ShellExecute.inc 4.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112
  1. // Copyright (C) 2012 Zeex
  2. //
  3. // Permission is hereby granted, free of charge, to any person obtaining a copy of
  4. // this software and associated documentation files (the "Software"), to deal in
  5. // the Software without restriction, including without limitation the rights to
  6. // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
  7. // of the Software, and to permit persons to whom the Software is furnished to do
  8. // so, subject to the following conditions:
  9. //
  10. // The above copyright notice and this permission notice shall be included in all
  11. // copies or substantial portions of the Software.
  12. //
  13. // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  14. // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  15. // FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  16. // AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  17. // LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  18. // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  19. // SOFTWARE.
  20. #if defined SHELL_EXECUTE_INC
  21. #endinput
  22. #endif
  23. #define SHELL_EXECUTE_INC
  24. #include "import_table"
  25. #include "../amx_header"
  26. #include "../amx_memory"
  27. #include "../dynamic_call"
  28. #include "../phys_memory"
  29. #include "../shellcode"
  30. // http://msdn.microsoft.com/en-us/library/windows/desktop/bb762153%28v=vs.85%29.aspx
  31. #define SW_HIDE (0)
  32. #define SW_MAXIMIZE (3)
  33. #define SW_MINIMIZE (6)
  34. #define SW_RESTORE (9)
  35. #define SW_SHOW (5)
  36. #define SW_SHOWDEFAULT (10)
  37. #define SW_SHOWMAXIMIZED (3)
  38. #define SW_SHOWMINIMIZED (2)
  39. #define SW_SHOWMINNOACTIVE (7)
  40. #define SW_SHOWNA (8)
  41. #define SW_SHOWNOACTIVATE (4)
  42. #define SW_SHOWNORMAL (1)
  43. // NOTE: string arguments must be prepared with ToCharString() or similar function.
  44. stock ShellExecute(const Operation[], const File[], const Parameters[], ShowCmd) {
  45. /*
  46. .text:10001000 55 push ebp
  47. .text:10001001 8B EC mov ebp, esp
  48. .text:10001003 8B 45 0C mov eax, [ebp+arg_4]
  49. .text:10001006 8B 48 18 mov ecx, [eax+18h]
  50. .text:10001009 51 push ecx ; nShowCmd
  51. .text:1000100A 8B 55 0C mov edx, [ebp+arg_4]
  52. .text:1000100D 8B 42 14 mov eax, [edx+14h]
  53. .text:10001010 50 push eax ; lpDirectory
  54. .text:10001011 8B 4D 0C mov ecx, [ebp+arg_4]
  55. .text:10001014 8B 51 10 mov edx, [ecx+10h]
  56. .text:10001017 52 push edx ; lpParameters
  57. .text:10001018 8B 45 0C mov eax, [ebp+arg_4]
  58. .text:1000101B 8B 48 0C mov ecx, [eax+0Ch]
  59. .text:1000101E 51 push ecx ; lpFile
  60. .text:1000101F 8B 55 0C mov edx, [ebp+arg_4]
  61. .text:10001022 8B 42 08 mov eax, [edx+8]
  62. .text:10001025 50 push eax ; lpOperation
  63. .text:10001026 8B 4D 0C mov ecx, [ebp+arg_4]
  64. .text:10001029 8B 51 04 mov edx, [ecx+4]
  65. .text:1000102C 52 push edx ; hwnd
  66. .text:1000102D FF 15 78 56 34 12 call ds:ShellExecuteA ; Opens or prints a specified file
  67. .text:10001033 5D pop ebp
  68. .text:10001034 C3 retn
  69. */
  70. #define __asm(%0,%1,%2,%3) (((0x%3) << 24) | ((0x%2) << 16) | (0x%1 << 8) | (0x%0))
  71. static const asm[] = {
  72. __asm(90,90,90,90),
  73. __asm(90,90,90,90),
  74. __asm(90,90,90,90),
  75. __asm(90,90,90,90),
  76. __asm(55,8B,EC,8B),
  77. __asm(45,0C,8B,48),
  78. __asm(18,51,8B,55),
  79. __asm(0C,8B,42,14),
  80. __asm(50,8B,4D,0C),
  81. __asm(8B,51,10,52),
  82. __asm(8B,45,0C,8B),
  83. __asm(48,0C,51,8B),
  84. __asm(55,0C,8B,42),
  85. __asm(08,50,8B,4D),
  86. __asm(0C,8B,51,04),
  87. __asm(52,FF,15,00),
  88. __asm(00,00,00,5D),
  89. __asm(C3,CC,CC,CC)
  90. };
  91. // #undef __
  92. new address = GetImportAddress("ShellExecuteA");
  93. WriteAmxMemory(ref(asm) + 63, refabs(address));
  94. Push(0); // HWND hwnd
  95. Push(refabs(Operation)); // LPCTSTR lpOperation
  96. Push(refabs(File)); // LPCTSTR lpFile
  97. Push(refabs(Parameters)); // LPCTSTR lpParameters
  98. Push(0); // LPCTSTR lpDirectory
  99. Push(ShowCmd); // INT nShowCmd
  100. return RunShellcode(refabs(asm));
  101. }