| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724 |
- //////////////////////////////////////////////////////////////////////////////
- //
- // Module Enumeration Functions (modules.cpp of detours.lib)
- //
- // Microsoft Research Detours Package, Version 2.1.
- //
- // Copyright (c) Microsoft Corporation. All rights reserved.
- //
- // Module enumeration functions.
- //
- #include <windows.h>
- #if (_MSC_VER < 1310)
- #else
- #include <strsafe.h>
- #endif
- //#define DETOUR_DEBUG 1
- #define DETOURS_INTERNAL
- #include "detours.h"
- //////////////////////////////////////////////////////////////////////////////
- //
- #ifndef _STRSAFE_H_INCLUDED_
- static inline HRESULT StringCchLengthA(const char* psz, size_t cchMax, size_t* pcch)
- {
- HRESULT hr = S_OK;
- size_t cchMaxPrev = cchMax;
- if (cchMax > 2147483647)
- {
- return ERROR_INVALID_PARAMETER;
- }
- while (cchMax && (*psz != '\0'))
- {
- psz++;
- cchMax--;
- }
- if (cchMax == 0)
- {
- // the string is longer than cchMax
- hr = ERROR_INVALID_PARAMETER;
- }
- if (SUCCEEDED(hr) && pcch)
- {
- *pcch = cchMaxPrev - cchMax;
- }
- return hr;
- }
- static inline HRESULT StringCchCopyA(char* pszDest, size_t cchDest, const char* pszSrc)
- {
- HRESULT hr = S_OK;
- if (cchDest == 0)
- {
- // can not null terminate a zero-byte dest buffer
- hr = ERROR_INVALID_PARAMETER;
- }
- else
- {
- while (cchDest && (*pszSrc != '\0'))
- {
- *pszDest++ = *pszSrc++;
- cchDest--;
- }
- if (cchDest == 0)
- {
- // we are going to truncate pszDest
- pszDest--;
- hr = ERROR_INVALID_PARAMETER;
- }
- *pszDest= '\0';
- }
- return hr;
- }
- static inline HRESULT StringCchCatA(char* pszDest, size_t cchDest, const char* pszSrc)
- {
- HRESULT hr;
- size_t cchDestCurrent;
- if (cchDest > 2147483647)
- {
- return ERROR_INVALID_PARAMETER;
- }
- hr = StringCchLengthA(pszDest, cchDest, &cchDestCurrent);
- if (SUCCEEDED(hr))
- {
- hr = StringCchCopyA(pszDest + cchDestCurrent,
- cchDest - cchDestCurrent,
- pszSrc);
- }
- return hr;
- }
- #endif
- //////////////////////////////////////////////////////////////////////////////
- //
- const GUID DETOUR_EXE_RESTORE_GUID = {
- 0x2ed7a3ff, 0x3339, 0x4a8d,
- { 0x80, 0x5c, 0xd4, 0x98, 0x15, 0x3f, 0xc2, 0x8f }};
- //////////////////////////////////////////////////////////////////////////////
- //
- PDETOUR_SYM_INFO DetourLoadImageHlp(VOID)
- {
- static DETOUR_SYM_INFO symInfo;
- static PDETOUR_SYM_INFO pSymInfo = NULL;
- static BOOL failed = false;
- if (failed) {
- return NULL;
- }
- if (pSymInfo != NULL) {
- return pSymInfo;
- }
- ZeroMemory(&symInfo, sizeof(symInfo));
- // Create a real handle to the process.
- #if 0
- DuplicateHandle(GetCurrentProcess(),
- GetCurrentProcess(),
- GetCurrentProcess(),
- &symInfo.hProcess,
- 0,
- FALSE,
- DUPLICATE_SAME_ACCESS);
- #else
- symInfo.hProcess = GetCurrentProcess();
- #endif
- symInfo.hDbgHelp = LoadLibraryA("dbghelp.dll");
- if (symInfo.hDbgHelp == NULL) {
- abort:
- failed = true;
- if (symInfo.hDbgHelp != NULL) {
- FreeLibrary(symInfo.hDbgHelp);
- }
- symInfo.pfImagehlpApiVersionEx = NULL;
- symInfo.pfSymInitialize = NULL;
- symInfo.pfSymSetOptions = NULL;
- symInfo.pfSymGetOptions = NULL;
- symInfo.pfSymLoadModule64 = NULL;
- symInfo.pfSymGetModuleInfo64 = NULL;
- symInfo.pfSymFromName = NULL;
- return NULL;
- }
- symInfo.pfImagehlpApiVersionEx
- = (PF_ImagehlpApiVersionEx)GetProcAddress(symInfo.hDbgHelp,
- "ImagehlpApiVersionEx");
- symInfo.pfSymInitialize
- = (PF_SymInitialize)GetProcAddress(symInfo.hDbgHelp, "SymInitialize");
- symInfo.pfSymSetOptions
- = (PF_SymSetOptions)GetProcAddress(symInfo.hDbgHelp, "SymSetOptions");
- symInfo.pfSymGetOptions
- = (PF_SymGetOptions)GetProcAddress(symInfo.hDbgHelp, "SymGetOptions");
- symInfo.pfSymLoadModule64
- = (PF_SymLoadModule64)GetProcAddress(symInfo.hDbgHelp, "SymLoadModule64");
- symInfo.pfSymGetModuleInfo64
- = (PF_SymGetModuleInfo64)GetProcAddress(symInfo.hDbgHelp, "SymGetModuleInfo64");
- symInfo.pfSymFromName
- = (PF_SymFromName)GetProcAddress(symInfo.hDbgHelp, "SymFromName");
- API_VERSION av;
- ZeroMemory(&av, sizeof(av));
- av.MajorVersion = API_VERSION_NUMBER;
- if (symInfo.pfImagehlpApiVersionEx == NULL ||
- symInfo.pfSymInitialize == NULL ||
- symInfo.pfSymLoadModule64 == NULL ||
- symInfo.pfSymGetModuleInfo64 == NULL ||
- symInfo.pfSymFromName == NULL) {
- goto abort;
- }
- symInfo.pfImagehlpApiVersionEx(&av);
- if (av.MajorVersion < API_VERSION_NUMBER) {
- goto abort;
- }
- if (!symInfo.pfSymInitialize(symInfo.hProcess, NULL, FALSE)) {
- // We won't retry the initialize if it fails.
- goto abort;
- }
- if (symInfo.pfSymGetOptions != NULL && symInfo.pfSymSetOptions != NULL) {
- DWORD dw = symInfo.pfSymGetOptions();
- dw &= ~(SYMOPT_CASE_INSENSITIVE |
- SYMOPT_UNDNAME |
- SYMOPT_DEFERRED_LOADS |
- 0);
- dw |= (
- #if defined(SYMOPT_EXACT_SYMBOLS)
- SYMOPT_EXACT_SYMBOLS |
- #endif
- #if defined(SYMOPT_NO_UNQUALIFIED_LOADS)
- SYMOPT_NO_UNQUALIFIED_LOADS |
- #endif
- SYMOPT_DEFERRED_LOADS |
- #if defined(SYMOPT_FAIL_CRITICAL_ERRORS)
- SYMOPT_FAIL_CRITICAL_ERRORS |
- #endif
- #if defined(SYMOPT_INCLUDE_32BIT_MODULES)
- SYMOPT_INCLUDE_32BIT_MODULES |
- #endif
- 0);
- symInfo.pfSymSetOptions(dw);
- }
- pSymInfo = &symInfo;
- return pSymInfo;
- }
- PVOID WINAPI DetourFindFunction(PCSTR pszModule, PCSTR pszFunction)
- {
- /////////////////////////////////////////////// First, try GetProcAddress.
- //
- HMODULE hModule = LoadLibraryA(pszModule);
- if (hModule == NULL) {
- return NULL;
- }
- PBYTE pbCode = (PBYTE)GetProcAddress(hModule, pszFunction);
- if (pbCode) {
- return pbCode;
- }
- ////////////////////////////////////////////////////// Then try ImageHelp.
- //
- DETOUR_TRACE(("DetourFindFunction(%s, %s)\n", pszModule, pszFunction));
- PDETOUR_SYM_INFO pSymInfo = DetourLoadImageHlp();
- if (pSymInfo == NULL) {
- DETOUR_TRACE(("DetourLoadImageHlp failed: %d\n",
- GetLastError()));
- return NULL;
- }
- if (pSymInfo->pfSymLoadModule64(pSymInfo->hProcess, NULL,
- (PCHAR)pszModule, NULL,
- (DWORD64)hModule, 0) == 0) {
- DETOUR_TRACE(("SymLoadModule64(%p) failed: %d\n",
- pSymInfo->hProcess, GetLastError()));
- // We don't stop because some version of dbghelp fail secondary calls.
- //return NULL;
- }
- HRESULT hrRet;
- CHAR szFullName[512];
- IMAGEHLP_MODULE64 modinfo;
- ZeroMemory(&modinfo, sizeof(modinfo));
- modinfo.SizeOfStruct = sizeof(modinfo);
- if (!pSymInfo->pfSymGetModuleInfo64(pSymInfo->hProcess, (DWORD64)hModule, &modinfo)) {
- DETOUR_TRACE(("SymGetModuleInfo64(%p, %p) failed: %d\n",
- pSymInfo->hProcess, hModule, GetLastError()));
- return NULL;
- }
- hrRet = StringCchCopyA(szFullName, sizeof(szFullName)/sizeof(CHAR), modinfo.ModuleName);
- if (FAILED(hrRet)) {
- DETOUR_TRACE(("StringCchCopyA failed: %08x\n", hrRet));
- return NULL;
- }
- hrRet = StringCchCatA(szFullName, sizeof(szFullName)/sizeof(CHAR), "!");
- if (FAILED(hrRet)) {
- DETOUR_TRACE(("StringCchCatA failed: %08x\n", hrRet));
- return NULL;
- }
- hrRet = StringCchCatA(szFullName, sizeof(szFullName)/sizeof(CHAR), pszFunction);
- if (FAILED(hrRet)) {
- DETOUR_TRACE(("StringCchCatA failed: %08x\n", hrRet));
- return NULL;
- }
- struct CFullSymbol : SYMBOL_INFO {
- CHAR szRestOfName[512];
- } symbol;
- ZeroMemory(&symbol, sizeof(symbol));
- //symbol.ModBase = (ULONG64)hModule;
- symbol.SizeOfStruct = sizeof(SYMBOL_INFO);
- #ifdef DBHLPAPI
- symbol.MaxNameLen = sizeof(symbol.szRestOfName)/sizeof(symbol.szRestOfName[0]);
- #else
- symbol.MaxNameLength = sizeof(symbol.szRestOfName)/sizeof(symbol.szRestOfName[0]);
- #endif
- if (!pSymInfo->pfSymFromName(pSymInfo->hProcess, szFullName, &symbol)) {
- DETOUR_TRACE(("SymFromName(%s) failed: %d\n", szFullName, GetLastError()));
- return NULL;
- }
- #ifdef DETOURS_IA64
- // On the IA64, we get a raw code pointer from the symbol engine
- // and have to convert it to a wrapped [code pointer, global pointer].
- //
- PPLABEL_DESCRIPTOR pldEntry = (PPLABEL_DESCRIPTOR)DetourGetEntryPoint(hModule);
- PPLABEL_DESCRIPTOR pldSymbol = new PLABEL_DESCRIPTOR;
- pldSymbol->EntryPoint = symbol.Address;
- pldSymbol->GlobalPointer = pldEntry->GlobalPointer;
- return (PBYTE)pldSymbol;
- #else
- return (PBYTE)symbol.Address;
- #endif
- }
- //////////////////////////////////////////////////// Module Image Functions.
- //
- HMODULE WINAPI DetourEnumerateModules(HMODULE hModuleLast)
- {
- PBYTE pbLast;
- if (hModuleLast == NULL) {
- pbLast = (PBYTE)0x10000;
- }
- else {
- pbLast = (PBYTE)hModuleLast + 0x10000;
- }
- MEMORY_BASIC_INFORMATION mbi;
- ZeroMemory(&mbi, sizeof(mbi));
- // Find the next memory region that contains a mapped PE image.
- //
- for (;; pbLast = (PBYTE)mbi.BaseAddress + mbi.RegionSize) {
- if (VirtualQuery((PVOID)pbLast, &mbi, sizeof(mbi)) <= 0) {
- break;
- }
- // Skip uncommitted regions and guard pages.
- //
- if ((mbi.State != MEM_COMMIT) || (mbi.Protect & PAGE_GUARD)) {
- continue;
- }
- __try {
- PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)pbLast;
- if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
- continue;
- }
- PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader +
- pDosHeader->e_lfanew);
- if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) {
- continue;
- }
- return (HMODULE)pDosHeader;
- }
- __except(EXCEPTION_EXECUTE_HANDLER) {
- return NULL;
- }
- }
- return NULL;
- }
- PVOID WINAPI DetourGetEntryPoint(HMODULE hModule)
- {
- PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hModule;
- if (hModule == NULL) {
- pDosHeader = (PIMAGE_DOS_HEADER)GetModuleHandle(NULL);
- }
- __try {
- if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
- SetLastError(ERROR_BAD_EXE_FORMAT);
- return NULL;
- }
- PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader +
- pDosHeader->e_lfanew);
- if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) {
- SetLastError(ERROR_INVALID_EXE_SIGNATURE);
- return NULL;
- }
- if (pNtHeader->FileHeader.SizeOfOptionalHeader == 0) {
- SetLastError(ERROR_EXE_MARKED_INVALID);
- return NULL;
- }
- SetLastError(NO_ERROR);
- return ((PBYTE)pDosHeader) +
- pNtHeader->OptionalHeader.AddressOfEntryPoint;
- }
- __except(EXCEPTION_EXECUTE_HANDLER) {
- SetLastError(ERROR_EXE_MARKED_INVALID);
- return NULL;
- }
- }
- ULONG WINAPI DetourGetModuleSize(HMODULE hModule)
- {
- PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hModule;
- if (hModule == NULL) {
- pDosHeader = (PIMAGE_DOS_HEADER)GetModuleHandle(NULL);
- }
- __try {
- if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
- SetLastError(ERROR_BAD_EXE_FORMAT);
- return NULL;
- }
- PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader +
- pDosHeader->e_lfanew);
- if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) {
- SetLastError(ERROR_INVALID_EXE_SIGNATURE);
- return NULL;
- }
- if (pNtHeader->FileHeader.SizeOfOptionalHeader == 0) {
- SetLastError(ERROR_EXE_MARKED_INVALID);
- return NULL;
- }
- SetLastError(NO_ERROR);
- return (pNtHeader->OptionalHeader.SizeOfImage);
- }
- __except(EXCEPTION_EXECUTE_HANDLER) {
- SetLastError(ERROR_EXE_MARKED_INVALID);
- return NULL;
- }
- }
- static inline PBYTE RvaAdjust(PIMAGE_DOS_HEADER pDosHeader, DWORD raddr)
- {
- if (raddr != NULL) {
- return ((PBYTE)pDosHeader) + raddr;
- }
- return NULL;
- }
- BOOL WINAPI DetourEnumerateExports(HMODULE hModule,
- PVOID pContext,
- PF_DETOUR_ENUMERATE_EXPORT_CALLBACK pfExport)
- {
- PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hModule;
- if (hModule == NULL) {
- pDosHeader = (PIMAGE_DOS_HEADER)GetModuleHandle(NULL);
- }
- __try {
- if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
- SetLastError(ERROR_BAD_EXE_FORMAT);
- return NULL;
- }
- PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader +
- pDosHeader->e_lfanew);
- if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) {
- SetLastError(ERROR_INVALID_EXE_SIGNATURE);
- return FALSE;
- }
- if (pNtHeader->FileHeader.SizeOfOptionalHeader == 0) {
- SetLastError(ERROR_EXE_MARKED_INVALID);
- return FALSE;
- }
- PIMAGE_EXPORT_DIRECTORY pExportDir
- = (PIMAGE_EXPORT_DIRECTORY)
- RvaAdjust(pDosHeader,
- pNtHeader->OptionalHeader
- .DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
- if (pExportDir == NULL) {
- SetLastError(ERROR_EXE_MARKED_INVALID);
- return FALSE;
- }
- PDWORD pdwFunctions = (PDWORD)RvaAdjust(pDosHeader, pExportDir->AddressOfFunctions);
- PDWORD pdwNames = (PDWORD)RvaAdjust(pDosHeader, pExportDir->AddressOfNames);
- PWORD pwOrdinals = (PWORD)RvaAdjust(pDosHeader, pExportDir->AddressOfNameOrdinals);
- for (DWORD nFunc = 0; nFunc < pExportDir->NumberOfFunctions; nFunc++) {
- PBYTE pbCode = (pdwFunctions != NULL)
- ? (PBYTE)RvaAdjust(pDosHeader, pdwFunctions[nFunc]) : NULL;
- PCHAR pszName = NULL;
- for (DWORD n = 0; n < pExportDir->NumberOfNames; n++) {
- if (pwOrdinals[n] == nFunc) {
- pszName = (pdwNames != NULL)
- ? (PCHAR)RvaAdjust(pDosHeader, pdwNames[n]) : NULL;
- break;
- }
- }
- ULONG nOrdinal = pExportDir->Base + nFunc;
- if (!pfExport(pContext, nOrdinal, pszName, pbCode)) {
- break;
- }
- }
- SetLastError(NO_ERROR);
- return TRUE;
- }
- __except(EXCEPTION_EXECUTE_HANDLER) {
- SetLastError(ERROR_EXE_MARKED_INVALID);
- return NULL;
- }
- }
- static PDETOUR_LOADED_BINARY WINAPI GetPayloadSectionFromModule(HMODULE hModule)
- {
- PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hModule;
- if (hModule == NULL) {
- pDosHeader = (PIMAGE_DOS_HEADER)GetModuleHandle(NULL);
- }
- __try {
- if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
- SetLastError(ERROR_BAD_EXE_FORMAT);
- return NULL;
- }
- PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader +
- pDosHeader->e_lfanew);
- if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) {
- SetLastError(ERROR_INVALID_EXE_SIGNATURE);
- return NULL;
- }
- if (pNtHeader->FileHeader.SizeOfOptionalHeader == 0) {
- SetLastError(ERROR_EXE_MARKED_INVALID);
- return NULL;
- }
- PIMAGE_SECTION_HEADER pSectionHeaders
- = (PIMAGE_SECTION_HEADER)((PBYTE)pNtHeader
- + sizeof(pNtHeader->Signature)
- + sizeof(pNtHeader->FileHeader)
- + pNtHeader->FileHeader.SizeOfOptionalHeader);
- for (DWORD n = 0; n < pNtHeader->FileHeader.NumberOfSections; n++) {
- if (strcmp((PCHAR)pSectionHeaders[n].Name, ".detour") == 0) {
- if (pSectionHeaders[n].VirtualAddress == 0 ||
- pSectionHeaders[n].SizeOfRawData == 0) {
- break;
- }
- PBYTE pbData = (PBYTE)pDosHeader + pSectionHeaders[n].VirtualAddress;
- DETOUR_SECTION_HEADER *pHeader = (DETOUR_SECTION_HEADER *)pbData;
- if (pHeader->cbHeaderSize < sizeof(DETOUR_SECTION_HEADER) ||
- pHeader->nSignature != DETOUR_SECTION_HEADER_SIGNATURE) {
- break;
- }
- if (pHeader->nDataOffset == 0) {
- pHeader->nDataOffset = pHeader->cbHeaderSize;
- }
- SetLastError(NO_ERROR);
- return (PBYTE)pHeader;
- }
- }
- SetLastError(ERROR_EXE_MARKED_INVALID);
- return NULL;
- }
- __except(EXCEPTION_EXECUTE_HANDLER) {
- SetLastError(ERROR_EXE_MARKED_INVALID);
- return NULL;
- }
- }
- DWORD WINAPI DetourGetSizeOfPayloads(HMODULE hModule)
- {
- PDETOUR_LOADED_BINARY pBinary = GetPayloadSectionFromModule(hModule);
- if (pBinary == NULL) {
- // Error set by GetPayloadSectonFromModule.
- return 0;
- }
- __try {
- DETOUR_SECTION_HEADER *pHeader = (DETOUR_SECTION_HEADER *)pBinary;
- if (pHeader->cbHeaderSize < sizeof(DETOUR_SECTION_HEADER) ||
- pHeader->nSignature != DETOUR_SECTION_HEADER_SIGNATURE) {
- SetLastError(ERROR_INVALID_HANDLE);
- return 0;
- }
- SetLastError(NO_ERROR);
- return pHeader->cbDataSize;
- }
- __except(EXCEPTION_EXECUTE_HANDLER) {
- SetLastError(ERROR_INVALID_HANDLE);
- return 0;
- }
- }
- PVOID WINAPI DetourFindPayload(HMODULE hModule, REFGUID rguid, DWORD * pcbData)
- {
- PBYTE pbData = NULL;
- if (pcbData) {
- *pcbData = 0;
- }
- PDETOUR_LOADED_BINARY pBinary = GetPayloadSectionFromModule(hModule);
- if (pBinary == NULL) {
- // Error set by GetPayloadSectonFromModule.
- return NULL;
- }
- __try {
- DETOUR_SECTION_HEADER *pHeader = (DETOUR_SECTION_HEADER *)pBinary;
- if (pHeader->cbHeaderSize < sizeof(DETOUR_SECTION_HEADER) ||
- pHeader->nSignature != DETOUR_SECTION_HEADER_SIGNATURE) {
- SetLastError(ERROR_INVALID_EXE_SIGNATURE);
- return NULL;
- }
- PBYTE pbBeg = ((PBYTE)pHeader) + pHeader->nDataOffset;
- PBYTE pbEnd = ((PBYTE)pHeader) + pHeader->cbDataSize;
- for (pbData = pbBeg; pbData < pbEnd;) {
- DETOUR_SECTION_RECORD *pSection = (DETOUR_SECTION_RECORD *)pbData;
- if (pSection->guid.Data1 == rguid.Data1 &&
- pSection->guid.Data2 == rguid.Data2 &&
- pSection->guid.Data3 == rguid.Data3 &&
- pSection->guid.Data4[0] == rguid.Data4[0] &&
- pSection->guid.Data4[1] == rguid.Data4[1] &&
- pSection->guid.Data4[2] == rguid.Data4[2] &&
- pSection->guid.Data4[3] == rguid.Data4[3] &&
- pSection->guid.Data4[4] == rguid.Data4[4] &&
- pSection->guid.Data4[5] == rguid.Data4[5] &&
- pSection->guid.Data4[6] == rguid.Data4[6] &&
- pSection->guid.Data4[7] == rguid.Data4[7]) {
- if (pcbData) {
- *pcbData = pSection->cbBytes - sizeof(*pSection);
- SetLastError(NO_ERROR);
- return (PBYTE)(pSection + 1);
- }
- }
- pbData = (PBYTE)pSection + pSection->cbBytes;
- }
- SetLastError(ERROR_INVALID_HANDLE);
- return NULL;
- }
- __except(EXCEPTION_EXECUTE_HANDLER) {
- SetLastError(ERROR_INVALID_HANDLE);
- return NULL;
- }
- }
- BOOL WINAPI DetourRestoreAfterWithEx(PVOID pvData, DWORD cbData)
- {
- PDETOUR_EXE_RESTORE pder = (PDETOUR_EXE_RESTORE)pvData;
- if (pder->cb != sizeof(*pder) || pder->cb > cbData) {
- SetLastError(ERROR_BAD_EXE_FORMAT);
- return FALSE;
- }
- DWORD dwPermIdh;
- DWORD dwPermInh;
- DWORD dwPermClr;
- DWORD dwOld;
- BOOL fSucceeded = FALSE;
- if (!VirtualProtect(pder->pidh, sizeof(pder->idh),
- PAGE_EXECUTE_READWRITE, &dwPermIdh)) {
- goto end0;
- }
- if (!VirtualProtect(pder->pinh, sizeof(pder->inh),
- PAGE_EXECUTE_READWRITE, &dwPermInh)) {
- goto end1;
- }
- if (pder->pclrFlags != NULL) {
- if (!VirtualProtect(pder->pclrFlags, sizeof(pder->clrFlags),
- PAGE_EXECUTE_READWRITE, &dwPermClr)) {
- goto end2;
- }
- }
- CopyMemory(pder->pidh, &pder->idh, sizeof(pder->idh));
- CopyMemory(pder->pinh, &pder->inh, sizeof(pder->inh));
- if (pder->pclrFlags != NULL) {
- CopyMemory(pder->pclrFlags, &pder->clrFlags, sizeof(pder->clrFlags));
- }
- fSucceeded = TRUE;
- if (pder->pclrFlags != NULL) {
- VirtualProtect(pder->pclrFlags, sizeof(pder->clrFlags), dwPermIdh, &dwOld);
- }
- end2:
- VirtualProtect(pder->pinh, sizeof(pder->inh), dwPermInh, &dwOld);
- end1:
- VirtualProtect(pder->pidh, sizeof(pder->idh), dwPermIdh, &dwOld);
- end0:
- return fSucceeded;
- }
- BOOL WINAPI DetourRestoreAfterWith()
- {
- for (HMODULE hMod = NULL; (hMod = DetourEnumerateModules(hMod)) != NULL;) {
- PVOID pvData;
- DWORD cbData;
- pvData = DetourFindPayload(hMod, DETOUR_EXE_RESTORE_GUID, &cbData);
- if (pvData == NULL || cbData == 0) {
- continue;
- }
- return DetourRestoreAfterWithEx(pvData, cbData);
- }
- SetLastError(ERROR_MOD_NOT_FOUND);
- return FALSE;
- }
- // End of File
|