mirror of
https://github.com/djhackersdev/bemanitools.git
synced 2026-09-27 17:26:24 -05:00
hook: Update capnhook source files from latest master
https://github.com/decafcode/capnhook
This commit is contained in:
@@ -1,5 +1,6 @@
|
||||
#include <windows.h>
|
||||
|
||||
#include <assert.h>
|
||||
#include <stddef.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
@@ -8,32 +9,44 @@
|
||||
#include "hook/peb.h"
|
||||
#include "hook/table.h"
|
||||
|
||||
#include "util/mem.h"
|
||||
static const char apiset_prefix[] = "api-ms-win-core-";
|
||||
static const size_t apiset_prefix_len = sizeof(apiset_prefix) - 1;
|
||||
|
||||
static void hook_table_apply_to_all(
|
||||
const char *depname, const struct hook_symbol *syms, size_t nsyms);
|
||||
const char *depname,
|
||||
const struct hook_symbol *syms,
|
||||
size_t nsyms);
|
||||
|
||||
static void hook_table_apply_to_iid(
|
||||
HMODULE target,
|
||||
const pe_iid_t *iid,
|
||||
const struct hook_symbol *syms,
|
||||
size_t nsyms);
|
||||
HMODULE target,
|
||||
const pe_iid_t *iid,
|
||||
const struct hook_symbol *syms,
|
||||
size_t nsyms);
|
||||
|
||||
static bool hook_table_match_module(
|
||||
HMODULE target,
|
||||
const char *iid_name,
|
||||
const char *depname);
|
||||
|
||||
static bool hook_table_match_proc(
|
||||
const struct pe_iat_entry *iate, const struct hook_symbol *sym);
|
||||
const struct pe_iat_entry *iate,
|
||||
const struct hook_symbol *sym);
|
||||
|
||||
static void hook_table_apply_to_all(
|
||||
const char *depname, const struct hook_symbol *syms, size_t nsyms)
|
||||
const char *depname,
|
||||
const struct hook_symbol *syms,
|
||||
size_t nsyms)
|
||||
{
|
||||
const peb_dll_t *dll;
|
||||
HMODULE pe;
|
||||
|
||||
for (dll = peb_dll_get_first(); dll != NULL; dll = peb_dll_get_next(dll)) {
|
||||
for ( dll = peb_dll_get_first() ;
|
||||
dll != NULL ;
|
||||
dll = peb_dll_get_next(dll)) {
|
||||
pe = peb_dll_get_base(dll);
|
||||
|
||||
if (pe == NULL) {
|
||||
/* wtf? */
|
||||
continue;
|
||||
continue; /* ?? Happens sometimes. */
|
||||
}
|
||||
|
||||
hook_table_apply(pe, depname, syms, nsyms);
|
||||
@@ -41,25 +54,29 @@ static void hook_table_apply_to_all(
|
||||
}
|
||||
|
||||
void hook_table_apply(
|
||||
HMODULE target,
|
||||
const char *depname,
|
||||
const struct hook_symbol *syms,
|
||||
size_t nsyms)
|
||||
HMODULE target,
|
||||
const char *depname,
|
||||
const struct hook_symbol *syms,
|
||||
size_t nsyms)
|
||||
{
|
||||
const pe_iid_t *iid;
|
||||
const char *iid_name;
|
||||
|
||||
assert(depname != NULL);
|
||||
assert(syms != NULL || nsyms == 0);
|
||||
|
||||
if (target == NULL) {
|
||||
/* Call out, which will then call us back repeatedly. Awkward, but
|
||||
viewed from the outside it's good for usability. */
|
||||
|
||||
hook_table_apply_to_all(depname, syms, nsyms);
|
||||
} else {
|
||||
for (iid = pe_iid_get_first(target); iid != NULL;
|
||||
iid = pe_iid_get_next(target, iid)) {
|
||||
for ( iid = pe_iid_get_first(target) ;
|
||||
iid != NULL ;
|
||||
iid = pe_iid_get_next(target, iid)) {
|
||||
iid_name = pe_iid_get_name(target, iid);
|
||||
|
||||
if (_stricmp(iid_name, depname) == 0) {
|
||||
if (hook_table_match_module(target, iid_name, depname)) {
|
||||
hook_table_apply_to_iid(target, iid, syms, nsyms);
|
||||
}
|
||||
}
|
||||
@@ -67,10 +84,10 @@ void hook_table_apply(
|
||||
}
|
||||
|
||||
static void hook_table_apply_to_iid(
|
||||
HMODULE target,
|
||||
const pe_iid_t *iid,
|
||||
const struct hook_symbol *syms,
|
||||
size_t nsyms)
|
||||
HMODULE target,
|
||||
const pe_iid_t *iid,
|
||||
const struct hook_symbol *syms,
|
||||
size_t nsyms)
|
||||
{
|
||||
struct pe_iat_entry iate;
|
||||
size_t i;
|
||||
@@ -79,8 +96,8 @@ static void hook_table_apply_to_iid(
|
||||
|
||||
i = 0;
|
||||
|
||||
while (pe_iid_get_iat_entry(target, iid, i++, &iate)) {
|
||||
for (j = 0; j < nsyms; j++) {
|
||||
while (pe_iid_get_iat_entry(target, iid, i++, &iate) == S_OK) {
|
||||
for (j = 0 ; j < nsyms ; j++) {
|
||||
sym = &syms[j];
|
||||
|
||||
if (hook_table_match_proc(&iate, sym)) {
|
||||
@@ -88,17 +105,70 @@ static void hook_table_apply_to_iid(
|
||||
*sym->link = *iate.ppointer;
|
||||
}
|
||||
|
||||
pe_patch_pointer(iate.ppointer, sym->patch);
|
||||
pe_patch(iate.ppointer, &sym->patch, sizeof(sym->patch));
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
static bool hook_table_match_proc(
|
||||
const struct pe_iat_entry *iate, const struct hook_symbol *sym)
|
||||
static bool hook_table_match_module(
|
||||
HMODULE target,
|
||||
const char *iid_name,
|
||||
const char *depname)
|
||||
{
|
||||
if (sym->name != NULL && iate->name != NULL &&
|
||||
strcmp(sym->name, iate->name) == 0) {
|
||||
HMODULE kernel32;
|
||||
int result;
|
||||
|
||||
/* OK, first do a straightforward match on the imported DLL name versus
|
||||
the hook table DLL name. If it succeeds then we're done. */
|
||||
|
||||
result = _stricmp(iid_name, depname);
|
||||
|
||||
if (result == 0) {
|
||||
return true;
|
||||
}
|
||||
|
||||
/* If it failed then we have to check if this hook table targets kernel32.
|
||||
We have to do some special processing around API sets in that case, so
|
||||
stop here if kernel32 is not the subject of this hook table. */
|
||||
|
||||
if (_stricmp(depname, "kernel32.dll") != 0) {
|
||||
return false;
|
||||
}
|
||||
|
||||
/* There isn't really any good test for whether a DLL import wants a
|
||||
concrete DLL or an abstract DLL providing a particular Windows API-set,
|
||||
so we use a hacky check against the prefix. If the imported DLL name
|
||||
looks like an apiset then we'll allow kernel32 hook tables to apply. */
|
||||
|
||||
result = _strnicmp(iid_name, apiset_prefix, apiset_prefix_len);
|
||||
|
||||
if (result != 0) {
|
||||
return false;
|
||||
}
|
||||
|
||||
/* ... EXCEPT for the case where we're hooking all DLLs loaded into the
|
||||
process and we are currently examining kernel32 itself. In that case
|
||||
there's some weird reference loops issues I don't entirely understand
|
||||
right now. To avoid those, we just don't apply kernel32 hook tables to
|
||||
kernel32 itself. */
|
||||
|
||||
kernel32 = GetModuleHandleW(L"kernel32.dll");
|
||||
|
||||
if (target == kernel32) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
static bool hook_table_match_proc(
|
||||
const struct pe_iat_entry *iate,
|
||||
const struct hook_symbol *sym)
|
||||
{
|
||||
if ( sym->name != NULL &&
|
||||
iate->name != NULL &&
|
||||
strcmp(sym->name, iate->name) == 0) {
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user