(); + + + ImGui::EndTabItem(); //End Memory tab + } + + if (ImGui::BeginTabItem("Modules Info")) { + + for (int i = 0; i < Process::currentProcessModules.size(); i++) + { + Process::DrawModules(i); + } + ImGui::EndTabItem(); } - ImGui::EndTabItem(); - } + if (ImGui::BeginTabItem("Find Value")) { + ImGui::InputText("Find Value", FindValue, IM_ARRAYSIZE(FindValue)); + + ImGui::Combo("Type", &FindValueIndex, FindValueTypes, 2); + - ImGui::EndTabBar(); + /*if (Process::findedCurrentProcessMemory) { + }*/ - } + + + ImGui::EndTabItem(); + } + } + + + ImGui::EndTabBar(); + } //endTabNar } void startGui() { @@ -172,6 +311,8 @@ void startGui() { UI::CleanupDeviceD3D(); ::DestroyWindow(hwnd); ::UnregisterClassW(wc.lpszClassName, wc.hInstance); + + //Process::selectedProcess.Destroy(); } diff --git a/MemoryReadProject/src/Process.cpp b/MemoryReadProject/src/Process.cpp index fc1826d..bd4dec6 100644 --- a/MemoryReadProject/src/Process.cpp +++ b/MemoryReadProject/src/Process.cpp @@ -1,6 +1,26 @@ #include "../Include/global.h" +void SelectedProcess::openProcess() { + this->process = OpenProcess( + PROCESS_VM_READ | PROCESS_QUERY_INFORMATION | + PROCESS_VM_WRITE | PROCESS_VM_OPERATION + , 0, this->pid); + + if ((this->process == INVALID_HANDLE_VALUE) || (this->process == 0)) { + this->process = 0; + this->pid = 0; + } +} + +template +void SelectedProcess::ReadMemory(void* start, size_t size, T const& buff) { + if (ReadProcessMemory(this->process, start, buff, size, nullptr)) { + return buff; + } + return buff; +} + void Process::EnableDebugPriv() { HANDLE hToken; @@ -21,24 +41,219 @@ void Process::EnableDebugPriv() } void Process::GetAllProcess() { - Process::EnableDebugPriv(); - - if (Process::currentsProcess.size()) { - Process::currentsProcess.clear(); - } - - PROCESSENTRY32 entry; - entry.dwSize = sizeof(PROCESSENTRY32); - - HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); - - if (Process32First(snapshot, &entry) == TRUE) { - do - { - Process::currentsProcess[entry.szExeFile] = entry.th32ProcessID; - //if (wcscmp(entry.szExeFile, /*processName*/) == 0) { - //printf("process name: %ls / PID: %d\n", &entry.szExeFile, entry.th32ProcessID); - //} - } while (Process32Next(snapshot, &entry) == TRUE); - } + Process::EnableDebugPriv(); + + if (Process::currentsProcess.size()) { + Process::currentsProcess.clear(); + } + + PROCESSENTRY32 entry; + entry.dwSize = sizeof(PROCESSENTRY32); + + HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); + + if (Process32First(snapshot, &entry) == TRUE) { + do + { + Process::currentsProcess[entry.szExeFile] = entry.th32ProcessID; + //if (wcscmp(entry.szExeFile, /*processName*/) == 0) { + //printf("process name: %ls / PID: %d\n", &entry.szExeFile, entry.th32ProcessID); + //} + } while (Process32Next(snapshot, &entry) == TRUE); + } +} + +unsigned long show_module(MEMORY_BASIC_INFORMATION info, int& count) { + unsigned long usage = 0; + + if ((info.State == MEM_COMMIT) && (info.AllocationProtect == PAGE_READWRITE || info.AllocationProtect == PAGE_READONLY)) + usage += info.RegionSize; + + Process::currentMemoryModulesInfo[count] = info; + + return usage; +} + +//GetMemoryPages +void Process::GetMemoryPages() { + Process::currentMemoryModulesInfo.clear(); + + unsigned long usage = 0; + + unsigned char* p = NULL; + + MEMORY_BASIC_INFORMATION info; + + int count{ 0 }; + for (p = NULL; + VirtualQueryEx(Process::selectedProcess.process, p, &info, sizeof(info)) == sizeof(info); + p += info.RegionSize) + { + usage += show_module(info, count); + ++count; + } +} + +void Process::DrawMemoryPages(const int& currentDrawPageIndex) { + if (!Process::currentMemoryModulesInfo.size()) { + return; + } + + SYSTEM_INFO sSysInfo = { }; + GetSystemInfo(&sSysInfo); + + ImGui::Text("BaseAddress: %p RegionSize: (%zu) pages count: %d", + Process::currentMemoryModulesInfo[currentDrawPageIndex].BaseAddress, + Process::currentMemoryModulesInfo[currentDrawPageIndex].RegionSize, + //Process::currentMemoryModulesInfo[currentDrawPageIndex].RegionSize / 1024, + Process::currentMemoryModulesInfo[currentDrawPageIndex].RegionSize / sSysInfo.dwPageSize); + + if (ImGui::IsItemClicked()) { + OpenClipboard(NULL); + EmptyClipboard(); + + char* str = (char*)malloc(20 * sizeof(char)); + snprintf(str, 20, "%p", Process::currentMemoryModulesInfo[currentDrawPageIndex].BaseAddress); + + HGLOBAL hg = GlobalAlloc(GMEM_MOVEABLE, strlen(str) + 1); + + if (!hg) { + CloseClipboard(); + } + + memcpy(GlobalLock(hg), str, strlen(str) + 1); + GlobalUnlock(hg); + SetClipboardData(CF_TEXT, hg); + CloseClipboard(); + GlobalFree(hg); + + } + + ImGui::SameLine(); + + switch (Process::currentMemoryModulesInfo[currentDrawPageIndex].State) { + case MEM_COMMIT: + ImGui::Text("Committed"); + break; + case MEM_RESERVE: + ImGui::Text("Reserved"); + break; + case MEM_FREE: + ImGui::Text("Free"); + break; + } + + ImGui::SameLine(); + + switch (Process::currentMemoryModulesInfo[currentDrawPageIndex].Type) { + case MEM_IMAGE: + ImGui::Text("Code Module"); + break; + case MEM_MAPPED: + ImGui::Text("Mapped "); + break; + case MEM_PRIVATE: + ImGui::Text("Private "); + } + + ImGui::SameLine(); + + int guard = 0, nocache = 0; + + if (Process::currentMemoryModulesInfo[currentDrawPageIndex].AllocationProtect & PAGE_NOCACHE) + nocache = 1; + if (Process::currentMemoryModulesInfo[currentDrawPageIndex].AllocationProtect & PAGE_GUARD) + guard = 1; + + Process::currentMemoryModulesInfo[currentDrawPageIndex].AllocationProtect &= ~(PAGE_GUARD | PAGE_NOCACHE); + + switch (Process::currentMemoryModulesInfo[currentDrawPageIndex].AllocationProtect) { + case PAGE_READONLY: + ImGui::Text("Read Only"); + break; + case PAGE_READWRITE: + ImGui::Text("Read/Write"); + break; + case PAGE_WRITECOPY: + ImGui::Text("Copy on Write"); + break; + case PAGE_EXECUTE: + ImGui::Text("Execute only"); + break; + case PAGE_EXECUTE_READ: + ImGui::Text("Execute/Read"); + break; + case PAGE_EXECUTE_READWRITE: + ImGui::Text("Execute/Read/Write"); + break; + case PAGE_EXECUTE_WRITECOPY: + ImGui::Text("COW Executable"); + break; + } + + ImGui::SameLine(); + + if (guard) + ImGui::Text("guard page"); + if (nocache) + ImGui::Text("non-cacheable"); + + ImGui::SameLine(); + + int data = 0; + + try + { + + + + + /*char bufferValue[256]; + std::sprintf(bufferValue, "%s");*/ + + ImGui::Text(""); + ImGui::Text("\n"); + } + catch (const std::exception&) + { + ImGui::Text("\n"); + } +} + +//Get Modules +void Process::GetModules() { + HANDLE hModuleSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, Process::selectedProcess.pid); + MODULEENTRY32 me32 = MODULEENTRY32(); + me32.dwSize = sizeof(MODULEENTRY32); + + if (hModuleSnap == INVALID_HANDLE_VALUE || hModuleSnap == 0) { + CloseHandle(hModuleSnap); + return; + } + + int moduleCount{ 0 }; + + if (Module32First(hModuleSnap, &me32) == TRUE) { + Process::currentProcessModules[moduleCount] = me32; + ++moduleCount; + } + else + { + CloseHandle(hModuleSnap); + return; + } + + + while (Module32Next(hModuleSnap, &me32) == TRUE) { + Process::currentProcessModules[moduleCount] = me32; + ++moduleCount; + } +} + +void Process::DrawModules(const int& currentDrawModuleIndex) { + ImGui::Text("ModuleName: %ls \\ ModBaseAddr: %p \\ ModBaseSize: %lu ", + Process::currentProcessModules[currentDrawModuleIndex].szModule, + Process::currentProcessModules[currentDrawModuleIndex].modBaseAddr, + Process::currentProcessModules[currentDrawModuleIndex].modBaseSize + ); } \ No newline at end of file diff --git a/Test/Test.cpp b/Test/Test.cpp new file mode 100644 index 0000000..54fa247 --- /dev/null +++ b/Test/Test.cpp @@ -0,0 +1,34 @@ +// Test.cpp : This file contains the 'main' function. Program execution begins and ends there. +// + +#include +#include + +int main() +{ + SetConsoleTitleA("teste.exe"); + + std::cout << "Hello World!\n"; + + int life = 100; + + std::cout << "Life address: " << &life << " Life offset " << (DWORD)GetModuleHandle(NULL) - (DWORD) & life << std::endl; + + std::cin.get(); + + while (true) + { + std::cout << life << std::endl; + } +} + +// Run program: Ctrl + F5 or Debug > Start Without Debugging menu +// Debug program: F5 or Debug > Start Debugging menu + +// Tips for Getting Started: +// 1. Use the Solution Explorer window to add/manage files +// 2. Use the Team Explorer window to connect to source control +// 3. Use the Output window to see build output and other messages +// 4. Use the Error List window to view errors +// 5. Go to Project > Add New Item to create new code files, or Project > Add Existing Item to add existing code files to the project +// 6. In the future, to open this project again, go to File > Open > Project and select the .sln file diff --git a/Test/Test.vcxproj b/Test/Test.vcxproj new file mode 100644 index 0000000..4c825d9 --- /dev/null +++ b/Test/Test.vcxproj @@ -0,0 +1,135 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 17.0 + Win32Proj + {068a6d2c-1986-435f-b067-455fc8a0bd12} + Test + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + true + true + + + + + + + + + \ No newline at end of file diff --git a/Test/Test.vcxproj.filters b/Test/Test.vcxproj.filters new file mode 100644 index 0000000..db0c6cf --- /dev/null +++ b/Test/Test.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + \ No newline at end of file