// This is an extended version of the function of the same name from Detours. BOOL WINAPI CreateProcessWithDll(LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation, LPCSTR lpDllName, LPCSTR lpFunctionName, LPCSTR lpFunctionArgs, PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA) { DWORD dwMyCreationFlags = (dwCreationFlags | CREATE_SUSPENDED); PROCESS_INFORMATION pi; if (pfCreateProcessA == NULL) { pfCreateProcessA = CreateProcessA; } if (!pfCreateProcessA(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwMyCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, &pi)) { return FALSE; } if (!InjectLibrary(pi.hProcess, pi.hThread, GetLoadLibraryA(), GetGetProcAddress(), (PBYTE)lpDllName, lpDllName ? strlen(lpDllName) + 1 : 0, (PBYTE)lpFunctionName, lpFunctionName ? strlen(lpFunctionName) + 1 : 0, (PBYTE)lpFunctionArgs, lpFunctionArgs ? strlen(lpFunctionArgs) + 1 : 0) ) { return FALSE; } if (lpProcessInformation) { CopyMemory(lpProcessInformation, &pi, sizeof(pi)); } if (!(dwCreationFlags & CREATE_SUSPENDED)) { ResumeThread(pi.hThread); } return TRUE; }
void CBody::GetBody(const char* dllname) { DBGTRACE("before make body\n"); int start1,end1; GetLibraryBody(&start1,&end1); DBGTRACE("maked code %d\n",end1-start1); const unsigned char* start; int size; GetLoadLibraryA(&start,&size); m_body.clear(); m_body.insert(m_body.end(),start,start+size); m_body.insert(m_body.end(),reinterpret_cast<const unsigned char*>(dllname),reinterpret_cast<const unsigned char*>(strchr(dllname,0)+1)); DBGTRACE("maked total %d\n",m_body.size()); }