[
{
"path": ".gitignore",
"content": "## Ignore Visual Studio temporary files, build results, and\n## files generated by popular Visual Studio add-ons.\n##\n## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore\n\n# User-specific files\n*.rsuser\n*.suo\n*.user\n*.userosscache\n*.sln.docstates\n\n# User-specific files (MonoDevelop/Xamarin Studio)\n*.userprefs\n\n# Mono auto generated files\nmono_crash.*\n\n# Build results\n[Dd]ebug/\n[Dd]ebugPublic/\n[Rr]elease/\n[Rr]eleases/\nx64/\nx86/\n[Aa][Rr][Mm]/\n[Aa][Rr][Mm]64/\nbld/\n[Bb]in/\n[Oo]bj/\n[Ll]og/\n[Ll]ogs/\n\n# Visual Studio 2015/2017 cache/options directory\n.vs/\n.xmake/\nvsxmake*/\nvs20*/\n# Uncomment if you have tasks that create the project's static files in wwwroot\n#wwwroot/\n\n# Visual Studio 2017 auto generated files\nGenerated\\ Files/\n\n# MSTest test Results\n[Tt]est[Rr]esult*/\n[Bb]uild[Ll]og.*\n\n# NUnit\n*.VisualState.xml\nTestResult.xml\nnunit-*.xml\n\n# Build Results of an ATL Project\n[Dd]ebugPS/\n[Rr]eleasePS/\ndlldata.c\n\n# Benchmark Results\nBenchmarkDotNet.Artifacts/\n\n# .NET Core\nproject.lock.json\nproject.fragment.lock.json\nartifacts/\n\n# StyleCop\nStyleCopReport.xml\n\n# Files built by Visual Studio\n*_i.c\n*_p.c\n*_h.h\n*.ilk\n*.meta\n*.obj\n*.iobj\n*.pch\n*.pdb\n*.ipdb\n*.pgc\n*.pgd\n*.rsp\n*.sbr\n*.tlb\n*.tli\n*.tlh\n*.tmp\n*.tmp_proj\n*_wpftmp.csproj\n*.log\n*.vspscc\n*.vssscc\n.builds\n*.pidb\n*.svclog\n*.scc\n\n# Chutzpah Test files\n_Chutzpah*\n\n# Visual C++ cache files\nipch/\n*.aps\n*.ncb\n*.opendb\n*.opensdf\n*.sdf\n*.cachefile\n*.VC.db\n*.VC.VC.opendb\n\n# Visual Studio profiler\n*.psess\n*.vsp\n*.vspx\n*.sap\n\n# Visual Studio Trace Files\n*.e2e\n\n# TFS 2012 Local Workspace\n$tf/\n\n# Guidance Automation Toolkit\n*.gpState\n\n# ReSharper is a .NET coding add-in\n_ReSharper*/\n*.[Rr]e[Ss]harper\n*.DotSettings.user\n\n# TeamCity is a build add-in\n_TeamCity*\n\n# DotCover is a Code Coverage Tool\n*.dotCover\n\n# AxoCover is a Code Coverage Tool\n.axoCover/*\n!.axoCover/settings.json\n\n# Visual Studio code coverage results\n*.coverage\n*.coveragexml\n\n# NCrunch\n_NCrunch_*\n.*crunch*.local.xml\nnCrunchTemp_*\n\n# MightyMoose\n*.mm.*\nAutoTest.Net/\n\n# Web workbench (sass)\n.sass-cache/\n\n# Installshield output folder\n[Ee]xpress/\n\n# DocProject is a documentation generator add-in\nDocProject/buildhelp/\nDocProject/Help/*.HxT\nDocProject/Help/*.HxC\nDocProject/Help/*.hhc\nDocProject/Help/*.hhk\nDocProject/Help/*.hhp\nDocProject/Help/Html2\nDocProject/Help/html\n\n# Click-Once directory\npublish/\n\n# Publish Web Output\n*.[Pp]ublish.xml\n*.azurePubxml\n# Note: Comment the next line if you want to checkin your web deploy settings,\n# but database connection strings (with potential passwords) will be unencrypted\n*.pubxml\n*.publishproj\n\n# Microsoft Azure Web App publish settings. Comment the next line if you want to\n# checkin your Azure Web App publish settings, but sensitive information contained\n# in these scripts will be unencrypted\nPublishScripts/\n\n# NuGet Packages\n*.nupkg\n# NuGet Symbol Packages\n*.snupkg\n# The packages folder can be ignored because of Package Restore\n**/[Pp]ackages/*\n# except build/, which is used as an MSBuild target.\n!**/[Pp]ackages/build/\n# Uncomment if necessary however generally it will be regenerated when needed\n#!**/[Pp]ackages/repositories.config\n# NuGet v3's project.json files produces more ignorable files\n*.nuget.props\n*.nuget.targets\n\n# Microsoft Azure Build Output\ncsx/\n*.build.csdef\n\n# Microsoft Azure Emulator\necf/\nrcf/\n\n# Windows Store app package directories and files\nAppPackages/\nBundleArtifacts/\nPackage.StoreAssociation.xml\n_pkginfo.txt\n*.appx\n*.appxbundle\n*.appxupload\n\n# Visual Studio cache files\n# files ending in .cache can be ignored\n*.[Cc]ache\n# but keep track of directories ending in .cache\n!?*.[Cc]ache/\n\n# Others\nClientBin/\n~$*\n*~\n*.dbmdl\n*.dbproj.schemaview\n*.jfm\n*.pfx\n*.publishsettings\norleans.codegen.cs\n\n# Including strong name files can present a security risk\n# (https://github.com/github/gitignore/pull/2483#issue-259490424)\n#*.snk\n\n# Since there are multiple workflows, uncomment next line to ignore bower_components\n# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)\n#bower_components/\n\n# RIA/Silverlight projects\nGenerated_Code/\n\n# Backup & report files from converting an old project file\n# to a newer Visual Studio version. Backup files are not needed,\n# because we have git ;-)\n_UpgradeReport_Files/\nBackup*/\nUpgradeLog*.XML\nUpgradeLog*.htm\nServiceFabricBackup/\n*.rptproj.bak\n\n# SQL Server files\n*.mdf\n*.ldf\n*.ndf\n\n# Business Intelligence projects\n*.rdl.data\n*.bim.layout\n*.bim_*.settings\n*.rptproj.rsuser\n*- [Bb]ackup.rdl\n*- [Bb]ackup ([0-9]).rdl\n*- [Bb]ackup ([0-9][0-9]).rdl\n\n# Microsoft Fakes\nFakesAssemblies/\n\n# GhostDoc plugin setting file\n*.GhostDoc.xml\n\n# Node.js Tools for Visual Studio\n.ntvs_analysis.dat\nnode_modules/\n\n# Visual Studio 6 build log\n*.plg\n\n# Visual Studio 6 workspace options file\n*.opt\n\n# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)\n*.vbw\n\n# Visual Studio LightSwitch build output\n**/*.HTMLClient/GeneratedArtifacts\n**/*.DesktopClient/GeneratedArtifacts\n**/*.DesktopClient/ModelManifest.xml\n**/*.Server/GeneratedArtifacts\n**/*.Server/ModelManifest.xml\n_Pvt_Extensions\n\n# Paket dependency manager\n.paket/paket.exe\npaket-files/\n\n# FAKE - F# Make\n.fake/\n\n# CodeRush personal settings\n.cr/personal\n\n# Python Tools for Visual Studio (PTVS)\n__pycache__/\n*.pyc\n\n# Cake - Uncomment if you are using it\n# tools/**\n# !tools/packages.config\n\n# Tabs Studio\n*.tss\n\n# Telerik's JustMock configuration file\n*.jmconfig\n\n# BizTalk build output\n*.btp.cs\n*.btm.cs\n*.odx.cs\n*.xsd.cs\n\n# OpenCover UI analysis results\nOpenCover/\n\n# Azure Stream Analytics local run output\nASALocalRun/\n\n# MSBuild Binary and Structured Log\n*.binlog\n\n# NVidia Nsight GPU debugger configuration file\n*.nvuser\n\n# MFractors (Xamarin productivity tool) working folder\n.mfractor/\n\n# Local History for Visual Studio\n.localhistory/\n\n# BeatPulse healthcheck temp database\nhealthchecksdb\n\n# Backup folder for Package Reference Convert tool in Visual Studio 2017\nMigrationBackup/\n\n# Ionide (cross platform F# VS Code tools) working folder\n.ionide/\n"
},
{
"path": "BuildAllTargets.cmd",
"content": "@setlocal\n@echo off\n\nrem Change to the current folder.\ncd \"%~dp0\"\n\nrem Remove the output folder for a fresh compile.\nrd /s /q Output\n\nrem Initialize Visual Studio environment\ncall \"%~dp0InitializeVisualStudioEnvironment.cmd\"\n\nrem Build all targets\nMSBuild -binaryLogger:Output\\BuildAllTargets.binlog -m BuildAllTargets.proj\n\n@endlocal"
},
{
"path": "BuildAllTargets.proj",
"content": "\n\n \n $(MSBuildThisFileDirectory)*.slnx\n \n \n \n \n Configuration=Debug;Platform=x64 \n \n \n Configuration=Release;Platform=x64 \n \n \n Configuration=Debug;Platform=ARM64 \n \n \n Configuration=Release;Platform=ARM64 \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n"
},
{
"path": "Detours/api_thunks.cpp",
"content": "//////////////////////////////////////////////////////////////////////////////\n//\n// Detours Disassembler (disasm.cpp of detours.lib)\n//\n// Microsoft Research Detours Package, Version 4.0.1\n//\n// Copyright (c) Microsoft Corporation. All rights reserved.\n//\n\n//////////////////////////////////////////////////////////////////////////////\n//\n\n#if _MSC_VER >= 1900\n#pragma warning(push)\n#pragma warning(disable:4091) // empty typedef\n#endif\n\n#if defined(_KERNEL_MODE)\n#define DETOURS_KERNEL\n#endif\n\n#include \n\n#ifdef DETOURS_KERNEL\n\nnamespace Detours::Thunks\n{\n\n//////////////////////////////////////////////////////////////////////////////\n//\n\n// Zw\n\nNTSTATUS NTAPI ZwReadVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _In_opt_ PVOID BaseAddress,\n _Out_writes_bytes_(BufferSize) PVOID Buffer,\n _In_ SIZE_T BufferSize,\n _Out_opt_ PSIZE_T NumberOfBytesRead\n)\n{\n SIZE_T BytesCopied = 0u;\n KPROCESSOR_MODE PreviousMode = KernelMode;\n PEPROCESS Process = NULL;\n NTSTATUS Status = STATUS_UNSUCCESSFUL;\n PETHREAD CurrentThread = NULL;\n\n PAGED_CODE();\n\n CurrentThread = PsGetCurrentThread();\n\n //\n // If the buffer size is not zero, then attempt to read data from the\n // specified process address space into the current process address\n // space.\n //\n\n BytesCopied = 0;\n Status = STATUS_SUCCESS;\n if (BufferSize != 0) {\n\n //\n // Reference the target process.\n //\n\n Status = ObReferenceObjectByHandle(\n ProcessHandle,\n PROCESS_VM_READ,\n *PsProcessType,\n PreviousMode,\n (PVOID*)&Process,\n NULL);\n\n //\n // If the process was successfully referenced, then attempt to\n // read the specified memory either by direct mapping or copying\n // through nonpaged pool.\n //\n\n if (Status == STATUS_SUCCESS) {\n\n Status = MmCopyVirtualMemory(\n Process,\n BaseAddress,\n PsGetThreadProcess(CurrentThread),\n Buffer,\n BufferSize,\n PreviousMode,\n &BytesCopied);\n\n //\n // Dereference the target process.\n //\n\n ObDereferenceObject(Process);\n }\n }\n\n //\n // If requested, return the number of bytes read.\n //\n\n if (ARGUMENT_PRESENT(NumberOfBytesRead)) {\n __try {\n *NumberOfBytesRead = BytesCopied;\n\n } __except(EXCEPTION_EXECUTE_HANDLER) {\n NOTHING;\n }\n }\n\n return Status;\n}\n\nNTSTATUS NTAPI ZwWriteVirtualMemory(\n _In_ HANDLE ProcessHandle,\n _In_opt_ PVOID BaseAddress,\n _In_reads_bytes_(BufferSize) PVOID Buffer,\n _In_ SIZE_T BufferSize,\n _Out_opt_ PSIZE_T NumberOfBytesWritten\n)\n{\n SIZE_T BytesCopied = 0u;\n KPROCESSOR_MODE PreviousMode = KernelMode;\n PEPROCESS Process = NULL;\n NTSTATUS Status = STATUS_UNSUCCESSFUL;\n PETHREAD CurrentThread = NULL;\n\n PAGED_CODE();\n\n CurrentThread = PsGetCurrentThread();\n\n //\n // If the buffer size is not zero, then attempt to write data from the\n // current process address space into the target process address space.\n //\n\n BytesCopied = 0;\n Status = STATUS_SUCCESS;\n if (BufferSize != 0) {\n\n //\n // Reference the target process.\n //\n\n Status = ObReferenceObjectByHandle(\n ProcessHandle,\n PROCESS_VM_WRITE,\n *PsProcessType,\n PreviousMode,\n (PVOID*)&Process,\n NULL);\n\n //\n // If the process was successfully referenced, then attempt to\n // write the specified memory either by direct mapping or copying\n // through nonpaged pool.\n //\n\n if (Status == STATUS_SUCCESS) {\n\n Status = MmCopyVirtualMemory(\n PsGetThreadProcess(CurrentThread),\n Buffer,\n Process,\n BaseAddress,\n BufferSize,\n PreviousMode,\n &BytesCopied);\n\n //\n // Dereference the target process.\n //\n\n ObDereferenceObject(Process);\n }\n }\n\n //\n // If requested, return the number of bytes read.\n //\n\n if (ARGUMENT_PRESENT(NumberOfBytesWritten)) {\n __try {\n *NumberOfBytesWritten = BytesCopied;\n\n } __except(EXCEPTION_EXECUTE_HANDLER) {\n NOTHING;\n }\n }\n\n return Status;\n}\n\n//////////////////////////////////////////////////////////////////////////////\n//\n\n// Set/Get Last Error\n\nstatic DWORD __Win32Error = NO_ERROR;\n\nVOID WINAPI SetLastError(_In_ DWORD Win32Error)\n{\n __Win32Error = Win32Error;\n}\n\nDWORD WINAPI GetLastError(VOID)\n{\n return __Win32Error;\n}\n\n\n//////////////////////////////////////////////////////////////////////////////\n//\n\n// Process & Thread\n\nHANDLE WINAPI GetCurrentProcess(VOID)\n{\n return ZwCurrentProcess();\n}\n\nHANDLE WINAPI GetCurrentThread(VOID)\n{\n return ZwCurrentThread();\n}\n\nDWORD WINAPI GetCurrentProcessId(VOID)\n{\n return (DWORD)(ULONG_PTR)PsGetCurrentProcessId();\n}\n\nDWORD WINAPI GetCurrentThreadId(VOID)\n{\n return (DWORD)(ULONG_PTR)PsGetCurrentThreadId();\n}\n\nBOOL WINAPI IsWow64Process(\n _In_ HANDLE hProcess,\n _Out_ PBOOL Wow64Process\n)\n{\n NTSTATUS NtStatus = STATUS_UNSUCCESSFUL;\n ULONG_PTR Peb32 = 0u;\n\n NtStatus = ZwQueryInformationProcess(\n hProcess,\n ProcessWow64Information,\n &Peb32,\n sizeof(Peb32),\n NULL\n );\n\n *Wow64Process = FALSE;\n\n if (!NT_SUCCESS(NtStatus)) {\n\n SetLastError(NtStatus);\n }\n else {\n\n if (Peb32 == 0) {\n *Wow64Process = FALSE;\n }\n else {\n *Wow64Process = TRUE;\n }\n }\n\n return (NT_SUCCESS(NtStatus));\n}\n\n_Success_(return != FALSE)\nBOOL WINAPI ReadProcessMemory(\n _In_ HANDLE hProcess,\n _In_ LPCVOID lpBaseAddress,\n _Out_writes_bytes_to_(nSize, *lpNumberOfBytesRead) LPVOID lpBuffer,\n _In_ SIZE_T nSize,\n _Out_opt_ SIZE_T * lpNumberOfBytesRead\n)\n{\n NTSTATUS Status = STATUS_UNSUCCESSFUL;\n SIZE_T NtNumberOfBytesRead = 0u;\n\n Status = ZwReadVirtualMemory(\n hProcess,\n (PVOID)lpBaseAddress,\n lpBuffer,\n nSize,\n &NtNumberOfBytesRead\n );\n\n if (lpNumberOfBytesRead != NULL) {\n *lpNumberOfBytesRead = NtNumberOfBytesRead;\n }\n\n if (!NT_SUCCESS(Status)) {\n SetLastError(Status);\n return FALSE;\n }\n else {\n return TRUE;\n }\n}\n\n_Success_(return != FALSE)\nBOOL WINAPI WriteProcessMemory(\n _In_ HANDLE hProcess,\n _In_ LPVOID lpBaseAddress,\n _In_reads_bytes_(nSize) LPCVOID lpBuffer,\n _In_ SIZE_T nSize,\n _Out_opt_ SIZE_T * lpNumberOfBytesWritten\n)\n{\n NTSTATUS Status;\n ULONG OldProtect = PAGE_READWRITE;\n SIZE_T RegionSize;\n PVOID Base;\n SIZE_T NtNumberOfBytesWritten = 0u;\n\n //\n // Set the protection to allow writes\n //\n\n RegionSize = nSize;\n Base = lpBaseAddress;\n Status = ZwProtectVirtualMemory(\n hProcess,\n &Base,\n &RegionSize,\n PAGE_READWRITE,\n &OldProtect\n );\n if (NT_SUCCESS(Status)) {\n\n //\n // See if previous protection was writable. If so,\n // then reset protection and do the write.\n // Otherwise, see if previous protection was read-only or\n // no access. In this case, don't do the write, just fail\n //\n\n if ((OldProtect & PAGE_READWRITE) == PAGE_READWRITE ||\n (OldProtect & PAGE_WRITECOPY) == PAGE_WRITECOPY ||\n (OldProtect & PAGE_EXECUTE_READWRITE) == PAGE_EXECUTE_READWRITE ||\n (OldProtect & PAGE_EXECUTE_WRITECOPY) == PAGE_EXECUTE_WRITECOPY) {\n\n (void)ZwProtectVirtualMemory(\n hProcess,\n &Base,\n &RegionSize,\n OldProtect,\n &OldProtect\n );\n Status = ZwWriteVirtualMemory(\n hProcess,\n lpBaseAddress,\n (PVOID)lpBuffer,\n nSize,\n &NtNumberOfBytesWritten\n );\n\n if (lpNumberOfBytesWritten != NULL) {\n *lpNumberOfBytesWritten = NtNumberOfBytesWritten;\n }\n\n if (!NT_SUCCESS(Status)) {\n SetLastError(Status);\n return FALSE;\n }\n ZwFlushInstructionCache(hProcess, lpBaseAddress, nSize);\n return TRUE;\n }\n else {\n\n //\n // See if the previous protection was read only or no access. If\n // this is the case, restore the previous protection and return\n // an access violation error.\n //\n if ((OldProtect & PAGE_NOACCESS) == PAGE_NOACCESS ||\n (OldProtect & PAGE_READONLY) == PAGE_READONLY) {\n\n (void)ZwProtectVirtualMemory(\n hProcess,\n &Base,\n &RegionSize,\n OldProtect,\n &OldProtect\n );\n SetLastError((DWORD)STATUS_ACCESS_VIOLATION);\n return FALSE;\n }\n else {\n\n //\n // The previous protection must have been code and the caller\n // is trying to set a breakpoint or edit the code. Do the write\n // and then restore the previous protection.\n //\n\n Status = ZwWriteVirtualMemory(\n hProcess,\n lpBaseAddress,\n (PVOID)lpBuffer,\n nSize,\n &NtNumberOfBytesWritten\n );\n\n if (lpNumberOfBytesWritten != NULL) {\n *lpNumberOfBytesWritten = NtNumberOfBytesWritten;\n }\n\n (void)ZwProtectVirtualMemory(\n hProcess,\n &Base,\n &RegionSize,\n OldProtect,\n &OldProtect\n );\n if (!NT_SUCCESS(Status)) {\n SetLastError((DWORD)STATUS_ACCESS_VIOLATION);\n return FALSE;\n }\n (void)ZwFlushInstructionCache(hProcess, lpBaseAddress, nSize);\n return TRUE;\n }\n }\n }\n else {\n SetLastError(Status);\n return FALSE;\n }\n}\n\n_Ret_maybenull_\n_Post_writable_byte_size_(dwSize)\nLPVOID WINAPI VirtualAllocEx(\n _In_ HANDLE hProcess,\n _In_opt_ LPVOID lpAddress,\n _In_ SIZE_T dwSize,\n _In_ DWORD flAllocationType,\n _In_ DWORD flProtect\n)\n{\n NTSTATUS Status;\n\n __try {\n Status = NtAllocateVirtualMemory(hProcess,\n &lpAddress,\n 0,\n &dwSize,\n flAllocationType,\n flProtect\n );\n }\n __except (EXCEPTION_EXECUTE_HANDLER) {\n Status = GetExceptionCode();\n }\n\n if (NT_SUCCESS(Status)) {\n return(lpAddress);\n }\n\n SetLastError(Status);\n return NULL;\n}\n\nBOOL WINAPI VirtualFreeEx(\n _In_ HANDLE hProcess,\n _Pre_notnull_ _When_(dwFreeType == MEM_DECOMMIT, _Post_invalid_) _When_(dwFreeType == MEM_RELEASE, _Post_ptr_invalid_) LPVOID lpAddress,\n _In_ SIZE_T dwSize,\n _In_ DWORD dwFreeType\n)\n{\n NTSTATUS Status;\n\n if ((dwFreeType & MEM_RELEASE) && dwSize != 0) {\n SetLastError((DWORD)STATUS_INVALID_PARAMETER);\n return FALSE;\n }\n\n Status = NtFreeVirtualMemory(\n hProcess,\n &lpAddress,\n &dwSize,\n dwFreeType\n );\n\n if (NT_SUCCESS(Status)) {\n return(TRUE);\n }\n\n SetLastError(Status);\n return FALSE;\n}\n\n_Success_(return != FALSE)\nBOOL WINAPI VirtualProtectEx(\n _In_ HANDLE hProcess,\n _In_ LPVOID lpAddress,\n _In_ SIZE_T dwSize,\n _In_ DWORD flNewProtect,\n _Out_ PDWORD lpflOldProtect)\n{\n NTSTATUS Status;\n\n Status = ZwProtectVirtualMemory(\n hProcess,\n &lpAddress,\n &dwSize,\n flNewProtect,\n lpflOldProtect);\n\n if (NT_SUCCESS(Status)) {\n return(TRUE);\n }\n\n SetLastError(Status);\n return FALSE;\n}\n\nSIZE_T WINAPI VirtualQueryEx(\n _In_ HANDLE hProcess,\n _In_opt_ LPCVOID lpAddress,\n _Out_writes_bytes_to_(dwLength, return) PMEMORY_BASIC_INFORMATION lpBuffer,\n _In_ SIZE_T dwLength)\n{\n NTSTATUS Status;\n SIZE_T ReturnLength = 0u;\n\n Status = ZwQueryVirtualMemory(\n hProcess,\n (LPVOID)lpAddress,\n MemoryBasicInformation,\n (PMEMORY_BASIC_INFORMATION)lpBuffer,\n dwLength,\n &ReturnLength);\n if (NT_SUCCESS(Status))\n {\n return(ReturnLength);\n }\n\n SetLastError(Status);\n return 0;\n}\n\n}\n\n#endif // DETOURS_KERNEL\n"
},
{
"path": "Detours/api_thunks.h",
"content": "#pragma once\n\nnamespace Detours::Thunks\n{\n VOID WINAPI SetLastError(_In_ DWORD Win32Error);\n DWORD WINAPI GetLastError(VOID);\n\n HANDLE WINAPI GetCurrentProcess(VOID);\n HANDLE WINAPI GetCurrentThread(VOID);\n DWORD WINAPI GetCurrentProcessId(VOID);\n DWORD WINAPI GetCurrentThreadId(VOID);\n\n BOOL WINAPI IsWow64Process(\n _In_ HANDLE hProcess,\n _Out_ PBOOL Wow64Process\n );\n\n BOOL WINAPI ReadProcessMemory(\n _In_ HANDLE hProcess,\n _In_ LPCVOID lpBaseAddress,\n _Out_writes_bytes_to_(nSize, *lpNumberOfBytesRead) LPVOID lpBuffer,\n _In_ SIZE_T nSize,\n _Out_opt_ SIZE_T * lpNumberOfBytesRead\n );\n\n BOOL WINAPI WriteProcessMemory(\n _In_ HANDLE hProcess,\n _In_ LPVOID lpBaseAddress,\n _In_reads_bytes_(nSize) LPCVOID lpBuffer,\n _In_ SIZE_T nSize,\n _Out_opt_ SIZE_T* lpNumberOfBytesWritten\n );\n\n LPVOID WINAPI VirtualAllocEx(\n _In_ HANDLE hProcess,\n _In_opt_ LPVOID lpAddress,\n _In_ SIZE_T dwSize,\n _In_ DWORD flAllocationType,\n _In_ DWORD flProtect\n );\n\n BOOL WINAPI VirtualFreeEx(\n _In_ HANDLE hProcess,\n _Pre_notnull_ _When_(dwFreeType == MEM_DECOMMIT, _Post_invalid_) _When_(dwFreeType == MEM_RELEASE, _Post_ptr_invalid_) LPVOID lpAddress,\n _In_ SIZE_T dwSize,\n _In_ DWORD dwFreeType\n );\n\n BOOL WINAPI VirtualProtectEx(\n _In_ HANDLE hProcess,\n _In_ LPVOID lpAddress,\n _In_ SIZE_T dwSize,\n _In_ DWORD flNewProtect,\n _Out_ PDWORD lpflOldProtect\n );\n\n SIZE_T WINAPI VirtualQueryEx(\n _In_ HANDLE hProcess,\n _In_opt_ LPCVOID lpAddress,\n _Out_writes_bytes_to_(dwLength, return) PMEMORY_BASIC_INFORMATION lpBuffer,\n _In_ SIZE_T dwLength\n );\n\n}\n\n#define SetLastError ::Detours::Thunks::SetLastError\n#define GetLastError ::Detours::Thunks::GetLastError\n\n#define GetCurrentProcess ::Detours::Thunks::GetCurrentProcess\n#define GetCurrentThread ::Detours::Thunks::GetCurrentThread\n#define GetCurrentProcessId ::Detours::Thunks::GetCurrentProcessId\n#define GetCurrentThreadId ::Detours::Thunks::GetCurrentThreadId\n\n#define IsWow64Process ::Detours::Thunks::IsWow64Process\n\n#define ReadProcessMemory ::Detours::Thunks::ReadProcessMemory\n#define WriteProcessMemory ::Detours::Thunks::WriteProcessMemory\n\n#define VirtualAllocEx ::Detours::Thunks::VirtualAllocEx\n#define VirtualFreeEx ::Detours::Thunks::VirtualFreeEx\n#define VirtualProtectEx ::Detours::Thunks::VirtualProtectEx\n#define VirtualQueryEx ::Detours::Thunks::VirtualQueryEx\n"
},
{
"path": "Detours/creatwth.cpp",
"content": "//////////////////////////////////////////////////////////////////////////////\n//\n// Create a process with a DLL (creatwth.cpp of detours.lib)\n//\n// Microsoft Research Detours Package, Version 4.0.1\n//\n// Copyright (c) Microsoft Corporation. All rights reserved.\n//\n\n#if _MSC_VER >= 1900\n#pragma warning(push)\n#pragma warning(disable:4091) // empty typedef\n#endif\n\n#if defined(_KERNEL_MODE)\n#define DETOURS_KERNEL\n#endif\n\n#define _CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS 1\n#define _ARM_WINAPI_PARTITION_DESKTOP_SDK_AVAILABLE 1\n\n#include \n\n#ifdef DETOURS_KERNEL\n#include \"api_thunks.h\"\n#endif\n\n#include \n#pragma warning(push)\n#if _MSC_VER > 1400\n#pragma warning(disable:6102 6103) // /analyze warnings\n#endif\n#include \n#pragma warning(pop)\n\n// #define DETOUR_DEBUG 1\n#define DETOURS_INTERNAL\n\n#include \"detours.h\"\n\n#if DETOURS_VERSION != 0x4c0c1 // 0xMAJORcMINORcPATCH\n#error detours.h version mismatch\n#endif\n\n#if _MSC_VER >= 1900\n#pragma warning(pop)\n#endif\n\n#define IMPORT_DIRECTORY OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]\n#define BOUND_DIRECTORY OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT]\n#define CLR_DIRECTORY OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR]\n#define IAT_DIRECTORY OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT]\n\n//////////////////////////////////////////////////////////////////////////////\n//\nconst GUID DETOUR_EXE_RESTORE_GUID = {\n 0x2ed7a3ff, 0x3339, 0x4a8d,\n { 0x80, 0x5c, 0xd4, 0x98, 0x15, 0x3f, 0xc2, 0x8f } };\n\nconst GUID DETOUR_EXE_HELPER_GUID = { /* ea0251b9-5cde-41b5-98d0-2af4a26b0fee */\n 0xea0251b9, 0x5cde, 0x41b5,\n { 0x98, 0xd0, 0x2a, 0xf4, 0xa2, 0x6b, 0x0f, 0xee }};\n\n//////////////////////////////////////////////////////////////////////////////\n//\n// Enumate through modules in the target process.\n//\nstatic BOOL WINAPI LoadNtHeaderFromProcess(HANDLE hProcess,\n HMODULE hModule,\n PIMAGE_NT_HEADERS32 pNtHeader)\n{\n PBYTE pbModule = (PBYTE)hModule;\n\n if (pbModule == NULL) {\n SetLastError(ERROR_INVALID_PARAMETER);\n return FALSE;\n }\n\n MEMORY_BASIC_INFORMATION mbi;\n ZeroMemory(&mbi, sizeof(mbi));\n\n if (VirtualQueryEx(hProcess, hModule, &mbi, sizeof(mbi)) == 0) {\n return FALSE;\n }\n\n IMAGE_DOS_HEADER idh;\n\n if (!ReadProcessMemory(hProcess, pbModule, &idh, sizeof(idh), NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(idh@%p..%p) failed: %lu\\n\",\n pbModule, pbModule + sizeof(idh), GetLastError()));\n return FALSE;\n }\n\n if (idh.e_magic != IMAGE_DOS_SIGNATURE ||\n (DWORD)idh.e_lfanew > mbi.RegionSize ||\n (DWORD)idh.e_lfanew < sizeof(idh)) {\n\n SetLastError(ERROR_BAD_EXE_FORMAT);\n return FALSE;\n }\n\n if (!ReadProcessMemory(hProcess, pbModule + idh.e_lfanew,\n pNtHeader, sizeof(*pNtHeader), NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(inh@%p..%p:%p) failed: %lu\\n\",\n pbModule + idh.e_lfanew,\n pbModule + idh.e_lfanew + sizeof(*pNtHeader),\n pbModule,\n GetLastError()));\n return FALSE;\n }\n\n if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) {\n SetLastError(ERROR_BAD_EXE_FORMAT);\n return FALSE;\n }\n\n return TRUE;\n}\n\nstatic HMODULE WINAPI EnumerateModulesInProcess(HANDLE hProcess,\n HMODULE hModuleLast,\n PIMAGE_NT_HEADERS32 pNtHeader)\n{\n PBYTE pbLast = (PBYTE)hModuleLast + MM_ALLOCATION_GRANULARITY;\n\n MEMORY_BASIC_INFORMATION mbi;\n ZeroMemory(&mbi, sizeof(mbi));\n\n // Find the next memory region that contains a mapped PE image.\n //\n\n for (;; pbLast = (PBYTE)mbi.BaseAddress + mbi.RegionSize) {\n if (VirtualQueryEx(hProcess, (PVOID)pbLast, &mbi, sizeof(mbi)) == 0) {\n break;\n }\n\n // Usermode address space has such an unaligned region size always at the\n // end and only at the end.\n //\n if ((mbi.RegionSize & 0xfff) == 0xfff) {\n break;\n }\n if (((PBYTE)mbi.BaseAddress + mbi.RegionSize) < pbLast) {\n break;\n }\n\n // Skip uncommitted regions and guard pages.\n //\n if ((mbi.State != MEM_COMMIT) ||\n ((mbi.Protect & 0xff) == PAGE_NOACCESS) ||\n (mbi.Protect & PAGE_GUARD)) {\n continue;\n }\n\n if (LoadNtHeaderFromProcess(hProcess, (HMODULE)pbLast, pNtHeader)) {\n return (HMODULE)pbLast;\n }\n }\n return NULL;\n}\n\n//////////////////////////////////////////////////////////////////////////////\n//\n// Find a region of memory in which we can create a replacement import table.\n//\nstatic PBYTE FindAndAllocateNearBase(HANDLE hProcess, PBYTE pbBase, DWORD cbAlloc)\n{\n MEMORY_BASIC_INFORMATION mbi;\n ZeroMemory(&mbi, sizeof(mbi));\n\n PBYTE pbLast = pbBase;\n for (;; pbLast = (PBYTE)mbi.BaseAddress + mbi.RegionSize) {\n\n ZeroMemory(&mbi, sizeof(mbi));\n if (VirtualQueryEx(hProcess, (PVOID)pbLast, &mbi, sizeof(mbi)) == 0) {\n if (GetLastError() == ERROR_INVALID_PARAMETER) {\n break;\n }\n DETOUR_TRACE((\"VirtualQueryEx(%p) failed: %lu\\n\",\n pbLast, GetLastError()));\n break;\n }\n // Usermode address space has such an unaligned region size always at the\n // end and only at the end.\n //\n if ((mbi.RegionSize & 0xfff) == 0xfff) {\n break;\n }\n\n // Skip anything other than a pure free region.\n //\n if (mbi.State != MEM_FREE) {\n continue;\n }\n\n PBYTE pbAddress = (PBYTE)(((DWORD_PTR)mbi.BaseAddress + 0xffff) & ~(DWORD_PTR)0xffff);\n\n#ifdef _WIN64\n // The distance from pbBase to pbAddress must fit in 32 bits.\n //\n const size_t GB4 = ((((size_t)1) << 32) - 1);\n if ((size_t)(pbAddress - pbBase) > GB4) {\n DETOUR_TRACE((\"FindAndAllocateNearBase(1) failing due to distance >4GB %p\\n\", pbAddress));\n return NULL;\n }\n#endif\n\n DETOUR_TRACE((\"Free region %p..%p\\n\",\n mbi.BaseAddress,\n (PBYTE)mbi.BaseAddress + mbi.RegionSize));\n\n for (; pbAddress < (PBYTE)mbi.BaseAddress + mbi.RegionSize; pbAddress += MM_ALLOCATION_GRANULARITY) {\n PBYTE pbAlloc = (PBYTE)VirtualAllocEx(hProcess, pbAddress, cbAlloc,\n MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);\n if (pbAlloc == NULL) {\n DETOUR_TRACE((\"VirtualAllocEx(%p) failed: %lu\\n\", pbAddress, GetLastError()));\n continue;\n }\n#ifdef _WIN64\n // The distance from pbBase to pbAddress must fit in 32 bits.\n //\n if ((size_t)(pbAddress - pbBase) > GB4) {\n DETOUR_TRACE((\"FindAndAllocateNearBase(2) failing due to distance >4GB %p\\n\", pbAddress));\n return NULL;\n }\n#endif\n DETOUR_TRACE((\"[%p..%p] Allocated for import table.\\n\",\n pbAlloc, pbAlloc + cbAlloc));\n return pbAlloc;\n }\n }\n return NULL;\n}\n\nstatic inline DWORD PadToDword(DWORD dw)\n{\n return (dw + 3) & ~3u;\n}\n\nstatic inline DWORD PadToDwordPtr(DWORD dw)\n{\n return (dw + 7) & ~7u;\n}\n\nstatic inline HRESULT ReplaceOptionalSizeA(_Inout_z_count_(cchDest) LPSTR pszDest,\n _In_ size_t cchDest,\n _In_z_ LPCSTR pszSize)\n{\n if (cchDest == 0 || pszDest == NULL || pszSize == NULL ||\n pszSize[0] == '\\0' || pszSize[1] == '\\0' || pszSize[2] != '\\0') {\n\n // can not write into empty buffer or with string other than two chars.\n return ERROR_INVALID_PARAMETER;\n }\n\n for (; cchDest >= 2; cchDest--, pszDest++) {\n if (pszDest[0] == '?' && pszDest[1] == '?') {\n pszDest[0] = pszSize[0];\n pszDest[1] = pszSize[1];\n break;\n }\n }\n\n return S_OK;\n}\n\nstatic BOOL RecordExeRestore(HANDLE hProcess, HMODULE hModule, DETOUR_EXE_RESTORE& der)\n{\n // Save the various headers for DetourRestoreAfterWith.\n ZeroMemory(&der, sizeof(der));\n der.cb = sizeof(der);\n\n der.pidh = (PBYTE)hModule;\n der.cbidh = sizeof(der.idh);\n if (!ReadProcessMemory(hProcess, der.pidh, &der.idh, sizeof(der.idh), NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(idh@%p..%p) failed: %lu\\n\",\n der.pidh, der.pidh + der.cbidh, GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"IDH: %p..%p\\n\", der.pidh, der.pidh + der.cbidh));\n\n // We read the NT header in two passes to get the full size.\n // First we read just the Signature and FileHeader.\n der.pinh = der.pidh + der.idh.e_lfanew;\n der.cbinh = FIELD_OFFSET(IMAGE_NT_HEADERS, OptionalHeader);\n if (!ReadProcessMemory(hProcess, der.pinh, &der.inh, der.cbinh, NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(inh@%p..%p) failed: %lu\\n\",\n der.pinh, der.pinh + der.cbinh, GetLastError()));\n return FALSE;\n }\n\n // Second we read the OptionalHeader and Section headers.\n der.cbinh = (FIELD_OFFSET(IMAGE_NT_HEADERS, OptionalHeader) +\n der.inh.FileHeader.SizeOfOptionalHeader +\n der.inh.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER));\n\n if (der.cbinh > sizeof(der.raw)) {\n return FALSE;\n }\n\n if (!ReadProcessMemory(hProcess, der.pinh, &der.inh, der.cbinh, NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(inh@%p..%p) failed: %lu\\n\",\n der.pinh, der.pinh + der.cbinh, GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"INH: %p..%p\\n\", der.pinh, der.pinh + der.cbinh));\n\n // Third, we read the CLR header\n\n if (der.inh.OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\n if (der.inh32.CLR_DIRECTORY.VirtualAddress != 0 &&\n der.inh32.CLR_DIRECTORY.Size != 0) {\n\n DETOUR_TRACE((\"CLR32.VirtAddr=%lx, CLR.Size=%lx\\n\",\n der.inh32.CLR_DIRECTORY.VirtualAddress,\n der.inh32.CLR_DIRECTORY.Size));\n\n der.pclr = ((PBYTE)hModule) + der.inh32.CLR_DIRECTORY.VirtualAddress;\n }\n }\n else if (der.inh.OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) {\n if (der.inh64.CLR_DIRECTORY.VirtualAddress != 0 &&\n der.inh64.CLR_DIRECTORY.Size != 0) {\n\n DETOUR_TRACE((\"CLR64.VirtAddr=%lx, CLR.Size=%lx\\n\",\n der.inh64.CLR_DIRECTORY.VirtualAddress,\n der.inh64.CLR_DIRECTORY.Size));\n\n der.pclr = ((PBYTE)hModule) + der.inh64.CLR_DIRECTORY.VirtualAddress;\n }\n }\n\n if (der.pclr != 0) {\n der.cbclr = sizeof(der.clr);\n if (!ReadProcessMemory(hProcess, der.pclr, &der.clr, der.cbclr, NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(clr@%p..%p) failed: %lu\\n\",\n der.pclr, der.pclr + der.cbclr, GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"CLR: %p..%p\\n\", der.pclr, der.pclr + der.cbclr));\n }\n\n return TRUE;\n}\n\n//////////////////////////////////////////////////////////////////////////////\n//\n#if DETOURS_32BIT\n#define DWORD_XX DWORD32\n#define IMAGE_NT_HEADERS_XX IMAGE_NT_HEADERS32\n#define IMAGE_NT_OPTIONAL_HDR_MAGIC_XX IMAGE_NT_OPTIONAL_HDR32_MAGIC\n#define IMAGE_ORDINAL_FLAG_XX IMAGE_ORDINAL_FLAG32\n#define UPDATE_IMPORTS_XX UpdateImports32\n#define DETOURS_BITS_XX 32\n#include \"uimports.cpp\"\n#undef DETOUR_EXE_RESTORE_FIELD_XX\n#undef DWORD_XX\n#undef IMAGE_NT_HEADERS_XX\n#undef IMAGE_NT_OPTIONAL_HDR_MAGIC_XX\n#undef IMAGE_ORDINAL_FLAG_XX\n#undef UPDATE_IMPORTS_XX\n#endif // DETOURS_32BIT\n\n#if DETOURS_64BIT\n#define DWORD_XX DWORD64\n#define IMAGE_NT_HEADERS_XX IMAGE_NT_HEADERS64\n#define IMAGE_NT_OPTIONAL_HDR_MAGIC_XX IMAGE_NT_OPTIONAL_HDR64_MAGIC\n#define IMAGE_ORDINAL_FLAG_XX IMAGE_ORDINAL_FLAG64\n#define UPDATE_IMPORTS_XX UpdateImports64\n#define DETOURS_BITS_XX 64\n#include \"uimports.cpp\"\n#undef DETOUR_EXE_RESTORE_FIELD_XX\n#undef DWORD_XX\n#undef IMAGE_NT_HEADERS_XX\n#undef IMAGE_NT_OPTIONAL_HDR_MAGIC_XX\n#undef IMAGE_ORDINAL_FLAG_XX\n#undef UPDATE_IMPORTS_XX\n#endif // DETOURS_64BIT\n\n//////////////////////////////////////////////////////////////////////////////\n//\n#if DETOURS_64BIT\n\nC_ASSERT(sizeof(IMAGE_NT_HEADERS64) == sizeof(IMAGE_NT_HEADERS32) + 16);\n\nstatic BOOL UpdateFrom32To64(HANDLE hProcess, HMODULE hModule, WORD machine,\n DETOUR_EXE_RESTORE& der)\n{\n IMAGE_DOS_HEADER idh;\n IMAGE_NT_HEADERS32 inh32;\n IMAGE_NT_HEADERS64 inh64;\n IMAGE_SECTION_HEADER sects[32];\n PBYTE pbModule = (PBYTE)hModule;\n DWORD n;\n\n ZeroMemory(&inh32, sizeof(inh32));\n ZeroMemory(&inh64, sizeof(inh64));\n ZeroMemory(sects, sizeof(sects));\n\n DETOUR_TRACE((\"UpdateFrom32To64(%04x)\\n\", machine));\n //////////////////////////////////////////////////////// Read old headers.\n //\n if (!ReadProcessMemory(hProcess, pbModule, &idh, sizeof(idh), NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(idh@%p..%p) failed: %lu\\n\",\n pbModule, pbModule + sizeof(idh), GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"ReadProcessMemory(idh@%p..%p)\\n\",\n pbModule, pbModule + sizeof(idh)));\n\n PBYTE pnh = pbModule + idh.e_lfanew;\n if (!ReadProcessMemory(hProcess, pnh, &inh32, sizeof(inh32), NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(inh@%p..%p) failed: %lu\\n\",\n pnh, pnh + sizeof(inh32), GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"ReadProcessMemory(inh@%p..%p)\\n\", pnh, pnh + sizeof(inh32)));\n\n if (inh32.FileHeader.NumberOfSections > (sizeof(sects)/sizeof(sects[0]))) {\n return FALSE;\n }\n\n PBYTE psects = pnh +\n FIELD_OFFSET(IMAGE_NT_HEADERS, OptionalHeader) +\n inh32.FileHeader.SizeOfOptionalHeader;\n ULONG cb = inh32.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);\n if (!ReadProcessMemory(hProcess, psects, §s, cb, NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(ish@%p..%p) failed: %lu\\n\",\n psects, psects + cb, GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"ReadProcessMemory(ish@%p..%p)\\n\", psects, psects + cb));\n\n ////////////////////////////////////////////////////////// Convert header.\n //\n inh64.Signature = inh32.Signature;\n inh64.FileHeader = inh32.FileHeader;\n inh64.FileHeader.Machine = machine;\n inh64.FileHeader.SizeOfOptionalHeader = sizeof(IMAGE_OPTIONAL_HEADER64);\n\n inh64.OptionalHeader.Magic = IMAGE_NT_OPTIONAL_HDR64_MAGIC;\n inh64.OptionalHeader.MajorLinkerVersion = inh32.OptionalHeader.MajorLinkerVersion;\n inh64.OptionalHeader.MinorLinkerVersion = inh32.OptionalHeader.MinorLinkerVersion;\n inh64.OptionalHeader.SizeOfCode = inh32.OptionalHeader.SizeOfCode;\n inh64.OptionalHeader.SizeOfInitializedData = inh32.OptionalHeader.SizeOfInitializedData;\n inh64.OptionalHeader.SizeOfUninitializedData = inh32.OptionalHeader.SizeOfUninitializedData;\n inh64.OptionalHeader.AddressOfEntryPoint = inh32.OptionalHeader.AddressOfEntryPoint;\n inh64.OptionalHeader.BaseOfCode = inh32.OptionalHeader.BaseOfCode;\n inh64.OptionalHeader.ImageBase = inh32.OptionalHeader.ImageBase;\n inh64.OptionalHeader.SectionAlignment = inh32.OptionalHeader.SectionAlignment;\n inh64.OptionalHeader.FileAlignment = inh32.OptionalHeader.FileAlignment;\n inh64.OptionalHeader.MajorOperatingSystemVersion\n = inh32.OptionalHeader.MajorOperatingSystemVersion;\n inh64.OptionalHeader.MinorOperatingSystemVersion\n = inh32.OptionalHeader.MinorOperatingSystemVersion;\n inh64.OptionalHeader.MajorImageVersion = inh32.OptionalHeader.MajorImageVersion;\n inh64.OptionalHeader.MinorImageVersion = inh32.OptionalHeader.MinorImageVersion;\n inh64.OptionalHeader.MajorSubsystemVersion = inh32.OptionalHeader.MajorSubsystemVersion;\n inh64.OptionalHeader.MinorSubsystemVersion = inh32.OptionalHeader.MinorSubsystemVersion;\n inh64.OptionalHeader.Win32VersionValue = inh32.OptionalHeader.Win32VersionValue;\n inh64.OptionalHeader.SizeOfImage = inh32.OptionalHeader.SizeOfImage;\n inh64.OptionalHeader.SizeOfHeaders = inh32.OptionalHeader.SizeOfHeaders;\n inh64.OptionalHeader.CheckSum = inh32.OptionalHeader.CheckSum;\n inh64.OptionalHeader.Subsystem = inh32.OptionalHeader.Subsystem;\n inh64.OptionalHeader.DllCharacteristics = inh32.OptionalHeader.DllCharacteristics;\n inh64.OptionalHeader.SizeOfStackReserve = inh32.OptionalHeader.SizeOfStackReserve;\n inh64.OptionalHeader.SizeOfStackCommit = inh32.OptionalHeader.SizeOfStackCommit;\n inh64.OptionalHeader.SizeOfHeapReserve = inh32.OptionalHeader.SizeOfHeapReserve;\n inh64.OptionalHeader.SizeOfHeapCommit = inh32.OptionalHeader.SizeOfHeapCommit;\n inh64.OptionalHeader.LoaderFlags = inh32.OptionalHeader.LoaderFlags;\n inh64.OptionalHeader.NumberOfRvaAndSizes = inh32.OptionalHeader.NumberOfRvaAndSizes;\n for (n = 0; n < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; n++) {\n inh64.OptionalHeader.DataDirectory[n] = inh32.OptionalHeader.DataDirectory[n];\n }\n\n /////////////////////////////////////////////////////// Write new headers.\n //\n DWORD dwProtect = 0;\n if (!DetourVirtualProtectSameExecuteEx(hProcess, pbModule, inh64.OptionalHeader.SizeOfHeaders,\n PAGE_EXECUTE_READWRITE, &dwProtect)) {\n return FALSE;\n }\n\n if (!WriteProcessMemory(hProcess, pnh, &inh64, sizeof(inh64), NULL)) {\n DETOUR_TRACE((\"WriteProcessMemory(inh@%p..%p) failed: %lu\\n\",\n pnh, pnh + sizeof(inh64), GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"WriteProcessMemory(inh@%p..%p)\\n\", pnh, pnh + sizeof(inh64)));\n\n psects = pnh +\n FIELD_OFFSET(IMAGE_NT_HEADERS, OptionalHeader) +\n inh64.FileHeader.SizeOfOptionalHeader;\n cb = inh64.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);\n if (!WriteProcessMemory(hProcess, psects, §s, cb, NULL)) {\n DETOUR_TRACE((\"WriteProcessMemory(ish@%p..%p) failed: %lu\\n\",\n psects, psects + cb, GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"WriteProcessMemory(ish@%p..%p)\\n\", psects, psects + cb));\n\n // Record the updated headers.\n if (!RecordExeRestore(hProcess, hModule, der)) {\n return FALSE;\n }\n\n // Remove the import table.\n if (der.pclr != NULL && (der.clr.Flags & 1)) {\n inh64.IMPORT_DIRECTORY.VirtualAddress = 0;\n inh64.IMPORT_DIRECTORY.Size = 0;\n\n if (!WriteProcessMemory(hProcess, pnh, &inh64, sizeof(inh64), NULL)) {\n DETOUR_TRACE((\"WriteProcessMemory(inh@%p..%p) failed: %lu\\n\",\n pnh, pnh + sizeof(inh64), GetLastError()));\n return FALSE;\n }\n }\n\n DWORD dwOld = 0;\n if (!VirtualProtectEx(hProcess, pbModule, inh64.OptionalHeader.SizeOfHeaders,\n dwProtect, &dwOld)) {\n return FALSE;\n }\n\n return TRUE;\n}\n#endif // DETOURS_64BIT\n\n//////////////////////////////////////////////////////////////////////////////\n//\nBOOL WINAPI DetourUpdateProcessWithDll(_In_ HANDLE hProcess,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_ DWORD nDlls)\n{\n // Find the next memory region that contains a mapped PE image.\n //\n BOOL bHas64BitDll = FALSE;\n BOOL bHas32BitExe = FALSE;\n BOOL bIs32BitProcess;\n HMODULE hModule = NULL;\n HMODULE hLast = NULL;\n\n DETOUR_TRACE((\"DetourUpdateProcessWithDll(%p,dlls=%lu)\\n\", hProcess, nDlls));\n\n for (;;) {\n IMAGE_NT_HEADERS32 inh;\n\n if ((hLast = EnumerateModulesInProcess(hProcess, hLast, &inh)) == NULL) {\n break;\n }\n\n DETOUR_TRACE((\"%p machine=%04x magic=%04x\\n\",\n (void*)hLast, inh.FileHeader.Machine, inh.OptionalHeader.Magic));\n\n if ((inh.FileHeader.Characteristics & IMAGE_FILE_DLL) == 0) {\n hModule = hLast;\n if (inh.OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC\n && inh.FileHeader.Machine != 0) {\n\n bHas32BitExe = TRUE;\n }\n DETOUR_TRACE((\"%p Found EXE\\n\", (void*)hLast));\n }\n else {\n if (inh.OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC\n && inh.FileHeader.Machine != 0) {\n\n bHas64BitDll = TRUE;\n }\n }\n }\n\n if (hModule == NULL) {\n SetLastError(ERROR_INVALID_OPERATION);\n return FALSE;\n }\n\n if (!bHas32BitExe) {\n bIs32BitProcess = FALSE;\n }\n else if (!bHas64BitDll) {\n bIs32BitProcess = TRUE;\n }\n else {\n if (!IsWow64Process(hProcess, &bIs32BitProcess)) {\n return FALSE;\n }\n }\n\n DETOUR_TRACE((\" 32BitExe=%d 32BitProcess=%d\\n\", bHas32BitExe, bIs32BitProcess));\n\n return DetourUpdateProcessWithDllEx(hProcess,\n hModule,\n bIs32BitProcess,\n rlpDlls,\n nDlls);\n}\n\nBOOL WINAPI DetourUpdateProcessWithDllEx(_In_ HANDLE hProcess,\n _In_ HMODULE hModule,\n _In_ BOOL bIs32BitProcess,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_ DWORD nDlls)\n{\n // Find the next memory region that contains a mapped PE image.\n //\n BOOL bIs32BitExe = FALSE;\n\n DETOUR_TRACE((\"DetourUpdateProcessWithDllEx(%p,%p,dlls=%lu)\\n\", hProcess, (void*)hModule, nDlls));\n\n IMAGE_NT_HEADERS32 inh;\n\n if (hModule == NULL || LoadNtHeaderFromProcess(hProcess, hModule, &inh) == FALSE) {\n SetLastError(ERROR_INVALID_OPERATION);\n return FALSE;\n }\n\n if (inh.OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC\n && inh.FileHeader.Machine != 0) {\n\n bIs32BitExe = TRUE;\n }\n\n DETOUR_TRACE((\" 32BitExe=%d 32BitProcess=%d\\n\", bIs32BitExe, bIs32BitProcess));\n\n if (hModule == NULL) {\n SetLastError(ERROR_INVALID_OPERATION);\n return FALSE;\n }\n\n // Save the various headers for DetourRestoreAfterWith.\n //\n DETOUR_EXE_RESTORE der;\n\n if (!RecordExeRestore(hProcess, hModule, der)) {\n return FALSE;\n }\n\n#if defined(DETOURS_64BIT)\n // Try to convert a neutral 32-bit managed binary to a 64-bit managed binary.\n if (bIs32BitExe && !bIs32BitProcess) {\n if (!der.pclr // Native binary\n || (der.clr.Flags & 1) == 0 // Or mixed-mode MSIL\n || (der.clr.Flags & 2) != 0) { // Or 32BIT Required MSIL\n\n SetLastError(ERROR_INVALID_HANDLE);\n return FALSE;\n }\n\n if (!UpdateFrom32To64(hProcess, hModule,\n#if defined(DETOURS_X64)\n IMAGE_FILE_MACHINE_AMD64,\n#elif defined(DETOURS_IA64)\n IMAGE_FILE_MACHINE_IA64,\n#elif defined(DETOURS_ARM64)\n IMAGE_FILE_MACHINE_ARM64,\n#else\n#error Must define one of DETOURS_X64 or DETOURS_IA64 or DETOURS_ARM64 on 64-bit.\n#endif\n der)) {\n return FALSE;\n }\n bIs32BitExe = FALSE;\n }\n#endif // DETOURS_64BIT\n\n // Now decide if we can insert the detour.\n\n#if defined(DETOURS_32BIT)\n if (bIs32BitProcess) {\n // 32-bit native or 32-bit managed process on any platform.\n if (!UpdateImports32(hProcess, hModule, rlpDlls, nDlls)) {\n return FALSE;\n }\n }\n else {\n // 64-bit native or 64-bit managed process.\n //\n // Can't detour a 64-bit process with 32-bit code.\n // Note: This happens for 32-bit PE binaries containing only\n // manage code that have been marked as 64-bit ready.\n //\n SetLastError(ERROR_INVALID_HANDLE);\n return FALSE;\n }\n#elif defined(DETOURS_64BIT)\n if (bIs32BitProcess || bIs32BitExe) {\n // Can't detour a 32-bit process with 64-bit code.\n SetLastError(ERROR_INVALID_HANDLE);\n return FALSE;\n }\n else {\n // 64-bit native or 64-bit managed process on any platform.\n if (!UpdateImports64(hProcess, hModule, rlpDlls, nDlls)) {\n return FALSE;\n }\n }\n#else\n#pragma Must define one of DETOURS_32BIT or DETOURS_64BIT.\n#endif // DETOURS_64BIT\n\n /////////////////////////////////////////////////// Update the CLR header.\n //\n if (der.pclr != NULL) {\n DETOUR_CLR_HEADER clr;\n CopyMemory(&clr, &der.clr, sizeof(clr));\n clr.Flags &= 0xfffffffe; // Clear the IL_ONLY flag.\n\n DWORD dwProtect;\n if (!DetourVirtualProtectSameExecuteEx(hProcess, der.pclr, sizeof(clr), PAGE_READWRITE, &dwProtect)) {\n DETOUR_TRACE((\"VirtualProtectEx(clr) write failed: %lu\\n\", GetLastError()));\n return FALSE;\n }\n\n if (!WriteProcessMemory(hProcess, der.pclr, &clr, sizeof(clr), NULL)) {\n DETOUR_TRACE((\"WriteProcessMemory(clr) failed: %lu\\n\", GetLastError()));\n return FALSE;\n }\n\n if (!VirtualProtectEx(hProcess, der.pclr, sizeof(clr), dwProtect, &dwProtect)) {\n DETOUR_TRACE((\"VirtualProtectEx(clr) restore failed: %lu\\n\", GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"CLR: %p..%p\\n\", der.pclr, der.pclr + der.cbclr));\n\n#if DETOURS_64BIT\n if (der.clr.Flags & 0x2) { // Is the 32BIT Required Flag set?\n // X64 never gets here because the process appears as a WOW64 process.\n // However, on IA64, it doesn't appear to be a WOW process.\n DETOUR_TRACE((\"CLR Requires 32-bit, %p...%p\\n\", der.pclr, der.pclr + der.cbclr));\n SetLastError(ERROR_INVALID_HANDLE);\n return FALSE;\n }\n#endif // DETOURS_64BIT\n }\n\n //////////////////////////////// Save the undo data to the target process.\n //\n if (!DetourCopyPayloadToProcess(hProcess, DETOUR_EXE_RESTORE_GUID, &der, sizeof(der))) {\n DETOUR_TRACE((\"DetourCopyPayloadToProcess failed: %lu\\n\", GetLastError()));\n return FALSE;\n }\n return TRUE;\n}\n\n#ifndef DETOURS_KERNEL\n//////////////////////////////////////////////////////////////////////////////\n//\nBOOL WINAPI DetourCreateProcessWithDllA(_In_opt_ LPCSTR lpApplicationName,\n _Inout_opt_ LPSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOA lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ LPCSTR lpDllName,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA)\n{\n DWORD dwMyCreationFlags = (dwCreationFlags | CREATE_SUSPENDED);\n PROCESS_INFORMATION pi;\n BOOL fResult = FALSE;\n\n if (pfCreateProcessA == NULL) {\n pfCreateProcessA = CreateProcessA;\n }\n\n fResult = pfCreateProcessA(lpApplicationName,\n lpCommandLine,\n lpProcessAttributes,\n lpThreadAttributes,\n bInheritHandles,\n dwMyCreationFlags,\n lpEnvironment,\n lpCurrentDirectory,\n lpStartupInfo,\n &pi);\n\n if (lpProcessInformation != NULL) {\n CopyMemory(lpProcessInformation, &pi, sizeof(pi));\n }\n\n if (!fResult) {\n return FALSE;\n }\n\n LPCSTR rlpDlls[2];\n DWORD nDlls = 0;\n if (lpDllName != NULL) {\n rlpDlls[nDlls++] = lpDllName;\n }\n\n if (!DetourUpdateProcessWithDll(pi.hProcess, rlpDlls, nDlls)) {\n TerminateProcess(pi.hProcess, ~0u);\n return FALSE;\n }\n\n if (!(dwCreationFlags & CREATE_SUSPENDED)) {\n ResumeThread(pi.hThread);\n }\n return TRUE;\n}\n\n\nBOOL WINAPI DetourCreateProcessWithDllW(_In_opt_ LPCWSTR lpApplicationName,\n _Inout_opt_ LPWSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCWSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOW lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ LPCSTR lpDllName,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW)\n{\n DWORD dwMyCreationFlags = (dwCreationFlags | CREATE_SUSPENDED);\n PROCESS_INFORMATION pi;\n\n if (pfCreateProcessW == NULL) {\n pfCreateProcessW = CreateProcessW;\n }\n\n BOOL fResult = pfCreateProcessW(lpApplicationName,\n lpCommandLine,\n lpProcessAttributes,\n lpThreadAttributes,\n bInheritHandles,\n dwMyCreationFlags,\n lpEnvironment,\n lpCurrentDirectory,\n lpStartupInfo,\n &pi);\n\n if (lpProcessInformation) {\n CopyMemory(lpProcessInformation, &pi, sizeof(pi));\n }\n\n if (!fResult) {\n return FALSE;\n }\n\n LPCSTR rlpDlls[2];\n DWORD nDlls = 0;\n if (lpDllName != NULL) {\n rlpDlls[nDlls++] = lpDllName;\n }\n\n if (!DetourUpdateProcessWithDll(pi.hProcess, rlpDlls, nDlls)) {\n TerminateProcess(pi.hProcess, ~0u);\n return FALSE;\n }\n\n if (!(dwCreationFlags & CREATE_SUSPENDED)) {\n ResumeThread(pi.hThread);\n }\n return TRUE;\n}\n#endif // DETOURS_KERNEL\n\nBOOL WINAPI DetourCopyPayloadToProcess(_In_ HANDLE hProcess,\n _In_ REFGUID rguid,\n _In_reads_bytes_(cbData) PVOID pvData,\n _In_ DWORD cbData)\n{\n DWORD cbTotal = (sizeof(IMAGE_DOS_HEADER) +\n sizeof(IMAGE_NT_HEADERS) +\n sizeof(IMAGE_SECTION_HEADER) +\n sizeof(DETOUR_SECTION_HEADER) +\n sizeof(DETOUR_SECTION_RECORD) +\n cbData);\n\n PBYTE pbBase = (PBYTE)VirtualAllocEx(hProcess, NULL, cbTotal,\n MEM_COMMIT, PAGE_READWRITE);\n if (pbBase == NULL) {\n DETOUR_TRACE((\"VirtualAllocEx(%lu) failed: %lu\\n\", cbTotal, GetLastError()));\n return FALSE;\n }\n\n PBYTE pbTarget = pbBase;\n IMAGE_DOS_HEADER idh;\n IMAGE_NT_HEADERS inh;\n IMAGE_SECTION_HEADER ish;\n DETOUR_SECTION_HEADER dsh;\n DETOUR_SECTION_RECORD dsr;\n SIZE_T cbWrote = 0;\n\n ZeroMemory(&idh, sizeof(idh));\n idh.e_magic = IMAGE_DOS_SIGNATURE;\n idh.e_lfanew = sizeof(idh);\n if (!WriteProcessMemory(hProcess, pbTarget, &idh, sizeof(idh), &cbWrote) ||\n cbWrote != sizeof(idh)) {\n DETOUR_TRACE((\"WriteProcessMemory(idh) failed: %lu\\n\", GetLastError()));\n return FALSE;\n }\n pbTarget += sizeof(idh);\n\n ZeroMemory(&inh, sizeof(inh));\n inh.Signature = IMAGE_NT_SIGNATURE;\n inh.FileHeader.SizeOfOptionalHeader = sizeof(inh.OptionalHeader);\n inh.FileHeader.Characteristics = IMAGE_FILE_DLL;\n inh.FileHeader.NumberOfSections = 1;\n inh.OptionalHeader.Magic = IMAGE_NT_OPTIONAL_HDR_MAGIC;\n if (!WriteProcessMemory(hProcess, pbTarget, &inh, sizeof(inh), &cbWrote) ||\n cbWrote != sizeof(inh)) {\n return FALSE;\n }\n pbTarget += sizeof(inh);\n\n ZeroMemory(&ish, sizeof(ish));\n memcpy(ish.Name, \".detour\", sizeof(ish.Name));\n ish.VirtualAddress = (DWORD)((pbTarget + sizeof(ish)) - pbBase);\n ish.SizeOfRawData = (sizeof(DETOUR_SECTION_HEADER) +\n sizeof(DETOUR_SECTION_RECORD) +\n cbData);\n if (!WriteProcessMemory(hProcess, pbTarget, &ish, sizeof(ish), &cbWrote) ||\n cbWrote != sizeof(ish)) {\n return FALSE;\n }\n pbTarget += sizeof(ish);\n\n ZeroMemory(&dsh, sizeof(dsh));\n dsh.cbHeaderSize = sizeof(dsh);\n dsh.nSignature = DETOUR_SECTION_HEADER_SIGNATURE;\n dsh.nDataOffset = sizeof(DETOUR_SECTION_HEADER);\n dsh.cbDataSize = (sizeof(DETOUR_SECTION_HEADER) +\n sizeof(DETOUR_SECTION_RECORD) +\n cbData);\n if (!WriteProcessMemory(hProcess, pbTarget, &dsh, sizeof(dsh), &cbWrote) ||\n cbWrote != sizeof(dsh)) {\n return FALSE;\n }\n pbTarget += sizeof(dsh);\n\n ZeroMemory(&dsr, sizeof(dsr));\n dsr.cbBytes = cbData + sizeof(DETOUR_SECTION_RECORD);\n dsr.nReserved = 0;\n dsr.guid = rguid;\n if (!WriteProcessMemory(hProcess, pbTarget, &dsr, sizeof(dsr), &cbWrote) ||\n cbWrote != sizeof(dsr)) {\n return FALSE;\n }\n pbTarget += sizeof(dsr);\n\n if (!WriteProcessMemory(hProcess, pbTarget, pvData, cbData, &cbWrote) ||\n cbWrote != cbData) {\n return FALSE;\n }\n pbTarget += cbData;\n\n DETOUR_TRACE((\"Copied %lu byte payload into target process at %p\\n\",\n cbTotal, pbTarget - cbTotal));\n return TRUE;\n}\n\n#ifndef DETOURS_KERNEL\nstatic BOOL s_fSearchedForHelper = FALSE;\nstatic PDETOUR_EXE_HELPER s_pHelper = NULL;\n\nVOID CALLBACK DetourFinishHelperProcess(_In_ HWND,\n _In_ HINSTANCE,\n _In_ LPSTR,\n _In_ INT)\n{\n LPCSTR * rlpDlls = NULL;\n DWORD Result = 9900;\n HANDLE hProcess = nullptr;\n DWORD cSize = 0;\n DWORD cOffset = 0;\n\n if (s_pHelper == NULL) {\n DETOUR_TRACE((\"DetourFinishHelperProcess called with s_pHelper = NULL.\\n\"));\n Result = 9905;\n goto Cleanup;\n }\n\n hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, s_pHelper->pid);\n if (hProcess == NULL) {\n DETOUR_TRACE((\"OpenProcess(pid=%lu) failed: %lu\\n\",\n s_pHelper->pid, GetLastError()));\n Result = 9901;\n goto Cleanup;\n }\n\n rlpDlls = new NOTHROW LPCSTR [s_pHelper->nDlls];\n cSize = s_pHelper->cb - sizeof(DETOUR_EXE_HELPER);\n cOffset = 0;\n for (DWORD n = 0; n < s_pHelper->nDlls; n++) {\n size_t cchDest = 0;\n HRESULT hr = StringCchLengthA(&s_pHelper->rDlls[cOffset], cSize - cOffset, &cchDest);\n if (!SUCCEEDED(hr)) {\n Result = 9902;\n goto Cleanup;\n }\n\n rlpDlls[n] = &s_pHelper->rDlls[cOffset];\n cOffset += (DWORD)cchDest + 1;\n }\n\n if (!DetourUpdateProcessWithDll(hProcess, rlpDlls, s_pHelper->nDlls)) {\n DETOUR_TRACE((\"DetourUpdateProcessWithDll(pid=%lu) failed: %lu\\n\",\n s_pHelper->pid, GetLastError()));\n Result = 9903;\n goto Cleanup;\n }\n Result = 0;\n\n Cleanup:\n if (rlpDlls != NULL) {\n delete[] rlpDlls;\n rlpDlls = NULL;\n }\n\n ExitProcess(Result);\n}\n\nBOOL WINAPI DetourIsHelperProcess(VOID)\n{\n PVOID pvData;\n DWORD cbData;\n\n if (s_fSearchedForHelper) {\n return (s_pHelper != NULL);\n }\n\n s_fSearchedForHelper = TRUE;\n pvData = DetourFindPayloadEx(DETOUR_EXE_HELPER_GUID, &cbData);\n\n if (pvData == NULL || cbData < sizeof(DETOUR_EXE_HELPER)) {\n return FALSE;\n }\n\n s_pHelper = (PDETOUR_EXE_HELPER)pvData;\n if (s_pHelper->cb < sizeof(*s_pHelper)) {\n s_pHelper = NULL;\n return FALSE;\n }\n\n return TRUE;\n}\n\nstatic\nBOOL WINAPI AllocExeHelper(_Out_ PDETOUR_EXE_HELPER *pHelper,\n _In_ DWORD dwTargetPid,\n _In_ DWORD nDlls,\n _In_reads_(nDlls) LPCSTR *rlpDlls)\n{\n PDETOUR_EXE_HELPER Helper = NULL;\n BOOL Result = FALSE;\n DWORD cSize = 0;\n _Field_range_(0, cSize - 4) DWORD cOffset = 0;\n\n if (pHelper == NULL) {\n goto Cleanup;\n }\n *pHelper = NULL;\n\n if (nDlls < 1 || nDlls > 4096) {\n SetLastError(ERROR_INVALID_PARAMETER);\n goto Cleanup;\n }\n\n cSize = 4;\n for (DWORD n = 0; n < nDlls; n++) {\n HRESULT hr;\n size_t cchDest = 0;\n\n hr = StringCchLengthA(rlpDlls[n], 4096, &cchDest);\n if (!SUCCEEDED(hr)) {\n goto Cleanup;\n }\n\n cSize += (DWORD)cchDest + 1;\n }\n\n Helper = (PDETOUR_EXE_HELPER) new NOTHROW BYTE[sizeof(DETOUR_EXE_HELPER) + cSize];\n if (Helper == NULL) {\n goto Cleanup;\n }\n\n Helper->cb = sizeof(DETOUR_EXE_HELPER) + cSize;\n Helper->pid = dwTargetPid;\n Helper->nDlls = nDlls;\n\n for (DWORD n = 0; n < nDlls; n++) {\n HRESULT hr;\n size_t cchDest = 0;\n\n if (cOffset > 0x10000 || cSize > 0x10000 || cOffset + 2 >= cSize) {\n goto Cleanup;\n }\n\n if (cOffset + 2 >= cSize || cOffset + 65536 < cSize) {\n goto Cleanup;\n }\n\n _Analysis_assume_(cOffset + 1 < cSize);\n _Analysis_assume_(cOffset < 0x10000);\n _Analysis_assume_(cSize < 0x10000);\n\n PCHAR psz = &Helper->rDlls[cOffset];\n\n hr = StringCchCopyA(psz, cSize - cOffset, rlpDlls[n]);\n if (!SUCCEEDED(hr)) {\n goto Cleanup;\n }\n\n// REVIEW 28020 The expression '1<=_Param_(2)& &_Param_(2)<=2147483647' is not true at this call.\n// REVIEW 28313 Analysis will not proceed past this point because of annotation evaluation. The annotation expression *_Param_(3)<_Param_(2)&&*_Param_(3)<=stringLength$(_Param_(1)) cannot be true under any assumptions at this point in the program.\n#pragma warning(suppress:28020 28313)\n hr = StringCchLengthA(psz, cSize - cOffset, &cchDest);\n if (!SUCCEEDED(hr)) {\n goto Cleanup;\n }\n\n // Replace \"32.\" with \"64.\" or \"64.\" with \"32.\"\n\n for (DWORD c = (DWORD)cchDest + 1; c > 3; c--) {\n#if DETOURS_32BIT\n if (psz[c - 3] == '3' && psz[c - 2] == '2' && psz[c - 1] == '.') {\n psz[c - 3] = '6'; psz[c - 2] = '4';\n break;\n }\n#else\n if (psz[c - 3] == '6' && psz[c - 2] == '4' && psz[c - 1] == '.') {\n psz[c - 3] = '3'; psz[c - 2] = '2';\n break;\n }\n#endif\n }\n\n cOffset += (DWORD)cchDest + 1;\n }\n\n *pHelper = Helper;\n Helper = NULL;\n Result = TRUE;\n\n Cleanup:\n if (Helper != NULL) {\n delete[] (PBYTE)Helper;\n Helper = NULL;\n }\n return Result;\n}\n\nstatic\nVOID WINAPI FreeExeHelper(PDETOUR_EXE_HELPER *pHelper)\n{\n if (*pHelper != NULL) {\n delete[] (PBYTE)*pHelper;\n *pHelper = NULL;\n }\n}\n\nBOOL WINAPI DetourProcessViaHelperA(_In_ DWORD dwTargetPid,\n _In_ LPCSTR lpDllName,\n _In_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA)\n{\n return DetourProcessViaHelperDllsA(dwTargetPid, 1, &lpDllName, pfCreateProcessA);\n}\n\n\nBOOL WINAPI DetourProcessViaHelperDllsA(_In_ DWORD dwTargetPid,\n _In_ DWORD nDlls,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA)\n{\n BOOL Result = FALSE;\n PROCESS_INFORMATION pi;\n STARTUPINFOA si;\n CHAR szExe[MAX_PATH];\n CHAR szCommand[MAX_PATH];\n PDETOUR_EXE_HELPER helper = NULL;\n HRESULT hr;\n DWORD nLen = 0;\n\n DETOUR_TRACE((\"DetourProcessViaHelperDlls(pid=%lu,dlls=%lu)\\n\", dwTargetPid, nDlls));\n if (nDlls < 1 || nDlls > 4096) {\n SetLastError(ERROR_INVALID_PARAMETER);\n goto Cleanup;\n }\n if (!AllocExeHelper(&helper, dwTargetPid, nDlls, rlpDlls)) {\n goto Cleanup;\n }\n\n nLen = GetEnvironmentVariableA(\"WINDIR\", szExe, ARRAYSIZE(szExe));\n if (nLen == 0 || nLen >= ARRAYSIZE(szExe)) {\n goto Cleanup;\n }\n\n#if DETOURS_OPTION_BITS\n#if DETOURS_32BIT\n hr = StringCchCatA(szExe, ARRAYSIZE(szExe), \"\\\\sysnative\\\\rundll32.exe\");\n#else // !DETOURS_32BIT\n hr = StringCchCatA(szExe, ARRAYSIZE(szExe), \"\\\\syswow64\\\\rundll32.exe\");\n#endif // !DETOURS_32BIT\n#else // DETOURS_OPTIONS_BITS\n hr = StringCchCatA(szExe, ARRAYSIZE(szExe), \"\\\\system32\\\\rundll32.exe\");\n#endif // DETOURS_OPTIONS_BITS\n if (!SUCCEEDED(hr)) {\n goto Cleanup;\n }\n\n hr = StringCchPrintfA(szCommand, ARRAYSIZE(szCommand),\n \"rundll32.exe \\\"%hs\\\",#1\", &helper->rDlls[0]);\n if (!SUCCEEDED(hr)) {\n goto Cleanup;\n }\n\n ZeroMemory(&pi, sizeof(pi));\n ZeroMemory(&si, sizeof(si));\n si.cb = sizeof(si);\n\n DETOUR_TRACE((\"DetourProcessViaHelperDlls(\\\"%hs\\\", \\\"%hs\\\")\\n\", szExe, szCommand));\n if (pfCreateProcessA(szExe, szCommand, NULL, NULL, FALSE, CREATE_SUSPENDED,\n NULL, NULL, &si, &pi)) {\n\n if (!DetourCopyPayloadToProcess(pi.hProcess,\n DETOUR_EXE_HELPER_GUID,\n helper, helper->cb)) {\n DETOUR_TRACE((\"DetourCopyPayloadToProcess failed: %lu\\n\", GetLastError()));\n TerminateProcess(pi.hProcess, ~0u);\n CloseHandle(pi.hProcess);\n CloseHandle(pi.hThread);\n goto Cleanup;\n }\n\n ResumeThread(pi.hThread);\n WaitForSingleObject(pi.hProcess, INFINITE);\n\n DWORD dwResult = 500;\n GetExitCodeProcess(pi.hProcess, &dwResult);\n\n CloseHandle(pi.hProcess);\n CloseHandle(pi.hThread);\n\n if (dwResult != 0) {\n DETOUR_TRACE((\"Rundll32.exe failed: result=%lu\\n\", dwResult));\n goto Cleanup;\n }\n Result = TRUE;\n }\n else {\n DETOUR_TRACE((\"CreateProcess failed: %lu\\n\", GetLastError()));\n goto Cleanup;\n }\n\n Cleanup:\n FreeExeHelper(&helper);\n return Result;\n}\n\nBOOL WINAPI DetourProcessViaHelperW(_In_ DWORD dwTargetPid,\n _In_ LPCSTR lpDllName,\n _In_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW)\n{\n return DetourProcessViaHelperDllsW(dwTargetPid, 1, &lpDllName, pfCreateProcessW);\n}\n\nBOOL WINAPI DetourProcessViaHelperDllsW(_In_ DWORD dwTargetPid,\n _In_ DWORD nDlls,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW)\n{\n BOOL Result = FALSE;\n PROCESS_INFORMATION pi;\n STARTUPINFOW si;\n WCHAR szExe[MAX_PATH];\n WCHAR szCommand[MAX_PATH];\n PDETOUR_EXE_HELPER helper = NULL;\n HRESULT hr;\n DWORD nLen = 0;\n\n DETOUR_TRACE((\"DetourProcessViaHelperDlls(pid=%lu,dlls=%lu)\\n\", dwTargetPid, nDlls));\n if (nDlls < 1 || nDlls > 4096) {\n SetLastError(ERROR_INVALID_PARAMETER);\n goto Cleanup;\n }\n if (!AllocExeHelper(&helper, dwTargetPid, nDlls, rlpDlls)) {\n goto Cleanup;\n }\n\n nLen = GetEnvironmentVariableW(L\"WINDIR\", szExe, ARRAYSIZE(szExe));\n if (nLen == 0 || nLen >= ARRAYSIZE(szExe)) {\n goto Cleanup;\n }\n\n#if DETOURS_OPTION_BITS\n#if DETOURS_32BIT\n hr = StringCchCatW(szExe, ARRAYSIZE(szExe), L\"\\\\sysnative\\\\rundll32.exe\");\n#else // !DETOURS_32BIT\n hr = StringCchCatW(szExe, ARRAYSIZE(szExe), L\"\\\\syswow64\\\\rundll32.exe\");\n#endif // !DETOURS_32BIT\n#else // DETOURS_OPTIONS_BITS\n hr = StringCchCatW(szExe, ARRAYSIZE(szExe), L\"\\\\system32\\\\rundll32.exe\");\n#endif // DETOURS_OPTIONS_BITS\n if (!SUCCEEDED(hr)) {\n goto Cleanup;\n }\n\n hr = StringCchPrintfW(szCommand, ARRAYSIZE(szCommand),\n L\"rundll32.exe \\\"%hs\\\",#1\", &helper->rDlls[0]);\n if (!SUCCEEDED(hr)) {\n goto Cleanup;\n }\n\n ZeroMemory(&pi, sizeof(pi));\n ZeroMemory(&si, sizeof(si));\n si.cb = sizeof(si);\n\n DETOUR_TRACE((\"DetourProcessViaHelperDlls(\\\"%ls\\\", \\\"%ls\\\")\\n\", szExe, szCommand));\n if (pfCreateProcessW(szExe, szCommand, NULL, NULL, FALSE, CREATE_SUSPENDED,\n NULL, NULL, &si, &pi)) {\n\n if (!DetourCopyPayloadToProcess(pi.hProcess,\n DETOUR_EXE_HELPER_GUID,\n helper, helper->cb)) {\n DETOUR_TRACE((\"DetourCopyPayloadToProcess failed: %lu\\n\", GetLastError()));\n TerminateProcess(pi.hProcess, ~0u);\n CloseHandle(pi.hProcess);\n CloseHandle(pi.hThread);\n goto Cleanup;\n }\n\n ResumeThread(pi.hThread);\n\n ResumeThread(pi.hThread);\n WaitForSingleObject(pi.hProcess, INFINITE);\n\n DWORD dwResult = 500;\n GetExitCodeProcess(pi.hProcess, &dwResult);\n\n CloseHandle(pi.hProcess);\n CloseHandle(pi.hThread);\n\n if (dwResult != 0) {\n DETOUR_TRACE((\"Rundll32.exe failed: result=%lu\\n\", dwResult));\n goto Cleanup;\n }\n Result = TRUE;\n }\n else {\n DETOUR_TRACE((\"CreateProcess failed: %lu\\n\", GetLastError()));\n goto Cleanup;\n }\n\n Cleanup:\n FreeExeHelper(&helper);\n return Result;\n}\n\nBOOL WINAPI DetourCreateProcessWithDllExA(_In_opt_ LPCSTR lpApplicationName,\n _Inout_opt_ LPSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOA lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ LPCSTR lpDllName,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA)\n{\n if (pfCreateProcessA == NULL) {\n pfCreateProcessA = CreateProcessA;\n }\n\n PROCESS_INFORMATION backup;\n if (lpProcessInformation == NULL) {\n lpProcessInformation = &backup;\n ZeroMemory(&backup, sizeof(backup));\n }\n\n if (!pfCreateProcessA(lpApplicationName,\n lpCommandLine,\n lpProcessAttributes,\n lpThreadAttributes,\n bInheritHandles,\n dwCreationFlags | CREATE_SUSPENDED,\n lpEnvironment,\n lpCurrentDirectory,\n lpStartupInfo,\n lpProcessInformation)) {\n return FALSE;\n }\n\n LPCSTR szDll = lpDllName;\n\n if (!DetourUpdateProcessWithDll(lpProcessInformation->hProcess, &szDll, 1) &&\n !DetourProcessViaHelperA(lpProcessInformation->dwProcessId,\n lpDllName,\n pfCreateProcessA)) {\n\n TerminateProcess(lpProcessInformation->hProcess, ~0u);\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n return FALSE;\n }\n\n if (!(dwCreationFlags & CREATE_SUSPENDED)) {\n ResumeThread(lpProcessInformation->hThread);\n }\n\n if (lpProcessInformation == &backup) {\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n }\n\n return TRUE;\n}\n\nBOOL WINAPI DetourCreateProcessWithDllExW(_In_opt_ LPCWSTR lpApplicationName,\n _Inout_opt_ LPWSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCWSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOW lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ LPCSTR lpDllName,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW)\n{\n if (pfCreateProcessW == NULL) {\n pfCreateProcessW = CreateProcessW;\n }\n\n PROCESS_INFORMATION backup;\n if (lpProcessInformation == NULL) {\n lpProcessInformation = &backup;\n ZeroMemory(&backup, sizeof(backup));\n }\n\n if (!pfCreateProcessW(lpApplicationName,\n lpCommandLine,\n lpProcessAttributes,\n lpThreadAttributes,\n bInheritHandles,\n dwCreationFlags | CREATE_SUSPENDED,\n lpEnvironment,\n lpCurrentDirectory,\n lpStartupInfo,\n lpProcessInformation)) {\n return FALSE;\n }\n\n\n LPCSTR sz = lpDllName;\n\n if (!DetourUpdateProcessWithDll(lpProcessInformation->hProcess, &sz, 1) &&\n !DetourProcessViaHelperW(lpProcessInformation->dwProcessId,\n lpDllName,\n pfCreateProcessW)) {\n\n TerminateProcess(lpProcessInformation->hProcess, ~0u);\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n return FALSE;\n }\n\n if (!(dwCreationFlags & CREATE_SUSPENDED)) {\n ResumeThread(lpProcessInformation->hThread);\n }\n\n if (lpProcessInformation == &backup) {\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n }\n return TRUE;\n}\n\nBOOL WINAPI DetourCreateProcessWithDllsA(_In_opt_ LPCSTR lpApplicationName,\n _Inout_opt_ LPSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOA lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ DWORD nDlls,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA)\n{\n if (pfCreateProcessA == NULL) {\n pfCreateProcessA = CreateProcessA;\n }\n\n PROCESS_INFORMATION backup;\n if (lpProcessInformation == NULL) {\n lpProcessInformation = &backup;\n ZeroMemory(&backup, sizeof(backup));\n }\n\n if (!pfCreateProcessA(lpApplicationName,\n lpCommandLine,\n lpProcessAttributes,\n lpThreadAttributes,\n bInheritHandles,\n dwCreationFlags | CREATE_SUSPENDED,\n lpEnvironment,\n lpCurrentDirectory,\n lpStartupInfo,\n lpProcessInformation)) {\n return FALSE;\n }\n\n if (!DetourUpdateProcessWithDll(lpProcessInformation->hProcess, rlpDlls, nDlls) &&\n !DetourProcessViaHelperDllsA(lpProcessInformation->dwProcessId,\n nDlls,\n rlpDlls,\n pfCreateProcessA)) {\n\n TerminateProcess(lpProcessInformation->hProcess, ~0u);\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n return FALSE;\n }\n\n if (!(dwCreationFlags & CREATE_SUSPENDED)) {\n ResumeThread(lpProcessInformation->hThread);\n }\n\n if (lpProcessInformation == &backup) {\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n }\n\n return TRUE;\n}\n\nBOOL WINAPI DetourCreateProcessWithDllsW(_In_opt_ LPCWSTR lpApplicationName,\n _Inout_opt_ LPWSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCWSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOW lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ DWORD nDlls,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW)\n{\n if (pfCreateProcessW == NULL) {\n pfCreateProcessW = CreateProcessW;\n }\n\n PROCESS_INFORMATION backup;\n if (lpProcessInformation == NULL) {\n lpProcessInformation = &backup;\n ZeroMemory(&backup, sizeof(backup));\n }\n\n if (!pfCreateProcessW(lpApplicationName,\n lpCommandLine,\n lpProcessAttributes,\n lpThreadAttributes,\n bInheritHandles,\n dwCreationFlags | CREATE_SUSPENDED,\n lpEnvironment,\n lpCurrentDirectory,\n lpStartupInfo,\n lpProcessInformation)) {\n return FALSE;\n }\n\n\n if (!DetourUpdateProcessWithDll(lpProcessInformation->hProcess, rlpDlls, nDlls) &&\n !DetourProcessViaHelperDllsW(lpProcessInformation->dwProcessId,\n nDlls,\n rlpDlls,\n pfCreateProcessW)) {\n\n TerminateProcess(lpProcessInformation->hProcess, ~0u);\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n return FALSE;\n }\n\n if (!(dwCreationFlags & CREATE_SUSPENDED)) {\n ResumeThread(lpProcessInformation->hThread);\n }\n\n if (lpProcessInformation == &backup) {\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n }\n return TRUE;\n}\n#endif // !DETOURS_KERNEL\n\n//\n///////////////////////////////////////////////////////////////// End of File.\n"
},
{
"path": "Detours/detours.cpp",
"content": "//////////////////////////////////////////////////////////////////////////////\n//\n// Core Detours Functionality (detours.cpp of detours.lib)\n//\n// Microsoft Research Detours Package, Version 4.0.1\n//\n// Copyright (c) Microsoft Corporation. All rights reserved.\n//\n\n#pragma warning(disable:4068) // unknown pragma (suppress)\n\n#if _MSC_VER >= 1900\n#pragma warning(push)\n#pragma warning(disable:4091) // empty typedef\n#endif\n\n#define _CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS 1\n#define _ARM_WINAPI_PARTITION_DESKTOP_SDK_AVAILABLE 1\n\n#include \n\n#if (_MSC_VER < 1299)\n#pragma warning(disable: 4710)\n#endif\n\n// #define DETOUR_DEBUG 1\n#define DETOURS_INTERNAL\n\n#include \"detours.h\"\n\n#if DETOURS_VERSION != 0x4c0c1 // 0xMAJORcMINORcPATCH\n#error detours.h version mismatch\n#endif\n\n#if _MSC_VER >= 1900\n#pragma warning(pop)\n#endif\n\n#define NOTHROW\n\n//////////////////////////////////////////////////////////////////////////////\n//\nstruct _DETOUR_ALIGN\n{\n BYTE obTarget : 3;\n BYTE obTrampoline : 5;\n};\n\nC_ASSERT(sizeof(_DETOUR_ALIGN) == 1);\n\n//////////////////////////////////////////////////////////////////////////////\n//\n// Region reserved for system DLLs, which cannot be used for trampolines.\n//\nstatic PVOID s_pSystemRegionLowerBound = (PVOID)(ULONG_PTR)0x70000000;\nstatic PVOID s_pSystemRegionUpperBound = (PVOID)(ULONG_PTR)0x80000000;\n\n//////////////////////////////////////////////////////////////////////////////\n//\nstatic bool detour_is_imported(PBYTE pbCode, PBYTE pbAddress)\n{\n MEMORY_BASIC_INFORMATION mbi;\n VirtualQuery((PVOID)pbCode, &mbi, sizeof(mbi));\n __try {\n PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)mbi.AllocationBase;\n if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {\n return false;\n }\n\n PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader +\n pDosHeader->e_lfanew);\n if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) {\n return false;\n }\n\n if (pbAddress >= ((PBYTE)pDosHeader +\n pNtHeader->OptionalHeader\n .DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress) &&\n pbAddress < ((PBYTE)pDosHeader +\n pNtHeader->OptionalHeader\n .DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress +\n pNtHeader->OptionalHeader\n .DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size)) {\n return true;\n }\n }\n#pragma prefast(suppress:28940, \"A bad pointer means this probably isn't a PE header.\")\n __except(GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ?\n EXCEPTION_EXECUTE_HANDLER : EXCEPTION_CONTINUE_SEARCH) {\n return false;\n }\n return false;\n}\n\ninline ULONG_PTR detour_2gb_below(ULONG_PTR address)\n{\n return (address > (ULONG_PTR)0x7ff80000) ? address - 0x7ff80000 : 0x80000;\n}\n\ninline ULONG_PTR detour_2gb_above(ULONG_PTR address)\n{\n#if defined(DETOURS_64BIT)\n return (address < (ULONG_PTR)0xffffffff80000000) ? address + 0x7ff80000 : (ULONG_PTR)0xfffffffffff80000;\n#else\n return (address < (ULONG_PTR)0x80000000) ? address + 0x7ff80000 : (ULONG_PTR)0xfff80000;\n#endif\n}\n\n///////////////////////////////////////////////////////////////////////// X86.\n//\n#ifdef DETOURS_X86\n\nstruct _DETOUR_TRAMPOLINE\n{\n BYTE rbCode[30]; // target code + jmp to pbRemain\n BYTE cbCode; // size of moved target code.\n BYTE cbCodeBreak; // padding to make debugging easier.\n BYTE rbRestore[22]; // original target code.\n BYTE cbRestore; // size of original target code.\n BYTE cbRestoreBreak; // padding to make debugging easier.\n _DETOUR_ALIGN rAlign[8]; // instruction alignment array.\n PBYTE pbRemain; // first instruction after moved code. [free list]\n PBYTE pbDetour; // first instruction of detour function.\n};\n\nC_ASSERT(sizeof(_DETOUR_TRAMPOLINE) == 72);\n\nenum {\n SIZE_OF_JMP = 5\n};\n\ninline PBYTE detour_gen_jmp_immediate(PBYTE pbCode, PBYTE pbJmpVal)\n{\n PBYTE pbJmpSrc = pbCode + 5;\n *pbCode++ = 0xE9; // jmp +imm32\n *((INT32*&)pbCode)++ = (INT32)(pbJmpVal - pbJmpSrc);\n return pbCode;\n}\n\ninline PBYTE detour_gen_jmp_indirect(PBYTE pbCode, PBYTE *ppbJmpVal)\n{\n *pbCode++ = 0xff; // jmp [+imm32]\n *pbCode++ = 0x25;\n *((INT32*&)pbCode)++ = (INT32)((PBYTE)ppbJmpVal);\n return pbCode;\n}\n\ninline PBYTE detour_gen_brk(PBYTE pbCode, PBYTE pbLimit)\n{\n while (pbCode < pbLimit) {\n *pbCode++ = 0xcc; // brk;\n }\n return pbCode;\n}\n\ninline PBYTE detour_skip_jmp(PBYTE pbCode, PVOID *ppGlobals)\n{\n if (pbCode == NULL) {\n return NULL;\n }\n if (ppGlobals != NULL) {\n *ppGlobals = NULL;\n }\n\n // First, skip over the import vector if there is one.\n if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [imm32]\n // Looks like an import alias jump, then get the code it points to.\n PBYTE pbTarget = *(UNALIGNED PBYTE *)&pbCode[2];\n if (detour_is_imported(pbCode, pbTarget)) {\n PBYTE pbNew = *(UNALIGNED PBYTE *)pbTarget;\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n\n // Then, skip over a patch jump\n if (pbCode[0] == 0xeb) { // jmp +imm8\n PBYTE pbNew = pbCode + 2 + *(CHAR *)&pbCode[1];\n DETOUR_TRACE((\"%p->%p: skipped over short jump.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n\n // First, skip over the import vector if there is one.\n if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [imm32]\n // Looks like an import alias jump, then get the code it points to.\n PBYTE pbTarget = *(UNALIGNED PBYTE *)&pbCode[2];\n if (detour_is_imported(pbCode, pbTarget)) {\n pbNew = *(UNALIGNED PBYTE *)pbTarget;\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n // Finally, skip over a long jump if it is the target of the patch jump.\n else if (pbCode[0] == 0xe9) { // jmp +imm32\n pbNew = pbCode + 5 + *(UNALIGNED INT32 *)&pbCode[1];\n DETOUR_TRACE((\"%p->%p: skipped over long jump.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n return pbCode;\n}\n\ninline void detour_find_jmp_bounds(PBYTE pbCode,\n PDETOUR_TRAMPOLINE *ppLower,\n PDETOUR_TRAMPOLINE *ppUpper)\n{\n // We have to place trampolines within +/- 2GB of code.\n ULONG_PTR lo = detour_2gb_below((ULONG_PTR)pbCode);\n ULONG_PTR hi = detour_2gb_above((ULONG_PTR)pbCode);\n DETOUR_TRACE((\"[%Ix..%p..%Ix]\\n\", lo, pbCode, hi));\n\n // And, within +/- 2GB of relative jmp targets.\n if (pbCode[0] == 0xe9) { // jmp +imm32\n PBYTE pbNew = pbCode + 5 + *(UNALIGNED INT32 *)&pbCode[1];\n\n if (pbNew < pbCode) {\n hi = detour_2gb_above((ULONG_PTR)pbNew);\n }\n else {\n lo = detour_2gb_below((ULONG_PTR)pbNew);\n }\n DETOUR_TRACE((\"[%Ix..%p..%Ix] +imm32\\n\", lo, pbCode, hi));\n }\n\n *ppLower = (PDETOUR_TRAMPOLINE)lo;\n *ppUpper = (PDETOUR_TRAMPOLINE)hi;\n}\n\ninline BOOL detour_does_code_end_function(PBYTE pbCode)\n{\n if (pbCode[0] == 0xeb || // jmp +imm8\n pbCode[0] == 0xe9 || // jmp +imm32\n pbCode[0] == 0xe0 || // jmp eax\n pbCode[0] == 0xc2 || // ret +imm8\n pbCode[0] == 0xc3 || // ret\n pbCode[0] == 0xcc) { // brk\n return TRUE;\n }\n else if (pbCode[0] == 0xf3 && pbCode[1] == 0xc3) { // rep ret\n return TRUE;\n }\n else if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [+imm32]\n return TRUE;\n }\n else if ((pbCode[0] == 0x26 || // jmp es:\n pbCode[0] == 0x2e || // jmp cs:\n pbCode[0] == 0x36 || // jmp ss:\n pbCode[0] == 0x3e || // jmp ds:\n pbCode[0] == 0x64 || // jmp fs:\n pbCode[0] == 0x65) && // jmp gs:\n pbCode[1] == 0xff && // jmp [+imm32]\n pbCode[2] == 0x25) {\n return TRUE;\n }\n return FALSE;\n}\n\ninline ULONG detour_is_code_filler(PBYTE pbCode)\n{\n // 1-byte through 11-byte NOPs.\n if (pbCode[0] == 0x90) {\n return 1;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x90) {\n return 2;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x00) {\n return 3;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x40 &&\n pbCode[3] == 0x00) {\n return 4;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x44 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00) {\n return 5;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x0F && pbCode[2] == 0x1F &&\n pbCode[3] == 0x44 && pbCode[4] == 0x00 && pbCode[5] == 0x00) {\n return 6;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x80 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00) {\n return 7;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x84 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00) {\n return 8;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x0F && pbCode[2] == 0x1F &&\n pbCode[3] == 0x84 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00) {\n return 9;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x66 && pbCode[2] == 0x0F &&\n pbCode[3] == 0x1F && pbCode[4] == 0x84 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00 &&\n pbCode[9] == 0x00) {\n return 10;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x66 && pbCode[2] == 0x66 &&\n pbCode[3] == 0x0F && pbCode[4] == 0x1F && pbCode[5] == 0x84 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00 &&\n pbCode[9] == 0x00 && pbCode[10] == 0x00) {\n return 11;\n }\n\n // int 3.\n if (pbCode[0] == 0xcc) {\n return 1;\n }\n return 0;\n}\n\n#endif // DETOURS_X86\n\n///////////////////////////////////////////////////////////////////////// X64.\n//\n#ifdef DETOURS_X64\n\nstruct _DETOUR_TRAMPOLINE\n{\n // An X64 instuction can be 15 bytes long.\n // In practice 11 seems to be the limit.\n BYTE rbCode[30]; // target code + jmp to pbRemain.\n BYTE cbCode; // size of moved target code.\n BYTE cbCodeBreak; // padding to make debugging easier.\n BYTE rbRestore[30]; // original target code.\n BYTE cbRestore; // size of original target code.\n BYTE cbRestoreBreak; // padding to make debugging easier.\n _DETOUR_ALIGN rAlign[8]; // instruction alignment array.\n PBYTE pbRemain; // first instruction after moved code. [free list]\n PBYTE pbDetour; // first instruction of detour function.\n BYTE rbCodeIn[8]; // jmp [pbDetour]\n};\n\nC_ASSERT(sizeof(_DETOUR_TRAMPOLINE) == 96);\n\nenum {\n SIZE_OF_JMP = 5\n};\n\ninline PBYTE detour_gen_jmp_immediate(PBYTE pbCode, PBYTE pbJmpVal)\n{\n PBYTE pbJmpSrc = pbCode + 5;\n *pbCode++ = 0xE9; // jmp +imm32\n *((INT32*&)pbCode)++ = (INT32)(pbJmpVal - pbJmpSrc);\n return pbCode;\n}\n\ninline PBYTE detour_gen_jmp_indirect(PBYTE pbCode, PBYTE *ppbJmpVal)\n{\n PBYTE pbJmpSrc = pbCode + 6;\n *pbCode++ = 0xff; // jmp [+imm32]\n *pbCode++ = 0x25;\n *((INT32*&)pbCode)++ = (INT32)((PBYTE)ppbJmpVal - pbJmpSrc);\n return pbCode;\n}\n\ninline PBYTE detour_gen_brk(PBYTE pbCode, PBYTE pbLimit)\n{\n while (pbCode < pbLimit) {\n *pbCode++ = 0xcc; // brk;\n }\n return pbCode;\n}\n\ninline PBYTE detour_skip_jmp(PBYTE pbCode, PVOID *ppGlobals)\n{\n if (pbCode == NULL) {\n return NULL;\n }\n if (ppGlobals != NULL) {\n *ppGlobals = NULL;\n }\n\n // First, skip over the import vector if there is one.\n if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [+imm32]\n // Looks like an import alias jump, then get the code it points to.\n PBYTE pbTarget = pbCode + 6 + *(UNALIGNED INT32 *)&pbCode[2];\n if (detour_is_imported(pbCode, pbTarget)) {\n PBYTE pbNew = *(UNALIGNED PBYTE *)pbTarget;\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n\n // Then, skip over a patch jump\n if (pbCode[0] == 0xeb) { // jmp +imm8\n PBYTE pbNew = pbCode + 2 + *(CHAR *)&pbCode[1];\n DETOUR_TRACE((\"%p->%p: skipped over short jump.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n\n // First, skip over the import vector if there is one.\n if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [+imm32]\n // Looks like an import alias jump, then get the code it points to.\n PBYTE pbTarget = pbCode + 6 + *(UNALIGNED INT32 *)&pbCode[2];\n if (detour_is_imported(pbCode, pbTarget)) {\n pbNew = *(UNALIGNED PBYTE *)pbTarget;\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n // Finally, skip over a long jump if it is the target of the patch jump.\n else if (pbCode[0] == 0xe9) { // jmp +imm32\n pbNew = pbCode + 5 + *(UNALIGNED INT32 *)&pbCode[1];\n DETOUR_TRACE((\"%p->%p: skipped over long jump.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n return pbCode;\n}\n\ninline void detour_find_jmp_bounds(PBYTE pbCode,\n PDETOUR_TRAMPOLINE *ppLower,\n PDETOUR_TRAMPOLINE *ppUpper)\n{\n // We have to place trampolines within +/- 2GB of code.\n ULONG_PTR lo = detour_2gb_below((ULONG_PTR)pbCode);\n ULONG_PTR hi = detour_2gb_above((ULONG_PTR)pbCode);\n DETOUR_TRACE((\"[%Ix..%p..%Ix]\\n\", lo, pbCode, hi));\n\n // And, within +/- 2GB of relative jmp vectors.\n if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [+imm32]\n PBYTE pbNew = pbCode + 6 + *(UNALIGNED INT32 *)&pbCode[2];\n\n if (pbNew < pbCode) {\n hi = detour_2gb_above((ULONG_PTR)pbNew);\n }\n else {\n lo = detour_2gb_below((ULONG_PTR)pbNew);\n }\n DETOUR_TRACE((\"[%Ix..%p..%Ix] [+imm32]\\n\", lo, pbCode, hi));\n }\n // And, within +/- 2GB of relative jmp targets.\n else if (pbCode[0] == 0xe9) { // jmp +imm32\n PBYTE pbNew = pbCode + 5 + *(UNALIGNED INT32 *)&pbCode[1];\n\n if (pbNew < pbCode) {\n hi = detour_2gb_above((ULONG_PTR)pbNew);\n }\n else {\n lo = detour_2gb_below((ULONG_PTR)pbNew);\n }\n DETOUR_TRACE((\"[%Ix..%p..%Ix] +imm32\\n\", lo, pbCode, hi));\n }\n\n *ppLower = (PDETOUR_TRAMPOLINE)lo;\n *ppUpper = (PDETOUR_TRAMPOLINE)hi;\n}\n\ninline BOOL detour_does_code_end_function(PBYTE pbCode)\n{\n if (pbCode[0] == 0xeb || // jmp +imm8\n pbCode[0] == 0xe9 || // jmp +imm32\n pbCode[0] == 0xe0 || // jmp eax\n pbCode[0] == 0xc2 || // ret +imm8\n pbCode[0] == 0xc3 || // ret\n pbCode[0] == 0xcc) { // brk\n return TRUE;\n }\n else if (pbCode[0] == 0xf3 && pbCode[1] == 0xc3) { // rep ret\n return TRUE;\n }\n else if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [+imm32]\n return TRUE;\n }\n else if ((pbCode[0] == 0x26 || // jmp es:\n pbCode[0] == 0x2e || // jmp cs:\n pbCode[0] == 0x36 || // jmp ss:\n pbCode[0] == 0x3e || // jmp ds:\n pbCode[0] == 0x64 || // jmp fs:\n pbCode[0] == 0x65) && // jmp gs:\n pbCode[1] == 0xff && // jmp [+imm32]\n pbCode[2] == 0x25) {\n return TRUE;\n }\n return FALSE;\n}\n\ninline ULONG detour_is_code_filler(PBYTE pbCode)\n{\n // 1-byte through 11-byte NOPs.\n if (pbCode[0] == 0x90) {\n return 1;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x90) {\n return 2;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x00) {\n return 3;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x40 &&\n pbCode[3] == 0x00) {\n return 4;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x44 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00) {\n return 5;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x0F && pbCode[2] == 0x1F &&\n pbCode[3] == 0x44 && pbCode[4] == 0x00 && pbCode[5] == 0x00) {\n return 6;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x80 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00) {\n return 7;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x84 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00) {\n return 8;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x0F && pbCode[2] == 0x1F &&\n pbCode[3] == 0x84 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00) {\n return 9;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x66 && pbCode[2] == 0x0F &&\n pbCode[3] == 0x1F && pbCode[4] == 0x84 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00 &&\n pbCode[9] == 0x00) {\n return 10;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x66 && pbCode[2] == 0x66 &&\n pbCode[3] == 0x0F && pbCode[4] == 0x1F && pbCode[5] == 0x84 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00 &&\n pbCode[9] == 0x00 && pbCode[10] == 0x00) {\n return 11;\n }\n\n // int 3.\n if (pbCode[0] == 0xcc) {\n return 1;\n }\n return 0;\n}\n\n#endif // DETOURS_X64\n\n//////////////////////////////////////////////////////////////////////// IA64.\n//\n#ifdef DETOURS_IA64\n\nstruct _DETOUR_TRAMPOLINE\n{\n // On the IA64, a trampoline is used for both incoming and outgoing calls.\n //\n // The trampoline contains the following bundles for the outgoing call:\n // movl gp=target_gp;\n // \n // brl target_code;\n //\n // The trampoline contains the following bundles for the incoming call:\n // alloc r41=ar.pfs, b, 0, 8, 0\n // mov r40=rp\n //\n // adds r50=0, r39\n // adds r49=0, r38\n // adds r48=0, r37 ;;\n //\n // adds r47=0, r36\n // adds r46=0, r35\n // adds r45=0, r34\n //\n // adds r44=0, r33\n // adds r43=0, r32\n // adds r42=0, gp ;;\n //\n // movl gp=ffffffff`ffffffff ;;\n //\n // brl.call.sptk.few rp=disas!TestCodes+20e0 (00000000`00404ea0) ;;\n //\n // adds gp=0, r42\n // mov rp=r40, +0 ;;\n // mov.i ar.pfs=r41\n //\n // br.ret.sptk.many rp ;;\n //\n // This way, we only have to relocate a single bundle.\n //\n // The complicated incoming trampoline is required because we have to\n // create an additional stack frame so that we save and restore the gp.\n // We must do this because gp is a caller-saved register, but not saved\n // if the caller thinks the target is in the same DLL, which changes\n // when we insert a detour.\n //\n DETOUR_IA64_BUNDLE bMovlTargetGp; // Bundle which sets target GP\n BYTE rbCode[sizeof(DETOUR_IA64_BUNDLE)]; // moved bundle.\n DETOUR_IA64_BUNDLE bBrlRemainEip; // Brl to pbRemain\n // This must be adjacent to bBranchIslands.\n\n // Each instruction in the moved bundle could be a IP-relative chk or branch or call.\n // Any such instructions are changed to point to a brl in bBranchIslands.\n // This must be adjacent to bBrlRemainEip -- see \"pbPool\".\n DETOUR_IA64_BUNDLE bBranchIslands[DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE];\n\n // Target of brl inserted in target function\n DETOUR_IA64_BUNDLE bAllocFrame; // alloc frame\n DETOUR_IA64_BUNDLE bSave37to39; // save r37, r38, r39.\n DETOUR_IA64_BUNDLE bSave34to36; // save r34, r35, r36.\n DETOUR_IA64_BUNDLE bSaveGPto33; // save gp, r32, r33.\n DETOUR_IA64_BUNDLE bMovlDetourGp; // set detour GP.\n DETOUR_IA64_BUNDLE bCallDetour; // call detour.\n DETOUR_IA64_BUNDLE bPopFrameGp; // pop frame and restore gp.\n DETOUR_IA64_BUNDLE bReturn; // return to caller.\n\n PLABEL_DESCRIPTOR pldTrampoline;\n\n BYTE rbRestore[sizeof(DETOUR_IA64_BUNDLE)]; // original target bundle.\n BYTE cbRestore; // size of original target code.\n BYTE cbCode; // size of moved target code.\n _DETOUR_ALIGN rAlign[14]; // instruction alignment array.\n PBYTE pbRemain; // first instruction after moved code. [free list]\n PBYTE pbDetour; // first instruction of detour function.\n PPLABEL_DESCRIPTOR ppldDetour; // [pbDetour,gpDetour]\n PPLABEL_DESCRIPTOR ppldTarget; // [pbTarget,gpDetour]\n};\n\nC_ASSERT(sizeof(DETOUR_IA64_BUNDLE) == 16);\nC_ASSERT(sizeof(_DETOUR_TRAMPOLINE) == 256 + DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE * 16);\n\nenum {\n SIZE_OF_JMP = sizeof(DETOUR_IA64_BUNDLE)\n};\n\ninline PBYTE detour_skip_jmp(PBYTE pPointer, PVOID *ppGlobals)\n{\n PBYTE pGlobals = NULL;\n PBYTE pbCode = NULL;\n\n if (pPointer != NULL) {\n PPLABEL_DESCRIPTOR ppld = (PPLABEL_DESCRIPTOR)pPointer;\n pbCode = (PBYTE)ppld->EntryPoint;\n pGlobals = (PBYTE)ppld->GlobalPointer;\n }\n if (ppGlobals != NULL) {\n *ppGlobals = pGlobals;\n }\n if (pbCode == NULL) {\n return NULL;\n }\n\n DETOUR_IA64_BUNDLE *pb = (DETOUR_IA64_BUNDLE *)pbCode;\n\n // IA64 Local Import Jumps look like:\n // addl r2=ffffffff`ffe021c0, gp ;;\n // ld8 r2=[r2]\n // nop.i 0 ;;\n //\n // ld8 r3=[r2], 8 ;;\n // ld8 gp=[r2]\n // mov b6=r3, +0\n //\n // nop.m 0\n // nop.i 0\n // br.cond.sptk.few b6\n //\n\n // 002024000200100b\n if ((pb[0].wide[0] & 0xfffffc000603ffff) == 0x002024000200100b &&\n pb[0].wide[1] == 0x0004000000203008 &&\n pb[1].wide[0] == 0x001014180420180a &&\n pb[1].wide[1] == 0x07000830c0203008 &&\n pb[2].wide[0] == 0x0000000100000010 &&\n pb[2].wide[1] == 0x0080006000000200) {\n\n ULONG64 offset =\n ((pb[0].wide[0] & 0x0000000001fc0000) >> 18) | // imm7b\n ((pb[0].wide[0] & 0x000001ff00000000) >> 25) | // imm9d\n ((pb[0].wide[0] & 0x00000000f8000000) >> 11); // imm5c\n if (pb[0].wide[0] & 0x0000020000000000) { // sign\n offset |= 0xffffffffffe00000;\n }\n PBYTE pbTarget = pGlobals + offset;\n DETOUR_TRACE((\"%p: potential import jump, target=%p\\n\", pb, pbTarget));\n\n if (detour_is_imported(pbCode, pbTarget) && *(PBYTE*)pbTarget != NULL) {\n DETOUR_TRACE((\"%p: is import jump, label=%p\\n\", pb, *(PBYTE *)pbTarget));\n\n PPLABEL_DESCRIPTOR ppld = (PPLABEL_DESCRIPTOR)*(PBYTE *)pbTarget;\n pbCode = (PBYTE)ppld->EntryPoint;\n pGlobals = (PBYTE)ppld->GlobalPointer;\n if (ppGlobals != NULL) {\n *ppGlobals = pGlobals;\n }\n }\n }\n return pbCode;\n}\n\n\ninline void detour_find_jmp_bounds(PBYTE pbCode,\n PDETOUR_TRAMPOLINE *ppLower,\n PDETOUR_TRAMPOLINE *ppUpper)\n{\n (void)pbCode;\n *ppLower = (PDETOUR_TRAMPOLINE)(ULONG_PTR)0x0000000000080000;\n *ppUpper = (PDETOUR_TRAMPOLINE)(ULONG_PTR)0xfffffffffff80000;\n}\n\ninline BOOL detour_does_code_end_function(PBYTE pbCode)\n{\n // Routine not needed on IA64.\n (void)pbCode;\n return FALSE;\n}\n\ninline ULONG detour_is_code_filler(PBYTE pbCode)\n{\n // Routine not needed on IA64.\n (void)pbCode;\n return 0;\n}\n\n#endif // DETOURS_IA64\n\n#ifdef DETOURS_ARM\n\nstruct _DETOUR_TRAMPOLINE\n{\n // A Thumb-2 instruction can be 2 or 4 bytes long.\n BYTE rbCode[62]; // target code + jmp to pbRemain\n BYTE cbCode; // size of moved target code.\n BYTE cbCodeBreak; // padding to make debugging easier.\n BYTE rbRestore[22]; // original target code.\n BYTE cbRestore; // size of original target code.\n BYTE cbRestoreBreak; // padding to make debugging easier.\n _DETOUR_ALIGN rAlign[8]; // instruction alignment array.\n PBYTE pbRemain; // first instruction after moved code. [free list]\n PBYTE pbDetour; // first instruction of detour function.\n};\n\nC_ASSERT(sizeof(_DETOUR_TRAMPOLINE) == 104);\n\nenum {\n SIZE_OF_JMP = 8\n};\n\ninline PBYTE align4(PBYTE pValue)\n{\n return (PBYTE)(((ULONG)pValue) & ~(ULONG)3u);\n}\n\ninline ULONG fetch_thumb_opcode(PBYTE pbCode)\n{\n ULONG Opcode = *(UINT16 *)&pbCode[0];\n if (Opcode >= 0xe800) {\n Opcode = (Opcode << 16) | *(UINT16 *)&pbCode[2];\n }\n return Opcode;\n}\n\ninline void write_thumb_opcode(PBYTE &pbCode, ULONG Opcode)\n{\n if (Opcode >= 0x10000) {\n *((UINT16*&)pbCode)++ = Opcode >> 16;\n }\n *((UINT16*&)pbCode)++ = (UINT16)Opcode;\n}\n\nPBYTE detour_gen_jmp_immediate(PBYTE pbCode, PBYTE *ppPool, PBYTE pbJmpVal)\n{\n PBYTE pbLiteral;\n if (ppPool != NULL) {\n *ppPool = *ppPool - 4;\n pbLiteral = *ppPool;\n }\n else {\n pbLiteral = align4(pbCode + 6);\n }\n\n *((PBYTE*&)pbLiteral) = DETOURS_PBYTE_TO_PFUNC(pbJmpVal);\n LONG delta = pbLiteral - align4(pbCode + 4);\n\n write_thumb_opcode(pbCode, 0xf8dff000 | delta); // LDR PC,[PC+n]\n\n if (ppPool == NULL) {\n if (((ULONG)pbCode & 2) != 0) {\n write_thumb_opcode(pbCode, 0xdefe); // BREAK\n }\n pbCode += 4;\n }\n return pbCode;\n}\n\ninline PBYTE detour_gen_brk(PBYTE pbCode, PBYTE pbLimit)\n{\n while (pbCode < pbLimit) {\n write_thumb_opcode(pbCode, 0xdefe);\n }\n return pbCode;\n}\n\ninline PBYTE detour_skip_jmp(PBYTE pbCode, PVOID *ppGlobals)\n{\n if (pbCode == NULL) {\n return NULL;\n }\n if (ppGlobals != NULL) {\n *ppGlobals = NULL;\n }\n\n // Skip over the import jump if there is one.\n pbCode = (PBYTE)DETOURS_PFUNC_TO_PBYTE(pbCode);\n ULONG Opcode = fetch_thumb_opcode(pbCode);\n\n if ((Opcode & 0xfbf08f00) == 0xf2400c00) { // movw r12,#xxxx\n ULONG Opcode2 = fetch_thumb_opcode(pbCode+4);\n\n if ((Opcode2 & 0xfbf08f00) == 0xf2c00c00) { // movt r12,#xxxx\n ULONG Opcode3 = fetch_thumb_opcode(pbCode+8);\n if (Opcode3 == 0xf8dcf000) { // ldr pc,[r12]\n PBYTE pbTarget = (PBYTE)(((Opcode2 << 12) & 0xf7000000) |\n ((Opcode2 << 1) & 0x08000000) |\n ((Opcode2 << 16) & 0x00ff0000) |\n ((Opcode >> 4) & 0x0000f700) |\n ((Opcode >> 15) & 0x00000800) |\n ((Opcode >> 0) & 0x000000ff));\n if (detour_is_imported(pbCode, pbTarget)) {\n PBYTE pbNew = *(PBYTE *)pbTarget;\n pbNew = DETOURS_PFUNC_TO_PBYTE(pbNew);\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n return pbNew;\n }\n }\n }\n }\n return pbCode;\n}\n\ninline void detour_find_jmp_bounds(PBYTE pbCode,\n PDETOUR_TRAMPOLINE *ppLower,\n PDETOUR_TRAMPOLINE *ppUpper)\n{\n // We have to place trampolines within +/- 2GB of code.\n ULONG_PTR lo = detour_2gb_below((ULONG_PTR)pbCode);\n ULONG_PTR hi = detour_2gb_above((ULONG_PTR)pbCode);\n DETOUR_TRACE((\"[%p..%p..%p]\\n\", lo, pbCode, hi));\n\n *ppLower = (PDETOUR_TRAMPOLINE)lo;\n *ppUpper = (PDETOUR_TRAMPOLINE)hi;\n}\n\n\ninline BOOL detour_does_code_end_function(PBYTE pbCode)\n{\n ULONG Opcode = fetch_thumb_opcode(pbCode);\n if ((Opcode & 0xffffff87) == 0x4700 || // bx \n (Opcode & 0xf800d000) == 0xf0009000) { // b \n return TRUE;\n }\n if ((Opcode & 0xffff8000) == 0xe8bd8000) { // pop {...,pc}\n __debugbreak();\n return TRUE;\n }\n if ((Opcode & 0xffffff00) == 0x0000bd00) { // pop {...,pc}\n __debugbreak();\n return TRUE;\n }\n return FALSE;\n}\n\ninline ULONG detour_is_code_filler(PBYTE pbCode)\n{\n if (pbCode[0] == 0x00 && pbCode[1] == 0xbf) { // nop.\n return 2;\n }\n if (pbCode[0] == 0x00 && pbCode[1] == 0x00) { // zero-filled padding.\n return 2;\n }\n return 0;\n}\n\n#endif // DETOURS_ARM\n\n#ifdef DETOURS_ARM64\n\nstruct _DETOUR_TRAMPOLINE\n{\n // An ARM64 instruction is 4 bytes long.\n BYTE rbCode[64]; // target code + jmp to pbRemain\n BYTE cbCode; // size of moved target code.\n BYTE cbCodeBreak[3]; // padding to make debugging easier.\n BYTE rbRestore[24]; // original target code.\n BYTE cbRestore; // size of original target code.\n BYTE cbRestoreBreak[3]; // padding to make debugging easier.\n _DETOUR_ALIGN rAlign[8]; // instruction alignment array.\n PBYTE pbRemain; // first instruction after moved code. [free list]\n PBYTE pbDetour; // first instruction of detour function.\n};\n\nC_ASSERT(sizeof(_DETOUR_TRAMPOLINE) == 120);\n\nenum {\n SIZE_OF_JMP = 8\n};\n\ninline ULONG fetch_opcode(PBYTE pbCode)\n{\n return *(ULONG *)pbCode;\n}\n\ninline void write_opcode(PBYTE &pbCode, ULONG Opcode)\n{\n *(ULONG *)pbCode = Opcode;\n pbCode += 4;\n}\n\nPBYTE detour_gen_jmp_immediate(PBYTE pbCode, PBYTE *ppPool, PBYTE pbJmpVal)\n{\n PBYTE pbLiteral;\n if (ppPool != NULL) {\n *ppPool = *ppPool - 8;\n pbLiteral = *ppPool;\n }\n else {\n pbLiteral = pbCode + 2*4;\n }\n\n *((PBYTE*&)pbLiteral) = pbJmpVal;\n LONG delta = (LONG)(pbLiteral - pbCode);\n\n write_opcode(pbCode, 0x58000011 | ((delta / 4) << 5)); // LDR X17,[PC+n]\n write_opcode(pbCode, 0xd61f0000 | (17 << 5)); // BR X17\n\n if (ppPool == NULL) {\n pbCode += 8;\n }\n return pbCode;\n}\n\ninline PBYTE detour_gen_brk(PBYTE pbCode, PBYTE pbLimit)\n{\n while (pbCode < pbLimit) {\n write_opcode(pbCode, 0xd4100000 | (0xf000 << 5));\n }\n return pbCode;\n}\n\ninline PBYTE detour_skip_jmp(PBYTE pbCode, PVOID *ppGlobals)\n{\n if (pbCode == NULL) {\n return NULL;\n }\n if (ppGlobals != NULL) {\n *ppGlobals = NULL;\n }\n\n // Skip over the import jump if there is one.\n pbCode = (PBYTE)pbCode;\n ULONG Opcode = fetch_opcode(pbCode);\n if ((Opcode & 0x9f00001f) == 0x90000010) { // adrp x16, IAT\n ULONG Opcode2 = fetch_opcode(pbCode+4);\n\n if ((Opcode2 & 0xffe003ff) == 0xf9400210) { // ldr x16, [x16, IAT]\n ULONG Opcode3 = fetch_opcode(pbCode+8);\n\n if (Opcode3 == 0xd61f0200) { // br x16\n\n ULONG PageOffset = ((Opcode & 0x60000000) >> 29) | ((Opcode & 0x00ffffe0) >> 3);\n PageOffset = (LONG)(Opcode << 11) >> 11;\n\n PBYTE pbTarget = (PBYTE)(((ULONG64)pbCode & 0xfffffffffffff000ULL) + PageOffset +\n ((Opcode2 >> 10) & 0xfff));\n if (detour_is_imported(pbCode, pbTarget)) {\n PBYTE pbNew = *(PBYTE *)pbTarget;\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n return pbNew;\n }\n }\n }\n }\n return pbCode;\n}\n\ninline void detour_find_jmp_bounds(PBYTE pbCode,\n PDETOUR_TRAMPOLINE* ppLower,\n PDETOUR_TRAMPOLINE* ppUpper)\n{\n // The encoding used by detour_gen_jmp_indirect actually enables a\n // displacement of +/- 4GiB. In the future, this could be changed to\n // reflect that. For now, just reuse the x86 logic which is plenty.\n\n ULONG_PTR lo = detour_2gb_below((ULONG_PTR)pbCode);\n ULONG_PTR hi = detour_2gb_above((ULONG_PTR)pbCode);\n DETOUR_TRACE((\"[%p..%p..%p]\\n\", (PVOID)lo, pbCode, (PVOID)hi));\n\n *ppLower = (PDETOUR_TRAMPOLINE)lo;\n *ppUpper = (PDETOUR_TRAMPOLINE)hi;\n}\n\ninline BOOL detour_does_code_end_function(PBYTE pbCode)\n{\n ULONG Opcode = fetch_opcode(pbCode);\n if ((Opcode & 0xfffffc1f) == 0xd65f0000 || // br \n (Opcode & 0xfc000000) == 0x14000000) { // b \n return TRUE;\n }\n return FALSE;\n}\n\ninline ULONG detour_is_code_filler(PBYTE pbCode)\n{\n if (*(ULONG *)pbCode == 0xd503201f) { // nop.\n return 4;\n }\n if (*(ULONG *)pbCode == 0x00000000) { // zero-filled padding.\n return 4;\n }\n return 0;\n}\n\n#endif // DETOURS_ARM64\n\n//////////////////////////////////////////////// Trampoline Memory Management.\n//\nstruct DETOUR_REGION\n{\n ULONG dwSignature;\n DETOUR_REGION * pNext; // Next region in list of regions.\n DETOUR_TRAMPOLINE * pFree; // List of free trampolines in this region.\n};\ntypedef DETOUR_REGION * PDETOUR_REGION;\n\nconst ULONG DETOUR_REGION_SIGNATURE = 'Rrtd';\nconst ULONG DETOUR_REGION_SIZE = 0x10000;\nconst ULONG DETOUR_TRAMPOLINES_PER_REGION = (DETOUR_REGION_SIZE\n / sizeof(DETOUR_TRAMPOLINE)) - 1;\nstatic PDETOUR_REGION s_pRegions = NULL; // List of all regions.\nstatic PDETOUR_REGION s_pRegion = NULL; // Default region.\n\nstatic DWORD detour_writable_trampoline_regions()\n{\n // Mark all of the regions as writable.\n for (PDETOUR_REGION pRegion = s_pRegions; pRegion != NULL; pRegion = pRegion->pNext) {\n DWORD dwOld;\n if (!VirtualProtect(pRegion, DETOUR_REGION_SIZE, PAGE_EXECUTE_READWRITE, &dwOld)) {\n return GetLastError();\n }\n }\n return NO_ERROR;\n}\n\nstatic void detour_runnable_trampoline_regions()\n{\n HANDLE hProcess = GetCurrentProcess();\n\n // Mark all of the regions as executable.\n for (PDETOUR_REGION pRegion = s_pRegions; pRegion != NULL; pRegion = pRegion->pNext) {\n DWORD dwOld;\n VirtualProtect(pRegion, DETOUR_REGION_SIZE, PAGE_EXECUTE_READ, &dwOld);\n FlushInstructionCache(hProcess, pRegion, DETOUR_REGION_SIZE);\n }\n}\n\nstatic PBYTE detour_alloc_round_down_to_region(PBYTE pbTry)\n{\n // WinXP64 returns free areas that aren't REGION aligned to 32-bit applications.\n ULONG_PTR extra = ((ULONG_PTR)pbTry) & (DETOUR_REGION_SIZE - 1);\n if (extra != 0) {\n pbTry -= extra;\n }\n return pbTry;\n}\n\nstatic PBYTE detour_alloc_round_up_to_region(PBYTE pbTry)\n{\n // WinXP64 returns free areas that aren't REGION aligned to 32-bit applications.\n ULONG_PTR extra = ((ULONG_PTR)pbTry) & (DETOUR_REGION_SIZE - 1);\n if (extra != 0) {\n ULONG_PTR adjust = DETOUR_REGION_SIZE - extra;\n pbTry += adjust;\n }\n return pbTry;\n}\n\n// Starting at pbLo, try to allocate a memory region, continue until pbHi.\n\nstatic PVOID detour_alloc_region_from_lo(PBYTE pbLo, PBYTE pbHi)\n{\n PBYTE pbTry = detour_alloc_round_up_to_region(pbLo);\n\n DETOUR_TRACE((\" Looking for free region in %p..%p from %p:\\n\", pbLo, pbHi, pbTry));\n\n for (; pbTry < pbHi;) {\n MEMORY_BASIC_INFORMATION mbi;\n\n if (pbTry >= s_pSystemRegionLowerBound && pbTry <= s_pSystemRegionUpperBound) {\n // Skip region reserved for system DLLs, but preserve address space entropy.\n pbTry += 0x08000000;\n continue;\n }\n\n ZeroMemory(&mbi, sizeof(mbi));\n if (!VirtualQuery(pbTry, &mbi, sizeof(mbi))) {\n break;\n }\n\n DETOUR_TRACE((\" Try %p => %p..%p %6lx\\n\",\n pbTry,\n mbi.BaseAddress,\n (PBYTE)mbi.BaseAddress + mbi.RegionSize - 1,\n mbi.State));\n\n if (mbi.State == MEM_FREE && mbi.RegionSize >= DETOUR_REGION_SIZE) {\n\n PVOID pv = VirtualAlloc(pbTry,\n DETOUR_REGION_SIZE,\n MEM_COMMIT|MEM_RESERVE,\n PAGE_EXECUTE_READWRITE);\n if (pv != NULL) {\n return pv;\n }\n pbTry += DETOUR_REGION_SIZE;\n }\n else {\n pbTry = detour_alloc_round_up_to_region((PBYTE)mbi.BaseAddress + mbi.RegionSize);\n }\n }\n return NULL;\n}\n\n// Starting at pbHi, try to allocate a memory region, continue until pbLo.\n\nstatic PVOID detour_alloc_region_from_hi(PBYTE pbLo, PBYTE pbHi)\n{\n PBYTE pbTry = detour_alloc_round_down_to_region(pbHi - DETOUR_REGION_SIZE);\n\n DETOUR_TRACE((\" Looking for free region in %p..%p from %p:\\n\", pbLo, pbHi, pbTry));\n\n for (; pbTry > pbLo;) {\n MEMORY_BASIC_INFORMATION mbi;\n\n DETOUR_TRACE((\" Try %p\\n\", pbTry));\n if (pbTry >= s_pSystemRegionLowerBound && pbTry <= s_pSystemRegionUpperBound) {\n // Skip region reserved for system DLLs, but preserve address space entropy.\n pbTry -= 0x08000000;\n continue;\n }\n\n ZeroMemory(&mbi, sizeof(mbi));\n if (!VirtualQuery(pbTry, &mbi, sizeof(mbi))) {\n break;\n }\n\n DETOUR_TRACE((\" Try %p => %p..%p %6lx\\n\",\n pbTry,\n mbi.BaseAddress,\n (PBYTE)mbi.BaseAddress + mbi.RegionSize - 1,\n mbi.State));\n\n if (mbi.State == MEM_FREE && mbi.RegionSize >= DETOUR_REGION_SIZE) {\n\n PVOID pv = VirtualAlloc(pbTry,\n DETOUR_REGION_SIZE,\n MEM_COMMIT|MEM_RESERVE,\n PAGE_EXECUTE_READWRITE);\n if (pv != NULL) {\n return pv;\n }\n pbTry -= DETOUR_REGION_SIZE;\n }\n else {\n pbTry = detour_alloc_round_down_to_region((PBYTE)mbi.AllocationBase\n - DETOUR_REGION_SIZE);\n }\n }\n return NULL;\n}\n\nstatic PDETOUR_TRAMPOLINE detour_alloc_trampoline(PBYTE pbTarget)\n{\n // We have to place trampolines within +/- 2GB of target.\n\n PDETOUR_TRAMPOLINE pLo;\n PDETOUR_TRAMPOLINE pHi;\n\n detour_find_jmp_bounds(pbTarget, &pLo, &pHi);\n\n PDETOUR_TRAMPOLINE pTrampoline = NULL;\n\n // Insure that there is a default region.\n if (s_pRegion == NULL && s_pRegions != NULL) {\n s_pRegion = s_pRegions;\n }\n\n // First check the default region for an valid free block.\n if (s_pRegion != NULL && s_pRegion->pFree != NULL &&\n s_pRegion->pFree >= pLo && s_pRegion->pFree <= pHi) {\n\n found_region:\n pTrampoline = s_pRegion->pFree;\n // do a last sanity check on region.\n if (pTrampoline < pLo || pTrampoline > pHi) {\n return NULL;\n }\n s_pRegion->pFree = (PDETOUR_TRAMPOLINE)pTrampoline->pbRemain;\n memset(pTrampoline, 0xcc, sizeof(*pTrampoline));\n return pTrampoline;\n }\n\n // Then check the existing regions for a valid free block.\n for (s_pRegion = s_pRegions; s_pRegion != NULL; s_pRegion = s_pRegion->pNext) {\n if (s_pRegion != NULL && s_pRegion->pFree != NULL &&\n s_pRegion->pFree >= pLo && s_pRegion->pFree <= pHi) {\n goto found_region;\n }\n }\n\n // We need to allocate a new region.\n\n // Round pbTarget down to 64KB block.\n pbTarget = pbTarget - (PtrToUlong(pbTarget) & 0xffff);\n\n PVOID pbTry = NULL;\n\n // NB: We must always also start the search at an offset from pbTarget\n // in order to maintain ASLR entropy.\n\n#if defined(DETOURS_64BIT)\n // Try looking 1GB below or lower.\n if (pbTry == NULL && pbTarget > (PBYTE)0x40000000) {\n pbTry = detour_alloc_region_from_hi((PBYTE)pLo, pbTarget - 0x40000000);\n }\n // Try looking 1GB above or higher.\n if (pbTry == NULL && pbTarget < (PBYTE)0xffffffff40000000) {\n pbTry = detour_alloc_region_from_lo(pbTarget + 0x40000000, (PBYTE)pHi);\n }\n // Try looking 1GB below or higher.\n if (pbTry == NULL && pbTarget > (PBYTE)0x40000000) {\n pbTry = detour_alloc_region_from_lo(pbTarget - 0x40000000, pbTarget);\n }\n // Try looking 1GB above or lower.\n if (pbTry == NULL && pbTarget < (PBYTE)0xffffffff40000000) {\n pbTry = detour_alloc_region_from_hi(pbTarget, pbTarget + 0x40000000);\n }\n#endif\n\n // Try anything below.\n if (pbTry == NULL) {\n pbTry = detour_alloc_region_from_hi((PBYTE)pLo, pbTarget);\n }\n // try anything above.\n if (pbTry == NULL) {\n pbTry = detour_alloc_region_from_lo(pbTarget, (PBYTE)pHi);\n }\n\n if (pbTry != NULL) {\n s_pRegion = (DETOUR_REGION*)pbTry;\n s_pRegion->dwSignature = DETOUR_REGION_SIGNATURE;\n s_pRegion->pFree = NULL;\n s_pRegion->pNext = s_pRegions;\n s_pRegions = s_pRegion;\n DETOUR_TRACE((\" Allocated region %p..%p\\n\\n\",\n (void*)s_pRegion, ((PBYTE)s_pRegion) + DETOUR_REGION_SIZE - 1));\n\n // Put everything but the first trampoline on the free list.\n PBYTE pFree = NULL;\n pTrampoline = ((PDETOUR_TRAMPOLINE)s_pRegion) + 1;\n for (int i = DETOUR_TRAMPOLINES_PER_REGION - 1; i > 1; i--) {\n pTrampoline[i].pbRemain = pFree;\n pFree = (PBYTE)&pTrampoline[i];\n }\n s_pRegion->pFree = (PDETOUR_TRAMPOLINE)pFree;\n goto found_region;\n }\n\n DETOUR_TRACE((\"Couldn't find available memory region!\\n\"));\n return NULL;\n}\n\nstatic void detour_free_trampoline(PDETOUR_TRAMPOLINE pTrampoline)\n{\n PDETOUR_REGION pRegion = (PDETOUR_REGION)\n ((ULONG_PTR)pTrampoline & ~(ULONG_PTR)0xffff);\n\n memset(pTrampoline, 0, sizeof(*pTrampoline));\n pTrampoline->pbRemain = (PBYTE)pRegion->pFree;\n pRegion->pFree = pTrampoline;\n}\n\nstatic BOOL detour_is_region_empty(PDETOUR_REGION pRegion)\n{\n // Stop if the region isn't a region (this would be bad).\n if (pRegion->dwSignature != DETOUR_REGION_SIGNATURE) {\n return FALSE;\n }\n\n PBYTE pbRegionBeg = (PBYTE)pRegion;\n PBYTE pbRegionLim = pbRegionBeg + DETOUR_REGION_SIZE;\n\n // Stop if any of the trampolines aren't free.\n PDETOUR_TRAMPOLINE pTrampoline = ((PDETOUR_TRAMPOLINE)pRegion) + 1;\n for (int i = 0; i < DETOUR_TRAMPOLINES_PER_REGION; i++) {\n if (pTrampoline[i].pbRemain != NULL &&\n (pTrampoline[i].pbRemain < pbRegionBeg ||\n pTrampoline[i].pbRemain >= pbRegionLim)) {\n return FALSE;\n }\n }\n\n // OK, the region is empty.\n return TRUE;\n}\n\nstatic void detour_free_unused_trampoline_regions()\n{\n PDETOUR_REGION *ppRegionBase = &s_pRegions;\n PDETOUR_REGION pRegion = s_pRegions;\n\n while (pRegion != NULL) {\n if (detour_is_region_empty(pRegion)) {\n *ppRegionBase = pRegion->pNext;\n\n VirtualFree(pRegion, 0, MEM_RELEASE);\n s_pRegion = NULL;\n }\n else {\n ppRegionBase = &pRegion->pNext;\n }\n pRegion = *ppRegionBase;\n }\n}\n\n///////////////////////////////////////////////////////// Transaction Structs.\n//\nstruct DetourThread\n{\n DetourThread * pNext;\n HANDLE hThread;\n};\n\nstruct DetourOperation\n{\n DetourOperation * pNext;\n BOOL fIsRemove;\n PBYTE * ppbPointer;\n PBYTE pbTarget;\n PDETOUR_TRAMPOLINE pTrampoline;\n ULONG dwPerm;\n};\n\nstatic BOOL s_fIgnoreTooSmall = FALSE;\nstatic BOOL s_fRetainRegions = FALSE;\n\nstatic LONG s_nPendingThreadId = 0; // Thread owning pending transaction.\nstatic LONG s_nPendingError = NO_ERROR;\nstatic PVOID * s_ppPendingError = NULL;\nstatic DetourThread * s_pPendingThreads = NULL;\nstatic DetourOperation * s_pPendingOperations = NULL;\n\n//////////////////////////////////////////////////////////////////////////////\n//\nPVOID WINAPI DetourCodeFromPointer(_In_ PVOID pPointer,\n _Out_opt_ PVOID *ppGlobals)\n{\n return detour_skip_jmp((PBYTE)pPointer, ppGlobals);\n}\n\n//////////////////////////////////////////////////////////// Transaction APIs.\n//\nBOOL WINAPI DetourSetIgnoreTooSmall(_In_ BOOL fIgnore)\n{\n BOOL fPrevious = s_fIgnoreTooSmall;\n s_fIgnoreTooSmall = fIgnore;\n return fPrevious;\n}\n\nBOOL WINAPI DetourSetRetainRegions(_In_ BOOL fRetain)\n{\n BOOL fPrevious = s_fRetainRegions;\n s_fRetainRegions = fRetain;\n return fPrevious;\n}\n\nPVOID WINAPI DetourSetSystemRegionLowerBound(_In_ PVOID pSystemRegionLowerBound)\n{\n PVOID pPrevious = s_pSystemRegionLowerBound;\n s_pSystemRegionLowerBound = pSystemRegionLowerBound;\n return pPrevious;\n}\n\nPVOID WINAPI DetourSetSystemRegionUpperBound(_In_ PVOID pSystemRegionUpperBound)\n{\n PVOID pPrevious = s_pSystemRegionUpperBound;\n s_pSystemRegionUpperBound = pSystemRegionUpperBound;\n return pPrevious;\n}\n\nLONG WINAPI DetourTransactionBegin()\n{\n // Only one transaction is allowed at a time.\n_Benign_race_begin_\n if (s_nPendingThreadId != 0) {\n return ERROR_INVALID_OPERATION;\n }\n_Benign_race_end_\n\n // Make sure only one thread can start a transaction.\n if (InterlockedCompareExchange(&s_nPendingThreadId, (LONG)GetCurrentThreadId(), 0) != 0) {\n return ERROR_INVALID_OPERATION;\n }\n\n s_pPendingOperations = NULL;\n s_pPendingThreads = NULL;\n s_ppPendingError = NULL;\n\n // Make sure the trampoline pages are writable.\n s_nPendingError = detour_writable_trampoline_regions();\n\n return s_nPendingError;\n}\n\nLONG WINAPI DetourTransactionAbort()\n{\n if (s_nPendingThreadId != (LONG)GetCurrentThreadId()) {\n return ERROR_INVALID_OPERATION;\n }\n\n // Restore all of the page permissions.\n for (DetourOperation *o = s_pPendingOperations; o != NULL;) {\n // We don't care if this fails, because the code is still accessible.\n DWORD dwOld;\n VirtualProtect(o->pbTarget, o->pTrampoline->cbRestore,\n o->dwPerm, &dwOld);\n\n if (!o->fIsRemove) {\n if (o->pTrampoline) {\n detour_free_trampoline(o->pTrampoline);\n o->pTrampoline = NULL;\n }\n }\n\n DetourOperation *n = o->pNext;\n delete o;\n o = n;\n }\n s_pPendingOperations = NULL;\n\n // Make sure the trampoline pages are no longer writable.\n detour_runnable_trampoline_regions();\n\n // Resume any suspended threads.\n for (DetourThread *t = s_pPendingThreads; t != NULL;) {\n // There is nothing we can do if this fails.\n ResumeThread(t->hThread);\n\n DetourThread *n = t->pNext;\n delete t;\n t = n;\n }\n s_pPendingThreads = NULL;\n s_nPendingThreadId = 0;\n\n return NO_ERROR;\n}\n\nLONG WINAPI DetourTransactionCommit()\n{\n return DetourTransactionCommitEx(NULL);\n}\n\nstatic BYTE detour_align_from_trampoline(PDETOUR_TRAMPOLINE pTrampoline, BYTE obTrampoline)\n{\n for (LONG n = 0; n < ARRAYSIZE(pTrampoline->rAlign); n++) {\n if (pTrampoline->rAlign[n].obTrampoline == obTrampoline) {\n return pTrampoline->rAlign[n].obTarget;\n }\n }\n return 0;\n}\n\nstatic LONG detour_align_from_target(PDETOUR_TRAMPOLINE pTrampoline, LONG obTarget)\n{\n for (LONG n = 0; n < ARRAYSIZE(pTrampoline->rAlign); n++) {\n if (pTrampoline->rAlign[n].obTarget == obTarget) {\n return pTrampoline->rAlign[n].obTrampoline;\n }\n }\n return 0;\n}\n\nLONG WINAPI DetourTransactionCommitEx(_Out_opt_ PVOID **pppFailedPointer)\n{\n if (pppFailedPointer != NULL) {\n // Used to get the last error.\n *pppFailedPointer = s_ppPendingError;\n }\n if (s_nPendingThreadId != (LONG)GetCurrentThreadId()) {\n return ERROR_INVALID_OPERATION;\n }\n\n // If any of the pending operations failed, then we abort the whole transaction.\n if (s_nPendingError != NO_ERROR) {\n DETOUR_BREAK();\n DetourTransactionAbort();\n return s_nPendingError;\n }\n\n // Common variables.\n DetourOperation *o;\n DetourThread *t;\n BOOL freed = FALSE;\n\n // Insert or remove each of the detours.\n for (o = s_pPendingOperations; o != NULL; o = o->pNext) {\n if (o->fIsRemove) {\n CopyMemory(o->pbTarget,\n o->pTrampoline->rbRestore,\n o->pTrampoline->cbRestore);\n#ifdef DETOURS_IA64\n *o->ppbPointer = (PBYTE)o->pTrampoline->ppldTarget;\n#endif // DETOURS_IA64\n\n#ifdef DETOURS_X86\n *o->ppbPointer = o->pbTarget;\n#endif // DETOURS_X86\n\n#ifdef DETOURS_X64\n *o->ppbPointer = o->pbTarget;\n#endif // DETOURS_X64\n\n#ifdef DETOURS_ARM\n *o->ppbPointer = DETOURS_PBYTE_TO_PFUNC(o->pbTarget);\n#endif // DETOURS_ARM\n\n#ifdef DETOURS_ARM64\n *o->ppbPointer = o->pbTarget;\n#endif // DETOURS_ARM\n }\n else {\n DETOUR_TRACE((\"detours: pbTramp =%p, pbRemain=%p, pbDetour=%p, cbRestore=%d\\n\",\n (void*)o->pTrampoline,\n o->pTrampoline->pbRemain,\n o->pTrampoline->pbDetour,\n o->pTrampoline->cbRestore));\n\n DETOUR_TRACE((\"detours: pbTarget=%p: \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x [before]\\n\",\n o->pbTarget,\n o->pbTarget[0], o->pbTarget[1], o->pbTarget[2], o->pbTarget[3],\n o->pbTarget[4], o->pbTarget[5], o->pbTarget[6], o->pbTarget[7],\n o->pbTarget[8], o->pbTarget[9], o->pbTarget[10], o->pbTarget[11]));\n\n#ifdef DETOURS_IA64\n ((DETOUR_IA64_BUNDLE*)o->pbTarget)\n ->SetBrl((UINT64)&o->pTrampoline->bAllocFrame);\n *o->ppbPointer = (PBYTE)&o->pTrampoline->pldTrampoline;\n#endif // DETOURS_IA64\n\n#ifdef DETOURS_X64\n detour_gen_jmp_indirect(o->pTrampoline->rbCodeIn, &o->pTrampoline->pbDetour);\n PBYTE pbCode = detour_gen_jmp_immediate(o->pbTarget, o->pTrampoline->rbCodeIn);\n pbCode = detour_gen_brk(pbCode, o->pTrampoline->pbRemain);\n *o->ppbPointer = o->pTrampoline->rbCode;\n UNREFERENCED_PARAMETER(pbCode);\n#endif // DETOURS_X64\n\n#ifdef DETOURS_X86\n PBYTE pbCode = detour_gen_jmp_immediate(o->pbTarget, o->pTrampoline->pbDetour);\n pbCode = detour_gen_brk(pbCode, o->pTrampoline->pbRemain);\n *o->ppbPointer = o->pTrampoline->rbCode;\n UNREFERENCED_PARAMETER(pbCode);\n#endif // DETOURS_X86\n\n#ifdef DETOURS_ARM\n PBYTE pbCode = detour_gen_jmp_immediate(o->pbTarget, NULL, o->pTrampoline->pbDetour);\n pbCode = detour_gen_brk(pbCode, o->pTrampoline->pbRemain);\n *o->ppbPointer = DETOURS_PBYTE_TO_PFUNC(o->pTrampoline->rbCode);\n UNREFERENCED_PARAMETER(pbCode);\n#endif // DETOURS_ARM\n\n#ifdef DETOURS_ARM64\n PBYTE pbCode = detour_gen_jmp_immediate(o->pbTarget, NULL, o->pTrampoline->pbDetour);\n pbCode = detour_gen_brk(pbCode, o->pTrampoline->pbRemain);\n *o->ppbPointer = o->pTrampoline->rbCode;\n UNREFERENCED_PARAMETER(pbCode);\n#endif // DETOURS_ARM64\n\n DETOUR_TRACE((\"detours: pbTarget=%p: \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x [after]\\n\",\n o->pbTarget,\n o->pbTarget[0], o->pbTarget[1], o->pbTarget[2], o->pbTarget[3],\n o->pbTarget[4], o->pbTarget[5], o->pbTarget[6], o->pbTarget[7],\n o->pbTarget[8], o->pbTarget[9], o->pbTarget[10], o->pbTarget[11]));\n\n DETOUR_TRACE((\"detours: pbTramp =%p: \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x\\n\",\n (void*)o->pTrampoline,\n o->pTrampoline->rbCode[0], o->pTrampoline->rbCode[1],\n o->pTrampoline->rbCode[2], o->pTrampoline->rbCode[3],\n o->pTrampoline->rbCode[4], o->pTrampoline->rbCode[5],\n o->pTrampoline->rbCode[6], o->pTrampoline->rbCode[7],\n o->pTrampoline->rbCode[8], o->pTrampoline->rbCode[9],\n o->pTrampoline->rbCode[10], o->pTrampoline->rbCode[11]));\n\n#ifdef DETOURS_IA64\n DETOUR_TRACE((\"\\n\"));\n DETOUR_TRACE((\"detours: &pldTrampoline =%p\\n\",\n &o->pTrampoline->pldTrampoline));\n DETOUR_TRACE((\"detours: &bMovlTargetGp =%p [%p]\\n\",\n &o->pTrampoline->bMovlTargetGp,\n o->pTrampoline->bMovlTargetGp.GetMovlGp()));\n DETOUR_TRACE((\"detours: &rbCode =%p [%p]\\n\",\n &o->pTrampoline->rbCode,\n ((DETOUR_IA64_BUNDLE&)o->pTrampoline->rbCode).GetBrlTarget()));\n DETOUR_TRACE((\"detours: &bBrlRemainEip =%p [%p]\\n\",\n &o->pTrampoline->bBrlRemainEip,\n o->pTrampoline->bBrlRemainEip.GetBrlTarget()));\n DETOUR_TRACE((\"detours: &bMovlDetourGp =%p [%p]\\n\",\n &o->pTrampoline->bMovlDetourGp,\n o->pTrampoline->bMovlDetourGp.GetMovlGp()));\n DETOUR_TRACE((\"detours: &bBrlDetourEip =%p [%p]\\n\",\n &o->pTrampoline->bCallDetour,\n o->pTrampoline->bCallDetour.GetBrlTarget()));\n DETOUR_TRACE((\"detours: pldDetour =%p [%p]\\n\",\n o->pTrampoline->ppldDetour->EntryPoint,\n o->pTrampoline->ppldDetour->GlobalPointer));\n DETOUR_TRACE((\"detours: pldTarget =%p [%p]\\n\",\n o->pTrampoline->ppldTarget->EntryPoint,\n o->pTrampoline->ppldTarget->GlobalPointer));\n DETOUR_TRACE((\"detours: pbRemain =%p\\n\",\n o->pTrampoline->pbRemain));\n DETOUR_TRACE((\"detours: pbDetour =%p\\n\",\n o->pTrampoline->pbDetour));\n DETOUR_TRACE((\"\\n\"));\n#endif // DETOURS_IA64\n }\n }\n\n // Update any suspended threads.\n for (t = s_pPendingThreads; t != NULL; t = t->pNext) {\n CONTEXT cxt;\n cxt.ContextFlags = CONTEXT_CONTROL;\n\n#undef DETOURS_EIP\n\n#ifdef DETOURS_X86\n#define DETOURS_EIP Eip\n#endif // DETOURS_X86\n\n#ifdef DETOURS_X64\n#define DETOURS_EIP Rip\n#endif // DETOURS_X64\n\n#ifdef DETOURS_IA64\n#define DETOURS_EIP StIIP\n#endif // DETOURS_IA64\n\n#ifdef DETOURS_ARM\n#define DETOURS_EIP Pc\n#endif // DETOURS_ARM\n\n#ifdef DETOURS_ARM64\n#define DETOURS_EIP Pc\n#endif // DETOURS_ARM64\n\ntypedef ULONG_PTR DETOURS_EIP_TYPE;\n\n if (GetThreadContext(t->hThread, &cxt)) {\n for (o = s_pPendingOperations; o != NULL; o = o->pNext) {\n if (o->fIsRemove) {\n if (cxt.DETOURS_EIP >= (DETOURS_EIP_TYPE)(ULONG_PTR)o->pTrampoline &&\n cxt.DETOURS_EIP < (DETOURS_EIP_TYPE)((ULONG_PTR)o->pTrampoline\n + sizeof(o->pTrampoline))\n ) {\n\n cxt.DETOURS_EIP = (DETOURS_EIP_TYPE)\n ((ULONG_PTR)o->pbTarget\n + detour_align_from_trampoline(o->pTrampoline,\n (BYTE)(cxt.DETOURS_EIP\n - (DETOURS_EIP_TYPE)(ULONG_PTR)\n o->pTrampoline)));\n\n SetThreadContext(t->hThread, &cxt);\n }\n }\n else {\n if (cxt.DETOURS_EIP >= (DETOURS_EIP_TYPE)(ULONG_PTR)o->pbTarget &&\n cxt.DETOURS_EIP < (DETOURS_EIP_TYPE)((ULONG_PTR)o->pbTarget\n + o->pTrampoline->cbRestore)\n ) {\n\n cxt.DETOURS_EIP = (DETOURS_EIP_TYPE)\n ((ULONG_PTR)o->pTrampoline\n + detour_align_from_target(o->pTrampoline,\n (BYTE)(cxt.DETOURS_EIP\n - (DETOURS_EIP_TYPE)(ULONG_PTR)\n o->pbTarget)));\n\n SetThreadContext(t->hThread, &cxt);\n }\n }\n }\n }\n#undef DETOURS_EIP\n }\n\n // Restore all of the page permissions and flush the icache.\n HANDLE hProcess = GetCurrentProcess();\n for (o = s_pPendingOperations; o != NULL;) {\n // We don't care if this fails, because the code is still accessible.\n DWORD dwOld;\n VirtualProtect(o->pbTarget, o->pTrampoline->cbRestore, o->dwPerm, &dwOld);\n FlushInstructionCache(hProcess, o->pbTarget, o->pTrampoline->cbRestore);\n\n if (o->fIsRemove && o->pTrampoline) {\n detour_free_trampoline(o->pTrampoline);\n o->pTrampoline = NULL;\n freed = true;\n }\n\n DetourOperation *n = o->pNext;\n delete o;\n o = n;\n }\n s_pPendingOperations = NULL;\n\n // Free any trampoline regions that are now unused.\n if (freed && !s_fRetainRegions) {\n detour_free_unused_trampoline_regions();\n }\n\n // Make sure the trampoline pages are no longer writable.\n detour_runnable_trampoline_regions();\n\n // Resume any suspended threads.\n for (t = s_pPendingThreads; t != NULL;) {\n // There is nothing we can do if this fails.\n ResumeThread(t->hThread);\n\n DetourThread *n = t->pNext;\n delete t;\n t = n;\n }\n s_pPendingThreads = NULL;\n s_nPendingThreadId = 0;\n\n if (pppFailedPointer != NULL) {\n *pppFailedPointer = s_ppPendingError;\n }\n\n return s_nPendingError;\n}\n\nLONG WINAPI DetourUpdateThread(_In_ HANDLE hThread)\n{\n LONG error;\n\n // If any of the pending operations failed, then we don't need to do this.\n if (s_nPendingError != NO_ERROR) {\n return s_nPendingError;\n }\n\n // Silently (and safely) drop any attempt to suspend our own thread.\n if (hThread == GetCurrentThread()) {\n return NO_ERROR;\n }\n\n DetourThread *t = new NOTHROW DetourThread;\n if (t == NULL) {\n error = ERROR_NOT_ENOUGH_MEMORY;\n fail:\n if (t != NULL) {\n delete t;\n t = NULL;\n }\n s_nPendingError = error;\n s_ppPendingError = NULL;\n DETOUR_BREAK();\n return error;\n }\n\n if (SuspendThread(hThread) == (DWORD)-1) {\n error = (LONG)GetLastError();\n DETOUR_BREAK();\n goto fail;\n }\n\n t->hThread = hThread;\n t->pNext = s_pPendingThreads;\n s_pPendingThreads = t;\n\n return NO_ERROR;\n}\n\n///////////////////////////////////////////////////////////// Transacted APIs.\n//\nLONG WINAPI DetourAttach(_Inout_ PVOID *ppPointer,\n _In_ PVOID pDetour)\n{\n return DetourAttachEx(ppPointer, pDetour, NULL, NULL, NULL);\n}\n\nLONG WINAPI DetourAttachEx(_Inout_ PVOID *ppPointer,\n _In_ PVOID pDetour,\n _Out_opt_ PDETOUR_TRAMPOLINE *ppRealTrampoline,\n _Out_opt_ PVOID *ppRealTarget,\n _Out_opt_ PVOID *ppRealDetour)\n{\n LONG error = NO_ERROR;\n\n if (ppRealTrampoline != NULL) {\n *ppRealTrampoline = NULL;\n }\n if (ppRealTarget != NULL) {\n *ppRealTarget = NULL;\n }\n if (ppRealDetour != NULL) {\n *ppRealDetour = NULL;\n }\n if (pDetour == NULL) {\n DETOUR_TRACE((\"empty detour\\n\"));\n return ERROR_INVALID_PARAMETER;\n }\n\n if (s_nPendingThreadId != (LONG)GetCurrentThreadId()) {\n DETOUR_TRACE((\"transaction conflict with thread id=%ld\\n\", s_nPendingThreadId));\n return ERROR_INVALID_OPERATION;\n }\n\n // If any of the pending operations failed, then we don't need to do this.\n if (s_nPendingError != NO_ERROR) {\n DETOUR_TRACE((\"pending transaction error=%ld\\n\", s_nPendingError));\n return s_nPendingError;\n }\n\n if (ppPointer == NULL) {\n DETOUR_TRACE((\"ppPointer is null\\n\"));\n return ERROR_INVALID_HANDLE;\n }\n if (*ppPointer == NULL) {\n error = ERROR_INVALID_HANDLE;\n s_nPendingError = error;\n s_ppPendingError = ppPointer;\n DETOUR_TRACE((\"*ppPointer is null (ppPointer=%p)\\n\", (void*)ppPointer));\n DETOUR_BREAK();\n return error;\n }\n\n PBYTE pbTarget = (PBYTE)*ppPointer;\n PDETOUR_TRAMPOLINE pTrampoline = NULL;\n DetourOperation *o = NULL;\n\n#ifdef DETOURS_IA64\n PPLABEL_DESCRIPTOR ppldDetour = (PPLABEL_DESCRIPTOR)pDetour;\n PPLABEL_DESCRIPTOR ppldTarget = (PPLABEL_DESCRIPTOR)pbTarget;\n PVOID pDetourGlobals = NULL;\n PVOID pTargetGlobals = NULL;\n\n pDetour = (PBYTE)DetourCodeFromPointer(ppldDetour, &pDetourGlobals);\n pbTarget = (PBYTE)DetourCodeFromPointer(ppldTarget, &pTargetGlobals);\n DETOUR_TRACE((\" ppldDetour=%p, code=%p [gp=%p]\\n\",\n ppldDetour, pDetour, pDetourGlobals));\n DETOUR_TRACE((\" ppldTarget=%p, code=%p [gp=%p]\\n\",\n ppldTarget, pbTarget, pTargetGlobals));\n#else // DETOURS_IA64\n pbTarget = (PBYTE)DetourCodeFromPointer(pbTarget, NULL);\n pDetour = DetourCodeFromPointer(pDetour, NULL);\n#endif // !DETOURS_IA64\n\n // Don't follow a jump if its destination is the target function.\n // This happens when the detour does nothing other than call the target.\n if (pDetour == (PVOID)pbTarget) {\n if (s_fIgnoreTooSmall) {\n goto stop;\n }\n else {\n DETOUR_BREAK();\n goto fail;\n }\n }\n\n if (ppRealTarget != NULL) {\n *ppRealTarget = pbTarget;\n }\n if (ppRealDetour != NULL) {\n *ppRealDetour = pDetour;\n }\n\n o = new NOTHROW DetourOperation;\n if (o == NULL) {\n error = ERROR_NOT_ENOUGH_MEMORY;\n fail:\n s_nPendingError = error;\n DETOUR_BREAK();\n stop:\n if (pTrampoline != NULL) {\n detour_free_trampoline(pTrampoline);\n pTrampoline = NULL;\n if (ppRealTrampoline != NULL) {\n *ppRealTrampoline = NULL;\n }\n }\n if (o != NULL) {\n delete o;\n o = NULL;\n }\n s_ppPendingError = ppPointer;\n return error;\n }\n\n pTrampoline = detour_alloc_trampoline(pbTarget);\n if (pTrampoline == NULL) {\n error = ERROR_NOT_ENOUGH_MEMORY;\n DETOUR_BREAK();\n goto fail;\n }\n\n if (ppRealTrampoline != NULL) {\n *ppRealTrampoline = pTrampoline;\n }\n\n DETOUR_TRACE((\"detours: pbTramp=%p, pDetour=%p\\n\", (void*)pTrampoline, pDetour));\n\n memset(pTrampoline->rAlign, 0, sizeof(pTrampoline->rAlign));\n\n // Determine the number of movable target instructions.\n PBYTE pbSrc = pbTarget;\n PBYTE pbTrampoline = pTrampoline->rbCode;\n#ifdef DETOURS_IA64\n PBYTE pbPool = (PBYTE)(&pTrampoline->bBranchIslands + 1);\n#else\n PBYTE pbPool = pbTrampoline + sizeof(pTrampoline->rbCode);\n#endif\n ULONG cbTarget = 0;\n ULONG cbJump = SIZE_OF_JMP;\n ULONG nAlign = 0;\n\n#ifdef DETOURS_ARM\n // On ARM, we need an extra instruction when the function isn't 32-bit aligned.\n // Check if the existing code is another detour (or at least a similar\n // \"ldr pc, [PC+0]\" jump.\n if ((ULONG)pbTarget & 2) {\n cbJump += 2;\n\n ULONG op = fetch_thumb_opcode(pbSrc);\n if (op == 0xbf00) {\n op = fetch_thumb_opcode(pbSrc + 2);\n if (op == 0xf8dff000) { // LDR PC,[PC]\n *((PUSHORT&)pbTrampoline)++ = *((PUSHORT&)pbSrc)++;\n *((PULONG&)pbTrampoline)++ = *((PULONG&)pbSrc)++;\n *((PULONG&)pbTrampoline)++ = *((PULONG&)pbSrc)++;\n cbTarget = (LONG)(pbSrc - pbTarget);\n // We will fall through the \"while\" because cbTarget is now >= cbJump.\n }\n }\n }\n else {\n ULONG op = fetch_thumb_opcode(pbSrc);\n if (op == 0xf8dff000) { // LDR PC,[PC]\n *((PULONG&)pbTrampoline)++ = *((PULONG&)pbSrc)++;\n *((PULONG&)pbTrampoline)++ = *((PULONG&)pbSrc)++;\n cbTarget = (LONG)(pbSrc - pbTarget);\n // We will fall through the \"while\" because cbTarget is now >= cbJump.\n }\n }\n#endif\n\n while (cbTarget < cbJump) {\n PBYTE pbOp = pbSrc;\n LONG lExtra = 0;\n\n DETOUR_TRACE((\" DetourCopyInstruction(%p,%p)\\n\",\n pbTrampoline, pbSrc));\n pbSrc = (PBYTE)\n DetourCopyInstruction(pbTrampoline, (PVOID*)&pbPool, pbSrc, NULL, &lExtra);\n DETOUR_TRACE((\" DetourCopyInstruction() = %p (%d bytes)\\n\",\n pbSrc, (int)(pbSrc - pbOp)));\n pbTrampoline += (pbSrc - pbOp) + lExtra;\n cbTarget = (LONG)(pbSrc - pbTarget);\n pTrampoline->rAlign[nAlign].obTarget = cbTarget;\n pTrampoline->rAlign[nAlign].obTrampoline = pbTrampoline - pTrampoline->rbCode;\n nAlign++;\n\n if (nAlign >= ARRAYSIZE(pTrampoline->rAlign)) {\n break;\n }\n\n if (detour_does_code_end_function(pbOp)) {\n break;\n }\n }\n\n // Consume, but don't duplicate padding if it is needed and available.\n while (cbTarget < cbJump) {\n LONG cFiller = detour_is_code_filler(pbSrc);\n if (cFiller == 0) {\n break;\n }\n\n pbSrc += cFiller;\n cbTarget = (LONG)(pbSrc - pbTarget);\n }\n\n#if DETOUR_DEBUG\n {\n DETOUR_TRACE((\" detours: rAlign [\"));\n LONG n = 0;\n for (n = 0; n < ARRAYSIZE(pTrampoline->rAlign); n++) {\n if (pTrampoline->rAlign[n].obTarget == 0 &&\n pTrampoline->rAlign[n].obTrampoline == 0) {\n break;\n }\n DETOUR_TRACE((\" %d/%d\",\n pTrampoline->rAlign[n].obTarget,\n pTrampoline->rAlign[n].obTrampoline\n ));\n\n }\n DETOUR_TRACE((\" ]\\n\"));\n }\n#endif\n\n if (cbTarget < cbJump || nAlign > ARRAYSIZE(pTrampoline->rAlign)) {\n // Too few instructions.\n\n error = ERROR_INVALID_BLOCK;\n if (s_fIgnoreTooSmall) {\n goto stop;\n }\n else {\n DETOUR_BREAK();\n goto fail;\n }\n }\n\n if (pbTrampoline > pbPool) {\n __debugbreak();\n }\n\n pTrampoline->cbCode = (BYTE)(pbTrampoline - pTrampoline->rbCode);\n pTrampoline->cbRestore = (BYTE)cbTarget;\n CopyMemory(pTrampoline->rbRestore, pbTarget, cbTarget);\n\n#if !defined(DETOURS_IA64)\n if (cbTarget > sizeof(pTrampoline->rbCode) - cbJump) {\n // Too many instructions.\n error = ERROR_INVALID_HANDLE;\n DETOUR_BREAK();\n goto fail;\n }\n#endif // !DETOURS_IA64\n\n pTrampoline->pbRemain = pbTarget + cbTarget;\n pTrampoline->pbDetour = (PBYTE)pDetour;\n\n#ifdef DETOURS_IA64\n pTrampoline->ppldDetour = ppldDetour;\n pTrampoline->ppldTarget = ppldTarget;\n pTrampoline->pldTrampoline.EntryPoint = (UINT64)&pTrampoline->bMovlTargetGp;\n pTrampoline->pldTrampoline.GlobalPointer = (UINT64)pDetourGlobals;\n\n ((DETOUR_IA64_BUNDLE *)pTrampoline->rbCode)->SetStop();\n\n pTrampoline->bMovlTargetGp.SetMovlGp((UINT64)pTargetGlobals);\n pTrampoline->bBrlRemainEip.SetBrl((UINT64)pTrampoline->pbRemain);\n\n // Alloc frame: alloc r41=ar.pfs,11,0,8,0; mov r40=rp\n pTrampoline->bAllocFrame.wide[0] = 0x00000580164d480c;\n pTrampoline->bAllocFrame.wide[1] = 0x00c4000500000200;\n // save r36, r37, r38.\n pTrampoline->bSave37to39.wide[0] = 0x031021004e019001;\n pTrampoline->bSave37to39.wide[1] = 0x8401280600420098;\n // save r34,r35,r36: adds r47=0,r36; adds r46=0,r35; adds r45=0,r34\n pTrampoline->bSave34to36.wide[0] = 0x02e0210048017800;\n pTrampoline->bSave34to36.wide[1] = 0x84011005a042008c;\n // save gp,r32,r33\" adds r44=0,r33; adds r43=0,r32; adds r42=0,gp ;;\n pTrampoline->bSaveGPto33.wide[0] = 0x02b0210042016001;\n pTrampoline->bSaveGPto33.wide[1] = 0x8400080540420080;\n // set detour GP.\n pTrampoline->bMovlDetourGp.SetMovlGp((UINT64)pDetourGlobals);\n // call detour: brl.call.sptk.few rp=detour ;;\n pTrampoline->bCallDetour.wide[0] = 0x0000000100000005;\n pTrampoline->bCallDetour.wide[1] = 0xd000001000000000;\n pTrampoline->bCallDetour.SetBrlTarget((UINT64)pDetour);\n // pop frame & gp: adds gp=0,r42; mov rp=r40,+0;; mov.i ar.pfs=r41\n pTrampoline->bPopFrameGp.wide[0] = 0x4000210054000802;\n pTrampoline->bPopFrameGp.wide[1] = 0x00aa029000038005;\n // return to caller: br.ret.sptk.many rp ;;\n pTrampoline->bReturn.wide[0] = 0x0000000100000019;\n pTrampoline->bReturn.wide[1] = 0x0084000880000200;\n\n DETOUR_TRACE((\"detours: &bMovlTargetGp=%p\\n\", &pTrampoline->bMovlTargetGp));\n DETOUR_TRACE((\"detours: &bMovlDetourGp=%p\\n\", &pTrampoline->bMovlDetourGp));\n#endif // DETOURS_IA64\n\n pbTrampoline = pTrampoline->rbCode + pTrampoline->cbCode;\n#ifdef DETOURS_X64\n pbTrampoline = detour_gen_jmp_indirect(pbTrampoline, &pTrampoline->pbRemain);\n pbTrampoline = detour_gen_brk(pbTrampoline, pbPool);\n#endif // DETOURS_X64\n\n#ifdef DETOURS_X86\n pbTrampoline = detour_gen_jmp_immediate(pbTrampoline, pTrampoline->pbRemain);\n pbTrampoline = detour_gen_brk(pbTrampoline, pbPool);\n#endif // DETOURS_X86\n\n#ifdef DETOURS_ARM\n pbTrampoline = detour_gen_jmp_immediate(pbTrampoline, &pbPool, pTrampoline->pbRemain);\n pbTrampoline = detour_gen_brk(pbTrampoline, pbPool);\n#endif // DETOURS_ARM\n\n#ifdef DETOURS_ARM64\n pbTrampoline = detour_gen_jmp_immediate(pbTrampoline, &pbPool, pTrampoline->pbRemain);\n pbTrampoline = detour_gen_brk(pbTrampoline, pbPool);\n#endif // DETOURS_ARM64\n\n (void)pbTrampoline;\n\n DWORD dwOld = 0;\n if (!VirtualProtect(pbTarget, cbTarget, PAGE_EXECUTE_READWRITE, &dwOld)) {\n error = GetLastError();\n DETOUR_BREAK();\n goto fail;\n }\n\n DETOUR_TRACE((\"detours: pbTarget=%p: \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x\\n\",\n pbTarget,\n pbTarget[0], pbTarget[1], pbTarget[2], pbTarget[3],\n pbTarget[4], pbTarget[5], pbTarget[6], pbTarget[7],\n pbTarget[8], pbTarget[9], pbTarget[10], pbTarget[11]));\n DETOUR_TRACE((\"detours: pbTramp =%p: \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x\\n\",\n (void*)pTrampoline,\n pTrampoline->rbCode[0], pTrampoline->rbCode[1],\n pTrampoline->rbCode[2], pTrampoline->rbCode[3],\n pTrampoline->rbCode[4], pTrampoline->rbCode[5],\n pTrampoline->rbCode[6], pTrampoline->rbCode[7],\n pTrampoline->rbCode[8], pTrampoline->rbCode[9],\n pTrampoline->rbCode[10], pTrampoline->rbCode[11]));\n\n o->fIsRemove = FALSE;\n o->ppbPointer = (PBYTE*)ppPointer;\n o->pTrampoline = pTrampoline;\n o->pbTarget = pbTarget;\n o->dwPerm = dwOld;\n o->pNext = s_pPendingOperations;\n s_pPendingOperations = o;\n\n return NO_ERROR;\n}\n\nLONG WINAPI DetourDetach(_Inout_ PVOID *ppPointer,\n _In_ PVOID pDetour)\n{\n LONG error = NO_ERROR;\n\n if (s_nPendingThreadId != (LONG)GetCurrentThreadId()) {\n return ERROR_INVALID_OPERATION;\n }\n\n // If any of the pending operations failed, then we don't need to do this.\n if (s_nPendingError != NO_ERROR) {\n return s_nPendingError;\n }\n\n if (pDetour == NULL) {\n return ERROR_INVALID_PARAMETER;\n }\n if (ppPointer == NULL) {\n return ERROR_INVALID_HANDLE;\n }\n if (*ppPointer == NULL) {\n error = ERROR_INVALID_HANDLE;\n s_nPendingError = error;\n s_ppPendingError = ppPointer;\n DETOUR_BREAK();\n return error;\n }\n\n DetourOperation *o = new NOTHROW DetourOperation;\n if (o == NULL) {\n error = ERROR_NOT_ENOUGH_MEMORY;\n fail:\n s_nPendingError = error;\n DETOUR_BREAK();\n stop:\n if (o != NULL) {\n delete o;\n o = NULL;\n }\n s_ppPendingError = ppPointer;\n return error;\n }\n\n\n#ifdef DETOURS_IA64\n PPLABEL_DESCRIPTOR ppldTrampo = (PPLABEL_DESCRIPTOR)*ppPointer;\n PPLABEL_DESCRIPTOR ppldDetour = (PPLABEL_DESCRIPTOR)pDetour;\n PVOID pDetourGlobals = NULL;\n PVOID pTrampoGlobals = NULL;\n\n pDetour = (PBYTE)DetourCodeFromPointer(ppldDetour, &pDetourGlobals);\n PDETOUR_TRAMPOLINE pTrampoline = (PDETOUR_TRAMPOLINE)\n DetourCodeFromPointer(ppldTrampo, &pTrampoGlobals);\n DETOUR_TRACE((\" ppldDetour=%p, code=%p [gp=%p]\\n\",\n ppldDetour, pDetour, pDetourGlobals));\n DETOUR_TRACE((\" ppldTrampo=%p, code=%p [gp=%p]\\n\",\n ppldTrampo, pTrampoline, pTrampoGlobals));\n\n\n DETOUR_TRACE((\"\\n\"));\n DETOUR_TRACE((\"detours: &pldTrampoline =%p\\n\",\n &pTrampoline->pldTrampoline));\n DETOUR_TRACE((\"detours: &bMovlTargetGp =%p [%p]\\n\",\n &pTrampoline->bMovlTargetGp,\n pTrampoline->bMovlTargetGp.GetMovlGp()));\n DETOUR_TRACE((\"detours: &rbCode =%p [%p]\\n\",\n &pTrampoline->rbCode,\n ((DETOUR_IA64_BUNDLE&)pTrampoline->rbCode).GetBrlTarget()));\n DETOUR_TRACE((\"detours: &bBrlRemainEip =%p [%p]\\n\",\n &pTrampoline->bBrlRemainEip,\n pTrampoline->bBrlRemainEip.GetBrlTarget()));\n DETOUR_TRACE((\"detours: &bMovlDetourGp =%p [%p]\\n\",\n &pTrampoline->bMovlDetourGp,\n pTrampoline->bMovlDetourGp.GetMovlGp()));\n DETOUR_TRACE((\"detours: &bBrlDetourEip =%p [%p]\\n\",\n &pTrampoline->bCallDetour,\n pTrampoline->bCallDetour.GetBrlTarget()));\n DETOUR_TRACE((\"detours: pldDetour =%p [%p]\\n\",\n pTrampoline->ppldDetour->EntryPoint,\n pTrampoline->ppldDetour->GlobalPointer));\n DETOUR_TRACE((\"detours: pldTarget =%p [%p]\\n\",\n pTrampoline->ppldTarget->EntryPoint,\n pTrampoline->ppldTarget->GlobalPointer));\n DETOUR_TRACE((\"detours: pbRemain =%p\\n\",\n pTrampoline->pbRemain));\n DETOUR_TRACE((\"detours: pbDetour =%p\\n\",\n pTrampoline->pbDetour));\n DETOUR_TRACE((\"\\n\"));\n#else // !DETOURS_IA64\n PDETOUR_TRAMPOLINE pTrampoline =\n (PDETOUR_TRAMPOLINE)DetourCodeFromPointer(*ppPointer, NULL);\n pDetour = DetourCodeFromPointer(pDetour, NULL);\n#endif // !DETOURS_IA64\n\n ////////////////////////////////////// Verify that Trampoline is in place.\n //\n LONG cbTarget = pTrampoline->cbRestore;\n PBYTE pbTarget = pTrampoline->pbRemain - cbTarget;\n if (cbTarget == 0 || cbTarget > sizeof(pTrampoline->rbCode)) {\n error = ERROR_INVALID_BLOCK;\n if (s_fIgnoreTooSmall) {\n goto stop;\n }\n else {\n DETOUR_BREAK();\n goto fail;\n }\n }\n\n if (pTrampoline->pbDetour != pDetour) {\n error = ERROR_INVALID_BLOCK;\n if (s_fIgnoreTooSmall) {\n goto stop;\n }\n else {\n DETOUR_BREAK();\n goto fail;\n }\n }\n\n DWORD dwOld = 0;\n if (!VirtualProtect(pbTarget, cbTarget,\n PAGE_EXECUTE_READWRITE, &dwOld)) {\n error = (LONG)GetLastError();\n DETOUR_BREAK();\n goto fail;\n }\n\n o->fIsRemove = TRUE;\n o->ppbPointer = (PBYTE*)ppPointer;\n o->pTrampoline = pTrampoline;\n o->pbTarget = pbTarget;\n o->dwPerm = dwOld;\n o->pNext = s_pPendingOperations;\n s_pPendingOperations = o;\n\n return NO_ERROR;\n}\n\n//////////////////////////////////////////////////////////////////////////////\n//\n// Helpers for manipulating page protection.\n//\n\n// For reference:\n// PAGE_NOACCESS 0x01\n// PAGE_READONLY 0x02\n// PAGE_READWRITE 0x04\n// PAGE_WRITECOPY 0x08\n// PAGE_EXECUTE 0x10\n// PAGE_EXECUTE_READ 0x20\n// PAGE_EXECUTE_READWRITE 0x40\n// PAGE_EXECUTE_WRITECOPY 0x80\n// PAGE_GUARD ...\n// PAGE_NOCACHE ...\n// PAGE_WRITECOMBINE ...\n\n#define DETOUR_PAGE_EXECUTE_ALL (PAGE_EXECUTE | \\\n PAGE_EXECUTE_READ | \\\n PAGE_EXECUTE_READWRITE | \\\n PAGE_EXECUTE_WRITECOPY)\n\n#define DETOUR_PAGE_NO_EXECUTE_ALL (PAGE_NOACCESS | \\\n PAGE_READONLY | \\\n PAGE_READWRITE | \\\n PAGE_WRITECOPY)\n\n#define DETOUR_PAGE_ATTRIBUTES (~(DETOUR_PAGE_EXECUTE_ALL | DETOUR_PAGE_NO_EXECUTE_ALL))\n\nC_ASSERT((DETOUR_PAGE_NO_EXECUTE_ALL << 4) == DETOUR_PAGE_EXECUTE_ALL);\n\nstatic DWORD DetourPageProtectAdjustExecute(_In_ DWORD dwOldProtect,\n _In_ DWORD dwNewProtect)\n// Copy EXECUTE from dwOldProtect to dwNewProtect.\n{\n bool const fOldExecute = ((dwOldProtect & DETOUR_PAGE_EXECUTE_ALL) != 0);\n bool const fNewExecute = ((dwNewProtect & DETOUR_PAGE_EXECUTE_ALL) != 0);\n\n if (fOldExecute && !fNewExecute) {\n dwNewProtect = ((dwNewProtect & DETOUR_PAGE_NO_EXECUTE_ALL) << 4)\n | (dwNewProtect & DETOUR_PAGE_ATTRIBUTES);\n }\n else if (!fOldExecute && fNewExecute) {\n dwNewProtect = ((dwNewProtect & DETOUR_PAGE_EXECUTE_ALL) >> 4)\n | (dwNewProtect & DETOUR_PAGE_ATTRIBUTES);\n }\n return dwNewProtect;\n}\n\n_Success_(return != FALSE)\nBOOL WINAPI DetourVirtualProtectSameExecuteEx(_In_ HANDLE hProcess,\n _In_ PVOID pAddress,\n _In_ SIZE_T nSize,\n _In_ DWORD dwNewProtect,\n _Out_ PDWORD pdwOldProtect)\n// Some systems do not allow executability of a page to change. This function applies\n// dwNewProtect to [pAddress, nSize), but preserving the previous executability.\n// This function is meant to be a drop-in replacement for some uses of VirtualProtectEx.\n// When \"restoring\" page protection, there is no need to use this function.\n{\n MEMORY_BASIC_INFORMATION mbi;\n\n // Query to get existing execute access.\n\n ZeroMemory(&mbi, sizeof(mbi));\n\n if (VirtualQueryEx(hProcess, pAddress, &mbi, sizeof(mbi)) == 0) {\n return FALSE;\n }\n return VirtualProtectEx(hProcess, pAddress, nSize,\n DetourPageProtectAdjustExecute(mbi.Protect, dwNewProtect),\n pdwOldProtect);\n}\n\n_Success_(return != FALSE)\nBOOL WINAPI DetourVirtualProtectSameExecute(_In_ PVOID pAddress,\n _In_ SIZE_T nSize,\n _In_ DWORD dwNewProtect,\n _Out_ PDWORD pdwOldProtect)\n{\n return DetourVirtualProtectSameExecuteEx(GetCurrentProcess(),\n pAddress, nSize, dwNewProtect, pdwOldProtect);\n}\n\n// End of File\n"
},
{
"path": "Detours/detours.h",
"content": "/////////////////////////////////////////////////////////////////////////////\n//\n// Core Detours Functionality (detours.h of detours.lib)\n//\n// Microsoft Research Detours Package, Version 4.0.1\n//\n// Copyright (c) Microsoft Corporation. All rights reserved.\n//\n\n#pragma once\n#ifndef _DETOURS_H_\n#define _DETOURS_H_\n\n#if defined(_KERNEL_MODE)\n#define DETOURS_KERNEL\n#endif\n\n#ifdef DETOURS_KERNEL\n#include \n#include \n#endif\n\n#define DETOURS_VERSION 0x4c0c1 // 0xMAJORcMINORcPATCH\n\n//////////////////////////////////////////////////////////////////////////////\n//\n\n#undef DETOURS_X64\n#undef DETOURS_X86\n#undef DETOURS_IA64\n#undef DETOURS_ARM\n#undef DETOURS_ARM64\n#undef DETOURS_BITS\n#undef DETOURS_32BIT\n#undef DETOURS_64BIT\n\n#if defined(_X86_)\n#define DETOURS_X86\n#define DETOURS_OPTION_BITS 64\n\n#elif defined(_AMD64_)\n#define DETOURS_X64\n#define DETOURS_OPTION_BITS 32\n\n#elif defined(_IA64_)\n#define DETOURS_IA64\n#define DETOURS_OPTION_BITS 32\n\n#elif defined(_ARM_)\n#define DETOURS_ARM\n\n#elif defined(_ARM64_)\n#define DETOURS_ARM64\n\n#else\n#error Unknown architecture (x86, amd64, ia64, arm, arm64)\n#endif\n\n#ifdef _WIN64\n#undef DETOURS_32BIT\n#define DETOURS_64BIT 1\n#define DETOURS_BITS 64\n// If all 64bit kernels can run one and only one 32bit architecture.\n//#define DETOURS_OPTION_BITS 32\n#else\n#define DETOURS_32BIT 1\n#undef DETOURS_64BIT\n#define DETOURS_BITS 32\n// If all 64bit kernels can run one and only one 32bit architecture.\n//#define DETOURS_OPTION_BITS 32\n#endif\n\n#define VER_DETOURS_BITS DETOUR_STRINGIFY(DETOURS_BITS)\n\n//////////////////////////////////////////////////////////////////////////////\n//\n\n#if (_MSC_VER < 1299)\ntypedef LONG LONG_PTR;\ntypedef ULONG ULONG_PTR;\n#endif\n\n///////////////////////////////////////////////// SAL 2.0 Annotations w/o SAL.\n//\n// These definitions are include so that Detours will build even if the\n// compiler doesn't have full SAL 2.0 support.\n//\n#ifndef DETOURS_DONT_REMOVE_SAL_20\n\n#ifdef DETOURS_TEST_REMOVE_SAL_20\n#undef _Analysis_assume_\n#undef _Benign_race_begin_\n#undef _Benign_race_end_\n#undef _Field_range_\n#undef _Field_size_\n#undef _In_\n#undef _In_bytecount_\n#undef _In_count_\n#undef _In_opt_\n#undef _In_opt_bytecount_\n#undef _In_opt_count_\n#undef _In_opt_z_\n#undef _In_range_\n#undef _In_reads_\n#undef _In_reads_bytes_\n#undef _In_reads_opt_\n#undef _In_reads_opt_bytes_\n#undef _In_reads_or_z_\n#undef _In_z_\n#undef _Inout_\n#undef _Inout_opt_\n#undef _Inout_z_count_\n#undef _Out_\n#undef _Out_opt_\n#undef _Out_writes_\n#undef _Outptr_result_maybenull_\n#undef _Readable_bytes_\n#undef _Success_\n#undef _Writable_bytes_\n#undef _Pre_notnull_\n#endif\n\n#if defined(_Deref_out_opt_z_) && !defined(_Outptr_result_maybenull_)\n#define _Outptr_result_maybenull_ _Deref_out_opt_z_\n#endif\n\n#if defined(_In_count_) && !defined(_In_reads_)\n#define _In_reads_(x) _In_count_(x)\n#endif\n\n#if defined(_In_opt_count_) && !defined(_In_reads_opt_)\n#define _In_reads_opt_(x) _In_opt_count_(x)\n#endif\n\n#if defined(_In_opt_bytecount_) && !defined(_In_reads_opt_bytes_)\n#define _In_reads_opt_bytes_(x) _In_opt_bytecount_(x)\n#endif\n\n#if defined(_In_bytecount_) && !defined(_In_reads_bytes_)\n#define _In_reads_bytes_(x) _In_bytecount_(x)\n#endif\n\n#ifndef _In_\n#define _In_\n#endif\n\n#ifndef _In_bytecount_\n#define _In_bytecount_(x)\n#endif\n\n#ifndef _In_count_\n#define _In_count_(x)\n#endif\n\n#ifndef _In_opt_\n#define _In_opt_\n#endif\n\n#ifndef _In_opt_bytecount_\n#define _In_opt_bytecount_(x)\n#endif\n\n#ifndef _In_opt_count_\n#define _In_opt_count_(x)\n#endif\n\n#ifndef _In_opt_z_\n#define _In_opt_z_\n#endif\n\n#ifndef _In_range_\n#define _In_range_(x,y)\n#endif\n\n#ifndef _In_reads_\n#define _In_reads_(x)\n#endif\n\n#ifndef _In_reads_bytes_\n#define _In_reads_bytes_(x)\n#endif\n\n#ifndef _In_reads_opt_\n#define _In_reads_opt_(x)\n#endif\n\n#ifndef _In_reads_opt_bytes_\n#define _In_reads_opt_bytes_(x)\n#endif\n\n#ifndef _In_reads_or_z_\n#define _In_reads_or_z_\n#endif\n\n#ifndef _In_z_\n#define _In_z_\n#endif\n\n#ifndef _Inout_\n#define _Inout_\n#endif\n\n#ifndef _Inout_opt_\n#define _Inout_opt_\n#endif\n\n#ifndef _Inout_z_count_\n#define _Inout_z_count_(x)\n#endif\n\n#ifndef _Out_\n#define _Out_\n#endif\n\n#ifndef _Out_opt_\n#define _Out_opt_\n#endif\n\n#ifndef _Out_writes_\n#define _Out_writes_(x)\n#endif\n\n#ifndef _Outptr_result_maybenull_\n#define _Outptr_result_maybenull_\n#endif\n\n#ifndef _Writable_bytes_\n#define _Writable_bytes_(x)\n#endif\n\n#ifndef _Readable_bytes_\n#define _Readable_bytes_(x)\n#endif\n\n#ifndef _Success_\n#define _Success_(x)\n#endif\n\n#ifndef _Pre_notnull_\n#define _Pre_notnull_\n#endif\n\n#ifdef DETOURS_INTERNAL\n\n#pragma warning(disable:4615) // unknown warning type (suppress with older compilers)\n\n#ifndef _Benign_race_begin_\n#define _Benign_race_begin_\n#endif\n\n#ifndef _Benign_race_end_\n#define _Benign_race_end_\n#endif\n\n#ifndef _Field_size_\n#define _Field_size_(x)\n#endif\n\n#ifndef _Field_range_\n#define _Field_range_(x,y)\n#endif\n\n#ifndef _Analysis_assume_\n#define _Analysis_assume_(x)\n#endif\n\n#endif // DETOURS_INTERNAL\n#endif // DETOURS_DONT_REMOVE_SAL_20\n\n//////////////////////////////////////////////////////////////////////////////\n//\n#ifndef GUID_DEFINED\n#define GUID_DEFINED\ntypedef struct _GUID\n{\n DWORD Data1;\n WORD Data2;\n WORD Data3;\n BYTE Data4[ 8 ];\n} GUID;\n\n#ifdef INITGUID\n#define DEFINE_GUID(name, l, w1, w2, b1, b2, b3, b4, b5, b6, b7, b8) \\\n const GUID name \\\n = { l, w1, w2, { b1, b2, b3, b4, b5, b6, b7, b8 } }\n#else\n#define DEFINE_GUID(name, l, w1, w2, b1, b2, b3, b4, b5, b6, b7, b8) \\\n const GUID name\n#endif // INITGUID\n#endif // !GUID_DEFINED\n\n#if defined(__cplusplus)\n#ifndef _REFGUID_DEFINED\n#define _REFGUID_DEFINED\n#define REFGUID const GUID &\n#endif // !_REFGUID_DEFINED\n#else // !__cplusplus\n#ifndef _REFGUID_DEFINED\n#define _REFGUID_DEFINED\n#define REFGUID const GUID * const\n#endif // !_REFGUID_DEFINED\n#endif // !__cplusplus\n\n#ifndef ARRAYSIZE\n#define ARRAYSIZE(x) (sizeof(x)/sizeof(x[0]))\n#endif\n\n//\n//////////////////////////////////////////////////////////////////////////////\n\n#ifdef __cplusplus\nextern \"C\" {\n#endif // __cplusplus\n\n//\n// Constants\n//\n#define MoveMemory RtlMoveMemory\n#define CopyMemory RtlCopyMemory\n#define FillMemory RtlFillMemory\n#define ZeroMemory RtlZeroMemory\n\n#undef NULL\n#define NULL nullptr\n\n/////////////////////////////////////////////////// Instruction Target Macros.\n//\n#define DETOUR_INSTRUCTION_TARGET_NONE ((PVOID)0)\n#define DETOUR_INSTRUCTION_TARGET_DYNAMIC ((PVOID)(LONG_PTR)-1)\n#define DETOUR_SECTION_HEADER_SIGNATURE 0x00727444 // \"Dtr\\0\"\n\nextern const GUID DETOUR_EXE_RESTORE_GUID;\nextern const GUID DETOUR_EXE_HELPER_GUID;\n\n#define DETOUR_TRAMPOLINE_SIGNATURE 0x21727444 // Dtr!\ntypedef struct _DETOUR_TRAMPOLINE DETOUR_TRAMPOLINE, *PDETOUR_TRAMPOLINE;\n\n/////////////////////////////////////////////////////////// Binary Structures.\n//\n#pragma pack(push, 8)\ntypedef struct _DETOUR_SECTION_HEADER\n{\n DWORD cbHeaderSize;\n DWORD nSignature;\n DWORD nDataOffset;\n DWORD cbDataSize;\n\n DWORD nOriginalImportVirtualAddress;\n DWORD nOriginalImportSize;\n DWORD nOriginalBoundImportVirtualAddress;\n DWORD nOriginalBoundImportSize;\n\n DWORD nOriginalIatVirtualAddress;\n DWORD nOriginalIatSize;\n DWORD nOriginalSizeOfImage;\n DWORD cbPrePE;\n\n DWORD nOriginalClrFlags;\n DWORD reserved1;\n DWORD reserved2;\n DWORD reserved3;\n\n // Followed by cbPrePE bytes of data.\n} DETOUR_SECTION_HEADER, *PDETOUR_SECTION_HEADER;\n\ntypedef struct _DETOUR_SECTION_RECORD\n{\n DWORD cbBytes;\n DWORD nReserved;\n GUID guid;\n} DETOUR_SECTION_RECORD, *PDETOUR_SECTION_RECORD;\n\ntypedef struct _DETOUR_CLR_HEADER\n{\n // Header versioning\n ULONG cb;\n USHORT MajorRuntimeVersion;\n USHORT MinorRuntimeVersion;\n\n // Symbol table and startup information\n IMAGE_DATA_DIRECTORY MetaData;\n ULONG Flags;\n\n // Followed by the rest of the IMAGE_COR20_HEADER\n} DETOUR_CLR_HEADER, *PDETOUR_CLR_HEADER;\n\ntypedef struct _DETOUR_EXE_RESTORE\n{\n DWORD cb;\n DWORD cbidh;\n DWORD cbinh;\n DWORD cbclr;\n\n PBYTE pidh;\n PBYTE pinh;\n PBYTE pclr;\n\n IMAGE_DOS_HEADER idh;\n union {\n IMAGE_NT_HEADERS inh;\n IMAGE_NT_HEADERS32 inh32;\n IMAGE_NT_HEADERS64 inh64;\n BYTE raw[sizeof(IMAGE_NT_HEADERS64) +\n sizeof(IMAGE_SECTION_HEADER) * 32];\n };\n DETOUR_CLR_HEADER clr;\n\n} DETOUR_EXE_RESTORE, *PDETOUR_EXE_RESTORE;\n\ntypedef struct _DETOUR_EXE_HELPER\n{\n DWORD cb;\n DWORD pid;\n DWORD nDlls;\n CHAR rDlls[4];\n} DETOUR_EXE_HELPER, *PDETOUR_EXE_HELPER;\n\n#pragma pack(pop)\n\n#define DETOUR_SECTION_HEADER_DECLARE(cbSectionSize) \\\n{ \\\n sizeof(DETOUR_SECTION_HEADER),\\\n DETOUR_SECTION_HEADER_SIGNATURE,\\\n sizeof(DETOUR_SECTION_HEADER),\\\n (cbSectionSize),\\\n \\\n 0,\\\n 0,\\\n 0,\\\n 0,\\\n \\\n 0,\\\n 0,\\\n 0,\\\n 0,\\\n}\n\n/////////////////////////////////////////////////////////////// Helper Macros.\n//\n#define DETOURS_STRINGIFY(x) DETOURS_STRINGIFY_(x)\n#define DETOURS_STRINGIFY_(x) #x\n\n#ifndef DETOURS_KERNEL\n///////////////////////////////////////////////////////////// Binary Typedefs.\n//\ntypedef BOOL (CALLBACK *PF_DETOUR_BINARY_BYWAY_CALLBACK)(\n _In_opt_ PVOID pContext,\n _In_opt_ LPCSTR pszFile,\n _Outptr_result_maybenull_ LPCSTR *ppszOutFile);\n\ntypedef BOOL (CALLBACK *PF_DETOUR_BINARY_FILE_CALLBACK)(\n _In_opt_ PVOID pContext,\n _In_ LPCSTR pszOrigFile,\n _In_ LPCSTR pszFile,\n _Outptr_result_maybenull_ LPCSTR *ppszOutFile);\n\ntypedef BOOL (CALLBACK *PF_DETOUR_BINARY_SYMBOL_CALLBACK)(\n _In_opt_ PVOID pContext,\n _In_ ULONG nOrigOrdinal,\n _In_ ULONG nOrdinal,\n _Out_ ULONG *pnOutOrdinal,\n _In_opt_ LPCSTR pszOrigSymbol,\n _In_opt_ LPCSTR pszSymbol,\n _Outptr_result_maybenull_ LPCSTR *ppszOutSymbol);\n\ntypedef BOOL (CALLBACK *PF_DETOUR_BINARY_COMMIT_CALLBACK)(\n _In_opt_ PVOID pContext);\n\ntypedef BOOL (CALLBACK *PF_DETOUR_ENUMERATE_EXPORT_CALLBACK)(_In_opt_ PVOID pContext,\n _In_ ULONG nOrdinal,\n _In_opt_ LPCSTR pszName,\n _In_opt_ PVOID pCode);\n\ntypedef BOOL (CALLBACK *PF_DETOUR_IMPORT_FILE_CALLBACK)(_In_opt_ PVOID pContext,\n _In_opt_ HMODULE hModule,\n _In_opt_ LPCSTR pszFile);\n\ntypedef BOOL (CALLBACK *PF_DETOUR_IMPORT_FUNC_CALLBACK)(_In_opt_ PVOID pContext,\n _In_ DWORD nOrdinal,\n _In_opt_ LPCSTR pszFunc,\n _In_opt_ PVOID pvFunc);\n\n// Same as PF_DETOUR_IMPORT_FUNC_CALLBACK but extra indirection on last parameter.\ntypedef BOOL (CALLBACK *PF_DETOUR_IMPORT_FUNC_CALLBACK_EX)(_In_opt_ PVOID pContext,\n _In_ DWORD nOrdinal,\n _In_opt_ LPCSTR pszFunc,\n _In_opt_ PVOID* ppvFunc);\n\ntypedef VOID * PDETOUR_BINARY;\ntypedef VOID * PDETOUR_LOADED_BINARY;\n#endif //!DETOURS_KERNEL\n\n//////////////////////////////////////////////////////////// Transaction APIs.\n//\nLONG WINAPI DetourTransactionBegin(VOID);\nLONG WINAPI DetourTransactionAbort(VOID);\nLONG WINAPI DetourTransactionCommit(VOID);\nLONG WINAPI DetourTransactionCommitEx(_Out_opt_ PVOID **pppFailedPointer);\n\nLONG WINAPI DetourUpdateThread(_In_ HANDLE hThread);\n\nLONG WINAPI DetourAttach(_Inout_ PVOID *ppPointer,\n _In_ PVOID pDetour);\n\nLONG WINAPI DetourAttachEx(_Inout_ PVOID *ppPointer,\n _In_ PVOID pDetour,\n _Out_opt_ PDETOUR_TRAMPOLINE *ppRealTrampoline,\n _Out_opt_ PVOID *ppRealTarget,\n _Out_opt_ PVOID *ppRealDetour);\n\nLONG WINAPI DetourDetach(_Inout_ PVOID *ppPointer,\n _In_ PVOID pDetour);\n\nBOOL WINAPI DetourSetIgnoreTooSmall(_In_ BOOL fIgnore);\nBOOL WINAPI DetourSetRetainRegions(_In_ BOOL fRetain);\nPVOID WINAPI DetourSetSystemRegionLowerBound(_In_ PVOID pSystemRegionLowerBound);\nPVOID WINAPI DetourSetSystemRegionUpperBound(_In_ PVOID pSystemRegionUpperBound);\n\n////////////////////////////////////////////////////////////// Code Functions.\n//\nPVOID WINAPI DetourCodeFromPointer(_In_ PVOID pPointer,\n _Out_opt_ PVOID *ppGlobals);\nPVOID WINAPI DetourCopyInstruction(_In_opt_ PVOID pDst,\n _Inout_opt_ PVOID *ppDstPool,\n _In_ PVOID pSrc,\n _Out_opt_ PVOID *ppTarget,\n _Out_opt_ LONG *plExtra);\n\n#ifndef DETOURS_KERNEL\nPVOID WINAPI DetourFindFunction(_In_ LPCSTR pszModule,\n _In_ LPCSTR pszFunction);\nBOOL WINAPI DetourSetCodeModule(_In_ HMODULE hModule,\n _In_ BOOL fLimitReferencesToModule);\n#endif // !DETOURS_KERNEL\n\n#ifndef DETOURS_KERNEL\n///////////////////////////////////////////////////// Loaded Binary Functions.\n//\nHMODULE WINAPI DetourGetContainingModule(_In_ PVOID pvAddr);\nHMODULE WINAPI DetourEnumerateModules(_In_opt_ HMODULE hModuleLast);\nPVOID WINAPI DetourGetEntryPoint(_In_opt_ HMODULE hModule);\nULONG WINAPI DetourGetModuleSize(_In_opt_ HMODULE hModule);\nBOOL WINAPI DetourEnumerateExports(_In_ HMODULE hModule,\n _In_opt_ PVOID pContext,\n _In_ PF_DETOUR_ENUMERATE_EXPORT_CALLBACK pfExport);\nBOOL WINAPI DetourEnumerateImports(_In_opt_ HMODULE hModule,\n _In_opt_ PVOID pContext,\n _In_opt_ PF_DETOUR_IMPORT_FILE_CALLBACK pfImportFile,\n _In_opt_ PF_DETOUR_IMPORT_FUNC_CALLBACK pfImportFunc);\n\nBOOL WINAPI DetourEnumerateImportsEx(_In_opt_ HMODULE hModule,\n _In_opt_ PVOID pContext,\n _In_opt_ PF_DETOUR_IMPORT_FILE_CALLBACK pfImportFile,\n _In_opt_ PF_DETOUR_IMPORT_FUNC_CALLBACK_EX pfImportFuncEx);\n\n_Writable_bytes_(*pcbData)\n_Readable_bytes_(*pcbData)\n_Success_(return != NULL)\nPVOID WINAPI DetourFindPayload(_In_opt_ HMODULE hModule,\n _In_ REFGUID rguid,\n _Out_ DWORD *pcbData);\n\n_Writable_bytes_(*pcbData)\n_Readable_bytes_(*pcbData)\n_Success_(return != NULL)\nPVOID WINAPI DetourFindPayloadEx(_In_ REFGUID rguid,\n _Out_ DWORD * pcbData);\n\nDWORD WINAPI DetourGetSizeOfPayloads(_In_opt_ HMODULE hModule);\n#endif // !DETOURS_KERNEL\n\n#ifndef DETOURS_KERNEL\n///////////////////////////////////////////////// Persistent Binary Functions.\n//\n\nPDETOUR_BINARY WINAPI DetourBinaryOpen(_In_ HANDLE hFile);\n\n_Writable_bytes_(*pcbData)\n_Readable_bytes_(*pcbData)\n_Success_(return != NULL)\nPVOID WINAPI DetourBinaryEnumeratePayloads(_In_ PDETOUR_BINARY pBinary,\n _Out_opt_ GUID *pGuid,\n _Out_ DWORD *pcbData,\n _Inout_ DWORD *pnIterator);\n\n_Writable_bytes_(*pcbData)\n_Readable_bytes_(*pcbData)\n_Success_(return != NULL)\nPVOID WINAPI DetourBinaryFindPayload(_In_ PDETOUR_BINARY pBinary,\n _In_ REFGUID rguid,\n _Out_ DWORD *pcbData);\n\nPVOID WINAPI DetourBinarySetPayload(_In_ PDETOUR_BINARY pBinary,\n _In_ REFGUID rguid,\n _In_reads_opt_(cbData) PVOID pData,\n _In_ DWORD cbData);\nBOOL WINAPI DetourBinaryDeletePayload(_In_ PDETOUR_BINARY pBinary, _In_ REFGUID rguid);\nBOOL WINAPI DetourBinaryPurgePayloads(_In_ PDETOUR_BINARY pBinary);\nBOOL WINAPI DetourBinaryResetImports(_In_ PDETOUR_BINARY pBinary);\nBOOL WINAPI DetourBinaryEditImports(_In_ PDETOUR_BINARY pBinary,\n _In_opt_ PVOID pContext,\n _In_opt_ PF_DETOUR_BINARY_BYWAY_CALLBACK pfByway,\n _In_opt_ PF_DETOUR_BINARY_FILE_CALLBACK pfFile,\n _In_opt_ PF_DETOUR_BINARY_SYMBOL_CALLBACK pfSymbol,\n _In_opt_ PF_DETOUR_BINARY_COMMIT_CALLBACK pfCommit);\nBOOL WINAPI DetourBinaryWrite(_In_ PDETOUR_BINARY pBinary, _In_ HANDLE hFile);\nBOOL WINAPI DetourBinaryClose(_In_ PDETOUR_BINARY pBinary);\n#endif // !DETOURS_KERNEL\n\n#ifndef DETOURS_KERNEL\n/////////////////////////////////////////////////// Create Process & Load Dll.\n//\ntypedef BOOL (WINAPI *PDETOUR_CREATE_PROCESS_ROUTINEA)(\n _In_opt_ LPCSTR lpApplicationName,\n _Inout_opt_ LPSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOA lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation);\n\ntypedef BOOL (WINAPI *PDETOUR_CREATE_PROCESS_ROUTINEW)(\n _In_opt_ LPCWSTR lpApplicationName,\n _Inout_opt_ LPWSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCWSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOW lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation);\n\nBOOL WINAPI DetourCreateProcessWithDllA(_In_opt_ LPCSTR lpApplicationName,\n _Inout_opt_ LPSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOA lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ LPCSTR lpDllName,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);\n\nBOOL WINAPI DetourCreateProcessWithDllW(_In_opt_ LPCWSTR lpApplicationName,\n _Inout_opt_ LPWSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCWSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOW lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ LPCSTR lpDllName,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);\n\n#ifdef UNICODE\n#define DetourCreateProcessWithDll DetourCreateProcessWithDllW\n#define PDETOUR_CREATE_PROCESS_ROUTINE PDETOUR_CREATE_PROCESS_ROUTINEW\n#else\n#define DetourCreateProcessWithDll DetourCreateProcessWithDllA\n#define PDETOUR_CREATE_PROCESS_ROUTINE PDETOUR_CREATE_PROCESS_ROUTINEA\n#endif // !UNICODE\n\nBOOL WINAPI DetourCreateProcessWithDllExA(_In_opt_ LPCSTR lpApplicationName,\n _Inout_opt_ LPSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOA lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ LPCSTR lpDllName,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);\n\nBOOL WINAPI DetourCreateProcessWithDllExW(_In_opt_ LPCWSTR lpApplicationName,\n _Inout_opt_ LPWSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCWSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOW lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ LPCSTR lpDllName,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);\n\n#ifdef UNICODE\n#define DetourCreateProcessWithDllEx DetourCreateProcessWithDllExW\n#else\n#define DetourCreateProcessWithDllEx DetourCreateProcessWithDllExA\n#endif // !UNICODE\n\nBOOL WINAPI DetourCreateProcessWithDllsA(_In_opt_ LPCSTR lpApplicationName,\n _Inout_opt_ LPSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOA lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ DWORD nDlls,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);\n\nBOOL WINAPI DetourCreateProcessWithDllsW(_In_opt_ LPCWSTR lpApplicationName,\n _Inout_opt_ LPWSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCWSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOW lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ DWORD nDlls,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);\n\n#ifdef UNICODE\n#define DetourCreateProcessWithDlls DetourCreateProcessWithDllsW\n#else\n#define DetourCreateProcessWithDlls DetourCreateProcessWithDllsA\n#endif // !UNICODE\n\nBOOL WINAPI DetourProcessViaHelperA(_In_ DWORD dwTargetPid,\n _In_ LPCSTR lpDllName,\n _In_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);\n\nBOOL WINAPI DetourProcessViaHelperW(_In_ DWORD dwTargetPid,\n _In_ LPCSTR lpDllName,\n _In_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);\n\n#ifdef UNICODE\n#define DetourProcessViaHelper DetourProcessViaHelperW\n#else\n#define DetourProcessViaHelper DetourProcessViaHelperA\n#endif // !UNICODE\n\nBOOL WINAPI DetourProcessViaHelperDllsA(_In_ DWORD dwTargetPid,\n _In_ DWORD nDlls,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);\n\nBOOL WINAPI DetourProcessViaHelperDllsW(_In_ DWORD dwTargetPid,\n _In_ DWORD nDlls,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);\n\n#ifdef UNICODE\n#define DetourProcessViaHelperDlls DetourProcessViaHelperDllsW\n#else\n#define DetourProcessViaHelperDlls DetourProcessViaHelperDllsA\n#endif // !UNICODE\n\n#endif // !DETOURS_KERNEL\n\nBOOL WINAPI DetourUpdateProcessWithDll(_In_ HANDLE hProcess,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_ DWORD nDlls);\n\nBOOL WINAPI DetourUpdateProcessWithDllEx(_In_ HANDLE hProcess,\n _In_ HMODULE hImage,\n _In_ BOOL bIs32Bit,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_ DWORD nDlls);\n\nBOOL WINAPI DetourCopyPayloadToProcess(_In_ HANDLE hProcess,\n _In_ REFGUID rguid,\n _In_reads_bytes_(cbData) PVOID pvData,\n _In_ DWORD cbData);\n\n#ifndef DETOURS_KERNEL\nBOOL WINAPI DetourRestoreAfterWith(VOID);\nBOOL WINAPI DetourRestoreAfterWithEx(_In_reads_bytes_(cbData) PVOID pvData,\n _In_ DWORD cbData);\nBOOL WINAPI DetourIsHelperProcess(VOID);\nVOID CALLBACK DetourFinishHelperProcess(_In_ HWND,\n _In_ HINSTANCE,\n _In_ LPSTR,\n _In_ INT);\n#endif // !DETOURS_KERNEL\n\n//\n//////////////////////////////////////////////////////////////////////////////\n#ifdef __cplusplus\n}\n#endif // __cplusplus\n\n//////////////////////////////////////////////// Detours Internal Definitions.\n//\n#ifdef __cplusplus\n#ifdef DETOURS_INTERNAL\n\n#define NOTHROW\n// #define NOTHROW (nothrow)\n\n//////////////////////////////////////////////////////////////////////////////\n//\n#ifndef DETOURS_KERNEL\n#if (_MSC_VER < 1299)\n#include \ntypedef IMAGEHLP_MODULE IMAGEHLP_MODULE64;\ntypedef PIMAGEHLP_MODULE PIMAGEHLP_MODULE64;\ntypedef IMAGEHLP_SYMBOL SYMBOL_INFO;\ntypedef PIMAGEHLP_SYMBOL PSYMBOL_INFO;\n\nstatic inline\nLONG InterlockedCompareExchange(_Inout_ LONG *ptr, _In_ LONG nval, _In_ LONG oval)\n{\n return (LONG)::InterlockedCompareExchange((PVOID*)ptr, (PVOID)nval, (PVOID)oval);\n}\n#else\n#pragma warning(push)\n#pragma warning(disable:4091) // empty typedef\n#include \n#pragma warning(pop)\n#endif\n\n#ifdef IMAGEAPI // defined by DBGHELP.H\ntypedef LPAPI_VERSION (NTAPI *PF_ImagehlpApiVersionEx)(_In_ LPAPI_VERSION AppVersion);\n\ntypedef BOOL (NTAPI *PF_SymInitialize)(_In_ HANDLE hProcess,\n _In_opt_ LPCSTR UserSearchPath,\n _In_ BOOL fInvadeProcess);\ntypedef DWORD (NTAPI *PF_SymSetOptions)(_In_ DWORD SymOptions);\ntypedef DWORD (NTAPI *PF_SymGetOptions)(VOID);\ntypedef DWORD64 (NTAPI *PF_SymLoadModule64)(_In_ HANDLE hProcess,\n _In_opt_ HANDLE hFile,\n _In_ LPSTR ImageName,\n _In_opt_ LPSTR ModuleName,\n _In_ DWORD64 BaseOfDll,\n _In_opt_ DWORD SizeOfDll);\ntypedef BOOL (NTAPI *PF_SymGetModuleInfo64)(_In_ HANDLE hProcess,\n _In_ DWORD64 qwAddr,\n _Out_ PIMAGEHLP_MODULE64 ModuleInfo);\ntypedef BOOL (NTAPI *PF_SymFromName)(_In_ HANDLE hProcess,\n _In_ LPSTR Name,\n _Out_ PSYMBOL_INFO Symbol);\n\ntypedef struct _DETOUR_SYM_INFO\n{\n HANDLE hProcess;\n HMODULE hDbgHelp;\n PF_ImagehlpApiVersionEx pfImagehlpApiVersionEx;\n PF_SymInitialize pfSymInitialize;\n PF_SymSetOptions pfSymSetOptions;\n PF_SymGetOptions pfSymGetOptions;\n PF_SymLoadModule64 pfSymLoadModule64;\n PF_SymGetModuleInfo64 pfSymGetModuleInfo64;\n PF_SymFromName pfSymFromName;\n} DETOUR_SYM_INFO, *PDETOUR_SYM_INFO;\n\nPDETOUR_SYM_INFO DetourLoadImageHlp(VOID);\n\n#endif // IMAGEAPI\n#endif // !DETOURS_KERNEL\n\n#if defined(_INC_STDIO) && !defined(_CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS)\n#error detours.h must be included before stdio.h (or at least define _CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS earlier)\n#endif\n#define _CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS 1\n\n#ifndef DETOUR_TRACE\n#if DETOUR_DEBUG && !defined(DETOURS_KERNEL)\n#define DETOUR_TRACE(x) printf x\n#define DETOUR_BREAK() __debugbreak()\n#include \n#include \n#else\n#define DETOUR_TRACE(x)\n#define DETOUR_BREAK()\n#endif\n#endif\n\n#if 1 || defined(DETOURS_IA64)\n\n//\n// IA64 instructions are 41 bits, 3 per bundle, plus 5 bit bundle template => 128 bits per bundle.\n//\n\n#define DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE (3)\n\n#define DETOUR_IA64_TEMPLATE_OFFSET (0)\n#define DETOUR_IA64_TEMPLATE_SIZE (5)\n\n#define DETOUR_IA64_INSTRUCTION_SIZE (41)\n#define DETOUR_IA64_INSTRUCTION0_OFFSET (DETOUR_IA64_TEMPLATE_SIZE)\n#define DETOUR_IA64_INSTRUCTION1_OFFSET (DETOUR_IA64_TEMPLATE_SIZE + DETOUR_IA64_INSTRUCTION_SIZE)\n#define DETOUR_IA64_INSTRUCTION2_OFFSET (DETOUR_IA64_TEMPLATE_SIZE + DETOUR_IA64_INSTRUCTION_SIZE + DETOUR_IA64_INSTRUCTION_SIZE)\n\nC_ASSERT(DETOUR_IA64_TEMPLATE_SIZE + DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE * DETOUR_IA64_INSTRUCTION_SIZE == 128);\n\n__declspec(align(16)) struct DETOUR_IA64_BUNDLE\n{\n public:\n union\n {\n BYTE data[16];\n UINT64 wide[2];\n };\n\n enum {\n A_UNIT = 1u,\n I_UNIT = 2u,\n M_UNIT = 3u,\n B_UNIT = 4u,\n F_UNIT = 5u,\n L_UNIT = 6u,\n X_UNIT = 7u,\n };\n struct DETOUR_IA64_METADATA\n {\n ULONG nTemplate : 8; // Instruction template.\n ULONG nUnit0 : 4; // Unit for slot 0\n ULONG nUnit1 : 4; // Unit for slot 1\n ULONG nUnit2 : 4; // Unit for slot 2\n };\n\n protected:\n static const DETOUR_IA64_METADATA s_rceCopyTable[33];\n\n UINT RelocateBundle(_Inout_ DETOUR_IA64_BUNDLE* pDst, _Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra) const;\n\n bool RelocateInstruction(_Inout_ DETOUR_IA64_BUNDLE* pDst,\n _In_ BYTE slot,\n _Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra) const;\n\n // 120 112 104 96 88 80 72 64 56 48 40 32 24 16 8 0\n // f. e. d. c. b. a. 9. 8. 7. 6. 5. 4. 3. 2. 1. 0.\n\n // 00\n // f.e. d.c. b.a. 9.8. 7.6. 5.4. 3.2. 1.0.\n // 0000 0000 0000 0000 0000 0000 0000 001f : Template [4..0]\n // 0000 0000 0000 0000 0000 03ff ffff ffe0 : Zero [ 41.. 5]\n // 0000 0000 0000 0000 0000 3c00 0000 0000 : Zero [ 45.. 42]\n // 0000 0000 0007 ffff ffff c000 0000 0000 : One [ 82.. 46]\n // 0000 0000 0078 0000 0000 0000 0000 0000 : One [ 86.. 83]\n // 0fff ffff ff80 0000 0000 0000 0000 0000 : Two [123.. 87]\n // f000 0000 0000 0000 0000 0000 0000 0000 : Two [127..124]\n BYTE GetTemplate() const;\n // Get 4 bit opcodes.\n BYTE GetInst0() const;\n BYTE GetInst1() const;\n BYTE GetInst2() const;\n BYTE GetUnit(BYTE slot) const;\n BYTE GetUnit0() const;\n BYTE GetUnit1() const;\n BYTE GetUnit2() const;\n // Get 37 bit data.\n UINT64 GetData0() const;\n UINT64 GetData1() const;\n UINT64 GetData2() const;\n\n // Get/set the full 41 bit instructions.\n UINT64 GetInstruction(BYTE slot) const;\n UINT64 GetInstruction0() const;\n UINT64 GetInstruction1() const;\n UINT64 GetInstruction2() const;\n void SetInstruction(BYTE slot, UINT64 instruction);\n void SetInstruction0(UINT64 instruction);\n void SetInstruction1(UINT64 instruction);\n void SetInstruction2(UINT64 instruction);\n\n // Get/set bitfields.\n static UINT64 GetBits(UINT64 Value, UINT64 Offset, UINT64 Count);\n static UINT64 SetBits(UINT64 Value, UINT64 Offset, UINT64 Count, UINT64 Field);\n\n // Get specific read-only fields.\n static UINT64 GetOpcode(UINT64 instruction); // 4bit opcode\n static UINT64 GetX(UINT64 instruction); // 1bit opcode extension\n static UINT64 GetX3(UINT64 instruction); // 3bit opcode extension\n static UINT64 GetX6(UINT64 instruction); // 6bit opcode extension\n\n // Get/set specific fields.\n static UINT64 GetImm7a(UINT64 instruction);\n static UINT64 SetImm7a(UINT64 instruction, UINT64 imm7a);\n static UINT64 GetImm13c(UINT64 instruction);\n static UINT64 SetImm13c(UINT64 instruction, UINT64 imm13c);\n static UINT64 GetSignBit(UINT64 instruction);\n static UINT64 SetSignBit(UINT64 instruction, UINT64 signBit);\n static UINT64 GetImm20a(UINT64 instruction);\n static UINT64 SetImm20a(UINT64 instruction, UINT64 imm20a);\n static UINT64 GetImm20b(UINT64 instruction);\n static UINT64 SetImm20b(UINT64 instruction, UINT64 imm20b);\n\n static UINT64 SignExtend(UINT64 Value, UINT64 Offset);\n\n BOOL IsMovlGp() const;\n\n VOID SetInst(BYTE Slot, BYTE nInst);\n VOID SetInst0(BYTE nInst);\n VOID SetInst1(BYTE nInst);\n VOID SetInst2(BYTE nInst);\n VOID SetData(BYTE Slot, UINT64 nData);\n VOID SetData0(UINT64 nData);\n VOID SetData1(UINT64 nData);\n VOID SetData2(UINT64 nData);\n BOOL SetNop(BYTE Slot);\n BOOL SetNop0();\n BOOL SetNop1();\n BOOL SetNop2();\n\n public:\n BOOL IsBrl() const;\n VOID SetBrl();\n VOID SetBrl(UINT64 target);\n UINT64 GetBrlTarget() const;\n VOID SetBrlTarget(UINT64 target);\n VOID SetBrlImm(UINT64 imm);\n UINT64 GetBrlImm() const;\n\n UINT64 GetMovlGp() const;\n VOID SetMovlGp(UINT64 gp);\n\n VOID SetStop();\n\n UINT Copy(_Out_ DETOUR_IA64_BUNDLE *pDst, _Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra = NULL) const;\n};\n#endif // DETOURS_IA64\n\n#ifdef DETOURS_ARM\n\n#define DETOURS_PFUNC_TO_PBYTE(p) ((PBYTE)(((ULONG_PTR)(p)) & ~(ULONG_PTR)1))\n#define DETOURS_PBYTE_TO_PFUNC(p) ((PBYTE)(((ULONG_PTR)(p)) | (ULONG_PTR)1))\n\n#endif // DETOURS_ARM\n\n//////////////////////////////////////////////////////////////////////////////\n\n#ifdef __cplusplus\nextern \"C\" {\n#endif // __cplusplus\n\n#define DETOUR_OFFLINE_LIBRARY(x) \\\nPVOID WINAPI DetourCopyInstruction##x(_In_opt_ PVOID pDst, \\\n _Inout_opt_ PVOID *ppDstPool, \\\n _In_ PVOID pSrc, \\\n _Out_opt_ PVOID *ppTarget, \\\n _Out_opt_ LONG *plExtra); \\\n \\\nBOOL WINAPI DetourSetCodeModule##x(_In_ HMODULE hModule, \\\n _In_ BOOL fLimitReferencesToModule); \\\n\nDETOUR_OFFLINE_LIBRARY(X86)\nDETOUR_OFFLINE_LIBRARY(X64)\nDETOUR_OFFLINE_LIBRARY(ARM)\nDETOUR_OFFLINE_LIBRARY(ARM64)\nDETOUR_OFFLINE_LIBRARY(IA64)\n\n#undef DETOUR_OFFLINE_LIBRARY\n\n//////////////////////////////////////////////////////////////////////////////\n//\n// Helpers for manipulating page protection.\n//\n\n_Success_(return != FALSE)\nBOOL WINAPI DetourVirtualProtectSameExecuteEx(_In_ HANDLE hProcess,\n _In_ PVOID pAddress,\n _In_ SIZE_T nSize,\n _In_ DWORD dwNewProtect,\n _Out_ PDWORD pdwOldProtect);\n\n_Success_(return != FALSE)\nBOOL WINAPI DetourVirtualProtectSameExecute(_In_ PVOID pAddress,\n _In_ SIZE_T nSize,\n _In_ DWORD dwNewProtect,\n _Out_ PDWORD pdwOldProtect);\n#ifdef __cplusplus\n}\n#endif // __cplusplus\n\n//////////////////////////////////////////////////////////////////////////////\n\n#define MM_ALLOCATION_GRANULARITY 0x10000\n\n//////////////////////////////////////////////////////////////////////////////\n\n#endif // DETOURS_INTERNAL\n#endif // __cplusplus\n\n#endif // _DETOURS_H_\n//\n//////////////////////////////////////////////////////////////// End of File.\n"
},
{
"path": "Detours/detoursx.cpp",
"content": "//////////////////////////////////////////////////////////////////////////////\n//\n// Core Detours Functionality (detours.cpp of detours.lib)\n//\n// Microsoft Research Detours Package, Version 4.0.1\n//\n// Copyright (c) Microsoft Corporation. All rights reserved.\n//\n\n#pragma warning(disable:4068) // unknown pragma (suppress)\n\n#if _MSC_VER >= 1900\n#pragma warning(push)\n#pragma warning(disable:4091) // empty typedef\n#endif\n\n#if defined(_KERNEL_MODE)\n#define DETOURS_KERNEL\n#endif\n\n#define _CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS 1\n#define _ARM_WINAPI_PARTITION_DESKTOP_SDK_AVAILABLE 1\n\n#include \n\n#ifdef DETOURS_KERNEL\n#include \"api_thunks.h\"\n#endif\n\n#include \n\n#if (_MSC_VER < 1299)\n#pragma warning(disable: 4710)\n#endif\n\n//#define DETOUR_DEBUG 1\n#define DETOURS_INTERNAL\n\n#include \"detours.h\"\n\n#if DETOURS_VERSION != 0x4c0c1 // 0xMAJORcMINORcPATCH\n#error detours.h version mismatch\n#endif\n\n#if _MSC_VER >= 1900\n#pragma warning(pop)\n#endif\n\n#define NOTHROW\n\n//////////////////////////////////////////////////////////////////////////////\n//\nstruct _DETOUR_ALIGN\n{\n BYTE obTarget : 3;\n BYTE obTrampoline : 5;\n};\n\nC_ASSERT(sizeof(_DETOUR_ALIGN) == 1);\n\n//////////////////////////////////////////////////////////////////////////////\n//\nstatic void* detour_memory_alloc(size_t size)\n{\n#pragma warning(suppress: 4996)\n return ExAllocatePoolWithTag(NonPagedPool, size, DETOUR_SECTION_HEADER_SIGNATURE);\n}\n\nstatic void detour_memory_free(void* p)\n{\n ExFreePoolWithTag(p, DETOUR_SECTION_HEADER_SIGNATURE);\n}\n\nstatic PMDL detour_remap_address(_In_ void* va, _In_ unsigned long size, _Out_ void** new_va)\n{\n PMDL Mdl = NULL;\n void* NewVA = NULL;\n\n for (;;) {\n Mdl = IoAllocateMdl(va, size, FALSE, FALSE, NULL);\n if (Mdl == NULL) {\n SetLastError(ERROR_NOT_ENOUGH_MEMORY);\n break;\n }\n\n __try {\n MmProbeAndLockPages(Mdl, KernelMode, IoReadAccess);\n }\n __except (EXCEPTION_EXECUTE_HANDLER) {\n IoFreeMdl(Mdl), Mdl = NULL;\n SetLastError(GetExceptionCode());\n break;\n }\n\n NewVA = MmGetSystemAddressForMdlSafe(Mdl, HighPagePriority);\n if (NewVA == NULL) {\n MmUnlockPages(Mdl);\n IoFreeMdl(Mdl), Mdl = NULL;\n\n SetLastError(ERROR_NOT_ENOUGH_MEMORY);\n break;\n }\n\n *new_va = NewVA;\n break;\n }\n\n return Mdl;\n}\n\nstatic void detour_unmap_address(_In_ PMDL mdl)\n{\n if (mdl) {\n MmUnlockPages(mdl);\n IoFreeMdl(mdl);\n }\n}\n\n//////////////////////////////////////////////////////////////////////////////\n//\n// Region reserved for system DLLs, which cannot be used for trampolines.\n//\nstatic PVOID s_pSystemRegionLowerBound = (PVOID)(ULONG_PTR)0x70000000;\nstatic PVOID s_pSystemRegionUpperBound = (PVOID)(ULONG_PTR)0x80000000;\n\n//////////////////////////////////////////////////////////////////////////////\n//\nstatic bool detour_is_imported(PBYTE pbCode, PBYTE pbAddress)\n{\n PVOID ImageBase = NULL;\n\n RtlPcToFileHeader(pbCode, &ImageBase);\n if (ImageBase == NULL) {\n return false;\n }\n\n __try {\n PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)ImageBase;\n if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {\n return false;\n }\n\n PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader +\n pDosHeader->e_lfanew);\n if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) {\n return false;\n }\n\n if (pbAddress >= ((PBYTE)pDosHeader +\n pNtHeader->OptionalHeader\n .DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress) &&\n pbAddress < ((PBYTE)pDosHeader +\n pNtHeader->OptionalHeader\n .DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress +\n pNtHeader->OptionalHeader\n .DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size)) {\n return true;\n }\n }\n#pragma prefast(suppress:28940, \"A bad pointer means this probably isn't a PE header.\")\n __except(GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ?\n EXCEPTION_EXECUTE_HANDLER : EXCEPTION_CONTINUE_SEARCH) {\n return false;\n }\n return false;\n}\n\ninline ULONG_PTR detour_2gb_below(ULONG_PTR address)\n{\n return (address > (ULONG_PTR)0x7ff80000) ? address - 0x7ff80000 : 0x80000;\n}\n\ninline ULONG_PTR detour_2gb_above(ULONG_PTR address)\n{\n#if defined(DETOURS_64BIT)\n return (address < (ULONG_PTR)0xffffffff80000000) ? address + 0x7ff80000 : (ULONG_PTR)0xfffffffffff80000;\n#else\n return (address < (ULONG_PTR)0x80000000) ? address + 0x7ff80000 : (ULONG_PTR)0xfff80000;\n#endif\n}\n\n///////////////////////////////////////////////////////////////////////// X86.\n//\n#ifdef DETOURS_X86\n\nstruct _DETOUR_TRAMPOLINE\n{\n BYTE rbCode[30]; // target code + jmp to pbRemain\n BYTE cbCode; // size of moved target code.\n BYTE cbCodeBreak; // padding to make debugging easier.\n BYTE rbRestore[22]; // original target code.\n BYTE cbRestore; // size of original target code.\n BYTE cbRestoreBreak; // padding to make debugging easier.\n _DETOUR_ALIGN rAlign[8]; // instruction alignment array.\n PBYTE pbRemain; // first instruction after moved code. [free list]\n PBYTE pbDetour; // first instruction of detour function.\n};\n\nC_ASSERT(sizeof(_DETOUR_TRAMPOLINE) == 72);\n\nenum {\n SIZE_OF_JMP = 5\n};\n\ninline PBYTE detour_gen_jmp_immediate(PBYTE pbCode, PBYTE pbJmpVal)\n{\n PBYTE pbJmpSrc = pbCode + 5;\n *pbCode++ = 0xE9; // jmp +imm32\n *((INT32*&)pbCode)++ = (INT32)(pbJmpVal - pbJmpSrc);\n return pbCode;\n}\n\ninline PBYTE detour_gen_jmp_immediate(PBYTE pbCode, PBYTE pbFixedCode, PBYTE pbJmpVal)\n{\n PBYTE pbJmpSrc = pbFixedCode + 5;\n *pbCode++ = 0xE9; // jmp +imm32\n *((INT32*&)pbCode)++ = (INT32)(pbJmpVal - pbJmpSrc);\n return pbCode;\n}\n\ninline PBYTE detour_gen_jmp_indirect(PBYTE pbCode, PBYTE *ppbJmpVal)\n{\n *pbCode++ = 0xff; // jmp [+imm32]\n *pbCode++ = 0x25;\n *((INT32*&)pbCode)++ = (INT32)((PBYTE)ppbJmpVal);\n return pbCode;\n}\n\ninline PBYTE detour_gen_brk(PBYTE pbCode, PBYTE pbLimit)\n{\n while (pbCode < pbLimit) {\n *pbCode++ = 0xcc; // brk;\n }\n return pbCode;\n}\n\ninline PBYTE detour_skip_jmp(PBYTE pbCode, PVOID *ppGlobals)\n{\n if (pbCode == NULL) {\n return NULL;\n }\n if (ppGlobals != NULL) {\n *ppGlobals = NULL;\n }\n\n // First, skip over the import vector if there is one.\n if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [imm32]\n // Looks like an import alias jump, then get the code it points to.\n PBYTE pbTarget = *(UNALIGNED PBYTE *)&pbCode[2];\n if (detour_is_imported(pbCode, pbTarget)) {\n PBYTE pbNew = *(UNALIGNED PBYTE *)pbTarget;\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n\n // Then, skip over a patch jump\n if (pbCode[0] == 0xeb) { // jmp +imm8\n PBYTE pbNew = pbCode + 2 + *(CHAR *)&pbCode[1];\n DETOUR_TRACE((\"%p->%p: skipped over short jump.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n\n // First, skip over the import vector if there is one.\n if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [imm32]\n // Looks like an import alias jump, then get the code it points to.\n PBYTE pbTarget = *(UNALIGNED PBYTE *)&pbCode[2];\n if (detour_is_imported(pbCode, pbTarget)) {\n pbNew = *(UNALIGNED PBYTE *)pbTarget;\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n // Finally, skip over a long jump if it is the target of the patch jump.\n else if (pbCode[0] == 0xe9) { // jmp +imm32\n pbNew = pbCode + 5 + *(UNALIGNED INT32 *)&pbCode[1];\n DETOUR_TRACE((\"%p->%p: skipped over long jump.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n return pbCode;\n}\n\ninline void detour_find_jmp_bounds(PBYTE pbCode,\n PDETOUR_TRAMPOLINE *ppLower,\n PDETOUR_TRAMPOLINE *ppUpper)\n{\n // We have to place trampolines within +/- 2GB of code.\n ULONG_PTR lo = detour_2gb_below((ULONG_PTR)pbCode);\n ULONG_PTR hi = detour_2gb_above((ULONG_PTR)pbCode);\n DETOUR_TRACE((\"[%p..%p..%p]\\n\", (PVOID)lo, pbCode, (PVOID)hi));\n\n // And, within +/- 2GB of relative jmp targets.\n if (pbCode[0] == 0xe9) { // jmp +imm32\n PBYTE pbNew = pbCode + 5 + *(UNALIGNED INT32*) & pbCode[1];\n\n if (pbNew < pbCode) {\n hi = detour_2gb_above((ULONG_PTR)pbNew);\n }\n else {\n lo = detour_2gb_below((ULONG_PTR)pbNew);\n }\n DETOUR_TRACE((\"[%p..%p..%p] +imm32\\n\", (PVOID)lo, pbCode, (PVOID)hi));\n }\n\n *ppLower = (PDETOUR_TRAMPOLINE)lo;\n *ppUpper = (PDETOUR_TRAMPOLINE)hi;\n}\n\ninline BOOL detour_does_code_end_function(PBYTE pbCode)\n{\n if (pbCode[0] == 0xeb || // jmp +imm8\n pbCode[0] == 0xe9 || // jmp +imm32\n pbCode[0] == 0xe0 || // jmp eax\n pbCode[0] == 0xc2 || // ret +imm8\n pbCode[0] == 0xc3 || // ret\n pbCode[0] == 0xcc) { // brk\n return TRUE;\n }\n else if (pbCode[0] == 0xf3 && pbCode[1] == 0xc3) { // rep ret\n return TRUE;\n }\n else if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [+imm32]\n return TRUE;\n }\n else if ((pbCode[0] == 0x26 || // jmp es:\n pbCode[0] == 0x2e || // jmp cs:\n pbCode[0] == 0x36 || // jmp ss:\n pbCode[0] == 0x3e || // jmp ds:\n pbCode[0] == 0x64 || // jmp fs:\n pbCode[0] == 0x65) && // jmp gs:\n pbCode[1] == 0xff && // jmp [+imm32]\n pbCode[2] == 0x25) {\n return TRUE;\n }\n return FALSE;\n}\n\ninline ULONG detour_is_code_filler(PBYTE pbCode)\n{\n // 1-byte through 11-byte NOPs.\n if (pbCode[0] == 0x90) {\n return 1;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x90) {\n return 2;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x00) {\n return 3;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x40 &&\n pbCode[3] == 0x00) {\n return 4;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x44 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00) {\n return 5;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x0F && pbCode[2] == 0x1F &&\n pbCode[3] == 0x44 && pbCode[4] == 0x00 && pbCode[5] == 0x00) {\n return 6;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x80 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00) {\n return 7;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x84 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00) {\n return 8;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x0F && pbCode[2] == 0x1F &&\n pbCode[3] == 0x84 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00) {\n return 9;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x66 && pbCode[2] == 0x0F &&\n pbCode[3] == 0x1F && pbCode[4] == 0x84 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00 &&\n pbCode[9] == 0x00) {\n return 10;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x66 && pbCode[2] == 0x66 &&\n pbCode[3] == 0x0F && pbCode[4] == 0x1F && pbCode[5] == 0x84 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00 &&\n pbCode[9] == 0x00 && pbCode[10] == 0x00) {\n return 11;\n }\n\n // int 3.\n if (pbCode[0] == 0xcc) {\n return 1;\n }\n return 0;\n}\n\n#endif // DETOURS_X86\n\n///////////////////////////////////////////////////////////////////////// X64.\n//\n#ifdef DETOURS_X64\n\nstruct _DETOUR_TRAMPOLINE\n{\n // An X64 instuction can be 15 bytes long.\n // In practice 11 seems to be the limit.\n BYTE rbCode[30]; // target code + jmp to pbRemain.\n BYTE cbCode; // size of moved target code.\n BYTE cbCodeBreak; // padding to make debugging easier.\n BYTE rbRestore[30]; // original target code.\n BYTE cbRestore; // size of original target code.\n BYTE cbRestoreBreak; // padding to make debugging easier.\n _DETOUR_ALIGN rAlign[8]; // instruction alignment array.\n PBYTE pbRemain; // first instruction after moved code. [free list]\n PBYTE pbDetour; // first instruction of detour function.\n PBYTE pbCodeIn; // jmp [pbDetour]\n PMDL pbCodeInMdl;\n};\n\nC_ASSERT(sizeof(_DETOUR_TRAMPOLINE) == 104);\n\nenum {\n SIZE_OF_JMP = 6 // jmp[+imm32]\n};\n\nstatic PIMAGE_SECTION_HEADER detour_va_to_section(PVOID base, PIMAGE_NT_HEADERS nt, PBYTE va)\n{\n PIMAGE_SECTION_HEADER NtSection = IMAGE_FIRST_SECTION(nt);\n for (size_t i = 0u; i < nt->FileHeader.NumberOfSections; ++i){\n if (va >= ((PBYTE)base + NtSection->VirtualAddress) &&\n va < ((PBYTE)base + NtSection->VirtualAddress + NtSection->Misc.VirtualSize)) {\n\n return NtSection;\n }\n ++NtSection;\n }\n\n return NULL;\n}\n\nPBYTE detour_gen_codein(PBYTE pbCode, PVOID pDetour, PMDL* pMdl)\n{\n PVOID ImageBase = NULL;\n PIMAGE_SECTION_HEADER NtSection = NULL;\n PIMAGE_SECTION_HEADER NtSectionLast = NULL;\n\n if (RtlPcToFileHeader(pbCode, &ImageBase) == NULL) {\n return NULL;\n }\n\n PIMAGE_NT_HEADERS NtHeader = RtlImageNtHeader(ImageBase);\n if (NtHeader == NULL) {\n return NULL;\n }\n\n NtSection = detour_va_to_section(ImageBase, NtHeader, pbCode);\n if (NtSection == NULL) {\n return NULL;\n }\n\n NtSectionLast = NtSection + 1;\n if (NtSectionLast >= (IMAGE_FIRST_SECTION(NtHeader) + NtHeader->FileHeader.NumberOfSections)) {\n NtSectionLast = NULL;\n }\n\n PBYTE CodeIn = (PBYTE)ImageBase + NtSection->VirtualAddress + NtSection->Misc.VirtualSize;\n PBYTE CodeInEnd = (PBYTE)ImageBase + (NtSectionLast != NULL\n ? NtSectionLast->VirtualAddress\n : NtHeader->OptionalHeader.SizeOfImage);\n\n CodeIn = (PBYTE)(((ULONG_PTR)CodeIn / 0x10 + 1) * 0x10);\n\n PBYTE NewCodeIn = NULL;\n do\n {\n if (*(PVOID*)CodeIn == NULL) {\n *pMdl = detour_remap_address(CodeIn, sizeof(void*), (PVOID*)&NewCodeIn);\n if (NewCodeIn) {\n *(PVOID*)NewCodeIn = pDetour;\n return CodeIn;\n }\n }\n\n CodeIn += sizeof(void*);\n } while (CodeIn < CodeInEnd);\n\n return NULL;\n}\n\nvoid detour_del_codein(PMDL pMdl)\n{\n if (pMdl) {\n PVOID va = MmGetSystemAddressForMdlSafe(pMdl, HighPagePriority);\n memset(va, 0, sizeof(void*));\n\n detour_unmap_address(pMdl);\n }\n}\n\ninline PBYTE detour_gen_jmp_immediate(PBYTE pbCode, PBYTE pbJmpVal)\n{\n PBYTE pbJmpSrc = pbCode + 5;\n *pbCode++ = 0xE9; // jmp +imm32\n *((INT32*&)pbCode)++ = (INT32)(pbJmpVal - pbJmpSrc);\n return pbCode;\n}\n\ninline PBYTE detour_gen_jmp_immediate(PBYTE pbCode, PBYTE pbFixedCode, PBYTE pbJmpVal)\n{\n PBYTE pbJmpSrc = pbFixedCode + 5;\n *pbCode++ = 0xE9; // jmp +imm32\n *((INT32*&)pbCode)++ = (INT32)(pbJmpVal - pbJmpSrc);\n return pbCode;\n}\n\ninline PBYTE detour_gen_jmp_indirect(PBYTE pbCode, PBYTE *ppbJmpVal)\n{\n PBYTE pbJmpSrc = pbCode + 6;\n *pbCode++ = 0xff; // jmp [+imm32]\n *pbCode++ = 0x25;\n *((INT32*&)pbCode)++ = (INT32)((PBYTE)ppbJmpVal - pbJmpSrc);\n return pbCode;\n}\n\ninline PBYTE detour_gen_jmp_indirect(PBYTE pbCode, PBYTE pbFixedCode, PBYTE* ppbJmpVal)\n{\n PBYTE pbJmpSrc = pbFixedCode + 6;\n *pbCode++ = 0xff; // jmp [+imm32]\n *pbCode++ = 0x25;\n *((INT32*&)pbCode)++ = (INT32)((PBYTE)ppbJmpVal - pbJmpSrc);\n return pbCode;\n}\n\ninline PBYTE detour_gen_brk(PBYTE pbCode, PBYTE pbLimit)\n{\n while (pbCode < pbLimit) {\n *pbCode++ = 0xcc; // brk;\n }\n return pbCode;\n}\n\ninline PBYTE detour_skip_jmp(PBYTE pbCode, PVOID *ppGlobals)\n{\n if (pbCode == NULL) {\n return NULL;\n }\n if (ppGlobals != NULL) {\n *ppGlobals = NULL;\n }\n\n // First, skip over the import vector if there is one.\n if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [+imm32]\n // Looks like an import alias jump, then get the code it points to.\n PBYTE pbTarget = pbCode + 6 + *(UNALIGNED INT32 *)&pbCode[2];\n if (detour_is_imported(pbCode, pbTarget)) {\n PBYTE pbNew = *(UNALIGNED PBYTE *)pbTarget;\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n\n // Then, skip over a patch jump\n if (pbCode[0] == 0xeb) { // jmp +imm8\n PBYTE pbNew = pbCode + 2 + *(CHAR *)&pbCode[1];\n DETOUR_TRACE((\"%p->%p: skipped over short jump.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n\n // First, skip over the import vector if there is one.\n if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [+imm32]\n // Looks like an import alias jump, then get the code it points to.\n PBYTE pbTarget = pbCode + 6 + *(UNALIGNED INT32 *)&pbCode[2];\n if (detour_is_imported(pbCode, pbTarget)) {\n pbNew = *(UNALIGNED PBYTE *)pbTarget;\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n // Finally, skip over a long jump if it is the target of the patch jump.\n else if (pbCode[0] == 0xe9) { // jmp +imm32\n pbNew = pbCode + 5 + *(UNALIGNED INT32 *)&pbCode[1];\n DETOUR_TRACE((\"%p->%p: skipped over long jump.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n return pbCode;\n}\n\ninline void detour_find_jmp_bounds(PBYTE pbCode,\n PDETOUR_TRAMPOLINE *ppLower,\n PDETOUR_TRAMPOLINE *ppUpper)\n{\n (void)pbCode;\n *ppLower = (PDETOUR_TRAMPOLINE)(ULONG_PTR)0x0000000000080000;\n *ppUpper = (PDETOUR_TRAMPOLINE)(ULONG_PTR)0xfffffffffff80000;\n}\n\ninline BOOL detour_does_code_end_function(PBYTE pbCode)\n{\n if (pbCode[0] == 0xeb || // jmp +imm8\n pbCode[0] == 0xe9 || // jmp +imm32\n pbCode[0] == 0xe0 || // jmp eax\n pbCode[0] == 0xc2 || // ret +imm8\n pbCode[0] == 0xc3 || // ret\n pbCode[0] == 0xcc) { // brk\n return TRUE;\n }\n else if (pbCode[0] == 0xf3 && pbCode[1] == 0xc3) { // rep ret\n return TRUE;\n }\n else if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [+imm32]\n return TRUE;\n }\n else if ((pbCode[0] == 0x26 || // jmp es:\n pbCode[0] == 0x2e || // jmp cs:\n pbCode[0] == 0x36 || // jmp ss:\n pbCode[0] == 0x3e || // jmp ds:\n pbCode[0] == 0x64 || // jmp fs:\n pbCode[0] == 0x65) && // jmp gs:\n pbCode[1] == 0xff && // jmp [+imm32]\n pbCode[2] == 0x25) {\n return TRUE;\n }\n return FALSE;\n}\n\ninline ULONG detour_is_code_filler(PBYTE pbCode)\n{\n // 1-byte through 11-byte NOPs.\n if (pbCode[0] == 0x90) {\n return 1;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x90) {\n return 2;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x00) {\n return 3;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x40 &&\n pbCode[3] == 0x00) {\n return 4;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x44 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00) {\n return 5;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x0F && pbCode[2] == 0x1F &&\n pbCode[3] == 0x44 && pbCode[4] == 0x00 && pbCode[5] == 0x00) {\n return 6;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x80 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00) {\n return 7;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x84 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00) {\n return 8;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x0F && pbCode[2] == 0x1F &&\n pbCode[3] == 0x84 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00) {\n return 9;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x66 && pbCode[2] == 0x0F &&\n pbCode[3] == 0x1F && pbCode[4] == 0x84 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00 &&\n pbCode[9] == 0x00) {\n return 10;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x66 && pbCode[2] == 0x66 &&\n pbCode[3] == 0x0F && pbCode[4] == 0x1F && pbCode[5] == 0x84 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00 &&\n pbCode[9] == 0x00 && pbCode[10] == 0x00) {\n return 11;\n }\n\n // int 3.\n if (pbCode[0] == 0xcc) {\n return 1;\n }\n return 0;\n}\n\n#endif // DETOURS_X64\n\n//////////////////////////////////////////////////////////////////////// IA64.\n//\n#ifdef DETOURS_IA64\n\nstruct _DETOUR_TRAMPOLINE\n{\n // On the IA64, a trampoline is used for both incoming and outgoing calls.\n //\n // The trampoline contains the following bundles for the outgoing call:\n // movl gp=target_gp;\n // \n // brl target_code;\n //\n // The trampoline contains the following bundles for the incoming call:\n // alloc r41=ar.pfs, b, 0, 8, 0\n // mov r40=rp\n //\n // adds r50=0, r39\n // adds r49=0, r38\n // adds r48=0, r37 ;;\n //\n // adds r47=0, r36\n // adds r46=0, r35\n // adds r45=0, r34\n //\n // adds r44=0, r33\n // adds r43=0, r32\n // adds r42=0, gp ;;\n //\n // movl gp=ffffffff`ffffffff ;;\n //\n // brl.call.sptk.few rp=disas!TestCodes+20e0 (00000000`00404ea0) ;;\n //\n // adds gp=0, r42\n // mov rp=r40, +0 ;;\n // mov.i ar.pfs=r41\n //\n // br.ret.sptk.many rp ;;\n //\n // This way, we only have to relocate a single bundle.\n //\n // The complicated incoming trampoline is required because we have to\n // create an additional stack frame so that we save and restore the gp.\n // We must do this because gp is a caller-saved register, but not saved\n // if the caller thinks the target is in the same DLL, which changes\n // when we insert a detour.\n //\n DETOUR_IA64_BUNDLE bMovlTargetGp; // Bundle which sets target GP\n BYTE rbCode[sizeof(DETOUR_IA64_BUNDLE)]; // moved bundle.\n DETOUR_IA64_BUNDLE bBrlRemainEip; // Brl to pbRemain\n // This must be adjacent to bBranchIslands.\n\n // Each instruction in the moved bundle could be a IP-relative chk or branch or call.\n // Any such instructions are changed to point to a brl in bBranchIslands.\n // This must be adjacent to bBrlRemainEip -- see \"pbPool\".\n DETOUR_IA64_BUNDLE bBranchIslands[DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE];\n\n // Target of brl inserted in target function\n DETOUR_IA64_BUNDLE bAllocFrame; // alloc frame\n DETOUR_IA64_BUNDLE bSave37to39; // save r37, r38, r39.\n DETOUR_IA64_BUNDLE bSave34to36; // save r34, r35, r36.\n DETOUR_IA64_BUNDLE bSaveGPto33; // save gp, r32, r33.\n DETOUR_IA64_BUNDLE bMovlDetourGp; // set detour GP.\n DETOUR_IA64_BUNDLE bCallDetour; // call detour.\n DETOUR_IA64_BUNDLE bPopFrameGp; // pop frame and restore gp.\n DETOUR_IA64_BUNDLE bReturn; // return to caller.\n\n PLABEL_DESCRIPTOR pldTrampoline;\n\n BYTE rbRestore[sizeof(DETOUR_IA64_BUNDLE)]; // original target bundle.\n BYTE cbRestore; // size of original target code.\n BYTE cbCode; // size of moved target code.\n _DETOUR_ALIGN rAlign[14]; // instruction alignment array.\n PBYTE pbRemain; // first instruction after moved code. [free list]\n PBYTE pbDetour; // first instruction of detour function.\n PPLABEL_DESCRIPTOR ppldDetour; // [pbDetour,gpDetour]\n PPLABEL_DESCRIPTOR ppldTarget; // [pbTarget,gpDetour]\n};\n\nC_ASSERT(sizeof(DETOUR_IA64_BUNDLE) == 16);\nC_ASSERT(sizeof(_DETOUR_TRAMPOLINE) == 256 + DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE * 16);\n\nenum {\n SIZE_OF_JMP = sizeof(DETOUR_IA64_BUNDLE)\n};\n\ninline PBYTE detour_skip_jmp(PBYTE pPointer, PVOID *ppGlobals)\n{\n PBYTE pGlobals = NULL;\n PBYTE pbCode = NULL;\n\n if (pPointer != NULL) {\n PPLABEL_DESCRIPTOR ppld = (PPLABEL_DESCRIPTOR)pPointer;\n pbCode = (PBYTE)ppld->EntryPoint;\n pGlobals = (PBYTE)ppld->GlobalPointer;\n }\n if (ppGlobals != NULL) {\n *ppGlobals = pGlobals;\n }\n if (pbCode == NULL) {\n return NULL;\n }\n\n DETOUR_IA64_BUNDLE *pb = (DETOUR_IA64_BUNDLE *)pbCode;\n\n // IA64 Local Import Jumps look like:\n // addl r2=ffffffff`ffe021c0, gp ;;\n // ld8 r2=[r2]\n // nop.i 0 ;;\n //\n // ld8 r3=[r2], 8 ;;\n // ld8 gp=[r2]\n // mov b6=r3, +0\n //\n // nop.m 0\n // nop.i 0\n // br.cond.sptk.few b6\n //\n\n // 002024000200100b\n if ((pb[0].wide[0] & 0xfffffc000603ffff) == 0x002024000200100b &&\n pb[0].wide[1] == 0x0004000000203008 &&\n pb[1].wide[0] == 0x001014180420180a &&\n pb[1].wide[1] == 0x07000830c0203008 &&\n pb[2].wide[0] == 0x0000000100000010 &&\n pb[2].wide[1] == 0x0080006000000200) {\n\n ULONG64 offset =\n ((pb[0].wide[0] & 0x0000000001fc0000) >> 18) | // imm7b\n ((pb[0].wide[0] & 0x000001ff00000000) >> 25) | // imm9d\n ((pb[0].wide[0] & 0x00000000f8000000) >> 11); // imm5c\n if (pb[0].wide[0] & 0x0000020000000000) { // sign\n offset |= 0xffffffffffe00000;\n }\n PBYTE pbTarget = pGlobals + offset;\n DETOUR_TRACE((\"%p: potential import jump, target=%p\\n\", pb, pbTarget));\n\n if (detour_is_imported(pbCode, pbTarget) && *(PBYTE*)pbTarget != NULL) {\n DETOUR_TRACE((\"%p: is import jump, label=%p\\n\", pb, *(PBYTE *)pbTarget));\n\n PPLABEL_DESCRIPTOR ppld = (PPLABEL_DESCRIPTOR)*(PBYTE *)pbTarget;\n pbCode = (PBYTE)ppld->EntryPoint;\n pGlobals = (PBYTE)ppld->GlobalPointer;\n if (ppGlobals != NULL) {\n *ppGlobals = pGlobals;\n }\n }\n }\n return pbCode;\n}\n\n\ninline void detour_find_jmp_bounds(PBYTE pbCode,\n PDETOUR_TRAMPOLINE *ppLower,\n PDETOUR_TRAMPOLINE *ppUpper)\n{\n (void)pbCode;\n *ppLower = (PDETOUR_TRAMPOLINE)(ULONG_PTR)0x0000000000080000;\n *ppUpper = (PDETOUR_TRAMPOLINE)(ULONG_PTR)0xfffffffffff80000;\n}\n\ninline BOOL detour_does_code_end_function(PBYTE pbCode)\n{\n // Routine not needed on IA64.\n (void)pbCode;\n return FALSE;\n}\n\ninline ULONG detour_is_code_filler(PBYTE pbCode)\n{\n // Routine not needed on IA64.\n (void)pbCode;\n return 0;\n}\n\n#endif // DETOURS_IA64\n\n#ifdef DETOURS_ARM\n\nstruct _DETOUR_TRAMPOLINE\n{\n // A Thumb-2 instruction can be 2 or 4 bytes long.\n BYTE rbCode[62]; // target code + jmp to pbRemain\n BYTE cbCode; // size of moved target code.\n BYTE cbCodeBreak; // padding to make debugging easier.\n BYTE rbRestore[22]; // original target code.\n BYTE cbRestore; // size of original target code.\n BYTE cbRestoreBreak; // padding to make debugging easier.\n _DETOUR_ALIGN rAlign[8]; // instruction alignment array.\n PBYTE pbRemain; // first instruction after moved code. [free list]\n PBYTE pbDetour; // first instruction of detour function.\n};\n\nC_ASSERT(sizeof(_DETOUR_TRAMPOLINE) == 104);\n\nenum {\n SIZE_OF_JMP = 8\n};\n\ninline PBYTE align4(PBYTE pValue)\n{\n return (PBYTE)(((ULONG)pValue) & ~(ULONG)3u);\n}\n\ninline ULONG fetch_thumb_opcode(PBYTE pbCode)\n{\n ULONG Opcode = *(UINT16 *)&pbCode[0];\n if (Opcode >= 0xe800) {\n Opcode = (Opcode << 16) | *(UINT16 *)&pbCode[2];\n }\n return Opcode;\n}\n\ninline void write_thumb_opcode(PBYTE &pbCode, ULONG Opcode)\n{\n if (Opcode >= 0x10000) {\n *((UINT16*&)pbCode)++ = Opcode >> 16;\n }\n *((UINT16*&)pbCode)++ = (UINT16)Opcode;\n}\n\nPBYTE detour_gen_jmp_immediate(PBYTE pbCode, PBYTE *ppPool, PBYTE pbJmpVal)\n{\n PBYTE pbLiteral;\n if (ppPool != NULL) {\n *ppPool = *ppPool - 4;\n pbLiteral = *ppPool;\n }\n else {\n pbLiteral = align4(pbCode + 6);\n }\n\n *((PBYTE*&)pbLiteral) = DETOURS_PBYTE_TO_PFUNC(pbJmpVal);\n LONG delta = pbLiteral - align4(pbCode + 4);\n\n write_thumb_opcode(pbCode, 0xf8dff000 | delta); // LDR PC,[PC+n]\n\n if (ppPool == NULL) {\n if (((ULONG)pbCode & 2) != 0) {\n write_thumb_opcode(pbCode, 0xdefe); // BREAK\n }\n pbCode += 4;\n }\n return pbCode;\n}\n\ninline PBYTE detour_gen_brk(PBYTE pbCode, PBYTE pbLimit)\n{\n while (pbCode < pbLimit) {\n write_thumb_opcode(pbCode, 0xdefe);\n }\n return pbCode;\n}\n\ninline PBYTE detour_skip_jmp(PBYTE pbCode, PVOID *ppGlobals)\n{\n if (pbCode == NULL) {\n return NULL;\n }\n if (ppGlobals != NULL) {\n *ppGlobals = NULL;\n }\n\n // Skip over the import jump if there is one.\n pbCode = (PBYTE)DETOURS_PFUNC_TO_PBYTE(pbCode);\n ULONG Opcode = fetch_thumb_opcode(pbCode);\n\n if ((Opcode & 0xfbf08f00) == 0xf2400c00) { // movw r12,#xxxx\n ULONG Opcode2 = fetch_thumb_opcode(pbCode+4);\n\n if ((Opcode2 & 0xfbf08f00) == 0xf2c00c00) { // movt r12,#xxxx\n ULONG Opcode3 = fetch_thumb_opcode(pbCode+8);\n if (Opcode3 == 0xf8dcf000) { // ldr pc,[r12]\n PBYTE pbTarget = (PBYTE)(((Opcode2 << 12) & 0xf7000000) |\n ((Opcode2 << 1) & 0x08000000) |\n ((Opcode2 << 16) & 0x00ff0000) |\n ((Opcode >> 4) & 0x0000f700) |\n ((Opcode >> 15) & 0x00000800) |\n ((Opcode >> 0) & 0x000000ff));\n if (detour_is_imported(pbCode, pbTarget)) {\n PBYTE pbNew = *(PBYTE *)pbTarget;\n pbNew = DETOURS_PFUNC_TO_PBYTE(pbNew);\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n return pbNew;\n }\n }\n }\n }\n return pbCode;\n}\n\ninline void detour_find_jmp_bounds(PBYTE pbCode,\n PDETOUR_TRAMPOLINE *ppLower,\n PDETOUR_TRAMPOLINE *ppUpper)\n{\n // We have to place trampolines within +/- 2GB of code.\n ULONG_PTR lo = detour_2gb_below((ULONG_PTR)pbCode);\n ULONG_PTR hi = detour_2gb_above((ULONG_PTR)pbCode);\n DETOUR_TRACE((\"[%p..%p..%p]\\n\", (PVOID)lo, pbCode, (PVOID)hi));\n\n *ppLower = (PDETOUR_TRAMPOLINE)lo;\n *ppUpper = (PDETOUR_TRAMPOLINE)hi;\n}\n\n\ninline BOOL detour_does_code_end_function(PBYTE pbCode)\n{\n ULONG Opcode = fetch_thumb_opcode(pbCode);\n if ((Opcode & 0xffffff87) == 0x4700 || // bx \n (Opcode & 0xf800d000) == 0xf0009000) { // b \n return TRUE;\n }\n if ((Opcode & 0xffff8000) == 0xe8bd8000) { // pop {...,pc}\n __debugbreak();\n return TRUE;\n }\n if ((Opcode & 0xffffff00) == 0x0000bd00) { // pop {...,pc}\n __debugbreak();\n return TRUE;\n }\n return FALSE;\n}\n\ninline ULONG detour_is_code_filler(PBYTE pbCode)\n{\n if (pbCode[0] == 0x00 && pbCode[1] == 0xbf) { // nop.\n return 2;\n }\n if (pbCode[0] == 0x00 && pbCode[1] == 0x00) { // zero-filled padding.\n return 2;\n }\n return 0;\n}\n\n#endif // DETOURS_ARM\n\n#ifdef DETOURS_ARM64\n\nstruct _DETOUR_TRAMPOLINE\n{\n // An ARM64 instruction is 4 bytes long.\n BYTE rbCode[64]; // target code + jmp to pbRemain\n BYTE cbCode; // size of moved target code.\n BYTE cbCodeBreak[3]; // padding to make debugging easier.\n BYTE rbRestore[24]; // original target code.\n BYTE cbRestore; // size of original target code.\n BYTE cbRestoreBreak[3]; // padding to make debugging easier.\n _DETOUR_ALIGN rAlign[8]; // instruction alignment array.\n PBYTE pbRemain; // first instruction after moved code. [free list]\n PBYTE pbDetour; // first instruction of detour function.\n};\n\nC_ASSERT(sizeof(_DETOUR_TRAMPOLINE) == 120);\n\nenum {\n SIZE_OF_JMP = 8\n};\n\ninline ULONG fetch_opcode(PBYTE pbCode)\n{\n return *(ULONG *)pbCode;\n}\n\ninline void write_opcode(PBYTE &pbCode, ULONG Opcode)\n{\n *(ULONG *)pbCode = Opcode;\n pbCode += 4;\n}\n\nPBYTE detour_gen_jmp_immediate(PBYTE pbCode, PBYTE *ppPool, PBYTE pbJmpVal)\n{\n PBYTE pbLiteral;\n if (ppPool != NULL) {\n *ppPool = *ppPool - 8;\n pbLiteral = *ppPool;\n }\n else {\n pbLiteral = pbCode + 2*4;\n }\n\n *((PBYTE*&)pbLiteral) = pbJmpVal;\n LONG delta = (LONG)(pbLiteral - pbCode);\n\n write_opcode(pbCode, 0x58000011 | ((delta / 4) << 5)); // LDR X17,[PC+n]\n write_opcode(pbCode, 0xd61f0000 | (17 << 5)); // BR X17\n\n if (ppPool == NULL) {\n pbCode += 8;\n }\n return pbCode;\n}\n\ninline PBYTE detour_gen_brk(PBYTE pbCode, PBYTE pbLimit)\n{\n while (pbCode < pbLimit) {\n write_opcode(pbCode, 0xd4100000 | (0xf000 << 5));\n }\n return pbCode;\n}\n\ninline PBYTE detour_skip_jmp(PBYTE pbCode, PVOID *ppGlobals)\n{\n if (pbCode == NULL) {\n return NULL;\n }\n if (ppGlobals != NULL) {\n *ppGlobals = NULL;\n }\n\n // Skip over the import jump if there is one.\n pbCode = (PBYTE)pbCode;\n ULONG Opcode = fetch_opcode(pbCode);\n if ((Opcode & 0x9f00001f) == 0x90000010) { // adrp x16, IAT\n ULONG Opcode2 = fetch_opcode(pbCode+4);\n\n if ((Opcode2 & 0xffe003ff) == 0xf9400210) { // ldr x16, [x16, IAT]\n ULONG Opcode3 = fetch_opcode(pbCode+8);\n\n if (Opcode3 == 0xd61f0200) { // br x16\n\n ULONG PageOffset = ((Opcode & 0x60000000) >> 29) | ((Opcode & 0x00ffffe0) >> 3);\n PageOffset = (LONG)(Opcode << 11) >> 11;\n\n PBYTE pbTarget = (PBYTE)(((ULONG64)pbCode & 0xfffffffffffff000ULL) + PageOffset +\n ((Opcode2 >> 10) & 0xfff));\n if (detour_is_imported(pbCode, pbTarget)) {\n PBYTE pbNew = *(PBYTE *)pbTarget;\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n return pbNew;\n }\n }\n }\n }\n return pbCode;\n}\n\ninline void detour_find_jmp_bounds(PBYTE pbCode,\n PDETOUR_TRAMPOLINE* ppLower,\n PDETOUR_TRAMPOLINE* ppUpper)\n{\n // The encoding used by detour_gen_jmp_indirect actually enables a\n // displacement of +/- 4GiB. In the future, this could be changed to\n // reflect that. For now, just reuse the x86 logic which is plenty.\n\n ULONG_PTR lo = detour_2gb_below((ULONG_PTR)pbCode);\n ULONG_PTR hi = detour_2gb_above((ULONG_PTR)pbCode);\n DETOUR_TRACE((\"[%p..%p..%p]\\n\", (PVOID)lo, pbCode, (PVOID)hi));\n\n *ppLower = (PDETOUR_TRAMPOLINE)lo;\n *ppUpper = (PDETOUR_TRAMPOLINE)hi;\n}\n\ninline BOOL detour_does_code_end_function(PBYTE pbCode)\n{\n ULONG Opcode = fetch_opcode(pbCode);\n if ((Opcode & 0xfffffc1f) == 0xd65f0000 || // br \n (Opcode & 0xfc000000) == 0x14000000) { // b \n return TRUE;\n }\n return FALSE;\n}\n\ninline ULONG detour_is_code_filler(PBYTE pbCode)\n{\n if (*(ULONG *)pbCode == 0xd503201f) { // nop.\n return 4;\n }\n if (*(ULONG *)pbCode == 0x00000000) { // zero-filled padding.\n return 4;\n }\n return 0;\n}\n\n#endif // DETOURS_ARM64\n\n//////////////////////////////////////////////// Trampoline Memory Management.\n//\nstruct DETOUR_REGION\n{\n ULONG dwSignature;\n PMDL pMdl; // MDL in this region.\n DETOUR_REGION * pNext; // Next region in list of regions.\n DETOUR_TRAMPOLINE * pFree; // List of free trampolines in this region.\n};\ntypedef DETOUR_REGION * PDETOUR_REGION;\n\nconst ULONG DETOUR_REGION_SIGNATURE = 'Rrtd';\nconst ULONG DETOUR_REGION_SIZE = PAGE_SIZE;\nconst ULONG DETOUR_TRAMPOLINES_PER_REGION = (DETOUR_REGION_SIZE\n / sizeof(DETOUR_TRAMPOLINE)) - 1;\nstatic PDETOUR_REGION s_pRegions = NULL; // List of all regions.\nstatic PDETOUR_REGION s_pRegion = NULL; // Default region.\n\nstatic DWORD detour_writable_trampoline_regions()\n{\n // Mark all of the regions as writable.\n for (PDETOUR_REGION pRegion = s_pRegions; pRegion != NULL; pRegion = pRegion->pNext) {\n NTSTATUS Result = MmProtectMdlSystemAddress(pRegion->pMdl, PAGE_EXECUTE_READWRITE);\n if (!NT_SUCCESS(Result)) {\n return SetLastError(Result), Result;\n }\n }\n return NO_ERROR;\n}\n\nstatic void detour_runnable_trampoline_regions()\n{\n // Mark all of the regions as executable.\n for (PDETOUR_REGION pRegion = s_pRegions; pRegion != NULL; pRegion = pRegion->pNext) {\n\n MmProtectMdlSystemAddress(pRegion->pMdl, PAGE_EXECUTE_READ);\n }\n}\n\n//static PBYTE detour_alloc_round_down_to_region(PBYTE pbTry)\n//{\n// // WinXP64 returns free areas that aren't REGION aligned to 32-bit applications.\n// ULONG_PTR extra = ((ULONG_PTR)pbTry) & (DETOUR_REGION_SIZE - 1);\n// if (extra != 0) {\n// pbTry -= extra;\n// }\n// return pbTry;\n//}\n//\n//static PBYTE detour_alloc_round_up_to_region(PBYTE pbTry)\n//{\n// // WinXP64 returns free areas that aren't REGION aligned to 32-bit applications.\n// ULONG_PTR extra = ((ULONG_PTR)pbTry) & (DETOUR_REGION_SIZE - 1);\n// if (extra != 0) {\n// ULONG_PTR adjust = DETOUR_REGION_SIZE - extra;\n// pbTry += adjust;\n// }\n// return pbTry;\n//}\n\n// Starting at pbLo, try to allocate a memory region, continue until pbHi.\n\nstatic PVOID detour_alloc_region_from_lo(PMDL pMdl, PBYTE /*pbLo*/, PBYTE /*pbHi*/)\n{\n return MmGetSystemAddressForMdlSafe(pMdl, HighPagePriority);\n}\n\n// Starting at pbHi, try to allocate a memory region, continue until pbLo.\n\nstatic PVOID detour_alloc_region_from_hi(PMDL pMdl, PBYTE /*pbLo*/, PBYTE /*pbHi*/)\n{\n return MmGetSystemAddressForMdlSafe(pMdl, HighPagePriority);\n}\n\nstatic PDETOUR_TRAMPOLINE detour_alloc_trampoline(PBYTE pbTarget)\n{\n // We have to place trampolines within +/- 2GB of target.\n\n PDETOUR_TRAMPOLINE pLo;\n PDETOUR_TRAMPOLINE pHi;\n\n detour_find_jmp_bounds(pbTarget, &pLo, &pHi);\n\n PDETOUR_TRAMPOLINE pTrampoline = NULL;\n\n // Insure that there is a default region.\n if (s_pRegion == NULL && s_pRegions != NULL) {\n s_pRegion = s_pRegions;\n }\n\n // First check the default region for an valid free block.\n if (s_pRegion != NULL && s_pRegion->pFree != NULL &&\n s_pRegion->pFree >= pLo && s_pRegion->pFree <= pHi) {\n\n found_region:\n pTrampoline = s_pRegion->pFree;\n // do a last sanity check on region.\n if (pTrampoline < pLo || pTrampoline > pHi) {\n return NULL;\n }\n s_pRegion->pFree = (PDETOUR_TRAMPOLINE)pTrampoline->pbRemain;\n memset(pTrampoline, 0xcc, sizeof(*pTrampoline));\n return pTrampoline;\n }\n\n // Then check the existing regions for a valid free block.\n for (s_pRegion = s_pRegions; s_pRegion != NULL; s_pRegion = s_pRegion->pNext) {\n if (s_pRegion != NULL && s_pRegion->pFree != NULL &&\n s_pRegion->pFree >= pLo && s_pRegion->pFree <= pHi) {\n goto found_region;\n }\n }\n\n // We need to allocate a new region.\n\n // Round pbTarget down to 64KB block.\n pbTarget = pbTarget - (PtrToUlong(pbTarget) & 0xffff);\n\n PMDL pMdl = NULL;\n PVOID pbTry = NULL;\n\n PHYSICAL_ADDRESS EmptyDesc = { 0 };\n PHYSICAL_ADDRESS MaxAddress = { 0 };\n MaxAddress.QuadPart = LONGLONG_MAX;\n\n pMdl = MmAllocatePagesForMdlEx(\n EmptyDesc, MaxAddress, EmptyDesc, DETOUR_REGION_SIZE,\n MmCached, MM_ALLOCATE_REQUIRE_CONTIGUOUS_CHUNKS);\n if (pMdl == NULL)\n {\n DETOUR_TRACE((\"Couldn't alloc memory region!\\n\"));\n return NULL;\n }\n\n // NB: We must always also start the search at an offset from pbTarget\n // in order to maintain ASLR entropy.\n\n#if defined(DETOURS_64BIT)\n // Try looking 1GB below or lower.\n if (pbTry == NULL && pbTarget > (PBYTE)0x40000000) {\n pbTry = detour_alloc_region_from_hi(pMdl, (PBYTE)pLo, pbTarget - 0x40000000);\n }\n // Try looking 1GB above or higher.\n if (pbTry == NULL && pbTarget < (PBYTE)0xffffffff40000000) {\n pbTry = detour_alloc_region_from_lo(pMdl, pbTarget + 0x40000000, (PBYTE)pHi);\n }\n // Try looking 1GB below or higher.\n if (pbTry == NULL && pbTarget > (PBYTE)0x40000000) {\n pbTry = detour_alloc_region_from_lo(pMdl, pbTarget - 0x40000000, pbTarget);\n }\n // Try looking 1GB above or lower.\n if (pbTry == NULL && pbTarget < (PBYTE)0xffffffff40000000) {\n pbTry = detour_alloc_region_from_hi(pMdl, pbTarget, pbTarget + 0x40000000);\n }\n#endif\n\n // Try anything below.\n if (pbTry == NULL) {\n pbTry = detour_alloc_region_from_hi(pMdl, (PBYTE)pLo, pbTarget);\n }\n // try anything above.\n if (pbTry == NULL) {\n pbTry = detour_alloc_region_from_lo(pMdl, pbTarget, (PBYTE)pHi);\n }\n\n if (pbTry != NULL) {\n s_pRegion = (DETOUR_REGION*)pbTry;\n s_pRegion->dwSignature = DETOUR_REGION_SIGNATURE;\n s_pRegion->pMdl = pMdl;\n s_pRegion->pFree = NULL;\n s_pRegion->pNext = s_pRegions;\n s_pRegions = s_pRegion;\n DETOUR_TRACE((\" Allocated region %p..%p\\n\\n\",\n s_pRegion, ((PBYTE)s_pRegion) + DETOUR_REGION_SIZE - 1));\n\n // Put everything but the first trampoline on the free list.\n PBYTE pFree = NULL;\n pTrampoline = ((PDETOUR_TRAMPOLINE)s_pRegion) + 1;\n for (int i = DETOUR_TRAMPOLINES_PER_REGION - 1; i > 1; i--) {\n pTrampoline[i].pbRemain = pFree;\n pFree = (PBYTE)&pTrampoline[i];\n }\n s_pRegion->pFree = (PDETOUR_TRAMPOLINE)pFree;\n goto found_region;\n }\n\n DETOUR_TRACE((\"Couldn't find available memory region!\\n\"));\n return NULL;\n}\n\nstatic void detour_free_trampoline(PDETOUR_TRAMPOLINE pTrampoline)\n{\n PDETOUR_REGION pRegion = (PDETOUR_REGION)\n ((ULONG_PTR)pTrampoline & ~(ULONG_PTR)(DETOUR_REGION_SIZE - 1));\n\n memset(pTrampoline, 0, sizeof(*pTrampoline));\n pTrampoline->pbRemain = (PBYTE)pRegion->pFree;\n pRegion->pFree = pTrampoline;\n}\n\nstatic BOOL detour_is_region_empty(PDETOUR_REGION pRegion)\n{\n // Stop if the region isn't a region (this would be bad).\n if (pRegion->dwSignature != DETOUR_REGION_SIGNATURE) {\n return FALSE;\n }\n\n PBYTE pbRegionBeg = (PBYTE)pRegion;\n PBYTE pbRegionLim = pbRegionBeg + DETOUR_REGION_SIZE;\n\n // Stop if any of the trampolines aren't free.\n PDETOUR_TRAMPOLINE pTrampoline = ((PDETOUR_TRAMPOLINE)pRegion) + 1;\n for (int i = 0; i < DETOUR_TRAMPOLINES_PER_REGION; i++) {\n if (pTrampoline[i].pbRemain != NULL &&\n (pTrampoline[i].pbRemain < pbRegionBeg ||\n pTrampoline[i].pbRemain >= pbRegionLim)) {\n return FALSE;\n }\n }\n\n // OK, the region is empty.\n return TRUE;\n}\n\nstatic void detour_free_unused_trampoline_regions()\n{\n PDETOUR_REGION *ppRegionBase = &s_pRegions;\n PDETOUR_REGION pRegion = s_pRegions;\n\n while (pRegion != NULL) {\n if (detour_is_region_empty(pRegion)) {\n *ppRegionBase = pRegion->pNext;\n\n PMDL pMdl = pRegion->pMdl;\n\n MmUnmapLockedPages(pRegion, pMdl);\n MmFreePagesFromMdl(pMdl);\n ExFreePool(pMdl);\n\n s_pRegion = NULL;\n }\n else {\n ppRegionBase = &pRegion->pNext;\n }\n pRegion = *ppRegionBase;\n }\n}\n\n///////////////////////////////////////////////////////// Transaction Structs.\n//\nstruct DetourThread\n{\n DetourThread * pNext;\n HANDLE hThread;\n};\n\nstruct DetourOperation\n{\n DetourOperation * pNext;\n BOOL fIsRemove;\n PBYTE * ppbPointer;\n PBYTE pbTarget;\n PMDL pbTargetMdl;\n PDETOUR_TRAMPOLINE pTrampoline;\n};\n\nstatic BOOL s_fIgnoreTooSmall = FALSE;\nstatic BOOL s_fRetainRegions = FALSE;\n\nstatic LONG s_nPendingThreadId = 0; // Thread owning pending transaction.\nstatic LONG s_nPendingError = NO_ERROR;\nstatic PVOID * s_ppPendingError = NULL;\nstatic DetourThread * s_pPendingThreads = NULL;\nstatic DetourOperation * s_pPendingOperations = NULL;\n\n//////////////////////////////////////////////////////////////////////////////\n//\nPVOID WINAPI DetourCodeFromPointer(_In_ PVOID pPointer,\n _Out_opt_ PVOID *ppGlobals)\n{\n return detour_skip_jmp((PBYTE)pPointer, ppGlobals);\n}\n\n//////////////////////////////////////////////////////////// Transaction APIs.\n//\nBOOL WINAPI DetourSetIgnoreTooSmall(_In_ BOOL fIgnore)\n{\n BOOL fPrevious = s_fIgnoreTooSmall;\n s_fIgnoreTooSmall = fIgnore;\n return fPrevious;\n}\n\nBOOL WINAPI DetourSetRetainRegions(_In_ BOOL fRetain)\n{\n BOOL fPrevious = s_fRetainRegions;\n s_fRetainRegions = fRetain;\n return fPrevious;\n}\n\nPVOID WINAPI DetourSetSystemRegionLowerBound(_In_ PVOID pSystemRegionLowerBound)\n{\n PVOID pPrevious = s_pSystemRegionLowerBound;\n s_pSystemRegionLowerBound = pSystemRegionLowerBound;\n return pPrevious;\n}\n\nPVOID WINAPI DetourSetSystemRegionUpperBound(_In_ PVOID pSystemRegionUpperBound)\n{\n PVOID pPrevious = s_pSystemRegionUpperBound;\n s_pSystemRegionUpperBound = pSystemRegionUpperBound;\n return pPrevious;\n}\n\nLONG WINAPI DetourTransactionBegin()\n{\n // Only one transaction is allowed at a time.\n_Benign_race_begin_\n if (s_nPendingThreadId != 0) {\n return ERROR_INVALID_OPERATION;\n }\n_Benign_race_end_\n\n // Make sure only one thread can start a transaction.\n if (InterlockedCompareExchange(&s_nPendingThreadId, (LONG)GetCurrentThreadId(), 0) != 0) {\n return ERROR_INVALID_OPERATION;\n }\n\n s_pPendingOperations = NULL;\n s_pPendingThreads = NULL;\n s_ppPendingError = NULL;\n\n // Make sure the trampoline pages are writable.\n s_nPendingError = detour_writable_trampoline_regions();\n\n return s_nPendingError;\n}\n\nLONG WINAPI DetourTransactionAbort()\n{\n if (s_nPendingThreadId != (LONG)GetCurrentThreadId()) {\n return ERROR_INVALID_OPERATION;\n }\n\n // Restore all of the page permissions.\n for (DetourOperation *o = s_pPendingOperations; o != NULL;) {\n // We don't care if this fails, because the code is still accessible.\n\n detour_unmap_address(o->pbTargetMdl);\n\n if (!o->fIsRemove) {\n if (o->pTrampoline) {\n detour_free_trampoline(o->pTrampoline);\n o->pTrampoline = NULL;\n }\n }\n\n DetourOperation *n = o->pNext;\n detour_memory_free(o);\n o = n;\n }\n s_pPendingOperations = NULL;\n\n // Make sure the trampoline pages are no longer writable.\n detour_runnable_trampoline_regions();\n\n // Resume any suspended processor.\n s_pPendingThreads = NULL;\n s_nPendingThreadId = 0;\n\n return NO_ERROR;\n}\n\nLONG WINAPI DetourTransactionCommit()\n{\n return DetourTransactionCommitEx(NULL);\n}\n\n#pragma warning(suppress: 4505)\nstatic BYTE detour_align_from_trampoline(PDETOUR_TRAMPOLINE pTrampoline, BYTE obTrampoline)\n{\n for (LONG n = 0; n < ARRAYSIZE(pTrampoline->rAlign); n++) {\n if (pTrampoline->rAlign[n].obTrampoline == obTrampoline) {\n return pTrampoline->rAlign[n].obTarget;\n }\n }\n return 0;\n}\n\n#pragma warning(suppress: 4505)\nstatic LONG detour_align_from_target(PDETOUR_TRAMPOLINE pTrampoline, LONG obTarget)\n{\n for (LONG n = 0; n < ARRAYSIZE(pTrampoline->rAlign); n++) {\n if (pTrampoline->rAlign[n].obTarget == obTarget) {\n return pTrampoline->rAlign[n].obTrampoline;\n }\n }\n return 0;\n}\n\nLONG WINAPI DetourTransactionCommitEx(_Out_opt_ PVOID **pppFailedPointer)\n{\n if (pppFailedPointer != NULL) {\n // Used to get the last error.\n *pppFailedPointer = s_ppPendingError;\n }\n if (s_nPendingThreadId != (LONG)GetCurrentThreadId()) {\n return ERROR_INVALID_OPERATION;\n }\n\n // If any of the pending operations failed, then we abort the whole transaction.\n if (s_nPendingError != NO_ERROR) {\n DETOUR_BREAK();\n DetourTransactionAbort();\n return s_nPendingError;\n }\n\n KeGenericCallDpc([](PKDPC /*Dpc*/, PVOID Context, PVOID SystemArgument1, PVOID SystemArgument2)\n {\n // Common variables.\n BOOL freed = FALSE;\n DetourOperation* o = NULL;\n ULONG PendingProcessorId = (ULONG)(ULONG_PTR)Context;\n\n KeSignalCallDpcSynchronize(SystemArgument2);\n\n if (PendingProcessorId == KeGetCurrentProcessorNumber()) {\n\n // Insert or remove each of the detours.\n for (o = s_pPendingOperations; o != NULL; o = o->pNext) {\n if (o->fIsRemove) {\n CopyMemory(o->pbTarget,\n o->pTrampoline->rbRestore,\n o->pTrampoline->cbRestore);\n\n#ifdef DETOURS_IA64\n * o->ppbPointer = (PBYTE)o->pTrampoline->pbRemain - o->pTrampoline->cbRestore;\n#endif // DETOURS_IA64\n\n#ifdef DETOURS_X86\n * o->ppbPointer = o->pTrampoline->pbRemain - o->pTrampoline->cbRestore;\n#endif // DETOURS_X86\n\n#ifdef DETOURS_X64\n detour_del_codein(o->pTrampoline->pbCodeInMdl);\n * o->ppbPointer = o->pTrampoline->pbRemain - o->pTrampoline->cbRestore;\n#endif // DETOURS_X64\n\n#ifdef DETOURS_ARM\n * o->ppbPointer = DETOURS_PBYTE_TO_PFUNC(o->pTrampoline->pbRemain - o->pTrampoline->cbRestore);\n#endif // DETOURS_ARM\n\n#ifdef DETOURS_ARM64\n * o->ppbPointer = o->pTrampoline->pbRemain - o->pTrampoline->cbRestore;\n#endif // DETOURS_ARM\n }\n else {\n DETOUR_TRACE((\"detours: pbTramp =%p, pbRemain=%p, pbDetour=%p, cbRestore=%d\\n\",\n o->pTrampoline,\n o->pTrampoline->pbRemain,\n o->pTrampoline->pbDetour,\n o->pTrampoline->cbRestore));\n\n DETOUR_TRACE((\"detours: pbTarget=%p: \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x [before]\\n\",\n o->pbTarget,\n o->pbTarget[0], o->pbTarget[1], o->pbTarget[2], o->pbTarget[3],\n o->pbTarget[4], o->pbTarget[5], o->pbTarget[6], o->pbTarget[7],\n o->pbTarget[8], o->pbTarget[9], o->pbTarget[10], o->pbTarget[11]));\n\n#ifdef DETOURS_IA64\n ((DETOUR_IA64_BUNDLE*)o->pbTarget)\n ->SetBrl((UINT64)&o->pTrampoline->bAllocFrame);\n *o->ppbPointer = (PBYTE)&o->pTrampoline->pldTrampoline;\n#endif // DETOURS_IA64\n\n#ifdef DETOURS_X64\n o->pTrampoline->pbCodeIn = detour_gen_codein(o->pTrampoline->pbRemain - o->pTrampoline->cbRestore,\n (PVOID)o->pTrampoline->pbDetour, &o->pTrampoline->pbCodeInMdl);\n PBYTE pbCode = detour_gen_jmp_indirect(o->pbTarget, o->pTrampoline->pbRemain - o->pTrampoline->cbRestore, (PBYTE*)o->pTrampoline->pbCodeIn);\n pbCode = detour_gen_brk(pbCode, o->pbTarget + o->pTrampoline->cbRestore /*o->pTrampoline->pbRemain*/);\n *o->ppbPointer = o->pTrampoline->rbCode;\n UNREFERENCED_PARAMETER(pbCode);\n#endif // DETOURS_X64\n\n#ifdef DETOURS_X86\n PBYTE pbCode = detour_gen_jmp_immediate(o->pbTarget, o->pTrampoline->pbRemain - o->pTrampoline->cbRestore, o->pTrampoline->pbDetour);\n pbCode = detour_gen_brk(pbCode, o->pbTarget + o->pTrampoline->cbRestore /*o->pTrampoline->pbRemain*/);\n *o->ppbPointer = o->pTrampoline->rbCode;\n UNREFERENCED_PARAMETER(pbCode);\n#endif // DETOURS_X86\n\n#ifdef DETOURS_ARM\n PBYTE pbCode = detour_gen_jmp_immediate(o->pbTarget, NULL, o->pTrampoline->pbDetour);\n pbCode = detour_gen_brk(pbCode, o->pbTarget + o->pTrampoline->cbRestore /*o->pTrampoline->pbRemain*/);\n *o->ppbPointer = DETOURS_PBYTE_TO_PFUNC(o->pTrampoline->rbCode);\n UNREFERENCED_PARAMETER(pbCode);\n#endif // DETOURS_ARM\n\n#ifdef DETOURS_ARM64\n PBYTE pbCode = detour_gen_jmp_immediate(o->pbTarget, NULL, o->pTrampoline->pbDetour);\n pbCode = detour_gen_brk(pbCode, o->pbTarget + o->pTrampoline->cbRestore /*o->pTrampoline->pbRemain*/);\n *o->ppbPointer = o->pTrampoline->rbCode;\n UNREFERENCED_PARAMETER(pbCode);\n#endif // DETOURS_ARM64\n\n DETOUR_TRACE((\"detours: pbTarget=%p: \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x [after]\\n\",\n o->pbTarget,\n o->pbTarget[0], o->pbTarget[1], o->pbTarget[2], o->pbTarget[3],\n o->pbTarget[4], o->pbTarget[5], o->pbTarget[6], o->pbTarget[7],\n o->pbTarget[8], o->pbTarget[9], o->pbTarget[10], o->pbTarget[11]));\n\n DETOUR_TRACE((\"detours: pbTramp =%p: \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x\\n\",\n o->pTrampoline,\n o->pTrampoline->rbCode[0], o->pTrampoline->rbCode[1],\n o->pTrampoline->rbCode[2], o->pTrampoline->rbCode[3],\n o->pTrampoline->rbCode[4], o->pTrampoline->rbCode[5],\n o->pTrampoline->rbCode[6], o->pTrampoline->rbCode[7],\n o->pTrampoline->rbCode[8], o->pTrampoline->rbCode[9],\n o->pTrampoline->rbCode[10], o->pTrampoline->rbCode[11]));\n\n#ifdef DETOURS_IA64\n DETOUR_TRACE((\"\\n\"));\n DETOUR_TRACE((\"detours: &pldTrampoline =%p\\n\",\n &o->pTrampoline->pldTrampoline));\n DETOUR_TRACE((\"detours: &bMovlTargetGp =%p [%p]\\n\",\n &o->pTrampoline->bMovlTargetGp,\n o->pTrampoline->bMovlTargetGp.GetMovlGp()));\n DETOUR_TRACE((\"detours: &rbCode =%p [%p]\\n\",\n &o->pTrampoline->rbCode,\n ((DETOUR_IA64_BUNDLE&)o->pTrampoline->rbCode).GetBrlTarget()));\n DETOUR_TRACE((\"detours: &bBrlRemainEip =%p [%p]\\n\",\n &o->pTrampoline->bBrlRemainEip,\n o->pTrampoline->bBrlRemainEip.GetBrlTarget()));\n DETOUR_TRACE((\"detours: &bMovlDetourGp =%p [%p]\\n\",\n &o->pTrampoline->bMovlDetourGp,\n o->pTrampoline->bMovlDetourGp.GetMovlGp()));\n DETOUR_TRACE((\"detours: &bBrlDetourEip =%p [%p]\\n\",\n &o->pTrampoline->bCallDetour,\n o->pTrampoline->bCallDetour.GetBrlTarget()));\n DETOUR_TRACE((\"detours: pldDetour =%p [%p]\\n\",\n o->pTrampoline->ppldDetour->EntryPoint,\n o->pTrampoline->ppldDetour->GlobalPointer));\n DETOUR_TRACE((\"detours: pldTarget =%p [%p]\\n\",\n o->pTrampoline->ppldTarget->EntryPoint,\n o->pTrampoline->ppldTarget->GlobalPointer));\n DETOUR_TRACE((\"detours: pbRemain =%p\\n\",\n o->pTrampoline->pbRemain));\n DETOUR_TRACE((\"detours: pbDetour =%p\\n\",\n o->pTrampoline->pbDetour));\n DETOUR_TRACE((\"\\n\"));\n#endif // DETOURS_IA64\n }\n }\n\n // Restore all of the page permissions and flush the icache.\n for (o = s_pPendingOperations; o != NULL;) {\n // We don't care if this fails, because the code is still accessible.\n\n detour_unmap_address(o->pbTargetMdl);\n\n if (o->fIsRemove && o->pTrampoline) {\n detour_free_trampoline(o->pTrampoline);\n o->pTrampoline = NULL;\n freed = true;\n }\n\n DetourOperation* n = o->pNext;\n detour_memory_free(o);\n o = n;\n }\n s_pPendingOperations = NULL;\n\n // Free any trampoline regions that are now unused.\n if (freed && !s_fRetainRegions) {\n detour_free_unused_trampoline_regions();\n }\n }\n\n KeSignalCallDpcDone(SystemArgument1);\n\n }, (PVOID)(ULONG_PTR)KeGetCurrentProcessorNumber());\n\n // Make sure the trampoline pages are no longer writable.\n detour_runnable_trampoline_regions();\n\n // Resume any suspended threads.\n s_pPendingThreads = NULL;\n s_nPendingThreadId = 0;\n\n if (pppFailedPointer != NULL) {\n *pppFailedPointer = s_ppPendingError;\n }\n\n return s_nPendingError;\n}\n\nLONG WINAPI DetourUpdateThread(_In_ HANDLE /*hThread*/)\n{\n // If any of the pending operations failed, then we don't need to do this.\n if (s_nPendingError != NO_ERROR) {\n return s_nPendingError;\n }\n\n return NO_ERROR;\n}\n\n///////////////////////////////////////////////////////////// Transacted APIs.\n//\nLONG WINAPI DetourAttach(_Inout_ PVOID *ppPointer,\n _In_ PVOID pDetour)\n{\n return DetourAttachEx(ppPointer, pDetour, NULL, NULL, NULL);\n}\n\nLONG WINAPI DetourAttachEx(_Inout_ PVOID *ppPointer,\n _In_ PVOID pDetour,\n _Out_opt_ PDETOUR_TRAMPOLINE *ppRealTrampoline,\n _Out_opt_ PVOID *ppRealTarget,\n _Out_opt_ PVOID *ppRealDetour)\n{\n LONG error = NO_ERROR;\n\n if (ppRealTrampoline != NULL) {\n *ppRealTrampoline = NULL;\n }\n if (ppRealTarget != NULL) {\n *ppRealTarget = NULL;\n }\n if (ppRealDetour != NULL) {\n *ppRealDetour = NULL;\n }\n if (pDetour == NULL) {\n DETOUR_TRACE((\"empty detour\\n\"));\n return ERROR_INVALID_PARAMETER;\n }\n\n if (s_nPendingThreadId != (LONG)GetCurrentThreadId()) {\n DETOUR_TRACE((\"transaction conflict with thread id=%d\\n\", s_nPendingThreadId));\n return ERROR_INVALID_OPERATION;\n }\n\n // If any of the pending operations failed, then we don't need to do this.\n if (s_nPendingError != NO_ERROR) {\n DETOUR_TRACE((\"pending transaction error=%d\\n\", s_nPendingError));\n return s_nPendingError;\n }\n\n if (ppPointer == NULL) {\n DETOUR_TRACE((\"ppPointer is null\\n\"));\n return ERROR_INVALID_HANDLE;\n }\n if (*ppPointer == NULL) {\n error = ERROR_INVALID_HANDLE;\n s_nPendingError = error;\n s_ppPendingError = ppPointer;\n DETOUR_TRACE((\"*ppPointer is null (ppPointer=%p)\\n\", ppPointer));\n DETOUR_BREAK();\n return error;\n }\n\n PBYTE pbTarget = (PBYTE)*ppPointer;\n PDETOUR_TRAMPOLINE pTrampoline = NULL;\n DetourOperation *o = NULL;\n\n#ifdef DETOURS_IA64\n PPLABEL_DESCRIPTOR ppldDetour = (PPLABEL_DESCRIPTOR)pDetour;\n PPLABEL_DESCRIPTOR ppldTarget = (PPLABEL_DESCRIPTOR)pbTarget;\n PVOID pDetourGlobals = NULL;\n PVOID pTargetGlobals = NULL;\n\n pDetour = (PBYTE)DetourCodeFromPointer(ppldDetour, &pDetourGlobals);\n pbTarget = (PBYTE)DetourCodeFromPointer(ppldTarget, &pTargetGlobals);\n DETOUR_TRACE((\" ppldDetour=%p, code=%p [gp=%p]\\n\",\n ppldDetour, pDetour, pDetourGlobals));\n DETOUR_TRACE((\" ppldTarget=%p, code=%p [gp=%p]\\n\",\n ppldTarget, pbTarget, pTargetGlobals));\n#else // DETOURS_IA64\n pbTarget = (PBYTE)DetourCodeFromPointer(pbTarget, NULL);\n pDetour = DetourCodeFromPointer(pDetour, NULL);\n#endif // !DETOURS_IA64\n\n // Don't follow a jump if its destination is the target function.\n // This happens when the detour does nothing other than call the target.\n if (pDetour == (PVOID)pbTarget) {\n if (s_fIgnoreTooSmall) {\n goto stop;\n }\n else {\n DETOUR_BREAK();\n goto fail;\n }\n }\n\n if (ppRealTarget != NULL) {\n *ppRealTarget = pbTarget;\n }\n if (ppRealDetour != NULL) {\n *ppRealDetour = pDetour;\n }\n\n o = (DetourOperation*)detour_memory_alloc(sizeof(DetourOperation));\n if (o == NULL) {\n error = ERROR_NOT_ENOUGH_MEMORY;\n fail:\n s_nPendingError = error;\n DETOUR_BREAK();\n stop:\n if (pTrampoline != NULL) {\n detour_free_trampoline(pTrampoline);\n pTrampoline = NULL;\n if (ppRealTrampoline != NULL) {\n *ppRealTrampoline = NULL;\n }\n }\n if (o != NULL) {\n detour_memory_free(o);\n o = NULL;\n }\n s_ppPendingError = ppPointer;\n return error;\n }\n\n pTrampoline = detour_alloc_trampoline(pbTarget);\n if (pTrampoline == NULL) {\n error = ERROR_NOT_ENOUGH_MEMORY;\n DETOUR_BREAK();\n goto fail;\n }\n\n if (ppRealTrampoline != NULL) {\n *ppRealTrampoline = pTrampoline;\n }\n\n DETOUR_TRACE((\"detours: pbTramp=%p, pDetour=%p\\n\", pTrampoline, pDetour));\n\n memset(pTrampoline->rAlign, 0, sizeof(pTrampoline->rAlign));\n\n // Determine the number of movable target instructions.\n PBYTE pbSrc = pbTarget;\n PBYTE pbTrampoline = pTrampoline->rbCode;\n#ifdef DETOURS_IA64\n PBYTE pbPool = (PBYTE)(&pTrampoline->bBranchIslands + 1);\n#else\n PBYTE pbPool = pbTrampoline + sizeof(pTrampoline->rbCode);\n#endif\n ULONG cbTarget = 0;\n ULONG cbJump = SIZE_OF_JMP;\n ULONG nAlign = 0;\n\n#ifdef DETOURS_ARM\n // On ARM, we need an extra instruction when the function isn't 32-bit aligned.\n // Check if the existing code is another detour (or at least a similar\n // \"ldr pc, [PC+0]\" jump.\n if ((ULONG)pbTarget & 2) {\n cbJump += 2;\n\n ULONG op = fetch_thumb_opcode(pbSrc);\n if (op == 0xbf00) {\n op = fetch_thumb_opcode(pbSrc + 2);\n if (op == 0xf8dff000) { // LDR PC,[PC]\n *((PUSHORT&)pbTrampoline)++ = *((PUSHORT&)pbSrc)++;\n *((PULONG&)pbTrampoline)++ = *((PULONG&)pbSrc)++;\n *((PULONG&)pbTrampoline)++ = *((PULONG&)pbSrc)++;\n cbTarget = (LONG)(pbSrc - pbTarget);\n // We will fall through the \"while\" because cbTarget is now >= cbJump.\n }\n }\n }\n else {\n ULONG op = fetch_thumb_opcode(pbSrc);\n if (op == 0xf8dff000) { // LDR PC,[PC]\n *((PULONG&)pbTrampoline)++ = *((PULONG&)pbSrc)++;\n *((PULONG&)pbTrampoline)++ = *((PULONG&)pbSrc)++;\n cbTarget = (LONG)(pbSrc - pbTarget);\n // We will fall through the \"while\" because cbTarget is now >= cbJump.\n }\n }\n#endif\n\n while (cbTarget < cbJump) {\n PBYTE pbOp = pbSrc;\n LONG lExtra = 0;\n\n DETOUR_TRACE((\" DetourCopyInstruction(%p,%p)\\n\",\n pbTrampoline, pbSrc));\n pbSrc = (PBYTE)\n DetourCopyInstruction(pbTrampoline, (PVOID*)&pbPool, pbSrc, NULL, &lExtra);\n DETOUR_TRACE((\" DetourCopyInstruction() = %p (%d bytes)\\n\",\n pbSrc, (int)(pbSrc - pbOp)));\n pbTrampoline += (pbSrc - pbOp) + lExtra;\n cbTarget = (LONG)(pbSrc - pbTarget);\n pTrampoline->rAlign[nAlign].obTarget = cbTarget;\n pTrampoline->rAlign[nAlign].obTrampoline = pbTrampoline - pTrampoline->rbCode;\n nAlign++;\n\n if (nAlign >= ARRAYSIZE(pTrampoline->rAlign)) {\n break;\n }\n\n if (detour_does_code_end_function(pbOp)) {\n break;\n }\n }\n\n // Consume, but don't duplicate padding if it is needed and available.\n while (cbTarget < cbJump) {\n LONG cFiller = detour_is_code_filler(pbSrc);\n if (cFiller == 0) {\n break;\n }\n\n pbSrc += cFiller;\n cbTarget = (LONG)(pbSrc - pbTarget);\n }\n\n#if DETOUR_DEBUG\n {\n DETOUR_TRACE((\" detours: rAlign [\"));\n LONG n = 0;\n for (n = 0; n < ARRAYSIZE(pTrampoline->rAlign); n++) {\n if (pTrampoline->rAlign[n].obTarget == 0 &&\n pTrampoline->rAlign[n].obTrampoline == 0) {\n break;\n }\n DETOUR_TRACE((\" %d/%d\",\n pTrampoline->rAlign[n].obTarget,\n pTrampoline->rAlign[n].obTrampoline\n ));\n\n }\n DETOUR_TRACE((\" ]\\n\"));\n }\n#endif\n\n if (cbTarget < cbJump || nAlign > ARRAYSIZE(pTrampoline->rAlign)) {\n // Too few instructions.\n\n error = ERROR_INVALID_BLOCK;\n if (s_fIgnoreTooSmall) {\n goto stop;\n }\n else {\n DETOUR_BREAK();\n goto fail;\n }\n }\n\n if (pbTrampoline > pbPool) {\n __debugbreak();\n }\n\n#ifdef DETOURS_X64\n pTrampoline->pbCodeIn = NULL;\n pTrampoline->pbCodeInMdl = NULL;\n#endif\n\n pTrampoline->cbCode = (BYTE)(pbTrampoline - pTrampoline->rbCode);\n pTrampoline->cbRestore = (BYTE)cbTarget;\n CopyMemory(pTrampoline->rbRestore, pbTarget, cbTarget);\n\n#if !defined(DETOURS_IA64)\n if (cbTarget > sizeof(pTrampoline->rbCode) - cbJump) {\n // Too many instructions.\n error = ERROR_INVALID_HANDLE;\n DETOUR_BREAK();\n goto fail;\n }\n#endif // !DETOURS_IA64\n\n pTrampoline->pbRemain = pbTarget + cbTarget;\n pTrampoline->pbDetour = (PBYTE)pDetour;\n\n#ifdef DETOURS_IA64\n pTrampoline->ppldDetour = ppldDetour;\n pTrampoline->ppldTarget = ppldTarget;\n pTrampoline->pldTrampoline.EntryPoint = (UINT64)&pTrampoline->bMovlTargetGp;\n pTrampoline->pldTrampoline.GlobalPointer = (UINT64)pDetourGlobals;\n\n ((DETOUR_IA64_BUNDLE *)pTrampoline->rbCode)->SetStop();\n\n pTrampoline->bMovlTargetGp.SetMovlGp((UINT64)pTargetGlobals);\n pTrampoline->bBrlRemainEip.SetBrl((UINT64)pTrampoline->pbRemain);\n\n // Alloc frame: alloc r41=ar.pfs,11,0,8,0; mov r40=rp\n pTrampoline->bAllocFrame.wide[0] = 0x00000580164d480c;\n pTrampoline->bAllocFrame.wide[1] = 0x00c4000500000200;\n // save r36, r37, r38.\n pTrampoline->bSave37to39.wide[0] = 0x031021004e019001;\n pTrampoline->bSave37to39.wide[1] = 0x8401280600420098;\n // save r34,r35,r36: adds r47=0,r36; adds r46=0,r35; adds r45=0,r34\n pTrampoline->bSave34to36.wide[0] = 0x02e0210048017800;\n pTrampoline->bSave34to36.wide[1] = 0x84011005a042008c;\n // save gp,r32,r33\" adds r44=0,r33; adds r43=0,r32; adds r42=0,gp ;;\n pTrampoline->bSaveGPto33.wide[0] = 0x02b0210042016001;\n pTrampoline->bSaveGPto33.wide[1] = 0x8400080540420080;\n // set detour GP.\n pTrampoline->bMovlDetourGp.SetMovlGp((UINT64)pDetourGlobals);\n // call detour: brl.call.sptk.few rp=detour ;;\n pTrampoline->bCallDetour.wide[0] = 0x0000000100000005;\n pTrampoline->bCallDetour.wide[1] = 0xd000001000000000;\n pTrampoline->bCallDetour.SetBrlTarget((UINT64)pDetour);\n // pop frame & gp: adds gp=0,r42; mov rp=r40,+0;; mov.i ar.pfs=r41\n pTrampoline->bPopFrameGp.wide[0] = 0x4000210054000802;\n pTrampoline->bPopFrameGp.wide[1] = 0x00aa029000038005;\n // return to caller: br.ret.sptk.many rp ;;\n pTrampoline->bReturn.wide[0] = 0x0000000100000019;\n pTrampoline->bReturn.wide[1] = 0x0084000880000200;\n\n DETOUR_TRACE((\"detours: &bMovlTargetGp=%p\\n\", &pTrampoline->bMovlTargetGp));\n DETOUR_TRACE((\"detours: &bMovlDetourGp=%p\\n\", &pTrampoline->bMovlDetourGp));\n#endif // DETOURS_IA64\n\n pbTrampoline = pTrampoline->rbCode + pTrampoline->cbCode;\n#ifdef DETOURS_X64\n pbTrampoline = detour_gen_jmp_indirect(pbTrampoline, &pTrampoline->pbRemain);\n pbTrampoline = detour_gen_brk(pbTrampoline, pbPool);\n#endif // DETOURS_X64\n\n#ifdef DETOURS_X86\n pbTrampoline = detour_gen_jmp_immediate(pbTrampoline, pTrampoline->pbRemain);\n pbTrampoline = detour_gen_brk(pbTrampoline, pbPool);\n#endif // DETOURS_X86\n\n#ifdef DETOURS_ARM\n pbTrampoline = detour_gen_jmp_immediate(pbTrampoline, &pbPool, pTrampoline->pbRemain);\n pbTrampoline = detour_gen_brk(pbTrampoline, pbPool);\n#endif // DETOURS_ARM\n\n#ifdef DETOURS_ARM64\n pbTrampoline = detour_gen_jmp_immediate(pbTrampoline, &pbPool, pTrampoline->pbRemain);\n pbTrampoline = detour_gen_brk(pbTrampoline, pbPool);\n#endif // DETOURS_ARM64\n\n (void)pbTrampoline;\n\n PMDL pbTargetMdl = detour_remap_address(pbTarget, cbTarget, (void**)&pbTarget);\n if (pbTargetMdl == NULL) {\n error = GetLastError();\n DETOUR_BREAK();\n goto fail;\n }\n\n DETOUR_TRACE((\"detours: pbTarget=%p: \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x\\n\",\n pbTarget,\n pbTarget[0], pbTarget[1], pbTarget[2], pbTarget[3],\n pbTarget[4], pbTarget[5], pbTarget[6], pbTarget[7],\n pbTarget[8], pbTarget[9], pbTarget[10], pbTarget[11]));\n DETOUR_TRACE((\"detours: pbTramp =%p: \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x \"\n \"%02x %02x %02x %02x\\n\",\n pTrampoline,\n pTrampoline->rbCode[0], pTrampoline->rbCode[1],\n pTrampoline->rbCode[2], pTrampoline->rbCode[3],\n pTrampoline->rbCode[4], pTrampoline->rbCode[5],\n pTrampoline->rbCode[6], pTrampoline->rbCode[7],\n pTrampoline->rbCode[8], pTrampoline->rbCode[9],\n pTrampoline->rbCode[10], pTrampoline->rbCode[11]));\n\n o->fIsRemove = FALSE;\n o->ppbPointer = (PBYTE*)ppPointer;\n o->pTrampoline = pTrampoline;\n o->pbTarget = pbTarget;\n o->pbTargetMdl = pbTargetMdl;\n o->pNext = s_pPendingOperations;\n s_pPendingOperations = o;\n\n return NO_ERROR;\n}\n\nLONG WINAPI DetourDetach(_Inout_ PVOID *ppPointer,\n _In_ PVOID pDetour)\n{\n LONG error = NO_ERROR;\n\n if (s_nPendingThreadId != (LONG)GetCurrentThreadId()) {\n return ERROR_INVALID_OPERATION;\n }\n\n // If any of the pending operations failed, then we don't need to do this.\n if (s_nPendingError != NO_ERROR) {\n return s_nPendingError;\n }\n\n if (pDetour == NULL) {\n return ERROR_INVALID_PARAMETER;\n }\n if (ppPointer == NULL) {\n return ERROR_INVALID_HANDLE;\n }\n if (*ppPointer == NULL) {\n error = ERROR_INVALID_HANDLE;\n s_nPendingError = error;\n s_ppPendingError = ppPointer;\n DETOUR_BREAK();\n return error;\n }\n\n DetourOperation *o = (DetourOperation*)detour_memory_alloc(sizeof(DetourOperation));\n if (o == NULL) {\n error = ERROR_NOT_ENOUGH_MEMORY;\n fail:\n s_nPendingError = error;\n DETOUR_BREAK();\n stop:\n if (o != NULL) {\n detour_memory_free(o);\n o = NULL;\n }\n s_ppPendingError = ppPointer;\n return error;\n }\n\n\n#ifdef DETOURS_IA64\n PPLABEL_DESCRIPTOR ppldTrampo = (PPLABEL_DESCRIPTOR)*ppPointer;\n PPLABEL_DESCRIPTOR ppldDetour = (PPLABEL_DESCRIPTOR)pDetour;\n PVOID pDetourGlobals = NULL;\n PVOID pTrampoGlobals = NULL;\n\n pDetour = (PBYTE)DetourCodeFromPointer(ppldDetour, &pDetourGlobals);\n PDETOUR_TRAMPOLINE pTrampoline = (PDETOUR_TRAMPOLINE)\n DetourCodeFromPointer(ppldTrampo, &pTrampoGlobals);\n DETOUR_TRACE((\" ppldDetour=%p, code=%p [gp=%p]\\n\",\n ppldDetour, pDetour, pDetourGlobals));\n DETOUR_TRACE((\" ppldTrampo=%p, code=%p [gp=%p]\\n\",\n ppldTrampo, pTrampoline, pTrampoGlobals));\n\n\n DETOUR_TRACE((\"\\n\"));\n DETOUR_TRACE((\"detours: &pldTrampoline =%p\\n\",\n &pTrampoline->pldTrampoline));\n DETOUR_TRACE((\"detours: &bMovlTargetGp =%p [%p]\\n\",\n &pTrampoline->bMovlTargetGp,\n pTrampoline->bMovlTargetGp.GetMovlGp()));\n DETOUR_TRACE((\"detours: &rbCode =%p [%p]\\n\",\n &pTrampoline->rbCode,\n ((DETOUR_IA64_BUNDLE&)pTrampoline->rbCode).GetBrlTarget()));\n DETOUR_TRACE((\"detours: &bBrlRemainEip =%p [%p]\\n\",\n &pTrampoline->bBrlRemainEip,\n pTrampoline->bBrlRemainEip.GetBrlTarget()));\n DETOUR_TRACE((\"detours: &bMovlDetourGp =%p [%p]\\n\",\n &pTrampoline->bMovlDetourGp,\n pTrampoline->bMovlDetourGp.GetMovlGp()));\n DETOUR_TRACE((\"detours: &bBrlDetourEip =%p [%p]\\n\",\n &pTrampoline->bCallDetour,\n pTrampoline->bCallDetour.GetBrlTarget()));\n DETOUR_TRACE((\"detours: pldDetour =%p [%p]\\n\",\n pTrampoline->ppldDetour->EntryPoint,\n pTrampoline->ppldDetour->GlobalPointer));\n DETOUR_TRACE((\"detours: pldTarget =%p [%p]\\n\",\n pTrampoline->ppldTarget->EntryPoint,\n pTrampoline->ppldTarget->GlobalPointer));\n DETOUR_TRACE((\"detours: pbRemain =%p\\n\",\n pTrampoline->pbRemain));\n DETOUR_TRACE((\"detours: pbDetour =%p\\n\",\n pTrampoline->pbDetour));\n DETOUR_TRACE((\"\\n\"));\n#else // !DETOURS_IA64\n PDETOUR_TRAMPOLINE pTrampoline =\n (PDETOUR_TRAMPOLINE)DetourCodeFromPointer(*ppPointer, NULL);\n pDetour = DetourCodeFromPointer(pDetour, NULL);\n#endif // !DETOURS_IA64\n\n ////////////////////////////////////// Verify that Trampoline is in place.\n //\n LONG cbTarget = pTrampoline->cbRestore;\n PBYTE pbTarget = pTrampoline->pbRemain - cbTarget;\n if (cbTarget == 0 || cbTarget > sizeof(pTrampoline->rbCode)) {\n error = ERROR_INVALID_BLOCK;\n if (s_fIgnoreTooSmall) {\n goto stop;\n }\n else {\n DETOUR_BREAK();\n goto fail;\n }\n }\n\n if (pTrampoline->pbDetour != pDetour) {\n error = ERROR_INVALID_BLOCK;\n if (s_fIgnoreTooSmall) {\n goto stop;\n }\n else {\n DETOUR_BREAK();\n goto fail;\n }\n }\n\n PMDL pbTargetMdl = detour_remap_address(pbTarget, cbTarget, (void**)&pbTarget);\n if (pbTargetMdl == nullptr)\n {\n error = GetLastError();\n DETOUR_BREAK();\n goto fail;\n }\n\n o->fIsRemove = TRUE;\n o->ppbPointer = (PBYTE*)ppPointer;\n o->pTrampoline = pTrampoline;\n o->pbTarget = pbTarget;\n o->pbTargetMdl = pbTargetMdl;\n o->pNext = s_pPendingOperations;\n s_pPendingOperations = o;\n\n return NO_ERROR;\n}\n\n//////////////////////////////////////////////////////////////////////////////\n//\n// Helpers for manipulating page protection.\n//\n\n// For reference:\n// PAGE_NOACCESS 0x01\n// PAGE_READONLY 0x02\n// PAGE_READWRITE 0x04\n// PAGE_WRITECOPY 0x08\n// PAGE_EXECUTE 0x10\n// PAGE_EXECUTE_READ 0x20\n// PAGE_EXECUTE_READWRITE 0x40\n// PAGE_EXECUTE_WRITECOPY 0x80\n// PAGE_GUARD ...\n// PAGE_NOCACHE ...\n// PAGE_WRITECOMBINE ...\n\n#define DETOUR_PAGE_EXECUTE_ALL (PAGE_EXECUTE | \\\n PAGE_EXECUTE_READ | \\\n PAGE_EXECUTE_READWRITE | \\\n PAGE_EXECUTE_WRITECOPY)\n\n#define DETOUR_PAGE_NO_EXECUTE_ALL (PAGE_NOACCESS | \\\n PAGE_READONLY | \\\n PAGE_READWRITE | \\\n PAGE_WRITECOPY)\n\n#define DETOUR_PAGE_ATTRIBUTES (~(DETOUR_PAGE_EXECUTE_ALL | DETOUR_PAGE_NO_EXECUTE_ALL))\n\nC_ASSERT((DETOUR_PAGE_NO_EXECUTE_ALL << 4) == DETOUR_PAGE_EXECUTE_ALL);\n\n#pragma warning(suppress: 4505)\nstatic DWORD DetourPageProtectAdjustExecute(_In_ DWORD dwOldProtect,\n _In_ DWORD dwNewProtect)\n// Copy EXECUTE from dwOldProtect to dwNewProtect.\n{\n bool const fOldExecute = ((dwOldProtect & DETOUR_PAGE_EXECUTE_ALL) != 0);\n bool const fNewExecute = ((dwNewProtect & DETOUR_PAGE_EXECUTE_ALL) != 0);\n\n if (fOldExecute && !fNewExecute) {\n dwNewProtect = ((dwNewProtect & DETOUR_PAGE_NO_EXECUTE_ALL) << 4)\n | (dwNewProtect & DETOUR_PAGE_ATTRIBUTES);\n }\n else if (!fOldExecute && fNewExecute) {\n dwNewProtect = ((dwNewProtect & DETOUR_PAGE_EXECUTE_ALL) >> 4)\n | (dwNewProtect & DETOUR_PAGE_ATTRIBUTES);\n }\n return dwNewProtect;\n}\n\n_Success_(return != FALSE)\nBOOL WINAPI DetourVirtualProtectSameExecuteEx(_In_ HANDLE hProcess,\n _In_ PVOID pAddress,\n _In_ SIZE_T nSize,\n _In_ DWORD dwNewProtect,\n _Out_ PDWORD pdwOldProtect)\n// Some systems do not allow executability of a page to change. This function applies\n// dwNewProtect to [pAddress, nSize), but preserving the previous executability.\n// This function is meant to be a drop-in replacement for some uses of VirtualProtectEx.\n// When \"restoring\" page protection, there is no need to use this function.\n{\n MEMORY_BASIC_INFORMATION mbi;\n\n // Query to get existing execute access.\n\n ZeroMemory(&mbi, sizeof(mbi));\n\n if (VirtualQueryEx(hProcess, pAddress, &mbi, sizeof(mbi)) == 0) {\n return FALSE;\n }\n return VirtualProtectEx(hProcess, pAddress, nSize,\n DetourPageProtectAdjustExecute(mbi.Protect, dwNewProtect),\n pdwOldProtect);\n}\n\n_Success_(return != FALSE)\nBOOL WINAPI DetourVirtualProtectSameExecute(_In_ PVOID pAddress,\n _In_ SIZE_T nSize,\n _In_ DWORD dwNewProtect,\n _Out_ PDWORD pdwOldProtect)\n{\n return DetourVirtualProtectSameExecuteEx(GetCurrentProcess(),\n pAddress, nSize, dwNewProtect, pdwOldProtect);\n}\n\n// End of File\n"
},
{
"path": "Detours/detver.h",
"content": "//////////////////////////////////////////////////////////////////////////////\n//\n// Common version parameters.\n//\n// Microsoft Research Detours Package, Version 4.0.1\n//\n// Copyright (c) Microsoft Corporation. All rights reserved.\n//\n\n#define _USING_V110_SDK71_ 1\n#include \"winver.h\"\n#if 0\n#include \n#include \n#else\n#ifndef DETOURS_STRINGIFY\n#define DETOURS_STRINGIFY(x) DETOURS_STRINGIFY_(x)\n#define DETOURS_STRINGIFY_(x) #x\n#endif\n\n#define VER_FILEFLAGSMASK 0x3fL\n#define VER_FILEFLAGS 0x0L\n#define VER_FILEOS 0x00040004L\n#define VER_FILETYPE 0x00000002L\n#define VER_FILESUBTYPE 0x00000000L\n#endif\n#define VER_DETOURS_BITS DETOUR_STRINGIFY(DETOURS_BITS)\n"
},
{
"path": "Detours/disasm.cpp",
"content": "//////////////////////////////////////////////////////////////////////////////\n//\n// Detours Disassembler (disasm.cpp of detours.lib)\n//\n// Microsoft Research Detours Package, Version 4.0.1\n//\n// Copyright (c) Microsoft Corporation. All rights reserved.\n//\n\n#if _MSC_VER >= 1900\n#pragma warning(push)\n#pragma warning(disable:4091) // empty typedef\n#endif\n\n#if defined(_KERNEL_MODE)\n#define DETOURS_KERNEL\n#endif\n\n#define _CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS 1\n#define _ARM_WINAPI_PARTITION_DESKTOP_SDK_AVAILABLE 1\n\n#include \n\n#ifdef DETOURS_KERNEL\n#include \"api_thunks.h\"\n#endif\n\n#include \n\n// #define DETOUR_DEBUG 1\n#define DETOURS_INTERNAL\n\n#include \"detours.h\"\n\n#if DETOURS_VERSION != 0x4c0c1 // 0xMAJORcMINORcPATCH\n#error detours.h version mismatch\n#endif\n\n#if _MSC_VER >= 1900\n#pragma warning(pop)\n#endif\n\n#undef ASSERT\n#define ASSERT(x)\n\n//////////////////////////////////////////////////////////////////////////////\n//\n// Special macros to handle the case when we are building disassembler for\n// offline processing.\n//\n\n\n#if defined(DETOURS_X86_OFFLINE_LIBRARY) \\\n || defined(DETOURS_X64_OFFLINE_LIBRARY) \\\n || defined(DETOURS_ARM_OFFLINE_LIBRARY) \\\n || defined(DETOURS_ARM64_OFFLINE_LIBRARY) \\\n || defined(DETOURS_IA64_OFFLINE_LIBRARY)\n\n#undef DETOURS_X64\n#undef DETOURS_X86\n#undef DETOURS_IA64\n#undef DETOURS_ARM\n#undef DETOURS_ARM64\n\n#if defined(DETOURS_X86_OFFLINE_LIBRARY)\n\n#define DetourCopyInstruction DetourCopyInstructionX86\n#define DetourSetCodeModule DetourSetCodeModuleX86\n#define CDetourDis CDetourDisX86\n#define DETOURS_X86\n\n#elif defined(DETOURS_X64_OFFLINE_LIBRARY)\n\n#if !defined(DETOURS_64BIT)\n// Fix this as/if bugs are discovered.\n//#error X64 disassembler can only build for 64-bit.\n#endif\n\n#define DetourCopyInstruction DetourCopyInstructionX64\n#define DetourSetCodeModule DetourSetCodeModuleX64\n#define CDetourDis CDetourDisX64\n#define DETOURS_X64\n\n#elif defined(DETOURS_ARM_OFFLINE_LIBRARY)\n\n#define DetourCopyInstruction DetourCopyInstructionARM\n#define DetourSetCodeModule DetourSetCodeModuleARM\n#define CDetourDis CDetourDisARM\n#define DETOURS_ARM\n\n#elif defined(DETOURS_ARM64_OFFLINE_LIBRARY)\n\n#define DetourCopyInstruction DetourCopyInstructionARM64\n#define DetourSetCodeModule DetourSetCodeModuleARM64\n#define CDetourDis CDetourDisARM64\n#define DETOURS_ARM64\n\n#elif defined(DETOURS_IA64_OFFLINE_LIBRARY)\n\n#define DetourCopyInstruction DetourCopyInstructionIA64\n#define DetourSetCodeModule DetourSetCodeModuleIA64\n#define DETOURS_IA64\n\n#else\n\n#error\n\n#endif\n#endif\n\n//////////////////////////////////////////////////////////////////////////////\n//\n// Function:\n// DetourCopyInstruction(PVOID pDst,\n// PVOID *ppDstPool\n// PVOID pSrc,\n// PVOID *ppTarget,\n// LONG *plExtra)\n// Purpose:\n// Copy a single instruction from pSrc to pDst.\n//\n// Arguments:\n// pDst:\n// Destination address for the instruction. May be NULL in which\n// case DetourCopyInstruction is used to measure an instruction.\n// If not NULL then the source instruction is copied to the\n// destination instruction and any relative arguments are adjusted.\n// ppDstPool:\n// Destination address for the end of the constant pool. The\n// constant pool works backwards toward pDst. All memory between\n// pDst and *ppDstPool must be available for use by this function.\n// ppDstPool may be NULL if pDst is NULL.\n// pSrc:\n// Source address of the instruction.\n// ppTarget:\n// Out parameter for any target instruction address pointed to by\n// the instruction. For example, a branch or a jump insruction has\n// a target, but a load or store instruction doesn't. A target is\n// another instruction that may be executed as a result of this\n// instruction. ppTarget may be NULL.\n// plExtra:\n// Out parameter for the number of extra bytes needed by the\n// instruction to reach the target. For example, lExtra = 3 if the\n// instruction had an 8-bit relative offset, but needs a 32-bit\n// relative offset.\n//\n// Returns:\n// Returns the address of the next instruction (following in the source)\n// instruction. By subtracting pSrc from the return value, the caller\n// can determinte the size of the instruction copied.\n//\n// Comments:\n// By following the pTarget, the caller can follow alternate\n// instruction streams. However, it is not always possible to determine\n// the target based on static analysis. For example, the destination of\n// a jump relative to a register cannot be determined from just the\n// instruction stream. The output value, pTarget, can have any of the\n// following outputs:\n// DETOUR_INSTRUCTION_TARGET_NONE:\n// The instruction has no targets.\n// DETOUR_INSTRUCTION_TARGET_DYNAMIC:\n// The instruction has a non-deterministic (dynamic) target.\n// (i.e. the jump is to an address held in a register.)\n// Address: The instruction has the specified target.\n//\n// When copying instructions, DetourCopyInstruction insures that any\n// targets remain constant. It does so by adjusting any IP relative\n// offsets.\n//\n\n#pragma data_seg(\".detourd\")\n#pragma const_seg(\".detourc\")\n\n//////////////////////////////////////////////////// X86 and X64 Disassembler.\n//\n// Includes full support for all x86 chips prior to the Pentium III, and some newer stuff.\n//\n#if defined(DETOURS_X64) || defined(DETOURS_X86)\n\nclass CDetourDis\n{\n public:\n CDetourDis(_Out_opt_ PBYTE *ppbTarget,\n _Out_opt_ LONG *plExtra);\n\n PBYTE CopyInstruction(PBYTE pbDst, PBYTE pbSrc);\n static BOOL SanityCheckSystem();\n static BOOL SetCodeModule(PBYTE pbBeg, PBYTE pbEnd, BOOL fLimitReferencesToModule);\n\n public:\n struct COPYENTRY;\n typedef const COPYENTRY * REFCOPYENTRY;\n\n typedef PBYTE (CDetourDis::* COPYFUNC)(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n\n // nFlagBits flags.\n enum {\n DYNAMIC = 0x1u,\n ADDRESS = 0x2u,\n NOENLARGE = 0x4u,\n RAX = 0x8u,\n };\n\n // ModR/M Flags\n enum {\n SIB = 0x10u,\n RIP = 0x20u,\n NOTSIB = 0x0fu,\n };\n\n struct COPYENTRY\n {\n // Many of these fields are often ignored. See ENTRY_DataIgnored.\n ULONG nOpcode : 8; // Opcode (ignored)\n ULONG nFixedSize : 4; // Fixed size of opcode\n ULONG nFixedSize16 : 4; // Fixed size when 16 bit operand\n ULONG nModOffset : 4; // Offset to mod/rm byte (0=none)\n ULONG nRelOffset : 4; // Offset to relative target.\n ULONG nTargetBack : 4; // Offset back to absolute or rip target\n ULONG nFlagBits : 4; // Flags for DYNAMIC, etc.\n COPYFUNC pfCopy; // Function pointer.\n };\n\n protected:\n // These macros define common uses of nFixedSize..pfCopy.\n#define ENTRY_DataIgnored 0, 0, 0, 0, 0, 0,\n#define ENTRY_CopyBytes1 1, 1, 0, 0, 0, 0, &CDetourDis::CopyBytes\n#ifdef DETOURS_X64\n#define ENTRY_CopyBytes1Address 9, 5, 0, 0, 0, ADDRESS, &CDetourDis::CopyBytes\n#else\n#define ENTRY_CopyBytes1Address 5, 3, 0, 0, 0, ADDRESS, &CDetourDis::CopyBytes\n#endif\n#define ENTRY_CopyBytes1Dynamic 1, 1, 0, 0, 0, DYNAMIC, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes2 2, 2, 0, 0, 0, 0, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes2Jump ENTRY_DataIgnored &CDetourDis::CopyBytesJump\n#define ENTRY_CopyBytes2CantJump 2, 2, 0, 1, 0, NOENLARGE, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes2Dynamic 2, 2, 0, 0, 0, DYNAMIC, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes3 3, 3, 0, 0, 0, 0, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes3Dynamic 3, 3, 0, 0, 0, DYNAMIC, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes3Or5 5, 3, 0, 0, 0, 0, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes3Or5Dynamic 5, 3, 0, 0, 0, DYNAMIC, &CDetourDis::CopyBytes // x86 only\n#ifdef DETOURS_X64\n#define ENTRY_CopyBytes3Or5Rax 5, 3, 0, 0, 0, RAX, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes3Or5Target 5, 5, 0, 1, 0, 0, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytesJumpToAbsolute 5, 5, 0, 1, 0, 0, &CDetourDis::CopyBytesJumpToAbsolute\n#else\n#define ENTRY_CopyBytes3Or5Rax 5, 3, 0, 0, 0, 0, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes3Or5Target 5, 3, 0, 1, 0, 0, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytesJumpToAbsolute ENTRY_CopyBytes3Or5Target\n#endif\n#define ENTRY_CopyBytes4 4, 4, 0, 0, 0, 0, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes5 5, 5, 0, 0, 0, 0, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes5Or7Dynamic 7, 5, 0, 0, 0, DYNAMIC, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes7 7, 7, 0, 0, 0, 0, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes2Mod 2, 2, 1, 0, 0, 0, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes2ModDynamic 2, 2, 1, 0, 0, DYNAMIC, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes2Mod1 3, 3, 1, 0, 1, 0, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes2ModOperand 6, 4, 1, 0, 4, 0, &CDetourDis::CopyBytes\n#define ENTRY_CopyBytes3Mod 3, 3, 2, 0, 0, 0, &CDetourDis::CopyBytes // SSE3 0F 38 opcode modrm\n#define ENTRY_CopyBytes3Mod1 4, 4, 2, 0, 1, 0, &CDetourDis::CopyBytes // SSE3 0F 3A opcode modrm .. imm8\n#define ENTRY_CopyBytesPrefix ENTRY_DataIgnored &CDetourDis::CopyBytesPrefix\n#define ENTRY_CopyBytesSegment ENTRY_DataIgnored &CDetourDis::CopyBytesSegment\n#define ENTRY_CopyBytesRax ENTRY_DataIgnored &CDetourDis::CopyBytesRax\n#define ENTRY_CopyF2 ENTRY_DataIgnored &CDetourDis::CopyF2\n#define ENTRY_CopyF3 ENTRY_DataIgnored &CDetourDis::CopyF3 // 32bit x86 only\n#define ENTRY_Copy0F ENTRY_DataIgnored &CDetourDis::Copy0F\n#define ENTRY_Copy0F78 ENTRY_DataIgnored &CDetourDis::Copy0F78\n#define ENTRY_Copy0F00 ENTRY_DataIgnored &CDetourDis::Copy0F00 // 32bit x86 only\n#define ENTRY_Copy0FB8 ENTRY_DataIgnored &CDetourDis::Copy0FB8 // 32bit x86 only\n#define ENTRY_Copy66 ENTRY_DataIgnored &CDetourDis::Copy66\n#define ENTRY_Copy67 ENTRY_DataIgnored &CDetourDis::Copy67\n#define ENTRY_CopyF6 ENTRY_DataIgnored &CDetourDis::CopyF6\n#define ENTRY_CopyF7 ENTRY_DataIgnored &CDetourDis::CopyF7\n#define ENTRY_CopyFF ENTRY_DataIgnored &CDetourDis::CopyFF\n#define ENTRY_CopyVex2 ENTRY_DataIgnored &CDetourDis::CopyVex2\n#define ENTRY_CopyVex3 ENTRY_DataIgnored &CDetourDis::CopyVex3\n#define ENTRY_Invalid ENTRY_DataIgnored &CDetourDis::Invalid\n#define ENTRY_End ENTRY_DataIgnored NULL\n\n PBYTE CopyBytes(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n PBYTE CopyBytesPrefix(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n PBYTE CopyBytesSegment(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n PBYTE CopyBytesRax(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n PBYTE CopyBytesJump(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n PBYTE CopyBytesJumpToAbsolute(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n\n PBYTE Invalid(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n\n PBYTE AdjustTarget(PBYTE pbDst, PBYTE pbSrc, UINT cbOp,\n UINT cbTargetOffset, UINT cbTargetSize);\n\n protected:\n PBYTE Copy0F(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n PBYTE Copy0F00(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc); // x86 only sldt/0 str/1 lldt/2 ltr/3 err/4 verw/5 jmpe/6/dynamic invalid/7\n PBYTE Copy0F78(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc); // vmread, 66/extrq/ib/ib, F2/insertq/ib/ib\n PBYTE Copy0FB8(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc); // jmpe or F3/popcnt\n PBYTE Copy66(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n PBYTE Copy67(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n PBYTE CopyF2(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n PBYTE CopyF3(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc); // x86 only\n PBYTE CopyF6(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n PBYTE CopyF7(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n PBYTE CopyFF(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n PBYTE CopyVex2(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n PBYTE CopyVex3(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc);\n PBYTE CopyVexCommon(BYTE m, PBYTE pbDst, PBYTE pbSrc);\n\n protected:\n static const COPYENTRY s_rceCopyTable[257];\n static const COPYENTRY s_rceCopyTable0F[257];\n static const BYTE s_rbModRm[256];\n static PBYTE s_pbModuleBeg;\n static PBYTE s_pbModuleEnd;\n static BOOL s_fLimitReferencesToModule;\n\n protected:\n BOOL m_bOperandOverride = FALSE;\n BOOL m_bAddressOverride = FALSE;\n BOOL m_bRaxOverride = FALSE; // AMD64 only\n BOOL m_bVex = FALSE;\n BOOL m_bF2 = FALSE;\n BOOL m_bF3 = FALSE; // x86 only\n BYTE m_nSegmentOverride = 0;\n\n PBYTE * m_ppbTarget = NULL;\n LONG * m_plExtra = NULL;\n\n LONG m_lScratchExtra = 0;\n PBYTE m_pbScratchTarget = NULL;\n BYTE m_rbScratchDst[64] = { 0 };\n};\n\nPVOID WINAPI DetourCopyInstruction(_In_opt_ PVOID pDst,\n _Inout_opt_ PVOID *ppDstPool,\n _In_ PVOID pSrc,\n _Out_opt_ PVOID *ppTarget,\n _Out_opt_ LONG *plExtra)\n{\n UNREFERENCED_PARAMETER(ppDstPool); // x86 & x64 don't use a constant pool.\n\n CDetourDis oDetourDisasm((PBYTE*)ppTarget, plExtra);\n return oDetourDisasm.CopyInstruction((PBYTE)pDst, (PBYTE)pSrc);\n}\n\n/////////////////////////////////////////////////////////// Disassembler Code.\n//\nCDetourDis::CDetourDis(_Out_opt_ PBYTE *ppbTarget, _Out_opt_ LONG *plExtra)\n{\n m_bOperandOverride = FALSE;\n m_bAddressOverride = FALSE;\n m_bRaxOverride = FALSE;\n m_bF2 = FALSE;\n m_bF3 = FALSE;\n m_bVex = FALSE;\n\n m_ppbTarget = ppbTarget ? ppbTarget : &m_pbScratchTarget;\n m_plExtra = plExtra ? plExtra : &m_lScratchExtra;\n\n *m_ppbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_NONE;\n *m_plExtra = 0;\n}\n\nPBYTE CDetourDis::CopyInstruction(PBYTE pbDst, PBYTE pbSrc)\n{\n // Configure scratch areas if real areas are not available.\n if (NULL == pbDst) {\n pbDst = m_rbScratchDst;\n }\n if (NULL == pbSrc) {\n // We can't copy a non-existent instruction.\n SetLastError(ERROR_INVALID_DATA);\n return NULL;\n }\n\n // Figure out how big the instruction is, do the appropriate copy,\n // and figure out what the target of the instruction is if any.\n //\n REFCOPYENTRY pEntry = &s_rceCopyTable[pbSrc[0]];\n return (this->*pEntry->pfCopy)(pEntry, pbDst, pbSrc);\n}\n\nPBYTE CDetourDis::CopyBytes(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)\n{\n UINT nBytesFixed;\n\n ASSERT(!m_bVex || pEntry->nFlagBits == 0);\n ASSERT(!m_bVex || pEntry->nFixedSize == pEntry->nFixedSize16);\n\n UINT const nModOffset = pEntry->nModOffset;\n UINT const nFlagBits = pEntry->nFlagBits;\n UINT const nFixedSize = pEntry->nFixedSize;\n UINT const nFixedSize16 = pEntry->nFixedSize16;\n\n if (nFlagBits & ADDRESS) {\n nBytesFixed = m_bAddressOverride ? nFixedSize16 : nFixedSize;\n }\n#ifdef DETOURS_X64\n // REX.W trumps 66\n else if (m_bRaxOverride) {\n nBytesFixed = nFixedSize + ((nFlagBits & RAX) ? 4 : 0);\n }\n#endif\n else {\n nBytesFixed = m_bOperandOverride ? nFixedSize16 : nFixedSize;\n }\n\n UINT nBytes = nBytesFixed;\n UINT nRelOffset = pEntry->nRelOffset;\n UINT cbTarget = nBytes - nRelOffset;\n if (nModOffset > 0) {\n ASSERT(nRelOffset == 0);\n BYTE const bModRm = pbSrc[nModOffset];\n BYTE const bFlags = s_rbModRm[bModRm];\n\n nBytes += bFlags & NOTSIB;\n\n if (bFlags & SIB) {\n BYTE const bSib = pbSrc[nModOffset + 1];\n\n if ((bSib & 0x07) == 0x05) {\n if ((bModRm & 0xc0) == 0x00) {\n nBytes += 4;\n }\n else if ((bModRm & 0xc0) == 0x40) {\n nBytes += 1;\n }\n else if ((bModRm & 0xc0) == 0x80) {\n nBytes += 4;\n }\n }\n cbTarget = nBytes - nRelOffset;\n }\n#ifdef DETOURS_X64\n else if (bFlags & RIP) {\n UINT nTargetBack = pEntry->nTargetBack;\n // nTargetBack describes immediate bytes at the end: 1, 2, or 4.\n // 2 vs. 4 is selected via 66 operand size override.\n ASSERT(nTargetBack == 0 || nTargetBack == 1 || nTargetBack == 4);\n if (nTargetBack == 4 && m_bOperandOverride && !m_bRaxOverride) {\n nTargetBack = 2;\n }\n\n nRelOffset = nBytes - (4 + nTargetBack);\n cbTarget = 4;\n }\n#endif\n }\n CopyMemory(pbDst, pbSrc, nBytes);\n\n if (nRelOffset) {\n *m_ppbTarget = AdjustTarget(pbDst, pbSrc, nBytes, nRelOffset, cbTarget);\n#ifdef DETOURS_X64\n if (pEntry->nRelOffset == 0) {\n // This is a data target, not a code target, so we shouldn't return it.\n *m_ppbTarget = NULL;\n }\n#endif\n }\n if (nFlagBits & NOENLARGE) {\n *m_plExtra = -*m_plExtra;\n }\n if (nFlagBits & DYNAMIC) {\n *m_ppbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;\n }\n return pbSrc + nBytes;\n}\n\nPBYTE CDetourDis::CopyBytesPrefix(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)\n{\n pbDst[0] = pbSrc[0];\n pEntry = &s_rceCopyTable[pbSrc[1]];\n return (this->*pEntry->pfCopy)(pEntry, pbDst + 1, pbSrc + 1);\n}\n\nPBYTE CDetourDis::CopyBytesSegment(REFCOPYENTRY, PBYTE pbDst, PBYTE pbSrc)\n{\n m_nSegmentOverride = pbSrc[0];\n return CopyBytesPrefix(NULL, pbDst, pbSrc);\n}\n\nPBYTE CDetourDis::CopyBytesRax(REFCOPYENTRY, PBYTE pbDst, PBYTE pbSrc)\n{ // AMD64 only\n if (pbSrc[0] & 0x8) {\n m_bRaxOverride = TRUE;\n }\n return CopyBytesPrefix(NULL, pbDst, pbSrc);\n}\n\nPBYTE CDetourDis::CopyBytesJump(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)\n{\n (void)pEntry;\n\n PVOID pvSrcAddr = &pbSrc[1];\n PVOID pvDstAddr = NULL;\n LONG_PTR nOldOffset = (LONG_PTR)*(signed char*&)pvSrcAddr;\n LONG_PTR nNewOffset = 0;\n\n *m_ppbTarget = pbSrc + 2 + nOldOffset;\n\n if (pbSrc[0] == 0xeb) {\n pbDst[0] = 0xe9;\n pvDstAddr = &pbDst[1];\n nNewOffset = nOldOffset - ((pbDst - pbSrc) + 3);\n *(UNALIGNED LONG*&)pvDstAddr = (LONG)nNewOffset;\n\n *m_plExtra = 3;\n return pbSrc + 2;\n }\n\n ASSERT(pbSrc[0] >= 0x70 && pbSrc[0] <= 0x7f);\n\n pbDst[0] = 0x0f;\n pbDst[1] = 0x80 | (pbSrc[0] & 0xf);\n pvDstAddr = &pbDst[2];\n nNewOffset = nOldOffset - ((pbDst - pbSrc) + 4);\n *(UNALIGNED LONG*&)pvDstAddr = (LONG)nNewOffset;\n\n *m_plExtra = 4;\n return pbSrc + 2;\n}\n\n\nPBYTE CDetourDis::CopyBytesJumpToAbsolute(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)\n{\n#ifdef DETOURS_KERNEL\n#ifdef DETOURS_X64\n PVOID pvSrcAddr = &pbSrc[1];\n LONG_PTR nOldOffset = (LONG_PTR) * (LONG*&)pvSrcAddr;\n LONG_PTR nNewOffset = (LONG_PTR)(pbSrc + 5 + nOldOffset);\n\n // call imm32 \n if (pbSrc[0] == 0xE8) {\n // jmp rax, imm64 \n pbDst[0] = 0x48;\n pbDst[1] = 0xB8;\n *(UNALIGNED LONG_PTR*)& pbDst[2] = nNewOffset;\n\n // call rax\n pbDst[10] = 0xFF;\n pbDst[11] = 0xD0;\n\n *m_plExtra = 12 - 5;\n *m_ppbTarget = (PBYTE)nNewOffset;\n return pbSrc + 5;\n }\n\n // jmp imm32 \n if (pbSrc[0] == 0xE9) {\n // jmp rax, imm64 \n pbDst[0] = 0x48;\n pbDst[1] = 0xB8;\n *(UNALIGNED LONG_PTR*)&pbDst[2] = nNewOffset;\n\n // jmp rax\n pbDst[10] = 0xFF;\n pbDst[11] = 0xE0;\n\n *m_plExtra = 12 - 5;\n *m_ppbTarget = (PBYTE)nNewOffset;\n return pbSrc + 5;\n }\n#endif // DETOURS_X64\n#endif // DETOURS_KERNEL\n\n return CopyBytes(pEntry, pbDst, pbSrc);\n}\n\nPBYTE CDetourDis::AdjustTarget(PBYTE pbDst, PBYTE pbSrc, UINT cbOp,\n UINT cbTargetOffset, UINT cbTargetSize)\n{\n PBYTE pbTarget = NULL;\n#if 1 // fault injection to test test code\n#if defined(DETOURS_X64)\n typedef LONGLONG T;\n#else\n typedef LONG T;\n#endif\n T nOldOffset;\n T nNewOffset;\n PVOID pvTargetAddr = &pbDst[cbTargetOffset];\n\n switch (cbTargetSize) {\n case 1:\n nOldOffset = *(signed char*&)pvTargetAddr;\n break;\n case 2:\n nOldOffset = *(UNALIGNED SHORT*&)pvTargetAddr;\n break;\n case 4:\n nOldOffset = *(UNALIGNED LONG*&)pvTargetAddr;\n break;\n#if defined(DETOURS_X64)\n case 8:\n nOldOffset = *(UNALIGNED LONGLONG*&)pvTargetAddr;\n break;\n#endif\n default:\n ASSERT(!\"cbTargetSize is invalid.\");\n nOldOffset = 0;\n break;\n }\n\n pbTarget = pbSrc + cbOp + nOldOffset;\n nNewOffset = nOldOffset - (T)(pbDst - pbSrc);\n\n switch (cbTargetSize) {\n case 1:\n *(CHAR*&)pvTargetAddr = (CHAR)nNewOffset;\n if (nNewOffset < SCHAR_MIN || nNewOffset > SCHAR_MAX) {\n *m_plExtra = sizeof(ULONG) - 1;\n }\n break;\n case 2:\n *(UNALIGNED SHORT*&)pvTargetAddr = (SHORT)nNewOffset;\n if (nNewOffset < SHRT_MIN || nNewOffset > SHRT_MAX) {\n *m_plExtra = sizeof(ULONG) - 2;\n }\n break;\n case 4:\n *(UNALIGNED LONG*&)pvTargetAddr = (LONG)nNewOffset;\n if (nNewOffset < LONG_MIN || nNewOffset > LONG_MAX) {\n *m_plExtra = sizeof(ULONG) - 4;\n }\n break;\n#if defined(DETOURS_X64)\n case 8:\n *(UNALIGNED LONGLONG*&)pvTargetAddr = nNewOffset;\n break;\n#endif\n }\n#ifdef DETOURS_X64\n // When we are only computing size, source and dest can be\n // far apart, distance not encodable in 32bits. Ok.\n // At least still check the lower 32bits.\n\n if (pbDst >= m_rbScratchDst && pbDst < (sizeof(m_rbScratchDst) + m_rbScratchDst)) {\n ASSERT((((size_t)pbDst + cbOp + nNewOffset) & 0xFFFFFFFF) == (((size_t)pbTarget) & 0xFFFFFFFF));\n }\n else\n#endif\n {\n ASSERT(pbDst + cbOp + nNewOffset == pbTarget);\n }\n#endif\n return pbTarget;\n}\n\nPBYTE CDetourDis::Invalid(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)\n{\n (void)pbDst;\n (void)pEntry;\n ASSERT(!\"Invalid Instruction\");\n return pbSrc + 1;\n}\n\n////////////////////////////////////////////////////// Individual Bytes Codes.\n//\nPBYTE CDetourDis::Copy0F(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)\n{\n pbDst[0] = pbSrc[0];\n pEntry = &s_rceCopyTable0F[pbSrc[1]];\n return (this->*pEntry->pfCopy)(pEntry, pbDst + 1, pbSrc + 1);\n}\n\nPBYTE CDetourDis::Copy0F78(REFCOPYENTRY, PBYTE pbDst, PBYTE pbSrc)\n{\n // vmread, 66/extrq, F2/insertq\n\n static const COPYENTRY vmread = { 0x78, ENTRY_CopyBytes2Mod };\n static const COPYENTRY extrq_insertq = { 0x78, ENTRY_CopyBytes4 };\n\n ASSERT(!(m_bF2 && m_bOperandOverride));\n\n // For insertq and presumably despite documentation extrq, mode must be 11, not checked.\n // insertq/extrq/78 are followed by two immediate bytes, and given mode == 11, mod/rm byte is always one byte,\n // and the 0x78 makes 4 bytes (not counting the 66/F2/F which are accounted for elsewhere)\n\n REFCOPYENTRY const pEntry = ((m_bF2 || m_bOperandOverride) ? &extrq_insertq : &vmread);\n\n return (this->*pEntry->pfCopy)(pEntry, pbDst, pbSrc);\n}\n\nPBYTE CDetourDis::Copy0F00(REFCOPYENTRY, PBYTE pbDst, PBYTE pbSrc)\n{\n // jmpe is 32bit x86 only\n // Notice that the sizes are the same either way, but jmpe is marked as \"dynamic\".\n\n static const COPYENTRY other = { 0xB8, ENTRY_CopyBytes2Mod }; // sldt/0 str/1 lldt/2 ltr/3 err/4 verw/5 jmpe/6 invalid/7\n static const COPYENTRY jmpe = { 0xB8, ENTRY_CopyBytes2ModDynamic }; // jmpe/6 x86-on-IA64 syscalls\n\n REFCOPYENTRY const pEntry = (((6 << 3) == ((7 << 3) & pbSrc[1])) ? &jmpe : &other);\n return (this->*pEntry->pfCopy)(pEntry, pbDst, pbSrc);\n}\n\nPBYTE CDetourDis::Copy0FB8(REFCOPYENTRY, PBYTE pbDst, PBYTE pbSrc)\n{\n // jmpe is 32bit x86 only\n\n static const COPYENTRY popcnt = { 0xB8, ENTRY_CopyBytes2Mod };\n static const COPYENTRY jmpe = { 0xB8, ENTRY_CopyBytes3Or5Dynamic }; // jmpe x86-on-IA64 syscalls\n REFCOPYENTRY const pEntry = m_bF3 ? &popcnt : &jmpe;\n return (this->*pEntry->pfCopy)(pEntry, pbDst, pbSrc);\n}\n\nPBYTE CDetourDis::Copy66(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)\n{ // Operand-size override prefix\n m_bOperandOverride = TRUE;\n return CopyBytesPrefix(pEntry, pbDst, pbSrc);\n}\n\nPBYTE CDetourDis::Copy67(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)\n{ // Address size override prefix\n m_bAddressOverride = TRUE;\n return CopyBytesPrefix(pEntry, pbDst, pbSrc);\n}\n\nPBYTE CDetourDis::CopyF2(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)\n{\n m_bF2 = TRUE;\n return CopyBytesPrefix(pEntry, pbDst, pbSrc);\n}\n\nPBYTE CDetourDis::CopyF3(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)\n{ // x86 only\n m_bF3 = TRUE;\n return CopyBytesPrefix(pEntry, pbDst, pbSrc);\n}\n\nPBYTE CDetourDis::CopyF6(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)\n{\n (void)pEntry;\n\n // TEST BYTE /0\n if (0x00 == (0x38 & pbSrc[1])) { // reg(bits 543) of ModR/M == 0\n static const COPYENTRY ce = { 0xf6, ENTRY_CopyBytes2Mod1 };\n return (this->*ce.pfCopy)(&ce, pbDst, pbSrc);\n }\n // DIV /6\n // IDIV /7\n // IMUL /5\n // MUL /4\n // NEG /3\n // NOT /2\n\n static const COPYENTRY ce = { 0xf6, ENTRY_CopyBytes2Mod };\n return (this->*ce.pfCopy)(&ce, pbDst, pbSrc);\n}\n\nPBYTE CDetourDis::CopyF7(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)\n{\n (void)pEntry;\n\n // TEST WORD /0\n if (0x00 == (0x38 & pbSrc[1])) { // reg(bits 543) of ModR/M == 0\n static const COPYENTRY ce = { 0xf7, ENTRY_CopyBytes2ModOperand };\n return (this->*ce.pfCopy)(&ce, pbDst, pbSrc);\n }\n\n // DIV /6\n // IDIV /7\n // IMUL /5\n // MUL /4\n // NEG /3\n // NOT /2\n static const COPYENTRY ce = { 0xf7, ENTRY_CopyBytes2Mod };\n return (this->*ce.pfCopy)(&ce, pbDst, pbSrc);\n}\n\nPBYTE CDetourDis::CopyFF(REFCOPYENTRY pEntry, PBYTE pbDst, PBYTE pbSrc)\n{ // INC /0\n // DEC /1\n // CALL /2\n // CALL /3\n // JMP /4\n // JMP /5\n // PUSH /6\n // invalid/7\n (void)pEntry;\n\n static const COPYENTRY ce = { 0xff, ENTRY_CopyBytes2Mod };\n PBYTE pbOut = (this->*ce.pfCopy)(&ce, pbDst, pbSrc);\n\n BYTE const b1 = pbSrc[1];\n\n if (0x15 == b1 || 0x25 == b1) { // CALL [], JMP []\n#ifdef DETOURS_X64\n // All segments but FS and GS are equivalent.\n if (m_nSegmentOverride != 0x64 && m_nSegmentOverride != 0x65)\n#else\n if (m_nSegmentOverride == 0 || m_nSegmentOverride == 0x2E)\n#endif\n {\n#ifdef DETOURS_X64\n INT32 offset = *(UNALIGNED INT32*)&pbSrc[2];\n PBYTE *ppbTarget = (PBYTE *)(pbSrc + 6 + offset);\n#else\n PBYTE *ppbTarget = (PBYTE *)(SIZE_T)*(UNALIGNED ULONG*)&pbSrc[2];\n#endif\n if (s_fLimitReferencesToModule &&\n (ppbTarget < (PVOID)s_pbModuleBeg || ppbTarget >= (PVOID)s_pbModuleEnd)) {\n\n *m_ppbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;\n }\n else {\n // This can access violate on random bytes. Use DetourSetCodeModule.\n *m_ppbTarget = *ppbTarget;\n }\n }\n else {\n *m_ppbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;\n }\n }\n else if (0x10 == (0x30 & b1) || // CALL /2 or /3 --> reg(bits 543) of ModR/M == 010 or 011\n 0x20 == (0x30 & b1)) { // JMP /4 or /5 --> reg(bits 543) of ModR/M == 100 or 101\n *m_ppbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;\n }\n return pbOut;\n}\n\nPBYTE CDetourDis::CopyVexCommon(BYTE m, PBYTE pbDst, PBYTE pbSrc)\n// m is first instead of last in the hopes of pbDst/pbSrc being\n// passed along efficiently in the registers they were already in.\n{\n static const COPYENTRY ceF38 = { 0x38, ENTRY_CopyBytes2Mod };\n static const COPYENTRY ceF3A = { 0x3A, ENTRY_CopyBytes2Mod1 };\n static const COPYENTRY Invalid = { 0xC4, ENTRY_Invalid };\n\n m_bVex = TRUE;\n REFCOPYENTRY pEntry;\n switch (m) {\n default: pEntry = &Invalid; break;\n case 1: pEntry = &s_rceCopyTable0F[pbSrc[0]]; break;\n case 2: pEntry = &ceF38; break;\n case 3: pEntry = &ceF3A; break;\n }\n\n switch (pbSrc[-1] & 3) { // p in last byte\n case 0: break;\n case 1: m_bOperandOverride = TRUE; break;\n case 2: m_bF3 = TRUE; break;\n case 3: m_bF2 = TRUE; break;\n }\n\n return (this->*pEntry->pfCopy)(pEntry, pbDst, pbSrc);\n}\n\nPBYTE CDetourDis::CopyVex3(REFCOPYENTRY, PBYTE pbDst, PBYTE pbSrc)\n// 3 byte VEX prefix 0xC4\n{\n#ifdef DETOURS_X86\n const static COPYENTRY ceLES = { 0xC4, ENTRY_CopyBytes2Mod };\n if ((pbSrc[1] & 0xC0) != 0xC0) {\n REFCOPYENTRY pEntry = &ceLES;\n return (this->*pEntry->pfCopy)(pEntry, pbDst, pbSrc);\n }\n#endif\n pbDst[0] = pbSrc[0];\n pbDst[1] = pbSrc[1];\n pbDst[2] = pbSrc[2];\n#ifdef DETOURS_X64\n m_bRaxOverride |= !!(pbSrc[2] & 0x80); // w in last byte, see CopyBytesRax\n#else\n //\n // TODO\n //\n // Usually the VEX.W bit changes the size of a general purpose register and is ignored for 32bit.\n // Sometimes it is an opcode extension.\n // Look in the Intel manual, in the instruction-by-instruction reference, for \".W1\",\n // without nearby wording saying it is ignored for 32bit.\n // For example: \"VFMADD132PD/VFMADD213PD/VFMADD231PD Fused Multiply-Add of Packed Double-Precision Floating-Point Values\".\n //\n // Then, go through each such case and determine if W0 vs. W1 affect the size of the instruction. Probably not.\n // Look for the same encoding but with \"W1\" changed to \"W0\".\n // Here is one such pairing:\n // VFMADD132PD/VFMADD213PD/VFMADD231PD Fused Multiply-Add of Packed Double-Precision Floating-Point Values\n //\n // VEX.DDS.128.66.0F38.W1 98 /r A V/V FMA Multiply packed double-precision floating-point values\n // from xmm0 and xmm2/mem, add to xmm1 and\n // put result in xmm0.\n // VFMADD132PD xmm0, xmm1, xmm2/m128\n //\n // VFMADD132PS/VFMADD213PS/VFMADD231PS Fused Multiply-Add of Packed Single-Precision Floating-Point Values\n // VEX.DDS.128.66.0F38.W0 98 /r A V/V FMA Multiply packed single-precision floating-point values\n // from xmm0 and xmm2/mem, add to xmm1 and put\n // result in xmm0.\n // VFMADD132PS xmm0, xmm1, xmm2/m128\n //\n#endif\n return CopyVexCommon(pbSrc[1] & 0x1F, pbDst + 3, pbSrc + 3);\n}\n\nPBYTE CDetourDis::CopyVex2(REFCOPYENTRY, PBYTE pbDst, PBYTE pbSrc)\n// 2 byte VEX prefix 0xC5\n{\n#ifdef DETOURS_X86\n const static COPYENTRY ceLDS = { 0xC5, ENTRY_CopyBytes2Mod };\n if ((pbSrc[1] & 0xC0) != 0xC0) {\n REFCOPYENTRY pEntry = &ceLDS;\n return (this->*pEntry->pfCopy)(pEntry, pbDst, pbSrc);\n }\n#endif\n pbDst[0] = pbSrc[0];\n pbDst[1] = pbSrc[1];\n return CopyVexCommon(1, pbDst + 2, pbSrc + 2);\n}\n\n//////////////////////////////////////////////////////////////////////////////\n//\nPBYTE CDetourDis::s_pbModuleBeg = NULL;\nPBYTE CDetourDis::s_pbModuleEnd = (PBYTE)~(ULONG_PTR)0;\nBOOL CDetourDis::s_fLimitReferencesToModule = FALSE;\n\nBOOL CDetourDis::SetCodeModule(PBYTE pbBeg, PBYTE pbEnd, BOOL fLimitReferencesToModule)\n{\n if (pbEnd < pbBeg) {\n return FALSE;\n }\n\n s_pbModuleBeg = pbBeg;\n s_pbModuleEnd = pbEnd;\n s_fLimitReferencesToModule = fLimitReferencesToModule;\n\n return TRUE;\n}\n\n///////////////////////////////////////////////////////// Disassembler Tables.\n//\nconst BYTE CDetourDis::s_rbModRm[256] = {\n 0,0,0,0, SIB|1,RIP|4,0,0, 0,0,0,0, SIB|1,RIP|4,0,0, // 0x\n 0,0,0,0, SIB|1,RIP|4,0,0, 0,0,0,0, SIB|1,RIP|4,0,0, // 1x\n 0,0,0,0, SIB|1,RIP|4,0,0, 0,0,0,0, SIB|1,RIP|4,0,0, // 2x\n 0,0,0,0, SIB|1,RIP|4,0,0, 0,0,0,0, SIB|1,RIP|4,0,0, // 3x\n 1,1,1,1, 2,1,1,1, 1,1,1,1, 2,1,1,1, // 4x\n 1,1,1,1, 2,1,1,1, 1,1,1,1, 2,1,1,1, // 5x\n 1,1,1,1, 2,1,1,1, 1,1,1,1, 2,1,1,1, // 6x\n 1,1,1,1, 2,1,1,1, 1,1,1,1, 2,1,1,1, // 7x\n 4,4,4,4, 5,4,4,4, 4,4,4,4, 5,4,4,4, // 8x\n 4,4,4,4, 5,4,4,4, 4,4,4,4, 5,4,4,4, // 9x\n 4,4,4,4, 5,4,4,4, 4,4,4,4, 5,4,4,4, // Ax\n 4,4,4,4, 5,4,4,4, 4,4,4,4, 5,4,4,4, // Bx\n 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, // Cx\n 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, // Dx\n 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, // Ex\n 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0 // Fx\n};\n\nconst CDetourDis::COPYENTRY CDetourDis::s_rceCopyTable[257] =\n{\n { 0x00, ENTRY_CopyBytes2Mod }, // ADD /r\n { 0x01, ENTRY_CopyBytes2Mod }, // ADD /r\n { 0x02, ENTRY_CopyBytes2Mod }, // ADD /r\n { 0x03, ENTRY_CopyBytes2Mod }, // ADD /r\n { 0x04, ENTRY_CopyBytes2 }, // ADD ib\n { 0x05, ENTRY_CopyBytes3Or5 }, // ADD iw\n#ifdef DETOURS_X64\n { 0x06, ENTRY_Invalid }, // Invalid\n { 0x07, ENTRY_Invalid }, // Invalid\n#else\n { 0x06, ENTRY_CopyBytes1 }, // PUSH\n { 0x07, ENTRY_CopyBytes1 }, // POP\n#endif\n { 0x08, ENTRY_CopyBytes2Mod }, // OR /r\n { 0x09, ENTRY_CopyBytes2Mod }, // OR /r\n { 0x0A, ENTRY_CopyBytes2Mod }, // OR /r\n { 0x0B, ENTRY_CopyBytes2Mod }, // OR /r\n { 0x0C, ENTRY_CopyBytes2 }, // OR ib\n { 0x0D, ENTRY_CopyBytes3Or5 }, // OR iw\n#ifdef DETOURS_X64\n { 0x0E, ENTRY_Invalid }, // Invalid\n#else\n { 0x0E, ENTRY_CopyBytes1 }, // PUSH\n#endif\n { 0x0F, ENTRY_Copy0F }, // Extension Ops\n { 0x10, ENTRY_CopyBytes2Mod }, // ADC /r\n { 0x11, ENTRY_CopyBytes2Mod }, // ADC /r\n { 0x12, ENTRY_CopyBytes2Mod }, // ADC /r\n { 0x13, ENTRY_CopyBytes2Mod }, // ADC /r\n { 0x14, ENTRY_CopyBytes2 }, // ADC ib\n { 0x15, ENTRY_CopyBytes3Or5 }, // ADC id\n#ifdef DETOURS_X64\n { 0x16, ENTRY_Invalid }, // Invalid\n { 0x17, ENTRY_Invalid }, // Invalid\n#else\n { 0x16, ENTRY_CopyBytes1 }, // PUSH\n { 0x17, ENTRY_CopyBytes1 }, // POP\n#endif\n { 0x18, ENTRY_CopyBytes2Mod }, // SBB /r\n { 0x19, ENTRY_CopyBytes2Mod }, // SBB /r\n { 0x1A, ENTRY_CopyBytes2Mod }, // SBB /r\n { 0x1B, ENTRY_CopyBytes2Mod }, // SBB /r\n { 0x1C, ENTRY_CopyBytes2 }, // SBB ib\n { 0x1D, ENTRY_CopyBytes3Or5 }, // SBB id\n#ifdef DETOURS_X64\n { 0x1E, ENTRY_Invalid }, // Invalid\n { 0x1F, ENTRY_Invalid }, // Invalid\n#else\n { 0x1E, ENTRY_CopyBytes1 }, // PUSH\n { 0x1F, ENTRY_CopyBytes1 }, // POP\n#endif\n { 0x20, ENTRY_CopyBytes2Mod }, // AND /r\n { 0x21, ENTRY_CopyBytes2Mod }, // AND /r\n { 0x22, ENTRY_CopyBytes2Mod }, // AND /r\n { 0x23, ENTRY_CopyBytes2Mod }, // AND /r\n { 0x24, ENTRY_CopyBytes2 }, // AND ib\n { 0x25, ENTRY_CopyBytes3Or5 }, // AND id\n { 0x26, ENTRY_CopyBytesSegment }, // ES prefix\n#ifdef DETOURS_X64\n { 0x27, ENTRY_Invalid }, // Invalid\n#else\n { 0x27, ENTRY_CopyBytes1 }, // DAA\n#endif\n { 0x28, ENTRY_CopyBytes2Mod }, // SUB /r\n { 0x29, ENTRY_CopyBytes2Mod }, // SUB /r\n { 0x2A, ENTRY_CopyBytes2Mod }, // SUB /r\n { 0x2B, ENTRY_CopyBytes2Mod }, // SUB /r\n { 0x2C, ENTRY_CopyBytes2 }, // SUB ib\n { 0x2D, ENTRY_CopyBytes3Or5 }, // SUB id\n { 0x2E, ENTRY_CopyBytesSegment }, // CS prefix\n#ifdef DETOURS_X64\n { 0x2F, ENTRY_Invalid }, // Invalid\n#else\n { 0x2F, ENTRY_CopyBytes1 }, // DAS\n#endif\n { 0x30, ENTRY_CopyBytes2Mod }, // XOR /r\n { 0x31, ENTRY_CopyBytes2Mod }, // XOR /r\n { 0x32, ENTRY_CopyBytes2Mod }, // XOR /r\n { 0x33, ENTRY_CopyBytes2Mod }, // XOR /r\n { 0x34, ENTRY_CopyBytes2 }, // XOR ib\n { 0x35, ENTRY_CopyBytes3Or5 }, // XOR id\n { 0x36, ENTRY_CopyBytesSegment }, // SS prefix\n#ifdef DETOURS_X64\n { 0x37, ENTRY_Invalid }, // Invalid\n#else\n { 0x37, ENTRY_CopyBytes1 }, // AAA\n#endif\n { 0x38, ENTRY_CopyBytes2Mod }, // CMP /r\n { 0x39, ENTRY_CopyBytes2Mod }, // CMP /r\n { 0x3A, ENTRY_CopyBytes2Mod }, // CMP /r\n { 0x3B, ENTRY_CopyBytes2Mod }, // CMP /r\n { 0x3C, ENTRY_CopyBytes2 }, // CMP ib\n { 0x3D, ENTRY_CopyBytes3Or5 }, // CMP id\n { 0x3E, ENTRY_CopyBytesSegment }, // DS prefix\n#ifdef DETOURS_X64\n { 0x3F, ENTRY_Invalid }, // Invalid\n#else\n { 0x3F, ENTRY_CopyBytes1 }, // AAS\n#endif\n#ifdef DETOURS_X64 // For Rax Prefix\n { 0x40, ENTRY_CopyBytesRax }, // Rax\n { 0x41, ENTRY_CopyBytesRax }, // Rax\n { 0x42, ENTRY_CopyBytesRax }, // Rax\n { 0x43, ENTRY_CopyBytesRax }, // Rax\n { 0x44, ENTRY_CopyBytesRax }, // Rax\n { 0x45, ENTRY_CopyBytesRax }, // Rax\n { 0x46, ENTRY_CopyBytesRax }, // Rax\n { 0x47, ENTRY_CopyBytesRax }, // Rax\n { 0x48, ENTRY_CopyBytesRax }, // Rax\n { 0x49, ENTRY_CopyBytesRax }, // Rax\n { 0x4A, ENTRY_CopyBytesRax }, // Rax\n { 0x4B, ENTRY_CopyBytesRax }, // Rax\n { 0x4C, ENTRY_CopyBytesRax }, // Rax\n { 0x4D, ENTRY_CopyBytesRax }, // Rax\n { 0x4E, ENTRY_CopyBytesRax }, // Rax\n { 0x4F, ENTRY_CopyBytesRax }, // Rax\n#else\n { 0x40, ENTRY_CopyBytes1 }, // INC\n { 0x41, ENTRY_CopyBytes1 }, // INC\n { 0x42, ENTRY_CopyBytes1 }, // INC\n { 0x43, ENTRY_CopyBytes1 }, // INC\n { 0x44, ENTRY_CopyBytes1 }, // INC\n { 0x45, ENTRY_CopyBytes1 }, // INC\n { 0x46, ENTRY_CopyBytes1 }, // INC\n { 0x47, ENTRY_CopyBytes1 }, // INC\n { 0x48, ENTRY_CopyBytes1 }, // DEC\n { 0x49, ENTRY_CopyBytes1 }, // DEC\n { 0x4A, ENTRY_CopyBytes1 }, // DEC\n { 0x4B, ENTRY_CopyBytes1 }, // DEC\n { 0x4C, ENTRY_CopyBytes1 }, // DEC\n { 0x4D, ENTRY_CopyBytes1 }, // DEC\n { 0x4E, ENTRY_CopyBytes1 }, // DEC\n { 0x4F, ENTRY_CopyBytes1 }, // DEC\n#endif\n { 0x50, ENTRY_CopyBytes1 }, // PUSH\n { 0x51, ENTRY_CopyBytes1 }, // PUSH\n { 0x52, ENTRY_CopyBytes1 }, // PUSH\n { 0x53, ENTRY_CopyBytes1 }, // PUSH\n { 0x54, ENTRY_CopyBytes1 }, // PUSH\n { 0x55, ENTRY_CopyBytes1 }, // PUSH\n { 0x56, ENTRY_CopyBytes1 }, // PUSH\n { 0x57, ENTRY_CopyBytes1 }, // PUSH\n { 0x58, ENTRY_CopyBytes1 }, // POP\n { 0x59, ENTRY_CopyBytes1 }, // POP\n { 0x5A, ENTRY_CopyBytes1 }, // POP\n { 0x5B, ENTRY_CopyBytes1 }, // POP\n { 0x5C, ENTRY_CopyBytes1 }, // POP\n { 0x5D, ENTRY_CopyBytes1 }, // POP\n { 0x5E, ENTRY_CopyBytes1 }, // POP\n { 0x5F, ENTRY_CopyBytes1 }, // POP\n#ifdef DETOURS_X64\n { 0x60, ENTRY_Invalid }, // Invalid\n { 0x61, ENTRY_Invalid }, // Invalid\n { 0x62, ENTRY_Invalid }, // Invalid (not yet implemented Intel EVEX support)\n#else\n { 0x60, ENTRY_CopyBytes1 }, // PUSHAD\n { 0x61, ENTRY_CopyBytes1 }, // POPAD\n { 0x62, ENTRY_CopyBytes2Mod }, // BOUND /r\n#endif\n { 0x63, ENTRY_CopyBytes2Mod }, // 32bit ARPL /r, 64bit MOVSXD\n { 0x64, ENTRY_CopyBytesSegment }, // FS prefix\n { 0x65, ENTRY_CopyBytesSegment }, // GS prefix\n { 0x66, ENTRY_Copy66 }, // Operand Prefix\n { 0x67, ENTRY_Copy67 }, // Address Prefix\n { 0x68, ENTRY_CopyBytes3Or5 }, // PUSH\n { 0x69, ENTRY_CopyBytes2ModOperand }, // IMUL /r iz\n { 0x6A, ENTRY_CopyBytes2 }, // PUSH\n { 0x6B, ENTRY_CopyBytes2Mod1 }, // IMUL /r ib\n { 0x6C, ENTRY_CopyBytes1 }, // INS\n { 0x6D, ENTRY_CopyBytes1 }, // INS\n { 0x6E, ENTRY_CopyBytes1 }, // OUTS/OUTSB\n { 0x6F, ENTRY_CopyBytes1 }, // OUTS/OUTSW\n { 0x70, ENTRY_CopyBytes2Jump }, // JO // 0f80\n { 0x71, ENTRY_CopyBytes2Jump }, // JNO // 0f81\n { 0x72, ENTRY_CopyBytes2Jump }, // JB/JC/JNAE // 0f82\n { 0x73, ENTRY_CopyBytes2Jump }, // JAE/JNB/JNC // 0f83\n { 0x74, ENTRY_CopyBytes2Jump }, // JE/JZ // 0f84\n { 0x75, ENTRY_CopyBytes2Jump }, // JNE/JNZ // 0f85\n { 0x76, ENTRY_CopyBytes2Jump }, // JBE/JNA // 0f86\n { 0x77, ENTRY_CopyBytes2Jump }, // JA/JNBE // 0f87\n { 0x78, ENTRY_CopyBytes2Jump }, // JS // 0f88\n { 0x79, ENTRY_CopyBytes2Jump }, // JNS // 0f89\n { 0x7A, ENTRY_CopyBytes2Jump }, // JP/JPE // 0f8a\n { 0x7B, ENTRY_CopyBytes2Jump }, // JNP/JPO // 0f8b\n { 0x7C, ENTRY_CopyBytes2Jump }, // JL/JNGE // 0f8c\n { 0x7D, ENTRY_CopyBytes2Jump }, // JGE/JNL // 0f8d\n { 0x7E, ENTRY_CopyBytes2Jump }, // JLE/JNG // 0f8e\n { 0x7F, ENTRY_CopyBytes2Jump }, // JG/JNLE // 0f8f\n { 0x80, ENTRY_CopyBytes2Mod1 }, // ADD/0 OR/1 ADC/2 SBB/3 AND/4 SUB/5 XOR/6 CMP/7 byte reg, immediate byte\n { 0x81, ENTRY_CopyBytes2ModOperand }, // ADD/0 OR/1 ADC/2 SBB/3 AND/4 SUB/5 XOR/6 CMP/7 byte reg, immediate word or dword\n#ifdef DETOURS_X64\n { 0x82, ENTRY_Invalid }, // Invalid\n#else\n { 0x82, ENTRY_CopyBytes2Mod1 }, // MOV al,x\n#endif\n { 0x83, ENTRY_CopyBytes2Mod1 }, // ADD/0 OR/1 ADC/2 SBB/3 AND/4 SUB/5 XOR/6 CMP/7 reg, immediate byte\n { 0x84, ENTRY_CopyBytes2Mod }, // TEST /r\n { 0x85, ENTRY_CopyBytes2Mod }, // TEST /r\n { 0x86, ENTRY_CopyBytes2Mod }, // XCHG /r @todo\n { 0x87, ENTRY_CopyBytes2Mod }, // XCHG /r @todo\n { 0x88, ENTRY_CopyBytes2Mod }, // MOV /r\n { 0x89, ENTRY_CopyBytes2Mod }, // MOV /r\n { 0x8A, ENTRY_CopyBytes2Mod }, // MOV /r\n { 0x8B, ENTRY_CopyBytes2Mod }, // MOV /r\n { 0x8C, ENTRY_CopyBytes2Mod }, // MOV /r\n { 0x8D, ENTRY_CopyBytes2Mod }, // LEA /r\n { 0x8E, ENTRY_CopyBytes2Mod }, // MOV /r\n { 0x8F, ENTRY_CopyBytes2Mod }, // POP /0\n { 0x90, ENTRY_CopyBytes1 }, // NOP\n { 0x91, ENTRY_CopyBytes1 }, // XCHG\n { 0x92, ENTRY_CopyBytes1 }, // XCHG\n { 0x93, ENTRY_CopyBytes1 }, // XCHG\n { 0x94, ENTRY_CopyBytes1 }, // XCHG\n { 0x95, ENTRY_CopyBytes1 }, // XCHG\n { 0x96, ENTRY_CopyBytes1 }, // XCHG\n { 0x97, ENTRY_CopyBytes1 }, // XCHG\n { 0x98, ENTRY_CopyBytes1 }, // CWDE\n { 0x99, ENTRY_CopyBytes1 }, // CDQ\n#ifdef DETOURS_X64\n { 0x9A, ENTRY_Invalid }, // Invalid\n#else\n { 0x9A, ENTRY_CopyBytes5Or7Dynamic }, // CALL cp\n#endif\n { 0x9B, ENTRY_CopyBytes1 }, // WAIT/FWAIT\n { 0x9C, ENTRY_CopyBytes1 }, // PUSHFD\n { 0x9D, ENTRY_CopyBytes1 }, // POPFD\n { 0x9E, ENTRY_CopyBytes1 }, // SAHF\n { 0x9F, ENTRY_CopyBytes1 }, // LAHF\n { 0xA0, ENTRY_CopyBytes1Address }, // MOV\n { 0xA1, ENTRY_CopyBytes1Address }, // MOV\n { 0xA2, ENTRY_CopyBytes1Address }, // MOV\n { 0xA3, ENTRY_CopyBytes1Address }, // MOV\n { 0xA4, ENTRY_CopyBytes1 }, // MOVS\n { 0xA5, ENTRY_CopyBytes1 }, // MOVS/MOVSD\n { 0xA6, ENTRY_CopyBytes1 }, // CMPS/CMPSB\n { 0xA7, ENTRY_CopyBytes1 }, // CMPS/CMPSW\n { 0xA8, ENTRY_CopyBytes2 }, // TEST\n { 0xA9, ENTRY_CopyBytes3Or5 }, // TEST\n { 0xAA, ENTRY_CopyBytes1 }, // STOS/STOSB\n { 0xAB, ENTRY_CopyBytes1 }, // STOS/STOSW\n { 0xAC, ENTRY_CopyBytes1 }, // LODS/LODSB\n { 0xAD, ENTRY_CopyBytes1 }, // LODS/LODSW\n { 0xAE, ENTRY_CopyBytes1 }, // SCAS/SCASB\n { 0xAF, ENTRY_CopyBytes1 }, // SCAS/SCASD\n { 0xB0, ENTRY_CopyBytes2 }, // MOV B0+rb\n { 0xB1, ENTRY_CopyBytes2 }, // MOV B0+rb\n { 0xB2, ENTRY_CopyBytes2 }, // MOV B0+rb\n { 0xB3, ENTRY_CopyBytes2 }, // MOV B0+rb\n { 0xB4, ENTRY_CopyBytes2 }, // MOV B0+rb\n { 0xB5, ENTRY_CopyBytes2 }, // MOV B0+rb\n { 0xB6, ENTRY_CopyBytes2 }, // MOV B0+rb\n { 0xB7, ENTRY_CopyBytes2 }, // MOV B0+rb\n { 0xB8, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb\n { 0xB9, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb\n { 0xBA, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb\n { 0xBB, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb\n { 0xBC, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb\n { 0xBD, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb\n { 0xBE, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb\n { 0xBF, ENTRY_CopyBytes3Or5Rax }, // MOV B8+rb\n { 0xC0, ENTRY_CopyBytes2Mod1 }, // RCL/2 ib, etc.\n { 0xC1, ENTRY_CopyBytes2Mod1 }, // RCL/2 ib, etc.\n { 0xC2, ENTRY_CopyBytes3 }, // RET\n { 0xC3, ENTRY_CopyBytes1 }, // RET\n { 0xC4, ENTRY_CopyVex3 }, // LES, VEX 3-byte opcodes.\n { 0xC5, ENTRY_CopyVex2 }, // LDS, VEX 2-byte opcodes.\n { 0xC6, ENTRY_CopyBytes2Mod1 }, // MOV\n { 0xC7, ENTRY_CopyBytes2ModOperand }, // MOV/0 XBEGIN/7\n { 0xC8, ENTRY_CopyBytes4 }, // ENTER\n { 0xC9, ENTRY_CopyBytes1 }, // LEAVE\n { 0xCA, ENTRY_CopyBytes3Dynamic }, // RET\n { 0xCB, ENTRY_CopyBytes1Dynamic }, // RET\n { 0xCC, ENTRY_CopyBytes1Dynamic }, // INT 3\n { 0xCD, ENTRY_CopyBytes2Dynamic }, // INT ib\n#ifdef DETOURS_X64\n { 0xCE, ENTRY_Invalid }, // Invalid\n#else\n { 0xCE, ENTRY_CopyBytes1Dynamic }, // INTO\n#endif\n { 0xCF, ENTRY_CopyBytes1Dynamic }, // IRET\n { 0xD0, ENTRY_CopyBytes2Mod }, // RCL/2, etc.\n { 0xD1, ENTRY_CopyBytes2Mod }, // RCL/2, etc.\n { 0xD2, ENTRY_CopyBytes2Mod }, // RCL/2, etc.\n { 0xD3, ENTRY_CopyBytes2Mod }, // RCL/2, etc.\n#ifdef DETOURS_X64\n { 0xD4, ENTRY_Invalid }, // Invalid\n { 0xD5, ENTRY_Invalid }, // Invalid\n#else\n { 0xD4, ENTRY_CopyBytes2 }, // AAM\n { 0xD5, ENTRY_CopyBytes2 }, // AAD\n#endif\n { 0xD6, ENTRY_Invalid }, // Invalid\n { 0xD7, ENTRY_CopyBytes1 }, // XLAT/XLATB\n { 0xD8, ENTRY_CopyBytes2Mod }, // FADD, etc.\n { 0xD9, ENTRY_CopyBytes2Mod }, // F2XM1, etc.\n { 0xDA, ENTRY_CopyBytes2Mod }, // FLADD, etc.\n { 0xDB, ENTRY_CopyBytes2Mod }, // FCLEX, etc.\n { 0xDC, ENTRY_CopyBytes2Mod }, // FADD/0, etc.\n { 0xDD, ENTRY_CopyBytes2Mod }, // FFREE, etc.\n { 0xDE, ENTRY_CopyBytes2Mod }, // FADDP, etc.\n { 0xDF, ENTRY_CopyBytes2Mod }, // FBLD/4, etc.\n { 0xE0, ENTRY_CopyBytes2CantJump }, // LOOPNE cb\n { 0xE1, ENTRY_CopyBytes2CantJump }, // LOOPE cb\n { 0xE2, ENTRY_CopyBytes2CantJump }, // LOOP cb\n { 0xE3, ENTRY_CopyBytes2CantJump }, // JCXZ/JECXZ\n { 0xE4, ENTRY_CopyBytes2 }, // IN ib\n { 0xE5, ENTRY_CopyBytes2 }, // IN id\n { 0xE6, ENTRY_CopyBytes2 }, // OUT ib\n { 0xE7, ENTRY_CopyBytes2 }, // OUT ib\n { 0xE8, ENTRY_CopyBytesJumpToAbsolute }, // CALL cd\n { 0xE9, ENTRY_CopyBytesJumpToAbsolute }, // JMP cd\n#ifdef DETOURS_X64\n { 0xEA, ENTRY_Invalid }, // Invalid\n#else\n { 0xEA, ENTRY_CopyBytes5Or7Dynamic }, // JMP cp\n#endif\n { 0xEB, ENTRY_CopyBytes2Jump }, // JMP cb\n { 0xEC, ENTRY_CopyBytes1 }, // IN ib\n { 0xED, ENTRY_CopyBytes1 }, // IN id\n { 0xEE, ENTRY_CopyBytes1 }, // OUT\n { 0xEF, ENTRY_CopyBytes1 }, // OUT\n { 0xF0, ENTRY_CopyBytesPrefix }, // LOCK prefix\n { 0xF1, ENTRY_CopyBytes1Dynamic }, // INT1 / ICEBP somewhat documented by AMD, not by Intel\n { 0xF2, ENTRY_CopyF2 }, // REPNE prefix\n//#ifdef DETOURS_X86\n { 0xF3, ENTRY_CopyF3 }, // REPE prefix\n//#else\n// This does presently suffice for AMD64 but it requires tracing\n// through a bunch of code to verify and seems not worth maintaining.\n// { 0xF3, ENTRY_CopyBytesPrefix }, // REPE prefix\n//#endif\n { 0xF4, ENTRY_CopyBytes1 }, // HLT\n { 0xF5, ENTRY_CopyBytes1 }, // CMC\n { 0xF6, ENTRY_CopyF6 }, // TEST/0, DIV/6\n { 0xF7, ENTRY_CopyF7 }, // TEST/0, DIV/6\n { 0xF8, ENTRY_CopyBytes1 }, // CLC\n { 0xF9, ENTRY_CopyBytes1 }, // STC\n { 0xFA, ENTRY_CopyBytes1 }, // CLI\n { 0xFB, ENTRY_CopyBytes1 }, // STI\n { 0xFC, ENTRY_CopyBytes1 }, // CLD\n { 0xFD, ENTRY_CopyBytes1 }, // STD\n { 0xFE, ENTRY_CopyBytes2Mod }, // DEC/1,INC/0\n { 0xFF, ENTRY_CopyFF }, // CALL/2\n { 0, ENTRY_End },\n};\n\nconst CDetourDis::COPYENTRY CDetourDis::s_rceCopyTable0F[257] =\n{\n#ifdef DETOURS_X86\n { 0x00, ENTRY_Copy0F00 }, // sldt/0 str/1 lldt/2 ltr/3 err/4 verw/5 jmpe/6/dynamic invalid/7\n#else\n { 0x00, ENTRY_CopyBytes2Mod }, // sldt/0 str/1 lldt/2 ltr/3 err/4 verw/5 jmpe/6/dynamic invalid/7\n#endif\n { 0x01, ENTRY_CopyBytes2Mod }, // INVLPG/7, etc.\n { 0x02, ENTRY_CopyBytes2Mod }, // LAR/r\n { 0x03, ENTRY_CopyBytes2Mod }, // LSL/r\n { 0x04, ENTRY_Invalid }, // _04\n { 0x05, ENTRY_CopyBytes1 }, // SYSCALL\n { 0x06, ENTRY_CopyBytes1 }, // CLTS\n { 0x07, ENTRY_CopyBytes1 }, // SYSRET\n { 0x08, ENTRY_CopyBytes1 }, // INVD\n { 0x09, ENTRY_CopyBytes1 }, // WBINVD\n { 0x0A, ENTRY_Invalid }, // _0A\n { 0x0B, ENTRY_CopyBytes1 }, // UD2\n { 0x0C, ENTRY_Invalid }, // _0C\n { 0x0D, ENTRY_CopyBytes2Mod }, // PREFETCH\n { 0x0E, ENTRY_CopyBytes1 }, // FEMMS (3DNow -- not in Intel documentation)\n { 0x0F, ENTRY_CopyBytes2Mod1 }, // 3DNow Opcodes\n { 0x10, ENTRY_CopyBytes2Mod }, // MOVSS MOVUPD MOVSD\n { 0x11, ENTRY_CopyBytes2Mod }, // MOVSS MOVUPD MOVSD\n { 0x12, ENTRY_CopyBytes2Mod }, // MOVLPD\n { 0x13, ENTRY_CopyBytes2Mod }, // MOVLPD\n { 0x14, ENTRY_CopyBytes2Mod }, // UNPCKLPD\n { 0x15, ENTRY_CopyBytes2Mod }, // UNPCKHPD\n { 0x16, ENTRY_CopyBytes2Mod }, // MOVHPD\n { 0x17, ENTRY_CopyBytes2Mod }, // MOVHPD\n { 0x18, ENTRY_CopyBytes2Mod }, // PREFETCHINTA...\n { 0x19, ENTRY_CopyBytes2Mod }, // NOP/r multi byte nop, not documented by Intel, documented by AMD\n { 0x1A, ENTRY_CopyBytes2Mod }, // NOP/r multi byte nop, not documented by Intel, documented by AMD\n { 0x1B, ENTRY_CopyBytes2Mod }, // NOP/r multi byte nop, not documented by Intel, documented by AMD\n { 0x1C, ENTRY_CopyBytes2Mod }, // NOP/r multi byte nop, not documented by Intel, documented by AMD\n { 0x1D, ENTRY_CopyBytes2Mod }, // NOP/r multi byte nop, not documented by Intel, documented by AMD\n { 0x1E, ENTRY_CopyBytes2Mod }, // NOP/r multi byte nop, not documented by Intel, documented by AMD\n { 0x1F, ENTRY_CopyBytes2Mod }, // NOP/r multi byte nop\n { 0x20, ENTRY_CopyBytes2Mod }, // MOV/r\n { 0x21, ENTRY_CopyBytes2Mod }, // MOV/r\n { 0x22, ENTRY_CopyBytes2Mod }, // MOV/r\n { 0x23, ENTRY_CopyBytes2Mod }, // MOV/r\n#ifdef DETOURS_X64\n { 0x24, ENTRY_Invalid }, // _24\n#else\n { 0x24, ENTRY_CopyBytes2Mod }, // MOV/r,TR TR is test register on 80386 and 80486, removed in Pentium\n#endif\n { 0x25, ENTRY_Invalid }, // _25\n#ifdef DETOURS_X64\n { 0x26, ENTRY_Invalid }, // _26\n#else\n { 0x26, ENTRY_CopyBytes2Mod }, // MOV TR/r TR is test register on 80386 and 80486, removed in Pentium\n#endif\n { 0x27, ENTRY_Invalid }, // _27\n { 0x28, ENTRY_CopyBytes2Mod }, // MOVAPS MOVAPD\n { 0x29, ENTRY_CopyBytes2Mod }, // MOVAPS MOVAPD\n { 0x2A, ENTRY_CopyBytes2Mod }, // CVPI2PS &\n { 0x2B, ENTRY_CopyBytes2Mod }, // MOVNTPS MOVNTPD\n { 0x2C, ENTRY_CopyBytes2Mod }, // CVTTPS2PI &\n { 0x2D, ENTRY_CopyBytes2Mod }, // CVTPS2PI &\n { 0x2E, ENTRY_CopyBytes2Mod }, // UCOMISS UCOMISD\n { 0x2F, ENTRY_CopyBytes2Mod }, // COMISS COMISD\n { 0x30, ENTRY_CopyBytes1 }, // WRMSR\n { 0x31, ENTRY_CopyBytes1 }, // RDTSC\n { 0x32, ENTRY_CopyBytes1 }, // RDMSR\n { 0x33, ENTRY_CopyBytes1 }, // RDPMC\n { 0x34, ENTRY_CopyBytes1 }, // SYSENTER\n { 0x35, ENTRY_CopyBytes1 }, // SYSEXIT\n { 0x36, ENTRY_Invalid }, // _36\n { 0x37, ENTRY_CopyBytes1 }, // GETSEC\n { 0x38, ENTRY_CopyBytes3Mod }, // SSE3 Opcodes\n { 0x39, ENTRY_Invalid }, // _39\n { 0x3A, ENTRY_CopyBytes3Mod1 }, // SSE3 Opcodes\n { 0x3B, ENTRY_Invalid }, // _3B\n { 0x3C, ENTRY_Invalid }, // _3C\n { 0x3D, ENTRY_Invalid }, // _3D\n { 0x3E, ENTRY_Invalid }, // _3E\n { 0x3F, ENTRY_Invalid }, // _3F\n { 0x40, ENTRY_CopyBytes2Mod }, // CMOVO (0F 40)\n { 0x41, ENTRY_CopyBytes2Mod }, // CMOVNO (0F 41)\n { 0x42, ENTRY_CopyBytes2Mod }, // CMOVB & CMOVNE (0F 42)\n { 0x43, ENTRY_CopyBytes2Mod }, // CMOVAE & CMOVNB (0F 43)\n { 0x44, ENTRY_CopyBytes2Mod }, // CMOVE & CMOVZ (0F 44)\n { 0x45, ENTRY_CopyBytes2Mod }, // CMOVNE & CMOVNZ (0F 45)\n { 0x46, ENTRY_CopyBytes2Mod }, // CMOVBE & CMOVNA (0F 46)\n { 0x47, ENTRY_CopyBytes2Mod }, // CMOVA & CMOVNBE (0F 47)\n { 0x48, ENTRY_CopyBytes2Mod }, // CMOVS (0F 48)\n { 0x49, ENTRY_CopyBytes2Mod }, // CMOVNS (0F 49)\n { 0x4A, ENTRY_CopyBytes2Mod }, // CMOVP & CMOVPE (0F 4A)\n { 0x4B, ENTRY_CopyBytes2Mod }, // CMOVNP & CMOVPO (0F 4B)\n { 0x4C, ENTRY_CopyBytes2Mod }, // CMOVL & CMOVNGE (0F 4C)\n { 0x4D, ENTRY_CopyBytes2Mod }, // CMOVGE & CMOVNL (0F 4D)\n { 0x4E, ENTRY_CopyBytes2Mod }, // CMOVLE & CMOVNG (0F 4E)\n { 0x4F, ENTRY_CopyBytes2Mod }, // CMOVG & CMOVNLE (0F 4F)\n { 0x50, ENTRY_CopyBytes2Mod }, // MOVMSKPD MOVMSKPD\n { 0x51, ENTRY_CopyBytes2Mod }, // SQRTPS &\n { 0x52, ENTRY_CopyBytes2Mod }, // RSQRTTS RSQRTPS\n { 0x53, ENTRY_CopyBytes2Mod }, // RCPPS RCPSS\n { 0x54, ENTRY_CopyBytes2Mod }, // ANDPS ANDPD\n { 0x55, ENTRY_CopyBytes2Mod }, // ANDNPS ANDNPD\n { 0x56, ENTRY_CopyBytes2Mod }, // ORPS ORPD\n { 0x57, ENTRY_CopyBytes2Mod }, // XORPS XORPD\n { 0x58, ENTRY_CopyBytes2Mod }, // ADDPS &\n { 0x59, ENTRY_CopyBytes2Mod }, // MULPS &\n { 0x5A, ENTRY_CopyBytes2Mod }, // CVTPS2PD &\n { 0x5B, ENTRY_CopyBytes2Mod }, // CVTDQ2PS &\n { 0x5C, ENTRY_CopyBytes2Mod }, // SUBPS &\n { 0x5D, ENTRY_CopyBytes2Mod }, // MINPS &\n { 0x5E, ENTRY_CopyBytes2Mod }, // DIVPS &\n { 0x5F, ENTRY_CopyBytes2Mod }, // MASPS &\n { 0x60, ENTRY_CopyBytes2Mod }, // PUNPCKLBW/r\n { 0x61, ENTRY_CopyBytes2Mod }, // PUNPCKLWD/r\n { 0x62, ENTRY_CopyBytes2Mod }, // PUNPCKLWD/r\n { 0x63, ENTRY_CopyBytes2Mod }, // PACKSSWB/r\n { 0x64, ENTRY_CopyBytes2Mod }, // PCMPGTB/r\n { 0x65, ENTRY_CopyBytes2Mod }, // PCMPGTW/r\n { 0x66, ENTRY_CopyBytes2Mod }, // PCMPGTD/r\n { 0x67, ENTRY_CopyBytes2Mod }, // PACKUSWB/r\n { 0x68, ENTRY_CopyBytes2Mod }, // PUNPCKHBW/r\n { 0x69, ENTRY_CopyBytes2Mod }, // PUNPCKHWD/r\n { 0x6A, ENTRY_CopyBytes2Mod }, // PUNPCKHDQ/r\n { 0x6B, ENTRY_CopyBytes2Mod }, // PACKSSDW/r\n { 0x6C, ENTRY_CopyBytes2Mod }, // PUNPCKLQDQ\n { 0x6D, ENTRY_CopyBytes2Mod }, // PUNPCKHQDQ\n { 0x6E, ENTRY_CopyBytes2Mod }, // MOVD/r\n { 0x6F, ENTRY_CopyBytes2Mod }, // MOV/r\n { 0x70, ENTRY_CopyBytes2Mod1 }, // PSHUFW/r ib\n { 0x71, ENTRY_CopyBytes2Mod1 }, // PSLLW/6 ib,PSRAW/4 ib,PSRLW/2 ib\n { 0x72, ENTRY_CopyBytes2Mod1 }, // PSLLD/6 ib,PSRAD/4 ib,PSRLD/2 ib\n { 0x73, ENTRY_CopyBytes2Mod1 }, // PSLLQ/6 ib,PSRLQ/2 ib\n { 0x74, ENTRY_CopyBytes2Mod }, // PCMPEQB/r\n { 0x75, ENTRY_CopyBytes2Mod }, // PCMPEQW/r\n { 0x76, ENTRY_CopyBytes2Mod }, // PCMPEQD/r\n { 0x77, ENTRY_CopyBytes1 }, // EMMS\n // extrq/insertq require mode=3 and are followed by two immediate bytes\n { 0x78, ENTRY_Copy0F78 }, // VMREAD/r, 66/EXTRQ/r/ib/ib, F2/INSERTQ/r/ib/ib\n // extrq/insertq require mod=3, therefore ENTRY_CopyBytes2, but it ends up the same\n { 0x79, ENTRY_CopyBytes2Mod }, // VMWRITE/r, 66/EXTRQ/r, F2/INSERTQ/r\n { 0x7A, ENTRY_Invalid }, // _7A\n { 0x7B, ENTRY_Invalid }, // _7B\n { 0x7C, ENTRY_CopyBytes2Mod }, // HADDPS\n { 0x7D, ENTRY_CopyBytes2Mod }, // HSUBPS\n { 0x7E, ENTRY_CopyBytes2Mod }, // MOVD/r\n { 0x7F, ENTRY_CopyBytes2Mod }, // MOV/r\n { 0x80, ENTRY_CopyBytes3Or5Target }, // JO\n { 0x81, ENTRY_CopyBytes3Or5Target }, // JNO\n { 0x82, ENTRY_CopyBytes3Or5Target }, // JB,JC,JNAE\n { 0x83, ENTRY_CopyBytes3Or5Target }, // JAE,JNB,JNC\n { 0x84, ENTRY_CopyBytes3Or5Target }, // JE,JZ,JZ\n { 0x85, ENTRY_CopyBytes3Or5Target }, // JNE,JNZ\n { 0x86, ENTRY_CopyBytes3Or5Target }, // JBE,JNA\n { 0x87, ENTRY_CopyBytes3Or5Target }, // JA,JNBE\n { 0x88, ENTRY_CopyBytes3Or5Target }, // JS\n { 0x89, ENTRY_CopyBytes3Or5Target }, // JNS\n { 0x8A, ENTRY_CopyBytes3Or5Target }, // JP,JPE\n { 0x8B, ENTRY_CopyBytes3Or5Target }, // JNP,JPO\n { 0x8C, ENTRY_CopyBytes3Or5Target }, // JL,NGE\n { 0x8D, ENTRY_CopyBytes3Or5Target }, // JGE,JNL\n { 0x8E, ENTRY_CopyBytes3Or5Target }, // JLE,JNG\n { 0x8F, ENTRY_CopyBytes3Or5Target }, // JG,JNLE\n { 0x90, ENTRY_CopyBytes2Mod }, // CMOVO (0F 40)\n { 0x91, ENTRY_CopyBytes2Mod }, // CMOVNO (0F 41)\n { 0x92, ENTRY_CopyBytes2Mod }, // CMOVB & CMOVC & CMOVNAE (0F 42)\n { 0x93, ENTRY_CopyBytes2Mod }, // CMOVAE & CMOVNB & CMOVNC (0F 43)\n { 0x94, ENTRY_CopyBytes2Mod }, // CMOVE & CMOVZ (0F 44)\n { 0x95, ENTRY_CopyBytes2Mod }, // CMOVNE & CMOVNZ (0F 45)\n { 0x96, ENTRY_CopyBytes2Mod }, // CMOVBE & CMOVNA (0F 46)\n { 0x97, ENTRY_CopyBytes2Mod }, // CMOVA & CMOVNBE (0F 47)\n { 0x98, ENTRY_CopyBytes2Mod }, // CMOVS (0F 48)\n { 0x99, ENTRY_CopyBytes2Mod }, // CMOVNS (0F 49)\n { 0x9A, ENTRY_CopyBytes2Mod }, // CMOVP & CMOVPE (0F 4A)\n { 0x9B, ENTRY_CopyBytes2Mod }, // CMOVNP & CMOVPO (0F 4B)\n { 0x9C, ENTRY_CopyBytes2Mod }, // CMOVL & CMOVNGE (0F 4C)\n { 0x9D, ENTRY_CopyBytes2Mod }, // CMOVGE & CMOVNL (0F 4D)\n { 0x9E, ENTRY_CopyBytes2Mod }, // CMOVLE & CMOVNG (0F 4E)\n { 0x9F, ENTRY_CopyBytes2Mod }, // CMOVG & CMOVNLE (0F 4F)\n { 0xA0, ENTRY_CopyBytes1 }, // PUSH\n { 0xA1, ENTRY_CopyBytes1 }, // POP\n { 0xA2, ENTRY_CopyBytes1 }, // CPUID\n { 0xA3, ENTRY_CopyBytes2Mod }, // BT (0F A3)\n { 0xA4, ENTRY_CopyBytes2Mod1 }, // SHLD\n { 0xA5, ENTRY_CopyBytes2Mod }, // SHLD\n { 0xA6, ENTRY_CopyBytes2Mod }, // XBTS\n { 0xA7, ENTRY_CopyBytes2Mod }, // IBTS\n { 0xA8, ENTRY_CopyBytes1 }, // PUSH\n { 0xA9, ENTRY_CopyBytes1 }, // POP\n { 0xAA, ENTRY_CopyBytes1 }, // RSM\n { 0xAB, ENTRY_CopyBytes2Mod }, // BTS (0F AB)\n { 0xAC, ENTRY_CopyBytes2Mod1 }, // SHRD\n { 0xAD, ENTRY_CopyBytes2Mod }, // SHRD\n\n // 0F AE mod76=mem mod543=0 fxsave\n // 0F AE mod76=mem mod543=1 fxrstor\n // 0F AE mod76=mem mod543=2 ldmxcsr\n // 0F AE mod76=mem mod543=3 stmxcsr\n // 0F AE mod76=mem mod543=4 xsave\n // 0F AE mod76=mem mod543=5 xrstor\n // 0F AE mod76=mem mod543=6 saveopt\n // 0F AE mod76=mem mod543=7 clflush\n // 0F AE mod76=11b mod543=5 lfence\n // 0F AE mod76=11b mod543=6 mfence\n // 0F AE mod76=11b mod543=7 sfence\n // F3 0F AE mod76=11b mod543=0 rdfsbase\n // F3 0F AE mod76=11b mod543=1 rdgsbase\n // F3 0F AE mod76=11b mod543=2 wrfsbase\n // F3 0F AE mod76=11b mod543=3 wrgsbase\n { 0xAE, ENTRY_CopyBytes2Mod }, // fxsave fxrstor ldmxcsr stmxcsr xsave xrstor saveopt clflush lfence mfence sfence rdfsbase rdgsbase wrfsbase wrgsbase\n { 0xAF, ENTRY_CopyBytes2Mod }, // IMUL (0F AF)\n { 0xB0, ENTRY_CopyBytes2Mod }, // CMPXCHG (0F B0)\n { 0xB1, ENTRY_CopyBytes2Mod }, // CMPXCHG (0F B1)\n { 0xB2, ENTRY_CopyBytes2Mod }, // LSS/r\n { 0xB3, ENTRY_CopyBytes2Mod }, // BTR (0F B3)\n { 0xB4, ENTRY_CopyBytes2Mod }, // LFS/r\n { 0xB5, ENTRY_CopyBytes2Mod }, // LGS/r\n { 0xB6, ENTRY_CopyBytes2Mod }, // MOVZX/r\n { 0xB7, ENTRY_CopyBytes2Mod }, // MOVZX/r\n#ifdef DETOURS_X86\n { 0xB8, ENTRY_Copy0FB8 }, // jmpe f3/popcnt\n#else\n { 0xB8, ENTRY_CopyBytes2Mod }, // f3/popcnt\n#endif\n { 0xB9, ENTRY_Invalid }, // _B9\n { 0xBA, ENTRY_CopyBytes2Mod1 }, // BT & BTC & BTR & BTS (0F BA)\n { 0xBB, ENTRY_CopyBytes2Mod }, // BTC (0F BB)\n { 0xBC, ENTRY_CopyBytes2Mod }, // BSF (0F BC)\n { 0xBD, ENTRY_CopyBytes2Mod }, // BSR (0F BD)\n { 0xBE, ENTRY_CopyBytes2Mod }, // MOVSX/r\n { 0xBF, ENTRY_CopyBytes2Mod }, // MOVSX/r\n { 0xC0, ENTRY_CopyBytes2Mod }, // XADD/r\n { 0xC1, ENTRY_CopyBytes2Mod }, // XADD/r\n { 0xC2, ENTRY_CopyBytes2Mod1 }, // CMPPS &\n { 0xC3, ENTRY_CopyBytes2Mod }, // MOVNTI\n { 0xC4, ENTRY_CopyBytes2Mod1 }, // PINSRW /r ib\n { 0xC5, ENTRY_CopyBytes2Mod1 }, // PEXTRW /r ib\n { 0xC6, ENTRY_CopyBytes2Mod1 }, // SHUFPS & SHUFPD\n { 0xC7, ENTRY_CopyBytes2Mod }, // CMPXCHG8B (0F C7)\n { 0xC8, ENTRY_CopyBytes1 }, // BSWAP 0F C8 + rd\n { 0xC9, ENTRY_CopyBytes1 }, // BSWAP 0F C8 + rd\n { 0xCA, ENTRY_CopyBytes1 }, // BSWAP 0F C8 + rd\n { 0xCB, ENTRY_CopyBytes1 }, // CVTPD2PI BSWAP 0F C8 + rd\n { 0xCC, ENTRY_CopyBytes1 }, // BSWAP 0F C8 + rd\n { 0xCD, ENTRY_CopyBytes1 }, // BSWAP 0F C8 + rd\n { 0xCE, ENTRY_CopyBytes1 }, // BSWAP 0F C8 + rd\n { 0xCF, ENTRY_CopyBytes1 }, // BSWAP 0F C8 + rd\n { 0xD0, ENTRY_CopyBytes2Mod }, // ADDSUBPS (untestd)\n { 0xD1, ENTRY_CopyBytes2Mod }, // PSRLW/r\n { 0xD2, ENTRY_CopyBytes2Mod }, // PSRLD/r\n { 0xD3, ENTRY_CopyBytes2Mod }, // PSRLQ/r\n { 0xD4, ENTRY_CopyBytes2Mod }, // PADDQ\n { 0xD5, ENTRY_CopyBytes2Mod }, // PMULLW/r\n { 0xD6, ENTRY_CopyBytes2Mod }, // MOVDQ2Q / MOVQ2DQ\n { 0xD7, ENTRY_CopyBytes2Mod }, // PMOVMSKB/r\n { 0xD8, ENTRY_CopyBytes2Mod }, // PSUBUSB/r\n { 0xD9, ENTRY_CopyBytes2Mod }, // PSUBUSW/r\n { 0xDA, ENTRY_CopyBytes2Mod }, // PMINUB/r\n { 0xDB, ENTRY_CopyBytes2Mod }, // PAND/r\n { 0xDC, ENTRY_CopyBytes2Mod }, // PADDUSB/r\n { 0xDD, ENTRY_CopyBytes2Mod }, // PADDUSW/r\n { 0xDE, ENTRY_CopyBytes2Mod }, // PMAXUB/r\n { 0xDF, ENTRY_CopyBytes2Mod }, // PANDN/r\n { 0xE0, ENTRY_CopyBytes2Mod }, // PAVGB\n { 0xE1, ENTRY_CopyBytes2Mod }, // PSRAW/r\n { 0xE2, ENTRY_CopyBytes2Mod }, // PSRAD/r\n { 0xE3, ENTRY_CopyBytes2Mod }, // PAVGW\n { 0xE4, ENTRY_CopyBytes2Mod }, // PMULHUW/r\n { 0xE5, ENTRY_CopyBytes2Mod }, // PMULHW/r\n { 0xE6, ENTRY_CopyBytes2Mod }, // CTDQ2PD &\n { 0xE7, ENTRY_CopyBytes2Mod }, // MOVNTQ\n { 0xE8, ENTRY_CopyBytes2Mod }, // PSUBB/r\n { 0xE9, ENTRY_CopyBytes2Mod }, // PSUBW/r\n { 0xEA, ENTRY_CopyBytes2Mod }, // PMINSW/r\n { 0xEB, ENTRY_CopyBytes2Mod }, // POR/r\n { 0xEC, ENTRY_CopyBytes2Mod }, // PADDSB/r\n { 0xED, ENTRY_CopyBytes2Mod }, // PADDSW/r\n { 0xEE, ENTRY_CopyBytes2Mod }, // PMAXSW /r\n { 0xEF, ENTRY_CopyBytes2Mod }, // PXOR/r\n { 0xF0, ENTRY_CopyBytes2Mod }, // LDDQU\n { 0xF1, ENTRY_CopyBytes2Mod }, // PSLLW/r\n { 0xF2, ENTRY_CopyBytes2Mod }, // PSLLD/r\n { 0xF3, ENTRY_CopyBytes2Mod }, // PSLLQ/r\n { 0xF4, ENTRY_CopyBytes2Mod }, // PMULUDQ/r\n { 0xF5, ENTRY_CopyBytes2Mod }, // PMADDWD/r\n { 0xF6, ENTRY_CopyBytes2Mod }, // PSADBW/r\n { 0xF7, ENTRY_CopyBytes2Mod }, // MASKMOVQ\n { 0xF8, ENTRY_CopyBytes2Mod }, // PSUBB/r\n { 0xF9, ENTRY_CopyBytes2Mod }, // PSUBW/r\n { 0xFA, ENTRY_CopyBytes2Mod }, // PSUBD/r\n { 0xFB, ENTRY_CopyBytes2Mod }, // FSUBQ/r\n { 0xFC, ENTRY_CopyBytes2Mod }, // PADDB/r\n { 0xFD, ENTRY_CopyBytes2Mod }, // PADDW/r\n { 0xFE, ENTRY_CopyBytes2Mod }, // PADDD/r\n { 0xFF, ENTRY_Invalid }, // _FF\n { 0, ENTRY_End },\n};\n\nBOOL CDetourDis::SanityCheckSystem()\n{\n ULONG n = 0;\n for (; n < 256; n++) {\n REFCOPYENTRY pEntry = &s_rceCopyTable[n];\n\n if (n != pEntry->nOpcode) {\n ASSERT(n == pEntry->nOpcode);\n return FALSE;\n }\n }\n if (s_rceCopyTable[256].pfCopy != NULL) {\n ASSERT(!\"Missing end marker.\");\n return FALSE;\n }\n\n for (n = 0; n < 256; n++) {\n REFCOPYENTRY pEntry = &s_rceCopyTable0F[n];\n\n if (n != pEntry->nOpcode) {\n ASSERT(n == pEntry->nOpcode);\n return FALSE;\n }\n }\n if (s_rceCopyTable0F[256].pfCopy != NULL) {\n ASSERT(!\"Missing end marker.\");\n return FALSE;\n }\n\n return TRUE;\n}\n#endif // defined(DETOURS_X64) || defined(DETOURS_X86)\n\n/////////////////////////////////////////////////////////// IA64 Disassembler.\n//\n#ifdef DETOURS_IA64\n\n#if defined(_IA64_) != defined(DETOURS_IA64_OFFLINE_LIBRARY)\n// Compile DETOUR_IA64_BUNDLE for native IA64 or cross, but not both -- we get duplicates otherwise.\nconst DETOUR_IA64_BUNDLE::DETOUR_IA64_METADATA DETOUR_IA64_BUNDLE::s_rceCopyTable[33] =\n{\n { 0x00, M_UNIT, I_UNIT, I_UNIT, },\n { 0x01, M_UNIT, I_UNIT, I_UNIT, },\n { 0x02, M_UNIT, I_UNIT, I_UNIT, },\n { 0x03, M_UNIT, I_UNIT, I_UNIT, },\n { 0x04, M_UNIT, L_UNIT, X_UNIT, },\n { 0x05, M_UNIT, L_UNIT, X_UNIT, },\n { 0x06, 0, 0, 0, },\n { 0x07, 0, 0, 0, },\n { 0x08, M_UNIT, M_UNIT, I_UNIT, },\n { 0x09, M_UNIT, M_UNIT, I_UNIT, },\n { 0x0a, M_UNIT, M_UNIT, I_UNIT, },\n { 0x0b, M_UNIT, M_UNIT, I_UNIT, },\n { 0x0c, M_UNIT, F_UNIT, I_UNIT, },\n { 0x0d, M_UNIT, F_UNIT, I_UNIT, },\n { 0x0e, M_UNIT, M_UNIT, F_UNIT, },\n { 0x0f, M_UNIT, M_UNIT, F_UNIT, },\n { 0x10, M_UNIT, I_UNIT, B_UNIT, },\n { 0x11, M_UNIT, I_UNIT, B_UNIT, },\n { 0x12, M_UNIT, B_UNIT, B_UNIT, },\n { 0x13, M_UNIT, B_UNIT, B_UNIT, },\n { 0x14, 0, 0, 0, },\n { 0x15, 0, 0, 0, },\n { 0x16, B_UNIT, B_UNIT, B_UNIT, },\n { 0x17, B_UNIT, B_UNIT, B_UNIT, },\n { 0x18, M_UNIT, M_UNIT, B_UNIT, },\n { 0x19, M_UNIT, M_UNIT, B_UNIT, },\n { 0x1a, 0, 0, 0, },\n { 0x1b, 0, 0, 0, },\n { 0x1c, M_UNIT, F_UNIT, B_UNIT, },\n { 0x1d, M_UNIT, F_UNIT, B_UNIT, },\n { 0x1e, 0, 0, 0, },\n { 0x1f, 0, 0, 0, },\n { 0x00, 0, 0, 0, },\n};\n\n// 120 112 104 96 88 80 72 64 56 48 40 32 24 16 8 0\n// f. e. d. c. b. a. 9. 8. 7. 6. 5. 4. 3. 2. 1. 0.\n\n// 00\n// f.e. d.c. b.a. 9.8. 7.6. 5.4. 3.2. 1.0.\n// 0000 0000 0000 0000 0000 0000 0000 001f : Template [4..0]\n// 0000 0000 0000 0000 0000 03ff ffff ffe0 : Zero [ 41.. 5]\n// 0000 0000 0000 0000 0000 3c00 0000 0000 : Zero [ 45.. 42]\n// 0000 0000 0007 ffff ffff c000 0000 0000 : One [ 82.. 46]\n// 0000 0000 0078 0000 0000 0000 0000 0000 : One [ 86.. 83]\n// 0fff ffff ff80 0000 0000 0000 0000 0000 : Two [123.. 87]\n// f000 0000 0000 0000 0000 0000 0000 0000 : Two [127..124]\nBYTE DETOUR_IA64_BUNDLE::GetTemplate() const\n{\n return (data[0] & 0x1f);\n}\n\nBYTE DETOUR_IA64_BUNDLE::GetInst0() const\n{\n return ((data[5] & 0x3c) >> 2);\n}\n\nBYTE DETOUR_IA64_BUNDLE::GetInst1() const\n{\n return ((data[10] & 0x78) >> 3);\n}\n\nBYTE DETOUR_IA64_BUNDLE::GetInst2() const\n{\n return ((data[15] & 0xf0) >> 4);\n}\n\nBYTE DETOUR_IA64_BUNDLE::GetUnit(BYTE slot) const\n{\n switch (slot) {\n case 0: return GetUnit0();\n case 1: return GetUnit1();\n case 2: return GetUnit2();\n }\n __debugbreak();\n return 0;\n}\n\nBYTE DETOUR_IA64_BUNDLE::GetUnit0() const\n{\n return s_rceCopyTable[data[0] & 0x1f].nUnit0;\n}\n\nBYTE DETOUR_IA64_BUNDLE::GetUnit1() const\n{\n return s_rceCopyTable[data[0] & 0x1f].nUnit1;\n}\n\nBYTE DETOUR_IA64_BUNDLE::GetUnit2() const\n{\n return s_rceCopyTable[data[0] & 0x1f].nUnit2;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetData0() const\n{\n return (((wide[0] & 0x000003ffffffffe0) >> 5));\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetData1() const\n{\n return (((wide[0] & 0xffffc00000000000) >> 46) |\n ((wide[1] & 0x000000000007ffff) << 18));\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetData2() const\n{\n return (((wide[1] & 0x0fffffffff800000) >> 23));\n}\n\nVOID DETOUR_IA64_BUNDLE::SetInst(BYTE slot, BYTE nInst)\n{\n switch (slot)\n {\n case 0: SetInst0(nInst); return;\n case 1: SetInst1(nInst); return;\n case 2: SetInst2(nInst); return;\n }\n __debugbreak();\n}\n\nVOID DETOUR_IA64_BUNDLE::SetInst0(BYTE nInst)\n{\n data[5] = (data[5] & ~0x3c) | ((nInst << 2) & 0x3c);\n}\n\nVOID DETOUR_IA64_BUNDLE::SetInst1(BYTE nInst)\n{\n data[10] = (data[10] & ~0x78) | ((nInst << 3) & 0x78);\n}\n\nVOID DETOUR_IA64_BUNDLE::SetInst2(BYTE nInst)\n{\n data[15] = (data[15] & ~0xf0) | ((nInst << 4) & 0xf0);\n}\n\nVOID DETOUR_IA64_BUNDLE::SetData(BYTE slot, UINT64 nData)\n{\n switch (slot)\n {\n case 0: SetData0(nData); return;\n case 1: SetData1(nData); return;\n case 2: SetData2(nData); return;\n }\n __debugbreak();\n}\n\nVOID DETOUR_IA64_BUNDLE::SetData0(UINT64 nData)\n{\n wide[0] = (wide[0] & ~0x000003ffffffffe0) | (( nData << 5) & 0x000003ffffffffe0);\n}\n\nVOID DETOUR_IA64_BUNDLE::SetData1(UINT64 nData)\n{\n wide[0] = (wide[0] & ~0xffffc00000000000) | ((nData << 46) & 0xffffc00000000000);\n wide[1] = (wide[1] & ~0x000000000007ffff) | ((nData >> 18) & 0x000000000007ffff);\n}\n\nVOID DETOUR_IA64_BUNDLE::SetData2(UINT64 nData)\n{\n wide[1] = (wide[1] & ~0x0fffffffff800000) | ((nData << 23) & 0x0fffffffff800000);\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetInstruction(BYTE slot) const\n{\n switch (slot) {\n case 0: return GetInstruction0();\n case 1: return GetInstruction1();\n case 2: return GetInstruction2();\n }\n __debugbreak();\n return 0;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetInstruction0() const\n{\n // 41 bits from wide[0], skipping the 5 bit template.\n return GetBits(wide[0], DETOUR_IA64_INSTRUCTION0_OFFSET, DETOUR_IA64_INSTRUCTION_SIZE);\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetInstruction1() const\n{\n // 64-46 bits from wide[0] and the rest from wide[1].\n const UINT count0 = 64 - DETOUR_IA64_INSTRUCTION1_OFFSET;\n const UINT count1 = DETOUR_IA64_INSTRUCTION_SIZE - count0;\n return GetBits(wide[0], DETOUR_IA64_INSTRUCTION1_OFFSET, count0) | (GetBits(wide[1], 0, count1) << count0);\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetInstruction2() const\n{\n // Upper 41 bits of wide[1].\n return wide[1] >> (64 - DETOUR_IA64_INSTRUCTION_SIZE);\n}\n\nvoid DETOUR_IA64_BUNDLE::SetInstruction(BYTE slot, UINT64 instruction)\n{\n switch (slot) {\n case 0: SetInstruction0(instruction); return;\n case 1: SetInstruction1(instruction); return;\n case 2: SetInstruction2(instruction); return;\n }\n __debugbreak();\n}\n\nvoid DETOUR_IA64_BUNDLE::SetInstruction0(UINT64 instruction)\n{\n wide[0] = SetBits(wide[0], DETOUR_IA64_INSTRUCTION0_OFFSET, DETOUR_IA64_INSTRUCTION_SIZE, instruction);\n}\n\nvoid DETOUR_IA64_BUNDLE::SetInstruction1(UINT64 instruction)\n{\n UINT const count0 = 64 - DETOUR_IA64_INSTRUCTION1_OFFSET;\n UINT const count1 = DETOUR_IA64_INSTRUCTION_SIZE - count0;\n UINT64 const wide0 = SetBits(wide[0], DETOUR_IA64_INSTRUCTION1_OFFSET, count0, instruction);\n UINT64 const wide1 = SetBits(wide[1], 0, count1, instruction >> count0);\n wide[0] = wide0;\n wide[1] = wide1;\n}\n\nvoid DETOUR_IA64_BUNDLE::SetInstruction2(UINT64 instruction)\n{\n // Set upper 41 bits of wide[1].\n wide[1] = SetBits(wide[1], 64 - DETOUR_IA64_INSTRUCTION_SIZE, DETOUR_IA64_INSTRUCTION_SIZE, instruction);\n}\n\nUINT64 DETOUR_IA64_BUNDLE::SignExtend(UINT64 Value, UINT64 Offset)\n// This definition is from the IA64 manual.\n{\n if ((Value & (((UINT64)1) << (Offset - 1))) == 0)\n return Value;\n UINT64 const new_value = Value | ((~(UINT64)0) << Offset);\n return new_value;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetBits(UINT64 Value, UINT64 Offset, UINT64 Count)\n{\n UINT64 const new_value = (Value >> Offset) & ~(~((UINT64)0) << Count);\n return new_value;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::SetBits(UINT64 Value, UINT64 Offset, UINT64 Count, UINT64 Field)\n{\n UINT64 const mask = (~((~(UINT64)0) << Count)) << Offset;\n UINT64 const new_value = (Value & ~mask) | ((Field << Offset) & mask);\n return new_value;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetOpcode(UINT64 instruction)\n// Get 4bit primary opcode.\n{\n UINT64 const opcode = GetBits(instruction, DETOUR_IA64_INSTRUCTION_SIZE - 4, 4);\n return opcode;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetX(UINT64 instruction)\n// Get 1bit opcode extension.\n{\n UINT64 const x = GetBits(instruction, 33, 1);\n return x;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetX3(UINT64 instruction)\n// Get 3bit opcode extension.\n{\n UINT64 const x3 = GetBits(instruction, 33, 3);\n return x3;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetX6(UINT64 instruction)\n// Get 6bit opcode extension.\n{\n UINT64 const x6 = GetBits(instruction, 27, 6);\n return x6;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetImm7a(UINT64 instruction)\n{\n UINT64 const imm7a = GetBits(instruction, 6, 7);\n return imm7a;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::SetImm7a(UINT64 instruction, UINT64 imm7a)\n{\n UINT64 const new_instruction = SetBits(instruction, 6, 7, imm7a);\n return new_instruction;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetImm13c(UINT64 instruction)\n{\n UINT64 const imm13c = GetBits(instruction, 20, 13);\n return imm13c;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::SetImm13c(UINT64 instruction, UINT64 imm13c)\n{\n UINT64 const new_instruction = SetBits(instruction, 20, 13, imm13c);\n return new_instruction;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetSignBit(UINT64 instruction)\n{\n UINT64 const signBit = GetBits(instruction, 36, 1);\n return signBit;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::SetSignBit(UINT64 instruction, UINT64 signBit)\n{\n UINT64 const new_instruction = SetBits(instruction, 36, 1, signBit);\n return new_instruction;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetImm20a(UINT64 instruction)\n{\n UINT64 const imm20a = GetBits(instruction, 6, 20);\n return imm20a;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::SetImm20a(UINT64 instruction, UINT64 imm20a)\n{\n UINT64 const new_instruction = SetBits(instruction, 6, 20, imm20a);\n return new_instruction;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetImm20b(UINT64 instruction)\n{\n UINT64 const imm20b = GetBits(instruction, 13, 20);\n return imm20b;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::SetImm20b(UINT64 instruction, UINT64 imm20b)\n{\n UINT64 const new_instruction = SetBits(instruction, 13, 20, imm20b);\n return new_instruction;\n}\n\nbool DETOUR_IA64_BUNDLE::RelocateInstruction(_Inout_ DETOUR_IA64_BUNDLE* pDst,\n _In_ BYTE slot,\n _Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra) const\n/*\n If pBundleExtra is provided and instruction is IP-relative,\n this function relocates instruction to target pBundleExtra,\n pBundleExtra is set to brl the original target, and return true.\n\n [Not used] If pBundleExtra is not provided and instruction is IP-relative, return true.\n\n Else return false.\n\n The following IP-relative forms are recognized:\n br and br.call\n chk.s.m integer and float\n chk.a.nc integer and float\n chk.a.clr integer and float\n chk.s.i\n fchkf\n\n Brl is handled elsewhere, because the code was previously written.\n\n Branch prediction hints are not relocated.\n*/\n{\n UINT64 const instruction = GetInstruction(slot);\n UINT64 const opcode = GetOpcode(instruction);\n size_t const dest = (size_t)pDst;\n size_t const extra = (size_t)pBundleExtra;\n\n switch (GetUnit(slot)) {\n case F_UNIT:\n // F14 fchkf\n if (opcode == 0 && GetX(instruction) == 0 && GetX6(instruction) == 8) {\n goto imm20a;\n }\n return false;\n\n case M_UNIT:\n // M20 x3 == 1 integer chk.s.m\n // M21 x3 == 3 floating point chk.s\n if (opcode == 1) {\n UINT64 const x3 = GetX3(instruction);\n if (x3 == 1 || x3 == 3) {\n goto imm13_7;\n }\n }\n\n // M22 x3 == 4 integer chk.a.nc\n // M22 x3 == 5 integer chk.a.clr\n // M23 x3 == 6 floating point chk.a.nc\n // M23 x3 == 7 floating point chk.a.clr\n if (opcode == 0) {\n UINT64 const x3 = GetX3(instruction);\n if (x3 == 4 || x3 == 5 || x3 == 6 || x3 == 7) {\n goto imm20b;\n }\n }\n return false;\n case I_UNIT:\n // I20\n if (opcode == 0 && GetX3(instruction) == 1) { // chk.s.i\n goto imm13_7;\n }\n return false;\n case B_UNIT:\n // B1 B2 B3\n // 4 br\n // 5 br.call\n if (opcode == 4 || opcode == 5) {\n goto imm20b;\n }\n return false;\n }\n return false;\n\n UINT64 imm;\n UINT64 new_instruction;\n\nimm13_7:\n imm = SignExtend((GetSignBit(instruction) << 20) | (GetImm13c(instruction) << 7) | GetImm7a(instruction), 21) << 4;\n new_instruction = SetSignBit(SetImm13c(SetImm7a(instruction, (extra - dest) >> 4), (extra - dest) >> 11), extra < dest);\n goto set_brl;\n\nimm20a:\n imm = SignExtend((GetSignBit(instruction) << 20) | GetImm20a(instruction), 21) << 4;\n new_instruction = SetSignBit(SetImm20a(instruction, (extra - dest) >> 4), extra < dest);\n goto set_brl;\n\nimm20b:\n imm = SignExtend((GetSignBit(instruction) << 20) | GetImm20b(instruction), 21) << 4;\n new_instruction = SetSignBit(SetImm20b(instruction, (extra - dest) >> 4), extra < dest);\n goto set_brl;\n\nset_brl:\n if (pBundleExtra != NULL) {\n pDst->SetInstruction(slot, new_instruction);\n pBundleExtra->SetBrl((size_t)this + imm);\n }\n return true;\n}\n\nUINT DETOUR_IA64_BUNDLE::RelocateBundle(_Inout_ DETOUR_IA64_BUNDLE* pDst,\n _Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra) const\n/*\n Having already copied the bundle unchanged, then relocate its instructions one at a time.\n Return how many extra bytes are required to relocate the bundle.\n*/\n{\n UINT nExtraBytes = 0;\n for (BYTE slot = 0; slot < DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE; ++slot) {\n if (!RelocateInstruction(pDst, slot, pBundleExtra)) {\n continue;\n }\n pBundleExtra -= !!pBundleExtra;\n nExtraBytes += sizeof(DETOUR_IA64_BUNDLE);\n }\n return nExtraBytes;\n}\n\nBOOL DETOUR_IA64_BUNDLE::IsBrl() const\n{\n // f.e. d.c. b.a. 9.8. 7.6. 5. 4. 3. 2. 1. 0.\n // c000 0070 0000 0000 0000 00 01 00 00 00 05 : brl.sptk.few\n // c8ff fff0 007f fff0 ffff 00 01 00 00 00 05 : brl.sptk.few\n // c000 0048 0000 0000 0001 00 00 00 00 00 05 : brl.sptk.many\n return ((wide[0] & 0x000000000000001e) == 0x0000000000000004 && // 4 or 5.\n (wide[1] & 0xe000000000000000) == 0xc000000000000000); // c or d.\n}\n\nVOID DETOUR_IA64_BUNDLE::SetBrl()\n{\n wide[0] = 0x0000000100000005; // few\n //wide[0] = 0x0000000180000005; // many\n wide[1] = 0xc000000800000000;\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetBrlImm() const\n{\n return (\n // 0x0000000000fffff0\n ((wide[1] & 0x00fffff000000000) >> 32) | // all 20 bits of imm20b.\n // 0x000000ffff000000\n ((wide[0] & 0xffff000000000000) >> 24) | // bottom 16 bits of imm39.\n // 0x7fffff0000000000\n ((wide[1] & 0x00000000007fffff) << 40) | // top 23 bits of imm39.\n // 0x8000000000000000\n ((wide[1] & 0x0800000000000000) << 4) // single bit of i.\n );\n}\n\nVOID DETOUR_IA64_BUNDLE::SetBrlImm(UINT64 imm)\n{\n wide[0] = ((wide[0] & ~0xffff000000000000) |\n // 0xffff000000000000\n ((imm & 0x000000ffff000000) << 24) // bottom 16 bits of imm39.\n );\n wide[1] = ((wide[1] & ~0x08fffff0007fffff) |\n // 0x00fffff000000000\n ((imm & 0x0000000000fffff0) << 32) | // all 20 bits of imm20b.\n // 0x00000000007fffff\n ((imm & 0x7fffff0000000000) >> 40) | // top 23 bits of imm39.\n // 0x0800000000000000\n ((imm & 0x8000000000000000) >> 4) // single bit of i.\n );\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetBrlTarget() const\n{\n return (UINT64)this + GetBrlImm();\n}\n\nVOID DETOUR_IA64_BUNDLE::SetBrl(UINT64 target)\n{\n UINT64 imm = target - (UINT64)this;\n SetBrl();\n SetBrlImm(imm);\n}\n\nVOID DETOUR_IA64_BUNDLE::SetBrlTarget(UINT64 target)\n{\n UINT64 imm = target - (UINT64)this;\n SetBrlImm(imm);\n}\n\nBOOL DETOUR_IA64_BUNDLE::IsMovlGp() const\n{\n // f.e. d.c. b.a. 9.8. 7.6. 5.4. 3.2. 1.0.\n // 6fff f7f0 207f ffff ffff c001 0000 0004\n // 6000 0000 2000 0000 0000 0001 0000 0004\n return ((wide[0] & 0x00003ffffffffffe) == 0x0000000100000004 &&\n (wide[1] & 0xf000080fff800000) == 0x6000000020000000);\n}\n\nUINT64 DETOUR_IA64_BUNDLE::GetMovlGp() const\n{\n UINT64 raw = (\n // 0x0000000000000070\n ((wide[1] & 0x000007f000000000) >> 36) |\n // 0x000000000000ff80\n ((wide[1] & 0x07fc000000000000) >> 43) |\n // 0x00000000001f0000\n ((wide[1] & 0x0003e00000000000) >> 29) |\n // 0x0000000000200000\n ((wide[1] & 0x0000100000000000) >> 23) |\n // 0x000000ffffc00000\n ((wide[0] & 0xffffc00000000000) >> 24) |\n // 0x7fffff0000000000\n ((wide[1] & 0x00000000007fffff) << 40) |\n // 0x8000000000000000\n ((wide[1] & 0x0800000000000000) << 4)\n );\n\n return (INT64)raw;\n}\n\nVOID DETOUR_IA64_BUNDLE::SetMovlGp(UINT64 gp)\n{\n UINT64 raw = (UINT64)gp;\n\n wide[0] = (0x0000000100000005 |\n // 0xffffc00000000000\n ((raw & 0x000000ffffc00000) << 24)\n );\n wide[1] = (\n 0x6000000020000000 |\n // 0x0000070000000000\n ((raw & 0x0000000000000070) << 36) |\n // 0x07fc000000000000\n ((raw & 0x000000000000ff80) << 43) |\n // 0x0003e00000000000\n ((raw & 0x00000000001f0000) << 29) |\n // 0x0000100000000000\n ((raw & 0x0000000000200000) << 23) |\n // 0x00000000007fffff\n ((raw & 0x7fffff0000000000) >> 40) |\n // 0x0800000000000000\n ((raw & 0x8000000000000000) >> 4)\n );\n}\n\nUINT DETOUR_IA64_BUNDLE::Copy(_Out_ DETOUR_IA64_BUNDLE *pDst,\n _Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra) const\n{\n // Copy the bytes unchanged.\n\n#pragma warning(suppress:6001) // using uninitialized *pDst\n pDst->wide[0] = wide[0];\n pDst->wide[1] = wide[1];\n\n // Relocate if necessary.\n\n UINT nExtraBytes = RelocateBundle(pDst, pBundleExtra);\n\n if (GetUnit1() == L_UNIT && IsBrl()) {\n pDst->SetBrlTarget(GetBrlTarget());\n }\n\n return nExtraBytes;\n}\n\nBOOL DETOUR_IA64_BUNDLE::SetNop(BYTE slot)\n{\n switch (GetUnit(slot)) {\n case I_UNIT:\n case M_UNIT:\n case F_UNIT:\n SetInst(slot, 0);\n SetData(slot, 0x8000000);\n return true;\n case B_UNIT:\n SetInst(slot, 2);\n SetData(slot, 0);\n return true;\n }\n __debugbreak();\n return false;\n}\n\nBOOL DETOUR_IA64_BUNDLE::SetNop0()\n{\n return SetNop(0);\n}\n\nBOOL DETOUR_IA64_BUNDLE::SetNop1()\n{\n return SetNop(1);\n}\n\nBOOL DETOUR_IA64_BUNDLE::SetNop2()\n{\n return SetNop(2);\n}\n\nVOID DETOUR_IA64_BUNDLE::SetStop()\n{\n data[0] |= 0x01;\n}\n\n#endif // DETOURS_IA64\n\nPVOID WINAPI DetourCopyInstruction(_In_opt_ PVOID pDst,\n _Inout_opt_ PVOID *ppDstPool,\n _In_ PVOID pSrc,\n _Out_opt_ PVOID *ppTarget,\n _Out_opt_ LONG *plExtra)\n{\n LONG nExtra;\n DETOUR_IA64_BUNDLE bExtra;\n DETOUR_IA64_BUNDLE *pbSrc = (DETOUR_IA64_BUNDLE *)pSrc;\n DETOUR_IA64_BUNDLE *pbDst = pDst ? (DETOUR_IA64_BUNDLE *)pDst : &bExtra;\n\n plExtra = plExtra ? plExtra : &nExtra;\n *plExtra = 0;\n\n if (ppTarget != NULL) {\n if (pbSrc->IsBrl()) {\n *ppTarget = (PVOID)pbSrc->GetBrlTarget();\n }\n else {\n *ppTarget = DETOUR_INSTRUCTION_TARGET_NONE;\n }\n }\n *plExtra = (LONG)pbSrc->Copy(pbDst, ppDstPool ? ((DETOUR_IA64_BUNDLE*)*ppDstPool) - 1 : (DETOUR_IA64_BUNDLE*)NULL);\n return pbSrc + 1;\n}\n\n#endif // DETOURS_IA64\n\n#ifdef DETOURS_ARM\n\n#define DETOURS_PFUNC_TO_PBYTE(p) ((PBYTE)(((ULONG_PTR)(p)) & ~(ULONG_PTR)1))\n#define DETOURS_PBYTE_TO_PFUNC(p) ((PBYTE)(((ULONG_PTR)(p)) | (ULONG_PTR)1))\n\n#define c_PCAdjust 4 // The PC value of an instruction is the PC address plus 4.\n#define c_PC 15 // The register number for the Program Counter\n#define c_LR 14 // The register number for the Link Register\n#define c_SP 13 // The register number for the Stack Pointer\n#define c_NOP 0xbf00 // A nop instruction\n#define c_BREAK 0xdefe // A nop instruction\n\nclass CDetourDis\n{\n public:\n CDetourDis();\n\n PBYTE CopyInstruction(PBYTE pDst,\n PBYTE *ppDstPool,\n PBYTE pSrc,\n PBYTE *ppTarget,\n LONG *plExtra);\n\n public:\n typedef BYTE (CDetourDis::* COPYFUNC)(PBYTE pbDst, PBYTE pbSrc);\n\n struct COPYENTRY {\n USHORT nOpcode;\n COPYFUNC pfCopy;\n };\n\n typedef const COPYENTRY * REFCOPYENTRY;\n\n struct Branch5\n {\n DWORD Register : 3;\n DWORD Imm5 : 5;\n DWORD Padding : 1;\n DWORD I : 1;\n DWORD OpCode : 6;\n };\n\n struct Branch5Target\n {\n DWORD Padding : 1;\n DWORD Imm5 : 5;\n DWORD I : 1;\n DWORD Padding2 : 25;\n };\n\n struct Branch8\n {\n DWORD Imm8 : 8;\n DWORD Condition : 4;\n DWORD OpCode : 4;\n };\n\n struct Branch8Target\n {\n DWORD Padding : 1;\n DWORD Imm8 : 8;\n DWORD Padding2 : 23;\n };\n\n struct Branch11\n {\n DWORD Imm11 : 11;\n DWORD OpCode : 5;\n };\n\n struct Branch11Target\n {\n DWORD Padding : 1;\n DWORD Imm11 : 11;\n DWORD Padding2 : 20;\n };\n\n struct Branch20\n {\n DWORD Imm11 : 11;\n DWORD J2 : 1;\n DWORD IT : 1;\n DWORD J1 : 1;\n DWORD Other : 2;\n DWORD Imm6 : 6;\n DWORD Condition : 4;\n DWORD Sign : 1;\n DWORD OpCode : 5;\n };\n\n struct Branch20Target\n {\n DWORD Padding : 1;\n DWORD Imm11 : 11;\n DWORD Imm6 : 6;\n DWORD J1 : 1;\n DWORD J2 : 1;\n DWORD Sign : 1;\n INT32 Padding2 : 11;\n };\n\n struct Branch24\n {\n DWORD Imm11 : 11;\n DWORD J2 : 1;\n DWORD InstructionSet : 1;\n DWORD J1 : 1;\n DWORD Link : 1;\n DWORD Branch : 1;\n DWORD Imm10 : 10;\n DWORD Sign : 1;\n DWORD OpCode : 5;\n };\n\n struct Branch24Target\n {\n DWORD Padding : 1;\n DWORD Imm11 : 11;\n DWORD Imm10 : 10;\n DWORD I2 : 1;\n DWORD I1 : 1;\n DWORD Sign : 1;\n INT32 Padding2 : 7;\n };\n\n struct LiteralLoad8\n {\n DWORD Imm8 : 8;\n DWORD Register : 3;\n DWORD OpCode : 5;\n };\n\n struct LiteralLoad8Target\n {\n DWORD Padding : 2;\n DWORD Imm8 : 8;\n DWORD Padding2 : 22;\n };\n\n struct LiteralLoad12\n {\n DWORD Imm12 : 12;\n DWORD Register : 4;\n DWORD OpCodeSuffix : 7;\n DWORD Add : 1;\n DWORD OpCodePrefix : 8;\n };\n\n struct LiteralLoad12Target\n {\n DWORD Imm12 : 12;\n DWORD Padding : 20;\n };\n\n struct ImmediateRegisterLoad32\n {\n DWORD Imm12 : 12;\n DWORD DestinationRegister : 4;\n DWORD SourceRegister: 4;\n DWORD OpCode : 12;\n };\n\n struct ImmediateRegisterLoad16\n {\n DWORD DestinationRegister : 3;\n DWORD SourceRegister: 3;\n DWORD OpCode : 10;\n };\n\n struct TableBranch\n {\n DWORD IndexRegister : 4;\n DWORD HalfWord : 1;\n DWORD OpCodeSuffix : 11;\n DWORD BaseRegister : 4;\n DWORD OpCodePrefix : 12;\n };\n\n struct Shift\n {\n DWORD Imm2 : 2;\n DWORD Imm3 : 3;\n };\n\n struct Add32\n {\n DWORD SecondOperandRegister : 4;\n DWORD Type : 2;\n DWORD Imm2 : 2;\n DWORD DestinationRegister : 4;\n DWORD Imm3 : 3;\n DWORD Padding : 1;\n DWORD FirstOperandRegister : 4;\n DWORD SetFlags : 1;\n DWORD OpCode : 11;\n };\n\n struct LogicalShiftLeft32\n {\n DWORD SourceRegister : 4;\n DWORD Padding : 2;\n DWORD Imm2 : 2;\n DWORD DestinationRegister : 4;\n DWORD Imm3 : 3;\n DWORD Padding2 : 5;\n DWORD SetFlags : 1;\n DWORD OpCode : 11;\n };\n\n struct StoreImmediate12\n {\n DWORD Imm12 : 12;\n DWORD SourceRegister : 4;\n DWORD BaseRegister : 4;\n DWORD OpCode : 12;\n };\n\n protected:\n BYTE PureCopy16(BYTE* pSource, BYTE* pDest);\n BYTE PureCopy32(BYTE* pSource, BYTE* pDest);\n BYTE CopyMiscellaneous16(BYTE* pSource, BYTE* pDest);\n BYTE CopyConditionalBranchOrOther16(BYTE* pSource, BYTE* pDest);\n BYTE CopyUnConditionalBranch16(BYTE* pSource, BYTE* pDest);\n BYTE CopyLiteralLoad16(BYTE* pSource, BYTE* pDest);\n BYTE CopyBranchExchangeOrDataProcessing16(BYTE* pSource, BYTE* pDest);\n BYTE CopyBranch24(BYTE* pSource, BYTE* pDest);\n BYTE CopyBranchOrMiscellaneous32(BYTE* pSource, BYTE* pDest);\n BYTE CopyLiteralLoad32(BYTE* pSource, BYTE* pDest);\n BYTE CopyLoadAndStoreSingle(BYTE* pSource, BYTE* pDest);\n BYTE CopyLoadAndStoreMultipleAndSRS(BYTE* pSource, BYTE* pDest);\n BYTE CopyTableBranch(BYTE* pSource, BYTE* pDest);\n BYTE BeginCopy32(BYTE* pSource, BYTE* pDest);\n\n LONG DecodeBranch5(ULONG opcode);\n USHORT EncodeBranch5(ULONG originalOpCode, LONG delta);\n LONG DecodeBranch8(ULONG opcode);\n USHORT EncodeBranch8(ULONG originalOpCode, LONG delta);\n LONG DecodeBranch11(ULONG opcode);\n USHORT EncodeBranch11(ULONG originalOpCode, LONG delta);\n BYTE EmitBranch11(PUSHORT& pDest, LONG relativeAddress);\n LONG DecodeBranch20(ULONG opcode);\n ULONG EncodeBranch20(ULONG originalOpCode, LONG delta);\n LONG DecodeBranch24(ULONG opcode, BOOL& fLink);\n ULONG EncodeBranch24(ULONG originalOpCode, LONG delta, BOOL fLink);\n LONG DecodeLiteralLoad8(ULONG instruction);\n LONG DecodeLiteralLoad12(ULONG instruction);\n BYTE EmitLiteralLoad8(PUSHORT& pDest, BYTE targetRegister, PBYTE pLiteral);\n BYTE EmitLiteralLoad12(PUSHORT& pDest, BYTE targetRegister, PBYTE pLiteral);\n BYTE EmitImmediateRegisterLoad32(PUSHORT& pDest, BYTE reg);\n BYTE EmitImmediateRegisterLoad16(PUSHORT& pDest, BYTE reg);\n BYTE EmitLongLiteralLoad(PUSHORT& pDest, BYTE reg, PVOID pTarget);\n BYTE EmitLongBranch(PUSHORT& pDest, PVOID pTarget);\n USHORT CalculateExtra(BYTE sourceLength, BYTE* pDestStart, BYTE* pDestEnd);\n\n protected:\n ULONG GetLongInstruction(BYTE* pSource)\n {\n return (((PUSHORT)pSource)[0] << 16) | (((PUSHORT)pSource)[1]);\n }\n\n BYTE EmitLongInstruction(PUSHORT& pDstInst, ULONG instruction)\n {\n *pDstInst++ = (USHORT)(instruction >> 16);\n *pDstInst++ = (USHORT)instruction;\n return sizeof(ULONG);\n }\n\n BYTE EmitShortInstruction(PUSHORT& pDstInst, USHORT instruction)\n {\n *pDstInst++ = instruction;\n return sizeof(USHORT);\n }\n\n PBYTE Align4(PBYTE pValue)\n {\n return (PBYTE)(((size_t)pValue) & ~(ULONG)3u);\n }\n\n PBYTE CalculateTarget(PBYTE pSource, LONG delta)\n {\n return (pSource + delta + c_PCAdjust);\n }\n\n LONG CalculateNewDelta(PBYTE pTarget, BYTE* pDest)\n {\n return (LONG)(pTarget - (pDest + c_PCAdjust));\n }\n\n BYTE EmitAdd32(PUSHORT& pDstInst, BYTE op1Reg, BYTE op2Reg, BYTE dstReg, BYTE shiftAmount)\n {\n Shift& shift = (Shift&)(shiftAmount);\n const BYTE shiftType = 0x00; // LSL\n Add32 add = { op2Reg, shiftType, shift.Imm2, dstReg, shift.Imm3,\n 0x0, op1Reg, 0x0, 0x758 };\n return EmitLongInstruction(pDstInst, (ULONG&)add);\n }\n\n BYTE EmitLogicalShiftLeft32(PUSHORT& pDstInst, BYTE srcReg, BYTE dstReg, BYTE shiftAmount)\n {\n Shift& shift = (Shift&)(shiftAmount);\n LogicalShiftLeft32 shiftLeft = { srcReg, 0x00, shift.Imm2, dstReg, shift.Imm3, 0x1E,\n 0x00, 0x752 };\n return EmitLongInstruction(pDstInst, (ULONG&)shiftLeft);\n }\n\n BYTE EmitStoreImmediate12(PUSHORT& pDstInst, BYTE srcReg, BYTE baseReg, USHORT offset)\n {\n StoreImmediate12 store = { offset, srcReg, baseReg, 0xF8C };\n return EmitLongInstruction(pDstInst, (ULONG&)store);\n }\n\n protected:\n PBYTE m_pbTarget = NULL;\n PBYTE m_pbPool = NULL;\n LONG m_lExtra = 0;\n\n BYTE m_rbScratchDst[64] = { 0 };\n\n static const COPYENTRY s_rceCopyTable[33];\n};\n\nLONG CDetourDis::DecodeBranch5(ULONG opcode)\n{\n Branch5& branch = (Branch5&)(opcode);\n\n Branch5Target target;\n ZeroMemory(&target, sizeof(target));\n target.Imm5 = branch.Imm5;\n target.I = branch.I;\n\n // Return zero-extended value\n return (LONG&)target;\n}\n\nUSHORT CDetourDis::EncodeBranch5(ULONG originalOpCode, LONG delta)\n{\n // Too large for a 5 bit branch (5 bit branches can be up to 7 bits due to I and the trailing 0)\n if (delta < 0 || delta > 0x7F) {\n return 0;\n }\n\n Branch5& branch = (Branch5&)(originalOpCode);\n Branch5Target& target = (Branch5Target&)(delta);\n\n branch.Imm5 = target.Imm5;\n branch.I = target.I;\n\n return (USHORT&)branch;\n}\n\nLONG CDetourDis::DecodeBranch8(ULONG opcode)\n{\n Branch8& branch = (Branch8&)(opcode);\n\n Branch8Target target;\n ZeroMemory(&target, sizeof(target));\n target.Imm8 = branch.Imm8;\n\n // Return sign extended value\n return (((LONG&)target) << 23) >> 23;\n}\n\nUSHORT CDetourDis::EncodeBranch8(ULONG originalOpCode, LONG delta)\n{\n // Too large for 8 bit branch (8 bit branches can be up to 9 bits due to the trailing 0)\n if (delta < (-(int)0x100) || delta > 0xFF) {\n return 0;\n }\n\n Branch8& branch = (Branch8&)(originalOpCode);\n Branch8Target& target = (Branch8Target&)(delta);\n\n branch.Imm8 = target.Imm8;\n\n return (USHORT&)branch;\n}\n\nLONG CDetourDis::DecodeBranch11(ULONG opcode)\n{\n Branch11& branch = (Branch11&)(opcode);\n\n Branch11Target target;\n ZeroMemory(&target, sizeof(target));\n target.Imm11 = branch.Imm11;\n\n // Return sign extended value\n return (((LONG&)target) << 20) >> 20;\n}\n\nUSHORT CDetourDis::EncodeBranch11(ULONG originalOpCode, LONG delta)\n{\n // Too large for an 11 bit branch (11 bit branches can be up to 12 bits due to the trailing 0)\n if (delta < (-(int)0x800) || delta > 0x7FF) {\n return 0;\n }\n\n Branch11& branch = (Branch11&)(originalOpCode);\n Branch11Target& target = (Branch11Target&)(delta);\n\n branch.Imm11 = target.Imm11;\n\n return (USHORT&)branch;\n}\n\nBYTE CDetourDis::EmitBranch11(PUSHORT& pDest, LONG relativeAddress)\n{\n Branch11Target& target = (Branch11Target&)(relativeAddress);\n Branch11 branch11 = { target.Imm11, 0x1C };\n\n *pDest++ = (USHORT&)branch11;\n return sizeof(USHORT);\n}\n\nLONG CDetourDis::DecodeBranch20(ULONG opcode)\n{\n Branch20& branch = (Branch20&)(opcode);\n\n Branch20Target target;\n ZeroMemory(&target, sizeof(target));\n target.Imm11 = branch.Imm11;\n target.Imm6 = branch.Imm6;\n target.Sign = branch.Sign;\n target.J1 = branch.J1;\n target.J2 = branch.J2;\n\n // Sign extend\n if (target.Sign) {\n target.Padding2 = -1;\n }\n\n return (LONG&)target;\n}\n\nULONG CDetourDis::EncodeBranch20(ULONG originalOpCode, LONG delta)\n{\n // Too large for 20 bit branch (20 bit branches can be up to 21 bits due to the trailing 0)\n if (delta < (-(int)0x100000) || delta > 0xFFFFF) {\n return 0;\n }\n\n Branch20& branch = (Branch20&)(originalOpCode);\n Branch20Target& target = (Branch20Target&)(delta);\n\n branch.Imm11 = target.Imm11;\n branch.Imm6 = target.Imm6;\n branch.Sign = target.Sign;\n branch.J1 = target.J1;\n branch.J2 = target.J2;\n\n return (ULONG&)branch;\n}\n\nLONG CDetourDis::DecodeBranch24(ULONG opcode, BOOL& fLink)\n{\n Branch24& branch = (Branch24&)(opcode);\n\n Branch24Target target;\n ZeroMemory(&target, sizeof(target));\n target.Imm11 = branch.Imm11;\n target.Imm10 = branch.Imm10;\n target.Sign = branch.Sign;\n target.I1 = ~(branch.J1 ^ target.Sign);\n target.I2 = ~(branch.J2 ^ target.Sign);\n fLink = branch.Link;\n\n // Sign extend\n if (target.Sign) {\n target.Padding2 = -1;\n }\n\n return (LONG&)target;\n}\n\nULONG CDetourDis::EncodeBranch24(ULONG originalOpCode, LONG delta, BOOL fLink)\n{\n // Too large for 24 bit branch (24 bit branches can be up to 25 bits due to the trailing 0)\n if (delta < static_cast(0xFF000000) || delta > static_cast(0xFFFFFF)) {\n return 0;\n }\n\n Branch24& branch = (Branch24&)(originalOpCode);\n Branch24Target& target = (Branch24Target&)(delta);\n\n branch.Imm11 = target.Imm11;\n branch.Imm10 = target.Imm10;\n branch.Link = fLink;\n branch.Sign = target.Sign;\n branch.J1 = ~(target.I1 ^ branch.Sign);\n branch.J2 = ~(target.I2 ^ branch.Sign);\n\n return (ULONG&)branch;\n}\n\nLONG CDetourDis::DecodeLiteralLoad8(ULONG instruction)\n{\n LiteralLoad8& load = (LiteralLoad8&)(instruction);\n\n LiteralLoad8Target target;\n ZeroMemory(&target, sizeof(target));\n target.Imm8 = load.Imm8;\n\n return (LONG&)target;\n}\n\nBYTE CDetourDis::EmitLiteralLoad8(PUSHORT& pDest, BYTE targetRegister, PBYTE pLiteral)\n{\n // Note: We add 2 (which gets rounded down) because literals must be 32-bit\n // aligned, but the ldr can be 16-bit aligned.\n LONG newDelta = CalculateNewDelta((PBYTE)pLiteral + 2, (PBYTE)pDest);\n LONG relative = ((newDelta > 0 ? newDelta : -newDelta) & 0x3FF);\n\n LiteralLoad8Target& target = (LiteralLoad8Target&)(relative);\n LiteralLoad8 load = { target.Imm8, targetRegister, 0x9 };\n\n return EmitShortInstruction(pDest, (USHORT&)load);\n}\n\nLONG CDetourDis::DecodeLiteralLoad12(ULONG instruction)\n{\n LiteralLoad12& load = (LiteralLoad12&)(instruction);\n\n LiteralLoad12Target target;\n ZeroMemory(&target, sizeof(target));\n target.Imm12 = load.Imm12;\n\n return (LONG&)target;\n}\n\nBYTE CDetourDis::EmitLiteralLoad12(PUSHORT& pDest, BYTE targetRegister, PBYTE pLiteral)\n{\n // Note: We add 2 (which gets rounded down) because literals must be 32-bit\n // aligned, but the ldr can be 16-bit aligned.\n LONG newDelta = CalculateNewDelta((PBYTE)pLiteral + 2, (PBYTE)pDest);\n LONG relative = ((newDelta > 0 ? newDelta : -newDelta) & 0xFFF);\n\n LiteralLoad12Target& target = (LiteralLoad12Target&)(relative);\n target.Imm12 -= target.Imm12 & 3;\n LiteralLoad12 load = { target.Imm12, targetRegister, 0x5F, (DWORD)(newDelta > 0), 0xF8 };\n\n return EmitLongInstruction(pDest, (ULONG&)load);\n}\n\nBYTE CDetourDis::EmitImmediateRegisterLoad32(PUSHORT& pDest, BYTE reg)\n{\n ImmediateRegisterLoad32 load = { 0, reg, reg, 0xF8D };\n return EmitLongInstruction(pDest, (ULONG&)load);\n}\n\nBYTE CDetourDis::EmitImmediateRegisterLoad16(PUSHORT& pDest, BYTE reg)\n{\n ImmediateRegisterLoad16 load = { reg, reg, 0x680 >> 2 };\n return EmitShortInstruction(pDest, (USHORT&)load);\n}\n\nBYTE CDetourDis::EmitLongLiteralLoad(PUSHORT& pDest, BYTE targetRegister, PVOID pTarget)\n{\n *--((PULONG&)m_pbPool) = (ULONG)(size_t)pTarget;\n\n // ldr rn, target.\n BYTE size = EmitLiteralLoad12(pDest, targetRegister, m_pbPool);\n\n // This only makes sense if targetRegister != PC;\n // otherwise, we would have branched with the previous instruction anyway\n if (targetRegister != c_PC) {\n // ldr rn, [rn]\n if (targetRegister <= 7) {\n size = (BYTE)(size + EmitImmediateRegisterLoad16(pDest, targetRegister));\n }\n else {\n size = (BYTE)(size + EmitImmediateRegisterLoad32(pDest, targetRegister));\n }\n }\n\n return size;\n}\n\nBYTE CDetourDis::EmitLongBranch(PUSHORT& pDest, PVOID pTarget)\n{\n // Emit a long literal load into PC\n BYTE size = EmitLongLiteralLoad(pDest, c_PC, DETOURS_PBYTE_TO_PFUNC(pTarget));\n return size;\n}\n\nBYTE CDetourDis::PureCopy16(BYTE* pSource, BYTE* pDest)\n{\n *(USHORT *)pDest = *(USHORT *)pSource;\n return sizeof(USHORT);\n}\n\nBYTE CDetourDis::PureCopy32(BYTE* pSource, BYTE* pDest)\n{\n *(UNALIGNED ULONG *)pDest = *(UNALIGNED ULONG*)pSource;\n return sizeof(DWORD);\n}\n\nUSHORT CDetourDis::CalculateExtra(BYTE sourceLength, BYTE* pDestStart, BYTE* pDestEnd)\n{\n ULONG destinationLength = (ULONG)(pDestEnd - pDestStart);\n return static_cast((destinationLength > sourceLength) ? (destinationLength - sourceLength) : 0);\n}\n\nBYTE CDetourDis::CopyMiscellaneous16(BYTE* pSource, BYTE* pDest)\n{\n USHORT instruction = *(PUSHORT)(pSource);\n\n // Compare and branch imm5 (CBZ, CBNZ)\n if ((instruction & 0x100) && !(instruction & 0x400)) { // (1011x0x1xxxxxxxx)\n LONG oldDelta = DecodeBranch5(instruction);\n PBYTE pTarget = CalculateTarget(pSource, oldDelta);\n m_pbTarget = pTarget;\n\n LONG newDelta = CalculateNewDelta(pTarget, pDest);\n instruction = EncodeBranch5(instruction, newDelta);\n\n if (instruction) {\n // Copy the 16 bit instruction over\n *(PUSHORT)(pDest) = instruction;\n return sizeof(USHORT); // The source instruction was 16 bits\n }\n\n // If that fails, re-encode with 'conditional branch' logic, without using the condition flags\n // For example, cbz r2,+0x56 (0x90432) becomes:\n //\n // 001df73a b92a cbnz r2,001df748\n // 001df73c e002 b 001df744\n // 001df73e bf00 nop\n // 001df740 0432 dc.h 0432\n // 001df742 0009 dc.h 0009\n // 001df744 f85ff008 ldr pc,=0x90432\n //\n\n // Store where we will be writing our conditional branch, and move past it so we can emit a long branch\n PUSHORT pDstInst = (PUSHORT)(pDest);\n PUSHORT pConditionalBranchInstruction = pDstInst++;\n\n // Emit the long branch instruction\n BYTE longBranchSize = EmitLongBranch(pDstInst, pTarget);\n\n // Invert the CBZ/CBNZ instruction to move past our 'long branch' if the inverse comparison succeeds\n // Write the CBZ/CBNZ instruction *before* the long branch we emitted above\n // This had to be done out of order, since the size of a long branch can vary due to alignment restrictions\n instruction = EncodeBranch5(*(PUSHORT)(pSource), longBranchSize - c_PCAdjust + sizeof(USHORT));\n Branch5& branch = (Branch5&)(instruction);\n branch.OpCode = (branch.OpCode & 0x02) ? 0x2C : 0x2E; // Invert the CBZ/CBNZ comparison\n *pConditionalBranchInstruction = instruction;\n\n // Compute the extra space needed for the branch sequence\n m_lExtra = CalculateExtra(sizeof(USHORT), pDest, (BYTE*)(pDstInst));\n return sizeof(USHORT); // The source instruction was 16 bits\n }\n\n // If-Then Instruction (IT)\n if ((instruction >> 8 == 0xBF) && (instruction & 0xF)) { //(10111111xxxx(mask != 0b0000))\n // ToDo: Implement IT handler\n ASSERT(false);\n return sizeof(USHORT);\n }\n\n // ADD/SUB, SXTH, SXTB, UXTH, UXTB, CBZ, CBNZ, PUSH, POP, REV, REV15, REVSH, NOP, YIELD, WFE, WFI, SEV, etc.\n return PureCopy16(pSource, pDest);\n}\n\nBYTE CDetourDis::CopyConditionalBranchOrOther16(BYTE* pSource, BYTE* pDest)\n{\n USHORT instruction = *(PUSHORT)(pSource);\n\n // Could be a conditional branch, an Undefined instruction or a Service System Call\n // Only the former needs special logic\n if ((instruction & 0xE00) != 0xE00) { // 1101(!=111x)xxxxxxxx\n LONG oldDelta = DecodeBranch8(instruction);\n PBYTE pTarget = CalculateTarget(pSource, oldDelta);\n m_pbTarget = pTarget;\n\n LONG newDelta = CalculateNewDelta(pTarget, pDest);\n instruction = EncodeBranch8(instruction, newDelta);\n if (instruction) {\n // Copy the 16 bit instruction over\n *(PUSHORT)(pDest) = instruction;\n return sizeof(USHORT); // The source instruction was 16 bits\n }\n\n // If that fails, re-encode as a sequence of branches\n // For example, bne +0x6E (0x90452) becomes:\n //\n // 001df758 d100 bne 001df75c\n // 001df75a e005 b 001df768\n // 001df75c e002 b 001df764\n // 001df75e bf00 nop\n // 001df760 0452 dc.h 0452\n // 001df762 0009 dc.h 0009\n // 001df764 f85ff008 ldr pc,=0x90452\n //\n\n // First, reuse the existing conditional branch to, if successful, branch down to a 'long branch' that we will emit below\n USHORT newInstruction = EncodeBranch8(*(PUSHORT)(pSource), 0); // Due to the size of c_PCAdjust a zero-length branch moves 4 bytes forward, past the following unconditional branch\n ASSERT(newInstruction);\n PUSHORT pDstInst = (PUSHORT)(pDest);\n *pDstInst++ = newInstruction;\n\n // Next, prepare to insert an unconditional branch that will be hit if the condition above is not met. This branch will branch over the following 'long branch'\n // We can't actually encode this branch yet though, because 'long branches' can vary in size\n PUSHORT pUnconditionalBranchInstruction = pDstInst++;\n\n // Then, emit a 'long branch' that will be hit if the original condition is met\n BYTE longBranchSize = EmitLongBranch(pDstInst, pTarget);\n\n // Finally, encode and emit the unconditional branch that will be used to branch past the 'long branch' if the initial condition was not met\n Branch11 branch11 = { 0x00, 0x1C };\n newInstruction = EncodeBranch11(*(DWORD*)(&branch11), longBranchSize - c_PCAdjust + sizeof(USHORT));\n ASSERT(newInstruction);\n *pUnconditionalBranchInstruction = newInstruction;\n\n // Compute the extra space needed for the branch sequence\n m_lExtra = CalculateExtra(sizeof(USHORT), pDest, (BYTE*)(pDstInst));\n return sizeof(USHORT); // The source instruction was 16 bits\n }\n\n return PureCopy16(pSource, pDest);\n}\n\nBYTE CDetourDis::CopyUnConditionalBranch16(BYTE* pSource, BYTE* pDest)\n{\n ULONG instruction = *(PUSHORT)(pSource);\n\n LONG oldDelta = DecodeBranch11(instruction);\n PBYTE pTarget = CalculateTarget(pSource, oldDelta);\n m_pbTarget = pTarget;\n\n LONG newDelta = CalculateNewDelta(pTarget, pDest);\n instruction = EncodeBranch11(instruction, newDelta);\n if (instruction) {\n // Copy the 16 bit instruction over\n *(PUSHORT)(pDest) = (USHORT)instruction;\n return sizeof(USHORT); // The source instruction was 16 bits\n }\n\n // If that fails, re-encode as 32-bit\n PUSHORT pDstInst = (PUSHORT)(pDest);\n instruction = EncodeBranch24(0xf0009000, newDelta, FALSE);\n if (instruction) {\n // Copy both bytes of the instruction\n EmitLongInstruction(pDstInst, instruction);\n\n m_lExtra = sizeof(DWORD) - sizeof(USHORT); // The destination instruction was 32 bits\n return sizeof(USHORT); // The source instruction was 16 bits\n }\n\n // If that fails, emit as a 'long branch'\n if (!instruction) {\n // For example, b +0x7FE (00090be6) becomes:\n // 003f6d02 e001 b 003f6d08\n // 003f6d04 0be6 dc.h 0be6\n // 003f6d06 0009 dc.h 0009\n // 003f6d08 f85ff008 ldr pc,=0x90BE6\n EmitLongBranch(pDstInst, pTarget);\n\n // Compute the extra space needed for the branch sequence\n m_lExtra = CalculateExtra(sizeof(USHORT), pDest, (BYTE*)(pDstInst));\n return sizeof(USHORT); // The source instruction was 16 bits\n }\n\n return sizeof(USHORT); // The source instruction was 16 bits\n}\n\nBYTE CDetourDis::CopyLiteralLoad16(BYTE* pSource, BYTE* pDest)\n{\n PBYTE pStart = pDest;\n USHORT instruction = *(PUSHORT)(pSource);\n\n LONG oldDelta = DecodeLiteralLoad8(instruction);\n PBYTE pTarget = CalculateTarget(Align4(pSource), oldDelta);\n\n // Re-encode as a 'long literal load'\n // For example, ldr r0, [PC + 1E0] (0x905B4) becomes:\n //\n // 001df72c f85f0008 ldr r0,=0x905B4\n // 001df730 f8d00000 ldr.w r0,[r0]\n LiteralLoad8& load8 = (LiteralLoad8&)(instruction);\n EmitLongLiteralLoad((PUSHORT&)pDest, load8.Register, pTarget);\n\n m_lExtra = (LONG)(pDest - pStart - sizeof(USHORT));\n return sizeof(USHORT); // The source instruction was 16 bits\n}\n\nBYTE CDetourDis::CopyBranchExchangeOrDataProcessing16(BYTE* pSource, BYTE* pDest)\n{\n ULONG instruction = *(PUSHORT)(pSource);\n\n // BX\n if ((instruction & 0xff80) == 0x4700) {\n // The target is stored in a register\n m_pbTarget = (PBYTE)DETOUR_INSTRUCTION_TARGET_DYNAMIC;\n }\n\n // AND, LSR, TST, ADD, CMP, MOV\n return PureCopy16(pSource, pDest);\n}\n\nconst CDetourDis::COPYENTRY CDetourDis::s_rceCopyTable[33] =\n{\n // Shift by immediate, move register\n // ToDo: Not handling moves from PC\n /* 0b00000 */ { 0x00, &CDetourDis::PureCopy16 },\n /* 0b00001 */ { 0x01, &CDetourDis::PureCopy16 },\n /* 0b00010 */ { 0x02, &CDetourDis::PureCopy16 },\n\n // Add/subtract register\n // Add/subtract immediate\n /* 0b00011 */ { 0x03, &CDetourDis::PureCopy16},\n\n // Add/subtract/compare/move immediate\n /* 0b00100 */ { 0x04, &CDetourDis::PureCopy16 },\n /* 0b00101 */ { 0x05, &CDetourDis::PureCopy16 },\n /* 0b00110 */ { 0x06, &CDetourDis::PureCopy16 },\n /* 0b00111 */ { 0x07, &CDetourDis::PureCopy16 },\n\n // Data-processing register\n // Special data processing\n // Branch/exchange instruction set\n /* 0b01000 */ { 0x08, &CDetourDis::CopyBranchExchangeOrDataProcessing16 },\n\n // Load from literal pool\n /* 0b01001 */ { 0x09, &CDetourDis::CopyLiteralLoad16 },\n\n // Load/store register offset\n /* 0b01010 */ { 0x0a, &CDetourDis::PureCopy16 },\n /* 0b01011 */ { 0x0b, &CDetourDis::PureCopy16 },\n\n // Load/store word/byte immediate offset.\n /* 0b01100 */ { 0x0c, &CDetourDis::PureCopy16 },\n /* 0b01101 */ { 0x0d, &CDetourDis::PureCopy16 },\n /* 0b01110 */ { 0x0e, &CDetourDis::PureCopy16 },\n /* 0b01111 */ { 0x0f, &CDetourDis::PureCopy16 },\n\n // Load/store halfword immediate offset.\n /* 0b10000 */ { 0x10, &CDetourDis::PureCopy16 },\n /* 0b10001 */ { 0x11, &CDetourDis::PureCopy16 },\n\n // Load from or store to stack\n /* 0b10010 */ { 0x12, &CDetourDis::PureCopy16 },\n /* 0b10011 */ { 0x13, &CDetourDis::PureCopy16 },\n\n // Add to SP or PC\n /* 0b10100 */ { 0x14, &CDetourDis::PureCopy16 },\n // ToDo: Is ADR (T1) blitt-able?\n // It adds a value to PC and stores the result in a register.\n // Does this count as a 'target' for detours?\n /* 0b10101 */ { 0x15, &CDetourDis::PureCopy16 },\n\n // Miscellaneous\n /* 0b10110 */ { 0x16, &CDetourDis::CopyMiscellaneous16 },\n /* 0b10111 */ { 0x17, &CDetourDis::CopyMiscellaneous16 },\n\n // Load/store multiple\n /* 0b11000 */ { 0x18, &CDetourDis::PureCopy16 },\n /* 0b11001 */ { 0x19, &CDetourDis::PureCopy16 },\n // ToDo: Are we sure these are all safe?\n // LDMIA, for example, can include an 'embedded' branch.\n // Does this count as a 'target' for detours?\n\n // Conditional branch\n /* 0b11010 */ { 0x1a, &CDetourDis::CopyConditionalBranchOrOther16 },\n\n // Conditional branch\n // Undefined instruction\n // Service (system) call\n /* 0b11011 */ { 0x1b, &CDetourDis::CopyConditionalBranchOrOther16 },\n\n // Unconditional branch\n /* 0b11100 */ { 0x1c, &CDetourDis::CopyUnConditionalBranch16 },\n\n // 32-bit instruction\n /* 0b11101 */ { 0x1d, &CDetourDis::BeginCopy32 },\n /* 0b11110 */ { 0x1e, &CDetourDis::BeginCopy32 },\n /* 0b11111 */ { 0x1f, &CDetourDis::BeginCopy32 },\n { 0, NULL }\n};\n\nBYTE CDetourDis::CopyBranch24(BYTE* pSource, BYTE* pDest)\n{\n ULONG instruction = GetLongInstruction(pSource);\n BOOL fLink;\n LONG oldDelta = DecodeBranch24(instruction, fLink);\n PBYTE pTarget = CalculateTarget(pSource, oldDelta);\n m_pbTarget = pTarget;\n\n // Re-encode as 32-bit\n PUSHORT pDstInst = (PUSHORT)(pDest);\n LONG newDelta = CalculateNewDelta(pTarget, pDest);\n instruction = EncodeBranch24(instruction, newDelta, fLink);\n if (instruction) {\n // Copy both bytes of the instruction\n EmitLongInstruction(pDstInst, instruction);\n return sizeof(DWORD);\n }\n\n // If that fails, re-encode as a 'long branch'\n EmitLongBranch(pDstInst, pTarget);\n\n // Compute the extra space needed for the instruction\n m_lExtra = CalculateExtra(sizeof(DWORD), pDest, (BYTE*)(pDstInst));\n return sizeof(DWORD); // The source instruction was 32 bits\n}\n\nBYTE CDetourDis::CopyBranchOrMiscellaneous32(BYTE* pSource, BYTE* pDest)\n{\n ULONG instruction = GetLongInstruction(pSource);\n if ((instruction & 0xf800d000) == 0xf0008000) { // B.W