Get Device Information - Windows Mobile Development and Hacking General

Does anybody know how to get Device Information on XDA(Wallaby, Himalaya and Blue Angel) from within C++?
I would like to get the RomVersions(ROM,Radio etc.) and Dates.
And also Modell Number, IMEI.
Nearly the same as you can see under Start->Settings>System: Device Information.
I read somethimg about a "disk on chip" document, but it is linked under wiki, and it seems to me that everything und wiki(sourceodes, documents etc.) is dead.

Ok, i have some of these things.
I get the Model-Nr, Platform String, IMEI, and the OS Version.
With this Information i can say what XDA Device i´m running on.
But i don´t know how to get the ROM Informations.
Does anybody know where to find them? On XDA3 i found Versiosn in Registry, but they are not avaible on XDA1, and not all avaible on XDA2.
Maybe i have to Get the FileVersions and Dates...

Device Information
Hi I'm new in PDA and I'm looking for c++ code to reed information about device serial number or IMEI (for MDA 2 or MDA 3). Could You help me.
Thanks for any information
Tom.

To retrieve the IMEI:
//Function GetIMEI
CString GetIMEI()
{
CString strTemp;
WCHAR szString[MAX_PATH] = L"\0";
LINEGENERALINFO *LPLineGeneralInfo = NULL;
LPLineGeneralInfo = (LINEGENERALINFO*)malloc(sizeof (LINEGENERALINFO));
LPLineGeneralInfo->dwTotalSize = sizeof(LINEGENERALINFO);
LONG lTapiReturn;
DWORD NewSize;
DWORD dwNumDevs;
DWORD dwAPIVersion = TAPI_API_HIGH_VERSION;
LINEINITIALIZEEXPARAMS liep;
HLINEAPP hLineApp = 0;
HLINE hLine = 0;
DWORD dwExtVersion;
BOOL bRetVal = FALSE;
LPBYTE pLineGeneralInfoBytes = NULL;
DWORD dwTAPILineDeviceID;
const DWORD dwMediaMode = LINEMEDIAMODE_DATAMODEM | LINEMEDIAMODE_INTERACTIVEVOICE;
// Initialisiern
liep.dwTotalSize = sizeof(liep);
liep.dwOptions = LINEINITIALIZEEXOPTION_USEEVENT;
lineInitializeEx(&hLineApp, 0, 0, L"MDAC", &dwNumDevs, &dwAPIVersion, &liep);
// Device ID holen
dwTAPILineDeviceID = GetTSPLineDeviceID(hLineApp, dwNumDevs, TAPI_API_LOW_VERSION, TAPI_API_HIGH_VERSION, CELLTSP_LINENAME_STRING);
// Line öffnen
lineOpen(hLineApp, dwTAPILineDeviceID, &hLine, dwAPIVersion, 0, 0, LINECALLPRIVILEGE_OWNER, dwMediaMode, 0);
// ExTAPI Version aushandeln
lineNegotiateExtVersion(hLineApp, dwTAPILineDeviceID, dwAPIVersion, EXT_API_LOW_VERSION, EXT_API_HIGH_VERSION, &dwExtVersion);
lTapiReturn = lineGetGeneralInfo(hLine, LPLineGeneralInfo);
//If the LineGeneralInfo buffer was too small then make it bigger and ask again
if ((lTapiReturn == 0) && (LPLineGeneralInfo->dwNeededSize > LPLineGeneralInfo->dwTotalSize))
{
NewSize = LPLineGeneralInfo->dwNeededSize;
LPLineGeneralInfo = (LINEGENERALINFO*)realloc(LPLineGeneralInfo, LPLineGeneralInfo->dwNeededSize);
LPLineGeneralInfo->dwTotalSize = NewSize;
lTapiReturn = lineGetGeneralInfo(hLine, LPLineGeneralInfo);
}
if (lTapiReturn != 0)
{
//wcscpy(szString, TEXT("Error, unable to read phone\n\rinformation with the phone\n\rswitched off.\n\n\rPlease Exit program and try again."));
}
else
{
//Copy Result over to this functions reply
// wcscpy(szString , TEXT("Manufacturer and Model:\n\r "));
// wcscat(szString, (TCHAR*)((char*)LPLineGeneralInfo + LPLineGeneralInfo->dwManufacturerOffset));
// wcscat(szString, TEXT("\n\r "));
// wcscat(szString, (TCHAR*)((char*)LPLineGeneralInfo + LPLineGeneralInfo->dwModelOffset ));
// wcscat(szString, TEXT("\n\n\r"));
// wcscat(szString , TEXT("Revision :\n\r "));
// wcscat(szString, (TCHAR*)((char*)LPLineGeneralInfo + LPLineGeneralInfo->dwRevisionOffset));
// wcscat(szString, TEXT("\n\n\r"));
// wcscat(szString , TEXT("Serial Number :\n\r "));
wcscpy(szString, (TCHAR*)((char*)LPLineGeneralInfo + LPLineGeneralInfo->dwSerialNumberOffset));
// wcscat(szString, TEXT("\n\n\r"));
// wcscat(szString , TEXT("Subscriber Number :\n\r "));
// wcscat(szString, (TCHAR*)((char*)LPLineGeneralInfo + LPLineGeneralInfo->dwSubscriberNumberOffset));
// wcscat(szString, TEXT("\n\r"));
}
strTemp = szString;
//Free up resources used
if (hLineApp != NULL)
lineShutdown(hLineApp);
if (LPLineGeneralInfo != NULL)
free(LPLineGeneralInfo);
if(strTemp.GetLength() == 17)
{
return strTemp.Left(15);
}
return strTemp;
}
//FUNCTION GetTSPLineDeviceID
DWORD GetTSPLineDeviceID(const HLINEAPP hLineApp, const DWORD dwNumberDevices, const DWORD dwAPIVersionLow, const DWORD dwAPIVersionHigh, const TCHAR *const psTSPLineName)
{
DWORD dwReturn = 0xffffffff;
for(DWORD dwCurrentDevID = 0 ; dwCurrentDevID < dwNumberDevices ; dwCurrentDevID++)
{
DWORD dwAPIVersion;
LINEEXTENSIONID LineExtensionID;
if(0 == lineNegotiateAPIVersion(hLineApp, dwCurrentDevID,
dwAPIVersionLow, dwAPIVersionHigh,
&dwAPIVersion, &LineExtensionID))
{
LINEDEVCAPS LineDevCaps;
LineDevCaps.dwTotalSize = sizeof(LineDevCaps);
if(0 == lineGetDevCaps(hLineApp, dwCurrentDevID,
dwAPIVersion, 0, &LineDevCaps))
{
BYTE* pLineDevCapsBytes = new BYTE[LineDevCaps.dwNeededSize];
if(0 != pLineDevCapsBytes)
{
LINEDEVCAPS* pLineDevCaps = (LINEDEVCAPS*)pLineDevCapsBytes;
pLineDevCaps->dwTotalSize = LineDevCaps.dwNeededSize;
if(0 == lineGetDevCaps(hLineApp, dwCurrentDevID,
dwAPIVersion, 0, pLineDevCaps))
{
if(0 == _tcscmp((TCHAR*)((BYTE*)pLineDevCaps+pLineDevCaps->dwLineNameOffset),
psTSPLineName))
{
dwReturn = dwCurrentDevID;
}
}
delete[] pLineDevCapsBytes;
}
}
}
}
return dwReturn;
}

Thanks for your code but I cand compile it error like:
error C2065: 'TAPI_API_HIGH_VERSION' : undeclared identifier
error C2065: 'TAPI_API_LOW_VERSION' : undeclared identifier
error C2065: 'CELLTSP_LINENAME_STRING' : undeclared identifier
error C2065: 'EXT_API_LOW_VERSION' : undeclared identifier
error C2065: 'EXT_API_HIGH_VERSION' : undeclared identifier
what should I include ?

#define TAPI_API_LOW_VERSION 0x00020000
#define TAPI_API_HIGH_VERSION 0x00020000
#define EXT_API_LOW_VERSION 0x00010000
#define EXT_API_HIGH_VERSION 0x00010000

OK but what with this one:
error C2065: 'CELLTSP_LINENAME_STRING' : undeclared identifier
thanks

#include <tapi.h>
#include <tsp.h>
#include "extapi.h"
#define TAPI_API_LOW_VERSION 0x00020000
#define TAPI_API_HIGH_VERSION 0x00020000
#define EXT_API_LOW_VERSION 0x00010000
#define EXT_API_HIGH_VERSION 0x00010000

Now is OK
.. but I have one question whay it dsn't work without SIM card ? Is it possible to get IMEI or device serial number if there aren't sim inside ?

Yes, it does work without simcard. It runs on my MDA 1/2/3 without SIMCard.
Maybe you phone decivce is completely turned off...

Yes you right phone device was turned off now is goood
Thanks

hmmm - are you writing this app in eVC++ 3.0 or eVC++ 4.0 ?? I dont seem to get it working in eVC++ 4.0. I'm getting an external link error for lineGetGeneralInfo().
Could you be kind enough to send me the full app ??? or help me solve this ?? i'm trying to write my program as a MFC pocket pc 2003 exe and dialog based!!
thanks

problem solved , thanks for the source code

has anybody used this as a utility to craete an output fie containing the IMEI number? I have'nt got Visual Studio for pocket PC but would like to be able to do this

Patrick said:
Yes, it does work without simcard. It runs on my MDA 1/2/3 without SIMCard.
Maybe you phone decivce is completely turned off...
Click to expand...
Click to collapse
My phone device is completelty turned off.
Do you have any idea how to find IMEI number when the device is in this state ?
It's possible because system info in control panel could display the IMEI in this state.

Hi everybody!
I know this is a bit off topic but if you want to get a serial number instead of IMEI you can use the following code:
Code:
#define IOCTL_HAL_GET_DEVICEID CTL_CODE(FILE_DEVICE_HAL, 21, METHOD_BUFFERED, FILE_ANY_ACCESS)
extern "C" BOOL KernelIoControl(
DWORD dwIoControlCode,
LPVOID lpInBuf,
DWORD nInBufSize,
LPVOID lpOutBuf,
DWORD nOutBufSize,
LPDWORD lpBytesReturned);
BYTE outBuff[16];
*(DWORD*)outBuff = 16;
KernelIoControl(IOCTL_HAL_GET_DEVICEID, 0, 0, outBuff, 16, &outBytes);
Should work on all devices regardless of what is turned on.

Thanks.
With the DEVICEID information, IMEI could be found with phone device turned off on QTEK 9090
Code:
void GetIMEIFromQtek9090(char *serial)
{
BYTE outBuff[16];
DWORD outBytes;
*(DWORD*)outBuff = 16;
KernelIoControl(IOCTL_HAL_GET_DEVICEID, 0, 0, outBuff, 16, &outBytes);
sprintf(serial,"35%02X%02X%02X%02X%02X%02X%02X", outBuff[6], outBuff[5], outBuff[4], outBuff[3], outBuff[2], outBuff[1], outBuff[0]);
}
Thanks again.

Any luck obtaining the device ROM version? It's the only item in your list that I seem to be stuck on...

Can someone send me a compiled version of the code to get the IMEI etc?

Related

lineSetAppPriority doesn't seem to work...

For the program I posted here, I want to handle incoming calls before the default popup appears (to replace the ringtone).
Currently, my tool seems to be quick enough without lineSetAppPriority in most cases, but sadly not in all...
I was using the following code: (currently removed again, because it didn't work and even caused some troubles...)
Initialization:
Code:
if ( lineInitialize( &LineApp, theApp.m_hInstance, LineCallback,
theApp.m_pszAppName, &LineHandleCount ) == 0 )
{
LineHandles = new HLINE[LineHandleCount];
for(DWORD i = 0; i < LineHandleCount; i++)
{
if ( lineNegotiateAPIVersion( LineApp, i, 0x00010000, 0x00020000,
&ver, &extensionID ) == 0 )
{
rc = lineOpen( LineApp, i, &LineHandles[i], ver, 0, (DWORD)this,
LINECALLPRIVILEGE_MONITOR|LINECALLPRIVILEGE_OWNER,
LINEMEDIAMODE_INTERACTIVEVOICE, NULL );
if ( rc < 0 )
LineHandles[i] = NULL;
else
if ( LineHandleSignal == NULL )
LineHandleSignal = LineHandles[i];
}
}
HRESULT res = lineSetAppPriority( theApp.m_pszAppName,
LINEMEDIAMODE_INTERACTIVEVOICE,
NULL,
LINEREQUESTMODE_MAKECALL,
NULL, 1 );
}
Callback:
Code:
VOID FAR PASCAL LineCallback( DWORD hDevice,
DWORD dwMsg,
DWORD dwCallbackInstance,
DWORD dwParam1,
DWORD dwParam2,
DWORD dwParam3
)
{
if ( dwMsg == LINE_CALLSTATE )
{
LINECALLINFO *callInfo = (LINECALLINFO *)calloc(sizeof(LINECALLINFO)
+1024, 1);
callInfo->dwTotalSize = sizeof(LINECALLINFO)+1024;
lineGetCallInfo( (HCALL)hDevice, callInfo );
// different stuff...
HRESULT res;
// Remove from priority list, so lineHandoff will run the default
// call window
res = lineSetAppPriority( theApp.m_pszAppName,
LINEMEDIAMODE_INTERACTIVEVOICE, NULL,
LINEREQUESTMODE_MEDIACALL, NULL, 0 );
// Forward event to next instance (usually Windows' phone app)
lineHandoff( (HCALL)hDevice, NULL, callInfo->dwMediaMode );
// Set to top priority again
res = lineSetAppPriority( theApp.m_pszAppName,
LINEMEDIAMODE_INTERACTIVEVOICE, NULL,
LINEREQUESTMODE_MEDIACALL, NULL, 1 );
}
lineSetAppPriorty returns OK in all cases. But when a call comes in, the
default bubble applears simultaneously with the callback function. I
wanted it to be shown when I do the lineHandoff...
What am I doing wrong?
TIA,
Mirko
I used lineSetAppPriority too, with same result....
I think there is one way.....kill cprog

RIL

Hi there,
I begin to learn RIL functions (i work i-mate sp3i).
I'm stuck with RIL_Initialize returning a NULL handle .... ??? :?
Hvoid RilResultCallback(
DWORD dwCode, // @parm result code
HRESULT hrCmdID, // @parm ID returned by the command that originated>
const void* lpData, // @parm data associated with the notification
DWORD cbData, // @parm size of the strcuture pointed to lpData
DWORD dwParam // @parm parameter passed to <f RIL_Initialize>
)
{
}
void RilNotifyCallback(
DWORD dwCode, // @parm notification code
const void* lpData, // @parm data associated with the notification
DWORD cbData, // @parm size of the strcuture pointed to lpData
DWORD dwParam // @parm parameter passed to <f RIL_Initialize>
)
{
}
void fn()
{
HRIL hRil;
RIL_Initialize(1, RilResultCallback, RilNotifyCallback,
0, 0, &hRil);
if(hRil == NULL)
{
AfxMessageBox(L"hRil == NULL");
}else AfxMessageBox(L"hRil != NULL");
}
I don't understand what the problem is???
Thanks for any help.
what is the result code?
rc= RIL_Initialize( ... )
willem
if i understand you the question right, the result is:
rc=RIL_Initialize(1, RilResultCallback, RilNotifyCallback,
0, 0, &hRil);
hRil==0 , rc == 8........
tstril -- Answers too
8 is a very strange result value for RIL_Initialize.
the only possible answers i see are:
0x80070057 for invalid parameter
0x8007000E or 0x80004005 or 1
... ah, when you specify a notifyproc, you do have to specify some notificationclasses to go with it. .. the 4th param should not be 0 when notifyproc !=NULL
willem
I a beginner if am possible on more in detail,
and the full answer 0x80004005
thankful in advance
maybe your phone is in flightmode?
.. this error means ril did not initialize properly.
willem
Thanks all. I have understood. The certificate is necessary.

RAPI problem writing registry key value

I am presently writing a RegEdit program to run on my PC and allow editing of the registry on the connected PPC. I have got to the point where I can read the entire registry and I am now implementing function to update the registry i.e. insert new key, delete key, add new Key Values etc...
The problem I have at the moment is trying to add a new value to an existing key. The function I have written so far to do this is as follows, but the call to CeRegSetValueEx(...) returns an error code 5!
Code:
//-----------------------------------------------------------------------------------
// Adds a new key value into the registry.
// // TO DO - add the data
int CRegEditDoc::AddNewKeyValue(HTREEITEM hParent, HKEY hRoot, LPTSTR lpszKey, LPTSTR lpszValueName, DWORD dwType)
{
USES_CONVERSION;
int nItem, rc;
HKEY hKey;
LPWSTR lpwszKey = T2W(lpszKey);
LPWSTR lpwszValueName = T2W(lpszValueName);
try
{
if (lstrlen (lpszKey))
{
if (m_rapi.CeRegOpenKeyEx (hRoot, lpwszKey, 0, 0, &hKey) != ERROR_SUCCESS)
{
return 0;
}
}
else
{
hKey = hRoot;
}
CString strValue = "my data";
LPWSTR lpwszData = T2W(strValue);
DWORD length = dim(lpwszData);
nItem = m_pRightView->GetListCtrl().GetItemCount();
if (m_rapi.CeRegSetValueEx(hKey, lpwszValueName, 0, dwType, (LPBYTE)lpwszData, length*2) != ERROR_SUCCESS) // last 2 lpData, szie in bytes of data.
{
HRESULT hResult = m_rapi.CeRapiGetError();
DWORD dwError = m_rapi.CeGetLastError();
return 0;
}
}
catch (CException* e)
{
TCHAR szCause[255];
e->GetErrorMessage(szCause, 255);
CString errorMsg = _T("Error in: CRegEditDoc::AddNewKeyValue: ");
errorMsg += szCause;
AfxMessageBox(errorMsg);
e->Delete();
}
return 1;
}
I would appreciate a little advise on the matter, as this is the first time I have used the RAPI.
Thanks.
Hi VZ800!
The error you're getting is 'access denied'. In WM5 many RAPI functions (including writing to registry) are blocked for security reasons. Your only choice is to use a dll with CeRapiInvoke functions, but it needs to be deployed through a special cab.
You can read about this on msdn.
By the way, the app you're writing already exists, and it has the same problem.
Good luck!
Thanks for the advice. Since my post I have found that my code works for the HKEY_LOCAL_MACHINE, "/Software".
I will investigate the issue you have pointed me to.
Actually, your code should work for the entire HKEY_CLASSES_ROOT as well. MS decided to block only certain 'sensitive' parts of the registry so they can not be corrupted from the outside by malicious software.
If you noticed, MS's own remote registry editor works through DLLs (a ton of them).
Any way, I skimped on words in my first post, since I was writing it on a bus, and while I love my Jamin, writing long text on it is not very enjoyable.
Let me elaborate on CeRapiInvoke:
It's a function you call on the PC side that receives a DLL name and a function name (in that DLL) as parameters and calls that function on the device. It also lets you transfer buffers of data to and from the called function.
It's a great way to communicate with a PPC device without using sockets. You can write the device side DLL to do what ever you wont (like access protected registry) and report back to the PC.
The only drawback is in WM5 this DLL has to be registered and have a 'system' file attribute set. That's why you have to deploy it by cab.
Like I said before it's all in the MSDN.
Hope this helps.
Thanks. I have read the articles (and printed them) about RAPI Restricted Mode Security etc... http://msdn.microsoft.com/library/d...5/html/wce51conRAPIRestrictedModeSecurity.asp and will write a DLL to go on the PPC which will be installed via CAB etc...
I updated the function to add a new value anyway. Rather than calling the RAPI functions for the registry CeRapi... I will call my own functions in my authorised DLL.
Code:
//-----------------------------------------------------------------------------------
// Adds a new key value into the registry.
//
int CRegEditDoc::AddNewKeyValue(HTREEITEM hParent, HKEY hRoot, LPTSTR lpszKey,
LPTSTR lpszValName, DWORD dwDType, LPBYTE lpData)
{
USES_CONVERSION;
HKEY hKey;
LPWSTR lpwszKey = T2W(lpszKey);
LPWSTR lpwszValName = T2W(lpszValName);
DWORD dwDSize = sizeof(lpData);
try
{
if (lstrlen(lpszKey))
{
if (m_rapi.CeRegOpenKeyEx (hRoot, lpwszKey, 0, 0, &hKey) != ERROR_SUCCESS)
{
return 0;
}
}
else
{
hKey = hRoot;
}
// Check if valuename already exists. Should never happen, but just in case.
if (m_rapi.CeRegQueryValueEx(hKey, lpwszValName, 0, &dwDType, NULL, &dwDSize) == ERROR_SUCCESS)
{
AfxMessageBox(_T("Value of this name already exists!"));
return 0;
}
if (m_rapi.CeRegSetValueEx(hKey, lpwszValName, 0, dwDType, lpData, dwDSize) != ERROR_SUCCESS)
{
HRESULT hResult = m_rapi.CeRapiGetError();
DWORD dwError = m_rapi.CeGetLastError();
AfxMessageBox(_T("Unable to create new value for this key!\nPlease check access rights."));
return 0;
}
}
catch (CException* e)
{
TCHAR szCause[255];
e->GetErrorMessage(szCause, 255);
CString errorMsg = _T("Error in: CRegEditDoc::AddNewKeyValue: ");
errorMsg += szCause;
AfxMessageBox(errorMsg);
e->Delete();
}
return 1;
}
A question on using the CeRapiInvoke function. Obviously my function that I will be invoking in my DLL will need to conform to the following footprint:
Code:
LPCWSTR, LPCWSTR, DWORD, BYTE*, DWORD*, BYTE**, IRAPIStream**, DWORD
What I would like to know is this: If I want my function to be a wrapper to say the
Code:
CeRegQueryValueEx(HKEY, LPWSTR, LPDWORD, LPDWORD, LPBYTE, LPDWORD)
function, how do I parse the function args? Please suggest how I would pack them into a BYTE* for the pInput parameter.
Actually, you got it a bit wrong:
Code:
FuncName(DWORD cbInput, BYTE *pInput, DWORD *pcbOutput, BYTE **ppOutput, IRAPIStream *ppIRAPIStream);
The prototype you specified is for the PC side (the first two strings are DLL name and function name);
I use the following parsing method:
Code:
BYTE* curInputPos = pInput;
memcpy((BYTE*)&hKey, curInputPos, sizeof(HKEY));
curInputPos += sizeof(HKEY);
memcpy((BYTE*)&dwIndex, curInputPos, sizeof(DWORD));
curInputPos += sizeof(DWORD);
memcpy((BYTE*)&Reserved, curInputPos, sizeof(DWORD));
curInputPos += sizeof(DWORD);
It works fine both ways.
Just don't forget to use LocalAlloc for inBuffer and LocalFree for outBuffer.
Thanks. I'll let you know how I get on.
So if I were to parse an HKEY and an LPTSTR accross I would do the following to put the data into a BYTE array:
Code:
DWORD dwIn, dwOut;
LPBYTE pInput;
PDWORD pOut;
dwIn = sizeof(HKEY) + (strlen(lpszKey)*sizeof(TCHAR));
pInput = (BYTE*)(LocalAlloc(LPTR, dwIn));
memcpy(pInput, (BYTE*)&hKey, sizeof(HKEY));
pInput += sizeof(HKEY);
memcpy(pInput, (BYTE*)&lpszKey, strlen(lpszKey)*sizeof(TCHAR));
// move pointer back to begining.
pInput -= sizeof(HKEY);
Basically, yes but with two reservations:
1) I recommend using a different pointer for the current position in buffer, to avoid errors.
2) you need to put the string length in the byte array before the string, otherwise you won't know it's length on the device side. Alternatively, you have to add 1 to the length so the 0 byte at the end gets packed and you can use strlen on the device.
Also keep in mined that unless you define the PC side project to work with UNICODE libraries, THCHAR will be defined as char, while on the device it's always WCHAR.
I really apreciate your help. I still can't get my DLL function to work I keep getting error 1064!
This is my code for the DLL named REditSvr.dll:
Code:
#include <windows.h>
#ifdef __cplusplus
extern "C"
{
#endif
__declspec (dllexport) INT RegEditDeleteValue (DWORD cbInput, BYTE* pInput, DWORD* pcbOutput, BYTE** ppOutput, PVOID reserved);
#ifdef __cplusplus
}
#endif
BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD dwReason, LPVOID lpvReserved)
{
return TRUE;
}
INT RegEditDeleteValue (DWORD cbInput, BYTE* pInput, DWORD* pcbOutput, BYTE** ppOutput, PVOID reserved)
{
INT rc = 0;
BYTE* curInputPos = pInput;
HKEY hKey;
DWORD dwLength;
// Copy args out of input buffer.
memcpy((BYTE*)&hKey, curInputPos, sizeof(HKEY));
curInputPos += sizeof(HKEY);
memcpy((BYTE*)&dwLength, curInputPos, sizeof(DWORD));
curInputPos += sizeof(DWORD);
// Allocate enough memory for local wchar.
LPWSTR lpszValueName = (WCHAR*)malloc(dwLength);
memcpy((BYTE*)&lpszValueName, curInputPos, sizeof(dwLength));
curInputPos += sizeof(dwLength);
// Do the registry delete.
rc = RegDeleteValue(hKey, lpszValueName);
// Allocate memory for the return buffer.
BYTE* pOutput = (BYTE*)LocalAlloc(LPTR, sizeof(long));
memcpy(pOutput, (BYTE*)rc, sizeof(long));
*ppOutput = pOutput;
*pcbOutput = sizeof(long);
// Free input buffer.
LocalFree(pInput);
// Free WCHAR
free(lpszValueName);
return GetLastError();
}
and this is the code in my PC application which invokes the above function (or I would hope it did):
Code:
//-----------------------------------------------------------------------------------
// Deletes the key value from the registry.
//
int CRegEditDoc::DeleteKeyValue(HKEY hRoot, LPCTSTR lpszKey, LPCTSTR lpszValName)
{
USES_CONVERSION;
HKEY hKey;
LPWSTR lpwszKey = T2W(lpszKey);
LPWSTR lpwszValName = T2W(lpszValName);
try
{
if (lstrlen(lpszKey))
{
if (m_rapi.CeRegOpenKeyEx (hRoot, lpwszKey, 0, 0, &hKey) != ERROR_SUCCESS)
{
return 0;
}
}
else
{
hKey = hRoot;
}
/* if (m_rapi.CeRegDeleteValue(hKey, lpwszValName) != ERROR_SUCCESS)
{
HRESULT hResult = m_rapi.CeRapiGetError();
DWORD dwError = m_rapi.CeGetLastError();
AfxMessageBox(_T("Unable to delete value for this key!\nPlease check access rights."));
return 0;
}
*/
// Testing remote registry value deletion.
DWORD dwIn, dwOut;
LPBYTE pInput, pCurInputPos;
PDWORD pOut;
DWORD dwLength = wcslen(lpwszValName)*sizeof(WCHAR);
dwIn = sizeof(HKEY) + dwLength;
pInput = (BYTE*)(LocalAlloc(LPTR, dwIn));
pCurInputPos = pInput;
memcpy(pCurInputPos, (BYTE*)&hKey, sizeof(HKEY));
pCurInputPos += sizeof(HKEY);
// Store the length of the string
memcpy(pCurInputPos, (BYTE*)&dwLength, sizeof(DWORD));
pCurInputPos += sizeof(DWORD);
memcpy(pCurInputPos, (BYTE*)&lpwszValName, dwLength);
HRESULT hr = m_rapi.CeRapiInvoke(L"REditSvr", L"RegEditDeleteValue", dwIn,
pInput, &dwOut, (PBYTE*)&pOut, NULL, 0);
HRESULT hResult = m_rapi.CeRapiGetError();
DWORD dwError = m_rapi.CeGetLastError();
LocalFree(pOut);
if (hKey != hRoot)
{
m_rapi.CeRegCloseKey(hKey);
}
}
catch (CException* e)
{
TCHAR szCause[255];
e->GetErrorMessage(szCause, 255);
CString errorMsg = _T("Error in: CRegEditDoc::DeleteKeyValue: ");
errorMsg += szCause;
AfxMessageBox(errorMsg);
e->Delete();
}
return 1;
}
The DLL has been deployed to the PPC \Windows folder by eVC4. My PPC runs WM5 (is this the problem, although I have written programs with eVC4 ok for it).
I would again appreciate your help/advice on why this isn't working. At present I have unlocked my PPC and I am able to edit any part of the registry etc...
Hi VZ800!
I noticed a couple of errors in your code (which you may have corrected yourself by now) but the biggest problem, I think is that you don't register the dll.
Here is the part you missed from MSDN:
(full link: http://msdn.microsoft.com/library/d...en-us/mobilesdk5/html/mob5lrfcerapiinvoke.asp)
To satisfy the requirements of the Remote Access Security Policy
1. Create a provisioning XML document that adds the new node "RAPI" to the metabase. This node must include the absolute path to the *.DLL file. For more information, see Metabase Settings. The following code example shows the contents of a typical provisioning XML file.
<wap-provisioningdoc>
<characteristic type="Metabase">
<characteristic type="RAPI\Program Files\Green Sky\recaller.dll\*">
<parm name="rw-access" value="3"/>
<parm name="access-role" value="152"/>
</characteristic>
</characteristic>
</wap-provisioningdoc>
2. Pass the file name of the provisioning XML document to the CAB wizard using the /postxml command line option. The CAB wizard will append the XML to the _setup.xml file it places in the CAB. For more information on creating CAB files, see CAB Wizard.
3. Set the System attribute on the *.DLL file.
Only the Manager security role provides the required permissions for modifying the metabase. The ideal way to get this security role is to have your application signed with a privileged certificate.
Note Since Pocket PC implements a one-tier security model, the CAB install process will automatically have the Manager security role.
Click to expand...
Click to collapse
Here's my advice:
Create a simple function that doesn't receive parameters, but pops up a message on the device. When you see that calling it works, try adding the rest of the code.
Hi
As I understand the DLL does not require code to self- register. Anyway, I can call the DLL function and did as you suggested and put a MessageBox in the function. This displayed fine. My code for the DLL is as follows now:
Code:
#include <windows.h>
#ifdef __cplusplus
extern "C"
{
#endif
__declspec (dllexport) INT RegEditDeleteValue (DWORD cbInput, BYTE* pInput, DWORD* pcbOutput, BYTE** ppOutput, PVOID reserved);
#ifdef __cplusplus
}
#endif
BOOL WINAPI DllMain (HANDLE hinstDLL, DWORD dwReason, LPVOID lpvReserved)
{
return TRUE;
}
INT RegEditDeleteValue (DWORD cbInput, BYTE* pInput, DWORD* pcbOutput, BYTE** ppOutput, PVOID reserved)
{
DWORD rc = 0;
BYTE* curInputPos = pInput;
LPCWSTR lpszValueName;
HKEY hKey;
int len;
// Copy args out of input buffer.
memcpy((BYTE*)&hKey, curInputPos, sizeof(HKEY));
curInputPos += sizeof(HKEY);
// Size of value name string.
memcpy((BYTE*)&len, curInputPos, sizeof(int));
curInputPos += sizeof(int);
// Value name string.
memcpy((BYTE*)&lpszValueName, curInputPos, sizeof(len));
curInputPos += sizeof(len);
// Do the registry delete.
rc = RegDeleteValue(hKey, lpszValueName);
// Allocate memory for the return buffer.
*ppOutput = (BYTE*)LocalAlloc(LPTR, rc);
memcpy(*ppOutput, (BYTE*)&rc, sizeof(DWORD));
*pcbOutput = sizeof(DWORD);
// Free input buffer.
if (pInput)
LocalFree(pInput);
return GetLastError();
}
and this is the code from which I am calling it:
Code:
//-----------------------------------------------------------------------------------
// Deletes the key value from the registry.
//
int CRegEditDoc::DeleteKeyValue(HKEY hRoot, LPCTSTR lpszKey, LPCTSTR lpszValName)
{
USES_CONVERSION;
HKEY hKey;
LPWSTR lpwszKey = T2W(lpszKey);
LPCWSTR lpwszValName = T2W(lpszValName);
try
{
if (lstrlen(lpszKey))
{
if (m_rapi.CeRegOpenKeyEx (hRoot, lpwszKey, 0, 0, &hKey) != ERROR_SUCCESS)
{
return 0;
}
}
else
{
hKey = hRoot;
}
/* if (m_rapi.CeRegDeleteValue(hKey, lpwszValName) != ERROR_SUCCESS)
{
HRESULT hResult = m_rapi.CeRapiGetError();
DWORD dwError = m_rapi.CeGetLastError();
AfxMessageBox(_T("Unable to delete value for this key!\nPlease check access rights."));
return 0;
}
*/
// Testing remote registry value deletion.
DWORD dwIn, dwOut;
LPBYTE pInput, pCurInputPos;
PDWORD pOut, rc;
int len = wcslen(lpwszValName)*sizeof(WCHAR);
dwIn = sizeof(HKEY) + len;
pInput = (BYTE*)(LocalAlloc(LPTR, dwIn));
pCurInputPos = pInput;
// Store the hKey value in the output buffer.
memcpy(pCurInputPos, (BYTE*)&hKey, sizeof(HKEY));
pCurInputPos += sizeof(HKEY);
// Store the length of the string in the output buffer.
memcpy(pCurInputPos, (BYTE*)&len, sizeof(int));
pCurInputPos += sizeof(int);
// Store the value name string in the output buffer.
memcpy(pCurInputPos, (BYTE*)&lpwszValName, len);
HRESULT hr = m_rapi.CeRapiInvoke(L"REditSvr", L"RegEditDeleteValue", dwIn,
pInput, &dwOut, (PBYTE*)&pOut, NULL, 0);
// HRESULT hr = RapiFuncTest(dwIn, pInput, &dwOut, (PBYTE*)&pOut, NULL);
HRESULT hResult = m_rapi.CeRapiGetError();
DWORD dwError = m_rapi.CeGetLastError();
if (dwOut)
{
memcpy((BYTE*)&rc, pOut, sizeof(DWORD));
}
if (pOut)
{
LocalFree(pOut);
}
if (hKey != hRoot)
{
m_rapi.CeRegCloseKey(hKey);
}
}
catch (CException* e)
{
TCHAR szCause[255];
e->GetErrorMessage(szCause, 255);
CString errorMsg = _T("Error in: CRegEditDoc::DeleteKeyValue: ");
errorMsg += szCause;
AfxMessageBox(errorMsg);
e->Delete();
}
return 1;
}
As you can see in the DeleteKeyValue(...) function I called a test-function just to check that I was retrieving the data out of the pInput buffer ok, which I am.
I signed the DLL with the SDKSamplePrivDeveloper.pfx, added the /postxml via the /postxml switch in the cabwiz and successfully created a CAB file which installs the DLL into the \Windows folder on the PPC. The .inf file is as follows:
Code:
[CEStrings]
InstallDir=%CE2%
AppName="REditSvr"
[Strings]
CompanyName="AHartley"
[Version]
Signature="$Chicago$"
CESignature="$Windows CE$"
Provider=%CompanyName%
[SourceDisksNames.Arm]
1=,"arm files",,C:\eMDevelopment\PPCRegEdit\REditSvr\REL
[SourceDisksFiles.Arm]
REditSvr.dll=1
[Files.ARM]
REditSvr.dll
[DestinationDirs]
Files.Arm=,%InstallDir%
[DefaultInstall.Arm]
CopyFiles=Files.Arm
My PC side code invokes the DLL function return 0 as error code. But the error code returned in the ppOutput buffer is 0x00000057 Dec 87. Which equates to the error message "The parameter is incorrect."! Which must be a param of the RegDeleteValue(...) function, as if I comment this out I don't get any error return values!!
Any odeas?
This is all academic now as I won't be finishing the PPCRegEdit program coz of the Remote Registry Editor tool available in the eVC4 IDE, which I hadn't noticed before, duh. But I would like to know why the function isn't working as required.
You were writing this as a tool? :shock:
If you just asked, people would have told you about the existing reg edit and CeRegEdit witch works through RAPI directly.
Still, it is a nice exercise in coding which I done my self once (for other purposes)
Any way, your error is simple:
Code:
// Value name string.
memcpy((BYTE*)&lpszValueName, curInputPos, sizeof(len));
curInputPos += sizeof(len);
You are parsing it incorrectly.
This is how it should look:
Code:
// Value name string.
memcpy((BYTE*)lpszValueName, curInputPos, len);
curInputPos += len;
and on the PC side:
Code:
memcpy(pCurInputPos, (BYTE*)&lpwszValName, len);
should be:
Code:
memcpy(pCurInputPos, (BYTE*)lpwszValName, len);
once again, no offence but if you just read your code more carefully and use debug prints to check parameters, you won't need anyone's help.
Good luck in future projects.
(whoops, made an error my self while correcting another)
Yes, it is just an exercise.
Thanks for all your help. Sorry for the silly errors, I will try and take more care in future.

Get notified when process is started

I want to know if there is a way to get notified from windows pocket pc
system when a process is started or a new window is created.
Is there an API call that will manage this?
Thanks.
Houser
Houser said:
I want to know if there is a way to get notified from windows pocket pc
system when a process is started or a new window is created.
Is there an API call that will manage this?
Thanks.
Houser
Click to expand...
Click to collapse
Nope.
The only thing available is using the toolhelp library, by getting the current process list and update it, you can determine if a process started or stopped.
For the windows, it's the same, there isn't any notification mechanism to do that.
Cheers,
.Fred
On the BB Windows, you can install a system-wide hook and catch WM_CREATE notifications. Probably there is something similar for Mobile...
Lurker0 said:
On the BB Windows, you can install a system-wide hook and catch WM_CREATE notifications. Probably there is something similar for Mobile...
Click to expand...
Click to collapse
In coredll.dll, the SetWindowsHookEx function is defined but is undocumented. Maybe the declaration is the same that the one under Windows, you can have try.
I found in PB5 header pwinuser.h the following declarations:
Code:
typedef LRESULT (CALLBACK* HOOKPROC)(int code, WPARAM wParam, LPARAM lParam);
HHOOK
WINAPI
SetWindowsHookExW(
int idHook,
HOOKPROC lpfn,
HINSTANCE hmod,
DWORD dwThreadId);
#define SetWindowsHookEx SetWindowsHookExW
BOOL
WINAPI
UnhookWindowsHookEx(
HHOOK hhk);
LRESULT
WINAPI
CallNextHookEx(
HHOOK hhk,
int nCode,
WPARAM wParam,
LPARAM lParam);
Cheers,
.Fred
dotfred said:
In coredll.dll, the SetWindowsHookEx function is defined but is undocumented. Maybe the declaration is the same that the one under Windows, you can have try.
I found in PB5 header pwinuser.h the following declarations:
Code:
typedef LRESULT (CALLBACK* HOOKPROC)(int code, WPARAM wParam, LPARAM lParam);
HHOOK
WINAPI
SetWindowsHookExW(
int idHook,
HOOKPROC lpfn,
HINSTANCE hmod,
DWORD dwThreadId);
#define SetWindowsHookEx SetWindowsHookExW
BOOL
WINAPI
UnhookWindowsHookEx(
HHOOK hhk);
LRESULT
WINAPI
CallNextHookEx(
HHOOK hhk,
int nCode,
WPARAM wParam,
LPARAM lParam);
Cheers,
.Fred
Click to expand...
Click to collapse
The idHook you're interested in is WH_CBT and it seems to work in WINCE5.
Cheers,
.Fred
Hey that sounds good. Thanks so far.
I will try this now with SetWindowsHookExW().
Currently I am polling the process list with toolhelp library.
But this is not so good for performance and battery.
Houser
So I have tried this and have written a Dll where I hook
the WH_CBT with SetWindowsHookExW.
I have loaded the function pointers from the coredll.dll with LoadLibrary()
which is ok. But when I call SetWindowsHookExW() in my hook Dll
theh I get always error 87 back.
This is my code in the hook dll to install the hook.
Any ideas what is wrong here?
Code:
BOOL __declspec(dllexport)__stdcall InstallHook()
{
log(( TEXT("InstallHook") ));
g_hDll = LoadLibrary( TEXT("\\windows\\coredll.dll") );
if( g_hDll == NULL )
{
err(( TEXT("LoadLibrary") ));
return FALSE;
}
fpSetWindowHookEx = (SETWINDOWHOOKEX) GetProcAddress( g_hDll, TEXT("SetWindowsHookExW") );
if( fpSetWindowHookEx == NULL )
{
MessageBox( NULL, TEXT("SetWindowsHookExW"), TEXT(""), MB_OK );
}
fpUnhook = (UNHOOKWINDOWHOOKEX) GetProcAddress( g_hDll, TEXT("UnhookWindowsHookEx") );
if( fpUnhook == NULL )
{
MessageBox( NULL, TEXT("UnhookWindowsHookEx"), TEXT(""), MB_OK );
}
fpCallNextHook = (CALLNEXTHOOKEX) GetProcAddress( g_hDll, TEXT("CallNextHookEx") );
if( fpCallNextHook == NULL )
{
MessageBox( NULL, TEXT("CallNextHookEx"), TEXT(""), MB_OK );
}
g_hHook = fpSetWindowHookEx( WH_CBT, (HOOKPROC) CBTProc, g_hInstanceDll, 0 );
if( g_hHook == NULL )
{
err(( TEXT("fpSetWindowHookEx failed <%d>!"), GetLastError() ));
MessageBox( NULL, TEXT("fpSetWindowHookEx failed!"), TEXT(""), MB_OK );
return FALSE;
}
return TRUE;
}
Houser said:
So I have tried this and have written a Dll where I hook
the WH_CBT with SetWindowsHookExW.
I have loaded the function pointers from the coredll.dll with LoadLibrary()
which is ok. But when I call SetWindowsHookExW() in my hook Dll
theh I get always error 87 back.
This is my code in the hook dll to install the hook.
Any ideas what is wrong here?
Code:
BOOL __declspec(dllexport)__stdcall InstallHook()
{
log(( TEXT("InstallHook") ));
g_hDll = LoadLibrary( TEXT("\\windows\\coredll.dll") );
if( g_hDll == NULL )
{
err(( TEXT("LoadLibrary") ));
return FALSE;
}
fpSetWindowHookEx = (SETWINDOWHOOKEX) GetProcAddress( g_hDll, TEXT("SetWindowsHookExW") );
if( fpSetWindowHookEx == NULL )
{
MessageBox( NULL, TEXT("SetWindowsHookExW"), TEXT(""), MB_OK );
}
fpUnhook = (UNHOOKWINDOWHOOKEX) GetProcAddress( g_hDll, TEXT("UnhookWindowsHookEx") );
if( fpUnhook == NULL )
{
MessageBox( NULL, TEXT("UnhookWindowsHookEx"), TEXT(""), MB_OK );
}
fpCallNextHook = (CALLNEXTHOOKEX) GetProcAddress( g_hDll, TEXT("CallNextHookEx") );
if( fpCallNextHook == NULL )
{
MessageBox( NULL, TEXT("CallNextHookEx"), TEXT(""), MB_OK );
}
g_hHook = fpSetWindowHookEx( WH_CBT, (HOOKPROC) CBTProc, g_hInstanceDll, 0 );
if( g_hHook == NULL )
{
err(( TEXT("fpSetWindowHookEx failed <%d>!"), GetLastError() ));
MessageBox( NULL, TEXT("fpSetWindowHookEx failed!"), TEXT(""), MB_OK );
return FALSE;
}
return TRUE;
}
Click to expand...
Click to collapse
87 means invalid parameter:
I think I know why!
Here read this:
hMod
[in] Handle to the DLL containing the hook procedure pointed to by the lpfn parameter. The hMod parameter must be set to NULL if the dwThreadId parameter specifies a thread created by the current process and if the hook procedure is within the code associated with the current process.
dwThreadId
[in] Specifies the identifier of the thread with which the hook procedure is to be associated. If this parameter is zero, the hook procedure is associated with all existing threads running in the same desktop as the calling thread.
So I would change your call by this one:
Code:
g_hHook = fpSetWindowHookEx( WH_CBT, (HOOKPROC) CBTProc, NULL, ::GetCurrentThreadId() );
or
Code:
g_hHook = fpSetWindowHookEx( WH_CBT, (HOOKPROC) CBTProc, NULL, 0 );
Cheers,
.Fred
I have tries both suggestions from you, but always error 87.
Have tried this in a dll and in an exe but same error.
Here is my callback function code:
Code:
LRESULT __declspec(dllexport)__stdcall CALLBACK CBTProc( int nCode, WPARAM wParam, LPARAM lParam )
{
if( nCode == HCBT_CREATEWND )
{
log(( TEXT("----> Window created") ));
}
LRESULT RetVal = fpCallNextHook( g_hHook, nCode, wParam, lParam );
return RetVal;
}
Houser
Houser said:
I have tries both suggestions from you, but always error 87.
Have tried this in a dll and in an exe but same error.
Here is my callback function code:
Code:
LRESULT __declspec(dllexport)__stdcall CALLBACK CBTProc( int nCode, WPARAM wParam, LPARAM lParam )
{
if( nCode == HCBT_CREATEWND )
{
log(( TEXT("----> Window created") ));
}
LRESULT RetVal = fpCallNextHook( g_hHook, nCode, wParam, lParam );
return RetVal;
}
Houser
Click to expand...
Click to collapse
Why are you exporting the CALLBACK function ?
Thanks for your quick answers.
Hmm I have seen this in a desktop sample hook dll project
and have copied this.
Tried the dll without exporting the callback function but same error.
I am really confused what param is invalid.
Have defined this in my dll:
Code:
typedef LRESULT (CALLBACK* HOOKPROC)(int code, WPARAM wParam, LPARAM lParam);
#define WH_CBT 5
I think this is correct.
Have you ever calles SetWindowsHookExW() successfully on pocket pc?
Houser
Houser said:
Thanks for your quick answers.
Hmm I have seen this in a desktop sample hook dll project
and have copied this.
Tried the dll without exporting the callback function but same error.
I am really confused what param is invalid.
Have defined this in my dll:
Code:
typedef LRESULT (CALLBACK* HOOKPROC)(int code, WPARAM wParam, LPARAM lParam);
#define WH_CBT 5
I think this is correct.
Have you ever calles SetWindowsHookExW() successfully on pocket pc?
Houser
Click to expand...
Click to collapse
I didn't try yet. Let me test! Give some feedback in a few minutes...
Got it now.
The problem was the first param WH_CBT (5) which is not supported.
Have now taken 20 for a try and it works.
The question is now is WH_CBT not supported or is 5 the wrong ID.
I will check this in PB header files.
Houser
dotfred said:
I didn't try yet. Let me test! Give some feedback in a few minutes...
Click to expand...
Click to collapse
Well it doesn't work, and I took the declarations from PB5.
So my guess is it simply doesn't work under WM5. Because it works under WCE5.
I think a little bit of disassembling is required here!
Cheers,
.Fred
So you have tried it with Hook ID 5 under CE5 and NOT under
WM5 (Pocket PC)?
And under CE5 it works? :-(
I have get it with Hook ID 20 and the function call was ok.
Houser
Houser said:
So you have tried it with Hook ID 5 under CE5 and NOT under
WM5 (Pocket PC)?
And under CE5 it works? :-(
I have get it with Hook ID 20 and the function call was ok.
Houser
Click to expand...
Click to collapse
In fact, the only one I tested under WM5 is WH_KEYBOARD_LL (20) as you did!
I never tried the others because I never needed it!
And I never tested it under WINCE5 but I found some code of MFC controls classes implementation under PB5 like the CCommandBarCtrl that use the WH_CBT.

problem with injection DLL to specified process

Save me from madness!!!
I have a several smartphone devices with windows CE
CE 6.0 - hp IPAQ 500 series
CE 5.0 - Samsung i600
I need to inject DLL into the process "home.exe". I use method with performcallback4 function. This method works successfully for all processes ("device.exe", "service.exe", etc.) except process "home.exe". In what a problem?
source code : InjectDLL.exe link with toolhelp.lib
#include <windows.h>
#include <Tlhelp32.h>
typedef struct _CALLBACKINFO {
HANDLE hProc;
FARPROC pfn;
PVOID pvArg0;
} CALLBACKINFO;
extern "C"
{
DWORD PerformCallBack4(CALLBACKINFO *pcbi,...);
LPVOID MapPtrToProcess(LPVOID lpv, HANDLE hProc);
BOOL SetKMode(BOOL fMode);
DWORD SetProcPermissions(DWORD newperms);
};
DWORD GetProcessId(WCHAR *wszProcessName)
{
HANDLE hTH= CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
PROCESSENTRY32 pe;
pe.dwSize= sizeof(PROCESSENTRY32);
DWORD PID=0;
if (Process32First(hTH, &pe))
{
do {
if (wcsicmp(wszProcessName, pe.szExeFile)==0)
{
PID=pe.th32ProcessID;
}
} while (Process32Next(hTH, &pe));
}
CloseToolhelp32Snapshot(hTH);
return PID;
}
HMODULE GetDllHandle(DWORD ProcessId,WCHAR* ModuleName)
{
HANDLE ToolHelp=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,ProcessId);
if (ToolHelp!=INVALID_HANDLE_VALUE)
{
MODULEENTRY32 ModuleEntry={sizeof MODULEENTRY32};
if (Module32First(ToolHelp,&ModuleEntry))
do
{
if (wcsicmp(ModuleEntry.szModule, ModuleName)==0)
return ModuleEntry.hModule;
}
while(Module32Next(ToolHelp,&ModuleEntry));
CloseToolhelp32Snapshot(ToolHelp);
}
return NULL;
}
BOOL InjectDll(WCHAR* ProcessName,WCHAR* ModuleName)
{
DWORD ProcessId=GetProcessId(ProcessName);
HMODULE ModuleHandle=GetDllHandle(ProcessId,ModuleName);
if (ModuleHandle!=NULL)
return TRUE;
HANDLE Process=OpenProcess(0,0,ProcessId);
if (Process==NULL)
return FALSE;
void* ModuleNamePtr=MapPtrToProcess(ModuleName,GetCurrentProcess());
if (ModuleNamePtr==NULL)
return FALSE;
CALLBACKINFO ci;
ci.hProc=Process;
void* LoadLibraryPtr=MapPtrToProcess(GetProcAddress(GetModuleHandle(L"coredll.dll"),L"LoadLibraryW"),Process);
if (LoadLibraryPtr==NULL)
return FALSE;
ci.pfn=(FARPROC)LoadLibraryPtr;
ci.pvArg0=ModuleNamePtr;
PerformCallBack4(&ci); in this place process exit. visual studio output message : "process exit with code 0xc0000030"
Sleep(500);
CloseHandle(Process);
return GetDllHandle(ProcessId,ModuleName)!=NULL;
}
extern "C"
{
BOOL SetKMode(BOOL fMode);
DWORD SetProcPermissions(DWORD newperms);
};
#define DLLNAME L"MyDll.dll"
int WINAPI WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPWSTR lpCmdLine,int nShowCmd)
{
WCHAR Path[MAX_PATH];
GetModuleFileName(NULL,Path,MAX_PATH);
wcscpy(wcsrchr(Path,L'\\')+1,DLLNAME);
WCHAR NewPath[MAX_PATH]=L"\\Windows\\";
wcscat(NewPath,DLLNAME);
CopyFile(Path,NewPath,FALSE);
BOOL Res=InjectDll(L"home.exe",L"MyDll.dll");
return 0;
}
the error code is
#define STATUS_INVALID_PARAMETER_MIX 0xC0000030
(maybe too fast for getting the thread infos?)
try to make the "Sleep(500);" before "PerformCallBack4(&ci);"
I have tried, a problem not in it. Any ideas?
I have not found the reason.... I Use other method without performcallback4
Problem with injection dll to cprog.exe process?
I want to inject dll to cprog.exe process. but it doesn't work.
source code.
Code:
VOID
InjectDllToCprog()
{
WCHAR DllPath[MAX_PATH] = L"";
CallbackInfo ci;
GetModuleFileName(NULL, DllPath, MAX_PATH);
PWCHAR p = wcsrchr(DllPath, L'\\');
DllPath[p - DllPath] = '\0';
wcscat(DllPath, L"\\CprogInject.dll");
ZeroMemory(&ci, sizeof(ci));
g_hCprog = FindCprogProcess(L"Cprog.exe"); // the handle is right.
if(g_hCprog != NULL)
{
DWORD dwMode = SetKMode(TRUE);
DWORD dwPerm = SetProcPermissions(0xFFFFFFFF);
FARPROC pFunc = GetProcAddress(GetModuleHandle(L"Coredll.dll"), L"LoadLibraryW");
ci.ProcId = (HANDLE)g_hCprog;
ci.pFunc = (FARPROC)MapPtrToProcess(pFunc, g_hCprog);
ci.pvArg0 = MapPtrToProcess(DllPath, GetCurrentProcess());
g_InjectCprog = (HINSTANCE)PerformCallBack4(&ci, 0, 0, 0);
if(GetLastError() != 0) // GetLastError() = 5
DbgError(L"PerformCallBack 执行失败", GetLastError());
SetKMode(dwMode);
SetProcPermissions(dwPerm);
}
}
GetLastError() return 0x00000005(Access is denied)
Anyone can help me? Sorry for my poor english.

Categories

Resources