C# How to output to GUI when data is coming via an interface via MarshalByRefObject?

Posted by Tom on Stack Overflow See other posts from Stack Overflow or by Tom
Published on 2010-05-27T22:00:11Z Indexed on 2010/05/27 22:01 UTC
Read the original article Hit count: 151

Filed under:
|

Hey, can someone please show me how i can write the output of OnCreateFile to a GUI? I thought the GUI would have to be declared at the bottom in the main function, so how do i then refer to it within OnCreateFile?

using System;
using System.Collections.Generic;
using System.Runtime.Remoting;
using System.Text;
using System.Diagnostics;
using System.IO;
using EasyHook;
using System.Drawing;
using System.Windows.Forms;

namespace FileMon
{
    public class FileMonInterface : MarshalByRefObject
    {
        public void IsInstalled(Int32 InClientPID)
        {

            //Console.WriteLine("FileMon has been installed in target {0}.\r\n", InClientPID);
        }

        public void OnCreateFile(Int32 InClientPID, String[] InFileNames)
        {
            for (int i = 0; i < InFileNames.Length; i++)
            {
                String[] s = InFileNames[i].ToString().Split('\t');

                if (s[0].ToString().Contains("ROpen"))
                {
                    //Console.WriteLine(DateTime.Now.Hour+":"+DateTime.Now.Minute+":"+DateTime.Now.Second+"."+DateTime.Now.Millisecond + "\t" + s[0] + "\t" + getProcessName(int.Parse(s[1])) + "\t" + getRootHive(s[2]));
                    Program.ff.enterText(DateTime.Now.Hour + ":" + DateTime.Now.Minute + ":" + DateTime.Now.Second + "." + DateTime.Now.Millisecond + "\t" + s[0] + "\t" + getProcessName(int.Parse(s[1])) + "\t" + getRootHive(s[2]));
                }
                else if (s[0].ToString().Contains("RQuery"))
                {
                    Console.WriteLine(DateTime.Now.Hour + ":" + DateTime.Now.Minute + ":" + DateTime.Now.Second + "." + DateTime.Now.Millisecond + "\t" + s[0] + "\t" + getProcessName(int.Parse(s[1])) + "\t" + getRootHive(s[2]));
                }
                else if (s[0].ToString().Contains("RDelete"))
                {
                    Console.WriteLine(DateTime.Now.Hour + ":" + DateTime.Now.Minute + ":" + DateTime.Now.Second + "." + DateTime.Now.Millisecond + "\t" + s[0] + "\t" + getProcessName(int.Parse(s[0])) + "\t" + getRootHive(s[1]));
                }
                else if (s[0].ToString().Contains("FCreate"))
                {
                    //Console.WriteLine(DateTime.Now.Hour+":"+DateTime.Now.Minute+":"+DateTime.Now.Second+"."+DateTime.Now.Millisecond + "\t" + s[0] + "\t" + getProcessName(int.Parse(s[1])) + "\t" + s[2]);
                }
            }
        }

        public void ReportException(Exception InInfo)
        {
            Console.WriteLine("The target process has reported an error:\r\n" + InInfo.ToString());
        }

        public void Ping()
        {
        }

        public String getProcessName(int ID)
        {
            String name = "";
            Process[] process = Process.GetProcesses();
            for (int i = 0; i < process.Length; i++)
            {
                if (process[i].Id == ID)
                {
                    name = process[i].ProcessName;
                }
            }
            return name;
        }

        public String getRootHive(String hKey)
        {
            int r = hKey.CompareTo("2147483648");
            int r1 = hKey.CompareTo("2147483649");
            int r2 = hKey.CompareTo("2147483650");
            int r3 = hKey.CompareTo("2147483651");
            int r4 = hKey.CompareTo("2147483653");

            if (r == 0)
            {
                return "HKEY_CLASSES_ROOT";
            }
            else if (r1 == 0)
            {
                return "HKEY_CURRENT_USER";
            }
            else if (r2 == 0)
            {
                return "HKEY_LOCAL_MACHINE";
            }
            else if (r3 == 0)
            {
                return "HKEY_USERS";
            }
            else if (r4 == 0)
            {
                return "HKEY_CURRENT_CONFIG";
            }
            else return hKey.ToString();
        }
    }

    class Program : System.Windows.Forms.Form
    {
        static String ChannelName = null;
        public static Form1 ff;

        Program() // ADD THIS CONSTRUCTOR
        {

            InitializeComponent();


        }

        static void Main()
        {

            try
            {

                Config.Register("A FileMon like demo application.", "FileMon.exe", "FileMonInject.dll");
                RemoteHooking.IpcCreateServer<FileMonInterface>(ref ChannelName, WellKnownObjectMode.SingleCall);
                Process[] p = Process.GetProcesses();
                for (int i = 0; i < p.Length; i++)
                {
                    try
                    {
                        RemoteHooking.Inject(p[i].Id, "FileMonInject.dll", "FileMonInject.dll", ChannelName);
                    }
                    catch (Exception e)
                    {
                    }
                }
            }
            catch (Exception ExtInfo)
            {
                Console.WriteLine("There was an error while connecting to target:\r\n{0}", ExtInfo.ToString());
            }


        }
    }
}

© Stack Overflow or respective owner

Related posts about c#

Related posts about gui