detours.h 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614
  1. //////////////////////////////////////////////////////////////////////////////
  2. //
  3. // File: detours.h
  4. // Module: detours.lib
  5. //
  6. // Detours for binary functions. Version 1.5 (Build 46)
  7. //
  8. // Copyright 1995-2001, Microsoft Corporation
  9. //
  10. #pragma once
  11. #ifndef _DETOURS_H_
  12. #define _DETOURS_H_
  13. //////////////////////////////////////////////////////////////////////////////
  14. //
  15. #ifndef GUID_DEFINED
  16. #define GUID_DEFINED
  17. typedef struct _GUID
  18. {
  19. DWORD Data1;
  20. WORD Data2;
  21. WORD Data3;
  22. BYTE Data4[ 8 ];
  23. } GUID;
  24. #endif // !GUID_DEFINED
  25. #if defined(__cplusplus)
  26. #ifndef _REFGUID_DEFINED
  27. #define _REFGUID_DEFINED
  28. #define REFGUID const GUID &
  29. #endif // !_REFGUID_DEFINED
  30. #else // !__cplusplus
  31. #ifndef _REFGUID_DEFINED
  32. #define _REFGUID_DEFINED
  33. #define REFGUID const GUID * const
  34. #endif // !_REFGUID_DEFINED
  35. #endif // !__cplusplus
  36. //
  37. //////////////////////////////////////////////////////////////////////////////
  38. #ifdef __cplusplus
  39. extern "C" {
  40. #endif // __cplusplus
  41. /////////////////////////////////////////////////// Instruction Target Macros.
  42. //
  43. #define DETOUR_INSTRUCTION_TARGET_NONE ((PBYTE)0)
  44. #define DETOUR_INSTRUCTION_TARGET_DYNAMIC ((PBYTE)~0ul)
  45. /////////////////////////////////////////////////////////// Trampoline Macros.
  46. //
  47. // DETOUR_TRAMPOLINE(trampoline_prototype, target_name)
  48. //
  49. // The naked trampoline must be at least DETOUR_TRAMPOLINE_SIZE bytes.
  50. //
  51. #define DETOUR_TRAMPOLINE_SIZE 32
  52. #define DETOUR_SECTION_HEADER_SIGNATURE 0x00727444 // "Dtr\0"
  53. #define DETOUR_TRAMPOLINE(trampoline,target) \
  54. static PVOID __fastcall _Detours_GetVA_##target(VOID) \
  55. { \
  56. return ⌖ \
  57. } \
  58. \
  59. __declspec(naked) trampoline \
  60. { \
  61. __asm { nop };\
  62. __asm { nop };\
  63. __asm { call _Detours_GetVA_##target };\
  64. __asm { jmp eax };\
  65. __asm { ret };\
  66. __asm { nop };\
  67. __asm { nop };\
  68. __asm { nop };\
  69. __asm { nop };\
  70. __asm { nop };\
  71. __asm { nop };\
  72. __asm { nop };\
  73. __asm { nop };\
  74. __asm { nop };\
  75. __asm { nop };\
  76. __asm { nop };\
  77. __asm { nop };\
  78. __asm { nop };\
  79. __asm { nop };\
  80. __asm { nop };\
  81. __asm { nop };\
  82. __asm { nop };\
  83. __asm { nop };\
  84. __asm { nop };\
  85. __asm { nop };\
  86. __asm { nop };\
  87. __asm { nop };\
  88. }
  89. #define DETOUR_TRAMPOLINE_EMPTY(trampoline) \
  90. __declspec(naked) trampoline \
  91. { \
  92. __asm { nop };\
  93. __asm { nop };\
  94. __asm { xor eax, eax };\
  95. __asm { mov eax, [eax] };\
  96. __asm { ret };\
  97. __asm { nop };\
  98. __asm { nop };\
  99. __asm { nop };\
  100. __asm { nop };\
  101. __asm { nop };\
  102. __asm { nop };\
  103. __asm { nop };\
  104. __asm { nop };\
  105. __asm { nop };\
  106. __asm { nop };\
  107. __asm { nop };\
  108. __asm { nop };\
  109. __asm { nop };\
  110. __asm { nop };\
  111. __asm { nop };\
  112. __asm { nop };\
  113. __asm { nop };\
  114. __asm { nop };\
  115. __asm { nop };\
  116. __asm { nop };\
  117. __asm { nop };\
  118. __asm { nop };\
  119. __asm { nop };\
  120. __asm { nop };\
  121. __asm { nop };\
  122. }
  123. /////////////////////////////////////////////////////////// Binary Structures.
  124. //
  125. #pragma pack(push, 8)
  126. typedef struct _DETOUR_SECTION_HEADER
  127. {
  128. DWORD cbHeaderSize;
  129. DWORD nSignature;
  130. DWORD nDataOffset;
  131. DWORD cbDataSize;
  132. DWORD nOriginalImportVirtualAddress;
  133. DWORD nOriginalImportSize;
  134. DWORD nOriginalBoundImportVirtualAddress;
  135. DWORD nOriginalBoundImportSize;
  136. DWORD nOriginalIatVirtualAddress;
  137. DWORD nOriginalIatSize;
  138. DWORD nOriginalSizeOfImage;
  139. DWORD nReserve;
  140. } DETOUR_SECTION_HEADER, *PDETOUR_SECTION_HEADER;
  141. typedef struct _DETOUR_SECTION_RECORD
  142. {
  143. DWORD cbBytes;
  144. DWORD nReserved;
  145. GUID guid;
  146. } DETOUR_SECTION_RECORD, *PDETOUR_SECTION_RECORD;
  147. #pragma pack(pop)
  148. #define DETOUR_SECTION_HEADER_DECLARE(cbSectionSize) \
  149. { \
  150. sizeof(DETOUR_SECTION_HEADER),\
  151. DETOUR_SECTION_HEADER_SIGNATURE,\
  152. sizeof(DETOUR_SECTION_HEADER),\
  153. (cbSectionSize),\
  154. \
  155. 0,\
  156. 0,\
  157. 0,\
  158. 0,\
  159. \
  160. 0,\
  161. 0,\
  162. 0,\
  163. 0,\
  164. }
  165. ///////////////////////////////////////////////////////////// Binary Typedefs.
  166. //
  167. typedef BOOL (CALLBACK *PF_DETOUR_BINARY_BYWAY_CALLBACK)(PVOID pContext,
  168. PCHAR pszFile,
  169. PCHAR *ppszOutFile);
  170. typedef BOOL (CALLBACK *PF_DETOUR_BINARY_FILE_CALLBACK)(PVOID pContext,
  171. PCHAR pszOrigFile,
  172. PCHAR pszFile,
  173. PCHAR *ppszOutFile);
  174. typedef BOOL (CALLBACK *PF_DETOUR_BINARY_SYMBOL_CALLBACK)(PVOID pContext,
  175. DWORD nOrdinal,
  176. PCHAR pszOrigSymbol,
  177. PCHAR pszSymbol,
  178. PCHAR *ppszOutSymbol);
  179. typedef BOOL (CALLBACK *PF_DETOUR_BINARY_FINAL_CALLBACK)(PVOID pContext);
  180. typedef BOOL (CALLBACK *PF_DETOUR_BINARY_EXPORT_CALLBACK)(PVOID pContext,
  181. DWORD nOrdinal,
  182. PCHAR pszName,
  183. PBYTE pbCode);
  184. typedef VOID * PDETOUR_BINARY;
  185. typedef VOID * PDETOUR_LOADED_BINARY;
  186. //////////////////////////////////////////////////////// Trampoline Functions.
  187. //
  188. PBYTE WINAPI DetourFunction(PBYTE pbTargetFunction,
  189. PBYTE pbDetourFunction);
  190. BOOL WINAPI DetourFunctionWithEmptyTrampoline(PBYTE pbTrampoline,
  191. PBYTE pbTarget,
  192. PBYTE pbDetour);
  193. BOOL WINAPI DetourFunctionWithEmptyTrampolineEx(PBYTE pbTrampoline,
  194. PBYTE pbTarget,
  195. PBYTE pbDetour,
  196. PBYTE *ppbRealTrampoline,
  197. PBYTE *ppbRealTarget,
  198. PBYTE *ppbRealDetour);
  199. BOOL WINAPI DetourFunctionWithTrampoline(PBYTE pbTrampoline,
  200. PBYTE pbDetour);
  201. BOOL WINAPI DetourFunctionWithTrampolineEx(PBYTE pbTrampoline,
  202. PBYTE pbDetour,
  203. PBYTE *ppbRealTrampoline,
  204. PBYTE *ppbRealTarget);
  205. BOOL WINAPI DetourRemove(PBYTE pbTrampoline, PBYTE pbDetour);
  206. ////////////////////////////////////////////////////////////// Code Functions.
  207. //
  208. PBYTE WINAPI DetourFindFunction(PCHAR pszModule, PCHAR pszFunction);
  209. PBYTE WINAPI DetourGetFinalCode(PBYTE pbCode, BOOL fSkipJmp);
  210. PBYTE WINAPI DetourCopyInstruction(PBYTE pbDst, PBYTE pbSrc, PBYTE *ppbTarget);
  211. PBYTE WINAPI DetourCopyInstructionEx(PBYTE pbDst,
  212. PBYTE pbSrc,
  213. PBYTE *ppbTarget,
  214. LONG *plExtra);
  215. ///////////////////////////////////////////////////// Loaded Binary Functions.
  216. //
  217. HMODULE WINAPI DetourEnumerateModules(HMODULE hModuleLast);
  218. PBYTE WINAPI DetourGetEntryPoint(HMODULE hModule);
  219. BOOL WINAPI DetourEnumerateExports(HMODULE hModule,
  220. PVOID pContext,
  221. PF_DETOUR_BINARY_EXPORT_CALLBACK pfExport);
  222. PBYTE WINAPI DetourFindPayload(HMODULE hModule, REFGUID rguid, DWORD *pcbData);
  223. DWORD WINAPI DetourGetSizeOfPayloads(HMODULE hModule);
  224. ///////////////////////////////////////////////// Persistent Binary Functions.
  225. //
  226. BOOL WINAPI DetourBinaryBindA(PCHAR pszFile, PCHAR pszDll, PCHAR pszPath);
  227. BOOL WINAPI DetourBinaryBindW(PWCHAR pwzFile, PWCHAR pwzDll, PWCHAR pwzPath);
  228. #ifdef UNICODE
  229. #define DetourBinaryBind DetourBinaryBindW
  230. #else
  231. #define DetourBinaryBind DetourBinaryBindA
  232. #endif // !UNICODE
  233. PDETOUR_BINARY WINAPI DetourBinaryOpen(HANDLE hFile);
  234. PBYTE WINAPI DetourBinaryEnumeratePayloads(PDETOUR_BINARY pBinary,
  235. GUID *pGuid,
  236. DWORD *pcbData,
  237. DWORD *pnIterator);
  238. PBYTE WINAPI DetourBinaryFindPayload(PDETOUR_BINARY pBinary,
  239. REFGUID rguid,
  240. DWORD *pcbData);
  241. PBYTE WINAPI DetourBinarySetPayload(PDETOUR_BINARY pBinary,
  242. REFGUID rguid,
  243. PBYTE pbData,
  244. DWORD cbData);
  245. BOOL WINAPI DetourBinaryDeletePayload(PDETOUR_BINARY pBinary, REFGUID rguid);
  246. BOOL WINAPI DetourBinaryPurgePayloads(PDETOUR_BINARY pBinary);
  247. BOOL WINAPI DetourBinaryResetImports(PDETOUR_BINARY pBinary);
  248. BOOL WINAPI DetourBinaryEditImports(PDETOUR_BINARY pBinary,
  249. PVOID pContext,
  250. PF_DETOUR_BINARY_BYWAY_CALLBACK pfByway,
  251. PF_DETOUR_BINARY_FILE_CALLBACK pfFile,
  252. PF_DETOUR_BINARY_SYMBOL_CALLBACK pfSymbol,
  253. PF_DETOUR_BINARY_FINAL_CALLBACK pfFinal);
  254. BOOL WINAPI DetourBinaryWrite(PDETOUR_BINARY pBinary, HANDLE hFile);
  255. BOOL WINAPI DetourBinaryClose(PDETOUR_BINARY pBinary);
  256. /////////////////////////////////////////////// First Chance Exception Filter.
  257. //
  258. LPTOP_LEVEL_EXCEPTION_FILTER WINAPI
  259. DetourFirstChanceExceptionFilter(LPTOP_LEVEL_EXCEPTION_FILTER lpTopLevelFilter);
  260. ///////////////////////////////////////////////// Create Process & Inject Dll.
  261. //
  262. typedef BOOL (WINAPI *PDETOUR_CREATE_PROCESS_ROUTINEA)
  263. (LPCSTR lpApplicationName,
  264. LPSTR lpCommandLine,
  265. LPSECURITY_ATTRIBUTES lpProcessAttributes,
  266. LPSECURITY_ATTRIBUTES lpThreadAttributes,
  267. BOOL bInheritHandles,
  268. DWORD dwCreationFlags,
  269. LPVOID lpEnvironment,
  270. LPCSTR lpCurrentDirectory,
  271. LPSTARTUPINFOA lpStartupInfo,
  272. LPPROCESS_INFORMATION lpProcessInformation);
  273. typedef BOOL (WINAPI *PDETOUR_CREATE_PROCESS_ROUTINEW)
  274. (LPCWSTR lpApplicationName,
  275. LPWSTR lpCommandLine,
  276. LPSECURITY_ATTRIBUTES lpProcessAttributes,
  277. LPSECURITY_ATTRIBUTES lpThreadAttributes,
  278. BOOL bInheritHandles,
  279. DWORD dwCreationFlags,
  280. LPVOID lpEnvironment,
  281. LPCWSTR lpCurrentDirectory,
  282. LPSTARTUPINFOW lpStartupInfo,
  283. LPPROCESS_INFORMATION lpProcessInformation);
  284. BOOL WINAPI DetourCreateProcessWithDllA(LPCSTR lpApplicationName,
  285. LPSTR lpCommandLine,
  286. LPSECURITY_ATTRIBUTES lpProcessAttributes,
  287. LPSECURITY_ATTRIBUTES lpThreadAttributes,
  288. BOOL bInheritHandles,
  289. DWORD dwCreationFlags,
  290. LPVOID lpEnvironment,
  291. LPCSTR lpCurrentDirectory,
  292. LPSTARTUPINFOA lpStartupInfo,
  293. LPPROCESS_INFORMATION lpProcessInformation,
  294. LPCSTR lpDllName,
  295. PDETOUR_CREATE_PROCESS_ROUTINEA
  296. pfCreateProcessA);
  297. BOOL WINAPI DetourCreateProcessWithDllW(LPCWSTR lpApplicationName,
  298. LPWSTR lpCommandLine,
  299. LPSECURITY_ATTRIBUTES lpProcessAttributes,
  300. LPSECURITY_ATTRIBUTES lpThreadAttributes,
  301. BOOL bInheritHandles,
  302. DWORD dwCreationFlags,
  303. LPVOID lpEnvironment,
  304. LPCWSTR lpCurrentDirectory,
  305. LPSTARTUPINFOW lpStartupInfo,
  306. LPPROCESS_INFORMATION lpProcessInformation,
  307. LPCWSTR lpDllName,
  308. PDETOUR_CREATE_PROCESS_ROUTINEW
  309. pfCreateProcessW);
  310. #ifdef UNICODE
  311. #define DetourCreateProcessWithDll DetourCreateProcessWithDllW
  312. #define PDETOUR_CREATE_PROCESS_ROUTINE PDETOUR_CREATE_PROCESS_ROUTINEW
  313. #else
  314. #define DetourCreateProcessWithDll DetourCreateProcessWithDllA
  315. #define PDETOUR_CREATE_PROCESS_ROUTINE PDETOUR_CREATE_PROCESS_ROUTINEA
  316. #endif // !UNICODE
  317. BOOL WINAPI DetourContinueProcessWithDllA(HANDLE hProcess, LPCSTR lpDllName);
  318. BOOL WINAPI DetourContinueProcessWithDllW(HANDLE hProcess, LPCWSTR lpDllName);
  319. #ifdef UNICODE
  320. #define DetourContinueProcessWithDll DetourContinueProcessWithDllW
  321. #else
  322. #define DetourContinueProcessWithDll DetourContinueProcessWithDllA
  323. #endif // !UNICODE
  324. //
  325. //////////////////////////////////////////////////////////////////////////////
  326. #ifdef __cplusplus
  327. }
  328. #endif // __cplusplus
  329. /////////////////////////////////////////////////////////////////// Old Names.
  330. //
  331. #define ContinueProcessWithDll DetourContinueProcessWithDll
  332. #define ContinueProcessWithDllA DetourContinueProcessWithDllA
  333. #define ContinueProcessWithDllW DetourContinueProcessWithDllW
  334. #define CreateProcessWithDll DetourCreateProcessWithDll
  335. #define CreateProcessWithDllA DetourCreateProcessWithDllA
  336. #define CreateProcessWithDllW DetourCreateProcessWithDllW
  337. #define DETOUR_TRAMPOLINE_WO_TARGET DETOUR_TRAMPOLINE_EMPTY
  338. #define DetourBinaryPurgePayload DetourBinaryPurgePayloads
  339. #define DetourEnumerateExportsForInstance DetourEnumerateExports
  340. #define DetourEnumerateInstances DetourEnumerateModules
  341. #define DetourFindEntryPointForInstance DetourGetEntryPoint
  342. #define DetourFindFinalCode DetourGetFinalCode
  343. #define DetourFindPayloadInBinary DetourFindPayload
  344. #define DetourGetSizeOfBinary DetourGetSizeOfPayloads
  345. #define DetourRemoveWithTrampoline DetourRemove
  346. #define PCREATE_PROCESS_ROUTINE PDETOUR_CREATE_PROCESS_ROUTINE
  347. #define PCREATE_PROCESS_ROUTINEA PDETOUR_CREATE_PROCESS_ROUTINEA
  348. #define PCREATE_PROCESS_ROUTINEW PDETOUR_CREATE_PROCESS_ROUTINEW
  349. //
  350. //////////////////////////////////////////////// Detours Internal Definitions.
  351. //
  352. #ifdef __cplusplus
  353. #ifdef DETOURS_INTERNAL
  354. //////////////////////////////////////////////////////////////////////////////
  355. //
  356. #ifdef IMAGEAPI // defined by IMAGEHLP.H
  357. typedef LPAPI_VERSION (NTAPI *PF_ImagehlpApiVersionEx)(LPAPI_VERSION AppVersion);
  358. typedef BOOL (NTAPI *PF_SymInitialize)(IN HANDLE hProcess,
  359. IN LPSTR UserSearchPath,
  360. IN BOOL fInvadeProcess);
  361. typedef DWORD (NTAPI *PF_SymSetOptions)(IN DWORD SymOptions);
  362. typedef DWORD (NTAPI *PF_SymGetOptions)(VOID);
  363. typedef BOOL (NTAPI *PF_SymLoadModule)(IN HANDLE hProcess,
  364. IN HANDLE hFile,
  365. IN PSTR ImageName,
  366. IN PSTR ModuleName,
  367. IN DWORD BaseOfDll,
  368. IN DWORD SizeOfDll);
  369. typedef BOOL (NTAPI *PF_SymGetModuleInfo)(IN HANDLE hProcess,
  370. IN DWORD dwAddr,
  371. OUT PIMAGEHLP_MODULE ModuleInfo);
  372. typedef BOOL (NTAPI *PF_SymGetSymFromName)(IN HANDLE hProcess,
  373. IN LPSTR Name,
  374. OUT PIMAGEHLP_SYMBOL Symbol);
  375. typedef BOOL (NTAPI *PF_BindImage)(IN LPSTR pszImageName,
  376. IN LPSTR pszDllPath,
  377. IN LPSTR pszSymbolPath);
  378. typedef struct _DETOUR_SYM_INFO
  379. {
  380. HANDLE hProcess;
  381. HMODULE hImageHlp;
  382. PF_ImagehlpApiVersionEx pfImagehlpApiVersionEx;
  383. PF_SymInitialize pfSymInitialize;
  384. PF_SymSetOptions pfSymSetOptions;
  385. PF_SymGetOptions pfSymGetOptions;
  386. PF_SymLoadModule pfSymLoadModule;
  387. PF_SymGetModuleInfo pfSymGetModuleInfo;
  388. PF_SymGetSymFromName pfSymGetSymFromName;
  389. PF_BindImage pfBindImage;
  390. } DETOUR_SYM_INFO, *PDETOUR_SYM_INFO;
  391. PDETOUR_SYM_INFO DetourLoadImageHlp(VOID);
  392. #endif // IMAGEAPI
  393. //////////////////////////////////////////////////////////////////////////////
  394. //
  395. class CDetourEnableWriteOnCodePage
  396. {
  397. public:
  398. CDetourEnableWriteOnCodePage(PBYTE pbCode, LONG cbCode = DETOUR_TRAMPOLINE_SIZE)
  399. {
  400. m_pbCode = pbCode;
  401. m_cbCode = cbCode;
  402. m_dwOldPerm = 0;
  403. m_hProcess = GetCurrentProcess();
  404. if (m_pbCode && m_cbCode) {
  405. if (!FlushInstructionCache(m_hProcess, pbCode, cbCode)) {
  406. return;
  407. }
  408. if (!VirtualProtect(pbCode,
  409. cbCode,
  410. PAGE_EXECUTE_READWRITE,
  411. &m_dwOldPerm)) {
  412. return;
  413. }
  414. }
  415. }
  416. ~CDetourEnableWriteOnCodePage()
  417. {
  418. if (m_dwOldPerm && m_pbCode && m_cbCode) {
  419. DWORD dwTemp = 0;
  420. if (!FlushInstructionCache(m_hProcess, m_pbCode, m_cbCode)) {
  421. return;
  422. }
  423. if (!VirtualProtect(m_pbCode, m_cbCode, m_dwOldPerm, &dwTemp)) {
  424. return;
  425. }
  426. }
  427. }
  428. BOOL SetPermission(DWORD dwPerms)
  429. {
  430. if (m_dwOldPerm && m_pbCode && m_cbCode) {
  431. m_dwOldPerm = dwPerms;
  432. return TRUE;
  433. }
  434. return FALSE;
  435. }
  436. BOOL IsValid(VOID)
  437. {
  438. return m_pbCode && m_cbCode && m_dwOldPerm;
  439. }
  440. private:
  441. HANDLE m_hProcess;
  442. PBYTE m_pbCode;
  443. LONG m_cbCode;
  444. DWORD m_dwOldPerm;
  445. };
  446. //////////////////////////////////////////////////////////////////////////////
  447. //
  448. inline PBYTE DetourGenMovEax(PBYTE pbCode, UINT32 nValue)
  449. {
  450. *pbCode++ = 0xB8;
  451. *((UINT32*&)pbCode)++ = nValue;
  452. return pbCode;
  453. }
  454. inline PBYTE DetourGenMovEbx(PBYTE pbCode, UINT32 nValue)
  455. {
  456. *pbCode++ = 0xBB;
  457. *((UINT32*&)pbCode)++ = nValue;
  458. return pbCode;
  459. }
  460. inline PBYTE DetourGenMovEcx(PBYTE pbCode, UINT32 nValue)
  461. {
  462. *pbCode++ = 0xB9;
  463. *((UINT32*&)pbCode)++ = nValue;
  464. return pbCode;
  465. }
  466. inline PBYTE DetourGenMovEdx(PBYTE pbCode, UINT32 nValue)
  467. {
  468. *pbCode++ = 0xBA;
  469. *((UINT32*&)pbCode)++ = nValue;
  470. return pbCode;
  471. }
  472. inline PBYTE DetourGenMovEsi(PBYTE pbCode, UINT32 nValue)
  473. {
  474. *pbCode++ = 0xBE;
  475. *((UINT32*&)pbCode)++ = nValue;
  476. return pbCode;
  477. }
  478. inline PBYTE DetourGenMovEdi(PBYTE pbCode, UINT32 nValue)
  479. {
  480. *pbCode++ = 0xBF;
  481. *((UINT32*&)pbCode)++ = nValue;
  482. return pbCode;
  483. }
  484. inline PBYTE DetourGenMovEbp(PBYTE pbCode, UINT32 nValue)
  485. {
  486. *pbCode++ = 0xBD;
  487. *((UINT32*&)pbCode)++ = nValue;
  488. return pbCode;
  489. }
  490. inline PBYTE DetourGenMovEsp(PBYTE pbCode, UINT32 nValue)
  491. {
  492. *pbCode++ = 0xBC;
  493. *((UINT32*&)pbCode)++ = nValue;
  494. return pbCode;
  495. }
  496. inline PBYTE DetourGenPush(PBYTE pbCode, UINT32 nValue)
  497. {
  498. *pbCode++ = 0x68;
  499. *((UINT32*&)pbCode)++ = nValue;
  500. return pbCode;
  501. }
  502. inline PBYTE DetourGenPushad(PBYTE pbCode)
  503. {
  504. *pbCode++ = 0x60;
  505. return pbCode;
  506. }
  507. inline PBYTE DetourGenPopad(PBYTE pbCode)
  508. {
  509. *pbCode++ = 0x61;
  510. return pbCode;
  511. }
  512. inline PBYTE DetourGenJmp(PBYTE pbCode, PBYTE pbJmpDst, PBYTE pbJmpSrc = 0)
  513. {
  514. if (pbJmpSrc == 0) {
  515. pbJmpSrc = pbCode;
  516. }
  517. *pbCode++ = 0xE9;
  518. *((INT32*&)pbCode)++ = pbJmpDst - (pbJmpSrc + 5);
  519. return pbCode;
  520. }
  521. inline PBYTE DetourGenCall(PBYTE pbCode, PBYTE pbJmpDst, PBYTE pbJmpSrc = 0)
  522. {
  523. if (pbJmpSrc == 0) {
  524. pbJmpSrc = pbCode;
  525. }
  526. *pbCode++ = 0xE8;
  527. *((INT32*&)pbCode)++ = pbJmpDst - (pbJmpSrc + 5);
  528. return pbCode;
  529. }
  530. inline PBYTE DetourGenBreak(PBYTE pbCode)
  531. {
  532. *pbCode++ = 0xcc;
  533. return pbCode;
  534. }
  535. inline PBYTE DetourGenRet(PBYTE pbCode)
  536. {
  537. *pbCode++ = 0xc3;
  538. return pbCode;
  539. }
  540. inline PBYTE DetourGenNop(PBYTE pbCode)
  541. {
  542. *pbCode++ = 0x90;
  543. return pbCode;
  544. }
  545. #endif DETOURS_INTERAL
  546. #endif // __cplusplus
  547. #endif // _DETOURS_H_
  548. //
  549. //////////////////////////////////////////////////////////////// End of File.