ShellExecute.inc 4.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107
  1. // Copyright (C) 2012 Zeex
  2. //
  3. // Permission is hereby granted, free of charge, to any person obtaining a copy of
  4. // this software and associated documentation files (the "Software"), to deal in
  5. // the Software without restriction, including without limitation the rights to
  6. // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
  7. // of the Software, and to permit persons to whom the Software is furnished to do
  8. // so, subject to the following conditions:
  9. //
  10. // The above copyright notice and this permission notice shall be included in all
  11. // copies or substantial portions of the Software.
  12. //
  13. // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  14. // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  15. // FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  16. // AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  17. // LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  18. // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  19. // SOFTWARE.
  20. #include "import_table"
  21. #include "../amx_header"
  22. #include "../amx_memory"
  23. #include "../dynamic_call"
  24. #include "../phys_memory"
  25. #include "../shellcode"
  26. // http://msdn.microsoft.com/en-us/library/windows/desktop/bb762153%28v=vs.85%29.aspx
  27. #define SW_HIDE (0)
  28. #define SW_MAXIMIZE (3)
  29. #define SW_MINIMIZE (6)
  30. #define SW_RESTORE (9)
  31. #define SW_SHOW (5)
  32. #define SW_SHOWDEFAULT (10)
  33. #define SW_SHOWMAXIMIZED (3)
  34. #define SW_SHOWMINIMIZED (2)
  35. #define SW_SHOWMINNOACTIVE (7)
  36. #define SW_SHOWNA (8)
  37. #define SW_SHOWNOACTIVATE (4)
  38. #define SW_SHOWNORMAL (1)
  39. // NOTE: string arguments must be prepared with ToCharString() or similar function.
  40. stock ShellExecute(const Operation[], const File[], const Parameters[], ShowCmd) {
  41. /*
  42. .text:10001000 55 push ebp
  43. .text:10001001 8B EC mov ebp, esp
  44. .text:10001003 8B 45 0C mov eax, [ebp+arg_4]
  45. .text:10001006 8B 48 18 mov ecx, [eax+18h]
  46. .text:10001009 51 push ecx ; nShowCmd
  47. .text:1000100A 8B 55 0C mov edx, [ebp+arg_4]
  48. .text:1000100D 8B 42 14 mov eax, [edx+14h]
  49. .text:10001010 50 push eax ; lpDirectory
  50. .text:10001011 8B 4D 0C mov ecx, [ebp+arg_4]
  51. .text:10001014 8B 51 10 mov edx, [ecx+10h]
  52. .text:10001017 52 push edx ; lpParameters
  53. .text:10001018 8B 45 0C mov eax, [ebp+arg_4]
  54. .text:1000101B 8B 48 0C mov ecx, [eax+0Ch]
  55. .text:1000101E 51 push ecx ; lpFile
  56. .text:1000101F 8B 55 0C mov edx, [ebp+arg_4]
  57. .text:10001022 8B 42 08 mov eax, [edx+8]
  58. .text:10001025 50 push eax ; lpOperation
  59. .text:10001026 8B 4D 0C mov ecx, [ebp+arg_4]
  60. .text:10001029 8B 51 04 mov edx, [ecx+4]
  61. .text:1000102C 52 push edx ; hwnd
  62. .text:1000102D FF 15 78 56 34 12 call ds:ShellExecuteA ; Opens or prints a specified file
  63. .text:10001033 5D pop ebp
  64. .text:10001034 C3 retn
  65. */
  66. #define __(%0,%1,%2,%3) (((0x%3) << 24) | ((0x%2) << 16) | (0x%1 << 8) | (0x%0))
  67. static const asm[] = {
  68. __(90,90,90,90),
  69. __(90,90,90,90),
  70. __(90,90,90,90),
  71. __(90,90,90,90),
  72. __(55,8B,EC,8B),
  73. __(45,0C,8B,48),
  74. __(18,51,8B,55),
  75. __(0C,8B,42,14),
  76. __(50,8B,4D,0C),
  77. __(8B,51,10,52),
  78. __(8B,45,0C,8B),
  79. __(48,0C,51,8B),
  80. __(55,0C,8B,42),
  81. __(08,50,8B,4D),
  82. __(0C,8B,51,04),
  83. __(52,FF,15,00),
  84. __(00,00,00,5D),
  85. __(C3,CC,CC,CC)
  86. };
  87. #undef __
  88. new address = GetImportAddress("ShellExecuteA");
  89. WriteAmxMemory(ref(asm) + 63, refabs(address));
  90. Push(0); // HWND hwnd
  91. Push(refabs(Operation)); // LPCTSTR lpOperation
  92. Push(refabs(File)); // LPCTSTR lpFile
  93. Push(refabs(Parameters)); // LPCTSTR lpParameters
  94. Push(0); // LPCTSTR lpDirectory
  95. Push(ShowCmd); // INT nShowCmd
  96. return RunShellcode(refabs(asm));
  97. }