About CreateIpcQueue Mechanism

c++ / delphi package - dll injection and api hooking
Post Reply
Aquarius_1983
Posts: 17
Joined: Sun Apr 03, 2005 7:39 am

About CreateIpcQueue Mechanism

Post by Aquarius_1983 »

sir, i trace the function and find that it use mutex,event,waitforsingle object and filemapping,your default filemapping maybe 4096 bytes.

now i find a topic which you answer shannon,there you said you use pipe to implement these function.but i don't find any pipe in assembler code.please interpret it. :crazy:

because i want to use CreateIpcQueueEx to make a Queue to transfer data maybe reach 100K,so i should make sure the Queue is safe.
nildo
Posts: 249
Joined: Mon Mar 22, 2004 11:32 am
Contact:

Re: About CreateIpcQueue Mechanism

Post by nildo »

Aquarius_1983 wrote:because i want to use CreateIpcQueueEx to make a Queue to transfer data maybe reach 100K,so i should make sure the Queue is safe.
Why don't you create a FileMapping, put your 100k data there, and send just the Pointer to that FileMapping, then your APP can read it normaly?
Aquarius_1983
Posts: 17
Joined: Sun Apr 03, 2005 7:39 am

Re: About CreateIpcQueue Mechanism

Post by Aquarius_1983 »

nildo wrote:
Aquarius_1983 wrote:because i want to use CreateIpcQueueEx to make a Queue to transfer data maybe reach 100K,so i should make sure the Queue is safe.
Why don't you create a FileMapping, put your 100k data there, and send just the Pointer to that FileMapping, then your APP can read it normaly?

because my scheduler manage function modules and share memory,so i should transfer data to it ,and my scheduler manage those modules' lifecycle.

I should manage it .In my first design ,i want to use service to read data.but in my practice,i can't read data by DLL which use interface.i don't know why.First i think it is caused by my access token.but i find delphi's service application has the same question. I don't know why,so i could only change my scheduler to the above.

by the way,i want to say,your demo service to injectlibrary has a logistic trap when you QueryServiceConfig :o .Why do you do these, :wink: . I don't believe that you have such a fault. 8)
xixi.
madshi
Site Admin
Posts: 10766
Joined: Sun Mar 21, 2004 5:25 pm

Re: About CreateIpcQueue Mechanism

Post by madshi »

Aquarius_1983 wrote:sir, i trace the function and find that it use mutex,event,waitforsingle object and filemapping,your default filemapping maybe 4096 bytes.

now i find a topic which you answer shannon,there you said you use pipe to implement these function.but i don't find any pipe in assembler code.please interpret it.
I am using a pipe. Don't know why it doesn't show for you in assembler code... :wink:
Aquarius_1983 wrote:because i want to use CreateIpcQueueEx to make a Queue to transfer data maybe reach 100K,so i should make sure the Queue is safe.
madCodeHook's IPC functions are not meant to be used for such big packets. I think in win9x there are some problems when transporting such big data sizes over pipes.
Aquarius_1983 wrote:because my scheduler manage function modules and share memory,so i should transfer data to it ,and my scheduler manage those modules' lifecycle.

I should manage it .In my first design ,i want to use service to read data.but in my practice,i can't read data by DLL which use interface.i don't know why.First i think it is caused by my access token.but i find delphi's service application has the same question. I don't know why,so i could only change my scheduler to the above.
I don't really understand what you mean. Basically you can use nildo's suggestion, it should work. You can also use VirtualAllocEx + WriteProcessMemory to write the data directly to the target process and then just transport the pointer via SendIpcMessage or something like that.
Aquarius_1983 wrote:by the way,i want to say,your demo service to injectlibrary has a logistic trap when you QueryServiceConfig unbelievable .Why do you do these, wink . I don't believe that you have such a fault. cool
What do you mean with "logistic trap"? Do you mean there's a bug in my demo service? What bug?
Aquarius_1983
Posts: 17
Joined: Sun Apr 03, 2005 7:39 am

Re: About CreateIpcQueue Mechanism

Post by Aquarius_1983 »

-----Start of CreateIpcQueue(...)
i trace and it show me those code.i think it is funny and don't know why,you can trace it in delphi and see CPU Window.
because i must know how it work and decide which method i choose,i create process communicate using share memory before ,but i cann't write such a good Queue.

Do you interpret it to me?

push $..
push $..
call CreateIpcQueue
.....
call CreateIpcQueueEx
...
call AddAccessForEveryOne
...
call CreateGlobalMutex
...
call CreateGlobalFilemapping
...
ret
madshi
Site Admin
Posts: 10766
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

Don't know what you want to hear from me.
Aquarius_1983
Posts: 17
Joined: Sun Apr 03, 2005 7:39 am

Sorry,i have no other means.

Post by Aquarius_1983 »

madshi wrote:Don't know what you want to hear from me.
I am sorry that i offended you.
I don't have other meaning.we make products,so we must make sure all of our core modules is safe and high efficiency and then we will buy it.

I do this only because i have some requirement before,now we have changed. but i am still interest in how you write such a good pipe(i make millons of test and all of them is correct) .I am weak in asm so i want to make technology communication with you.If my trace is wrong,it appears that i am poor in delphi's advanced debug and i will improve on.
madshi
Site Admin
Posts: 10766
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

You didn't offend me. I'm just not sure what your real question is.

As I said, the main work in my IPC functions is done by pipes. Probably you traced the wrong function. CreateIpcQueue internally calls CreateIpcQueueEx, which does the real work.

My IPC functions work quite fine and stable, but they're too slow for my taste. So I'll rewrite them somewhen in a future version.
Aquarius_1983
Posts: 17
Joined: Sun Apr 03, 2005 7:39 am

Post by Aquarius_1983 »

No,in my actual test,your IPC Queue are safe and high effient.
I sent 1000,000 commands in a minute and received all of them.It is very good.So i traced it.
when we buy your code ,i want to research it.i can't believe that a PIPE can show me filemapping.it is too strange. :-x

my computer teconology is not very good especially in asm.may be i make a mistake.

by the way ,can you give me some document of access token control in NT/XP?i have some problems in service,may be i must change access token.
madshi
Site Admin
Posts: 10766
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

I never said that CreateIpcQueue only uses a pipe and nothing else. Other things like file mapping are also used. But the real IPC messages, the real data, goes through a pipe.
by the way ,can you give me some document of access token control in NT/XP?i have some problems in service,may be i must change access token.
Now sure exactly what problems you have. If you want normal users to be able to stop your service, you can call the following function (exported by madCodeHook) :

Code: Select all

function AddAccessForEveryone (processOrService, access: dword) : bool; stdcall;
If you create objects in your service (e.g. file mappings or such stuff) you should set up a security descriptor like this:

Code: Select all

procedure InitSecAttr(var sa: TSecurityAttributes; var sd: TSecurityDescriptor);
begin
  sa.nLength := sizeOf(sa);
  sa.lpSecurityDescriptor := @sd;
  sa.bInheritHandle := false;
  InitializeSecurityDescriptor(@sd, SECURITY_DESCRIPTOR_REVISION);
  SetSecurityDescriptorDacl(@sd, true, nil, false);
end;

var sa : TSecurityAttributes;
    sd : TSecurityDescriptor;
begin
  InitSecAttr(sa, sd);
  result := CreateMutex(@sa, ...);
Post Reply