Skip to content

Commit 617323f

Browse files
LuSlowerLuSlower
authored
Add files via upload
1 parent a77cc32 commit 617323f

File tree

4 files changed

+169
-15
lines changed

4 files changed

+169
-15
lines changed

‎MemDrain/MemDrain.cpp

+12-9
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#include "HelpMem.h"
1+
#include "MemDrain.h"
22

33
// Definir una estructura para asociar opciones con funciones
44
typedef struct {
@@ -8,14 +8,14 @@ typedef struct {
88

99
// Funciones para cada accion
1010
void help_action(int argc, char* argv[]) {
11-
printf("uso: md.exe <Argument> <Parameter>\n");
12-
printf("\n -ws <IM> <-r> | Drain WorkingSet");
13-
printf("\n -sws | Drain SystemWorkingSet");
14-
printf("\n -mpl | Drain ModifiedPageList");
15-
printf("\n -mcl | Drain CombineMemoryList");
16-
printf("\n -sl <0> | Drain StanbyList (and low priority)");
17-
printf("\n -rh | Drain Registry Hives");
18-
printf("\n -all | Drain All");
11+
printf("use: md.exe <Argument> <Parameter>\n");
12+
printf("\n -ws <IM> <-r> | Drain WorkingSet");
13+
printf("\n -sws | Drain SystemWorkingSet");
14+
printf("\n -mpl | Drain ModifiedPageList");
15+
printf("\n -mcl | Drain CombineMemoryList");
16+
printf("\n -sl <0> | Drain StanbyList (and low priority)");
17+
printf("\n -rh | Drain Registry Hives");
18+
printf("\n -all | Drain All");
1919

2020
}
2121
void working_set_action(int argc, char* argv[]){
@@ -169,6 +169,9 @@ void all_action(int argc, char* argv[]){
169169
sl0 = MemoryPurgeLowPriorityStandbyList;
170170
NtSetSystemInformation(SystemMemoryListInformation, &sl0, sizeof(sl0));
171171

172+
// Vaciar colmenas (hives) de registro
173+
NtSetSystemInformation (SystemRegistryReconciliationInformation, NULL, 0);
174+
172175
printf("Sucess");
173176
return;
174177

‎MemDrain/MemDrain.h

+153
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
#pragma once
2+
#include <windows.h>
3+
#include <stdio.h>
4+
#include <stdlib.h>
5+
#include <cstdlib>
6+
#include <psapi.h>
7+
#include <tlhelp32.h>
8+
#include <winternl.h>
9+
10+
typedef struct _MEMORY_COMBINE_INFORMATION_EX {
11+
HANDLE Handle;
12+
ULONG_PTR PagesCombined;
13+
ULONG Flags;
14+
} MEMORY_COMBINE_INFORMATION_EX, *PMEMORY_COMBINE_INFORMATION_EX;
15+
16+
typedef struct _SYSTEM_FILECACHE_INFORMATION {
17+
SIZE_T CurrentSize;
18+
SIZE_T PeakSize;
19+
ULONG PageFaultCount;
20+
SIZE_T MinimumWorkingSet;
21+
SIZE_T MaximumWorkingSet;
22+
SIZE_T CurrentSizeIncludingTransitionInPages;
23+
SIZE_T PeakSizeIncludingTransitionInPages;
24+
ULONG TransitionRePurposeCount;
25+
ULONG Flags;
26+
} SYSTEM_FILECACHE_INFORMATION, *PSYSTEM_FILECACHE_INFORMATION;
27+
28+
typedef enum _SYSTEM_MEMORY_LIST_COMMAND {
29+
MemoryCaptureAccessedBits,
30+
MemoryCaptureAndResetAccessedBits,
31+
MemoryEmptyWorkingSets,
32+
MemoryFlushModifiedList,
33+
MemoryPurgeStandbyList,
34+
MemoryPurgeLowPriorityStandbyList,
35+
MemoryCommandMax
36+
} SYSTEM_MEMORY_LIST_COMMAND;
37+
38+
39+
// definicion de SYSTEM_INFORMATION_CLASS
40+
typedef enum _SYSTEM_INFORMATION_CLASS_MOD {
41+
SystemCombinePhysicalMemoryInformation = 130,
42+
SystemFileCacheInformationEx = 81,
43+
SystemMemoryListInformation = 80,
44+
SystemRegistryReconciliationInformation = 155,
45+
} SYSTEM_INFORMATION_CLASS_MOD;
46+
47+
extern "C"{
48+
typedef NTSTATUS LONG;
49+
// Definir funciones internas
50+
NTSYSAPI
51+
NTSTATUS
52+
NTAPI
53+
NtSetSystemInformation(
54+
IN SYSTEM_INFORMATION_CLASS_MOD SystemInformationClass,
55+
IN PVOID SystemInformation,
56+
IN ULONG SystemInformationLength
57+
);
58+
}
59+
60+
DWORD GetChildProcesses(DWORD ParentPID, DWORD* ChildPIDs) {
61+
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
62+
if (hSnapshot == INVALID_HANDLE_VALUE) {
63+
printf("Error al crear un snapshot de procesos");
64+
return 0;
65+
}
66+
67+
PROCESSENTRY32 pe32;
68+
pe32.dwSize = sizeof(PROCESSENTRY32);
69+
70+
DWORD NumProcesses = 0;
71+
72+
if (Process32First(hSnapshot, &pe32)) {
73+
do {
74+
if (pe32.th32ParentProcessID == ParentPID) {
75+
if (NumProcesses < 64) {
76+
ChildPIDs[NumProcesses++] = pe32.th32ProcessID;
77+
} else {
78+
printf("Se alcanzó el límite máximo de procesos hijos");
79+
break;
80+
}
81+
}
82+
} while (Process32Next(hSnapshot, &pe32));
83+
}
84+
85+
CloseHandle(hSnapshot);
86+
return NumProcesses;
87+
}
88+
89+
DWORD GetPID(const char* processName) {
90+
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
91+
if (snapshot == INVALID_HANDLE_VALUE) {
92+
printf("Error al crear un snapshot de procesos");
93+
return 0;
94+
}
95+
96+
PROCESSENTRY32 entry;
97+
entry.dwSize = sizeof(PROCESSENTRY32);
98+
if (!Process32First(snapshot, &entry)) {
99+
CloseHandle(snapshot);
100+
printf("Error al obtener la primera entrada de proceso");
101+
return 0;
102+
}
103+
104+
DWORD processId = 0;
105+
do {
106+
if (strcmp(entry.szExeFile, processName) == 0) {
107+
processId = entry.th32ProcessID;
108+
break;
109+
}
110+
} while (Process32Next(snapshot, &entry));
111+
112+
CloseHandle(snapshot);
113+
return processId;
114+
}
115+
116+
bool EnablePrivilege(DWORD processId, LPCSTR privilegeName, HANDLE hProcess = NULL) {
117+
118+
TOKEN_PRIVILEGES tp;
119+
tp.PrivilegeCount = 1;
120+
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
121+
if (!LookupPrivilegeValue(NULL, privilegeName, &tp.Privileges[0].Luid)) {
122+
printf("Error al buscar el valor del privilegio ");
123+
return false;
124+
}
125+
126+
if (!hProcess) {
127+
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId);
128+
// comprobar por ultima vez
129+
if (!hProcess){
130+
printf("Error al abrir el token del proceso");
131+
return false;
132+
}
133+
}
134+
135+
HANDLE hToken;
136+
if (!OpenProcessToken(hProcess, TOKEN_ALL_ACCESS, &hToken)) {
137+
printf("Error al abrir el token del proceso");
138+
CloseHandle(hProcess);
139+
return false;
140+
}
141+
142+
if (!AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL)) {
143+
printf("Error al ajustar los privilegios del token");
144+
CloseHandle(hToken);
145+
CloseHandle(hProcess);
146+
return false;
147+
}
148+
149+
CloseHandle(hToken);
150+
CloseHandle(hProcess);
151+
return true;
152+
}
153+

‎MemDrain/MemDrain.layout

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@
22
<CodeBlocks_layout_file>
33
<FileVersion major="1" minor="0" />
44
<ActiveTarget name="Release" />
5-
<File name="HelpMem.h" open="1" top="0" tabpos="2" split="0" active="1" splitpos="0" zoom_1="0" zoom_2="0">
5+
<File name="HelpMem.h" open="0" top="0" tabpos="2" split="0" active="1" splitpos="0" zoom_1="0" zoom_2="0">
66
<Cursor>
7-
<Cursor1 position="359" topLine="18" />
7+
<Cursor1 position="1342" topLine="41" />
88
</Cursor>
99
</File>
1010
<File name="MemDrain.cpp" open="1" top="1" tabpos="1" split="0" active="1" splitpos="0" zoom_1="0" zoom_2="0">
1111
<Cursor>
12-
<Cursor1 position="4522" topLine="104" />
12+
<Cursor1 position="742" topLine="0" />
1313
</Cursor>
1414
</File>
1515
</CodeBlocks_layout_file>

‎MemDrain/MemDrain.rc

+1-3
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,9 @@ BEGIN
99
VALUE "CompanyName", "LuSlower Software"
1010
VALUE "FileDescription", "MemDrain"
1111
VALUE "FileVersion", "0.0.0.0"
12-
VALUE "InternalName", "MemDrain"
1312
VALUE "LegalCopyright", "Copyright � LuSlower"
14-
VALUE "OriginalFilename", "md.exe"
15-
VALUE "ProductName", "MemDrain"
1613
VALUE "ProductVersion", "0.0.0.0"
14+
VALUE "ProductName", "MemDrain"
1715
}
1816
}
1917
BLOCK "VarFileInfo"

0 commit comments

Comments
 (0)