C / C++ / MFC

Garth J Lancaster wrote:

Using Matt Pietrek's notes on the PE format etc, maybe you can create a value in the .DATA segment (or such), and write directly back into the exe, by locating that segment/value in the compiled exe ??

Garth J Lancaster wrote:

store the data in the resource table - it can be modified by adding a custom post build step to fang off a program to edit the resource value

Garth J Lancaster wrote:

Looking forward to reading your article (as always )

Garth J Lancaster wrote:

I'd have to do some more study to determine the feasibility

Garth J Lancaster wrote:

someone clever enough bypassing the tamper check routines themselves - ie injecting a routine that simply says the images match ...

Garth J Lancaster wrote:

but nice work and good reading

void CMyDlg::OnDeviceNotify()
{
	CString cs;
	HDEVNOTIFY *hdn = NULL;
	
	bool bDevInterResult = DoRegisterDeviceInterface(SOME_GUID, hdn) != 0;
	
	if (bDevInterResult)
	{
		cs.Format("Device notification : %d", bDevInterResult);
		MessageBox(cs);
	}
	else
	{
		MessageBox("Device Notification Registration failed");
	}
}

BOOL CMyDlg::DoRegisterDeviceInterface(GUID InterfaceClassGuid, HDEVNOTIFY *hDevNotify)
{
	DEV_BROADCAST_DEVICEINTERFACE NotificationFilter;
	char szMsg[80];
	
	ZeroMemory(&NotificationFilter, sizeof(NotificationFilter) );
	NotificationFilter.dbcc_size = sizeof(DEV_BROADCAST_DEVICEINTERFACE);
	NotificationFilter.dbcc_devicetype = DBT_DEVTYP_DEVICEINTERFACE;
	NotificationFilter.dbcc_classguid = InterfaceClassGuid;
	
	hDevNotify = (void **)RegisterDeviceNotification(GetSafeHwnd(),
		&NotificationFilter, DEVICE_NOTIFY_WINDOW_HANDLE);
	
	if (!*hDevNotify)
	{
		wsprintf(szMsg, "RegisterDeviceNotification failed: %d\n",
			GetLastError());
		MessageBox((const char*)GetSafeHwnd(),szMsg, MB_OK);
		return FALSE;
	}
	
	return TRUE;
}

BOOL CMyDlg::OnDeviceChange(UINT nEventType, DWORD dwData)
{
	MessageBox("Device Change Occurred");
	
	DEV_BROADCAST_HDR *lpdbh= (DEV_BROADCAST_HDR *)dwData;
	
	switch (nEventType)
	{
		case DBT_DEVICEARRIVAL:
			MessageBox("New Device Arrived");
			break;
			
		case DBT_DEVICEREMOVECOMPLETE:
			MessageBox("Device Removed");
			break;
	}
	return TRUE;
}