-
Notifications
You must be signed in to change notification settings - Fork 0
/
HookFunction.cpp
159 lines (120 loc) · 5.46 KB
/
HookFunction.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
#pragma once
#include <Windows.h>
#include <detours/detours.h>
#include "HookFunction.h"
#include "Utils.h"
// TODO: PROPERLY IMPLEMENT (Not entirely necessary, but would be helpful in the
// future.)
void RelocateCodeSegment(void *src, void *dst, const size_t size) {
memcpy(dst, src, size);
}
HookedFunctionInfo HookFunction(void *&src, void *dst, const size_t code_size,
FunctionHookType type) {
HookedFunctionInfo info = HookedFunctionInfo::Default();
if (code_size < 5)
return info; // You cannot hook at code segments smaller than 5 bytes.
if (type == FunctionHookType::EntireReplacement) {
info = {src, dst, nullptr, type, code_size};
// Create and commit a Microsoft Detour.
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach((void **)&src, dst);
DetourTransactionCommit();
info.original_code = src;
} else if (type == FunctionHookType::IATReplacement) {
SetExecuteReadWritePermission(src, 4);
info = {src, dst, *(void **)src, type, 0};
*(void **)src = dst;
} else if (type == FunctionHookType::InlineReplacement) {
SetExecuteReadWritePermission(src, code_size);
char *original_code =
AllocateCode(code_size); // Allocate code for backed up instructions.
RelocateCodeSegment(src, original_code,
code_size); // Relocate code from the source pointer
// into the allocated backup buffer.
info = {src, dst, original_code, type, code_size};
memset(src, 0x90, code_size); // Pad out the original code with NOPs.
WriteCALL(
src,
dst); // Write a function call from the source to the detour function.
} else if (type == FunctionHookType::InlineReplacementJMP) {
SetExecuteReadWritePermission(src, code_size);
char *original_code =
AllocateCode(code_size); // Allocate code for backed up instructions.
RelocateCodeSegment(src, original_code,
code_size); // Relocate code from the source pointer
// into the allocated backup buffer.
info = {src, dst, original_code, type, code_size};
memset(src, 0x90, code_size); // Pad out the original code with NOPs.
WriteJMP(
src,
dst); // Write a function call from the source to the detour function.
}
return info;
}
HookedFunctionInfo HookFunction(unsigned long src, void *dst,
const size_t code_size, FunctionHookType type) {
HookedFunctionInfo info = HookedFunctionInfo::Default();
if (code_size < 5 && (type == FunctionHookType::InlineReplacement ||
type == FunctionHookType::InlineReplacementJMP))
return info; // You cannot inline hook at code segments smaller than 5
// bytes.
else if (type == FunctionHookType::IATReplacement) {
SetReadWritePermission((void *)src, 4);
info = {(void *)src, dst, *(void **)src, type, 0};
*(void **)src = dst;
} else if (type == FunctionHookType::InlineReplacement) {
SetExecuteReadWritePermission((void *)src, code_size);
char *original_code =
AllocateCode(code_size); // Allocate code for backed up instructions.
RelocateCodeSegment((void *)src, original_code,
code_size); // Relocate code from the source pointer
// into the allocated backup buffer.
info = {(void *)src, dst, original_code, type, code_size};
memset((void *)src, 0x90,
code_size); // Pad out the original code with NOPs.
WriteCALL(
(void*)src,
dst); // Write a function call from the source to the detour function.
} else if (type == FunctionHookType::InlineReplacementJMP) {
SetExecuteReadWritePermission((void *)src, code_size);
char *original_code =
AllocateCode(code_size); // Allocate code for backed up instructions.
RelocateCodeSegment((void *)src, original_code,
code_size); // Relocate code from the source pointer
// into the allocated backup buffer.
info = {(void *)src, dst, original_code, type, code_size};
memset((void *)src, 0x90,
code_size); // Pad out the original code with NOPs.
WriteJMP(
(void*)src,
dst); // Write a function call from the source to the detour function.
}
return info;
}
bool UninstallFunctionHook(HookedFunctionInfo &function_info) {
if (function_info.type == FunctionHookType::Invalid)
return false;
if (function_info.type == FunctionHookType::EntireReplacement) {
// Remove the Microsoft Detour.
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourDetach((void **)&function_info.source_address,
function_info.destination_address);
DetourTransactionCommit();
return true;
} else if (function_info.type == FunctionHookType::IATReplacement) {
*(void **)function_info.source_address =
function_info
.original_code; // Set the pointer back to its original value.
return true;
} else if (function_info.type == FunctionHookType::InlineReplacement) {
RelocateCodeSegment(
function_info.original_code, function_info.source_address,
function_info.code_size); // Relocate the original code back into the
// correct address.
FreeCode(function_info.original_code); // Free the allocated code buffer.
return true;
}
return false;
}