Add files via upload

Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "Processya"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+winapi = { version = "0.3", features = ["tlhelp32", "winnt", "memoryapi", "handleapi", "processthreadsapi", "psapi"] }
+ntapi = "0.4.1"
+structopt = "0.3.26"
+once_cell = "1.19.0"
+
+

src/dump/dump.rs

@@ -0,0 +1,47 @@
+use std::ffi::CStr;
+use std::fs::OpenOptions;
+use winapi::shared::minwindef::LPVOID;
+use winapi::um::handleapi::CloseHandle;
+
+use winapi::um::tlhelp32::PROCESSENTRY32;
+use winapi::um::winnt::HANDLE;
+use crate::OPT;
+use crate::process::get_base_addr;
+use crate::utils::*;
+
+
+
+pub fn dump_file(entry: PROCESSENTRY32, h_proc: HANDLE) {
+    unsafe {
+        let filename = CStr::from_ptr(entry.szExeFile.as_ptr()).to_string_lossy().to_string();
+        println!("\n\x1b[0;35mDump {filename}{RESET}");
+        let outpath = format!("{}\\{}", OPT.outpath.to_string_lossy(), filename.replace(".", &format!("_dump{}.", entry.th32ProcessID)));
+        let mut outfile = match OpenOptions::new().write(true).read(true).create(true).truncate(true).open(&outpath) {
+            Ok(file) => file,
+            Err(e) => {
+                eprintln!("{RED}Failed to create file {outpath} : {e}{RESET}");
+                std::process::exit(1);
+            }
+        };
+        let base_addr = get_base_addr(entry.th32ProcessID).unwrap_or_else(|e| {
+            eprintln!("{RED}{e}{RESET}");
+            std::process::exit(1)
+        });
+
+
+        let sectionv = crate::dump::header::dump_header(h_proc, base_addr, &mut (0 as LPVOID), &mut outfile).unwrap_or_else(|e| {
+            eprintln!("{RED}Failed to read header of process in output file : {e}{RESET}");
+            CloseHandle(h_proc);
+            std::process::exit(1)
+        });
+
+        crate::dump::section::dump_section(&mut outfile, h_proc, &sectionv, base_addr).unwrap_or_else(|e|{
+            eprintln!("{RED}Error to dump section : {e}{RESET}");
+            CloseHandle(h_proc);
+            std::process::exit(1)
+        });
+    }
+}
+
+
+

src/dump/dump_child.rs

@@ -0,0 +1,62 @@
+use std::{io, ptr};
+use std::ffi::{c_char, CStr};
+use winapi::um::handleapi::INVALID_HANDLE_VALUE;
+use winapi::um::processthreadsapi::OpenProcess;
+use winapi::um::tlhelp32::{CreateToolhelp32Snapshot, Process32First, Process32Next, PROCESSENTRY32, TH32CS_SNAPPROCESS};
+use winapi::um::winnt::{PROCESS_QUERY_INFORMATION, PROCESS_SUSPEND_RESUME, PROCESS_VM_OPERATION, PROCESS_VM_READ};
+use crate::dump;
+use crate::utils::*;
+
+pub fn dump_child(entry: PROCESSENTRY32) {
+    match find_child(entry.th32ProcessID) {
+        Ok(child_proc) => {
+            for child in child_proc {
+                let mut child = child;
+                let new_name = unsafe {CStr::from_ptr(child.szExeFile.as_ptr()).to_string_lossy()}.replace(".", "_child.");
+                let new_name = new_name.as_bytes();
+                if new_name.len() < 260 {
+                    unsafe {
+                        ptr::copy(new_name.as_ptr() as *const c_char, child.szExeFile.as_mut_ptr(), new_name.len());
+                    }
+                    child.szExeFile[new_name.len()] = 0;
+                }
+                unsafe {
+                    let h_proc = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_SUSPEND_RESUME, 0, child.th32ProcessID);
+                    dump::dump::dump_file(child, h_proc);
+                }
+            }
+        }
+        Err(e) => eprintln!("{e}"),
+    }
+}
+
+
+
+pub fn find_child(parent_pid: u32) -> Result<Vec<PROCESSENTRY32>, String> {
+    let mut child_proc = Vec::new();
+    unsafe {
+        let snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+        if snapshot == INVALID_HANDLE_VALUE {
+            return Err(format!("{RED}failed to create snapshot for dump child process: {}{RESET}", io::Error::last_os_error()))
+        }
+        let mut entry: PROCESSENTRY32 = std::mem::zeroed();
+        entry.dwSize = std::mem::size_of::<PROCESSENTRY32>() as u32;
+        if Process32First(snapshot, &mut entry) != 0 {
+            loop {
+                if entry.th32ParentProcessID == parent_pid {
+                    child_proc.push(entry)
+                }
+                if Process32Next(snapshot, &mut entry) == 0 {
+                    break;
+                }
+            }
+        }else {
+            return Err(format!("{RED}failed to get info of first process : {}{RESET}", io::Error::last_os_error()));
+        }
+    }
+    if child_proc.len() != 0 {
+        Ok(child_proc)
+    }else {
+        Err(String::from("the process does not contain children"))
+    }
+}