3 replies to this topic

[CaptainClucks]

Ever want to use notepad to run or compile autoit scripts?

Well, a while ago I saw a post where Melba23 posted a script that added a menu entry to notepad and it was even able to detect what buttons you clicked and when I saw that I just HAD TO DO THIS.






Whenever you use a tool, the wrapper script for notepad will even save the file that's open for you when you run any tool and if a file is modified by tidy, the script will also reload the script into notepad.

The Script uses NomadMemory.au3 to get the file that's open in notepad, what I'm not so sure about is if the memory address range is different on different systems like vitsa or windows 7, I've only tested this on windows XP x86.

 NotePadWrapper.rar   11.2K   145 downloads

Edited by THAT1ANONYMOUSEDUDE, 12 March 2012 - 08:05 AM.

[Mat]

Interesting... What did you do to determine the memory location? I'll try it out for you on Vista (x86). I messed around with cheat engine but couldn't find much.

[CaptainClucks]

Interesting... What did you do to determine the memory location? I'll try it out for you on Vista (x86). I messed around with cheat engine but couldn't find much.

I basically ran this script a dozen times until I found the address it seemed to always exist in, because the string seems to appear in several locations depending on how you opened the file in notepad.

AutoIt        expandcollapse  popup

#RequireAdmin
#include <NomadMemory.au3>

HotKeySet("{ESC}","_EXIT")

SetPrivilege("SetDebugPrivilege", 1)

Global $Search = @ScriptFullPath; file full path
$PID = Run('NotePad.exe "' & $Search &'"')
Global $Mem_Open = _MemoryOpen(ProcessExists($PID))

Scan($Search,30000000)

Func Scan($Srch,$aEnd)
    Local $R
    For $I = 0 To $aEnd Step (1024 - BinaryLen(Binary($Srch)))
        If StringInStr( BinaryToString(StringReplace(_MemoryRead("0x" & Hex($I,8),$Mem_Open,"byte[1024]"),"00","")),$Search,2) Then
            $R = DeepScan($Srch,$I)
            If Not @error Then MsgBox(64,"Located","Dec:"&$R&@CR&"Address: "&("0x" & Hex(@extended,8)))
        EndIf
    Next
EndFunc

Func DeepScan($Str,$Start)
    Local $Data, $Address
    Local $Byte = "byte[" & BinaryLen(Binary($Str)) * 2 & "]"
    For $x = $Start To $Start + 1000 Step 1
        ToolTip($Byte&" DeepScan>"&$x)
        $Address = ("0x" & Hex($x,8))
        $Data = BinaryToString(StringReplace(_MemoryRead($Address,$Mem_Open,$Byte),"00",""))
        If StringInStr($Data,$Str,2) Then
            ConsoleWrite($x & " > " & $Address & " <> " & $Data &  @CR)
            If StringStripWS($Data,3) == $Str Then
                ToolTip('')
                Return SetError(0,$Address,$x)
            EndIf
        EndIf
    Next
    ToolTip('')
    Return SetError(1,"","")
EndFunc

Func _Exit()
    Exit
EndFunc

If you drag and drop the file into notepad under windows xp (if it's the same on your machine...), you'll notice that the string seems to appear in fewer locations than if you were to open it with the fileopendialog or load it the way the above script does.

But it always seems to appear at 0x0100A900

Edited by THAT1ANONYMOUSEDUDE, 12 March 2012 - 12:26 PM.

[CaptainClucks]

Well, I finally got on a windows 7 x86 PC to test this and found that there is not absolute memory address that the file string will be located, this is what I've got for now.

AutoIt        expandcollapse  popup

#RequireAdmin
#region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_Icon=tt.ico
#AutoIt3Wrapper_Outfile=.NotePadWrapper.exe
#AutoIt3Wrapper_Compression=4
#AutoIt3Wrapper_UseUpx=n
#AutoIt3Wrapper_Res_Comment=Wrapper for the windows notepad on Windows XP
#AutoIt3Wrapper_Res_Description=NotePad Wrapper
#AutoIt3Wrapper_Res_Fileversion=1.0.0.6
#AutoIt3Wrapper_Res_Fileversion_AutoIncrement=y
#AutoIt3Wrapper_Res_LegalCopyright=AutoIt Community
#AutoIt3Wrapper_Res_Language=1033
#AutoIt3Wrapper_Res_requestedExecutionLevel=asInvoker
#AutoIt3Wrapper_Run_Obfuscator=y
#Obfuscator_Parameters=/so
#endregion ;**** Directives created by AutoIt3Wrapper_GUI ****
#include <WindowsConstants.au3>
#include <GuiConstants.au3>
#include <NomadMemory.au3>
#include <GuiMenu.au3>
#include <GuiEdit.au3>
#include <Misc.au3>
#include <File.au3>
_GetPrivilege_SEDEBUG()
HotKeySet('{ESC}', '_OnExit')
Global $hWnd, $hMenu, $sCurrent_Item = ""
Global $Operation
Global $PID
Global $mHwnd
Global $AutoItWrapper = RegRead("HKEY_LOCAL_MACHINESOFTWAREAutoIt v3AutoIt", "InstallDir")
Global $Tidy
If @error Then
    MsgBox(16, "Error!", "Error reading autoit installation path!")
    Exit
Else
    $Tidy = FileGetShortName($AutoItWrapper & "SciTEtidytidy.exe")
    $AutoItWrapper = FileGetShortName($AutoItWrapper & "SciTEAutoIt3WrapperAutoIt3Wrapper.exe")
    If FileExists($AutoItWrapper) Then
        ConsoleWrite("AutoIt3Wrapper Found! > " & $AutoItWrapper & @CR)
        ConsoleWrite("Tidy Found! > " & $Tidy & @CR)
    EndIf
EndIf
;SetPrivilege("SetDebugPrivilege", 1)
Global $aCmdID[5][2] = [ _
        ["&Run", 0x2000], _
        ["&Build", 0x2100], _
        ["", 0], _
        ["&Syntax Check", 0x2200], _
        ["&Tidy", 0x2300]]
Global $Entries = UBound($aCmdID) - 1
; Open DLL for IsPressed
Global Const $hUSER32 = DllOpen("user32.dll")
Global Const $hKERNEL32 = DllOpen("kernel32.dll")
Global $hdbg
Global $STDERR_VIEW
$PID = Run("Notepad.exe")
WinWaitActive("[CLASS:Notepad]")
$hWnd = WinGetHandle("[CLASS:Notepad]")
Main()
Func Main()
    Local $FilePath
    Local $Split
    Local $Datum
    Local $Title = WinGetTitle($hWnd)
    Local $Title_Old = False
    _InsertMenu()
    While 1
        ; Check status of Notepad menubar
        $aInfo = _GUICtrlMenu_GetMenuBarInfo($hWnd)
        ; If menu is active
        If $aInfo[6] = True Then
            ; Run through our added items to see if they are active
            $sCurrent_Item = ""
            For $i = 0 To $Entries
                If _GUICtrlMenu_GetItemHighlighted($hMenu, $aCmdID[$i][1], False) Then
                    ; If active, get text
                    If $aCmdID[$i][0] <> $sCurrent_Item Then $sCurrent_Item = $aCmdID[$i][0]
                EndIf
            Next
        EndIf
        ; If one of our menu items was selected
        If $sCurrent_Item <> "" Then
            $Title = WinGetTitle($hWnd)
            ; If mouse clicked or Enter pressed
            If _IsPressed("01", $hUSER32) Or _IsPressed("0D", $hUSER32) Then
                If Not ($Title == $Title_Old) Then
                    $Title_Old = $Title
                    $FilePath = _GetOpenFile($Title)
                EndIf
                If @error Then
                    While _IsPressed("0D", $hUSER32) Or _IsPressed("01", $hUSER32)
                        Sleep(10)
                    WEnd
                    MsgBox(16, "Error!", "Notepad doesn't seem to have a file open at the moment." & @CRLF & "@Error Code: " & @error)
                    $sCurrent_Item = ""
                    ContinueLoop
                Else
                    $Split = StringSplit($FilePath, "", 2)
                    $Datum = ''
                    For $i = 0 To UBound($Split) - 2
                        $Datum &= $Split[$i] & ""
                    Next
                    FileChangeDir($Datum)
                EndIf
                $Operation = StringReplace($sCurrent_Item, "&", "")
                ConsoleWrite($Operation & @CRLF)
                Switch $Operation
                    Case "Run"
                        _Save()
                        _Execute($AutoItWrapper & ' /run /prod /in "' & $FilePath & '"')
                    Case "Build"
                        _Save()
                        _Execute($AutoItWrapper & ' /ShowGui /in "' & $FilePath & '"', 1)
                        _Reload($FilePath)
                    Case "Syntax Check"
                        _Save()
                        _Execute($AutoItWrapper & ' /prod /AU3Check /in "' & $FilePath & '"')
                    Case "Tidy"
                        _Save()
                        $Datum = _TempFile(@WorkingDir, "~Tidy", ".au3")
                        FileCopy($FilePath, $Datum, 1)
                        _Execute($Tidy & ' "' & FileGetShortName($Datum) & '"')
                        _Reload($FilePath, $Datum)
                EndSwitch
                ; Prevent "double tap"
                $sCurrent_Item = ""
                ; Wait until mouse/Enter released
                While _IsPressed("0D", $hUSER32) Or _IsPressed("01", $hUSER32)
                    Sleep(10)
                WEnd
            EndIf
        EndIf
        Sleep(10)
        ; Exit if Notepad is closed
        If Not WinExists("[CLASS:Notepad]") Then _OnExit()
        $Operation = ""
    WEnd
EndFunc   ;==>Main
Func _Reload($Path, $Tmp = '')
    $NotePad = FileGetShortName(@WindowsDir & "NotePad.exe")
    ProcessClose($PID)
    If FileExists($Tmp) Then
        FileCopy($Tmp, $Path, 1)
        FileDelete($Tmp)
    EndIf
    $PID = Run($NotePad & ' "' & $Path & '"')
    WinWaitActive("[CLASS:Notepad]")
    $hWnd = WinGetHandle("[CLASS:Notepad]")
    _InsertMenu()
EndFunc   ;==>_Reload
Func _Execute($String, $type = 0)
    If $type Then Return Run($String)
    Local $ID, $line, $nMsg
    $STDERR_VIEW = GUICreate("Console Debug Info", 617, 311, -1, -1, BitOR($GUI_SS_DEFAULT_GUI, $WS_SIZEBOX, $WS_THICKFRAME, $DS_MODALFRAME), BitOR($WS_EX_APPWINDOW, $WS_EX_TOOLWINDOW, $WS_EX_WINDOWEDGE))
    GUISetBkColor(0x000000)
    $hdbg = GUICtrlCreateEdit("", 0, 0, 617, 311)
    GUICtrlSetResizing(-1, $GUI_DOCKAUTO)
    GUICtrlSetFont(-1, 10, 500, "", "Consolas")
    GUICtrlSetBkColor(-1, 0x000000)
    GUICtrlSetColor(-1, 0x00ff00)
    GUISetState(@SW_SHOW)
    $ID = Run($String, "", @SW_HIDE, 2 + 4)
    While 1
        $line = StdoutRead($ID)
        If @error Then ExitLoop
        ConsoleWrite2($line)
    WEnd
    While 1
        $nMsg = GUIGetMsg($STDERR_VIEW)
        Switch $nMsg
            Case -3
                ExitLoop
        EndSwitch
    WEnd
    GUIDelete($STDERR_VIEW)
    Return
EndFunc   ;==>_Execute
Func ConsoleWrite2($data)
    If Not $data Then Return
    _GUICtrlEdit_AppendText($hdbg, $data)
    Return
EndFunc   ;==>ConsoleWrite2
Func _Save()
    WinActivate("[CLASS:Notepad]")
    Send("^s")
    Return
EndFunc   ;==>_Save
Func _GetOpenFile($Title);Return file path of file open in notepad
    Local $data
    $data = _MemoryRead(0x000AD5CB, $mHwnd, "byte[256]"); address when file was dropped in notepad / xp
    $data = BinaryToString(StringReplace($data, "00", "")); strip the null chars
    If FileExists($data) Then Return SetError(0, 1, $data)
    $data = _MemoryRead(0x0057F5CD, $mHwnd, "byte[150]"); address when file was dropped in notepad / xp
    $data = BinaryToString(StringReplace($data, "00", "")); strip the null chars
    If FileExists($data) Then Return SetError(0, 2, $data)
    $data = _MemoryRead(0x01009620, $mHwnd, "byte[256]"); address when file was dropped in notepad / xp
    $data = BinaryToString(StringReplace($data, "00", "")); strip the null chars
    If FileExists($data) Then Return SetError(0, 3, $data)
    $data = _MemoryRead(0x0100A900, $mHwnd, "byte[256]"); Secondary address when file is selected via the open file dialog
    $data = BinaryToString(StringReplace($data, "00", ""))
    If FileExists($data) Then Return SetError(0, 4, $data)
    ; everything failed, must be on vista / 7
    TrayTip("Searching notepad memory...", "Sorry. but the open file was not detected, searching for the open file manually...", 10, 1)
    $data = Scan(StringReplace($Title, " - NotePad", ""), 20000000)
    If Not @error Then
        If FileExists($data) Then Return SetError(0, 0, $data)
    EndIf
    Return SetError(1, 0, False)
EndFunc   ;==>_GetOpenFile
Func Scan($Srch, $aEnd)
    Local $R
    For $i = 0 To $aEnd Step (1024)
        If StringInStr(BinaryToString(StringReplace(_MemoryRead("0x" & Hex($i, 8), $mHwnd, "byte[1024]"), "00", "")), $Srch, 2) Then
            $R = DeepScan($Srch, $i)
            If Not @error Then Return SetError(0, 0, $R)
        EndIf
    Next
EndFunc   ;==>Scan
Func DeepScan($Srch, $Start)
    Local $R, $Datum, $Path
    Local $Byte = "byte[350]"
    For $i = $Start To $Start + 1000 Step 1
        $Datum = BinaryToString(StringReplace(_MemoryRead("0x" & Hex($i, 8), $mHwnd, $Byte), "00", ""))
        If Not $Datum Then ContinueLoop
        ;ToolTip($Byte)
        If StringInStr($Datum, $Srch, 2) Then
            ;ConsoleWrite("->PATH=" & $Datum & @CR)
            If FileExists($Datum) Then
                ConsoleWrite("+>PATH=" & $Datum & @CR)
                Return SetError(0, 0, $Datum)
            EndIf
        EndIf
        ;ConsoleWrite("!>PATH=" & $Datum & @CR)
    Next
    Return SetError(1, 0, 0)
EndFunc   ;==>DeepScan
Func _InsertMenu()
    Local $hItem1, $hItem2
    ; Open Notepad
    ;SendKeepActive("[CLASS:Notepad]")
    $hMenu = _GUICtrlMenu_GetMenu($hWnd)
    ; Create menu
    $hItem2 = _GUICtrlMenu_CreateMenu()
    For $i = 0 To $Entries
        _GUICtrlMenu_InsertMenuItem($hItem2, $i, $aCmdID[$i][0], $aCmdID[$i][1])
    Next
    ; Insert new menu into Notepad
    _GUICtrlMenu_InsertMenuItem($hMenu, 2, "&Tools", 0, $hItem2)
    _GUICtrlMenu_DrawMenuBar($hWnd)
    $mHwnd = _MemoryOpen($PID)
EndFunc   ;==>_InsertMenu
Func _GetPrivilege_SEDEBUG()
    Local $tagLUIDANDATTRIB = "int64 Luid;dword Attributes"
    Local $count = 1
    Local $tagTOKENPRIVILEGES = "dword PrivilegeCount;byte LUIDandATTRIB[" & $count * 12 & "]" ; count of LUID structs * sizeof LUID struct
    Local $TOKEN_ADJUST_PRIVILEGES = 0x20
    Local $SE_PRIVILEGE_ENABLED = 0x2
    Local $curProc = DllCall("kernel32.dll", "ptr", "GetCurrentProcess")
    Local $call = DllCall("advapi32.dll", "int", "OpenProcessToken", "ptr", $curProc[0], "dword", $TOKEN_ADJUST_PRIVILEGES, "ptr*", "")
    If Not $call[0] Then Return False
    Local $hToken = $call[3]
    $call = DllCall("advapi32.dll", "int", "LookupPrivilegeValue", "str", "", "str", "SeDebugPrivilege", "int64*", "")
    Local $iLuid = $call[3]
    Local $TP = DllStructCreate($tagTOKENPRIVILEGES)
    Local $LUID = DllStructCreate($tagLUIDANDATTRIB, DllStructGetPtr($TP, "LUIDandATTRIB"))
    DllStructSetData($TP, "PrivilegeCount", $count)
    DllStructSetData($LUID, "Luid", $iLuid)
    DllStructSetData($LUID, "Attributes", $SE_PRIVILEGE_ENABLED)
    $call = DllCall("advapi32.dll", "int", "AdjustTokenPrivileges", "ptr", $hToken, "int", 0, "ptr", DllStructGetPtr($TP), "dword", 0, "ptr", 0, "ptr", 0)
    DllCall("kernel32.dll", "int", "CloseHandle", "ptr", $hToken)
    Return ($call[0] <> 0) ; $call[0] <> 0 is success
EndFunc   ;==>_GetPrivilege_SEDEBUG
Func _OnExit()
    DllClose($hUSER32)
    DllClose($hKERNEL32)
    Exit
EndFunc   ;==>_OnExit