Skip to content

Commit 1d1e5ce

Browse files
hugsyhugsy
committed
Minor code formatting
1 parent 95f117d commit 1d1e5ce

File tree

3 files changed

+76
-103
lines changed

3 files changed

+76
-103
lines changed

‎Workspaces/LaunchAndExecute.debugTarget

+20-19
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,22 @@
1-
<?xml version="1.0" encoding="utf-8"?>
1+
<?xml version="1.0" encoding="utf-8"?>
22
<TargetConfig Name="C:\Windows\System32\notepad.exe" LastUsed="2022-07-14T23:44:46.0958299Z">
3-
<EngineConfig />
4-
<EngineOptions>
5-
<Property name="DebugChildProcesses" value="false" />
6-
</EngineOptions>
7-
<TargetOptions>
8-
<Option name="LaunchProcess">
9-
<Property name="Executable" value="C:\Windows\System32\notepad.exe" />
10-
<Property name="Arguments" value="" />
11-
</Option>
12-
<Option name="ExecuteCommand">
13-
<Property name="Command" value="bu 4242424242424242" />
14-
</Option>
15-
<Option name="RestoreCommandHistory">
16-
<Property name="History">
17-
<Property value="dx @$curprocess.Environment.EnvironmentBlock.ProcessParameters" />
18-
</Property>
19-
</Option>
20-
</TargetOptions>
3+
<EngineConfig />
4+
<EngineOptions>
5+
<Property name="DebugChildProcesses" value="false" />
6+
</EngineOptions>
7+
<TargetOptions>
8+
<Option name="LaunchProcess">
9+
<Property name="Executable" value="C:\Windows\System32\notepad.exe" />
10+
<Property name="Arguments" value="" />
11+
</Option>
12+
<Option name="ExecuteCommand">
13+
<Property name="Command" value="bu 4242424242424242" />
14+
</Option>
15+
<Option name="RestoreCommandHistory">
16+
<Property name="History">
17+
<Property value="bu 4242424242424242" />
18+
<Property value="dx @$curprocess.Environment.EnvironmentBlock.ProcessParameters" />
19+
</Property>
20+
</Option>
21+
</TargetOptions>
2122
</TargetConfig>

‎scripts/JsSkeleton.js

+2
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22
/// <reference path="../extra/JSProvider.d.ts" />
33
///
44
/// @ts-check
5+
/// @links
6+
/// - https://aka.ms/JsDbgExt
57
///
68
"use strict";
79

‎scripts/VadExplorer.js

+54-84
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
///
2-
/// <reference path="JSProvider.d.ts" />
2+
/// <reference path="../extra/JSProvider.d.ts" />
33
///
44
"use strict";
55

@@ -28,7 +28,7 @@ const PAGE_EXECUTE_READWRITE = 0x40;
2828
const PAGE_EXECUTE_WRITECOPY = 0x80;
2929
const PAGE_GUARD = 0x100;
3030
const PAGE_NOCACHE = 0x200;
31-
const PAGE_WRITECOMBINE = 0x400;
31+
const PAGE_WRITECOMBINE = 0x400;
3232

3333
var PERMISSIONS = {};
3434
PERMISSIONS[PAGE_EXECUTE] = "PAGE_EXECUTE";
@@ -64,46 +64,40 @@ VAD_TYPES[VadRotatePhysical] = "VadRotatePhysical";
6464
VAD_TYPES[VadLargePageSection] = "VadLargePageSection";
6565

6666

67-
function SizeAsHumanReadableString(size)
68-
{
67+
function SizeAsHumanReadableString(size) {
6968
let step = 1024;
70-
if(Math.abs(size) < step)
69+
if (Math.abs(size) < step)
7170
return `${size}B`;
7271

73-
let units = ['kB','MB','GB','TB','PB','EB','ZB','YB'];
72+
let units = ['kB', 'MB', 'GB', 'TB', 'PB', 'EB', 'ZB', 'YB'];
7473
let u = -1;
75-
do
76-
{
74+
do {
7775
size /= step;
7876
++u;
7977
}
80-
while(Math.abs(size) >= step && u < units.length - 1);
78+
while (Math.abs(size) >= step && u < units.length - 1);
8179
return `${size.toFixed(1)}${units[u]}`;
8280
}
8381

8482

85-
function MakeQword(hi, lo)
86-
{
83+
function MakeQword(hi, lo) {
8784
return hi.bitwiseShiftLeft(32).add(lo);
8885
}
8986

9087

91-
function AlignHexString(value)
92-
{
88+
function AlignHexString(value) {
9389
return value.toString(16).padStart(10, "0");
9490
}
9591

9692

9793
/**
9894
*
9995
*/
100-
class Vad
101-
{
96+
class Vad {
10297
/**
10398
*
10499
*/
105-
constructor(level, address, pMmProtectToValue)
106-
{
100+
constructor(level, address, pMmProtectToValue) {
107101
this.Level = level;
108102
this.Address = address;
109103
this.VadObject = host.createTypedObject(this.Address, "nt", "_MMVAD");
@@ -114,7 +108,7 @@ class Vad
114108
//
115109
this.__ProtectionIndex = this.VadObject.Core.u.VadFlags.Protection;
116110
this.__MmProtectToValue = pMmProtectToValue;
117-
this.__Protection = u32(this.__MmProtectToValue.add(4*this.__ProtectionIndex));
111+
this.__Protection = u32(this.__MmProtectToValue.add(4 * this.__ProtectionIndex));
118112

119113
//
120114
// The 3-bit is an index in VAD_TYPES (see MI_VAD_TYPES - https://www.nirsoft.net/kernel_struct/vista/MI_VAD_TYPE.html)
@@ -131,8 +125,7 @@ class Vad
131125
/**
132126
*
133127
*/
134-
get Protection()
135-
{
128+
get Protection() {
136129
var p = [];
137130
if (this.__Protection & PAGE_EXECUTE)
138131
p.push(PERMISSIONS[this.__Protection & PAGE_EXECUTE]);
@@ -163,67 +156,59 @@ class Vad
163156
/**
164157
*
165158
*/
166-
get VadType()
167-
{
159+
get VadType() {
168160
return VAD_TYPES[this.__VadType];
169161
}
170162

171163

172164
/**
173165
*
174166
*/
175-
get Filename()
176-
{
177-
if(this.__VadType == VadNone)
167+
get Filename() {
168+
if (this.__VadType == VadNone)
178169
return "";
179170

180-
try
181-
{
171+
try {
182172
let ControlArea = host.createTypedObject(this.VadObject.Subsection.ControlArea.address, "nt", "_CONTROL_AREA");
183173
let FileObjectAddress = ControlArea.FilePointer.Value.bitwiseAnd(-16);
184174
let FileObject = host.createTypedObject(FileObjectAddress, "nt", "_FILE_OBJECT");
185-
return host.memory.readWideString(FileObject.FileName.Buffer.address, FileObject.FileName.Length/2);
186-
}
187-
catch(e)
188-
{
189-
return "";
190-
}
175+
return host.memory.readWideString(FileObject.FileName.Buffer.address, FileObject.FileName.Length / 2);
176+
}
177+
catch (e) {
178+
return "";
179+
}
191180
}
192181

193182
/**
194183
*
195184
*/
196-
IsInRange(address)
197-
{
185+
IsInRange(address) {
198186
return (address.compareTo(this.VaStart) >= 0 && address.compareTo(this.VaEnd) < 0);
199187
}
200188

201189
/**
202190
*
203191
*/
204-
toString()
205-
{
192+
toString() {
206193
let txt = "VAD(";
207194
txt += `Address=${this.Address.toString(16)}, VpnStart=${AlignHexString(this.VpnStart)}, VpnEnd=${AlignHexString(this.VpnEnd)}`
208-
txt +=`, Protection=${this.Protection}, VadType=${this.VadType}`;
209-
txt +=`, Size=${SizeAsHumanReadableString(this.Size)}`;
195+
txt += `, Protection=${this.Protection}, VadType=${this.VadType}`;
196+
txt += `, Size=${SizeAsHumanReadableString(this.Size)}`;
210197

211-
if(this.Filename)
198+
if (this.Filename)
212199
txt += `, Filename=${this.Filename}`;
213200
txt += ")";
214201
return txt;
215202
}
216203
}
217204

218205

219-
class VadList
220-
{
206+
class VadList {
221207

222208
/**
223209
*
224210
*/
225-
constructor(process)
226-
{
211+
constructor(process) {
227212
this.__process = process;
228213
this.__entries_by_level = new Array();
229214
this.__pMmProtectToValue = host.getModuleSymbolAddress("nt", "MmProtectToValue");
@@ -233,12 +218,10 @@ class VadList
233218
/**
234219
* MaxLevel getter
235220
*/
236-
get MaxLevel()
237-
{
238-
let MaxLevel = 0;
221+
get MaxLevel() {
222+
let MaxLevel = 0;
239223

240-
for(let vad of this)
241-
{
224+
for (let vad of this) {
242225
if (vad.Level > MaxLevel)
243226
MaxLevel = vad.Level;
244227
}
@@ -250,25 +233,22 @@ class VadList
250233
/**
251234
* Average level getter
252235
*/
253-
get AverageLevel()
254-
{
255-
return this.__entries_by_level.indexOf(Math.max(...this.__entries_by_level) );
236+
get AverageLevel() {
237+
return this.__entries_by_level.indexOf(Math.max(...this.__entries_by_level));
256238
}
257239

258240

259241
/**
260242
* Process getter
261243
*/
262-
get Process()
263-
{
244+
get Process() {
264245
return this.__process;
265246
}
266247

267248
/**
268249
* Help
269250
*/
270-
get [Symbol.metadataDescriptor]()
271-
{
251+
get [Symbol.metadataDescriptor]() {
272252
return {
273253
Process:
274254
{
@@ -279,16 +259,15 @@ class VadList
279259
MaxLevel: {
280260
PreferShow: true,
281261
Help: "The maximum level of recursion for the process's VADs."
282-
},
262+
},
283263
};
284264
}
285265

286266

287267
/**
288268
*
289269
*/
290-
*[Symbol.iterator]()
291-
{
270+
*[Symbol.iterator]() {
292271
for (let vad of this.__Walk(0, this.__process.VadRoot.Root.address))
293272
yield vad;
294273
}
@@ -297,11 +276,10 @@ class VadList
297276
/**
298277
*
299278
*/
300-
*__Walk(level, VadAddress)
301-
{
279+
*__Walk(level, VadAddress) {
302280
var nodeObject = host.createTypedObject(VadAddress, "nt", "_RTL_BALANCED_NODE");
303281

304-
if( nodeObject.isNull || nodeObject.Left == undefined || nodeObject.Right == undefined)
282+
if (nodeObject.isNull || nodeObject.Left == undefined || nodeObject.Right == undefined)
305283
return;
306284

307285
if (this.__entries_by_level.length < level + 1)
@@ -311,11 +289,11 @@ class VadList
311289

312290
yield new Vad(level, VadAddress, this.__pMmProtectToValue);
313291

314-
if(nodeObject.Left)
315-
yield *this.__Walk(level+1, nodeObject.Left.address);
292+
if (nodeObject.Left)
293+
yield* this.__Walk(level + 1, nodeObject.Left.address);
316294

317-
if(nodeObject.Right)
318-
yield *this.__Walk(level+1, nodeObject.Right.address);
295+
if (nodeObject.Right)
296+
yield* this.__Walk(level + 1, nodeObject.Right.address);
319297
}
320298

321299
/**
@@ -324,30 +302,25 @@ class VadList
324302
* @param {host.Int64} virtualAddress An address to find in the process
325303
* @returns {Vad} If the function finds the VAD, it returns a Vad object, else it returns null
326304
*/
327-
LookupVad(virtualAddress)
328-
{
305+
LookupVad(virtualAddress) {
329306
var currentLevel = 0;
330307
var currentVadAddress = this.__process.VadRoot.Root.address;
331308

332-
while (currentVadAddress.compareTo(0) != 0)
333-
{
309+
while (currentVadAddress.compareTo(0) != 0) {
334310
var currentVad = new Vad(currentLevel, currentVadAddress, this.__pMmProtectToValue);
335311

336-
if (currentVad.IsInRange(virtualAddress))
337-
{
312+
if (currentVad.IsInRange(virtualAddress)) {
338313
return currentVad;
339314
}
340315

341316
currentLevel += 1;
342317

343318
var currentNodeObject = host.createTypedObject(currentVadAddress, "nt", "_RTL_BALANCED_NODE");
344319

345-
if (currentVad.VaStart.compareTo(virtualAddress) > 0)
346-
{
320+
if (currentVad.VaStart.compareTo(virtualAddress) > 0) {
347321
currentVadAddress = currentNodeObject.Left.address;
348-
}
349-
else
350-
{
322+
}
323+
else {
351324
currentVadAddress = currentNodeObject.Right.address;
352325
}
353326
}
@@ -360,10 +333,8 @@ class VadList
360333
/**
361334
*
362335
*/
363-
class ProcessVads
364-
{
365-
get Vads()
366-
{
336+
class ProcessVads {
337+
get Vads() {
367338
return new VadList(this);
368339
}
369340
}
@@ -372,12 +343,11 @@ class ProcessVads
372343
/**
373344
*
374345
*/
375-
function initializeScript()
376-
{
346+
function initializeScript() {
377347
//log("[+] Extending EPROCESS with Vads property...");
378348

379349
return [
380350
new host.apiVersionSupport(1, 3),
381-
new host.typeSignatureExtension(ProcessVads, "_EPROCESS"),
351+
new host.typeSignatureExtension(ProcessVads, "_EPROCESS"),
382352
];
383353
}

0 commit comments

Comments
 (0)