找回密码
 立即注册
TheExtTextOutWSciLexerwindbg | 系统编程 2021-07-05 662 0star收藏 版权: . 保留作者信息 . 禁止商业使用 . 禁止修改作品
工程名为SciLexer是因为先测试scintilla里的SciLexer组件,测试通过后发现完全可以利用的asm词法解析引擎,顺便就建立了windbg高亮插件子工程名为hs。test子工程只是测试SciLexer组件的,已经过期,基本上只看hs子工程就OK。工程属性里设置了windbg插件sdk的目录,本来我是想写windbg插件的,结果发现根本不需要sdk,任何普通dll都可以用.load命令加载,所以如果你没有windbg sdk的话,直接删除engextcpp.cpp并更改dllmain等相关代码(我现在的机子没有编程环境),所以默认编译需要:vs2008及以上,boost库,windbg sdk。
hook ExtTextOutW,并设置SetTextColor设置文本色,当然也可以设置背景色,但貌似还不需要。ExtTextOutW_Hook中判断是否要处理(如判断窗口是否是汇编窗口和命令窗口,并加入窗口缓存),要处理的话调用CText类的lex函数分析,lex分析完毕会调用CText里的SetStyles,在这里我们才进行文本着色,SetStyles( int length, const char *styles )length是字符个数,styles是一段buffer,每个字节对应一个处理过的字符,它的值就是该字符显示为什么颜色。如CPU就是6,对应SciLexer\include\SciLexer.h里的SCE_ASM_CPUINSTRUCTION,举例:                    mov eax,0styles里对应  666088802其中8是SCE_ASM_REGISTER,2是SCE_ASM_NUMBER,所以我们显示的时候要分段显示,对同一值的调用一次SetTextColor,并马上ExtTextOutW,并修正X坐标以便下一个ExtTextOutW调用,测试发现每次ExtTextOutW只显示一行,所以不用管Y坐标。

(The project is called SciLexer because the SciLexer component in scintilla is tested first. After the test is passed, it is found that the asm lexical parsing engine is fully usable. By the way, the windbg highlighting plug-in sub-project named hs is created. The test subproject is only used to test the SciLexer components, and it has expired. Basically, just look at the hs subproject and it will be OK.The directory of the windbg plug-in SDK is set in the project properties. Originally I wanted to write the windbg plug-in, but I found that no SDK is needed at all. Any ordinary dll can be loaded with the .load command, so if you don’t have a windbg sdk, just delete engextcpp. cpp and change related codes such as dllmain (my current machine does not have a programming environment), so the default compilation requires: vs2008 and above, boost library, windbg sdk.
Hook ExtTextOutW, and set SetTextColor to set the text color. Of course, you can also set the background color, but it doesn't seem to be needed. In ExtTextOutW_Hook, it is judged whether to process (such as judging whether the window is an assembly window and a command window, and adding the window cache). If it needs to be processed, call the lex function analysis of the CText class. After the lex analysis is completed, the SetStyles in CText will be called. Text coloring,SetStyles( int length, const char *styles)Length is the number of characters, styles is a buffer, each byte corresponds to a processed character, and its value is the color of the character. If the CPU is 6, it corresponds to SCE_ASM_CPUINSTRUCTION in SciLexer\include\SciLexer.h, for example:                    mov eax,0Corresponding in styles 666088802Where 8 is SCE_ASM_REGISTER, 2 is SCE_ASM_NUMBER, so we need to display it in segments when we display it, call SetTextColor once for the same value, and immediately ExtTextOutW, and correct the X coordinate so that the next ExtTextOutW call, the test found that each ExtTextOutW only displays one line. So don't care about the Y coordinate.)

1625468128923.rar


上一篇:xspy v0.3,探测mfc/alt/wtl窗口,开源
下一篇:Cheat Engine 6.3源码+人个美化版