Add files via upload

Author: libalpm64

CMakeLists.txt

@@ -0,0 +1,13 @@
+cmake_minimum_required(VERSION 3.10)
+project(CodecaveDumper)
+
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+
+include_directories(include)
+
+add_executable(codecave_dumper
+    main.cpp
+    codecave_dumper.cpp
+    codecave_dumper_cli.cpp
+)

codecave_dumper.cpp

@@ -0,0 +1,123 @@
+#include "codecave_dumper.h"
+#include <iostream>
+#include <fstream>
+#include <regex>
+#include <algorithm>
+
+const DWORD CodecaveDumper::READABLE_PROTECTIONS[] = {
+    MEM_PAGE_READONLY,
+    MEM_PAGE_READWRITE, 
+    MEM_PAGE_WRITECOPY,
+    MEM_PAGE_EXECUTE_READ,
+    MEM_PAGE_EXECUTE_READWRITE
+};
+
+HANDLE CodecaveDumper::getHandle(DWORD pid) {
+    return OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
+}
+
+std::vector<char> CodecaveDumper::readMemory(HANDLE handle, LPVOID address, SIZE_T size) {
+    std::vector<char> buffer(size);
+    SIZE_T bytesRead;
+    
+    if (!ReadProcessMemory(handle, address, buffer.data(), size, &bytesRead)) {
+        throw std::runtime_error("Failed to read process memory");
+    }
+    
+    buffer.resize(bytesRead);
+    return buffer;
+}
+
+bool CodecaveDumper::isReadable(DWORD protect) {
+    const size_t size = sizeof(READABLE_PROTECTIONS) / sizeof(READABLE_PROTECTIONS[0]);
+    return std::find(READABLE_PROTECTIONS, 
+                    READABLE_PROTECTIONS + size,
+                    protect) != READABLE_PROTECTIONS + size;
+}
+
+std::vector<std::string> CodecaveDumper::extractData(const std::vector<char>& data, size_t minLength) {
+    static const auto junkPattern = std::regex(R"(^[0-9A-F]+$|^[A-Z]{1,3}\d+$|^\W+$|^.{1,3}$|(.)\1{3,})", 
+                                             std::regex::optimize);
+    
+    std::vector<std::string> strings;
+    strings.reserve(1000);
+    
+    constexpr size_t CHUNK_SIZE = 4096;
+    std::string current;
+    current.reserve(256);
+
+    for (size_t i = 0; i < data.size(); i += CHUNK_SIZE) {
+        const size_t chunk_end = (i + CHUNK_SIZE < data.size()) ? i + CHUNK_SIZE : data.size();
+        for (char byte : data) {
+            if (isprint(byte)) {
+                current += byte;
+            } else if (!current.empty()) {
+                if (current.length() >= minLength && 
+                    !std::regex_match(current, junkPattern) &&
+                    std::any_of(current.begin(), current.end(), ::isalnum)) {
+                    strings.push_back(std::move(current));
+                }
+                current.clear();
+                current.reserve(256);
+            }
+        }
+    }
+
+    if (current.length() >= minLength && 
+        !std::regex_match(current, junkPattern) &&
+        std::any_of(current.begin(), current.end(), ::isalnum)) {
+        strings.push_back(std::move(current));
+    }
+
+    return strings;
+}
+
+void CodecaveDumper::dump(DWORD pid) {
+    try {
+        HANDLE handle = getHandle(pid);
+        if (handle == NULL) {
+            throw std::runtime_error("Failed to open process");
+        }
+
+        std::cout << "\nStarting codecave dump for PID: " << pid << std::endl;
+
+        std::string outputFile = std::to_string(pid) + "_dump.txt";
+        LPVOID address = nullptr;
+        MEMORY_BASIC_INFORMATION memInfo;
+        std::set<std::string> uniqueStrings;
+        size_t regionsAnalyzed = 0;
+        size_t totalRegions = 0;
+
+        while (VirtualQueryEx(handle, address, &memInfo, sizeof(memInfo))) {
+            totalRegions++;
+            if (isReadable(memInfo.Protect)) {
+                try {
+                    auto chunk = readMemory(handle, memInfo.BaseAddress, memInfo.RegionSize);
+                    auto strings = extractData(chunk);
+                    uniqueStrings.insert(std::make_move_iterator(strings.begin()), 
+                                       std::make_move_iterator(strings.end()));
+                    regionsAnalyzed++;
+                }
+                catch (const std::exception&) {
+                    // Skip failed regions
+                }
+            }
+            address = (LPVOID)((DWORD_PTR)memInfo.BaseAddress + memInfo.RegionSize);
+        }
+
+        std::ofstream outFile(outputFile, std::ios::binary);
+        for (const auto& str : uniqueStrings) {
+            outFile << str << '\n';
+        }
+
+        std::cout << "\nDump complete!" << std::endl;
+        std::cout << "Analyzed " << regionsAnalyzed << "/" << totalRegions << " regions" << std::endl;
+        std::cout << "Found " << uniqueStrings.size() << " unique strings" << std::endl;
+        std::cout << "Results saved to: " << outputFile << std::endl;
+
+        CloseHandle(handle);
+    }
+    catch (const std::exception& e) {
+        std::cerr << "Error: " << e.what() << std::endl;
+    }
+}

codecave_dumper_cli.cpp

@@ -0,0 +1,60 @@
+#include "codecave_dumper_cli.h"
+#include <iostream>
+#include <tlhelp32.h>
+
+void CodecaveDumperCLI::listProcesses() {
+    HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+    if (snapshot == INVALID_HANDLE_VALUE) return;
+
+    PROCESSENTRY32W pe32;
+    pe32.dwSize = sizeof(pe32);
+
+    std::cout << "\nAvailable Python processes:" << std::endl;
+    if (Process32FirstW(snapshot, &pe32)) {
+        do {
+            std::wstring processName = pe32.szExeFile;
+            if (processName.find(L"python") != std::wstring::npos) {
+                std::wcout << pe32.th32ProcessID << L"\t" << processName << std::endl;
+            }
+        } while (Process32NextW(snapshot, &pe32));
+    }
+
+    CloseHandle(snapshot);
+}
+
+void CodecaveDumperCLI::run() {
+    while (true) {
+        std::cout << "Codecave Hook By Libalpm Program Dumper" << std::endl;
+        std::cout << "\nMenu Options:" << std::endl;
+        std::cout << "1. List Python Processes" << std::endl;
+        std::cout << "2. Dump Process Memory" << std::endl;
+        std::cout << "3. Exit" << std::endl;
+
+        std::string choice;
+        std::cout << "\nEnter your choice (1-3): ";
+        std::getline(std::cin, choice);
+
+        if (choice == "1") {
+            listProcesses();
+        }
+        else if (choice == "2") {
+            std::cout << "Enter PID to dump: ";
+            std::string pidStr;
+            std::getline(std::cin, pidStr);
+            try {
+                DWORD pid = std::stoul(pidStr);
+                dumper.dump(pid);
+            }
+            catch (const std::exception&) {
+                std::cerr << "Error: Please enter a valid PID" << std::endl;
+            }
+        }
+        else if (choice == "3") {
+            std::cout << "\nGoodbye!" << std::endl;
+            break;
+        }
+        else {
+            std::cout << "Invalid choice. Please try again." << std::endl;
+        }
+    }
+}

include/codecave_dumper.h

@@ -0,0 +1,24 @@
+#pragma once
+#include <windows.h>
+#include <string>
+#include <vector>
+#include <set>
+
+// Pyarmors constants
+#define MEM_PAGE_READONLY           0x02
+#define MEM_PAGE_READWRITE         0x04
+#define MEM_PAGE_WRITECOPY         0x08
+#define MEM_PAGE_EXECUTE_READ      0x20
+#define MEM_PAGE_EXECUTE_READWRITE 0x40
+
+class CodecaveDumper {
+private:
+    static const DWORD READABLE_PROTECTIONS[];
+    HANDLE getHandle(DWORD pid);
+    std::vector<char> readMemory(HANDLE handle, LPVOID address, SIZE_T size);
+    bool isReadable(DWORD protect);
+    std::vector<std::string> extractData(const std::vector<char>& data, size_t minLength = 4);
+
+public:
+    void dump(DWORD pid);
+};

include/codecave_dumper_cli.h

@@ -0,0 +1,11 @@
+#pragma once
+#include "codecave_dumper.h"
+
+class CodecaveDumperCLI {
+private:
+    CodecaveDumper dumper;
+    void listProcesses();
+
+public:
+    void run();
+};

main.cpp

@@ -0,0 +1,7 @@
+#include "codecave_dumper_cli.h"
+
+int main() {
+    CodecaveDumperCLI cli;
+    cli.run();
+    return 0;
+}