Fixed restoring original attributes on detach.

This commit is contained in:
Jason Hood 2014-02-08 12:04:43 +10:00
parent db36552c42
commit 453db81af5
2 changed files with 35 additions and 13 deletions

44
ANSI.c
View File

@ -111,12 +111,12 @@
v1.66, 20 & 21 September, 2013: v1.66, 20 & 21 September, 2013:
fix 32-bit process trying to detect 64-bit process. fix 32-bit process trying to detect 64-bit process.
v1.70, 25 January to 7 February, 2014: v1.70, 25 January to 8 February, 2014:
don't hook ourself from LoadLibrary or LoadLibraryEx; don't hook ourself from LoadLibrary or LoadLibraryEx;
update the LoadLibraryEx flags that should not cause hooking; update the LoadLibraryEx flags that should not cause hooking;
inject by manipulating the import directory table; for 64-bit AnyCPU use inject by manipulating the import directory table; for 64-bit AnyCPU use
ntdll's LdrLoadDll via CreateRemoteThread; ntdll's LdrLoadDll via CreateRemoteThread;
restore original attribute on detach (for LoadLibrary/FreeLibrary usage); restore original attributes on detach (for LoadLibrary/FreeLibrary usage);
log: remove the quotes around the CreateProcess command line string and log: remove the quotes around the CreateProcess command line string and
distinguish NULL and "" args. distinguish NULL and "" args.
*/ */
@ -139,7 +139,7 @@
// ========== Global variables and constants // ========== Global variables and constants
HANDLE hConOut; // handle to CONOUT$ HANDLE hConOut; // handle to CONOUT$
WORD orgattr; // original attribute WORD orgattr; // original attributes
#define ESC '\x1B' // ESCape character #define ESC '\x1B' // ESCape character
#define BEL '\x07' #define BEL '\x07'
@ -1769,7 +1769,7 @@ HookFn Hooks[] = {
// OriginalAttr() // OriginalAttr()
// Determine the original attributes for use by \e[m. // Determine the original attributes for use by \e[m.
//----------------------------------------------------------------------------- //-----------------------------------------------------------------------------
void OriginalAttr( void ) void OriginalAttr( PVOID lpReserved )
{ {
HANDLE hConOut; HANDLE hConOut;
CONSOLE_SCREEN_BUFFER_INFO csbi; CONSOLE_SCREEN_BUFFER_INFO csbi;
@ -1779,9 +1779,28 @@ void OriginalAttr( void )
NULL, OPEN_EXISTING, 0, 0 ); NULL, OPEN_EXISTING, 0, 0 );
if (!GetConsoleScreenBufferInfo( hConOut, &csbi )) if (!GetConsoleScreenBufferInfo( hConOut, &csbi ))
csbi.wAttributes = 7; csbi.wAttributes = 7;
orgattr = csbi.wAttributes;
CloseHandle( hConOut ); CloseHandle( hConOut );
// If we were loaded dynamically, remember the current attributes to restore
// upon unloading. However, if we're the 64-bit DLL, but the image is 32-
// bit, then the dynamic load was due to injecting into AnyCPU.
while (lpReserved == NULL) // breakable if
{
#ifdef _WIN64
if (*DllNameType == '6')
{
PIMAGE_DOS_HEADER pDosHeader;
PIMAGE_NT_HEADERS pNTHeader;
pDosHeader = (PIMAGE_DOS_HEADER)GetModuleHandle( NULL );
pNTHeader = MakeVA( PIMAGE_NT_HEADERS, pDosHeader->e_lfanew );
if (pNTHeader->FileHeader.Machine == IMAGE_FILE_MACHINE_I386)
break;
}
#endif
orgattr = csbi.wAttributes;
break;
}
if (s_flag == GRM_INIT && s_pid == GetCurrentProcessId()) if (s_flag == GRM_INIT && s_pid == GetCurrentProcessId())
{ {
s_flag = 0; s_flag = 0;
@ -1864,7 +1883,7 @@ BOOL WINAPI DllMain( HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved )
hook->oldfunc = GetProcAddress( hKernel, hook->name ); hook->oldfunc = GetProcAddress( hKernel, hook->name );
bResult = HookAPIAllMod( Hooks, FALSE ); bResult = HookAPIAllMod( Hooks, FALSE );
OriginalAttr(); OriginalAttr( lpReserved );
DisableThreadLibraryCalls( hInstance ); DisableThreadLibraryCalls( hInstance );
} }
else if (dwReason == DLL_PROCESS_DETACH) else if (dwReason == DLL_PROCESS_DETACH)
@ -1873,11 +1892,6 @@ BOOL WINAPI DllMain( HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved )
{ {
DEBUGSTR( 1, L"Unloading" ); DEBUGSTR( 1, L"Unloading" );
HookAPIAllMod( Hooks, TRUE ); HookAPIAllMod( Hooks, TRUE );
hConOut = CreateFile( L"CONOUT$", GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL, OPEN_EXISTING, 0, 0 );
SetConsoleTextAttribute( hConOut, orgattr );
CloseHandle( hConOut );
} }
else else
{ {
@ -1886,6 +1900,14 @@ BOOL WINAPI DllMain( HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved )
s_grm = grm; s_grm = grm;
s_flag = GRM_EXIT; s_flag = GRM_EXIT;
} }
if (orgattr != 0)
{
hConOut = CreateFile( L"CONOUT$", GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL, OPEN_EXISTING, 0, 0 );
SetConsoleTextAttribute( hConOut, orgattr );
CloseHandle( hConOut );
}
} }
return bResult; return bResult;

View File

@ -87,7 +87,7 @@
add error codes to some message. add error codes to some message.
*/ */
#define PDATE L"7 February, 2014" #define PDATE L"8 February, 2014"
#include "ansicon.h" #include "ansicon.h"
#include "version.h" #include "version.h"
@ -331,7 +331,7 @@ int main( void )
if (_isatty( 2 )) if (_isatty( 2 ))
_setmode( 2, _O_U16TEXT); _setmode( 2, _O_U16TEXT);
// Create a console handle and store the current attribute. // Create a console handle and store the current attributes.
get_original_attr(); get_original_attr();
argv = GetCommandLine(); argv = GetCommandLine();