Skip to content

Instantly share code, notes, and snippets.

@J1327
Created April 13, 2024 23:18
Show Gist options
  • Save J1327/ea71054fe98b2da21854ce17882307a4 to your computer and use it in GitHub Desktop.
Save J1327/ea71054fe98b2da21854ce17882307a4 to your computer and use it in GitHub Desktop.
...
SteppingHunter = {}
local function local_GUI_createButton(form, r, l, w, h, t, string, c, bool)
local obj = createButton(form)
obj.Left = l
obj.Width = w
obj.Height = h
obj.Top = t
obj.OnClick = string
if c ~= nil then
obj.Caption = c
end
if bool == nil then
else
obj.Enabled = bool
end
return obj
end
local function setHint(obj, string, boolean)
if obj == nil then
return
end
if string == nil then
return
end
obj.Hint = string
obj.ShowHint = true
end
local function local_autogues_type(address)
local eh = "Can't determinate type from nil."
if address == nil then
return error(eh)
end
if readByte(address) == nil then
return error(eh)
end
local cs = createStructure(address);
cs.autoGuess(address, '', 8);
local temp_type = cs.Element[0].Vartype
cs.destroy()
cs = nil;
return temp_type
end
local function local_GUI_symbol_check(register)
uds = enumRegisteredSymbols()
for i = 1, #uds do
if register == uds[i].address then
return uds[i].symbolname
end
end
end
if not readInteger(process) then
return
end
if SteppingHunter.mccf then
SteppingHunter.mccf.destroy()
SteppingHunter.mccf = nil;
end
if SteppingHunter.STACK3 then
pcall(function()
SteppingHunter.STACK3.destroy()
end)
SteppingHunter.STACK3 = nil;
end
local function local_S3_SV_update()
SteppingHunter.STACKVIEW.Items.clear()
local SVITEMS = SteppingHunter.STACKVIEW.Items
for i = 0, getMemoryViewForm().lvStacktraceData.Items.Count - 1 do
local item = SVITEMS.Add()
item.Caption = getMemoryViewForm().lvStacktraceData.Items.Item[i].Caption
item.SubItems.Text = getMemoryViewForm().lvStacktraceData.Items.Item[i].SubItems.text
local EY = item.SubItems[0]
local SIA = tostring(item.SubItems[0], 16)
if readInteger(SIA) then
local local_type = local_autogues_type(SIA)
local set
if (local_type == 0) then
set = "vtByte"
elseif (local_type == 1) then
set = "vtWord"
elseif (local_type == 2) then
set = "vtDword"
elseif (local_type == 3) then
set = "vtQword"
elseif (local_type == 4) then
set = "vtSingle"
elseif (local_type == 5) then
set = "vtDouble"
elseif (local_type == 6) then
set = "vtString"
elseif (local_type == 7) then
set = "vtString"
elseif (local_type == 12) then
set = "vtPointer"
end
item.SubItems.addText(set)
else
item.SubItems.addText("Register Value")
end
local class_name = getRTTIClassName("0x" .. EY) or "-"
item.SubItems.addText(class_name)
if item.SubItems[2] ~= "Register Value" then
local addvalue
if item.SubItems[2] == "vtByte" then
addvalue = readByte(item.SubItems[0])
elseif item.SubItems[2] == "vtWord" then
addvalue = readInteger(item.SubItems[0])
elseif item.SubItems[2] == "vtDword" then
addvalue = readInteger(item.SubItems[0])
elseif item.SubItems[2] == "vtQword" then
addvalue = readQword(item.SubItems[0])
elseif item.SubItems[2] == "vtString" then
addvalue = readString(item.SubItems[0], 64)
elseif item.SubItems[2] == "vtSingle" then
addvalue = readFloat(item.SubItems[0])
elseif item.SubItems[2] == "vtDouble" then
addvalue = readDouble(item.SubItems[0])
elseif item.SubItems[2] == "vtPointer" then
addvalue = string.format("%X", getAddress("[" .. item.SubItems[0] .. "]"))
end
item.SubItems.addText(addvalue)
else
item.SubItems.addText("-")
end
end
end
local function Call_S3()
SteppingHunter.STACK3 = createForm()
SteppingHunter.STACK3.UpdateOnStep = false
SteppingHunter.STACK3.Caption = "Stacktrace3"
SteppingHunter.STACK3.ClassName = "SteppingHunterSTACK3"
SteppingHunter.STACK3.Name = "FRMSteppingHunterSTACK3"
SteppingHunter.STACK3.setSize(800, 400)
SteppingHunter.STACKVIEW = createListView(SteppingHunter.STACK3)
SteppingHunter.STACKVIEW.BorderSize = 'bsNone'
SteppingHunter.STACKVIEW.ViewStyle = 'vsReport'
SteppingHunter.STACKVIEW.ScrollBars = 'ssAutoVertical'
SteppingHunter.STACKVIEW.ReadOnly = true
SteppingHunter.STACKVIEW.RowSelect = true
SteppingHunter.STACKVIEW.GridLines = true
SteppingHunter.STACKVIEW.OnClick = function()
getMemoryViewForm().HexadecimalView.Address = tonumber(SteppingHunter.STACKVIEW.Selected.SubItems[0], 16)
end
SteppingHunter.STACK3.OnClose = function()
SteppingHunter.STACK3.destroy()
SteppingHunter.STACKVIEW.destroy()
SteppingHunter.STACK3 = nil;
SteppingHunter.STACKVIEW = nil;
debugger_onBreakpoint = nil
end
SteppingHunter.STACK3.AutoSize = true
setProperty(SteppingHunter.STACK3, "BorderStyle", bsSizeable)
setProperty(SteppingHunter.STACKVIEW, "BorderStyle", bsSizeable)
SteppingHunter.STACKVIEW.Align = [[alClient]]
local HEAD1 = SteppingHunter.STACKVIEW.Columns.add()
HEAD1.Caption = "| Address |"
HEAD1.Width = 245
HEAD1.Alignment = 'taCenter'
local HEAD2 = SteppingHunter.STACKVIEW.Columns.add()
HEAD2.Caption = "| DWORD |"
HEAD2.Width = 112
HEAD2.Alignment = 'taCenter'
local HEAD3 = SteppingHunter.STACKVIEW.Columns.add()
HEAD3.Caption = "| Value |"
HEAD3.Width = 260
HEAD3.Alignment = 'taCenter'
local HEAD4 = SteppingHunter.STACKVIEW.Columns.add()
HEAD4.Caption = "| DWORD Type |"
HEAD4.Width = 40
HEAD4.Alignment = 'taCenter'
local HEAD5 = SteppingHunter.STACKVIEW.Columns.add()
HEAD5.Caption = "| Class |"
HEAD5.Width = 40
HEAD5.Alignment = 'taCenter'
local HEAD6 = SteppingHunter.STACKVIEW.Columns.add()
HEAD6.Caption = "| DWORD Value |"
HEAD6.Width = 40
HEAD6.Alignment = 'taCenter'
-- Based on Full view
getMemoryViewForm().stacktrace2.Parent.Owner.Items[0].OnClick(_)
local temp_collectedbyluagarbage = createMainMenu(SteppingHunter.STACK3)
temp_collectedbyluagarbage = nil;
itemss = createMenuItem(f)
itemss.Caption = " | Stack Kit (2) | "
SteppingHunter.STACK3.Menu.Items.add(itemss)
local REST_STK1 = createMenuItem(itemss)
REST_STK1.Caption = "Restore/Show Secondary Stack Window"
REST_STK1.OnClick = function()
getMemoryViewForm().stacktrace1.Enabled = true
getMemoryViewForm().Stacktrace1.OnClick(_)
end
itemss.add(REST_STK1)
local REST_STK2 = createMenuItem(itemss)
REST_STK2.Caption = "CHECK STACK"
REST_STK2.Checked = false
REST_STK2.OnClick = function()
if REST_STK2.Checked then
setProperty(SteppingHunter.STACK3, "UpdateOnStep", false)
setProperty(REST_STK2, "Checked", false)
else
setProperty(SteppingHunter.STACK3, "UpdateOnStep", true)
setProperty(REST_STK2, "Checked", true)
end
end
itemss.add(REST_STK2)
local REST_STK3 = createMenuItem(itemss)
REST_STK3.Caption = "UPDATE VIEW"
REST_STK3.OnClick = function()
if debug_isStepping() then local_S3_SV_update() end
end
itemss.add(REST_STK3)
end
SteppingHunter.mccf = createForm()
if targetIs64Bit() then
SteppingHunter.mccf.setSize(1056, 800)
else
SteppingHunter.mccf.setSize(1056, 600)
end
SteppingHunter.mccf.OnClose = function()
if SteppingHunter.STACK3 then SteppingHunter.STACK3.OnClose(_) end
SteppingHunter.mccf.destroy()
SteppingHunter.mccf = nil;
debugger_onBreakpoint = nil
end
SteppingHunter.mccf.Position = 'poScreenCenter'
SteppingHunter.mccf.Caption = '[ Stepping Hunter ] RTTI Stepping look up'
SteppingHunter.mccf.BorderStyle = 2
local lf = createListView(SteppingHunter.mccf)
lf.Anchors = [[akTop,akRight,akLeft]]
lf.setPosition(25, 25)
if targetIs64Bit() then
lf.setSize(945, 570)
else
lf.setSize(945, 360)
end
lf.BorderSize = 'bsNone'
lf.ViewStyle = 'vsReport'
lf.ScrollBars = 'ssAutoVertical'
lf.ReadOnly = true
lf.RowSelect = true
lf.GridLines = true
lf.OnClick = function()
if lf.Selected and (lf.Selected.SubItems.Count ~= 0) then
writeToClipboard(tostring(lf.Selected.SubItems[0]))
end
end
local lf_address = lf.Columns.add()
lf_address.Caption = "Register"
lf_address.Width = 80
lf_address.Alignment = 'taCenter'
local lf_class_name = lf.Columns.add()
lf_class_name.Caption = "Register value [HEX]"
lf_class_name.Width = 180
lf_class_name.Alignment = 'taCenter'
local lf_class_name = lf.Columns.add()
lf_class_name.Caption = "Class Name"
lf_class_name.Width = 180
lf_class_name.Alignment = 'taCenter'
local lf_class_name = lf.Columns.add()
lf_class_name.Caption = "vtType"
lf_class_name.Width = 180
lf_class_name.Alignment = 'taCenter'
local lf_class_name = lf.Columns.add()
lf_class_name.Caption = "As [DEC]"
lf_class_name.Width = 120
lf_class_name.Alignment = 'taCenter'
local lf_class_name = lf.Columns.add()
lf_class_name.Caption = "Unique Symbolname"
lf_class_name.Width = 200
lf_class_name.Alignment = 'taCenter'
SteppingHunter.ButtonCover = createGroupBox(SteppingHunter.mccf)
SteppingHunter.ButtonCover.Anchors = [[akTop,akRight]]
if targetIs64Bit() then
local items = lf.Items
items.Clear()
local item = items.Add()
item.Caption = "[RAX]"
item = items.Add()
item.Caption = "[RBX]"
item = items.Add()
item.Caption = "[RCX]"
item = items.Add()
item.Caption = "[RDX]"
item = items.Add()
item.Caption = "[RDI]"
item = items.Add()
item.Caption = "[RSI]"
item = items.Add()
item.Caption = "[RBP]"
item = items.Add()
item.Caption = "[RSP]"
item = items.Add()
item.Caption = "[R8]"
item = items.Add()
item.Caption = "[R9]"
item = items.Add()
item.Caption = "[R10]"
item = items.Add()
item.Caption = "[R11]"
item = items.Add()
item.Caption = "[R12]"
item = items.Add()
item.Caption = "[R13]"
item = items.Add()
item.Caption = "[R14]"
item = items.Add()
item.Caption = "[R15]"
item = items.Add()
item.Caption = "[RIP]"
local o = 50
local s = 25
SteppingHunter.ButtonCover.setPosition(975, 25)
SteppingHunter.ButtonCover.setSize(75, 555)
btn_a = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 0, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, RAX)
end, "[RAX]");
btn_b = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 30, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, RBX)
end, "[RBX]")
btn_c = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 60, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, RCX)
end, "[RCX]")
btn_d = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 90, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, RDX)
end, "[RDX]")
btn_i = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 120, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, RDI)
end, "[RDI]")
btn_s = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 150, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, RSI)
end, "[RSI]")
btn_p = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 180, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, RBP)
end, "[RBP]")
btn_e = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 210, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, RSP)
end, "[RSP]")
btn_aa = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 240, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, R8)
end, "[R8]")
btn_ab = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 270, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, R9)
end, "[R9]")
btn_ac = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 300, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, R10)
end, "[R10]")
btn_ad = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 330, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, R11)
end, "[R11]")
btn_ad = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 360, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, R12)
end, "[R12]")
btn_ae = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 390, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, R13)
end, "[R13]")
btn_af = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 420, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, R14)
end, "[R14]")
btn_ag = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 450, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, R15)
end, "[R15]")
btn_m = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 480, function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, RIP)
end, "[RIP]")
else
local items = lf.Items
items.Clear()
local item = items.Add()
item.Caption = "[EAX]"
item = items.Add()
item.Caption = "[EBX]"
item = items.Add()
item.Caption = "[ECX]"
item = items.Add()
item.Caption = "[EDX]"
item = items.Add()
item.Caption = "[EDI]"
item = items.Add()
item.Caption = "[ESI]"
item = items.Add()
item.Caption = "[EBP]"
item = items.Add()
item.Caption = "[ESP]"
item = items.Add()
item.Caption = "[EIP]"
local o = 50
local s = 25
SteppingHunter.ButtonCover.setPosition(975, 25)
SteppingHunter.ButtonCover.setSize(75, 325)
local btn_a = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 0,
function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, EAX)
end, "[EAX]")
local btn_b = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 30,
function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, EBX)
end, "[EBX]")
local btn_c = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 60,
function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, ECX)
end, "[ECX]")
local btn_d = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 90,
function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, EDX)
end, "[EDX]")
local btn_i = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 120,
function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, EDI)
end, "[EDI]")
local btn_s = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 150,
function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, ESI)
end, "[ESI]")
local btn_p = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 180,
function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, EBP)
end, "[EBP]")
local btn_e = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 210,
function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, ESP)
end, "[ESP]")
local btn_m = local_GUI_createButton(SteppingHunter.ButtonCover, nil, 0, 70, 30, 240,
function()
local userinput = inputQuery("REGISTER AS USER SYMBOL", nil, nil);
registerSymbol(userinput, EIP)
end, "[EIP]")
end
local btn_mm_3 = local_GUI_createButton(SteppingHunter.mccf, nil, 25, 200, 50, lf.Height + lf.Top + lf.Left, function()
if lf.Selected == nil then
return
end
createStructureForm(lf.Selected.SubItems[0])
end, "Create Dissect Structure")
setHint(btn_mm_3, "\n Still this is not full proof -- :P -- need better handling")
local btn_mm_4 = local_GUI_createButton(SteppingHunter.mccf, nil, 425, 400, 50, lf.Height + lf.Top + lf.Left + 50,
function()
Call_S3()
end, "\n Extended Stack view")
setHint(btn_mm_4, "\n Extended Stepping stack lookup..")
local btn_mm_0 = local_GUI_createButton(SteppingHunter.mccf, nil, 25, 400, 50,
lf.Height + lf.Top + lf.Left + btn_mm_3.Height, function()
if tostring(lf.Selected.SubItems[2]) ~= "Register Value " then
local a = AddressList.createMemoryRecord()
a.Address = lf.Selected.SubItems[0]
end
end, "\n Add selected register to Address List")
setHint(btn_mm_0, "\n Should add selected address from this list to current CEGUI addresslist")
function debugger_onBreakpoint()
local registers
if targetIs64Bit() then
registers = {{
name = "RAX",
value = RAX
}, {
name = "RBX",
value = RBX
}, {
name = "RCX",
value = RCX
}, {
name = "RDX",
value = RDX
}, {
name = "RDI",
value = RDI
}, {
name = "RSI",
value = RSI
}, {
name = "RBP",
value = RBP
}, {
name = "RSP",
value = RSP
}, {
name = "R8",
value = R8
}, {
name = "R9",
value = R9
}, {
name = "R10",
value = R10
}, {
name = "R11",
value = R11
}, {
name = "R12",
value = R12
}, {
name = "R13",
value = R13
}, {
name = "R14",
value = R14
}, {
name = "R15",
value = R15
}, {
name = "RIP",
value = RIP
}}
else
registers = {{
name = "EAX",
value = EAX
}, {
name = "EBX",
value = EBX
}, {
name = "ECX",
value = ECX
}, {
name = "EDX",
value = EDX
}, {
name = "EDI",
value = EDI
}, {
name = "ESI",
value = ESI
}, {
name = "EBP",
value = EBP
}, {
name = "ESP",
value = ESP
}, {
name = "EIP",
value = EIP
}}
end
local vtType
local usersymbol
for i = 0, lf.Items.Count - 1 do
local temp_item = lf.Items[i]
local r = registers[i + 1].value
rv = readInteger(r) or "-"
if type(rv) == "number" then
local adr = string.format("%X", r)
vtType = local_autogues_type(adr)
usersymbol = local_GUI_symbol_check(r) or "-"
if vtType then
if vtType == 0 then
vtType = "vtByte";
end
if vtType == 1 then
vtType = "vtWord (2-bytes)"
end
if vtType == 2 then
vtType = "vtDword (4-bytes)"
end
if vtType == 3 then
vtType = "vtQword (8-bytes)"
end
if vtType == 4 then
vtType = "vtSingle (Float)"
end
if vtType == 5 then
vtType = "vtDouble (Double)"
end
if vtType == 6 then
vtType = "vtString (String)" .. "\n" .. readString(r, 128)
end
if vtType == 7 then
vtType = "vtString (String)" .. "\n" .. readString(r, 128)
end
if vtType == 8 then
vtType = "vtPointer (Pointer)"
end
if vtType == 9 then
vtType = "vtPointer (Pointer)"
end
if vtType == 10 then
vtType = "vtPointer (Pointer)"
end
if vtType == 12 then
vtType = "vtPointer (Pointer)"
end
if vtType == 14 then
vtType = "vtPointer (Pointer)"
end
vtType = vtType .. "\n" .. "" .. "\n" .. usersymbol
end
else
if r == nil then
return
end
vtType = "Register Value " .. "\n" .. string.format("%d", r)
usersymbol = "-"
end
local class_name = getRTTIClassName(r) or "-"
temp_item.SubItems.text = string.format("%X", r) .. "\n" .. class_name .. "\n" .. vtType .. "\n" .. usersymbol
vtType = nil;
end
if SteppingHunter.STACK3 and (SteppingHunter.STACK3.UpdateOnStep) then
local_S3_SV_update()
end
end
debugger_onBreakpoint()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment