SHARE
TWEET

Untitled

a guest Mar 27th, 2018 160 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #include "stdafx.h"
  2. #include "windows.h"
  3. #include <fstream>
  4. #include <vector>
  5. using namespace std;
  6.  
  7. typedef struct {
  8.     byte Version;
  9.     int  FileSize;
  10.     LPVOID BaseAddr;
  11.     bool Compressed;
  12. } CWSHeader;
  13.  
  14. vector<CWSHeader> headers;
  15.  
  16.  
  17. bool contains(char *begin, int size, char *sub, size_t len) {
  18.     char *end = begin + size - len;
  19.     for (char *p = begin; p < end; p++) {
  20.         if (memcmp(p, sub, len) == 0) {
  21.             return true;
  22.         }
  23.     }
  24.     return false;
  25. }
  26.  
  27. int main(int argc, char **argv)
  28. {
  29.     if (argc < 2) {
  30.         printf("invalid arguments");
  31.         return -1;
  32.     }
  33.     DWORD pid;
  34.     sscanf_s(argv[1], "%d", &pid);
  35.     HANDLE hProcess = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, false, pid);
  36.     if (hProcess == NULL) {
  37.         printf("unable to open process :%d", pid);
  38.         return -1;
  39.     }
  40.  
  41.     //get page size
  42.     SYSTEM_INFO si;
  43.     GetSystemInfo(&si);
  44.  
  45.     //check 32bit or 64bit
  46.     //BOOL isWow64 = false;
  47.     //IsWow64Process(hProcess, &isWow64);
  48.     CWSHeader instance;
  49.     //char *domain = "www.doswf.com";
  50.     //size_t domainLen = strlen(domain);
  51.     SIZE_T bytesRead;
  52.  
  53.     MEMORY_BASIC_INFORMATION info;
  54.     //std::vector<char> chunk;
  55.     char *chunk = NULL;
  56.     char* p = (char *)si.lpMinimumApplicationAddress;
  57.     while (p < si.lpMaximumApplicationAddress)
  58.     {
  59.         if (VirtualQueryEx(hProcess, p, &info, sizeof(info)))
  60.         {
  61.             if (info.Protect == PAGE_READWRITE && info.State == MEM_COMMIT) {
  62.                 p = (char*)info.BaseAddress;
  63.                 chunk = (char *)realloc(chunk, info.RegionSize);
  64.                 if (chunk == NULL) {
  65.                     printf("can't malloc space:%lld", info.RegionSize);
  66.                     return -1;
  67.                 }
  68.                 //chunk.resize(info.RegionSize);
  69.                
  70.                 if (ReadProcessMemory(hProcess, p, (LPVOID)chunk, info.RegionSize, &bytesRead))
  71.                 {
  72.                     for (uint64_t i = 0; i < bytesRead - 8; ) {
  73.                         if ((chunk[i] == 'F' || chunk[i]=='C') && chunk[i + 1] == 'W' && chunk[i + 2] == 'S') {
  74.                             instance.Version = chunk[i + 3];
  75.                             memcpy(&instance.FileSize, &chunk[i + 4], 4);
  76.                             instance.BaseAddr = p + i;
  77.                             instance.Compressed = chunk[i] == 'C';
  78.                             /*if (!instance.Compressed) {
  79.                                 instance.Dirty = contains((char *)chunk+i, instance.FileSize, domain, domainLen);
  80.                             }*/
  81.                            
  82.                             headers.push_back(instance);
  83.                             i += 8;
  84.                         }
  85.                         else {
  86.                             i++;
  87.                         }
  88.                     }
  89.                 }
  90.             }
  91.             p += info.RegionSize;
  92.         } else {
  93.             if (GetLastError() == ERROR_INVALID_PARAMETER) {
  94.                 //Address specifies an address above the highest memory address accessible to the process
  95.                 break;
  96.             }
  97.             else {
  98.                 printf("VirtualQueryEx error: %d\n", GetLastError());
  99.             }
  100.         }
  101.     }
  102.    
  103.     printf(" No\tVersion\t     FileSize\tCompressed\tBaseAddr\n");
  104.     for (uint32_t i = 0; i < headers.size(); i++) {
  105.         printf("%3d\t%7d\t%13d\t%10c\t%llx\n",
  106.             i,
  107.             headers[i].Version,
  108.             headers[i].FileSize,
  109.             headers[i].Compressed ? 'Y' : 'N',
  110.             (uint64_t)headers[i].BaseAddr);
  111.         chunk = (char *)realloc(chunk, headers[i].FileSize);
  112.         ReadProcessMemory(hProcess, headers[i].BaseAddr, chunk, headers[i].FileSize, &bytesRead);
  113.         if (bytesRead != headers[i].FileSize) {
  114.             printf("read process memory err:%lld != %d\n", bytesRead, headers[i].FileSize);
  115.         }
  116.         char szFile[256];
  117.         sprintf_s(szFile, "%d.swf", i);
  118.         ofstream fs(szFile, ios_base::out|ios_base::binary);
  119.         fs.write(chunk, headers[i].FileSize);
  120.         fs.close();
  121.     }
  122.     if (chunk) free(chunk);
  123.     return 0;
  124. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top