CallDriver.cc

// Copyright (c) 2026 渟雲. All rights reserved.
#include <Windows.h>
#include <string>
#include <iostream>
#include <thread>
#include <atomic>
#include <memory>
#include <string_view>

#include "../includes/windows_operation.h"

using WindowHandle = HWND;
using ThreadHandle = HANDLE;
using EventHandle = HANDLE;
using Address = uintptr_t;
using SizeType = size_t;

constexpr inline DWORD WINDOW_CREATION_TIMEOUT = 5000u;
constexpr inline DWORD THREAD_WAIT_TIMEOUT = 1000u;
constexpr inline DWORD DESTROY_WINDOW_TIMEOUT = 5000u;
constexpr inline UINT WINDOW_WIDTH = 200u;
constexpr inline UINT WINDOW_HEIGHT = 150u;
constexpr inline uint64_t TEST_WRITE_VALUE = 0x1919810ULL;
constexpr inline std::string_view WINDOW_CLASS_NAME = "TestWindowClass";
constexpr inline std::string_view WINDOW_TITLE = "Test";
constexpr inline std::wstring_view TARGET_PROCESS_NAME = L"Target.exe";
// only for my build, you should make your own pattern
constexpr inline std::string_view TARGET_PATTERN = "48 8B 15 ? ? ? ? 48 89 C1";

struct HandleDeleter {
    void operator()(HANDLE h) const noexcept {
        if (h != nullptr && h != INVALID_HANDLE_VALUE) {
            CloseHandle(h);
        }
    }
};

using UniqueThreadPtr = std::unique_ptr<void, HandleDeleter>;
using UniqueEventPtr = std::unique_ptr<void, HandleDeleter>;

struct WindowData {
    WindowHandle hwnd = nullptr;
    std::atomic<bool> windowReady{false};
    std::atomic<bool> windowRunning{true};
    UniqueEventPtr windowReadyEvent;
};

LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam) {
    WindowData* windowData = reinterpret_cast<WindowData*>(GetWindowLongPtr(hwnd, GWLP_USERDATA));

    switch (uMsg) {
        case WM_CREATE: {
            CREATESTRUCT* createStruct = reinterpret_cast<CREATESTRUCT*>(lParam);
            WindowData* data = reinterpret_cast<WindowData*>(createStruct->lpCreateParams);
            SetWindowLongPtr(hwnd, GWLP_USERDATA, reinterpret_cast<LONG_PTR>(data));
            return 0;
        }

        case WM_SYSCOMMAND: {
            if (wParam == SC_CLOSE) {
                if (windowData && windowData->windowRunning.load()) {
                    return 0;
                }
            }
            return DefWindowProc(hwnd, uMsg, wParam, lParam);
        }

        case WM_CLOSE: {
            if (windowData && windowData->windowRunning.load()) {
                return 0;
            }
            return DefWindowProc(hwnd, uMsg, wParam, lParam);
        }

        case WM_DESTROY:
            PostQuitMessage(0);
            return 0;

        case WM_PAINT: {
            PAINTSTRUCT ps;
            HDC hdc = BeginPaint(hwnd, &ps);
            FillRect(hdc, &ps.rcPaint, (HBRUSH)(COLOR_WINDOW + 1));
            EndPaint(hwnd, &ps);
            return 0;
        }

        default:
            return DefWindowProc(hwnd, uMsg, wParam, lParam);
    }
}

DWORD WINAPI WindowThreadProc(LPVOID lpParameter) noexcept {
    WindowData* windowData = static_cast<WindowData*>(lpParameter);
    if (!windowData) {
        return 1;
    }

    WNDCLASSA wc = {};
    wc.lpfnWndProc = WindowProc;
    wc.hInstance = GetModuleHandle(NULL);
    wc.lpszClassName = WINDOW_CLASS_NAME.data();
    wc.hCursor = LoadCursor(NULL, IDC_ARROW);
    wc.hbrBackground = (HBRUSH)(COLOR_WINDOW + 1);
    
    if (!RegisterClassA(&wc)) {
        printf("Failed to register window class in thread. Error: %lu\n", GetLastError());
        windowData->windowReady = false;
        if (windowData->windowReadyEvent) {
            SetEvent(windowData->windowReadyEvent.get());
        }
        return 1;
    }
    
    WindowHandle hwnd = CreateWindowExA(
        0,
        WINDOW_CLASS_NAME.data(),
        WINDOW_TITLE.data(),
        WS_OVERLAPPEDWINDOW,
        CW_USEDEFAULT, CW_USEDEFAULT, WINDOW_WIDTH, WINDOW_HEIGHT,
        NULL,
        NULL,
        GetModuleHandle(NULL),
        windowData
    );
    
    if (!hwnd) {
        printf("Failed to create window in thread. Error: %lu\n", GetLastError());
        windowData->windowReady = false;
        if (windowData->windowReadyEvent) {
            SetEvent(windowData->windowReadyEvent.get());
        }
        return 1;
    }
    
    windowData->hwnd = hwnd;
    windowData->windowReady = true;
    if (windowData->windowReadyEvent) {
        SetEvent(windowData->windowReadyEvent.get());
    }
    
    ShowWindow(hwnd, SW_SHOW);
    UpdateWindow(hwnd);
    
    MSG msg;
    while (windowData->windowRunning) {
        if (PeekMessage(&msg, NULL, 0, 0, PM_REMOVE)) {
            if (msg.message == WM_QUIT) {
                break;
            }
            
            TranslateMessage(&msg);
            DispatchMessage(&msg);
        }
        else {
            Sleep(1);
        }
    }
    
    if (IsWindow(hwnd)) {
        DestroyWindow(hwnd);
    }

    while (PeekMessage(&msg, NULL, 0, 0, PM_REMOVE)) {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
    }
    
    UnregisterClassA(WINDOW_CLASS_NAME.data(), GetModuleHandle(NULL));
    
    return 0;
}

UniqueThreadPtr CreateWindowThread(WindowData& windowData) noexcept {
    windowData.windowReadyEvent = UniqueEventPtr(
        CreateEvent(NULL, TRUE, FALSE, NULL),
        HandleDeleter()
    );
    if (!windowData.windowReadyEvent) {
        printf("Failed to create window ready event. Error: %lu\n", GetLastError());
        return nullptr;
    }
    
    DWORD threadId;
    ThreadHandle threadHandle = CreateThread(
        NULL,
        0,
        WindowThreadProc,
        &windowData,
        0,
        &threadId
    );
    
    if (!threadHandle) {
        printf("Failed to create window thread. Error: %lu\n", GetLastError());
        windowData.windowReadyEvent.reset();
        return nullptr;
    }
    
    WaitForSingleObject(windowData.windowReadyEvent.get(), WINDOW_CREATION_TIMEOUT);
    
    if (!windowData.windowReady) {
        printf("Window creation failed or timeout.\n");
        windowData.windowRunning = false;
        WaitForSingleObject(threadHandle, THREAD_WAIT_TIMEOUT);
        CloseHandle(threadHandle);
        windowData.windowReadyEvent.reset();
        return nullptr;
    }
    
    printf("Window created successfully in thread. HWND: 0x%p\n", windowData.hwnd);
    
    return UniqueThreadPtr(threadHandle, HandleDeleter());
}

int main() {
    WindowData windowData;
    
    UniqueThreadPtr windowThread = CreateWindowThread(windowData);
    if (!windowThread) {
        printf("Failed to create window thread.\n");
        system("pause");
        return 1;
    }
    
    Operation op;
    
#ifdef USING_USUGUMO
    if (!op.DriverProbe()) {
        printf("Driver probe failed\n");
        windowData.windowRunning = false;
        DWORD threadId = GetThreadId(reinterpret_cast<HANDLE>(windowThread.get()));
        if (threadId != 0) {
            PostThreadMessage(threadId, WM_QUIT, 0, 0);
        }
        WaitForSingleObject(windowThread.get(), THREAD_WAIT_TIMEOUT);
        system("pause");
        return 1;
    }
    printf("Driver probe success\n");
#else
    printf("Using native api\n");
#endif

    if (!op.Init(TARGET_PROCESS_NAME)) {
        printf("Failed to initialize\n");
        windowData.windowRunning = false;
        DWORD threadId = GetThreadId(reinterpret_cast<HANDLE>(windowThread.get()));
        if (threadId != 0) {
            PostThreadMessage(threadId, WM_QUIT, 0, 0);
        }
        WaitForSingleObject(windowThread.get(), THREAD_WAIT_TIMEOUT);
        system("pause");
        return 1;
    }
#ifdef USING_USUGUMO
    printf("Driver handle created 0x%p\n", op.GetDriverHandle());
#else
    printf("Process handle created 0x%p\n", op.GetTargetProcessHandle());
#endif
    std::string targetProcessNameNarrow(TARGET_PROCESS_NAME.begin(), TARGET_PROCESS_NAME.end());
    uint64_t base_address = 0;
    uint64_t module_size = 0;
    if (!op.GetModuleInfo(targetProcessNameNarrow.c_str(), &base_address, &module_size)) {
        printf("Failed to get module info\n");
        windowData.windowRunning = false;
        DWORD threadId = GetThreadId(reinterpret_cast<HANDLE>(windowThread.get()));
        if (threadId != 0) {
            PostThreadMessage(threadId, WM_QUIT, 0, 0);
        }
        WaitForSingleObject(windowThread.get(), THREAD_WAIT_TIMEOUT);
        system("pause");
        return 1;
    }
    
    printf("Module base: 0x%llX, size: 0x%llX\n", base_address, module_size);

    Address pattern_addr = op.PatternScanSize(base_address, module_size, TARGET_PATTERN.data());
    if (pattern_addr == 0) {
        printf("Failed to find target pattern\n");
        windowData.windowRunning = false;
        DWORD threadId = GetThreadId(reinterpret_cast<HANDLE>(windowThread.get()));
        if (threadId != 0) {
            PostThreadMessage(threadId, WM_QUIT, 0, 0);
        }
        WaitForSingleObject(windowThread.get(), THREAD_WAIT_TIMEOUT);
        system("pause");
        return 1;
    }
    printf("Target pattern found at: 0x%llX\n", pattern_addr);

    int32_t disp32 = 0;
    if (!op.Read<int32_t>(pattern_addr + 3, &disp32)) {
        printf("Failed to read displacement\n");
        windowData.windowRunning = false;
        DWORD threadId = GetThreadId(reinterpret_cast<HANDLE>(windowThread.get()));
        if (threadId != 0) {
            PostThreadMessage(threadId, WM_QUIT, 0, 0);
        }
        WaitForSingleObject(windowThread.get(), THREAD_WAIT_TIMEOUT);
        system("pause");
        return 1;
    }

    // here hard coded, you should using hde64 or zydis to decode the instruction length
    Address resolved_addr = pattern_addr + 7 + disp32;
    printf("Resolved target address: 0x%llX\n", resolved_addr);

    uint64_t target_var = 0;
    if (!op.Read<uint64_t>(resolved_addr, &target_var)) {
        printf("Failed to read memory\n");
    } else {
        printf("Read target_var = 0x%llX at 0x%llX\n", target_var, resolved_addr);
    }
    
    if (!op.Write<uint64_t>(resolved_addr, TEST_WRITE_VALUE, sizeof(uint64_t))) {
        printf("Failed to write memory\n");
    } else {
        printf("Written 0x%llX to 0x%llX\n", TEST_WRITE_VALUE, resolved_addr);
    }
    
    if (op.Read<uint64_t>(resolved_addr, &target_var)) {
        printf("Read back target_var = 0x%llX\n", target_var);
    }
    
    printf("Waiting 3 second then mouse left down...\n");
    Sleep(3000);
    
    op.MouseLeftDown();
    printf("Waiting 1 second then mouse left up...\n");
    Sleep(1000);
    op.MouseLeftUp();
    
    printf("Waiting 3 second then move mouse (100, -100)...\n");
    Sleep(3000);
    op.MouseMove(100, -100);
    
    printf("Waiting 3 second then set cursor position (500, 500)...\n");
    Sleep(3000);
    op.SetCursorPos(500, 500);

    printf("Waiting 1 second then press VK_LWIN...\n");
    Sleep(1000);
    op.KeybdEvent(VK_LWIN, 0, 0, 0);
    Sleep(100);
    op.KeybdEvent(VK_LWIN, 0, KEYEVENTF_KEYUP, 0);

    printf("Waiting 1 second then anti capture test window...\n");
    Sleep(1000);
    
    if (windowData.hwnd && IsWindow(windowData.hwnd)) {
        op.AntiCapture(windowData.hwnd);
        printf("Anti capture applied to window.\n");
    } else {
        printf("Window handle is invalid.\n");
    }

    printf("Waiting input then undo anti capture test window...\n");
    system("pause");
    
    if (windowData.hwnd && IsWindow(windowData.hwnd)) {
        op.AntiCapture(windowData.hwnd, false);
        printf("Anti capture removed from window.\n");
    }

    printf("Waiting 3 second then destroy test window...\n");
    Sleep(3000);
    
    windowData.windowRunning = false;
    if (windowData.hwnd && IsWindow(windowData.hwnd)) {
        PostMessage(windowData.hwnd, WM_CLOSE, 0, 0);
    }
    
    WaitForSingleObject(windowThread.get(), DESTROY_WINDOW_TIMEOUT);
    
    printf("Done\n");
    
    system("pause");
    return 0;
}