void main() {
PSID UserSID = NULL;
PSID GroupSID = NULL;
PSECURITY_DESCRIPTOR SD = NULL;
ACL *pDACL = new ACL ;
string input, ext = "";
wcout << "Enter the location : " << endl;
std::getline(cin, input);
LPCSTR file = input.c_str();
HANDLE hFile = CreateFileA(file, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL);
if (hFile == INVALID_HANDLE_VALUE)
{
if (GetLastError() == ERROR_ACCESS_DENIED)
{
cout << "Access Denied : System Files" << endl;
return;
}
else if (GetLastError() == ERROR_PATH_NOT_FOUND)
{
cout << "Path Name Not Found" << endl;
return;
}
else if (GetLastError() == ERROR_FILE_NOT_FOUND)
{
cout << "File Not Found" << endl;
return;
}
else
{
cout << GetLastError() << endl;
return;
}
}
ULONG Count = NULL;
PEXPLICIT_ACCESS_W *pExplicitEntries = new PEXPLICIT_ACCESS_W;
if (GetSecurityInfo(hFile,SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, NULL, NULL, &pDACL, NULL, &SD) == ERROR_SUCCESS)
{
cout << "GetSecInfo Success " << pDACL->AceCount << endl;
cout << GetLastError() << endl;
}
if (GetExplicitEntriesFromAclW(pDACL, &Count, pExplicitEntries) == ERROR_SUCCESS)
{
cout << Count << endl;
cout << GetLastError() << endl;
}
if (pExplicitEntries[0]->Trustee.TrusteeForm == TRUSTEE_IS_SID)
{
TCHAR AccountBuff[80];
TCHAR DomainBuff[80];
DWORD AccountBufflength = 40;
DWORD DomainBufflength = 40;
PSID_NAME_USE peUse = new SID_NAME_USE;
PSID Sid = pExplicitEntries[0]->Trustee.ptstrName;
LookupAccountSidW(NULL, Sid, AccountBuff, &AccountBufflength, DomainBuff, &DomainBufflength, peUse);
wcout << AccountBuff << endl;
DWORD pAccessRights;
if (GetEffectiveRightsFromAclW(pDACL, &pExplicitEntries[0]->Trustee, &pAccessRights) == ERROR_SUCCESS)
{
DisplayAccessMask(pAccessRights);
}
}
}
Currently, the array index is 0, if i switch to other index like 1 or 2, it causes exception : Accessing location. Please Help, please someone give me solution to access all the trustee in the ACL and get the access permission and username of each trustee of a file
GetSecurityInfo gives me ACE count as 4 , but when it comes to the
GetExplicitEntriesFromAclW the Count value remains 0.
I can reproduce this issue when my test target file is an new created, for example, TXT file. Yes, GetSecurityInfo gives me ACE count as 4 , but when it comes to the GetExplicitEntriesFromAclW the Count value remains 0.
Use function to check the ACE type and found that all types are 0: ACCESS_MIN_MS_ACE_TYPE \ ACCESS_ALLOWED_ACE_TYPE.
if (GetSecurityInfo(hFile, SE_FILE_OBJECT, DACL_SECURITY_INFORMATION, NULL, NULL, &pDACL, NULL, &SD) == ERROR_SUCCESS)
{
cout << "GetSecInfo Success " << pDACL->AceCount << endl;
cout << GetLastError() << endl;
}
PACL pAcl = pDACL;
int aceNum = pDACL->AceCount;
for (int i = 0; i < aceNum; i++)
{
ACE_HEADER *aceAddr = NULL;
if (GetAce(pAcl, i, (void**)(&aceAddr)))
{
printf("ACE type: %d \n",aceAddr->AceType); ACCESS_ALLOWED_ACE_TYPE;
printf("ACE flags: %d \n", aceAddr->AceFlags);
printf("ACE size: %d \n", aceAddr->AceSize);
}
}
If you set deny write operation for current user like this:
Then ACE type 1 (ACCESS_DENIED_ACE_TYPE) appears. And the Count value returned from the GetExplicitEntriesFromAclW equals the number of entries whose ACE type is 1. See the following snapshot:
Looks like you are passing null EXPLICIT_ACCESS_W to GetExplicitEntriesFromAclW.
So try either:
EXPLICIT_ACCESS_W *pExplicitEntries=NULL;
EXPLICIT_ACCESS_W **pExplicitEntries2=&pExplicitEntries;
GetExplicitEntriesFromAclA(pacl,&countExplicitACL,pExplicitEntries2);
or:
EXPLICIT_ACCESS_W *pExplicitEntries =NULL;
GetExplicitEntriesFromAclA(pacl,&countExplicitACL,&pExplicitEntries2);
Both serve your purpose. Beware of NULL pointers.
Related
I decided to create my own dll injector but the problem is that almost when I finished my code a problem occurs, in the following code my dll does not inject correctly, I tried everything like checking if my dll was good or even my code in general but nothing works. (I want to specify that for my processId if I use GetCurrentProcessId() my dll is injected correctly but not where I want so it is imperative for me to use GetProcessIdByName.) Thank you to all those who will help me!
#include <Windows.h>
#include <TlHelp32.h>
#include <tchar.h>
#include <string>
#include <iostream>
using namespace std;
DWORD GetProcessIdByName(const char* processName)
{
DWORD processId = 0;
HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (snap != INVALID_HANDLE_VALUE)
{
PROCESSENTRY32 pe;
pe.dwSize = sizeof(pe);
if (Process32First(snap, &pe))
{
do
{
if (!_stricmp(pe.szExeFile, processName))
{
processId = pe.th32ProcessID;
break;
}
} while (Process32Next(snap, &pe));
}
CloseHandle(snap);
}
return processId;
}
int main()
{
const char* processName = "OLLYDBG.exe";
DWORD processId = GetProcessIdByName(processName);
LPCSTR dllPath = "C:\\Users\\Alban\\source\\repos\\Cheat\\Cheat\\testdll.dll";
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId);
if (hProcess == NULL)
{
cout << "Error with 'OpenProcess', error code : " << GetLastError() << endl;
return 1;
}
cout << "process id : " << processId << endl;
LPVOID pdllPath = VirtualAllocEx(hProcess, NULL, strlen(dllPath) + 1, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
if (pdllPath == NULL)
{
cout << "failed to allocate dll path, error code : " << GetLastError() << endl;
return 1;
}
cout << "path to memory : " << hex << pdllPath << endl;
BOOL writedMemory = WriteProcessMemory(hProcess, pdllPath, LPVOID(dllPath), strlen(dllPath) + 1, NULL);
if (writedMemory == 0)
{
cout << "failed to write memory, error code : " << GetLastError() << endl;
return 1;
}
HANDLE hloadThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle("KERNEL32.DLL"), "LoadLibraryA"), pdllPath, 0, NULL);
if (hloadThread == NULL)
{
cout << "Can not create remote thread, error code : " << GetLastError() << endl;
return 1;
}
WaitForSingleObject(hloadThread, INFINITE);
BOOL virtualFree = VirtualFreeEx(hProcess, pdllPath, 0, MEM_RELEASE);
if (virtualFree == 0)
{
cout << "Can not release memory, error code : " << GetLastError() << endl;
}
CloseHandle(hProcess);
}
Trying to write code to change the registry keys with c++ after endless amount of time I reached this point but this code still does not edit the registry even when running as admin
to change the registry 4 functions are needed according to this question which I used and every single one of them returns a zero which means that the function completed without errors but still no values are changed in the registry gui
the SecurityHealth strartup service is running on my machine and has the path %windir%\system32\SecurityHealthSystray.exe and type REG_EXPAND_SZ
I even tried creating a new entry similar to the SecurityHealth and still nothing is changed
I am compiling as admin and running as admin
HKEY open_reg()
{
int result;
LPCSTR lpSubKey = "Software\\Microsoft\\Windows\\CurrentVersion\\Run";
HKEY hKey;
result = RegOpenKeyExA(HKEY_LOCAL_MACHINE, lpSubKey, 0, KEY_QUERY_VALUE|KEY_WRITE|KEY_READ|KEY_SET_VALUE, &hKey);
if ( result != 0)
{
cout << " Failed to open registry. - [ "<< result<< "]" <<endl;
}
else
{
cout << "Found registry key. - [" << result<<"]" << endl;
}
return hKey;
}
HKEY find_reg_value(HKEY handle)
{
LPCSTR lpValueName = "SecurityHealth";
DWORD BufferSize = TOTALBYTES;
DWORD cbData;
int dwRet;
PPERF_DATA_BLOCK PerfData = (PPERF_DATA_BLOCK) malloc( BufferSize );
cbData = BufferSize;
cout << "\nRetrieving the data..." << endl;
dwRet = RegQueryValueExA( handle,
lpValueName,
NULL,
NULL,
(LPBYTE) PerfData,
&cbData );
if ( dwRet == 0 )
{
cout << "Successfully quered [" << dwRet << "]"<<endl;
}
else
{
cout << "Failed to query Error code : [" << dwRet << "]"<<endl;
}
return handle;
}
void set_reg_value(HKEY handle)
{
int result;
LPCSTR lpValueName = "SecurityHealth";
std::string file = "C:\\Windows\\System32\\cmd.exe";
const char * sth = file.c_str();
unsigned char m_Test[file.size()];
strcpy((char*)m_Test, sth);
DWORD DATA_SIZE = file.size()+1;
result = RegSetValueExA(handle,lpValueName,0,REG_EXPAND_SZ,m_Test,DATA_SIZE);
if ( result == 0 )
{
cout << "Successfully changed value [" << result << "]"<<endl;
}
else
{
cout << "Failed to change value Error code : [" << result << "]"<<endl;
}
RegCloseKey (handle);
}
int main()
{
cout << "testing windows registry " << endl;
HKEY reg_handle = open_reg();
HKEY handler = find_reg_value(reg_handle);
set_reg_value(handler);
system("PAUSE");
return 0;
}
the compiled exe output in the terminal
testing windows registry
Found registry key. - [0]
Retrieving the data...
Successfully quered [0]
Successfully changed value [0]
Press any key to continue . . .
Compiled with g++ regutil.cpp
I suspect you are compiling as a 32-bit program but looking at a 64-bit registry. Switch to compiling as 64-bit instead. (There is a 32-bit registry instead, which can be found buried within the 64-bit hives but you likely want to change the actual 64-bit version).
every single one of them returns a zero which means that the function completed without errors but still no values are changed in the registry GUI
The only way that can happen is if either:
You are not updating the GUI after making the changes.
you are modifying a different area of the Registry then you are viewing, ie if you are modifying the 32bit Registry but viewing the 64bit Registry, or vice versa. Read up about the Registry Redirector, Registry Keys Affected by WOW64 and Accessing an Alternate Registry View on MSDN for more details about working with the 32bit and 64bit Registry views.
That being said, there are a number of other mistakes in your code.
Try something more like this instead:
HKEY open_reg()
{
HKEY hKey = NULL;
int result = RegOpenKeyExA( HKEY_LOCAL_MACHINE,
"Software\\Microsoft\\Windows\\CurrentVersion\\Run",
0,
KEY_QUERY_VALUE | KEY_SET_VALUE /* | KEY_WOW64_(32|64)KEY if needed */,
&hKey );
if ( result != 0 )
{
cout << " Failed to open Registry, Error " << result << endl;
return NULL;
}
else
{
cout << "Opened Registry key" << endl;
return hKey;
}
}
void query_reg_value(HKEY handle)
{
DWORD cbBuffer = TOTALBYTES;
std::vector<char> buffer(cbBuffer);
cout << "\nRetrieving the data..." << endl;
int result = RegQueryValueExA( handle,
"SecurityHealth",
NULL,
NULL,
reinterpret_cast<LPBYTE>(buffer.data()),
&cbBuffer );
if ( result == 0 )
{
cout << "Successfully quered: ";
while (cbBuffer != 0 && buffer[cbBuffer-1] == '\0') --cbBuffer; // ignore null terminator(s)
cout.write(buffer.data(), cbBuffer);
cout << endl;
}
else
{
cout << "Failed to query, Error " << result << endl;
}
}
void set_reg_value(HKEY handle)
{
std::string file = "C:\\Windows\\System32\\cmd.exe";
int result = RegSetValueExA( handle,
"SecurityHealth",
0,
REG_EXPAND_SZ,
reinterpret_cast<LPCBYTE>(file.c_str()),
file.size()+1);
if ( result == 0 )
{
cout << "Successfully changed value" << endl;
}
else
{
cout << "Failed to change value, Error " << result << endl;
}
}
int main()
{
cout << "testing Windows Registry" << endl;
HKEY hKey = open_reg();
if (hKey) {
query_reg_value(hKey);
set_reg_value(hKey);
RegCloseKey(hKey);
}
system("PAUSE");
return 0;
}
However, it should be noted that only admin users have write access to HKLM keys by default, most users have read-only access. As such, it is not a good idea to open a key under HKLM for both reading and writing at the time same, unless you know what you are doing. You should open a key for reading only, read from it, and close it. Same for writing. For instance:
HKEY open_reg(bool isWriting)
{
HKEY hKey = NULL;
int result = RegOpenKeyExA( HKEY_LOCAL_MACHINE,
"Software\\Microsoft\\Windows\\CurrentVersion\\Run",
0,
(isWriting ? KEY_SET_VALUE : KEY_QUERY_VALUE) /* | KEY_WOW64_(32|64)KEY if needed */,
&hKey );
if ( result != 0 )
{
cout << " Failed to open Registry, Error " << result << endl;
return NULL;
}
else
{
cout << "Opened registry key" << endl;
return hKey;
}
}
void query_reg_value()
{
HKEY hKey = open_reg(false);
if (!hKey) return;
DWORD cbBuffer = TOTALBYTES;
std::vector<char> buffer(cbBuffer);
cout << "\nRetrieving the data..." << endl;
int result = RegQueryValueExA( hKey,
"SecurityHealth",
NULL,
NULL,
reinterpret_cast<LPBYTE>(buffer.data()),
&cbBuffer );
if ( result == 0 )
{
cout << "Successfully quered: ";
while (cbBuffer != 0 && buffer[cbBuffer-1] == '\0') --cbData; // ignore null terminator(s)
cout.write(buffer.data(), cbBuffer);
cout << endl;
}
else
{
cout << "Failed to query, Error " << result << endl;
}
RegCloseKey(hKey);
}
void set_reg_value()
{
HKEY hKey = open_reg(true);
if (!hKey) return;
std::string file = "C:\\Windows\\System32\\cmd.exe";
int result = RegSetValueExA( hKey,
"SecurityHealth",
0,
REG_EXPAND_SZ,
reinterpret_cast<LPCBYTE>(file.c_str()),
file.size()+1);
if ( result == 0 )
{
cout << "Successfully changed value" << endl;
}
else
{
cout << "Failed to change value, Error " << result << endl;
}
RegCloseKey(hKey);
}
int main()
{
cout << "testing Windows Registry" << endl;
query_reg_value();
set_reg_value();
system("PAUSE");
return 0;
}
This is all the source code for a program i'm trying to make, and I can't get WriteProcessMemory to work at all. It returns the correct messages, saying that everything went successfully, but nothing actually changes in the game. Does anyone know of a fix?
#include <iostream>
#include <Windows.h>
using namespace std;
// variables
int plcHold = 1;
string hlthLoop = "OFF";
string ammoLoop = "OFF";
DWORD pid;
DWORD playerAddr;
DWORD hlthOffs = 0xF8;
// main function
int main()
{
// finding pid, opening proc, finding player address
HWND hwnd = FindWindowA(NULL, "AssaultCube");
if(hwnd == NULL)
{
cout << "Error; Couldn't find window" << endl;
} else{
GetWindowThreadProcessId(hwnd, &pid);
HANDLE pHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
if(pHandle == NULL)
{
cout << "Error; Couldn't open process" << endl;
} else{
ReadProcessMemory(pHandle, (LPCVOID)0x50F4F4, &playerAddr, sizeof(playerAddr), 0);
if(ReadProcessMemory != FALSE)
{
cout << "Health successfully read!" << endl;
} else{
cout << "Error code " << GetLastError << endl;
}
}
while(plcHold == 1){
cout << "========== *****'s Assault Cube Trainer ==========\n" << endl;
cout << "=============== Health Loop - " << hlthLoop << " ================" << endl;
Sleep(1500);
system("cls");
if(GetAsyncKeyState(0x5A))
{
cout << "Health successfully edited!" << endl;
WriteProcessMemory(pHandle, LPVOID(playerAddr + hlthOffs), 0, sizeof(999), 0);
CloseHandle(pHandle);
}
}
}
return 0;
}
You're passing a null pointer to WriteProcessMemory for the third (lpBuffer) parameter. You have to pass the address of the actual value, not the value itself. If you want to write an integer value, try this:
DWORD val = 0; // or 999?
WriteProcessMemory(
pHandle, static_cast<LPVOID>(playerAddr + hlthOffs),
&val, sizeof(val), 0);
I'm using a file that has MBR code at an offset of 54 bytes.
In the main() function, I'm calling OpenMBbrFile(), then ReadMbrData().
However, I'm not able to read MBR in my Buffer Properly. Please Help Me with the Issue..................................................................................................................................................................................................................................................................................................................................................................................................................
BOOL OpenMbrFile(LPWSTR sPath)
{
cout << "OpenMBR: Create Handle" << endl;
m_hMbrFile = CreateFile(sPath
, GENERIC_READ
, FILE_SHARE_READ
, NULL
, OPEN_EXISTING
, FILE_ATTRIBUTE_NORMAL
, NULL);
if (m_hMbrFile == INVALID_HANDLE_VALUE) return FALSE;
return TRUE;
}
BOOL CloseMbrFile()
{
cout << "CloseMBR: Closing Handle" << endl;
BOOL bReturn = TRUE;
if (m_hMbrFile != INVALID_HANDLE_VALUE)
bReturn = CloseHandle(m_hMbrFile);
m_hMbrFile = NULL;
cout << "Returning from CloseMBR" << endl;
return bReturn;
}
BOOL ReadMbrData()
{
cout << "ReadMBR: Initialization" << endl;
BOOL bReturn = FALSE;
DWORD dwByteRead = 0;
LARGE_INTEGER filepointer;
filepointer.QuadPart = 54; //MBR data in File at offset 54
BYTE* pBuff = NULL;
pBuff = new BYTE[512];
if (!pBuff)
{
cout << "ReadMBR: Cleaning Stuff up" << endl;
if (pBuff) delete[] pBuff;
CloseMbrFile();
ClosePhysicalDrive();
return bReturn;
}
if (m_hMbrFile == INVALID_HANDLE_VALUE) return FALSE;
cout << "ReadMBR: Setting fp" << endl;
if(!SetFilePointerEx(m_hMbrFile, filepointer, NULL, FILE_BEGIN))
{
cout << "Failed to SetFilePointer ( " << m_hMbrFile << ", " << filepointer.QuadPart << ", 0, FILE_BEGIN)" << endl;
cout << "ReadMBR: Cleaning Stuff up" << endl;
if (pBuff) delete[] pBuff;
CloseMbrFile();
ClosePhysicalDrive();
return bReturn;
}
cout << "ReadMBR: Starting to read File" << endl;
bReturn = ReadFile(m_hMbrFile, pBuff, sizeof(*pBuff), &dwByteRead, 0);
if (bReturn)
bReturn = (sizeof(*pBuff) == dwByteRead); //Need to check this condition? shd it be 512 or size of wud do??
cout << "ReadMBR: Cleaning Stuff up" << endl;
if (pBuff) delete[] pBuff;
CloseMbrFile();
ClosePhysicalDrive();
return bReturn;
}
I'm trying to retrieve a value of a key but i'm only getting the first char of the value..
can anyone help?
my code:
void dealWithRegistry()
{
HKEY regkey1;
char data[100];
DWORD datasize = sizeof (data) / sizeof (char);
LONG rc = RegOpenKeyEx(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", 0, KEY_READ, ®key1);
if (rc != ERROR_SUCCESS)
{
cout << "there was a problem openning" << endl;
}
else
{
rc = RegGetValue (regkey1, NULL, L"AppData", RRF_RT_REG_SZ, NULL, (void*) data, &datasize);
if (rc != ERROR_SUCCESS)
{
cout << data << endl;
cout << "there was a problem getting the value" << endl;
}
}
cout << data << endl;
}
It is probably returning Unicode data and you are only printing the first character. A quick test of that would be to change the call to RegGetValueA.