Sandboxie循序渐进耳之监控篇上

PipServer.*SbieIniServer::Handler2处理MSGID_SBIE_INI_GET_VERSION    if (msg->msgid == MSGID_SBIE_INI_GET_VERSION) {
        return GetVersion(msg);}

MSG_HEADER *SbieIniServer::GetVersion(MSG_HEADER *msg){    WCHAR ver_str[16];    wsprintf(ver_str, L"%S", MY_VERSION_STRING);  // MY_VERSION_STRING = "5.40" 
    ULONG ver_len = wcslen(ver_str);    ULONG rpl_len = sizeof(SBIE_INI_GET_USER_RPL)                  + (ver_len + 1) * sizeof(WCHAR);    SBIE_INI_GET_VERSION_RPL *rpl =        (SBIE_INI_GET_VERSION_RPL *)LONG_REPLY(rpl_len);    if (! rpl)        return SHORT_REPLY(STATUS_INSUFFICIENT_RESOURCES);
    wcscpy(rpl->version, ver_str);    rpl->version_len = ver_len;    return &rpl->h;}

if (! data->PortHandle) {         BOOLEAN Silent = (req->msgid == MSGID_SBIE_INI_GET_VERSION ||                          req->msgid == MSGID_SBIE_INI_GET_USER ||                          req->msgid == MSGID_PROCESS_CHECK_INIT_COMPLETE);        if (! SbieDll_ConnectPort(Silent))            return NULL;

RtlInitUnicodeString(&PortName, SbieDll_PortName());// 连接服务端        status = NtConnectPort(            &data->PortHandle, &PortName, &QoS,            NULL, NULL, &data->MaxDataLen, NULL, NULL);        if (! NT_SUCCESS(status)) {            if (! ErrorReported) {                if (! Silent)                    SbieApi_Log(2203, L"connect %08X", status);                ErrorReported = TRUE;            }           // 连接失败返回            return FALSE;        }

        status = NtConnectPort(            &data->PortHandle, &PortName, &QoS,            NULL, NULL, &data->MaxDataLen, NULL, NULL);
        if (! NT_SUCCESS(status)) {// 如果失败，提示是否加载服务和驱动  只提示一次安装服务比较合适，nServiceloadflag标志是否第一次提示if (!nServiceloadflag && (IDYES == MessageBoxW(NULL, L"是否重新加载服务和驱动", L"RPC-Server Connect失败", MB_OK | MB_YESNOCANCEL))){// 加载......MessageBoxW(NULL, L"加载成功", L"Waring", NULL);}else{nServiceloadflag = TRUE;if (!ErrorReported) {if (!Silent)SbieApi_Log(2203, L"connect %08X", status);ErrorReported = TRUE;}return FALSE;}        }

// Cmdline获取控制码    if (! Parse_Command_Line(            &Command, &Driver_Name, &Driver_Path,            &Driver_Display, &Driver_MsgFile,            &Driver_Altitude, &Driver_Group,            &Options))        return EXIT_FAILURE;// 卸载    if (Command == CMD_DELETE) {        ok = Kmd_Delete_Service(Driver_Name);        if (ok)            ok = Kmd_Unregister_Event_Source(Driver_Name);        ok = TRUE;  // don't let the calling installer fail    }
// 安装    if (Command == CMD_INSTALL) {        ok = Kmd_Install_Service(            Driver_Name, Driver_Path, Driver_Display, Driver_Group, Options);        if (ok) {            if (! Driver_MsgFile)                Driver_MsgFile = Driver_Path;            ok = Kmd_Register_Event_Source(Driver_Name, Driver_MsgFile);            if (ok && Driver_Altitude)                ok = Kmd_Register_MiniFilter(Driver_Name, Driver_Altitude);            if (! ok) {                Kmd_Unregister_Event_Source(Driver_Name);                Kmd_Delete_Service(Driver_Name);            }        }    }
// 启动    if (Command == CMD_START)        ok = Kmd_Start_Service(Driver_Name);
// 停止    if (Command == CMD_STOP)        ok = Kmd_Stop_Service(Driver_Name);

void CSbieUtils::Install(EComponent Component, QStringList& Ops){QString HomePath = QCoreApplication::applicationDirPath().replace("/", "\"); // "C:\Program Files\Sandboxie "if ((Component & eDriver) != 0 && GetServiceStatus(SBIEDRV) == 0)Ops.append(QString::fromWCharArray(L"kmdutil.exe|install|" SBIEDRV L"|") + """ + HomePath + "\" + QString::fromWCharArray(SBIEDRV_SYS) + """ + "|type=kernel|start=demand|altitude=86900");if ((Component & eService) != 0 && GetServiceStatus(SBIESVC) == 0) {Ops.append(QString::fromWCharArray(L"kmdutil.exe|install|" SBIESVC L"|") + """ + HomePath + "\" + QString::fromWCharArray(SBIESVC_EXE) + """ + "|type=own|start=auto|display="Sandboxie Service"|group=UIGroup");Ops.append("reg.exe|ADD|HKLM\SYSTEM\ControlSet001\Services\SbieSvc|/v|PreferExternalManifest|/t|REG_DWORD|/d|1");}}

Cmd runing:1. kmdutil.exe install SbieDrv "{path}SbieDrv.sys" type=kernel start=demand altitude=869002. kmdutil.exe install SbieSvc "{path}SbieSvc.exe" type=own start=auto display="Sandboxie Service" group=UIGroup3. reg.exe ADD HKLMSYSTEMControlSet001ServicesSbieSvc.exe /v PreferExternalManifest /t REG_DWORD /d 14. Kmdutil start SbieDrv5. Kmdutil start SbieSvc

        if ((status != STATUS_SUCCESS)                            && (status != STATUS_BAD_INITIAL_PC)) {
            WCHAR msg[256];            swprintf(msg, L"%S (%08X) access=%08X initialized=%d", syscall_entry->name, status, HandleInfo->GrantedAccess, proc->initialized);            Log_Msg(MSG_2101, msg, Name != NULL ? Name->Name.Buffer : L"Unnamed object");        }

enum {    SVC_FIRST                   = 0x23450000L,
    SVC_LOOKUP_SID,    SVC_INJECT_PROCESS,    SVC_CANCEL_PROCESS,    SVC_UNMOUNT_HIVE,    SVC_LOG_MESSAGE,    SVC_RESTART_HOST_INJECTED_SVCS,
    SVC_LAST};

    //    // initialize modules.  these place hooks into the system.  hooks    // become active as soon as installed.  the Process module must be    // initialized first, because it initializes the process list    //
    if (ok)        ok = Process_Init();

    //    // install process notify routines    //
status = PsSetCreateProcessNotifyRoutine(Process_NotifyProcess, FALSE);

    if (ProcessId) {
        if (Create) {
            if (ParentId) {
                Process_NotifyProcess_Create(ProcessId, ParentId, NULL);            }
        } else {
            Process_NotifyProcess_Delete(ProcessId);        }    }

            Process_Low_Inject(                pid, session_id, create_time, nptr1, add_process_to_job, bHostInject);
        if (! Api_SendServiceMessage(SVC_INJECT_PROCESS, sizeof(msg), &msg))            status = STATUS_SERVER_DISABLED;

    else if (msgid == SVC_INJECT_PROCESS) {
        InjectLow(data_ptr);
    }    else if (msgid == SVC_RESTART_HOST_INJECTED_SVCS) {
        RestartHostInjectedSvcs();}

    if (SbieApi_CallOne(API_INJECT_COMPLETE, msg->process_id) == 0)        errlvl = 0;    else        errlvl = 0x99;

#define SBIEDLL_HOOK(pfx,proc)                      *(ULONG_PTR *)&__sys_##proc = (ULONG_PTR)           SbieDll_Hook(#proc, proc, pfx##proc);   if (! __sys_##proc) return FALSE;

   if (! SourceFunc) {        SbieApi_Log(2303, _fmt1, SourceFuncName, 1);        return NULL;}

  UCHAR *func = (UCHAR *)SourceFunc;    if (func[0] == 0xB8 &&                  // mov eax,?        func[5] == 0xBA &&                  // mov edx,?        *(USHORT *)&func[10] == 0xE2FF)     // jmp edx    {        ULONG i = 0;        ULONG *longs = *(ULONG **)&func[6];
        for (i = 0; i < 20; i++, longs++)        {            if (longs[0] == 0x5208EC83 && longs[1] == 0x0C24548B &&                longs[2] == 0x08245489 && longs[3] == 0x0C2444C7 &&                longs[5] == 0x042444C7)            {                SourceFunc = (void *)longs[4];                break;            }        }    }

    if (*(UCHAR *)SourceFunc == 0xEB) {        signed char offset = *((signed char *)SourceFunc + 1);        SourceFunc = (UCHAR *)SourceFunc + offset + 2;}

    while (*(UCHAR *)SourceFunc == 0xE9) {        diff = *(LONG *)((ULONG_PTR)SourceFunc + 1);        target = (ULONG_PTR)SourceFunc + diff + 5;        if (target == (ULONG_PTR)DetourFunc) {            SbieApi_Log(2303, _fmt1, SourceFuncName, 4);            return NULL;        }

    tramp = Dll_AllocCode128();    if (SbieApi_HookTramp(SourceFunc, tramp) != 0) {        SbieApi_Log(2303, _fmt1, SourceFuncName, 2);        return NULL;

    func = (UCHAR *)SourceFunc;
    if (!VirtualProtect(&func[-8], 20, PAGE_EXECUTE_READWRITE, &prot)) {
        ULONG err = GetLastError();        SbieApi_Log(2303, _fmt2, SourceFuncName, 33, err);        return NULL;        }    diff = (UCHAR *)DetourFunc - (func + 5);    func[0] = 0xE9;             // JMP DetourFunc    *(ULONG *)(&func[1]) = (ULONG)diff;        VirtualProtect(&func[-8], 20, prot, &dummy_prot);        func = (UCHAR *)(ULONG_PTR)(tramp + 16);

    // 设置List表    CListCtrl::InsertColumn(0, CMyMsg(MSG_3517), LVCFMT_LEFT, width0, 0);    CListCtrl::InsertColumn(1, CMyMsg(MSG_3518), LVCFMT_LEFT, width1, 0);    CListCtrl::InsertColumn(2, CMyMsg(MSG_3519), LVCFMT_LEFT, width2, 0);     CListCtrl::InsertColumn(3, L"测试", LVCFMT_LEFT, width2, 0);

CRect rc;this->GetClientRect(rc);int nWidth = rc.Width();CListCtrl *listctrl = (CListCtrl *)GetDlgItem(ID_MESSAGE_LIST_MONITORL);DWORD dwOldStyle;dwOldStyle = listctrl->GetExtendedStyle();listctrl->SetExtendedStyle(dwOldStyle | LVS_EX_FULLROWSELECT | LVS_EX_GRIDLINES);listctrl->InsertColumn(0, L"监控类型", LVCFMT_CENTER, nWidth / 3);listctrl->InsertColumn(1, L"监控api", LVCFMT_CENTER, nWidth / 3);listctrl->InsertColumn(2, L"捕获数据", LVCFMT_CENTER, nWidth / 3);

void CMyFrame::InitMenus(void){    //    // create and customize main menu    //
CMenu *pMenu = CMyApp::MyLoadMenu(L"TOP_MENU");

#----------------------------------------------------------------------------# New TOP_MENUS MSG#----------------------------------------------------------------------------5161;txt;01&Test.
5162;txt;01&ProcessAPiMonitor.

1. Class类声明afx_msg void OnCmdPackTools();
2. Map映射，OnCmdPackTools响应菜单点击函数BEGIN_MESSAGE_MAP(CMyFrame, CFrameWnd){    ......    ON_COMMAND(ID_MEUN_APIMONITOR,     OnCmdPackTools)    ......}
3. 方法实现，如何操作：void CMyFrame::OnCmdPackTools(){    AfxMessageBox(L"1");}

    //    // create viewers    //        // 初始化List-tree控件 进程/文件    m_proclist.Create(this);        m_filelist.Create(this);