OSDN -- 오픈 소스 소프트웨어 개발 및 다운로드
Translation Status of 한국말 translation status for ko
  • R/O
  • HTTP
  • SSH
  • HTTPS
Fork

Commit

Tags
No Tags

Frequently used words (click to add to your profile)

javac++androidlinuxc#windowsobjective-ccocoa誰得qtpythonphprubygameguibathyscaphec計画中(planning stage)翻訳omegatframeworktwitterdomtestvb.netdirectxゲームエンジンbtronarduinopreviewer

FFFTPのソースコードです。


Commit MetaInfo

Revisionc30cc851b60a7c4006cd02b4718d9738a6c4049a (tree)
Time2011-10-03 23:17:55
Authors_kawamoto <s_kawamoto@user...>
Commiters_kawamoto

Log Message

Fix bugs process protection.
Add support for process protection on Vista/7.
Fix bugs of UTF-8 to UTF-16 API bridge.
Fix inconsistent WINVER, _WIN32_WINNT and _WIN32_IE.

Change Summary

Incremental Difference

--- a/FFFTP.vc90.vcproj
+++ b/FFFTP.vc90.vcproj
@@ -47,7 +47,7 @@
4747 Name="VCCLCompilerTool"
4848 Optimization="0"
4949 AdditionalIncludeDirectories="Resource"
50- PreprocessorDefinitions="WIN32,_DEBUG,_WINDOWS,_WIN32_IE=0x300,_CRT_SECURE_NO_WARNINGS"
50+ PreprocessorDefinitions="WIN32,_DEBUG,_WINDOWS,WINVER=0x0500,_WIN32_WINNT=0x0500,_WIN32_IE=0x0400,_CRT_SECURE_NO_WARNINGS"
5151 RuntimeLibrary="1"
5252 PrecompiledHeaderFile=".\Debug\FFFTP.pch"
5353 AssemblerListingLocation=".\Debug\"
@@ -71,12 +71,12 @@
7171 <Tool
7272 Name="VCLinkerTool"
7373 AdditionalOptions="/MACHINE:I386"
74- AdditionalDependencies="wsock32.lib comctl32.lib winmm.lib rasapi32.lib htmlhelp.lib sfc.lib wintrust.lib"
74+ AdditionalDependencies="comctl32.lib htmlhelp.lib imagehlp.lib rasapi32.lib sfc.lib winmm.lib wintrust.lib wsock32.lib"
7575 OutputFile=".\Debug\FFFTP.exe"
7676 LinkIncremental="2"
7777 SuppressStartupBanner="true"
7878 GenerateManifest="false"
79- DelayLoadDLLs="advapi32.dll;comctl32.dll;comdlg32.dll;gdi32.dll;sfc.dll;shell32.dll;ole32.dll;user32.dll;winmm.dll;wintrust.dll;wsock32.dll"
79+ DelayLoadDLLs="advapi32.dll;comctl32.dll;comdlg32.dll;gdi32.dll;imagehlp.dll;ole32.dll;sfc.dll;shell32.dll;user32.dll;winmm.dll;wintrust.dll;wsock32.dll"
8080 GenerateDebugInformation="true"
8181 ProgramDatabaseFile=".\Debug\FFFTP.pdb"
8282 SubSystem="2"
@@ -138,7 +138,7 @@
138138 Name="VCCLCompilerTool"
139139 InlineFunctionExpansion="1"
140140 AdditionalIncludeDirectories="Resource"
141- PreprocessorDefinitions="WIN32,NDEBUG,_WINDOWS,_WIN32_IE=0x300,_CRT_SECURE_NO_WARNINGS"
141+ PreprocessorDefinitions="WIN32,NDEBUG,_WINDOWS,WINVER=0x0500,_WIN32_WINNT=0x0500,_WIN32_IE=0x0400,_CRT_SECURE_NO_WARNINGS"
142142 StringPooling="true"
143143 RuntimeLibrary="0"
144144 EnableFunctionLevelLinking="true"
@@ -164,7 +164,7 @@
164164 <Tool
165165 Name="VCLinkerTool"
166166 AdditionalOptions="/MACHINE:I386"
167- AdditionalDependencies="wsock32.lib comctl32.lib winmm.lib rasapi32.lib htmlhelp.lib sfc.lib wintrust.lib"
167+ AdditionalDependencies="comctl32.lib htmlhelp.lib imagehlp.lib rasapi32.lib sfc.lib winmm.lib wintrust.lib wsock32.lib"
168168 OutputFile=".\Release\FFFTP.exe"
169169 LinkIncremental="1"
170170 SuppressStartupBanner="true"
--- a/FFFTP.vcproj
+++ b/FFFTP.vcproj
@@ -46,7 +46,7 @@
4646 Name="VCCLCompilerTool"
4747 Optimization="0"
4848 AdditionalIncludeDirectories="Resource"
49- PreprocessorDefinitions="WIN32,_DEBUG,_WINDOWS,_WIN32_IE=0x300,_CRT_SECURE_NO_WARNINGS"
49+ PreprocessorDefinitions="WIN32,_DEBUG,_WINDOWS,WINVER=0x0500,_WIN32_WINNT=0x0500,_WIN32_IE=0x0400,_CRT_SECURE_NO_WARNINGS"
5050 RuntimeLibrary="1"
5151 PrecompiledHeaderFile=".\Debug\FFFTP.pch"
5252 AssemblerListingLocation=".\Debug\"
@@ -70,7 +70,7 @@
7070 <Tool
7171 Name="VCLinkerTool"
7272 AdditionalOptions="/MACHINE:I386"
73- AdditionalDependencies="wsock32.lib comctl32.lib winmm.lib rasapi32.lib htmlhelp.lib sfc.lib wintrust.lib"
73+ AdditionalDependencies="comctl32.lib htmlhelp.lib imagehlp.lib rasapi32.lib sfc.lib winmm.lib wintrust.lib wsock32.lib"
7474 OutputFile=".\Debug\FFFTP.exe"
7575 LinkIncremental="2"
7676 SuppressStartupBanner="true"
@@ -138,7 +138,7 @@
138138 Name="VCCLCompilerTool"
139139 InlineFunctionExpansion="1"
140140 AdditionalIncludeDirectories="Resource"
141- PreprocessorDefinitions="WIN32,NDEBUG,_WINDOWS,_WIN32_IE=0x300,_CRT_SECURE_NO_WARNINGS"
141+ PreprocessorDefinitions="WIN32,NDEBUG,_WINDOWS,WINVER=0x0500,_WIN32_WINNT=0x0500,_WIN32_IE=0x0400,_CRT_SECURE_NO_WARNINGS"
142142 StringPooling="true"
143143 RuntimeLibrary="0"
144144 EnableFunctionLevelLinking="true"
@@ -164,7 +164,7 @@
164164 <Tool
165165 Name="VCLinkerTool"
166166 AdditionalOptions="/MACHINE:I386"
167- AdditionalDependencies="wsock32.lib comctl32.lib winmm.lib rasapi32.lib htmlhelp.lib sfc.lib wintrust.lib"
167+ AdditionalDependencies="comctl32.lib htmlhelp.lib imagehlp.lib rasapi32.lib sfc.lib winmm.lib wintrust.lib wsock32.lib"
168168 OutputFile=".\Release\FFFTP.exe"
169169 LinkIncremental="1"
170170 SuppressStartupBanner="true"
Binary files a/FFFTP_Eng_Release/FFFTP.exe and b/FFFTP_Eng_Release/FFFTP.exe differ
--- a/FFFTP_English.vc90.vcproj
+++ b/FFFTP_English.vc90.vcproj
@@ -48,7 +48,7 @@
4848 Name="VCCLCompilerTool"
4949 Optimization="0"
5050 AdditionalIncludeDirectories="Resource_eng"
51- PreprocessorDefinitions="WIN32,_DEBUG,_WINDOWS,_WIN32_IE=0x300,_CRT_SECURE_NO_WARNINGS,ENGLISH"
51+ PreprocessorDefinitions="WIN32,_DEBUG,_WINDOWS,WINVER=0x0500,_WIN32_WINNT=0x0500,_WIN32_IE=0x0400,_CRT_SECURE_NO_WARNINGS,ENGLISH"
5252 BasicRuntimeChecks="3"
5353 RuntimeLibrary="1"
5454 PrecompiledHeaderFile=".\FFFTP_Eng_Debug\FFFTP_English.pch"
@@ -73,7 +73,7 @@
7373 <Tool
7474 Name="VCLinkerTool"
7575 AdditionalOptions="/MACHINE:I386"
76- AdditionalDependencies="wsock32.lib comctl32.lib winmm.lib rasapi32.lib htmlhelp.lib sfc.lib wintrust.lib"
76+ AdditionalDependencies="comctl32.lib htmlhelp.lib imagehlp.lib rasapi32.lib sfc.lib winmm.lib wintrust.lib wsock32.lib"
7777 OutputFile=".\FFFTP_Eng_Debug\FFFTP.exe"
7878 LinkIncremental="2"
7979 SuppressStartupBanner="true"
@@ -140,7 +140,7 @@
140140 Name="VCCLCompilerTool"
141141 InlineFunctionExpansion="1"
142142 AdditionalIncludeDirectories="Resource_eng"
143- PreprocessorDefinitions="WIN32,NDEBUG,_WINDOWS,_WIN32_IE=0x300,_CRT_SECURE_NO_WARNINGS,ENGLISH"
143+ PreprocessorDefinitions="WIN32,NDEBUG,_WINDOWS,WINVER=0x0500,_WIN32_WINNT=0x0500,_WIN32_IE=0x0400,_CRT_SECURE_NO_WARNINGS,ENGLISH"
144144 StringPooling="true"
145145 RuntimeLibrary="0"
146146 EnableFunctionLevelLinking="true"
@@ -165,7 +165,7 @@
165165 <Tool
166166 Name="VCLinkerTool"
167167 AdditionalOptions="/MACHINE:I386"
168- AdditionalDependencies="wsock32.lib comctl32.lib winmm.lib rasapi32.lib htmlhelp.lib sfc.lib wintrust.lib"
168+ AdditionalDependencies="comctl32.lib htmlhelp.lib imagehlp.lib rasapi32.lib sfc.lib winmm.lib wintrust.lib wsock32.lib"
169169 OutputFile=".\FFFTP_Eng_Release\FFFTP.exe"
170170 LinkIncremental="1"
171171 SuppressStartupBanner="true"
--- a/FFFTP_English.vcproj
+++ b/FFFTP_English.vcproj
@@ -47,7 +47,7 @@
4747 Name="VCCLCompilerTool"
4848 Optimization="0"
4949 AdditionalIncludeDirectories="Resource_eng"
50- PreprocessorDefinitions="WIN32,_DEBUG,_WINDOWS,_WIN32_IE=0x300,_CRT_SECURE_NO_WARNINGS,ENGLISH"
50+ PreprocessorDefinitions="WIN32,_DEBUG,_WINDOWS,WINVER=0x0500,_WIN32_WINNT=0x0500,_WIN32_IE=0x0400,_CRT_SECURE_NO_WARNINGS,ENGLISH"
5151 BasicRuntimeChecks="3"
5252 RuntimeLibrary="1"
5353 PrecompiledHeaderFile=".\FFFTP_Eng_Debug\FFFTP_English.pch"
@@ -72,7 +72,7 @@
7272 <Tool
7373 Name="VCLinkerTool"
7474 AdditionalOptions="/MACHINE:I386"
75- AdditionalDependencies="wsock32.lib comctl32.lib winmm.lib rasapi32.lib htmlhelp.lib sfc.lib wintrust.lib"
75+ AdditionalDependencies="comctl32.lib htmlhelp.lib imagehlp.lib rasapi32.lib sfc.lib winmm.lib wintrust.lib wsock32.lib"
7676 OutputFile=".\FFFTP_Eng_Debug\FFFTP.exe"
7777 LinkIncremental="2"
7878 SuppressStartupBanner="true"
@@ -140,7 +140,7 @@
140140 Name="VCCLCompilerTool"
141141 InlineFunctionExpansion="1"
142142 AdditionalIncludeDirectories="Resource_eng"
143- PreprocessorDefinitions="WIN32,NDEBUG,_WINDOWS,_WIN32_IE=0x300,_CRT_SECURE_NO_WARNINGS,ENGLISH"
143+ PreprocessorDefinitions="WIN32,NDEBUG,_WINDOWS,WINVER=0x0500,_WIN32_WINNT=0x0500,_WIN32_IE=0x0400,_CRT_SECURE_NO_WARNINGS,ENGLISH"
144144 StringPooling="true"
145145 RuntimeLibrary="0"
146146 EnableFunctionLevelLinking="true"
@@ -165,7 +165,7 @@
165165 <Tool
166166 Name="VCLinkerTool"
167167 AdditionalOptions="/MACHINE:I386"
168- AdditionalDependencies="wsock32.lib comctl32.lib winmm.lib rasapi32.lib htmlhelp.lib sfc.lib wintrust.lib"
168+ AdditionalDependencies="comctl32.lib htmlhelp.lib imagehlp.lib rasapi32.lib sfc.lib winmm.lib wintrust.lib wsock32.lib"
169169 OutputFile=".\FFFTP_Eng_Release\FFFTP.exe"
170170 LinkIncremental="1"
171171 SuppressStartupBanner="true"
Binary files a/Release/FFFTP.exe and b/Release/FFFTP.exe differ
--- a/bookmark.c
+++ b/bookmark.c
@@ -27,7 +27,8 @@
2727 / THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
2828 /============================================================================*/
2929
30-#define WINVER 0x400
30+// UTF-8対応
31+//#define WINVER 0x400
3132
3233 #define STRICT
3334 #include <windows.h>
--- a/filelist.c
+++ b/filelist.c
@@ -27,7 +27,8 @@
2727 / THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
2828 /============================================================================*/
2929
30-#define _WIN32_WINNT 0x400
30+// UTF-8対応
31+//#define _WIN32_WINNT 0x400
3132
3233 #define STRICT
3334 #include <windows.h>
--- a/hostman.c
+++ b/hostman.c
@@ -1531,6 +1531,10 @@ static int DispHostSetDlg(HWND hDlg)
15311531 PROPSHEETPAGE psp[7];
15321532 PROPSHEETHEADER psh;
15331533
1534+ // 変数が未初期化のバグ修正
1535+ memset(&psp, 0, sizeof(psp));
1536+ memset(&psh, 0, sizeof(psh));
1537+
15341538 psp[0].dwSize = sizeof(PROPSHEETPAGE);
15351539 psp[0].dwFlags = PSP_USETITLE | PSP_HASHELP;
15361540 psp[0].hInstance = GetFtpInst();
--- a/main.c
+++ b/main.c
@@ -247,17 +247,37 @@ int PASCAL WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpszCmdLi
247247 break;
248248 }
249249 }
250- InitializeLoadLibraryHook();
251250 if(bProtect)
252251 {
252+ if(!InitializeLoadLibraryHook())
253+ {
254+ MessageBox(NULL, MSGJPN321, "FFFTP", MB_OK | MB_ICONERROR);
255+ return 0;
256+ }
253257 #ifndef _DEBUG
254- if(IsDebuggerPresent() || RestartProtectedProcess(" --restart"))
258+ if(IsDebuggerPresent())
259+ {
260+ MessageBox(NULL, MSGJPN322, "FFFTP", MB_OK | MB_ICONERROR);
255261 return 0;
262+ }
256263 #endif
257- // DLLの検証の前にロードされている必要があるDLL
258- LoadLibrary("shell32.dll");
259- EnableLoadLibraryHook(TRUE);
264+ if(!UnloadUntrustedModule())
265+ {
266+ MessageBox(NULL, MSGJPN323, "FFFTP", MB_OK | MB_ICONERROR);
267+ return 0;
268+ }
269+#ifndef _DEBUG
270+ if(RestartProtectedProcess(" --restart"))
271+ return 0;
272+#endif
273+ if(!EnableLoadLibraryHook(TRUE))
274+ {
275+ MessageBox(NULL, MSGJPN324, "FFFTP", MB_OK | MB_ICONERROR);
276+ return 0;
277+ }
260278 }
279+ else
280+ InitializeLoadLibraryHook();
261281 #endif
262282
263283 #ifdef DISABLE_MULTI_CPUS
--- a/mbswrapper.c
+++ b/mbswrapper.c
@@ -6,9 +6,6 @@
66
77 #define UNICODE
88 #define _UNICODE
9-#define _WIN32_WINNT 0x0600
10-#undef _WIN32_IE
11-#define _WIN32_IE 0x0400
129
1310 #include <tchar.h>
1411 #include <direct.h>
@@ -262,6 +259,7 @@ char* AllocateStringA(int size)
262259 }
263260
264261 // メモリを確保してマルチバイト文字列からワイド文字列へ変換
262+// リソースIDならば元の値を返す
265263 wchar_t* DuplicateMtoW(LPCSTR lpString, int c)
266264 {
267265 wchar_t* p;
@@ -280,6 +278,7 @@ wchar_t* DuplicateMtoW(LPCSTR lpString, int c)
280278 }
281279
282280 // 指定したサイズのメモリを確保してマルチバイト文字列からワイド文字列へ変換
281+// リソースIDならば元の値を返す
283282 wchar_t* DuplicateMtoWBuffer(LPCSTR lpString, int c, int size)
284283 {
285284 wchar_t* p;
@@ -298,6 +297,7 @@ wchar_t* DuplicateMtoWBuffer(LPCSTR lpString, int c, int size)
298297 }
299298
300299 // メモリを確保してNULL区切りマルチバイト文字列からワイド文字列へ変換
300+// リソースIDならば元の値を返す
301301 wchar_t* DuplicateMtoWMultiString(LPCSTR lpString)
302302 {
303303 int count;
@@ -312,6 +312,7 @@ wchar_t* DuplicateMtoWMultiString(LPCSTR lpString)
312312 }
313313
314314 // 指定したサイズのメモリを確保してNULL区切りマルチバイト文字列からワイド文字列へ変換
315+// リソースIDならば元の値を返す
315316 wchar_t* DuplicateMtoWMultiStringBuffer(LPCSTR lpString, int size)
316317 {
317318 int count;
@@ -330,6 +331,7 @@ wchar_t* DuplicateMtoWMultiStringBuffer(LPCSTR lpString, int size)
330331 }
331332
332333 // メモリを確保してワイド文字列からマルチバイト文字列へ変換
334+// リソースIDならば元の値を返す
333335 char* DuplicateWtoM(LPCWSTR lpString, int c)
334336 {
335337 char* p;
@@ -348,6 +350,7 @@ char* DuplicateWtoM(LPCWSTR lpString, int c)
348350 }
349351
350352 // メモリを確保してShift_JIS文字列からワイド文字列へ変換
353+// リソースIDならば元の値を返す
351354 wchar_t* DuplicateAtoW(LPCSTR lpString, int c)
352355 {
353356 wchar_t* p;
@@ -366,6 +369,7 @@ wchar_t* DuplicateAtoW(LPCSTR lpString, int c)
366369 }
367370
368371 // メモリを確保してワイド文字列からShift_JIS文字列へ変換
372+// リソースIDならば元の値を返す
369373 char* DuplicateWtoA(LPCWSTR lpString, int c)
370374 {
371375 char* p;
@@ -384,6 +388,7 @@ char* DuplicateWtoA(LPCWSTR lpString, int c)
384388 }
385389
386390 // 文字列用に確保したメモリを開放
391+// リソースIDならば何もしない
387392 void FreeDuplicatedString(void* p)
388393 {
389394 if(p < (void*)0x00010000 || p == (void*)~0)
@@ -984,18 +989,6 @@ END_ROUTINE
984989 return r;
985990 }
986991
987-BOOL SetDllDirectoryM(LPCSTR lpPathName)
988-{
989- BOOL r = FALSE;
990- wchar_t* pw0 = NULL;
991-START_ROUTINE
992- pw0 = DuplicateMtoW(lpPathName, -1);
993- r = SetDllDirectoryW(pw0);
994-END_ROUTINE
995- FreeDuplicatedString(pw0);
996- return r;
997-}
998-
999992 DWORD GetTempPathM(DWORD nBufferLength, LPSTR lpBuffer)
1000993 {
1001994 DWORD r = 0;
@@ -1184,56 +1177,79 @@ START_ROUTINE
11841177 a0.hIcon = v0->hIcon;
11851178 a0.pszCaption = DuplicateMtoW(v0->pszCaption, -1);
11861179 a0.nPages = v0->nPages;
1187- a0.pStartPage = DuplicateMtoW(v0->pStartPage, -1);
1188- if(v0->ppsp && (pwPage = (PROPSHEETPAGEW*)malloc(sizeof(PROPSHEETPAGEW) * v0->nPages)))
1180+ if(v0->dwFlags & PSH_USEPSTARTPAGE)
1181+ a0.pStartPage = DuplicateMtoW(v0->pStartPage, -1);
1182+ else
1183+ a0.nStartPage = v0->nStartPage;
1184+ if(v0->dwFlags & PSH_PROPSHEETPAGE)
11891185 {
1190- for(i = 0; i < v0->nPages; i++)
1186+ if(v0->ppsp && (pwPage = (PROPSHEETPAGEW*)malloc(sizeof(PROPSHEETPAGEW) * v0->nPages)))
11911187 {
1192- pwPage[i].dwSize = sizeof(PROPSHEETPAGEW);
1193- pwPage[i].dwFlags = v0->ppsp[i].dwFlags;
1194- pwPage[i].hInstance = v0->ppsp[i].hInstance;
1195- pwPage[i].pszTemplate = DuplicateMtoW(v0->ppsp[i].pszTemplate, -1);
1196- if(v0->ppsp[i].dwFlags & PSP_USEICONID)
1197- pwPage[i].pszIcon = DuplicateMtoW(v0->ppsp[i].pszIcon, -1);
1198- else
1199- pwPage[i].hIcon = v0->ppsp[i].hIcon;
1200- if(v0->ppsp[i].dwFlags & PSP_USETITLE)
1201- pwPage[i].pszTitle = DuplicateMtoW(v0->ppsp[i].pszTitle, -1);
1202- pwPage[i].pfnDlgProc = v0->ppsp[i].pfnDlgProc;
1203- pwPage[i].lParam = v0->ppsp[i].lParam;
1204- // TODO: pfnCallback
1205- pwPage[i].pfnCallback = (LPFNPSPCALLBACKW)v0->ppsp[i].pfnCallback;
1206- pwPage[i].pcRefParent = v0->ppsp[i].pcRefParent;
1207-// pwPage[i].pszHeaderTitle = DuplicateMtoW(v0->ppsp[i].pszHeaderTitle, -1);
1208-// pwPage[i].pszHeaderSubTitle = DuplicateMtoW(v0->ppsp[i].pszHeaderSubTitle, -1);
1209- pwPage[i].hActCtx = v0->ppsp[i].hActCtx;
1210-// pwPage[i].pszbmHeader = DuplicateMtoW(v0->ppsp[i].pszbmHeader, -1);
1188+ for(i = 0; i < v0->nPages; i++)
1189+ {
1190+ pwPage[i].dwSize = sizeof(PROPSHEETPAGEW);
1191+ pwPage[i].dwFlags = v0->ppsp[i].dwFlags;
1192+ pwPage[i].hInstance = v0->ppsp[i].hInstance;
1193+ if(v0->ppsp[i].dwFlags & PSP_DLGINDIRECT)
1194+ pwPage[i].pResource = v0->ppsp[i].pResource;
1195+ else
1196+ pwPage[i].pszTemplate = DuplicateMtoW(v0->ppsp[i].pszTemplate, -1);
1197+ if(v0->ppsp[i].dwFlags & PSP_USEICONID)
1198+ pwPage[i].pszIcon = DuplicateMtoW(v0->ppsp[i].pszIcon, -1);
1199+ else
1200+ pwPage[i].hIcon = v0->ppsp[i].hIcon;
1201+ if(v0->ppsp[i].dwFlags & PSP_USETITLE)
1202+ pwPage[i].pszTitle = DuplicateMtoW(v0->ppsp[i].pszTitle, -1);
1203+ pwPage[i].pfnDlgProc = v0->ppsp[i].pfnDlgProc;
1204+ pwPage[i].lParam = v0->ppsp[i].lParam;
1205+ // TODO: pfnCallback
1206+ pwPage[i].pfnCallback = (LPFNPSPCALLBACKW)v0->ppsp[i].pfnCallback;
1207+ pwPage[i].pcRefParent = v0->ppsp[i].pcRefParent;
1208+ if(v0->ppsp[i].dwFlags & PSP_USEHEADERTITLE)
1209+ pwPage[i].pszHeaderTitle = DuplicateMtoW(v0->ppsp[i].pszHeaderTitle, -1);
1210+ if(v0->ppsp[i].dwFlags & PSP_USEHEADERSUBTITLE)
1211+ pwPage[i].pszHeaderSubTitle = DuplicateMtoW(v0->ppsp[i].pszHeaderSubTitle, -1);
1212+ }
12111213 }
1214+ else
1215+ pwPage = NULL;
1216+ a0.ppsp = pwPage;
12121217 }
12131218 else
1214- pwPage = NULL;
1215- a0.ppsp = pwPage;
1219+ a0.phpage = v0->phpage;
12161220 a0.pfnCallback = v0->pfnCallback;
1221+ if(v0->dwFlags & PSH_USEHBMWATERMARK)
1222+ a0.hbmWatermark = v0->hbmWatermark;
1223+ else
1224+ a0.pszbmWatermark = DuplicateMtoW(v0->pszbmWatermark, -1);
12171225 r = PropertySheetW(&a0);
12181226 if(a0.dwFlags & PSH_USEICONID)
12191227 FreeDuplicatedString((void*)a0.pszIcon);
12201228 FreeDuplicatedString((void*)a0.pszCaption);
1221- FreeDuplicatedString((void*)a0.pStartPage);
1222- if(pwPage)
1229+ if(v0->dwFlags & PSH_USEPSTARTPAGE)
1230+ FreeDuplicatedString((void*)a0.pStartPage);
1231+ if(v0->dwFlags & PSH_PROPSHEETPAGE)
12231232 {
1224- for(i = 0; i < v0->nPages; i++)
1233+ if(pwPage)
12251234 {
1226- FreeDuplicatedString((void*)pwPage[i].pszTemplate);
1227- if(pwPage[i].dwFlags & PSP_USEICONID)
1228- FreeDuplicatedString((void*)pwPage[i].pszIcon);
1229- if(pwPage[i].dwFlags & PSP_USETITLE)
1230- FreeDuplicatedString((void*)pwPage[i].pszTitle);
1231-// FreeDuplicatedString((void*)pwPage[i].pszHeaderTitle);
1232-// FreeDuplicatedString((void*)pwPage[i].pszHeaderSubTitle);
1233-// FreeDuplicatedString((void*)pwPage[i].pszbmHeader);
1235+ for(i = 0; i < v0->nPages; i++)
1236+ {
1237+ if(!(v0->ppsp[i].dwFlags & PSP_DLGINDIRECT))
1238+ FreeDuplicatedString((void*)pwPage[i].pszTemplate);
1239+ if(v0->ppsp[i].dwFlags & PSP_USEICONID)
1240+ FreeDuplicatedString((void*)pwPage[i].pszIcon);
1241+ if(v0->ppsp[i].dwFlags & PSP_USETITLE)
1242+ FreeDuplicatedString((void*)pwPage[i].pszTitle);
1243+ if(v0->ppsp[i].dwFlags & PSP_USEHEADERTITLE)
1244+ FreeDuplicatedString((void*)pwPage[i].pszHeaderTitle);
1245+ if(v0->ppsp[i].dwFlags & PSP_USEHEADERSUBTITLE)
1246+ FreeDuplicatedString((void*)pwPage[i].pszHeaderSubTitle);
1247+ }
1248+ free(pwPage);
12341249 }
1235- free(pwPage);
12361250 }
1251+ if(!(v0->dwFlags & PSH_USEHBMWATERMARK))
1252+ FreeDuplicatedString((void*)a0.pszbmWatermark);
12371253 END_ROUTINE
12381254 return r;
12391255 }
@@ -1521,7 +1537,8 @@ START_ROUTINE
15211537 wFileOp.fFlags = lpFileOp->fFlags;
15221538 wFileOp.fAnyOperationsAborted = lpFileOp->fAnyOperationsAborted;
15231539 wFileOp.hNameMappings = lpFileOp->hNameMappings;
1524- pw2 = DuplicateMtoW(lpFileOp->lpszProgressTitle, -1);
1540+ if(lpFileOp->fFlags & FOF_SIMPLEPROGRESS)
1541+ pw2 = DuplicateMtoW(lpFileOp->lpszProgressTitle, -1);
15251542 r = SHFileOperationW(&wFileOp);
15261543 lpFileOp->fAnyOperationsAborted = wFileOp.fAnyOperationsAborted;
15271544 END_ROUTINE
@@ -1563,9 +1580,13 @@ START_ROUTINE
15631580 wmii.hbmpChecked = lpmii->hbmpChecked;
15641581 wmii.hbmpUnchecked = lpmii->hbmpUnchecked;
15651582 wmii.dwItemData = lpmii->dwItemData;
1566- pw0 = DuplicateMtoWBuffer(lpmii->dwTypeData, -1, lpmii->cch * 4);
1567- wmii.dwTypeData = pw0;
1568- wmii.cch = lpmii->cch * 4;
1583+ if(lpmii->fMask & MIIM_TYPE)
1584+ {
1585+ pw0 = DuplicateMtoWBuffer(lpmii->dwTypeData, -1, lpmii->cch * 4);
1586+ wmii.dwTypeData = pw0;
1587+ wmii.cch = lpmii->cch * 4;
1588+ }
1589+ wmii.hbmpItem = lpmii->hbmpItem;
15691590 r = GetMenuItemInfoW(hmenu, item, fByPosition, &wmii);
15701591 lpmii->fType = wmii.fType;
15711592 lpmii->fState = wmii.fState;
--- a/mbswrapper.h
+++ b/mbswrapper.h
@@ -74,9 +74,6 @@ DWORD GetCurrentDirectoryM(DWORD nBufferLength, LPSTR lpBuffer);
7474 #undef SetCurrentDirectory
7575 #define SetCurrentDirectory SetCurrentDirectoryM
7676 BOOL SetCurrentDirectoryM(LPCSTR lpPathName);
77-#undef SetDllDirectory
78-#define SetDllDirectory SetDllDirectoryM
79-BOOL SetDllDirectoryM(LPCSTR lpPathName);
8077 #undef GetTempPath
8178 #define GetTempPath GetTempPathM
8279 DWORD GetTempPathM(DWORD nBufferLength, LPSTR lpBuffer);
--- a/mesg-eng.h
+++ b/mesg-eng.h
@@ -318,3 +318,7 @@
318318 #define MSGJPN318 "OpenSSL is loaded."
319319 #define MSGJPN319 "OpenSSL is not installed.\r\nCommunication will not be encrypted."
320320 #define MSGJPN320 "Feature"
321+#define MSGJPN321 "Failed to get required functions to protect the process."
322+#define MSGJPN322 "Debugger was detected."
323+#define MSGJPN323 "Failed to unload untrustworthy DLLs."
324+#define MSGJPN324 "Failed to hook required functions to protect the process."
--- a/mesg-eng.old.h
+++ b/mesg-eng.old.h
@@ -318,3 +318,7 @@
318318 #define MSGJPN318 "OpenSSL is loaded."
319319 #define MSGJPN319 "OpenSSL is not installed.\r\nCommunication will not be encrypted."
320320 #define MSGJPN320 "Feature"
321+#define MSGJPN321 "Failed to get required functions to protect the process."
322+#define MSGJPN322 "Debugger was detected."
323+#define MSGJPN323 "Failed to unload untrustworthy DLLs."
324+#define MSGJPN324 "Failed to hook required functions to protect the process."
--- a/mesg-jpn.h
+++ b/mesg-jpn.h
@@ -318,3 +318,7 @@
318318 #define MSGJPN318 "OpenSSL\xE3\x81\x8C\xE8\xAA\xAD\xE3\x81\xBF\xE8\xBE\xBC\xE3\x81\xBE\xE3\x82\x8C\xE3\x81\xBE\xE3\x81\x97\xE3\x81\x9F."
319319 #define MSGJPN319 "OpenSSL\xE3\x81\x8C\xE3\x82\xA4\xE3\x83\xB3\xE3\x82\xB9\xE3\x83\x88\xE3\x83\xBC\xE3\x83\xAB\xE3\x81\x95\xE3\x82\x8C\xE3\x81\xA6\xE3\x81\x84\xE3\x81\xBE\xE3\x81\x9B\xE3\x82\x93.\r\n\xE9\x80\x9A\xE4\xBF\xA1\xE3\x81\xAE\xE6\x9A\x97\xE5\x8F\xB7\xE5\x8C\x96\xE3\x81\xAF\xE8\xA1\x8C\xE3\x82\x8F\xE3\x82\x8C\xE3\x81\xBE\xE3\x81\x9B\xE3\x82\x93."
320320 #define MSGJPN320 "\xE7\x89\xB9\xE6\xAE\x8A\xE6\xA9\x9F\xE8\x83\xBD"
321+#define MSGJPN321 "\xE3\x83\x97\xE3\x83\xAD\xE3\x82\xBB\xE3\x82\xB9\xE3\x81\xAE\xE4\xBF\x9D\xE8\xAD\xB7\xE3\x81\xAB\xE5\xBF\x85\xE8\xA6\x81\xE3\x81\xAA\xE9\x96\xA2\xE6\x95\xB0\xE3\x82\x92\xE5\x8F\x96\xE5\xBE\x97\xE3\x81\xA7\xE3\x81\x8D\xE3\x81\xBE\xE3\x81\x9B\xE3\x82\x93\xE3\x81\xA7\xE3\x81\x97\xE3\x81\x9F."
322+#define MSGJPN322 "\xE3\x83\x87\xE3\x83\x90\xE3\x83\x83\xE3\x82\xAC\xE3\x81\x8C\xE6\xA4\x9C\xE5\x87\xBA\xE3\x81\x95\xE3\x82\x8C\xE3\x81\xBE\xE3\x81\x97\xE3\x81\x9F."
323+#define MSGJPN323 "\xE4\xBF\xA1\xE9\xA0\xBC\xE3\x81\xA7\xE3\x81\x8D\xE3\x81\xAA\xE3\x81\x84\x44LL\xE3\x82\x92\xE3\x82\xA2\xE3\x83\xB3\xE3\x83\xAD\xE3\x83\xBC\xE3\x83\x89\xE3\x81\xA7\xE3\x81\x8D\xE3\x81\xBE\xE3\x81\x9B\xE3\x82\x93\xE3\x81\xA7\xE3\x81\x97\xE3\x81\x9F."
324+#define MSGJPN324 "\xE3\x83\x97\xE3\x83\xAD\xE3\x82\xBB\xE3\x82\xB9\xE3\x81\xAE\xE4\xBF\x9D\xE8\xAD\xB7\xE3\x81\xAB\xE5\xBF\x85\xE8\xA6\x81\xE3\x81\xAA\xE9\x96\xA2\xE6\x95\xB0\xE3\x82\x92\xE3\x83\x95\xE3\x83\x83\xE3\x82\xAF\xE3\x81\xA7\xE3\x81\x8D\xE3\x81\xBE\xE3\x81\x9B\xE3\x82\x93\xE3\x81\xA7\xE3\x81\x97\xE3\x81\x9F."
--- a/mesg-jpn.old.h
+++ b/mesg-jpn.old.h
@@ -318,3 +318,7 @@
318318 #define MSGJPN318 "OpenSSLが読み込まれました."
319319 #define MSGJPN319 "OpenSSLがインストールされていません.\r\n通信の暗号化は行われません."
320320 #define MSGJPN320 "特殊機能"
321+#define MSGJPN321 "プロセスの保護に必要な関数を取得できませんでした."
322+#define MSGJPN322 "デバッガが検出されました."
323+#define MSGJPN323 "信頼できないDLLをアンロードできませんでした."
324+#define MSGJPN324 "プロセスの保護に必要な関数をフックできませんでした."
--- a/option.c
+++ b/option.c
@@ -163,6 +163,10 @@ void SetOption(int Start)
163163 PROPSHEETPAGE psp[12];
164164 PROPSHEETHEADER psh;
165165
166+ // 変数が未初期化のバグ修正
167+ memset(&psp, 0, sizeof(psp));
168+ memset(&psh, 0, sizeof(psh));
169+
166170 psp[0].dwSize = sizeof(PROPSHEETPAGE);
167171 psp[0].dwFlags = PSP_USETITLE | PSP_HASHELP;
168172 psp[0].hInstance = GetFtpInst();
--- a/protectprocess.c
+++ b/protectprocess.c
@@ -16,8 +16,6 @@
1616 // フック用の関数名 h_%s
1717 // フック対象のコードのバックアップ c_%s
1818
19-#define _WIN32_WINNT 0x0600
20-
2119 #include <tchar.h>
2220 #include <windows.h>
2321 #include <ntsecapi.h>
@@ -26,8 +24,9 @@
2624 #include <softpub.h>
2725 #include <aclapi.h>
2826 #include <sfc.h>
29-#ifdef USE_IAT_HOOK
3027 #include <tlhelp32.h>
28+#include <imagehlp.h>
29+#ifdef USE_IAT_HOOK
3130 #include <dbghelp.h>
3231 #endif
3332
@@ -47,7 +46,20 @@
4746 #endif
4847 #endif
4948
49+BOOL LockThreadLock();
50+BOOL UnlockThreadLock();
51+#ifdef USE_CODE_HOOK
5052 BOOL HookFunctionInCode(void* pOriginal, void* pNew, void* pBackupCode, BOOL bRestore);
53+#endif
54+#ifdef USE_IAT_HOOK
55+BOOL HookFunctionInIAT(void* pOriginal, void* pNew);
56+#endif
57+HANDLE LockExistingFile(LPCWSTR Filename);
58+BOOL FindTrustedModuleMD5Hash(void* pHash);
59+BOOL VerifyFileSignature(LPCWSTR Filename);
60+BOOL VerifyFileSignatureInCatalog(LPCWSTR Catalog, LPCWSTR Filename);
61+BOOL GetSHA1HashOfModule(LPCWSTR Filename, void* pHash);
62+BOOL IsModuleTrusted(LPCWSTR Filename);
5163
5264 // 変数の宣言
5365 #ifdef USE_CODE_HOOK
@@ -70,21 +82,23 @@ HOOK_FUNCTION_VAR(LoadLibraryW)
7082 HOOK_FUNCTION_VAR(LoadLibraryExA)
7183 HOOK_FUNCTION_VAR(LoadLibraryExW)
7284
73-// ドキュメントが無いため原因は不明だが第2引数はポインタでないとエラーになる場合がある
74-//typedef NTSTATUS (WINAPI* _LdrLoadDll)(LPCWSTR, DWORD, UNICODE_STRING*, HMODULE*);
75-typedef NTSTATUS (WINAPI* _LdrLoadDll)(LPCWSTR, DWORD*, UNICODE_STRING*, HMODULE*);
76-// ドキュメントが無いため原因は不明だが第2引数はポインタでないとエラーになる場合がある
77-//typedef NTSTATUS (WINAPI* _LdrGetDllHandle)(LPCWSTR, DWORD, UNICODE_STRING*, HMODULE*);
78-typedef NTSTATUS (WINAPI* _LdrGetDllHandle)(LPCWSTR, DWORD*, UNICODE_STRING*, HMODULE*);
79-typedef NTSTATUS (WINAPI* _LdrAddRefDll)(DWORD, HMODULE);
85+typedef NTSTATUS (NTAPI* _LdrLoadDll)(LPCWSTR, DWORD*, UNICODE_STRING*, HMODULE*);
86+typedef NTSTATUS (NTAPI* _LdrGetDllHandle)(LPCWSTR, DWORD*, UNICODE_STRING*, HMODULE*);
87+typedef PIMAGE_NT_HEADERS (NTAPI* _RtlImageNtHeader)(PVOID);
88+typedef BOOL (WINAPI* _CryptCATAdminCalcHashFromFileHandle)(HANDLE, DWORD*, BYTE*, DWORD);
8089
8190 _LdrLoadDll p_LdrLoadDll;
8291 _LdrGetDllHandle p_LdrGetDllHandle;
83-_LdrAddRefDll p_LdrAddRefDll;
92+_RtlImageNtHeader p_RtlImageNtHeader;
93+_CryptCATAdminCalcHashFromFileHandle p_CryptCATAdminCalcHashFromFileHandle;
8494
85-#define MAX_MD5_HASH_TABLE 16
95+#define MAX_LOCKED_THREAD 16
96+#define MAX_TRUSTED_FILENAME_TABLE 16
97+#define MAX_TRUSTED_MD5_HASH_TABLE 16
8698
87-BYTE g_MD5HashTable[MAX_MD5_HASH_TABLE][16];
99+DWORD g_LockedThread[MAX_LOCKED_THREAD];
100+WCHAR* g_pTrustedFilenameTable[MAX_TRUSTED_FILENAME_TABLE];
101+BYTE g_TrustedMD5HashTable[MAX_TRUSTED_MD5_HASH_TABLE][16];
88102
89103 // 以下フック関数
90104 // フック対象を呼び出す場合は前後でSTART_HOOK_FUNCTIONとEND_HOOK_FUNCTIONを実行する必要がある
@@ -92,84 +106,142 @@ BYTE g_MD5HashTable[MAX_MD5_HASH_TABLE][16];
92106 HMODULE WINAPI h_LoadLibraryA(LPCSTR lpLibFileName)
93107 {
94108 HMODULE r = NULL;
95- if(GetModuleHandleA(lpLibFileName) || IsModuleTrustedA(lpLibFileName))
96- {
97- wchar_t* pw0 = NULL;
98- pw0 = DuplicateAtoW(lpLibFileName, -1);
99- r = System_LoadLibrary(pw0, NULL, 0);
100- FreeDuplicatedString(pw0);
101- }
109+ wchar_t* pw0 = NULL;
110+ if(pw0 = DuplicateAtoW(lpLibFileName, -1))
111+ r = LoadLibraryExW(pw0, NULL, 0);
112+ FreeDuplicatedString(pw0);
102113 return r;
103114 }
104115
105116 HMODULE WINAPI h_LoadLibraryW(LPCWSTR lpLibFileName)
106117 {
107118 HMODULE r = NULL;
108- if(GetModuleHandleW(lpLibFileName) || IsModuleTrustedW(lpLibFileName))
109- r = System_LoadLibrary(lpLibFileName, NULL, 0);
119+ r = LoadLibraryExW(lpLibFileName, NULL, 0);
110120 return r;
111121 }
112122
113123 HMODULE WINAPI h_LoadLibraryExA(LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
114124 {
115125 HMODULE r = NULL;
116- if(GetModuleHandleA(lpLibFileName) || IsModuleTrustedA(lpLibFileName))
117- {
118- wchar_t* pw0 = NULL;
119- pw0 = DuplicateAtoW(lpLibFileName, -1);
120- r = System_LoadLibrary(pw0, hFile, dwFlags);
121- FreeDuplicatedString(pw0);
122- }
126+ wchar_t* pw0 = NULL;
127+ if(pw0 = DuplicateAtoW(lpLibFileName, -1))
128+ r = LoadLibraryExW(pw0, hFile, dwFlags);
129+ FreeDuplicatedString(pw0);
123130 return r;
124131 }
125132
126133 HMODULE WINAPI h_LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
127134 {
128135 HMODULE r = NULL;
129- if(GetModuleHandleW(lpLibFileName) || IsModuleTrustedW(lpLibFileName))
136+ BOOL bTrusted;
137+ wchar_t* pw0;
138+ HANDLE hLock;
139+ HMODULE hModule;
140+ DWORD Length;
141+ bTrusted = FALSE;
142+ pw0 = NULL;
143+ hLock = NULL;
144+// if(dwFlags & (DONT_RESOLVE_DLL_REFERENCES | LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_IMAGE_RESOURCE | LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE))
145+ if(dwFlags & (DONT_RESOLVE_DLL_REFERENCES | LOAD_LIBRARY_AS_DATAFILE | 0x00000020 | 0x00000040))
146+ bTrusted = TRUE;
147+ if(!bTrusted)
148+ {
149+ if(hModule = System_LoadLibrary(lpLibFileName, NULL, DONT_RESOLVE_DLL_REFERENCES))
150+ {
151+ Length = MAX_PATH;
152+ if(pw0 = AllocateStringW(Length))
153+ {
154+ if(GetModuleFileNameW(hModule, pw0, Length) > 0)
155+ {
156+ while(pw0)
157+ {
158+ if(GetModuleFileNameW(hModule, pw0, Length) + 1 <= Length)
159+ {
160+ lpLibFileName = pw0;
161+ break;
162+ }
163+ Length = Length * 2;
164+ FreeDuplicatedString(pw0);
165+ pw0 = AllocateStringW(Length);
166+ }
167+ }
168+ }
169+ hLock = LockExistingFile(lpLibFileName);
170+ FreeLibrary(hModule);
171+ }
172+ if(GetModuleHandleW(lpLibFileName))
173+ bTrusted = TRUE;
174+ }
175+ if(!bTrusted)
176+ {
177+ if(LockThreadLock())
178+ {
179+ if(hLock)
180+ {
181+ if(IsModuleTrusted(lpLibFileName))
182+ bTrusted = TRUE;
183+ }
184+ UnlockThreadLock();
185+ }
186+ }
187+ if(bTrusted)
130188 r = System_LoadLibrary(lpLibFileName, hFile, dwFlags);
189+ FreeDuplicatedString(pw0);
190+ if(hLock)
191+ CloseHandle(hLock);
131192 return r;
132193 }
133194
134195 // 以下ヘルパー関数
135196
136-BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash)
197+BOOL LockThreadLock()
137198 {
138199 BOOL bResult;
139- HCRYPTPROV hProv;
140- HCRYPTHASH hHash;
141- HANDLE hFile;
142- DWORD Size;
143- void* pData;
144- DWORD dw;
200+ DWORD ThreadId;
201+ DWORD i;
145202 bResult = FALSE;
146- if(CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, 0) || CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET))
203+ ThreadId = GetCurrentThreadId();
204+ i = 0;
205+ while(i < MAX_LOCKED_THREAD)
147206 {
148- if(CryptCreateHash(hProv, CALG_MD5, 0, 0, &hHash))
207+ if(g_LockedThread[i] == ThreadId)
208+ break;
209+ i++;
210+ }
211+ if(i >= MAX_LOCKED_THREAD)
212+ {
213+ i = 0;
214+ while(i < MAX_LOCKED_THREAD)
149215 {
150- if((hFile = CreateFileW(Filename, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE)
216+ if(g_LockedThread[i] == 0)
151217 {
152- Size = GetFileSize(hFile, NULL);
153- if(pData = VirtualAlloc(NULL, Size, MEM_COMMIT, PAGE_READWRITE))
154- {
155- VirtualLock(pData, Size);
156- if(ReadFile(hFile, pData, Size, &dw, NULL))
157- {
158- if(CryptHashData(hHash, (BYTE*)pData, Size, 0))
159- {
160- dw = 16;
161- if(CryptGetHashParam(hHash, HP_HASHVAL, (BYTE*)pHash, &dw, 0))
162- bResult = TRUE;
163- }
164- }
165- VirtualUnlock(pData, Size);
166- VirtualFree(pData, Size, MEM_DECOMMIT);
167- }
168- CloseHandle(hFile);
218+ g_LockedThread[i] = ThreadId;
219+ bResult = TRUE;
220+ break;
169221 }
170- CryptDestroyHash(hHash);
222+ i++;
171223 }
172- CryptReleaseContext(hProv, 0);
224+ }
225+ return bResult;
226+}
227+
228+BOOL UnlockThreadLock()
229+{
230+ BOOL bResult;
231+ DWORD ThreadId;
232+ DWORD i;
233+ bResult = FALSE;
234+ ThreadId = GetCurrentThreadId();
235+ i = 0;
236+ while(i < MAX_LOCKED_THREAD)
237+ {
238+ if(g_LockedThread[i] == ThreadId)
239+ {
240+ g_LockedThread[i] = 0;
241+ bResult = TRUE;
242+ break;
243+ }
244+ i++;
173245 }
174246 return bResult;
175247 }
@@ -287,43 +359,378 @@ BOOL HookFunctionInIAT(void* pOriginal, void* pNew)
287359 }
288360 #endif
289361
362+// ファイルを変更不能に設定
363+HANDLE LockExistingFile(LPCWSTR Filename)
364+{
365+ HANDLE hResult;
366+ hResult = NULL;
367+ if((hResult = CreateFileW(Filename, 0, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL)) == INVALID_HANDLE_VALUE)
368+ hResult = NULL;
369+ return hResult;
370+}
371+
372+// DLLのハッシュを検索
373+BOOL FindTrustedModuleMD5Hash(void* pHash)
374+{
375+ BOOL bResult;
376+ int i;
377+ bResult = FALSE;
378+ i = 0;
379+ while(i < MAX_TRUSTED_MD5_HASH_TABLE)
380+ {
381+ if(memcmp(&g_TrustedMD5HashTable[i], pHash, 16) == 0)
382+ {
383+ bResult = TRUE;
384+ break;
385+ }
386+ i++;
387+ }
388+ return bResult;
389+}
390+
391+// ファイルの署名を確認
392+BOOL VerifyFileSignature(LPCWSTR Filename)
393+{
394+ BOOL bResult;
395+ GUID g = WINTRUST_ACTION_GENERIC_VERIFY_V2;
396+ WINTRUST_FILE_INFO wfi;
397+ WINTRUST_DATA wd;
398+ bResult = FALSE;
399+ ZeroMemory(&wfi, sizeof(WINTRUST_FILE_INFO));
400+ wfi.cbStruct = sizeof(WINTRUST_FILE_INFO);
401+ wfi.pcwszFilePath = Filename;
402+ ZeroMemory(&wd, sizeof(WINTRUST_DATA));
403+ wd.cbStruct = sizeof(WINTRUST_DATA);
404+ wd.dwUIChoice = WTD_UI_NONE;
405+ wd.dwUnionChoice = WTD_CHOICE_FILE;
406+ wd.pFile = &wfi;
407+ if(WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd) == ERROR_SUCCESS)
408+ bResult = TRUE;
409+ return bResult;
410+}
411+
412+// ファイルの署名をカタログファイルで確認
413+BOOL VerifyFileSignatureInCatalog(LPCWSTR Catalog, LPCWSTR Filename)
414+{
415+ BOOL bResult;
416+ GUID g = WINTRUST_ACTION_GENERIC_VERIFY_V2;
417+ WINTRUST_CATALOG_INFO wci;
418+ WINTRUST_DATA wd;
419+ bResult = FALSE;
420+ if(VerifyFileSignature(Catalog))
421+ {
422+ ZeroMemory(&wci, sizeof(WINTRUST_CATALOG_INFO));
423+ wci.cbStruct = sizeof(WINTRUST_CATALOG_INFO);
424+ wci.pcwszCatalogFilePath = Catalog;
425+ wci.pcwszMemberFilePath = Filename;
426+ if((wci.hMemberFile = CreateFileW(Filename, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL)) != INVALID_HANDLE_VALUE)
427+ {
428+ p_CryptCATAdminCalcHashFromFileHandle(wci.hMemberFile, &wci.cbCalculatedFileHash, NULL, 0);
429+ if(wci.pbCalculatedFileHash = (BYTE*)malloc(wci.cbCalculatedFileHash))
430+ {
431+ if(p_CryptCATAdminCalcHashFromFileHandle(wci.hMemberFile, &wci.cbCalculatedFileHash, wci.pbCalculatedFileHash, 0))
432+ {
433+ ZeroMemory(&wd, sizeof(WINTRUST_DATA));
434+ wd.cbStruct = sizeof(WINTRUST_DATA);
435+ wd.dwUIChoice = WTD_UI_NONE;
436+ wd.dwUnionChoice = WTD_CHOICE_CATALOG;
437+ wd.pCatalog = &wci;
438+ if(WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd) == ERROR_SUCCESS)
439+ bResult = TRUE;
440+ }
441+ free(wci.pbCalculatedFileHash);
442+ }
443+ CloseHandle(wci.hMemberFile);
444+ }
445+ }
446+ return bResult;
447+}
448+
449+BOOL WINAPI GetSHA1HashOfModule_Function(DIGEST_HANDLE refdata, PBYTE pData, DWORD dwLength)
450+{
451+ return CryptHashData(*(HCRYPTHASH*)refdata, pData, dwLength, 0);
452+}
453+
454+// モジュールのSHA1ハッシュを取得
455+// マニフェストファイルのfile要素のhash属性は実行可能ファイルの場合にImageGetDigestStreamで算出される
456+BOOL GetSHA1HashOfModule(LPCWSTR Filename, void* pHash)
457+{
458+ BOOL bResult;
459+ HCRYPTPROV hProv;
460+ HCRYPTHASH hHash;
461+ HANDLE hFile;
462+ DWORD dw;
463+ bResult = FALSE;
464+ if(CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, 0) || CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET))
465+ {
466+ if(CryptCreateHash(hProv, CALG_SHA1, 0, 0, &hHash))
467+ {
468+ if((hFile = CreateFileW(Filename, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE)
469+ {
470+ if(ImageGetDigestStream(hFile, CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO, GetSHA1HashOfModule_Function, (DIGEST_HANDLE)&hHash))
471+ {
472+ dw = 20;
473+ if(CryptGetHashParam(hHash, HP_HASHVAL, (BYTE*)pHash, &dw, 0))
474+ bResult = TRUE;
475+ }
476+ CloseHandle(hFile);
477+ }
478+ CryptDestroyHash(hHash);
479+ }
480+ CryptReleaseContext(hProv, 0);
481+ }
482+ return bResult;
483+}
484+
485+BOOL IsSxsModuleTrusted_Function(LPCWSTR Catalog, LPCWSTR Manifest, LPCWSTR Module)
486+{
487+ BOOL bResult;
488+ HANDLE hLock0;
489+ HANDLE hLock1;
490+ BYTE Hash[20];
491+ int i;
492+ static char HexTable[16] = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'};
493+ char HashHex[41];
494+ HANDLE hFile;
495+ DWORD Size;
496+ char* pData;
497+ DWORD dw;
498+ bResult = FALSE;
499+ if(hLock0 = LockExistingFile(Catalog))
500+ {
501+ if(hLock1 = LockExistingFile(Manifest))
502+ {
503+ if(VerifyFileSignatureInCatalog(Catalog, Manifest))
504+ {
505+ if(GetSHA1HashOfModule(Module, &Hash))
506+ {
507+ for(i = 0; i < 20; i++)
508+ {
509+ HashHex[i * 2] = HexTable[(Hash[i] >> 4) & 0x0f];
510+ HashHex[i * 2 + 1] = HexTable[Hash[i] & 0x0f];
511+ }
512+ HashHex[i * 2] = '\0';
513+ if((hFile = CreateFileW(Manifest, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL)) != INVALID_HANDLE_VALUE)
514+ {
515+ Size = GetFileSize(hFile, NULL);
516+ if(pData = (char*)VirtualAlloc(NULL, Size + 1, MEM_COMMIT, PAGE_READWRITE))
517+ {
518+ VirtualLock(pData, Size + 1);
519+ if(ReadFile(hFile, pData, Size, &dw, NULL))
520+ {
521+ pData[dw] = '\0';
522+ if(strstr(pData, HashHex))
523+ bResult = TRUE;
524+ }
525+ VirtualUnlock(pData, Size + 1);
526+ VirtualFree(pData, Size + 1, MEM_DECOMMIT);
527+ }
528+ CloseHandle(hFile);
529+ }
530+ }
531+ }
532+ CloseHandle(hLock1);
533+ }
534+ CloseHandle(hLock0);
535+ }
536+ return bResult;
537+}
538+
539+// サイドバイサイドDLLを確認
540+// パスは"%SystemRoot%\WinSxS"以下を想定
541+// 以下のファイルが存在するものとする
542+// "\xxx\yyy.dll"、"\manifests\xxx.cat"、"\manifests\xxx.manifest"のセット（XPの全てのDLL、Vista以降の一部のDLL）
543+// "\xxx\yyy.dll"、"\catalogs\zzz.cat"、"\manifests\xxx.manifest"のセット（Vista以降のほとんどのDLL）
544+// 署名されたカタログファイルを用いてマニフェストファイルが改竄されていないことを確認
545+// ハッシュ値は マニフェストファイルのfile要素のhash属性に記述されているものを用いる
546+// マニフェストファイル内にSHA1ハッシュ値の16進数表記を直接検索しているが確率的に問題なし
547+BOOL IsSxsModuleTrusted(LPCWSTR Filename)
548+{
549+ BOOL bResult;
550+ wchar_t* pw0;
551+ wchar_t* pw1;
552+ wchar_t* pw2;
553+ wchar_t* pw3;
554+ wchar_t* pw4;
555+ wchar_t* pw5;
556+ wchar_t* p;
557+ HANDLE hFind;
558+ WIN32_FIND_DATAW wfd;
559+ bResult = FALSE;
560+ if(pw0 = AllocateStringW(wcslen(Filename) + 1))
561+ {
562+ wcscpy(pw0, Filename);
563+ if(p = wcsrchr(pw0, L'\\'))
564+ {
565+ wcscpy(p, L"");
566+ if(p = wcsrchr(pw0, L'\\'))
567+ {
568+ p++;
569+ if(pw1 = AllocateStringW(wcslen(p) + 1))
570+ {
571+ wcscpy(pw1, p);
572+ wcscpy(p, L"");
573+ if(pw2 = AllocateStringW(wcslen(pw0) + wcslen(L"manifests\\") + wcslen(pw1) + wcslen(L".cat") + 1))
574+ {
575+ wcscpy(pw2, pw0);
576+ wcscat(pw2, L"manifests\\");
577+ wcscat(pw2, pw1);
578+ if(pw3 = AllocateStringW(wcslen(pw2) + wcslen(L".manifest") + 1))
579+ {
580+ wcscpy(pw3, pw2);
581+ wcscat(pw3, L".manifest");
582+ wcscat(pw2, L".cat");
583+ if(IsSxsModuleTrusted_Function(pw2, pw3, Filename))
584+ bResult = TRUE;
585+ FreeDuplicatedString(pw3);
586+ }
587+ FreeDuplicatedString(pw2);
588+ }
589+ if(!bResult)
590+ {
591+ if(pw2 = AllocateStringW(wcslen(pw0) + wcslen(L"catalogs\\") + 1))
592+ {
593+ if(pw3 = AllocateStringW(wcslen(pw0) + wcslen(L"manifests\\") + wcslen(pw1) + wcslen(L".manifest") + 1))
594+ {
595+ wcscpy(pw2, pw0);
596+ wcscat(pw2, L"catalogs\\");
597+ wcscpy(pw3, pw0);
598+ wcscat(pw3, L"manifests\\");
599+ wcscat(pw3, pw1);
600+ wcscat(pw3, L".manifest");
601+ if(pw4 = AllocateStringW(wcslen(pw2) + wcslen(L"*.cat") + 1))
602+ {
603+ wcscpy(pw4, pw2);
604+ wcscat(pw4, L"*.cat");
605+ if((hFind = FindFirstFileW(pw4, &wfd)) != INVALID_HANDLE_VALUE)
606+ {
607+ do
608+ {
609+ if(pw5 = AllocateStringW(wcslen(pw2) + wcslen(wfd.cFileName) + 1))
610+ {
611+ wcscpy(pw5, pw2);
612+ wcscat(pw5, wfd.cFileName);
613+ if(IsSxsModuleTrusted_Function(pw5, pw3, Filename))
614+ bResult = TRUE;
615+ FreeDuplicatedString(pw5);
616+ }
617+ }
618+ while(!bResult && FindNextFileW(hFind, &wfd));
619+ FindClose(hFind);
620+ }
621+ FreeDuplicatedString(pw4);
622+ }
623+ FreeDuplicatedString(pw3);
624+ }
625+ FreeDuplicatedString(pw2);
626+ }
627+ }
628+ FreeDuplicatedString(pw1);
629+ }
630+ }
631+ }
632+ FreeDuplicatedString(pw0);
633+ }
634+ return bResult;
635+}
636+
637+// DLLを確認
638+// ハッシュが登録されている、Authenticode署名がされている、またはWFPによる保護下にあることを確認
639+BOOL IsModuleTrusted(LPCWSTR Filename)
640+{
641+ BOOL bResult;
642+ BYTE Hash[16];
643+ bResult = FALSE;
644+ if(GetMD5HashOfFile(Filename, &Hash))
645+ {
646+ if(FindTrustedModuleMD5Hash(&Hash))
647+ bResult = TRUE;
648+ }
649+ if(!bResult)
650+ {
651+ if(VerifyFileSignature(Filename))
652+ bResult = TRUE;
653+ }
654+ if(!bResult)
655+ {
656+ if(IsSxsModuleTrusted(Filename))
657+ bResult = TRUE;
658+ }
659+ if(!bResult)
660+ {
661+ if(SfcIsFileProtected(NULL, Filename))
662+ bResult = TRUE;
663+ }
664+ return bResult;
665+}
666+
290667 // kernel32.dllのLoadLibraryExW相当の関数
668+// ドキュメントが無いため詳細は不明
669+// 一部のウィルス対策ソフト（Avast!等）がLdrLoadDllをフックしているためLdrLoadDllを書き換えるべきではない
670+// カーネルモードのコードに対しては効果なし
671+// SeDebugPrivilegeが使用可能なユーザーに対しては効果なし
291672 HMODULE System_LoadLibrary(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
292673 {
293674 HMODULE r = NULL;
294675 UNICODE_STRING us;
676+ HANDLE hDataFile;
677+ HANDLE hMapping;
678+ DWORD DllFlags;
295679 us.Length = sizeof(wchar_t) * wcslen(lpLibFileName);
296680 us.MaximumLength = sizeof(wchar_t) * (wcslen(lpLibFileName) + 1);
297681 us.Buffer = (PWSTR)lpLibFileName;
298- if(dwFlags & LOAD_LIBRARY_AS_DATAFILE)
682+// if(dwFlags & (LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE))
683+ if(dwFlags & (LOAD_LIBRARY_AS_DATAFILE | 0x00000040))
299684 {
300-// if(p_LdrGetDllHandle(NULL, dwFlags, &us, &r) == 0)
301- if(p_LdrGetDllHandle(NULL, &dwFlags, &us, &r) == 0)
685+// if(p_LdrGetDllHandle(NULL, NULL, &us, &r) == STATUS_SUCCESS)
686+ if(p_LdrGetDllHandle(NULL, NULL, &us, &r) == 0)
302687 {
303- if(p_LdrAddRefDll)
304- p_LdrAddRefDll(0, r);
688+// dwFlags &= ~(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE);
689+ dwFlags &= ~(LOAD_LIBRARY_AS_DATAFILE | 0x00000040);
690+ dwFlags |= DONT_RESOLVE_DLL_REFERENCES;
305691 }
306692 else
307693 {
308- dwFlags |= DONT_RESOLVE_DLL_REFERENCES;
309-// if(p_LdrLoadDll(NULL, dwFlags, &us, &r) == 0)
310- if(p_LdrLoadDll(NULL, &dwFlags, &us, &r) == 0)
694+// if(dwFlags & LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE)
695+ if(dwFlags & 0x00000040)
696+ hDataFile = CreateFileW(lpLibFileName, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
697+ else
698+ hDataFile = CreateFileW(lpLibFileName, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, 0, NULL);
699+ if(hDataFile != INVALID_HANDLE_VALUE)
311700 {
701+ if(hMapping = CreateFileMappingW(hDataFile, NULL, PAGE_READONLY, 0, 0, NULL))
702+ {
703+ if(r = (HMODULE)MapViewOfFileEx(hMapping, FILE_MAP_READ, 0, 0, 0, NULL))
704+ {
705+ if(p_RtlImageNtHeader(r))
706+ r = (HMODULE)((size_t)r | 1);
707+ else
708+ {
709+ UnmapViewOfFile(r);
710+ r = NULL;
711+ }
712+ }
713+ CloseHandle(hMapping);
714+ }
715+ CloseHandle(hDataFile);
312716 }
313717 else
314- r = NULL;
718+ {
719+// dwFlags &= ~(LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE);
720+ dwFlags &= ~(LOAD_LIBRARY_AS_DATAFILE | 0x00000040);
721+ dwFlags |= DONT_RESOLVE_DLL_REFERENCES;
722+ }
315723 }
316724 }
317- else
725+// if(!(dwFlags & (LOAD_LIBRARY_AS_DATAFILE | LOAD_LIBRARY_AS_DATAFILE_EXCLUSIVE)))
726+ if(!(dwFlags & (LOAD_LIBRARY_AS_DATAFILE | 0x00000040)))
318727 {
319-// if(p_LdrGetDllHandle(NULL, dwFlags, &us, &r) == 0)
320- if(p_LdrGetDllHandle(NULL, &dwFlags, &us, &r) == 0)
321- {
322- if(p_LdrAddRefDll)
323- p_LdrAddRefDll(0, r);
324- }
325-// else if(p_LdrLoadDll(NULL, dwFlags, &us, &r) == 0)
326- else if(p_LdrLoadDll(NULL, &dwFlags, &us, &r) == 0)
728+ DllFlags = 0;
729+// if(dwFlags & (DONT_RESOLVE_DLL_REFERENCES | LOAD_LIBRARY_AS_IMAGE_RESOURCE))
730+ if(dwFlags & (DONT_RESOLVE_DLL_REFERENCES | 0x00000020))
731+ DllFlags |= 0x00000002;
732+// if(p_LdrLoadDll(NULL, &DllFlags, &us, &r) == STATUS_SUCCESS)
733+ if(p_LdrLoadDll(NULL, &DllFlags, &us, &r) == 0)
327734 {
328735 }
329736 else
@@ -332,23 +739,65 @@ HMODULE System_LoadLibrary(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
332739 return r;
333740 }
334741
742+// ファイルのMD5ハッシュを取得
743+BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash)
744+{
745+ BOOL bResult;
746+ HCRYPTPROV hProv;
747+ HCRYPTHASH hHash;
748+ HANDLE hFile;
749+ DWORD Size;
750+ void* pData;
751+ DWORD dw;
752+ bResult = FALSE;
753+ if(CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, 0) || CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET))
754+ {
755+ if(CryptCreateHash(hProv, CALG_MD5, 0, 0, &hHash))
756+ {
757+ if((hFile = CreateFileW(Filename, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE)
758+ {
759+ Size = GetFileSize(hFile, NULL);
760+ if(pData = VirtualAlloc(NULL, Size, MEM_COMMIT, PAGE_READWRITE))
761+ {
762+ VirtualLock(pData, Size);
763+ if(ReadFile(hFile, pData, Size, &dw, NULL))
764+ {
765+ if(CryptHashData(hHash, (BYTE*)pData, Size, 0))
766+ {
767+ dw = 16;
768+ if(CryptGetHashParam(hHash, HP_HASHVAL, (BYTE*)pHash, &dw, 0))
769+ bResult = TRUE;
770+ }
771+ }
772+ VirtualUnlock(pData, Size);
773+ VirtualFree(pData, Size, MEM_DECOMMIT);
774+ }
775+ CloseHandle(hFile);
776+ }
777+ CryptDestroyHash(hHash);
778+ }
779+ CryptReleaseContext(hProv, 0);
780+ }
781+ return bResult;
782+}
783+
335784 // DLLのハッシュを登録
336-BOOL RegisterModuleMD5Hash(void* pHash)
785+BOOL RegisterTrustedModuleMD5Hash(void* pHash)
337786 {
338787 BOOL bResult;
339788 BYTE NullHash[16] = {0};
340789 int i;
341790 bResult = FALSE;
342- if(FindModuleMD5Hash(pHash))
791+ if(FindTrustedModuleMD5Hash(pHash))
343792 bResult = TRUE;
344793 else
345794 {
346795 i = 0;
347- while(i < MAX_MD5_HASH_TABLE)
796+ while(i < MAX_TRUSTED_MD5_HASH_TABLE)
348797 {
349- if(memcmp(&g_MD5HashTable[i], &NullHash, 16) == 0)
798+ if(memcmp(&g_TrustedMD5HashTable[i], &NullHash, 16) == 0)
350799 {
351- memcpy(&g_MD5HashTable[i], pHash, 16);
800+ memcpy(&g_TrustedMD5HashTable[i], pHash, 16);
352801 bResult = TRUE;
353802 break;
354803 }
@@ -359,18 +808,18 @@ BOOL RegisterModuleMD5Hash(void* pHash)
359808 }
360809
361810 // DLLのハッシュの登録を解除
362-BOOL UnregisterModuleMD5Hash(void* pHash)
811+BOOL UnregisterTrustedModuleMD5Hash(void* pHash)
363812 {
364813 BOOL bResult;
365814 BYTE NullHash[16] = {0};
366815 int i;
367816 bResult = FALSE;
368817 i = 0;
369- while(i < MAX_MD5_HASH_TABLE)
818+ while(i < MAX_TRUSTED_MD5_HASH_TABLE)
370819 {
371- if(memcmp(&g_MD5HashTable[i], pHash, 16) == 0)
820+ if(memcmp(&g_TrustedMD5HashTable[i], pHash, 16) == 0)
372821 {
373- memcpy(&g_MD5HashTable[i], &NullHash, 16);
822+ memcpy(&g_TrustedMD5HashTable[i], &NullHash, 16);
374823 bResult = TRUE;
375824 break;
376825 }
@@ -379,144 +828,157 @@ BOOL UnregisterModuleMD5Hash(void* pHash)
379828 return bResult;
380829 }
381830
382-// DLLのハッシュを検索
383-BOOL FindModuleMD5Hash(void* pHash)
831+// 信頼できないDLLをアンロード
832+BOOL UnloadUntrustedModule()
384833 {
385834 BOOL bResult;
386- int i;
835+ wchar_t* pw0;
836+ HANDLE hSnapshot;
837+ MODULEENTRY32 me;
838+ DWORD Length;
387839 bResult = FALSE;
388- i = 0;
389- while(i < MAX_MD5_HASH_TABLE)
840+ pw0 = NULL;
841+ if((hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetCurrentProcessId())) != INVALID_HANDLE_VALUE)
390842 {
391- if(memcmp(&g_MD5HashTable[i], pHash, 16) == 0)
843+ bResult = TRUE;
844+ me.dwSize = sizeof(MODULEENTRY32);
845+ if(Module32First(hSnapshot, &me))
392846 {
393- bResult = TRUE;
394- break;
847+ do
848+ {
849+ Length = MAX_PATH;
850+ FreeDuplicatedString(pw0);
851+ if(pw0 = AllocateStringW(Length))
852+ {
853+ if(GetModuleFileNameW(me.hModule, pw0, Length) > 0)
854+ {
855+ while(pw0)
856+ {
857+ if(GetModuleFileNameW(me.hModule, pw0, Length) + 1 <= Length)
858+ break;
859+ Length = Length * 2;
860+ FreeDuplicatedString(pw0);
861+ pw0 = AllocateStringW(Length);
862+ }
863+ }
864+ }
865+ if(pw0)
866+ {
867+ if(!IsModuleTrusted(pw0))
868+ {
869+ if(me.hModule != GetModuleHandleW(NULL))
870+ {
871+ while(FreeLibrary(me.hModule))
872+ {
873+ }
874+ if(GetModuleFileNameW(me.hModule, pw0, Length) > 0)
875+ {
876+ bResult = FALSE;
877+ break;
878+ }
879+ }
880+ }
881+ }
882+ else
883+ {
884+ bResult = FALSE;
885+ break;
886+ }
887+ }
888+ while(Module32Next(hSnapshot, &me));
395889 }
396- i++;
890+ CloseHandle(hSnapshot);
397891 }
398- return bResult;
399-}
400-
401-// DLLを確認
402-// ハッシュが登録されている、Authenticode署名がされている、またはWFPによる保護下にあることを確認
403-BOOL IsModuleTrustedA(LPCSTR Filename)
404-{
405- BOOL r = FALSE;
406- wchar_t* pw0 = NULL;
407- pw0 = DuplicateAtoW(Filename, -1);
408- r = IsModuleTrustedW(pw0);
409892 FreeDuplicatedString(pw0);
410- return r;
411-}
412-
413-// DLLを確認
414-// ハッシュが登録されている、Authenticode署名がされている、またはWFPによる保護下にあることを確認
415-BOOL IsModuleTrustedW(LPCWSTR Filename)
416-{
417- BOOL bResult;
418- WCHAR Path[MAX_PATH];
419- LPWSTR p;
420- BYTE Hash[16];
421- GUID g = WINTRUST_ACTION_GENERIC_VERIFY_V2;
422- WINTRUST_FILE_INFO wfi;
423- WINTRUST_DATA wd;
424- bResult = FALSE;
425- if(wcsrchr(Filename, '.') > wcsrchr(Filename, '\\'))
426- {
427- if(SearchPathW(NULL, Filename, NULL, MAX_PATH, Path, &p) > 0)
428- Filename = Path;
429- }
430- else
431- {
432- if(SearchPathW(NULL, Filename, L".dll", MAX_PATH, Path, &p) > 0)
433- Filename = Path;
434- }
435- if(GetMD5HashOfFile(Filename, &Hash))
436- {
437- if(FindModuleMD5Hash(&Hash))
438- bResult = TRUE;
439- }
440- if(!bResult)
441- {
442- ZeroMemory(&wfi, sizeof(WINTRUST_FILE_INFO));
443- wfi.cbStruct = sizeof(WINTRUST_FILE_INFO);
444- wfi.pcwszFilePath = Filename;
445- ZeroMemory(&wd, sizeof(WINTRUST_DATA));
446- wd.cbStruct = sizeof(WINTRUST_DATA);
447- wd.dwUIChoice = WTD_UI_NONE;
448- wd.dwUnionChoice = WTD_CHOICE_FILE;
449- wd.pFile = &wfi;
450- if(WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd) == ERROR_SUCCESS)
451- bResult = TRUE;
452- }
453- if(!bResult)
454- {
455- if(SfcIsFileProtected(NULL, Filename))
456- bResult = TRUE;
457- }
458-// if(!bResult)
459-// {
460-// WCHAR Temp[MAX_PATH + 128];
461-// _swprintf(Temp, L"Untrusted module was detected! \"%s\"\n", Filename);
462-// OutputDebugStringW(Temp);
463-// }
464893 return bResult;
465894 }
466895
467896 // 関数ポインタを使用可能な状態に初期化
468897 BOOL InitializeLoadLibraryHook()
469898 {
899+ BOOL bResult;
470900 HMODULE hModule;
471- hModule = GetModuleHandleW(L"kernel32.dll");
472- GET_FUNCTION(hModule, LoadLibraryA);
473- GET_FUNCTION(hModule, LoadLibraryW);
474- GET_FUNCTION(hModule, LoadLibraryExA);
475- GET_FUNCTION(hModule, LoadLibraryExW);
476- hModule = GetModuleHandleW(L"ntdll.dll");
477- GET_FUNCTION(hModule, LdrLoadDll);
478- GET_FUNCTION(hModule, LdrGetDllHandle);
479- GET_FUNCTION(hModule, LdrAddRefDll);
480- return TRUE;
901+ bResult = TRUE;
902+ if(!(hModule = GetModuleHandleW(L"kernel32.dll")))
903+ bResult = FALSE;
904+ if(!(GET_FUNCTION(hModule, LoadLibraryA)))
905+ bResult = FALSE;
906+ if(!(GET_FUNCTION(hModule, LoadLibraryW)))
907+ bResult = FALSE;
908+ if(!(GET_FUNCTION(hModule, LoadLibraryExA)))
909+ bResult = FALSE;
910+ if(!(GET_FUNCTION(hModule, LoadLibraryExW)))
911+ bResult = FALSE;
912+ if(!(hModule = GetModuleHandleW(L"ntdll.dll")))
913+ bResult = FALSE;
914+ if(!(GET_FUNCTION(hModule, LdrLoadDll)))
915+ bResult = FALSE;
916+ if(!(GET_FUNCTION(hModule, LdrGetDllHandle)))
917+ bResult = FALSE;
918+ if(!(GET_FUNCTION(hModule, RtlImageNtHeader)))
919+ bResult = FALSE;
920+ if(!(hModule = LoadLibraryW(L"wintrust.dll")))
921+ bResult = FALSE;
922+ if(!(GET_FUNCTION(hModule, CryptCATAdminCalcHashFromFileHandle)))
923+ bResult = FALSE;
924+ return bResult;
481925 }
482926
483927 // SetWindowsHookEx対策
484928 // DLL Injectionされた場合は上のh_LoadLibrary系関数でトラップ可能
485929 BOOL EnableLoadLibraryHook(BOOL bEnable)
486930 {
931+ BOOL bResult;
932+ bResult = FALSE;
487933 if(bEnable)
488934 {
489- // 検証に必要なDLLの遅延読み込み回避
490- IsModuleTrustedA("");
935+ bResult = TRUE;
491936 #ifdef USE_CODE_HOOK
492- SET_HOOK_FUNCTION(LoadLibraryA);
493- SET_HOOK_FUNCTION(LoadLibraryW);
494- SET_HOOK_FUNCTION(LoadLibraryExA);
495- SET_HOOK_FUNCTION(LoadLibraryExW);
937+ if(!SET_HOOK_FUNCTION(LoadLibraryA))
938+ bResult = FALSE;
939+ if(!SET_HOOK_FUNCTION(LoadLibraryW))
940+ bResult = FALSE;
941+ if(!SET_HOOK_FUNCTION(LoadLibraryExA))
942+ bResult = FALSE;
943+ if(!SET_HOOK_FUNCTION(LoadLibraryExW))
944+ bResult = FALSE;
496945 #endif
497946 #ifdef USE_IAT_HOOK
498- HookFunctionInIAT(p_LoadLibraryA, h_LoadLibraryA);
499- HookFunctionInIAT(p_LoadLibraryW, h_LoadLibraryW);
500- HookFunctionInIAT(p_LoadLibraryExA, h_LoadLibraryExA);
501- HookFunctionInIAT(p_LoadLibraryExW, h_LoadLibraryExW);
947+ if(!HookFunctionInIAT(p_LoadLibraryA, h_LoadLibraryA))
948+ bResult = FALSE;
949+ if(!HookFunctionInIAT(p_LoadLibraryW, h_LoadLibraryW))
950+ bResult = FALSE;
951+ if(!HookFunctionInIAT(p_LoadLibraryExA, h_LoadLibraryExA))
952+ bResult = FALSE;
953+ if(!HookFunctionInIAT(p_LoadLibraryExW, h_LoadLibraryExW))
954+ bResult = FALSE;
502955 #endif
503956 }
504957 else
505958 {
959+ bResult = TRUE;
506960 #ifdef USE_CODE_HOOK
507- END_HOOK_FUNCTION(LoadLibraryA);
508- END_HOOK_FUNCTION(LoadLibraryW);
509- END_HOOK_FUNCTION(LoadLibraryExA);
510- END_HOOK_FUNCTION(LoadLibraryExW);
961+ if(!END_HOOK_FUNCTION(LoadLibraryA))
962+ bResult = FALSE;
963+ if(!END_HOOK_FUNCTION(LoadLibraryW))
964+ bResult = FALSE;
965+ if(!END_HOOK_FUNCTION(LoadLibraryExA))
966+ bResult = FALSE;
967+ if(!END_HOOK_FUNCTION(LoadLibraryExW))
968+ bResult = FALSE;
511969 #endif
512970 #ifdef USE_IAT_HOOK
513- HookFunctionInIAT(h_LoadLibraryA, p_LoadLibraryA);
514- HookFunctionInIAT(h_LoadLibraryW, p_LoadLibraryW);
515- HookFunctionInIAT(h_LoadLibraryExA, p_LoadLibraryExA);
516- HookFunctionInIAT(h_LoadLibraryExW, p_LoadLibraryExW);
971+ if(!HookFunctionInIAT(h_LoadLibraryA, p_LoadLibraryA))
972+ bResult = FALSE;
973+ if(!HookFunctionInIAT(h_LoadLibraryW, p_LoadLibraryW))
974+ bResult = FALSE;
975+ if(!HookFunctionInIAT(h_LoadLibraryExA, p_LoadLibraryExA))
976+ bResult = FALSE;
977+ if(!HookFunctionInIAT(h_LoadLibraryExW, p_LoadLibraryExW))
978+ bResult = FALSE;
517979 #endif
518980 }
519- return TRUE;
981+ return bResult;
520982 }
521983
522984 // ReadProcessMemory、WriteProcessMemory、CreateRemoteThread対策
--- a/protectprocess.h
+++ b/protectprocess.h
@@ -45,11 +45,10 @@ EXTERN_HOOK_FUNCTION_VAR(LoadLibraryExW)
4545 #endif
4646
4747 HMODULE System_LoadLibrary(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags);
48-BOOL RegisterModuleMD5Hash(void* pHash);
49-BOOL UnregisterModuleMD5Hash(void* pHash);
50-BOOL FindModuleMD5Hash(void* pHash);
51-BOOL IsModuleTrustedA(LPCSTR Filename);
52-BOOL IsModuleTrustedW(LPCWSTR Filename);
48+BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash);
49+BOOL RegisterTrustedModuleMD5Hash(void* pHash);
50+BOOL UnregisterTrustedModuleMD5Hash(void* pHash);
51+BOOL UnloadUntrustedModule();
5352 BOOL InitializeLoadLibraryHook();
5453 BOOL EnableLoadLibraryHook(BOOL bEnable);
5554 BOOL RestartProtectedProcess(LPCTSTR Keyword);
--- a/ras.c
+++ b/ras.c
@@ -29,7 +29,8 @@
2929
3030 #define STRICT
3131
32-#define WINVER 0x400
32+// UTF-8対応
33+//#define WINVER 0x400
3334
3435 #include <windows.h>
3536 #include <stdio.h>
--- a/socketwrapper.c
+++ b/socketwrapper.c
@@ -5,8 +5,6 @@
55 // コンパイルにはOpenSSLのヘッダーファイルが必要
66 // 実行にはOpenSSLのDLLが必要
77
8-#define _WIN32_WINNT 0x0600
9-
108 #include <windows.h>
119 #include <mmsystem.h>
1210 #include <openssl/ssl.h>
@@ -71,9 +69,9 @@ BOOL LoadOpenSSL()
7169 #ifdef ENABLE_PROCESS_PROTECTION
7270 // ssleay32.dll 1.0.0e
7371 // libssl32.dll 1.0.0e
74- RegisterModuleMD5Hash("\x8B\xA3\xB7\xB3\xCE\x2E\x4F\x07\x8C\xB8\x93\x7D\x77\xE1\x09\x3A");
72+ RegisterTrustedModuleMD5Hash("\x8B\xA3\xB7\xB3\xCE\x2E\x4F\x07\x8C\xB8\x93\x7D\x77\xE1\x09\x3A");
7573 // libeay32.dll 1.0.0e
76- RegisterModuleMD5Hash("\xA6\x4C\xAF\x9E\xF3\xDC\xFC\x68\xAE\xCA\xCC\x61\xD2\xF6\x70\x8B");
74+ RegisterTrustedModuleMD5Hash("\xA6\x4C\xAF\x9E\xF3\xDC\xFC\x68\xAE\xCA\xCC\x61\xD2\xF6\x70\x8B");
7775 #endif
7876 g_hOpenSSL = LoadLibrary("ssleay32.dll");
7977 if(!g_hOpenSSL)