├── .gitattributes ├── .gitignore ├── Bin_Debug ├── config.ini └── dbghelp.dll ├── Bin_NtLayer-Debug ├── config.ini └── dbghelp.dll ├── Bin_NtLayer-Release ├── config.ini └── dbghelp.dll ├── Bin_Release ├── config.ini └── dbghelp.dll ├── HSHook ├── Detoursor.cpp ├── Detoursor.h ├── DetoursorHelper.h ├── HSHook.aps ├── HSHook.cpp ├── HSHook.rc ├── HSHook.vcproj ├── HSHook.vcxproj ├── HSHook.vcxproj.filters ├── HandleApis.cpp ├── NtHandleApis.cpp ├── SysTypedef.h ├── WitlessCriticalSection.cpp ├── WitlessCriticalSection.h ├── callstack │ ├── CallStack.cpp │ ├── CallStack.h │ └── PdbSig.cpp ├── detours │ ├── creatwth.cpp │ ├── detours.cpp │ ├── detours.h │ ├── detver.h │ ├── disasm.cpp │ ├── image.cpp │ ├── modules.cpp │ └── uimports.cpp ├── dprintf │ ├── DPrintf.cpp │ └── DPrintf.h ├── resource.h ├── stdafx.cpp └── stdafx.h ├── HandleSpy ├── AboutDlg.h ├── Api.cpp ├── Api.h ├── ApiListView.cpp ├── ApiListView.h ├── CProgressBarDlg.cpp ├── CProgressBarDlg.h ├── ChartView.cpp ├── ChartView.h ├── DetectDlg.cpp ├── DetectDlg.h ├── Detector.cpp ├── Detector.h ├── FuncCallDlg.cpp ├── FuncCallDlg.h ├── HandleSpy.aps ├── HandleSpy.cpp ├── HandleSpy.h ├── HandleSpy.rc ├── HandleSpy.vcproj ├── HandleSpy.vcxproj ├── HandleSpy.vcxproj.filters ├── HandleSpy.vcxproj.user ├── Inject.cpp ├── Inject.h ├── LeakedFunCallDlg.cpp ├── LeakedFunCallDlg.h ├── MainFrm.cpp ├── MainFrm.h ├── ProcessSelDlg.cpp ├── ProcessSelDlg.h ├── ProgressDlg.cpp ├── ProgressDlg.h ├── ShionChartView.cpp ├── ShionChartView.h ├── StackDlg.cpp ├── StackDlg.h ├── SymbolHandler.cpp ├── SymbolHandler.h ├── dbghelp.h ├── lib │ └── dbghelp.lib ├── res │ ├── HandleSpy.ico │ └── Toolbar.bmp ├── resource.h ├── stdafx.cpp ├── stdafx.h └── wtl │ └── include │ ├── atlapp.h │ ├── atlcrack.h │ ├── atlctrls.h │ ├── atlctrlw.h │ ├── atlctrlx.h │ ├── atlddx.h │ ├── atldlgs.h │ ├── atlfind.h │ ├── atlframe.h │ ├── atlgdi.h │ ├── atlmisc.h │ ├── atlprint.h │ ├── atlres.h │ ├── atlresce.h │ ├── atlscrl.h │ ├── atlsplit.h │ ├── atltheme.h │ ├── atluser.h │ ├── atlwince.h │ └── atlwinx.h ├── HandleSpy_vs2008.sln ├── HandleSpy_vs2010.sln ├── README.md ├── Storage ├── StackStorage.cpp └── StackStorage.h ├── hs0.jpg ├── hs1.jpg └── include ├── ApiIndex.h ├── CallStackTypeDefine.h ├── CountAndTimeTypeDefine.h └── NtApiIndex.h /.gitattributes: -------------------------------------------------------------------------------- 1 | # Auto detect text files and perform LF normalization 2 | * text=auto 3 | 4 | # Custom for Visual Studio 5 | *.cs diff=csharp 6 | 7 | # Standard to msysgit 8 | *.doc diff=astextplain 9 | *.DOC diff=astextplain 10 | *.docx diff=astextplain 11 | *.DOCX diff=astextplain 12 | *.dot diff=astextplain 13 | *.DOT diff=astextplain 14 | *.pdf diff=astextplain 15 | *.PDF diff=astextplain 16 | *.rtf diff=astextplain 17 | *.RTF diff=astextplain 18 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Windows image file caches 2 | Thumbs.db 3 | ehthumbs.db 4 | 5 | # Folder config file 6 | Desktop.ini 7 | 8 | # Recycle Bin used on file shares 9 | $RECYCLE.BIN/ 10 | 11 | # Windows Installer files 12 | *.cab 13 | *.msi 14 | *.msm 15 | *.msp 16 | 17 | # Windows shortcuts 18 | *.lnk 19 | 20 | # ========================= 21 | # Operating System Files 22 | # ========================= 23 | 24 | # OSX 25 | # ========================= 26 | 27 | .DS_Store 28 | .AppleDouble 29 | .LSOverride 30 | 31 | # Thumbnails 32 | ._* 33 | 34 | # Files that might appear on external disk 35 | .Spotlight-V100 36 | .Trashes 37 | 38 | # Directories potentially created on remote AFP share 39 | .AppleDB 40 | .AppleDesktop 41 | Network Trash Folder 42 | Temporary Items 43 | .apdisk 44 | -------------------------------------------------------------------------------- /Bin_Debug/config.ini: -------------------------------------------------------------------------------- 1 | [Config] 2 | sympath=E:\Symbols; -------------------------------------------------------------------------------- /Bin_Debug/dbghelp.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/Bin_Debug/dbghelp.dll -------------------------------------------------------------------------------- /Bin_NtLayer-Debug/config.ini: -------------------------------------------------------------------------------- 1 | [Config] 2 | sympath=F:\Symbols; -------------------------------------------------------------------------------- /Bin_NtLayer-Debug/dbghelp.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/Bin_NtLayer-Debug/dbghelp.dll -------------------------------------------------------------------------------- /Bin_NtLayer-Release/config.ini: -------------------------------------------------------------------------------- 1 | [Config] 2 | sympath=F:\Symbols; -------------------------------------------------------------------------------- /Bin_NtLayer-Release/dbghelp.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/Bin_NtLayer-Release/dbghelp.dll -------------------------------------------------------------------------------- /Bin_Release/config.ini: -------------------------------------------------------------------------------- 1 | [Config] 2 | sympath=F:\Symbols; -------------------------------------------------------------------------------- /Bin_Release/dbghelp.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/Bin_Release/dbghelp.dll -------------------------------------------------------------------------------- /HSHook/Detoursor.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HSHook/Detoursor.cpp -------------------------------------------------------------------------------- /HSHook/Detoursor.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HSHook/Detoursor.h -------------------------------------------------------------------------------- /HSHook/DetoursorHelper.h: -------------------------------------------------------------------------------- 1 | #ifndef __HANDLEAPIS_H__ 2 | #define __HANDLEAPIS_H__ 3 | #include "Detoursor.h" 4 | 5 | namespace DetoursorHelper 6 | { 7 | /* 8 | * Helper function of CDetoursor 9 | * Add many functions to CDetoursor 10 | */ 11 | BOOL AddAllFunctionsToDetoursor(CDetoursor *pDetoursor); 12 | } 13 | #endif -------------------------------------------------------------------------------- /HSHook/HSHook.aps: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HSHook/HSHook.aps -------------------------------------------------------------------------------- /HSHook/HSHook.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HSHook/HSHook.cpp -------------------------------------------------------------------------------- /HSHook/HSHook.rc: -------------------------------------------------------------------------------- 1 | // Microsoft Visual C++ generated resource script. 2 | // 3 | #include "resource.h" 4 | 5 | #define APSTUDIO_READONLY_SYMBOLS 6 | ///////////////////////////////////////////////////////////////////////////// 7 | // 8 | // Generated from the TEXTINCLUDE 2 resource. 9 | // 10 | #include "afxres.h" 11 | 12 | ///////////////////////////////////////////////////////////////////////////// 13 | #undef APSTUDIO_READONLY_SYMBOLS 14 | 15 | ///////////////////////////////////////////////////////////////////////////// 16 | // Chinese (P.R.C.) resources 17 | 18 | #if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS) 19 | #ifdef _WIN32 20 | LANGUAGE LANG_CHINESE, SUBLANG_CHINESE_SIMPLIFIED 21 | #pragma code_page(936) 22 | #endif //_WIN32 23 | 24 | #ifdef APSTUDIO_INVOKED 25 | ///////////////////////////////////////////////////////////////////////////// 26 | // 27 | // TEXTINCLUDE 28 | // 29 | 30 | 1 TEXTINCLUDE 31 | BEGIN 32 | "resource.h\0" 33 | END 34 | 35 | 2 TEXTINCLUDE 36 | BEGIN 37 | "#include ""afxres.h""\r\n" 38 | "\0" 39 | END 40 | 41 | 3 TEXTINCLUDE 42 | BEGIN 43 | "\r\n" 44 | "\0" 45 | END 46 | 47 | #endif // APSTUDIO_INVOKED 48 | 49 | 50 | ///////////////////////////////////////////////////////////////////////////// 51 | // 52 | // Version 53 | // 54 | 55 | VS_VERSION_INFO VERSIONINFO 56 | FILEVERSION 1,0,0,7 57 | PRODUCTVERSION 1,0,0,7 58 | FILEFLAGSMASK 0x17L 59 | #ifdef _DEBUG 60 | FILEFLAGS 0x1L 61 | #else 62 | FILEFLAGS 0x0L 63 | #endif 64 | FILEOS 0x4L 65 | FILETYPE 0x2L 66 | FILESUBTYPE 0x0L 67 | BEGIN 68 | BLOCK "StringFileInfo" 69 | BEGIN 70 | BLOCK "080404b0" 71 | BEGIN 72 | VALUE "FileDescription", "HandleSpy Api Hook Module" 73 | VALUE "FileVersion", "1. 0. 0. 7" 74 | VALUE "InternalName", "HSHook" 75 | VALUE "LegalCopyright", "Copyright (C) 2013" 76 | VALUE "OriginalFilename", "HSHook.dll" 77 | VALUE "ProductName", "HSHook" 78 | VALUE "ProductVersion", "1. 0. 0. 7" 79 | END 80 | END 81 | BLOCK "VarFileInfo" 82 | BEGIN 83 | VALUE "Translation", 0x804, 1200 84 | END 85 | END 86 | 87 | #endif // Chinese (P.R.C.) resources 88 | ///////////////////////////////////////////////////////////////////////////// 89 | 90 | 91 | 92 | #ifndef APSTUDIO_INVOKED 93 | ///////////////////////////////////////////////////////////////////////////// 94 | // 95 | // Generated from the TEXTINCLUDE 3 resource. 96 | // 97 | 98 | 99 | ///////////////////////////////////////////////////////////////////////////// 100 | #endif // not APSTUDIO_INVOKED 101 | 102 | -------------------------------------------------------------------------------- /HSHook/HSHook.vcproj: -------------------------------------------------------------------------------- 1 | 2 | 11 | 12 | 15 | 16 | 17 | 18 | 19 | 26 | 29 | 32 | 35 | 38 | 41 | 55 | 58 | 61 | 64 | 73 | 76 | 79 | 82 | 85 | 88 | 91 | 94 | 95 | 103 | 106 | 109 | 112 | 115 | 118 | 133 | 136 | 139 | 142 | 154 | 157 | 160 | 163 | 166 | 169 | 172 | 175 | 176 | 184 | 187 | 190 | 193 | 196 | 199 | 214 | 217 | 220 | 223 | 235 | 238 | 241 | 244 | 247 | 250 | 253 | 256 | 257 | 264 | 267 | 270 | 273 | 276 | 279 | 293 | 296 | 299 | 302 | 311 | 314 | 317 | 320 | 323 | 326 | 329 | 332 | 333 | 334 | 335 | 336 | 337 | 342 | 345 | 346 | 349 | 350 | 353 | 354 | 357 | 360 | 366 | 367 | 370 | 376 | 377 | 378 | 381 | 384 | 388 | 389 | 392 | 396 | 397 | 398 | 401 | 404 | 410 | 411 | 412 | 415 | 416 | 419 | 422 | 426 | 427 | 430 | 434 | 435 | 438 | 442 | 443 | 446 | 450 | 451 | 452 | 455 | 456 | 459 | 460 | 463 | 464 | 467 | 468 | 469 | 474 | 477 | 478 | 479 | 482 | 485 | 488 | 492 | 493 | 496 | 500 | 501 | 504 | 508 | 509 | 512 | 516 | 517 | 518 | 521 | 524 | 528 | 529 | 532 | 536 | 537 | 540 | 544 | 545 | 548 | 552 | 553 | 554 | 557 | 558 | 561 | 562 | 565 | 568 | 572 | 573 | 576 | 580 | 581 | 584 | 588 | 589 | 592 | 596 | 597 | 598 | 601 | 604 | 608 | 609 | 612 | 616 | 617 | 620 | 624 | 625 | 628 | 632 | 633 | 634 | 637 | 640 | 644 | 645 | 648 | 652 | 653 | 656 | 660 | 661 | 664 | 668 | 669 | 670 | 671 | 674 | 677 | 680 | 684 | 685 | 688 | 692 | 693 | 696 | 700 | 701 | 704 | 708 | 709 | 710 | 713 | 714 | 715 | 718 | 721 | 724 | 728 | 729 | 732 | 736 | 737 | 740 | 744 | 745 | 748 | 752 | 753 | 754 | 757 | 758 | 761 | 762 | 763 | 766 | 769 | 770 | 773 | 774 | 777 | 778 | 779 | 782 | 785 | 786 | 789 | 790 | 791 | 794 | 795 | 796 | 797 | 798 | 799 | -------------------------------------------------------------------------------- /HSHook/HSHook.vcxproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | NtLayer-Debug 10 | Win32 11 | 12 | 13 | NtLayer-Release 14 | Win32 15 | 16 | 17 | Release 18 | Win32 19 | 20 | 21 | 22 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1} 23 | HSHook 24 | Win32Proj 25 | 26 | 27 | 28 | DynamicLibrary 29 | Unicode 30 | v120 31 | 32 | 33 | DynamicLibrary 34 | Unicode 35 | true 36 | v120 37 | 38 | 39 | DynamicLibrary 40 | Unicode 41 | true 42 | v120 43 | 44 | 45 | DynamicLibrary 46 | Unicode 47 | v120 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | <_ProjectFileVersion>10.0.40219.1 67 | $(SolutionDir)Bin_$(Configuration)\ 68 | $(SolutionDir)Intermediate_$(Configuration)\$(ProjectName)\ 69 | true 70 | $(SolutionDir)Bin_$(Configuration)\ 71 | $(SolutionDir)Intermediate_$(Configuration)\$(ProjectName)\ 72 | false 73 | $(SolutionDir)Bin_$(Configuration)\ 74 | $(SolutionDir)Intermediate_$(Configuration)\$(ProjectName)\ 75 | false 76 | $(SolutionDir)Bin_$(Configuration)\ 77 | $(SolutionDir)Intermediate_$(Configuration)\$(ProjectName)\ 78 | true 79 | 80 | 81 | 82 | Disabled 83 | $(SolutionDir)include;$(SolutionDir)Storage;%(AdditionalIncludeDirectories) 84 | WIN32;_DEBUG;_WINDOWS;_USRDLL;HSHOOK_EXPORTS;DETOURS_X86;DETOURS_32BIT;%(PreprocessorDefinitions) 85 | true 86 | EnableFastChecks 87 | MultiThreadedDebugDLL 88 | Use 89 | All 90 | Level3 91 | EditAndContinue 92 | 93 | 94 | true 95 | Windows 96 | false 97 | 98 | 99 | MachineX86 100 | 101 | 102 | 103 | 104 | Disabled 105 | false 106 | $(SolutionDir)include;$(SolutionDir)Storage;%(AdditionalIncludeDirectories) 107 | WIN32;NDEBUG;_WINDOWS;_USRDLL;HSHOOK_EXPORTS;DETOURS_X86;DETOURS_32BIT;%(PreprocessorDefinitions) 108 | Default 109 | MultiThreadedDLL 110 | false 111 | Use 112 | All 113 | Level3 114 | ProgramDatabase 115 | 116 | 117 | true 118 | Windows 119 | true 120 | true 121 | 122 | 123 | false 124 | 125 | 126 | MachineX86 127 | 128 | 129 | 130 | 131 | Disabled 132 | false 133 | $(SolutionDir)include;$(SolutionDir)Storage;%(AdditionalIncludeDirectories) 134 | WIN32;NDEBUG;_WINDOWS;_USRDLL;HSHOOK_EXPORTS;DETOURS_X86;DETOURS_32BIT;NT_LAYER_FUNCTION_HOOK;%(PreprocessorDefinitions) 135 | Default 136 | MultiThreadedDLL 137 | false 138 | Use 139 | All 140 | Level3 141 | ProgramDatabase 142 | 143 | 144 | true 145 | Windows 146 | true 147 | true 148 | 149 | 150 | false 151 | 152 | 153 | MachineX86 154 | 155 | 156 | 157 | 158 | Disabled 159 | $(SolutionDir)include;$(SolutionDir)Storage;%(AdditionalIncludeDirectories) 160 | WIN32;_DEBUG;_WINDOWS;_USRDLL;HSHOOK_EXPORTS;DETOURS_X86;DETOURS_32BIT;NT_LAYER_FUNCTION_HOOK;%(PreprocessorDefinitions) 161 | true 162 | EnableFastChecks 163 | MultiThreadedDebugDLL 164 | Use 165 | AssemblyCode 166 | Level3 167 | EditAndContinue 168 | 169 | 170 | true 171 | Windows 172 | false 173 | 174 | 175 | MachineX86 176 | 177 | 178 | 179 | 180 | 181 | Disabled 182 | Use 183 | All 184 | Disabled 185 | Use 186 | All 187 | 188 | 189 | AssemblyAndSourceCode 190 | AssemblyAndSourceCode 191 | 192 | 193 | Default 194 | false 195 | 196 | 197 | 198 | 199 | Create 200 | Create 201 | Create 202 | Create 203 | 204 | 205 | 206 | 207 | 208 | 209 | 210 | 211 | 212 | 213 | 214 | 215 | 216 | 217 | 218 | 219 | 220 | 221 | 222 | 223 | 224 | 225 | 226 | 227 | 228 | 229 | 230 | 231 | 232 | 233 | 234 | 235 | 236 | 237 | 238 | 239 | 240 | 241 | 242 | 243 | 244 | 245 | 246 | 247 | 248 | 249 | 250 | 251 | 252 | 253 | 254 | 255 | 256 | 257 | 258 | 259 | 260 | 261 | 262 | 263 | 264 | 265 | 266 | 267 | 268 | 269 | 270 | 271 | 272 | 273 | 274 | 275 | 276 | 277 | 278 | 279 | 280 | 281 | 282 | 283 | 284 | 285 | 286 | 287 | 288 | 289 | 290 | 291 | 292 | 293 | 294 | 295 | 296 | 297 | 298 | 299 | 300 | 301 | 302 | 303 | -------------------------------------------------------------------------------- /HSHook/HSHook.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 6 | h;hpp;hxx;hm;inl;inc;xsd 7 | 8 | 9 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 10 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav 11 | 12 | 13 | {831452be-62ba-4b45-9201-fb2946576b22} 14 | 15 | 16 | {01937b47-b5f8-42c0-8b38-9dbd224f6fc8} 17 | 18 | 19 | {bfdc4d4b-4db1-4bf5-a5a3-563bec2562ae} 20 | 21 | 22 | {8d6338cf-2f01-4ba3-b59d-72fe7e650953} 23 | 24 | 25 | {6969edd7-9099-45fd-a8c7-c27113a88812} 26 | 27 | 28 | 29 | 30 | dllmain 31 | 32 | 33 | dllmain 34 | 35 | 36 | dllmain 37 | 38 | 39 | dllmain 40 | 41 | 42 | dllmain 43 | 44 | 45 | dllmain 46 | 47 | 48 | detours 49 | 50 | 51 | detours 52 | 53 | 54 | detours 55 | 56 | 57 | detours 58 | 59 | 60 | detours 61 | 62 | 63 | dprintf 64 | 65 | 66 | callstack 67 | 68 | 69 | callstack 70 | 71 | 72 | storage 73 | 74 | 75 | 76 | 77 | dllmain 78 | 79 | 80 | dllmain 81 | 82 | 83 | dllmain 84 | 85 | 86 | dllmain 87 | 88 | 89 | dllmain 90 | 91 | 92 | dllmain 93 | 94 | 95 | detours 96 | 97 | 98 | detours 99 | 100 | 101 | dprintf 102 | 103 | 104 | callstack 105 | 106 | 107 | include 108 | 109 | 110 | include 111 | 112 | 113 | include 114 | 115 | 116 | storage 117 | 118 | 119 | 120 | 121 | Resource Files 122 | 123 | 124 | 125 | 126 | 127 | -------------------------------------------------------------------------------- /HSHook/HandleApis.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HSHook/HandleApis.cpp -------------------------------------------------------------------------------- /HSHook/NtHandleApis.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HSHook/NtHandleApis.cpp -------------------------------------------------------------------------------- /HSHook/SysTypedef.h: -------------------------------------------------------------------------------- 1 | typedef LONG NTSTATUS; 2 | #define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0) 3 | 4 | typedef struct _UNICODE_STRING { 5 | USHORT Length; 6 | USHORT MaximumLength; 7 | PWSTR Buffer; 8 | } UNICODE_STRING; 9 | typedef UNICODE_STRING *PUNICODE_STRING; 10 | typedef const UNICODE_STRING *PCUNICODE_STRING; 11 | 12 | typedef struct _OBJECT_ATTRIBUTES { 13 | ULONG Length; 14 | HANDLE RootDirectory; 15 | PUNICODE_STRING ObjectName; 16 | ULONG Attributes; 17 | PVOID SecurityDescriptor; 18 | PVOID SecurityQualityOfService; 19 | } OBJECT_ATTRIBUTES; 20 | typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES; 21 | 22 | 23 | typedef struct _LDR_MODULE { 24 | LIST_ENTRY InLoadOrderModuleList; 25 | LIST_ENTRY InMemoryOrderModuleList; 26 | LIST_ENTRY InInitializationOrderModuleList; 27 | PVOID BaseAddress; 28 | PVOID EntryPoint; 29 | ULONG SizeOfImage; 30 | UNICODE_STRING FullDllName; 31 | UNICODE_STRING BaseDllName; 32 | ULONG Flags; 33 | SHORT LoadCount; 34 | SHORT TlsIndex; 35 | LIST_ENTRY HashTableEntry; 36 | ULONG TimeDateStamp; 37 | } LDR_MODULE, *PLDR_MODULE; 38 | 39 | typedef struct _PEB_LDR_DATA { 40 | ULONG Length; 41 | BOOLEAN Initialized; 42 | PVOID SsHandle; 43 | LIST_ENTRY InLoadOrderModuleList; 44 | LIST_ENTRY InMemoryOrderModuleList; 45 | LIST_ENTRY InInitializationOrderModuleList; 46 | } PEB_LDR_DATA, *PPEB_LDR_DATA; 47 | 48 | typedef struct _PEB { 49 | BYTE Reserved1[0x02]; 50 | BYTE BeingDebugged; 51 | BYTE Reserved2[0x01]; 52 | PVOID Reserved3[0x02]; 53 | PPEB_LDR_DATA Ldr; 54 | PVOID ProcessParameters;/*PRTL_USER_PROCESS_PARAMETERS*/ 55 | BYTE Reserved4[0x24]; 56 | PVOID ApiSetMap; 57 | BYTE Reserved5[0x40]; 58 | PVOID Reserved6[52]; 59 | PVOID PostProcessInitRoutine;/*PPS_POST_PROCESS_INIT_ROUTINE*/ 60 | BYTE Reserved7[0x80]; 61 | PVOID Reserved8[0x01]; 62 | ULONG SessionId; 63 | } PEB, *PPEB; 64 | 65 | typedef struct _TEB { 66 | NT_TIB NtTib; 67 | BYTE Reserved1[0x078c]; 68 | PVOID Reserved2[0x019c]; 69 | PVOID TlsSlots[0x40]; 70 | BYTE Reserved3[0x08]; 71 | PVOID Reserved4[0x1a]; 72 | PVOID ReservedForOle; 73 | PVOID Reserved5[0x04]; 74 | PVOID TlsExpansionSlots; 75 | } TEB, *PTEB; -------------------------------------------------------------------------------- /HSHook/WitlessCriticalSection.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HSHook/WitlessCriticalSection.cpp -------------------------------------------------------------------------------- /HSHook/WitlessCriticalSection.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | class CWitlessCriticalSection 4 | { 5 | public: 6 | CWitlessCriticalSection(void); 7 | ~CWitlessCriticalSection(void); 8 | 9 | void Enter(); 10 | void Leave(); 11 | 12 | private: 13 | volatile long m_lLockCount; 14 | unsigned long m_lOwninThread; 15 | unsigned long m_lRecursionCount; 16 | }; 17 | -------------------------------------------------------------------------------- /HSHook/callstack/CallStack.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HSHook/callstack/CallStack.cpp -------------------------------------------------------------------------------- /HSHook/callstack/CallStack.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HSHook/callstack/CallStack.h -------------------------------------------------------------------------------- /HSHook/callstack/PdbSig.cpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "stdafx.h" 4 | #include 5 | #include 6 | #include 7 | 8 | #define CV_SIGNATURE_NB10 '01BN' 9 | #define CV_SIGNATURE_RSDS 'SDSR' 10 | 11 | // CodeView header 12 | struct CV_HEADER 13 | { 14 | DWORD CvSignature; // NBxx 15 | LONG Offset; // Always 0 for NB10 16 | }; 17 | 18 | // CodeView NB10 debug information 19 | // (used when debug information is stored in a PDB 2.00 file) 20 | struct CV_INFO_PDB20 21 | { 22 | CV_HEADER Header; 23 | DWORD Signature; // seconds since 01.01.1970 24 | DWORD Age; // an always-incrementing value 25 | BYTE PdbFileName[1]; // zero terminated string with the name of the PDB file 26 | }; 27 | 28 | // CodeView RSDS debug information 29 | // (used when debug information is stored in a PDB 7.00 file) 30 | struct CV_INFO_PDB70 31 | { 32 | DWORD CvSignature; 33 | GUID Signature; // unique identifier 34 | DWORD Age; // an always-incrementing value 35 | BYTE PdbFileName[1]; // zero terminated string with the name of the PDB file 36 | }; 37 | 38 | BOOL IsPEFile(LPVOID ImageBase) 39 | { 40 | PIMAGE_DOS_HEADER pDH = NULL; 41 | PIMAGE_NT_HEADERS pNtH = NULL; 42 | 43 | if(!ImageBase) 44 | return FALSE; 45 | 46 | pDH = (PIMAGE_DOS_HEADER)ImageBase; 47 | if (pDH->e_magic != IMAGE_DOS_SIGNATURE) 48 | return FALSE; 49 | 50 | pNtH = (PIMAGE_NT_HEADERS32)UIntToPtr(PtrToUint(pDH) + pDH->e_lfanew); 51 | if (pNtH->Signature != IMAGE_NT_SIGNATURE ) 52 | return FALSE; 53 | 54 | return TRUE; 55 | } 56 | 57 | PIMAGE_NT_HEADERS GetNtHeaders(LPVOID ImageBase) 58 | { 59 | if(!IsPEFile(ImageBase)) 60 | return NULL; 61 | 62 | PIMAGE_NT_HEADERS pNtH; 63 | PIMAGE_DOS_HEADER pDH; 64 | pDH = (PIMAGE_DOS_HEADER)ImageBase; 65 | pNtH = (PIMAGE_NT_HEADERS)UIntToPtr(PtrToUint(pDH) + pDH->e_lfanew); 66 | return pNtH; 67 | } 68 | 69 | PIMAGE_FILE_HEADER GetFileHeader(LPVOID ImageBase) 70 | { 71 | PIMAGE_DOS_HEADER pDH=NULL; 72 | PIMAGE_NT_HEADERS pNtH=NULL; 73 | PIMAGE_FILE_HEADER pFH=NULL; 74 | 75 | if (!IsPEFile(ImageBase)) 76 | return NULL; 77 | pDH = (PIMAGE_DOS_HEADER)ImageBase; 78 | pNtH = (PIMAGE_NT_HEADERS)UIntToPtr(PtrToUint(pDH) + pDH->e_lfanew); 79 | pFH = &pNtH->FileHeader; 80 | return pFH; 81 | } 82 | 83 | PIMAGE_OPTIONAL_HEADER GetOptionalHeader(LPVOID ImageBase) 84 | { 85 | PIMAGE_DOS_HEADER pDH=NULL; 86 | PIMAGE_NT_HEADERS pNtH=NULL; 87 | PIMAGE_OPTIONAL_HEADER pOH=NULL; 88 | 89 | if (!IsPEFile(ImageBase)) 90 | return NULL; 91 | 92 | pDH = (PIMAGE_DOS_HEADER)ImageBase; 93 | pNtH = (PIMAGE_NT_HEADERS)UIntToPtr(PtrToUint(pDH) + pDH->e_lfanew); 94 | pOH = &pNtH->OptionalHeader; 95 | return pOH; 96 | } 97 | 98 | PIMAGE_SECTION_HEADER GetFirstSectionHeader(LPVOID ImageBase) 99 | { 100 | PIMAGE_NT_HEADERS pNtH=NULL; 101 | PIMAGE_SECTION_HEADER pSH=NULL; 102 | 103 | pNtH = GetNtHeaders(ImageBase); 104 | pSH = IMAGE_FIRST_SECTION(pNtH); 105 | return pSH; 106 | } 107 | 108 | const std::wstring GetModuleIndexString(void *pModBase, BOOL bPDB) 109 | { 110 | wchar_t sig[128] = {0}; 111 | if (!IsPEFile(pModBase)) 112 | { 113 | assert(0); 114 | return std::wstring(); 115 | } 116 | 117 | if (!bPDB) //time stamp and size of the image for a executable file 118 | { 119 | IMAGE_NT_HEADERS *pNTHeaders = GetNtHeaders(pModBase); 120 | assert(pNTHeaders); 121 | if (pNTHeaders) 122 | swprintf_s(sig, L"%08X%x", pNTHeaders->FileHeader.TimeDateStamp, pNTHeaders->OptionalHeader.SizeOfImage); 123 | } 124 | else // signature and age for a pdb file. 125 | { 126 | do 127 | { 128 | PIMAGE_NT_HEADERS pNtH=NULL; 129 | PIMAGE_OPTIONAL_HEADER pOH=NULL; 130 | 131 | pNtH = GetNtHeaders(pModBase); 132 | if (!pNtH) 133 | return std::wstring(); 134 | pOH = GetOptionalHeader(pModBase); 135 | if (!pOH) 136 | return std::wstring(); 137 | 138 | IMAGE_DEBUG_DIRECTORY *pDebugDir = (IMAGE_DEBUG_DIRECTORY*)((BYTE*)pModBase + pOH->DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].VirtualAddress); 139 | 140 | ULONG size = pOH->DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].Size; 141 | 142 | //assert(pDebugDir && size == sizeof(IMAGE_DEBUG_DIRECTORY)); 143 | if (!pDebugDir || size == 0 || size % sizeof(IMAGE_DEBUG_DIRECTORY) != 0) 144 | break; 145 | 146 | if (IsBadReadPtr(pDebugDir, size)) 147 | { 148 | assert(0); 149 | break; 150 | } 151 | if (!pDebugDir->AddressOfRawData) 152 | break; 153 | 154 | LPBYTE pDebugInfo = (LPBYTE)pModBase + pDebugDir->AddressOfRawData; 155 | ULONG ulDebugSize = pDebugDir->SizeOfData; 156 | assert(pDebugDir->Type == IMAGE_DEBUG_TYPE_CODEVIEW); 157 | if (pDebugDir->Type != IMAGE_DEBUG_TYPE_CODEVIEW) 158 | break; 159 | 160 | if (IsBadReadPtr(pDebugInfo, ulDebugSize)) 161 | { 162 | assert(0); 163 | break; 164 | } 165 | 166 | DWORD CvSignature = *(DWORD*)pDebugInfo; 167 | if (CvSignature == CV_SIGNATURE_NB10)//CodeView format: NB10 168 | { 169 | // NB10 -> PDB 2.00 170 | CV_INFO_PDB20* pCvInfo = (CV_INFO_PDB20*)pDebugInfo; 171 | if (IsBadReadPtr( pDebugInfo, sizeof(CV_INFO_PDB20)) 172 | || IsBadStringPtrA( (CHAR*)pCvInfo->PdbFileName, UINT_MAX)) 173 | { 174 | assert(0); 175 | break; 176 | } 177 | 178 | swprintf_s(sig, L"%08X%x", pCvInfo->Signature, pCvInfo->Age); 179 | } 180 | else if( CvSignature == CV_SIGNATURE_RSDS ) 181 | { 182 | // RSDS -> PDB 7.00 183 | CV_INFO_PDB70* pCvInfo = (CV_INFO_PDB70*)pDebugInfo; 184 | if (IsBadReadPtr(pDebugInfo, sizeof(CV_INFO_PDB70)) 185 | || IsBadStringPtrA((CHAR*)pCvInfo->PdbFileName, UINT_MAX)) 186 | { 187 | assert(0); 188 | break; 189 | } 190 | 191 | swprintf_s(sig, L"%08X%04X%04X%02X%02X%02X%02X%02X%02X%02X%02X%x", 192 | pCvInfo->Signature.Data1, pCvInfo->Signature.Data2, pCvInfo->Signature.Data3, 193 | pCvInfo->Signature.Data4[0], pCvInfo->Signature.Data4[1], pCvInfo->Signature.Data4[2], 194 | pCvInfo->Signature.Data4[3], pCvInfo->Signature.Data4[4], pCvInfo->Signature.Data4[5], 195 | pCvInfo->Signature.Data4[6], pCvInfo->Signature.Data4[7], 196 | pCvInfo->Age); 197 | } 198 | else 199 | { 200 | assert(0); 201 | break; 202 | } 203 | 204 | } while (0); 205 | } 206 | 207 | 208 | //assert(wcslen(sig) > 0); 209 | return std::wstring(sig); 210 | } -------------------------------------------------------------------------------- /HSHook/detours/detver.h: -------------------------------------------------------------------------------- 1 | ////////////////////////////////////////////////////////////////////////////// 2 | // 3 | // Common version parameters. 4 | // 5 | // Microsoft Research Detours Package, Version 3.0 Build_316. 6 | // 7 | // Copyright (c) Microsoft Corporation. All rights reserved. 8 | // 9 | 10 | #ifndef DETOURS_STRINGIFY 11 | #define DETOURS_STRINGIFY(x) DETOURS_STRINGIFY_(x) 12 | #define DETOURS_STRINGIFY_(x) #x 13 | #endif 14 | 15 | #define VER_FILEFLAGSMASK 0x3fL 16 | #define VER_FILEFLAGS 0x0L 17 | #define VER_FILEOS 0x00040004L 18 | #define VER_FILETYPE 0x00000002L 19 | #define VER_FILESUBTYPE 0x00000000L 20 | 21 | #define VER_DETOURS_BITS DETOUR_STRINGIFY(DETOURS_BITS) 22 | -------------------------------------------------------------------------------- /HSHook/detours/uimports.cpp: -------------------------------------------------------------------------------- 1 | ////////////////////////////////////////////////////////////////////////////// 2 | // 3 | // Add DLLs to a module import table (uimports.cpp of detours.lib) 4 | // 5 | // Microsoft Research Detours Package, Version 3.0 Build_316. 6 | // 7 | // Copyright (c) Microsoft Corporation. All rights reserved. 8 | // 9 | // Note that this file is included into creatwth.cpp one or more times 10 | // (once for each supported module format). 11 | // 12 | 13 | // UpdateImports32 aka UpdateImports64 14 | static BOOL UPDATE_IMPORTS_XX(HANDLE hProcess, 15 | HMODULE hModule, 16 | LPCSTR *plpDlls, 17 | DWORD nDlls) 18 | { 19 | BOOL fSucceeded = FALSE; 20 | BYTE * pbNew = NULL; 21 | DWORD i; 22 | 23 | PBYTE pbModule = (PBYTE)hModule; 24 | 25 | IMAGE_DOS_HEADER idh; 26 | ZeroMemory(&idh, sizeof(idh)); 27 | if (!ReadProcessMemory(hProcess, pbModule, &idh, sizeof(idh), NULL)) { 28 | DETOUR_TRACE(("ReadProcessMemory(idh@%p..%p) failed: %d\n", 29 | pbModule, pbModule + sizeof(idh), GetLastError())); 30 | 31 | finish: 32 | if (pbNew != NULL) { 33 | delete[] pbNew; 34 | pbNew = NULL; 35 | } 36 | return fSucceeded; 37 | } 38 | 39 | IMAGE_NT_HEADERS_XX inh; 40 | ZeroMemory(&inh, sizeof(inh)); 41 | 42 | if (!ReadProcessMemory(hProcess, pbModule + idh.e_lfanew, &inh, sizeof(inh), NULL)) { 43 | DETOUR_TRACE(("ReadProcessMemory(inh@%p..%p) failed: %d\n", 44 | pbModule + idh.e_lfanew, 45 | pbModule + idh.e_lfanew + sizeof(inh), 46 | GetLastError())); 47 | goto finish; 48 | } 49 | 50 | if (inh.OptionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR_MAGIC_XX) { 51 | DETOUR_TRACE(("Wrong size image (%04x != %04x).\n", 52 | inh.OptionalHeader.Magic, IMAGE_NT_OPTIONAL_HDR_MAGIC_XX)); 53 | SetLastError(ERROR_INVALID_BLOCK); 54 | goto finish; 55 | } 56 | 57 | // Zero out the bound table so loader doesn't use it instead of our new table. 58 | inh.BOUND_DIRECTORY.VirtualAddress = 0; 59 | inh.BOUND_DIRECTORY.Size = 0; 60 | 61 | // Find the size of the mapped file. 62 | DWORD dwFileSize = 0; 63 | DWORD dwSec = idh.e_lfanew + 64 | FIELD_OFFSET(IMAGE_NT_HEADERS_XX, OptionalHeader) + 65 | inh.FileHeader.SizeOfOptionalHeader; 66 | 67 | for (i = 0; i < inh.FileHeader.NumberOfSections; i++) { 68 | IMAGE_SECTION_HEADER ish; 69 | ZeroMemory(&ish, sizeof(ish)); 70 | 71 | if (!ReadProcessMemory(hProcess, pbModule + dwSec + sizeof(ish) * i, &ish, 72 | sizeof(ish), NULL)) { 73 | DETOUR_TRACE(("ReadProcessMemory(ish@%p..%p) failed: %d\n", 74 | pbModule + dwSec + sizeof(ish) * i, 75 | pbModule + dwSec + sizeof(ish) * (i + 1), 76 | GetLastError())); 77 | goto finish; 78 | } 79 | 80 | DETOUR_TRACE(("ish[%d] : va=%08x sr=%d\n", i, ish.VirtualAddress, ish.SizeOfRawData)); 81 | 82 | // If the file didn't have an IAT_DIRECTORY, we assign it... 83 | if (inh.IAT_DIRECTORY.VirtualAddress == 0 && 84 | inh.IMPORT_DIRECTORY.VirtualAddress >= ish.VirtualAddress && 85 | inh.IMPORT_DIRECTORY.VirtualAddress < ish.VirtualAddress + ish.SizeOfRawData) { 86 | 87 | inh.IAT_DIRECTORY.VirtualAddress = ish.VirtualAddress; 88 | inh.IAT_DIRECTORY.Size = ish.SizeOfRawData; 89 | } 90 | 91 | // Find the end of the file... 92 | if (dwFileSize < ish.PointerToRawData + ish.SizeOfRawData) { 93 | dwFileSize = ish.PointerToRawData + ish.SizeOfRawData; 94 | } 95 | } 96 | DETOUR_TRACE(("dwFileSize = %08x\n", dwFileSize)); 97 | 98 | #if IGNORE_CHECKSUMS 99 | // Find the current checksum. 100 | WORD wBefore = ComputeChkSum(hProcess, pbModule, &inh); 101 | DETOUR_TRACE(("ChkSum: %04x + %08x => %08x\n", wBefore, dwFileSize, wBefore + dwFileSize)); 102 | #endif 103 | 104 | DETOUR_TRACE((" Imports: %p..%p\n", 105 | (DWORD_PTR)pbModule + inh.IMPORT_DIRECTORY.VirtualAddress, 106 | (DWORD_PTR)pbModule + inh.IMPORT_DIRECTORY.VirtualAddress + 107 | inh.IMPORT_DIRECTORY.Size)); 108 | 109 | DWORD obRem = sizeof(IMAGE_IMPORT_DESCRIPTOR) * nDlls; 110 | DWORD obTab = PadToDwordPtr(obRem + 111 | inh.IMPORT_DIRECTORY.Size + 112 | sizeof(IMAGE_IMPORT_DESCRIPTOR)); 113 | DWORD obDll = obTab + sizeof(DWORD_XX) * 4 * nDlls; 114 | DWORD obStr = obDll; 115 | DWORD cbNew = obStr; 116 | DWORD n; 117 | for (n = 0; n < nDlls; n++) { 118 | cbNew += PadToDword((DWORD)strlen(plpDlls[n]) + 1); 119 | } 120 | 121 | pbNew = new BYTE [cbNew]; 122 | if (pbNew == NULL) { 123 | DETOUR_TRACE(("new BYTE [cbNew] failed.\n")); 124 | goto finish; 125 | } 126 | ZeroMemory(pbNew, cbNew); 127 | 128 | PBYTE pbBase = pbModule; 129 | PBYTE pbNext = pbBase 130 | + inh.OptionalHeader.BaseOfCode 131 | + inh.OptionalHeader.SizeOfCode 132 | + inh.OptionalHeader.SizeOfInitializedData 133 | + inh.OptionalHeader.SizeOfUninitializedData; 134 | if (pbBase < pbNext) { 135 | pbBase = pbNext; 136 | } 137 | DETOUR_TRACE(("pbBase = %p\n", pbBase)); 138 | 139 | PBYTE pbNewIid = FindAndAllocateNearBase(hProcess, pbBase, cbNew); 140 | if (pbNewIid == NULL) { 141 | DETOUR_TRACE(("FindAndAllocateNearBase failed.\n")); 142 | goto finish; 143 | } 144 | 145 | DWORD obBase = (DWORD)(pbNewIid - pbModule); 146 | DWORD dwProtect = 0; 147 | if (inh.IMPORT_DIRECTORY.VirtualAddress != 0) { 148 | // Read the old import directory if it exists. 149 | #if 0 150 | if (!VirtualProtectEx(hProcess, 151 | pbModule + inh.IMPORT_DIRECTORY.VirtualAddress, 152 | inh.IMPORT_DIRECTORY.Size, PAGE_EXECUTE_READWRITE, &dwProtect)) { 153 | DETOUR_TRACE(("VirtualProtectEx(import) write failed: %d\n", GetLastError())); 154 | goto finish; 155 | } 156 | #endif 157 | DETOUR_TRACE(("IMPORT_DIRECTORY perms=%x\n", dwProtect)); 158 | 159 | if (!ReadProcessMemory(hProcess, 160 | pbModule + inh.IMPORT_DIRECTORY.VirtualAddress, 161 | pbNew + obRem, 162 | inh.IMPORT_DIRECTORY.Size, NULL)) { 163 | DETOUR_TRACE(("ReadProcessMemory(imports) failed: %d\n", GetLastError())); 164 | goto finish; 165 | } 166 | } 167 | 168 | PIMAGE_IMPORT_DESCRIPTOR piid = (PIMAGE_IMPORT_DESCRIPTOR)pbNew; 169 | DWORD_XX *pt; 170 | 171 | for (n = 0; n < nDlls; n++) { 172 | HRESULT hrRet = StringCchCopyA((char*)pbNew + obStr, cbNew - obStr, plpDlls[n]); 173 | if (FAILED(hrRet)) { 174 | DETOUR_TRACE(("StringCchCopyA failed: %d\n", GetLastError())); 175 | goto finish; 176 | } 177 | 178 | // After copying the string, we patch up the size "??" bits if any. 179 | hrRet = ReplaceOptionalSizeA((char*)pbNew + obStr, 180 | cbNew - obStr, 181 | DETOURS_STRINGIFY(DETOURS_BITS_XX)); 182 | if (FAILED(hrRet)) { 183 | DETOUR_TRACE(("ReplaceOptionalSizeA failed: %d\n", GetLastError())); 184 | goto finish; 185 | } 186 | 187 | DWORD nOffset = obTab + (sizeof(DWORD_XX) * (4 * n)); 188 | piid[n].OriginalFirstThunk = obBase + nOffset; 189 | pt = ((DWORD_XX*)(pbNew + nOffset)); 190 | pt[0] = IMAGE_ORDINAL_FLAG_XX + 1; 191 | pt[1] = 0; 192 | 193 | nOffset = obTab + (sizeof(DWORD_XX) * ((4 * n) + 2)); 194 | piid[n].FirstThunk = obBase + nOffset; 195 | pt = ((DWORD_XX*)(pbNew + nOffset)); 196 | pt[0] = IMAGE_ORDINAL_FLAG_XX + 1; 197 | pt[1] = 0; 198 | piid[n].TimeDateStamp = 0; 199 | piid[n].ForwarderChain = 0; 200 | piid[n].Name = obBase + obStr; 201 | 202 | obStr += PadToDword((DWORD)strlen(plpDlls[n]) + 1); 203 | } 204 | 205 | for (i = 0; i < nDlls + (inh.IMPORT_DIRECTORY.Size / sizeof(*piid)); i++) { 206 | DETOUR_TRACE(("%8d. Look=%08x Time=%08x Fore=%08x Name=%08x Addr=%08x\n", 207 | i, 208 | piid[i].OriginalFirstThunk, 209 | piid[i].TimeDateStamp, 210 | piid[i].ForwarderChain, 211 | piid[i].Name, 212 | piid[i].FirstThunk)); 213 | if (piid[i].OriginalFirstThunk == 0 && piid[i].FirstThunk == 0) { 214 | break; 215 | } 216 | } 217 | 218 | if (!WriteProcessMemory(hProcess, pbNewIid, pbNew, obStr, NULL)) { 219 | DETOUR_TRACE(("WriteProcessMemory(iid) failed: %d\n", GetLastError())); 220 | goto finish; 221 | } 222 | 223 | DETOUR_TRACE(("obBaseBef = %08x..%08x\n", 224 | inh.IMPORT_DIRECTORY.VirtualAddress, 225 | inh.IMPORT_DIRECTORY.VirtualAddress + inh.IMPORT_DIRECTORY.Size)); 226 | DETOUR_TRACE(("obBaseAft = %08x..%08x\n", obBase, obBase + obStr)); 227 | 228 | // If the file doesn't have an IAT_DIRECTORY, we create it... 229 | if (inh.IAT_DIRECTORY.VirtualAddress == 0) { 230 | inh.IAT_DIRECTORY.VirtualAddress = obBase; 231 | inh.IAT_DIRECTORY.Size = cbNew; 232 | } 233 | 234 | inh.IMPORT_DIRECTORY.VirtualAddress = obBase; 235 | inh.IMPORT_DIRECTORY.Size = cbNew; 236 | 237 | /////////////////////// Update the NT header for the new import directory. 238 | /////////////////////////////// Update the DOS header to fix the checksum. 239 | // 240 | if (!VirtualProtectEx(hProcess, pbModule, inh.OptionalHeader.SizeOfHeaders, 241 | PAGE_EXECUTE_READWRITE, &dwProtect)) { 242 | DETOUR_TRACE(("VirtualProtectEx(inh) write failed: %d\n", GetLastError())); 243 | goto finish; 244 | } 245 | 246 | #if IGNORE_CHECKSUMS 247 | idh.e_res[0] = 0; 248 | #else 249 | inh.OptionalHeader.CheckSum = 0; 250 | #endif // IGNORE_CHECKSUMS 251 | 252 | if (!WriteProcessMemory(hProcess, pbModule, &idh, sizeof(idh), NULL)) { 253 | DETOUR_TRACE(("WriteProcessMemory(idh) failed: %d\n", GetLastError())); 254 | goto finish; 255 | } 256 | DETOUR_TRACE(("WriteProcessMemory(idh:%p..%p)\n", pbModule, pbModule + sizeof(idh))); 257 | 258 | if (!WriteProcessMemory(hProcess, pbModule + idh.e_lfanew, &inh, sizeof(inh), NULL)) { 259 | DETOUR_TRACE(("WriteProcessMemory(inh) failed: %d\n", GetLastError())); 260 | goto finish; 261 | } 262 | DETOUR_TRACE(("WriteProcessMemory(inh:%p..%p)\n", 263 | pbModule + idh.e_lfanew, 264 | pbModule + idh.e_lfanew + sizeof(inh))); 265 | 266 | #if IGNORE_CHECKSUMS 267 | WORD wDuring = ComputeChkSum(hProcess, pbModule, &inh); 268 | DETOUR_TRACE(("ChkSum: %04x + %08x => %08x\n", wDuring, dwFileSize, wDuring + dwFileSize)); 269 | 270 | idh.e_res[0] = detour_sum_minus(idh.e_res[0], detour_sum_minus(wDuring, wBefore)); 271 | 272 | if (!WriteProcessMemory(hProcess, pbModule, &idh, sizeof(idh), NULL)) { 273 | DETOUR_TRACE(("WriteProcessMemory(idh) failed: %d\n", GetLastError())); 274 | goto finish; 275 | } 276 | #endif // IGNORE_CHECKSUMS 277 | 278 | if (!VirtualProtectEx(hProcess, pbModule, inh.OptionalHeader.SizeOfHeaders, 279 | dwProtect, &dwProtect)) { 280 | DETOUR_TRACE(("VirtualProtectEx(idh) restore failed: %d\n", GetLastError())); 281 | goto finish; 282 | } 283 | 284 | #if IGNORE_CHECKSUMS 285 | WORD wAfter = ComputeChkSum(hProcess, pbModule, &inh); 286 | DETOUR_TRACE(("ChkSum: %04x + %08x => %08x\n", wAfter, dwFileSize, wAfter + dwFileSize)); 287 | DETOUR_TRACE(("Before: %08x, After: %08x\n", wBefore + dwFileSize, wAfter + dwFileSize)); 288 | 289 | if (wBefore != wAfter) { 290 | DETOUR_TRACE(("Restore of checksum failed %04x != %04x.\n", wBefore, wAfter)); 291 | goto finish; 292 | } 293 | #endif // IGNORE_CHECKSUMS 294 | 295 | fSucceeded = TRUE; 296 | goto finish; 297 | } 298 | 299 | -------------------------------------------------------------------------------- /HSHook/dprintf/DPrintf.cpp: -------------------------------------------------------------------------------- 1 | #ifdef _DEBUG 2 | #include 3 | #include 4 | #include 5 | 6 | #define DEBUG_STRING_MAX_LENGTH 1024 7 | 8 | int _cdecl DPrintf(CONST TCHAR *format, ...) 9 | { 10 | va_list arglist; 11 | TCHAR tchDebugString[DEBUG_STRING_MAX_LENGTH]; 12 | int nBufLen = -1; 13 | 14 | ZeroMemory(tchDebugString, DEBUG_STRING_MAX_LENGTH*sizeof(TCHAR)); 15 | 16 | if (format == NULL) 17 | { 18 | OutputDebugString(_T("DebugPrintf() FAILED: Format is null pointer!\r\n")); 19 | return nBufLen; 20 | } 21 | 22 | va_start(arglist, format); 23 | nBufLen = _vstprintf_s((TCHAR *)tchDebugString, DEBUG_STRING_MAX_LENGTH, format, arglist); 24 | 25 | if (nBufLen == -1) 26 | { 27 | OutputDebugString(_T("DebugPrintf() FAILED: String is too long!\r\n")); 28 | return nBufLen; 29 | } 30 | 31 | //OutputDebugString(_T("DebugPrintf:")); 32 | OutputDebugString(tchDebugString); 33 | return nBufLen; 34 | }; 35 | #else 36 | #define DPrintf __noop 37 | #endif -------------------------------------------------------------------------------- /HSHook/dprintf/DPrintf.h: -------------------------------------------------------------------------------- 1 | #ifndef __DPRINTF_H__ 2 | #define __DPRINTF_H__ 3 | #ifdef _DEBUG 4 | int _cdecl DPrintf(CONST TCHAR *format, ...); 5 | #else 6 | #define DPrintf __noop 7 | #endif 8 | #endif -------------------------------------------------------------------------------- /HSHook/resource.h: -------------------------------------------------------------------------------- 1 | //{{NO_DEPENDENCIES}} 2 | // Microsoft Visual C++ generated include file. 3 | // Used by HSHook.rc 4 | 5 | // Next default values for new objects 6 | // 7 | #ifdef APSTUDIO_INVOKED 8 | #ifndef APSTUDIO_READONLY_SYMBOLS 9 | #define _APS_NEXT_RESOURCE_VALUE 101 10 | #define _APS_NEXT_COMMAND_VALUE 40001 11 | #define _APS_NEXT_CONTROL_VALUE 1001 12 | #define _APS_NEXT_SYMED_VALUE 101 13 | #endif 14 | #endif 15 | -------------------------------------------------------------------------------- /HSHook/stdafx.cpp: -------------------------------------------------------------------------------- 1 | // stdafx.cpp : source file that includes just the standard includes 2 | // HSHook.pch will be the pre-compiled header 3 | // stdafx.obj will contain the pre-compiled type information 4 | 5 | #include "stdafx.h" 6 | 7 | CWitlessCriticalSection g_csForStackDataBuffer; 8 | 9 | // TODO: reference any additional headers you need in STDAFX.H 10 | // and not in this file 11 | -------------------------------------------------------------------------------- /HSHook/stdafx.h: -------------------------------------------------------------------------------- 1 | // stdafx.h : include file for standard system include files, 2 | // or project specific include files that are used frequently, but 3 | // are changed infrequently 4 | // 5 | 6 | #pragma once 7 | 8 | // Modify the following defines if you have to target a platform prior to the ones specified below. 9 | // Refer to MSDN for the latest info on corresponding values for different platforms. 10 | #ifndef WINVER // Allow use of features specific to Windows XP or later. 11 | #define WINVER 0x0501 // Change this to the appropriate value to target other versions of Windows. 12 | #endif 13 | 14 | #ifndef _WIN32_WINNT // Allow use of features specific to Windows XP or later. 15 | #define _WIN32_WINNT 0x0501 // Change this to the appropriate value to target other versions of Windows. 16 | #endif 17 | 18 | #ifndef _WIN32_WINDOWS // Allow use of features specific to Windows 98 or later. 19 | #define _WIN32_WINDOWS 0x0410 // Change this to the appropriate value to target Windows Me or later. 20 | #endif 21 | 22 | #ifndef _WIN32_IE // Allow use of features specific to IE 6.0 or later. 23 | #define _WIN32_IE 0x0600 // Change this to the appropriate value to target other versions of IE. 24 | #endif 25 | 26 | #define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers 27 | // Windows Header Files: 28 | #include 29 | #include 30 | 31 | #define INJECTED_MODULE 32 | 33 | #include "WitlessCriticalSection.h" 34 | #define EnterCriticalSection(x) {x.Enter();} 35 | #define LeaveCriticalSection(x) {x.Leave();} 36 | 37 | 38 | // TODO: reference additional headers your program requires here 39 | -------------------------------------------------------------------------------- /HandleSpy/AboutDlg.h: -------------------------------------------------------------------------------- 1 | // aboutdlg.h : interface of the CAboutDlg class 2 | // 3 | ///////////////////////////////////////////////////////////////////////////// 4 | 5 | #pragma once 6 | 7 | class CAboutDlg : public CDialogImpl 8 | { 9 | public: 10 | enum { IDD = IDD_ABOUTBOX }; 11 | 12 | BEGIN_MSG_MAP(CAboutDlg) 13 | MESSAGE_HANDLER(WM_INITDIALOG, OnInitDialog) 14 | COMMAND_ID_HANDLER(IDOK, OnCloseCmd) 15 | COMMAND_ID_HANDLER(IDCANCEL, OnCloseCmd) 16 | END_MSG_MAP() 17 | 18 | // Handler prototypes (uncomment arguments if needed): 19 | // LRESULT MessageHandler(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/) 20 | // LRESULT CommandHandler(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) 21 | // LRESULT NotifyHandler(int /*idCtrl*/, LPNMHDR /*pnmh*/, BOOL& /*bHandled*/) 22 | 23 | LRESULT OnInitDialog(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/) 24 | { 25 | CenterWindow(GetParent()); 26 | return TRUE; 27 | } 28 | 29 | LRESULT OnCloseCmd(WORD /*wNotifyCode*/, WORD wID, HWND /*hWndCtl*/, BOOL& /*bHandled*/) 30 | { 31 | EndDialog(wID); 32 | return 0; 33 | } 34 | }; 35 | -------------------------------------------------------------------------------- /HandleSpy/Api.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/Api.cpp -------------------------------------------------------------------------------- /HandleSpy/Api.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | class CApi 4 | { 5 | public: 6 | static TCHAR* GetNameByIndex(DWORD dwIndex); 7 | private: 8 | static TCHAR* Name[]; 9 | 10 | static TCHAR* invalidIndex; 11 | }; 12 | -------------------------------------------------------------------------------- /HandleSpy/ApiListView.cpp: -------------------------------------------------------------------------------- 1 | #include "StdAfx.h" 2 | #include "ApiListView.h" 3 | #include "StackDlg.h" 4 | 5 | CApiListView::CApiListView(void) 6 | { 7 | 8 | } 9 | 10 | CApiListView::~CApiListView(void) 11 | { 12 | } 13 | 14 | BOOL CApiListView::PreTranslateMessage(MSG* pMsg) 15 | { 16 | pMsg; 17 | return FALSE; 18 | } -------------------------------------------------------------------------------- /HandleSpy/ApiListView.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include "CallStackTypeDefine.h" 3 | #include "atlwin.h" 4 | 5 | class CApiListView : 6 | public CWindowImpl 7 | { 8 | public: 9 | public: 10 | DECLARE_WND_SUPERCLASS(NULL, CListViewCtrl::GetWndClassName()) 11 | 12 | BOOL PreTranslateMessage(MSG* pMsg); 13 | 14 | CApiListView(void); 15 | ~CApiListView(void); 16 | 17 | BEGIN_MSG_MAP(CApiListView) 18 | END_MSG_MAP() 19 | 20 | 21 | // Handler prototypes (uncomment arguments if needed): 22 | // LRESULT MessageHandler(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/) 23 | // LRESULT CommandHandler(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) 24 | // LRESULT NotifyHandler(int /*idCtrl*/, LPNMHDR /*pnmh*/, BOOL& /*bHandled*/) 25 | }; 26 | -------------------------------------------------------------------------------- /HandleSpy/CProgressBarDlg.cpp: -------------------------------------------------------------------------------- 1 | #include "StdAfx.h" 2 | #include "CProgressBarDlg.h" 3 | 4 | 5 | LRESULT CCProgressBarDlg::OnInitDialog(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/) 6 | { 7 | CenterWindow(); 8 | return TRUE; 9 | } 10 | 11 | LRESULT CCProgressBarDlg::OnCloseCmd(WORD /*wNotifyCode*/, WORD wID, HWND /*hWndCtl*/, BOOL& /*bHandled*/) 12 | { 13 | EndDialog(wID); 14 | return 0; 15 | } -------------------------------------------------------------------------------- /HandleSpy/CProgressBarDlg.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | class CCProgressBarDlg : 3 | public CDialogImpl 4 | { 5 | public: 6 | enum { IDD = IDD_DIALOG_PROGRESS }; 7 | 8 | BEGIN_MSG_MAP(CCProgressBarDlg) 9 | MESSAGE_HANDLER(WM_INITDIALOG, OnInitDialog) 10 | COMMAND_ID_HANDLER(IDOK, OnCloseCmd) 11 | COMMAND_ID_HANDLER(IDCANCEL, OnCloseCmd) 12 | END_MSG_MAP() 13 | 14 | // Handler prototypes (uncomment arguments if needed): 15 | // LRESULT MessageHandler(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/) 16 | // LRESULT CommandHandler(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) 17 | // LRESULT NotifyHandler(int /*idCtrl*/, LPNMHDR /*pnmh*/, BOOL& /*bHandled*/) 18 | 19 | LRESULT OnInitDialog(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/); 20 | LRESULT OnCloseCmd(WORD /*wNotifyCode*/, WORD wID, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 21 | }; 22 | 23 | -------------------------------------------------------------------------------- /HandleSpy/ChartView.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/ChartView.cpp -------------------------------------------------------------------------------- /HandleSpy/ChartView.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/ChartView.h -------------------------------------------------------------------------------- /HandleSpy/DetectDlg.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/DetectDlg.cpp -------------------------------------------------------------------------------- /HandleSpy/DetectDlg.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include "atlwin.h" 3 | #include "Detector.h" 4 | #include "ChartView.h" 5 | #include "CountAndTimeTypeDefine.h" 6 | 7 | class CDetectDlg : 8 | public CDialogImpl 9 | { 10 | public: 11 | enum { IDD = IDD_DIALOG_DETECT }; 12 | 13 | BEGIN_MSG_MAP(CAboutDlg) 14 | MESSAGE_HANDLER(WM_INITDIALOG, OnInitDialog) 15 | COMMAND_ID_HANDLER(IDCANCEL, OnCloseCmd) 16 | COMMAND_HANDLER(ID_STOP, BN_CLICKED, OnBnClickedStop) 17 | MESSAGE_HANDLER(WM_TIMER, OnTimer) 18 | MESSAGE_HANDLER(HSMSG_TARGETPROCESSEXIT, OnTargetProcessExit) 19 | END_MSG_MAP() 20 | 21 | CDetectDlg(void); 22 | 23 | void SetArrayPointer(std::vector* p); 24 | 25 | // Handler prototypes (uncomment arguments if needed): 26 | // LRESULT MessageHandler(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/) 27 | // LRESULT CommandHandler(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) 28 | // LRESULT NotifyHandler(int /*idCtrl*/, LPNMHDR /*pnmh*/, BOOL& /*bHandled*/) 29 | 30 | LRESULT OnInitDialog(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM lParam, BOOL& /*bHandled*/); 31 | LRESULT OnCloseCmd(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 32 | LRESULT OnTimer(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& bHandled); 33 | LRESULT OnBnClickedStop(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 34 | LRESULT OnTargetProcessExit(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& bHandled); 35 | 36 | private: 37 | CChartView m_chart; 38 | CDetector m_detector; 39 | 40 | std::vector* m_pArray; 41 | }; 42 | -------------------------------------------------------------------------------- /HandleSpy/Detector.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/Detector.cpp -------------------------------------------------------------------------------- /HandleSpy/Detector.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | 4 | #define HSMSG_TARGETPROCESSEXIT WM_USER+0x100 5 | 6 | class CDetector 7 | { 8 | public: 9 | 10 | CDetector(); 11 | ~CDetector(void); 12 | 13 | BOOL Init(DWORD pid, HWND h); 14 | 15 | BOOL Start(); 16 | BOOL Stop(); 17 | 18 | BOOL InjectHSHook(); 19 | BOOL UnInjectHSHook(); 20 | 21 | BOOL GetHandleCount(DWORD* pdwCount); 22 | 23 | private: 24 | HWND m_hWndHolder; 25 | DWORD m_dwPid; 26 | BOOL m_bIsWorking; 27 | HANDLE m_hProcess; 28 | HMODULE m_hInjectedModule; 29 | CStringA m_strDllPath; 30 | }; 31 | -------------------------------------------------------------------------------- /HandleSpy/FuncCallDlg.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/FuncCallDlg.cpp -------------------------------------------------------------------------------- /HandleSpy/FuncCallDlg.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "CallStackTypeDefine.h" 4 | #include "StackDlg.h" 5 | #include "ProgressDlg.h" 6 | 7 | class CFuncCallDlg : public CDialogImpl 8 | { 9 | public: 10 | enum {IDD = IDD_DIALOG_FUNCCALL}; 11 | CFuncCallDlg(DWORD dwBegin, DWORD dwEnd); 12 | ~CFuncCallDlg(void); 13 | 14 | public: 15 | BEGIN_MSG_MAP(CFuncCallDlg) 16 | MESSAGE_HANDLER(WM_INITDIALOG, OnInitDialog) 17 | COMMAND_ID_HANDLER(IDCANCEL, OnCloseCmd) 18 | NOTIFY_CODE_HANDLER(NM_DBLCLK, OnNmDbClick) 19 | COMMAND_HANDLER(IDC_BUTTON_SHOWALL, BN_CLICKED, OnBnClickedButtonShowall) 20 | COMMAND_HANDLER(IDC_BUTTON_ONLYLEAK, BN_CLICKED, OnBnClickedButtonOnlyleak) 21 | COMMAND_HANDLER(IDC_BUTTON_SMARTFILTER, BN_CLICKED, OnBnClickedButtonSmartfilter) 22 | END_MSG_MAP() 23 | 24 | void ShowAll(); 25 | void ShowLeak(); 26 | 27 | void ShowStackDlg(CALL_STACK* pCs, LPCTSTR lpText); 28 | void ReleaseAllStackDlg(); 29 | 30 | void AdvanceFilter(std::vector& vecSrc, std::vector& vecDst); 31 | BOOL SimpleFilter(const std::vector& vecSrc, std::vector& vecDst); 32 | 33 | public: 34 | BOOL OnInitDialog(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/); 35 | LRESULT OnCloseCmd(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 36 | LRESULT OnBnClickedCancel(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 37 | LRESULT OnNmDbClick(int /*idCtrl*/, LPNMHDR /*pnmh*/, BOOL& /*bHandled*/); 38 | LRESULT OnBnClickedButtonShowall(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 39 | LRESULT OnBnClickedButtonOnlyleak(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 40 | LRESULT OnBnClickedButtonSmartfilter(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 41 | 42 | private: 43 | CListViewCtrl m_listFuncCall; 44 | DWORD m_BeginPos; 45 | DWORD m_EndPos; 46 | std::vector m_AllSrcVec; 47 | std::vector m_AdvanceFilterVec; 48 | std::vector m_SimpleFilterVec; 49 | 50 | std::map m_CallstackDlgMap; 51 | 52 | CProgressDlg m_Progress; 53 | }; -------------------------------------------------------------------------------- /HandleSpy/HandleSpy.aps: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/HandleSpy.aps -------------------------------------------------------------------------------- /HandleSpy/HandleSpy.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/HandleSpy.cpp -------------------------------------------------------------------------------- /HandleSpy/HandleSpy.h: -------------------------------------------------------------------------------- 1 | // HandleSpy.h 2 | -------------------------------------------------------------------------------- /HandleSpy/HandleSpy.rc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/HandleSpy.rc -------------------------------------------------------------------------------- /HandleSpy/HandleSpy.vcproj: -------------------------------------------------------------------------------- 1 | 2 | 10 | 11 | 14 | 15 | 16 | 17 | 18 | 26 | 29 | 32 | 35 | 38 | 50 | 62 | 65 | 71 | 74 | 83 | 86 | 89 | 92 | 95 | 98 | 101 | 104 | 105 | 113 | 116 | 119 | 122 | 125 | 137 | 148 | 151 | 157 | 160 | 169 | 172 | 175 | 178 | 181 | 184 | 187 | 190 | 191 | 199 | 202 | 205 | 208 | 211 | 223 | 234 | 237 | 243 | 246 | 255 | 258 | 261 | 264 | 267 | 270 | 273 | 276 | 277 | 285 | 288 | 291 | 294 | 297 | 309 | 321 | 324 | 330 | 333 | 342 | 345 | 348 | 351 | 354 | 357 | 360 | 363 | 364 | 365 | 366 | 367 | 368 | 372 | 375 | 376 | 379 | 380 | 383 | 384 | 387 | 388 | 391 | 392 | 395 | 396 | 399 | 400 | 403 | 404 | 407 | 408 | 411 | 412 | 415 | 416 | 419 | 420 | 423 | 424 | 427 | 428 | 431 | 432 | 435 | 436 | 439 | 440 | 443 | 444 | 447 | 448 | 451 | 452 | 455 | 456 | 459 | 460 | 463 | 464 | 465 | 468 | 471 | 472 | 475 | 476 | 479 | 480 | 483 | 484 | 485 | 489 | 492 | 493 | 496 | 497 | 500 | 501 | 502 | 505 | 508 | 511 | 516 | 517 | 520 | 525 | 526 | 529 | 534 | 535 | 538 | 543 | 544 | 545 | 548 | 549 | 550 | 553 | 554 | 557 | 558 | 561 | 562 | 565 | 566 | 569 | 570 | 573 | 574 | 577 | 580 | 584 | 585 | 588 | 592 | 593 | 596 | 600 | 601 | 604 | 608 | 609 | 610 | 613 | 614 | 617 | 618 | 621 | 622 | 623 | 624 | 628 | 629 | 630 | -------------------------------------------------------------------------------- /HandleSpy/HandleSpy.vcxproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | NtLayer-Debug 10 | Win32 11 | 12 | 13 | NtLayer-Release 14 | Win32 15 | 16 | 17 | Release 18 | Win32 19 | 20 | 21 | Template 22 | Win32 23 | 24 | 25 | 26 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E} 27 | HandleSpy 28 | 29 | 30 | 31 | Application 32 | Unicode 33 | v120 34 | 35 | 36 | Application 37 | Unicode 38 | v120 39 | 40 | 41 | Application 42 | Unicode 43 | v120 44 | 45 | 46 | Application 47 | Unicode 48 | v120 49 | 50 | 51 | v120 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | <_ProjectFileVersion>10.0.40219.1 71 | $(SolutionDir)Bin_$(Configuration)\ 72 | $(SolutionDir)Intermediate_$(Configuration)\$(ProjectName)\ 73 | true 74 | $(SolutionDir)Bin_$(Configuration)\ 75 | $(SolutionDir)Intermediate_$(Configuration)\$(ProjectName)\ 76 | false 77 | $(SolutionDir)Bin_$(Configuration)\ 78 | $(SolutionDir)Intermediate_$(Configuration)\$(ProjectName)\ 79 | false 80 | $(SolutionDir)Bin_$(Configuration)\ 81 | $(SolutionDir)Intermediate_$(Configuration)\$(ProjectName)\ 82 | true 83 | 84 | 85 | 86 | _DEBUG;%(PreprocessorDefinitions) 87 | false 88 | Win32 89 | true 90 | $(IntDir)HandleSpy.tlb 91 | HandleSpy.h 92 | 93 | 94 | HandleSpy_i.c 95 | HandleSpy_p.c 96 | 97 | 98 | Disabled 99 | $(SolutionDir)include;$(SolutionDir)Storage;$(ProjectDir)wtl\include;%(AdditionalIncludeDirectories) 100 | WIN32;_WINDOWS;STRICT;_DEBUG;%(PreprocessorDefinitions) 101 | true 102 | EnableFastChecks 103 | MultiThreadedDebug 104 | Use 105 | Level3 106 | EditAndContinue 107 | 108 | 109 | _DEBUG;%(PreprocessorDefinitions) 110 | 0x0804 111 | $(IntDir);$(ProjectDir)wtl\include;%(AdditionalIncludeDirectories) 112 | 113 | 114 | true 115 | Windows 116 | false 117 | 118 | 119 | MachineX86 120 | 121 | 122 | 123 | 124 | NDEBUG;%(PreprocessorDefinitions) 125 | false 126 | Win32 127 | true 128 | $(IntDir)HandleSpy.tlb 129 | HandleSpy.h 130 | 131 | 132 | HandleSpy_i.c 133 | HandleSpy_p.c 134 | 135 | 136 | Full 137 | $(SolutionDir)include;$(SolutionDir)Storage;$(ProjectDir)wtl\include;%(AdditionalIncludeDirectories) 138 | WIN32;_WINDOWS;STRICT;NDEBUG;%(PreprocessorDefinitions) 139 | Sync 140 | MultiThreaded 141 | Use 142 | Level3 143 | OldStyle 144 | 145 | 146 | NDEBUG;%(PreprocessorDefinitions) 147 | 0x0409 148 | $(IntDir);$(ProjectDir)wtl\include;%(AdditionalIncludeDirectories) 149 | 150 | 151 | true 152 | Windows 153 | false 154 | 155 | 156 | MachineX86 157 | 158 | 159 | 160 | 161 | NDEBUG;%(PreprocessorDefinitions) 162 | false 163 | Win32 164 | true 165 | $(IntDir)HandleSpy.tlb 166 | HandleSpy.h 167 | 168 | 169 | HandleSpy_i.c 170 | HandleSpy_p.c 171 | 172 | 173 | Full 174 | $(SolutionDir)include;$(SolutionDir)Storage;$(ProjectDir)wtl\include;%(AdditionalIncludeDirectories) 175 | WIN32;_WINDOWS;STRICT;NDEBUG;NT_LAYER_FUNCTION_HOOK;%(PreprocessorDefinitions) 176 | Sync 177 | MultiThreaded 178 | Use 179 | Level3 180 | OldStyle 181 | 182 | 183 | NDEBUG;%(PreprocessorDefinitions) 184 | 0x0409 185 | $(IntDir);$(ProjectDir)wtl\include;%(AdditionalIncludeDirectories) 186 | 187 | 188 | true 189 | Windows 190 | false 191 | 192 | 193 | MachineX86 194 | 195 | 196 | 197 | 198 | _DEBUG;%(PreprocessorDefinitions) 199 | false 200 | Win32 201 | true 202 | $(IntDir)HandleSpy.tlb 203 | HandleSpy.h 204 | 205 | 206 | HandleSpy_i.c 207 | HandleSpy_p.c 208 | 209 | 210 | Disabled 211 | $(SolutionDir)include;$(SolutionDir)Storage;$(ProjectDir)wtl\include;%(AdditionalIncludeDirectories) 212 | WIN32;_WINDOWS;STRICT;_DEBUG;NT_LAYER_FUNCTION_HOOK;%(PreprocessorDefinitions) 213 | true 214 | EnableFastChecks 215 | MultiThreadedDebug 216 | Use 217 | Level3 218 | EditAndContinue 219 | 220 | 221 | _DEBUG;%(PreprocessorDefinitions) 222 | 0x0804 223 | $(IntDir);$(ProjectDir)wtl\include;%(AdditionalIncludeDirectories) 224 | 225 | 226 | true 227 | Windows 228 | false 229 | 230 | 231 | MachineX86 232 | 233 | 234 | 235 | 236 | 237 | 238 | 239 | 240 | 241 | 242 | 243 | 244 | 245 | 246 | 247 | 248 | 249 | 250 | 251 | 252 | 253 | 254 | 255 | 256 | 257 | 258 | 259 | 260 | 261 | 262 | 263 | 264 | 265 | 266 | 267 | 268 | 269 | 270 | 271 | $(IntDir)%(Filename)1.obj 272 | $(IntDir)%(Filename)1.xdc 273 | $(IntDir)%(Filename)1.obj 274 | $(IntDir)%(Filename)1.xdc 275 | $(IntDir)%(Filename)1.obj 276 | $(IntDir)%(Filename)1.xdc 277 | $(IntDir)%(Filename)1.obj 278 | $(IntDir)%(Filename)1.xdc 279 | 280 | 281 | 282 | 283 | 284 | Create 285 | Create 286 | Create 287 | Create 288 | 289 | 290 | 291 | 292 | 293 | 294 | 295 | 296 | 297 | 298 | 299 | 300 | 301 | 302 | 303 | 304 | 305 | 306 | -------------------------------------------------------------------------------- /HandleSpy/HandleSpy.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {ada16294-a198-4a5c-9c5b-0505d9131e2f} 6 | cpp;c;cxx;def;odl;idl;hpj;bat;asm;h 7 | 8 | 9 | {4482ef28-9680-4618-b945-79c8c3546c44} 10 | 11 | 12 | {64375d14-05c5-41f6-97c7-bb9e70532608} 13 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;jpg;jpeg;jpe;manifest 14 | 15 | 16 | {60ee9a9c-9fbd-4a33-8869-2d4fd7523824} 17 | 18 | 19 | {3f76e921-e3ca-4390-8614-e96131ecd5eb} 20 | 21 | 22 | 23 | 24 | UI 25 | 26 | 27 | UI 28 | 29 | 30 | UI 31 | 32 | 33 | UI 34 | 35 | 36 | UI 37 | 38 | 39 | UI 40 | 41 | 42 | UI 43 | 44 | 45 | UI 46 | 47 | 48 | UI 49 | 50 | 51 | UI 52 | 53 | 54 | include 55 | 56 | 57 | include 58 | 59 | 60 | include 61 | 62 | 63 | include 64 | 65 | 66 | Storage 67 | 68 | 69 | UI 70 | 71 | 72 | UI 73 | 74 | 75 | UI 76 | 77 | 78 | UI 79 | 80 | 81 | UI 82 | 83 | 84 | UI 85 | 86 | 87 | Symbol 88 | 89 | 90 | 91 | 92 | UI 93 | 94 | 95 | UI 96 | 97 | 98 | UI 99 | 100 | 101 | UI 102 | 103 | 104 | UI 105 | 106 | 107 | UI 108 | 109 | 110 | UI 111 | 112 | 113 | UI 114 | 115 | 116 | UI 117 | 118 | 119 | Storage 120 | 121 | 122 | UI 123 | 124 | 125 | UI 126 | 127 | 128 | UI 129 | 130 | 131 | UI 132 | 133 | 134 | UI 135 | 136 | 137 | UI 138 | 139 | 140 | Symbol 141 | 142 | 143 | 144 | 145 | Resource Files 146 | 147 | 148 | Resource Files 149 | 150 | 151 | 152 | 153 | Resource Files 154 | 155 | 156 | -------------------------------------------------------------------------------- /HandleSpy/HandleSpy.vcxproj.user: -------------------------------------------------------------------------------- 1 |  2 | 3 | -------------------------------------------------------------------------------- /HandleSpy/Inject.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/Inject.cpp -------------------------------------------------------------------------------- /HandleSpy/Inject.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/Inject.h -------------------------------------------------------------------------------- /HandleSpy/LeakedFunCallDlg.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/LeakedFunCallDlg.cpp -------------------------------------------------------------------------------- /HandleSpy/LeakedFunCallDlg.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "CallStackTypeDefine.h" 4 | #include "StackDlg.h" 5 | #include "ProgressDlg.h" 6 | #include "SymbolHandler.h" 7 | 8 | class CLeakedFunCallDlg : public CDialogImpl 9 | { 10 | public: 11 | enum {IDD = IDD_DIALOG_SELECTEDFUNCALL}; 12 | CLeakedFunCallDlg(DWORD dwBegin, DWORD dwEnd); 13 | ~CLeakedFunCallDlg(void); 14 | 15 | void ShowLeaked(); 16 | void ShowAll(); 17 | void AdvanceFilter(std::vector& vecSrc, std::vector& vecDst); 18 | 19 | BEGIN_MSG_MAP(CLeakedFunCallDlg) 20 | MESSAGE_HANDLER(WM_INITDIALOG, OnInitDialog) 21 | COMMAND_ID_HANDLER(IDCANCEL, OnCloseCmd) 22 | //NOTIFY_CODE_HANDLER(NM_DBLCLK, OnNmDbClick) 23 | COMMAND_HANDLER(IDC_BUTTON_LEAKED, BN_CLICKED, OnBnClickedButtonLeaked) 24 | COMMAND_HANDLER(IDC_BUTTON_ALL, BN_CLICKED, OnBnClickedButtonAll) 25 | MESSAGE_HANDLER(WM_SIZE, OnSize) 26 | NOTIFY_CODE_HANDLER(NM_RCLICK, OnNMRclickTree) 27 | COMMAND_ID_HANDLER(ID_FUNC_COPY, OnFuncCopy) 28 | //COMMAND_ID_HANDLER(ID_FUNC_COPYSTACK, OnFuncCopystack) 29 | COMMAND_ID_HANDLER(ID_FUNC_EXPAND_ALL_STACKS, OnFuncExpandAllStacks) 30 | COMMAND_ID_HANDLER(ID_FUNC_COLLAPSE_ALL_STACKS, OnFuncCollapseAllStacks) 31 | COMMAND_ID_HANDLER(ID_FUNC_EXPAND_ALL_SOURCE, OnFuncExpandAllSource) 32 | COMMAND_ID_HANDLER(ID_FUNC_COLLAPSE_ALL_SOURCE, OnFuncCollapseAllSource) 33 | COMMAND_ID_HANDLER(ID_FUNC_EXPORT2TXT, OnFuncExport2txt) 34 | COMMAND_ID_HANDLER(ID_FUNC_COPYALLLEAKED, OnFuncCopyallleaked) 35 | END_MSG_MAP() 36 | 37 | BOOL OnInitDialog(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/); 38 | LRESULT OnCloseCmd(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 39 | LRESULT OnBnClickedButtonLeaked(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 40 | LRESULT OnBnClickedButtonAll(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 41 | LRESULT OnSize(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/); 42 | 43 | LRESULT OnNMRclickTree(int /*idCtrl*/, LPNMHDR pNMHDR, BOOL& /*bHandled*/); 44 | LRESULT OnFuncCopy(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 45 | LRESULT OnFuncCopystack(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 46 | LRESULT OnFuncExpandAllStacks(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 47 | LRESULT OnFuncCollapseAllStacks(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 48 | LRESULT OnFuncExpandAllSource(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 49 | LRESULT OnFuncCollapseAllSource(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 50 | LRESULT OnFuncExport2txt(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 51 | LRESULT OnFuncCopyallleaked(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 52 | 53 | private: 54 | DWORD m_dwHeightOfButtonsPane; 55 | CSize m_sizeButton; 56 | 57 | CProgressDlg m_Progress; 58 | CTreeViewCtrl m_treeLeaked; 59 | CTreeViewCtrl m_treeAll; 60 | CButton m_btnLeaked; 61 | CButton m_btnAll; 62 | CButton m_btnQuit; 63 | DWORD m_BeginPos; 64 | DWORD m_EndPos; 65 | 66 | std::vector m_vecAllCall; 67 | std::vector m_vecLeakedCall; 68 | }; 69 | -------------------------------------------------------------------------------- /HandleSpy/MainFrm.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/MainFrm.cpp -------------------------------------------------------------------------------- /HandleSpy/MainFrm.h: -------------------------------------------------------------------------------- 1 | // MainFrm.h : interface of the CMainFrame class 2 | // 3 | ///////////////////////////////////////////////////////////////////////////// 4 | 5 | #pragma once 6 | #include "atlctrlw.h" 7 | #include "atlsplit.h" 8 | #include "ChartView.h" 9 | #include "ProcessSelDlg.h" 10 | #include "DetectDlg.h" 11 | #include "StackStorage.h" 12 | #include "ShionChartView.h" 13 | #include "ApiListView.h" 14 | #include "ProgressDlg.h" 15 | 16 | class CMainFrame : 17 | public CFrameWindowImpl, 18 | public CUpdateUI, 19 | public CMessageFilter, 20 | public CIdleHandler 21 | { 22 | public: 23 | DECLARE_FRAME_WND_CLASS(NULL, IDR_MAINFRAME) 24 | 25 | virtual BOOL PreTranslateMessage(MSG* pMsg); 26 | virtual BOOL OnIdle(); 27 | 28 | BEGIN_UPDATE_UI_MAP(CMainFrame) 29 | UPDATE_ELEMENT(ID_FILE_SAVE, UPDUI_MENUPOPUP | UPDUI_TOOLBAR) 30 | //UPDATE_ELEMENT(ID_FILE_SAVE, UPDUI_TOOLBAR) 31 | 32 | UPDATE_ELEMENT(ID_FILE_CLOSE, UPDUI_MENUPOPUP | UPDUI_TOOLBAR) 33 | 34 | UPDATE_ELEMENT(ID_VIEW_TOOLBAR, UPDUI_MENUPOPUP) 35 | UPDATE_ELEMENT(ID_EDIT_OPTIONS, UPDUI_MENUPOPUP) 36 | END_UPDATE_UI_MAP() 37 | 38 | BEGIN_MSG_MAP(CMainFrame) 39 | MESSAGE_HANDLER(WM_CREATE, OnCreate) 40 | MESSAGE_HANDLER(WM_DESTROY, OnDestroy) 41 | COMMAND_ID_HANDLER(ID_APP_EXIT, OnFileExit) 42 | COMMAND_ID_HANDLER(ID_FILE_PROCESSLIST, OnProcessList) 43 | COMMAND_ID_HANDLER(ID_VIEW_TOOLBAR, OnViewToolBar) 44 | COMMAND_ID_HANDLER(ID_APP_ABOUT, OnAppAbout) 45 | COMMAND_ID_HANDLER(ID_FILE_SAVE, OnFileSave) 46 | COMMAND_ID_HANDLER(ID_FILE_OPEN, OnFileOpen) 47 | COMMAND_ID_HANDLER(ID_SHOW_SELECTED_FUNCS, OnShowSelectedFuncs) 48 | NOTIFY_CODE_HANDLER(NM_DBLCLK, OnNmDbClick) 49 | NOTIFY_CODE_HANDLER(NM_RCLICK, OnNmRClick) 50 | COMMAND_ID_HANDLER(ID_FILE_CLOSE, OnFileClose) 51 | MESSAGE_HANDLER(WM_CLOSE, OnClose) 52 | CHAIN_MSG_MAP(CUpdateUI) 53 | CHAIN_MSG_MAP(CFrameWindowImpl) 54 | END_MSG_MAP() 55 | 56 | void AppendCountData(); 57 | 58 | void CreateChartView(); 59 | void CreateStackListView(); 60 | 61 | BOOL DoDetect(DWORD dwPid); 62 | void FillStackListView(); 63 | void FillCountTimeArray(); 64 | void FillModInfoArray(); 65 | 66 | BOOL CloseConfirmation(); 67 | void CleanAndClose(); 68 | 69 | void SetWindowNameSuffix(LPCTSTR suffix = NULL); 70 | 71 | private: 72 | CToolBarCtrl m_ToolBar; 73 | CCommandBarCtrl m_CmdBar; 74 | CHorSplitterWindow m_splitter; 75 | CShionChartView m_ChartView; 76 | CApiListView m_ApiListView; 77 | CProgressDlg m_Progress; 78 | 79 | DWORD m_MaxCount; 80 | DWORD m_MinCount; 81 | 82 | BOOL m_bSaved; 83 | BOOL m_bOpened; 84 | 85 | std::vector m_CountArray; 86 | std::vector m_CallStackArray; 87 | std::vector m_ModInfo; 88 | CString m_strFileName; 89 | CString m_strWindowName; 90 | 91 | public: 92 | 93 | // Handler prototypes (uncomment arguments if needed): 94 | // LRESULT MessageHandler(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/) 95 | // LRESULT CommandHandler(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/) 96 | // LRESULT NotifyHandler(int /*idCtrl*/, LPNMHDR /*pnmh*/, BOOL& /*bHandled*/) 97 | 98 | LRESULT OnCreate(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/); 99 | LRESULT OnDestroy(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& bHandled); 100 | 101 | // Command Message Handler 102 | LRESULT OnFileExit(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 103 | LRESULT OnProcessList(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 104 | LRESULT OnViewToolBar(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 105 | LRESULT OnAppAbout(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 106 | LRESULT OnFileSave(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 107 | LRESULT OnFileOpen(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 108 | LRESULT OnShowSelectedFuncs(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 109 | 110 | LRESULT OnNmDbClick(int /*idCtrl*/, LPNMHDR /*pnmh*/, BOOL& /*bHandled*/); 111 | LRESULT OnNmRClick(int /*idCtrl*/, LPNMHDR /*pnmh*/, BOOL& /*bHandled*/); 112 | LRESULT OnFileClose(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 113 | LRESULT OnClose(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/); 114 | }; 115 | -------------------------------------------------------------------------------- /HandleSpy/ProcessSelDlg.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/ProcessSelDlg.cpp -------------------------------------------------------------------------------- /HandleSpy/ProcessSelDlg.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | class CProcessSelDlg : public CDialogImpl 4 | { 5 | public: 6 | enum {IDD = IDD_DIALOG_PROCESS}; 7 | CProcessSelDlg(void); 8 | ~CProcessSelDlg(void); 9 | 10 | public: 11 | BEGIN_MSG_MAP(CProcessSelDlg) 12 | MESSAGE_HANDLER(WM_INITDIALOG, OnInitDialog) 13 | COMMAND_HANDLER(IDOK, BN_CLICKED, OnBnClickedOk) 14 | COMMAND_HANDLER(IDC_BUTTON_REFRESH, BN_CLICKED, OnBnClickedRefresh) 15 | COMMAND_HANDLER(IDCANCEL, BN_CLICKED, OnBnClickedCancel) 16 | NOTIFY_HANDLER(IDC_PROCESSLIST, NM_DBLCLK, OnNmDblClickProcesslist) 17 | NOTIFY_CODE_HANDLER(HDN_ITEMCLICK, OnHdnItemClickProcesslist) 18 | END_MSG_MAP() 19 | 20 | public: 21 | BOOL OnInitDialog(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/); 22 | 23 | LRESULT OnBnClickedOk(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 24 | LRESULT OnBnClickedRefresh(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 25 | LRESULT OnBnClickedCancel(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 26 | LRESULT OnNMDblclkProcessList(int /*idCtrl*/, LPNMHDR /*pNMHDR*/, BOOL& /*bHandled*/); 27 | LRESULT OnNmDblClickProcesslist(int /*idCtrl*/, LPNMHDR pNMHDR, BOOL& /*bHandled*/); 28 | LRESULT OnHdnItemClickProcesslist(int /*idCtrl*/, LPNMHDR pNMHDR, BOOL& /*bHandled*/); 29 | 30 | protected: 31 | void ReFreshProcessList(); 32 | void GetSelectedProcessID(); 33 | static int CALLBACK CompareFunc(LPARAM lParam1, LPARAM lParam2, LPARAM lParamSort); 34 | 35 | private: 36 | CListViewCtrl m_listProcess; 37 | PDWORD m_pdwPidReceiver; 38 | 39 | static BOOL s_Order[2]; 40 | static INT s_SortColumn; 41 | }; -------------------------------------------------------------------------------- /HandleSpy/ProgressDlg.cpp: -------------------------------------------------------------------------------- 1 | #include "StdAfx.h" 2 | #include "ProgressDlg.h" 3 | 4 | CProgressDlg::CProgressDlg(void) 5 | { 6 | m_hTread = NULL; 7 | m_OkEvent = NULL; 8 | } 9 | 10 | CProgressDlg::~CProgressDlg(void) 11 | { 12 | m_hTread = NULL; 13 | m_OkEvent = NULL; 14 | } 15 | 16 | LRESULT CProgressDlg::OnCreate(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM lParam, BOOL& /*bHandled*/) 17 | { 18 | LPCREATESTRUCT pCreateStruct = (LPCREATESTRUCT)lParam; 19 | 20 | CRect rcClient(0, 0, pCreateStruct->cx, pCreateStruct->cy); 21 | 22 | SetWindowText(m_Text); 23 | 24 | CRect rcProgress; 25 | rcProgress.left = rcClient.left + 5; 26 | rcProgress.right = rcClient.right - 5; 27 | rcProgress.top = rcClient.top + 20; 28 | rcProgress.bottom = rcProgress.top + 40; 29 | m_Progress.Create(m_hWnd, rcProgress, NULL, WS_CHILD | WS_VISIBLE | PBS_SMOOTH); 30 | 31 | m_Progress.SetRange(0, m_Range); 32 | m_Progress.SetStep(1); 33 | 34 | return 0; 35 | } 36 | 37 | void CProgressDlg::Go(HWND hWndParent, LPCTSTR lpText, DWORD dwRange) 38 | { 39 | m_hWndParent = hWndParent; 40 | m_Text = lpText; 41 | m_Range = dwRange; 42 | 43 | ::EnableWindow(m_hWndParent, FALSE); 44 | 45 | DWORD dwTid = 0; 46 | m_OkEvent = ::CreateEvent(NULL, TRUE, FALSE, NULL); 47 | m_hTread = ::CreateThread(NULL, 0, ThreadProc, this, 0, &dwTid); 48 | ::WaitForSingleObject(m_OkEvent, INFINITE); 49 | ::CloseHandle(m_OkEvent); 50 | } 51 | 52 | void CProgressDlg::StepIt(LPCTSTR lpText) 53 | { 54 | SendMessage(PROGRESS_MSG_STEPIT, (WPARAM)lpText, 0); 55 | } 56 | 57 | void CProgressDlg::Stop() 58 | { 59 | PostMessage(PROGRESS_MSG_STOP, 0, 0); 60 | ::WaitForSingleObject(m_hTread, INFINITE); 61 | ::CloseHandle(m_hTread); 62 | 63 | ::EnableWindow(m_hWndParent, TRUE); 64 | ::SetForegroundWindow(m_hWndParent); 65 | 66 | m_hTread = NULL; 67 | m_Range = 0; 68 | m_Text = _T(""); 69 | m_hWnd = NULL; 70 | m_Progress.m_hWnd = NULL; 71 | } 72 | 73 | DWORD WINAPI CProgressDlg::ThreadProc(LPVOID lpVoid) 74 | { 75 | CProgressDlg* p = (CProgressDlg*)lpVoid; 76 | CRect rc(0, 0, 500, 50); 77 | p->Create(NULL, rc, NULL, WS_POPUP|WS_VISIBLE); 78 | p->CenterWindow(p->m_hWndParent); 79 | p->ShowWindow(SW_SHOW); 80 | 81 | ::SetEvent(p->m_OkEvent); 82 | 83 | CMessageLoop msgLoop; 84 | int nRet = msgLoop.Run(); 85 | 86 | return 0; 87 | } 88 | 89 | LRESULT CProgressDlg::OnStepIt(UINT /*uMsg*/, WPARAM wParam, LPARAM /*lParam*/, BOOL& /*bHandled*/) 90 | { 91 | LPCTSTR lpText = (LPCTSTR)wParam; 92 | m_Progress.StepIt(); 93 | if (NULL != lpText) 94 | { 95 | SetWindowText(lpText); 96 | } 97 | 98 | return 0; 99 | } 100 | 101 | LRESULT CProgressDlg::OnClose(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/) 102 | { 103 | DestroyWindow(); 104 | return 0; 105 | } 106 | 107 | LRESULT CProgressDlg::OnDestroy(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/) 108 | { 109 | PostQuitMessage(0); 110 | return 0; 111 | } 112 | -------------------------------------------------------------------------------- /HandleSpy/ProgressDlg.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include "atlwin.h" 3 | 4 | #define PROGRESS_MSG_STEPIT (WM_USER+0x100) 5 | #define PROGRESS_MSG_STOP (WM_USER+0x101) 6 | 7 | class CProgressDlg : 8 | public CWindowImpl> 9 | { 10 | public: 11 | CProgressDlg(void); 12 | ~CProgressDlg(void); 13 | 14 | void Go(HWND hWndParent, LPCTSTR lpText, DWORD dwRange); 15 | void StepIt(LPCTSTR lpText = NULL); 16 | void Stop(); 17 | 18 | BEGIN_MSG_MAP(CProcessSelDlg) 19 | MESSAGE_HANDLER(WM_CREATE, OnCreate) 20 | MESSAGE_HANDLER(PROGRESS_MSG_STEPIT, OnStepIt) 21 | MESSAGE_HANDLER(PROGRESS_MSG_STOP, OnClose) 22 | MESSAGE_HANDLER(WM_CLOSE, OnClose) 23 | MESSAGE_HANDLER(WM_DESTROY, OnDestroy) 24 | END_MSG_MAP() 25 | 26 | LRESULT OnCreate(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/); 27 | LRESULT OnStepIt(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/); 28 | LRESULT OnClose(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/); 29 | LRESULT OnDestroy(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/); 30 | 31 | protected: 32 | static DWORD WINAPI ThreadProc(LPVOID lpVoid); 33 | 34 | private: 35 | CProgressBarCtrl m_Progress; 36 | HANDLE m_hTread; 37 | 38 | HWND m_hWndParent; 39 | DWORD m_Range; 40 | CString m_Text; 41 | 42 | HANDLE m_OkEvent; 43 | }; 44 | -------------------------------------------------------------------------------- /HandleSpy/ShionChartView.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/ShionChartView.cpp -------------------------------------------------------------------------------- /HandleSpy/ShionChartView.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/ShionChartView.h -------------------------------------------------------------------------------- /HandleSpy/StackDlg.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/StackDlg.cpp -------------------------------------------------------------------------------- /HandleSpy/StackDlg.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include "atlwin.h" 3 | #include "CallStackTypeDefine.h" 4 | #include "ProgressDlg.h" 5 | 6 | class CStackDlg : 7 | public CDialogImpl 8 | { 9 | public: 10 | 11 | enum { IDD = IDD_DIALOG_STACK }; 12 | 13 | BEGIN_MSG_MAP(CStackDlg) 14 | MESSAGE_HANDLER(WM_INITDIALOG, OnInitDialog) 15 | COMMAND_ID_HANDLER(IDCANCEL, OnCloseCmd) 16 | MESSAGE_HANDLER(WM_SIZE, OnSize) 17 | END_MSG_MAP() 18 | 19 | CStackDlg(void); 20 | ~CStackDlg(void); 21 | 22 | LRESULT OnInitDialog(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM lParam, BOOL& /*bHandled*/); 23 | LRESULT OnCloseCmd(WORD /*wNotifyCode*/, WORD /*wID*/, HWND /*hWndCtl*/, BOOL& /*bHandled*/); 24 | LRESULT OnSize(UINT /*uMsg*/, WPARAM /*wParam*/, LPARAM /*lParam*/, BOOL& /*bHandled*/); 25 | private: 26 | CListBox m_StackList; 27 | CProgressDlg m_Progress; 28 | }; 29 | -------------------------------------------------------------------------------- /HandleSpy/SymbolHandler.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/SymbolHandler.cpp -------------------------------------------------------------------------------- /HandleSpy/SymbolHandler.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include 4 | #include 5 | 6 | #include "CallStackTypeDefine.h" 7 | 8 | typedef std::basic_string StringT; 9 | 10 | typedef struct __MOD_SYMBOL_INFO 11 | { 12 | MOD_INFO modinfo; 13 | WCHAR wcszPdbPath[MAX_PATH]; 14 | }MOD_SYMBOL_INFO, *PMOD_SYMBOL_INFO; 15 | 16 | class CSymbolHandler 17 | { 18 | public: 19 | 20 | static CSymbolHandler* GetInstance(); 21 | 22 | BOOL Init(LPCTSTR lpConfigFile); 23 | void LoadSymbols(std::vector& vec); 24 | StringT FrameNameFromAddr(STACK_FRAME sf); 25 | BOOL GetSourceFileAndLineNumber(STACK_FRAME sf, StringT& strSourceFile, DWORD& dwLineNumber); 26 | 27 | void ClearAllSymbols(); 28 | 29 | CSymbolHandler(void); 30 | ~CSymbolHandler(void); 31 | 32 | 33 | private: 34 | std::vector m_vecSymbolPaths; 35 | std::vector m_vecModSymbolInfo; 36 | StringT m_strSymboPaths; 37 | HANDLE m_hProcess; 38 | }; 39 | -------------------------------------------------------------------------------- /HandleSpy/lib/dbghelp.lib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/lib/dbghelp.lib -------------------------------------------------------------------------------- /HandleSpy/res/HandleSpy.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/res/HandleSpy.ico -------------------------------------------------------------------------------- /HandleSpy/res/Toolbar.bmp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/HandleSpy/res/Toolbar.bmp -------------------------------------------------------------------------------- /HandleSpy/resource.h: -------------------------------------------------------------------------------- 1 | //{{NO_DEPENDENCIES}} 2 | // Microsoft Visual C++ generated include file. 3 | // Used by HandleSpy.rc 4 | // 5 | #define LWS_USEVISUALSTYLE 0x0008 6 | #define IDD_ABOUTBOX 100 7 | #define IDR_MAINFRAME 128 8 | #define IDD_DIALOG_PROCESS 200 9 | #define IDD_DIALOG_DETECT 201 10 | #define IDD_DIALOG_STACK 203 11 | #define IDD_DIALOG_FUNCCALL 204 12 | #define IDR_MENU_POPUP 209 13 | #define IDD_DIALOG_SELECTEDFUNCALL 211 14 | #define IDD_DIALOG1 212 15 | #define IDD_DIALOG_PROGRESS 212 16 | #define IDC_TREE_ALL 1014 17 | #define IDC_TREE_LEAKED 1015 18 | #define IDC_BUTTON_LEAKED 1016 19 | #define IDC_BUTTON_ALL 1017 20 | #define IDC_SYSLINK 1019 21 | #define IDC_PROGRESS_BAR 1020 22 | #define IDC_STATIC_TEXT 1021 23 | #define IDC_PROCESSLIST 2000 24 | #define IDC_BUTTON_REFRESH 2001 25 | #define IDC_STATIC_CHARTFRAME 2010 26 | #define ID_STOP 2011 27 | #define IDC_LIST_STACK 2030 28 | #define IDC_LIST_FUNC_CALL 2040 29 | #define IDC_BUTTON_SHOWALL 2041 30 | #define IDC_BUTTON_SMARTFILTER 2042 31 | #define IDC_BUTTON_ONLYLEAK 2043 32 | #define ID_FILE_PROCESSLIST 32779 33 | #define ID_LINE_CHART_CONTEXT 32782 34 | #define ID_LINE_CHART_CONTEXTMENU 32783 35 | #define ID_SHOW_SELECTED_FUNCS 32784 36 | #define ID_EDIT_OPTIONS 32785 37 | #define IDC_FILE_CLOSE 32786 38 | #define ID_FUNC_COPY 32789 39 | #define ID_FUNC_COPYSTACK 32790 40 | #define ID_FUNC_COLLAPSE_ALL_STACK 32796 41 | #define ID_FUNC_EXPAND_ALL_STACKS 32797 42 | #define ID_FUNC_COLLAPSE_ALL_STACKS 32798 43 | #define ID_FUNC_COLLAPSE_ALL_SOURCE 32799 44 | #define ID_FUNC_EXPAND_ALL_SOURCE 32800 45 | #define ID_FUNC_EXPORT2TXT 32801 46 | #define ID_FUNC_COPY_ALLLEAKED 32802 47 | #define ID_FUNC_COPYALLLEAKED 32803 48 | 49 | // Next default values for new objects 50 | // 51 | #ifdef APSTUDIO_INVOKED 52 | #ifndef APSTUDIO_READONLY_SYMBOLS 53 | #define _APS_NEXT_RESOURCE_VALUE 213 54 | #define _APS_NEXT_COMMAND_VALUE 32806 55 | #define _APS_NEXT_CONTROL_VALUE 1022 56 | #define _APS_NEXT_SYMED_VALUE 101 57 | #endif 58 | #endif 59 | -------------------------------------------------------------------------------- /HandleSpy/stdafx.cpp: -------------------------------------------------------------------------------- 1 | // stdafx.cpp : source file that includes just the standard includes 2 | // HandleSpy.pch will be the pre-compiled header 3 | // stdafx.obj will contain the pre-compiled type information 4 | 5 | #include "stdafx.h" 6 | 7 | #if (_ATL_VER < 0x0700) 8 | #include 9 | #endif //(_ATL_VER < 0x0700) 10 | -------------------------------------------------------------------------------- /HandleSpy/stdafx.h: -------------------------------------------------------------------------------- 1 | // stdafx.h : include file for standard system include files, 2 | // or project specific include files that are used frequently, but 3 | // are changed infrequently 4 | // 5 | 6 | #pragma once 7 | 8 | // Change these values to use different versions 9 | #define WINVER 0x0500 10 | #define _WIN32_WINNT 0x0501 11 | #define _WIN32_IE 0x0501 12 | #define _RICHEDIT_VER 0x0200 13 | 14 | #define _WTL_NO_CSTRING 15 | #include 16 | #include 17 | #include 18 | #include 19 | 20 | extern CAppModule _Module; 21 | 22 | #include 23 | 24 | #include 25 | #include 26 | #include 27 | #include 28 | 29 | #include 30 | #include "resource.h" 31 | 32 | #include 33 | #pragma comment(lib, "gdiplus.lib") 34 | 35 | using namespace Gdiplus; 36 | using namespace WTL; 37 | 38 | #include 39 | #include 40 | 41 | #if defined _M_IX86 42 | #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*'\"") 43 | #elif defined _M_IA64 44 | #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='ia64' publicKeyToken='6595b64144ccf1df' language='*'\"") 45 | #elif defined _M_X64 46 | #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='amd64' publicKeyToken='6595b64144ccf1df' language='*'\"") 47 | #else 48 | #pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'\"") 49 | #endif 50 | -------------------------------------------------------------------------------- /HandleSpy/wtl/include/atlddx.h: -------------------------------------------------------------------------------- 1 | // Windows Template Library - WTL version 9.0 2 | // Copyright (C) Microsoft Corporation, WTL Team. All rights reserved. 3 | // 4 | // This file is a part of the Windows Template Library. 5 | // The use and distribution terms for this software are covered by the 6 | // Common Public License 1.0 (http://opensource.org/licenses/cpl1.0.php) 7 | // which can be found in the file CPL.TXT at the root of this distribution. 8 | // By using this software in any fashion, you are agreeing to be bound by 9 | // the terms of this license. You must not remove this notice, or 10 | // any other, from this software. 11 | 12 | #ifndef __ATLDDX_H__ 13 | #define __ATLDDX_H__ 14 | 15 | #pragma once 16 | 17 | #ifndef __ATLAPP_H__ 18 | #error atlddx.h requires atlapp.h to be included first 19 | #endif 20 | 21 | #if defined(_ATL_USE_DDX_FLOAT) && defined(_ATL_MIN_CRT) 22 | #error Cannot use floating point DDX with _ATL_MIN_CRT defined 23 | #endif // defined(_ATL_USE_DDX_FLOAT) && defined(_ATL_MIN_CRT) 24 | 25 | #ifdef _ATL_USE_DDX_FLOAT 26 | #include 27 | #endif // _ATL_USE_DDX_FLOAT 28 | 29 | 30 | /////////////////////////////////////////////////////////////////////////////// 31 | // Classes in this file: 32 | // 33 | // CWinDataExchange 34 | 35 | 36 | namespace WTL 37 | { 38 | 39 | // Constants 40 | #define DDX_LOAD FALSE 41 | #define DDX_SAVE TRUE 42 | 43 | // DDX map macros 44 | #define BEGIN_DDX_MAP(thisClass) \ 45 | BOOL DoDataExchange(BOOL bSaveAndValidate = FALSE, UINT nCtlID = (UINT)-1) \ 46 | { \ 47 | bSaveAndValidate; \ 48 | nCtlID; 49 | 50 | #define DDX_TEXT(nID, var) \ 51 | if(nCtlID == (UINT)-1 || nCtlID == nID) \ 52 | { \ 53 | if(!DDX_Text(nID, var, sizeof(var), bSaveAndValidate)) \ 54 | return FALSE; \ 55 | } 56 | 57 | #define DDX_TEXT_LEN(nID, var, len) \ 58 | if(nCtlID == (UINT)-1 || nCtlID == nID) \ 59 | { \ 60 | if(!DDX_Text(nID, var, sizeof(var), bSaveAndValidate, TRUE, len)) \ 61 | return FALSE; \ 62 | } 63 | 64 | #define DDX_INT(nID, var) \ 65 | if(nCtlID == (UINT)-1 || nCtlID == nID) \ 66 | { \ 67 | if(!DDX_Int(nID, var, TRUE, bSaveAndValidate)) \ 68 | return FALSE; \ 69 | } 70 | 71 | #define DDX_INT_RANGE(nID, var, min, max) \ 72 | if(nCtlID == (UINT)-1 || nCtlID == nID) \ 73 | { \ 74 | if(!DDX_Int(nID, var, TRUE, bSaveAndValidate, TRUE, min, max)) \ 75 | return FALSE; \ 76 | } 77 | 78 | #define DDX_UINT(nID, var) \ 79 | if(nCtlID == (UINT)-1 || nCtlID == nID) \ 80 | { \ 81 | if(!DDX_Int(nID, var, FALSE, bSaveAndValidate)) \ 82 | return FALSE; \ 83 | } 84 | 85 | #define DDX_UINT_RANGE(nID, var, min, max) \ 86 | if(nCtlID == (UINT)-1 || nCtlID == nID) \ 87 | { \ 88 | if(!DDX_Int(nID, var, FALSE, bSaveAndValidate, TRUE, min, max)) \ 89 | return FALSE; \ 90 | } 91 | 92 | #ifdef _ATL_USE_DDX_FLOAT 93 | #define DDX_FLOAT(nID, var) \ 94 | if(nCtlID == (UINT)-1 || nCtlID == nID) \ 95 | { \ 96 | if(!DDX_Float(nID, var, bSaveAndValidate)) \ 97 | return FALSE; \ 98 | } 99 | 100 | #define DDX_FLOAT_RANGE(nID, var, min, max) \ 101 | if(nCtlID == (UINT)-1 || nCtlID == nID) \ 102 | { \ 103 | if(!DDX_Float(nID, var, bSaveAndValidate, TRUE, min, max)) \ 104 | return FALSE; \ 105 | } 106 | #define DDX_FLOAT_P(nID, var, precision) \ 107 | if(nCtlID == (UINT)-1 || nCtlID == nID) \ 108 | { \ 109 | if(!DDX_Float(nID, var, bSaveAndValidate, FALSE, 0, 0, precision)) \ 110 | return FALSE; \ 111 | } 112 | 113 | #define DDX_FLOAT_P_RANGE(nID, var, min, max, precision) \ 114 | if(nCtlID == (UINT)-1 || nCtlID == nID) \ 115 | { \ 116 | if(!DDX_Float(nID, var, bSaveAndValidate, TRUE, min, max, precision)) \ 117 | return FALSE; \ 118 | } 119 | #endif // _ATL_USE_DDX_FLOAT 120 | 121 | #define DDX_CONTROL(nID, obj) \ 122 | if(nCtlID == (UINT)-1 || nCtlID == nID) \ 123 | DDX_Control(nID, obj, bSaveAndValidate); 124 | 125 | #define DDX_CONTROL_HANDLE(nID, obj) \ 126 | if(nCtlID == (UINT)-1 || nCtlID == nID) \ 127 | DDX_Control_Handle(nID, obj, bSaveAndValidate); 128 | 129 | #define DDX_CHECK(nID, var) \ 130 | if(nCtlID == (UINT)-1 || nCtlID == nID) \ 131 | DDX_Check(nID, var, bSaveAndValidate); 132 | 133 | #define DDX_RADIO(nID, var) \ 134 | if(nCtlID == (UINT)-1 || nCtlID == nID) \ 135 | DDX_Radio(nID, var, bSaveAndValidate); 136 | 137 | #define END_DDX_MAP() \ 138 | return TRUE; \ 139 | } 140 | 141 | // DDX support for Tab, Combo, ListBox and ListView selection index 142 | // Note: Specialized versions require atlctrls.h to be included first 143 | #if (_MSC_VER >= 1300) 144 | 145 | #define DDX_INDEX(CtrlClass, nID, var) \ 146 | if(nCtlID == (UINT)-1 || nCtlID == nID) \ 147 | DDX_Index(nID, var, bSaveAndValidate); 148 | 149 | #ifdef __ATLCTRLS_H__ 150 | #define DDX_TAB_INDEX(nID, var) DDX_INDEX(WTL::CTabCtrl, nID, var) 151 | #ifndef WIN32_PLATFORM_WFSP // No COMBOBOX on SmartPhones 152 | #define DDX_COMBO_INDEX(nID, var) DDX_INDEX(WTL::CComboBox, nID, var) 153 | #endif 154 | #define DDX_LISTBOX_INDEX(nID, var) DDX_INDEX(WTL::CListBox, nID, var) 155 | #define DDX_LISTVIEW_INDEX(nID, var) DDX_INDEX(WTL::CListViewCtrl, nID, var) 156 | #endif // __ATLCTRLS_H__ 157 | 158 | #endif // (_MSC_VER >= 1300) 159 | 160 | 161 | /////////////////////////////////////////////////////////////////////////////// 162 | // CWinDataExchange - provides support for DDX 163 | 164 | template 165 | class CWinDataExchange 166 | { 167 | public: 168 | // Data exchange method - override in your derived class 169 | BOOL DoDataExchange(BOOL /*bSaveAndValidate*/ = FALSE, UINT /*nCtlID*/ = (UINT)-1) 170 | { 171 | // this one should never be called, override it in 172 | // your derived class by implementing DDX map 173 | ATLASSERT(FALSE); 174 | return FALSE; 175 | } 176 | 177 | // Helpers for validation error reporting 178 | enum _XDataType 179 | { 180 | ddxDataNull = 0, 181 | ddxDataText = 1, 182 | ddxDataInt = 2, 183 | ddxDataFloat = 3, 184 | ddxDataDouble = 4 185 | }; 186 | 187 | struct _XTextData 188 | { 189 | int nLength; 190 | int nMaxLength; 191 | }; 192 | 193 | struct _XIntData 194 | { 195 | long nVal; 196 | long nMin; 197 | long nMax; 198 | }; 199 | 200 | struct _XFloatData 201 | { 202 | double nVal; 203 | double nMin; 204 | double nMax; 205 | }; 206 | 207 | struct _XData 208 | { 209 | _XDataType nDataType; 210 | union 211 | { 212 | _XTextData textData; 213 | _XIntData intData; 214 | _XFloatData floatData; 215 | }; 216 | }; 217 | 218 | // Text exchange 219 | BOOL DDX_Text(UINT nID, LPTSTR lpstrText, int cbSize, BOOL bSave, BOOL bValidate = FALSE, int nLength = 0) 220 | { 221 | T* pT = static_cast(this); 222 | BOOL bSuccess = TRUE; 223 | 224 | if(bSave) 225 | { 226 | HWND hWndCtrl = pT->GetDlgItem(nID); 227 | int nRetLen = ::GetWindowText(hWndCtrl, lpstrText, cbSize / sizeof(TCHAR)); 228 | if(nRetLen < ::GetWindowTextLength(hWndCtrl)) 229 | bSuccess = FALSE; 230 | } 231 | else 232 | { 233 | ATLASSERT(!bValidate || lstrlen(lpstrText) <= nLength); 234 | bSuccess = pT->SetDlgItemText(nID, lpstrText); 235 | } 236 | 237 | if(!bSuccess) 238 | { 239 | pT->OnDataExchangeError(nID, bSave); 240 | } 241 | else if(bSave && bValidate) // validation 242 | { 243 | ATLASSERT(nLength > 0); 244 | if(lstrlen(lpstrText) > nLength) 245 | { 246 | _XData data = { ddxDataText }; 247 | data.textData.nLength = lstrlen(lpstrText); 248 | data.textData.nMaxLength = nLength; 249 | pT->OnDataValidateError(nID, bSave, data); 250 | bSuccess = FALSE; 251 | } 252 | } 253 | return bSuccess; 254 | } 255 | 256 | BOOL DDX_Text(UINT nID, BSTR& bstrText, int /*cbSize*/, BOOL bSave, BOOL bValidate = FALSE, int nLength = 0) 257 | { 258 | T* pT = static_cast(this); 259 | BOOL bSuccess = TRUE; 260 | 261 | if(bSave) 262 | { 263 | bSuccess = pT->GetDlgItemText(nID, bstrText); 264 | } 265 | else 266 | { 267 | USES_CONVERSION; 268 | LPTSTR lpstrText = OLE2T(bstrText); 269 | ATLASSERT(!bValidate || lstrlen(lpstrText) <= nLength); 270 | bSuccess = pT->SetDlgItemText(nID, lpstrText); 271 | } 272 | 273 | if(!bSuccess) 274 | { 275 | pT->OnDataExchangeError(nID, bSave); 276 | } 277 | else if(bSave && bValidate) // validation 278 | { 279 | ATLASSERT(nLength > 0); 280 | if((int)::SysStringLen(bstrText) > nLength) 281 | { 282 | _XData data = { ddxDataText }; 283 | data.textData.nLength = (int)::SysStringLen(bstrText); 284 | data.textData.nMaxLength = nLength; 285 | pT->OnDataValidateError(nID, bSave, data); 286 | bSuccess = FALSE; 287 | } 288 | } 289 | return bSuccess; 290 | } 291 | 292 | BOOL DDX_Text(UINT nID, ATL::CComBSTR& bstrText, int /*cbSize*/, BOOL bSave, BOOL bValidate = FALSE, int nLength = 0) 293 | { 294 | T* pT = static_cast(this); 295 | BOOL bSuccess = TRUE; 296 | 297 | if(bSave) 298 | { 299 | bSuccess = pT->GetDlgItemText(nID, (BSTR&)bstrText); 300 | } 301 | else 302 | { 303 | USES_CONVERSION; 304 | LPTSTR lpstrText = OLE2T(bstrText); 305 | ATLASSERT(!bValidate || lstrlen(lpstrText) <= nLength); 306 | bSuccess = pT->SetDlgItemText(nID, lpstrText); 307 | } 308 | 309 | if(!bSuccess) 310 | { 311 | pT->OnDataExchangeError(nID, bSave); 312 | } 313 | else if(bSave && bValidate) // validation 314 | { 315 | ATLASSERT(nLength > 0); 316 | if((int)bstrText.Length() > nLength) 317 | { 318 | _XData data = { ddxDataText }; 319 | data.textData.nLength = (int)bstrText.Length(); 320 | data.textData.nMaxLength = nLength; 321 | pT->OnDataValidateError(nID, bSave, data); 322 | bSuccess = FALSE; 323 | } 324 | } 325 | return bSuccess; 326 | } 327 | 328 | #if defined(_WTL_USE_CSTRING) || defined(__ATLSTR_H__) 329 | BOOL DDX_Text(UINT nID, _CSTRING_NS::CString& strText, int /*cbSize*/, BOOL bSave, BOOL bValidate = FALSE, int nLength = 0) 330 | { 331 | T* pT = static_cast(this); 332 | BOOL bSuccess = TRUE; 333 | 334 | if(bSave) 335 | { 336 | HWND hWndCtrl = pT->GetDlgItem(nID); 337 | int nLen = ::GetWindowTextLength(hWndCtrl); 338 | int nRetLen = -1; 339 | LPTSTR lpstr = strText.GetBufferSetLength(nLen); 340 | if(lpstr != NULL) 341 | { 342 | nRetLen = ::GetWindowText(hWndCtrl, lpstr, nLen + 1); 343 | strText.ReleaseBuffer(); 344 | } 345 | if(nRetLen < nLen) 346 | bSuccess = FALSE; 347 | } 348 | else 349 | { 350 | bSuccess = pT->SetDlgItemText(nID, strText); 351 | } 352 | 353 | if(!bSuccess) 354 | { 355 | pT->OnDataExchangeError(nID, bSave); 356 | } 357 | else if(bSave && bValidate) // validation 358 | { 359 | ATLASSERT(nLength > 0); 360 | if(strText.GetLength() > nLength) 361 | { 362 | _XData data = { ddxDataText }; 363 | data.textData.nLength = strText.GetLength(); 364 | data.textData.nMaxLength = nLength; 365 | pT->OnDataValidateError(nID, bSave, data); 366 | bSuccess = FALSE; 367 | } 368 | } 369 | return bSuccess; 370 | } 371 | #endif // defined(_WTL_USE_CSTRING) || defined(__ATLSTR_H__) 372 | 373 | // Numeric exchange 374 | template 375 | BOOL DDX_Int(UINT nID, Type& nVal, BOOL bSigned, BOOL bSave, BOOL bValidate = FALSE, Type nMin = 0, Type nMax = 0) 376 | { 377 | T* pT = static_cast(this); 378 | BOOL bSuccess = TRUE; 379 | 380 | if(bSave) 381 | { 382 | nVal = (Type)pT->GetDlgItemInt(nID, &bSuccess, bSigned); 383 | } 384 | else 385 | { 386 | ATLASSERT(!bValidate || nVal >= nMin && nVal <= nMax); 387 | bSuccess = pT->SetDlgItemInt(nID, nVal, bSigned); 388 | } 389 | 390 | if(!bSuccess) 391 | { 392 | pT->OnDataExchangeError(nID, bSave); 393 | } 394 | else if(bSave && bValidate) // validation 395 | { 396 | ATLASSERT(nMin != nMax); 397 | if(nVal < nMin || nVal > nMax) 398 | { 399 | _XData data = { ddxDataInt }; 400 | data.intData.nVal = (long)nVal; 401 | data.intData.nMin = (long)nMin; 402 | data.intData.nMax = (long)nMax; 403 | pT->OnDataValidateError(nID, bSave, data); 404 | bSuccess = FALSE; 405 | } 406 | } 407 | return bSuccess; 408 | } 409 | 410 | // Float exchange 411 | #ifdef _ATL_USE_DDX_FLOAT 412 | static BOOL _AtlSimpleFloatParse(LPCTSTR lpszText, double& d) 413 | { 414 | ATLASSERT(lpszText != NULL); 415 | while (*lpszText == _T(' ') || *lpszText == _T('\t')) 416 | lpszText++; 417 | 418 | TCHAR chFirst = lpszText[0]; 419 | d = _tcstod(lpszText, (LPTSTR*)&lpszText); 420 | if (d == 0.0 && chFirst != _T('0')) 421 | return FALSE; // could not convert 422 | while (*lpszText == _T(' ') || *lpszText == _T('\t')) 423 | lpszText++; 424 | 425 | if (*lpszText != _T('\0')) 426 | return FALSE; // not terminated properly 427 | 428 | return TRUE; 429 | } 430 | 431 | BOOL DDX_Float(UINT nID, float& nVal, BOOL bSave, BOOL bValidate = FALSE, float nMin = 0.F, float nMax = 0.F, int nPrecision = FLT_DIG) 432 | { 433 | T* pT = static_cast(this); 434 | BOOL bSuccess = TRUE; 435 | const int cchBuff = 32; 436 | TCHAR szBuff[cchBuff] = { 0 }; 437 | 438 | if(bSave) 439 | { 440 | pT->GetDlgItemText(nID, szBuff, cchBuff); 441 | double d = 0; 442 | if(_AtlSimpleFloatParse(szBuff, d)) 443 | nVal = (float)d; 444 | else 445 | bSuccess = FALSE; 446 | } 447 | else 448 | { 449 | ATLASSERT(!bValidate || nVal >= nMin && nVal <= nMax); 450 | SecureHelper::sprintf_x(szBuff, cchBuff, _T("%.*g"), nPrecision, nVal); 451 | bSuccess = pT->SetDlgItemText(nID, szBuff); 452 | } 453 | 454 | if(!bSuccess) 455 | { 456 | pT->OnDataExchangeError(nID, bSave); 457 | } 458 | else if(bSave && bValidate) // validation 459 | { 460 | ATLASSERT(nMin != nMax); 461 | if(nVal < nMin || nVal > nMax) 462 | { 463 | _XData data = { ddxDataFloat }; 464 | data.floatData.nVal = (double)nVal; 465 | data.floatData.nMin = (double)nMin; 466 | data.floatData.nMax = (double)nMax; 467 | pT->OnDataValidateError(nID, bSave, data); 468 | bSuccess = FALSE; 469 | } 470 | } 471 | return bSuccess; 472 | } 473 | 474 | BOOL DDX_Float(UINT nID, double& nVal, BOOL bSave, BOOL bValidate = FALSE, double nMin = 0., double nMax = 0., int nPrecision = DBL_DIG) 475 | { 476 | T* pT = static_cast(this); 477 | BOOL bSuccess = TRUE; 478 | const int cchBuff = 32; 479 | TCHAR szBuff[cchBuff] = { 0 }; 480 | 481 | if(bSave) 482 | { 483 | pT->GetDlgItemText(nID, szBuff, cchBuff); 484 | double d = 0; 485 | if(_AtlSimpleFloatParse(szBuff, d)) 486 | nVal = d; 487 | else 488 | bSuccess = FALSE; 489 | } 490 | else 491 | { 492 | ATLASSERT(!bValidate || nVal >= nMin && nVal <= nMax); 493 | SecureHelper::sprintf_x(szBuff, cchBuff, _T("%.*g"), nPrecision, nVal); 494 | bSuccess = pT->SetDlgItemText(nID, szBuff); 495 | } 496 | 497 | if(!bSuccess) 498 | { 499 | pT->OnDataExchangeError(nID, bSave); 500 | } 501 | else if(bSave && bValidate) // validation 502 | { 503 | ATLASSERT(nMin != nMax); 504 | if(nVal < nMin || nVal > nMax) 505 | { 506 | _XData data = { ddxDataFloat }; 507 | data.floatData.nVal = nVal; 508 | data.floatData.nMin = nMin; 509 | data.floatData.nMax = nMax; 510 | pT->OnDataValidateError(nID, bSave, data); 511 | bSuccess = FALSE; 512 | } 513 | } 514 | return bSuccess; 515 | } 516 | #endif // _ATL_USE_DDX_FLOAT 517 | 518 | // Full control subclassing (for CWindowImpl derived controls) 519 | template 520 | void DDX_Control(UINT nID, TControl& ctrl, BOOL bSave) 521 | { 522 | if(!bSave && ctrl.m_hWnd == NULL) 523 | { 524 | T* pT = static_cast(this); 525 | ctrl.SubclassWindow(pT->GetDlgItem(nID)); 526 | } 527 | } 528 | 529 | // Simple control attaching (for HWND wrapper controls) 530 | template 531 | void DDX_Control_Handle(UINT nID, TControl& ctrl, BOOL bSave) 532 | { 533 | if(!bSave && ctrl.m_hWnd == NULL) 534 | { 535 | T* pT = static_cast(this); 536 | ctrl = pT->GetDlgItem(nID); 537 | } 538 | } 539 | 540 | // Control state 541 | void DDX_Check(UINT nID, int& nValue, BOOL bSave) 542 | { 543 | T* pT = static_cast(this); 544 | HWND hWndCtrl = pT->GetDlgItem(nID); 545 | if(bSave) 546 | { 547 | nValue = (int)::SendMessage(hWndCtrl, BM_GETCHECK, 0, 0L); 548 | ATLASSERT(nValue >= 0 && nValue <= 2); 549 | } 550 | else 551 | { 552 | if(nValue < 0 || nValue > 2) 553 | { 554 | ATLTRACE2(atlTraceUI, 0, _T("ATL: Warning - dialog data checkbox value (%d) out of range.\n"), nValue); 555 | nValue = 0; // default to off 556 | } 557 | ::SendMessage(hWndCtrl, BM_SETCHECK, nValue, 0L); 558 | } 559 | } 560 | 561 | // variant that supports bool (checked/not-checked, no intermediate state) 562 | void DDX_Check(UINT nID, bool& bCheck, BOOL bSave) 563 | { 564 | int nValue = bCheck ? 1 : 0; 565 | DDX_Check(nID, nValue, bSave); 566 | 567 | if(bSave) 568 | { 569 | if(nValue == 2) 570 | ATLTRACE2(atlTraceUI, 0, _T("ATL: Warning - checkbox state (%d) out of supported range.\n"), nValue); 571 | bCheck = (nValue == 1); 572 | } 573 | } 574 | 575 | void DDX_Radio(UINT nID, int& nValue, BOOL bSave) 576 | { 577 | T* pT = static_cast(this); 578 | HWND hWndCtrl = pT->GetDlgItem(nID); 579 | ATLASSERT(hWndCtrl != NULL); 580 | 581 | // must be first in a group of auto radio buttons 582 | ATLASSERT(::GetWindowLong(hWndCtrl, GWL_STYLE) & WS_GROUP); 583 | ATLASSERT(::SendMessage(hWndCtrl, WM_GETDLGCODE, 0, 0L) & DLGC_RADIOBUTTON); 584 | 585 | if(bSave) 586 | nValue = -1; // value if none found 587 | 588 | // walk all children in group 589 | int nButton = 0; 590 | do 591 | { 592 | if(::SendMessage(hWndCtrl, WM_GETDLGCODE, 0, 0L) & DLGC_RADIOBUTTON) 593 | { 594 | // control in group is a radio button 595 | if(bSave) 596 | { 597 | if(::SendMessage(hWndCtrl, BM_GETCHECK, 0, 0L) != 0) 598 | { 599 | ATLASSERT(nValue == -1); // only set once 600 | nValue = nButton; 601 | } 602 | } 603 | else 604 | { 605 | // select button 606 | ::SendMessage(hWndCtrl, BM_SETCHECK, (nButton == nValue), 0L); 607 | } 608 | nButton++; 609 | } 610 | else 611 | { 612 | ATLTRACE2(atlTraceUI, 0, _T("ATL: Warning - skipping non-radio button in group.\n")); 613 | } 614 | hWndCtrl = ::GetWindow(hWndCtrl, GW_HWNDNEXT); 615 | } 616 | while (hWndCtrl != NULL && !(GetWindowLong(hWndCtrl, GWL_STYLE) & WS_GROUP)); 617 | } 618 | 619 | // DDX support for Tab, Combo, ListBox and ListView selection index 620 | #if (_MSC_VER >= 1300) 621 | template 622 | INT _getSel(TCtrl& tCtrl) 623 | { 624 | return tCtrl.GetCurSel(); 625 | } 626 | 627 | template 628 | void _setSel(TCtrl& tCtrl, INT iSel) 629 | { 630 | if(iSel < 0) 631 | tCtrl.SetCurSel(-1); 632 | else 633 | tCtrl.SetCurSel(iSel); 634 | } 635 | 636 | #ifdef __ATLCTRLS_H__ 637 | // ListViewCtrl specialization 638 | template <> 639 | INT _getSel(WTL::CListViewCtrl& tCtrl) 640 | { 641 | return tCtrl.GetSelectedIndex(); 642 | } 643 | 644 | template <> 645 | void _setSel(WTL::CListViewCtrl& tCtrl, INT iSel) 646 | { 647 | if(iSel < 0) 648 | tCtrl.SelectItem(-1); 649 | else 650 | tCtrl.SelectItem(iSel); 651 | } 652 | #endif // __ATLCTRLS_H__ 653 | 654 | template 655 | void DDX_Index(UINT nID, INT& nVal, BOOL bSave) 656 | { 657 | T* pT = static_cast(this); 658 | TCtrl ctrl(pT->GetDlgItem(nID)); 659 | 660 | if(bSave) 661 | nVal = _getSel(ctrl); 662 | else 663 | _setSel(ctrl, nVal); 664 | } 665 | #endif // (_MSC_VER >= 1300) 666 | 667 | // Overrideables 668 | void OnDataExchangeError(UINT nCtrlID, BOOL /*bSave*/) 669 | { 670 | // Override to display an error message 671 | ::MessageBeep((UINT)-1); 672 | T* pT = static_cast(this); 673 | ::SetFocus(pT->GetDlgItem(nCtrlID)); 674 | } 675 | 676 | void OnDataValidateError(UINT nCtrlID, BOOL /*bSave*/, _XData& /*data*/) 677 | { 678 | // Override to display an error message 679 | ::MessageBeep((UINT)-1); 680 | T* pT = static_cast(this); 681 | ::SetFocus(pT->GetDlgItem(nCtrlID)); 682 | } 683 | }; 684 | 685 | }; // namespace WTL 686 | 687 | #endif // __ATLDDX_H__ 688 | -------------------------------------------------------------------------------- /HandleSpy/wtl/include/atlres.h: -------------------------------------------------------------------------------- 1 | // Windows Template Library - WTL version 9.0 2 | // Copyright (C) Microsoft Corporation, WTL Team. All rights reserved. 3 | // 4 | // This file is a part of the Windows Template Library. 5 | // The use and distribution terms for this software are covered by the 6 | // Common Public License 1.0 (http://opensource.org/licenses/cpl1.0.php) 7 | // which can be found in the file CPL.TXT at the root of this distribution. 8 | // By using this software in any fashion, you are agreeing to be bound by 9 | // the terms of this license. You must not remove this notice, or 10 | // any other, from this software. 11 | 12 | #ifndef __ATLRES_H__ 13 | #define __ATLRES_H__ 14 | 15 | #pragma once 16 | 17 | #if defined(_WIN32_WCE) && !defined(__ATLRESCE_H__) 18 | #error Use atlresCE.h instead of atlres.h for Windows CE 19 | #endif 20 | 21 | 22 | #ifdef RC_INVOKED 23 | #ifndef _INC_WINDOWS 24 | 25 | #define _INC_WINDOWS 26 | 27 | #ifndef _WIN32_WCE 28 | #define VS_VERSION_INFO 1 29 | 30 | #ifdef APSTUDIO_INVOKED 31 | #define APSTUDIO_HIDDEN_SYMBOLS // Ignore following symbols 32 | #endif // APSTUDIO_INVOKED 33 | 34 | #ifndef WINVER 35 | #define WINVER 0x0400 // default to Windows Version 4.0 36 | #endif // !WINVER 37 | 38 | #include 39 | 40 | // operation messages sent to DLGINIT 41 | #define LB_ADDSTRING (WM_USER+1) 42 | #define CB_ADDSTRING (WM_USER+3) 43 | #endif // !_WIN32_WCE 44 | 45 | #ifdef APSTUDIO_INVOKED 46 | #undef APSTUDIO_HIDDEN_SYMBOLS 47 | #endif // APSTUDIO_INVOKED 48 | 49 | #ifdef IDC_STATIC 50 | #undef IDC_STATIC 51 | #endif // IDC_STATIC 52 | #define IDC_STATIC (-1) 53 | 54 | #endif // !_INC_WINDOWS 55 | #endif // RC_INVOKED 56 | 57 | #ifdef APSTUDIO_INVOKED 58 | #define APSTUDIO_HIDDEN_SYMBOLS 59 | #endif // APSTUDIO_INVOKED 60 | 61 | /////////////////////////////////////////////////////////////////////////////// 62 | // ATL resource types 63 | 64 | #ifndef RC_INVOKED 65 | #define RT_DLGINIT MAKEINTRESOURCE(240) 66 | #define RT_TOOLBAR MAKEINTRESOURCE(241) 67 | #endif // RC_INVOKED 68 | 69 | /////////////////////////////////////////////////////////////////////////////// 70 | 71 | #ifdef APSTUDIO_INVOKED 72 | #undef APSTUDIO_HIDDEN_SYMBOLS 73 | #endif // APSTUDIO_INVOKED 74 | 75 | /////////////////////////////////////////////////////////////////////////////// 76 | // Standard window components 77 | 78 | #define ID_SEPARATOR 0 // special separator value 79 | #define ID_DEFAULT_PANE 0 // default status bar pane 80 | 81 | #ifndef RC_INVOKED // code only 82 | // standard control bars (IDW = window ID) 83 | #define ATL_IDW_TOOLBAR 0xE800 // main Toolbar for window 84 | #define ATL_IDW_STATUS_BAR 0xE801 // Status bar window 85 | #define ATL_IDW_COMMAND_BAR 0xE802 // Command bar window 86 | 87 | // parts of a frame window 88 | #define ATL_IDW_CLIENT 0xE900 89 | #define ATL_IDW_PANE_FIRST 0xE900 // first pane (256 max) 90 | #define ATL_IDW_PANE_LAST 0xE9FF 91 | #define ATL_IDW_HSCROLL_FIRST 0xEA00 // first Horz scrollbar (16 max) 92 | #define ATL_IDW_VSCROLL_FIRST 0xEA10 // first Vert scrollbar (16 max) 93 | 94 | #define ATL_IDW_SIZE_BOX 0xEA20 // size box for splitters 95 | #define ATL_IDW_PANE_SAVE 0xEA21 // to shift ATL_IDW_PANE_FIRST 96 | 97 | // bands for a rebar 98 | #define ATL_IDW_BAND_FIRST 0xEB00 99 | #define ATL_IDW_BAND_LAST 0xEBFF 100 | #endif // !RC_INVOKED 101 | 102 | /////////////////////////////////////////////////////////////////////////////// 103 | // Standard Commands 104 | 105 | // File commands 106 | #define ID_FILE_NEW 0xE100 107 | #define ID_FILE_OPEN 0xE101 108 | #define ID_FILE_CLOSE 0xE102 109 | #define ID_FILE_SAVE 0xE103 110 | #define ID_FILE_SAVE_AS 0xE104 111 | #define ID_FILE_PAGE_SETUP 0xE105 112 | #define ID_FILE_PRINT_SETUP 0xE106 113 | #define ID_FILE_PRINT 0xE107 114 | #define ID_FILE_PRINT_DIRECT 0xE108 115 | #define ID_FILE_PRINT_PREVIEW 0xE109 116 | #define ID_FILE_UPDATE 0xE10A 117 | #define ID_FILE_SAVE_COPY_AS 0xE10B 118 | #define ID_FILE_SEND_MAIL 0xE10C 119 | 120 | #define ID_FILE_MRU_FIRST 0xE110 121 | #define ID_FILE_MRU_FILE1 0xE110 // range - 16 max 122 | #define ID_FILE_MRU_FILE2 0xE111 123 | #define ID_FILE_MRU_FILE3 0xE112 124 | #define ID_FILE_MRU_FILE4 0xE113 125 | #define ID_FILE_MRU_FILE5 0xE114 126 | #define ID_FILE_MRU_FILE6 0xE115 127 | #define ID_FILE_MRU_FILE7 0xE116 128 | #define ID_FILE_MRU_FILE8 0xE117 129 | #define ID_FILE_MRU_FILE9 0xE118 130 | #define ID_FILE_MRU_FILE10 0xE119 131 | #define ID_FILE_MRU_FILE11 0xE11A 132 | #define ID_FILE_MRU_FILE12 0xE11B 133 | #define ID_FILE_MRU_FILE13 0xE11C 134 | #define ID_FILE_MRU_FILE14 0xE11D 135 | #define ID_FILE_MRU_FILE15 0xE11E 136 | #define ID_FILE_MRU_FILE16 0xE11F 137 | #define ID_FILE_MRU_LAST 0xE11F 138 | 139 | // Edit commands 140 | #define ID_EDIT_CLEAR 0xE120 141 | #define ID_EDIT_CLEAR_ALL 0xE121 142 | #define ID_EDIT_COPY 0xE122 143 | #define ID_EDIT_CUT 0xE123 144 | #define ID_EDIT_FIND 0xE124 145 | #define ID_EDIT_PASTE 0xE125 146 | #define ID_EDIT_PASTE_LINK 0xE126 147 | #define ID_EDIT_PASTE_SPECIAL 0xE127 148 | #define ID_EDIT_REPEAT 0xE128 149 | #define ID_EDIT_REPLACE 0xE129 150 | #define ID_EDIT_SELECT_ALL 0xE12A 151 | #define ID_EDIT_UNDO 0xE12B 152 | #define ID_EDIT_REDO 0xE12C 153 | #define ID_EDIT_DELETE ID_EDIT_CLEAR 154 | #define ID_EDIT_FIND_NEXT ID_EDIT_REPEAT 155 | #define ID_EDIT_FIND_PREVIOUS 0xE12D 156 | 157 | // Window commands 158 | #define ID_WINDOW_NEW 0xE130 159 | #define ID_WINDOW_ARRANGE 0xE131 160 | #define ID_WINDOW_CASCADE 0xE132 161 | #define ID_WINDOW_TILE_HORZ 0xE133 162 | #define ID_WINDOW_TILE_VERT 0xE134 163 | #define ID_WINDOW_SPLIT 0xE135 164 | #ifndef RC_INVOKED // code only 165 | #define ATL_IDM_WINDOW_FIRST 0xE130 166 | #define ATL_IDM_WINDOW_LAST 0xE13F 167 | #define ATL_IDM_FIRST_MDICHILD 0xFF00 // window list starts here 168 | #define ATL_IDM_LAST_MDICHILD 0xFFFD 169 | #endif // !RC_INVOKED 170 | // TabView 171 | #define ID_WINDOW_TABFIRST 0xFF00 // = ATL_IDM_FIRST_MDICHILD 172 | #define ID_WINDOW_TABLAST 0xFFFD 173 | #define ID_WINDOW_SHOWTABLIST 0xFFFE 174 | 175 | // Help and App commands 176 | #define ID_APP_ABOUT 0xE140 177 | #define ID_APP_EXIT 0xE141 178 | #define ID_HELP_INDEX 0xE142 179 | #define ID_HELP_FINDER 0xE143 180 | #define ID_HELP_USING 0xE144 181 | #define ID_CONTEXT_HELP 0xE145 // shift-F1 182 | // special commands for processing help 183 | #define ID_HELP 0xE146 // first attempt for F1 184 | #define ID_DEFAULT_HELP 0xE147 // last attempt 185 | 186 | // Misc 187 | #define ID_NEXT_PANE 0xE150 188 | #define ID_PREV_PANE 0xE151 189 | #define ID_PANE_CLOSE 0xE152 190 | #define ID_PANE_NEXT ID_NEXT_PANE 191 | #define ID_PANE_PREVIOUS ID_PREV_PANE 192 | 193 | // Format 194 | #define ID_FORMAT_FONT 0xE160 195 | 196 | // Scroll 197 | #define ID_SCROLL_UP 0xE170 198 | #define ID_SCROLL_DOWN 0xE171 199 | #define ID_SCROLL_PAGE_UP 0xE172 200 | #define ID_SCROLL_PAGE_DOWN 0xE173 201 | #define ID_SCROLL_TOP 0xE174 202 | #define ID_SCROLL_BOTTOM 0xE175 203 | #define ID_SCROLL_LEFT 0xE176 204 | #define ID_SCROLL_RIGHT 0xE177 205 | #define ID_SCROLL_PAGE_LEFT 0xE178 206 | #define ID_SCROLL_PAGE_RIGHT 0xE179 207 | #define ID_SCROLL_ALL_LEFT 0xE17A 208 | #define ID_SCROLL_ALL_RIGHT 0xE17B 209 | 210 | // OLE commands 211 | #define ID_OLE_INSERT_NEW 0xE200 212 | #define ID_OLE_EDIT_LINKS 0xE201 213 | #define ID_OLE_EDIT_CONVERT 0xE202 214 | #define ID_OLE_EDIT_CHANGE_ICON 0xE203 215 | #define ID_OLE_EDIT_PROPERTIES 0xE204 216 | #define ID_OLE_VERB_FIRST 0xE210 // range - 16 max 217 | #ifndef RC_INVOKED // code only 218 | #define ID_OLE_VERB_LAST 0xE21F 219 | #endif // !RC_INVOKED 220 | 221 | // View commands (same number used as IDW used for toolbar and status bar) 222 | #define ID_VIEW_TOOLBAR 0xE800 223 | #define ID_VIEW_STATUS_BAR 0xE801 224 | #define ID_VIEW_REFRESH 0xE803 225 | #define ID_VIEW_RIBBON 0xE804 226 | 227 | /////////////////////////////////////////////////////////////////////////////// 228 | // Standard control IDs 229 | 230 | #ifdef IDC_STATIC 231 | #undef IDC_STATIC 232 | #endif // IDC_STATIC 233 | #define IDC_STATIC (-1) // all static controls 234 | 235 | /////////////////////////////////////////////////////////////////////////////// 236 | // Standard string error/warnings 237 | 238 | // idle status bar message 239 | #define ATL_IDS_IDLEMESSAGE 0xE001 240 | 241 | #ifndef RC_INVOKED // code only 242 | #define ATL_IDS_SCFIRST 0xEF00 243 | #endif // !RC_INVOKED 244 | 245 | #define ATL_IDS_SCSIZE 0xEF00 246 | #define ATL_IDS_SCMOVE 0xEF01 247 | #define ATL_IDS_SCMINIMIZE 0xEF02 248 | #define ATL_IDS_SCMAXIMIZE 0xEF03 249 | #define ATL_IDS_SCNEXTWINDOW 0xEF04 250 | #define ATL_IDS_SCPREVWINDOW 0xEF05 251 | #define ATL_IDS_SCCLOSE 0xEF06 252 | #define ATL_IDS_SCRESTORE 0xEF12 253 | #define ATL_IDS_SCTASKLIST 0xEF13 254 | 255 | #define ATL_IDS_MDICHILD 0xEF1F 256 | #define ATL_IDS_MRU_FILE 0xEFDA 257 | 258 | /////////////////////////////////////////////////////////////////////////////// 259 | // Misc. control IDs 260 | 261 | // Property Sheet control id's (determined with Spy++) 262 | #define ID_APPLY_NOW 0x3021 263 | #define ID_WIZBACK 0x3023 264 | #define ID_WIZNEXT 0x3024 265 | #define ID_WIZFINISH 0x3025 266 | #define ATL_IDC_TAB_CONTROL 0x3020 267 | 268 | #endif // __ATLRES_H__ 269 | -------------------------------------------------------------------------------- /HandleSpy/wtl/include/atlresce.h: -------------------------------------------------------------------------------- 1 | // Windows Template Library - WTL version 9.0 2 | // Copyright (C) Microsoft Corporation, WTL Team. All rights reserved. 3 | // 4 | // This file is a part of the Windows Template Library. 5 | // The use and distribution terms for this software are covered by the 6 | // Common Public License 1.0 (http://opensource.org/licenses/cpl1.0.php) 7 | // which can be found in the file CPL.TXT at the root of this distribution. 8 | // By using this software in any fashion, you are agreeing to be bound by 9 | // the terms of this license. You must not remove this notice, or 10 | // any other, from this software. 11 | 12 | #ifndef __ATLRESCE_H__ 13 | #define __ATLRESCE_H__ 14 | 15 | #pragma once 16 | 17 | #ifndef _WIN32_WCE 18 | #error atlresCE.h is only for Windows CE 19 | #endif 20 | 21 | 22 | #ifdef RC_INVOKED 23 | #ifndef _INC_WINDOWS 24 | 25 | #define VS_VERSION_INFO 1 26 | 27 | #ifdef APSTUDIO_INVOKED 28 | #define APSTUDIO_HIDDEN_SYMBOLS // Ignore following symbols 29 | #endif // APSTUDIO_INVOKED 30 | 31 | #ifndef WINVER 32 | #define WINVER 0x0400 // default to Windows Version 4.0 33 | #endif // !WINVER 34 | 35 | #if !defined(WCEOLE_ENABLE_DIALOGEX) 36 | #define DIALOGEX DIALOG DISCARDABLE 37 | #endif 38 | 39 | #include 40 | #define SHMENUBAR RCDATA 41 | 42 | #if defined(SHELLSDK_MODULES_AYGSHELL) 43 | #include 44 | #else 45 | #define NOMENU 0xFFFF 46 | #define IDS_SHNEW 1 47 | #define IDM_SHAREDNEW 10 48 | #define IDM_SHAREDNEWDEFAULT 11 49 | #endif 50 | #ifndef I_IMAGENONE 51 | #define I_IMAGENONE (-2) 52 | #endif 53 | 54 | #include 55 | 56 | #endif // !_INC_WINDOWS 57 | #endif // RC_INVOKED 58 | 59 | #include "atlres.h" 60 | 61 | #ifdef APSTUDIO_INVOKED 62 | #undef APSTUDIO_HIDDEN_SYMBOLS 63 | #endif // APSTUDIO_INVOKED 64 | 65 | // Visual Studio dialog editor bug fix 66 | #ifndef DS_FIXEDSYS 67 | #define DS_FIXEDSYS 0 68 | #endif 69 | 70 | #define IDC_INFOSTATIC 0xFFFE // == IDC_STATIC -1 71 | 72 | /////////////////////////////////////////////////////////////////////////////// 73 | // Smartphone and PPC 2005 Resource IDs 74 | 75 | // Command and associated string resource IDs 76 | #define ID_MENU_OK 0xE790 77 | #define ID_MENU_CANCEL 0xE791 78 | #define ID_MENU 0xE792 79 | #define ID_ACTION 0xE793 80 | #define ID_VIEW_FULLSCREEN 0xE802 81 | 82 | // MenuBar resource IDs 83 | #define ATL_IDM_MENU_DONE 0xE701 84 | #define ATL_IDM_MENU_CANCEL 0xE702 85 | #define ATL_IDM_MENU_DONECANCEL 0xE703 86 | 87 | // Default device MenuBar control ID and MenuBar resource ID 88 | #define ATL_IDW_MENU_BAR 0xE802 89 | 90 | // SmartPhone spinned controls ID offset for CSpinCtrl 91 | #define ATL_IDW_SPIN_ID 9999 92 | 93 | #endif // __ATLRESCE_H__ 94 | -------------------------------------------------------------------------------- /HandleSpy/wtl/include/atlwinx.h: -------------------------------------------------------------------------------- 1 | // Windows Template Library - WTL version 9.0 2 | // Copyright (C) Microsoft Corporation, WTL Team. All rights reserved. 3 | // 4 | // This file is a part of the Windows Template Library. 5 | // The use and distribution terms for this software are covered by the 6 | // Common Public License 1.0 (http://opensource.org/licenses/cpl1.0.php) 7 | // which can be found in the file CPL.TXT at the root of this distribution. 8 | // By using this software in any fashion, you are agreeing to be bound by 9 | // the terms of this license. You must not remove this notice, or 10 | // any other, from this software. 11 | 12 | #ifndef __ATLWINX_H__ 13 | #define __ATLWINX_H__ 14 | 15 | #pragma once 16 | 17 | #ifndef __ATLAPP_H__ 18 | #error atlwinx.h requires atlapp.h to be included first 19 | #endif 20 | 21 | #if (_ATL_VER >= 0x0700) 22 | #include 23 | #endif // (_ATL_VER >= 0x0700) 24 | 25 | 26 | /////////////////////////////////////////////////////////////////////////////// 27 | // Classes in this file: 28 | // 29 | // _U_RECT 30 | // _U_MENUorID 31 | // _U_STRINGorID 32 | 33 | 34 | /////////////////////////////////////////////////////////////////////////////// 35 | // Command Chaining Macros 36 | 37 | #define CHAIN_COMMANDS(theChainClass) \ 38 | if(uMsg == WM_COMMAND) \ 39 | CHAIN_MSG_MAP(theChainClass) 40 | 41 | #define CHAIN_COMMANDS_ALT(theChainClass, msgMapID) \ 42 | if(uMsg == WM_COMMAND) \ 43 | CHAIN_MSG_MAP_ALT(theChainClass, msgMapID) 44 | 45 | #define CHAIN_COMMANDS_MEMBER(theChainMember) \ 46 | if(uMsg == WM_COMMAND) \ 47 | CHAIN_MSG_MAP_MEMBER(theChainMember) 48 | 49 | #define CHAIN_COMMANDS_ALT_MEMBER(theChainMember, msgMapID) \ 50 | if(uMsg == WM_COMMAND) \ 51 | CHAIN_MSG_MAP_ALT_MEMBER(theChainMember, msgMapID) 52 | 53 | 54 | /////////////////////////////////////////////////////////////////////////////// 55 | // Macros for parent message map to selectively reflect control messages 56 | 57 | // NOTE: ReflectNotifications is a member of ATL's CWindowImplRoot 58 | // (and overridden in 2 cases - CContainedWindowT and CAxHostWindow) 59 | // Since we can't modify ATL, we'll provide the needed additions 60 | // in a separate function (that is not a member of CWindowImplRoot) 61 | 62 | namespace WTL 63 | { 64 | 65 | inline LRESULT WtlReflectNotificationsFiltered(HWND hWndParent, UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& bHandled, 66 | UINT uMsgFilter = WM_NULL, UINT_PTR idFromFilter = 0, HWND hWndChildFilter = NULL) 67 | { 68 | if((uMsgFilter != WM_NULL) && (uMsgFilter != uMsg)) 69 | { 70 | // The notification message doesn't match the filter. 71 | bHandled = FALSE; 72 | return 1; 73 | } 74 | 75 | HWND hWndChild = NULL; 76 | UINT_PTR idFrom = 0; 77 | 78 | switch(uMsg) 79 | { 80 | case WM_COMMAND: 81 | if(lParam != NULL) // not from a menu 82 | { 83 | hWndChild = (HWND)lParam; 84 | idFrom = (UINT_PTR)LOWORD(wParam); 85 | } 86 | break; 87 | case WM_NOTIFY: 88 | hWndChild = ((LPNMHDR)lParam)->hwndFrom; 89 | idFrom = ((LPNMHDR)lParam)->idFrom; 90 | break; 91 | #ifndef _WIN32_WCE 92 | case WM_PARENTNOTIFY: 93 | switch(LOWORD(wParam)) 94 | { 95 | case WM_CREATE: 96 | case WM_DESTROY: 97 | hWndChild = (HWND)lParam; 98 | idFrom = (UINT_PTR)HIWORD(wParam); 99 | break; 100 | default: 101 | hWndChild = ::GetDlgItem(hWndParent, HIWORD(wParam)); 102 | idFrom = (UINT_PTR)::GetDlgCtrlID(hWndChild); 103 | break; 104 | } 105 | break; 106 | #endif // !_WIN32_WCE 107 | case WM_DRAWITEM: 108 | if(wParam) // not from a menu 109 | { 110 | hWndChild = ((LPDRAWITEMSTRUCT)lParam)->hwndItem; 111 | idFrom = (UINT_PTR)wParam; 112 | } 113 | break; 114 | case WM_MEASUREITEM: 115 | if(wParam) // not from a menu 116 | { 117 | hWndChild = ::GetDlgItem(hWndParent, ((LPMEASUREITEMSTRUCT)lParam)->CtlID); 118 | idFrom = (UINT_PTR)wParam; 119 | } 120 | break; 121 | case WM_COMPAREITEM: 122 | if(wParam) // not from a menu 123 | { 124 | hWndChild = ((LPCOMPAREITEMSTRUCT)lParam)->hwndItem; 125 | idFrom = (UINT_PTR)wParam; 126 | } 127 | break; 128 | case WM_DELETEITEM: 129 | if(wParam) // not from a menu 130 | { 131 | hWndChild = ((LPDELETEITEMSTRUCT)lParam)->hwndItem; 132 | idFrom = (UINT_PTR)wParam; 133 | } 134 | break; 135 | case WM_VKEYTOITEM: 136 | case WM_CHARTOITEM: 137 | case WM_HSCROLL: 138 | case WM_VSCROLL: 139 | hWndChild = (HWND)lParam; 140 | idFrom = (UINT_PTR)::GetDlgCtrlID(hWndChild); 141 | break; 142 | case WM_CTLCOLORBTN: 143 | case WM_CTLCOLORDLG: 144 | case WM_CTLCOLOREDIT: 145 | case WM_CTLCOLORLISTBOX: 146 | case WM_CTLCOLORMSGBOX: 147 | case WM_CTLCOLORSCROLLBAR: 148 | case WM_CTLCOLORSTATIC: 149 | hWndChild = (HWND)lParam; 150 | idFrom = (UINT_PTR)::GetDlgCtrlID(hWndChild); 151 | break; 152 | default: 153 | break; 154 | } 155 | 156 | if((hWndChild == NULL) || 157 | ((hWndChildFilter != NULL) && (hWndChildFilter != hWndChild))) 158 | { 159 | // Either hWndChild isn't valid, or 160 | // hWndChild doesn't match the filter. 161 | bHandled = FALSE; 162 | return 1; 163 | } 164 | 165 | if((idFromFilter != 0) && (idFromFilter != idFrom)) 166 | { 167 | // The dialog control id doesn't match the filter. 168 | bHandled = FALSE; 169 | return 1; 170 | } 171 | 172 | ATLASSERT(::IsWindow(hWndChild)); 173 | LRESULT lResult = ::SendMessage(hWndChild, OCM__BASE + uMsg, wParam, lParam); 174 | if((lResult == 0) && (uMsg >= WM_CTLCOLORMSGBOX) && (uMsg <= WM_CTLCOLORSTATIC)) 175 | { 176 | // Try to prevent problems with WM_CTLCOLOR* messages when 177 | // the message wasn't really handled 178 | bHandled = FALSE; 179 | } 180 | 181 | return lResult; 182 | } 183 | 184 | }; // namespace WTL 185 | 186 | // Try to prevent problems with WM_CTLCOLOR* messages when 187 | // the message wasn't really handled 188 | #define REFLECT_NOTIFICATIONS_EX() \ 189 | { \ 190 | bHandled = TRUE; \ 191 | lResult = ReflectNotifications(uMsg, wParam, lParam, bHandled); \ 192 | if((lResult == 0) && (uMsg >= WM_CTLCOLORMSGBOX) && (uMsg <= WM_CTLCOLORSTATIC)) \ 193 | bHandled = FALSE; \ 194 | if(bHandled) \ 195 | return TRUE; \ 196 | } 197 | 198 | #define REFLECT_NOTIFICATIONS_MSG_FILTERED(uMsgFilter) \ 199 | { \ 200 | bHandled = TRUE; \ 201 | lResult = WTL::WtlReflectNotificationsFiltered(m_hWnd, uMsg, wParam, lParam, bHandled, uMsgFilter, 0, NULL); \ 202 | if(bHandled) \ 203 | return TRUE; \ 204 | } 205 | 206 | #define REFLECT_NOTIFICATIONS_ID_FILTERED(idFromFilter) \ 207 | { \ 208 | bHandled = TRUE; \ 209 | lResult = WTL::WtlReflectNotificationsFiltered(m_hWnd, uMsg, wParam, lParam, bHandled, WM_NULL, idFromFilter, NULL); \ 210 | if(bHandled) \ 211 | return TRUE; \ 212 | } 213 | 214 | #define REFLECT_NOTIFICATIONS_HWND_FILTERED(hWndChildFilter) \ 215 | { \ 216 | bHandled = TRUE; \ 217 | lResult = WTL::WtlReflectNotificationsFiltered(m_hWnd, uMsg, wParam, lParam, bHandled, WM_NULL, 0, hWndChildFilter); \ 218 | if(bHandled) \ 219 | return TRUE; \ 220 | } 221 | 222 | #define REFLECT_NOTIFICATIONS_MSG_ID_FILTERED(uMsgFilter, idFromFilter) \ 223 | { \ 224 | bHandled = TRUE; \ 225 | lResult = WTL::WtlReflectNotificationsFiltered(m_hWnd, uMsg, wParam, lParam, bHandled, uMsgFilter, idFromFilter, NULL); \ 226 | if(bHandled) \ 227 | return TRUE; \ 228 | } 229 | 230 | #define REFLECT_NOTIFICATIONS_MSG_HWND_FILTERED(uMsgFilter, hWndChildFilter) \ 231 | { \ 232 | bHandled = TRUE; \ 233 | lResult = WTL::WtlReflectNotificationsFiltered(m_hWnd, uMsg, wParam, lParam, bHandled, uMsgFilter, 0, hWndChildFilter); \ 234 | if(bHandled) \ 235 | return TRUE; \ 236 | } 237 | 238 | #define REFLECT_COMMAND(id, code) \ 239 | if(uMsg == WM_COMMAND && id == LOWORD(wParam) && code == HIWORD(wParam)) \ 240 | { \ 241 | bHandled = TRUE; \ 242 | lResult = ReflectNotifications(uMsg, wParam, lParam, bHandled); \ 243 | if(bHandled) \ 244 | return TRUE; \ 245 | } 246 | 247 | #define REFLECT_COMMAND_ID(id) \ 248 | if(uMsg == WM_COMMAND && id == LOWORD(wParam)) \ 249 | { \ 250 | bHandled = TRUE; \ 251 | lResult = ReflectNotifications(uMsg, wParam, lParam, bHandled); \ 252 | if(bHandled) \ 253 | return TRUE; \ 254 | } 255 | 256 | #define REFLECT_COMMAND_CODE(code) \ 257 | if(uMsg == WM_COMMAND && code == HIWORD(wParam)) \ 258 | { \ 259 | bHandled = TRUE; \ 260 | lResult = ReflectNotifications(uMsg, wParam, lParam, bHandled); \ 261 | if(bHandled) \ 262 | return TRUE; \ 263 | } 264 | 265 | #define REFLECT_COMMAND_RANGE(idFirst, idLast) \ 266 | if(uMsg == WM_COMMAND && LOWORD(wParam) >= idFirst && LOWORD(wParam) <= idLast) \ 267 | { \ 268 | bHandled = TRUE; \ 269 | lResult = ReflectNotifications(uMsg, wParam, lParam, bHandled); \ 270 | if(bHandled) \ 271 | return TRUE; \ 272 | } 273 | 274 | #define REFLECT_COMMAND_RANGE_CODE(idFirst, idLast, code) \ 275 | if(uMsg == WM_COMMAND && code == HIWORD(wParam) && LOWORD(wParam) >= idFirst && LOWORD(wParam) <= idLast) \ 276 | { \ 277 | bHandled = TRUE; \ 278 | lResult = ReflectNotifications(uMsg, wParam, lParam, bHandled); \ 279 | if(bHandled) \ 280 | return TRUE; \ 281 | } 282 | 283 | #define REFLECT_NOTIFY(id, cd) \ 284 | if(uMsg == WM_NOTIFY && id == ((LPNMHDR)lParam)->idFrom && cd == ((LPNMHDR)lParam)->code) \ 285 | { \ 286 | bHandled = TRUE; \ 287 | lResult = ReflectNotifications(uMsg, wParam, lParam, bHandled); \ 288 | if(bHandled) \ 289 | return TRUE; \ 290 | } 291 | 292 | #define REFLECT_NOTIFY_ID(id) \ 293 | if(uMsg == WM_NOTIFY && id == ((LPNMHDR)lParam)->idFrom) \ 294 | { \ 295 | bHandled = TRUE; \ 296 | lResult = ReflectNotifications(uMsg, wParam, lParam, bHandled); \ 297 | if(bHandled) \ 298 | return TRUE; \ 299 | } 300 | 301 | #define REFLECT_NOTIFY_CODE(cd) \ 302 | if(uMsg == WM_NOTIFY && cd == ((LPNMHDR)lParam)->code) \ 303 | { \ 304 | bHandled = TRUE; \ 305 | lResult = ReflectNotifications(uMsg, wParam, lParam, bHandled); \ 306 | if(bHandled) \ 307 | return TRUE; \ 308 | } 309 | 310 | #define REFLECT_NOTIFY_RANGE(idFirst, idLast) \ 311 | if(uMsg == WM_NOTIFY && ((LPNMHDR)lParam)->idFrom >= idFirst && ((LPNMHDR)lParam)->idFrom <= idLast) \ 312 | { \ 313 | bHandled = TRUE; \ 314 | lResult = ReflectNotifications(uMsg, wParam, lParam, bHandled); \ 315 | if(bHandled) \ 316 | return TRUE; \ 317 | } 318 | 319 | #define REFLECT_NOTIFY_RANGE_CODE(idFirst, idLast, cd) \ 320 | if(uMsg == WM_NOTIFY && cd == ((LPNMHDR)lParam)->code && ((LPNMHDR)lParam)->idFrom >= idFirst && ((LPNMHDR)lParam)->idFrom <= idLast) \ 321 | { \ 322 | bHandled = TRUE; \ 323 | lResult = ReflectNotifications(uMsg, wParam, lParam, bHandled); \ 324 | if(bHandled) \ 325 | return TRUE; \ 326 | } 327 | 328 | 329 | /////////////////////////////////////////////////////////////////////////////// 330 | // Reflected message handler macros for message maps (for ATL 3.0) 331 | 332 | #if (_ATL_VER < 0x0700) 333 | 334 | #define REFLECTED_COMMAND_HANDLER(id, code, func) \ 335 | if(uMsg == OCM_COMMAND && id == LOWORD(wParam) && code == HIWORD(wParam)) \ 336 | { \ 337 | bHandled = TRUE; \ 338 | lResult = func(HIWORD(wParam), LOWORD(wParam), (HWND)lParam, bHandled); \ 339 | if(bHandled) \ 340 | return TRUE; \ 341 | } 342 | 343 | #define REFLECTED_COMMAND_ID_HANDLER(id, func) \ 344 | if(uMsg == OCM_COMMAND && id == LOWORD(wParam)) \ 345 | { \ 346 | bHandled = TRUE; \ 347 | lResult = func(HIWORD(wParam), LOWORD(wParam), (HWND)lParam, bHandled); \ 348 | if(bHandled) \ 349 | return TRUE; \ 350 | } 351 | 352 | #define REFLECTED_COMMAND_CODE_HANDLER(code, func) \ 353 | if(uMsg == OCM_COMMAND && code == HIWORD(wParam)) \ 354 | { \ 355 | bHandled = TRUE; \ 356 | lResult = func(HIWORD(wParam), LOWORD(wParam), (HWND)lParam, bHandled); \ 357 | if(bHandled) \ 358 | return TRUE; \ 359 | } 360 | 361 | #define REFLECTED_COMMAND_RANGE_HANDLER(idFirst, idLast, func) \ 362 | if(uMsg == OCM_COMMAND && LOWORD(wParam) >= idFirst && LOWORD(wParam) <= idLast) \ 363 | { \ 364 | bHandled = TRUE; \ 365 | lResult = func(HIWORD(wParam), LOWORD(wParam), (HWND)lParam, bHandled); \ 366 | if(bHandled) \ 367 | return TRUE; \ 368 | } 369 | 370 | #define REFLECTED_COMMAND_RANGE_CODE_HANDLER(idFirst, idLast, code, func) \ 371 | if(uMsg == OCM_COMMAND && code == HIWORD(wParam) && LOWORD(wParam) >= idFirst && LOWORD(wParam) <= idLast) \ 372 | { \ 373 | bHandled = TRUE; \ 374 | lResult = func(HIWORD(wParam), LOWORD(wParam), (HWND)lParam, bHandled); \ 375 | if(bHandled) \ 376 | return TRUE; \ 377 | } 378 | 379 | #define REFLECTED_NOTIFY_HANDLER(id, cd, func) \ 380 | if(uMsg == OCM_NOTIFY && id == ((LPNMHDR)lParam)->idFrom && cd == ((LPNMHDR)lParam)->code) \ 381 | { \ 382 | bHandled = TRUE; \ 383 | lResult = func((int)wParam, (LPNMHDR)lParam, bHandled); \ 384 | if(bHandled) \ 385 | return TRUE; \ 386 | } 387 | 388 | #define REFLECTED_NOTIFY_ID_HANDLER(id, func) \ 389 | if(uMsg == OCM_NOTIFY && id == ((LPNMHDR)lParam)->idFrom) \ 390 | { \ 391 | bHandled = TRUE; \ 392 | lResult = func((int)wParam, (LPNMHDR)lParam, bHandled); \ 393 | if(bHandled) \ 394 | return TRUE; \ 395 | } 396 | 397 | #define REFLECTED_NOTIFY_CODE_HANDLER(cd, func) \ 398 | if(uMsg == OCM_NOTIFY && cd == ((LPNMHDR)lParam)->code) \ 399 | { \ 400 | bHandled = TRUE; \ 401 | lResult = func((int)wParam, (LPNMHDR)lParam, bHandled); \ 402 | if(bHandled) \ 403 | return TRUE; \ 404 | } 405 | 406 | #define REFLECTED_NOTIFY_RANGE_HANDLER(idFirst, idLast, func) \ 407 | if(uMsg == OCM_NOTIFY && ((LPNMHDR)lParam)->idFrom >= idFirst && ((LPNMHDR)lParam)->idFrom <= idLast) \ 408 | { \ 409 | bHandled = TRUE; \ 410 | lResult = func((int)wParam, (LPNMHDR)lParam, bHandled); \ 411 | if(bHandled) \ 412 | return TRUE; \ 413 | } 414 | 415 | #define REFLECTED_NOTIFY_RANGE_CODE_HANDLER(idFirst, idLast, cd, func) \ 416 | if(uMsg == OCM_NOTIFY && cd == ((LPNMHDR)lParam)->code && ((LPNMHDR)lParam)->idFrom >= idFirst && ((LPNMHDR)lParam)->idFrom <= idLast) \ 417 | { \ 418 | bHandled = TRUE; \ 419 | lResult = func((int)wParam, (LPNMHDR)lParam, bHandled); \ 420 | if(bHandled) \ 421 | return TRUE; \ 422 | } 423 | 424 | #endif // (_ATL_VER < 0x0700) 425 | 426 | 427 | /////////////////////////////////////////////////////////////////////////////// 428 | // Dual argument helper classes (for ATL 3.0) 429 | 430 | #if (_ATL_VER < 0x0700) 431 | 432 | namespace ATL 433 | { 434 | 435 | class _U_RECT 436 | { 437 | public: 438 | _U_RECT(LPRECT lpRect) : m_lpRect(lpRect) 439 | { } 440 | _U_RECT(RECT& rc) : m_lpRect(&rc) 441 | { } 442 | LPRECT m_lpRect; 443 | }; 444 | 445 | class _U_MENUorID 446 | { 447 | public: 448 | _U_MENUorID(HMENU hMenu) : m_hMenu(hMenu) 449 | { } 450 | _U_MENUorID(UINT nID) : m_hMenu((HMENU)LongToHandle(nID)) 451 | { } 452 | HMENU m_hMenu; 453 | }; 454 | 455 | class _U_STRINGorID 456 | { 457 | public: 458 | _U_STRINGorID(LPCTSTR lpString) : m_lpstr(lpString) 459 | { } 460 | _U_STRINGorID(UINT nID) : m_lpstr(MAKEINTRESOURCE(nID)) 461 | { } 462 | LPCTSTR m_lpstr; 463 | }; 464 | 465 | }; // namespace ATL 466 | 467 | #endif // (_ATL_VER < 0x0700) 468 | 469 | 470 | namespace WTL 471 | { 472 | 473 | /////////////////////////////////////////////////////////////////////////////// 474 | // Forward notifications support for message maps (for ATL 3.0) 475 | 476 | #if (_ATL_VER < 0x0700) 477 | 478 | // forward notifications support 479 | #define FORWARD_NOTIFICATIONS() \ 480 | { \ 481 | bHandled = TRUE; \ 482 | lResult = WTL::Atl3ForwardNotifications(m_hWnd, uMsg, wParam, lParam, bHandled); \ 483 | if(bHandled) \ 484 | return TRUE; \ 485 | } 486 | 487 | static LRESULT Atl3ForwardNotifications(HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam, BOOL& bHandled) 488 | { 489 | LRESULT lResult = 0; 490 | switch(uMsg) 491 | { 492 | case WM_COMMAND: 493 | case WM_NOTIFY: 494 | #ifndef _WIN32_WCE 495 | case WM_PARENTNOTIFY: 496 | #endif // !_WIN32_WCE 497 | case WM_DRAWITEM: 498 | case WM_MEASUREITEM: 499 | case WM_COMPAREITEM: 500 | case WM_DELETEITEM: 501 | case WM_VKEYTOITEM: 502 | case WM_CHARTOITEM: 503 | case WM_HSCROLL: 504 | case WM_VSCROLL: 505 | case WM_CTLCOLORBTN: 506 | case WM_CTLCOLORDLG: 507 | case WM_CTLCOLOREDIT: 508 | case WM_CTLCOLORLISTBOX: 509 | case WM_CTLCOLORMSGBOX: 510 | case WM_CTLCOLORSCROLLBAR: 511 | case WM_CTLCOLORSTATIC: 512 | lResult = ::SendMessage(::GetParent(hWnd), uMsg, wParam, lParam); 513 | break; 514 | default: 515 | bHandled = FALSE; 516 | break; 517 | } 518 | return lResult; 519 | } 520 | 521 | #endif // (_ATL_VER < 0x0700) 522 | 523 | }; // namespace WTL 524 | 525 | #endif // __ATLWINX_H__ 526 | -------------------------------------------------------------------------------- /HandleSpy_vs2008.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 10.00 3 | # Visual Studio 2008 4 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "HSHook", "HSHook\HSHook.vcproj", "{E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}" 5 | EndProject 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "HandleSpy", "HandleSpy\HandleSpy.vcproj", "{FB9D7ECF-68FE-4352-9CBF-E48BC964299E}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Win32 = Debug|Win32 11 | NtLayer-Debug|Win32 = NtLayer-Debug|Win32 12 | NtLayer-Release|Win32 = NtLayer-Release|Win32 13 | Release|Win32 = Release|Win32 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.Debug|Win32.ActiveCfg = Debug|Win32 17 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.Debug|Win32.Build.0 = Debug|Win32 18 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.NtLayer-Debug|Win32.ActiveCfg = NtLayer-Debug|Win32 19 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.NtLayer-Debug|Win32.Build.0 = NtLayer-Debug|Win32 20 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.NtLayer-Release|Win32.ActiveCfg = NtLayer-Release|Win32 21 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.NtLayer-Release|Win32.Build.0 = NtLayer-Release|Win32 22 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.Release|Win32.ActiveCfg = Release|Win32 23 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.Release|Win32.Build.0 = Release|Win32 24 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.Debug|Win32.ActiveCfg = Debug|Win32 25 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.Debug|Win32.Build.0 = Debug|Win32 26 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.NtLayer-Debug|Win32.ActiveCfg = NtLayer-Debug|Win32 27 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.NtLayer-Debug|Win32.Build.0 = NtLayer-Debug|Win32 28 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.NtLayer-Release|Win32.ActiveCfg = NtLayer-Release|Win32 29 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.NtLayer-Release|Win32.Build.0 = NtLayer-Release|Win32 30 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.Release|Win32.ActiveCfg = Release|Win32 31 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.Release|Win32.Build.0 = Release|Win32 32 | EndGlobalSection 33 | GlobalSection(SolutionProperties) = preSolution 34 | HideSolutionNode = FALSE 35 | EndGlobalSection 36 | EndGlobal 37 | -------------------------------------------------------------------------------- /HandleSpy_vs2010.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 11.00 3 | # Visual Studio 2010 4 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "HSHook", "HSHook\HSHook.vcxproj", "{E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}" 5 | EndProject 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "HandleSpy", "HandleSpy\HandleSpy.vcxproj", "{FB9D7ECF-68FE-4352-9CBF-E48BC964299E}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|Win32 = Debug|Win32 11 | NtLayer-Debug|Win32 = NtLayer-Debug|Win32 12 | NtLayer-Release|Win32 = NtLayer-Release|Win32 13 | Release|Win32 = Release|Win32 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.Debug|Win32.ActiveCfg = Debug|Win32 17 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.Debug|Win32.Build.0 = Debug|Win32 18 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.NtLayer-Debug|Win32.ActiveCfg = NtLayer-Debug|Win32 19 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.NtLayer-Debug|Win32.Build.0 = NtLayer-Debug|Win32 20 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.NtLayer-Release|Win32.ActiveCfg = NtLayer-Release|Win32 21 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.NtLayer-Release|Win32.Build.0 = NtLayer-Release|Win32 22 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.Release|Win32.ActiveCfg = Release|Win32 23 | {E46E2CB2-88F0-4EC2-A761-C84AE3EE6FB1}.Release|Win32.Build.0 = Release|Win32 24 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.Debug|Win32.ActiveCfg = Debug|Win32 25 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.Debug|Win32.Build.0 = Debug|Win32 26 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.NtLayer-Debug|Win32.ActiveCfg = NtLayer-Debug|Win32 27 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.NtLayer-Debug|Win32.Build.0 = NtLayer-Debug|Win32 28 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.NtLayer-Release|Win32.ActiveCfg = NtLayer-Release|Win32 29 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.NtLayer-Release|Win32.Build.0 = NtLayer-Release|Win32 30 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.Release|Win32.ActiveCfg = Release|Win32 31 | {FB9D7ECF-68FE-4352-9CBF-E48BC964299E}.Release|Win32.Build.0 = Release|Win32 32 | EndGlobalSection 33 | GlobalSection(SolutionProperties) = preSolution 34 | HideSolutionNode = FALSE 35 | EndGlobalSection 36 | EndGlobal 37 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # HandleSpy 2 | Tool to capture the count and source of the HANDLE resources in windows application. 3 | 4 | 5 | ![alt text](hs0.jpg "") 6 | 7 | ![alt text](hs1.jpg "") -------------------------------------------------------------------------------- /Storage/StackStorage.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/Storage/StackStorage.cpp -------------------------------------------------------------------------------- /Storage/StackStorage.h: -------------------------------------------------------------------------------- 1 | 2 | #ifndef __CSTORAGE_H__ 3 | #define __CSTORAGE_H__ 4 | 5 | #pragma once 6 | 7 | #include 8 | #include "CallStackTypeDefine.h" 9 | #include "CountAndTimeTypeDefine.h" 10 | 11 | /************************************************************************\ 12 | * ------------------- 13 | * | STACK_FILE_HEADER | 14 | * |-------------------| 15 | * | STACK_DATA_BUFFER | 16 | * |-------------------| 17 | * | MOD_INFO_BUFFER | 18 | * |-------------------| 19 | * |EXTENDED_DATABUFFER| 20 | * ------------------- 21 | \************************************************************************/ 22 | 23 | typedef struct __STACK_FILE_HEADER 24 | { 25 | DWORD signature; // 26 | WCHAR wcsExePath[_MAX_PATH]; 27 | DWORD dwStackDataLen; 28 | DWORD dwModInfoOffset; 29 | DWORD dwModInfoLen; 30 | DWORD dwExtendedOffset; 31 | DWORD dwExtendedDataLen; 32 | 33 | __STACK_FILE_HEADER() 34 | { 35 | ZeroMemory(this, sizeof(__STACK_FILE_HEADER)); 36 | this->signature = 'HSPY'; 37 | } 38 | }STACK_FILE_HEADER, *PSTACK_FILE_HEADER; 39 | 40 | typedef std::basic_string StringT; 41 | 42 | class CStackStorage 43 | { 44 | public: 45 | static CStackStorage* GetInstance(); 46 | 47 | BOOL InitSharedFileMapping(DWORD dwMaxSize); 48 | BOOL Open(); 49 | void Close(); 50 | 51 | void SetHeaderData(LPCWSTR lpExeFilePathName); 52 | LPVOID GetStackDataBufferTail(); 53 | void IncreaseStackDataLen(DWORD dwLen); 54 | void SetModInfoData(std::vector& vec); 55 | 56 | #ifndef INJECTED_MODULE 57 | BOOL CheckFileFormat(); 58 | BOOL ReadFromFile(LPCTSTR lpFilePathName); 59 | BOOL WriteToFile(LPCTSTR lpFilePathName); 60 | 61 | void SetExtendedData(std::vector& vec); 62 | 63 | PCALL_STACK GetStackDataBuffer(); 64 | PMOD_INFO GetModInfoBuffer(); 65 | PCOUNT_TIME GetExtendedBuffer(); 66 | 67 | BOOL GetCallStackData(std::vector& vec); 68 | BOOL GetModInfoData(std::vector& vec); 69 | BOOL GetExtendedData(std::vector& vec); 70 | BOOL GenerateStorageFileName(CString& str); 71 | 72 | #endif 73 | 74 | 75 | protected: 76 | CStackStorage(void); 77 | ~CStackStorage(void); 78 | 79 | private: 80 | HANDLE m_hFileMapping; 81 | LPVOID m_lpBuf; 82 | 83 | PSTACK_FILE_HEADER m_pHeader; 84 | 85 | DWORD m_dwStackDataLen; 86 | 87 | static TCHAR s_StorageMemName[_MAX_PATH]; 88 | }; 89 | #endif -------------------------------------------------------------------------------- /hs0.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/hs0.jpg -------------------------------------------------------------------------------- /hs1.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/hs1.jpg -------------------------------------------------------------------------------- /include/ApiIndex.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/include/ApiIndex.h -------------------------------------------------------------------------------- /include/CallStackTypeDefine.h: -------------------------------------------------------------------------------- 1 | #ifndef __CALLSTACKTYPEDEF_H__ 2 | #define __CALLSTACKTYPEDEF_H__ 3 | 4 | ////////////////////////////////////////////////////////////////////////// 5 | typedef struct __MOD_INFO 6 | { 7 | DWORD dwModuleBase; 8 | DWORD dwImageSize; 9 | DWORD dwTimeStamp; 10 | WCHAR wcszModPath[MAX_PATH]; 11 | WCHAR wcszPdbSig[64]; 12 | 13 | __MOD_INFO(void) 14 | { 15 | ZeroMemory(this, sizeof(__MOD_INFO)); 16 | } 17 | }MOD_INFO, *PMOD_INFO; 18 | 19 | typedef struct __STACK_FRAME 20 | { 21 | DWORD dwAddr; 22 | SIZE_T iIndex; 23 | 24 | __STACK_FRAME(void) 25 | { 26 | ZeroMemory(this, sizeof(__STACK_FRAME)); 27 | } 28 | }STACK_FRAME, *PSTACK_FRAME; 29 | 30 | 31 | typedef struct __CALL_STACK 32 | { 33 | DWORD Type; 34 | DWORD dwTimeStamp; 35 | 36 | HANDLE Handle; 37 | HANDLE Handle2; 38 | 39 | DWORD nFrameCount; 40 | DWORD dwReserve; 41 | ////////////////////// 42 | STACK_FRAME frame[ANYSIZE_ARRAY]; 43 | }CALL_STACK, *PCALL_STACK; 44 | 45 | #endif -------------------------------------------------------------------------------- /include/CountAndTimeTypeDefine.h: -------------------------------------------------------------------------------- 1 | #ifndef __COUNTANDTIMEDEF_H__ 2 | #define __COUNTANDTIMEDEF_H__ 3 | 4 | ////////////////////////////////////////////////////////////////////////// 5 | typedef struct _COUNT_TIME 6 | { 7 | DWORD dwCount; 8 | DWORD dwTime; 9 | }COUNT_TIME, *PCOUNT_TIME; 10 | 11 | #endif -------------------------------------------------------------------------------- /include/NtApiIndex.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tishion/HandleSpy/a1e2e87718a7c410314d08c9c861353d94c23009/include/NtApiIndex.h --------------------------------------------------------------------------------