pcRGBQUAD); [DllImport("Gdi32.dll", SetLastError = true)] private static extern IntPtr CreateDIBSection DIBSection必须用不压缩的格式 BmpInfo.Header.XPelsPerMeter = 0; // CreateDIBSection CreateCompatibleDC(ScreecDC); ReleaseDC(IntPtr.Zero, ScreecDC); m_Handle = CreateDIBSection DeleteDC(m_Hdc); m_Hdc = IntPtr.Zero; throw new OutOfMemoryException("CreateDIBSection false; } return IsGray; } #endregion } 正如上面所述,我们用GDI的方式(CreateDIBSection
freerdp将会在wf_post_connect中进行一系列的初始化,包括初始化bitmap,api调用路径如下: wf_post_connect->wf_image_new->wf_create_dib->CreateDIBSection 最后将会调用windows的api CreateDIBSection,CreateDIBSection将会以bmi.bmiHeader.biWidth * bmi.bmiHeader.biHeight 最后来到数据越界的函数freerdp_image_copy(),这里的copyDstWidth、nYDst、nDstStep 、xDstOffset 变量都是可控制的,memcpy这里将会越界写 这里有个问题,CreateDIBSection 分配的是以4096页为基数的大内存,而此片内存并没有在freerdp进程内,即使越界写也很难覆写到freerdp的内存,而这里将desktopWidth或desktopHeight置0的话,将会导致CreateDIBSection
HBITMAP hbitmap=(HBITMAP)::LoadImage(AfxGetInstanceHandle(),string, IMAGE_BITMAP,1024,768, LR_CREATEDIBSECTION
pImage->depth*pImage->nChannels, pImage->origin ); char *pBits=NULL; HBITMAP hBitmap=CreateDIBSection DWORD*) bmi->bmiColors)[1] = 0x0000FF00; ((DWORD*) bmi->bmiColors)[2] = 0x000000FF; break; } hBmp = ::CreateDIBSection
hbitmap=(HBITMAP)LoadImage(AfxGetInstanceHandle(),”图片/aa.bmp”,IMAGE_BITMAP, 0, 0, LR_LOADFROMFILE|LR_CREATEDIBSECTION LR_CREATEDIBSECTION:当參数uType指定为IMAGE_BITMAP时,使得函数返回一个DIB部分位图,而不是一个兼容的位图。 忽略n1和n2的设置 LR_CREATEDIBSECTION 假设指定了IMAGE_BITMAP,就返回DIBSection的句柄,而不是位图的句柄 LR_DEFAULTSIZE 假设n1
rect.Width(); height = rect.Height(); g_hMemDC = CreateCompatibleDC(pDC->m_hDC);//创建兼容设备环境的内存DC g_hBmp = CreateDIBSection ); mybmpobj.g_hMemDC = CreateCompatibleDC(mybmpobj.pDC->m_hDC);//创建兼容设备环境的内存DC mybmpobj.g_hBmp = CreateDIBSection ; pic->GetClientRect(&rect); g_hMemDC = CreateCompatibleDC(pDC->m_hDC);//创建兼容设备环境的内存DC g_hBmp = CreateDIBSection
bimpi.bmiHeader.biCompression = BI_RGB; bimpi.bmiHeader.biSizeImage = nCW * nCH*4; HBITMAP hNewBMP = CreateDIBSection
hBitmap = (HBITMAP)LoadImage(NULL, TEXT("color24x3.bmp"), IMAGE_BITMAP, 0, 0, LR_LOADFROMFILE|LR_CREATEDIBSECTION hBitmap = (HBITMAP)LoadImage(NULL, TEXT("green24x3.bmp"), IMAGE_BITMAP, 0, 0, LR_LOADFROMFILE|LR_CREATEDIBSECTION hBitmap = (HBITMAP)LoadImage(NULL, TEXT("gray24x3.bmp"), IMAGE_BITMAP, 0, 0, LR_LOADFROMFILE|LR_CREATEDIBSECTION
.从文件中装载 HBITMAP hbmp = (HBITMAP)LoadImage(NULL,lpszBitmapFile,IMAGE_BITMAP,0,0,LR_LOADFROMFILE|LR_CREATEDIBSECTION
return SaveBmpWithFileInfo(filename,&header,&info,bits); } //由位图句柄(HBITMAP)保存成bmp图片 //可以用CreateDIBitmap、CreateDIBSection
LR_CREATEDIBSECTION:当参数uType指定为IMAGE_BITMAP时,使得函数返回一个DIB部分位图,而不是一个兼容的位图。
strDrawLineStep; bih.biClrUsed = 0; bih.biClrImportant = 0; void* pDibData = 0; HBITMAP hBmp = CreateDIBSection
pBits; hdc = CreateIC(TEXT("DISPLAY"),NULL,NULL,NULL); hdcMem = CreateCompatibleDC(hdc); hBitMap = CreateDIBSection
(); m_RcTemp = lpRect; int nWid = m_RcTemp.Width(); int nHei = m_RcTemp.Height(); m_DIBTemp.CreateDIBSection
LPCTSTR file) { HBITMAP hBitmap = (HBITMAP)LoadImage(NULL, file, IMAGE_BITMAP, 0, 0, LR_LOADFROMFILE|LR_CREATEDIBSECTION
{ bmiHeader_biCompression = 0 }; colorBitmap = Gdi32Interop.CreateDIBSection
如果要显示不同格式的16位的图像数据,其实也很简单,有两中方法,第一,是修改CreateDIBSection函数的一个参数类型pBitmapInfo ,把这个默认参数BITMAPINFO修改为BITMAPV4HEADER
Hbm = (HBITMAP)LoadImage(GetModuleHandle(NULL),szBitmap, IMAGE_BITMAP,0,0,LR_CREATEDIBSECTION
IntPtr pBitmapBits = IntPtr.Zero; _hBitmap = UnsafeNativeMethods.CreateDIBSection(new HandleRef
text:10008C34 add esp, 1A4h .text:10008C3A retn 如代码清单 16-11 所示,该病毒通过 GetDesktopWindow 获取桌面的 HDC,再通过 CreateDIBSection ebx ; usage .text:1000D96E push eax ; lpbmi .text:1000D96F push ecx ; HDC .text:1000D970 call edi ; CreateDIBSection