Mail Archives: cygwin/2009/05/01/16:10:57
Andy Koppe wrote:
> 2009/4/21 Barry Kelly:
> > Windows implements console mode as a client-server protocol between the
> > executable (ntvdm.exe for DOS apps) and winsrv.dll (hosted in
> > csrss.exe), but the protocol isn't easily hookable. I guess one would
> > have to hijack the console APIs, perhaps by stepping into the
> > application using debugging APIs and overwriting the DLL imports, but it
> > would be pretty painful.
>=20
> Hi Barry, have you got any pointers to documentation or reverse
> engineering attempts for that console protocol?
It is not just the console. It's a substantial fraction of the Win32
API. The NT kernel transfers the data (LPCs, local/lightweight procedure
calls) across a bit like a microkernel OS design; at least that's the
theory, in practice it's all pretty monolithic.
You can read a little bit more about it here:
http://en.wikipedia.org/wiki/Local_Procedure_Call
> 2009/4/21 Christopher Faylor:
> > It can be done using the same technique as Console2:
> >
> > http://console.sourceforge.net
>=20
> I don't understand how. ReadConsoleOutput() on the hidden console only
> gives you the cooked output in terms of character cell contents and
> attributes, whereas the raw output as it came from the console app
> would need to be sent to the pty to be displayed by the likes of
> screen. As far as I can see, recreating the raw output from the cooked
> one isn't possible in general.
You could intercept the calls to the console APIs by finding out where
the imports resolve to using GetProcAddress etc. (i.e. somewhere inside
where kernel32.dll is mapped to in the process), then adjusting the page
permissions (VirtualProtect etc.) and rewriting the entrypoint code
(save original 5 bytes of code, insert JMP <your-stub-here>, and at
<your-stub-here> save the parameters, update your stuff, execute the
missing code (the code you skipped - may need adjustment owing to
code-relative addressing modes in e.g. Jcc instructions), then JMP back.
That's all assuming you have access to the innards of the process, most
likely with debugging APIs like CreateRemoteThread, DebugActiveProcess /
CreateProcess w/ debug, and WaitForDebugEvent / ContinueDebugEvent
debugging loop.
Doing all this could be fun, but I reckon it would amount to a stack of
hacks. It also requires overbearing privileges.
-- Barry
--=20
http://barrkel.blogspot.com/
--
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
Problem reports: http://cygwin.com/problems.html
Documentation: http://cygwin.com/docs.html
FAQ: http://cygwin.com/faq/
- Raw text -