SpoofMSINFO32/util.cpp at main · shellster/SpoofMSINFO32 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
#include "util.h"

DWORD processID = -1;
HANDLE processHandle;

wchar_t* _get_msinfo32_path() {
    HMODULE hExe = GetModuleHandle(NULL);
	wchar_t system32[MAX_PATH] = { 0 };
	wchar_t * command = new wchar_t[MAX_PATH * 2 + 100];
    wchar_t* fullPath = new wchar_t[MAX_PATH];
    GetModuleFileName(hExe, fullPath, MAX_PATH);
    PathRemoveFileSpec(fullPath);


	GetSystemDirectoryW(system32, MAX_PATH);

    lstrcpyW(command, L"\"");
    lstrcatW(command, system32);
	lstrcatW(command, L"\\msinfo32.exe\" \"");
    lstrcatW(command, fullPath);
    lstrcatW(command, L"\\msinfo32.nfo\"");

	return command;
}

bool _startswith(const char* str, const char* prefix)
{
    if (strlen(prefix) > strlen(str))
        return false;

    while (*prefix)
    {
        if (*prefix != *str)
            return false;

        prefix++;
        str++;
    }

    return true;
}

bool _fixText(HANDLE process, HWND hwnd) {
    bool success = false;

    HWND hwndTree = FindWindowExA(hwnd, NULL, "SysTreeView32", NULL);

    HTREEITEM hitem = TreeView_GetSelection(hwndTree);
    if (!hitem)
        return success;

    const int buflen = 1024;

    TVITEMEXA* ptv = (TVITEMEXA*)VirtualAllocEx(process, NULL, sizeof(TVITEMEXA), MEM_COMMIT, PAGE_READWRITE);
    char* pbuf = (char*)VirtualAllocEx(process, NULL, buflen, MEM_COMMIT, PAGE_READWRITE);

    TVITEMEXA tv = { 0 };
    tv.hItem = hitem;
    tv.cchTextMax = buflen;
    tv.pszText = pbuf;
    tv.mask = TVIF_TEXT | TVIF_HANDLE;

    WriteProcessMemory(process, ptv, &tv, sizeof(TVITEMEXA), NULL);

    if (SendMessageW(hwndTree, TVM_GETITEMA, 0, (LPARAM)(TVITEMEXA*)(ptv)))
    {
        char buf[buflen];
        ReadProcessMemory(process, pbuf, buf, buflen, 0);

        const char* replacement = "System Summary";

        if (_startswith(buf, replacement)) {
            WriteProcessMemory(process, pbuf, replacement, strlen(replacement) + 1, NULL);
            SendMessageW(hwndTree, TVM_SETITEMA, 0, (LPARAM)(TVITEMEXA*)(ptv));

            success = true;
        }
    }

    VirtualFreeEx(process, ptv, 0, MEM_RELEASE);
    VirtualFreeEx(process, pbuf, 0, MEM_RELEASE);
    CloseHandle(process);

    return success;
}

BOOL CALLBACK _searchForProc(HWND hWnd, LPARAM lParam) {
    DWORD pid = 0;
    GetWindowThreadProcessId(hWnd, &pid);

    if (pid == processID)
        _fixText(processHandle, hWnd);

    return true;
}

int startMSInfo32andFixText() {
    STARTUPINFO si = { sizeof si };
    PROCESS_INFORMATION pi = { 0 };

    wchar_t* exe_path = _get_msinfo32_path();

    if (!CreateProcess(NULL, exe_path, NULL, NULL, FALSE, CREATE_SUSPENDED | DEBUG_PROCESS, NULL, NULL, &si, &pi)) {
        return 1;
    }

    delete exe_path;

    processID = pi.dwProcessId;
    processHandle = pi.hProcess;

    //Resume Process
    if (ResumeThread(pi.hThread) == -1) {
        return 2;
    }

    //Stop Debugging Process
    DebugActiveProcessStop(pi.dwProcessId);

    //Wait for process to have time to create a window
    Sleep(250);

    //Search for MSINFO32 Window and edit label
    EnumWindows(_searchForProc, NULL);

    Sleep(3000);

    // Cleanup.
    CloseHandle(pi.hProcess);

    return 0;
}