unit UWinDbg;

interface

uses
  Windows;

{

Access token
Communications device
Console input
Console screen buffer
+ Event
File
+ File mapping
Job
Mailslot
+ Mutex
Named pipe
Process
+ Semaphore
Socket
Thread
+ Waitable timer
}

implementation

uses
  SysUtils, TypInfo, Classes;

const
  {$IFDEF UNICODE}
  CSfx = 'W';
  {$ELSE}
  CSfx = 'A';
  {$ENDIF}

type
  THandleType = (htDuplicate, htMutex, htEvent, htSemaphore, htTimer, htFileMap);

  PIndexHandle = ^TIndexHandle;
  TIndexHandle = record
    Handle: THandle;
    HandleType: THandleType;
    Index: Integer;
  end;

  PJump = ^TJump;
  TJump = packed record
    OpCode: Byte;
    Distance: Pointer;
  end;

var
  GHandlesInfo: TMappedStrings;
  GIndexHandles: TSimpleRecordList;
  GSecAttr: PSecurityAttributes;
  GIsLoaded: Boolean;
//  GLogFile: TextFile;

function WinCloseHandle(hObject: THandle): BOOL; stdcall; external kernel32 name 'CloseHandle';

function WinDuplicateHandle(hSourceProcessHandle, hSourceHandle, hTargetProcessHandle: THandle; lpTargetHandle: PHandle; dwDesiredAccess: DWORD; bInheritHandle: BOOL; dwOptions: DWORD): BOOL; stdcall; external kernel32 name 'DuplicateHandle';

function WinCreateMutex(lpMutexAttributes: PSecurityAttributes; bInitialOwner: BOOL; lpName: PChar): THandle; stdcall; external kernel32 name 'CreateMutex' + CSfx;
function WinCreateMutexA(lpMutexAttributes: PSecurityAttributes; bInitialOwner: BOOL; lpName: PAnsiChar): THandle; stdcall; external kernel32 name 'CreateMutexA';
function WinCreateMutexW(lpMutexAttributes: PSecurityAttributes; bInitialOwner: BOOL; lpName: PWideChar): THandle; stdcall; external kernel32 name 'CreateMutexW';

function WinOpenMutex(dwDesiredAccess: DWORD; bInheritHandle: BOOL; lpName: PChar): THandle; stdcall; external kernel32 name 'OpenMutex' + CSfx;
function WinOpenMutexA(dwDesiredAccess: DWORD; bInheritHandle: BOOL; lpName: PAnsiChar): THandle; stdcall; external kernel32 name 'OpenMutexA';
function WinOpenMutexW(dwDesiredAccess: DWORD; bInheritHandle: BOOL; lpName: PWideChar): THandle; stdcall; external kernel32 name 'OpenMutexW';

function WinCreateEvent(lpEventAttributes: PSecurityAttributes; bManualReset, bInitialState: BOOL; lpName: PChar): THandle; stdcall; external kernel32 name 'CreateEvent' + CSfx;
function WinCreateEventA(lpEventAttributes: PSecurityAttributes; bManualReset, bInitialState: BOOL; lpName: PAnsiChar): THandle; stdcall; external kernel32 name 'CreateEventA';
function WinCreateEventW(lpEventAttributes: PSecurityAttributes; bManualReset, bInitialState: BOOL; lpName: PWideChar): THandle; stdcall; external kernel32 name 'CreateEventW';

function WinOpenEvent(dwDesiredAccess: DWORD; bInheritHandle: BOOL; lpName: PChar): THandle; stdcall; external kernel32 name 'OpenEvent' + CSfx;
function WinOpenEventA(dwDesiredAccess: DWORD; bInheritHandle: BOOL; lpName: PAnsiChar): THandle; stdcall; external kernel32 name 'OpenEventA';
function WinOpenEventW(dwDesiredAccess: DWORD; bInheritHandle: BOOL; lpName: PWideChar): THandle; stdcall; external kernel32 name 'OpenEventW';

function WinCreateSemaphore(lpSemaphoreAttributes: PSecurityAttributes; lInitialCount, lMaximumCount: Longint; lpName: PChar): THandle; stdcall; external kernel32 name 'CreateSemaphore' + CSfx;
function WinCreateSemaphoreA(lpSemaphoreAttributes: PSecurityAttributes; lInitialCount, lMaximumCount: Longint; lpName: PAnsiChar): THandle; stdcall; external kernel32 name 'CreateSemaphoreA';
function WinCreateSemaphoreW(lpSemaphoreAttributes: PSecurityAttributes; lInitialCount, lMaximumCount: Longint; lpName: PWideChar): THandle; stdcall; external kernel32 name 'CreateSemaphoreW';

function WinOpenSemaphore(dwDesiredAccess: DWORD; bInheritHandle: BOOL; lpName: PChar): THandle; stdcall; external kernel32 name 'OpenSemaphore' + CSfx;
function WinOpenSemaphoreA(dwDesiredAccess: DWORD; bInheritHandle: BOOL; lpName: PAnsiChar): THandle; stdcall; external kernel32 name 'OpenSemaphoreA';
function WinOpenSemaphoreW(dwDesiredAccess: DWORD; bInheritHandle: BOOL; lpName: PWideChar): THandle; stdcall; external kernel32 name 'OpenSemaphoreW';

function WinCreateWaitableTimer(lpTimerAttributes: PSecurityAttributes; bManualReset: BOOL; lpTimerName: PChar): THandle; stdcall; external kernel32 name 'CreateWaitableTimer' + CSfx;
function WinCreateWaitableTimerA(lpTimerAttributes: PSecurityAttributes; bManualReset: BOOL; lpTimerName: PAnsiChar): THandle; stdcall; external kernel32 name 'CreateWaitableTimerA';
function WinCreateWaitableTimerW(lpTimerAttributes: PSecurityAttributes; bManualReset: BOOL; lpTimerName: PWideChar): THandle; stdcall; external kernel32 name 'CreateWaitableTimerW';

function WinOpenWaitableTimer(dwDesiredAccess: DWORD; bInheritHandle: BOOL; lpTimerName: PChar): THandle; stdcall; external kernel32 name 'OpenWaitableTimer' + CSfx;
function WinOpenWaitableTimerA(dwDesiredAccess: DWORD; bInheritHandle: BOOL; lpTimerName: PAnsiChar): THandle; stdcall; external kernel32 name 'OpenWaitableTimerA';
function WinOpenWaitableTimerW(dwDesiredAccess: DWORD; bInheritHandle: BOOL; lpTimerName: PWideChar): THandle; stdcall; external kernel32 name 'OpenWaitableTimerW';

function WinCreateFileMapping(hFile: THandle; lpFileMappingAttributes: PSecurityAttributes; flProtect, dwMaximumSizeHigh, dwMaximumSizeLow: DWORD; lpName: PChar): THandle; stdcall; external kernel32 name 'CreateFileMapping' + CSfx;
function WinCreateFileMappingA(hFile: THandle; lpFileMappingAttributes: PSecurityAttributes; flProtect, dwMaximumSizeHigh, dwMaximumSizeLow: DWORD; lpName: PAnsiChar): THandle; stdcall; external kernel32 name 'CreateFileMappingA';
function WinCreateFileMappingW(hFile: THandle; lpFileMappingAttributes: PSecurityAttributes; flProtect, dwMaximumSizeHigh, dwMaximumSizeLow: DWORD; lpName: PWideChar): THandle; stdcall; external kernel32 name 'CreateFileMappingW';

function WinOpenFileMapping(dwDesiredAccess: DWORD; bInheritHandle: BOOL; lpName: PChar): THandle; stdcall; external kernel32 name 'OpenFileMapping' + CSfx;
function WinOpenFileMappingA(dwDesiredAccess: DWORD; bInheritHandle: BOOL; lpName: PAnsiChar): THandle; stdcall; external kernel32 name 'OpenFileMappingA';
function WinOpenFileMappingW(dwDesiredAccess: DWORD; bInheritHandle: BOOL; lpName: PWideChar): THandle; stdcall; external kernel32 name 'OpenFileMappingW';

procedure AddHandle(AHandleType: THandleType; AHandle: THandle; const AName: string); overload;
begin
  ............
end;

{$IFDEF UNICODE}
procedure AddHandle(AHandleType: THandleType; AHandle: THandle; const AName: AnsiString); inline; overload;
begin
  AddHandleStr(AHandleType, AHandle, string(AName));
end;
{$ENDIF}

procedure RemoveHandle(AHandle: THandle);
begin
  ...........
end;

procedure ProcAddressPatch(ASource, ADestination: Pointer);
var
  LNewJump: PJump;
  LOldProtect: Cardinal;
begin
  if VirtualProtect(ASource, SizeOf(TJump), PAGE_EXECUTE_READWRITE, LOldProtect) then
  begin
    LNewJump := PJump(ASource);
    LNewJump^.OpCode := $E9;  // jmp
    LNewJump^.Distance := Pointer(WPARAM(ADestination) - WPARAM(ASource) - 5);

    FlushInstructionCache(GetCurrentProcess, ASource, SizeOf(TJump));
    VirtualProtect(ASource, SizeOf(TJump), LOldProtect, @LOldProtect);
  end;
end;

function DbgCloseHandle(hObject: THandle): BOOL; stdcall;
begin
  try
    RemoveHandle(hObject);
  finally
    Result := WinCloseHandle(hObject);
  end;
end;

function DbgDuplicateHandle(hSourceProcessHandle, hSourceHandle,
  hTargetProcessHandle: THandle; lpTargetHandle: PHandle; dwDesiredAccess: DWORD;
  bInheritHandle: BOOL; dwOptions: DWORD): BOOL; stdcall;
begin
  Result := WinDuplicateHandle(hSourceProcessHandle, hSourceHandle, hTargetProcessHandle,
    lpTargetHandle, dwDesiredAccess, bInheritHandle, dwOptions);
  if Result then
    AddHandle(htDuplicate, lpTargetHandle^, '');
end;

function DbgCreateMutex(lpMutexAttributes: PSecurityAttributes; bInitialOwner: BOOL; lpName: PChar): THandle; stdcall;
begin
  Result := WinCreateMutex(lpMutexAttributes, bInitialOwner, lpName);
  if Result <> 0 then
    AddHandle(htMutex, Result, lpName);
end;

function DbgCreateMutexA(lpMutexAttributes: PSecurityAttributes; bInitialOwner: BOOL; lpName: PAnsiChar): THandle; stdcall;
begin
  Result := WinCreateMutexA(lpMutexAttributes, bInitialOwner, lpName);
  if Result <> 0 then
    AddHandle(htMutex, Result, lpName);
end;

function DbgCreateMutexW(lpMutexAttributes: PSecurityAttributes; bInitialOwner: BOOL; lpName: PWideChar): THandle; stdcall;
begin
  Result := WinCreateMutexW(lpMutexAttributes, bInitialOwner, lpName);
  if Result <> 0 then
    AddHandle(htMutex, Result, lpName);
end;

.....................

procedure PatchFunctions;
begin
  ProcAddressPatch(@Windows.CloseHandle, @DbgCloseHandle);

  ProcAddressPatch(@Windows.DuplicateHandle, @DbgDuplicateHandle);

  ProcAddressPatch(@Windows.CreateMutex, @DbgCreateMutex);
  ProcAddressPatch(@Windows.CreateMutexA, @DbgCreateMutexA);
  ProcAddressPatch(@Windows.CreateMutexW, @DbgCreateMutexW);

  ProcAddressPatch(@Windows.OpenMutex, @DbgOpenMutex);
  ProcAddressPatch(@Windows.OpenMutexA, @DbgOpenMutexA);
  ProcAddressPatch(@Windows.OpenMutexW, @DbgOpenMutexW);

  ProcAddressPatch(@Windows.CreateEvent, @DbgCreateEvent);
  ProcAddressPatch(@Windows.CreateEventA, @DbgCreateEventA);
  ProcAddressPatch(@Windows.CreateEventW, @DbgCreateEventW);

  ProcAddressPatch(@Windows.OpenEvent, @DbgOpenEvent);
  ProcAddressPatch(@Windows.OpenEventA, @DbgOpenEventA);
  ProcAddressPatch(@Windows.OpenEventW, @DbgOpenEventW);

  ProcAddressPatch(@Windows.CreateSemaphore, @DbgCreateSemaphore);
  ProcAddressPatch(@Windows.CreateSemaphoreA, @DbgCreateSemaphoreA);
  ProcAddressPatch(@Windows.CreateSemaphoreW, @DbgCreateSemaphoreW);

  ProcAddressPatch(@Windows.OpenSemaphore, @DbgOpenSemaphore);
  ProcAddressPatch(@Windows.OpenSemaphoreA, @DbgOpenSemaphoreA);
  ProcAddressPatch(@Windows.OpenSemaphoreW, @DbgOpenSemaphoreW);

  ProcAddressPatch(@Windows.CreateWaitableTimer, @DbgCreateWaitableTimer);
  ProcAddressPatch(@Windows.CreateWaitableTimerA, @DbgCreateWaitableTimerA);
  ProcAddressPatch(@Windows.CreateWaitableTimerW, @DbgCreateWaitableTimerW);

  ProcAddressPatch(@Windows.OpenWaitableTimer, @DbgOpenWaitableTimer);
  ProcAddressPatch(@Windows.OpenWaitableTimerA, @DbgOpenWaitableTimerA);
  ProcAddressPatch(@Windows.OpenWaitableTimerW, @DbgOpenWaitableTimerW);

  ProcAddressPatch(@Windows.CreateFileMapping, @DbgCreateFileMapping);
  ProcAddressPatch(@Windows.CreateFileMappingA, @DbgCreateFileMappingA);
  ProcAddressPatch(@Windows.CreateFileMappingW, @DbgCreateFileMappingW);

  ProcAddressPatch(@Windows.OpenFileMapping, @DbgOpenFileMapping);
  ProcAddressPatch(@Windows.OpenFileMappingA, @DbgOpenFileMappingA);
  ProcAddressPatch(@Windows.OpenFileMappingW, @DbgOpenFileMappingW);
end;

initialization
  PatchFunctions;

end;