static BOOL hookFunction(HMODULE hModule, const char *szModule, const char *pszDllName, const char *pszFunctionName, LPVOID lpNewAddress) { PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor = getImportDescriptor(hModule, szModule, pszDllName); if (pImportDescriptor == NULL) { return FALSE; } LPVOID* lpOldFunctionAddress = getOldFunctionAddress(hModule, pImportDescriptor, pszFunctionName); if (lpOldFunctionAddress == NULL) { return FALSE; } if (*lpOldFunctionAddress == lpNewAddress) { return TRUE; } if (VERBOSITY >= 3) { debugPrintf(" hooking %s->%s!%s\n", szModule, pszDllName, pszFunctionName); } return replaceAddress(lpOldFunctionAddress, lpNewAddress); }
static BOOL patchFunction(HMODULE hModule, const char *szModule, const char *pszDllName, T pImportDescriptor, const char *pszFunctionName, LPVOID lpOldAddress, LPVOID lpNewAddress) { LPVOID* lpPatchAddress = getPatchAddress(hModule, pImportDescriptor, pszFunctionName, lpOldAddress); if (lpPatchAddress == NULL) { return FALSE; } if (*lpPatchAddress == lpNewAddress) { return TRUE; } DWORD Offset = (DWORD)(UINT_PTR)lpPatchAddress - (UINT_PTR)hModule; if (VERBOSITY > 0) { debugPrintf("inject: patching %s!0x%lx -> %s!%s\n", szModule, Offset, pszDllName, pszFunctionName); } BOOL bRet; bRet = replaceAddress(lpPatchAddress, lpNewAddress); if (!bRet) { debugPrintf("inject: failed to patch %s!0x%lx -> %s!%s\n", szModule, Offset, pszDllName, pszFunctionName); } return bRet; }
static void replaceModule(HMODULE hModule, const char *szModule, PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor, HMODULE hNewModule) { PIMAGE_THUNK_DATA pOriginalFirstThunk = (PIMAGE_THUNK_DATA)((PBYTE)hModule + pImportDescriptor->OriginalFirstThunk); PIMAGE_THUNK_DATA pFirstThunk = (PIMAGE_THUNK_DATA)((PBYTE)hModule + pImportDescriptor->FirstThunk); while (pOriginalFirstThunk->u1.Function) { PIMAGE_IMPORT_BY_NAME pImport = (PIMAGE_IMPORT_BY_NAME)((PBYTE)hModule + pOriginalFirstThunk->u1.AddressOfData); const char* szFunctionName = (const char* )pImport->Name; if (VERBOSITY > 0) { debugPrintf(" hooking %s->%s!%s\n", szModule, getImportDescriptionName(hModule, pImportDescriptor), szFunctionName); } PROC pNewProc = GetProcAddress(hNewModule, szFunctionName); if (!pNewProc) { debugPrintf("warning: no replacement for %s\n", szFunctionName); } else { LPVOID *lpOldAddress = (LPVOID *)(&pFirstThunk->u1.Function); replaceAddress(lpOldAddress, (LPVOID)pNewProc); if (pSharedMem) { pSharedMem->bReplaced = TRUE; } } ++pOriginalFirstThunk; ++pFirstThunk; } }