Example #1
0
static BOOL
hookFunction(HMODULE hModule,
             const char *szModule,
             const char *pszDllName,
             const char *pszFunctionName,
             LPVOID lpNewAddress)
{
    PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor = getImportDescriptor(hModule, szModule, pszDllName);
    if (pImportDescriptor == NULL) {
        return FALSE;
    }
    LPVOID* lpOldFunctionAddress = getOldFunctionAddress(hModule, pImportDescriptor, pszFunctionName);
    if (lpOldFunctionAddress == NULL) {
        return FALSE;
    }

    if (*lpOldFunctionAddress == lpNewAddress) {
        return TRUE;
    }

    if (VERBOSITY >= 3) {
        debugPrintf("      hooking %s->%s!%s\n", szModule, pszDllName, pszFunctionName);
    }

    return replaceAddress(lpOldFunctionAddress, lpNewAddress);
}
Example #2
0
static BOOL
patchFunction(HMODULE hModule,
              const char *szModule,
              const char *pszDllName,
              T pImportDescriptor,
              const char *pszFunctionName,
              LPVOID lpOldAddress,
              LPVOID lpNewAddress)
{
    LPVOID* lpPatchAddress = getPatchAddress(hModule, pImportDescriptor, pszFunctionName, lpOldAddress);
    if (lpPatchAddress == NULL) {
        return FALSE;
    }

    if (*lpPatchAddress == lpNewAddress) {
        return TRUE;
    }

    DWORD Offset = (DWORD)(UINT_PTR)lpPatchAddress - (UINT_PTR)hModule;
    if (VERBOSITY > 0) {
        debugPrintf("inject: patching %s!0x%lx -> %s!%s\n", szModule, Offset, pszDllName, pszFunctionName);
    }

    BOOL bRet;
    bRet = replaceAddress(lpPatchAddress, lpNewAddress);
    if (!bRet) {
        debugPrintf("inject: failed to patch %s!0x%lx -> %s!%s\n", szModule, Offset, pszDllName, pszFunctionName);
    }

    return bRet;
}
Example #3
0
static void
replaceModule(HMODULE hModule,
              const char *szModule,
              PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor,
              HMODULE hNewModule)
{
    PIMAGE_THUNK_DATA pOriginalFirstThunk = (PIMAGE_THUNK_DATA)((PBYTE)hModule + pImportDescriptor->OriginalFirstThunk);
    PIMAGE_THUNK_DATA pFirstThunk = (PIMAGE_THUNK_DATA)((PBYTE)hModule + pImportDescriptor->FirstThunk);

    while (pOriginalFirstThunk->u1.Function) {
        PIMAGE_IMPORT_BY_NAME pImport = (PIMAGE_IMPORT_BY_NAME)((PBYTE)hModule + pOriginalFirstThunk->u1.AddressOfData);
        const char* szFunctionName = (const char* )pImport->Name;
        if (VERBOSITY > 0) {
            debugPrintf("      hooking %s->%s!%s\n", szModule,
                        getImportDescriptionName(hModule, pImportDescriptor),
                        szFunctionName);
        }

        PROC pNewProc = GetProcAddress(hNewModule, szFunctionName);
        if (!pNewProc) {
            debugPrintf("warning: no replacement for %s\n", szFunctionName);
        } else {
            LPVOID *lpOldAddress = (LPVOID *)(&pFirstThunk->u1.Function);
            replaceAddress(lpOldAddress, (LPVOID)pNewProc);
            if (pSharedMem) {
                pSharedMem->bReplaced = TRUE;
            }
        }

        ++pOriginalFirstThunk;
        ++pFirstThunk;
    }
}