CLEAR
*------ Determina la longitud de un puntero, sin el caracter null de finalización
DECLARE LONG lstrlenA IN Kernel32 AS GetStrLenA;
LONG lpString
DECLARE LONG lstrlenW IN Kernel32 AS GetStrLenW;
LONG lpString
*------ CyptoAPI
DECLARE LONG CryptEnumOIDInfo IN Crypt32;
LONG dwGroupId,;
LONG dwFlags,;
LONG @pvArg,;
LONG pfnEnumOIDInfo
oCallBack = CREATEOBJECT("EnumOIDInfoCallback")
PUBLIC nItem
nItem = 0
dwGroupId = 0
dwFlags = 0
pvArg = 0
pfnEnumOIDInfo = oCallBack.ProcAddress
nResp = CryptEnumOIDInfo(dwGroupId, dwFlags, @pvArg, pfnEnumOIDInfo)
? nResp
? nItem
DEFINE CLASS EnumOIDInfoCallback AS Callback
PROCEDURE Init()
*----- La función PFN_CRYPT_ENUM_OID_INFO, tiene 2 parametros, pInfo y pvArg, de 4 bytes cada uno, 4x2=8
RETURN DODEFAULT(8)
ENDPROC
PROCEDURE Callback()
LPARAMETERS sParams AS String
LOCAL pInfo AS Long, pvArg AS Long
pInfo = CTOBIN(SUBSTR(sParams,1,4), "4RS")
pvArg = CTOBIN(SUBSTR(sParams,5,4), "4RS")
nItem = nItem + 1
IF pInfo>0
*----- El puntero pInfo tiene una longitud de 36 bytes
cOidVal = SYS(2600, pInfo, 36)
cbSize = CTOBIN(SUBSTR(cOidVal, 1, 4), "4RS")
pszOID = CTOBIN(SUBSTR(cOidVal, 5, 4), "4RS")
pwszName = CTOBIN(SUBSTR(cOidVal, 9, 4), "4RS")
dwGroupId = CTOBIN(SUBSTR(cOidVal, 13, 4), "4RS")
bUnion1 = CTOBIN(SUBSTR(cOidVal, 17, 4), "4RS")
bUnion2 = CTOBIN(SUBSTR(cOidVal, 21, 4), "4RS")
pExtraInfo = CTOBIN(SUBSTR(cOidVal, 25, 4), "4RS")
pwszCNGAlgid = CTOBIN(SUBSTR(cOidVal, 29, 4), "4RS")
pwszCNGExtraAlgid = CTOBIN(SUBSTR(cOidVal, 33, 4), "4RS")
nwszCNGExtraAlgid = GetStrLenW(pwszCNGExtraAlgid)
lcOID = SYS(2600, pszOID, GetStrLenA(pszOID))
lcName = STRCONV(SYS(2600, pwszName, GetStrLenW(pwszName)*2),6)
cExtraInfo = STRCONV(SYS(2600, pExtraInfo, GetStrLenW(pExtraInfo)*2),15)
cCNGAlgID = STRCONV(SYS(2600, pwszCNGAlgid, GetStrLenW(pwszCNGAlgid)*2),6)
cCNGExtraAlgid = STRCONV(SYS(2600, pwszCNGExtraAlgid, GetStrLenW(pwszCNGExtraAlgid)*2),6)
ACTIVATE SCREEN
? lcOID, lcName, cExtraInfo, cCNGAlgID, cCNGExtraAlgid
ENDIF
RETURN 1
ENDPROC
ENDDEFINE
DEFINE CLASS Callback AS Custom
ProcAddress = 0
hHeap = 0
hWindows = _SCREEN.HWnd
#DEFINE WM_USERCALLBACK 0x400+700
#DEFINE HEAP_CREATE_ENABLE_EXECUTE 0x00040000
#DEFINE HEAP_GENERATE_EXCEPTIONS 0x00000004
PROCEDURE Init()
LPARAMETERS tnParamSize AS Long
THIS.SetDeclarationsAPI()
IF VARTYPE(tnParamSize)#"N"
tnParamSize = 0
ENDIF
LOCAL pfnSendMessage, hModule
hModule = GetModuleHandleA("user32.dll")
pfnSendMessage = GetProcAddress(hModule, "SendMessageA")
*----- Armamos una cadena binaria
LOCAL sCode
sCode = 0h + CHR(0x55) && push ebp
sCode = sCode + CHR(0x89) + CHR(0xE5) && mov ebp, esp
*----- Lectura de datos para la cadena
IF tnParamSize=0
sCode = sCode + CHR(0x68) + BINTOC(0,"4RS") && push 0 : lParam - ptr to params
ELSE
sCode = sCode + CHR(0x89) + CHR(0xE8) && mov eax, ebp
sCode = sCode + CHR(0x83) + CHR(0xC0) + CHR(0x08) && add eax,8
sCode = sCode + CHR(0x50) && push eax : lParam - ptr to params
ENDIF
*----- Agregamos parámetos a la cadena
sCode = sCode + CHR(0x68) + BINTOC(tnParamSize, "4RS") && push wParam - param size
sCode = sCode + CHR(0x68) + BINTOC(WM_USERCALLBACK, "4RS") && push nMsg
sCode = sCode + CHR(0x68) + BINTOC(THIS.hWindows, "4RS") && push hWnd
*----- Agregamos el mensaje a enviar
sCode = sCode + CHR(0xB8) + BINTOC(pfnSendMessage, "4RS") && move eax, procSendMessage
sCode = sCode + CHR(0xFF) + CHR(0xD0) && call eax
*----- Región de respuesta
sCode = sCode + CHR(0xC9) && leave
IF tnParamSize = 0
sCode = sCode + CHR(0xC3) && ret
ELSE
sCode = sCode + CHR(0xC2) + BINTOC(tnParamSize, "2RS") && ret tnParamSize
ENDIF
*----- Creamos una pila de memoria, del tamaño de un cluster.
THIS.hHeap = HeapCreate(HEAP_CREATE_ENABLE_EXECUTE, 0, 4096)
THIS.ProcAddress = HeapAlloc(THIS.hHeap, HEAP_GENERATE_EXCEPTIONS, LEN(sCode))
*----- Cargamos la cadena binaria en el puntero de memoria
RtlMoveMemory(THIS.ProcAddress, sCode, LEN(sCode))
BINDEVENT(THIS.hWindows, WM_USERCALLBACK, THIS, "CallbackEvent")
ENDPROC
PROCEDURE CallbackEvent()
LPARAMETERS hWnd, uMsg, wParam, lParam
LOCAL sParamData
IF wParam>0
sParamData = SYS(2600, lParam, wParam)
ELSE
sParamData = ""
ENDIF
RETURN THIS.Callback(sParamData)
ENDPROC
PROCEDURE Callback()
LPARAMETERS sParamData
ENDPROC
PROCEDURE SetDeclarationsAPI()
DECLARE LONG GetModuleHandleA IN Kernel32;
STRING lpModuleName
DECLARE LONG GetProcAddress IN Kernel32;
LONG hModule,;
STRING procname
DECLARE LONG HeapAlloc IN Kernel32;
LONG hHeap,;
LONG dwFlags,;
LONG dwBytes
DECLARE LONG HeapCreate IN Kernel32;
LONG dwFlags,;
LONG dwBytes,;
LONG dwMaxBytes
DECLARE LONG HeapDestroy IN Kernel32;
LONG hHeap
DECLARE RtlMoveMemory IN Kernel32;
LONG Destination,;
STRING @Source,;
LONG Length
ENDPROC
PROCEDURE Destroy()
UNBINDEVENTS(THIS)
TRY
HeapFree(GetProcessHeap(), 0, THIS.ProcAddress)
CATCH TO oError
cMensaje = oError.Message
ENDTRY
ENDPROC
ENDDEFINE