| 3 |
tristanc |
1 |
/////////////////////////////////////////////////////////////////////////////
|
|
|
2 |
//
|
|
|
3 |
// Core Detours Functionality (detours.h of detours.lib)
|
|
|
4 |
//
|
|
|
5 |
// Microsoft Research Detours Package, Version 3.0 Build_343.
|
|
|
6 |
//
|
|
|
7 |
// Copyright (c) Microsoft Corporation. All rights reserved.
|
|
|
8 |
//
|
|
|
9 |
|
|
|
10 |
#pragma once
|
|
|
11 |
#ifndef _DETOURS_H_
|
|
|
12 |
#define _DETOURS_H_
|
|
|
13 |
|
|
|
14 |
#define DETOURS_VERSION 30001 // 3.00.01
|
|
|
15 |
|
|
|
16 |
//////////////////////////////////////////////////////////////////////////////
|
|
|
17 |
//
|
|
|
18 |
|
|
|
19 |
#undef DETOURS_X64
|
|
|
20 |
#undef DETOURS_X86
|
|
|
21 |
#undef DETOURS_IA64
|
|
|
22 |
#undef DETOURS_ARM
|
|
|
23 |
#undef DETOURS_ARM64
|
|
|
24 |
#undef DETOURS_BITS
|
|
|
25 |
#undef DETOURS_32BIT
|
|
|
26 |
#undef DETOURS_64BIT
|
|
|
27 |
|
|
|
28 |
#if defined(_X86_)
|
|
|
29 |
#define DETOURS_X86
|
|
|
30 |
#define DETOURS_OPTION_BITS 64
|
|
|
31 |
|
|
|
32 |
#elif defined(_AMD64_)
|
|
|
33 |
#define DETOURS_X64
|
|
|
34 |
#define DETOURS_OPTION_BITS 32
|
|
|
35 |
|
|
|
36 |
#elif defined(_IA64_)
|
|
|
37 |
#define DETOURS_IA64
|
|
|
38 |
#define DETOURS_OPTION_BITS 32
|
|
|
39 |
|
|
|
40 |
#elif defined(_ARM_)
|
|
|
41 |
#define DETOURS_ARM
|
|
|
42 |
|
|
|
43 |
#elif defined(_ARM64_)
|
|
|
44 |
#define DETOURS_ARM64
|
|
|
45 |
|
|
|
46 |
#else
|
|
|
47 |
#error Unknown architecture (x86, amd64, ia64, arm, arm64)
|
|
|
48 |
#endif
|
|
|
49 |
|
|
|
50 |
#ifdef _WIN64
|
|
|
51 |
#undef DETOURS_32BIT
|
|
|
52 |
#define DETOURS_64BIT 1
|
|
|
53 |
#define DETOURS_BITS 64
|
|
|
54 |
// If all 64bit kernels can run one and only one 32bit architecture.
|
|
|
55 |
//#define DETOURS_OPTION_BITS 32
|
|
|
56 |
#else
|
|
|
57 |
#define DETOURS_32BIT 1
|
|
|
58 |
#undef DETOURS_64BIT
|
|
|
59 |
#define DETOURS_BITS 32
|
|
|
60 |
// If all 64bit kernels can run one and only one 32bit architecture.
|
|
|
61 |
//#define DETOURS_OPTION_BITS 32
|
|
|
62 |
#endif
|
|
|
63 |
|
|
|
64 |
#define VER_DETOURS_BITS DETOUR_STRINGIFY(DETOURS_BITS)
|
|
|
65 |
|
|
|
66 |
//////////////////////////////////////////////////////////////////////////////
|
|
|
67 |
//
|
|
|
68 |
|
|
|
69 |
#if (_MSC_VER < 1299)
|
|
|
70 |
typedef LONG LONG_PTR;
|
|
|
71 |
typedef ULONG ULONG_PTR;
|
|
|
72 |
#endif
|
|
|
73 |
|
|
|
74 |
///////////////////////////////////////////////// SAL 2.0 Annotations w/o SAL.
|
|
|
75 |
//
|
|
|
76 |
// These definitions are include so that Detours will build even if the
|
|
|
77 |
// compiler doesn't have full SAL 2.0 support.
|
|
|
78 |
//
|
|
|
79 |
#ifndef DETOURS_DONT_REMOVE_SAL_20
|
|
|
80 |
|
|
|
81 |
#ifdef DETOURS_TEST_REMOVE_SAL_20
|
|
|
82 |
#undef _Analysis_assume_
|
|
|
83 |
#undef _Benign_race_begin_
|
|
|
84 |
#undef _Benign_race_end_
|
|
|
85 |
#undef _Field_range_
|
|
|
86 |
#undef _Field_size_
|
|
|
87 |
#undef _In_
|
|
|
88 |
#undef _In_bytecount_
|
|
|
89 |
#undef _In_count_
|
|
|
90 |
#undef _In_opt_
|
|
|
91 |
#undef _In_opt_bytecount_
|
|
|
92 |
#undef _In_opt_count_
|
|
|
93 |
#undef _In_opt_z_
|
|
|
94 |
#undef _In_range_
|
|
|
95 |
#undef _In_reads_
|
|
|
96 |
#undef _In_reads_bytes_
|
|
|
97 |
#undef _In_reads_opt_
|
|
|
98 |
#undef _In_reads_opt_bytes_
|
|
|
99 |
#undef _In_reads_or_z_
|
|
|
100 |
#undef _In_z_
|
|
|
101 |
#undef _Inout_
|
|
|
102 |
#undef _Inout_opt_
|
|
|
103 |
#undef _Inout_z_count_
|
|
|
104 |
#undef _Out_
|
|
|
105 |
#undef _Out_opt_
|
|
|
106 |
#undef _Out_writes_
|
|
|
107 |
#undef _Outptr_result_maybenull_
|
|
|
108 |
#undef _Readable_bytes_
|
|
|
109 |
#undef _Success_
|
|
|
110 |
#undef _Writable_bytes_
|
|
|
111 |
#undef _Pre_notnull_
|
|
|
112 |
#endif
|
|
|
113 |
|
|
|
114 |
#if defined(_Deref_out_opt_z_) && !defined(_Outptr_result_maybenull_)
|
|
|
115 |
#define _Outptr_result_maybenull_ _Deref_out_opt_z_
|
|
|
116 |
#endif
|
|
|
117 |
|
|
|
118 |
#if defined(_In_count_) && !defined(_In_reads_)
|
|
|
119 |
#define _In_reads_(x) _In_count_(x)
|
|
|
120 |
#endif
|
|
|
121 |
|
|
|
122 |
#if defined(_In_opt_count_) && !defined(_In_reads_opt_)
|
|
|
123 |
#define _In_reads_opt_(x) _In_opt_count_(x)
|
|
|
124 |
#endif
|
|
|
125 |
|
|
|
126 |
#if defined(_In_opt_bytecount_) && !defined(_In_reads_opt_bytes_)
|
|
|
127 |
#define _In_reads_opt_bytes_(x) _In_opt_bytecount_(x)
|
|
|
128 |
#endif
|
|
|
129 |
|
|
|
130 |
#if defined(_In_bytecount_) && !defined(_In_reads_bytes_)
|
|
|
131 |
#define _In_reads_bytes_(x) _In_bytecount_(x)
|
|
|
132 |
#endif
|
|
|
133 |
|
|
|
134 |
#ifndef _In_
|
|
|
135 |
#define _In_
|
|
|
136 |
#endif
|
|
|
137 |
|
|
|
138 |
#ifndef _In_bytecount_
|
|
|
139 |
#define _In_bytecount_(x)
|
|
|
140 |
#endif
|
|
|
141 |
|
|
|
142 |
#ifndef _In_count_
|
|
|
143 |
#define _In_count_(x)
|
|
|
144 |
#endif
|
|
|
145 |
|
|
|
146 |
#ifndef _In_opt_
|
|
|
147 |
#define _In_opt_
|
|
|
148 |
#endif
|
|
|
149 |
|
|
|
150 |
#ifndef _In_opt_bytecount_
|
|
|
151 |
#define _In_opt_bytecount_(x)
|
|
|
152 |
#endif
|
|
|
153 |
|
|
|
154 |
#ifndef _In_opt_count_
|
|
|
155 |
#define _In_opt_count_(x)
|
|
|
156 |
#endif
|
|
|
157 |
|
|
|
158 |
#ifndef _In_opt_z_
|
|
|
159 |
#define _In_opt_z_
|
|
|
160 |
#endif
|
|
|
161 |
|
|
|
162 |
#ifndef _In_range_
|
|
|
163 |
#define _In_range_(x,y)
|
|
|
164 |
#endif
|
|
|
165 |
|
|
|
166 |
#ifndef _In_reads_
|
|
|
167 |
#define _In_reads_(x)
|
|
|
168 |
#endif
|
|
|
169 |
|
|
|
170 |
#ifndef _In_reads_bytes_
|
|
|
171 |
#define _In_reads_bytes_(x)
|
|
|
172 |
#endif
|
|
|
173 |
|
|
|
174 |
#ifndef _In_reads_opt_
|
|
|
175 |
#define _In_reads_opt_(x)
|
|
|
176 |
#endif
|
|
|
177 |
|
|
|
178 |
#ifndef _In_reads_opt_bytes_
|
|
|
179 |
#define _In_reads_opt_bytes_(x)
|
|
|
180 |
#endif
|
|
|
181 |
|
|
|
182 |
#ifndef _In_reads_or_z_
|
|
|
183 |
#define _In_reads_or_z_
|
|
|
184 |
#endif
|
|
|
185 |
|
|
|
186 |
#ifndef _In_z_
|
|
|
187 |
#define _In_z_
|
|
|
188 |
#endif
|
|
|
189 |
|
|
|
190 |
#ifndef _Inout_
|
|
|
191 |
#define _Inout_
|
|
|
192 |
#endif
|
|
|
193 |
|
|
|
194 |
#ifndef _Inout_opt_
|
|
|
195 |
#define _Inout_opt_
|
|
|
196 |
#endif
|
|
|
197 |
|
|
|
198 |
#ifndef _Inout_z_count_
|
|
|
199 |
#define _Inout_z_count_(x)
|
|
|
200 |
#endif
|
|
|
201 |
|
|
|
202 |
#ifndef _Out_
|
|
|
203 |
#define _Out_
|
|
|
204 |
#endif
|
|
|
205 |
|
|
|
206 |
#ifndef _Out_opt_
|
|
|
207 |
#define _Out_opt_
|
|
|
208 |
#endif
|
|
|
209 |
|
|
|
210 |
#ifndef _Out_writes_
|
|
|
211 |
#define _Out_writes_(x)
|
|
|
212 |
#endif
|
|
|
213 |
|
|
|
214 |
#ifndef _Outptr_result_maybenull_
|
|
|
215 |
#define _Outptr_result_maybenull_
|
|
|
216 |
#endif
|
|
|
217 |
|
|
|
218 |
#ifndef _Writable_bytes_
|
|
|
219 |
#define _Writable_bytes_(x)
|
|
|
220 |
#endif
|
|
|
221 |
|
|
|
222 |
#ifndef _Readable_bytes_
|
|
|
223 |
#define _Readable_bytes_(x)
|
|
|
224 |
#endif
|
|
|
225 |
|
|
|
226 |
#ifndef _Success_
|
|
|
227 |
#define _Success_(x)
|
|
|
228 |
#endif
|
|
|
229 |
|
|
|
230 |
#ifndef _Pre_notnull_
|
|
|
231 |
#define _Pre_notnull_
|
|
|
232 |
#endif
|
|
|
233 |
|
|
|
234 |
#ifdef DETOURS_INTERNAL
|
|
|
235 |
|
|
|
236 |
#pragma warning(disable:4615) // unknown warning type (suppress with older compilers)
|
|
|
237 |
|
|
|
238 |
#ifndef _Benign_race_begin_
|
|
|
239 |
#define _Benign_race_begin_
|
|
|
240 |
#endif
|
|
|
241 |
|
|
|
242 |
#ifndef _Benign_race_end_
|
|
|
243 |
#define _Benign_race_end_
|
|
|
244 |
#endif
|
|
|
245 |
|
|
|
246 |
#ifndef _Field_size_
|
|
|
247 |
#define _Field_size_(x)
|
|
|
248 |
#endif
|
|
|
249 |
|
|
|
250 |
#ifndef _Field_range_
|
|
|
251 |
#define _Field_range_(x,y)
|
|
|
252 |
#endif
|
|
|
253 |
|
|
|
254 |
#ifndef _Analysis_assume_
|
|
|
255 |
#define _Analysis_assume_(x)
|
|
|
256 |
#endif
|
|
|
257 |
|
|
|
258 |
#endif // DETOURS_INTERNAL
|
|
|
259 |
#endif // DETOURS_DONT_REMOVE_SAL_20
|
|
|
260 |
|
|
|
261 |
//////////////////////////////////////////////////////////////////////////////
|
|
|
262 |
//
|
|
|
263 |
#ifndef GUID_DEFINED
|
|
|
264 |
#define GUID_DEFINED
|
|
|
265 |
typedef struct _GUID
|
|
|
266 |
{
|
|
|
267 |
DWORD Data1;
|
|
|
268 |
WORD Data2;
|
|
|
269 |
WORD Data3;
|
|
|
270 |
BYTE Data4[ 8 ];
|
|
|
271 |
} GUID;
|
|
|
272 |
|
|
|
273 |
#ifdef INITGUID
|
|
|
274 |
#define DEFINE_GUID(name, l, w1, w2, b1, b2, b3, b4, b5, b6, b7, b8) \
|
|
|
275 |
const GUID name \
|
|
|
276 |
= { l, w1, w2, { b1, b2, b3, b4, b5, b6, b7, b8 } }
|
|
|
277 |
#else
|
|
|
278 |
#define DEFINE_GUID(name, l, w1, w2, b1, b2, b3, b4, b5, b6, b7, b8) \
|
|
|
279 |
const GUID name
|
|
|
280 |
#endif // INITGUID
|
|
|
281 |
#endif // !GUID_DEFINED
|
|
|
282 |
|
|
|
283 |
#if defined(__cplusplus)
|
|
|
284 |
#ifndef _REFGUID_DEFINED
|
|
|
285 |
#define _REFGUID_DEFINED
|
|
|
286 |
#define REFGUID const GUID &
|
|
|
287 |
#endif // !_REFGUID_DEFINED
|
|
|
288 |
#else // !__cplusplus
|
|
|
289 |
#ifndef _REFGUID_DEFINED
|
|
|
290 |
#define _REFGUID_DEFINED
|
|
|
291 |
#define REFGUID const GUID * const
|
|
|
292 |
#endif // !_REFGUID_DEFINED
|
|
|
293 |
#endif // !__cplusplus
|
|
|
294 |
|
|
|
295 |
#ifndef ARRAYSIZE
|
|
|
296 |
#define ARRAYSIZE(x) (sizeof(x)/sizeof(x[0]))
|
|
|
297 |
#endif
|
|
|
298 |
|
|
|
299 |
//
|
|
|
300 |
//////////////////////////////////////////////////////////////////////////////
|
|
|
301 |
|
|
|
302 |
#ifdef __cplusplus
|
|
|
303 |
extern "C" {
|
|
|
304 |
#endif // __cplusplus
|
|
|
305 |
|
|
|
306 |
/////////////////////////////////////////////////// Instruction Target Macros.
|
|
|
307 |
//
|
|
|
308 |
#define DETOUR_INSTRUCTION_TARGET_NONE ((PVOID)0)
|
|
|
309 |
#define DETOUR_INSTRUCTION_TARGET_DYNAMIC ((PVOID)(LONG_PTR)-1)
|
|
|
310 |
#define DETOUR_SECTION_HEADER_SIGNATURE 0x00727444 // "Dtr\0"
|
|
|
311 |
|
|
|
312 |
extern const GUID DETOUR_EXE_RESTORE_GUID;
|
|
|
313 |
extern const GUID DETOUR_EXE_HELPER_GUID;
|
|
|
314 |
|
|
|
315 |
#define DETOUR_TRAMPOLINE_SIGNATURE 0x21727444 // Dtr!
|
|
|
316 |
typedef struct _DETOUR_TRAMPOLINE DETOUR_TRAMPOLINE, *PDETOUR_TRAMPOLINE;
|
|
|
317 |
|
|
|
318 |
/////////////////////////////////////////////////////////// Binary Structures.
|
|
|
319 |
//
|
|
|
320 |
#pragma pack(push, 8)
|
|
|
321 |
typedef struct _DETOUR_SECTION_HEADER
|
|
|
322 |
{
|
|
|
323 |
DWORD cbHeaderSize;
|
|
|
324 |
DWORD nSignature;
|
|
|
325 |
DWORD nDataOffset;
|
|
|
326 |
DWORD cbDataSize;
|
|
|
327 |
|
|
|
328 |
DWORD nOriginalImportVirtualAddress;
|
|
|
329 |
DWORD nOriginalImportSize;
|
|
|
330 |
DWORD nOriginalBoundImportVirtualAddress;
|
|
|
331 |
DWORD nOriginalBoundImportSize;
|
|
|
332 |
|
|
|
333 |
DWORD nOriginalIatVirtualAddress;
|
|
|
334 |
DWORD nOriginalIatSize;
|
|
|
335 |
DWORD nOriginalSizeOfImage;
|
|
|
336 |
DWORD cbPrePE;
|
|
|
337 |
|
|
|
338 |
DWORD nOriginalClrFlags;
|
|
|
339 |
DWORD reserved1;
|
|
|
340 |
DWORD reserved2;
|
|
|
341 |
DWORD reserved3;
|
|
|
342 |
|
|
|
343 |
// Followed by cbPrePE bytes of data.
|
|
|
344 |
} DETOUR_SECTION_HEADER, *PDETOUR_SECTION_HEADER;
|
|
|
345 |
|
|
|
346 |
typedef struct _DETOUR_SECTION_RECORD
|
|
|
347 |
{
|
|
|
348 |
DWORD cbBytes;
|
|
|
349 |
DWORD nReserved;
|
|
|
350 |
GUID guid;
|
|
|
351 |
} DETOUR_SECTION_RECORD, *PDETOUR_SECTION_RECORD;
|
|
|
352 |
|
|
|
353 |
typedef struct _DETOUR_CLR_HEADER
|
|
|
354 |
{
|
|
|
355 |
// Header versioning
|
|
|
356 |
ULONG cb;
|
|
|
357 |
USHORT MajorRuntimeVersion;
|
|
|
358 |
USHORT MinorRuntimeVersion;
|
|
|
359 |
|
|
|
360 |
// Symbol table and startup information
|
|
|
361 |
IMAGE_DATA_DIRECTORY MetaData;
|
|
|
362 |
ULONG Flags;
|
|
|
363 |
|
|
|
364 |
// Followed by the rest of the IMAGE_COR20_HEADER
|
|
|
365 |
} DETOUR_CLR_HEADER, *PDETOUR_CLR_HEADER;
|
|
|
366 |
|
|
|
367 |
typedef struct _DETOUR_EXE_RESTORE
|
|
|
368 |
{
|
|
|
369 |
DWORD cb;
|
|
|
370 |
DWORD cbidh;
|
|
|
371 |
DWORD cbinh;
|
|
|
372 |
DWORD cbclr;
|
|
|
373 |
|
|
|
374 |
PBYTE pidh;
|
|
|
375 |
PBYTE pinh;
|
|
|
376 |
PBYTE pclr;
|
|
|
377 |
|
|
|
378 |
IMAGE_DOS_HEADER idh;
|
|
|
379 |
union {
|
|
|
380 |
IMAGE_NT_HEADERS inh;
|
|
|
381 |
IMAGE_NT_HEADERS32 inh32;
|
|
|
382 |
IMAGE_NT_HEADERS64 inh64;
|
|
|
383 |
BYTE raw[sizeof(IMAGE_NT_HEADERS64) +
|
|
|
384 |
sizeof(IMAGE_SECTION_HEADER) * 32];
|
|
|
385 |
};
|
|
|
386 |
DETOUR_CLR_HEADER clr;
|
|
|
387 |
|
|
|
388 |
} DETOUR_EXE_RESTORE, *PDETOUR_EXE_RESTORE;
|
|
|
389 |
|
|
|
390 |
typedef struct _DETOUR_EXE_HELPER
|
|
|
391 |
{
|
|
|
392 |
DWORD cb;
|
|
|
393 |
DWORD pid;
|
|
|
394 |
DWORD nDlls;
|
|
|
395 |
CHAR rDlls[4];
|
|
|
396 |
} DETOUR_EXE_HELPER, *PDETOUR_EXE_HELPER;
|
|
|
397 |
|
|
|
398 |
#pragma pack(pop)
|
|
|
399 |
|
|
|
400 |
#define DETOUR_SECTION_HEADER_DECLARE(cbSectionSize) \
|
|
|
401 |
{ \
|
|
|
402 |
sizeof(DETOUR_SECTION_HEADER),\
|
|
|
403 |
DETOUR_SECTION_HEADER_SIGNATURE,\
|
|
|
404 |
sizeof(DETOUR_SECTION_HEADER),\
|
|
|
405 |
(cbSectionSize),\
|
|
|
406 |
\
|
|
|
407 |
0,\
|
|
|
408 |
0,\
|
|
|
409 |
0,\
|
|
|
410 |
0,\
|
|
|
411 |
\
|
|
|
412 |
0,\
|
|
|
413 |
0,\
|
|
|
414 |
0,\
|
|
|
415 |
0,\
|
|
|
416 |
}
|
|
|
417 |
|
|
|
418 |
/////////////////////////////////////////////////////////////// Helper Macros.
|
|
|
419 |
//
|
|
|
420 |
#define DETOURS_STRINGIFY(x) DETOURS_STRINGIFY_(x)
|
|
|
421 |
#define DETOURS_STRINGIFY_(x) #x
|
|
|
422 |
|
|
|
423 |
///////////////////////////////////////////////////////////// Binary Typedefs.
|
|
|
424 |
//
|
|
|
425 |
typedef BOOL (CALLBACK *PF_DETOUR_BINARY_BYWAY_CALLBACK)(
|
|
|
426 |
_In_opt_ PVOID pContext,
|
|
|
427 |
_In_opt_ LPCSTR pszFile,
|
|
|
428 |
_Outptr_result_maybenull_ LPCSTR *ppszOutFile);
|
|
|
429 |
|
|
|
430 |
typedef BOOL (CALLBACK *PF_DETOUR_BINARY_FILE_CALLBACK)(
|
|
|
431 |
_In_opt_ PVOID pContext,
|
|
|
432 |
_In_ LPCSTR pszOrigFile,
|
|
|
433 |
_In_ LPCSTR pszFile,
|
|
|
434 |
_Outptr_result_maybenull_ LPCSTR *ppszOutFile);
|
|
|
435 |
|
|
|
436 |
typedef BOOL (CALLBACK *PF_DETOUR_BINARY_SYMBOL_CALLBACK)(
|
|
|
437 |
_In_opt_ PVOID pContext,
|
|
|
438 |
_In_ ULONG nOrigOrdinal,
|
|
|
439 |
_In_ ULONG nOrdinal,
|
|
|
440 |
_Out_ ULONG *pnOutOrdinal,
|
|
|
441 |
_In_opt_ LPCSTR pszOrigSymbol,
|
|
|
442 |
_In_opt_ LPCSTR pszSymbol,
|
|
|
443 |
_Outptr_result_maybenull_ LPCSTR *ppszOutSymbol);
|
|
|
444 |
|
|
|
445 |
typedef BOOL (CALLBACK *PF_DETOUR_BINARY_COMMIT_CALLBACK)(
|
|
|
446 |
_In_opt_ PVOID pContext);
|
|
|
447 |
|
|
|
448 |
typedef BOOL (CALLBACK *PF_DETOUR_ENUMERATE_EXPORT_CALLBACK)(_In_opt_ PVOID pContext,
|
|
|
449 |
_In_ ULONG nOrdinal,
|
|
|
450 |
_In_opt_ LPCSTR pszName,
|
|
|
451 |
_In_opt_ PVOID pCode);
|
|
|
452 |
|
|
|
453 |
typedef BOOL (CALLBACK *PF_DETOUR_IMPORT_FILE_CALLBACK)(_In_opt_ PVOID pContext,
|
|
|
454 |
_In_opt_ HMODULE hModule,
|
|
|
455 |
_In_opt_ LPCSTR pszFile);
|
|
|
456 |
|
|
|
457 |
typedef BOOL (CALLBACK *PF_DETOUR_IMPORT_FUNC_CALLBACK)(_In_opt_ PVOID pContext,
|
|
|
458 |
_In_ DWORD nOrdinal,
|
|
|
459 |
_In_opt_ LPCSTR pszFunc,
|
|
|
460 |
_In_opt_ PVOID pvFunc);
|
|
|
461 |
|
|
|
462 |
// Same as PF_DETOUR_IMPORT_FUNC_CALLBACK but extra indirection on last parameter.
|
|
|
463 |
typedef BOOL (CALLBACK *PF_DETOUR_IMPORT_FUNC_CALLBACK_EX)(_In_opt_ PVOID pContext,
|
|
|
464 |
_In_ DWORD nOrdinal,
|
|
|
465 |
_In_opt_ LPCSTR pszFunc,
|
|
|
466 |
_In_opt_ PVOID* ppvFunc);
|
|
|
467 |
|
|
|
468 |
typedef VOID * PDETOUR_BINARY;
|
|
|
469 |
typedef VOID * PDETOUR_LOADED_BINARY;
|
|
|
470 |
|
|
|
471 |
//////////////////////////////////////////////////////////// Transaction APIs.
|
|
|
472 |
//
|
|
|
473 |
LONG WINAPI DetourTransactionBegin(VOID);
|
|
|
474 |
LONG WINAPI DetourTransactionAbort(VOID);
|
|
|
475 |
LONG WINAPI DetourTransactionCommit(VOID);
|
|
|
476 |
LONG WINAPI DetourTransactionCommitEx(_Out_opt_ PVOID **pppFailedPointer);
|
|
|
477 |
|
|
|
478 |
LONG WINAPI DetourUpdateThread(_In_ HANDLE hThread);
|
|
|
479 |
|
|
|
480 |
LONG WINAPI DetourAttach(_Inout_ PVOID *ppPointer,
|
|
|
481 |
_In_ PVOID pDetour);
|
|
|
482 |
|
|
|
483 |
LONG WINAPI DetourAttachEx(_Inout_ PVOID *ppPointer,
|
|
|
484 |
_In_ PVOID pDetour,
|
|
|
485 |
_Out_opt_ PDETOUR_TRAMPOLINE *ppRealTrampoline,
|
|
|
486 |
_Out_opt_ PVOID *ppRealTarget,
|
|
|
487 |
_Out_opt_ PVOID *ppRealDetour);
|
|
|
488 |
|
|
|
489 |
LONG WINAPI DetourDetach(_Inout_ PVOID *ppPointer,
|
|
|
490 |
_In_ PVOID pDetour);
|
|
|
491 |
|
|
|
492 |
BOOL WINAPI DetourSetIgnoreTooSmall(_In_ BOOL fIgnore);
|
|
|
493 |
BOOL WINAPI DetourSetRetainRegions(_In_ BOOL fRetain);
|
|
|
494 |
PVOID WINAPI DetourSetSystemRegionLowerBound(_In_ PVOID pSystemRegionLowerBound);
|
|
|
495 |
PVOID WINAPI DetourSetSystemRegionUpperBound(_In_ PVOID pSystemRegionUpperBound);
|
|
|
496 |
|
|
|
497 |
////////////////////////////////////////////////////////////// Code Functions.
|
|
|
498 |
//
|
|
|
499 |
PVOID WINAPI DetourFindFunction(_In_ LPCSTR pszModule,
|
|
|
500 |
_In_ LPCSTR pszFunction);
|
|
|
501 |
PVOID WINAPI DetourCodeFromPointer(_In_ PVOID pPointer,
|
|
|
502 |
_Out_opt_ PVOID *ppGlobals);
|
|
|
503 |
PVOID WINAPI DetourCopyInstruction(_In_opt_ PVOID pDst,
|
|
|
504 |
_Inout_opt_ PVOID *ppDstPool,
|
|
|
505 |
_In_ PVOID pSrc,
|
|
|
506 |
_Out_opt_ PVOID *ppTarget,
|
|
|
507 |
_Out_opt_ LONG *plExtra);
|
|
|
508 |
BOOL WINAPI DetourSetCodeModule(_In_ HMODULE hModule,
|
|
|
509 |
_In_ BOOL fLimitReferencesToModule);
|
|
|
510 |
|
|
|
511 |
///////////////////////////////////////////////////// Loaded Binary Functions.
|
|
|
512 |
//
|
|
|
513 |
HMODULE WINAPI DetourGetContainingModule(_In_ PVOID pvAddr);
|
|
|
514 |
HMODULE WINAPI DetourEnumerateModules(_In_opt_ HMODULE hModuleLast);
|
|
|
515 |
PVOID WINAPI DetourGetEntryPoint(_In_opt_ HMODULE hModule);
|
|
|
516 |
ULONG WINAPI DetourGetModuleSize(_In_opt_ HMODULE hModule);
|
|
|
517 |
BOOL WINAPI DetourEnumerateExports(_In_ HMODULE hModule,
|
|
|
518 |
_In_opt_ PVOID pContext,
|
|
|
519 |
_In_ PF_DETOUR_ENUMERATE_EXPORT_CALLBACK pfExport);
|
|
|
520 |
BOOL WINAPI DetourEnumerateImports(_In_opt_ HMODULE hModule,
|
|
|
521 |
_In_opt_ PVOID pContext,
|
|
|
522 |
_In_opt_ PF_DETOUR_IMPORT_FILE_CALLBACK pfImportFile,
|
|
|
523 |
_In_opt_ PF_DETOUR_IMPORT_FUNC_CALLBACK pfImportFunc);
|
|
|
524 |
|
|
|
525 |
BOOL WINAPI DetourEnumerateImportsEx(_In_opt_ HMODULE hModule,
|
|
|
526 |
_In_opt_ PVOID pContext,
|
|
|
527 |
_In_opt_ PF_DETOUR_IMPORT_FILE_CALLBACK pfImportFile,
|
|
|
528 |
_In_opt_ PF_DETOUR_IMPORT_FUNC_CALLBACK_EX pfImportFuncEx);
|
|
|
529 |
|
|
|
530 |
_Writable_bytes_(*pcbData)
|
|
|
531 |
_Readable_bytes_(*pcbData)
|
|
|
532 |
_Success_(return != NULL)
|
|
|
533 |
PVOID WINAPI DetourFindPayload(_In_opt_ HMODULE hModule,
|
|
|
534 |
_In_ REFGUID rguid,
|
|
|
535 |
_Out_ DWORD *pcbData);
|
|
|
536 |
|
|
|
537 |
_Writable_bytes_(*pcbData)
|
|
|
538 |
_Readable_bytes_(*pcbData)
|
|
|
539 |
_Success_(return != NULL)
|
|
|
540 |
PVOID WINAPI DetourFindPayloadEx(_In_ REFGUID rguid,
|
|
|
541 |
_Out_ DWORD * pcbData);
|
|
|
542 |
|
|
|
543 |
DWORD WINAPI DetourGetSizeOfPayloads(_In_opt_ HMODULE hModule);
|
|
|
544 |
|
|
|
545 |
///////////////////////////////////////////////// Persistent Binary Functions.
|
|
|
546 |
//
|
|
|
547 |
|
|
|
548 |
PDETOUR_BINARY WINAPI DetourBinaryOpen(_In_ HANDLE hFile);
|
|
|
549 |
|
|
|
550 |
_Writable_bytes_(*pcbData)
|
|
|
551 |
_Readable_bytes_(*pcbData)
|
|
|
552 |
_Success_(return != NULL)
|
|
|
553 |
PVOID WINAPI DetourBinaryEnumeratePayloads(_In_ PDETOUR_BINARY pBinary,
|
|
|
554 |
_Out_opt_ GUID *pGuid,
|
|
|
555 |
_Out_ DWORD *pcbData,
|
|
|
556 |
_Inout_ DWORD *pnIterator);
|
|
|
557 |
|
|
|
558 |
_Writable_bytes_(*pcbData)
|
|
|
559 |
_Readable_bytes_(*pcbData)
|
|
|
560 |
_Success_(return != NULL)
|
|
|
561 |
PVOID WINAPI DetourBinaryFindPayload(_In_ PDETOUR_BINARY pBinary,
|
|
|
562 |
_In_ REFGUID rguid,
|
|
|
563 |
_Out_ DWORD *pcbData);
|
|
|
564 |
|
|
|
565 |
PVOID WINAPI DetourBinarySetPayload(_In_ PDETOUR_BINARY pBinary,
|
|
|
566 |
_In_ REFGUID rguid,
|
|
|
567 |
_In_reads_opt_(cbData) PVOID pData,
|
|
|
568 |
_In_ DWORD cbData);
|
|
|
569 |
BOOL WINAPI DetourBinaryDeletePayload(_In_ PDETOUR_BINARY pBinary, _In_ REFGUID rguid);
|
|
|
570 |
BOOL WINAPI DetourBinaryPurgePayloads(_In_ PDETOUR_BINARY pBinary);
|
|
|
571 |
BOOL WINAPI DetourBinaryResetImports(_In_ PDETOUR_BINARY pBinary);
|
|
|
572 |
BOOL WINAPI DetourBinaryEditImports(_In_ PDETOUR_BINARY pBinary,
|
|
|
573 |
_In_opt_ PVOID pContext,
|
|
|
574 |
_In_opt_ PF_DETOUR_BINARY_BYWAY_CALLBACK pfByway,
|
|
|
575 |
_In_opt_ PF_DETOUR_BINARY_FILE_CALLBACK pfFile,
|
|
|
576 |
_In_opt_ PF_DETOUR_BINARY_SYMBOL_CALLBACK pfSymbol,
|
|
|
577 |
_In_opt_ PF_DETOUR_BINARY_COMMIT_CALLBACK pfCommit);
|
|
|
578 |
BOOL WINAPI DetourBinaryWrite(_In_ PDETOUR_BINARY pBinary, _In_ HANDLE hFile);
|
|
|
579 |
BOOL WINAPI DetourBinaryClose(_In_ PDETOUR_BINARY pBinary);
|
|
|
580 |
|
|
|
581 |
/////////////////////////////////////////////////// Create Process & Load Dll.
|
|
|
582 |
//
|
|
|
583 |
typedef BOOL (WINAPI *PDETOUR_CREATE_PROCESS_ROUTINEA)(
|
|
|
584 |
_In_opt_ LPCSTR lpApplicationName,
|
|
|
585 |
_Inout_opt_ LPSTR lpCommandLine,
|
|
|
586 |
_In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
|
|
587 |
_In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
|
|
588 |
_In_ BOOL bInheritHandles,
|
|
|
589 |
_In_ DWORD dwCreationFlags,
|
|
|
590 |
_In_opt_ LPVOID lpEnvironment,
|
|
|
591 |
_In_opt_ LPCSTR lpCurrentDirectory,
|
|
|
592 |
_In_ LPSTARTUPINFOA lpStartupInfo,
|
|
|
593 |
_Out_ LPPROCESS_INFORMATION lpProcessInformation);
|
|
|
594 |
|
|
|
595 |
typedef BOOL (WINAPI *PDETOUR_CREATE_PROCESS_ROUTINEW)(
|
|
|
596 |
_In_opt_ LPCWSTR lpApplicationName,
|
|
|
597 |
_Inout_opt_ LPWSTR lpCommandLine,
|
|
|
598 |
_In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
|
|
599 |
_In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
|
|
600 |
_In_ BOOL bInheritHandles,
|
|
|
601 |
_In_ DWORD dwCreationFlags,
|
|
|
602 |
_In_opt_ LPVOID lpEnvironment,
|
|
|
603 |
_In_opt_ LPCWSTR lpCurrentDirectory,
|
|
|
604 |
_In_ LPSTARTUPINFOW lpStartupInfo,
|
|
|
605 |
_Out_ LPPROCESS_INFORMATION lpProcessInformation);
|
|
|
606 |
|
|
|
607 |
BOOL WINAPI DetourCreateProcessWithDllA(_In_opt_ LPCSTR lpApplicationName,
|
|
|
608 |
_Inout_opt_ LPSTR lpCommandLine,
|
|
|
609 |
_In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
|
|
610 |
_In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
|
|
611 |
_In_ BOOL bInheritHandles,
|
|
|
612 |
_In_ DWORD dwCreationFlags,
|
|
|
613 |
_In_opt_ LPVOID lpEnvironment,
|
|
|
614 |
_In_opt_ LPCSTR lpCurrentDirectory,
|
|
|
615 |
_In_ LPSTARTUPINFOA lpStartupInfo,
|
|
|
616 |
_Out_ LPPROCESS_INFORMATION lpProcessInformation,
|
|
|
617 |
_In_ LPCSTR lpDllName,
|
|
|
618 |
_In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);
|
|
|
619 |
|
|
|
620 |
BOOL WINAPI DetourCreateProcessWithDllW(_In_opt_ LPCWSTR lpApplicationName,
|
|
|
621 |
_Inout_opt_ LPWSTR lpCommandLine,
|
|
|
622 |
_In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
|
|
623 |
_In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
|
|
624 |
_In_ BOOL bInheritHandles,
|
|
|
625 |
_In_ DWORD dwCreationFlags,
|
|
|
626 |
_In_opt_ LPVOID lpEnvironment,
|
|
|
627 |
_In_opt_ LPCWSTR lpCurrentDirectory,
|
|
|
628 |
_In_ LPSTARTUPINFOW lpStartupInfo,
|
|
|
629 |
_Out_ LPPROCESS_INFORMATION lpProcessInformation,
|
|
|
630 |
_In_ LPCSTR lpDllName,
|
|
|
631 |
_In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);
|
|
|
632 |
|
|
|
633 |
#ifdef UNICODE
|
|
|
634 |
#define DetourCreateProcessWithDll DetourCreateProcessWithDllW
|
|
|
635 |
#define PDETOUR_CREATE_PROCESS_ROUTINE PDETOUR_CREATE_PROCESS_ROUTINEW
|
|
|
636 |
#else
|
|
|
637 |
#define DetourCreateProcessWithDll DetourCreateProcessWithDllA
|
|
|
638 |
#define PDETOUR_CREATE_PROCESS_ROUTINE PDETOUR_CREATE_PROCESS_ROUTINEA
|
|
|
639 |
#endif // !UNICODE
|
|
|
640 |
|
|
|
641 |
BOOL WINAPI DetourCreateProcessWithDllExA(_In_opt_ LPCSTR lpApplicationName,
|
|
|
642 |
_Inout_opt_ LPSTR lpCommandLine,
|
|
|
643 |
_In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
|
|
644 |
_In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
|
|
645 |
_In_ BOOL bInheritHandles,
|
|
|
646 |
_In_ DWORD dwCreationFlags,
|
|
|
647 |
_In_opt_ LPVOID lpEnvironment,
|
|
|
648 |
_In_opt_ LPCSTR lpCurrentDirectory,
|
|
|
649 |
_In_ LPSTARTUPINFOA lpStartupInfo,
|
|
|
650 |
_Out_ LPPROCESS_INFORMATION lpProcessInformation,
|
|
|
651 |
_In_ LPCSTR lpDllName,
|
|
|
652 |
_In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);
|
|
|
653 |
|
|
|
654 |
BOOL WINAPI DetourCreateProcessWithDllExW(_In_opt_ LPCWSTR lpApplicationName,
|
|
|
655 |
_Inout_opt_ LPWSTR lpCommandLine,
|
|
|
656 |
_In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
|
|
657 |
_In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
|
|
658 |
_In_ BOOL bInheritHandles,
|
|
|
659 |
_In_ DWORD dwCreationFlags,
|
|
|
660 |
_In_opt_ LPVOID lpEnvironment,
|
|
|
661 |
_In_opt_ LPCWSTR lpCurrentDirectory,
|
|
|
662 |
_In_ LPSTARTUPINFOW lpStartupInfo,
|
|
|
663 |
_Out_ LPPROCESS_INFORMATION lpProcessInformation,
|
|
|
664 |
_In_ LPCSTR lpDllName,
|
|
|
665 |
_In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);
|
|
|
666 |
|
|
|
667 |
#ifdef UNICODE
|
|
|
668 |
#define DetourCreateProcessWithDllEx DetourCreateProcessWithDllExW
|
|
|
669 |
#else
|
|
|
670 |
#define DetourCreateProcessWithDllEx DetourCreateProcessWithDllExA
|
|
|
671 |
#endif // !UNICODE
|
|
|
672 |
|
|
|
673 |
BOOL WINAPI DetourCreateProcessWithDllsA(_In_opt_ LPCSTR lpApplicationName,
|
|
|
674 |
_Inout_opt_ LPSTR lpCommandLine,
|
|
|
675 |
_In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
|
|
676 |
_In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
|
|
677 |
_In_ BOOL bInheritHandles,
|
|
|
678 |
_In_ DWORD dwCreationFlags,
|
|
|
679 |
_In_opt_ LPVOID lpEnvironment,
|
|
|
680 |
_In_opt_ LPCSTR lpCurrentDirectory,
|
|
|
681 |
_In_ LPSTARTUPINFOA lpStartupInfo,
|
|
|
682 |
_Out_ LPPROCESS_INFORMATION lpProcessInformation,
|
|
|
683 |
_In_ DWORD nDlls,
|
|
|
684 |
_In_reads_(nDlls) LPCSTR *rlpDlls,
|
|
|
685 |
_In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);
|
|
|
686 |
|
|
|
687 |
BOOL WINAPI DetourCreateProcessWithDllsW(_In_opt_ LPCWSTR lpApplicationName,
|
|
|
688 |
_Inout_opt_ LPWSTR lpCommandLine,
|
|
|
689 |
_In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
|
|
|
690 |
_In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
|
|
|
691 |
_In_ BOOL bInheritHandles,
|
|
|
692 |
_In_ DWORD dwCreationFlags,
|
|
|
693 |
_In_opt_ LPVOID lpEnvironment,
|
|
|
694 |
_In_opt_ LPCWSTR lpCurrentDirectory,
|
|
|
695 |
_In_ LPSTARTUPINFOW lpStartupInfo,
|
|
|
696 |
_Out_ LPPROCESS_INFORMATION lpProcessInformation,
|
|
|
697 |
_In_ DWORD nDlls,
|
|
|
698 |
_In_reads_(nDlls) LPCSTR *rlpDlls,
|
|
|
699 |
_In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);
|
|
|
700 |
|
|
|
701 |
#ifdef UNICODE
|
|
|
702 |
#define DetourCreateProcessWithDlls DetourCreateProcessWithDllsW
|
|
|
703 |
#else
|
|
|
704 |
#define DetourCreateProcessWithDlls DetourCreateProcessWithDllsA
|
|
|
705 |
#endif // !UNICODE
|
|
|
706 |
|
|
|
707 |
BOOL WINAPI DetourProcessViaHelperA(_In_ DWORD dwTargetPid,
|
|
|
708 |
_In_ LPCSTR lpDllName,
|
|
|
709 |
_In_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);
|
|
|
710 |
|
|
|
711 |
BOOL WINAPI DetourProcessViaHelperW(_In_ DWORD dwTargetPid,
|
|
|
712 |
_In_ LPCSTR lpDllName,
|
|
|
713 |
_In_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);
|
|
|
714 |
|
|
|
715 |
#ifdef UNICODE
|
|
|
716 |
#define DetourProcessViaHelper DetourProcessViaHelperW
|
|
|
717 |
#else
|
|
|
718 |
#define DetourProcessViaHelper DetourProcessViaHelperA
|
|
|
719 |
#endif // !UNICODE
|
|
|
720 |
|
|
|
721 |
BOOL WINAPI DetourProcessViaHelperDllsA(_In_ DWORD dwTargetPid,
|
|
|
722 |
_In_ DWORD nDlls,
|
|
|
723 |
_In_reads_(nDlls) LPCSTR *rlpDlls,
|
|
|
724 |
_In_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);
|
|
|
725 |
|
|
|
726 |
BOOL WINAPI DetourProcessViaHelperDllsW(_In_ DWORD dwTargetPid,
|
|
|
727 |
_In_ DWORD nDlls,
|
|
|
728 |
_In_reads_(nDlls) LPCSTR *rlpDlls,
|
|
|
729 |
_In_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);
|
|
|
730 |
|
|
|
731 |
#ifdef UNICODE
|
|
|
732 |
#define DetourProcessViaHelperDlls DetourProcessViaHelperDllsW
|
|
|
733 |
#else
|
|
|
734 |
#define DetourProcessViaHelperDlls DetourProcessViaHelperDllsA
|
|
|
735 |
#endif // !UNICODE
|
|
|
736 |
|
|
|
737 |
BOOL WINAPI DetourUpdateProcessWithDll(_In_ HANDLE hProcess,
|
|
|
738 |
_In_reads_(nDlls) LPCSTR *rlpDlls,
|
|
|
739 |
_In_ DWORD nDlls);
|
|
|
740 |
|
|
|
741 |
BOOL WINAPI DetourUpdateProcessWithDllEx(_In_ HANDLE hProcess,
|
|
|
742 |
_In_ HMODULE hImage,
|
|
|
743 |
_In_ BOOL bIs32Bit,
|
|
|
744 |
_In_reads_(nDlls) LPCSTR *rlpDlls,
|
|
|
745 |
_In_ DWORD nDlls);
|
|
|
746 |
|
|
|
747 |
BOOL WINAPI DetourCopyPayloadToProcess(_In_ HANDLE hProcess,
|
|
|
748 |
_In_ REFGUID rguid,
|
|
|
749 |
_In_reads_bytes_(cbData) PVOID pvData,
|
|
|
750 |
_In_ DWORD cbData);
|
|
|
751 |
BOOL WINAPI DetourRestoreAfterWith(VOID);
|
|
|
752 |
BOOL WINAPI DetourRestoreAfterWithEx(_In_reads_bytes_(cbData) PVOID pvData,
|
|
|
753 |
_In_ DWORD cbData);
|
|
|
754 |
BOOL WINAPI DetourIsHelperProcess(VOID);
|
|
|
755 |
VOID CALLBACK DetourFinishHelperProcess(_In_ HWND,
|
|
|
756 |
_In_ HINSTANCE,
|
|
|
757 |
_In_ LPSTR,
|
|
|
758 |
_In_ INT);
|
|
|
759 |
|
|
|
760 |
//
|
|
|
761 |
//////////////////////////////////////////////////////////////////////////////
|
|
|
762 |
#ifdef __cplusplus
|
|
|
763 |
}
|
|
|
764 |
#endif // __cplusplus
|
|
|
765 |
|
|
|
766 |
//////////////////////////////////////////////// Detours Internal Definitions.
|
|
|
767 |
//
|
|
|
768 |
#ifdef __cplusplus
|
|
|
769 |
#ifdef DETOURS_INTERNAL
|
|
|
770 |
|
|
|
771 |
#define NOTHROW
|
|
|
772 |
// #define NOTHROW (nothrow)
|
|
|
773 |
|
|
|
774 |
//////////////////////////////////////////////////////////////////////////////
|
|
|
775 |
//
|
|
|
776 |
#if (_MSC_VER < 1299)
|
|
|
777 |
#include <imagehlp.h>
|
|
|
778 |
typedef IMAGEHLP_MODULE IMAGEHLP_MODULE64;
|
|
|
779 |
typedef PIMAGEHLP_MODULE PIMAGEHLP_MODULE64;
|
|
|
780 |
typedef IMAGEHLP_SYMBOL SYMBOL_INFO;
|
|
|
781 |
typedef PIMAGEHLP_SYMBOL PSYMBOL_INFO;
|
|
|
782 |
|
|
|
783 |
static inline
|
|
|
784 |
LONG InterlockedCompareExchange(_Inout_ LONG *ptr, _In_ LONG nval, _In_ LONG oval)
|
|
|
785 |
{
|
|
|
786 |
return (LONG)::InterlockedCompareExchange((PVOID*)ptr, (PVOID)nval, (PVOID)oval);
|
|
|
787 |
}
|
|
|
788 |
#else
|
|
|
789 |
#pragma warning(push)
|
|
|
790 |
#pragma warning(disable:4091) // empty typedef
|
|
|
791 |
#include <dbghelp.h>
|
|
|
792 |
#pragma warning(pop)
|
|
|
793 |
#endif
|
|
|
794 |
|
|
|
795 |
#ifdef IMAGEAPI // defined by DBGHELP.H
|
|
|
796 |
typedef LPAPI_VERSION (NTAPI *PF_ImagehlpApiVersionEx)(_In_ LPAPI_VERSION AppVersion);
|
|
|
797 |
|
|
|
798 |
typedef BOOL (NTAPI *PF_SymInitialize)(_In_ HANDLE hProcess,
|
|
|
799 |
_In_opt_ LPCSTR UserSearchPath,
|
|
|
800 |
_In_ BOOL fInvadeProcess);
|
|
|
801 |
typedef DWORD (NTAPI *PF_SymSetOptions)(_In_ DWORD SymOptions);
|
|
|
802 |
typedef DWORD (NTAPI *PF_SymGetOptions)(VOID);
|
|
|
803 |
typedef DWORD64 (NTAPI *PF_SymLoadModule64)(_In_ HANDLE hProcess,
|
|
|
804 |
_In_opt_ HANDLE hFile,
|
|
|
805 |
_In_ LPSTR ImageName,
|
|
|
806 |
_In_opt_ LPSTR ModuleName,
|
|
|
807 |
_In_ DWORD64 BaseOfDll,
|
|
|
808 |
_In_opt_ DWORD SizeOfDll);
|
|
|
809 |
typedef BOOL (NTAPI *PF_SymGetModuleInfo64)(_In_ HANDLE hProcess,
|
|
|
810 |
_In_ DWORD64 qwAddr,
|
|
|
811 |
_Out_ PIMAGEHLP_MODULE64 ModuleInfo);
|
|
|
812 |
typedef BOOL (NTAPI *PF_SymFromName)(_In_ HANDLE hProcess,
|
|
|
813 |
_In_ LPSTR Name,
|
|
|
814 |
_Out_ PSYMBOL_INFO Symbol);
|
|
|
815 |
|
|
|
816 |
typedef struct _DETOUR_SYM_INFO
|
|
|
817 |
{
|
|
|
818 |
HANDLE hProcess;
|
|
|
819 |
HMODULE hDbgHelp;
|
|
|
820 |
PF_ImagehlpApiVersionEx pfImagehlpApiVersionEx;
|
|
|
821 |
PF_SymInitialize pfSymInitialize;
|
|
|
822 |
PF_SymSetOptions pfSymSetOptions;
|
|
|
823 |
PF_SymGetOptions pfSymGetOptions;
|
|
|
824 |
PF_SymLoadModule64 pfSymLoadModule64;
|
|
|
825 |
PF_SymGetModuleInfo64 pfSymGetModuleInfo64;
|
|
|
826 |
PF_SymFromName pfSymFromName;
|
|
|
827 |
} DETOUR_SYM_INFO, *PDETOUR_SYM_INFO;
|
|
|
828 |
|
|
|
829 |
PDETOUR_SYM_INFO DetourLoadImageHlp(VOID);
|
|
|
830 |
|
|
|
831 |
#endif // IMAGEAPI
|
|
|
832 |
|
|
|
833 |
#if defined(_INC_STDIO) && !defined(_CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS)
|
|
|
834 |
#error detours.h must be included before stdio.h (or at least define _CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS earlier)
|
|
|
835 |
#endif
|
|
|
836 |
#define _CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS 1
|
|
|
837 |
|
|
|
838 |
#ifndef DETOUR_TRACE
|
|
|
839 |
#if DETOUR_DEBUG
|
|
|
840 |
#define DETOUR_TRACE(x) printf x
|
|
|
841 |
#define DETOUR_BREAK() __debugbreak()
|
|
|
842 |
#include <stdio.h>
|
|
|
843 |
#include <limits.h>
|
|
|
844 |
#else
|
|
|
845 |
#define DETOUR_TRACE(x)
|
|
|
846 |
#define DETOUR_BREAK()
|
|
|
847 |
#endif
|
|
|
848 |
#endif
|
|
|
849 |
|
|
|
850 |
#if 1 || defined(DETOURS_IA64)
|
|
|
851 |
|
|
|
852 |
//
|
|
|
853 |
// IA64 instructions are 41 bits, 3 per bundle, plus 5 bit bundle template => 128 bits per bundle.
|
|
|
854 |
//
|
|
|
855 |
|
|
|
856 |
#define DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE (3)
|
|
|
857 |
|
|
|
858 |
#define DETOUR_IA64_TEMPLATE_OFFSET (0)
|
|
|
859 |
#define DETOUR_IA64_TEMPLATE_SIZE (5)
|
|
|
860 |
|
|
|
861 |
#define DETOUR_IA64_INSTRUCTION_SIZE (41)
|
|
|
862 |
#define DETOUR_IA64_INSTRUCTION0_OFFSET (DETOUR_IA64_TEMPLATE_SIZE)
|
|
|
863 |
#define DETOUR_IA64_INSTRUCTION1_OFFSET (DETOUR_IA64_TEMPLATE_SIZE + DETOUR_IA64_INSTRUCTION_SIZE)
|
|
|
864 |
#define DETOUR_IA64_INSTRUCTION2_OFFSET (DETOUR_IA64_TEMPLATE_SIZE + DETOUR_IA64_INSTRUCTION_SIZE + DETOUR_IA64_INSTRUCTION_SIZE)
|
|
|
865 |
|
|
|
866 |
C_ASSERT(DETOUR_IA64_TEMPLATE_SIZE + DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE * DETOUR_IA64_INSTRUCTION_SIZE == 128);
|
|
|
867 |
|
|
|
868 |
__declspec(align(16)) struct DETOUR_IA64_BUNDLE
|
|
|
869 |
{
|
|
|
870 |
public:
|
|
|
871 |
union
|
|
|
872 |
{
|
|
|
873 |
BYTE data[16];
|
|
|
874 |
UINT64 wide[2];
|
|
|
875 |
};
|
|
|
876 |
|
|
|
877 |
enum {
|
|
|
878 |
A_UNIT = 1u,
|
|
|
879 |
I_UNIT = 2u,
|
|
|
880 |
M_UNIT = 3u,
|
|
|
881 |
B_UNIT = 4u,
|
|
|
882 |
F_UNIT = 5u,
|
|
|
883 |
L_UNIT = 6u,
|
|
|
884 |
X_UNIT = 7u,
|
|
|
885 |
};
|
|
|
886 |
struct DETOUR_IA64_METADATA
|
|
|
887 |
{
|
|
|
888 |
ULONG nTemplate : 8; // Instruction template.
|
|
|
889 |
ULONG nUnit0 : 4; // Unit for slot 0
|
|
|
890 |
ULONG nUnit1 : 4; // Unit for slot 1
|
|
|
891 |
ULONG nUnit2 : 4; // Unit for slot 2
|
|
|
892 |
};
|
|
|
893 |
|
|
|
894 |
protected:
|
|
|
895 |
static const DETOUR_IA64_METADATA s_rceCopyTable[33];
|
|
|
896 |
|
|
|
897 |
UINT RelocateBundle(_Inout_ DETOUR_IA64_BUNDLE* pDst, _Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra) const;
|
|
|
898 |
|
|
|
899 |
bool RelocateInstruction(_Inout_ DETOUR_IA64_BUNDLE* pDst,
|
|
|
900 |
_In_ BYTE slot,
|
|
|
901 |
_Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra) const;
|
|
|
902 |
|
|
|
903 |
// 120 112 104 96 88 80 72 64 56 48 40 32 24 16 8 0
|
|
|
904 |
// f. e. d. c. b. a. 9. 8. 7. 6. 5. 4. 3. 2. 1. 0.
|
|
|
905 |
|
|
|
906 |
// 00
|
|
|
907 |
// f.e. d.c. b.a. 9.8. 7.6. 5.4. 3.2. 1.0.
|
|
|
908 |
// 0000 0000 0000 0000 0000 0000 0000 001f : Template [4..0]
|
|
|
909 |
// 0000 0000 0000 0000 0000 03ff ffff ffe0 : Zero [ 41.. 5]
|
|
|
910 |
// 0000 0000 0000 0000 0000 3c00 0000 0000 : Zero [ 45.. 42]
|
|
|
911 |
// 0000 0000 0007 ffff ffff c000 0000 0000 : One [ 82.. 46]
|
|
|
912 |
// 0000 0000 0078 0000 0000 0000 0000 0000 : One [ 86.. 83]
|
|
|
913 |
// 0fff ffff ff80 0000 0000 0000 0000 0000 : Two [123.. 87]
|
|
|
914 |
// f000 0000 0000 0000 0000 0000 0000 0000 : Two [127..124]
|
|
|
915 |
BYTE GetTemplate() const;
|
|
|
916 |
// Get 4 bit opcodes.
|
|
|
917 |
BYTE GetInst0() const;
|
|
|
918 |
BYTE GetInst1() const;
|
|
|
919 |
BYTE GetInst2() const;
|
|
|
920 |
BYTE GetUnit(BYTE slot) const;
|
|
|
921 |
BYTE GetUnit0() const;
|
|
|
922 |
BYTE GetUnit1() const;
|
|
|
923 |
BYTE GetUnit2() const;
|
|
|
924 |
// Get 37 bit data.
|
|
|
925 |
UINT64 GetData0() const;
|
|
|
926 |
UINT64 GetData1() const;
|
|
|
927 |
UINT64 GetData2() const;
|
|
|
928 |
|
|
|
929 |
// Get/set the full 41 bit instructions.
|
|
|
930 |
UINT64 GetInstruction(BYTE slot) const;
|
|
|
931 |
UINT64 GetInstruction0() const;
|
|
|
932 |
UINT64 GetInstruction1() const;
|
|
|
933 |
UINT64 GetInstruction2() const;
|
|
|
934 |
void SetInstruction(BYTE slot, UINT64 instruction);
|
|
|
935 |
void SetInstruction0(UINT64 instruction);
|
|
|
936 |
void SetInstruction1(UINT64 instruction);
|
|
|
937 |
void SetInstruction2(UINT64 instruction);
|
|
|
938 |
|
|
|
939 |
// Get/set bitfields.
|
|
|
940 |
static UINT64 GetBits(UINT64 Value, UINT64 Offset, UINT64 Count);
|
|
|
941 |
static UINT64 SetBits(UINT64 Value, UINT64 Offset, UINT64 Count, UINT64 Field);
|
|
|
942 |
|
|
|
943 |
// Get specific read-only fields.
|
|
|
944 |
static UINT64 GetOpcode(UINT64 instruction); // 4bit opcode
|
|
|
945 |
static UINT64 GetX(UINT64 instruction); // 1bit opcode extension
|
|
|
946 |
static UINT64 GetX3(UINT64 instruction); // 3bit opcode extension
|
|
|
947 |
static UINT64 GetX6(UINT64 instruction); // 6bit opcode extension
|
|
|
948 |
|
|
|
949 |
// Get/set specific fields.
|
|
|
950 |
static UINT64 GetImm7a(UINT64 instruction);
|
|
|
951 |
static UINT64 SetImm7a(UINT64 instruction, UINT64 imm7a);
|
|
|
952 |
static UINT64 GetImm13c(UINT64 instruction);
|
|
|
953 |
static UINT64 SetImm13c(UINT64 instruction, UINT64 imm13c);
|
|
|
954 |
static UINT64 GetSignBit(UINT64 instruction);
|
|
|
955 |
static UINT64 SetSignBit(UINT64 instruction, UINT64 signBit);
|
|
|
956 |
static UINT64 GetImm20a(UINT64 instruction);
|
|
|
957 |
static UINT64 SetImm20a(UINT64 instruction, UINT64 imm20a);
|
|
|
958 |
static UINT64 GetImm20b(UINT64 instruction);
|
|
|
959 |
static UINT64 SetImm20b(UINT64 instruction, UINT64 imm20b);
|
|
|
960 |
|
|
|
961 |
static UINT64 SignExtend(UINT64 Value, UINT64 Offset);
|
|
|
962 |
|
|
|
963 |
BOOL IsMovlGp() const;
|
|
|
964 |
|
|
|
965 |
VOID SetInst(BYTE Slot, BYTE nInst);
|
|
|
966 |
VOID SetInst0(BYTE nInst);
|
|
|
967 |
VOID SetInst1(BYTE nInst);
|
|
|
968 |
VOID SetInst2(BYTE nInst);
|
|
|
969 |
VOID SetData(BYTE Slot, UINT64 nData);
|
|
|
970 |
VOID SetData0(UINT64 nData);
|
|
|
971 |
VOID SetData1(UINT64 nData);
|
|
|
972 |
VOID SetData2(UINT64 nData);
|
|
|
973 |
BOOL SetNop(BYTE Slot);
|
|
|
974 |
BOOL SetNop0();
|
|
|
975 |
BOOL SetNop1();
|
|
|
976 |
BOOL SetNop2();
|
|
|
977 |
|
|
|
978 |
public:
|
|
|
979 |
BOOL IsBrl() const;
|
|
|
980 |
VOID SetBrl();
|
|
|
981 |
VOID SetBrl(UINT64 target);
|
|
|
982 |
UINT64 GetBrlTarget() const;
|
|
|
983 |
VOID SetBrlTarget(UINT64 target);
|
|
|
984 |
VOID SetBrlImm(UINT64 imm);
|
|
|
985 |
UINT64 GetBrlImm() const;
|
|
|
986 |
|
|
|
987 |
UINT64 GetMovlGp() const;
|
|
|
988 |
VOID SetMovlGp(UINT64 gp);
|
|
|
989 |
|
|
|
990 |
VOID SetStop();
|
|
|
991 |
|
|
|
992 |
UINT Copy(_Out_ DETOUR_IA64_BUNDLE *pDst, _Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra = NULL) const;
|
|
|
993 |
};
|
|
|
994 |
#endif // DETOURS_IA64
|
|
|
995 |
|
|
|
996 |
#ifdef DETOURS_ARM
|
|
|
997 |
|
|
|
998 |
#define DETOURS_PFUNC_TO_PBYTE(p) ((PBYTE)(((ULONG_PTR)(p)) & ~(ULONG_PTR)1))
|
|
|
999 |
#define DETOURS_PBYTE_TO_PFUNC(p) ((PBYTE)(((ULONG_PTR)(p)) | (ULONG_PTR)1))
|
|
|
1000 |
|
|
|
1001 |
#endif // DETOURS_ARM
|
|
|
1002 |
|
|
|
1003 |
//////////////////////////////////////////////////////////////////////////////
|
|
|
1004 |
|
|
|
1005 |
#ifdef __cplusplus
|
|
|
1006 |
extern "C" {
|
|
|
1007 |
#endif // __cplusplus
|
|
|
1008 |
|
|
|
1009 |
#define DETOUR_OFFLINE_LIBRARY(x) \
|
|
|
1010 |
PVOID WINAPI DetourCopyInstruction##x(_In_opt_ PVOID pDst, \
|
|
|
1011 |
_Inout_opt_ PVOID *ppDstPool, \
|
|
|
1012 |
_In_ PVOID pSrc, \
|
|
|
1013 |
_Out_opt_ PVOID *ppTarget, \
|
|
|
1014 |
_Out_opt_ LONG *plExtra); \
|
|
|
1015 |
\
|
|
|
1016 |
BOOL WINAPI DetourSetCodeModule##x(_In_ HMODULE hModule, \
|
|
|
1017 |
_In_ BOOL fLimitReferencesToModule); \
|
|
|
1018 |
|
|
|
1019 |
DETOUR_OFFLINE_LIBRARY(X86)
|
|
|
1020 |
DETOUR_OFFLINE_LIBRARY(X64)
|
|
|
1021 |
DETOUR_OFFLINE_LIBRARY(ARM)
|
|
|
1022 |
DETOUR_OFFLINE_LIBRARY(ARM64)
|
|
|
1023 |
DETOUR_OFFLINE_LIBRARY(IA64)
|
|
|
1024 |
|
|
|
1025 |
#undef DETOUR_OFFLINE_LIBRARY
|
|
|
1026 |
|
|
|
1027 |
//////////////////////////////////////////////////////////////////////////////
|
|
|
1028 |
//
|
|
|
1029 |
// Helpers for manipulating page protection.
|
|
|
1030 |
//
|
|
|
1031 |
|
|
|
1032 |
_Success_(return != FALSE)
|
|
|
1033 |
BOOL WINAPI DetourVirtualProtectSameExecuteEx(_In_ HANDLE hProcess,
|
|
|
1034 |
_In_ PVOID pAddress,
|
|
|
1035 |
_In_ SIZE_T nSize,
|
|
|
1036 |
_In_ DWORD dwNewProtect,
|
|
|
1037 |
_Out_ PDWORD pdwOldProtect);
|
|
|
1038 |
|
|
|
1039 |
_Success_(return != FALSE)
|
|
|
1040 |
BOOL WINAPI DetourVirtualProtectSameExecute(_In_ PVOID pAddress,
|
|
|
1041 |
_In_ SIZE_T nSize,
|
|
|
1042 |
_In_ DWORD dwNewProtect,
|
|
|
1043 |
_Out_ PDWORD pdwOldProtect);
|
|
|
1044 |
#ifdef __cplusplus
|
|
|
1045 |
}
|
|
|
1046 |
#endif // __cplusplus
|
|
|
1047 |
|
|
|
1048 |
//////////////////////////////////////////////////////////////////////////////
|
|
|
1049 |
|
|
|
1050 |
#define MM_ALLOCATION_GRANULARITY 0x10000
|
|
|
1051 |
|
|
|
1052 |
//////////////////////////////////////////////////////////////////////////////
|
|
|
1053 |
|
|
|
1054 |
#endif // DETOURS_INTERNAL
|
|
|
1055 |
#endif // __cplusplus
|
|
|
1056 |
|
|
|
1057 |
#endif // _DETOURS_H_
|
|
|
1058 |
//
|
|
|
1059 |
//////////////////////////////////////////////////////////////// End of File.
|