├── HeapMonitor ├── nbproject │ ├── private │ │ ├── config.properties │ │ ├── private.properties │ │ └── private.xml │ ├── genfiles.properties │ ├── project.xml │ └── project.properties ├── manifest.mf ├── src │ └── heapmonitor │ │ ├── AllocationTrace.java │ │ ├── TraceJPanel.form │ │ ├── Trace.java │ │ ├── OptionsJDialog.form │ │ ├── TraceJPanel.java │ │ ├── OptionsJDialog.java │ │ ├── MemoryTupleHandler.java │ │ ├── FreeJPanel.form │ │ ├── AllocationJPanel.form │ │ ├── ManagedRunnable.java │ │ ├── MemoryChunk.java │ │ ├── MemoryMapLabel.java │ │ ├── SocketHandler.java │ │ ├── FreeJPanel.java │ │ └── AllocationJPanel.java └── build.xml ├── Observer ├── HeapMonitor.suo ├── HeapMonitor.v11.suo ├── libs │ ├── MinHook │ │ ├── src │ │ │ ├── hook.cpp │ │ │ ├── thread.h │ │ │ ├── buffer.cpp │ │ │ ├── thread.cpp │ │ │ ├── trampoline.cpp │ │ │ ├── buffer.h │ │ │ ├── hook.h │ │ │ ├── trampoline.h │ │ │ ├── export.cpp │ │ │ ├── HDE32 │ │ │ │ ├── hde32.h │ │ │ │ └── table32.h │ │ │ └── HDE64 │ │ │ │ ├── include │ │ │ │ └── hde64.h │ │ │ │ └── src │ │ │ │ └── table64.h │ │ ├── dll_resources │ │ │ ├── resource.h │ │ │ ├── dllmain.cpp │ │ │ └── MinHook.def │ │ ├── .gitignore │ │ ├── README.md │ │ ├── build │ │ │ ├── MinHookVC10.sln │ │ │ ├── MinHookVC11.sln │ │ │ ├── MinHookVC9.sln │ │ │ ├── libMinHook.vcxproj.filters │ │ │ ├── libMinHook.vcproj │ │ │ ├── MinHook.vcproj │ │ │ └── libMinHook.vcxproj │ │ ├── MinHook.vcxproj.filters │ │ ├── COPYING.txt │ │ ├── MinHook.vcxproj │ │ └── include │ │ │ └── MinHook.h │ ├── dbghelp │ │ └── lib │ │ │ ├── x64 │ │ │ ├── dbghelp.dll │ │ │ └── dbghelp.lib │ │ │ └── x86 │ │ │ ├── dbghelp.dll │ │ │ └── dbghelp.lib │ └── Where these are from.txt ├── Observer │ ├── Observer.vcxproj.user │ ├── build │ │ └── Win32 │ │ │ └── Release │ │ │ └── Observer.vcxprojResolveAssemblyReference.cache │ ├── Observer.vcxproj.filters │ ├── Observer_dyn.h │ ├── Observer.h │ └── Observer.vcxproj ├── TestAllocations │ ├── TestAllocations.vcxproj.user │ ├── stdafx.cpp │ ├── targetver.h │ ├── stdafx.h │ ├── TestAllocations.vcxproj.filters │ ├── TestAllocations.cpp │ ├── ReadMe.txt │ └── TestAllocations.vcxproj ├── DllInjector │ ├── DllInjector.vcxproj.user │ ├── DllInjector.vcxproj.filters │ ├── DllInjector.vcxproj │ └── DllInjector.cpp ├── COPYING.txt └── HeapMonitor.sln ├── .gitattributes ├── README.md └── .gitignore /HeapMonitor/nbproject/private/config.properties: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /Observer/HeapMonitor.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/securifera/HeapMonitor/HEAD/Observer/HeapMonitor.suo -------------------------------------------------------------------------------- /HeapMonitor/manifest.mf: -------------------------------------------------------------------------------- 1 | Manifest-Version: 1.0 2 | X-COMMENT: Main-Class will be added automatically by build 3 | 4 | -------------------------------------------------------------------------------- /Observer/HeapMonitor.v11.suo: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/securifera/HeapMonitor/HEAD/Observer/HeapMonitor.v11.suo -------------------------------------------------------------------------------- /Observer/libs/MinHook/src/hook.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/securifera/HeapMonitor/HEAD/Observer/libs/MinHook/src/hook.cpp -------------------------------------------------------------------------------- /Observer/libs/MinHook/src/thread.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/securifera/HeapMonitor/HEAD/Observer/libs/MinHook/src/thread.h -------------------------------------------------------------------------------- /Observer/libs/MinHook/src/buffer.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/securifera/HeapMonitor/HEAD/Observer/libs/MinHook/src/buffer.cpp -------------------------------------------------------------------------------- /Observer/libs/MinHook/src/thread.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/securifera/HeapMonitor/HEAD/Observer/libs/MinHook/src/thread.cpp -------------------------------------------------------------------------------- /Observer/libs/MinHook/src/trampoline.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/securifera/HeapMonitor/HEAD/Observer/libs/MinHook/src/trampoline.cpp -------------------------------------------------------------------------------- /Observer/libs/dbghelp/lib/x64/dbghelp.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/securifera/HeapMonitor/HEAD/Observer/libs/dbghelp/lib/x64/dbghelp.dll -------------------------------------------------------------------------------- /Observer/libs/dbghelp/lib/x64/dbghelp.lib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/securifera/HeapMonitor/HEAD/Observer/libs/dbghelp/lib/x64/dbghelp.lib -------------------------------------------------------------------------------- /Observer/libs/dbghelp/lib/x86/dbghelp.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/securifera/HeapMonitor/HEAD/Observer/libs/dbghelp/lib/x86/dbghelp.dll -------------------------------------------------------------------------------- /Observer/libs/dbghelp/lib/x86/dbghelp.lib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/securifera/HeapMonitor/HEAD/Observer/libs/dbghelp/lib/x86/dbghelp.lib -------------------------------------------------------------------------------- /Observer/libs/MinHook/dll_resources/resource.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/securifera/HeapMonitor/HEAD/Observer/libs/MinHook/dll_resources/resource.h -------------------------------------------------------------------------------- /Observer/Observer/Observer.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | -------------------------------------------------------------------------------- /Observer/TestAllocations/TestAllocations.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/dll_resources/dllmain.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) 4 | { 5 | return TRUE; 6 | } 7 | 8 | -------------------------------------------------------------------------------- /Observer/Observer/build/Win32/Release/Observer.vcxprojResolveAssemblyReference.cache: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/securifera/HeapMonitor/HEAD/Observer/Observer/build/Win32/Release/Observer.vcxprojResolveAssemblyReference.cache -------------------------------------------------------------------------------- /HeapMonitor/nbproject/private/private.properties: -------------------------------------------------------------------------------- 1 | compile.on.save=false 2 | do.depend=false 3 | do.jar=true 4 | javac.debug=true 5 | javadoc.preview=true 6 | user.properties.file=C:\\Users\\user\\AppData\\Roaming\\NetBeans\\8.2\\build.properties 7 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/dll_resources/MinHook.def: -------------------------------------------------------------------------------- 1 | EXPORTS 2 | MH_Initialize 3 | MH_Uninitialize 4 | 5 | MH_CreateHook 6 | MH_RemoveHook 7 | MH_EnableHook 8 | MH_DisableHook 9 | MH_QueueEnableHook 10 | MH_QueueDisableHook 11 | MH_ApplyQueued 12 | -------------------------------------------------------------------------------- /Observer/TestAllocations/stdafx.cpp: -------------------------------------------------------------------------------- 1 | // stdafx.cpp : source file that includes just the standard includes 2 | // TestAllocations.pch will be the pre-compiled header 3 | // stdafx.obj will contain the pre-compiled type information 4 | 5 | #include "stdafx.h" 6 | 7 | // TODO: reference any additional headers you need in STDAFX.H 8 | // and not in this file 9 | -------------------------------------------------------------------------------- /Observer/TestAllocations/targetver.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | // Including SDKDDKVer.h defines the highest available Windows platform. 4 | 5 | // If you wish to build your application for a previous Windows platform, include WinSDKVer.h and 6 | // set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. 7 | 8 | #include 9 | -------------------------------------------------------------------------------- /Observer/TestAllocations/stdafx.h: -------------------------------------------------------------------------------- 1 | // stdafx.h : include file for standard system include files, 2 | // or project specific include files that are used frequently, but 3 | // are changed infrequently 4 | // 5 | 6 | #pragma once 7 | 8 | #include "targetver.h" 9 | 10 | #include 11 | #include 12 | 13 | 14 | 15 | // TODO: reference additional headers your program requires here 16 | -------------------------------------------------------------------------------- /Observer/libs/Where these are from.txt: -------------------------------------------------------------------------------- 1 | 2 | MinHook 3 | ======= 4 | 5 | This guys MinHook fork: 6 | 7 | https://github.com/RaMMicHaeL/minhook commit 4141fefb4445d41e8506d8f72801a27e1b8874c6 8 | 9 | MinHook is originally from codeproject.com: http://www.codeproject.com/Articles/44326/MinHook-The-Minimalistic-x86-x64-API-Hooking-Libra 10 | 11 | dbghelp 12 | ======= 13 | 14 | Windows SDK 8.1 15 | 16 | 17 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/.gitignore: -------------------------------------------------------------------------------- 1 | #OS junk files 2 | [Tt]humbs.db 3 | *.DS_Store 4 | 5 | #Visual Studio files 6 | *.[Oo]bj 7 | *.user 8 | *.aps 9 | *.pch 10 | *.vspscc 11 | *.vssscc 12 | *_i.c 13 | *_p.c 14 | *.ncb 15 | *.suo 16 | *.tlb 17 | *.tlh 18 | *.bak 19 | *.[Cc]ache 20 | *.ilk 21 | *.log 22 | *.sbr 23 | *.sdf 24 | *.opensdf 25 | *.unsuccessfulbuild 26 | ipch/ 27 | obj/ 28 | [Ll]ib 29 | [Bb]in 30 | [Dd]ebug*/ 31 | [Rr]elease*/ 32 | Ankh.NoLoad 33 | -------------------------------------------------------------------------------- /.gitattributes: -------------------------------------------------------------------------------- 1 | # Auto detect text files and perform LF normalization 2 | * text=auto 3 | 4 | # Custom for Visual Studio 5 | *.cs diff=csharp 6 | 7 | # Standard to msysgit 8 | *.doc diff=astextplain 9 | *.DOC diff=astextplain 10 | *.docx diff=astextplain 11 | *.DOCX diff=astextplain 12 | *.dot diff=astextplain 13 | *.DOT diff=astextplain 14 | *.pdf diff=astextplain 15 | *.PDF diff=astextplain 16 | *.rtf diff=astextplain 17 | *.RTF diff=astextplain 18 | -------------------------------------------------------------------------------- /HeapMonitor/nbproject/genfiles.properties: -------------------------------------------------------------------------------- 1 | build.xml.data.CRC32=69f34197 2 | build.xml.script.CRC32=ef0198f1 3 | build.xml.stylesheet.CRC32=8064a381@1.74.1.48 4 | # This file is used by a NetBeans-based IDE to track changes in generated files such as build-impl.xml. 5 | # Do not edit this file. You may delete it but then the IDE will never regenerate such files for you. 6 | nbproject/build-impl.xml.data.CRC32=69f34197 7 | nbproject/build-impl.xml.script.CRC32=872418d0 8 | nbproject/build-impl.xml.stylesheet.CRC32=830a3534@1.80.1.48 9 | -------------------------------------------------------------------------------- /HeapMonitor/nbproject/project.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | org.netbeans.modules.java.j2seproject 4 | 5 | 6 | HeapMonitor 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | -------------------------------------------------------------------------------- /Observer/DllInjector/DllInjector.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -p 4164 -d "C:\Users\user\Desktop\HeapMonitor\Heapy\Debug\HeapyInject_Win32.dll" 5 | WindowsLocalDebugger 6 | 7 | 8 | -e C:\TestAllocations.exe -d C:\Observer_x64.dll 9 | WindowsLocalDebugger 10 | 11 | -------------------------------------------------------------------------------- /HeapMonitor/nbproject/private/private.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | file:/C:/Users/user/Documents/GitHub/HeapMonitor/HeapMonitor/src/heapmonitor/FreeJPanel.java 7 | file:/C:/Users/user/Documents/GitHub/HeapMonitor/HeapMonitor/src/heapmonitor/AllocationJPanel.java 8 | file:/C:/Users/user/Documents/GitHub/HeapMonitor/HeapMonitor/src/heapmonitor/MainFrame.java 9 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /HeapMonitor/src/heapmonitor/AllocationTrace.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Trace.java 3 | * 4 | */ 5 | 6 | package heapmonitor; 7 | 8 | //======================================================================= 9 | /** 10 | * Class structure for Trace 11 | */ 12 | public class AllocationTrace extends Trace { 13 | 14 | private final int size; 15 | 16 | //============================================================= 17 | /** 18 | * 19 | * @param passedByteArr 20 | * @param passedSize 21 | */ 22 | public AllocationTrace( byte[] passedByteArr, int passedSize ){ 23 | super( passedByteArr ); 24 | size = passedSize; 25 | } 26 | 27 | //============================================================= 28 | /** 29 | * 30 | * @return 31 | */ 32 | public int getSize() { 33 | return size; 34 | } 35 | 36 | } -------------------------------------------------------------------------------- /Observer/DllInjector/DllInjector.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | -------------------------------------------------------------------------------- /Observer/Observer/Observer.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Header Files 20 | 21 | 22 | 23 | 24 | Source Files 25 | 26 | 27 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | Heap Monitor 2 | ===== 3 | 4 | HeapMonitor is a tool to allow you to visually monitor the heap memory allocations and deallocations happening 5 | in a Windows application in real-time on a remote system. It also provides a stack trace of each allocation and 6 | free so you can locate where the calls are being made from. 7 | 8 | The tool is composed of two main parts. 9 | 10 | HeapMonitor GUI 11 | -------- 12 | This is the GUI that displays the allocations and frees occurring in the target application. 13 | 14 | ![ScreenShot](https://www.securifera.com/wp-content/uploads/2016/01/heap_tool.jpg) 15 | 16 | 17 | Observer 18 | -------- 19 | This is the native c++ code that is responsible for hooking the heap allocation function calls. It consists of the 20 | DllInjector and the Observer DLL. As can probably be presumed, the DllInjector application injects the Observer DLL 21 | into the target process. Once the DLL has been injected, it waits for a connection on port 7777 from the HeapMonitor GUI. 22 | 23 | The Observer application uses the MinHook library (https://github.com/TsudaKageyu/minhook) for function hooking 24 | and built upon Luke Dodd's Heapy tool (https://github.com/lukedodd/Heapy). 25 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Windows image file caches 2 | Thumbs.db 3 | ehthumbs.db 4 | 5 | # Folder config file 6 | Desktop.ini 7 | 8 | # Recycle Bin used on file shares 9 | $RECYCLE.BIN/ 10 | 11 | # Windows Installer files 12 | *.cab 13 | *.msi 14 | *.msm 15 | *.msp 16 | 17 | # Windows shortcuts 18 | *.lnk 19 | 20 | # ========================= 21 | # Operating System Files 22 | # ========================= 23 | 24 | # OSX 25 | # ========================= 26 | 27 | .DS_Store 28 | .AppleDouble 29 | .LSOverride 30 | 31 | # Thumbnails 32 | ._* 33 | 34 | # Files that might appear on external disk 35 | .Spotlight-V100 36 | .Trashes 37 | 38 | # Directories potentially created on remote AFP share 39 | .AppleDB 40 | .AppleDesktop 41 | Network Trash Folder 42 | Temporary Items 43 | .apdisk 44 | *.exe 45 | *.pdb 46 | *.tlog 47 | *.log 48 | *.obj 49 | *.idb 50 | *.lastbuildstate 51 | *.pch 52 | heap_inject_dll/heap_injector/Debug/heap_injector.exe.intermediate.manifest 53 | *.manifest 54 | heap_inject_dll/heap_inject_dll/Debug/heap_inject.dll.embed.manifest.res 55 | *.unsuccessfulbuild 56 | *.rc 57 | *.ipch 58 | /HeapMonitor/build/ 59 | /HeapMonitor/dist/ 60 | *.properties 61 | *.xml 62 | *.opensdf 63 | Observer/HeapMonitor.sdf 64 | Observer/dist/ 65 | Observer/Observer/build/ 66 | Observer/DllInjector/build/ 67 | Observer/TestAllocations/build/ 68 | Observer/libs/ 69 | Observer/.vs/ -------------------------------------------------------------------------------- /Observer/libs/MinHook/README.md: -------------------------------------------------------------------------------- 1 | # MinHook 2 | 3 | A Windows API hooking library originally written by Tsuda Kageyu. 4 | 5 | http://www.codeproject.com/KB/winsdk/LibMinHook.aspx 6 | 7 | ## Main differences from original v1.1 8 | 9 | * Removed boost dependency ([jarredholman](https://github.com/jarredholman/minhook)). 10 | * Fixed a small bug in the GetRelativeBranchDestination function ([pillbug99](http://www.codeproject.com/Messages/4058892/Small-Bug-Found.aspx)). 11 | * Added the `MH_RemoveHook` function, which removes a hook created with the `MH_CreateHook` function. 12 | * Added the following functions to enable or disable multiple hooks in one go: `MH_QueueEnableHook`, `MH_QueueDisableHook`, `MH_ApplyQueued`. This is the preferred way of handling multiple hooks as every call to `MH_EnableHook` or `MH_DisableHook` suspends and resumes all threads. 13 | * Made the functions `MH_EnableHook` and `MH_DisableHook` enable/disable all created hooks when the `MH_ALL_HOOKS` parameter is passed. This, too, is an efficient way of handling multiple hooks. 14 | * If the target function is too small to be patched with a jump, MinHook tries to place the jump above the function. If that fails as well, the `MH_CreateHook` function returns `MH_ERROR_UNSUPPORTED_FUNCTION`. This fixes an issue of hooking the LoadLibraryExW function on Windows 7 x64 ([reported by Obble](http://www.codeproject.com/Messages/4578613/Re-Bug-LoadLibraryExW-hook-fails-on-windows-2008-r.aspx)). 15 | -------------------------------------------------------------------------------- /Observer/TestAllocations/TestAllocations.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | Header Files 23 | 24 | 25 | Header Files 26 | 27 | 28 | 29 | 30 | Source Files 31 | 32 | 33 | Source Files 34 | 35 | 36 | -------------------------------------------------------------------------------- /Observer/COPYING.txt: -------------------------------------------------------------------------------- 1 | ======================== 2 | Heapy - A Heap Profiler For Windows Applications. 3 | Copyright (c) 2013, Luke Dodd 4 | All rights reserved. 5 | 6 | Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 7 | 8 | 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 9 | 10 | 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 11 | 12 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 13 | 14 | ======================== 15 | 16 | The MinHook library is used in this project. 17 | 18 | All MinHook files are under libs/MinHook. 19 | 20 | The license for MinHook is at libs/MinHook/Copying.txt. 21 | -------------------------------------------------------------------------------- /Observer/TestAllocations/TestAllocations.cpp: -------------------------------------------------------------------------------- 1 | // TestAllocations.cpp : Defines the entry point for the console application. 2 | // 3 | 4 | #include "stdafx.h" 5 | #include 6 | #include 7 | 8 | 9 | int _tmain(int argc, _TCHAR* argv[]) 10 | { 11 | 12 | printf("Current pid: %d\n", GetCurrentProcessId()); 13 | printf("Sleeping, attach profiler\n", GetCurrentProcessId()); 14 | 15 | Sleep(5000); 16 | 17 | const int numAllocs = 10; 18 | char *smallmem[numAllocs]; 19 | int size = 0xf0; 20 | for( int i = 0; i < 4; i++ ){ 21 | 22 | smallmem[i] = (char*) malloc(size); 23 | printf("Allcated %d bytes.\n",size); 24 | Sleep(1000); 25 | } 26 | 27 | size = 0x178; 28 | for( int i = 4; i < 8; i++ ){ 29 | 30 | smallmem[i] = (char*) malloc(size); 31 | printf("Allocated %d bytes.\n",size); 32 | Sleep(1000); 33 | } 34 | 35 | 36 | size = 812; 37 | char *mem[numAllocs]; 38 | for( int i = 0; i < numAllocs; i++ ){ 39 | 40 | mem[i] = (char*) malloc(size); 41 | printf("Allcated %d bytes.\n",size); 42 | Sleep(500); 43 | } 44 | 45 | //Make hole 46 | free(mem[4]); 47 | //free(mem[5]); 48 | 49 | /*for( int i = 0; i < numAllocs; i++ ){ 50 | free(mem[i]); 51 | printf("Freed bytes.\n",size); 52 | Sleep(2000); 53 | }*/ 54 | 55 | //Allocate 56 | mem[8] = (char*) malloc(0xf0); 57 | 58 | //Make second hole 59 | free(mem[7]); 60 | 61 | //Allocate 62 | mem[9] = (char*) malloc(0x178); 63 | 64 | /*for( int i = 0; i < numAllocs; i++ ){ 65 | free(mem[i]); 66 | printf("Freed bytes.\n",size); 67 | Sleep(1000); 68 | }*/ 69 | 70 | 71 | /*int count = 1000; 72 | for( int i = 0; i < count; i++ ){ 73 | 74 | int u = ((int)rand() % 500) + 8; 75 | test = (char*) malloc(u); 76 | printf("Allcated %d bytes.\n",u); 77 | Sleep(2000); 78 | free(test); 79 | printf("Freed bytes.\n",u); 80 | Sleep(2000); 81 | }*/ 82 | return 0; 83 | } 84 | 85 | -------------------------------------------------------------------------------- /Observer/TestAllocations/ReadMe.txt: -------------------------------------------------------------------------------- 1 | ======================================================================== 2 | CONSOLE APPLICATION : TestAllocations Project Overview 3 | ======================================================================== 4 | 5 | AppWizard has created this TestAllocations application for you. 6 | 7 | This file contains a summary of what you will find in each of the files that 8 | make up your TestAllocations application. 9 | 10 | 11 | TestAllocations.vcxproj 12 | This is the main project file for VC++ projects generated using an Application Wizard. 13 | It contains information about the version of Visual C++ that generated the file, and 14 | information about the platforms, configurations, and project features selected with the 15 | Application Wizard. 16 | 17 | TestAllocations.vcxproj.filters 18 | This is the filters file for VC++ projects generated using an Application Wizard. 19 | It contains information about the association between the files in your project 20 | and the filters. This association is used in the IDE to show grouping of files with 21 | similar extensions under a specific node (for e.g. ".cpp" files are associated with the 22 | "Source Files" filter). 23 | 24 | TestAllocations.cpp 25 | This is the main application source file. 26 | 27 | ///////////////////////////////////////////////////////////////////////////// 28 | Other standard files: 29 | 30 | StdAfx.h, StdAfx.cpp 31 | These files are used to build a precompiled header (PCH) file 32 | named TestAllocations.pch and a precompiled types file named StdAfx.obj. 33 | 34 | ///////////////////////////////////////////////////////////////////////////// 35 | Other notes: 36 | 37 | AppWizard uses "TODO:" comments to indicate parts of the source code you 38 | should add to or customize. 39 | 40 | ///////////////////////////////////////////////////////////////////////////// 41 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/src/buffer.h: -------------------------------------------------------------------------------- 1 | /* 2 | * MinHook - Minimalistic API Hook Library 3 | * Copyright (C) 2009 Tsuda Kageyu. All rights reserved. 4 | * 5 | * Redistribution and use in source and binary forms, with or without 6 | * modification, are permitted provided that the following conditions 7 | * are met: 8 | * 9 | * 1. Redistributions of source code must retain the above copyright 10 | * notice, this list of conditions and the following disclaimer. 11 | * 2. Redistributions in binary form must reproduce the above copyright 12 | * notice, this list of conditions and the following disclaimer in the 13 | * documentation and/or other materials provided with the distribution. 14 | * 3. The name of the author may not be used to endorse or promote products 15 | * derived from this software without specific prior written permission. 16 | * 17 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 | */ 28 | 29 | #pragma once 30 | 31 | namespace MinHook 32 | { 33 | void InitializeBuffer(); 34 | void UninitializeBuffer(); 35 | void* AllocateCodeBuffer(void* const pOrigin, size_t size); 36 | void* AllocateDataBuffer(void* const pOrigin, size_t size); 37 | void FreeBuffer(void* const pBuffer); 38 | void RollbackBuffer(); 39 | void CommitBuffer(); 40 | } 41 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/build/MinHookVC10.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 11.00 3 | # Visual Studio 2010 4 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libMinHook", "libMinHook.vcxproj", "{65021938-D251-46FA-BC3D-85C385D4C06D}" 5 | EndProject 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MinHook", "MinHook.vcxproj", "{CA4EE302-D012-4826-86D6-80D23641AB4E}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Win32 = Debug|Win32 11 | Debug|x64 = Debug|x64 12 | Release|Win32 = Release|Win32 13 | Release|x64 = Release|x64 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|Win32.ActiveCfg = Debug|Win32 17 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|Win32.Build.0 = Debug|Win32 18 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|x64.ActiveCfg = Debug|x64 19 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|x64.Build.0 = Debug|x64 20 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|Win32.ActiveCfg = Release|Win32 21 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|Win32.Build.0 = Release|Win32 22 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|x64.ActiveCfg = Release|x64 23 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|x64.Build.0 = Release|x64 24 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Debug|Win32.ActiveCfg = Debug|Win32 25 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Debug|Win32.Build.0 = Debug|Win32 26 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Debug|x64.ActiveCfg = Debug|Win32 27 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Debug|x64.Build.0 = Debug|Win32 28 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Release|Win32.ActiveCfg = Release|Win32 29 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Release|Win32.Build.0 = Release|Win32 30 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Release|x64.ActiveCfg = Release|x64 31 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Release|x64.Build.0 = Release|x64 32 | EndGlobalSection 33 | GlobalSection(SolutionProperties) = preSolution 34 | HideSolutionNode = FALSE 35 | EndGlobalSection 36 | EndGlobal 37 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/build/MinHookVC11.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 2012 4 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libMinHook", "libMinHook.vcxproj", "{65021938-D251-46FA-BC3D-85C385D4C06D}" 5 | EndProject 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MinHook", "MinHook.vcxproj", "{CA4EE302-D012-4826-86D6-80D23641AB4E}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Win32 = Debug|Win32 11 | Debug|x64 = Debug|x64 12 | Release|Win32 = Release|Win32 13 | Release|x64 = Release|x64 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|Win32.ActiveCfg = Debug|Win32 17 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|Win32.Build.0 = Debug|Win32 18 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|x64.ActiveCfg = Debug|x64 19 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|x64.Build.0 = Debug|x64 20 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|Win32.ActiveCfg = Release|Win32 21 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|Win32.Build.0 = Release|Win32 22 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|x64.ActiveCfg = Release|x64 23 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|x64.Build.0 = Release|x64 24 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Debug|Win32.ActiveCfg = Debug|Win32 25 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Debug|Win32.Build.0 = Debug|Win32 26 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Debug|x64.ActiveCfg = Debug|Win32 27 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Debug|x64.Build.0 = Debug|Win32 28 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Release|Win32.ActiveCfg = Release|Win32 29 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Release|Win32.Build.0 = Release|Win32 30 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Release|x64.ActiveCfg = Release|x64 31 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Release|x64.Build.0 = Release|x64 32 | EndGlobalSection 33 | GlobalSection(SolutionProperties) = preSolution 34 | HideSolutionNode = FALSE 35 | EndGlobalSection 36 | EndGlobal 37 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/src/hook.h: -------------------------------------------------------------------------------- 1 | /* 2 | * MinHook - Minimalistic API Hook Library 3 | * Copyright (C) 2009 Tsuda Kageyu. All rights reserved. 4 | * 5 | * Redistribution and use in source and binary forms, with or without 6 | * modification, are permitted provided that the following conditions 7 | * are met: 8 | * 9 | * 1. Redistributions of source code must retain the above copyright 10 | * notice, this list of conditions and the following disclaimer. 11 | * 2. Redistributions in binary form must reproduce the above copyright 12 | * notice, this list of conditions and the following disclaimer in the 13 | * documentation and/or other materials provided with the distribution. 14 | * 3. The name of the author may not be used to endorse or promote products 15 | * derived from this software without specific prior written permission. 16 | * 17 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 | */ 28 | 29 | #pragma once 30 | 31 | #include "MinHook.h" 32 | 33 | namespace MinHook 34 | { 35 | MH_STATUS Initialize(); 36 | MH_STATUS Uninitialize(); 37 | MH_STATUS CreateHook(void* pTarget, void* const pDetour, void** ppOriginal); 38 | MH_STATUS RemoveHook(void* pTarget); 39 | MH_STATUS EnableHook(void* pTarget); 40 | MH_STATUS DisableHook(void* pTarget); 41 | MH_STATUS QueueEnableHook(void* pTarget); 42 | MH_STATUS QueueDisableHook(void* pTarget); 43 | MH_STATUS ApplyQueued(); 44 | } 45 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/build/MinHookVC9.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 10.00 3 | # Visual Studio 2008 4 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libMinHook", "libMinHook.vcproj", "{65021938-D251-46FA-BC3D-85C385D4C06D}" 5 | EndProject 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MinHook", "MinHook.vcproj", "{CA4EE302-D012-4826-86D6-80D23641AB4E}" 7 | ProjectSection(ProjectDependencies) = postProject 8 | {65021938-D251-46FA-BC3D-85C385D4C06D} = {65021938-D251-46FA-BC3D-85C385D4C06D} 9 | EndProjectSection 10 | EndProject 11 | Global 12 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 13 | Debug|Win32 = Debug|Win32 14 | Debug|x64 = Debug|x64 15 | Release|Win32 = Release|Win32 16 | Release|x64 = Release|x64 17 | EndGlobalSection 18 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 19 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|Win32.ActiveCfg = Debug|Win32 20 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|Win32.Build.0 = Debug|Win32 21 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|x64.ActiveCfg = Debug|x64 22 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|x64.Build.0 = Debug|x64 23 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|Win32.ActiveCfg = Release|Win32 24 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|Win32.Build.0 = Release|Win32 25 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|x64.ActiveCfg = Release|x64 26 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|x64.Build.0 = Release|x64 27 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Debug|Win32.ActiveCfg = Debug|Win32 28 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Debug|Win32.Build.0 = Debug|Win32 29 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Debug|x64.ActiveCfg = Debug|Win32 30 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Debug|x64.Build.0 = Debug|Win32 31 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Release|Win32.ActiveCfg = Release|Win32 32 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Release|Win32.Build.0 = Release|Win32 33 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Release|x64.ActiveCfg = Release|x64 34 | {CA4EE302-D012-4826-86D6-80D23641AB4E}.Release|x64.Build.0 = Release|x64 35 | EndGlobalSection 36 | GlobalSection(SolutionProperties) = preSolution 37 | HideSolutionNode = FALSE 38 | EndGlobalSection 39 | EndGlobal 40 | -------------------------------------------------------------------------------- /HeapMonitor/src/heapmonitor/TraceJPanel.form: -------------------------------------------------------------------------------- 1 | 2 | 3 |
4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 |
46 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/src/trampoline.h: -------------------------------------------------------------------------------- 1 | /* 2 | * MinHook - Minimalistic API Hook Library 3 | * Copyright (C) 2009 Tsuda Kageyu. All rights reserved. 4 | * 5 | * Redistribution and use in source and binary forms, with or without 6 | * modification, are permitted provided that the following conditions 7 | * are met: 8 | * 9 | * 1. Redistributions of source code must retain the above copyright 10 | * notice, this list of conditions and the following disclaimer. 11 | * 2. Redistributions in binary form must reproduce the above copyright 12 | * notice, this list of conditions and the following disclaimer in the 13 | * documentation and/or other materials provided with the distribution. 14 | * 3. The name of the author may not be used to endorse or promote products 15 | * derived from this software without specific prior written permission. 16 | * 17 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 | */ 28 | 29 | #pragma once 30 | 31 | #include 32 | 33 | namespace MinHook 34 | { 35 | struct TEMP_ADDR 36 | { 37 | uintptr_t address; 38 | size_t position; 39 | size_t pc; 40 | }; 41 | 42 | struct CREATE_TREMPOLINE_T 43 | { 44 | void* pTarget; 45 | void* pTrampoline; 46 | bool patchAbove; 47 | std::vector trampoline; 48 | std::vector tempAddr; 49 | #if defined _M_X64 50 | void* pTable; 51 | std::vector table; 52 | #endif 53 | std::vector oldIPs; 54 | std::vector newIPs; 55 | }; 56 | 57 | bool CreateTrampolineFunction(CREATE_TREMPOLINE_T& ct); 58 | bool ResolveTemporaryAddresses(CREATE_TREMPOLINE_T& ct); 59 | } -------------------------------------------------------------------------------- /HeapMonitor/src/heapmonitor/Trace.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Trace.java 3 | * 4 | */ 5 | 6 | package heapmonitor; 7 | 8 | //======================================================================= 9 | import java.util.Date; 10 | 11 | 12 | /** 13 | * Class structure for Trace 14 | */ 15 | public class Trace implements Comparable{ 16 | 17 | protected final byte[] traceByteArr; 18 | protected final Date dateReceived; 19 | 20 | //============================================================= 21 | /** 22 | * 23 | * @param passedByteArr 24 | */ 25 | public Trace( byte[] passedByteArr ){ 26 | traceByteArr = passedByteArr; 27 | dateReceived = new Date(); 28 | } 29 | 30 | //============================================================= 31 | /** 32 | * 33 | * @return 34 | */ 35 | public byte[] getTraceByteArray(){ 36 | return traceByteArr; 37 | } 38 | 39 | //============================================================= 40 | /** 41 | * 42 | * @param otherTrace 43 | * @return 44 | */ 45 | @Override 46 | public int compareTo(Trace otherTrace) { 47 | return otherTrace.dateReceived.compareTo(dateReceived); 48 | } 49 | 50 | //================================================================== 51 | /** 52 | * 53 | * @param traceByteArr 54 | * @return 55 | */ 56 | public static String processStackTrace( byte[] traceByteArr ) { 57 | 58 | String retStr = ""; 59 | if( traceByteArr != null ){ 60 | 61 | String traceIniStr = new String(traceByteArr); 62 | String[] traceArr = traceIniStr.split("\n"); 63 | //Loop through 64 | for( String traceStr : traceArr ){ 65 | 66 | //Get frame name 67 | String[] traceElementArr = traceStr.split("\t"); 68 | if( traceElementArr.length == 3 ){ 69 | 70 | //Get function name 71 | String functionName = traceElementArr[0].trim(); 72 | 73 | //Get source path 74 | String sourcePath = traceElementArr[1].trim(); 75 | 76 | //Get trace address 77 | String stackAddressStr = traceElementArr[2].trim(); 78 | retStr += String.format( "%-20.20s %-30.30s %-10s \n", stackAddressStr, functionName, sourcePath ); 79 | 80 | } else { 81 | System.err.println("Improperly formatted trace."); 82 | } 83 | 84 | } 85 | } 86 | 87 | return retStr; 88 | } 89 | 90 | } -------------------------------------------------------------------------------- /Observer/libs/MinHook/src/export.cpp: -------------------------------------------------------------------------------- 1 | /* 2 | * MinHook - Minimalistic API Hook Library 3 | * Copyright (C) 2009 Tsuda Kageyu. All rights reserved. 4 | * 5 | * Redistribution and use in source and binary forms, with or without 6 | * modification, are permitted provided that the following conditions 7 | * are met: 8 | * 9 | * 1. Redistributions of source code must retain the above copyright 10 | * notice, this list of conditions and the following disclaimer. 11 | * 2. Redistributions in binary form must reproduce the above copyright 12 | * notice, this list of conditions and the following disclaimer in the 13 | * documentation and/or other materials provided with the distribution. 14 | * 3. The name of the author may not be used to endorse or promote products 15 | * derived from this software without specific prior written permission. 16 | * 17 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 | */ 28 | 29 | #include 30 | #include "MinHook.h" 31 | #include "hook.h" 32 | 33 | using namespace MinHook; 34 | 35 | MH_STATUS WINAPI MH_Initialize() 36 | { 37 | return Initialize(); 38 | } 39 | 40 | MH_STATUS WINAPI MH_Uninitialize() 41 | { 42 | return Uninitialize(); 43 | } 44 | 45 | MH_STATUS WINAPI MH_CreateHook(void* pTarget, void* const pDetour, void** ppOriginal) 46 | { 47 | return CreateHook(pTarget, pDetour, ppOriginal); 48 | } 49 | 50 | MH_STATUS WINAPI MH_RemoveHook(void* pTarget) 51 | { 52 | return RemoveHook(pTarget); 53 | } 54 | 55 | MH_STATUS WINAPI MH_EnableHook(void* pTarget) 56 | { 57 | return EnableHook(pTarget); 58 | } 59 | 60 | MH_STATUS WINAPI MH_DisableHook(void* pTarget) 61 | { 62 | return DisableHook(pTarget); 63 | } 64 | 65 | MH_STATUS WINAPI MH_QueueEnableHook(void* pTarget) 66 | { 67 | return QueueEnableHook(pTarget); 68 | } 69 | 70 | MH_STATUS WINAPI MH_QueueDisableHook(void* pTarget) 71 | { 72 | return QueueDisableHook(pTarget); 73 | } 74 | 75 | MH_STATUS WINAPI MH_ApplyQueued() 76 | { 77 | return ApplyQueued(); 78 | } 79 | -------------------------------------------------------------------------------- /HeapMonitor/nbproject/project.properties: -------------------------------------------------------------------------------- 1 | annotation.processing.enabled=true 2 | annotation.processing.enabled.in.editor=false 3 | annotation.processing.processors.list= 4 | annotation.processing.run.all.processors=true 5 | annotation.processing.source.output=${build.generated.sources.dir}/ap-source-output 6 | application.title=HeapMonitor 7 | application.vendor=root 8 | build.classes.dir=${build.dir}/classes 9 | build.classes.excludes=**/*.java,**/*.form 10 | # This directory is removed when the project is cleaned: 11 | build.dir=build 12 | build.generated.dir=${build.dir}/generated 13 | build.generated.sources.dir=${build.dir}/generated-sources 14 | # Only compile against the classpath explicitly listed here: 15 | build.sysclasspath=ignore 16 | build.test.classes.dir=${build.dir}/test/classes 17 | build.test.results.dir=${build.dir}/test/results 18 | # Uncomment to specify the preferred debugger connection transport: 19 | #debug.transport=dt_socket 20 | debug.classpath=\ 21 | ${run.classpath} 22 | debug.test.classpath=\ 23 | ${run.test.classpath} 24 | # Files in build.classes.dir which should be excluded from distribution jar 25 | dist.archive.excludes= 26 | # This directory is removed when the project is cleaned: 27 | dist.dir=dist 28 | dist.jar=${dist.dir}/HeapMonitor.jar 29 | dist.javadoc.dir=${dist.dir}/javadoc 30 | endorsed.classpath= 31 | excludes= 32 | includes=** 33 | jar.compress=false 34 | javac.classpath= 35 | # Space-separated list of extra javac options 36 | javac.compilerargs= 37 | javac.deprecation=false 38 | javac.processorpath=\ 39 | ${javac.classpath} 40 | javac.source=1.7 41 | javac.target=1.7 42 | javac.test.classpath=\ 43 | ${javac.classpath}:\ 44 | ${build.classes.dir} 45 | javac.test.processorpath=\ 46 | ${javac.test.classpath} 47 | javadoc.additionalparam= 48 | javadoc.author=false 49 | javadoc.encoding=${source.encoding} 50 | javadoc.noindex=false 51 | javadoc.nonavbar=false 52 | javadoc.notree=false 53 | javadoc.private=false 54 | javadoc.splitindex=true 55 | javadoc.use=true 56 | javadoc.version=false 57 | javadoc.windowtitle= 58 | main.class=heapmonitor.MainFrame 59 | manifest.file=manifest.mf 60 | meta.inf.dir=${src.dir}/META-INF 61 | mkdist.disabled=false 62 | platform.active=default_platform 63 | run.classpath=\ 64 | ${javac.classpath}:\ 65 | ${build.classes.dir} 66 | # Space-separated list of JVM arguments used when running the project. 67 | # You may also define separate properties like run-sys-prop.name=value instead of -Dname=value. 68 | # To set system properties for unit tests define test-sys-prop.name=value: 69 | run.jvmargs= 70 | run.test.classpath=\ 71 | ${javac.test.classpath}:\ 72 | ${build.test.classes.dir} 73 | source.encoding=UTF-8 74 | src.dir=src 75 | test.src.dir=test 76 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/MinHook.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | {018ae07f-8130-433b-b3b3-bc48d89587bc} 18 | 19 | 20 | {c216d12c-6586-4678-ab38-9858bbd7d255} 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | Source Files 29 | 30 | 31 | Source Files 32 | 33 | 34 | Source Files 35 | 36 | 37 | Source Files 38 | 39 | 40 | Source Files 41 | 42 | 43 | Source Files\HDE32 44 | 45 | 46 | 47 | 48 | Source Files 49 | 50 | 51 | Source Files 52 | 53 | 54 | Source Files 55 | 56 | 57 | Source Files 58 | 59 | 60 | Source Files 61 | 62 | 63 | Source Files\HDE32 64 | 65 | 66 | Source Files\HDE32 67 | 68 | 69 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/build/libMinHook.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {d2fc03a6-683a-49e0-87fa-844d1529a19c} 6 | 7 | 8 | {76b54476-8b6d-4556-84dc-311115cff274} 9 | 10 | 11 | {b2dbe4c4-a42e-40cd-b744-92327b9acf3e} 12 | 13 | 14 | {df59be5b-00d3-495b-8a79-ea0c6df20e74} 15 | 16 | 17 | {c5cf3151-e815-430f-9743-6ec94394b47d} 18 | 19 | 20 | 21 | 22 | src\HDE32 23 | 24 | 25 | src\HDE64 26 | 27 | 28 | src\Source Files 29 | 30 | 31 | src\Source Files 32 | 33 | 34 | src\Source Files 35 | 36 | 37 | src\Source Files 38 | 39 | 40 | src\Source Files 41 | 42 | 43 | 44 | 45 | src\HDE32 46 | 47 | 48 | src\HDE32 49 | 50 | 51 | src\HDE64 52 | 53 | 54 | src\HDE64 55 | 56 | 57 | src\Header Files 58 | 59 | 60 | src\Header Files 61 | 62 | 63 | src\Header Files 64 | 65 | 66 | src\Header Files 67 | 68 | 69 | src\Header Files 70 | 71 | 72 | 73 | 74 | 75 | 76 | -------------------------------------------------------------------------------- /HeapMonitor/src/heapmonitor/OptionsJDialog.form: -------------------------------------------------------------------------------- 1 | 2 | 3 |
4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 |
56 | -------------------------------------------------------------------------------- /HeapMonitor/src/heapmonitor/TraceJPanel.java: -------------------------------------------------------------------------------- 1 | package heapmonitor; 2 | 3 | import java.awt.Font; 4 | 5 | /** 6 | * 7 | * @author b0yd 8 | */ 9 | public class TraceJPanel extends javax.swing.JPanel { 10 | 11 | private final MainFrame parentFrame; 12 | 13 | /** 14 | * Creates new form TraceJPanel 15 | * @param parent 16 | */ 17 | public TraceJPanel( MainFrame parent) { 18 | initComponents(); 19 | initializeComponents(); 20 | parentFrame = parent; 21 | } 22 | 23 | //======================================================================= 24 | /** 25 | * 26 | */ 27 | private void initializeComponents() { 28 | //Set text area font 29 | traceJTextArea.setFont( new Font(Font.MONOSPACED, Font.PLAIN, 11 )); 30 | } 31 | 32 | //====================================================================== 33 | /** 34 | * 35 | * @param retStr 36 | */ 37 | public void setStackTraceTextArea( String retStr ) { 38 | 39 | traceJTextArea.setText( retStr ); 40 | //traceJTextArea.setCaretPosition(0); 41 | } 42 | 43 | /** 44 | * This method is called from within the constructor to initialize the form. 45 | * WARNING: Do NOT modify this code. The content of this method is always 46 | * regenerated by the Form Editor. 47 | */ 48 | @SuppressWarnings("unchecked") 49 | // //GEN-BEGIN:initComponents 50 | private void initComponents() { 51 | 52 | traceJPanel = new javax.swing.JScrollPane(); 53 | traceJTextArea = new javax.swing.JTextArea(); 54 | 55 | traceJTextArea.setColumns(20); 56 | traceJTextArea.setRows(5); 57 | traceJPanel.setViewportView(traceJTextArea); 58 | 59 | javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this); 60 | this.setLayout(layout); 61 | layout.setHorizontalGroup( 62 | layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) 63 | .addComponent(traceJPanel, javax.swing.GroupLayout.DEFAULT_SIZE, 593, Short.MAX_VALUE) 64 | ); 65 | layout.setVerticalGroup( 66 | layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) 67 | .addComponent(traceJPanel, javax.swing.GroupLayout.DEFAULT_SIZE, 463, Short.MAX_VALUE) 68 | ); 69 | }// //GEN-END:initComponents 70 | 71 | 72 | // Variables declaration - do not modify//GEN-BEGIN:variables 73 | private javax.swing.JScrollPane traceJPanel; 74 | private javax.swing.JTextArea traceJTextArea; 75 | // End of variables declaration//GEN-END:variables 76 | 77 | //======================================================================= 78 | /** 79 | * 80 | */ 81 | public void clearPanel() { 82 | //Clear trace 83 | traceJTextArea.setText(""); 84 | } 85 | } 86 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/src/HDE32/hde32.h: -------------------------------------------------------------------------------- 1 | /* 2 | * Hacker Disassembler Engine 32 3 | * Copyright (c) 2006-2009, Vyacheslav Patkov. 4 | * All rights reserved. 5 | * 6 | * hde32.h: C/C++ header file 7 | * 8 | */ 9 | 10 | #ifndef _HDE32_H_ 11 | #define _HDE32_H_ 12 | 13 | /* stdint.h - C99 standard header 14 | * http://en.wikipedia.org/wiki/stdint.h 15 | * 16 | * if your compiler doesn't contain "stdint.h" header (for 17 | * example, Microsoft Visual C++), you can download file: 18 | * http://www.azillionmonkeys.com/qed/pstdint.h 19 | * and change next line to: 20 | * #include "pstdint.h" 21 | */ 22 | /* #include */ 23 | #include "../pstdint.h" 24 | 25 | #define F_MODRM 0x00000001 26 | #define F_SIB 0x00000002 27 | #define F_IMM8 0x00000004 28 | #define F_IMM16 0x00000008 29 | #define F_IMM32 0x00000010 30 | #define F_DISP8 0x00000020 31 | #define F_DISP16 0x00000040 32 | #define F_DISP32 0x00000080 33 | #define F_RELATIVE 0x00000100 34 | #define F_2IMM16 0x00000800 35 | #define F_ERROR 0x00001000 36 | #define F_ERROR_OPCODE 0x00002000 37 | #define F_ERROR_LENGTH 0x00004000 38 | #define F_ERROR_LOCK 0x00008000 39 | #define F_ERROR_OPERAND 0x00010000 40 | #define F_PREFIX_REPNZ 0x01000000 41 | #define F_PREFIX_REPX 0x02000000 42 | #define F_PREFIX_REP 0x03000000 43 | #define F_PREFIX_66 0x04000000 44 | #define F_PREFIX_67 0x08000000 45 | #define F_PREFIX_LOCK 0x10000000 46 | #define F_PREFIX_SEG 0x20000000 47 | #define F_PREFIX_ANY 0x3f000000 48 | 49 | #define PREFIX_SEGMENT_CS 0x2e 50 | #define PREFIX_SEGMENT_SS 0x36 51 | #define PREFIX_SEGMENT_DS 0x3e 52 | #define PREFIX_SEGMENT_ES 0x26 53 | #define PREFIX_SEGMENT_FS 0x64 54 | #define PREFIX_SEGMENT_GS 0x65 55 | #define PREFIX_LOCK 0xf0 56 | #define PREFIX_REPNZ 0xf2 57 | #define PREFIX_REPX 0xf3 58 | #define PREFIX_OPERAND_SIZE 0x66 59 | #define PREFIX_ADDRESS_SIZE 0x67 60 | 61 | #pragma pack(push,1) 62 | 63 | typedef struct { 64 | uint8_t len; 65 | uint8_t p_rep; 66 | uint8_t p_lock; 67 | uint8_t p_seg; 68 | uint8_t p_66; 69 | uint8_t p_67; 70 | uint8_t opcode; 71 | uint8_t opcode2; 72 | uint8_t modrm; 73 | uint8_t modrm_mod; 74 | uint8_t modrm_reg; 75 | uint8_t modrm_rm; 76 | uint8_t sib; 77 | uint8_t sib_scale; 78 | uint8_t sib_index; 79 | uint8_t sib_base; 80 | union { 81 | uint8_t imm8; 82 | uint16_t imm16; 83 | uint32_t imm32; 84 | } imm; 85 | union { 86 | uint8_t disp8; 87 | uint16_t disp16; 88 | uint32_t disp32; 89 | } disp; 90 | uint32_t flags; 91 | } hde32s; 92 | 93 | #pragma pack(pop) 94 | 95 | #ifdef __cplusplus 96 | extern "C" { 97 | #endif 98 | 99 | /* __cdecl */ 100 | unsigned int hde32_disasm(const void *code, hde32s *hs); 101 | 102 | #ifdef __cplusplus 103 | } 104 | #endif 105 | 106 | #endif /* _HDE32_H_ */ 107 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/src/HDE64/include/hde64.h: -------------------------------------------------------------------------------- 1 | /* 2 | * Hacker Disassembler Engine 64 3 | * Copyright (c) 2008-2009, Vyacheslav Patkov. 4 | * All rights reserved. 5 | * 6 | * hde64.h: C/C++ header file 7 | * 8 | */ 9 | 10 | #ifndef _HDE64_H_ 11 | #define _HDE64_H_ 12 | 13 | /* stdint.h - C99 standard header 14 | * http://en.wikipedia.org/wiki/stdint.h 15 | * 16 | * if your compiler doesn't contain "stdint.h" header (for 17 | * example, Microsoft Visual C++), you can download file: 18 | * http://www.azillionmonkeys.com/qed/pstdint.h 19 | * and change next line to: 20 | * #include "pstdint.h" 21 | */ 22 | /* #include */ 23 | #include "../../pstdint.h" 24 | 25 | #define F_MODRM 0x00000001 26 | #define F_SIB 0x00000002 27 | #define F_IMM8 0x00000004 28 | #define F_IMM16 0x00000008 29 | #define F_IMM32 0x00000010 30 | #define F_IMM64 0x00000020 31 | #define F_DISP8 0x00000040 32 | #define F_DISP16 0x00000080 33 | #define F_DISP32 0x00000100 34 | #define F_RELATIVE 0x00000200 35 | #define F_ERROR 0x00001000 36 | #define F_ERROR_OPCODE 0x00002000 37 | #define F_ERROR_LENGTH 0x00004000 38 | #define F_ERROR_LOCK 0x00008000 39 | #define F_ERROR_OPERAND 0x00010000 40 | #define F_PREFIX_REPNZ 0x01000000 41 | #define F_PREFIX_REPX 0x02000000 42 | #define F_PREFIX_REP 0x03000000 43 | #define F_PREFIX_66 0x04000000 44 | #define F_PREFIX_67 0x08000000 45 | #define F_PREFIX_LOCK 0x10000000 46 | #define F_PREFIX_SEG 0x20000000 47 | #define F_PREFIX_REX 0x40000000 48 | #define F_PREFIX_ANY 0x7f000000 49 | 50 | #define PREFIX_SEGMENT_CS 0x2e 51 | #define PREFIX_SEGMENT_SS 0x36 52 | #define PREFIX_SEGMENT_DS 0x3e 53 | #define PREFIX_SEGMENT_ES 0x26 54 | #define PREFIX_SEGMENT_FS 0x64 55 | #define PREFIX_SEGMENT_GS 0x65 56 | #define PREFIX_LOCK 0xf0 57 | #define PREFIX_REPNZ 0xf2 58 | #define PREFIX_REPX 0xf3 59 | #define PREFIX_OPERAND_SIZE 0x66 60 | #define PREFIX_ADDRESS_SIZE 0x67 61 | 62 | #pragma pack(push,1) 63 | 64 | typedef struct { 65 | uint8_t len; 66 | uint8_t p_rep; 67 | uint8_t p_lock; 68 | uint8_t p_seg; 69 | uint8_t p_66; 70 | uint8_t p_67; 71 | uint8_t rex; 72 | uint8_t rex_w; 73 | uint8_t rex_r; 74 | uint8_t rex_x; 75 | uint8_t rex_b; 76 | uint8_t opcode; 77 | uint8_t opcode2; 78 | uint8_t modrm; 79 | uint8_t modrm_mod; 80 | uint8_t modrm_reg; 81 | uint8_t modrm_rm; 82 | uint8_t sib; 83 | uint8_t sib_scale; 84 | uint8_t sib_index; 85 | uint8_t sib_base; 86 | union { 87 | uint8_t imm8; 88 | uint16_t imm16; 89 | uint32_t imm32; 90 | uint64_t imm64; 91 | } imm; 92 | union { 93 | uint8_t disp8; 94 | uint16_t disp16; 95 | uint32_t disp32; 96 | } disp; 97 | uint32_t flags; 98 | } hde64s; 99 | 100 | #pragma pack(pop) 101 | 102 | #ifdef __cplusplus 103 | extern "C" { 104 | #endif 105 | 106 | /* __cdecl */ 107 | unsigned int hde64_disasm(const void *code, hde64s *hs); 108 | 109 | #ifdef __cplusplus 110 | } 111 | #endif 112 | 113 | #endif /* _HDE64_H_ */ 114 | -------------------------------------------------------------------------------- /HeapMonitor/src/heapmonitor/OptionsJDialog.java: -------------------------------------------------------------------------------- 1 | package heapmonitor; 2 | 3 | import java.awt.Window; 4 | 5 | /** 6 | * 7 | * @author b0yd 8 | */ 9 | public class OptionsJDialog extends javax.swing.JDialog { 10 | 11 | /** 12 | * Creates new form OptionsJDialog 13 | * @param parent 14 | * @param modal 15 | */ 16 | public OptionsJDialog( MainFrame parent, boolean modal) { 17 | super(parent, modal); 18 | initComponents(); 19 | initializeComponents(); 20 | } 21 | 22 | /** 23 | * This method is called from within the constructor to initialize the form. 24 | * WARNING: Do NOT modify this code. The content of this method is always 25 | * regenerated by the Form Editor. 26 | */ 27 | @SuppressWarnings("unchecked") 28 | // //GEN-BEGIN:initComponents 29 | private void initComponents() { 30 | 31 | scrollTextbox = new javax.swing.JCheckBox(); 32 | 33 | setDefaultCloseOperation(javax.swing.WindowConstants.DISPOSE_ON_CLOSE); 34 | setTitle("Options"); 35 | 36 | scrollTextbox.setText("Auto Scroll"); 37 | scrollTextbox.setIconTextGap(10); 38 | scrollTextbox.addActionListener(new java.awt.event.ActionListener() { 39 | public void actionPerformed(java.awt.event.ActionEvent evt) { 40 | scrollTextboxActionPerformed(evt); 41 | } 42 | }); 43 | 44 | javax.swing.GroupLayout layout = new javax.swing.GroupLayout(getContentPane()); 45 | getContentPane().setLayout(layout); 46 | layout.setHorizontalGroup( 47 | layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) 48 | .addGroup(layout.createSequentialGroup() 49 | .addGap(20, 20, 20) 50 | .addComponent(scrollTextbox, javax.swing.GroupLayout.PREFERRED_SIZE, 99, javax.swing.GroupLayout.PREFERRED_SIZE) 51 | .addContainerGap(243, Short.MAX_VALUE)) 52 | ); 53 | layout.setVerticalGroup( 54 | layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) 55 | .addGroup(layout.createSequentialGroup() 56 | .addGap(27, 27, 27) 57 | .addComponent(scrollTextbox) 58 | .addContainerGap(166, Short.MAX_VALUE)) 59 | ); 60 | 61 | pack(); 62 | }// //GEN-END:initComponents 63 | 64 | private void scrollTextboxActionPerformed(java.awt.event.ActionEvent evt) {//GEN-FIRST:event_scrollTextboxActionPerformed 65 | 66 | Window parentWindow = this.getOwner(); 67 | if( parentWindow instanceof MainFrame ){ 68 | MainFrame theMainFrame = (MainFrame)parentWindow; 69 | theMainFrame.setScrollFlag( scrollTextbox.isSelected() ); 70 | } 71 | }//GEN-LAST:event_scrollTextboxActionPerformed 72 | 73 | 74 | // Variables declaration - do not modify//GEN-BEGIN:variables 75 | private javax.swing.JCheckBox scrollTextbox; 76 | // End of variables declaration//GEN-END:variables 77 | 78 | //======================================================================== 79 | /** 80 | * 81 | */ 82 | private void initializeComponents() { 83 | scrollTextbox.setSelected(MainFrame.AUTOSCROLL_FLAG); 84 | } 85 | } 86 | -------------------------------------------------------------------------------- /HeapMonitor/src/heapmonitor/MemoryTupleHandler.java: -------------------------------------------------------------------------------- 1 | /* 2 | * MessageHandler.java 3 | * 4 | */ 5 | 6 | package heapmonitor; 7 | 8 | import java.util.LinkedList; 9 | import java.util.Queue; 10 | 11 | /** 12 | * 13 | * @author b0yd 14 | */ 15 | public class MemoryTupleHandler extends ManagedRunnable { 16 | 17 | private final MainFrame theParentFrame; 18 | private final Queue incomingTraceQueue = new LinkedList<>(); 19 | 20 | //================================================================= 21 | /** 22 | * 23 | * @param passedParent 24 | */ 25 | public MemoryTupleHandler( MainFrame passedParent ) { 26 | super( MainFrame.Executor ); 27 | theParentFrame = passedParent; 28 | } 29 | 30 | //================================================================= 31 | /** 32 | * Main loop 33 | */ 34 | @Override 35 | public void go() { 36 | 37 | Object[] anObjArr; 38 | while( !shutdownRequested ){ 39 | 40 | //Wait till something is added to the queue 41 | waitToBeNotified(); 42 | 43 | //Waits until a msg comes in 44 | while( !isIncomingEmpty() ){ 45 | 46 | 47 | // Handle the next message 48 | synchronized(incomingTraceQueue) { 49 | anObjArr = (Object[])incomingTraceQueue.poll(); 50 | } 51 | 52 | //Handles a message if there is one 53 | if(anObjArr != null){ 54 | handleIncoming(anObjArr); 55 | anObjArr = null; 56 | } 57 | 58 | } 59 | } 60 | } 61 | 62 | //=============================================================== 63 | /** 64 | * Handles incoming messages 65 | * 66 | * @param theMessage 67 | * @return 68 | */ 69 | private void handleIncoming( Object[] anObjArr ) { 70 | 71 | //String aStr = null; 72 | if( anObjArr != null && anObjArr.length == 2){ 73 | 74 | Long address = (Long)anObjArr[0]; 75 | Trace theTrace = (Trace)anObjArr[1]; 76 | theParentFrame.addTrace( address, theTrace ); 77 | 78 | } 79 | } 80 | 81 | 82 | //=============================================================== 83 | /** 84 | * Checks if the incoming queue is empty 85 | * 86 | * @return 87 | */ 88 | public boolean isIncomingEmpty(){ 89 | 90 | boolean retVal; 91 | 92 | synchronized(incomingTraceQueue) { 93 | retVal = incomingTraceQueue.isEmpty(); 94 | } 95 | return retVal; 96 | } 97 | 98 | //=============================================================== 99 | /** 100 | * Queues a MemoryTuple 101 | * 102 | * @param address 103 | * @param passedTrace 104 | */ 105 | public void processIncoming( long address, Trace passedTrace) { 106 | 107 | //Copy over the bytes 108 | if(passedTrace != null){ 109 | 110 | synchronized(incomingTraceQueue) { 111 | incomingTraceQueue.add(new Object[]{ address, passedTrace }); 112 | } 113 | beNotified(); 114 | 115 | } 116 | } 117 | 118 | 119 | } 120 | -------------------------------------------------------------------------------- /HeapMonitor/src/heapmonitor/FreeJPanel.form: -------------------------------------------------------------------------------- 1 | 2 | 3 |
4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 |
67 | -------------------------------------------------------------------------------- /HeapMonitor/src/heapmonitor/AllocationJPanel.form: -------------------------------------------------------------------------------- 1 | 2 | 3 |
4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 |
67 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/src/HDE32/table32.h: -------------------------------------------------------------------------------- 1 | /* 2 | * Hacker Disassembler Engine 32 C 3 | * Copyright (c) 2008-2009, Vyacheslav Patkov. 4 | * All rights reserved. 5 | * 6 | */ 7 | 8 | #define C_NONE 0x00 9 | #define C_MODRM 0x01 10 | #define C_IMM8 0x02 11 | #define C_IMM16 0x04 12 | #define C_IMM_P66 0x10 13 | #define C_REL8 0x20 14 | #define C_REL32 0x40 15 | #define C_GROUP 0x80 16 | #define C_ERROR 0xff 17 | 18 | #define PRE_ANY 0x00 19 | #define PRE_NONE 0x01 20 | #define PRE_F2 0x02 21 | #define PRE_F3 0x04 22 | #define PRE_66 0x08 23 | #define PRE_67 0x10 24 | #define PRE_LOCK 0x20 25 | #define PRE_SEG 0x40 26 | #define PRE_ALL 0xff 27 | 28 | #define DELTA_OPCODES 0x4a 29 | #define DELTA_FPU_REG 0xf1 30 | #define DELTA_FPU_MODRM 0xf8 31 | #define DELTA_PREFIXES 0x130 32 | #define DELTA_OP_LOCK_OK 0x1a1 33 | #define DELTA_OP2_LOCK_OK 0x1b9 34 | #define DELTA_OP_ONLY_MEM 0x1cb 35 | #define DELTA_OP2_ONLY_MEM 0x1da 36 | 37 | unsigned char hde32_table[] = { 38 | 0xa3,0xa8,0xa3,0xa8,0xa3,0xa8,0xa3,0xa8,0xa3,0xa8,0xa3,0xa8,0xa3,0xa8,0xa3, 39 | 0xa8,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xaa,0xac,0xaa,0xb2,0xaa,0x9f,0x9f, 40 | 0x9f,0x9f,0xb5,0xa3,0xa3,0xa4,0xaa,0xaa,0xba,0xaa,0x96,0xaa,0xa8,0xaa,0xc3, 41 | 0xc3,0x96,0x96,0xb7,0xae,0xd6,0xbd,0xa3,0xc5,0xa3,0xa3,0x9f,0xc3,0x9c,0xaa, 42 | 0xaa,0xac,0xaa,0xbf,0x03,0x7f,0x11,0x7f,0x01,0x7f,0x01,0x3f,0x01,0x01,0x90, 43 | 0x82,0x7d,0x97,0x59,0x59,0x59,0x59,0x59,0x7f,0x59,0x59,0x60,0x7d,0x7f,0x7f, 44 | 0x59,0x59,0x59,0x59,0x59,0x59,0x59,0x59,0x59,0x59,0x59,0x59,0x9a,0x88,0x7d, 45 | 0x59,0x50,0x50,0x50,0x50,0x59,0x59,0x59,0x59,0x61,0x94,0x61,0x9e,0x59,0x59, 46 | 0x85,0x59,0x92,0xa3,0x60,0x60,0x59,0x59,0x59,0x59,0x59,0x59,0x59,0x59,0x59, 47 | 0x59,0x59,0x9f,0x01,0x03,0x01,0x04,0x03,0xd5,0x03,0xcc,0x01,0xbc,0x03,0xf0, 48 | 0x10,0x10,0x10,0x10,0x50,0x50,0x50,0x50,0x14,0x20,0x20,0x20,0x20,0x01,0x01, 49 | 0x01,0x01,0xc4,0x02,0x10,0x00,0x00,0x00,0x00,0x01,0x01,0xc0,0xc2,0x10,0x11, 50 | 0x02,0x03,0x11,0x03,0x03,0x04,0x00,0x00,0x14,0x00,0x02,0x00,0x00,0xc6,0xc8, 51 | 0x02,0x02,0x02,0x02,0x00,0x00,0xff,0xff,0xff,0xff,0x00,0x00,0x00,0xff,0xca, 52 | 0x01,0x01,0x01,0x00,0x06,0x00,0x04,0x00,0xc0,0xc2,0x01,0x01,0x03,0x01,0xff, 53 | 0xff,0x01,0x00,0x03,0xc4,0xc4,0xc6,0x03,0x01,0x01,0x01,0xff,0x03,0x03,0x03, 54 | 0xc8,0x40,0x00,0x0a,0x00,0x04,0x00,0x00,0x00,0x00,0x7f,0x00,0x33,0x01,0x00, 55 | 0x00,0x00,0x00,0x00,0x00,0xff,0xbf,0xff,0xff,0x00,0x00,0x00,0x00,0x07,0x00, 56 | 0x00,0xff,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 57 | 0x00,0xff,0xff,0x00,0x00,0x00,0xbf,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, 58 | 0x7f,0x00,0x00,0xff,0x4a,0x4a,0x4a,0x4a,0x4b,0x52,0x4a,0x4a,0x4a,0x4a,0x4f, 59 | 0x4c,0x4a,0x4a,0x4a,0x4a,0x4a,0x4a,0x4a,0x4a,0x55,0x45,0x40,0x4a,0x4a,0x4a, 60 | 0x45,0x59,0x4d,0x46,0x4a,0x5d,0x4a,0x4a,0x4a,0x4a,0x4a,0x4a,0x4a,0x4a,0x4a, 61 | 0x4a,0x4a,0x4a,0x4a,0x4a,0x61,0x63,0x67,0x4e,0x4a,0x4a,0x6b,0x6d,0x4a,0x4a, 62 | 0x45,0x6d,0x4a,0x4a,0x44,0x45,0x4a,0x4a,0x00,0x00,0x00,0x02,0x0d,0x06,0x06, 63 | 0x06,0x06,0x0e,0x00,0x00,0x00,0x00,0x06,0x06,0x06,0x00,0x06,0x06,0x02,0x06, 64 | 0x00,0x0a,0x0a,0x07,0x07,0x06,0x02,0x05,0x05,0x02,0x02,0x00,0x00,0x04,0x04, 65 | 0x04,0x04,0x00,0x00,0x00,0x0e,0x05,0x06,0x06,0x06,0x01,0x06,0x00,0x00,0x08, 66 | 0x00,0x10,0x00,0x18,0x00,0x20,0x00,0x28,0x00,0x30,0x00,0x80,0x01,0x82,0x01, 67 | 0x86,0x00,0xf6,0xcf,0xfe,0x3f,0xab,0x00,0xb0,0x00,0xb1,0x00,0xb3,0x00,0xba, 68 | 0xf8,0xbb,0x00,0xc0,0x00,0xc1,0x00,0xc7,0xbf,0x62,0xff,0x00,0x8d,0xff,0x00, 69 | 0xc4,0xff,0x00,0xc5,0xff,0x00,0xff,0xff,0xeb,0x01,0xff,0x0e,0x12,0x08,0x00, 70 | 0x13,0x09,0x00,0x16,0x08,0x00,0x17,0x09,0x00,0x2b,0x09,0x00,0xae,0xff,0x07, 71 | 0xb2,0xff,0x00,0xb4,0xff,0x00,0xb5,0xff,0x00,0xc3,0x01,0x00,0xc7,0xff,0xbf, 72 | 0xe7,0x08,0x00,0xf0,0x02,0x00 73 | }; 74 | -------------------------------------------------------------------------------- /HeapMonitor/build.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | Builds, tests, and runs the project HeapMonitor. 12 | 13 | 73 | 74 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/src/HDE64/src/table64.h: -------------------------------------------------------------------------------- 1 | /* 2 | * Hacker Disassembler Engine 64 C 3 | * Copyright (c) 2008-2009, Vyacheslav Patkov. 4 | * All rights reserved. 5 | * 6 | */ 7 | 8 | #define C_NONE 0x00 9 | #define C_MODRM 0x01 10 | #define C_IMM8 0x02 11 | #define C_IMM16 0x04 12 | #define C_IMM_P66 0x10 13 | #define C_REL8 0x20 14 | #define C_REL32 0x40 15 | #define C_GROUP 0x80 16 | #define C_ERROR 0xff 17 | 18 | #define PRE_ANY 0x00 19 | #define PRE_NONE 0x01 20 | #define PRE_F2 0x02 21 | #define PRE_F3 0x04 22 | #define PRE_66 0x08 23 | #define PRE_67 0x10 24 | #define PRE_LOCK 0x20 25 | #define PRE_SEG 0x40 26 | #define PRE_ALL 0xff 27 | 28 | #define DELTA_OPCODES 0x4a 29 | #define DELTA_FPU_REG 0xfd 30 | #define DELTA_FPU_MODRM 0x104 31 | #define DELTA_PREFIXES 0x13c 32 | #define DELTA_OP_LOCK_OK 0x1ae 33 | #define DELTA_OP2_LOCK_OK 0x1c6 34 | #define DELTA_OP_ONLY_MEM 0x1d8 35 | #define DELTA_OP2_ONLY_MEM 0x1e7 36 | 37 | unsigned char hde64_table[] = { 38 | 0xa5,0xaa,0xa5,0xb8,0xa5,0xaa,0xa5,0xaa,0xa5,0xb8,0xa5,0xb8,0xa5,0xb8,0xa5, 39 | 0xb8,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xc0,0xac,0xc0,0xcc,0xc0,0xa1,0xa1, 40 | 0xa1,0xa1,0xb1,0xa5,0xa5,0xa6,0xc0,0xc0,0xd7,0xda,0xe0,0xc0,0xe4,0xc0,0xea, 41 | 0xea,0xe0,0xe0,0x98,0xc8,0xee,0xf1,0xa5,0xd3,0xa5,0xa5,0xa1,0xea,0x9e,0xc0, 42 | 0xc0,0xc2,0xc0,0xe6,0x03,0x7f,0x11,0x7f,0x01,0x7f,0x01,0x3f,0x01,0x01,0xab, 43 | 0x8b,0x90,0x64,0x5b,0x5b,0x5b,0x5b,0x5b,0x92,0x5b,0x5b,0x76,0x90,0x92,0x92, 44 | 0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x6a,0x73,0x90, 45 | 0x5b,0x52,0x52,0x52,0x52,0x5b,0x5b,0x5b,0x5b,0x77,0x7c,0x77,0x85,0x5b,0x5b, 46 | 0x70,0x5b,0x7a,0xaf,0x76,0x76,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b,0x5b, 47 | 0x5b,0x5b,0x86,0x01,0x03,0x01,0x04,0x03,0xd5,0x03,0xd5,0x03,0xcc,0x01,0xbc, 48 | 0x03,0xf0,0x03,0x03,0x04,0x00,0x50,0x50,0x50,0x50,0xff,0x20,0x20,0x20,0x20, 49 | 0x01,0x01,0x01,0x01,0xc4,0x02,0x10,0xff,0xff,0xff,0x01,0x00,0x03,0x11,0xff, 50 | 0x03,0xc4,0xc6,0xc8,0x02,0x10,0x00,0xff,0xcc,0x01,0x01,0x01,0x00,0x00,0x00, 51 | 0x00,0x01,0x01,0x03,0x01,0xff,0xff,0xc0,0xc2,0x10,0x11,0x02,0x03,0x01,0x01, 52 | 0x01,0xff,0xff,0xff,0x00,0x00,0x00,0xff,0x00,0x00,0xff,0xff,0xff,0xff,0x10, 53 | 0x10,0x10,0x10,0x02,0x10,0x00,0x00,0xc6,0xc8,0x02,0x02,0x02,0x02,0x06,0x00, 54 | 0x04,0x00,0x02,0xff,0x00,0xc0,0xc2,0x01,0x01,0x03,0x03,0x03,0xca,0x40,0x00, 55 | 0x0a,0x00,0x04,0x00,0x00,0x00,0x00,0x7f,0x00,0x33,0x01,0x00,0x00,0x00,0x00, 56 | 0x00,0x00,0xff,0xbf,0xff,0xff,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0xff,0x00, 57 | 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xff,0xff, 58 | 0x00,0x00,0x00,0xbf,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x7f,0x00,0x00, 59 | 0xff,0x40,0x40,0x40,0x40,0x41,0x49,0x40,0x40,0x40,0x40,0x4c,0x42,0x40,0x40, 60 | 0x40,0x40,0x40,0x40,0x40,0x40,0x4f,0x44,0x53,0x40,0x40,0x40,0x44,0x57,0x43, 61 | 0x5c,0x40,0x60,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40,0x40, 62 | 0x40,0x40,0x64,0x66,0x6e,0x6b,0x40,0x40,0x6a,0x46,0x40,0x40,0x44,0x46,0x40, 63 | 0x40,0x5b,0x44,0x40,0x40,0x00,0x00,0x00,0x00,0x06,0x06,0x06,0x06,0x01,0x06, 64 | 0x06,0x02,0x06,0x06,0x00,0x06,0x00,0x0a,0x0a,0x00,0x00,0x00,0x02,0x07,0x07, 65 | 0x06,0x02,0x0d,0x06,0x06,0x06,0x0e,0x05,0x05,0x02,0x02,0x00,0x00,0x04,0x04, 66 | 0x04,0x04,0x05,0x06,0x06,0x06,0x00,0x00,0x00,0x0e,0x00,0x00,0x08,0x00,0x10, 67 | 0x00,0x18,0x00,0x20,0x00,0x28,0x00,0x30,0x00,0x80,0x01,0x82,0x01,0x86,0x00, 68 | 0xf6,0xcf,0xfe,0x3f,0xab,0x00,0xb0,0x00,0xb1,0x00,0xb3,0x00,0xba,0xf8,0xbb, 69 | 0x00,0xc0,0x00,0xc1,0x00,0xc7,0xbf,0x62,0xff,0x00,0x8d,0xff,0x00,0xc4,0xff, 70 | 0x00,0xc5,0xff,0x00,0xff,0xff,0xeb,0x01,0xff,0x0e,0x12,0x08,0x00,0x13,0x09, 71 | 0x00,0x16,0x08,0x00,0x17,0x09,0x00,0x2b,0x09,0x00,0xae,0xff,0x07,0xb2,0xff, 72 | 0x00,0xb4,0xff,0x00,0xb5,0xff,0x00,0xc3,0x01,0x00,0xc7,0xff,0xbf,0xe7,0x08, 73 | 0x00,0xf0,0x02,0x00 74 | }; 75 | -------------------------------------------------------------------------------- /HeapMonitor/src/heapmonitor/ManagedRunnable.java: -------------------------------------------------------------------------------- 1 | 2 | /* 3 | * ManagedRunnable.java 4 | * 5 | * Created on June 2, 2013 10:21 PM 6 | */ 7 | 8 | package heapmonitor; 9 | 10 | import java.util.concurrent.Executor; 11 | 12 | /** 13 | * 14 | * 15 | */ 16 | abstract public class ManagedRunnable implements Runnable { 17 | 18 | protected volatile boolean shutdownRequested = false; 19 | private volatile boolean isRunning = false; 20 | private volatile boolean notified = false; 21 | protected final Executor theExecutor; 22 | 23 | //=============================================================== 24 | /** 25 | * Base constructor 26 | * @param passedExecutor 27 | */ 28 | protected ManagedRunnable( Executor passedExecutor ) { 29 | theExecutor = passedExecutor; 30 | } 31 | 32 | //=============================================================== 33 | /** 34 | * Starts the detector thread 35 | */ 36 | public synchronized void start(){ 37 | if( !isRunning ){ 38 | theExecutor.execute( this ); 39 | } 40 | } 41 | 42 | //=============================================================== 43 | /** 44 | * Used for setting the run flags 45 | */ 46 | @Override //Runnable 47 | final public void run() { 48 | 49 | //Set flag 50 | isRunning = true; 51 | 52 | //Run the main function 53 | go(); 54 | 55 | //Set flag 56 | isRunning = false; 57 | 58 | } 59 | 60 | //=============================================================== 61 | /** 62 | * The main thread function 63 | */ 64 | abstract protected void go(); 65 | 66 | //=============================================================== 67 | /** 68 | * Shut down the detector 69 | */ 70 | public synchronized void shutdown(){ 71 | shutdownRequested = true; 72 | notifyAll(); 73 | } 74 | 75 | 76 | // ========================================================================== 77 | /** 78 | * Causes the calling {@link Thread} to wait() until notified by 79 | * another. 80 | *

81 | * This method most certainly "blocks". 82 | * @param anInt 83 | */ 84 | public synchronized void waitToBeNotified( Integer... anInt ) { 85 | 86 | while( !notified && !shutdownRequested) { //Until notified... 87 | 88 | try { 89 | 90 | //Add a timeout if necessary 91 | if( anInt.length > 0 ){ 92 | 93 | wait( anInt[0]); 94 | break; 95 | 96 | } else { 97 | wait(); //Wait here until notified 98 | } 99 | 100 | } catch( InterruptedException ex ) { 101 | } 102 | 103 | } 104 | notified = false; 105 | } 106 | 107 | //=============================================================== 108 | /** 109 | * Notifies the thread 110 | */ 111 | protected synchronized void beNotified() { 112 | notified = true; 113 | notifyAll(); 114 | } 115 | 116 | // ========================================================================== 117 | /** 118 | * Checks the shutdown flag. 119 | * 120 | * @return 121 | */ 122 | public synchronized boolean finished() { 123 | return shutdownRequested; 124 | } 125 | 126 | // ========================================================================== 127 | /** 128 | * Check if the running flag has been set 129 | * 130 | * @return 131 | */ 132 | public boolean isRunning() { 133 | return isRunning; 134 | } 135 | } -------------------------------------------------------------------------------- /Observer/libs/MinHook/COPYING.txt: -------------------------------------------------------------------------------- 1 | /* 2 | * MinHook - The Minimalistic API Hooking Library for x64/x86 3 | * Copyright (c) 2009 Tsuda Kageyu. 4 | * All rights reserved. 5 | * 6 | * Redistribution and use in source and binary forms, with or without 7 | * modification, are permitted provided that the following conditions 8 | * are met: 9 | * 10 | * 1. Redistributions of source code must retain the above copyright 11 | * notice, this list of conditions and the following disclaimer. 12 | * 2. Redistributions in binary form must reproduce the above copyright 13 | * notice, this list of conditions and the following disclaimer in the 14 | * documentation and/or other materials provided with the distribution. 15 | * 3. The name of the author may not be used to endorse or promote products 16 | * derived from this software without specific prior written permission. 17 | * 18 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 | */ 29 | 30 | ================================================================================ 31 | Portions of this software are Copyright (c) 2008-2009, Vyacheslav Patkov. 32 | ================================================================================ 33 | /* 34 | * Hacker Disassembler Engine 32 C 35 | * Copyright (c) 2008-2009, Vyacheslav Patkov. 36 | * All rights reserved. 37 | * 38 | */ 39 | 40 | /* 41 | * Hacker Disassembler Engine 64 C 42 | * Copyright (c) 2008-2009, Vyacheslav Patkov. 43 | * All rights reserved. 44 | * 45 | */ 46 | 47 | ================================================================================ 48 | Portions of this software are Copyright (c) 2005-2007 Paul Hsieh. 49 | ================================================================================ 50 | /* A portable stdint.h 51 | **************************************************************************** 52 | * BSD License: 53 | **************************************************************************** 54 | * 55 | * Copyright (c) 2005-2007 Paul Hsieh 56 | * All rights reserved. 57 | * 58 | * Redistribution and use in source and binary forms, with or without 59 | * modification, are permitted provided that the following conditions 60 | * are met: 61 | * 62 | * 1. Redistributions of source code must retain the above copyright 63 | * notice, this list of conditions and the following disclaimer. 64 | * 2. Redistributions in binary form must reproduce the above copyright 65 | * notice, this list of conditions and the following disclaimer in the 66 | * documentation and/or other materials provided with the distribution. 67 | * 3. The name of the author may not be used to endorse or promote products 68 | * derived from this software without specific prior written permission. 69 | * 70 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 71 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 72 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 73 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 74 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 75 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 76 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 77 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 78 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 79 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 80 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/MinHook.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | 14 | {672868F4-6952-4D53-9BCA-22277B95027D} 15 | Win32Proj 16 | MinHook 17 | 18 | 19 | 20 | StaticLibrary 21 | true 22 | v110 23 | Unicode 24 | 25 | 26 | StaticLibrary 27 | false 28 | v110 29 | true 30 | Unicode 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | Level3 48 | Disabled 49 | WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions) 50 | 51 | 52 | Windows 53 | true 54 | 55 | 56 | 57 | 58 | Level3 59 | 60 | 61 | MaxSpeed 62 | true 63 | true 64 | WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions) 65 | 66 | 67 | Windows 68 | true 69 | true 70 | true 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | -------------------------------------------------------------------------------- /Observer/HeapMonitor.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 2012 4 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DllInjector", "DllInjector\DllInjector.vcxproj", "{964F661B-8FA0-4DEF-836F-0D0720972D02}" 5 | ProjectSection(ProjectDependencies) = postProject 6 | {F3C8DD27-15AB-4B73-A499-C32181ACACC9} = {F3C8DD27-15AB-4B73-A499-C32181ACACC9} 7 | EndProjectSection 8 | EndProject 9 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Observer", "Observer\Observer.vcxproj", "{F3C8DD27-15AB-4B73-A499-C32181ACACC9}" 10 | EndProject 11 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "libMinHook", "libs\MinHook\build\libMinHook.vcxproj", "{65021938-D251-46FA-BC3D-85C385D4C06D}" 12 | EndProject 13 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TestAllocations", "TestAllocations\TestAllocations.vcxproj", "{5D63EFBE-1839-4708-9814-81170AF56313}" 14 | EndProject 15 | Global 16 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 17 | Debug|Mixed Platforms = Debug|Mixed Platforms 18 | Debug|Win32 = Debug|Win32 19 | Debug|x64 = Debug|x64 20 | Release|Mixed Platforms = Release|Mixed Platforms 21 | Release|Win32 = Release|Win32 22 | Release|x64 = Release|x64 23 | EndGlobalSection 24 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 25 | {964F661B-8FA0-4DEF-836F-0D0720972D02}.Debug|Mixed Platforms.ActiveCfg = Debug|x64 26 | {964F661B-8FA0-4DEF-836F-0D0720972D02}.Debug|Mixed Platforms.Build.0 = Debug|x64 27 | {964F661B-8FA0-4DEF-836F-0D0720972D02}.Debug|Win32.ActiveCfg = Debug|Win32 28 | {964F661B-8FA0-4DEF-836F-0D0720972D02}.Debug|Win32.Build.0 = Debug|Win32 29 | {964F661B-8FA0-4DEF-836F-0D0720972D02}.Debug|x64.ActiveCfg = Debug|x64 30 | {964F661B-8FA0-4DEF-836F-0D0720972D02}.Debug|x64.Build.0 = Debug|x64 31 | {964F661B-8FA0-4DEF-836F-0D0720972D02}.Release|Mixed Platforms.ActiveCfg = Release|Win32 32 | {964F661B-8FA0-4DEF-836F-0D0720972D02}.Release|Mixed Platforms.Build.0 = Release|Win32 33 | {964F661B-8FA0-4DEF-836F-0D0720972D02}.Release|Win32.ActiveCfg = Release|Win32 34 | {964F661B-8FA0-4DEF-836F-0D0720972D02}.Release|Win32.Build.0 = Release|Win32 35 | {964F661B-8FA0-4DEF-836F-0D0720972D02}.Release|x64.ActiveCfg = Release|x64 36 | {964F661B-8FA0-4DEF-836F-0D0720972D02}.Release|x64.Build.0 = Release|x64 37 | {F3C8DD27-15AB-4B73-A499-C32181ACACC9}.Debug|Mixed Platforms.ActiveCfg = Debug|x64 38 | {F3C8DD27-15AB-4B73-A499-C32181ACACC9}.Debug|Mixed Platforms.Build.0 = Debug|x64 39 | {F3C8DD27-15AB-4B73-A499-C32181ACACC9}.Debug|Win32.ActiveCfg = Debug|Win32 40 | {F3C8DD27-15AB-4B73-A499-C32181ACACC9}.Debug|Win32.Build.0 = Debug|Win32 41 | {F3C8DD27-15AB-4B73-A499-C32181ACACC9}.Debug|x64.ActiveCfg = Debug|x64 42 | {F3C8DD27-15AB-4B73-A499-C32181ACACC9}.Debug|x64.Build.0 = Debug|x64 43 | {F3C8DD27-15AB-4B73-A499-C32181ACACC9}.Release|Mixed Platforms.ActiveCfg = Release|Win32 44 | {F3C8DD27-15AB-4B73-A499-C32181ACACC9}.Release|Mixed Platforms.Build.0 = Release|Win32 45 | {F3C8DD27-15AB-4B73-A499-C32181ACACC9}.Release|Win32.ActiveCfg = Release|Win32 46 | {F3C8DD27-15AB-4B73-A499-C32181ACACC9}.Release|Win32.Build.0 = Release|Win32 47 | {F3C8DD27-15AB-4B73-A499-C32181ACACC9}.Release|x64.ActiveCfg = Release|x64 48 | {F3C8DD27-15AB-4B73-A499-C32181ACACC9}.Release|x64.Build.0 = Release|x64 49 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|Mixed Platforms.ActiveCfg = Debug|x64 50 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|Mixed Platforms.Build.0 = Debug|x64 51 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|Win32.ActiveCfg = Debug|Win32 52 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|Win32.Build.0 = Debug|Win32 53 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|x64.ActiveCfg = Debug|x64 54 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Debug|x64.Build.0 = Debug|x64 55 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|Mixed Platforms.ActiveCfg = Release|Win32 56 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|Mixed Platforms.Build.0 = Release|Win32 57 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|Win32.ActiveCfg = Release|Win32 58 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|Win32.Build.0 = Release|Win32 59 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|x64.ActiveCfg = Release|x64 60 | {65021938-D251-46FA-BC3D-85C385D4C06D}.Release|x64.Build.0 = Release|x64 61 | {5D63EFBE-1839-4708-9814-81170AF56313}.Debug|Mixed Platforms.ActiveCfg = Debug|Win32 62 | {5D63EFBE-1839-4708-9814-81170AF56313}.Debug|Mixed Platforms.Build.0 = Debug|Win32 63 | {5D63EFBE-1839-4708-9814-81170AF56313}.Debug|Win32.ActiveCfg = Debug|Win32 64 | {5D63EFBE-1839-4708-9814-81170AF56313}.Debug|Win32.Build.0 = Debug|Win32 65 | {5D63EFBE-1839-4708-9814-81170AF56313}.Debug|x64.ActiveCfg = Debug|x64 66 | {5D63EFBE-1839-4708-9814-81170AF56313}.Release|Mixed Platforms.ActiveCfg = Release|Win32 67 | {5D63EFBE-1839-4708-9814-81170AF56313}.Release|Mixed Platforms.Build.0 = Release|Win32 68 | {5D63EFBE-1839-4708-9814-81170AF56313}.Release|Win32.ActiveCfg = Release|Win32 69 | {5D63EFBE-1839-4708-9814-81170AF56313}.Release|Win32.Build.0 = Release|Win32 70 | {5D63EFBE-1839-4708-9814-81170AF56313}.Release|x64.ActiveCfg = Release|x64 71 | {5D63EFBE-1839-4708-9814-81170AF56313}.Release|x64.Build.0 = Release|x64 72 | EndGlobalSection 73 | GlobalSection(SolutionProperties) = preSolution 74 | HideSolutionNode = FALSE 75 | EndGlobalSection 76 | EndGlobal 77 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/include/MinHook.h: -------------------------------------------------------------------------------- 1 | /* 2 | * MinHook - Minimalistic API Hook Library 3 | * Copyright (C) 2009 Tsuda Kageyu. All rights reserved. 4 | * 5 | * Redistribution and use in source and binary forms, with or without 6 | * modification, are permitted provided that the following conditions 7 | * are met: 8 | * 9 | * 1. Redistributions of source code must retain the above copyright 10 | * notice, this list of conditions and the following disclaimer. 11 | * 2. Redistributions in binary form must reproduce the above copyright 12 | * notice, this list of conditions and the following disclaimer in the 13 | * documentation and/or other materials provided with the distribution. 14 | * 3. The name of the author may not be used to endorse or promote products 15 | * derived from this software without specific prior written permission. 16 | * 17 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 | */ 28 | 29 | #pragma once 30 | 31 | #include 32 | 33 | // MinHook Error Codes. 34 | typedef enum MH_STATUS 35 | { 36 | // Unknown error. Should not be returned. 37 | MH_UNKNOWN = -1, 38 | 39 | // Successful. 40 | MH_OK = 0, 41 | 42 | // MinHook is already initialized. 43 | MH_ERROR_ALREADY_INITIALIZED, 44 | 45 | // MinHook is not initialized yet, or already uninitialized. 46 | MH_ERROR_NOT_INITIALIZED, 47 | 48 | // The hook for the specified target function is already created. 49 | MH_ERROR_ALREADY_CREATED, 50 | 51 | // The hook for the specified target function is not created yet. 52 | MH_ERROR_NOT_CREATED, 53 | 54 | // The hook for the specified target function is already enabled. 55 | MH_ERROR_ENABLED, 56 | 57 | // The hook for the specified target function is not enabled yet, or already disabled. 58 | MH_ERROR_DISABLED, 59 | 60 | // The specified pointer is invalid. It points the address of non-allocated and/or non-executable region. 61 | MH_ERROR_NOT_EXECUTABLE, 62 | 63 | // The specified target function cannot be hooked. 64 | MH_ERROR_UNSUPPORTED_FUNCTION, 65 | 66 | // Failed to allocate memory. 67 | MH_ERROR_MEMORY_ALLOC, 68 | 69 | // Failed to change the memory protection. 70 | MH_ERROR_MEMORY_PROTECT 71 | } 72 | MH_STATUS; 73 | 74 | // Can be passed as a parameter to MH_EnableHook, MH_DisableHook, MH_QueueEnableHook or MH_QueueDisableHook. 75 | #define MH_ALL_HOOKS NULL 76 | 77 | #if defined __cplusplus 78 | extern "C" { 79 | #endif 80 | 81 | // Initialize the MinHook library. 82 | MH_STATUS WINAPI MH_Initialize(); 83 | 84 | // Uninitialize the MinHook library. 85 | MH_STATUS WINAPI MH_Uninitialize(); 86 | 87 | // Creates the Hook for the specified target function, in disabled state. 88 | // Parameters: 89 | // pTarget [in] A pointer to the target function, which will be overridden by the detour function. 90 | // pDetour [in] A pointer to the detour function, which will override the target function. 91 | // ppOriginal [out] A pointer to the trampoline function, which will be used to call the original target function. 92 | MH_STATUS WINAPI MH_CreateHook(void* pTarget, void* const pDetour, void** ppOriginal); 93 | 94 | // Removes the already created hook. 95 | // Parameters: 96 | // pTarget [in] A pointer to the target function. 97 | MH_STATUS WINAPI MH_RemoveHook(void* pTarget); 98 | 99 | // Enables the already created hook. 100 | // Parameters: 101 | // pTarget [in] A pointer to the target function. 102 | // If this parameter is MH_ALL_HOOKS, all created hooks are enabled in one go. 103 | MH_STATUS WINAPI MH_EnableHook(void* pTarget); 104 | 105 | // Disables the already created hook. 106 | // Parameters: 107 | // pTarget [in] A pointer to the target function. 108 | // If this parameter is MH_ALL_HOOKS, all created hooks are disabled in one go. 109 | MH_STATUS WINAPI MH_DisableHook(void* pTarget); 110 | 111 | // Queues to enable the already created hook. 112 | // Parameters: 113 | // pTarget [in] A pointer to the target function. 114 | // If this parameter is MH_ALL_HOOKS, all created hooks are queued to be enabled. 115 | MH_STATUS WINAPI MH_QueueEnableHook(void* pTarget); 116 | 117 | // Queues to disable the already created hook. 118 | // Parameters: 119 | // pTarget [in] A pointer to the target function. 120 | // If this parameter is MH_ALL_HOOKS, all created hooks are queued to be disabled. 121 | MH_STATUS WINAPI MH_QueueDisableHook(void* pTarget); 122 | 123 | // Applies all queued changes in one go. 124 | MH_STATUS WINAPI MH_ApplyQueued(); 125 | 126 | #if defined __cplusplus 127 | } 128 | #endif 129 | 130 | -------------------------------------------------------------------------------- /Observer/Observer/Observer_dyn.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | #include "dbghelp.h" 4 | #include 5 | #include 6 | #include 7 | 8 | const int backtraceSize = 100; 9 | 10 | class Trace { 11 | 12 | public: 13 | Trace(){ 14 | this->getTrace(); 15 | }; 16 | std::string trace_str; 17 | 18 | private: 19 | void getTrace(){ 20 | 21 | std::stringstream stream; 22 | unsigned long retLong; 23 | void *backtrace[backtraceSize]; 24 | unsigned short frames; 25 | char tmpBuf[24]; 26 | char lineNum[20]; 27 | 28 | frames = CaptureStackBackTrace(0, backtraceSize, backtrace, &retLong); 29 | 30 | HANDLE process = GetCurrentProcess(); 31 | 32 | const int MAXSYMBOLNAME = 128 - sizeof(IMAGEHLP_SYMBOL); 33 | char symbol64_buf[sizeof(IMAGEHLP_SYMBOL) + MAXSYMBOLNAME] = {0}; 34 | IMAGEHLP_SYMBOL *symbol = reinterpret_cast(symbol64_buf); 35 | symbol->SizeOfStruct = sizeof(IMAGEHLP_SYMBOL); 36 | symbol->MaxNameLength = MAXSYMBOLNAME - 1; 37 | 38 | // Print out stack trace. Skip the first frame (that's our hook function.) 39 | for(size_t i = 1; i < frames; ++i){ 40 | 41 | size_t curr_trace = (size_t)backtrace[i]; 42 | if( curr_trace ){ 43 | 44 | sprintf_s(tmpBuf, "%p", curr_trace); 45 | // Output stack frame symbols if available. 46 | if(SymGetSymFromAddr(process, (DWORD64)curr_trace, 0, symbol)){ 47 | 48 | stream << symbol->Name; 49 | 50 | // Output filename + line info if available. 51 | IMAGEHLP_LINE64 lineSymbol; 52 | lineSymbol.SizeOfStruct = sizeof(IMAGEHLP_LINE64); 53 | DWORD displacement; 54 | 55 | if(SymGetLineFromAddr64(process, (DWORD64)curr_trace, &displacement, &lineSymbol)){ 56 | stream << "\t" << lineSymbol.FileName; 57 | stream << ":"; 58 | 59 | //Add line number 60 | _ltoa_s(lineSymbol.LineNumber, lineNum, 10 ); 61 | stream << lineNum; 62 | 63 | } else { 64 | stream << "\t"; 65 | } 66 | 67 | //stream << "\t(" << std::setw(sizeof(void*)*2) << std::setfill('0') << curr_trace 68 | stream << "\t("; 69 | stream << tmpBuf; 70 | stream << ")\n"; 71 | 72 | } else { 73 | //stream << "\t" << "\t(" << std::setw(sizeof(void*)*2) << std::setfill('0') << curr_trace << ")\n"; 74 | stream << "\t\t("; 75 | stream << tmpBuf; 76 | stream << ")\n"; 77 | } 78 | 79 | } else{ 80 | break; 81 | } 82 | } 83 | 84 | //Set the stream 85 | trace_str.assign( stream.str() ); 86 | } 87 | }; 88 | 89 | //****************************************************************************** 90 | class MemoryMessage{ 91 | public: 92 | MemoryMessage(size_t *ptr, Trace *trace ){ 93 | this->ptr = ptr; 94 | this->trace = trace; 95 | }; 96 | char* getBytes( DWORD *retBytes ){ 97 | DWORD buf_size = 12; 98 | char *retPtr = NULL; 99 | 100 | //Check that an address 101 | if( trace ){ 102 | 103 | buf_size += trace->trace_str.length(); 104 | retPtr = (char *)malloc(buf_size); 105 | memset(retPtr, 0, buf_size ); 106 | 107 | //Add address and stack trace 108 | *(long *)retPtr = (size_t)ptr; 109 | *(int *)((char*)retPtr + 8) = trace->trace_str.length(); 110 | memcpy( (char*)retPtr + 12, trace->trace_str.c_str(), trace->trace_str.length() ); 111 | 112 | } 113 | 114 | *retBytes = buf_size; 115 | return retPtr; 116 | 117 | } 118 | byte msg_type; 119 | private: 120 | size_t *ptr; 121 | Trace *trace; 122 | }; 123 | 124 | class MallocMessage : public MemoryMessage{ 125 | public: 126 | MallocMessage(DWORD size, size_t *ptr, Trace *trace ) : MemoryMessage( ptr, trace) { 127 | this->size = size; 128 | msg_type = (byte)0x12; 129 | }; 130 | 131 | char* getBytes( DWORD *retBytes ){ 132 | DWORD ret_size = 0; 133 | DWORD child_size = 0; 134 | char *retPtr = NULL; 135 | char *basePtr = NULL; 136 | 137 | //Get data from the base class 138 | basePtr = this->MemoryMessage::getBytes( &child_size ); 139 | if( basePtr && child_size > 0 ){ 140 | 141 | ret_size = child_size + 5; 142 | retPtr = (char *)malloc( ret_size); 143 | memset(retPtr, 0, ret_size ); 144 | 145 | //Add type 146 | *(byte *)retPtr = (byte)msg_type; 147 | //Add size 148 | *((DWORD *)((char *)(retPtr + 1))) = size; 149 | //Add internal 150 | memcpy(retPtr + 5, basePtr, child_size ); 151 | //Free internal buffer 152 | free(basePtr); 153 | } 154 | 155 | *retBytes = ret_size; 156 | return retPtr; 157 | } 158 | private: 159 | DWORD size; 160 | }; 161 | 162 | class FreeMessage : public MemoryMessage{ 163 | public: 164 | FreeMessage( size_t *ptr, Trace *trace ) : MemoryMessage( ptr, trace) { 165 | msg_type = (byte)0x13; 166 | }; 167 | 168 | char* getBytes( DWORD *retBytes ){ 169 | DWORD ret_size = 0; 170 | DWORD child_size = 0; 171 | char *retPtr = NULL; 172 | char *basePtr = NULL; 173 | 174 | //Get data from the base class 175 | basePtr = this->MemoryMessage::getBytes( &child_size ); 176 | if( basePtr && child_size > 0 ){ 177 | 178 | ret_size = child_size + 1; 179 | retPtr = (char *)malloc( ret_size); 180 | memset(retPtr, 0, ret_size ); 181 | 182 | //Add type 183 | *(byte *)retPtr = (byte)msg_type; 184 | //Add internal 185 | memcpy(retPtr + 1, basePtr, child_size ); 186 | //Free internal buffer 187 | free(basePtr); 188 | 189 | } 190 | 191 | *retBytes = ret_size; 192 | return retPtr; 193 | 194 | } 195 | }; -------------------------------------------------------------------------------- /HeapMonitor/src/heapmonitor/MemoryChunk.java: -------------------------------------------------------------------------------- 1 | 2 | package heapmonitor; 3 | 4 | import java.awt.Color; 5 | import java.text.SimpleDateFormat; 6 | import java.util.ArrayList; 7 | import java.util.Collections; 8 | import java.util.List; 9 | import java.util.Stack; 10 | 11 | /** 12 | * 13 | * @author b0yd 14 | */ 15 | public class MemoryChunk { 16 | 17 | protected final long memoryAddress; 18 | protected final Stack allocationList = new Stack<>(); 19 | protected final Stack freeList = new Stack<>(); 20 | private Color memoryColor = Color.BLUE; 21 | 22 | private boolean allocated = false; 23 | 24 | //================================================================= 25 | /** 26 | * 27 | * @param passedAddress 28 | */ 29 | public MemoryChunk( long passedAddress ) { 30 | memoryAddress = passedAddress; 31 | } 32 | 33 | //================================================================= 34 | /** 35 | * 36 | * @param passedAllocation 37 | */ 38 | public void addAllocation( AllocationTrace passedAllocation ){ 39 | allocated = true; 40 | 41 | allocationList.push(passedAllocation); 42 | if( allocationList.size() > 20 ) 43 | allocationList.removeElementAt(0); 44 | 45 | } 46 | 47 | //================================================================= 48 | /** 49 | * 50 | * @return 51 | */ 52 | public int getAllocatedSize(){ 53 | 54 | int retSize = 0; 55 | if( allocated && !allocationList.isEmpty() ){ 56 | AllocationTrace aTrace = allocationList.peek(); 57 | retSize = aTrace.getSize(); 58 | } 59 | return retSize; 60 | } 61 | 62 | //================================================================= 63 | /** 64 | * 65 | * @param freeTrace 66 | */ 67 | public void addFree( Trace freeTrace ){ 68 | allocated = false; 69 | freeList.push(freeTrace); 70 | if( freeList.size() > 20 ) 71 | freeList.removeElementAt(0); 72 | } 73 | 74 | //================================================================== 75 | /** 76 | * 77 | * @return 78 | */ 79 | @Override 80 | public String toString(){ 81 | String retStr = String.format("0x%08X", memoryAddress ); 82 | if( allocated && !allocationList.isEmpty() ){ 83 | AllocationTrace aTrace = allocationList.peek(); 84 | retStr += ":" + String.format("0x%08X", aTrace.getSize() ); 85 | } 86 | return retStr; 87 | } 88 | 89 | //================================================================== 90 | /** 91 | * 92 | * @return 93 | */ 94 | public boolean isAllocated() { 95 | return allocated; 96 | } 97 | 98 | //================================================================== 99 | /** 100 | * 101 | * @return 102 | */ 103 | public long getAddress() { 104 | return memoryAddress; 105 | } 106 | 107 | //================================================================== 108 | /** 109 | * 110 | * @return 111 | */ 112 | public byte[] getLastTrace() { 113 | byte[] traceArr = null; 114 | if( allocated && !allocationList.isEmpty() ){ 115 | AllocationTrace aTrace = allocationList.peek(); 116 | traceArr = aTrace.traceByteArr; 117 | } else if( !freeList.isEmpty() ){ 118 | Trace aTrace = freeList.peek(); 119 | traceArr = aTrace.traceByteArr; 120 | } 121 | return traceArr; 122 | } 123 | 124 | //================================================================== 125 | /** 126 | * 127 | * @return 128 | */ 129 | public String getTraceHistory() { 130 | 131 | SimpleDateFormat format = new SimpleDateFormat("MM/dd/yyyy-hh:mm:ss:SSSZ "); 132 | 133 | String retStr = ""; 134 | List allTraces = new ArrayList<>(); 135 | 136 | //Add allocations 137 | allTraces.addAll(allocationList); 138 | 139 | //Add frees 140 | allTraces.addAll(freeList); 141 | 142 | //Sort 143 | Collections.sort( allTraces ); 144 | 145 | for( Trace aTrace : allTraces ){ 146 | 147 | retStr += " " + format.format( aTrace.dateReceived ); 148 | 149 | //Add size 150 | if( aTrace instanceof AllocationTrace ){ 151 | AllocationTrace allocTrace = (AllocationTrace)aTrace; 152 | retStr += "\nMALLOC Size: " + allocTrace.getSize(); 153 | } else { 154 | retStr += "\nFREE"; 155 | } 156 | 157 | retStr += "\n"; 158 | retStr += Trace.processStackTrace( aTrace.traceByteArr ); 159 | retStr += "\n"; 160 | 161 | } 162 | 163 | return retStr; 164 | 165 | } 166 | 167 | //======================================================================== 168 | /** 169 | * 170 | * @param passedColor 171 | */ 172 | public void setColor( Color passedColor ){ 173 | memoryColor = passedColor; 174 | } 175 | 176 | //========================================================================= 177 | /** 178 | * 179 | * @return 180 | */ 181 | public Color getColor() { 182 | return memoryColor; 183 | } 184 | } 185 | -------------------------------------------------------------------------------- /HeapMonitor/src/heapmonitor/MemoryMapLabel.java: -------------------------------------------------------------------------------- 1 | package heapmonitor; 2 | 3 | import java.awt.Color; 4 | import java.awt.Cursor; 5 | import java.awt.Graphics; 6 | import java.awt.event.MouseAdapter; 7 | import java.awt.event.MouseEvent; 8 | import java.awt.event.MouseMotionListener; 9 | import java.awt.image.BufferedImage; 10 | import java.util.Map.Entry; 11 | import java.util.TreeMap; 12 | import javax.swing.BorderFactory; 13 | import javax.swing.JLabel; 14 | import javax.swing.SwingUtilities; 15 | 16 | /** 17 | * 18 | * @author b0yd 19 | */ 20 | public class MemoryMapLabel extends JLabel { 21 | 22 | public static final int MEMORY_MAP_LABEL_WIDTH = 755; 23 | public static final int MEMORY_MAP_LABEL_HEIGHT = 24; 24 | 25 | private final MemoryJPanel parentPanel; 26 | private BufferedImage memoryMapImage; 27 | private final Object lockObj = new Object(); 28 | 29 | private volatile long curr_start_address = 0; 30 | private volatile long curr_end_address = 0; 31 | 32 | //====================================================================== 33 | /** 34 | * 35 | */ 36 | public MemoryMapLabel( MemoryJPanel passedParent ) { 37 | initialize(); 38 | memoryMapImage = new BufferedImage( MEMORY_MAP_LABEL_WIDTH, MEMORY_MAP_LABEL_HEIGHT, BufferedImage.TYPE_INT_ARGB); 39 | parentPanel = passedParent; 40 | } 41 | 42 | //======================================================================= 43 | /** 44 | * 45 | * @param g 46 | */ 47 | @Override 48 | public void paintComponent( Graphics g ){ 49 | //super.paintComponent(g); 50 | synchronized(lockObj ){ 51 | g.drawImage(memoryMapImage, 0, 0, null); 52 | } 53 | } 54 | 55 | //======================================================================= 56 | /** 57 | * 58 | * @param passedMemMap 59 | */ 60 | public void updateMemoryMap( TreeMap passedMemMap ){ 61 | synchronized(lockObj ){ 62 | 63 | curr_start_address = passedMemMap.firstKey(); 64 | curr_end_address = passedMemMap.lastKey(); 65 | 66 | long range = curr_end_address - curr_start_address; 67 | if( range != 0 ){ 68 | 69 | double pixel_per_byte = (double)MEMORY_MAP_LABEL_WIDTH/(double)range; 70 | 71 | //Get the graphics 72 | Graphics g = memoryMapImage.getGraphics(); 73 | //Paint background first 74 | g.setColor(Color.WHITE); 75 | g.fillRect(0, 0, MEMORY_MAP_LABEL_WIDTH, MEMORY_MAP_LABEL_HEIGHT); 76 | 77 | //Set color for the rest 78 | g.setColor(Color.BLUE); 79 | 80 | for ( Entry anEntry : passedMemMap.entrySet() ) { 81 | long chunk_address = anEntry.getKey(); 82 | MemoryChunk aChunk = anEntry.getValue(); 83 | if( aChunk.isAllocated() ){ 84 | int start_location = (int)(Math.floor( ((double)chunk_address - (double)curr_start_address) * pixel_per_byte)); 85 | int size = (int) ((double)aChunk.getAllocatedSize() * pixel_per_byte); 86 | if( size == 0) 87 | size = 1; 88 | 89 | g.fillRect(start_location, 0, size, MEMORY_MAP_LABEL_HEIGHT); 90 | } 91 | } 92 | } 93 | } 94 | 95 | //Repaint if the adddress space is open 96 | SwingUtilities.invokeLater( new Runnable(){ 97 | @Override 98 | public void run() { 99 | repaint(); 100 | } 101 | }); 102 | } 103 | 104 | //======================================================================= 105 | /** 106 | * 107 | */ 108 | private void initialize() { 109 | 110 | //Set border 111 | setBorder( BorderFactory.createLineBorder(Color.black) ); 112 | 113 | //Add mouse listener for click 114 | addMouseListener( new MouseAdapter(){ 115 | 116 | @Override 117 | public void mouseClicked(MouseEvent evt) { 118 | 119 | if (evt.getClickCount() == 1) { 120 | 121 | int x = evt.getX(); 122 | int y = evt.getY(); 123 | 124 | long range = curr_end_address - curr_start_address; 125 | if( range != 0 ){ 126 | double pixel_per_byte = (double)MEMORY_MAP_LABEL_WIDTH/(double)range; 127 | long clicked_address = (long) ( curr_start_address + ( (double)x / pixel_per_byte)); 128 | 129 | long baseaddr = (clicked_address >> 16) << 16; 130 | parentPanel.loadMemoryPage(baseaddr, true); 131 | } 132 | 133 | } 134 | } 135 | 136 | }); 137 | 138 | //Change mouse cursor 139 | addMouseMotionListener( new MouseMotionListener(){ 140 | 141 | @Override 142 | public void mouseDragged(MouseEvent e) { 143 | } 144 | 145 | //Change the cursor 146 | @Override 147 | public void mouseMoved(MouseEvent e) { 148 | setCursor(new Cursor(Cursor.HAND_CURSOR)); 149 | } 150 | 151 | }); 152 | } 153 | 154 | //======================================================================== 155 | /** 156 | * 157 | */ 158 | public void clear() { 159 | memoryMapImage = new BufferedImage( MEMORY_MAP_LABEL_WIDTH, MEMORY_MAP_LABEL_HEIGHT, BufferedImage.TYPE_INT_ARGB); 160 | } 161 | 162 | } 163 | -------------------------------------------------------------------------------- /HeapMonitor/src/heapmonitor/SocketHandler.java: -------------------------------------------------------------------------------- 1 | package heapmonitor; 2 | 3 | import java.io.DataInputStream; 4 | import java.io.IOException; 5 | import java.net.Socket; 6 | import java.net.SocketException; 7 | import java.net.SocketTimeoutException; 8 | import java.nio.ByteBuffer; 9 | import java.nio.ByteOrder; 10 | import java.util.logging.Level; 11 | import java.util.logging.Logger; 12 | 13 | /** 14 | * 15 | * @author b0yd 16 | */ 17 | public class SocketHandler implements Runnable { 18 | 19 | private final Socket theClientSocket; 20 | private final MainFrame theParentFrame; 21 | 22 | public static final byte ALLOCATE = 0x12; 23 | public static final byte FREE = 0x13; 24 | public static final byte SOCKET_CLOSED = -1; 25 | 26 | //================================================================= 27 | /** 28 | * 29 | * @param parentFrame 30 | * @param clientSocket 31 | */ 32 | public SocketHandler(MainFrame parentFrame, Socket clientSocket) { 33 | theParentFrame = parentFrame; 34 | theClientSocket = clientSocket; 35 | } 36 | 37 | //================================================================= 38 | /** 39 | * Main receive loop 40 | * 41 | * Protocol format 42 | * 43 | * Allocation 44 | * [ 1 byte - message type ][ 4 byte - allocation size ][ 8 bytes - address ] 45 | * [ 4 bytes - trace size ][ (trace_size bytes) trace string array ] 46 | * 47 | * Free 48 | * [ 1 byte - message type ][ 8 bytes - address ] 49 | * [ 4 bytes - trace size ][ (trace_size bytes) trace string array ] 50 | * 51 | * 52 | * 53 | */ 54 | @Override 55 | public void run() { 56 | 57 | try { 58 | 59 | boolean socketClosed = false; 60 | //Create the handler and start it 61 | MemoryTupleHandler aHandler = new MemoryTupleHandler(theParentFrame); 62 | aHandler.start(); 63 | 64 | theClientSocket.setSoTimeout(1000); 65 | DataInputStream dataStream = new DataInputStream( theClientSocket.getInputStream() ); 66 | byte[] sizeArr = new byte[4]; 67 | byte[] addrArr = new byte[8]; 68 | byte[] traceLen = new byte[4]; 69 | 70 | while( !socketClosed ){ 71 | 72 | Trace aTrace = null; 73 | try{ 74 | 75 | //Get message type 76 | byte messageType = (byte)dataStream.read(); 77 | long address = 0; 78 | switch( messageType){ 79 | case ALLOCATE: 80 | 81 | //Get allocation size 82 | dataStream.readFully(sizeArr); 83 | int size = ByteBuffer.wrap(sizeArr).order(ByteOrder.LITTLE_ENDIAN).getInt(); 84 | 85 | //Get address 86 | dataStream.readFully(addrArr); 87 | address = ByteBuffer.wrap(addrArr).order(ByteOrder.LITTLE_ENDIAN).getLong(); 88 | 89 | //Get trace len 90 | dataStream.readFully(traceLen); 91 | int trace_len = ByteBuffer.wrap(traceLen).order(ByteOrder.LITTLE_ENDIAN).getInt(); 92 | 93 | //Get trace data 94 | byte[] traceByteArr = new byte[trace_len]; 95 | dataStream.readFully(traceByteArr); 96 | 97 | //Create tuple 98 | aTrace = new AllocationTrace( traceByteArr, size); 99 | break; 100 | 101 | case FREE: 102 | //Get address 103 | dataStream.readFully(addrArr); 104 | address = ByteBuffer.wrap(addrArr).order(ByteOrder.LITTLE_ENDIAN).getLong(); 105 | 106 | //Get trace len 107 | dataStream.readFully(traceLen); 108 | trace_len = ByteBuffer.wrap(traceLen).order(ByteOrder.LITTLE_ENDIAN).getInt(); 109 | 110 | //Get trace data 111 | traceByteArr = new byte[trace_len]; 112 | dataStream.readFully(traceByteArr); 113 | 114 | //Create tuple 115 | aTrace = new Trace( traceByteArr ); 116 | 117 | break; 118 | case SOCKET_CLOSED: 119 | socketClosed = true; 120 | break; 121 | default: 122 | System.err.println("Unknown message type detected."); 123 | break; 124 | } 125 | 126 | //Add to queue to be processed 127 | if( address != 0 && aTrace != null ) 128 | aHandler.processIncoming(address, aTrace); 129 | 130 | 131 | } catch(SocketTimeoutException ex){ 132 | } 133 | } 134 | } catch (SocketException ex) { 135 | if( !ex.getMessage().contains("Connection reset")) 136 | Logger.getLogger(SocketHandler.class.getName()).log(Level.SEVERE, null, ex); 137 | } catch (IOException ex) { 138 | Logger.getLogger(SocketHandler.class.getName()).log(Level.SEVERE, null, ex); 139 | } 140 | 141 | //Set socket handler to null 142 | theParentFrame.setSocketHandler(null); 143 | 144 | } 145 | 146 | //========================================================================== 147 | /** 148 | * 149 | */ 150 | public void disconnect() { 151 | try { 152 | theClientSocket.close(); 153 | } catch (IOException ex) { 154 | } 155 | } 156 | 157 | } 158 | -------------------------------------------------------------------------------- /Observer/Observer/Observer.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "dbghelp.h" 4 | #include 5 | 6 | const int backtraceSize = 64; 7 | 8 | class Trace { 9 | 10 | public: 11 | Trace(HANDLE passedHeapHandle){ 12 | heapHandle = passedHeapHandle; 13 | trace_str_buf_size = 0; 14 | this->walkStack(); 15 | }; 16 | 17 | ~Trace(){ 18 | if( trace_str_buf != NULL && heapHandle != NULL ) 19 | HeapFree(heapHandle, 0 , trace_str_buf); 20 | 21 | }; 22 | char *trace_str_buf; 23 | DWORD trace_str_buf_size; 24 | HANDLE heapHandle; 25 | 26 | private: 27 | 28 | void appendToTrace( char *str, size_t size ){ 29 | 30 | if( heapHandle != NULL){ 31 | if( trace_str_buf_size == 0 ){ 32 | 33 | //Create a buffer and copy into it 34 | trace_str_buf_size = 0x100000; 35 | trace_str_buf = (char *)HeapAlloc(heapHandle, HEAP_ZERO_MEMORY, trace_str_buf_size); 36 | strncpy_s(trace_str_buf, trace_str_buf_size, str, size ); 37 | 38 | } else if( strlen(trace_str_buf) + size > trace_str_buf_size) { 39 | 40 | //Add more space 41 | trace_str_buf_size += 0x100000; 42 | trace_str_buf = (char *)HeapReAlloc(heapHandle, HEAP_ZERO_MEMORY, trace_str_buf, trace_str_buf_size); 43 | if( trace_str_buf == NULL) 44 | return; 45 | //Concatenate the string 46 | strncat_s(trace_str_buf, trace_str_buf_size, str, size); 47 | 48 | } else { 49 | 50 | //Concatenate the string 51 | strncat_s(trace_str_buf, trace_str_buf_size, str, size); 52 | } 53 | } 54 | 55 | } 56 | 57 | void walkStack(){ 58 | 59 | CONTEXT Context = {0}; 60 | STACKFRAME64 stk; 61 | memset(&stk, 0, sizeof(stk)); 62 | 63 | HANDLE hThread = GetCurrentThread(); 64 | HANDLE currProc = GetCurrentProcess(); 65 | 66 | const int MAXSYMBOLNAME = 128 - sizeof(IMAGEHLP_SYMBOL); 67 | char symbol64_buf[sizeof(IMAGEHLP_SYMBOL) + MAXSYMBOLNAME] = {0}; 68 | IMAGEHLP_SYMBOL *symbol = reinterpret_cast(symbol64_buf); 69 | symbol->SizeOfStruct = sizeof(IMAGEHLP_SYMBOL); 70 | symbol->MaxNameLength = MAXSYMBOLNAME - 1; 71 | 72 | DWORD IMG_ARCH = IMAGE_FILE_MACHINE_I386; 73 | RtlCaptureContext( &Context ); 74 | #ifdef _WIN64 75 | IMG_ARCH = IMAGE_FILE_MACHINE_AMD64; 76 | stk.AddrPC.Offset = Context.Rip; 77 | stk.AddrPC.Mode = AddrModeFlat; 78 | stk.AddrStack.Offset = Context.Rsp; 79 | stk.AddrStack.Mode = AddrModeFlat; 80 | stk.AddrFrame.Offset = Context.Rbp; 81 | stk.AddrFrame.Mode = AddrModeFlat; 82 | #elif _WIN32 83 | stk.AddrPC.Offset = Context.Eip; 84 | stk.AddrPC.Mode = AddrModeFlat; 85 | stk.AddrStack.Offset = Context.Esp; 86 | stk.AddrStack.Mode = AddrModeFlat; 87 | stk.AddrFrame.Offset = Context.Ebp; 88 | stk.AddrFrame.Mode = AddrModeFlat; 89 | #endif 90 | 91 | char tmpBuf[24]; 92 | char lineNum[20]; 93 | DWORD str_len = 0; 94 | for(ULONG Frame = 0; ; Frame++) 95 | { 96 | BOOL result = StackWalk64( 97 | IMG_ARCH, // __in DWORD MachineType, 98 | currProc, // __in HANDLE hProcess, 99 | hThread, // __in HANDLE hThread, 100 | &stk, // __inout LP STACKFRAME64 StackFrame, 101 | &Context, // __inout PVOID ContextRecord, 102 | NULL, // __in_opt PREAD_PROCESS_MEMORY_ROUTINE64 ReadMemoryRoutine, 103 | SymFunctionTableAccess64, // __in_opt PFUNCTION_TABLE_ACCESS_ROUTINE64 FunctionTableAccessRoutine, 104 | SymGetModuleBase64, // __in_opt PGET_MODULE_BASE_ROUTINE64 GetModuleBaseRoutine, 105 | NULL // __in_opt PTRANSLATE_ADDRESS_ROUTINE64 TranslateAddress 106 | ); 107 | 108 | size_t curr_trace = (ULONG64)stk.AddrPC.Offset; 109 | if( curr_trace ){ 110 | 111 | sprintf_s(tmpBuf, "%p", curr_trace); 112 | // Output stack frame symbols if available. 113 | if(SymGetSymFromAddr(currProc, (DWORD64)curr_trace, 0, symbol)){ 114 | 115 | appendToTrace(symbol->Name, strlen(symbol->Name)); 116 | 117 | // Output filename + line info if available. 118 | IMAGEHLP_LINE64 lineSymbol; 119 | lineSymbol.SizeOfStruct = sizeof(IMAGEHLP_LINE64); 120 | DWORD displacement; 121 | 122 | if(SymGetLineFromAddr64(currProc, (DWORD64)curr_trace, &displacement, &lineSymbol)){ 123 | 124 | appendToTrace( "\t", 1); 125 | appendToTrace( lineSymbol.FileName, strlen(lineSymbol.FileName)); 126 | appendToTrace( ":", 1); 127 | 128 | //Add line number 129 | _ltoa_s(lineSymbol.LineNumber, lineNum, 10 ); 130 | appendToTrace( lineNum, strlen(lineNum)); 131 | 132 | } else { 133 | appendToTrace( "\t", 1); 134 | } 135 | 136 | appendToTrace( "\t", 1); 137 | 138 | appendToTrace( tmpBuf, strlen(tmpBuf)); 139 | 140 | appendToTrace( ")\n", 2); 141 | 142 | } else { 143 | 144 | appendToTrace("\t\t(", 14); 145 | 146 | appendToTrace(tmpBuf, strlen(tmpBuf)); 147 | 148 | appendToTrace( ")\n", 2); 149 | } 150 | 151 | } 152 | 153 | if(!result) 154 | break; 155 | } 156 | 157 | 158 | } 159 | 160 | }; 161 | 162 | //****************************************************************************** 163 | class MemoryMessage{ 164 | public: 165 | MemoryMessage(size_t *ptr, Trace *trace ){ 166 | this->ptr = ptr; 167 | this->trace = trace; 168 | }; 169 | 170 | size_t getBytes(char* buf, size_t max_size){ 171 | size_t ret_size = 0; 172 | size_t buf_size = 12; 173 | 174 | //Check that an address 175 | if( trace ){ 176 | 177 | DWORD trace_len = (DWORD)strlen(trace->trace_str_buf); 178 | buf_size += trace_len; 179 | if( buf && buf_size <= max_size ){ 180 | ret_size = buf_size; 181 | memset(buf, 0, ret_size ); 182 | 183 | //Add address and stack trace 184 | *(long *)buf = (long)ptr; 185 | *(DWORD *)((char*)buf + 8) = (DWORD)trace_len; 186 | memcpy( (char*)buf + 12, trace->trace_str_buf, trace_len ); 187 | } else { 188 | printf("MemoryMessage: Unable to create MemoryMessage, buffer is too small.\nProvided: %d, Needed: %d\n", max_size, buf_size ); 189 | } 190 | } 191 | return ret_size; 192 | 193 | } 194 | byte msg_type; 195 | private: 196 | size_t *ptr; 197 | Trace *trace; 198 | }; 199 | 200 | class MallocMessage : public MemoryMessage{ 201 | public: 202 | MallocMessage(DWORD size, size_t *ptr, Trace *trace ) : MemoryMessage( ptr, trace) { 203 | this->size = size; 204 | msg_type = (byte)0x12; 205 | }; 206 | 207 | size_t getBytes(char* buf, DWORD max_size){ 208 | size_t ret_size = 0; 209 | size_t buf_size = 0; 210 | 211 | //Get data from the base class 212 | buf_size = this->MemoryMessage::getBytes(buf + 5, max_size - 5); 213 | if( buf_size > 0 ){ 214 | 215 | buf_size += 5; 216 | if( buf && buf_size <= max_size ){ 217 | 218 | ret_size = buf_size; 219 | //Add type 220 | *(byte *)buf = (byte)msg_type; 221 | //Add size 222 | *((DWORD *)((char *)(buf + 1))) = size; 223 | 224 | } else { 225 | printf("MallocMessage: Unable to create MallocMessage, buffer is too small.\nProvided:%d, Needed:%d\n", max_size, buf_size ); 226 | } 227 | } 228 | 229 | return ret_size; 230 | } 231 | private: 232 | DWORD size; 233 | }; 234 | 235 | class FreeMessage : public MemoryMessage{ 236 | public: 237 | FreeMessage( size_t *ptr, Trace *trace ) : MemoryMessage( ptr, trace) { 238 | msg_type = (byte)0x13; 239 | }; 240 | 241 | size_t getBytes(char* buf, DWORD max_size){ 242 | size_t ret_size = 0; 243 | size_t buf_size = 0; 244 | 245 | //Get data from the base class 246 | buf_size = this->MemoryMessage::getBytes(buf + 1, max_size - 1); 247 | 248 | if( buf && buf_size > 0 ){ 249 | 250 | buf_size += 1; 251 | if( buf && buf_size <= max_size ){ 252 | ret_size = buf_size; 253 | 254 | //Add type 255 | *(byte *)buf = (byte)msg_type; 256 | 257 | } else { 258 | printf("FreeMessage: Unable to create FreeMessage, buffer is too small.\nProvided:%d, Needed:%d\n", max_size, buf_size ); 259 | } 260 | } 261 | 262 | return ret_size; 263 | 264 | } 265 | }; -------------------------------------------------------------------------------- /HeapMonitor/src/heapmonitor/FreeJPanel.java: -------------------------------------------------------------------------------- 1 | package heapmonitor; 2 | 3 | import static heapmonitor.MainFrame.COLORIZE_ALLOC; 4 | import java.awt.Color; 5 | import java.awt.Component; 6 | import java.awt.Font; 7 | import java.awt.event.MouseAdapter; 8 | import java.awt.event.MouseEvent; 9 | import javax.swing.DefaultListCellRenderer; 10 | import javax.swing.DefaultListModel; 11 | import javax.swing.JList; 12 | import javax.swing.JMenuItem; 13 | import javax.swing.JPopupMenu; 14 | import javax.swing.event.ListSelectionEvent; 15 | import javax.swing.event.ListSelectionListener; 16 | 17 | /** 18 | * 19 | * @author b0yd 20 | */ 21 | public class FreeJPanel extends javax.swing.JPanel { 22 | 23 | private final MainFrame parentFrame; 24 | private boolean autoScroll = false; 25 | 26 | /** 27 | * Creates new form AllocationJPanel 28 | * @param parent 29 | */ 30 | public FreeJPanel( MainFrame parent ) { 31 | initComponents(); 32 | initializeComponents(); 33 | parentFrame = parent; 34 | } 35 | 36 | //======================================================================= 37 | /** 38 | * 39 | */ 40 | private void initializeComponents() { 41 | 42 | DefaultListModel listModel = new DefaultListModel(); 43 | freeJList.setModel(listModel); 44 | freeJList.setFont( new Font(Font.MONOSPACED, Font.PLAIN, 12 )); 45 | freeJList.addListSelectionListener( new ListSelectionListener() { 46 | 47 | @Override 48 | public void valueChanged(ListSelectionEvent e) { 49 | if( !e.getValueIsAdjusting()){ 50 | loadMemoryAddr(); 51 | } 52 | } 53 | }); 54 | 55 | freeJList.addMouseListener( new MouseAdapter(){ 56 | @Override 57 | public void mouseReleased(MouseEvent e){ 58 | if(e.isPopupTrigger()){ 59 | doTreePopupMenuLogic(e); 60 | } 61 | } 62 | }); 63 | 64 | freeJList.setCellRenderer( new DefaultListCellRenderer(){ 65 | @Override 66 | public Component getListCellRendererComponent( JList list, Object value, int index, boolean isSelected, boolean cellHasFocus ) { 67 | Component c = super.getListCellRendererComponent( list, value, index, isSelected, cellHasFocus ); 68 | if( value instanceof MemoryChunk ){ 69 | MemoryChunk mem = (MemoryChunk)value; 70 | Color val_c = mem.getColor(); 71 | if( val_c != Color.BLUE ) { 72 | c.setBackground( val_c ); //yellow every even row 73 | } 74 | } 75 | return c; 76 | } 77 | }); 78 | } 79 | 80 | 81 | //======================================================================= 82 | /** 83 | * Determines what menu options to show on the popup menu based on the 84 | * {@link XmlObject} object contained in the currently selected node. 85 | * 86 | * @param e the {@code MouseEvent} that triggered the popup 87 | */ 88 | public void doTreePopupMenuLogic( MouseEvent e ) { 89 | 90 | JPopupMenu popup = new JPopupMenu(); 91 | JMenuItem menuItem; 92 | 93 | menuItem = new JMenuItem( "Colorize"); 94 | menuItem.setActionCommand( MainFrame.COLORIZE_FREE ); 95 | menuItem.addActionListener(parentFrame); 96 | menuItem.setEnabled( true ); 97 | popup.add(menuItem); 98 | 99 | if( popup.getComponentCount() > 0 ) 100 | popup.show(e.getComponent(), e.getX(), e.getY()); 101 | 102 | } 103 | 104 | //======================================================================= 105 | /** 106 | * 107 | * @return 108 | */ 109 | public MemoryChunk getSelected() { 110 | return (MemoryChunk)freeJList.getSelectedValue(); 111 | } 112 | 113 | private void loadMemoryAddr(){ 114 | MemoryChunk aChunk = (MemoryChunk)freeJList.getSelectedValue(); 115 | if( aChunk != null ){ 116 | parentFrame.getTracePanel().setStackTraceTextArea( aChunk.getTraceHistory() ); 117 | parentFrame.getMemoryPanel().loadMemoryPage( aChunk.getAddress(), false ); 118 | } 119 | } 120 | 121 | /** 122 | * This method is called from within the constructor to initialize the form. 123 | * WARNING: Do NOT modify this code. The content of this method is always 124 | * regenerated by the Form Editor. 125 | */ 126 | @SuppressWarnings("unchecked") 127 | // //GEN-BEGIN:initComponents 128 | private void initComponents() { 129 | 130 | allocationScrollPane = new javax.swing.JScrollPane(); 131 | 132 | allocationScrollPane.setBorder(null); 133 | allocationScrollPane.setPreferredSize(new java.awt.Dimension(45, 165)); 134 | 135 | allocationScrollPane.setViewportView(freeJList); 136 | 137 | javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this); 138 | this.setLayout(layout); 139 | layout.setHorizontalGroup( 140 | layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) 141 | .addGap(0, 185, Short.MAX_VALUE) 142 | .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) 143 | .addGroup(layout.createSequentialGroup() 144 | .addComponent(allocationScrollPane, javax.swing.GroupLayout.PREFERRED_SIZE, 185, javax.swing.GroupLayout.PREFERRED_SIZE) 145 | .addGap(0, 0, Short.MAX_VALUE))) 146 | ); 147 | layout.setVerticalGroup( 148 | layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) 149 | .addGap(0, 353, Short.MAX_VALUE) 150 | .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) 151 | .addComponent(allocationScrollPane, javax.swing.GroupLayout.DEFAULT_SIZE, 353, Short.MAX_VALUE)) 152 | ); 153 | }// //GEN-END:initComponents 154 | 155 | 156 | // Variables declaration - do not modify//GEN-BEGIN:variables 157 | private javax.swing.JScrollPane allocationScrollPane; 158 | private final javax.swing.JList freeJList = new javax.swing.JList(); 159 | // End of variables declaration//GEN-END:variables 160 | 161 | //======================================================================= 162 | /** 163 | * 164 | * @param aChunk 165 | */ 166 | public void addFree(MemoryChunk aChunk) { 167 | DefaultListModel listModel = (DefaultListModel) freeJList.getModel(); 168 | listModel.removeElement( aChunk ); 169 | listModel.addElement( aChunk ); 170 | 171 | //If autoscroll 172 | if( autoScroll ){ 173 | int lastIndex = listModel.getSize() - 1; 174 | if (lastIndex >= 0) { 175 | freeJList.ensureIndexIsVisible(lastIndex); 176 | } 177 | } 178 | } 179 | 180 | //======================================================================= 181 | /** 182 | * 183 | * @param aChunk 184 | */ 185 | public void removeMemoryChunk(MemoryChunk aChunk) { 186 | DefaultListModel listModel = (DefaultListModel) freeJList.getModel(); 187 | listModel.removeElement( aChunk ); 188 | } 189 | 190 | //======================================================================= 191 | /** 192 | * 193 | */ 194 | public void clearPanel() { 195 | DefaultListModel listModel = (DefaultListModel)freeJList.getModel(); 196 | listModel.clear(); 197 | } 198 | 199 | //========================================================================= 200 | /** 201 | * 202 | * @param selected 203 | */ 204 | public void setAutoscrollFlag(boolean selected) { 205 | autoScroll = selected; 206 | } 207 | 208 | //========================================================================= 209 | /** 210 | * 211 | * @param object 212 | */ 213 | public void setSelected(Object object) { 214 | if( object == null) 215 | freeJList.clearSelection(); 216 | else 217 | freeJList.setSelectedValue(object, true); 218 | } 219 | } 220 | -------------------------------------------------------------------------------- /HeapMonitor/src/heapmonitor/AllocationJPanel.java: -------------------------------------------------------------------------------- 1 | 2 | package heapmonitor; 3 | 4 | import java.awt.Color; 5 | import java.awt.Component; 6 | import java.awt.Font; 7 | import java.awt.event.MouseAdapter; 8 | import java.awt.event.MouseEvent; 9 | import javax.swing.DefaultListCellRenderer; 10 | import javax.swing.DefaultListModel; 11 | import javax.swing.JList; 12 | import javax.swing.JMenuItem; 13 | import javax.swing.JPopupMenu; 14 | import javax.swing.event.ListSelectionEvent; 15 | import javax.swing.event.ListSelectionListener; 16 | 17 | /** 18 | * 19 | * @author b0yd 20 | */ 21 | public class AllocationJPanel extends javax.swing.JPanel { 22 | 23 | private final MainFrame parentFrame; 24 | private boolean autoScroll = false; 25 | 26 | /** 27 | * Creates new form AllocationJPanel 28 | * @param parent 29 | */ 30 | public AllocationJPanel( MainFrame parent ) { 31 | initComponents(); 32 | initializeComponents(); 33 | parentFrame = parent; 34 | } 35 | 36 | //======================================================================= 37 | /** 38 | * 39 | */ 40 | private void initializeComponents() { 41 | 42 | DefaultListModel listModel = new DefaultListModel(); 43 | allocationJList.setModel(listModel); 44 | allocationJList.setFont( new Font(Font.MONOSPACED, Font.PLAIN, 12 )); 45 | allocationJList.addListSelectionListener( new ListSelectionListener() { 46 | 47 | @Override 48 | public void valueChanged(ListSelectionEvent e) { 49 | if( !e.getValueIsAdjusting()) 50 | loadMemoryAddr(); 51 | } 52 | }); 53 | 54 | allocationJList.addMouseListener( new MouseAdapter(){ 55 | @Override 56 | public void mouseReleased(MouseEvent e){ 57 | if(e.isPopupTrigger()){ 58 | doTreePopupMenuLogic(e); 59 | } 60 | } 61 | }); 62 | 63 | allocationJList.setCellRenderer( new DefaultListCellRenderer(){ 64 | @Override 65 | public Component getListCellRendererComponent( JList list, Object value, int index, boolean isSelected, boolean cellHasFocus ) { 66 | Component c = super.getListCellRendererComponent( list, value, index, isSelected, cellHasFocus ); 67 | if( value instanceof MemoryChunk ){ 68 | MemoryChunk mem = (MemoryChunk)value; 69 | Color val_c = mem.getColor(); 70 | if( val_c != Color.BLUE ) { 71 | c.setBackground( val_c ); //yellow every even row 72 | } 73 | } 74 | return c; 75 | } 76 | }); 77 | 78 | 79 | } 80 | 81 | //======================================================================= 82 | /** 83 | * Determines what menu options to show on the popup menu based on the 84 | * {@link XmlObject} object contained in the currently selected node. 85 | * 86 | * @param e the {@code MouseEvent} that triggered the popup 87 | */ 88 | public void doTreePopupMenuLogic( MouseEvent e ) { 89 | 90 | JPopupMenu popup = new JPopupMenu(); 91 | JMenuItem menuItem; 92 | 93 | menuItem = new JMenuItem( "Colorize" ); 94 | menuItem.setActionCommand( MainFrame.COLORIZE_ALLOC ); 95 | menuItem.addActionListener(parentFrame); 96 | menuItem.setEnabled( true ); 97 | popup.add(menuItem); 98 | 99 | if( popup.getComponentCount() > 0 ) 100 | popup.show(e.getComponent(), e.getX(), e.getY()); 101 | 102 | } 103 | 104 | private void loadMemoryAddr(){ 105 | MemoryChunk aChunk = (MemoryChunk)allocationJList.getSelectedValue(); 106 | if( aChunk != null ){ 107 | parentFrame.getTracePanel().setStackTraceTextArea( aChunk.getTraceHistory() ); 108 | parentFrame.getMemoryPanel().loadMemoryPage( aChunk.getAddress(), false ); 109 | } 110 | } 111 | /** 112 | * This method is called from within the constructor to initialize the form. 113 | * WARNING: Do NOT modify this code. The content of this method is always 114 | * regenerated by the Form Editor. 115 | */ 116 | @SuppressWarnings("unchecked") 117 | // //GEN-BEGIN:initComponents 118 | private void initComponents() { 119 | 120 | allocationScrollPane = new javax.swing.JScrollPane(); 121 | 122 | allocationScrollPane.setBorder(null); 123 | allocationScrollPane.setPreferredSize(new java.awt.Dimension(45, 165)); 124 | 125 | allocationScrollPane.setViewportView(allocationJList); 126 | 127 | javax.swing.GroupLayout layout = new javax.swing.GroupLayout(this); 128 | this.setLayout(layout); 129 | layout.setHorizontalGroup( 130 | layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) 131 | .addGap(0, 185, Short.MAX_VALUE) 132 | .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) 133 | .addGroup(layout.createSequentialGroup() 134 | .addComponent(allocationScrollPane, javax.swing.GroupLayout.PREFERRED_SIZE, 185, javax.swing.GroupLayout.PREFERRED_SIZE) 135 | .addGap(0, 0, Short.MAX_VALUE))) 136 | ); 137 | layout.setVerticalGroup( 138 | layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) 139 | .addGap(0, 353, Short.MAX_VALUE) 140 | .addGroup(layout.createParallelGroup(javax.swing.GroupLayout.Alignment.LEADING) 141 | .addComponent(allocationScrollPane, javax.swing.GroupLayout.DEFAULT_SIZE, 353, Short.MAX_VALUE)) 142 | ); 143 | }// //GEN-END:initComponents 144 | 145 | 146 | // Variables declaration - do not modify//GEN-BEGIN:variables 147 | private final javax.swing.JList allocationJList = new javax.swing.JList(); 148 | private javax.swing.JScrollPane allocationScrollPane; 149 | // End of variables declaration//GEN-END:variables 150 | 151 | //======================================================================= 152 | /** 153 | * 154 | * @return 155 | */ 156 | public MemoryChunk getSelected() { 157 | return (MemoryChunk)allocationJList.getSelectedValue(); 158 | } 159 | 160 | 161 | //======================================================================= 162 | /** 163 | * 164 | * @param aChunk 165 | */ 166 | public void setSelected(MemoryChunk aChunk) { 167 | if( aChunk == null ) 168 | allocationJList.clearSelection(); 169 | else 170 | allocationJList.setSelectedValue(aChunk, true); 171 | } 172 | 173 | 174 | 175 | //======================================================================= 176 | /** 177 | * 178 | * @param aChunk 179 | */ 180 | public void addMemoryChunk(MemoryChunk aChunk) { 181 | DefaultListModel listModel = (DefaultListModel) allocationJList.getModel(); 182 | listModel.removeElement( aChunk ); 183 | listModel.addElement( aChunk ); 184 | 185 | //If autoscroll 186 | if( autoScroll ){ 187 | int lastIndex = listModel.getSize() - 1; 188 | if (lastIndex >= 0) { 189 | allocationJList.ensureIndexIsVisible(lastIndex); 190 | } 191 | } 192 | } 193 | 194 | //======================================================================= 195 | /** 196 | * 197 | */ 198 | public void clearPanel() { 199 | DefaultListModel listModel = (DefaultListModel)allocationJList.getModel(); 200 | listModel.clear(); 201 | } 202 | 203 | //========================================================================= 204 | /** 205 | * 206 | * @param aChunk 207 | */ 208 | public void removeMemoryChunk(MemoryChunk aChunk) { 209 | DefaultListModel listModel = (DefaultListModel) allocationJList.getModel(); 210 | listModel.removeElement( aChunk ); 211 | } 212 | 213 | //========================================================================= 214 | /** 215 | * 216 | * @param selected 217 | */ 218 | public void setAutoscrollFlag(boolean selected) { 219 | autoScroll = selected; 220 | } 221 | } 222 | -------------------------------------------------------------------------------- /Observer/DllInjector/DllInjector.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Debug 10 | x64 11 | 12 | 13 | Release 14 | Win32 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | {964F661B-8FA0-4DEF-836F-0D0720972D02} 23 | Win32Proj 24 | DllInjector 25 | DllInjector 26 | 27 | 28 | 29 | Application 30 | true 31 | v110 32 | MultiByte 33 | 34 | 35 | Application 36 | true 37 | v110 38 | MultiByte 39 | 40 | 41 | Application 42 | false 43 | v110 44 | true 45 | MultiByte 46 | Static 47 | 48 | 49 | Application 50 | false 51 | v110 52 | true 53 | MultiByte 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | true 73 | $(ProjectName)_Win32 74 | $(SolutionDir)dist\$(Platform)\$(Configuration)\ 75 | build\$(Platform)\$(Configuration)\ 76 | 77 | 78 | true 79 | $(ProjectName)_x64 80 | $(SolutionDir)dist\$(Platform)\$(Configuration)\ 81 | build\$(Platform)\$(Configuration)\ 82 | 83 | 84 | false 85 | $(ProjectName)_Win32 86 | $(SolutionDir)dist\$(Platform)\$(Configuration)\ 87 | build\$(Platform)\$(Configuration)\ 88 | 89 | 90 | false 91 | $(ProjectName)_x64 92 | $(SolutionDir)dist\$(Platform)\$(Configuration)\ 93 | build\$(Platform)\$(Configuration)\ 94 | 95 | 96 | 97 | 98 | 99 | Level3 100 | Disabled 101 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 102 | MultiThreadedDebug 103 | 104 | 105 | Console 106 | true 107 | 108 | 109 | 110 | 111 | 112 | 113 | Level3 114 | Disabled 115 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 116 | MultiThreadedDebug 117 | 118 | 119 | Console 120 | true 121 | 122 | 123 | 124 | 125 | Level3 126 | 127 | 128 | MaxSpeed 129 | true 130 | true 131 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 132 | MultiThreaded 133 | 134 | 135 | Console 136 | true 137 | true 138 | true 139 | 140 | 141 | 142 | 143 | Level3 144 | 145 | 146 | MaxSpeed 147 | true 148 | true 149 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 150 | MultiThreaded 151 | 152 | 153 | Console 154 | true 155 | true 156 | true 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | -------------------------------------------------------------------------------- /Observer/TestAllocations/TestAllocations.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Debug 10 | x64 11 | 12 | 13 | Release 14 | Win32 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | {5D63EFBE-1839-4708-9814-81170AF56313} 23 | Win32Proj 24 | TestAllocations 25 | 26 | 27 | 28 | Application 29 | true 30 | v110 31 | Unicode 32 | 33 | 34 | Application 35 | true 36 | v110 37 | Unicode 38 | 39 | 40 | Application 41 | false 42 | v110 43 | true 44 | Unicode 45 | 46 | 47 | Application 48 | false 49 | v110 50 | true 51 | Unicode 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | true 71 | $(SolutionDir)dist\$(Platform)\$(Configuration)\ 72 | build\$(Platform)\$(Configuration)\ 73 | 74 | 75 | true 76 | $(SolutionDir)dist\$(Platform)\$(Configuration)\ 77 | build\$(Platform)\$(Configuration)\ 78 | 79 | 80 | false 81 | $(SolutionDir)dist\$(Platform)\$(Configuration)\ 82 | build\$(Platform)\$(Configuration)\ 83 | 84 | 85 | false 86 | $(SolutionDir)dist\$(Platform)\$(Configuration)\ 87 | build\$(Platform)\$(Configuration)\ 88 | 89 | 90 | 91 | Use 92 | Level3 93 | Disabled 94 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 95 | true 96 | 97 | 98 | Console 99 | true 100 | 101 | 102 | 103 | 104 | Use 105 | Level3 106 | Disabled 107 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) 108 | true 109 | 110 | 111 | Console 112 | true 113 | 114 | 115 | 116 | 117 | Level3 118 | Use 119 | MaxSpeed 120 | true 121 | true 122 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 123 | true 124 | 125 | 126 | Console 127 | true 128 | true 129 | true 130 | 131 | 132 | 133 | 134 | Level3 135 | Use 136 | MaxSpeed 137 | true 138 | true 139 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) 140 | true 141 | 142 | 143 | Console 144 | true 145 | true 146 | true 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | Create 159 | Create 160 | Create 161 | Create 162 | 163 | 164 | 165 | 166 | 167 | 168 | -------------------------------------------------------------------------------- /Observer/DllInjector/DllInjector.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | #include 5 | #include 6 | #include 7 | 8 | #pragma comment (lib, "Advapi32.lib") 9 | 10 | typedef LONG (NTAPI *NtSuspendProcess)(IN HANDLE ProcessHandle); 11 | typedef LONG (NTAPI *NtResumeProcess)(IN HANDLE ProcessHandle); 12 | typedef NTSTATUS (NTAPI *NtRtlCreateUserThread)( IN HANDLE ProcessHandle, 13 | IN PSECURITY_DESCRIPTOR SecurityDescriptor OPTIONAL, 14 | IN BOOLEAN CreateSuspended, 15 | IN ULONG StackZeroBits, 16 | IN OUT PULONG StackReserved, 17 | IN OUT PULONG StackCommit, 18 | IN PVOID StartAddress, 19 | IN PVOID StartParameter OPTIONAL, 20 | OUT PHANDLE ThreadHandle, 21 | OUT VOID* ClientID 22 | ); 23 | 24 | // Inject a DLL into the target process by creating a new thread at LoadLibrary 25 | // Waits for injected thread to finish and returns its exit code. 26 | // 27 | // Originally from : 28 | // http://www.codeproject.com/Articles/2082/API-hooking-revealed 29 | int LoadLibraryInjection(HANDLE proc, const char *dllName){ 30 | 31 | int retVal; 32 | LPVOID RemoteString, LoadLibAddy; 33 | LoadLibAddy = (LPVOID)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA"); 34 | 35 | RemoteString = (LPVOID)VirtualAllocEx(proc, NULL, strlen(dllName) + 1, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE); 36 | if(RemoteString == NULL){ 37 | CloseHandle(proc); // Close the process handle. 38 | throw std::runtime_error("LoadLibraryInjection: Error on VirtualAllocEx."); 39 | } 40 | 41 | if(WriteProcessMemory(proc, (LPVOID)RemoteString, dllName,strlen(dllName) + 1, NULL) == 0){ 42 | VirtualFreeEx(proc, RemoteString, 0, MEM_RELEASE); // Free the memory we were going to use. 43 | CloseHandle(proc); // Close the process handle. 44 | throw std::runtime_error("LoadLibraryInjection: Error on WriteProcessMemeory."); 45 | } 46 | 47 | HANDLE hThread; 48 | NtRtlCreateUserThread pfnNtRtlCreateUserThread = (NtRtlCreateUserThread)GetProcAddress( GetModuleHandleA("ntdll"), "RtlCreateUserThread"); 49 | NTSTATUS retNtVal = pfnNtRtlCreateUserThread(proc, NULL, FALSE, 0, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibAddy, (LPVOID)RemoteString, &hThread, NULL); 50 | //if((hThread = CreateRemoteThread(proc, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibAddy, (LPVOID)RemoteString, NULL, NULL)) == NULL){ 51 | if( retNtVal ){ 52 | VirtualFreeEx(proc, RemoteString, 0, MEM_RELEASE); // Free the memory we were going to use. 53 | CloseHandle(proc); // Close the process handle. 54 | throw std::runtime_error("LoadLibraryInjection: Error on CreateRemoteThread."); 55 | } 56 | 57 | // Wait for the thread to finish. 58 | WaitForSingleObject(hThread, INFINITE); 59 | 60 | // Lets see what it says... 61 | //DWORD dwThreadExitCode=0; 62 | GetExitCodeThread(hThread, (LPDWORD)&retVal); 63 | 64 | // No need for this handle anymore, lets get rid of it. 65 | CloseHandle(hThread); 66 | 67 | // Lets clear up that memory we allocated earlier. 68 | VirtualFreeEx(proc, RemoteString, 0, MEM_RELEASE); 69 | 70 | return retVal; 71 | } 72 | 73 | std::string getDirectoryOfFile(const std::string &file){ 74 | size_t pos = (std::min)(file.find_last_of("/"), file.find_last_of("\\")); 75 | if(pos == std::string::npos) 76 | return "."; 77 | else 78 | return file.substr(0, pos); 79 | } 80 | 81 | 82 | //Suspend the process 83 | NTSTATUS suspend(HANDLE processHandle){ 84 | 85 | NtSuspendProcess pfnNtSuspendProcess = (NtSuspendProcess)GetProcAddress( GetModuleHandleA("ntdll"), "NtSuspendProcess"); 86 | return pfnNtSuspendProcess(processHandle); 87 | } 88 | 89 | //Resume the process 90 | NTSTATUS resume(HANDLE processHandle){ 91 | 92 | NtResumeProcess pfnNtResumeProcess = (NtResumeProcess)GetProcAddress( GetModuleHandleA("ntdll"), "NtResumeProcess"); 93 | return pfnNtResumeProcess(processHandle); 94 | } 95 | 96 | //START OF CODE 97 | int enableSEPrivilege(LPCTSTR name) 98 | { 99 | HANDLE hToken; 100 | LUID luid; 101 | TOKEN_PRIVILEGES tkp; 102 | 103 | if(!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken)) return 0; 104 | 105 | if(!LookupPrivilegeValue(NULL, name, &luid)) return 0; 106 | 107 | tkp.PrivilegeCount = 1; 108 | tkp.Privileges[0].Luid = luid; 109 | tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 110 | 111 | if(!AdjustTokenPrivileges(hToken, false, &tkp, sizeof(tkp), NULL, NULL)) return 0; 112 | 113 | if(GetLastError() == ERROR_NOT_ALL_ASSIGNED) return 0; 114 | 115 | CloseHandle(hToken); 116 | return 1; 117 | } 118 | 119 | 120 | extern "C" int main(int argc, char* argv[]){ 121 | 122 | 123 | if(argc < 2){ 124 | std::cout << "No arguments specified!\n\n"; 125 | std::cout << "Usage: DllInjector -p pid -e -a [args to pass to exe]\n\n" 126 | " -p Provide the process pid if you wish to attach to a running process\n" 127 | " -e Path to exe to launch \n" 128 | " -d Path to dll to inject \n" 129 | " -a Any arguments for the specified exe\n"; 130 | 131 | return -1; 132 | } 133 | 134 | //Loop through args and set flags 135 | char *curArg; 136 | char *injectionTarget = NULL; 137 | int processId = 0; 138 | std::string commandLine = ""; 139 | std::string dllPath = ""; 140 | 141 | for( int i =1; i < argc; i++){ 142 | curArg = argv[i]; 143 | if( strcmp(curArg, "-p") == 0 ){ 144 | 145 | //Get the process id 146 | if( argc > i + 1 ){ 147 | char *procIdStr = argv[i+1]; 148 | processId = atoi(procIdStr); 149 | } 150 | 151 | } else if( strcmp(curArg, "-e") == 0){ 152 | //Get the exe path 153 | if( argc > i + 1){ 154 | injectionTarget = argv[i+1]; 155 | commandLine = injectionTarget; 156 | i++; 157 | } 158 | } else if( strcmp(curArg, "-a") == 0){ 159 | 160 | //Loop through the args 161 | for(int j = i+1; j < argc; ++j){ 162 | commandLine += " " + std::string(argv[j]); 163 | } 164 | 165 | } else if( strcmp(curArg, "-d") == 0){ 166 | //Get the process id 167 | if( argc > i + 1){ 168 | dllPath = argv[i+1]; 169 | i++; 170 | } 171 | break; 172 | } 173 | } 174 | 175 | //Make sure dll exists 176 | if ( GetFileAttributesA((LPCSTR)dllPath.c_str()) == INVALID_FILE_ATTRIBUTES ){ 177 | std::cerr << "DLL does not exist. Please check path: (" << dllPath << ").\n\n"; 178 | return -1; 179 | } 180 | 181 | // Start our new process with a suspended main thread. 182 | std::cout << "Starting process with heap profiling enabled..." << std::endl; 183 | 184 | //If process id was given 185 | HANDLE processHandle; 186 | HANDLE threadHandle = 0; 187 | 188 | if( processId != 0 ){ 189 | 190 | DWORD dwResult = enableSEPrivilege(SE_DEBUG_NAME); 191 | processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId ); 192 | if( processHandle == NULL ){ 193 | std::cerr << "Error attaching to process " << processId << std::endl; 194 | return -1; 195 | } 196 | 197 | std::cout << "Target process id: " << processId << std::endl; 198 | 199 | NTSTATUS retVal = suspend(processHandle ); 200 | if( retVal ){ 201 | std::cerr << "Error suspending process " << processId << " Code: " << retVal << std::endl; 202 | return 1; 203 | } 204 | 205 | } else if( !commandLine.empty() ){ 206 | 207 | // Start our new process with a suspended main thread. 208 | std::cout << "Target exe path: " << injectionTarget << std::endl; 209 | std::cout << "Target exe command line: " << commandLine << std::endl; 210 | 211 | 212 | DWORD flags = CREATE_SUSPENDED; 213 | PROCESS_INFORMATION pi; 214 | STARTUPINFOA si; 215 | GetStartupInfoA(&si); 216 | 217 | if(CreateProcessA(NULL, (LPSTR)commandLine.c_str(), NULL, NULL, 0, flags, NULL, 218 | (LPSTR)".", &si, &pi) == 0){ 219 | int err = GetLastError(); 220 | std::cerr << "Error creating process " << injectionTarget << " Code: " << err << std::endl; 221 | return -1; 222 | } 223 | 224 | processHandle = pi.hProcess; 225 | threadHandle = pi.hThread; 226 | 227 | } 228 | 229 | try{ 230 | 231 | int retVal = LoadLibraryInjection(processHandle, dllPath.c_str()); 232 | if( retVal == 0 ){ 233 | throw std::runtime_error("LoadLibrary failed!"); 234 | } 235 | 236 | } catch(const std::exception &e){ 237 | std::cerr << "\n"; 238 | std::cerr << "Error while injecting process: " << e.what() << "\n\n"; 239 | std::cerr << "Check that the hook dll (" << dllPath << " is in the correct location.\n\n"; 240 | 241 | if( processId != 0 ) 242 | resume(processHandle); 243 | 244 | // TODO: figure out how to terminate thread. This does not always work. 245 | return -1; 246 | } 247 | 248 | // Once the injection thread has returned it is safe to resume the main thread. 249 | if( threadHandle){ 250 | ResumeThread(threadHandle); 251 | std::cout << "Resuming thread handle.\n" << std::endl; 252 | } else if( processId != 0 ){ 253 | if( !resume(processHandle)) 254 | std::cout << "Sucessfully resumed process.\n" << std::endl; 255 | } 256 | 257 | std::cout << "Sucessfully injected Hooking DLL.\n" << std::endl; 258 | 259 | return 0; 260 | } 261 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/build/libMinHook.vcproj: -------------------------------------------------------------------------------- 1 | 2 | 11 | 12 | 15 | 18 | 19 | 20 | 21 | 22 | 29 | 32 | 35 | 38 | 41 | 44 | 56 | 59 | 62 | 65 | 69 | 72 | 75 | 78 | 81 | 84 | 85 | 92 | 95 | 98 | 101 | 104 | 108 | 120 | 123 | 126 | 129 | 133 | 136 | 139 | 142 | 145 | 148 | 149 | 157 | 160 | 163 | 166 | 169 | 172 | 184 | 187 | 190 | 193 | 197 | 200 | 203 | 206 | 209 | 212 | 213 | 221 | 224 | 227 | 230 | 233 | 237 | 249 | 252 | 255 | 258 | 262 | 265 | 268 | 271 | 274 | 277 | 278 | 279 | 280 | 281 | 282 | 285 | 288 | 291 | 292 | 295 | 296 | 299 | 300 | 301 | 304 | 307 | 308 | 311 | 312 | 315 | 316 | 317 | 320 | 323 | 324 | 327 | 328 | 331 | 332 | 335 | 336 | 339 | 340 | 341 | 344 | 347 | 348 | 351 | 352 | 355 | 356 | 359 | 360 | 363 | 364 | 365 | 366 | 369 | 370 | 373 | 374 | 375 | 376 | 377 | 378 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/build/MinHook.vcproj: -------------------------------------------------------------------------------- 1 | 2 | 11 | 12 | 15 | 18 | 19 | 20 | 21 | 22 | 29 | 32 | 35 | 38 | 41 | 44 | 55 | 58 | 61 | 64 | 74 | 77 | 80 | 83 | 86 | 89 | 92 | 95 | 96 | 104 | 107 | 110 | 113 | 116 | 119 | 130 | 133 | 136 | 139 | 151 | 154 | 157 | 160 | 163 | 166 | 169 | 172 | 173 | 180 | 183 | 186 | 189 | 192 | 196 | 207 | 210 | 213 | 216 | 225 | 228 | 231 | 234 | 237 | 240 | 243 | 246 | 247 | 255 | 258 | 261 | 264 | 267 | 271 | 282 | 285 | 288 | 291 | 303 | 306 | 309 | 312 | 315 | 318 | 321 | 324 | 325 | 326 | 327 | 328 | 329 | 332 | 335 | 340 | 341 | 344 | 349 | 350 | 353 | 358 | 359 | 362 | 367 | 368 | 369 | 372 | 373 | 376 | 377 | 380 | 381 | 382 | 383 | 384 | 385 | -------------------------------------------------------------------------------- /Observer/libs/MinHook/build/libMinHook.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Debug 10 | x64 11 | 12 | 13 | Release 14 | Win32 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | {65021938-D251-46FA-BC3D-85C385D4C06D} 23 | libMinHook 24 | Win32Proj 25 | 26 | 27 | 28 | StaticLibrary 29 | Unicode 30 | true 31 | v110_xp 32 | 33 | 34 | StaticLibrary 35 | Unicode 36 | v110 37 | 38 | 39 | StaticLibrary 40 | Unicode 41 | true 42 | v110 43 | 44 | 45 | StaticLibrary 46 | Unicode 47 | v110 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | <_ProjectFileVersion>10.0.40219.1 67 | AllRules.ruleset 68 | 69 | 70 | AllRules.ruleset 71 | 72 | 73 | AllRules.ruleset 74 | 75 | 76 | AllRules.ruleset 77 | 78 | 79 | 80 | 81 | $(SolutionDir)dist\$(Platform)\$(Configuration)\ 82 | build\$(Platform)\$(Configuration)\ 83 | 84 | 85 | $(SolutionDir)dist\$(Platform)\$(Configuration)\ 86 | build\$(Platform)\$(Configuration)\ 87 | 88 | 89 | 90 | Disabled 91 | $(ProjectDir)\..\include;%(AdditionalIncludeDirectories) 92 | WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions) 93 | true 94 | EnableFastChecks 95 | MultiThreadedDebug 96 | 97 | 98 | Level3 99 | EditAndContinue 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | X64 108 | 109 | 110 | Disabled 111 | $(ProjectDir)\..\include;%(AdditionalIncludeDirectories) 112 | WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions) 113 | true 114 | EnableFastChecks 115 | MultiThreadedDebug 116 | 117 | 118 | Level3 119 | ProgramDatabase 120 | 121 | 122 | 123 | 124 | 125 | MaxSpeed 126 | true 127 | $(ProjectDir)\..\include;%(AdditionalIncludeDirectories) 128 | WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions) 129 | MultiThreaded 130 | true 131 | 132 | 133 | Level3 134 | ProgramDatabase 135 | NoExtensions 136 | 137 | 138 | 139 | 140 | 141 | X64 142 | 143 | 144 | MaxSpeed 145 | true 146 | $(ProjectDir)\..\include;%(AdditionalIncludeDirectories) 147 | WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions) 148 | MultiThreaded 149 | true 150 | 151 | 152 | Level3 153 | ProgramDatabase 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | 169 | 170 | 171 | 172 | 173 | 174 | 175 | 176 | 177 | 178 | 179 | 180 | 181 | 182 | 183 | 184 | -------------------------------------------------------------------------------- /Observer/Observer/Observer.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Debug 10 | x64 11 | 12 | 13 | Release 14 | Win32 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | {F3C8DD27-15AB-4B73-A499-C32181ACACC9} 23 | Win32Proj 24 | Observer 25 | Observer 26 | 27 | 28 | 29 | DynamicLibrary 30 | true 31 | v110 32 | Unicode 33 | 34 | 35 | DynamicLibrary 36 | true 37 | v110 38 | Unicode 39 | 40 | 41 | DynamicLibrary 42 | false 43 | v110 44 | true 45 | Unicode 46 | Static 47 | 48 | 49 | DynamicLibrary 50 | false 51 | v110 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | true 73 | $(ProjectName)_Win32 74 | $(SolutionDir)dist\$(Platform)\$(Configuration)\ 75 | build\$(Platform)\$(Configuration)\ 76 | 77 | 78 | true 79 | $(ProjectName)_x64 80 | $(SolutionDir)dist\$(Platform)\$(Configuration)\ 81 | build\$(Platform)\$(Configuration)\ 82 | 83 | 84 | false 85 | $(ProjectName)_Win32 86 | $(SolutionDir)dist\$(Platform)\$(Configuration)\ 87 | build\$(Platform)\$(Configuration)\ 88 | 89 | 90 | false 91 | $(ProjectName)_x64 92 | $(SolutionDir)dist\$(Platform)\$(Configuration)\ 93 | build\$(Platform)\$(Configuration)\ 94 | 95 | 96 | 97 | 98 | 99 | Level3 100 | Disabled 101 | WIN32;_DEBUG;_WINDOWS;_USRDLL;HEAPYINJECT_EXPORTS;%(PreprocessorDefinitions) 102 | $(SolutionDir)\libs\MinHook\include;%(AdditionalIncludeDirectories) 103 | ProgramDatabase 104 | MultiThreadedDebug 105 | 106 | 107 | Windows 108 | true 109 | $(SolutionDir)\libs\dbghelp\lib\x86 110 | dbghelp.lib;%(AdditionalDependencies) 111 | 112 | 113 | 114 | 115 | 116 | 117 | Level3 118 | Disabled 119 | WIN32;_DEBUG;_WINDOWS;_USRDLL;HEAPYINJECT_EXPORTS;%(PreprocessorDefinitions) 120 | $(SolutionDir)\libs\MinHook\include;%(AdditionalIncludeDirectories) 121 | MultiThreadedDebug 122 | 123 | 124 | Windows 125 | true 126 | $(SolutionDir)\libs\dbghelp\lib\x64 127 | dbghelp.lib;%(AdditionalDependencies) 128 | 129 | 130 | 131 | 132 | Level3 133 | 134 | 135 | MaxSpeed 136 | true 137 | true 138 | WIN32;NDEBUG;_WINDOWS;_USRDLL;HEAPYINJECT_EXPORTS;%(PreprocessorDefinitions) 139 | $(SolutionDir)\libs\MinHook\include;%(AdditionalIncludeDirectories) 140 | MultiThreaded 141 | 142 | 143 | Windows 144 | true 145 | true 146 | true 147 | $(SolutionDir)\libs\dbghelp\lib\x86 148 | dbghelp.lib;%(AdditionalDependencies) 149 | 150 | 151 | 152 | 153 | Level3 154 | 155 | 156 | MaxSpeed 157 | true 158 | true 159 | WIN32;NDEBUG;_WINDOWS;_USRDLL;HEAPYINJECT_EXPORTS;%(PreprocessorDefinitions) 160 | $(SolutionDir)\libs\MinHook\include;%(AdditionalIncludeDirectories) 161 | MultiThreaded 162 | 163 | 164 | Windows 165 | true 166 | true 167 | true 168 | $(SolutionDir)\libs\dbghelp\lib\x64 169 | dbghelp.lib;%(AdditionalDependencies) 170 | 171 | 172 | 173 | 174 | 175 | 176 | 177 | 178 | 179 | 180 | {65021938-d251-46fa-bc3d-85c385d4c06d} 181 | 182 | 183 | 184 | 185 | 186 | --------------------------------------------------------------------------------