-
Notifications
You must be signed in to change notification settings - Fork 4
/
Copy pathmain.h
54 lines (42 loc) · 1.73 KB
/
main.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
//? Marius Negrutiu (marius.negrutiu@protonmail.com) :: 2014/01/19
#pragma once
#ifndef _DEBUG
#if DBG || _DEBUG
#define _DEBUG
#endif
#endif
#define PLUGINNAME _T( "NSxfer" )
#define COBJMACROS
#define _WIN32_WINNT 0x0500
#define _WIN32_IE 0x0600
#include <windows.h>
#include <wininet.h>
#include <shlwapi.h> /// for wvnsprintf, StrToInt64Ex
#include <commctrl.h>
#include <shobjidl.h> /// ITaskbarList
// --> NSIS plugin API
#include <nsis/pluginapi.h>
// Validate input parameters to prevent crashes
// VirusTotal "detonates" dlls by running `RunDll32.exe "<dll>",<proc>` with no parameters
// If exported functions don't validate input parameters properly they will likely crash, triggering WER to launch WerFault.exe as child process
// When this happens, our dll is labeled as a potential program launcher increasing the chances of being reported as malitious
// NOTE: Functions called from .onInit receive parent=NULL
#define EXDLL_VALID_PARAMS() \
if ((parent && !IsWindow(parent)) || string_size == 0 || (string_size % 1024) != 0 || !variables || !stacktop || !extra) \
return;
#undef EXDLL_INIT
#define EXDLL_INIT() { \
g_stringsize=string_size; \
g_stacktop=stacktop; \
g_variables=variables; \
g_ep=extra; \
g_hwndparent=parent; }
#define EXDLL_VALIDATE() \
if (g_ep && g_ep->exec_flags && (g_ep->exec_flags->plugin_api_version != NSISPIAPIVER_CURR)) \
return;
extern extra_parameters *g_ep; /// main.c
extern HWND g_hwndparent; /// main.c
#define safepushstring(psz) pushstring( (psz) ? (psz) : _T("") )
UINT_PTR __cdecl PluginCallback( enum NSPIM iMessage );
// <-- NSIS plugin API
extern HINSTANCE g_hInst; /// Defined in main.c