From 165011e8de483b3b9cdd182e6c5c33ed0da93f4b Mon Sep 17 00:00:00 2001 From: snowie2000 Date: Thu, 12 Sep 2024 17:13:10 +0800 Subject: [PATCH] add the macloader project launch application from macloader using the standard detour API. --- detours.h | 955 +++++++++++++++++++++++++++++++++++----------- gdiexe.rc | 70 ---- gdipp.sln | 30 ++ gdipp.vcxproj | 18 +- macloader.rc | Bin 0 -> 5836 bytes macloader.vcxproj | 147 +++++++ resource.h | 14 + run.cpp | 251 +++++++----- 8 files changed, 1095 insertions(+), 390 deletions(-) delete mode 100644 gdiexe.rc create mode 100644 macloader.rc create mode 100644 macloader.vcxproj diff --git a/detours.h b/detours.h index 16be412..fe7acf1 100644 --- a/detours.h +++ b/detours.h @@ -1,8 +1,8 @@ -////////////////////////////////////////////////////////////////////////////// +///////////////////////////////////////////////////////////////////////////// // // Core Detours Functionality (detours.h of detours.lib) // -// Microsoft Research Detours Package, Version 2.1. +// Microsoft Research Detours Package, Version 4.0.1 // // Copyright (c) Microsoft Corporation. All rights reserved. // @@ -11,7 +11,57 @@ #ifndef _DETOURS_H_ #define _DETOURS_H_ -#define DETOURS_VERSION 20100 // 2.1.0 +#define DETOURS_VERSION 0x4c0c1 // 0xMAJORcMINORcPATCH + +////////////////////////////////////////////////////////////////////////////// +// + +#undef DETOURS_X64 +#undef DETOURS_X86 +#undef DETOURS_IA64 +#undef DETOURS_ARM +#undef DETOURS_ARM64 +#undef DETOURS_BITS +#undef DETOURS_32BIT +#undef DETOURS_64BIT + +#if defined(_X86_) +#define DETOURS_X86 +#define DETOURS_OPTION_BITS 64 + +#elif defined(_AMD64_) +#define DETOURS_X64 +#define DETOURS_OPTION_BITS 32 + +#elif defined(_IA64_) +#define DETOURS_IA64 +#define DETOURS_OPTION_BITS 32 + +#elif defined(_ARM_) +#define DETOURS_ARM + +#elif defined(_ARM64_) +#define DETOURS_ARM64 + +#else +#error Unknown architecture (x86, amd64, ia64, arm, arm64) +#endif + +#ifdef _WIN64 +#undef DETOURS_32BIT +#define DETOURS_64BIT 1 +#define DETOURS_BITS 64 +// If all 64bit kernels can run one and only one 32bit architecture. +//#define DETOURS_OPTION_BITS 32 +#else +#define DETOURS_32BIT 1 +#undef DETOURS_64BIT +#define DETOURS_BITS 32 +// If all 64bit kernels can run one and only one 32bit architecture. +//#define DETOURS_OPTION_BITS 32 +#endif + +#define VER_DETOURS_BITS DETOUR_STRINGIFY(DETOURS_BITS) ////////////////////////////////////////////////////////////////////////////// // @@ -21,10 +71,193 @@ typedef LONG LONG_PTR; typedef ULONG ULONG_PTR; #endif -#ifndef __in_z -#define __in_z +///////////////////////////////////////////////// SAL 2.0 Annotations w/o SAL. +// +// These definitions are include so that Detours will build even if the +// compiler doesn't have full SAL 2.0 support. +// +#ifndef DETOURS_DONT_REMOVE_SAL_20 + +#ifdef DETOURS_TEST_REMOVE_SAL_20 +#undef _Analysis_assume_ +#undef _Benign_race_begin_ +#undef _Benign_race_end_ +#undef _Field_range_ +#undef _Field_size_ +#undef _In_ +#undef _In_bytecount_ +#undef _In_count_ +#undef _In_opt_ +#undef _In_opt_bytecount_ +#undef _In_opt_count_ +#undef _In_opt_z_ +#undef _In_range_ +#undef _In_reads_ +#undef _In_reads_bytes_ +#undef _In_reads_opt_ +#undef _In_reads_opt_bytes_ +#undef _In_reads_or_z_ +#undef _In_z_ +#undef _Inout_ +#undef _Inout_opt_ +#undef _Inout_z_count_ +#undef _Out_ +#undef _Out_opt_ +#undef _Out_writes_ +#undef _Outptr_result_maybenull_ +#undef _Readable_bytes_ +#undef _Success_ +#undef _Writable_bytes_ +#undef _Pre_notnull_ +#endif + +#if defined(_Deref_out_opt_z_) && !defined(_Outptr_result_maybenull_) +#define _Outptr_result_maybenull_ _Deref_out_opt_z_ +#endif + +#if defined(_In_count_) && !defined(_In_reads_) +#define _In_reads_(x) _In_count_(x) +#endif + +#if defined(_In_opt_count_) && !defined(_In_reads_opt_) +#define _In_reads_opt_(x) _In_opt_count_(x) +#endif + +#if defined(_In_opt_bytecount_) && !defined(_In_reads_opt_bytes_) +#define _In_reads_opt_bytes_(x) _In_opt_bytecount_(x) +#endif + +#if defined(_In_bytecount_) && !defined(_In_reads_bytes_) +#define _In_reads_bytes_(x) _In_bytecount_(x) +#endif + +#ifndef _In_ +#define _In_ +#endif + +#ifndef _In_bytecount_ +#define _In_bytecount_(x) +#endif + +#ifndef _In_count_ +#define _In_count_(x) +#endif + +#ifndef _In_opt_ +#define _In_opt_ +#endif + +#ifndef _In_opt_bytecount_ +#define _In_opt_bytecount_(x) +#endif + +#ifndef _In_opt_count_ +#define _In_opt_count_(x) +#endif + +#ifndef _In_opt_z_ +#define _In_opt_z_ +#endif + +#ifndef _In_range_ +#define _In_range_(x,y) +#endif + +#ifndef _In_reads_ +#define _In_reads_(x) +#endif + +#ifndef _In_reads_bytes_ +#define _In_reads_bytes_(x) +#endif + +#ifndef _In_reads_opt_ +#define _In_reads_opt_(x) +#endif + +#ifndef _In_reads_opt_bytes_ +#define _In_reads_opt_bytes_(x) +#endif + +#ifndef _In_reads_or_z_ +#define _In_reads_or_z_ +#endif + +#ifndef _In_z_ +#define _In_z_ +#endif + +#ifndef _Inout_ +#define _Inout_ +#endif + +#ifndef _Inout_opt_ +#define _Inout_opt_ +#endif + +#ifndef _Inout_z_count_ +#define _Inout_z_count_(x) +#endif + +#ifndef _Out_ +#define _Out_ +#endif + +#ifndef _Out_opt_ +#define _Out_opt_ +#endif + +#ifndef _Out_writes_ +#define _Out_writes_(x) +#endif + +#ifndef _Outptr_result_maybenull_ +#define _Outptr_result_maybenull_ +#endif + +#ifndef _Writable_bytes_ +#define _Writable_bytes_(x) +#endif + +#ifndef _Readable_bytes_ +#define _Readable_bytes_(x) +#endif + +#ifndef _Success_ +#define _Success_(x) +#endif + +#ifndef _Pre_notnull_ +#define _Pre_notnull_ +#endif + +#ifdef DETOURS_INTERNAL + +#pragma warning(disable:4615) // unknown warning type (suppress with older compilers) + +#ifndef _Benign_race_begin_ +#define _Benign_race_begin_ +#endif + +#ifndef _Benign_race_end_ +#define _Benign_race_end_ +#endif + +#ifndef _Field_size_ +#define _Field_size_(x) +#endif + +#ifndef _Field_range_ +#define _Field_range_(x,y) #endif +#ifndef _Analysis_assume_ +#define _Analysis_assume_(x) +#endif + +#endif // DETOURS_INTERNAL +#endif // DETOURS_DONT_REMOVE_SAL_20 + ////////////////////////////////////////////////////////////////////////////// // #ifndef GUID_DEFINED @@ -59,6 +292,10 @@ typedef struct _GUID #endif // !_REFGUID_DEFINED #endif // !__cplusplus +#ifndef ARRAYSIZE +#define ARRAYSIZE(x) (sizeof(x)/sizeof(x[0])) +#endif + // ////////////////////////////////////////////////////////////////////////////// @@ -73,6 +310,7 @@ extern "C" { #define DETOUR_SECTION_HEADER_SIGNATURE 0x00727444 // "Dtr\0" extern const GUID DETOUR_EXE_RESTORE_GUID; +extern const GUID DETOUR_EXE_HELPER_GUID; #define DETOUR_TRAMPOLINE_SIGNATURE 0x21727444 // Dtr! typedef struct _DETOUR_TRAMPOLINE DETOUR_TRAMPOLINE, *PDETOUR_TRAMPOLINE; @@ -123,23 +361,40 @@ typedef struct _DETOUR_CLR_HEADER IMAGE_DATA_DIRECTORY MetaData; ULONG Flags; - // Followed by the rest of the header. + // Followed by the rest of the IMAGE_COR20_HEADER } DETOUR_CLR_HEADER, *PDETOUR_CLR_HEADER; typedef struct _DETOUR_EXE_RESTORE { - ULONG cb; + DWORD cb; + DWORD cbidh; + DWORD cbinh; + DWORD cbclr; - PIMAGE_DOS_HEADER pidh; - PIMAGE_NT_HEADERS pinh; - PULONG pclrFlags; - DWORD impDirProt; + PBYTE pidh; + PBYTE pinh; + PBYTE pclr; IMAGE_DOS_HEADER idh; - IMAGE_NT_HEADERS inh; - ULONG clrFlags; + union { + IMAGE_NT_HEADERS inh; + IMAGE_NT_HEADERS32 inh32; + IMAGE_NT_HEADERS64 inh64; + BYTE raw[sizeof(IMAGE_NT_HEADERS64) + + sizeof(IMAGE_SECTION_HEADER) * 32]; + }; + DETOUR_CLR_HEADER clr; + } DETOUR_EXE_RESTORE, *PDETOUR_EXE_RESTORE; +typedef struct _DETOUR_EXE_HELPER +{ + DWORD cb; + DWORD pid; + DWORD nDlls; + CHAR rDlls[4]; +} DETOUR_EXE_HELPER, *PDETOUR_EXE_HELPER; + #pragma pack(pop) #define DETOUR_SECTION_HEADER_DECLARE(cbSectionSize) \ @@ -160,181 +415,347 @@ typedef struct _DETOUR_EXE_RESTORE 0,\ } +/////////////////////////////////////////////////////////////// Helper Macros. +// +#define DETOURS_STRINGIFY(x) DETOURS_STRINGIFY_(x) +#define DETOURS_STRINGIFY_(x) #x + ///////////////////////////////////////////////////////////// Binary Typedefs. // -typedef BOOL (CALLBACK *PF_DETOUR_BINARY_BYWAY_CALLBACK)(PVOID pContext, - PCHAR pszFile, - PCHAR *ppszOutFile); - -typedef BOOL (CALLBACK *PF_DETOUR_BINARY_FILE_CALLBACK)(PVOID pContext, - PCHAR pszOrigFile, - PCHAR pszFile, - PCHAR *ppszOutFile); - -typedef BOOL (CALLBACK *PF_DETOUR_BINARY_SYMBOL_CALLBACK)(PVOID pContext, - ULONG nOrigOrdinal, - ULONG nOrdinal, - ULONG *pnOutOrdinal, - PCHAR pszOrigSymbol, - PCHAR pszSymbol, - PCHAR *ppszOutSymbol); - -typedef BOOL (CALLBACK *PF_DETOUR_BINARY_COMMIT_CALLBACK)(PVOID pContext); - -typedef BOOL (CALLBACK *PF_DETOUR_ENUMERATE_EXPORT_CALLBACK)(PVOID pContext, - ULONG nOrdinal, - PCHAR pszName, - PVOID pCode); +typedef BOOL (CALLBACK *PF_DETOUR_BINARY_BYWAY_CALLBACK)( + _In_opt_ PVOID pContext, + _In_opt_ LPCSTR pszFile, + _Outptr_result_maybenull_ LPCSTR *ppszOutFile); + +typedef BOOL (CALLBACK *PF_DETOUR_BINARY_FILE_CALLBACK)( + _In_opt_ PVOID pContext, + _In_ LPCSTR pszOrigFile, + _In_ LPCSTR pszFile, + _Outptr_result_maybenull_ LPCSTR *ppszOutFile); + +typedef BOOL (CALLBACK *PF_DETOUR_BINARY_SYMBOL_CALLBACK)( + _In_opt_ PVOID pContext, + _In_ ULONG nOrigOrdinal, + _In_ ULONG nOrdinal, + _Out_ ULONG *pnOutOrdinal, + _In_opt_ LPCSTR pszOrigSymbol, + _In_opt_ LPCSTR pszSymbol, + _Outptr_result_maybenull_ LPCSTR *ppszOutSymbol); + +typedef BOOL (CALLBACK *PF_DETOUR_BINARY_COMMIT_CALLBACK)( + _In_opt_ PVOID pContext); + +typedef BOOL (CALLBACK *PF_DETOUR_ENUMERATE_EXPORT_CALLBACK)(_In_opt_ PVOID pContext, + _In_ ULONG nOrdinal, + _In_opt_ LPCSTR pszName, + _In_opt_ PVOID pCode); + +typedef BOOL (CALLBACK *PF_DETOUR_IMPORT_FILE_CALLBACK)(_In_opt_ PVOID pContext, + _In_opt_ HMODULE hModule, + _In_opt_ LPCSTR pszFile); + +typedef BOOL (CALLBACK *PF_DETOUR_IMPORT_FUNC_CALLBACK)(_In_opt_ PVOID pContext, + _In_ DWORD nOrdinal, + _In_opt_ LPCSTR pszFunc, + _In_opt_ PVOID pvFunc); + +// Same as PF_DETOUR_IMPORT_FUNC_CALLBACK but extra indirection on last parameter. +typedef BOOL (CALLBACK *PF_DETOUR_IMPORT_FUNC_CALLBACK_EX)(_In_opt_ PVOID pContext, + _In_ DWORD nOrdinal, + _In_opt_ LPCSTR pszFunc, + _In_opt_ PVOID* ppvFunc); typedef VOID * PDETOUR_BINARY; typedef VOID * PDETOUR_LOADED_BINARY; -//////////////////////////////////////////////////////////// Detours 2.1 APIs. +//////////////////////////////////////////////////////////// Transaction APIs. // +LONG WINAPI DetourTransactionBegin(VOID); +LONG WINAPI DetourTransactionAbort(VOID); +LONG WINAPI DetourTransactionCommit(VOID); +LONG WINAPI DetourTransactionCommitEx(_Out_opt_ PVOID **pppFailedPointer); -LONG WINAPI DetourTransactionBegin(); -LONG WINAPI DetourTransactionAbort(); -LONG WINAPI DetourTransactionCommit(); -LONG WINAPI DetourTransactionCommitEx(PVOID **pppFailedPointer); +LONG WINAPI DetourUpdateThread(_In_ HANDLE hThread); -LONG WINAPI DetourUpdateThread(HANDLE hThread); +LONG WINAPI DetourAttach(_Inout_ PVOID *ppPointer, + _In_ PVOID pDetour); -LONG WINAPI DetourAttach(PVOID *ppPointer, - PVOID pDetour); +LONG WINAPI DetourAttachEx(_Inout_ PVOID *ppPointer, + _In_ PVOID pDetour, + _Out_opt_ PDETOUR_TRAMPOLINE *ppRealTrampoline, + _Out_opt_ PVOID *ppRealTarget, + _Out_opt_ PVOID *ppRealDetour); -LONG WINAPI DetourAttachEx(PVOID *ppPointer, - PVOID pDetour, - PDETOUR_TRAMPOLINE *ppRealTrampoline, - PVOID *ppRealTarget, - PVOID *ppRealDetour); +LONG WINAPI DetourDetach(_Inout_ PVOID *ppPointer, + _In_ PVOID pDetour); -LONG WINAPI DetourDetach(PVOID *ppPointer, - PVOID pDetour); - -VOID WINAPI DetourSetIgnoreTooSmall(BOOL fIgnore); +BOOL WINAPI DetourSetIgnoreTooSmall(_In_ BOOL fIgnore); +BOOL WINAPI DetourSetRetainRegions(_In_ BOOL fRetain); +PVOID WINAPI DetourSetSystemRegionLowerBound(_In_ PVOID pSystemRegionLowerBound); +PVOID WINAPI DetourSetSystemRegionUpperBound(_In_ PVOID pSystemRegionUpperBound); ////////////////////////////////////////////////////////////// Code Functions. // -PVOID WINAPI DetourFindFunction(PCSTR pszModule, PCSTR pszFunction); -PVOID WINAPI DetourCodeFromPointer(PVOID pPointer, PVOID *ppGlobals); - -PVOID WINAPI DetourCopyInstruction(PVOID pDst, PVOID pSrc, PVOID *ppTarget); -PVOID WINAPI DetourCopyInstructionEx(PVOID pDst, - PVOID pSrc, - PVOID *ppTarget, - LONG *plExtra); +PVOID WINAPI DetourFindFunction(_In_ LPCSTR pszModule, + _In_ LPCSTR pszFunction); +PVOID WINAPI DetourCodeFromPointer(_In_ PVOID pPointer, + _Out_opt_ PVOID *ppGlobals); +PVOID WINAPI DetourCopyInstruction(_In_opt_ PVOID pDst, + _Inout_opt_ PVOID *ppDstPool, + _In_ PVOID pSrc, + _Out_opt_ PVOID *ppTarget, + _Out_opt_ LONG *plExtra); +BOOL WINAPI DetourSetCodeModule(_In_ HMODULE hModule, + _In_ BOOL fLimitReferencesToModule); ///////////////////////////////////////////////////// Loaded Binary Functions. // -HMODULE WINAPI DetourEnumerateModules(HMODULE hModuleLast); -PVOID WINAPI DetourGetEntryPoint(HMODULE hModule); -ULONG WINAPI DetourGetModuleSize(HMODULE hModule); -BOOL WINAPI DetourEnumerateExports(HMODULE hModule, - PVOID pContext, - PF_DETOUR_ENUMERATE_EXPORT_CALLBACK pfExport); - -PVOID WINAPI DetourFindPayload(HMODULE hModule, REFGUID rguid, DWORD *pcbData); -DWORD WINAPI DetourGetSizeOfPayloads(HMODULE hModule); +HMODULE WINAPI DetourGetContainingModule(_In_ PVOID pvAddr); +HMODULE WINAPI DetourEnumerateModules(_In_opt_ HMODULE hModuleLast); +PVOID WINAPI DetourGetEntryPoint(_In_opt_ HMODULE hModule); +ULONG WINAPI DetourGetModuleSize(_In_opt_ HMODULE hModule); +BOOL WINAPI DetourEnumerateExports(_In_ HMODULE hModule, + _In_opt_ PVOID pContext, + _In_ PF_DETOUR_ENUMERATE_EXPORT_CALLBACK pfExport); +BOOL WINAPI DetourEnumerateImports(_In_opt_ HMODULE hModule, + _In_opt_ PVOID pContext, + _In_opt_ PF_DETOUR_IMPORT_FILE_CALLBACK pfImportFile, + _In_opt_ PF_DETOUR_IMPORT_FUNC_CALLBACK pfImportFunc); + +BOOL WINAPI DetourEnumerateImportsEx(_In_opt_ HMODULE hModule, + _In_opt_ PVOID pContext, + _In_opt_ PF_DETOUR_IMPORT_FILE_CALLBACK pfImportFile, + _In_opt_ PF_DETOUR_IMPORT_FUNC_CALLBACK_EX pfImportFuncEx); + +_Writable_bytes_(*pcbData) +_Readable_bytes_(*pcbData) +_Success_(return != NULL) +PVOID WINAPI DetourFindPayload(_In_opt_ HMODULE hModule, + _In_ REFGUID rguid, + _Out_ DWORD *pcbData); + +_Writable_bytes_(*pcbData) +_Readable_bytes_(*pcbData) +_Success_(return != NULL) +PVOID WINAPI DetourFindPayloadEx(_In_ REFGUID rguid, + _Out_ DWORD * pcbData); + +DWORD WINAPI DetourGetSizeOfPayloads(_In_opt_ HMODULE hModule); ///////////////////////////////////////////////// Persistent Binary Functions. // -PDETOUR_BINARY WINAPI DetourBinaryOpen(HANDLE hFile); -PVOID WINAPI DetourBinaryEnumeratePayloads(PDETOUR_BINARY pBinary, - GUID *pGuid, - DWORD *pcbData, - DWORD *pnIterator); -PVOID WINAPI DetourBinaryFindPayload(PDETOUR_BINARY pBinary, - REFGUID rguid, - DWORD *pcbData); -PVOID WINAPI DetourBinarySetPayload(PDETOUR_BINARY pBinary, - REFGUID rguid, - PVOID pData, - DWORD cbData); -BOOL WINAPI DetourBinaryDeletePayload(PDETOUR_BINARY pBinary, REFGUID rguid); -BOOL WINAPI DetourBinaryPurgePayloads(PDETOUR_BINARY pBinary); -BOOL WINAPI DetourBinaryResetImports(PDETOUR_BINARY pBinary); -BOOL WINAPI DetourBinaryEditImports(PDETOUR_BINARY pBinary, - PVOID pContext, - PF_DETOUR_BINARY_BYWAY_CALLBACK pfByway, - PF_DETOUR_BINARY_FILE_CALLBACK pfFile, - PF_DETOUR_BINARY_SYMBOL_CALLBACK pfSymbol, - PF_DETOUR_BINARY_COMMIT_CALLBACK pfCommit); -BOOL WINAPI DetourBinaryWrite(PDETOUR_BINARY pBinary, HANDLE hFile); -BOOL WINAPI DetourBinaryClose(PDETOUR_BINARY pBinary); +PDETOUR_BINARY WINAPI DetourBinaryOpen(_In_ HANDLE hFile); + +_Writable_bytes_(*pcbData) +_Readable_bytes_(*pcbData) +_Success_(return != NULL) +PVOID WINAPI DetourBinaryEnumeratePayloads(_In_ PDETOUR_BINARY pBinary, + _Out_opt_ GUID *pGuid, + _Out_ DWORD *pcbData, + _Inout_ DWORD *pnIterator); + +_Writable_bytes_(*pcbData) +_Readable_bytes_(*pcbData) +_Success_(return != NULL) +PVOID WINAPI DetourBinaryFindPayload(_In_ PDETOUR_BINARY pBinary, + _In_ REFGUID rguid, + _Out_ DWORD *pcbData); + +PVOID WINAPI DetourBinarySetPayload(_In_ PDETOUR_BINARY pBinary, + _In_ REFGUID rguid, + _In_reads_opt_(cbData) PVOID pData, + _In_ DWORD cbData); +BOOL WINAPI DetourBinaryDeletePayload(_In_ PDETOUR_BINARY pBinary, _In_ REFGUID rguid); +BOOL WINAPI DetourBinaryPurgePayloads(_In_ PDETOUR_BINARY pBinary); +BOOL WINAPI DetourBinaryResetImports(_In_ PDETOUR_BINARY pBinary); +BOOL WINAPI DetourBinaryEditImports(_In_ PDETOUR_BINARY pBinary, + _In_opt_ PVOID pContext, + _In_opt_ PF_DETOUR_BINARY_BYWAY_CALLBACK pfByway, + _In_opt_ PF_DETOUR_BINARY_FILE_CALLBACK pfFile, + _In_opt_ PF_DETOUR_BINARY_SYMBOL_CALLBACK pfSymbol, + _In_opt_ PF_DETOUR_BINARY_COMMIT_CALLBACK pfCommit); +BOOL WINAPI DetourBinaryWrite(_In_ PDETOUR_BINARY pBinary, _In_ HANDLE hFile); +BOOL WINAPI DetourBinaryClose(_In_ PDETOUR_BINARY pBinary); /////////////////////////////////////////////////// Create Process & Load Dll. // -typedef BOOL (WINAPI *PDETOUR_CREATE_PROCESS_ROUTINEA) - (LPCSTR lpApplicationName, - LPSTR lpCommandLine, - LPSECURITY_ATTRIBUTES lpProcessAttributes, - LPSECURITY_ATTRIBUTES lpThreadAttributes, - BOOL bInheritHandles, - DWORD dwCreationFlags, - LPVOID lpEnvironment, - LPCSTR lpCurrentDirectory, - LPSTARTUPINFOA lpStartupInfo, - LPPROCESS_INFORMATION lpProcessInformation); - -typedef BOOL (WINAPI *PDETOUR_CREATE_PROCESS_ROUTINEW) - (LPCWSTR lpApplicationName, - LPWSTR lpCommandLine, - LPSECURITY_ATTRIBUTES lpProcessAttributes, - LPSECURITY_ATTRIBUTES lpThreadAttributes, - BOOL bInheritHandles, - DWORD dwCreationFlags, - LPVOID lpEnvironment, - LPCWSTR lpCurrentDirectory, - LPSTARTUPINFOW lpStartupInfo, - LPPROCESS_INFORMATION lpProcessInformation); - -BOOL WINAPI DetourCreateProcessWithDllA(LPCSTR lpApplicationName, - __in_z LPSTR lpCommandLine, - LPSECURITY_ATTRIBUTES lpProcessAttributes, - LPSECURITY_ATTRIBUTES lpThreadAttributes, - BOOL bInheritHandles, - DWORD dwCreationFlags, - LPVOID lpEnvironment, - LPCSTR lpCurrentDirectory, - LPSTARTUPINFOA lpStartupInfo, - LPPROCESS_INFORMATION lpProcessInformation, - LPCSTR lpDetouredDllFullName, - LPCSTR lpDllName, - PDETOUR_CREATE_PROCESS_ROUTINEA - pfCreateProcessA); - -BOOL WINAPI DetourCreateProcessWithDllW(LPCWSTR lpApplicationName, - __in_z LPWSTR lpCommandLine, - LPSECURITY_ATTRIBUTES lpProcessAttributes, - LPSECURITY_ATTRIBUTES lpThreadAttributes, - BOOL bInheritHandles, - DWORD dwCreationFlags, - LPVOID lpEnvironment, - LPCWSTR lpCurrentDirectory, - LPSTARTUPINFOW lpStartupInfo, - LPPROCESS_INFORMATION lpProcessInformation, - LPCSTR lpDetouredDllFullName, - LPCSTR lpDllName, - PDETOUR_CREATE_PROCESS_ROUTINEW - pfCreateProcessW); +typedef BOOL (WINAPI *PDETOUR_CREATE_PROCESS_ROUTINEA)( + _In_opt_ LPCSTR lpApplicationName, + _Inout_opt_ LPSTR lpCommandLine, + _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes, + _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes, + _In_ BOOL bInheritHandles, + _In_ DWORD dwCreationFlags, + _In_opt_ LPVOID lpEnvironment, + _In_opt_ LPCSTR lpCurrentDirectory, + _In_ LPSTARTUPINFOA lpStartupInfo, + _Out_ LPPROCESS_INFORMATION lpProcessInformation); + +typedef BOOL (WINAPI *PDETOUR_CREATE_PROCESS_ROUTINEW)( + _In_opt_ LPCWSTR lpApplicationName, + _Inout_opt_ LPWSTR lpCommandLine, + _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes, + _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes, + _In_ BOOL bInheritHandles, + _In_ DWORD dwCreationFlags, + _In_opt_ LPVOID lpEnvironment, + _In_opt_ LPCWSTR lpCurrentDirectory, + _In_ LPSTARTUPINFOW lpStartupInfo, + _Out_ LPPROCESS_INFORMATION lpProcessInformation); + +BOOL WINAPI DetourCreateProcessWithDllA(_In_opt_ LPCSTR lpApplicationName, + _Inout_opt_ LPSTR lpCommandLine, + _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes, + _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes, + _In_ BOOL bInheritHandles, + _In_ DWORD dwCreationFlags, + _In_opt_ LPVOID lpEnvironment, + _In_opt_ LPCSTR lpCurrentDirectory, + _In_ LPSTARTUPINFOA lpStartupInfo, + _Out_ LPPROCESS_INFORMATION lpProcessInformation, + _In_ LPCSTR lpDllName, + _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA); + +BOOL WINAPI DetourCreateProcessWithDllW(_In_opt_ LPCWSTR lpApplicationName, + _Inout_opt_ LPWSTR lpCommandLine, + _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes, + _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes, + _In_ BOOL bInheritHandles, + _In_ DWORD dwCreationFlags, + _In_opt_ LPVOID lpEnvironment, + _In_opt_ LPCWSTR lpCurrentDirectory, + _In_ LPSTARTUPINFOW lpStartupInfo, + _Out_ LPPROCESS_INFORMATION lpProcessInformation, + _In_ LPCSTR lpDllName, + _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW); + +#ifdef UNICODE +#define DetourCreateProcessWithDll DetourCreateProcessWithDllW +#define PDETOUR_CREATE_PROCESS_ROUTINE PDETOUR_CREATE_PROCESS_ROUTINEW +#else +#define DetourCreateProcessWithDll DetourCreateProcessWithDllA +#define PDETOUR_CREATE_PROCESS_ROUTINE PDETOUR_CREATE_PROCESS_ROUTINEA +#endif // !UNICODE + +BOOL WINAPI DetourCreateProcessWithDllExA(_In_opt_ LPCSTR lpApplicationName, + _Inout_opt_ LPSTR lpCommandLine, + _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes, + _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes, + _In_ BOOL bInheritHandles, + _In_ DWORD dwCreationFlags, + _In_opt_ LPVOID lpEnvironment, + _In_opt_ LPCSTR lpCurrentDirectory, + _In_ LPSTARTUPINFOA lpStartupInfo, + _Out_ LPPROCESS_INFORMATION lpProcessInformation, + _In_ LPCSTR lpDllName, + _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA); + +BOOL WINAPI DetourCreateProcessWithDllExW(_In_opt_ LPCWSTR lpApplicationName, + _Inout_opt_ LPWSTR lpCommandLine, + _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes, + _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes, + _In_ BOOL bInheritHandles, + _In_ DWORD dwCreationFlags, + _In_opt_ LPVOID lpEnvironment, + _In_opt_ LPCWSTR lpCurrentDirectory, + _In_ LPSTARTUPINFOW lpStartupInfo, + _Out_ LPPROCESS_INFORMATION lpProcessInformation, + _In_ LPCSTR lpDllName, + _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW); + +#ifdef UNICODE +#define DetourCreateProcessWithDllEx DetourCreateProcessWithDllExW +#else +#define DetourCreateProcessWithDllEx DetourCreateProcessWithDllExA +#endif // !UNICODE + +BOOL WINAPI DetourCreateProcessWithDllsA(_In_opt_ LPCSTR lpApplicationName, + _Inout_opt_ LPSTR lpCommandLine, + _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes, + _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes, + _In_ BOOL bInheritHandles, + _In_ DWORD dwCreationFlags, + _In_opt_ LPVOID lpEnvironment, + _In_opt_ LPCSTR lpCurrentDirectory, + _In_ LPSTARTUPINFOA lpStartupInfo, + _Out_ LPPROCESS_INFORMATION lpProcessInformation, + _In_ DWORD nDlls, + _In_reads_(nDlls) LPCSTR *rlpDlls, + _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA); + +BOOL WINAPI DetourCreateProcessWithDllsW(_In_opt_ LPCWSTR lpApplicationName, + _Inout_opt_ LPWSTR lpCommandLine, + _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes, + _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes, + _In_ BOOL bInheritHandles, + _In_ DWORD dwCreationFlags, + _In_opt_ LPVOID lpEnvironment, + _In_opt_ LPCWSTR lpCurrentDirectory, + _In_ LPSTARTUPINFOW lpStartupInfo, + _Out_ LPPROCESS_INFORMATION lpProcessInformation, + _In_ DWORD nDlls, + _In_reads_(nDlls) LPCSTR *rlpDlls, + _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW); + +#ifdef UNICODE +#define DetourCreateProcessWithDlls DetourCreateProcessWithDllsW +#else +#define DetourCreateProcessWithDlls DetourCreateProcessWithDllsA +#endif // !UNICODE + +BOOL WINAPI DetourProcessViaHelperA(_In_ DWORD dwTargetPid, + _In_ LPCSTR lpDllName, + _In_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA); + +BOOL WINAPI DetourProcessViaHelperW(_In_ DWORD dwTargetPid, + _In_ LPCSTR lpDllName, + _In_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW); #ifdef UNICODE -#define DetourCreateProcessWithDll DetourCreateProcessWithDllW -#define PDETOUR_CREATE_PROCESS_ROUTINE PDETOUR_CREATE_PROCESS_ROUTINEW +#define DetourProcessViaHelper DetourProcessViaHelperW #else -#define DetourCreateProcessWithDll DetourCreateProcessWithDllA -#define PDETOUR_CREATE_PROCESS_ROUTINE PDETOUR_CREATE_PROCESS_ROUTINEA +#define DetourProcessViaHelper DetourProcessViaHelperA #endif // !UNICODE -BOOL WINAPI DetourCopyPayloadToProcess(HANDLE hProcess, - REFGUID rguid, - PVOID pvData, - DWORD cbData); -BOOL WINAPI DetourRestoreAfterWith(); -BOOL WINAPI DetourRestoreAfterWithEx(PVOID pvData, DWORD cbData); +BOOL WINAPI DetourProcessViaHelperDllsA(_In_ DWORD dwTargetPid, + _In_ DWORD nDlls, + _In_reads_(nDlls) LPCSTR *rlpDlls, + _In_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA); + +BOOL WINAPI DetourProcessViaHelperDllsW(_In_ DWORD dwTargetPid, + _In_ DWORD nDlls, + _In_reads_(nDlls) LPCSTR *rlpDlls, + _In_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW); + +#ifdef UNICODE +#define DetourProcessViaHelperDlls DetourProcessViaHelperDllsW +#else +#define DetourProcessViaHelperDlls DetourProcessViaHelperDllsA +#endif // !UNICODE -HMODULE WINAPI DetourGetDetouredMarker(); +BOOL WINAPI DetourUpdateProcessWithDll(_In_ HANDLE hProcess, + _In_reads_(nDlls) LPCSTR *rlpDlls, + _In_ DWORD nDlls); + +BOOL WINAPI DetourUpdateProcessWithDllEx(_In_ HANDLE hProcess, + _In_ HMODULE hImage, + _In_ BOOL bIs32Bit, + _In_reads_(nDlls) LPCSTR *rlpDlls, + _In_ DWORD nDlls); + +BOOL WINAPI DetourCopyPayloadToProcess(_In_ HANDLE hProcess, + _In_ REFGUID rguid, + _In_reads_bytes_(cbData) PVOID pvData, + _In_ DWORD cbData); +BOOL WINAPI DetourRestoreAfterWith(VOID); +BOOL WINAPI DetourRestoreAfterWithEx(_In_reads_bytes_(cbData) PVOID pvData, + _In_ DWORD cbData); +BOOL WINAPI DetourIsHelperProcess(VOID); +VOID CALLBACK DetourFinishHelperProcess(_In_ HWND, + _In_ HINSTANCE, + _In_ LPSTR, + _In_ INT); // ////////////////////////////////////////////////////////////////////////////// @@ -347,13 +768,8 @@ HMODULE WINAPI DetourGetDetouredMarker(); #ifdef __cplusplus #ifdef DETOURS_INTERNAL -#ifndef __deref_out -#define __deref_out -#endif - -#ifndef __deref -#define __deref -#endif +#define NOTHROW +// #define NOTHROW (nothrow) ////////////////////////////////////////////////////////////////////////////// // @@ -365,34 +781,37 @@ typedef IMAGEHLP_SYMBOL SYMBOL_INFO; typedef PIMAGEHLP_SYMBOL PSYMBOL_INFO; static inline -LONG InterlockedCompareExchange(LONG *ptr, LONG nval, LONG oval) +LONG InterlockedCompareExchange(_Inout_ LONG *ptr, _In_ LONG nval, _In_ LONG oval) { return (LONG)::InterlockedCompareExchange((PVOID*)ptr, (PVOID)nval, (PVOID)oval); } #else +#pragma warning(push) +#pragma warning(disable:4091) // empty typedef #include +#pragma warning(pop) #endif #ifdef IMAGEAPI // defined by DBGHELP.H -typedef LPAPI_VERSION (NTAPI *PF_ImagehlpApiVersionEx)(LPAPI_VERSION AppVersion); +typedef LPAPI_VERSION (NTAPI *PF_ImagehlpApiVersionEx)(_In_ LPAPI_VERSION AppVersion); -typedef BOOL (NTAPI *PF_SymInitialize)(IN HANDLE hProcess, - IN LPCSTR UserSearchPath, - IN BOOL fInvadeProcess); -typedef DWORD (NTAPI *PF_SymSetOptions)(IN DWORD SymOptions); +typedef BOOL (NTAPI *PF_SymInitialize)(_In_ HANDLE hProcess, + _In_opt_ LPCSTR UserSearchPath, + _In_ BOOL fInvadeProcess); +typedef DWORD (NTAPI *PF_SymSetOptions)(_In_ DWORD SymOptions); typedef DWORD (NTAPI *PF_SymGetOptions)(VOID); -typedef DWORD64 (NTAPI *PF_SymLoadModule64)(IN HANDLE hProcess, - IN HANDLE hFile, - IN PSTR ImageName, - IN PSTR ModuleName, - IN DWORD64 BaseOfDll, - IN DWORD SizeOfDll); -typedef BOOL (NTAPI *PF_SymGetModuleInfo64)(IN HANDLE hProcess, - IN DWORD64 qwAddr, - OUT PIMAGEHLP_MODULE64 ModuleInfo); -typedef BOOL (NTAPI *PF_SymFromName)(IN HANDLE hProcess, - IN LPSTR Name, - OUT PSYMBOL_INFO Symbol); +typedef DWORD64 (NTAPI *PF_SymLoadModule64)(_In_ HANDLE hProcess, + _In_opt_ HANDLE hFile, + _In_ LPSTR ImageName, + _In_opt_ LPSTR ModuleName, + _In_ DWORD64 BaseOfDll, + _In_opt_ DWORD SizeOfDll); +typedef BOOL (NTAPI *PF_SymGetModuleInfo64)(_In_ HANDLE hProcess, + _In_ DWORD64 qwAddr, + _Out_ PIMAGEHLP_MODULE64 ModuleInfo); +typedef BOOL (NTAPI *PF_SymFromName)(_In_ HANDLE hProcess, + _In_ LPSTR Name, + _Out_ PSYMBOL_INFO Symbol); typedef struct _DETOUR_SYM_INFO { @@ -407,14 +826,19 @@ typedef struct _DETOUR_SYM_INFO PF_SymFromName pfSymFromName; } DETOUR_SYM_INFO, *PDETOUR_SYM_INFO; -PDETOUR_SYM_INFO DetourLoadDbgHelp(VOID); +PDETOUR_SYM_INFO DetourLoadImageHlp(VOID); #endif // IMAGEAPI +#if defined(_INC_STDIO) && !defined(_CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS) +#error detours.h must be included before stdio.h (or at least define _CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS earlier) +#endif +#define _CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS 1 + #ifndef DETOUR_TRACE #if DETOUR_DEBUG #define DETOUR_TRACE(x) printf x -#define DETOUR_BREAK() DebugBreak() +#define DETOUR_BREAK() __debugbreak() #include #include #else @@ -423,7 +847,24 @@ PDETOUR_SYM_INFO DetourLoadDbgHelp(VOID); #endif #endif -#ifdef DETOURS_IA64 +#if 1 || defined(DETOURS_IA64) + +// +// IA64 instructions are 41 bits, 3 per bundle, plus 5 bit bundle template => 128 bits per bundle. +// + +#define DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE (3) + +#define DETOUR_IA64_TEMPLATE_OFFSET (0) +#define DETOUR_IA64_TEMPLATE_SIZE (5) + +#define DETOUR_IA64_INSTRUCTION_SIZE (41) +#define DETOUR_IA64_INSTRUCTION0_OFFSET (DETOUR_IA64_TEMPLATE_SIZE) +#define DETOUR_IA64_INSTRUCTION1_OFFSET (DETOUR_IA64_TEMPLATE_SIZE + DETOUR_IA64_INSTRUCTION_SIZE) +#define DETOUR_IA64_INSTRUCTION2_OFFSET (DETOUR_IA64_TEMPLATE_SIZE + DETOUR_IA64_INSTRUCTION_SIZE + DETOUR_IA64_INSTRUCTION_SIZE) + +C_ASSERT(DETOUR_IA64_TEMPLATE_SIZE + DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE * DETOUR_IA64_INSTRUCTION_SIZE == 128); + __declspec(align(16)) struct DETOUR_IA64_BUNDLE { public: @@ -433,12 +874,6 @@ __declspec(align(16)) struct DETOUR_IA64_BUNDLE UINT64 wide[2]; }; - public: - struct DETOUR_IA64_METADATA; - - typedef BOOL (DETOUR_IA64_BUNDLE::* DETOUR_IA64_METACOPY) - (const DETOUR_IA64_METADATA *pMeta, DETOUR_IA64_BUNDLE *pDst) const; - enum { A_UNIT = 1u, I_UNIT = 2u, @@ -447,8 +882,6 @@ __declspec(align(16)) struct DETOUR_IA64_BUNDLE F_UNIT = 5u, L_UNIT = 6u, X_UNIT = 7u, - UNIT_MASK = 7u, - STOP = 8u }; struct DETOUR_IA64_METADATA { @@ -456,19 +889,17 @@ __declspec(align(16)) struct DETOUR_IA64_BUNDLE ULONG nUnit0 : 4; // Unit for slot 0 ULONG nUnit1 : 4; // Unit for slot 1 ULONG nUnit2 : 4; // Unit for slot 2 - DETOUR_IA64_METACOPY pfCopy; // Function pointer. }; protected: - BOOL CopyBytes(const DETOUR_IA64_METADATA *pMeta, DETOUR_IA64_BUNDLE *pDst) const; - BOOL CopyBytesMMB(const DETOUR_IA64_METADATA *pMeta, DETOUR_IA64_BUNDLE *pDst) const; - BOOL CopyBytesMBB(const DETOUR_IA64_METADATA *pMeta, DETOUR_IA64_BUNDLE *pDst) const; - BOOL CopyBytesBBB(const DETOUR_IA64_METADATA *pMeta, DETOUR_IA64_BUNDLE *pDst) const; - BOOL CopyBytesMLX(const DETOUR_IA64_METADATA *pMeta, DETOUR_IA64_BUNDLE *pDst) const; - static const DETOUR_IA64_METADATA s_rceCopyTable[33]; - public: + UINT RelocateBundle(_Inout_ DETOUR_IA64_BUNDLE* pDst, _Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra) const; + + bool RelocateInstruction(_Inout_ DETOUR_IA64_BUNDLE* pDst, + _In_ BYTE slot, + _Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra) const; + // 120 112 104 96 88 80 72 64 56 48 40 32 24 16 8 0 // f. e. d. c. b. a. 9. 8. 7. 6. 5. 4. 3. 2. 1. 0. @@ -482,44 +913,142 @@ __declspec(align(16)) struct DETOUR_IA64_BUNDLE // 0fff ffff ff80 0000 0000 0000 0000 0000 : Two [123.. 87] // f000 0000 0000 0000 0000 0000 0000 0000 : Two [127..124] BYTE GetTemplate() const; + // Get 4 bit opcodes. BYTE GetInst0() const; BYTE GetInst1() const; BYTE GetInst2() const; + BYTE GetUnit(BYTE slot) const; BYTE GetUnit0() const; BYTE GetUnit1() const; BYTE GetUnit2() const; + // Get 37 bit data. UINT64 GetData0() const; UINT64 GetData1() const; UINT64 GetData2() const; - public: - BOOL IsBrl() const; - VOID SetBrl(); - VOID SetBrl(UINT64 target); - UINT64 GetBrlTarget() const; - VOID SetBrlTarget(UINT64 target); - VOID SetBrlImm(UINT64 imm); - UINT64 GetBrlImm() const; + // Get/set the full 41 bit instructions. + UINT64 GetInstruction(BYTE slot) const; + UINT64 GetInstruction0() const; + UINT64 GetInstruction1() const; + UINT64 GetInstruction2() const; + void SetInstruction(BYTE slot, UINT64 instruction); + void SetInstruction0(UINT64 instruction); + void SetInstruction1(UINT64 instruction); + void SetInstruction2(UINT64 instruction); + + // Get/set bitfields. + static UINT64 GetBits(UINT64 Value, UINT64 Offset, UINT64 Count); + static UINT64 SetBits(UINT64 Value, UINT64 Offset, UINT64 Count, UINT64 Field); + + // Get specific read-only fields. + static UINT64 GetOpcode(UINT64 instruction); // 4bit opcode + static UINT64 GetX(UINT64 instruction); // 1bit opcode extension + static UINT64 GetX3(UINT64 instruction); // 3bit opcode extension + static UINT64 GetX6(UINT64 instruction); // 6bit opcode extension + + // Get/set specific fields. + static UINT64 GetImm7a(UINT64 instruction); + static UINT64 SetImm7a(UINT64 instruction, UINT64 imm7a); + static UINT64 GetImm13c(UINT64 instruction); + static UINT64 SetImm13c(UINT64 instruction, UINT64 imm13c); + static UINT64 GetSignBit(UINT64 instruction); + static UINT64 SetSignBit(UINT64 instruction, UINT64 signBit); + static UINT64 GetImm20a(UINT64 instruction); + static UINT64 SetImm20a(UINT64 instruction, UINT64 imm20a); + static UINT64 GetImm20b(UINT64 instruction); + static UINT64 SetImm20b(UINT64 instruction, UINT64 imm20b); + + static UINT64 SignExtend(UINT64 Value, UINT64 Offset); BOOL IsMovlGp() const; - UINT64 GetMovlGp() const; - VOID SetMovlGp(UINT64 gp); + VOID SetInst(BYTE Slot, BYTE nInst); VOID SetInst0(BYTE nInst); VOID SetInst1(BYTE nInst); VOID SetInst2(BYTE nInst); + VOID SetData(BYTE Slot, UINT64 nData); VOID SetData0(UINT64 nData); VOID SetData1(UINT64 nData); VOID SetData2(UINT64 nData); + BOOL SetNop(BYTE Slot); BOOL SetNop0(); BOOL SetNop1(); BOOL SetNop2(); - BOOL SetStop(); - BOOL Copy(DETOUR_IA64_BUNDLE *pDst) const; + public: + BOOL IsBrl() const; + VOID SetBrl(); + VOID SetBrl(UINT64 target); + UINT64 GetBrlTarget() const; + VOID SetBrlTarget(UINT64 target); + VOID SetBrlImm(UINT64 imm); + UINT64 GetBrlImm() const; + + UINT64 GetMovlGp() const; + VOID SetMovlGp(UINT64 gp); + + VOID SetStop(); + + UINT Copy(_Out_ DETOUR_IA64_BUNDLE *pDst, _Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra = NULL) const; }; #endif // DETOURS_IA64 +#ifdef DETOURS_ARM + +#define DETOURS_PFUNC_TO_PBYTE(p) ((PBYTE)(((ULONG_PTR)(p)) & ~(ULONG_PTR)1)) +#define DETOURS_PBYTE_TO_PFUNC(p) ((PBYTE)(((ULONG_PTR)(p)) | (ULONG_PTR)1)) + +#endif // DETOURS_ARM + +////////////////////////////////////////////////////////////////////////////// + +#ifdef __cplusplus +extern "C" { +#endif // __cplusplus + +#define DETOUR_OFFLINE_LIBRARY(x) \ +PVOID WINAPI DetourCopyInstruction##x(_In_opt_ PVOID pDst, \ + _Inout_opt_ PVOID *ppDstPool, \ + _In_ PVOID pSrc, \ + _Out_opt_ PVOID *ppTarget, \ + _Out_opt_ LONG *plExtra); \ + \ +BOOL WINAPI DetourSetCodeModule##x(_In_ HMODULE hModule, \ + _In_ BOOL fLimitReferencesToModule); \ + +DETOUR_OFFLINE_LIBRARY(X86) +DETOUR_OFFLINE_LIBRARY(X64) +DETOUR_OFFLINE_LIBRARY(ARM) +DETOUR_OFFLINE_LIBRARY(ARM64) +DETOUR_OFFLINE_LIBRARY(IA64) + +#undef DETOUR_OFFLINE_LIBRARY + +////////////////////////////////////////////////////////////////////////////// +// +// Helpers for manipulating page protection. +// + +_Success_(return != FALSE) +BOOL WINAPI DetourVirtualProtectSameExecuteEx(_In_ HANDLE hProcess, + _In_ PVOID pAddress, + _In_ SIZE_T nSize, + _In_ DWORD dwNewProtect, + _Out_ PDWORD pdwOldProtect); + +_Success_(return != FALSE) +BOOL WINAPI DetourVirtualProtectSameExecute(_In_ PVOID pAddress, + _In_ SIZE_T nSize, + _In_ DWORD dwNewProtect, + _Out_ PDWORD pdwOldProtect); +#ifdef __cplusplus +} +#endif // __cplusplus + +////////////////////////////////////////////////////////////////////////////// + +#define MM_ALLOCATION_GRANULARITY 0x10000 + ////////////////////////////////////////////////////////////////////////////// #endif // DETOURS_INTERNAL diff --git a/gdiexe.rc b/gdiexe.rc deleted file mode 100644 index 3addf8b..0000000 --- a/gdiexe.rc +++ /dev/null @@ -1,70 +0,0 @@ -#pragma code_page(65001) -#ifdef RC_INVOKED -#include -#endif - -#define IDS_USAGE 1 -#define IDS_DLL 2 -#define IDC_EXEC 3 - -#ifdef RC_INVOKED - -#define GDIPP_EXE -#include "gdidll.rc" - -VS_VERSION_INFO VERSIONINFO -FILEVERSION VER_NUMBER -PRODUCTVERSION VER_NUMBER -FILEOS VOS_NT_WINDOWS32 -FILETYPE VFT_APP -{ - BLOCK "StringFileInfo" - { - BLOCK "041104B0" - { - VALUE "CompanyName", "2ch" - VALUE "FileDescription", "GDI++ Font Rasterizer Driver" - VALUE "FileVersion", VER_STRING - VALUE "InternalName", "gdi++" - VALUE "LegalCopyright", "(C) 仧0x0D/0x20I, 460. All rights reserved." - VALUE "OriginalFilename", "gdi++.exe" - VALUE "ProductVersion", VER_STRING - VALUE "URL", "http://drwatson.nobody.jp/gdi++/" - } - } - - BLOCK "VarFileInfo" - { - VALUE "Translation", 0x0411 0x04B0 - } -} - -1 24 DISCARDABLE -{ -"\n" -"" -} - -//じゃぱにーず -STRINGTABLE DISCARDABLE -{ -IDS_USAGE "gdi++.exe argument ...\n\nEXE, またはショートカットなどをドロップしてください." -IDS_DLL "error: 0x%08x\nDLLが見つかりません." -IDC_EXEC "error: 0x%08x\n実行できません." -} - -//えーご(適当) -LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US - -STRINGTABLE DISCARDABLE -{ -IDS_USAGE "gdi++.exe argument ...\n\nPlease drag and drop executable files or shortcut files." -IDS_DLL "error: 0x%08x\nCannot find a DLL." -IDC_EXEC "error: 0x%08x\nCannot execute." -} - -#endif - -#ifdef APSTUDIO_INVOKED -#include "Please modify with a text editor instead of Visual Studio." -#endif diff --git a/gdipp.sln b/gdipp.sln index 22ac13a..83b7aaa 100644 --- a/gdipp.sln +++ b/gdipp.sln @@ -4,6 +4,8 @@ VisualStudioVersion = 17.4.33103.184 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MacType", "gdipp.vcxproj", "{15C33FD9-0811-4981-B08F-E0BAD74A3028}" EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "macloader", "macloader.vcxproj", "{6D6AC860-BA16-4BE7-9169-21787F21CB6F}" +EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug Infinality|Win32 = Debug Infinality|Win32 @@ -50,6 +52,34 @@ Global {15C33FD9-0811-4981-B08F-E0BAD74A3028}.Release+StaticHook|Win32.Build.0 = Release+StaticHook|Win32 {15C33FD9-0811-4981-B08F-E0BAD74A3028}.Release+StaticHook|x64.ActiveCfg = Release+StaticHook|x64 {15C33FD9-0811-4981-B08F-E0BAD74A3028}.Release+StaticHook|x64.Build.0 = Release+StaticHook|x64 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Debug Infinality|Win32.ActiveCfg = Debug|Win32 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Debug Infinality|Win32.Build.0 = Debug|Win32 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Debug Infinality|x64.ActiveCfg = Debug|x64 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Debug Infinality|x64.Build.0 = Debug|x64 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Debug|Win32.ActiveCfg = Debug|Win32 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Debug|Win32.Build.0 = Debug|Win32 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Debug|x64.ActiveCfg = Debug|x64 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Debug|x64.Build.0 = Debug|x64 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Rel+Detours|Win32.ActiveCfg = Release|Win32 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Rel+Detours|Win32.Build.0 = Release|Win32 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Rel+Detours|x64.ActiveCfg = Release|x64 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Rel+Detours|x64.Build.0 = Release|x64 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Rel+Trace|Win32.ActiveCfg = Release|Win32 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Rel+Trace|Win32.Build.0 = Release|Win32 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Rel+Trace|x64.ActiveCfg = Release|x64 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Rel+Trace|x64.Build.0 = Release|x64 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Release Infinality|Win32.ActiveCfg = Release|Win32 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Release Infinality|Win32.Build.0 = Release|Win32 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Release Infinality|x64.ActiveCfg = Release|x64 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Release Infinality|x64.Build.0 = Release|x64 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Release|Win32.ActiveCfg = Release|Win32 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Release|Win32.Build.0 = Release|Win32 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Release|x64.ActiveCfg = Release|x64 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Release|x64.Build.0 = Release|x64 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Release+StaticHook|Win32.ActiveCfg = Release|Win32 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Release+StaticHook|Win32.Build.0 = Release|Win32 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Release+StaticHook|x64.ActiveCfg = Release|x64 + {6D6AC860-BA16-4BE7-9169-21787F21CB6F}.Release+StaticHook|x64.Build.0 = Release|x64 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE diff --git a/gdipp.vcxproj b/gdipp.vcxproj index 87b7915..9f3658b 100644 --- a/gdipp.vcxproj +++ b/gdipp.vcxproj @@ -17,6 +17,14 @@ Debug x64 + + EXE + Win32 + + + EXE + x64 + Rel+Detours Win32 @@ -67,7 +75,7 @@ - DynamicLibrary + Application Unicode true v143 @@ -146,6 +154,12 @@ v143 Unicode + + v143 + + + v143 + @@ -443,7 +457,7 @@ true Speed false - WIN32;NDEBUG;_WINDOWS;_USRDLL;GDIPP_EXPORTS;_GDIPP_DLL;EASYHOOK;%(PreprocessorDefinitions) + WIN32;NDEBUG;_WINDOWS;_USRDLL;GDIPP_EXPORTS;_GDIPP_EXE;EASYHOOK;STATIC_LIB;%(PreprocessorDefinitions) Sync MultiThreaded false diff --git a/macloader.rc b/macloader.rc new file mode 100644 index 0000000000000000000000000000000000000000..1b54250c1f81b22f1a092f1c52fd1ad4a8080d6e GIT binary patch literal 5836 zcmdUzZEIpj6vxloE%ZA~4TUT%J|t;bmQqO6SgCm+MrolS);w9ZF{tTg%YNVe7Hxn3 zGmd(VhIN}4E|Jj#w1JIiS2kv>&DhB9t!r<1E890* z!LIGnZfQft$MhGB4e2%So~Itqfj4pM+Z{A{`_jHZO2PXrW?Ukn?_7fI+o?6}+*($# zx}8|Z&aBF4h38{y*sqKa&QTeh*lQFiU+5;TmavEA}{!M@7m*oAGAPluo@ z=2nwDYLR7S@YMlj4KDG0&lOhAJcq{_Sne?ICp3NOQX7mOGuooBIbPF9q!XH}P*>fK zCUgf#i*pt!l;?Hw{1l2h`qr6MS+FhEj%CP@q&AlQJe{?fC{IYA?*nJZnl=vE`W_&)?HPF5j7)_&n-s!)AhH>Q(TQl z8&M&u zb!Mt6OWL7V@fzA5QO%oF-GHnI+hyHqxRkgSrFyM(rb_K^5$~+tGft61X*&NB#A{`I zn!Y$kubqQd&g_g6^ozXr&{5akWX{Zc=j<>~(J-sS?0dvzmMTd;U|!9m73Id7taa`L z|H?BtG#LASSb2Pij&HE54ic`wL)@FiSpgp{<2L&`&$UQgWsTbJ+_Ri!bDrXusM^F) zyH5Eahu+$q-ceO~~e_L*M(rCFR*^EpYlsK)VtjXiuyl2fi{1sK5i-z<% zIW79`+A*rL)H+-naJ+VYip(7`kuR=^!gv~$ZK9@q+=pXjVi6A&xIef(b&uShea}c9 znte3Wscyz)|K+0 z%4OBK0HvgO~QL(Yi2|rAjnlw*DgB_|q5- zMLSQkSeue{GsNVOGvpGl*US~7zvljmUiy|@Gv#jL9QEu%8@Vi#k;U11GNNCjEthyM z*1c@@tUjGR&naNDGa+GHecVAl^*8AAKJ)*-|AM=qbn(Ay_P=2A + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + + + + + + + 17.0 + Win32Proj + {6d6ac860-ba16-4be7-9169-21787f21cb6f} + macloader + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + $(ProjectName)64 + + + $(ProjectName)64 + + + + Level3 + true + WIN32;_DEBUG;_WINDOWS;USE_DETOURS;_GDIPP_EXE;%(PreprocessorDefinitions) + Default + MultiThreadedDebugDLL + + + Windows + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_WINDOWS;USE_DETOURS;_GDIPP_EXE;%(PreprocessorDefinitions) + Default + MultiThreaded + + + Windows + true + true + true + + + + + Level3 + true + _DEBUG;_WINDOWS;USE_DETOURS;_GDIPP_EXE;_WIN64;%(PreprocessorDefinitions) + Default + + + Windows + true + + + + + Level3 + true + true + true + NDEBUG;_WINDOWS;USE_DETOURS;_GDIPP_EXE;_WIN64;%(PreprocessorDefinitions) + Default + MultiThreaded + + + Windows + true + true + true + + + + + + \ No newline at end of file diff --git a/resource.h b/resource.h index 7fe2c0d..75ccc1b 100644 --- a/resource.h +++ b/resource.h @@ -1424,3 +1424,17 @@ #define _APS_NEXT_SYMED_VALUE 101 #endif #endif +//{{NO_DEPENDENCIES}} +// Microsoft Visual C++ generated include file. +// Used by Resource.rc + +// Next default values for new objects +// +#ifdef APSTUDIO_INVOKED +#ifndef APSTUDIO_READONLY_SYMBOLS +#define _APS_NEXT_RESOURCE_VALUE 101 +#define _APS_NEXT_COMMAND_VALUE 40001 +#define _APS_NEXT_CONTROL_VALUE 1001 +#define _APS_NEXT_SYMED_VALUE 101 +#endif +#endif diff --git a/run.cpp b/run.cpp index ba2ce1a..5c88465 100644 --- a/run.cpp +++ b/run.cpp @@ -1,4 +1,4 @@ -// dll injection +// dll injection #define _CRT_SECURE_NO_DEPRECATE 1 #define WINVER 0x500 #define _WIN32_WINNT 0x500 @@ -14,7 +14,6 @@ #include #include "array.h" #include -#include "gdiexe.rc" // _vsnwprintf用 #include @@ -37,13 +36,21 @@ #pragma comment(lib, "ShLwApi.lib") #pragma comment(lib, "Ole32.lib") +#define IDS_USAGE 101 +#define IDS_DLL 102 +#define IDC_EXEC 103 + +static void showmsg(LPCSTR msg) { + MessageBoxA(NULL, msg, "MacType ERROR", MB_OK | MB_ICONSTOP); +} + static void errmsg(UINT id, DWORD code) { - char buffer [512]; - char format [128]; + char buffer[512]; + char format[128]; LoadStringA(GetModuleHandleA(NULL), id, format, 128); wnsprintfA(buffer, 512, format, code); - MessageBoxA(NULL, buffer, "MacType ERROR", MB_OK|MB_ICONSTOP); + showmsg(buffer); } inline HRESULT HresultFromLastError() @@ -53,7 +60,17 @@ inline HRESULT HresultFromLastError() } -//#include +#include "detours.h" +#ifdef _M_IX86 +#pragma comment (lib, "detours.lib") +const auto MacTypeDll = L"MacType.dll"; +const auto MacTypeDllA = "MacType.dll"; +#else +#pragma comment (lib, "detours64.lib") +const auto MacTypeDll = L"MacType64.dll"; +const auto MacTypeDllA = "MacType64.dll"; +#endif + HINSTANCE hinstDLL; @@ -62,60 +79,97 @@ HINSTANCE hinstDLL; #define _GDIPP_EXE #define _GDIPP_RUN_CPP -#include "supinfo.h" - -static BOOL (WINAPI * ORIG_CreateProcessW)(LPCWSTR lpApp, LPWSTR lpCmd, LPSECURITY_ATTRIBUTES pa, LPSECURITY_ATTRIBUTES ta, BOOL bInherit, DWORD dwFlags, LPVOID lpEnv, LPCWSTR lpDir, LPSTARTUPINFOW psi, LPPROCESS_INFORMATION ppi) - = CreateProcessW; - -static BOOL WINAPI IMPL_CreateProcessW(LPCWSTR lpApp, LPWSTR lpCmd, LPSECURITY_ATTRIBUTES pa, LPSECURITY_ATTRIBUTES ta, BOOL bInherit, DWORD dwFlags, LPVOID lpEnv, LPCWSTR lpDir, LPSTARTUPINFOW psi, LPPROCESS_INFORMATION ppi) -{ - return _CreateProcessAorW(lpApp, lpCmd, pa, ta, bInherit, dwFlags, lpEnv, lpDir, psi, ppi, ORIG_CreateProcessW); -} - +//#include "supinfo.h" //#define OLD_PSDK #ifdef OLD_PSDK extern "C" { -HRESULT WINAPI _SHILCreateFromPath(LPCWSTR pszPath, LPITEMIDLIST *ppidl, DWORD *rgflnOut) -{ - if (!pszPath || !ppidl) { - return E_INVALIDARG; - } + HRESULT WINAPI _SHILCreateFromPath(LPCWSTR pszPath, LPITEMIDLIST* ppidl, DWORD* rgflnOut) + { + if (!pszPath || !ppidl) { + return E_INVALIDARG; + } - LPSHELLFOLDER psf; - HRESULT hr = ::SHGetDesktopFolder(&psf); - if (hr != NOERROR) { + LPSHELLFOLDER psf; + HRESULT hr = ::SHGetDesktopFolder(&psf); + if (hr != NOERROR) { + return hr; + } + + ULONG chEaten; + LPOLESTR lpszDisplayName = ::StrDupW(pszPath); + hr = psf->ParseDisplayName(NULL, NULL, lpszDisplayName, &chEaten, ppidl, rgflnOut); + ::LocalFree(lpszDisplayName); + psf->Release(); return hr; } - ULONG chEaten; - LPOLESTR lpszDisplayName = ::StrDupW(pszPath); - hr = psf->ParseDisplayName(NULL, NULL, lpszDisplayName, &chEaten, ppidl, rgflnOut); - ::LocalFree(lpszDisplayName); - psf->Release(); - return hr; -} - -void WINAPI _SHFree(void *pv) -{ - if (!pv) { - return; - } + void WINAPI _SHFree(void* pv) + { + if (!pv) { + return; + } - LPMALLOC pMalloc = NULL; - if (::SHGetMalloc(&pMalloc) == NOERROR) { - pMalloc->Free(pv); - pMalloc->Release(); + LPMALLOC pMalloc = NULL; + if (::SHGetMalloc(&pMalloc) == NOERROR) { + pMalloc->Free(pv); + pMalloc->Release(); + } } } -} #else #define _SHILCreateFromPath SHILCreateFromPath #define _SHFree SHFree #endif +bool isX64PE(const TCHAR* file_path) { + HANDLE hFile = CreateFile(file_path, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); + if (hFile == INVALID_HANDLE_VALUE) { + showmsg("Error opening file"); + return false; + } + + IMAGE_DOS_HEADER dosHeader; + DWORD bytesRead; + if (!ReadFile(hFile, &dosHeader, sizeof(IMAGE_DOS_HEADER), &bytesRead, NULL)) { + showmsg("Error reading file"); + CloseHandle(hFile); + return false; + } + + // Check if it's a PE file + if (dosHeader.e_magic != IMAGE_DOS_SIGNATURE) { + showmsg("Not a PE file"); + CloseHandle(hFile); + return false; + } + + IMAGE_NT_HEADERS ntHeaders; + // Seek to the PE header offset + SetFilePointer(hFile, dosHeader.e_lfanew, NULL, FILE_BEGIN); + if (!ReadFile(hFile, &ntHeaders, sizeof(IMAGE_NT_HEADERS), &bytesRead, NULL)) { + showmsg("Error reading PE header"); + CloseHandle(hFile); + return false; + } + + if (ntHeaders.FileHeader.Machine == IMAGE_FILE_MACHINE_I386) { + CloseHandle(hFile); + return false; + } + else if (ntHeaders.FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64) { + CloseHandle(hFile); + return true; + } + else { + CloseHandle(hFile); + return false; + } +} + + // １つ目の引数だけファイルとして扱い、実行する。 // // コマンドは こんな感じで連結されます。 @@ -125,34 +179,35 @@ static HRESULT HookAndExecute(int show) { int argc = 0; LPWSTR* argv = CommandLineToArgvW(GetCommandLineW(), &argc); - if(!argv) { + if (!argv) { return HresultFromLastError(); } - if(argc <= 1) { - char buffer [256]; + if (argc <= 1) { + char buffer[256]; LoadStringA(GetModuleHandleA(NULL), IDS_USAGE, buffer, 256); MessageBoxA(NULL, buffer - ,"MacType", MB_OK|MB_ICONINFORMATION); + , "MacType", MB_OK | MB_ICONINFORMATION); LocalFree(argv); return S_OK; } + int i; size_t length = 1; - for(i=2; i