-
Notifications
You must be signed in to change notification settings - Fork 3
Expand file tree
/
Copy pathGarbage.pas
More file actions
161 lines (135 loc) · 4.29 KB
/
Garbage.pas
File metadata and controls
161 lines (135 loc) · 4.29 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
function GetOrigApiAddr (HookAddr: pointer): pointer;
begin
{!} Assert(HookAddr <> nil);
result := pointer
(
integer(HookAddr) +
sizeof(THookRec) +
PINTEGER(integer(HookAddr) + 1)^ +
BRIDGE_DEF_CODE_OFS
);
end; // .function GetOrigApiAddr
function RecallWinApi (Context: PHookContext; NumArgs: integer): integer;
var
ApiAddr: pointer;
PtrArgs: integer;
ApiRes: integer;
begin
ApiAddr := GetOrigApiAddr(Ptr(PINTEGER(Context.ESP)^ - sizeof(THookRec)));
PtrArgs := integer(GetStdcallArg(Context, NumArgs));
asm
MOV ECX, NumArgs
MOV EDX, PtrArgs
@PUSHARGS:
PUSH [EDX]
SUB EDX, 4
Dec ECX
JNZ @PUSHARGS
MOV EAX, ApiAddr
CALL EAX
MOV ApiRes, EAX
end; // .asm
result := ApiRes;
end; // .function RecallWinApi
function FindHookHandlerAddr ({n} Addr: pointer; ModuleList: TStrList {of TModuleInfo};
out ModuleInd, out IsHook: boolean): boolean;
const
MAX_HOOK_WRAPPER_SIZE = 256;
var
Disasm: hde32.TDisasm;
BufPos: integer;
HookFound: boolean;
HookAddr: pointer;
begin
result := FindModuleByAddr(Addr, ModuleList, ModuleInd);
?? try except
if not result then begin
HookFound := false;
BufPos := 0;
while (BufPos < MAX_HOOK_WRAPPER_SIZE) and not HookFound do begin
hde32.hde32_disasm(Utils.PtrOfs(Addr, BufPos), Disasm);
if Disasm.Opcode in RET_OPCODES then begin
BufPos := MAX_HOOK_WRAPPER_SIZE;
end else if (Disasm.Len = sizeof(THookRec)) and (Disasm.Opcode in [OPCODE_JUMP, OPCODE_CALL])
then begin
HookFound := true;
HookAddr := Utils.PtrOfs(Addr, BufPos + sizeof(THookRec)
+ pinteger(Utils.PtrOfs(Addr, BufPos + 1))^);
end;
Inc(BufPos, Disasm.Len);
end; // .while
end else begin
IsHook := false;
end; // .else
end; // .function FindHookHandlerAddr
DEFAULT_LINE_END_MARKER = #10;
DIGITS = ['0'..'9'];
SIGNS = ['+', '-'];
INT_HEAD = SIGNS + DIGITS;
HEX_LETTERS = ['a'..'f', 'A'..'F'];
HEX_DIGITS = DIGITS + HEX_LETTERS;
HEX_INT_PASCAL_PREFIX = '$';
HEX_INT_C_PREFIX = ['x', 'X'];
FLOAT_DELIM = '.';
BLANKS = [#0..#32];
INLINE_BLANKS = BLANKS - [DEFAULT_LINE_END_MARKER];
IDENT_HEAD = ['_', 'a'..'z', 'A'..'Z'];
IDENT_BODY = IDENT_HEAD + DIGITS;
function IsInt: boolean;
function IsHexInt: boolean;
function IsFloat: boolean;
function IsNumber: boolean;
function IsIdent: boolean;
function TTextScanner.IsInt: boolean;
var
Ch: char;
begin
Ch := Self.c;
result := (Ch in DIGITS) or ((Ch in SIGNS) and (CharsRel[1] in DIGITS));
end;
function TTextScanner.IsHexInt: boolean;
var
Ch: char;
begin???????? what is int???
Ch := Self.c;
result := (Ch in DIGITS) or
((Ch = HEX_INT_PASCAL_PREFIX) and CharsRel[1] in DIGITS) or
(Ch in (DIGITS + HEX_INT_PASCAL_PREFIX)??? $ + digit) or
((Ch = '0') and (CharsRel[1] in HEX_INT_C_PREFIX) and (CharsRel[2] in DIGITS));
end; // .function TTextScanner.IsHexInt
function TTextScanner.IsFloat: boolean;
begin
result := IsInt or ((Self.c = FLOAT_DELIM) and (CharsRel[1] in DIGITS));
end;
function TTextScanner.IsNumber: boolean;
begin
result := IsFloat or IsHexInt;
end;
function TTextScanner.IsIdent: boolean;
begin
result := Self.c in IDENT_HEAD;
end;
function TTextScanner.ReadAnyHexInt (out Res: integer): boolean;
var
Ch: char;
StartPos: integer;
StrValue: string;
ResValue: integer;
begin
Ch := Self.c;
result := Ch in (HEX_DIGITS + ['$']);
if result then begin
if (Ch = '0') and (CharsRel[1] in ['x', 'X']) then begin
GotoRelPos( +2 );
end else if Ch = '$' then begin
GotoNextChar;
end;
StartPos := fPos;
SkipCharset(HEX_DIGITS);
StrValue := GetSubstrAtPos(StartPos, fPos - StartPos);
result := (StrValue <> '') and TryStrToInt('$' + StrValue, ResValue);
if result then begin
Res := ResValue;
end;
end; // .if
end; // .function TTextScanner.ReadAnyHexInt