image.cpp 62 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186
  1. //////////////////////////////////////////////////////////////////////////////
  2. //
  3. // Image manipulation functions (image.cpp of detours.lib)
  4. //
  5. // Microsoft Research Detours Package, Version 2.1.
  6. //
  7. // Copyright (c) Microsoft Corporation. All rights reserved.
  8. //
  9. // Used for for payloads, byways, and imports.
  10. //
  11. #include <windows.h>
  12. #if (_MSC_VER < 1310)
  13. #else
  14. #include <strsafe.h>
  15. #endif
  16. #if (_MSC_VER < 1299)
  17. #pragma warning(disable: 4710)
  18. #else
  19. #endif
  20. //#define DETOUR_DEBUG 1
  21. #define DETOURS_INTERNAL
  22. #include "detours.h"
  23. namespace Detour
  24. {
  25. //////////////////////////////////////////////////////////////////////////////
  26. //
  27. #ifndef _STRSAFE_H_INCLUDED_
  28. static inline HRESULT StringCchLengthA(const char* psz, size_t cchMax, size_t* pcch)
  29. {
  30. HRESULT hr = S_OK;
  31. size_t cchMaxPrev = cchMax;
  32. if (cchMax > 2147483647)
  33. {
  34. return ERROR_INVALID_PARAMETER;
  35. }
  36. while (cchMax && (*psz != '\0'))
  37. {
  38. psz++;
  39. cchMax--;
  40. }
  41. if (cchMax == 0)
  42. {
  43. // the string is longer than cchMax
  44. hr = ERROR_INVALID_PARAMETER;
  45. }
  46. if (SUCCEEDED(hr) && pcch)
  47. {
  48. *pcch = cchMaxPrev - cchMax;
  49. }
  50. return hr;
  51. }
  52. static inline HRESULT StringCchCopyA(char* pszDest, size_t cchDest, const char* pszSrc)
  53. {
  54. HRESULT hr = S_OK;
  55. if (cchDest == 0)
  56. {
  57. // can not null terminate a zero-byte dest buffer
  58. hr = ERROR_INVALID_PARAMETER;
  59. }
  60. else
  61. {
  62. while (cchDest && (*pszSrc != '\0'))
  63. {
  64. *pszDest++ = *pszSrc++;
  65. cchDest--;
  66. }
  67. if (cchDest == 0)
  68. {
  69. // we are going to truncate pszDest
  70. pszDest--;
  71. hr = ERROR_INVALID_PARAMETER;
  72. }
  73. *pszDest= '\0';
  74. }
  75. return hr;
  76. }
  77. static inline HRESULT StringCchCatA(char* pszDest, size_t cchDest, const char* pszSrc)
  78. {
  79. HRESULT hr;
  80. size_t cchDestCurrent;
  81. if (cchDest > 2147483647)
  82. {
  83. return ERROR_INVALID_PARAMETER;
  84. }
  85. hr = StringCchLengthA(pszDest, cchDest, &cchDestCurrent);
  86. if (SUCCEEDED(hr))
  87. {
  88. hr = StringCchCopyA(pszDest + cchDestCurrent,
  89. cchDest - cchDestCurrent,
  90. pszSrc);
  91. }
  92. return hr;
  93. }
  94. #endif
  95. ///////////////////////////////////////////////////////////////////////////////
  96. //
  97. class CImageData
  98. {
  99. friend class CImage;
  100. public:
  101. CImageData(PBYTE pbData, DWORD cbData);
  102. ~CImageData();
  103. PBYTE Enumerate(GUID *pGuid, DWORD *pcbData, DWORD *pnIterator);
  104. PBYTE Find(REFGUID rguid, DWORD *pcbData);
  105. PBYTE Set(REFGUID rguid, PBYTE pbData, DWORD cbData);
  106. BOOL Delete(REFGUID rguid);
  107. BOOL Purge();
  108. BOOL IsEmpty() { return m_cbData == 0; }
  109. BOOL IsValid();
  110. protected:
  111. BOOL SizeTo(DWORD cbData);
  112. protected:
  113. PBYTE m_pbData;
  114. DWORD m_cbData;
  115. DWORD m_cbAlloc;
  116. };
  117. class CImageImportFile
  118. {
  119. friend class CImage;
  120. friend class CImageImportName;
  121. public:
  122. CImageImportFile();
  123. ~CImageImportFile();
  124. public:
  125. CImageImportFile * m_pNextFile;
  126. BOOL m_fByway;
  127. CImageImportName * m_pImportNames;
  128. DWORD m_nImportNames;
  129. DWORD m_rvaOriginalFirstThunk;
  130. DWORD m_rvaFirstThunk;
  131. DWORD m_nForwarderChain;
  132. PCHAR m_pszOrig;
  133. PCHAR m_pszName;
  134. };
  135. class CImageImportName
  136. {
  137. friend class CImage;
  138. friend class CImageImportFile;
  139. public:
  140. CImageImportName();
  141. ~CImageImportName();
  142. public:
  143. WORD m_nHint;
  144. ULONG m_nOrig;
  145. ULONG m_nOrdinal;
  146. PCHAR m_pszOrig;
  147. PCHAR m_pszName;
  148. };
  149. class CImage
  150. {
  151. friend class CImageThunks;
  152. friend class CImageChars;
  153. friend class CImageImportFile;
  154. friend class CImageImportName;
  155. public:
  156. CImage();
  157. ~CImage();
  158. static CImage * IsValid(PDETOUR_BINARY pBinary);
  159. public: // File Functions
  160. BOOL Read(HANDLE hFile);
  161. BOOL Write(HANDLE hFile);
  162. BOOL Close();
  163. public: // Manipulation Functions
  164. PBYTE DataEnum(GUID *pGuid, DWORD *pcbData, DWORD *pnIterator);
  165. PBYTE DataFind(REFGUID rguid, DWORD *pcbData);
  166. PBYTE DataSet(REFGUID rguid, PBYTE pbData, DWORD cbData);
  167. BOOL DataDelete(REFGUID rguid);
  168. BOOL DataPurge();
  169. BOOL EditImports(PVOID pContext,
  170. PF_DETOUR_BINARY_BYWAY_CALLBACK pfBywayCallback,
  171. PF_DETOUR_BINARY_FILE_CALLBACK pfFileCallback,
  172. PF_DETOUR_BINARY_SYMBOL_CALLBACK pfSymbolCallback,
  173. PF_DETOUR_BINARY_COMMIT_CALLBACK pfCommitCallback);
  174. protected:
  175. BOOL WriteFile(HANDLE hFile,
  176. LPCVOID lpBuffer,
  177. DWORD nNumberOfBytesToWrite,
  178. LPDWORD lpNumberOfBytesWritten);
  179. BOOL CopyFileData(HANDLE hFile, DWORD nOldPos, DWORD cbData);
  180. BOOL ZeroFileData(HANDLE hFile, DWORD cbData);
  181. BOOL AlignFileData(HANDLE hFile);
  182. BOOL SizeOutputBuffer(DWORD cbData);
  183. PBYTE AllocateOutput(DWORD cbData, DWORD *pnVirtAddr);
  184. PVOID RvaToVa(ULONG_PTR nRva);
  185. DWORD RvaToFileOffset(DWORD nRva);
  186. DWORD FileAlign(DWORD nAddr);
  187. DWORD SectionAlign(DWORD nAddr);
  188. BOOL CheckImportsNeeded(DWORD *pnTables,
  189. DWORD *pnThunks,
  190. DWORD *pnChars);
  191. CImageImportFile * NewByway(__in_z PCHAR pszName);
  192. private:
  193. DWORD m_dwValidSignature;
  194. CImageData * m_pImageData; // Read & Write
  195. HANDLE m_hMap; // Read & Write
  196. PBYTE m_pMap; // Read & Write
  197. DWORD m_nNextFileAddr; // Write
  198. DWORD m_nNextVirtAddr; // Write
  199. IMAGE_DOS_HEADER m_DosHeader; // Read & Write
  200. IMAGE_NT_HEADERS m_NtHeader; // Read & Write
  201. IMAGE_SECTION_HEADER m_SectionHeaders[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
  202. DWORD m_nPrePE;
  203. DWORD m_cbPrePE;
  204. DWORD m_cbPostPE;
  205. DWORD m_nPeOffset;
  206. DWORD m_nSectionsOffset;
  207. DWORD m_nExtraOffset;
  208. DWORD m_nFileSize;
  209. DWORD m_nOutputVirtAddr;
  210. DWORD m_nOutputVirtSize;
  211. DWORD m_nOutputFileAddr;
  212. PBYTE m_pbOutputBuffer;
  213. DWORD m_cbOutputBuffer;
  214. CImageImportFile * m_pImportFiles;
  215. DWORD m_nImportFiles;
  216. BOOL m_fHadDetourSection;
  217. private:
  218. enum {
  219. DETOUR_IMAGE_VALID_SIGNATURE = 0xfedcba01, // "Dtr\0"
  220. };
  221. };
  222. //////////////////////////////////////////////////////////////////////////////
  223. //
  224. static BYTE s_rbDosCode[0x10] = {
  225. 0x0E,0x1F,0xBA,0x0E,0x00,0xB4,0x09,0xCD,
  226. 0x21,0xB8,0x01,0x4C,0xCD,0x21,'*','*'
  227. };
  228. static inline DWORD Max(DWORD a, DWORD b)
  229. {
  230. return a > b ? a : b;
  231. }
  232. static inline DWORD Align(DWORD a, DWORD size)
  233. {
  234. size--;
  235. return (a + size) & ~size;
  236. }
  237. static inline DWORD QuadAlign(DWORD a)
  238. {
  239. return Align(a, 8);
  240. }
  241. static PCHAR DuplicateString(__in_z PCHAR pszIn)
  242. {
  243. if (pszIn) {
  244. UINT nIn = (UINT)strlen(pszIn);
  245. PCHAR pszOut = new CHAR [nIn + 1];
  246. if (pszOut == NULL) {
  247. SetLastError(ERROR_OUTOFMEMORY);
  248. }
  249. else {
  250. CopyMemory(pszOut, pszIn, nIn + 1);
  251. }
  252. return pszOut;
  253. }
  254. return NULL;
  255. }
  256. static PCHAR ReplaceString(__deref_out PCHAR *ppsz, __in_z PCHAR pszIn)
  257. {
  258. if (ppsz == NULL) {
  259. return NULL;
  260. }
  261. UINT nIn;
  262. if (*ppsz != NULL) {
  263. if (strcmp(*ppsz, pszIn) == 0) {
  264. return *ppsz;
  265. }
  266. nIn = (UINT)strlen(pszIn);
  267. if (strlen(*ppsz) == nIn) {
  268. CopyMemory(*ppsz, pszIn, nIn + 1);
  269. return *ppsz;
  270. }
  271. else {
  272. delete[] *ppsz;
  273. *ppsz = NULL;
  274. }
  275. }
  276. else {
  277. nIn = (UINT)strlen(pszIn);
  278. }
  279. *ppsz = new CHAR [nIn + 1];
  280. if (*ppsz == NULL) {
  281. SetLastError(ERROR_OUTOFMEMORY);
  282. }
  283. else {
  284. CopyMemory(*ppsz, pszIn, nIn + 1);
  285. }
  286. return *ppsz;
  287. }
  288. //////////////////////////////////////////////////////////////////////////////
  289. //
  290. CImageImportFile::CImageImportFile()
  291. {
  292. m_pNextFile = NULL;
  293. m_fByway = FALSE;
  294. m_pImportNames = NULL;
  295. m_nImportNames = 0;
  296. m_rvaOriginalFirstThunk = 0;
  297. m_rvaFirstThunk = 0;
  298. m_nForwarderChain = (UINT)0;
  299. m_pszName = NULL;
  300. m_pszOrig = NULL;
  301. }
  302. CImageImportFile::~CImageImportFile()
  303. {
  304. if (m_pNextFile) {
  305. delete m_pNextFile;
  306. m_pNextFile = NULL;
  307. }
  308. if (m_pImportNames) {
  309. delete[] m_pImportNames;
  310. m_pImportNames = NULL;
  311. m_nImportNames = 0;
  312. }
  313. if (m_pszName) {
  314. delete[] m_pszName;
  315. m_pszName = NULL;
  316. }
  317. if (m_pszOrig) {
  318. delete[] m_pszOrig;
  319. m_pszOrig = NULL;
  320. }
  321. }
  322. CImageImportName::CImageImportName()
  323. {
  324. m_nOrig = 0;
  325. m_nOrdinal = 0;
  326. m_nHint = 0;
  327. m_pszName = NULL;
  328. m_pszOrig = NULL;
  329. }
  330. CImageImportName::~CImageImportName()
  331. {
  332. if (m_pszName) {
  333. delete[] m_pszName;
  334. m_pszName = NULL;
  335. }
  336. if (m_pszOrig) {
  337. delete[] m_pszOrig;
  338. m_pszOrig = NULL;
  339. }
  340. }
  341. //////////////////////////////////////////////////////////////////////////////
  342. //
  343. CImageData::CImageData(PBYTE pbData, DWORD cbData)
  344. {
  345. m_pbData = pbData;
  346. m_cbData = cbData;
  347. m_cbAlloc = 0;
  348. }
  349. CImageData::~CImageData()
  350. {
  351. IsValid();
  352. if (m_cbAlloc == 0) {
  353. m_pbData = NULL;
  354. }
  355. if (m_pbData) {
  356. delete[] m_pbData;
  357. m_pbData = NULL;
  358. }
  359. m_cbData = 0;
  360. m_cbAlloc = 0;
  361. }
  362. BOOL CImageData::SizeTo(DWORD cbData)
  363. {
  364. IsValid();
  365. if (cbData <= m_cbAlloc) {
  366. return TRUE;
  367. }
  368. PBYTE pbNew = new BYTE [cbData];
  369. if (pbNew == NULL) {
  370. SetLastError(ERROR_OUTOFMEMORY);
  371. return FALSE;
  372. }
  373. if (m_pbData) {
  374. CopyMemory(pbNew, m_pbData, m_cbData);
  375. if (m_cbAlloc > 0) {
  376. delete[] m_pbData;
  377. }
  378. m_pbData = NULL;
  379. }
  380. m_pbData = pbNew;
  381. m_cbAlloc = cbData;
  382. IsValid();
  383. return TRUE;
  384. }
  385. BOOL CImageData::Purge()
  386. {
  387. m_cbData = 0;
  388. IsValid();
  389. return TRUE;
  390. }
  391. BOOL CImageData::IsValid()
  392. {
  393. if (m_pbData == NULL) {
  394. return TRUE;
  395. }
  396. PBYTE pbBeg = m_pbData;
  397. PBYTE pbEnd = m_pbData + m_cbData;
  398. for (PBYTE pbIter = pbBeg; pbIter < pbEnd;) {
  399. PDETOUR_SECTION_RECORD pRecord = (PDETOUR_SECTION_RECORD)pbIter;
  400. if (pRecord->cbBytes < sizeof(DETOUR_SECTION_RECORD)) {
  401. return FALSE;
  402. }
  403. if (pRecord->nReserved != 0) {
  404. return FALSE;
  405. }
  406. pbIter += pRecord->cbBytes;
  407. }
  408. return TRUE;
  409. }
  410. PBYTE CImageData::Enumerate(GUID *pGuid, DWORD *pcbData, DWORD *pnIterator)
  411. {
  412. IsValid();
  413. if (pnIterator == NULL ||
  414. m_cbData < *pnIterator + sizeof(DETOUR_SECTION_RECORD)) {
  415. if (pcbData) {
  416. *pcbData = 0;
  417. }
  418. if (pGuid) {
  419. ZeroMemory(pGuid, sizeof(*pGuid));
  420. }
  421. return NULL;
  422. }
  423. PDETOUR_SECTION_RECORD pRecord = (PDETOUR_SECTION_RECORD)(m_pbData + *pnIterator);
  424. if (pGuid) {
  425. *pGuid = pRecord->guid;
  426. }
  427. if (pcbData) {
  428. *pcbData = pRecord->cbBytes - sizeof(DETOUR_SECTION_RECORD);
  429. }
  430. *pnIterator = (LONG)(((PBYTE)pRecord - m_pbData) + pRecord->cbBytes);
  431. return (PBYTE)(pRecord + 1);
  432. }
  433. PBYTE CImageData::Find(REFGUID rguid, DWORD *pcbData)
  434. {
  435. IsValid();
  436. DWORD cbBytes = sizeof(DETOUR_SECTION_RECORD);
  437. for (DWORD nOffset = 0; nOffset < m_cbData; nOffset += cbBytes) {
  438. PDETOUR_SECTION_RECORD pRecord = (PDETOUR_SECTION_RECORD)(m_pbData + nOffset);
  439. cbBytes = pRecord->cbBytes;
  440. if (cbBytes > m_cbData) {
  441. break;
  442. }
  443. if (cbBytes < sizeof(DETOUR_SECTION_RECORD)) {
  444. continue;
  445. }
  446. if (pRecord->guid.Data1 == rguid.Data1 &&
  447. pRecord->guid.Data2 == rguid.Data2 &&
  448. pRecord->guid.Data3 == rguid.Data3 &&
  449. pRecord->guid.Data4[0] == rguid.Data4[0] &&
  450. pRecord->guid.Data4[1] == rguid.Data4[1] &&
  451. pRecord->guid.Data4[2] == rguid.Data4[2] &&
  452. pRecord->guid.Data4[3] == rguid.Data4[3] &&
  453. pRecord->guid.Data4[4] == rguid.Data4[4] &&
  454. pRecord->guid.Data4[5] == rguid.Data4[5] &&
  455. pRecord->guid.Data4[6] == rguid.Data4[6] &&
  456. pRecord->guid.Data4[7] == rguid.Data4[7]) {
  457. *pcbData = cbBytes - sizeof(DETOUR_SECTION_RECORD);
  458. return (PBYTE)(pRecord + 1);
  459. }
  460. }
  461. if (pcbData) {
  462. *pcbData = 0;
  463. }
  464. return NULL;
  465. }
  466. BOOL CImageData::Delete(REFGUID rguid)
  467. {
  468. IsValid();
  469. PBYTE pbFound = NULL;
  470. DWORD cbFound = 0;
  471. pbFound = Find(rguid, &cbFound);
  472. if (pbFound == NULL) {
  473. SetLastError(ERROR_MOD_NOT_FOUND);
  474. return FALSE;
  475. }
  476. pbFound -= sizeof(DETOUR_SECTION_RECORD);
  477. cbFound += sizeof(DETOUR_SECTION_RECORD);
  478. PBYTE pbRestData = pbFound + cbFound;
  479. DWORD cbRestData = m_cbData - (LONG)(pbRestData - m_pbData);
  480. if (cbRestData) {
  481. MoveMemory(pbFound, pbRestData, cbRestData);
  482. }
  483. m_cbData -= cbFound;
  484. IsValid();
  485. return TRUE;
  486. }
  487. PBYTE CImageData::Set(REFGUID rguid, PBYTE pbData, DWORD cbData)
  488. {
  489. IsValid();
  490. Delete(rguid);
  491. DWORD cbAlloc = QuadAlign(cbData);
  492. if (!SizeTo(m_cbData + cbAlloc + sizeof(DETOUR_SECTION_RECORD))) {
  493. return NULL;
  494. }
  495. PDETOUR_SECTION_RECORD pRecord = (PDETOUR_SECTION_RECORD)(m_pbData + m_cbData);
  496. pRecord->cbBytes = cbAlloc + sizeof(DETOUR_SECTION_RECORD);
  497. pRecord->nReserved = 0;
  498. pRecord->guid = rguid;
  499. PBYTE pbDest = (PBYTE)(pRecord + 1);
  500. if (pbData) {
  501. CopyMemory(pbDest, pbData, cbData);
  502. if (cbData < cbAlloc) {
  503. ZeroMemory(pbDest + cbData, cbAlloc - cbData);
  504. }
  505. }
  506. else {
  507. if (cbAlloc > 0) {
  508. ZeroMemory(pbDest, cbAlloc);
  509. }
  510. }
  511. m_cbData += cbAlloc + sizeof(DETOUR_SECTION_RECORD);
  512. IsValid();
  513. return pbDest;
  514. }
  515. //////////////////////////////////////////////////////////////////////////////
  516. //
  517. class CImageThunks
  518. {
  519. private:
  520. CImage * m_pImage;
  521. PIMAGE_THUNK_DATA m_pThunks;
  522. DWORD m_nThunks;
  523. DWORD m_nThunksMax;
  524. DWORD m_nThunkVirtAddr;
  525. public:
  526. CImageThunks(CImage *pImage, DWORD nThunksMax, DWORD *pnAddr)
  527. {
  528. m_pImage = pImage;
  529. m_nThunks = 0;
  530. m_nThunksMax = nThunksMax;
  531. m_pThunks = (PIMAGE_THUNK_DATA)
  532. m_pImage->AllocateOutput(sizeof(IMAGE_THUNK_DATA) * nThunksMax,
  533. &m_nThunkVirtAddr);
  534. *pnAddr = m_nThunkVirtAddr;
  535. }
  536. PIMAGE_THUNK_DATA Current(DWORD *pnVirtAddr)
  537. {
  538. if (m_nThunksMax > 1) {
  539. *pnVirtAddr = m_nThunkVirtAddr;
  540. return m_pThunks;
  541. }
  542. *pnVirtAddr = 0;
  543. return NULL;
  544. }
  545. PIMAGE_THUNK_DATA Allocate(ULONG_PTR nData, DWORD *pnVirtAddr)
  546. {
  547. if (m_nThunks < m_nThunksMax) {
  548. *pnVirtAddr = m_nThunkVirtAddr;
  549. m_nThunks++;
  550. m_nThunkVirtAddr += sizeof(IMAGE_THUNK_DATA);
  551. m_pThunks->u1.Ordinal = nData;
  552. return m_pThunks++;
  553. }
  554. *pnVirtAddr = 0;
  555. return NULL;
  556. }
  557. DWORD Size()
  558. {
  559. return m_nThunksMax * sizeof(IMAGE_THUNK_DATA);
  560. }
  561. };
  562. //////////////////////////////////////////////////////////////////////////////
  563. //
  564. class CImageChars
  565. {
  566. private:
  567. CImage * m_pImage;
  568. PCHAR m_pChars;
  569. DWORD m_nChars;
  570. DWORD m_nCharsMax;
  571. DWORD m_nCharVirtAddr;
  572. public:
  573. CImageChars(CImage *pImage, DWORD nCharsMax, DWORD *pnAddr)
  574. {
  575. m_pImage = pImage;
  576. m_nChars = 0;
  577. m_nCharsMax = nCharsMax;
  578. m_pChars = (PCHAR)m_pImage->AllocateOutput(nCharsMax, &m_nCharVirtAddr);
  579. *pnAddr = m_nCharVirtAddr;
  580. }
  581. PCHAR Allocate(__in_z PCHAR pszString, DWORD *pnVirtAddr)
  582. {
  583. DWORD nLen = (DWORD)strlen(pszString) + 1;
  584. nLen += (nLen & 1);
  585. if (m_nChars + nLen > m_nCharsMax) {
  586. *pnVirtAddr = 0;
  587. return NULL;
  588. }
  589. *pnVirtAddr = m_nCharVirtAddr;
  590. HRESULT hrRet = StringCchCopyA(m_pChars,m_nCharsMax, pszString);
  591. if (FAILED(hrRet)) {
  592. return NULL;
  593. }
  594. pszString = m_pChars;
  595. m_pChars += nLen;
  596. m_nChars += nLen;
  597. m_nCharVirtAddr += nLen;
  598. return pszString;
  599. }
  600. PCHAR Allocate(PCHAR pszString, DWORD nHint, DWORD *pnVirtAddr)
  601. {
  602. DWORD nLen = (DWORD)strlen(pszString) + 1 + sizeof(USHORT);
  603. nLen += (nLen & 1);
  604. if (m_nChars + nLen > m_nCharsMax) {
  605. *pnVirtAddr = 0;
  606. return NULL;
  607. }
  608. *pnVirtAddr = m_nCharVirtAddr;
  609. *(USHORT *)m_pChars = (USHORT)nHint;
  610. HRESULT hrRet = StringCchCopyA(m_pChars + sizeof(USHORT), m_nCharsMax, pszString);
  611. if (FAILED(hrRet)) {
  612. return NULL;
  613. }
  614. pszString = m_pChars + sizeof(USHORT);
  615. m_pChars += nLen;
  616. m_nChars += nLen;
  617. m_nCharVirtAddr += nLen;
  618. return pszString;
  619. }
  620. DWORD Size()
  621. {
  622. return m_nChars;
  623. }
  624. };
  625. //////////////////////////////////////////////////////////////////////////////
  626. //
  627. CImage * CImage::IsValid(PDETOUR_BINARY pBinary)
  628. {
  629. if (pBinary) {
  630. CImage *pImage = (CImage *)pBinary;
  631. if (pImage->m_dwValidSignature == DETOUR_IMAGE_VALID_SIGNATURE) {
  632. return pImage;
  633. }
  634. }
  635. SetLastError(ERROR_INVALID_HANDLE);
  636. return NULL;
  637. }
  638. CImage::CImage()
  639. {
  640. m_dwValidSignature = (DWORD)DETOUR_IMAGE_VALID_SIGNATURE;
  641. m_hMap = NULL;
  642. m_pMap = NULL;
  643. m_nPeOffset = 0;
  644. m_nSectionsOffset = 0;
  645. m_pbOutputBuffer = NULL;
  646. m_cbOutputBuffer = 0;
  647. m_pImageData = NULL;
  648. m_pImportFiles = NULL;
  649. m_nImportFiles = 0;
  650. m_fHadDetourSection = FALSE;
  651. }
  652. CImage::~CImage()
  653. {
  654. Close();
  655. m_dwValidSignature = 0;
  656. }
  657. BOOL CImage::Close()
  658. {
  659. if (m_pImportFiles) {
  660. delete m_pImportFiles;
  661. m_pImportFiles = NULL;
  662. m_nImportFiles = 0;
  663. }
  664. if (m_pImageData) {
  665. delete m_pImageData;
  666. m_pImageData = NULL;
  667. }
  668. if (m_pMap != NULL) {
  669. UnmapViewOfFile(m_pMap);
  670. m_pMap = NULL;
  671. }
  672. if (m_hMap) {
  673. CloseHandle(m_hMap);
  674. m_hMap = NULL;
  675. }
  676. if (m_pbOutputBuffer) {
  677. delete[] m_pbOutputBuffer;
  678. m_pbOutputBuffer = NULL;
  679. m_cbOutputBuffer = 0;
  680. }
  681. return TRUE;
  682. }
  683. //////////////////////////////////////////////////////////////////////////////
  684. //
  685. PBYTE CImage::DataEnum(GUID *pGuid, DWORD *pcbData, DWORD *pnIterator)
  686. {
  687. if (m_pImageData == NULL) {
  688. return NULL;
  689. }
  690. return m_pImageData->Enumerate(pGuid, pcbData, pnIterator);
  691. }
  692. PBYTE CImage::DataFind(REFGUID rguid, DWORD *pcbData)
  693. {
  694. if (m_pImageData == NULL) {
  695. return NULL;
  696. }
  697. return m_pImageData->Find(rguid, pcbData);
  698. }
  699. PBYTE CImage::DataSet(REFGUID rguid, PBYTE pbData, DWORD cbData)
  700. {
  701. if (m_pImageData == NULL) {
  702. return NULL;
  703. }
  704. return m_pImageData->Set(rguid, pbData, cbData);
  705. }
  706. BOOL CImage::DataDelete(REFGUID rguid)
  707. {
  708. if (m_pImageData == NULL) {
  709. return FALSE;
  710. }
  711. return m_pImageData->Delete(rguid);
  712. }
  713. BOOL CImage::DataPurge()
  714. {
  715. if (m_pImageData == NULL) {
  716. return TRUE;
  717. }
  718. return m_pImageData->Purge();
  719. }
  720. //////////////////////////////////////////////////////////////////////////////
  721. //
  722. BOOL CImage::SizeOutputBuffer(DWORD cbData)
  723. {
  724. if (m_cbOutputBuffer < cbData) {
  725. if (cbData < 1024) {//65536
  726. cbData = 1024;
  727. }
  728. cbData = FileAlign(cbData);
  729. PBYTE pOutput = new BYTE [cbData];
  730. if (pOutput == NULL) {
  731. SetLastError(ERROR_OUTOFMEMORY);
  732. return FALSE;
  733. }
  734. if (m_pbOutputBuffer) {
  735. CopyMemory(pOutput, m_pbOutputBuffer, m_cbOutputBuffer);
  736. delete[] m_pbOutputBuffer;
  737. m_pbOutputBuffer = NULL;
  738. }
  739. ZeroMemory(pOutput + m_cbOutputBuffer, cbData - m_cbOutputBuffer),
  740. m_pbOutputBuffer = pOutput;
  741. m_cbOutputBuffer = cbData;
  742. }
  743. return TRUE;
  744. }
  745. PBYTE CImage::AllocateOutput(DWORD cbData, DWORD *pnVirtAddr)
  746. {
  747. cbData = QuadAlign(cbData);
  748. PBYTE pbData = m_pbOutputBuffer + m_nOutputVirtSize;
  749. *pnVirtAddr = m_nOutputVirtAddr + m_nOutputVirtSize;
  750. m_nOutputVirtSize += cbData;
  751. if (m_nOutputVirtSize > m_cbOutputBuffer) {
  752. SetLastError(ERROR_OUTOFMEMORY);
  753. return NULL;
  754. }
  755. ZeroMemory(pbData, cbData);
  756. return pbData;
  757. }
  758. //////////////////////////////////////////////////////////////////////////////
  759. //
  760. DWORD CImage::FileAlign(DWORD nAddr)
  761. {
  762. return Align(nAddr, m_NtHeader.OptionalHeader.FileAlignment);
  763. }
  764. DWORD CImage::SectionAlign(DWORD nAddr)
  765. {
  766. return Align(nAddr, m_NtHeader.OptionalHeader.SectionAlignment);
  767. }
  768. //////////////////////////////////////////////////////////////////////////////
  769. //
  770. PVOID CImage::RvaToVa(ULONG_PTR nRva)
  771. {
  772. if (nRva == 0) {
  773. return NULL;
  774. }
  775. for (DWORD n = 0; n < m_NtHeader.FileHeader.NumberOfSections; n++) {
  776. DWORD vaStart = m_SectionHeaders[n].VirtualAddress;
  777. DWORD vaEnd = vaStart + m_SectionHeaders[n].SizeOfRawData;
  778. if (nRva >= vaStart && nRva < vaEnd) {
  779. return (PBYTE)m_pMap
  780. + m_SectionHeaders[n].PointerToRawData
  781. + nRva - m_SectionHeaders[n].VirtualAddress;
  782. }
  783. }
  784. return NULL;
  785. }
  786. DWORD CImage::RvaToFileOffset(DWORD nRva)
  787. {
  788. DWORD n;
  789. for (n = 0; n < m_NtHeader.FileHeader.NumberOfSections; n++) {
  790. DWORD vaStart = m_SectionHeaders[n].VirtualAddress;
  791. DWORD vaEnd = vaStart + m_SectionHeaders[n].SizeOfRawData;
  792. if (nRva >= vaStart && nRva < vaEnd) {
  793. return m_SectionHeaders[n].PointerToRawData
  794. + nRva - m_SectionHeaders[n].VirtualAddress;
  795. }
  796. }
  797. return 0;
  798. }
  799. //////////////////////////////////////////////////////////////////////////////
  800. //
  801. BOOL CImage::WriteFile(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite,
  802. LPDWORD lpNumberOfBytesWritten)
  803. {
  804. return ::WriteFile(hFile,
  805. lpBuffer,
  806. nNumberOfBytesToWrite,
  807. lpNumberOfBytesWritten,
  808. NULL);
  809. }
  810. BOOL CImage::CopyFileData(HANDLE hFile, DWORD nOldPos, DWORD cbData)
  811. {
  812. DWORD cbDone = 0;
  813. return WriteFile(hFile, m_pMap + nOldPos, cbData, &cbDone);
  814. }
  815. BOOL CImage::ZeroFileData(HANDLE hFile, DWORD cbData)
  816. {
  817. if (!SizeOutputBuffer(4096)) {
  818. return FALSE;
  819. }
  820. ZeroMemory(m_pbOutputBuffer, 4096);
  821. for (DWORD cbLeft = cbData; cbLeft > 0;) {
  822. DWORD cbStep = cbLeft > sizeof(m_pbOutputBuffer)
  823. ? sizeof(m_pbOutputBuffer) : cbLeft;
  824. DWORD cbDone = 0;
  825. if (!WriteFile(hFile, m_pbOutputBuffer, cbStep, &cbDone)) {
  826. return FALSE;
  827. }
  828. if (cbDone == 0) {
  829. break;
  830. }
  831. cbLeft -= cbDone;
  832. }
  833. return TRUE;
  834. }
  835. BOOL CImage::AlignFileData(HANDLE hFile)
  836. {
  837. DWORD nLastFileAddr = m_nNextFileAddr;
  838. m_nNextFileAddr = FileAlign(m_nNextFileAddr);
  839. m_nNextVirtAddr = SectionAlign(m_nNextVirtAddr);
  840. if (hFile != INVALID_HANDLE_VALUE) {
  841. if (m_nNextFileAddr > nLastFileAddr) {
  842. if (SetFilePointer(hFile, nLastFileAddr, NULL, FILE_BEGIN) == ~0u) {
  843. return FALSE;
  844. }
  845. return ZeroFileData(hFile, m_nNextFileAddr - nLastFileAddr);
  846. }
  847. }
  848. return TRUE;
  849. }
  850. BOOL CImage::Read(HANDLE hFile)
  851. {
  852. DWORD n;
  853. PBYTE pbData = NULL;
  854. DWORD cbData = 0;
  855. if (hFile == INVALID_HANDLE_VALUE) {
  856. SetLastError(ERROR_INVALID_HANDLE);
  857. return FALSE;
  858. }
  859. ///////////////////////////////////////////////////////// Create mapping.
  860. //
  861. m_nFileSize = GetFileSize(hFile, NULL);
  862. if (m_nFileSize == (DWORD)-1) {
  863. return FALSE;
  864. }
  865. m_hMap = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
  866. if (m_hMap == NULL) {
  867. return FALSE;
  868. }
  869. m_pMap = (PBYTE)MapViewOfFile(m_hMap, FILE_MAP_READ, 0, 0, 0);
  870. if (m_pMap == NULL) {
  871. return FALSE;
  872. }
  873. ////////////////////////////////////////////////////// Process DOS Header.
  874. //
  875. PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)m_pMap;
  876. if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
  877. SetLastError(ERROR_BAD_EXE_FORMAT);
  878. return FALSE;
  879. }
  880. m_nPeOffset = pDosHeader->e_lfanew;
  881. m_nPrePE = 0;
  882. m_cbPrePE = QuadAlign(pDosHeader->e_lfanew);
  883. CopyMemory(&m_DosHeader, m_pMap + m_nPrePE, sizeof(m_DosHeader));
  884. /////////////////////////////////////////////////////// Process PE Header.
  885. //
  886. CopyMemory(&m_NtHeader, m_pMap + m_nPeOffset, sizeof(m_NtHeader));
  887. if (m_NtHeader.Signature != IMAGE_NT_SIGNATURE) {
  888. SetLastError(ERROR_INVALID_EXE_SIGNATURE);
  889. return FALSE;
  890. }
  891. if (m_NtHeader.FileHeader.SizeOfOptionalHeader == 0) {
  892. SetLastError(ERROR_EXE_MARKED_INVALID);
  893. return FALSE;
  894. }
  895. m_nSectionsOffset = m_nPeOffset
  896. + sizeof(m_NtHeader.Signature)
  897. + sizeof(m_NtHeader.FileHeader)
  898. + m_NtHeader.FileHeader.SizeOfOptionalHeader;
  899. ///////////////////////////////////////////////// Process Section Headers.
  900. //
  901. if (m_NtHeader.FileHeader.NumberOfSections > (sizeof(m_SectionHeaders) /
  902. sizeof(m_SectionHeaders[0]))) {
  903. SetLastError(ERROR_EXE_MARKED_INVALID);
  904. return FALSE;
  905. }
  906. CopyMemory(&m_SectionHeaders,
  907. m_pMap + m_nSectionsOffset,
  908. sizeof(m_SectionHeaders[0]) * m_NtHeader.FileHeader.NumberOfSections);
  909. /////////////////////////////////////////////////// Parse .detour Section.
  910. //
  911. DWORD rvaOriginalImageDirectory = 0;
  912. DWORD rvaDetourBeg = 0;
  913. DWORD rvaDetourEnd = 0;
  914. for (n = 0; n < m_NtHeader.FileHeader.NumberOfSections; n++) {
  915. if (strcmp((PCHAR)m_SectionHeaders[n].Name, ".detour") == 0) {
  916. DETOUR_SECTION_HEADER dh;
  917. CopyMemory(&dh,
  918. m_pMap + m_SectionHeaders[n].PointerToRawData,
  919. sizeof(dh));
  920. rvaOriginalImageDirectory = dh.nOriginalImportVirtualAddress;
  921. if (dh.cbPrePE != 0) {
  922. m_nPrePE = m_SectionHeaders[n].PointerToRawData + sizeof(dh);
  923. m_cbPrePE = dh.cbPrePE;
  924. }
  925. rvaDetourBeg = m_SectionHeaders[n].VirtualAddress;
  926. rvaDetourEnd = rvaDetourBeg + m_SectionHeaders[n].SizeOfRawData;
  927. }
  928. }
  929. //////////////////////////////////////////////////////// Get Import Table.
  930. //
  931. DWORD rvaImageDirectory = m_NtHeader.OptionalHeader
  932. .DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
  933. PIMAGE_IMPORT_DESCRIPTOR iidp
  934. = (PIMAGE_IMPORT_DESCRIPTOR)RvaToVa(rvaImageDirectory);
  935. PIMAGE_IMPORT_DESCRIPTOR oidp
  936. = (PIMAGE_IMPORT_DESCRIPTOR)RvaToVa(rvaOriginalImageDirectory);
  937. if (oidp == NULL) {
  938. oidp = iidp;
  939. }
  940. if (iidp == NULL || oidp == NULL) {
  941. SetLastError(ERROR_EXE_MARKED_INVALID);
  942. return FALSE;
  943. }
  944. DWORD nFiles = 0;
  945. for (; iidp[nFiles].OriginalFirstThunk != 0; nFiles++) {
  946. }
  947. CImageImportFile **ppLastFile = &m_pImportFiles;
  948. m_pImportFiles = NULL;
  949. for (n = 0; n < nFiles; n++, iidp++) {
  950. ULONG_PTR rvaName = iidp->Name;
  951. PCHAR pszName = (PCHAR)RvaToVa(rvaName);
  952. if (pszName == NULL) {
  953. SetLastError(ERROR_EXE_MARKED_INVALID);
  954. goto fail;
  955. }
  956. CImageImportFile *pImportFile = new CImageImportFile;
  957. if (pImportFile == NULL) {
  958. SetLastError(ERROR_OUTOFMEMORY);
  959. goto fail;
  960. }
  961. *ppLastFile = pImportFile;
  962. ppLastFile = &pImportFile->m_pNextFile;
  963. m_nImportFiles++;
  964. pImportFile->m_pszName = DuplicateString(pszName);
  965. if (pImportFile->m_pszName == NULL) {
  966. goto fail;
  967. }
  968. pImportFile->m_rvaOriginalFirstThunk = iidp->OriginalFirstThunk;
  969. pImportFile->m_rvaFirstThunk = iidp->FirstThunk;
  970. pImportFile->m_nForwarderChain = iidp->ForwarderChain;
  971. pImportFile->m_pImportNames = NULL;
  972. pImportFile->m_nImportNames = 0;
  973. pImportFile->m_fByway = FALSE;
  974. if ((ULONG)iidp->FirstThunk >= rvaDetourBeg &&
  975. (ULONG)iidp->FirstThunk < rvaDetourEnd) {
  976. pImportFile->m_pszOrig = NULL;
  977. pImportFile->m_fByway = TRUE;
  978. continue;
  979. }
  980. rvaName = oidp->Name;
  981. pszName = (PCHAR)RvaToVa(rvaName);
  982. if (pszName == NULL) {
  983. SetLastError(ERROR_EXE_MARKED_INVALID);
  984. goto fail;
  985. }
  986. pImportFile->m_pszOrig = DuplicateString(pszName);
  987. if (pImportFile->m_pszOrig == NULL) {
  988. goto fail;
  989. }
  990. DWORD rvaThunk = iidp->OriginalFirstThunk;
  991. PIMAGE_THUNK_DATA pAddrThunk = (PIMAGE_THUNK_DATA)RvaToVa(rvaThunk);
  992. rvaThunk = oidp->OriginalFirstThunk;
  993. PIMAGE_THUNK_DATA pLookThunk = (PIMAGE_THUNK_DATA)RvaToVa(rvaThunk);
  994. DWORD nNames = 0;
  995. if (pAddrThunk) {
  996. for (; pAddrThunk[nNames].u1.Ordinal; nNames++) {
  997. }
  998. }
  999. if (pAddrThunk && nNames) {
  1000. pImportFile->m_nImportNames = nNames;
  1001. pImportFile->m_pImportNames = new CImageImportName [nNames];
  1002. if (pImportFile->m_pImportNames == NULL) {
  1003. SetLastError(ERROR_OUTOFMEMORY);
  1004. goto fail;
  1005. }
  1006. CImageImportName *pImportName = &pImportFile->m_pImportNames[0];
  1007. for (DWORD f = 0; f < nNames; f++, pImportName++) {
  1008. pImportName->m_nOrig = 0;
  1009. pImportName->m_nOrdinal = 0;
  1010. pImportName->m_nHint = 0;
  1011. pImportName->m_pszName = NULL;
  1012. pImportName->m_pszOrig = NULL;
  1013. rvaName = pAddrThunk[f].u1.Ordinal;
  1014. if (rvaName & IMAGE_ORDINAL_FLAG) {
  1015. pImportName->m_nOrig = (ULONG)IMAGE_ORDINAL(rvaName);
  1016. pImportName->m_nOrdinal = pImportName->m_nOrig;
  1017. }
  1018. else {
  1019. PIMAGE_IMPORT_BY_NAME pName
  1020. = (PIMAGE_IMPORT_BY_NAME)RvaToVa(rvaName);
  1021. if (pName) {
  1022. pImportName->m_nHint = pName->Hint;
  1023. pImportName->m_pszName = DuplicateString((PCHAR)pName->Name);
  1024. if (pImportName->m_pszName == NULL) {
  1025. goto fail;
  1026. }
  1027. }
  1028. rvaName = pLookThunk[f].u1.Ordinal;
  1029. if (rvaName & IMAGE_ORDINAL_FLAG) {
  1030. pImportName->m_nOrig = (ULONG)IMAGE_ORDINAL(rvaName);
  1031. pImportName->m_nOrdinal = (ULONG)IMAGE_ORDINAL(rvaName);
  1032. }
  1033. else {
  1034. pName = (PIMAGE_IMPORT_BY_NAME)RvaToVa(rvaName);
  1035. if (pName) {
  1036. pImportName->m_pszOrig
  1037. = DuplicateString((PCHAR)pName->Name);
  1038. if (pImportName->m_pszOrig == NULL) {
  1039. goto fail;
  1040. }
  1041. }
  1042. }
  1043. }
  1044. }
  1045. }
  1046. oidp++;
  1047. }
  1048. ////////////////////////////////////////////////////////// Parse Sections.
  1049. //
  1050. m_nExtraOffset = 0;
  1051. for (n = 0; n < m_NtHeader.FileHeader.NumberOfSections; n++) {
  1052. m_nExtraOffset = Max(m_SectionHeaders[n].PointerToRawData +
  1053. m_SectionHeaders[n].SizeOfRawData,
  1054. m_nExtraOffset);
  1055. if (strcmp((PCHAR)m_SectionHeaders[n].Name, ".detour") == 0) {
  1056. DETOUR_SECTION_HEADER dh;
  1057. CopyMemory(&dh,
  1058. m_pMap + m_SectionHeaders[n].PointerToRawData,
  1059. sizeof(dh));
  1060. if (dh.nDataOffset == 0) {
  1061. dh.nDataOffset = dh.cbHeaderSize;
  1062. }
  1063. cbData = dh.cbDataSize - dh.nDataOffset;
  1064. pbData = (m_pMap +
  1065. m_SectionHeaders[n].PointerToRawData +
  1066. dh.nDataOffset);
  1067. m_nExtraOffset = Max(m_SectionHeaders[n].PointerToRawData +
  1068. m_SectionHeaders[n].SizeOfRawData,
  1069. m_nExtraOffset);
  1070. m_NtHeader.FileHeader.NumberOfSections--;
  1071. m_NtHeader.OptionalHeader
  1072. .DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress
  1073. = dh.nOriginalImportVirtualAddress;
  1074. m_NtHeader.OptionalHeader
  1075. .DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size
  1076. = dh.nOriginalImportSize;
  1077. m_NtHeader.OptionalHeader
  1078. .DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress
  1079. = dh.nOriginalBoundImportVirtualAddress;
  1080. m_NtHeader.OptionalHeader
  1081. .DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size
  1082. = dh.nOriginalBoundImportSize;
  1083. m_NtHeader.OptionalHeader
  1084. .DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress
  1085. = dh.nOriginalIatVirtualAddress;
  1086. m_NtHeader.OptionalHeader
  1087. .DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size
  1088. = dh.nOriginalIatSize;
  1089. m_NtHeader.OptionalHeader.CheckSum = 0;
  1090. m_NtHeader.OptionalHeader.SizeOfImage
  1091. = dh.nOriginalSizeOfImage;
  1092. m_fHadDetourSection = TRUE;
  1093. }
  1094. }
  1095. m_pImageData = new CImageData(pbData, cbData);
  1096. if (m_pImageData == NULL) {
  1097. SetLastError(ERROR_OUTOFMEMORY);
  1098. }
  1099. return TRUE;
  1100. fail:
  1101. return FALSE;
  1102. }
  1103. static inline BOOL strneq(__in_z PCHAR pszOne, __in_z PCHAR pszTwo)
  1104. {
  1105. if (pszOne == pszTwo) {
  1106. return FALSE;
  1107. }
  1108. if (!pszOne || !pszTwo) {
  1109. return TRUE;
  1110. }
  1111. return (strcmp(pszOne, pszTwo) != 0);
  1112. }
  1113. BOOL CImage::CheckImportsNeeded(DWORD *pnTables, DWORD *pnThunks, DWORD *pnChars)
  1114. {
  1115. DWORD nTables = 0;
  1116. DWORD nThunks = 0;
  1117. DWORD nChars = 0;
  1118. BOOL fNeedDetourSection = FALSE;
  1119. for (CImageImportFile *pImportFile = m_pImportFiles;
  1120. pImportFile != NULL; pImportFile = pImportFile->m_pNextFile) {
  1121. nChars += (int)strlen(pImportFile->m_pszName) + 1;
  1122. nChars += nChars & 1;
  1123. if (pImportFile->m_fByway) {
  1124. fNeedDetourSection = TRUE;
  1125. nThunks++;
  1126. }
  1127. else {
  1128. if (!fNeedDetourSection &&
  1129. strneq(pImportFile->m_pszName, pImportFile->m_pszOrig)) {
  1130. fNeedDetourSection = TRUE;
  1131. }
  1132. for (DWORD n = 0; n < pImportFile->m_nImportNames; n++) {
  1133. CImageImportName *pImportName = &pImportFile->m_pImportNames[n];
  1134. if (!fNeedDetourSection &&
  1135. strneq(pImportName->m_pszName, pImportName->m_pszOrig)) {
  1136. fNeedDetourSection = TRUE;
  1137. }
  1138. if (pImportName->m_pszName) {
  1139. nChars += sizeof(WORD); // Hint
  1140. nChars += (int)strlen(pImportName->m_pszName) + 1;
  1141. nChars += nChars & 1;
  1142. }
  1143. nThunks++;
  1144. }
  1145. }
  1146. nThunks++;
  1147. nTables++;
  1148. }
  1149. nTables++;
  1150. *pnTables = nTables;
  1151. *pnThunks = nThunks;
  1152. *pnChars = nChars;
  1153. return fNeedDetourSection;
  1154. }
  1155. //////////////////////////////////////////////////////////////////////////////
  1156. //
  1157. CImageImportFile * CImage::NewByway(__in_z PCHAR pszName)
  1158. {
  1159. CImageImportFile *pImportFile = new CImageImportFile;
  1160. if (pImportFile == NULL) {
  1161. SetLastError(ERROR_OUTOFMEMORY);
  1162. goto fail;
  1163. }
  1164. pImportFile->m_pNextFile = NULL;
  1165. pImportFile->m_fByway = TRUE;
  1166. pImportFile->m_pszName = DuplicateString(pszName);
  1167. if (pImportFile->m_pszName == NULL) {
  1168. goto fail;
  1169. }
  1170. pImportFile->m_rvaOriginalFirstThunk = 0;
  1171. pImportFile->m_rvaFirstThunk = 0;
  1172. pImportFile->m_nForwarderChain = (UINT)0;
  1173. pImportFile->m_pImportNames = NULL;
  1174. pImportFile->m_nImportNames = 0;
  1175. m_nImportFiles++;
  1176. return pImportFile;
  1177. fail:
  1178. if (pImportFile) {
  1179. delete pImportFile;
  1180. pImportFile = NULL;
  1181. }
  1182. return NULL;
  1183. }
  1184. BOOL CImage::EditImports(PVOID pContext,
  1185. PF_DETOUR_BINARY_BYWAY_CALLBACK pfBywayCallback,
  1186. PF_DETOUR_BINARY_FILE_CALLBACK pfFileCallback,
  1187. PF_DETOUR_BINARY_SYMBOL_CALLBACK pfSymbolCallback,
  1188. PF_DETOUR_BINARY_COMMIT_CALLBACK pfCommitCallback)
  1189. {
  1190. CImageImportFile *pImportFile = NULL;
  1191. CImageImportFile **ppLastFile = &m_pImportFiles;
  1192. SetLastError(ERROR_CALL_NOT_IMPLEMENTED);
  1193. while ((pImportFile = *ppLastFile) != NULL) {
  1194. if (pfBywayCallback) {
  1195. PCHAR pszFile = NULL;
  1196. if (!(*pfBywayCallback)(pContext, pszFile, &pszFile)) {
  1197. goto fail;
  1198. }
  1199. if (pszFile) {
  1200. // Insert a new Byway.
  1201. CImageImportFile *pByway = NewByway(pszFile);
  1202. if (pByway == NULL) {
  1203. return FALSE;
  1204. }
  1205. pByway->m_pNextFile = pImportFile;
  1206. *ppLastFile = pByway;
  1207. ppLastFile = &pByway->m_pNextFile;
  1208. continue; // Retry after Byway.
  1209. }
  1210. }
  1211. if (pImportFile->m_fByway) {
  1212. if (pfBywayCallback) {
  1213. PCHAR pszFile = pImportFile->m_pszName;
  1214. if (!(*pfBywayCallback)(pContext, pszFile, &pszFile)) {
  1215. goto fail;
  1216. }
  1217. if (pszFile) { // Replace? Byway
  1218. if (ReplaceString(&pImportFile->m_pszName, pszFile) == NULL) {
  1219. goto fail;
  1220. }
  1221. }
  1222. else { // Delete Byway
  1223. *ppLastFile = pImportFile->m_pNextFile;
  1224. pImportFile->m_pNextFile = NULL;
  1225. delete pImportFile;
  1226. pImportFile = *ppLastFile;
  1227. m_nImportFiles--;
  1228. continue; // Retry after delete.
  1229. }
  1230. }
  1231. }
  1232. else {
  1233. if (pfFileCallback) {
  1234. PCHAR pszFile = pImportFile->m_pszName;
  1235. if (!(*pfFileCallback)(pContext, pImportFile->m_pszOrig,
  1236. pszFile, &pszFile)) {
  1237. goto fail;
  1238. }
  1239. if (pszFile != NULL) {
  1240. if (ReplaceString(&pImportFile->m_pszName, pszFile) == NULL) {
  1241. goto fail;
  1242. }
  1243. }
  1244. }
  1245. if (pfSymbolCallback) {
  1246. for (DWORD n = 0; n < pImportFile->m_nImportNames; n++) {
  1247. CImageImportName *pImportName = &pImportFile->m_pImportNames[n];
  1248. PCHAR pszName = pImportName->m_pszName;
  1249. ULONG nOrdinal = pImportName->m_nOrdinal;
  1250. if (!(*pfSymbolCallback)(pContext,
  1251. pImportName->m_nOrig,
  1252. nOrdinal,
  1253. &nOrdinal,
  1254. pImportName->m_pszOrig,
  1255. pszName,
  1256. &pszName)) {
  1257. goto fail;
  1258. }
  1259. if (pszName != NULL) {
  1260. pImportName->m_nOrdinal = 0;
  1261. if (ReplaceString(&pImportName->m_pszName, pszName) == NULL) {
  1262. goto fail;
  1263. }
  1264. }
  1265. else if (nOrdinal != 0) {
  1266. pImportName->m_nOrdinal = nOrdinal;
  1267. if (pImportName->m_pszName != NULL) {
  1268. delete[] pImportName->m_pszName;
  1269. pImportName->m_pszName = NULL;
  1270. }
  1271. }
  1272. }
  1273. }
  1274. }
  1275. ppLastFile = &pImportFile->m_pNextFile;
  1276. pImportFile = pImportFile->m_pNextFile;
  1277. }
  1278. for (;;) {
  1279. if (pfBywayCallback) {
  1280. PCHAR pszFile = NULL;
  1281. if (!(*pfBywayCallback)(pContext, NULL, &pszFile)) {
  1282. goto fail;
  1283. }
  1284. if (pszFile) {
  1285. // Insert a new Byway.
  1286. CImageImportFile *pByway = NewByway(pszFile);
  1287. if (pByway == NULL) {
  1288. return FALSE;
  1289. }
  1290. pByway->m_pNextFile = pImportFile;
  1291. *ppLastFile = pByway;
  1292. ppLastFile = &pByway->m_pNextFile;
  1293. continue; // Retry after Byway.
  1294. }
  1295. }
  1296. break;
  1297. }
  1298. if (pfCommitCallback) {
  1299. if (!(*pfCommitCallback)(pContext)) {
  1300. goto fail;
  1301. }
  1302. }
  1303. SetLastError(NO_ERROR);
  1304. return TRUE;
  1305. fail:
  1306. return FALSE;
  1307. }
  1308. BOOL CImage::Write(HANDLE hFile)
  1309. {
  1310. DWORD cbDone;
  1311. if (hFile == INVALID_HANDLE_VALUE) {
  1312. SetLastError(ERROR_INVALID_HANDLE);
  1313. return FALSE;
  1314. }
  1315. m_nNextFileAddr = 0;
  1316. m_nNextVirtAddr = 0;
  1317. DWORD nTables = 0;
  1318. DWORD nThunks = 0;
  1319. DWORD nChars = 0;
  1320. BOOL fNeedDetourSection = CheckImportsNeeded(&nTables, &nThunks, &nChars);
  1321. //////////////////////////////////////////////////////////// Copy Headers.
  1322. //
  1323. if (SetFilePointer(hFile, 0, NULL, FILE_BEGIN) == ~0u) {
  1324. return FALSE;
  1325. }
  1326. if (!CopyFileData(hFile, 0, m_NtHeader.OptionalHeader.SizeOfHeaders)) {
  1327. return FALSE;
  1328. }
  1329. if (fNeedDetourSection || !m_pImageData->IsEmpty()) {
  1330. // Replace the file's DOS header with our own.
  1331. m_nPeOffset = sizeof(m_DosHeader) + sizeof(s_rbDosCode);
  1332. m_nSectionsOffset = m_nPeOffset
  1333. + sizeof(m_NtHeader.Signature)
  1334. + sizeof(m_NtHeader.FileHeader)
  1335. + m_NtHeader.FileHeader.SizeOfOptionalHeader;
  1336. m_DosHeader.e_lfanew = m_nPeOffset;
  1337. if (SetFilePointer(hFile, 0, NULL, FILE_BEGIN) == ~0u) {
  1338. return FALSE;
  1339. }
  1340. if (!WriteFile(hFile, &m_DosHeader, sizeof(m_DosHeader), &cbDone)) {
  1341. return FALSE;
  1342. }
  1343. if (!WriteFile(hFile, &s_rbDosCode, sizeof(s_rbDosCode), &cbDone)) {
  1344. return FALSE;
  1345. }
  1346. }
  1347. else {
  1348. // Restore the file's original DOS header.
  1349. if (m_nPrePE != 0) {
  1350. m_nPeOffset = m_cbPrePE;
  1351. m_nSectionsOffset = m_nPeOffset
  1352. + sizeof(m_NtHeader.Signature)
  1353. + sizeof(m_NtHeader.FileHeader)
  1354. + m_NtHeader.FileHeader.SizeOfOptionalHeader;
  1355. m_DosHeader.e_lfanew = m_nPeOffset;
  1356. if (SetFilePointer(hFile, 0, NULL, FILE_BEGIN) == ~0u) {
  1357. return FALSE;
  1358. }
  1359. if (!CopyFileData(hFile, m_nPrePE, m_cbPrePE)) {
  1360. return FALSE;
  1361. }
  1362. }
  1363. }
  1364. m_nNextFileAddr = m_NtHeader.OptionalHeader.SizeOfHeaders;
  1365. m_nNextVirtAddr = 0;
  1366. if (!AlignFileData(hFile)) {
  1367. return FALSE;
  1368. }
  1369. /////////////////////////////////////////////////////////// Copy Sections.
  1370. //
  1371. DWORD n = 0;
  1372. for (; n < m_NtHeader.FileHeader.NumberOfSections; n++) {
  1373. if (m_SectionHeaders[n].SizeOfRawData) {
  1374. if (SetFilePointer(hFile,
  1375. m_SectionHeaders[n].PointerToRawData,
  1376. NULL, FILE_BEGIN) == ~0u) {
  1377. return FALSE;
  1378. }
  1379. if (!CopyFileData(hFile,
  1380. m_SectionHeaders[n].PointerToRawData,
  1381. m_SectionHeaders[n].SizeOfRawData)) {
  1382. return FALSE;
  1383. }
  1384. }
  1385. m_nNextFileAddr = Max(m_SectionHeaders[n].PointerToRawData +
  1386. m_SectionHeaders[n].SizeOfRawData,
  1387. m_nNextFileAddr);
  1388. m_nNextVirtAddr = Max(m_SectionHeaders[n].VirtualAddress +
  1389. m_SectionHeaders[n].Misc.VirtualSize,
  1390. m_nNextVirtAddr);
  1391. m_nExtraOffset = Max(m_nNextFileAddr, m_nExtraOffset);
  1392. if (!AlignFileData(hFile)) {
  1393. return FALSE;
  1394. }
  1395. }
  1396. if (fNeedDetourSection || !m_pImageData->IsEmpty()) {
  1397. ////////////////////////////////////////////// Insert .detour Section.
  1398. //
  1399. DWORD nSection = m_NtHeader.FileHeader.NumberOfSections++;
  1400. DETOUR_SECTION_HEADER dh;
  1401. ZeroMemory(&dh, sizeof(dh));
  1402. ZeroMemory(&m_SectionHeaders[nSection], sizeof(m_SectionHeaders[nSection]));
  1403. dh.cbHeaderSize = sizeof(DETOUR_SECTION_HEADER);
  1404. dh.nSignature = DETOUR_SECTION_HEADER_SIGNATURE;
  1405. dh.nOriginalImportVirtualAddress = m_NtHeader.OptionalHeader
  1406. .DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
  1407. dh.nOriginalImportSize = m_NtHeader.OptionalHeader
  1408. .DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size;
  1409. dh.nOriginalBoundImportVirtualAddress
  1410. = m_NtHeader.OptionalHeader
  1411. .DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress;
  1412. dh.nOriginalBoundImportSize = m_NtHeader.OptionalHeader
  1413. .DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size;
  1414. dh.nOriginalIatVirtualAddress = m_NtHeader.OptionalHeader
  1415. .DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress;
  1416. dh.nOriginalIatSize = m_NtHeader.OptionalHeader
  1417. .DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size;
  1418. dh.nOriginalSizeOfImage = m_NtHeader.OptionalHeader.SizeOfImage;
  1419. DWORD clrAddr = m_NtHeader.OptionalHeader
  1420. .DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress;
  1421. DWORD clrSize = m_NtHeader.OptionalHeader
  1422. .DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].Size;
  1423. if (clrAddr && clrSize) {
  1424. PDETOUR_CLR_HEADER pHdr = (PDETOUR_CLR_HEADER)RvaToVa(clrAddr);
  1425. if (pHdr != NULL) {
  1426. DETOUR_CLR_HEADER hdr;
  1427. hdr = *pHdr;
  1428. dh.nOriginalClrFlags = hdr.Flags;
  1429. }
  1430. }
  1431. HRESULT hrRet = StringCchCopyA((PCHAR)m_SectionHeaders[nSection].Name, IMAGE_SIZEOF_SHORT_NAME , ".detour");
  1432. if (FAILED(hrRet))
  1433. return FALSE;
  1434. m_SectionHeaders[nSection].Characteristics
  1435. = IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE;
  1436. m_nOutputVirtAddr = m_nNextVirtAddr;
  1437. m_nOutputVirtSize = 0;
  1438. m_nOutputFileAddr = m_nNextFileAddr;
  1439. dh.nDataOffset = 0; // pbData
  1440. dh.cbDataSize = m_pImageData->m_cbData;
  1441. dh.cbPrePE = m_cbPrePE;
  1442. //////////////////////////////////////////////////////////////////////////
  1443. //
  1444. DWORD rvaImportTable = 0;
  1445. DWORD rvaLookupTable = 0;
  1446. DWORD rvaBoundTable = 0;
  1447. DWORD rvaNameTable = 0;
  1448. DWORD nImportTableSize = nTables * sizeof(IMAGE_IMPORT_DESCRIPTOR);
  1449. if (!SizeOutputBuffer(QuadAlign(sizeof(dh))
  1450. + m_cbPrePE
  1451. + QuadAlign(m_pImageData->m_cbData)
  1452. + QuadAlign(sizeof(IMAGE_THUNK_DATA) * nThunks)
  1453. + QuadAlign(sizeof(IMAGE_THUNK_DATA) * nThunks)
  1454. + QuadAlign(nChars)
  1455. + QuadAlign(nImportTableSize))) {
  1456. return FALSE;
  1457. }
  1458. DWORD vaHead = 0;
  1459. PBYTE pbHead = NULL;
  1460. DWORD vaPrePE = 0;
  1461. PBYTE pbPrePE = NULL;
  1462. DWORD vaData = 0;
  1463. PBYTE pbData = NULL;
  1464. if ((pbHead = AllocateOutput(sizeof(dh), &vaHead)) == NULL) {
  1465. return FALSE;
  1466. }
  1467. if ((pbPrePE = AllocateOutput(m_cbPrePE, &vaPrePE)) == NULL) {
  1468. return FALSE;
  1469. }
  1470. CImageThunks lookupTable(this, nThunks, &rvaLookupTable);
  1471. CImageThunks boundTable(this, nThunks, &rvaBoundTable);
  1472. CImageChars nameTable(this, nChars, &rvaNameTable);
  1473. if ((pbData = AllocateOutput(m_pImageData->m_cbData, &vaData)) == NULL) {
  1474. return FALSE;
  1475. }
  1476. dh.nDataOffset = vaData - vaHead;
  1477. dh.cbDataSize = dh.nDataOffset + m_pImageData->m_cbData;
  1478. CopyMemory(pbHead, &dh, sizeof(dh));
  1479. CopyMemory(pbPrePE, m_pMap + m_nPrePE, m_cbPrePE);
  1480. CopyMemory(pbData, m_pImageData->m_pbData, m_pImageData->m_cbData);
  1481. PIMAGE_IMPORT_DESCRIPTOR piidDst = (PIMAGE_IMPORT_DESCRIPTOR)
  1482. AllocateOutput(nImportTableSize, &rvaImportTable);
  1483. if (piidDst == NULL) {
  1484. return FALSE;
  1485. }
  1486. //////////////////////////////////////////////// Step Through Imports.
  1487. //
  1488. for (CImageImportFile *pImportFile = m_pImportFiles;
  1489. pImportFile != NULL; pImportFile = pImportFile->m_pNextFile) {
  1490. ZeroMemory(piidDst, sizeof(piidDst));
  1491. nameTable.Allocate(pImportFile->m_pszName, (DWORD *)&piidDst->Name);
  1492. piidDst->TimeDateStamp = 0;
  1493. piidDst->ForwarderChain = pImportFile->m_nForwarderChain;
  1494. if (pImportFile->m_fByway) {
  1495. ULONG rvaIgnored;
  1496. lookupTable.Allocate(IMAGE_ORDINAL_FLAG+1,
  1497. (DWORD *)&piidDst->OriginalFirstThunk);
  1498. boundTable.Allocate(IMAGE_ORDINAL_FLAG+1,
  1499. (DWORD *)&piidDst->FirstThunk);
  1500. lookupTable.Allocate(0, &rvaIgnored);
  1501. boundTable.Allocate(0, &rvaIgnored);
  1502. }
  1503. else {
  1504. ULONG rvaIgnored;
  1505. piidDst->FirstThunk = (ULONG)pImportFile->m_rvaFirstThunk;
  1506. lookupTable.Current((DWORD *)&piidDst->OriginalFirstThunk);
  1507. for (n = 0; n < pImportFile->m_nImportNames; n++) {
  1508. CImageImportName *pImportName = &pImportFile->m_pImportNames[n];
  1509. if (pImportName->m_pszName) {
  1510. ULONG nDstName = 0;
  1511. nameTable.Allocate(pImportName->m_pszName,
  1512. pImportName->m_nHint,
  1513. &nDstName);
  1514. lookupTable.Allocate(nDstName, &rvaIgnored);
  1515. }
  1516. else {
  1517. lookupTable.Allocate(IMAGE_ORDINAL_FLAG + pImportName->m_nOrdinal,
  1518. &rvaIgnored);
  1519. }
  1520. }
  1521. lookupTable.Allocate(0, &rvaIgnored);
  1522. }
  1523. piidDst++;
  1524. }
  1525. ZeroMemory(piidDst, sizeof(piidDst));
  1526. //////////////////////////////////////////////////////////////////////////
  1527. //
  1528. m_nNextVirtAddr += m_nOutputVirtSize;
  1529. m_nNextFileAddr += FileAlign(m_nOutputVirtSize);
  1530. if (!AlignFileData(hFile)) {
  1531. return FALSE;
  1532. }
  1533. //////////////////////////////////////////////////////////////////////////
  1534. //
  1535. m_SectionHeaders[nSection].VirtualAddress = m_nOutputVirtAddr;
  1536. m_SectionHeaders[nSection].Misc.VirtualSize = m_nOutputVirtSize;
  1537. m_SectionHeaders[nSection].PointerToRawData = m_nOutputFileAddr;
  1538. m_SectionHeaders[nSection].SizeOfRawData = FileAlign(m_nOutputVirtSize);
  1539. m_NtHeader.OptionalHeader
  1540. .DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress
  1541. = rvaImportTable;
  1542. m_NtHeader.OptionalHeader
  1543. .DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size
  1544. = nImportTableSize;
  1545. m_NtHeader.OptionalHeader
  1546. .DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress = 0;
  1547. m_NtHeader.OptionalHeader
  1548. .DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size = 0;
  1549. //////////////////////////////////////////////////////////////////////////
  1550. //
  1551. if (SetFilePointer(hFile, m_SectionHeaders[nSection].PointerToRawData,
  1552. NULL, FILE_BEGIN) == ~0u) {
  1553. return FALSE;
  1554. }
  1555. if (!WriteFile(hFile, m_pbOutputBuffer, m_SectionHeaders[nSection].SizeOfRawData,
  1556. &cbDone)) {
  1557. return FALSE;
  1558. }
  1559. }
  1560. ///////////////////////////////////////////////////// Adjust Extra Data.
  1561. //
  1562. LONG nExtraAdjust = m_nNextFileAddr - m_nExtraOffset;
  1563. for (n = 0; n < m_NtHeader.FileHeader.NumberOfSections; n++) {
  1564. if (m_SectionHeaders[n].PointerToRawData > m_nExtraOffset) {
  1565. m_SectionHeaders[n].PointerToRawData += nExtraAdjust;
  1566. }
  1567. if (m_SectionHeaders[n].PointerToRelocations > m_nExtraOffset) {
  1568. m_SectionHeaders[n].PointerToRelocations += nExtraAdjust;
  1569. }
  1570. if (m_SectionHeaders[n].PointerToLinenumbers > m_nExtraOffset) {
  1571. m_SectionHeaders[n].PointerToLinenumbers += nExtraAdjust;
  1572. }
  1573. }
  1574. if (m_NtHeader.FileHeader.PointerToSymbolTable > m_nExtraOffset) {
  1575. m_NtHeader.FileHeader.PointerToSymbolTable += nExtraAdjust;
  1576. }
  1577. m_NtHeader.OptionalHeader.CheckSum = 0;
  1578. m_NtHeader.OptionalHeader.SizeOfImage = m_nNextVirtAddr;
  1579. ////////////////////////////////////////////////// Adjust Debug Directory.
  1580. //
  1581. DWORD debugAddr = m_NtHeader.OptionalHeader
  1582. .DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].VirtualAddress;
  1583. DWORD debugSize = m_NtHeader.OptionalHeader
  1584. .DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].Size;
  1585. if (debugAddr && debugSize) {
  1586. DWORD nFileOffset = RvaToFileOffset(debugAddr);
  1587. if (SetFilePointer(hFile, nFileOffset, NULL, FILE_BEGIN) == ~0u) {
  1588. return FALSE;
  1589. }
  1590. PIMAGE_DEBUG_DIRECTORY pDir = (PIMAGE_DEBUG_DIRECTORY)RvaToVa(debugAddr);
  1591. if (pDir == NULL) {
  1592. return FALSE;
  1593. }
  1594. DWORD nEntries = debugSize / sizeof(*pDir);
  1595. for (n = 0; n < nEntries; n++) {
  1596. IMAGE_DEBUG_DIRECTORY dir = pDir[n];
  1597. if (dir.PointerToRawData > m_nExtraOffset) {
  1598. dir.PointerToRawData += nExtraAdjust;
  1599. }
  1600. if (!WriteFile(hFile, &dir, sizeof(dir), &cbDone)) {
  1601. return FALSE;
  1602. }
  1603. }
  1604. }
  1605. /////////////////////////////////////////////////////// Adjust CLR Header.
  1606. //
  1607. DWORD clrAddr = m_NtHeader.OptionalHeader
  1608. .DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress;
  1609. DWORD clrSize = m_NtHeader.OptionalHeader
  1610. .DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].Size;
  1611. if (clrAddr && clrSize && fNeedDetourSection) {
  1612. DWORD nFileOffset = RvaToFileOffset(clrAddr);
  1613. if (SetFilePointer(hFile, nFileOffset, NULL, FILE_BEGIN) == ~0u) {
  1614. return FALSE;
  1615. }
  1616. PDETOUR_CLR_HEADER pHdr = (PDETOUR_CLR_HEADER)RvaToVa(clrAddr);
  1617. if (pHdr == NULL) {
  1618. return FALSE;
  1619. }
  1620. DETOUR_CLR_HEADER hdr;
  1621. hdr = *pHdr;
  1622. hdr.Flags &= 0xfffffffe; // Clear the IL_ONLY flag.
  1623. if (!WriteFile(hFile, &hdr, sizeof(hdr), &cbDone)) {
  1624. return FALSE;
  1625. }
  1626. }
  1627. ///////////////////////////////////////////////// Copy Left-over Data.
  1628. //
  1629. if (m_nFileSize > m_nExtraOffset) {
  1630. if (SetFilePointer(hFile, m_nNextFileAddr, NULL, FILE_BEGIN) == ~0u) {
  1631. return FALSE;
  1632. }
  1633. if (!CopyFileData(hFile, m_nExtraOffset, m_nFileSize - m_nExtraOffset)) {
  1634. return FALSE;
  1635. }
  1636. }
  1637. //////////////////////////////////////////////////// Finalize Headers.
  1638. //
  1639. if (SetFilePointer(hFile, m_nPeOffset, NULL, FILE_BEGIN) == ~0u) {
  1640. return FALSE;
  1641. }
  1642. if (!WriteFile(hFile, &m_NtHeader, sizeof(m_NtHeader), &cbDone)) {
  1643. return FALSE;
  1644. }
  1645. if (SetFilePointer(hFile, m_nSectionsOffset, NULL, FILE_BEGIN) == ~0u) {
  1646. return FALSE;
  1647. }
  1648. if (!WriteFile(hFile, &m_SectionHeaders,
  1649. sizeof(m_SectionHeaders[0])
  1650. * m_NtHeader.FileHeader.NumberOfSections,
  1651. &cbDone)) {
  1652. return FALSE;
  1653. }
  1654. m_cbPostPE = SetFilePointer(hFile, 0, NULL, FILE_CURRENT);
  1655. if (m_cbPostPE == ~0u) {
  1656. return FALSE;
  1657. }
  1658. m_cbPostPE = m_NtHeader.OptionalHeader.SizeOfHeaders - m_cbPostPE;
  1659. return TRUE;
  1660. }
  1661. }; // namespace Detour
  1662. //////////////////////////////////////////////////////////////////////////////
  1663. //
  1664. PDETOUR_BINARY WINAPI DetourBinaryOpen(HANDLE hFile)
  1665. {
  1666. Detour::CImage *pImage = new Detour::CImage;
  1667. if (pImage == NULL) {
  1668. SetLastError(ERROR_OUTOFMEMORY);
  1669. return FALSE;
  1670. }
  1671. if (!pImage->Read(hFile)) {
  1672. delete pImage;
  1673. return FALSE;
  1674. }
  1675. return (PDETOUR_BINARY)pImage;
  1676. }
  1677. BOOL WINAPI DetourBinaryWrite(PDETOUR_BINARY pdi, HANDLE hFile)
  1678. {
  1679. Detour::CImage *pImage = Detour::CImage::IsValid(pdi);
  1680. if (pImage == NULL) {
  1681. return FALSE;
  1682. }
  1683. return pImage->Write(hFile);
  1684. }
  1685. PVOID WINAPI DetourBinaryEnumeratePayloads(PDETOUR_BINARY pdi,
  1686. GUID *pGuid,
  1687. DWORD *pcbData,
  1688. DWORD *pnIterator)
  1689. {
  1690. Detour::CImage *pImage = Detour::CImage::IsValid(pdi);
  1691. if (pImage == NULL) {
  1692. return FALSE;
  1693. }
  1694. return pImage->DataEnum(pGuid, pcbData, pnIterator);
  1695. }
  1696. PVOID WINAPI DetourBinaryFindPayload(PDETOUR_BINARY pdi,
  1697. REFGUID rguid,
  1698. DWORD *pcbData)
  1699. {
  1700. Detour::CImage *pImage = Detour::CImage::IsValid(pdi);
  1701. if (pImage == NULL) {
  1702. return FALSE;
  1703. }
  1704. return pImage->DataFind(rguid, pcbData);
  1705. }
  1706. PVOID WINAPI DetourBinarySetPayload(PDETOUR_BINARY pdi,
  1707. REFGUID rguid,
  1708. PVOID pvData,
  1709. DWORD cbData)
  1710. {
  1711. Detour::CImage *pImage = Detour::CImage::IsValid(pdi);
  1712. if (pImage == NULL) {
  1713. return FALSE;
  1714. }
  1715. return pImage->DataSet(rguid, (PBYTE)pvData, cbData);
  1716. }
  1717. BOOL WINAPI DetourBinaryDeletePayload(PDETOUR_BINARY pdi,
  1718. REFGUID rguid)
  1719. {
  1720. Detour::CImage *pImage = Detour::CImage::IsValid(pdi);
  1721. if (pImage == NULL) {
  1722. return FALSE;
  1723. }
  1724. return pImage->DataDelete(rguid);
  1725. }
  1726. BOOL WINAPI DetourBinaryPurgePayloads(PDETOUR_BINARY pdi)
  1727. {
  1728. Detour::CImage *pImage = Detour::CImage::IsValid(pdi);
  1729. if (pImage == NULL) {
  1730. return FALSE;
  1731. }
  1732. return pImage->DataPurge();
  1733. }
  1734. //////////////////////////////////////////////////////////////////////////////
  1735. //
  1736. static BOOL CALLBACK ResetBywayCallback(PVOID pContext,
  1737. __in_z PCHAR pszFile,
  1738. __deref PCHAR *ppszOutFile)
  1739. {
  1740. (void)pContext;
  1741. (void)pszFile;
  1742. *ppszOutFile = NULL;
  1743. return TRUE;
  1744. }
  1745. static BOOL CALLBACK ResetFileCallback(PVOID pContext,
  1746. __in_z PCHAR pszOrigFile,
  1747. __in_z PCHAR pszFile,
  1748. __deref PCHAR *ppszOutFile)
  1749. {
  1750. (void)pContext;
  1751. (void)pszFile;
  1752. *ppszOutFile = pszOrigFile;
  1753. return TRUE;
  1754. }
  1755. static BOOL CALLBACK ResetSymbolCallback(PVOID pContext,
  1756. ULONG nOrigOrdinal,
  1757. ULONG nOrdinal,
  1758. ULONG *pnOutOrdinal,
  1759. __in_z PCHAR pszOrigSymbol,
  1760. __in_z PCHAR pszSymbol,
  1761. __deref PCHAR *ppszOutSymbol)
  1762. {
  1763. (void)pContext;
  1764. (void)nOrdinal;
  1765. (void)pszSymbol;
  1766. *pnOutOrdinal = nOrigOrdinal;
  1767. *ppszOutSymbol = pszOrigSymbol;
  1768. return TRUE;
  1769. }
  1770. BOOL WINAPI DetourBinaryResetImports(PDETOUR_BINARY pdi)
  1771. {
  1772. Detour::CImage *pImage = Detour::CImage::IsValid(pdi);
  1773. if (pImage == NULL) {
  1774. return FALSE;
  1775. }
  1776. return pImage->EditImports(NULL,
  1777. ResetBywayCallback,
  1778. ResetFileCallback,
  1779. ResetSymbolCallback,
  1780. NULL);
  1781. }
  1782. //////////////////////////////////////////////////////////////////////////////
  1783. //
  1784. BOOL WINAPI DetourBinaryEditImports(PDETOUR_BINARY pdi,
  1785. PVOID pContext,
  1786. PF_DETOUR_BINARY_BYWAY_CALLBACK pfBywayCallback,
  1787. PF_DETOUR_BINARY_FILE_CALLBACK pfFileCallback,
  1788. PF_DETOUR_BINARY_SYMBOL_CALLBACK pfSymbolCallback,
  1789. PF_DETOUR_BINARY_COMMIT_CALLBACK pfCommitCallback)
  1790. {
  1791. Detour::CImage *pImage = Detour::CImage::IsValid(pdi);
  1792. if (pImage == NULL) {
  1793. return FALSE;
  1794. }
  1795. return pImage->EditImports(pContext,
  1796. pfBywayCallback,
  1797. pfFileCallback,
  1798. pfSymbolCallback,
  1799. pfCommitCallback);
  1800. }
  1801. BOOL WINAPI DetourBinaryClose(PDETOUR_BINARY pdi)
  1802. {
  1803. Detour::CImage *pImage = Detour::CImage::IsValid(pdi);
  1804. if (pImage == NULL) {
  1805. return FALSE;
  1806. }
  1807. BOOL bSuccess = pImage->Close();
  1808. delete pImage;
  1809. pImage = NULL;
  1810. return bSuccess;
  1811. }
  1812. //
  1813. ///////////////////////////////////////////////////////////////// End of File.