11#include " stdafx.h"
22#include < 3rdparty/Detours/detours.h>
33
4- typedef HRESULT (WINAPI* GetFileVersion_T)(
5- LPCWSTR szFilename,
6- LPWSTR szBuffer,
7- DWORD cchBuffer,
8- DWORD* dwLength
9- );
10-
114typedef struct _MMP_FAKE_HANDLE_LIST_ENTRY {
125 LIST_ENTRY InMmpFakeHandleList;
136 HANDLE hObject;
147 PVOID value;
158 BOOL bImageMapping;
169}MMP_FAKE_HANDLE_LIST_ENTRY, * PMMP_FAKE_HANDLE_LIST_ENTRY;
1710
18- static decltype (&CreateFileW) OriginCreateFileW = CreateFileW;
19- static decltype (&GetFileInformationByHandle) OriginGetFileInformationByHandle = GetFileInformationByHandle;
20- static decltype (&GetFileAttributesExW) OriginGetFileAttributesExW = GetFileAttributesExW;
21- static decltype (&GetFileSize) OriginGetFileSize = GetFileSize;
22- static decltype (&GetFileSizeEx) OriginGetFileSizeEx = GetFileSizeEx;
23- static decltype (&CreateFileMappingW) OriginCreateFileMappingW = CreateFileMappingW;
24- static decltype (&MapViewOfFileEx) OriginMapViewOfFileEx = MapViewOfFileEx;
25- static decltype (&MapViewOfFile) OriginMapViewOfFile = MapViewOfFile;
26- static decltype (&UnmapViewOfFile)OriginUnmapViewOfFile = UnmapViewOfFile;
27- static decltype (&CloseHandle)OriginCloseHandle = CloseHandle;
28- static GetFileVersion_T OriginGetFileVersion1 = nullptr ;
29- static GetFileVersion_T OriginGetFileVersion2 = nullptr ;
30-
3111BOOL MmpIsMemoryModuleFileName (
3212 _In_ LPCWSTR lpFileName,
3313 _Out_opt_ PLDR_DATA_TABLE_ENTRY *LdrEntry) {
@@ -127,7 +107,7 @@ HANDLE WINAPI HookCreateFileW(
127107 return hEvent;
128108 }
129109
130- return OriginCreateFileW (
110+ return MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginCreateFileW (
131111 lpFileName,
132112 dwDesiredAccess,
133113 dwShareMode,
@@ -154,7 +134,7 @@ BOOL WINAPI HookGetFileInformationByHandle(
154134 return TRUE ;
155135 }
156136 else {
157- return OriginGetFileInformationByHandle (
137+ return MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginGetFileInformationByHandle (
158138 hFile,
159139 lpFileInformation
160140 );
@@ -186,7 +166,7 @@ BOOL WINAPI HookGetFileAttributesExW(
186166 }
187167 }
188168
189- return OriginGetFileAttributesExW (
169+ return MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginGetFileAttributesExW (
190170 lpFileName,
191171 fInfoLevelId ,
192172 lpFileInformation
@@ -207,7 +187,7 @@ DWORD WINAPI HookGetFileSize(
207187 return module ->dwImageFileSize ;
208188 }
209189 else {
210- return OriginGetFileSize (
190+ return MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginGetFileSize (
211191 hFile,
212192 lpFileSizeHigh
213193 );
@@ -228,7 +208,7 @@ BOOL WINAPI HookGetFileSizeEx(
228208 return TRUE ;
229209 }
230210 else {
231- return OriginGetFileSizeEx (
211+ return MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginGetFileSizeEx (
232212 hFile,
233213 lpFileSize
234214 );
@@ -252,7 +232,7 @@ HANDLE WINAPI HookCreateFileMappingW(
252232 return hEvent;
253233 }
254234
255- return OriginCreateFileMappingW (
235+ return MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginCreateFileMappingW (
256236 hFile,
257237 lpFileMappingAttributes,
258238 flProtect,
@@ -288,7 +268,7 @@ LPVOID WINAPI HookMapViewOfFileEx(
288268 return hModule;
289269 }
290270
291- return OriginMapViewOfFileEx (
271+ return MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginMapViewOfFileEx (
292272 hFileMappingObject,
293273 dwDesiredAccess,
294274 dwFileOffsetHigh,
@@ -324,14 +304,14 @@ BOOL WINAPI HookUnmapViewOfFile(_In_ LPCVOID lpBaseAddress) {
324304 return TRUE ;
325305 }
326306
327- return OriginUnmapViewOfFile (lpBaseAddress);
307+ return MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginUnmapViewOfFile (lpBaseAddress);
328308}
329309
330310BOOL WINAPI HookCloseHandle (_In_ _Post_ptr_invalid_ HANDLE hObject) {
331311 auto iter = MmpFindHandleEntry (hObject);
332312 if (iter)MmpFreeHandleEntry (iter);
333313
334- return OriginCloseHandle (hObject);
314+ return MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginCloseHandle (hObject);
335315}
336316
337317HRESULT WINAPI HookGetFileVersion (
@@ -374,7 +354,7 @@ HRESULT WINAPI HookGetFileVersion(
374354
375355 }
376356
377- return OriginGetFileVersion1 (
357+ return MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginGetFileVersion1 (
378358 szFilename,
379359 szBuffer,
380360 cchBuffer,
@@ -389,28 +369,39 @@ BOOL WINAPI MmpPreInitializeHooksForDotNet() {
389369 if (!MmpGlobalDataPtr->MmpDotNet .PreHooked ) {
390370 HMODULE hModule = LoadLibraryW (L" mscoree.dll" );
391371 if (hModule) {
392- OriginGetFileVersion2 = (GetFileVersion_T)GetProcAddress (hModule, " GetFileVersion" );
393- if (OriginGetFileVersion2) {
372+ MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginGetFileVersion2 = (GetFileVersion_T)GetProcAddress (hModule, " GetFileVersion" );
373+ if (MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginGetFileVersion2 ) {
394374
395375 GetSystemTimeAsFileTime (&MmpGlobalDataPtr->MmpDotNet .AssemblyTimes );
396376
397377 InitializeCriticalSection (&MmpGlobalDataPtr->MmpDotNet .MmpFakeHandleListLock );
398378 InitializeListHead (&MmpGlobalDataPtr->MmpDotNet .MmpFakeHandleListHead );
399379
380+ MmpGlobalDataPtr->MmpDotNet .Hooks .OriginCreateFileW = CreateFileW;
381+ MmpGlobalDataPtr->MmpDotNet .Hooks .OriginGetFileInformationByHandle = GetFileInformationByHandle;
382+ MmpGlobalDataPtr->MmpDotNet .Hooks .OriginGetFileAttributesExW = GetFileAttributesExW;
383+ MmpGlobalDataPtr->MmpDotNet .Hooks .OriginGetFileSize = GetFileSize;
384+ MmpGlobalDataPtr->MmpDotNet .Hooks .OriginGetFileSizeEx = GetFileSizeEx;
385+ MmpGlobalDataPtr->MmpDotNet .Hooks .OriginCreateFileMappingW = CreateFileMappingW;
386+ MmpGlobalDataPtr->MmpDotNet .Hooks .OriginMapViewOfFileEx = MapViewOfFileEx;
387+ MmpGlobalDataPtr->MmpDotNet .Hooks .OriginMapViewOfFile = MapViewOfFile;
388+ MmpGlobalDataPtr->MmpDotNet .Hooks .OriginUnmapViewOfFile = UnmapViewOfFile;
389+ MmpGlobalDataPtr->MmpDotNet .Hooks .OriginCloseHandle = CloseHandle;
390+
400391 DetourTransactionBegin ();
401392 DetourUpdateThread (NtCurrentThread ());
402393
403- DetourAttach ((PVOID*)&OriginCreateFileW, HookCreateFileW);
404- DetourAttach ((PVOID*)&OriginGetFileInformationByHandle, HookGetFileInformationByHandle);
405- DetourAttach ((PVOID*)&OriginGetFileAttributesExW, HookGetFileAttributesExW);
406- DetourAttach ((PVOID*)&OriginGetFileSize, HookGetFileSize);
407- DetourAttach ((PVOID*)&OriginGetFileSizeEx, HookGetFileSizeEx);
408- DetourAttach ((PVOID*)&OriginCreateFileMappingW, HookCreateFileMappingW);
409- DetourAttach ((PVOID*)&OriginMapViewOfFileEx, HookMapViewOfFileEx);
410- DetourAttach ((PVOID*)&OriginMapViewOfFile, HookMapViewOfFile);
411- DetourAttach ((PVOID*)&OriginUnmapViewOfFile, HookUnmapViewOfFile);
412- DetourAttach ((PVOID*)&OriginCloseHandle, HookCloseHandle);
413- DetourAttach ((PVOID*)&OriginGetFileVersion2, HookGetFileVersion);
394+ DetourAttach ((PVOID*)&MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginCreateFileW , HookCreateFileW);
395+ DetourAttach ((PVOID*)&MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginGetFileInformationByHandle , HookGetFileInformationByHandle);
396+ DetourAttach ((PVOID*)&MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginGetFileAttributesExW , HookGetFileAttributesExW);
397+ DetourAttach ((PVOID*)&MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginGetFileSize , HookGetFileSize);
398+ DetourAttach ((PVOID*)&MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginGetFileSizeEx , HookGetFileSizeEx);
399+ DetourAttach ((PVOID*)&MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginCreateFileMappingW , HookCreateFileMappingW);
400+ DetourAttach ((PVOID*)&MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginMapViewOfFileEx , HookMapViewOfFileEx);
401+ DetourAttach ((PVOID*)&MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginMapViewOfFile , HookMapViewOfFile);
402+ DetourAttach ((PVOID*)&MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginUnmapViewOfFile , HookUnmapViewOfFile);
403+ DetourAttach ((PVOID*)&MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginCloseHandle , HookCloseHandle);
404+ DetourAttach ((PVOID*)&MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginGetFileVersion2 , HookGetFileVersion);
414405
415406 DetourTransactionCommit ();
416407
@@ -427,8 +418,8 @@ BOOL WINAPI MmpPreInitializeHooksForDotNet() {
427418BOOL WINAPI MmpInitializeHooksForDotNet () {
428419 HMODULE hModule = GetModuleHandleW (L" mscoreei.dll" );
429420 if (hModule) {
430- OriginGetFileVersion1 = (GetFileVersion_T)GetProcAddress (hModule, " GetFileVersion" );
431- if (OriginGetFileVersion1) {
421+ MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginGetFileVersion1 = (GetFileVersion_T)GetProcAddress (hModule, " GetFileVersion" );
422+ if (MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginGetFileVersion1 ) {
432423
433424 EnterCriticalSection (NtCurrentPeb ()->FastPebLock );
434425
@@ -440,7 +431,7 @@ BOOL WINAPI MmpInitializeHooksForDotNet() {
440431 if (!MmpGlobalDataPtr->MmpDotNet .Initialized ) {
441432 DetourTransactionBegin ();
442433 DetourUpdateThread (NtCurrentThread ());
443- DetourAttach ((PVOID*)&OriginGetFileVersion1, HookGetFileVersion);
434+ DetourAttach ((PVOID*)&MmpGlobalDataPtr-> MmpDotNet . Hooks . OriginGetFileVersion1 , HookGetFileVersion);
444435 DetourTransactionCommit ();
445436 MmpGlobalDataPtr->MmpDotNet .Initialized = TRUE ;
446437 }
0 commit comments