Download Pelles C here: http://www.pellesc.se
C:\clang>clang -c -m32 -Wall Hello.c -o Hello32.o
C:\clang>set INCLUDE=D:\VCForPython27\VC\include;D:\VCForPython27\WinSDK\Include
C:\clang>clang -c -m32 -Wall Hello.c -o Hello32.oQuoteCybersecurity researchers have uncovered a sophisticated malware campaign exploiting Microsoft Help Index Files (.mshi) to deliver the notorious PipeMagic backdoor, marking a significant evolution in the threat actors' tactics since the malware's first detection in 2022.
#define WIN32_LEAN_AND_MEAN
//#include <stdio.h> // clang needs different stdio.h
#include <windows.h>
#pragma comment(lib, "kernel32.lib")
#pragma comment(lib, "user32.lib")
void CheckFile(char *szFile);
int __cdecl puts(const char *string); // clang needs different stdio.h
TCHAR szBuffer[4096];
int ScanDir(char *szDir)
{
WIN32_FIND_DATA fdFile;
HANDLE hFile;
//int i = 0;
int nLen = lstrlen(szDir);
lstrcpy(szDir+nLen, "*-flat.md");
// OutputDebugString(szDir);
hFile = FindFirstFile(szDir, &fdFile);
if (hFile != INVALID_HANDLE_VALUE)
do {
if ((fdFile.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)
!= FILE_ATTRIBUTE_DIRECTORY) {
lstrcpy(szDir+nLen, fdFile.cFileName);
//puts(szDir);
//OutputDebugString(szDir);
CheckFile(szDir);
//i++;
}
} while (FindNextFile(hFile, &fdFile));
FindClose(hFile);
return 0;
}
void ParseField1(char *pStart, char *pEnd)
{
char *pPtr1 = pStart+2;
char *pPtr2 = szBuffer;
while (*pPtr1 != '|') { // until a new field separator
if (*pPtr1 != '\\') // avoid '\'
*pPtr2++ = *pPtr1;
if (*pPtr1 == ')') break; // end of function
pPtr1++;
}
*pPtr2++ = ';';
*pPtr2 = 0;
puts(szBuffer);
}
void CheckFile(char *szFile)
{
HANDLE hFile;
BYTE *pRows;
DWORD nMax, nRead;
hFile = CreateFile(szFile, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
if (hFile != INVALID_HANDLE_VALUE)
{
nMax = GetFileSize(hFile, NULL);
pRows = HeapAlloc(GetProcessHeap(), 0, nMax + 1);
//if (nMax > sizeof(szBuffer)) nMax = sizeof(szBuffer); // read only header
if (ReadFile(hFile, pRows, nMax, &nRead, NULL)) {
TCHAR *pPtr1, *pPtr2; //, *pPtr3;
CloseHandle(hFile);
*(pRows + nMax) = 0; // ensure 0
pPtr1 = (char*)pRows;
while (*pPtr1 != '|') pPtr1++; // find first '|'
if (pPtr1) {
while (*pPtr1 != 10) {
pPtr2 = pPtr1;
while (*pPtr2 != 10) pPtr2++; // find end of line
*pPtr2 = 0; // cut line
if (*pPtr1 != 10 && *(pPtr1+1) != '-' && *(pPtr1+2) != 'F')
ParseField1(pPtr1, pPtr2);
pPtr1 = pPtr2+1;
if (!*pPtr1 || *pPtr1 == 10) break;
}
}
} else CloseHandle(hFile);
HeapFree(GetProcessHeap(), 0, pRows);
}
}
int main(int argc, char **argv) {
char szDir[MAX_PATH];
lstrcpy(szDir, "gdiplus/");
ScanDir(szDir);
return 0;
}
Page created in 0.041 seconds with 14 queries.