|
There is no 'friendly' way of doing it. With that being said, a hacked up way would be to use CreateRemoteThread() into a target process and force it to close the file handle. Which in turn would probably cause serious problems in the target process.
Partial pseudo-code looks something like this:
<br />
PID TargetProcess = P;<br />
HANDLE TargetHandle = H;<br />
HANDLE hProc = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ,FALSE,TargetProcess);<br />
HMODULE hMod = LoadLibrary(_T("kernel32.dll"));<br />
DWORD rc;<br />
CreateRemoteThread(hProc,0,0,(__stdcall *)(void*)GetProcAddress(hMod,"CloseHandle"),TargetHandle,0,&rc );<br />
Best Wishes,
-Randor
|
|
|
|
|
Thank You for Your pseudocode!
Randor wrote: Which in turn would probably cause serious problems in the target process.
Well, if there exists a way to suspend the process during this operation,
and reopen the same handle after that it surely would do the job
without skrewing up the target process.
By the way, opening UnlockerDriver5.sys in Notepad
I noticed that it is a User Mode driver, importing
a dozen of routines from ntoskrnl.dll.
I've never wrote WinNT drivers up to now, so it seems
I have to learn the corresponding rituals 
to produce a "smooth" solution to the problem
of stealing Skype's files without depressing Skype too much 
|
|
|
|
|
OK, I've learned the rituals of writing kernel mode drivers --
these rituals turned out to be not that difficult.
What is difficult, however, is to determine what
this driver ought to do exactly (find a "handles table"
inside a Kernal memory space and change temporary
the sharing attributes of the corresponding handle?
Or to do somethinh else?). I have no time to read books
of Russinovich&Solomon or Dabak&Phadke&Borate,
so I decided to try first to find a way to do the job without
writing drivers of any kind, working entirely in User mode.
I've tried several ways to find a solution.
1) Injecting in the remote process blocking the access to the file
a remote thread, which uses the blocking handle
to copy the corresponding file rather than to close the handle.
For the purpose one is to inject Your own dll instead of
starting inside the remote thread any functon from Kernel32.dll
or some other "canonical" Windows library.
The reason is that any function like ReadFile(), etc.
uses more than 1 parameter. In Your own dll You can export a function
fn(void*p) which formaly has one pointer parameter, but this pointer
can point to a structure containing any number of parameters needed
e.g, for CreateFile(). The latter function can then be called from
inside of fn(). The structure with necessary parameters for fn()
is, of course, to be injected as well into the address space of the blocking
process, because the pointer to this structure in the calling process
has no sense in the remote process.
A sample implementation of the corresponding
algorithm (by Zoltan Csizmadia) can be found at
http://www.codeguru.com/cpp/w-p/dll/article.php/c105/ .
I've tried the demo exe from there: it is trying to attach a simple dll
to any process of Your choice. It succeeded for many of the processes
running on my PC, but failed to attach to Skype 
2) Duplicating remote handle of an open file into Your process.
I've tried (different variations of) the next code:
bool CopyLockedFile(LPCTSTR lpFileName,int bytesToRead,char*buff)
{
HANDLE hProcess=NULL,//handle of the blocking process
hRemote=NULL;//blocking handle to the file lpFileName I wish to read
//Receive the handle hProcess of the blocking process
//as well as the blocking handle hRemote of the file You wish to read
....... //The code is omitted here
HANDLE hDup=NULL;
DuplicateHandle(hProcess,hRemote,GetCurrentProcess(),&hDup,0,FALSE,DUPLICATE_SAME_ACCESS);
DWORD err=GetLastError();
if(err!=0||hDup==NULL)return false;//Never happened!
CloseHandle(hProcess);
BOOL ok=LockFile(hDup,0,0,bytesToRead,0);//Does not help!
err=GetLastError();
if(!ok||err!=0)return false;//Never happened!
int bytesRead=0;
ok=ReadFile(hDup,(LPVOID)buff,bytesToRead,&bytesRead,NULL);
err=GetLastError();
CloseHandle(hDup);
if(!ok||err!=0)return false;//Never happened!
if(bytesRead==bytesToRead)return true;
return false;
}
Variations of the code consisted in changing different flags, using in ReadFile()
non-zero OVERLAPPED structure instead of last parameter=NULL, etc.
The result was always the same: the code produced no errors, but the number
of read bytes (i.e. bytesRead) were less than the file length bytesToRead.
More exactly, at the first run of my prog this number was slightly less
(about 5%) than the file length. All subsequent runs produced bytesRead==0.
Until the blocking app (Skype in this case) was restarted. Then my prog
was able again to partially read the file.
3) Googling in the internet I found that many other peoples
(especially those writing backup apps) were faced with this problem.
The solution proposed by them was to use somehow Windows Volume shadow copy service.
The only working application using this service I've found is ntbackup.exe by MS.
It succeedes in copying Skype's .dbb files only if Volume shadow service
is permitted as an option, otherwise it fails. Another application
(TeeBackuper written in Delphi -- source code 30K, exe -- 3.2M!) also failed.
It clearly did not use the Volume shadow service (which, by the way is
present on WinXP and higher only, so the solution using this service
would not work on Win2k).
4) I was prepairing already to learn more about Volume shadow service,
to include it somehow into my app. But yesterday googling again
I found the following remarkable link:
http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=1089734&SiteId=1 .
The author (ismar) faced with the same problem. The only difference
is that he works with C# .NET. His first (buggy) solution
is the direct .NET counterpart of the "DuplicateHandle" way 2) above.
The bug of this .NET solution is roughly the same as the bug
of C++ solution: failure to read the locked file more than once.
Which indicates that using of CreateFile() together with the handle obtained
via DuplicateHandle() produces an (undocumented) bug of MS itself!
The good thing is that after about 2 weeks of playing around with
the buggy solution ismar found the working one! The
idea is to use, instead of ReadFile(),
the combination CreateFileMapping()+MapViewOfFile()
(in C# language this are NativeMethods.CreateFileMapping()+
NativeMethods.MapViewOfFile()).
I immediately have changed the buggy code 2) by the code:
bool CopyLockedFile(LPCTSTR lpFileName,int bytesToRead,char*buff)
{
HANDLE hProcess=NULL,//handle of the blocking process
hRemote=NULL;//blocking handle to the file lpFileName I wish to read
//Receive the handle hProcess of the blocking process
//as well as the blocking handle hRemote of the file You wish to read
....... //The code is omitted here
HANDLE hDup=NULL;
DuplicateHandle(hProcess,hRemote,GetCurrentProcess(),&hDup,0,FALSE,DUPLICATE_SAME_ACCESS);
DWORD err=GetLastError();
if(err!=0||hDup==NULL)return false;//Never happened!
CloseHandle(hProcess);
HANDLE hMap=CreateFileMapping(hDup,NULL,PAGE_WRITECOPY,0,bytesToRead,NULL);
err=GetLastError();
if(err!=0||hMap==NULL)return false;//Never happened!
char* pMap=(char*)MapViewOfFile(hMap,FILE_MAP_COPY,0,0,bytesToRead);
if(pMap==NULL){CloseHandle(hMap);return false;}
for(int i=0;i<bytesToRead;i++)buff[i]=pMap[i];
UnmapViewOfFile(pMap);
CloseHandle(hMap);
return true;
}
And this code works great! At last!
No matter how many times it is called.
It uses no drivers, no CreateRemoteThread()
(requiring, by the way, SeDebugPrivilege),
so that I suppose the prog using it can be run
under an ordinary user account without any administrative rights
(though I did not tested it yet under an ordinary user account).
-- modified at 14:01 Wednesday 22nd August, 2007
|
|
|
|
|
Backup programs run into problems like yours quite often.... It's not an easy answer.
If you are specifically looking to steal information out of Skype -- might I suggest using the Skype API? You can get a lot of information out of Skype with that.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br />
Peter Weyzen<br />
Staff Engineer<br />
<A HREF="http://www.soonr.com">SoonR Inc -- PC Power delivered to your phone</A>
|
|
|
|
|
1) There exists info which can not be accessed by current version of
Skype API. For example, Skype account owner's e-mail (see
http://forum.skype.com/index.php?showtopic=92887[^] )
2) *.dbb files often contain info that even Skype itself did not show.
|
|
|
|
|
I have a program which needs to disable/enable IIS Admin. I am doing the following
int val = system("net stop iisadmin");
But this function pops-up the dos window and asks the user for confirmation. I do not want this window to appear [Basically the user of my program need not be aware that the IIS is being disabled and hence need not respond to the dos window]
Is there some way to stop the dos window poping up and asking for confirmation?
Is there any other command that can be used?
Is there a better way of doing this operation?
Can I obtain the instance of IIS by using COM api and disable it?
|
|
|
|
|
koumodaki wrote: I do not want this window to appear
Did you try ShellExecute:
HINSTANCE ShellExecute(HWND hwnd,
LPCTSTR lpOperation,
LPCTSTR lpFile,
LPCTSTR lpParameters,
LPCTSTR lpDirectory,
INT nShowCmd
);
It's last parameter may help you in your cause.
Somethings seem HARD to do, until we know how to do them.
 _AnShUmAn_
|
|
|
|
|
You may be able to get around the confirmation by redirecting a text file containing a Y, or yes followed by a CR, but it would likely be better for you to just use the SCM/Service API directly to start/stop the service.
Lookup the StartService(...) Win32 function for more details.
Peace!
-=- James Please rate this message - let me know if I helped or not!<HR>If you think it costs a lot to do it right, just wait until you find out how much it costs to do it wrong!
Avoid driving a vehicle taller than you and remember that Professional Driver on Closed Course does not mean your Dumb Ass on a Public Road!
See DeleteFXPFiles
|
|
|
|
|
koumodaki wrote: Is there some way to stop the dos window poping up and asking for confirmation?
Yes.
echo y.|net stop iisadmin But you are better off using James' suggestion.
"A good athlete is the result of a good and worthy opponent." - David Crow
"To have a respect for ourselves guides our morals; to have deference for others governs our manners." - Laurence Sterne
|
|
|
|
|
I am currently working on a Visual C++ 6 project which generates an html file by first generating a xml file and applying my own xsl stylesheets. Currently, I just have the xsl files on my harddrive and I am loading them with a c++ string literal containing the directory of the files. Obviously this is a bad way, but it is temporary..
The problem now is that I would like to package up the xsl files, an external javascript file, and a set of images (used as icons in the html pages) with the executable. How can I do this with VC6? I would ideally like to be able to output a folder containing the html file and a subfolder that contains the images and the javascript file. In this way, a user can use my tool to "publish" the html file. To generate the html file, I would like to use my internal xsl files along with MSXML.
To summarize in case I was not clear, I need to allow the user to publish an html file by generating the html file, and also supplying with the html file a set of images and a javascript file needed by the html file. However, I need to package the images and javascript file with the executable of my project and output those files when the html is published.
Thanks a bunch for any help!
|
|
|
|
|
have you seen this[^] series of articles ?
|
|
|
|
|
Yes, but the article deals with embedded text files and I was not sure if the same techniques would apply to bitmap files.
Since the files are stored as binary files, could I simply output the binary stream of an embedded bitmap to some file and call it "name.bmp" and it would that file interepted by Windows as a bitmap?
|
|
|
|
|
yes, i think doing so would do the trick...
|
|
|
|
|
Yes, you can even store executables or DLL's as resource files and write them back out to disk. They will have the same checksum as they did before being stored as a resource, its an exact binary match.
The article by Hans is great but in case you dont feel like reading for that long, here is another thats alot more simple and right to the point. http://www.codeproject.com/win32/binaryresources.asp[^]
-Randor
|
|
|
|
|
Torus_XL wrote: The problem now is that I would like to package up the xsl files, an external javascript file, and a set of images (used as icons in the html pages) with the executable. How can I do this with VC6?
To understand how FindResource() and LoadResource() work, see the Extracting the data section
of this article.
"A good athlete is the result of a good and worthy opponent." - David Crow
"To have a respect for ourselves guides our morals; to have deference for others governs our manners." - Laurence Sterne
|
|
|
|
|
Alright, thanks to everyone who posted! Those articles should be a good jumpstart for me 
|
|
|
|
|
I'm moving from VC6 to VC2005. This code....
class myAccessor
{
public:
TCHAR m_EMPRESA[6];
SHORT m_TipoCpbte;
BEGIN_COLUMN_MAP(CdboBajFactProvAccessor)
COLUMN_ENTRY(1, m_EMPRESA)
COLUMN_ENTRY(2, m_TipoCpbte)
END_COLUMN_MAP()
CString sEmpresa = "Esta Empresa";
strcpy( myAccessor.m_EMPRESA, sEmpresa );
myAccessor.m_TipoCpbte = 1;
HRESULT hr = myAccessor.Insert();
I can't compile strcpy, invalid function. What function replace strcpy. Thanks
|
|
|
|
|
it's been deprecated (due to thread safety reasons), but never removed from the CRT (how could it?) !
if the compiler doesn't find it, you have a problem in your VS2005 installation
|
|
|
|
|
Interesting, I didn't know this. I thought it was deprecated for buffer overflow reasons.
|
|
|
|
|
Yes, it was because of the possibility of buffer overflow.
-Randor
|
|
|
|
|
Even if strcpy() were available (it is, just not by default), you do realize that m_EMPRESA will only hold 6 characters, not the 13 that sEmpresa holds.
"A good athlete is the result of a good and worthy opponent." - David Crow
"To have a respect for ourselves guides our morals; to have deference for others governs our manners." - Laurence Sterne
|
|
|
|
|
Have you read the docs? The first sentence on the strcpy page reads:
These functions are deprecated because more secure versions are available; see strcpy_s, wcscpy_s, _mbscpy_s.
|
|
|
|
|
Hi,
I'm using VC++6.
I'm having an application which has dependency with many other libraries.
I've added the libraries to the application workspace using
project->dependencies.
I'm getting compiler error c1083. "fatal error C1083: Cannot open include file: 'filename.h': No such file or directory"
But the file exists.
If i include the path in Include files(Tools->Options->Directories), Iam getting the error for some other file.
The files are library files. If i build the library there is no error. The error occurs only if i build the application.
What could be the root cause?
Thanks & Regards,
Sanju
|
|
|
|
|
I'm not sure if I fully understand what you mean. First you mention a header file. Then you mention a library file. Which one is it? *.h and *.lib paths are not part of the same list of paths, as far as I know. There should be a section for each of them. That said, it would typically be better to add the include paths to your project file, not in the global settings as it makes your application more portable in development when you move from computer to computer, environment to environment.
Edit: I just reread it, and maybe you mean that once you solve the header issue, you get a library issue. If that's the case, then you will have to edit the library paths as well. I'm unsure which setting it is in VC6, but in VC2005, it's under "Configuration Properties --> Linker --> General --> Additional Library Directories".
|
|
|
|
|
Hi,
Thanks for the reply.
I'll explain the issue in detail.
I have an MFC AppWizard Exe application and i've say 2-3 MFC Win32 static library applications. I've added the library applications as dependencies in the exe application using Project->Dependencies.
Suppose fileX.h and fileY.h is in lib1.
file2.h in lib2, file3.h in lib3.
Then in fileX.h i've added #include "file2.h" and
in fileY.h i've added #include "file3.h".
If i build lib1 i'm not getting any compiler error.
But if i build the application which has dependency on lib1, i'm getting error c1083, saying
"fatal error C1083: Cannot open include file: 'file2.h': No such file or directory".
But the file exists. Then i included the file path of file2.h using Tools->Options->Directories. Then the error for file2.h is gone but it shows error for file3.h. What could be the problem?
Thanks & Regards,
Sanju
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
