[
{
"path": ".gitattributes",
"content": "# Auto detect text files and perform LF normalization\n* text=auto\n"
},
{
"path": ".gitignore",
"content": "## Ignore Visual Studio temporary files, build results, and\n## files generated by popular Visual Studio add-ons.\n##\n## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore\n\n# User-specific files\n*.suo\n*.user\n*.userosscache\n*.sln.docstates\n*.DotSettings\n\n# User-specific files (MonoDevelop/Xamarin Studio)\n*.userprefs\n\n# Build results\n[Dd]ebug/\n[Dd]ebugPublic/\n[Rr]elease/\n[Rr]eleases/\nx64/\nx86/\nbld/\n[Bb]in/\n[Oo]bj/\n[Ll]og/\n\n# Visual Studio 2015/2017 cache/options directory\n.vs/\n# Uncomment if you have tasks that create the project's static files in wwwroot\n#wwwroot/\n\n# Visual Studio 2017 auto generated files\nGenerated\\ Files/\n\n# MSTest test Results\n[Tt]est[Rr]esult*/\n[Bb]uild[Ll]og.*\n\n# NUNIT\n*.VisualState.xml\nTestResult.xml\n\n# Build Results of an ATL Project\n[Dd]ebugPS/\n[Rr]eleasePS/\ndlldata.c\n\n# Benchmark Results\nBenchmarkDotNet.Artifacts/\n\n# .NET Core\nproject.lock.json\nproject.fragment.lock.json\nartifacts/\n**/Properties/launchSettings.json\n\n# StyleCop\nStyleCopReport.xml\n\n# Files built by Visual Studio\n*_i.c\n*_p.c\n*_i.h\n*.ilk\n*.meta\n*.obj\n*.iobj\n*.pch\n*.pdb\n*.ipdb\n*.pgc\n*.pgd\n*.rsp\n*.sbr\n*.tlb\n*.tli\n*.tlh\n*.tmp\n*.tmp_proj\n*.log\n*.vspscc\n*.vssscc\n.builds\n*.pidb\n*.svclog\n*.scc\n\n# Chutzpah Test files\n_Chutzpah*\n\n# Visual C++ cache files\nipch/\n*.aps\n*.ncb\n*.opendb\n*.opensdf\n*.sdf\n*.cachefile\n*.VC.db\n*.VC.VC.opendb\n\n# Visual Studio profiler\n*.psess\n*.vsp\n*.vspx\n*.sap\n\n# Visual Studio Trace Files\n*.e2e\n\n# TFS 2012 Local Workspace\n$tf/\n\n# Guidance Automation Toolkit\n*.gpState\n\n# ReSharper is a .NET coding add-in\n_ReSharper*/\n*.[Rr]e[Ss]harper\n*.DotSettings.user\n\n# JustCode is a .NET coding add-in\n.JustCode\n\n# TeamCity is a build add-in\n_TeamCity*\n\n# DotCover is a Code Coverage Tool\n*.dotCover\n\n# AxoCover is a Code Coverage Tool\n.axoCover/*\n!.axoCover/settings.json\n\n# Visual Studio code coverage results\n*.coverage\n*.coveragexml\n\n# NCrunch\n_NCrunch_*\n.*crunch*.local.xml\nnCrunchTemp_*\n\n# MightyMoose\n*.mm.*\nAutoTest.Net/\n\n# Web workbench (sass)\n.sass-cache/\n\n# Installshield output folder\n[Ee]xpress/\n\n# DocProject is a documentation generator add-in\nDocProject/buildhelp/\nDocProject/Help/*.HxT\nDocProject/Help/*.HxC\nDocProject/Help/*.hhc\nDocProject/Help/*.hhk\nDocProject/Help/*.hhp\nDocProject/Help/Html2\nDocProject/Help/html\n\n# Click-Once directory\npublish/\n\n# Publish Web Output\n*.[Pp]ublish.xml\n*.azurePubxml\n# Note: Comment the next line if you want to checkin your web deploy settings,\n# but database connection strings (with potential passwords) will be unencrypted\n*.publishproj\n\n# Microsoft Azure Web App publish settings. Comment the next line if you want to\n# checkin your Azure Web App publish settings, but sensitive information contained\n# in these scripts will be unencrypted\nPublishScripts/\n\n# NuGet Packages\n*.nupkg\n# The packages folder can be ignored because of Package Restore\n**/[Pp]ackages/*\n# except build/, which is used as an MSBuild target.\n!**/[Pp]ackages/build/\n# Uncomment if necessary however generally it will be regenerated when needed\n#!**/[Pp]ackages/repositories.config\n# NuGet v3's project.json files produces more ignorable files\n*.nuget.props\n*.nuget.targets\n\n# Microsoft Azure Build Output\ncsx/\n*.build.csdef\n\n# Microsoft Azure Emulator\necf/\nrcf/\n\n# Windows Store app package directories and files\nAppPackages/\nBundleArtifacts/\nPackage.StoreAssociation.xml\n_pkginfo.txt\n*.appx\n\n# Visual Studio cache files\n# files ending in .cache can be ignored\n*.[Cc]ache\n# but keep track of directories ending in .cache\n!*.[Cc]ache/\n\n# Others\nClientBin/\n~$*\n*~\n*.dbmdl\n*.dbproj.schemaview\n*.jfm\n*.pfx\n*.publishsettings\norleans.codegen.cs\n\n# Including strong name files can present a security risk\n# (https://github.com/github/gitignore/pull/2483#issue-259490424)\n#*.snk\n\n# Since there are multiple workflows, uncomment next line to ignore bower_components\n# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)\n#bower_components/\n\n# RIA/Silverlight projects\nGenerated_Code/\n\n# Backup & report files from converting an old project file\n# to a newer Visual Studio version. Backup files are not needed,\n# because we have git ;-)\n_UpgradeReport_Files/\nBackup*/\nUpgradeLog*.XML\nUpgradeLog*.htm\nServiceFabricBackup/\n*.rptproj.bak\n\n# SQL Server files\n*.mdf\n*.ldf\n*.ndf\n\n# Business Intelligence projects\n*.rdl.data\n*.bim.layout\n*.bim_*.settings\n*.rptproj.rsuser\n\n# Microsoft Fakes\nFakesAssemblies/\n\n# GhostDoc plugin setting file\n*.GhostDoc.xml\n\n# Node.js Tools for Visual Studio\n.ntvs_analysis.dat\nnode_modules/\n\n# Visual Studio 6 build log\n*.plg\n\n# Visual Studio 6 workspace options file\n*.opt\n\n# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)\n*.vbw\n\n# Visual Studio LightSwitch build output\n**/*.HTMLClient/GeneratedArtifacts\n**/*.DesktopClient/GeneratedArtifacts\n**/*.DesktopClient/ModelManifest.xml\n**/*.Server/GeneratedArtifacts\n**/*.Server/ModelManifest.xml\n_Pvt_Extensions\n\n# Paket dependency manager\n.paket/paket.exe\npaket-files/\n\n# FAKE - F# Make\n.fake/\n\n# JetBrains Rider\n.idea/\n*.sln.iml\n\n# CodeRush\n.cr/\n\n# Python Tools for Visual Studio (PTVS)\n__pycache__/\n*.pyc\n\n# Cake - Uncomment if you are using it\n# tools/**\n# !tools/packages.config\n\n# Tabs Studio\n*.tss\n\n# Telerik's JustMock configuration file\n*.jmconfig\n\n# BizTalk build output\n*.btp.cs\n*.btm.cs\n*.odx.cs\n*.xsd.cs\n\n# OpenCover UI analysis results\nOpenCover/\n\n# Azure Stream Analytics local run output\nASALocalRun/\n\n# MSBuild Binary and Structured Log\n*.binlog\n\n# NVidia Nsight GPU debugger configuration file\n*.nvuser\n\n# MFractors (Xamarin productivity tool) working folder\n.mfractor/\nopencoverCoverage.xml\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/BKEFileNameDumper/BKEFileNameDumper.vcxproj",
"content": "\n\n \n \n Debug\n Win32\n \n \n Release\n Win32\n \n \n \n 16.0\n Win32Proj\n {5a11c975-a301-4700-b5d2-13e027255948}\n BKEFileNameDumper\n 10.0\n \n \n \n DynamicLibrary\n true\n v143\n Unicode\n \n \n DynamicLibrary\n false\n v143\n true\n Unicode\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n false\n false\n \n \n \n Level3\n false\n _WIN32_WINNT=0x601;_WIN32;_DEBUG;BKEFILENAMEDUMPER_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)\n true\n NotUsing\n pch.h\n false\n false\n false\n AdvancedVectorExtensions2\n false\n MultiThreadedDebug\n $(SolutionDir)Common;\n stdcpp20\n \n \n Windows\n true\n false\n false\n false\n false\n false\n false\n true\n false\n /FILEALIGN:0x1000 %(AdditionalOptions)\n \n \n \n \n Level3\n true\n true\n false\n _WIN32_WINNT=0x601;WIN32;NDEBUG;BKEFILENAMEDUMPER_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)\n true\n NotUsing\n pch.h\n false\n false\n false\n AdvancedVectorExtensions2\n false\n MultiThreaded\n $(SolutionDir)Common;\n stdcpp20\n \n \n Windows\n true\n true\n false\n false\n false\n false\n false\n false\n false\n true\n false\n /FILEALIGN:0x1000 %(AdditionalOptions)\n \n \n false\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/BKEFileNameDumper/BKEFileNameDumper.vcxproj.filters",
"content": "\n\n \n \n {4FC737F1-C7A5-4376-A066-2A32D752A2FF}\n cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx\n \n \n {93995380-89BD-4b04-88EB-625FBE52EBFB}\n h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd\n \n \n {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}\n rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms\n \n \n {731d0d0e-aab8-4952-a2cc-6a31a6bb8f12}\n \n \n \n \n Common\n \n \n Common\n \n \n Common\n \n \n Common\n \n \n Common\n \n \n Common\n \n \n Common\n \n \n \n \n 源文件\n \n \n Common\n \n \n Common\n \n \n Common\n \n \n Common\n \n \n Common\n \n \n Common\n \n \n Common\n \n \n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/BKEFileNameDumper/dllmain.cpp",
"content": "#include \n#include \n#include \"log.h\"\n#include \"stringhelper.h\"\n#include \"util.h\"\n#include \"path.h\"\n#include \"file.h\"\n#include \"pe.h\"\n\n//仅仅《十二色的季节》使用了Hash\n#define BKARC_GetFileEntry_Vptr_RVA 0x29633C\nstruct StdWStringMSVC2013\n{\n union\n {\n wchar_t* LongString;\n wchar_t ShortString[8];\n } String;\n int StringLength;\n int MaxStringLength;\n\n const wchar_t* ConstString()\n {\n if (this->MaxStringLength >= 8)\n {\n return this->String.LongString;\n }\n else\n {\n return this->String.ShortString;\n }\n }\n int Length()\n {\n return this->StringLength;\n }\n};\ntypedef void* (_fastcall* tBKARC_GetFileEntry)(void*, void*, StdWStringMSVC2013*);\n\n\nstatic tBKARC_GetFileEntry g_BKARC_GetFileEntry_FuncPtr = NULL;\nstatic Log::Logger g_FileNameDumper;\n\n//Hook 封包查找函数\n__declspec(noinline)\nvoid* __fastcall HookBKARCGetFileEntry(void* thisObj, void* unusedEdx,StdWStringMSVC2013* string)\n{\n void* entry = g_BKARC_GetFileEntry_FuncPtr(thisObj, NULL, string);\n //文件存在\n if (entry) \n {\n g_FileNameDumper.Write(L\"%s\\n\", string->ConstString());\n }\n return entry;\n}\n\nvoid InstallHook() \n{\n PVOID gameBase = GetModuleHandleW(NULL);\n PVOID bkarc_GetFileEntry_Vptr_VA = (BYTE*)gameBase + BKARC_GetFileEntry_Vptr_RVA;\n\n //保存原函数指针\n g_BKARC_GetFileEntry_FuncPtr = *(tBKARC_GetFileEntry*)bkarc_GetFileEntry_Vptr_VA;\n\n //虚表Hook\n PVOID HookBKARC_GetFileEntry_FuncPtr = HookBKARCGetFileEntry;\n PE::WriteMemory(bkarc_GetFileEntry_Vptr_VA, &HookBKARC_GetFileEntry_FuncPtr, sizeof(PVOID));\n}\n\nvoid Initialize() \n{\n std::wstring gameDirectory = Util::GetAppDirectoryW();\n std::wstring fileNameOutPath = gameDirectory + L\"\\\\FileName.lst\";\n\n File::Delete(fileNameOutPath);\n\n g_FileNameDumper.Open(fileNameOutPath.c_str());\n\n InstallHook();\n}\n\nvoid ShutDown() \n{\n g_FileNameDumper.Close();\n}\n\nBOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)\n{\n switch (ul_reason_for_call)\n {\n case DLL_PROCESS_ATTACH:\n {\n Initialize();\n break;\n }\n case DLL_THREAD_ATTACH:\n case DLL_THREAD_DETACH:\n break;\n case DLL_PROCESS_DETACH:\n {\n ShutDown();\n break;\n }\n }\n return TRUE;\n}\n\n\nextern \"C\" __declspec(dllexport) void Dummy() {}\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/BKEFileNameDumper.sln",
"content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 17\nVisualStudioVersion = 17.4.33403.182\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"BKEFileNameDumper\", \"BKEFileNameDumper\\BKEFileNameDumper.vcxproj\", \"{5A11C975-A301-4700-B5D2-13E027255948}\"\nEndProject\nProject(\"{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}\") = \"Loader\", \"Loader\\Loader.vcxproj\", \"{1514DC6A-FF75-4B71-8565-9A721C6B07E4}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|x86 = Debug|x86\n\t\tRelease|x86 = Release|x86\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{5A11C975-A301-4700-B5D2-13E027255948}.Debug|x86.ActiveCfg = Debug|Win32\n\t\t{5A11C975-A301-4700-B5D2-13E027255948}.Debug|x86.Build.0 = Debug|Win32\n\t\t{5A11C975-A301-4700-B5D2-13E027255948}.Release|x86.ActiveCfg = Release|Win32\n\t\t{5A11C975-A301-4700-B5D2-13E027255948}.Release|x86.Build.0 = Release|Win32\n\t\t{1514DC6A-FF75-4B71-8565-9A721C6B07E4}.Debug|x86.ActiveCfg = Debug|Win32\n\t\t{1514DC6A-FF75-4B71-8565-9A721C6B07E4}.Debug|x86.Build.0 = Debug|Win32\n\t\t{1514DC6A-FF75-4B71-8565-9A721C6B07E4}.Release|x86.ActiveCfg = Release|Win32\n\t\t{1514DC6A-FF75-4B71-8565-9A721C6B07E4}.Release|x86.Build.0 = Release|Win32\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {54E8DE13-1F44-4EA1-AB87-ED4B26B886BE}\n\tEndGlobalSection\nEndGlobal\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Common/encoding.cpp",
"content": "// encoding.cpp\n\n#include \n#include \"encoding.h\"\n\n#undef max\n\nnamespace Encoding\n{\n\tstd::wstring AnsiToUnicode(const std::string& source, int codePage)\n\t{\n\t\tif (source.length() == 0)\n\t\t{\n\t\t\treturn std::wstring();\n\t\t}\n\n\t\tif (source.length() > (size_t)std::numeric_limits::max())\n\t\t{\n\t\t\treturn std::wstring();\n\t\t}\n\n\t\tint length = MultiByteToWideChar(codePage, 0, source.c_str(), (int)source.length(), NULL, 0);\n\n\t\tif (length <= 0)\n\t\t{\n\t\t\treturn std::wstring();\n\t\t}\n\n\t\tstd::wstring output(length, L'\\0');\n\n\t\tif (MultiByteToWideChar(codePage, 0, source.c_str(), (int)source.length(), (LPWSTR)output.data(), (int)output.length() + 1) == 0)\n\t\t{\n\t\t\treturn std::wstring();\n\t\t}\n\n\t\treturn output;\n\t}\n\n\tstd::string UnicodeToAnsi(const std::wstring& source, int codePage)\n\t{\n\t\tif (source.length() == 0)\n\t\t{\n\t\t\treturn std::string();\n\t\t}\n\n\t\tif (source.length() > (size_t)std::numeric_limits::max())\n\t\t{\n\t\t\treturn std::string();\n\t\t}\n\n\t\tint length = WideCharToMultiByte(codePage, 0, source.c_str(), (int)source.length(), NULL, 0, NULL, NULL);\n\n\t\tif (length <= 0)\n\t\t{\n\t\t\treturn std::string();\n\t\t}\n\n\t\tstd::string output(length, '\\0');\n\n\t\tif (WideCharToMultiByte(codePage, 0, source.c_str(), (int)source.length(), (LPSTR)output.data(), (int)output.length() + 1, NULL, NULL) == 0)\n\t\t{\n\t\t\treturn std::string();\n\t\t}\n\n\t\treturn output;\n\t}\n}\n\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Common/encoding.h",
"content": "// encoding.h\n\n#pragma once\n\n#include \n\nnamespace Encoding\n{\n\tenum CodePage\n\t{\n\t\tACP = 0,\n\t\tUTF_8 = 65001,\n\t\tSHIFT_JIS = 932,\n\t\tGBK = 936,\n\t};\n\n\tstd::wstring AnsiToUnicode(const std::string& source, int codePage);\n\tstd::string UnicodeToAnsi(const std::wstring& source, int codePage);\n}\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Common/file.cpp",
"content": "// file.cpp\n\n#include \n#include \n#include \n#include \n\n\nnamespace File\n{\n\tstd::string ReadAllText(const std::string& path)\n\t{\n\t\tFILE* fp;\n\t\tlong long size;\n\t\tsize_t length;\n\t\tunsigned char buf[3];\n\t\tbool utf8bom;\n\t\tstd::string output;\n\n\t\tif (fopen_s(&fp, path.c_str(), \"rb\") != 0)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tif (_fseeki64(fp, 0, SEEK_END) != 0)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tsize = _ftelli64(fp);\n\n\t\tif (size <= 0)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tif (static_cast(size) > std::numeric_limits::max())\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tif (_fseeki64(fp, 0, SEEK_SET) != 0)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tlength = static_cast(size);\n\n\t\t// Check UTF-8 BOM\n\n\t\tutf8bom = false;\n\n\t\tif (fread(buf, 3, 1, fp) == 1)\n\t\t{\n\t\t\tif (buf[0] == 0xEF && buf[1] == 0xBB && buf[2] == 0xBF)\n\t\t\t{\n\t\t\t\tutf8bom = true;\n\t\t\t}\n\t\t}\n\n\t\tif (utf8bom)\n\t\t{\n\t\t\tlength -= 3;\n\t\t}\n\t\telse\n\t\t{\n\t\t\tif (_fseeki64(fp, 0, SEEK_SET) != 0)\n\t\t\t{\n\t\t\t\tgoto error;\n\t\t\t}\n\t\t}\n\n\t\tif (length == 0)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\toutput.resize(length);\n\n\t\tif (fread(output.data(), length, 1, fp) != 1)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tfclose(fp);\n\n\t\treturn output;\n\n\terror:\n\t\tif (fp)\n\t\t{\n\t\t\tfclose(fp);\n\t\t}\n\n\t\treturn std::string();\n\t}\n\n\tstd::string ReadAllText(const std::wstring& path)\n\t{\n\t\tFILE* fp;\n\t\tlong long size;\n\t\tsize_t length;\n\t\tunsigned char buf[3];\n\t\tbool utf8bom;\n\t\tstd::string output;\n\n\t\tif (_wfopen_s(&fp, path.c_str(), L\"rb\") != 0)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tif (fp == nullptr)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tif (_fseeki64(fp, 0, SEEK_END) != 0)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tsize = _ftelli64(fp);\n\n\t\tif (size <= 0)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tif (static_cast(size) > std::numeric_limits::max())\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tif (_fseeki64(fp, 0, SEEK_SET) != 0)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tlength = static_cast(size);\n\n\t\t// Check UTF-8 BOM\n\n\t\tutf8bom = false;\n\n\t\tif (fread(buf, 3, 1, fp) == 1)\n\t\t{\n\t\t\tif (buf[0] == 0xEF && buf[1] == 0xBB && buf[2] == 0xBF)\n\t\t\t{\n\t\t\t\tutf8bom = true;\n\t\t\t}\n\t\t}\n\n\t\tif (utf8bom)\n\t\t{\n\t\t\tlength -= 3;\n\t\t}\n\t\telse\n\t\t{\n\t\t\tif (_fseeki64(fp, 0, SEEK_SET) != 0)\n\t\t\t{\n\t\t\t\tgoto error;\n\t\t\t}\n\t\t}\n\n\t\tif (length == 0)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\toutput.resize(length);\n\n\t\tif (fread(output.data(), length, 1, fp) != 1)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tfclose(fp);\n\n\t\treturn output;\n\n\terror:\n\t\tif (fp)\n\t\t{\n\t\t\tfclose(fp);\n\t\t}\n\n\t\treturn std::string();\n\t}\n\n\tbool WriteAllBytes(const std::string& path, const void* buffer, size_t size)\n\t{\n\t\tFILE* fp;\n\n\t\tif (fopen_s(&fp, path.c_str(), \"wb\") != 0)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tif (buffer == nullptr)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tif (size == 0)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tif (fwrite(buffer, size, 1, fp) != 1)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tfflush(fp);\n\n\t\tfclose(fp);\n\n\t\treturn true;\n\n\terror:\n\t\tif (fp)\n\t\t{\n\t\t\tfclose(fp);\n\t\t}\n\n\t\treturn false;\n\t}\n\n\tbool WriteAllBytes(const std::wstring& path, const void* buffer, size_t size)\n\t{\n\t\tFILE* fp;\n\n\t\tif (_wfopen_s(&fp, path.c_str(), L\"wb\") != 0)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tif (fp == nullptr)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tif (buffer == nullptr)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tif (size == 0)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tif (fwrite(buffer, size, 1, fp) != 1)\n\t\t{\n\t\t\tgoto error;\n\t\t}\n\n\t\tfflush(fp);\n\n\t\tfclose(fp);\n\n\t\treturn true;\n\n\terror:\n\t\tif (fp)\n\t\t{\n\t\t\tfclose(fp);\n\t\t}\n\n\t\treturn false;\n\t}\n\n\tvoid Delete(const std::string& path)\n\t{\n\t\tremove(path.c_str());\n\t}\n\n\tvoid Delete(const std::wstring& path)\n\t{\n\t\t_wremove(path.c_str());\n\t}\n}\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Common/file.h",
"content": "// file.h\n\n#pragma once\n\n#include \n\nnamespace File\n{\n\tstd::string ReadAllText(const std::string& path);\n\tstd::string ReadAllText(const std::wstring& path);\n\tbool WriteAllBytes(const std::string& path, const void* buffer, size_t size);\n\tbool WriteAllBytes(const std::wstring& path, const void* buffer, size_t size);\n\tvoid Delete(const std::string& path);\n\tvoid Delete(const std::wstring& path);\n}\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Common/log.cpp",
"content": "// log.cpp\n\n#include \n#include \n#include \"log.h\"\n#include \"stringhelper.h\"\n#include \"encoding.h\"\n\n\nnamespace Log\n{\n\tLogger::Logger() : m_pOutput{}\n\t{\n\t}\n\n\tLogger::Logger(const wchar_t* lpFileName)\n\t\t: m_pOutput{}\n\t{\n\t\tOpen(lpFileName);\n\t}\n\n\tLogger::~Logger()\n\t{\n\t\tClose();\n\t}\n\n\tvoid Logger::Open(const wchar_t* lpFileName)\n\t{\n\t\tm_pOutput = _wfsopen(lpFileName, L\"at\", _SH_DENYWR);\n\t}\n\n\tvoid Logger::Close()\n\t{\n\t\tFlush();\n\n\t\tif (m_pOutput)\n\t\t{\n\t\t\tfclose(m_pOutput);\n\t\t\tm_pOutput = nullptr;\n\t\t}\n\t}\n\n\tvoid Logger::Flush()\n\t{\n\t\tif (m_pOutput)\n\t\t{\n\t\t\tfflush(m_pOutput);\n\t\t}\n\t}\n\n\tstatic std::string GetTimeString()\n\t{\n\t\ttime_t tv;\n\t\tstruct tm tm;\n\t\tchar buf[32];\n\n\t\ttime(&tv);\n\t\tlocaltime_s(&tm, &tv);\n\t\tstrftime(buf, sizeof(buf), \"%Y-%m-%d %H:%M:%S\", &tm);\n\n\t\treturn std::string(buf);\n\t}\n\n\tvoid Logger::WriteAnsi(int iCodePage, const char* lpFormat, ...)\n\t{\n\t\tif (!m_pOutput)\n\t\t{\n\t\t\treturn;\n\t\t}\n\n\t\tva_list ap;\n\n\t\tva_start(ap, lpFormat);\n\t\tauto content = StringHelper::VFormat(lpFormat, ap);\n\t\tva_end(ap);\n\n\t\tauto unicode = Encoding::AnsiToUnicode(content, iCodePage);\n\t\tauto output = Encoding::UnicodeToAnsi(unicode, Encoding::CodePage::UTF_8);\n\n\t\tfwrite(output.data(), output.length(), 1, m_pOutput);\n\t\tfflush(m_pOutput);\n\t}\n\n\tvoid Logger::WriteLineAnsi(int iCodePage, const char* lpFormat, ...)\n\t{\n\t\tif (!m_pOutput)\n\t\t{\n\t\t\treturn;\n\t\t}\n\n\t\tva_list ap;\n\n\t\tva_start(ap, lpFormat);\n\t\tauto content = StringHelper::VFormat(lpFormat, ap);\n\t\tva_end(ap);\n\n\t\tauto unicode = Encoding::AnsiToUnicode(content, iCodePage);\n\t\tauto utf = Encoding::UnicodeToAnsi(unicode, Encoding::CodePage::UTF_8);\n\t\tauto timestamp = GetTimeString();\n\n\t\tauto output = timestamp + \" | \" + utf + \"\\n\";\n\n\t\tfwrite(output.data(), output.length(), 1, m_pOutput);\n\t\tfflush(m_pOutput);\n\t}\n\n\tvoid Logger::Write(const wchar_t* lpFormat, ...)\n\t{\n\t\tif (!m_pOutput)\n\t\t{\n\t\t\treturn;\n\t\t}\n\n\t\tva_list ap;\n\n\t\tva_start(ap, lpFormat);\n\t\tauto content = StringHelper::VFormat(lpFormat, ap);\n\t\tva_end(ap);\n\n\t\tauto output = Encoding::UnicodeToAnsi(content, Encoding::CodePage::UTF_8);\n\n\t\tfwrite(output.data(), output.length(), 1, m_pOutput);\n\t\tfflush(m_pOutput);\n\t}\n\n\tvoid Logger::WriteLine(const wchar_t* lpFormat, ...)\n\t{\n\t\tif (!m_pOutput)\n\t\t{\n\t\t\treturn;\n\t\t}\n\n\t\tva_list ap;\n\n\t\tva_start(ap, lpFormat);\n\t\tauto content = StringHelper::VFormat(lpFormat, ap);\n\t\tva_end(ap);\n\n\t\tauto utf = Encoding::UnicodeToAnsi(content, Encoding::CodePage::UTF_8);\n\t\tauto timestamp = GetTimeString();\n\n\t\tauto output = timestamp + \" | \" + utf + \"\\n\";\n\n\t\tfwrite(output.data(), output.length(), 1, m_pOutput);\n\t\tfflush(m_pOutput);\n\t}\n}\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Common/log.h",
"content": "// log.h\n\n#pragma once\n\n#include \n\nnamespace Log\n{\n\tclass Logger\n\t{\n\tpublic:\n\t\tLogger();\n\t\tLogger(const wchar_t* lpFileName);\n\t\t~Logger();\n\n\t\tLogger(const Logger&) = delete;\n\t\tLogger& operator=(const Logger&) = delete;\n\n\t\tvoid Open(const wchar_t* lpFileName);\n\t\tvoid Close();\n\t\tvoid Flush();\n\n\t\tvoid WriteAnsi(int iCodePage, const char* lpFormat, ...);\n\t\tvoid WriteLineAnsi(int iCodePage, const char* lpFormat, ...);\n\t\tvoid Write(const wchar_t* lpFormat, ...);\n\t\tvoid WriteLine(const wchar_t* lpFormat, ...);\n\n\tprivate:\n\t\tFILE* m_pOutput;\n\t};\n}\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Common/path.cpp",
"content": "// path.cpp\n\n#include \n#include \n\nnamespace Path\n{\n\tstd::string GetFileName(const std::string& path)\n\t{\n\t\tsize_t pos;\n\n\t\tpos = path.find_last_of('\\\\');\n\n\t\tif (pos != std::string::npos)\n\t\t{\n\t\t\treturn path.substr(pos + 1);\n\t\t}\n\n\t\tpos = path.find_last_of('/');\n\n\t\tif (pos != std::string::npos)\n\t\t{\n\t\t\treturn path.substr(pos + 1);\n\t\t}\n\n\t\treturn path;\n\t}\n\n\tstd::wstring GetFileName(const std::wstring& path)\n\t{\n\t\tsize_t pos;\n\n\t\tpos = path.find_last_of(L'\\\\');\n\n\t\tif (pos != std::wstring::npos)\n\t\t{\n\t\t\treturn path.substr(pos + 1);\n\t\t}\n\n\t\tpos = path.find_last_of(L'/');\n\n\t\tif (pos != std::wstring::npos)\n\t\t{\n\t\t\treturn path.substr(pos + 1);\n\t\t}\n\n\t\treturn path;\n\t}\n\n\tstd::string GetFileNameWithoutExtension(const std::string& path)\n\t{\n\t\tstd::string name = GetFileName(path);\n\n\t\tsize_t pos = name.find_last_of('.');\n\n\t\tif (pos != std::string::npos && pos > 0)\n\t\t{\n\t\t\treturn name.substr(0, pos);\n\t\t}\n\n\t\treturn name;\n\t}\n\n\tstd::wstring GetFileNameWithoutExtension(const std::wstring& path)\n\t{\n\t\tstd::wstring name = GetFileName(path);\n\n\t\tsize_t pos = name.find_last_of(L'.');\n\n\t\tif (pos != std::wstring::npos && pos > 0)\n\t\t{\n\t\t\treturn name.substr(0, pos);\n\t\t}\n\n\t\treturn name;\n\t}\n\n\tstd::string GetDirectoryName(const std::string& path)\n\t{\n\t\tsize_t pos;\n\n\t\tpos = path.find_last_of('\\\\');\n\n\t\tif (pos != std::string::npos && pos > 0)\n\t\t{\n\t\t\treturn path.substr(0, pos);\n\t\t}\n\n\t\tpos = path.find_last_of('/');\n\n\t\tif (pos != std::string::npos && pos > 0)\n\t\t{\n\t\t\treturn path.substr(0, pos);\n\t\t}\n\n\t\treturn std::string();\n\t}\n\n\tstd::wstring GetDirectoryName(const std::wstring& path)\n\t{\n\t\tsize_t pos;\n\n\t\tpos = path.find_last_of(L'\\\\');\n\n\t\tif (pos != std::wstring::npos && pos > 0)\n\t\t{\n\t\t\treturn path.substr(0, pos);\n\t\t}\n\n\t\tpos = path.find_last_of(L'/');\n\n\t\tif (pos != std::wstring::npos && pos > 0)\n\t\t{\n\t\t\treturn path.substr(0, pos);\n\t\t}\n\n\t\treturn std::wstring();\n\t}\n\n\tstd::string GetExtension(const std::string& path)\n\t{\n\t\tint length = static_cast(path.length());\n\n\t\tfor (int i = length - 1; i >= 0; i--)\n\t\t{\n\t\t\tchar ch = path[i];\n\n\t\t\tif (ch == '.')\n\t\t\t{\n\t\t\t\tif (i != length - 1)\n\t\t\t\t{\n\t\t\t\t\treturn path.substr(i, length - i);\n\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\treturn std::string();\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (ch == '\\\\' || ch == '/')\n\t\t\t{\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\n\t\treturn std::string();\n\t}\n\n\tstd::wstring GetExtension(const std::wstring& path)\n\t{\n\t\tint length = static_cast(path.length());\n\n\t\tfor (int i = length - 1; i >= 0; i--)\n\t\t{\n\t\t\twchar_t ch = path[i];\n\n\t\t\tif (ch == '.')\n\t\t\t{\n\t\t\t\tif (i != length - 1)\n\t\t\t\t{\n\t\t\t\t\treturn path.substr(i, length - i);\n\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t{\n\t\t\t\t\treturn std::wstring();\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (ch == L'\\\\' || ch == L'/')\n\t\t\t{\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\n\t\treturn std::wstring();\n\t}\n\n\tstd::string ChangeExtension(const std::string& path, const std::string& ext)\n\t{\n\t\tint length = static_cast(path.length());\n\n\t\tif (length == 0)\n\t\t{\n\t\t\treturn std::string();\n\t\t}\n\n\t\tint subLength = static_cast(path.length());\n\n\t\tfor (int i = length - 1; i >= 0; i--)\n\t\t{\n\t\t\tchar ch = path[i];\n\n\t\t\tif (ch == '.')\n\t\t\t{\n\t\t\t\tsubLength = i;\n\t\t\t\tbreak;\n\t\t\t}\n\n\t\t\tif (ch == '\\\\' || ch == '/')\n\t\t\t{\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\n\t\tstd::string subPath = path.substr(0, subLength);\n\n\t\tif (ext.length() == 0)\n\t\t{\n\t\t\treturn subPath;\n\t\t}\n\n\t\tif (ext.front() != '.')\n\t\t{\n\t\t\treturn subPath + \".\" + ext;\n\t\t}\n\t\telse\n\t\t{\n\t\t\treturn subPath + ext;\n\t\t}\n\t}\n\n\tstd::wstring ChangeExtension(const std::wstring& path, const std::wstring& ext)\n\t{\n\t\tint length = static_cast(path.length());\n\n\t\tif (length == 0)\n\t\t{\n\t\t\treturn std::wstring();\n\t\t}\n\n\t\tint subLength = static_cast(path.length());\n\n\t\tfor (int i = length - 1; i >= 0; i--)\n\t\t{\n\t\t\twchar_t ch = path[i];\n\n\t\t\tif (ch == L'.')\n\t\t\t{\n\t\t\t\tsubLength = i;\n\t\t\t\tbreak;\n\t\t\t}\n\n\t\t\tif (ch == L'\\\\' || ch == L'/')\n\t\t\t{\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\n\t\tstd::wstring subPath = path.substr(0, subLength);\n\n\t\tif (ext.length() == 0)\n\t\t{\n\t\t\treturn subPath;\n\t\t}\n\n\t\tif (ext.front() != L'.')\n\t\t{\n\t\t\treturn subPath + L'.' + ext;\n\t\t}\n\t\telse\n\t\t{\n\t\t\treturn subPath + ext;\n\t\t}\n\t}\n\n\tstd::string GetFullPath(const std::string& path)\n\t{\n\t\tDWORD dwBufferSize = MAX_PATH;\n\n\t\tstd::string output;\n\n\t\twhile (dwBufferSize < USHRT_MAX)\n\t\t{\n\t\t\toutput.resize(dwBufferSize);\n\n\t\t\tDWORD nSize = GetFullPathNameA(path.c_str(), dwBufferSize, const_cast(output.data()), NULL);\n\n\t\t\tif (nSize == 0)\n\t\t\t{\n\t\t\t\treturn std::string();\n\t\t\t}\n\n\t\t\tif (nSize < dwBufferSize)\n\t\t\t{\n\t\t\t\treturn output.substr(0, nSize);\n\t\t\t}\n\t\t\telse\n\t\t\t{\n\t\t\t\tdwBufferSize *= 2;\n\t\t\t}\n\t\t}\n\n\t\treturn std::string();\n\t}\n\n\tstd::wstring GetFullPath(const std::wstring& path)\n\t{\n\t\tDWORD dwBufferSize = MAX_PATH;\n\n\t\tstd::wstring output;\n\n\t\twhile (dwBufferSize < USHRT_MAX)\n\t\t{\n\t\t\toutput.resize(dwBufferSize);\n\n\t\t\tDWORD nSize = GetFullPathNameW(path.c_str(), dwBufferSize, const_cast(output.data()), NULL);\n\n\t\t\tif (nSize == 0)\n\t\t\t{\n\t\t\t\treturn std::wstring();\n\t\t\t}\n\n\t\t\tif (nSize < dwBufferSize)\n\t\t\t{\n\t\t\t\treturn output.substr(0, nSize);\n\t\t\t}\n\t\t\telse\n\t\t\t{\n\t\t\t\tdwBufferSize *= 2;\n\t\t\t}\n\t\t}\n\n\t\treturn std::wstring();\n\t}\n}\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Common/path.h",
"content": "// path.h\n\n#pragma once\n\n#include \n\nnamespace Path\n{\n\tstd::string GetFileName(const std::string& path);\n\tstd::wstring GetFileName(const std::wstring& path);\n\tstd::string GetFileNameWithoutExtension(const std::string& path);\n\tstd::wstring GetFileNameWithoutExtension(const std::wstring& path);\n\tstd::string GetDirectoryName(const std::string& path);\n\tstd::wstring GetDirectoryName(const std::wstring& path);\n\tstd::string GetExtension(const std::string& path);\n\tstd::wstring GetExtension(const std::wstring& path);\n\tstd::string ChangeExtension(const std::string& path, const std::string& ext);\n\tstd::wstring ChangeExtension(const std::wstring& path, const std::wstring& ext);\n\tstd::string GetFullPath(const std::string& path);\n\tstd::wstring GetFullPath(const std::wstring& path);\n}\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Common/pe.cpp",
"content": "// pe.cpp\n\n#include \"pe.h\"\n\nnamespace PE\n{\n\tPVOID GetModuleBase(HMODULE hModule)\n\t{\n\t\tMEMORY_BASIC_INFORMATION mem;\n\n\t\tif (!VirtualQuery(hModule, &mem, sizeof(mem)))\n\t\t\treturn 0;\n\n\t\treturn mem.AllocationBase;\n\t}\n\n\tDWORD GetModuleSize(HMODULE hModule)\n\t{\n\t\treturn ((PIMAGE_NT_HEADERS)((ULONG_PTR)hModule + ((PIMAGE_DOS_HEADER)hModule)->e_lfanew))->OptionalHeader.SizeOfImage;\n\t}\n\n\tPIMAGE_SECTION_HEADER GetSectionHeader(HMODULE hModule, PCSTR lpName)\n\t{\n\t\tPIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hModule;\n\n\t\tif (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)\n\t\t\treturn NULL;\n\n\t\tPIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader + pDosHeader->e_lfanew);\n\n\t\tif (pNtHeader->Signature != IMAGE_NT_SIGNATURE)\n\t\t\treturn NULL;\n\n\t\tif (pNtHeader->FileHeader.SizeOfOptionalHeader == 0)\n\t\t\treturn NULL;\n\n\t\tPIMAGE_SECTION_HEADER pSectionHeaders = (PIMAGE_SECTION_HEADER)((PBYTE)pNtHeader + sizeof(pNtHeader->Signature) + sizeof(pNtHeader->FileHeader) + pNtHeader->FileHeader.SizeOfOptionalHeader);\n\n\t\tfor (DWORD n = 0; n < pNtHeader->FileHeader.NumberOfSections; n++)\n\t\t{\n\t\t\tif (strcmp((PCSTR)pSectionHeaders[n].Name, lpName) == 0)\n\t\t\t{\n\t\t\t\tif (pSectionHeaders[n].VirtualAddress == 0 || pSectionHeaders[n].SizeOfRawData == 0)\n\t\t\t\t\treturn NULL;\n\n\t\t\t\treturn &pSectionHeaders[n];\n\t\t\t}\n\t\t}\n\n\t\treturn NULL;\n\t}\n\n\tstatic inline PBYTE RvaAdjust(PIMAGE_DOS_HEADER pDosHeader, DWORD raddr)\n\t{\n\t\tif (raddr != NULL)\n\t\t{\n\t\t\treturn ((PBYTE)pDosHeader) + raddr;\n\t\t}\n\n\t\treturn NULL;\n\t}\n\n\tPVOID GetImportAddress(HMODULE hModule, LPCSTR lpModuleName, LPCSTR lpProcName)\n\t{\n\t\tPIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hModule;\n\n\t\tif (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE)\n\t\t\treturn NULL;\n\n\t\tPIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader + pDosHeader->e_lfanew);\n\n\t\tif (pNtHeader->Signature != IMAGE_NT_SIGNATURE)\n\t\t\treturn NULL;\n\n\t\tif (pNtHeader->FileHeader.SizeOfOptionalHeader == 0)\n\t\t\treturn NULL;\n\n\t\tPIMAGE_IMPORT_DESCRIPTOR iidp = (PIMAGE_IMPORT_DESCRIPTOR)RvaAdjust(pDosHeader, pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);\n\n\t\tif (iidp == NULL)\n\t\t\treturn NULL;\n\n\t\tfor (; iidp->OriginalFirstThunk != 0; iidp++)\n\t\t{\n\t\t\tLPCSTR lpszModule = (LPCSTR)RvaAdjust(pDosHeader, iidp->Name);\n\n\t\t\tif (lpszModule == NULL)\n\t\t\t\treturn NULL;\n\n\t\t\tif (_stricmp(lpszModule, lpModuleName) != 0)\n\t\t\t\tcontinue;\n\n\t\t\tPIMAGE_THUNK_DATA pThunks = (PIMAGE_THUNK_DATA)RvaAdjust(pDosHeader, iidp->OriginalFirstThunk);\n\n\t\t\tPVOID* pAddrs = (PVOID*)RvaAdjust(pDosHeader, iidp->FirstThunk);\n\n\t\t\tif (pThunks == NULL)\n\t\t\t\tcontinue;\n\n\t\t\tfor (DWORD i = 0; pThunks[i].u1.Ordinal; i++)\n\t\t\t{\n\t\t\t\tif (IMAGE_SNAP_BY_ORDINAL(pThunks[i].u1.Ordinal))\n\t\t\t\t\tcontinue;\n\n\t\t\t\tLPCSTR lpszProc = (PCSTR)RvaAdjust(pDosHeader, (DWORD)pThunks[i].u1.AddressOfData + 2);\n\n\t\t\t\tif (lpszProc == NULL)\n\t\t\t\t\tcontinue;\n\n\t\t\t\tif (strcmp(lpszProc, lpProcName) == 0)\n\t\t\t\t\treturn &pAddrs[i];\n\t\t\t}\n\t\t}\n\n\t\treturn NULL;\n\t}\n\n\tPVOID SearchPattern(PVOID lpStartSearch, DWORD dwSearchLen, const char* lpPattern, DWORD dwPatternLen)\n\t{\n\t\tULONG_PTR dwStartAddr = (ULONG_PTR)lpStartSearch;\n\t\tULONG_PTR dwEndAddr = dwStartAddr + dwSearchLen - dwPatternLen;\n\n\t\twhile (dwStartAddr < dwEndAddr)\n\t\t{\n\t\t\tbool found = true;\n\n\t\t\tfor (DWORD i = 0; i < dwPatternLen; i++)\n\t\t\t{\n\t\t\t\tchar code = *(char*)(dwStartAddr + i);\n\n\t\t\t\tif (lpPattern[i] != 0x2A && lpPattern[i] != code)\n\t\t\t\t{\n\t\t\t\t\tfound = false;\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (found)\n\t\t\t\treturn (PVOID)dwStartAddr;\n\n\t\t\tdwStartAddr++;\n\t\t}\n\n\t\treturn 0;\n\t}\n\n\tBOOL WriteMemory(PVOID lpAddress, PVOID lpBuffer, DWORD nSize)\n\t{\n\t\tDWORD dwProtect;\n\n\t\tif (VirtualProtect(lpAddress, nSize, PAGE_EXECUTE_READWRITE, &dwProtect))\n\t\t{\n\t\t\tmemcpy(lpAddress, lpBuffer, nSize);\n\t\t\tVirtualProtect(lpAddress, nSize, dwProtect, &dwProtect);\n\t\t\treturn TRUE;\n\t\t}\n\n\t\treturn FALSE;\n\t}\n\n\tBOOL IATHook(HMODULE hModule, LPCSTR lpModuleName, LPCSTR lpProcName, PVOID lpNewProc, PVOID* lpOriginalProc)\n\t{\n\t\tPVOID lpAddress = GetImportAddress(hModule, lpModuleName, lpProcName);\n\n\t\tif (lpAddress == NULL)\n\t\t{\n\t\t\treturn FALSE;\n\t\t}\n\n\t\tif (lpOriginalProc)\n\t\t{\n\t\t\t*lpOriginalProc = *(PVOID*)lpAddress;\n\t\t}\n\n\t\treturn WriteValue(lpAddress, lpNewProc);\n\t}\n}\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Common/pe.h",
"content": "// pe.h\n\n#pragma once\n\n#include \n#include \n\nnamespace PE\n{\n\t// Get the base address of the specified module.\n\tPVOID GetModuleBase(HMODULE hModule);\n\n\t// Get the size of the specified module.\n\tDWORD GetModuleSize(HMODULE hModule);\n\n\t// Get the section with the specified name.\n\tPIMAGE_SECTION_HEADER GetSectionHeader(HMODULE hModule, PCSTR lpName);\n\n\t// Get the address of the imported function in the import table.\n\tPVOID GetImportAddress(HMODULE hModule, LPCSTR lpModuleName, LPCSTR lpProcName);\n\n\t// Searche memory for the specified pattern.\n\tPVOID SearchPattern(PVOID lpStartSearch, DWORD dwSearchLen, const char* lpPattern, DWORD dwPatternLen);\n\n\t// Write data to the specified address.\n\tBOOL WriteMemory(PVOID lpAddress, PVOID lpBuffer, DWORD nSize);\n\n\t// Writes a scalar value to the specified address.\n\t// If you pass a pointer, the value of that pointer is written.\n\ttemplate, bool> = true>\n\tBOOL WriteValue(PVOID lpAddress, T tValue)\n\t{\n\t\treturn WriteMemory(lpAddress, &tValue, sizeof(T));\n\t}\n\n\t// Replace imported function in the import table.\n\tBOOL IATHook(HMODULE hModule, LPCSTR lpModuleName, LPCSTR lpProcName, PVOID lpNewProc, PVOID* lpOriginalProc);\n}\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Common/stringhelper.cpp",
"content": "// stringhelper.cpp\n\n#include \n#include \n#include \n\nnamespace StringHelper\n{\n\tbool StartsWith(const char* source, const char* sub)\n\t{\n\t\tstd::string_view vsource(source);\n\t\tstd::string_view vsub(sub);\n\n\t\tif (vsource.length() == 0 || vsub.length() == 0 || vsource.length() < vsub.length())\n\t\t{\n\t\t\treturn false;\n\t\t}\n\n\t\treturn vsource.compare(0, vsub.length(), sub) == 0;\n\t}\n\n\tbool StartsWith(const wchar_t* source, const wchar_t* sub)\n\t{\n\t\tstd::wstring_view vsource(source);\n\t\tstd::wstring_view vsub(sub);\n\n\t\tif (vsource.length() == 0 || vsub.length() == 0 || vsource.length() < vsub.length())\n\t\t{\n\t\t\treturn false;\n\t\t}\n\n\t\treturn vsource.compare(0, vsub.length(), sub) == 0;\n\t}\n\n\tbool StartsWith(const std::string& source, const std::string& sub)\n\t{\n\t\tif (source.length() == 0 || sub.length() == 0 || source.length() < sub.length())\n\t\t{\n\t\t\treturn false;\n\t\t}\n\n\t\treturn source.compare(0, sub.length(), sub) == 0;\n\t}\n\n\tbool StartsWith(const std::wstring& source, const std::wstring& sub)\n\t{\n\t\tif (source.length() == 0 || sub.length() == 0 || source.length() < sub.length())\n\t\t{\n\t\t\treturn false;\n\t\t}\n\n\t\treturn source.compare(0, sub.length(), sub) == 0;\n\t}\n\n\tbool EndsWith(const char* source, const char* sub)\n\t{\n\t\tstd::string_view vsource(source);\n\t\tstd::string_view vsub(sub);\n\n\t\tif (vsource.length() == 0 || vsub.length() == 0 || vsource.length() < vsub.length())\n\t\t{\n\t\t\treturn false;\n\t\t}\n\n\t\treturn vsource.compare(vsource.length() - vsub.length(), vsub.length(), sub) == 0;\n\t}\n\n\tbool EndsWith(const wchar_t* source, const wchar_t* sub)\n\t{\n\t\tstd::wstring_view vsource(source);\n\t\tstd::wstring_view vsub(sub);\n\n\t\tif (vsource.length() == 0 || vsub.length() == 0 || vsource.length() < vsub.length())\n\t\t{\n\t\t\treturn false;\n\t\t}\n\n\t\treturn vsource.compare(vsource.length() - vsub.length(), vsub.length(), sub) == 0;\n\t}\n\n\tbool EndsWith(const std::string& source, const std::string& sub)\n\t{\n\t\tif (source.length() == 0 || sub.length() == 0 || source.length() < sub.length())\n\t\t{\n\t\t\treturn false;\n\t\t}\n\n\t\treturn source.compare(source.length() - sub.length(), sub.length(), sub) == 0;\n\t}\n\n\tbool EndsWith(const std::wstring& source, const std::wstring& sub)\n\t{\n\t\tif (source.length() == 0 || sub.length() == 0 || source.length() < sub.length())\n\t\t{\n\t\t\treturn false;\n\t\t}\n\n\t\treturn source.compare(source.length() - sub.length(), sub.length(), sub) == 0;\n\t}\n\n\tstd::string ToLower(const std::string& source)\n\t{\n\t\tstd::string output = source;\n\n\t\tstd::transform(output.begin(), output.end(), output.begin(), [](auto c) { return (std::string::value_type)std::tolower(c); });\n\n\t\treturn output;\n\t}\n\n\tstd::wstring ToLower(const std::wstring& source)\n\t{\n\t\tstd::wstring output = source;\n\n\t\tstd::transform(output.begin(), output.end(), output.begin(), [](auto c) { return (std::wstring::value_type)std::tolower(c); });\n\n\t\treturn output;\n\t}\n\n\tstd::string ToUpper(const std::string& source)\n\t{\n\t\tstd::string output = source;\n\n\t\tstd::transform(output.begin(), output.end(), output.begin(), [](auto c) { return (std::string::value_type)std::toupper(c); });\n\n\t\treturn output;\n\t}\n\n\tstd::wstring ToUpper(const std::wstring& source)\n\t{\n\t\tstd::wstring output = source;\n\n\t\tstd::transform(output.begin(), output.end(), output.begin(), [](auto c) { return (std::wstring::value_type)std::toupper(c); });\n\n\t\treturn output;\n\t}\n\n\tstd::string Format(const char* format, ...)\n\t{\n\t\tchar buf[1024];\n\t\tint count;\n\t\tva_list ap;\n\n\t\t// Try to print to a small buffer first.\n\t\t// We don't need to allocate a large buffer if it's enough to hold all the characters.\n\t\tva_start(ap, format);\n\t\tcount = vsnprintf(buf, sizeof(buf), format, ap);\n\t\tva_end(ap);\n\n\t\tif (count <= 0)\n\t\t{\n\t\t\t// Something error happened, We return an empty string.\n\t\t\treturn std::string();\n\t\t}\n\n\t\tif (count < sizeof(buf))\n\t\t{\n\t\t\t// All characters have been written to the small buffer.\n\t\t\treturn std::string(buf, count);\n\t\t}\n\n\t\t// Allocate a buffer large enough to hold all characters.\n\t\tstd::string output(count, '\\0');\n\n\t\t// Try to print\n\t\tva_start(ap, format);\n\t\tcount = vsnprintf(const_cast(output.data()), output.size() + 1, format, ap);\n\t\tva_end(ap);\n\n\t\tif (count <= 0)\n\t\t{\n\t\t\t// Something error happened, We return an empty string.\n\t\t\treturn std::string();\n\t\t}\n\n\t\treturn output;\n\t}\n\n\tstd::string VFormat(const char* format, va_list ap)\n\t{\n\t\tchar buf[1024];\n\t\tint count;\n\n\t\t// Try to print to a small buffer first.\n\t\t// We don't need to allocate a large buffer if it's enough to hold all the characters.\n\t\tcount = vsnprintf(buf, sizeof(buf), format, ap);\n\n\t\tif (count <= 0)\n\t\t{\n\t\t\t// Something error happened, We return an empty string.\n\t\t\treturn std::string();\n\t\t}\n\n\t\tif (count < sizeof(buf))\n\t\t{\n\t\t\t// All characters have been written to the small buffer.\n\t\t\treturn std::string(buf, count);\n\t\t}\n\n\t\t// Allocate a buffer large enough to hold all characters.\n\t\tstd::string output(count, '\\0');\n\n\t\t// Try to print\n\t\tcount = vsnprintf(const_cast(output.data()), output.size() + 1, format, ap);\n\n\t\tif (count <= 0)\n\t\t{\n\t\t\t// Something error happened, We return an empty string.\n\t\t\treturn std::string();\n\t\t}\n\n\t\treturn output;\n\t}\n\n\tstd::wstring Format(const wchar_t* format, ...)\n\t{\n\t\twchar_t buf[1024];\n\t\tint count;\n\t\tva_list ap;\n\n\t\t// Try to print to a small buffer first.\n\t\t// We don't need to allocate a large buffer if it's enough to hold all the characters.\n\t\tva_start(ap, format);\n\t\tcount = _vsnwprintf_s(buf, _countof(buf), format, ap);\n\t\tva_end(ap);\n\n\t\tif (count <= 0)\n\t\t{\n\t\t\t// Something error happened, We return an empty string.\n\t\t\treturn std::wstring();\n\t\t}\n\n\t\tif (count < sizeof(buf))\n\t\t{\n\t\t\t// All characters have been written to the small buffer.\n\t\t\treturn std::wstring(buf, count);\n\t\t}\n\n\t\t// Allocate a buffer large enough to hold all characters.\n\t\tstd::wstring output(count, '\\0');\n\n\t\t// Try to print\n\t\tva_start(ap, format);\n\t\tcount = _vsnwprintf_s(const_cast(output.data()), output.size() + 1, output.size() + 1, format, ap);\n\t\tva_end(ap);\n\n\t\tif (count <= 0)\n\t\t{\n\t\t\t// Something error happened, We return an empty string.\n\t\t\treturn std::wstring();\n\t\t}\n\n\t\treturn output;\n\t}\n\n\tstd::wstring VFormat(const wchar_t* format, va_list ap)\n\t{\n\t\twchar_t buf[1024];\n\t\tint count;\n\n\t\t// Try to print to a small buffer first.\n\t\t// We don't need to allocate a large buffer if it's enough to hold all the characters.\n\t\tcount = _vsnwprintf_s(buf, _countof(buf), format, ap);\n\n\t\tif (count <= 0)\n\t\t{\n\t\t\t// Something error happened, We return an empty string.\n\t\t\treturn std::wstring();\n\t\t}\n\n\t\tif (count < sizeof(buf))\n\t\t{\n\t\t\t// All characters have been written to the small buffer.\n\t\t\treturn std::wstring(buf, count);\n\t\t}\n\n\t\t// Allocate a buffer large enough to hold all characters.\n\t\tstd::wstring output(count, '\\0');\n\n\t\t// Try to print\n\t\tcount = _vsnwprintf_s(const_cast(output.data()), output.size() + 1, output.size() + 1, format, ap);\n\n\t\tif (count <= 0)\n\t\t{\n\t\t\t// Something error happened, We return an empty string.\n\t\t\treturn std::wstring();\n\t\t}\n\n\t\treturn output;\n\t}\n}\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Common/stringhelper.h",
"content": "// stringhelper.h\n\n#pragma once\n\n#include \n\nnamespace StringHelper\n{\n\tbool StartsWith(const char* source, const char* sub);\n\tbool StartsWith(const wchar_t* source, const wchar_t* sub);\n\tbool StartsWith(const std::string& source, const std::string& sub);\n\tbool StartsWith(const std::wstring& source, const std::wstring& sub);\n\tbool EndsWith(const char* source, const char* sub);\n\tbool EndsWith(const wchar_t* source, const wchar_t* sub);\n\tbool EndsWith(const std::string& source, const std::string& sub);\n\tbool EndsWith(const std::wstring& source, const std::wstring& sub);\n\n\tstd::string ToLower(const std::string& source);\n\tstd::wstring ToLower(const std::wstring& source);\n\tstd::string ToUpper(const std::string& source);\n\tstd::wstring ToUpper(const std::wstring& source);\n\n\tstd::string Format(const char* format, ...);\n\tstd::string VFormat(const char* format, va_list ap);\n\tstd::wstring Format(const wchar_t* format, ...);\n\tstd::wstring VFormat(const wchar_t* format, va_list ap);\n}\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Common/util.cpp",
"content": "// util.cpp\n\n#include \n#include \n#include \"stringhelper.h\"\n\nnamespace Util\n{\n std::string GetModulePathA(HMODULE hModule)\n {\n DWORD dwBufferSize = MAX_PATH;\n\n std::string output;\n\n // Maximum file path limitation\n // @see https://docs.microsoft.com/en-us/windows/win32/fileio/maximum-file-path-limitation\n while (dwBufferSize < USHRT_MAX)\n {\n output.resize(dwBufferSize);\n\n // Try to get the file name.\n DWORD nSize = GetModuleFileNameA(hModule, const_cast(output.data()), dwBufferSize);\n DWORD dwErrorCode = GetLastError();\n\n if (dwErrorCode != ERROR_SUCCESS && dwErrorCode != ERROR_INSUFFICIENT_BUFFER)\n {\n // Something unexpected happened.\n return std::string();\n }\n\n if (dwErrorCode == ERROR_SUCCESS && nSize < dwBufferSize)\n {\n // All characters have been written into the buffer.\n return output.substr(0, nSize);\n }\n\n if (dwErrorCode == ERROR_INSUFFICIENT_BUFFER || nSize == dwBufferSize)\n {\n // Expand the buffer.\n dwBufferSize *= 2;\n }\n }\n\n return std::string();\n }\n\n std::wstring GetModulePathW(HMODULE hModule)\n {\n DWORD dwBufferSize = MAX_PATH;\n\n std::wstring output;\n\n // Maximum file path limitation\n // @see https://docs.microsoft.com/en-us/windows/win32/fileio/maximum-file-path-limitation\n while (dwBufferSize < USHRT_MAX)\n {\n output.resize(dwBufferSize);\n\n // Try to get the file name.\n DWORD nSize = GetModuleFileNameW(hModule, const_cast(output.data()), dwBufferSize);\n DWORD dwErrorCode = GetLastError();\n\n if (dwErrorCode != ERROR_SUCCESS && dwErrorCode != ERROR_INSUFFICIENT_BUFFER)\n {\n // Something unexpected happened.\n return std::wstring();\n }\n\n if (dwErrorCode == ERROR_SUCCESS && nSize < dwBufferSize)\n {\n // All characters have been written into the buffer.\n return output.substr(0, nSize);\n }\n\n if (dwErrorCode == ERROR_INSUFFICIENT_BUFFER || nSize == dwBufferSize)\n {\n // Expand the buffer.\n dwBufferSize *= 2;\n }\n }\n\n return std::wstring();\n }\n\n std::string GetAppPathA()\n {\n return GetModulePathA(GetModuleHandleW(NULL));\n }\n\n std::wstring GetAppPathW()\n {\n return GetModulePathW(GetModuleHandleW(NULL));\n }\n\n std::string GetAppDirectoryA()\n {\n std::string path = GetAppPathA();\n\n size_t pos = path.find_last_of('\\\\');\n\n if (pos != std::string::npos && pos > 0)\n {\n return path.substr(0, pos);\n }\n\n return path;\n }\n\n\tstd::wstring GetAppDirectoryW()\n\t{\n\t\tstd::wstring path = GetAppPathW();\n\n\t\tsize_t pos = path.find_last_of('\\\\');\n\n\t\tif (pos != std::wstring::npos && pos > 0)\n\t\t{\n\t\t\treturn path.substr(0, pos);\n\t\t}\n\n\t\treturn path;\n\t}\n\n std::string GetLastErrorMessageA()\n {\n DWORD dwFlags = FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM;\n DWORD dwErrorCode = GetLastError();\n DWORD dwLanguageId = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_US);\n LPSTR pBuffer = NULL;\n\n if (FormatMessageA(dwFlags, NULL, dwErrorCode, dwLanguageId, (LPSTR)&pBuffer, 0, NULL) == 0)\n {\n return std::string();\n }\n\n std::string message(pBuffer);\n\n LocalFree(pBuffer);\n\n return message;\n }\n\n std::wstring GetLastErrorMessageW()\n {\n DWORD dwFlags = FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM;\n DWORD dwErrorCode = GetLastError();\n DWORD dwLanguageId = MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_US);\n PWSTR pBuffer = NULL;\n\n if (FormatMessageW(dwFlags, NULL, dwErrorCode, dwLanguageId, (PWSTR)&pBuffer, 0, NULL) == 0)\n {\n return std::wstring();\n }\n\n std::wstring message(pBuffer);\n\n LocalFree(pBuffer);\n\n return message;\n }\n\n __declspec(noreturn) void ThrowError(const char* format, ...)\n {\n va_list ap;\n\n va_start(ap, format);\n auto message = StringHelper::VFormat(format, ap);\n va_end(ap);\n\n MessageBoxA(NULL, message.c_str(), \"Fatal Error\", MB_ICONERROR | MB_OK);\n ExitProcess(1);\n }\n\n __declspec(noreturn) void ThrowError(const wchar_t* format, ...)\n {\n va_list ap;\n\n va_start(ap, format);\n auto message = StringHelper::VFormat(format, ap);\n va_end(ap);\n\n MessageBoxW(NULL, message.c_str(), L\"Fatal Error\", MB_ICONERROR | MB_OK);\n ExitProcess(1);\n }\n\n\tvoid WriteDebugMessage(const char* format, ...)\n\t{\n\t\tva_list ap;\n\n\t\tva_start(ap, format);\n\t\tauto message = StringHelper::VFormat(format, ap);\n\t\tva_end(ap);\n\n\t\tOutputDebugStringA(message.c_str());\n\t}\n\n\tvoid WriteDebugMessage(const wchar_t* format, ...)\n\t{\n\t\tva_list ap;\n\n\t\tva_start(ap, format);\n\t\tauto message = StringHelper::VFormat(format, ap);\n\t\tva_end(ap);\n\n\t\tOutputDebugStringW(message.c_str());\n\t}\n\n std::string OpenFolderDialog(const std::string& title)\n {\n char buf[MAX_PATH]{};\n BROWSEINFOA bi{};\n\n bi.hwndOwner = GetActiveWindow();\n bi.pidlRoot = NULL;\n bi.pszDisplayName = buf;\n bi.lpszTitle = title.c_str();\n bi.ulFlags = BIF_NEWDIALOGSTYLE;\n bi.lpfn = NULL;\n bi.lParam = NULL;\n bi.iImage = 0;\n\n LPITEMIDLIST idl = SHBrowseForFolderA(&bi);\n\n if (idl == NULL)\n {\n return std::string();\n }\n\n if (SHGetPathFromIDListA(idl, buf) == FALSE)\n {\n return std::string();\n }\n\n return std::string(buf);\n }\n\n std::wstring OpenFolderDialog(const std::wstring& title)\n {\n WCHAR buf[MAX_PATH]{};\n BROWSEINFOW bi{};\n\n bi.hwndOwner = GetActiveWindow();\n bi.pidlRoot = NULL;\n bi.pszDisplayName = buf;\n bi.lpszTitle = title.c_str();\n bi.ulFlags = BIF_NEWDIALOGSTYLE;\n bi.lpfn = NULL;\n bi.lParam = NULL;\n bi.iImage = 0;\n\n LPITEMIDLIST idl = SHBrowseForFolderW(&bi);\n\n if (idl == NULL)\n {\n return std::wstring();\n }\n\n if (SHGetPathFromIDListW(idl, buf) == FALSE)\n {\n return std::wstring();\n }\n\n return std::wstring(buf);\n }\n}\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Common/util.h",
"content": "// util.h\n\n#pragma once\n\n#include \n#include \n\nnamespace Util\n{\n\t// Get the full path of the specified module.\n\tstd::string GetModulePathA(HMODULE hModule);\n\n\t// Get the full path of the specified module.\n\tstd::wstring GetModulePathW(HMODULE hModule);\n\n\t// Get the full path to the executable.\n\tstd::string GetAppPathA();\n\n\t// Get the full path to the executable.\n\tstd::wstring GetAppPathW();\n\n\t// Get the directory path to the executable.\n\tstd::string GetAppDirectoryA();\n\n\t// Get the directory path to the executable.\n\tstd::wstring GetAppDirectoryW();\n\n\t// Get message from Win32 last error code.\n\tstd::string GetLastErrorMessageA();\n\n\t// Get message from Win32 last error code.\n\tstd::wstring GetLastErrorMessageW();\n\n\t// Display an error message then close the application.\n\t__declspec(noreturn) void ThrowError(const char* format, ...);\n\n\t// Display an error message then close the application.\n\t__declspec(noreturn) void ThrowError(const wchar_t* format, ...);\n\n\t// Sends a string to the debugger for display.\n\tvoid WriteDebugMessage(const char* format, ...);\n\n\t// Sends a string to the debugger for display.\n\tvoid WriteDebugMessage(const wchar_t* format, ...);\n\n\t// Display a folder select dialog.\n\tstd::string OpenFolderDialog(const std::string& title);\n\n\t// Display a folder select dialog.\n\tstd::wstring OpenFolderDialog(const std::wstring& title);\n}\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Detours/creatwth.cpp",
"content": "//////////////////////////////////////////////////////////////////////////////\n//\n// Create a process with a DLL (creatwth.cpp of detours.lib)\n//\n// Microsoft Research Detours Package, Version 4.0.1\n//\n// Copyright (c) Microsoft Corporation. All rights reserved.\n//\n\n// #define DETOUR_DEBUG 1\n#define DETOURS_INTERNAL\n#include \"detours.h\"\n#include \n\n#if DETOURS_VERSION != 0x4c0c1 // 0xMAJORcMINORcPATCH\n#error detours.h version mismatch\n#endif\n\n#define IMPORT_DIRECTORY OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]\n#define BOUND_DIRECTORY OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT]\n#define CLR_DIRECTORY OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR]\n#define IAT_DIRECTORY OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT]\n\n//////////////////////////////////////////////////////////////////////////////\n//\nconst GUID DETOUR_EXE_HELPER_GUID = { /* ea0251b9-5cde-41b5-98d0-2af4a26b0fee */\n 0xea0251b9, 0x5cde, 0x41b5,\n { 0x98, 0xd0, 0x2a, 0xf4, 0xa2, 0x6b, 0x0f, 0xee }};\n\n//////////////////////////////////////////////////////////////////////////////\n//\n// Enumerate through modules in the target process.\n//\nstatic PVOID LoadNtHeaderFromProcess(_In_ HANDLE hProcess,\n _In_ HMODULE hModule,\n _Out_ PIMAGE_NT_HEADERS32 pNtHeader)\n{\n ZeroMemory(pNtHeader, sizeof(*pNtHeader));\n PBYTE pbModule = (PBYTE)hModule;\n\n if (pbModule == NULL) {\n SetLastError(ERROR_INVALID_PARAMETER);\n return NULL;\n }\n\n MEMORY_BASIC_INFORMATION mbi;\n ZeroMemory(&mbi, sizeof(mbi));\n\n if (VirtualQueryEx(hProcess, hModule, &mbi, sizeof(mbi)) == 0) {\n return NULL;\n }\n\n IMAGE_DOS_HEADER idh;\n if (!ReadProcessMemory(hProcess, pbModule, &idh, sizeof(idh), NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(idh@%p..%p) failed: %lu\\n\",\n pbModule, pbModule + sizeof(idh), GetLastError()));\n return NULL;\n }\n\n if (idh.e_magic != IMAGE_DOS_SIGNATURE ||\n (DWORD)idh.e_lfanew > mbi.RegionSize ||\n (DWORD)idh.e_lfanew < sizeof(idh)) {\n\n SetLastError(ERROR_BAD_EXE_FORMAT);\n return NULL;\n }\n\n if (!ReadProcessMemory(hProcess, pbModule + idh.e_lfanew,\n pNtHeader, sizeof(*pNtHeader), NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(inh@%p..%p:%p) failed: %lu\\n\",\n pbModule + idh.e_lfanew,\n pbModule + idh.e_lfanew + sizeof(*pNtHeader),\n pbModule,\n GetLastError()));\n return NULL;\n }\n\n if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) {\n SetLastError(ERROR_BAD_EXE_FORMAT);\n return NULL;\n }\n\n return pbModule + idh.e_lfanew;\n}\n\nstatic HMODULE EnumerateModulesInProcess(_In_ HANDLE hProcess,\n _In_opt_ HMODULE hModuleLast,\n _Out_ PIMAGE_NT_HEADERS32 pNtHeader,\n _Out_opt_ PVOID *pRemoteNtHeader)\n{\n ZeroMemory(pNtHeader, sizeof(*pNtHeader));\n if (pRemoteNtHeader) {\n *pRemoteNtHeader = NULL;\n }\n\n PBYTE pbLast = (PBYTE)hModuleLast + MM_ALLOCATION_GRANULARITY;\n\n MEMORY_BASIC_INFORMATION mbi;\n ZeroMemory(&mbi, sizeof(mbi));\n\n // Find the next memory region that contains a mapped PE image.\n //\n\n for (;; pbLast = (PBYTE)mbi.BaseAddress + mbi.RegionSize) {\n if (VirtualQueryEx(hProcess, (PVOID)pbLast, &mbi, sizeof(mbi)) == 0) {\n break;\n }\n\n // Usermode address space has such an unaligned region size always at the\n // end and only at the end.\n //\n if ((mbi.RegionSize & 0xfff) == 0xfff) {\n break;\n }\n if (((PBYTE)mbi.BaseAddress + mbi.RegionSize) < pbLast) {\n break;\n }\n\n // Skip uncommitted regions and guard pages.\n //\n if ((mbi.State != MEM_COMMIT) ||\n ((mbi.Protect & 0xff) == PAGE_NOACCESS) ||\n (mbi.Protect & PAGE_GUARD)) {\n continue;\n }\n\n PVOID remoteHeader\n = LoadNtHeaderFromProcess(hProcess, (HMODULE)pbLast, pNtHeader);\n if (remoteHeader) {\n if (pRemoteNtHeader) {\n *pRemoteNtHeader = remoteHeader;\n }\n\n return (HMODULE)pbLast;\n }\n }\n return NULL;\n}\n\n//////////////////////////////////////////////////////////////////////////////\n//\n// Find payloads in target process.\n//\n\nstatic PVOID FindDetourSectionInRemoteModule(_In_ HANDLE hProcess,\n _In_ HMODULE hModule,\n _In_ const IMAGE_NT_HEADERS32 *pNtHeader,\n _In_ PVOID pRemoteNtHeader)\n{\n if (pNtHeader->FileHeader.SizeOfOptionalHeader == 0) {\n SetLastError(ERROR_EXE_MARKED_INVALID);\n return NULL;\n }\n\n PIMAGE_SECTION_HEADER pRemoteSectionHeaders\n = (PIMAGE_SECTION_HEADER)((PBYTE)pRemoteNtHeader\n + sizeof(pNtHeader->Signature)\n + sizeof(pNtHeader->FileHeader)\n + pNtHeader->FileHeader.SizeOfOptionalHeader);\n\n IMAGE_SECTION_HEADER header;\n for (DWORD n = 0; n < pNtHeader->FileHeader.NumberOfSections; ++n) {\n if (!ReadProcessMemory(hProcess, pRemoteSectionHeaders + n, &header, sizeof(header), NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(ish@%p..%p) failed: %lu\\n\",\n pRemoteSectionHeaders + n,\n (PBYTE)(pRemoteSectionHeaders + n) + sizeof(header),\n GetLastError()));\n\n return NULL;\n }\n\n if (strcmp((PCHAR)header.Name, \".detour\") == 0) {\n if (header.VirtualAddress == 0 ||\n header.SizeOfRawData == 0) {\n\n break;\n }\n\n SetLastError(NO_ERROR);\n return (PBYTE)hModule + header.VirtualAddress;\n }\n }\n\n SetLastError(ERROR_EXE_MARKED_INVALID);\n return NULL;\n}\n\nstatic PVOID FindPayloadInRemoteDetourSection(_In_ HANDLE hProcess,\n _In_ REFGUID rguid,\n _Out_opt_ DWORD *pcbData,\n _In_ PVOID pvRemoteDetoursSection)\n{\n if (pcbData) {\n *pcbData = 0;\n }\n\n PBYTE pbData = (PBYTE)pvRemoteDetoursSection;\n\n DETOUR_SECTION_HEADER header;\n if (!ReadProcessMemory(hProcess, pbData, &header, sizeof(header), NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(dsh@%p..%p) failed: %lu\\n\",\n pbData,\n pbData + sizeof(header),\n GetLastError()));\n return NULL;\n }\n\n if (header.cbHeaderSize < sizeof(DETOUR_SECTION_HEADER) ||\n header.nSignature != DETOUR_SECTION_HEADER_SIGNATURE) {\n SetLastError(ERROR_EXE_MARKED_INVALID);\n return NULL;\n }\n\n if (header.nDataOffset == 0) {\n header.nDataOffset = header.cbHeaderSize;\n }\n\n for (PVOID pvSection = pbData + header.nDataOffset; pvSection < pbData + header.cbDataSize;) {\n DETOUR_SECTION_RECORD section;\n if (!ReadProcessMemory(hProcess, pvSection, §ion, sizeof(section), NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(dsr@%p..%p) failed: %lu\\n\",\n pvSection,\n (PBYTE)pvSection + sizeof(section),\n GetLastError()));\n return NULL;\n }\n\n if (DetourAreSameGuid(section.guid, rguid)) {\n if (pcbData) {\n *pcbData = section.cbBytes - sizeof(section);\n }\n SetLastError(NO_ERROR);\n return (DETOUR_SECTION_RECORD *)pvSection + 1;\n }\n\n pvSection = (PBYTE)pvSection + section.cbBytes;\n }\n\n return NULL;\n}\n\n_Success_(return != NULL)\nPVOID WINAPI DetourFindRemotePayload(_In_ HANDLE hProcess,\n _In_ REFGUID rguid,\n _Out_opt_ DWORD *pcbData)\n{\n if (hProcess == NULL) {\n SetLastError(ERROR_INVALID_HANDLE);\n return NULL;\n }\n\n IMAGE_NT_HEADERS32 header;\n PVOID pvRemoteHeader;\n for (HMODULE hMod = NULL; (hMod = EnumerateModulesInProcess(hProcess, hMod, &header, &pvRemoteHeader)) != NULL;) {\n PVOID pvData = FindDetourSectionInRemoteModule(hProcess, hMod, &header, pvRemoteHeader);\n if (pvData != NULL) {\n pvData = FindPayloadInRemoteDetourSection(hProcess, rguid, pcbData, pvData);\n if (pvData != NULL) {\n return pvData;\n }\n }\n }\n\n SetLastError(ERROR_MOD_NOT_FOUND);\n return NULL;\n}\n\n//////////////////////////////////////////////////////////////////////////////\n//\n// Find a region of memory in which we can create a replacement import table.\n//\nstatic PBYTE FindAndAllocateNearBase(HANDLE hProcess, PBYTE pbModule, PBYTE pbBase, DWORD cbAlloc)\n{\n MEMORY_BASIC_INFORMATION mbi;\n ZeroMemory(&mbi, sizeof(mbi));\n\n PBYTE pbLast = pbBase;\n for (;; pbLast = (PBYTE)mbi.BaseAddress + mbi.RegionSize) {\n\n ZeroMemory(&mbi, sizeof(mbi));\n if (VirtualQueryEx(hProcess, (PVOID)pbLast, &mbi, sizeof(mbi)) == 0) {\n if (GetLastError() == ERROR_INVALID_PARAMETER) {\n break;\n }\n DETOUR_TRACE((\"VirtualQueryEx(%p) failed: %lu\\n\",\n pbLast, GetLastError()));\n break;\n }\n // Usermode address space has such an unaligned region size always at the\n // end and only at the end.\n //\n if ((mbi.RegionSize & 0xfff) == 0xfff) {\n break;\n }\n\n // Skip anything other than a pure free region.\n //\n if (mbi.State != MEM_FREE) {\n continue;\n }\n\n // Use the max of mbi.BaseAddress and pbBase, in case mbi.BaseAddress < pbBase.\n PBYTE pbAddress = (PBYTE)mbi.BaseAddress > pbBase ? (PBYTE)mbi.BaseAddress : pbBase;\n\n // Round pbAddress up to the nearest MM allocation boundary.\n const DWORD_PTR mmGranularityMinusOne = (DWORD_PTR)(MM_ALLOCATION_GRANULARITY -1);\n pbAddress = (PBYTE)(((DWORD_PTR)pbAddress + mmGranularityMinusOne) & ~mmGranularityMinusOne);\n\n#ifdef _WIN64\n // The offset from pbModule to any replacement import must fit into 32 bits.\n // For simplicity, we check that the offset to the last byte fits into 32 bits,\n // instead of the largest offset we'll actually use. The values are very similar.\n const size_t GB4 = ((((size_t)1) << 32) - 1);\n if ((size_t)(pbAddress + cbAlloc - 1 - pbModule) > GB4) {\n DETOUR_TRACE((\"FindAndAllocateNearBase(1) failing due to distance >4GB %p\\n\", pbAddress));\n return NULL;\n }\n#else\n UNREFERENCED_PARAMETER(pbModule);\n#endif\n\n DETOUR_TRACE((\"Free region %p..%p\\n\",\n mbi.BaseAddress,\n (PBYTE)mbi.BaseAddress + mbi.RegionSize));\n\n for (; pbAddress < (PBYTE)mbi.BaseAddress + mbi.RegionSize; pbAddress += MM_ALLOCATION_GRANULARITY) {\n PBYTE pbAlloc = (PBYTE)VirtualAllocEx(hProcess, pbAddress, cbAlloc,\n MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);\n if (pbAlloc == NULL) {\n DETOUR_TRACE((\"VirtualAllocEx(%p) failed: %lu\\n\", pbAddress, GetLastError()));\n continue;\n }\n#ifdef _WIN64\n // The offset from pbModule to any replacement import must fit into 32 bits.\n if ((size_t)(pbAddress + cbAlloc - 1 - pbModule) > GB4) {\n DETOUR_TRACE((\"FindAndAllocateNearBase(2) failing due to distance >4GB %p\\n\", pbAddress));\n return NULL;\n }\n#endif\n DETOUR_TRACE((\"[%p..%p] Allocated for import table.\\n\",\n pbAlloc, pbAlloc + cbAlloc));\n return pbAlloc;\n }\n }\n return NULL;\n}\n\nstatic inline DWORD PadToDword(DWORD dw)\n{\n return (dw + 3) & ~3u;\n}\n\nstatic inline DWORD PadToDwordPtr(DWORD dw)\n{\n return (dw + 7) & ~7u;\n}\n\nstatic inline HRESULT ReplaceOptionalSizeA(_Inout_z_count_(cchDest) LPSTR pszDest,\n _In_ size_t cchDest,\n _In_z_ LPCSTR pszSize)\n{\n if (cchDest == 0 || pszDest == NULL || pszSize == NULL ||\n pszSize[0] == '\\0' || pszSize[1] == '\\0' || pszSize[2] != '\\0') {\n\n // can not write into empty buffer or with string other than two chars.\n return ERROR_INVALID_PARAMETER;\n }\n\n for (; cchDest >= 2; cchDest--, pszDest++) {\n if (pszDest[0] == '?' && pszDest[1] == '?') {\n pszDest[0] = pszSize[0];\n pszDest[1] = pszSize[1];\n break;\n }\n }\n\n return S_OK;\n}\n\nstatic BOOL RecordExeRestore(HANDLE hProcess, HMODULE hModule, DETOUR_EXE_RESTORE& der)\n{\n // Save the various headers for DetourRestoreAfterWith.\n ZeroMemory(&der, sizeof(der));\n der.cb = sizeof(der);\n\n der.pidh = (PBYTE)hModule;\n der.cbidh = sizeof(der.idh);\n if (!ReadProcessMemory(hProcess, der.pidh, &der.idh, sizeof(der.idh), NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(idh@%p..%p) failed: %lu\\n\",\n der.pidh, der.pidh + der.cbidh, GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"IDH: %p..%p\\n\", der.pidh, der.pidh + der.cbidh));\n\n // We read the NT header in two passes to get the full size.\n // First we read just the Signature and FileHeader.\n der.pinh = der.pidh + der.idh.e_lfanew;\n der.cbinh = FIELD_OFFSET(IMAGE_NT_HEADERS, OptionalHeader);\n if (!ReadProcessMemory(hProcess, der.pinh, &der.inh, der.cbinh, NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(inh@%p..%p) failed: %lu\\n\",\n der.pinh, der.pinh + der.cbinh, GetLastError()));\n return FALSE;\n }\n\n // Second we read the OptionalHeader and Section headers.\n der.cbinh = (FIELD_OFFSET(IMAGE_NT_HEADERS, OptionalHeader) +\n der.inh.FileHeader.SizeOfOptionalHeader +\n der.inh.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER));\n\n if (der.cbinh > sizeof(der.raw)) {\n return FALSE;\n }\n\n if (!ReadProcessMemory(hProcess, der.pinh, &der.inh, der.cbinh, NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(inh@%p..%p) failed: %lu\\n\",\n der.pinh, der.pinh + der.cbinh, GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"INH: %p..%p\\n\", der.pinh, der.pinh + der.cbinh));\n\n // Third, we read the CLR header\n\n if (der.inh.OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) {\n if (der.inh32.CLR_DIRECTORY.VirtualAddress != 0 &&\n der.inh32.CLR_DIRECTORY.Size != 0) {\n\n DETOUR_TRACE((\"CLR32.VirtAddr=%08lx, CLR.Size=%lu\\n\",\n der.inh32.CLR_DIRECTORY.VirtualAddress,\n der.inh32.CLR_DIRECTORY.Size));\n\n der.pclr = ((PBYTE)hModule) + der.inh32.CLR_DIRECTORY.VirtualAddress;\n }\n }\n else if (der.inh.OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) {\n if (der.inh64.CLR_DIRECTORY.VirtualAddress != 0 &&\n der.inh64.CLR_DIRECTORY.Size != 0) {\n\n DETOUR_TRACE((\"CLR64.VirtAddr=%08lx, CLR.Size=%lu\\n\",\n der.inh64.CLR_DIRECTORY.VirtualAddress,\n der.inh64.CLR_DIRECTORY.Size));\n\n der.pclr = ((PBYTE)hModule) + der.inh64.CLR_DIRECTORY.VirtualAddress;\n }\n }\n\n if (der.pclr != 0) {\n der.cbclr = sizeof(der.clr);\n if (!ReadProcessMemory(hProcess, der.pclr, &der.clr, der.cbclr, NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(clr@%p..%p) failed: %lu\\n\",\n der.pclr, der.pclr + der.cbclr, GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"CLR: %p..%p\\n\", der.pclr, der.pclr + der.cbclr));\n }\n\n return TRUE;\n}\n\n//////////////////////////////////////////////////////////////////////////////\n//\n#if DETOURS_32BIT\n#define DWORD_XX DWORD32\n#define IMAGE_NT_HEADERS_XX IMAGE_NT_HEADERS32\n#define IMAGE_NT_OPTIONAL_HDR_MAGIC_XX IMAGE_NT_OPTIONAL_HDR32_MAGIC\n#define IMAGE_ORDINAL_FLAG_XX IMAGE_ORDINAL_FLAG32\n#define IMAGE_THUNK_DATAXX IMAGE_THUNK_DATA32\n#define UPDATE_IMPORTS_XX UpdateImports32\n#define DETOURS_BITS_XX 32\n#include \"uimports.cpp\"\n#undef DETOUR_EXE_RESTORE_FIELD_XX\n#undef DWORD_XX\n#undef IMAGE_NT_HEADERS_XX\n#undef IMAGE_NT_OPTIONAL_HDR_MAGIC_XX\n#undef IMAGE_ORDINAL_FLAG_XX\n#undef UPDATE_IMPORTS_XX\n#endif // DETOURS_32BIT\n\n#if DETOURS_64BIT\n#define DWORD_XX DWORD64\n#define IMAGE_NT_HEADERS_XX IMAGE_NT_HEADERS64\n#define IMAGE_NT_OPTIONAL_HDR_MAGIC_XX IMAGE_NT_OPTIONAL_HDR64_MAGIC\n#define IMAGE_ORDINAL_FLAG_XX IMAGE_ORDINAL_FLAG64\n#define IMAGE_THUNK_DATAXX IMAGE_THUNK_DATA64\n#define UPDATE_IMPORTS_XX UpdateImports64\n#define DETOURS_BITS_XX 64\n#include \"uimports.cpp\"\n#undef DETOUR_EXE_RESTORE_FIELD_XX\n#undef DWORD_XX\n#undef IMAGE_NT_HEADERS_XX\n#undef IMAGE_NT_OPTIONAL_HDR_MAGIC_XX\n#undef IMAGE_ORDINAL_FLAG_XX\n#undef UPDATE_IMPORTS_XX\n#endif // DETOURS_64BIT\n\n//////////////////////////////////////////////////////////////////////////////\n//\n#if DETOURS_64BIT\n\nC_ASSERT(sizeof(IMAGE_NT_HEADERS64) == sizeof(IMAGE_NT_HEADERS32) + 16);\n\nstatic BOOL UpdateFrom32To64(HANDLE hProcess, HMODULE hModule, WORD machine,\n DETOUR_EXE_RESTORE& der)\n{\n IMAGE_DOS_HEADER idh;\n IMAGE_NT_HEADERS32 inh32;\n IMAGE_NT_HEADERS64 inh64;\n IMAGE_SECTION_HEADER sects[32];\n PBYTE pbModule = (PBYTE)hModule;\n DWORD n;\n\n ZeroMemory(&inh32, sizeof(inh32));\n ZeroMemory(&inh64, sizeof(inh64));\n ZeroMemory(sects, sizeof(sects));\n\n DETOUR_TRACE((\"UpdateFrom32To64(%04x)\\n\", machine));\n //////////////////////////////////////////////////////// Read old headers.\n //\n if (!ReadProcessMemory(hProcess, pbModule, &idh, sizeof(idh), NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(idh@%p..%p) failed: %lu\\n\",\n pbModule, pbModule + sizeof(idh), GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"ReadProcessMemory(idh@%p..%p)\\n\",\n pbModule, pbModule + sizeof(idh)));\n\n PBYTE pnh = pbModule + idh.e_lfanew;\n if (!ReadProcessMemory(hProcess, pnh, &inh32, sizeof(inh32), NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(inh@%p..%p) failed: %lu\\n\",\n pnh, pnh + sizeof(inh32), GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"ReadProcessMemory(inh@%p..%p)\\n\", pnh, pnh + sizeof(inh32)));\n\n if (inh32.FileHeader.NumberOfSections > (sizeof(sects)/sizeof(sects[0]))) {\n return FALSE;\n }\n\n PBYTE psects = pnh +\n FIELD_OFFSET(IMAGE_NT_HEADERS, OptionalHeader) +\n inh32.FileHeader.SizeOfOptionalHeader;\n ULONG cb = inh32.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);\n if (!ReadProcessMemory(hProcess, psects, §s, cb, NULL)) {\n DETOUR_TRACE((\"ReadProcessMemory(ish@%p..%p) failed: %lu\\n\",\n psects, psects + cb, GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"ReadProcessMemory(ish@%p..%p)\\n\", psects, psects + cb));\n\n ////////////////////////////////////////////////////////// Convert header.\n //\n inh64.Signature = inh32.Signature;\n inh64.FileHeader = inh32.FileHeader;\n inh64.FileHeader.Machine = machine;\n inh64.FileHeader.SizeOfOptionalHeader = sizeof(IMAGE_OPTIONAL_HEADER64);\n\n inh64.OptionalHeader.Magic = IMAGE_NT_OPTIONAL_HDR64_MAGIC;\n inh64.OptionalHeader.MajorLinkerVersion = inh32.OptionalHeader.MajorLinkerVersion;\n inh64.OptionalHeader.MinorLinkerVersion = inh32.OptionalHeader.MinorLinkerVersion;\n inh64.OptionalHeader.SizeOfCode = inh32.OptionalHeader.SizeOfCode;\n inh64.OptionalHeader.SizeOfInitializedData = inh32.OptionalHeader.SizeOfInitializedData;\n inh64.OptionalHeader.SizeOfUninitializedData = inh32.OptionalHeader.SizeOfUninitializedData;\n inh64.OptionalHeader.AddressOfEntryPoint = inh32.OptionalHeader.AddressOfEntryPoint;\n inh64.OptionalHeader.BaseOfCode = inh32.OptionalHeader.BaseOfCode;\n inh64.OptionalHeader.ImageBase = inh32.OptionalHeader.ImageBase;\n inh64.OptionalHeader.SectionAlignment = inh32.OptionalHeader.SectionAlignment;\n inh64.OptionalHeader.FileAlignment = inh32.OptionalHeader.FileAlignment;\n inh64.OptionalHeader.MajorOperatingSystemVersion\n = inh32.OptionalHeader.MajorOperatingSystemVersion;\n inh64.OptionalHeader.MinorOperatingSystemVersion\n = inh32.OptionalHeader.MinorOperatingSystemVersion;\n inh64.OptionalHeader.MajorImageVersion = inh32.OptionalHeader.MajorImageVersion;\n inh64.OptionalHeader.MinorImageVersion = inh32.OptionalHeader.MinorImageVersion;\n inh64.OptionalHeader.MajorSubsystemVersion = inh32.OptionalHeader.MajorSubsystemVersion;\n inh64.OptionalHeader.MinorSubsystemVersion = inh32.OptionalHeader.MinorSubsystemVersion;\n inh64.OptionalHeader.Win32VersionValue = inh32.OptionalHeader.Win32VersionValue;\n inh64.OptionalHeader.SizeOfImage = inh32.OptionalHeader.SizeOfImage;\n inh64.OptionalHeader.SizeOfHeaders = inh32.OptionalHeader.SizeOfHeaders;\n inh64.OptionalHeader.CheckSum = inh32.OptionalHeader.CheckSum;\n inh64.OptionalHeader.Subsystem = inh32.OptionalHeader.Subsystem;\n inh64.OptionalHeader.DllCharacteristics = inh32.OptionalHeader.DllCharacteristics;\n inh64.OptionalHeader.SizeOfStackReserve = inh32.OptionalHeader.SizeOfStackReserve;\n inh64.OptionalHeader.SizeOfStackCommit = inh32.OptionalHeader.SizeOfStackCommit;\n inh64.OptionalHeader.SizeOfHeapReserve = inh32.OptionalHeader.SizeOfHeapReserve;\n inh64.OptionalHeader.SizeOfHeapCommit = inh32.OptionalHeader.SizeOfHeapCommit;\n inh64.OptionalHeader.LoaderFlags = inh32.OptionalHeader.LoaderFlags;\n inh64.OptionalHeader.NumberOfRvaAndSizes = inh32.OptionalHeader.NumberOfRvaAndSizes;\n for (n = 0; n < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; n++) {\n inh64.OptionalHeader.DataDirectory[n] = inh32.OptionalHeader.DataDirectory[n];\n }\n\n /////////////////////////////////////////////////////// Write new headers.\n //\n DWORD dwProtect = 0;\n if (!DetourVirtualProtectSameExecuteEx(hProcess, pbModule, inh64.OptionalHeader.SizeOfHeaders,\n PAGE_EXECUTE_READWRITE, &dwProtect)) {\n return FALSE;\n }\n\n if (!WriteProcessMemory(hProcess, pnh, &inh64, sizeof(inh64), NULL)) {\n DETOUR_TRACE((\"WriteProcessMemory(inh@%p..%p) failed: %lu\\n\",\n pnh, pnh + sizeof(inh64), GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"WriteProcessMemory(inh@%p..%p)\\n\", pnh, pnh + sizeof(inh64)));\n\n psects = pnh +\n FIELD_OFFSET(IMAGE_NT_HEADERS, OptionalHeader) +\n inh64.FileHeader.SizeOfOptionalHeader;\n cb = inh64.FileHeader.NumberOfSections * sizeof(IMAGE_SECTION_HEADER);\n if (!WriteProcessMemory(hProcess, psects, §s, cb, NULL)) {\n DETOUR_TRACE((\"WriteProcessMemory(ish@%p..%p) failed: %lu\\n\",\n psects, psects + cb, GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"WriteProcessMemory(ish@%p..%p)\\n\", psects, psects + cb));\n\n // Record the updated headers.\n if (!RecordExeRestore(hProcess, hModule, der)) {\n return FALSE;\n }\n\n // Remove the import table.\n if (der.pclr != NULL && (der.clr.Flags & COMIMAGE_FLAGS_ILONLY)) {\n inh64.IMPORT_DIRECTORY.VirtualAddress = 0;\n inh64.IMPORT_DIRECTORY.Size = 0;\n\n if (!WriteProcessMemory(hProcess, pnh, &inh64, sizeof(inh64), NULL)) {\n DETOUR_TRACE((\"WriteProcessMemory(inh@%p..%p) failed: %lu\\n\",\n pnh, pnh + sizeof(inh64), GetLastError()));\n return FALSE;\n }\n }\n\n DWORD dwOld = 0;\n if (!VirtualProtectEx(hProcess, pbModule, inh64.OptionalHeader.SizeOfHeaders,\n dwProtect, &dwOld)) {\n return FALSE;\n }\n\n return TRUE;\n}\n#endif // DETOURS_64BIT\n\ntypedef BOOL(WINAPI *LPFN_ISWOW64PROCESS)(HANDLE, PBOOL);\n\nstatic BOOL IsWow64ProcessHelper(HANDLE hProcess,\n PBOOL Wow64Process)\n{\n#ifdef _X86_\n if (Wow64Process == NULL) {\n return FALSE;\n }\n\n // IsWow64Process is not available on all supported versions of Windows.\n //\n HMODULE hKernel32 = LoadLibraryW(L\"KERNEL32.DLL\");\n if (hKernel32 == NULL) {\n DETOUR_TRACE((\"LoadLibraryW failed: %lu\\n\", GetLastError()));\n return FALSE;\n }\n\n LPFN_ISWOW64PROCESS pfnIsWow64Process = (LPFN_ISWOW64PROCESS)GetProcAddress(\n hKernel32, \"IsWow64Process\");\n\n if (pfnIsWow64Process == NULL) {\n DETOUR_TRACE((\"GetProcAddress failed: %lu\\n\", GetLastError()));\n return FALSE;\n }\n return pfnIsWow64Process(hProcess, Wow64Process);\n#else\n return IsWow64Process(hProcess, Wow64Process);\n#endif\n}\n\n//////////////////////////////////////////////////////////////////////////////\n//\nBOOL WINAPI DetourUpdateProcessWithDll(_In_ HANDLE hProcess,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_ DWORD nDlls)\n{\n // Find the next memory region that contains a mapped PE image.\n //\n BOOL bIs32BitProcess;\n BOOL bIs64BitOS = FALSE;\n HMODULE hModule = NULL;\n HMODULE hLast = NULL;\n\n DETOUR_TRACE((\"DetourUpdateProcessWithDll(%p,dlls=%lu)\\n\", hProcess, nDlls));\n\n for (;;) {\n IMAGE_NT_HEADERS32 inh;\n\n if ((hLast = EnumerateModulesInProcess(hProcess, hLast, &inh, NULL)) == NULL) {\n break;\n }\n\n DETOUR_TRACE((\"%p machine=%04x magic=%04x\\n\",\n hLast, inh.FileHeader.Machine, inh.OptionalHeader.Magic));\n\n if ((inh.FileHeader.Characteristics & IMAGE_FILE_DLL) == 0) {\n hModule = hLast;\n DETOUR_TRACE((\"%p Found EXE\\n\", hLast));\n }\n }\n\n if (hModule == NULL) {\n SetLastError(ERROR_INVALID_OPERATION);\n return FALSE;\n }\n\n // Determine if the target process is 32bit or 64bit. This is a two-stop process:\n //\n // 1. First, determine if we're running on a 64bit operating system.\n // - If we're running 64bit code (i.e. _WIN64 is defined), this is trivially true.\n // - If we're running 32bit code (i.e. _WIN64 is not defined), test if\n // we're running under Wow64. If so, it implies that the operating system\n // is 64bit.\n //\n#ifdef _WIN64\n bIs64BitOS = TRUE;\n#else\n if (!IsWow64ProcessHelper(GetCurrentProcess(), &bIs64BitOS)) {\n return FALSE;\n }\n#endif\n\n // 2. With the operating system bitness known, we can now consider the target process:\n // - If we're running on a 64bit OS, the target process is 32bit in case\n // it is running under Wow64. Otherwise, it's 64bit, running natively\n // (without Wow64).\n // - If we're running on a 32bit OS, the target process must be 32bit, too.\n //\n if (bIs64BitOS) {\n if (!IsWow64ProcessHelper(hProcess, &bIs32BitProcess)) {\n return FALSE;\n }\n } else {\n bIs32BitProcess = TRUE;\n }\n\n DETOUR_TRACE((\" 32BitProcess=%d\\n\", bIs32BitProcess));\n\n return DetourUpdateProcessWithDllEx(hProcess,\n hModule,\n bIs32BitProcess,\n rlpDlls,\n nDlls);\n}\n\nBOOL WINAPI DetourUpdateProcessWithDllEx(_In_ HANDLE hProcess,\n _In_ HMODULE hModule,\n _In_ BOOL bIs32BitProcess,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_ DWORD nDlls)\n{\n // Find the next memory region that contains a mapped PE image.\n //\n BOOL bIs32BitExe = FALSE;\n\n DETOUR_TRACE((\"DetourUpdateProcessWithDllEx(%p,%p,dlls=%lu)\\n\", hProcess, hModule, nDlls));\n\n IMAGE_NT_HEADERS32 inh;\n\n if (hModule == NULL || !LoadNtHeaderFromProcess(hProcess, hModule, &inh)) {\n SetLastError(ERROR_INVALID_OPERATION);\n return FALSE;\n }\n\n if (inh.OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC\n && inh.FileHeader.Machine != 0) {\n\n bIs32BitExe = TRUE;\n }\n\n DETOUR_TRACE((\" 32BitExe=%d\\n\", bIs32BitExe));\n\n if (hModule == NULL) {\n SetLastError(ERROR_INVALID_OPERATION);\n return FALSE;\n }\n\n // Save the various headers for DetourRestoreAfterWith.\n //\n DETOUR_EXE_RESTORE der;\n\n if (!RecordExeRestore(hProcess, hModule, der)) {\n return FALSE;\n }\n\n#if defined(DETOURS_64BIT)\n // Try to convert a neutral 32-bit managed binary to a 64-bit managed binary.\n if (bIs32BitExe && !bIs32BitProcess) {\n if (!der.pclr // Native binary\n || (der.clr.Flags & COMIMAGE_FLAGS_ILONLY) == 0 // Or mixed-mode MSIL\n || (der.clr.Flags & COMIMAGE_FLAGS_32BITREQUIRED) != 0) { // Or 32BIT Required MSIL\n\n SetLastError(ERROR_INVALID_HANDLE);\n return FALSE;\n }\n\n if (!UpdateFrom32To64(hProcess, hModule,\n#if defined(DETOURS_X64)\n IMAGE_FILE_MACHINE_AMD64,\n#elif defined(DETOURS_IA64)\n IMAGE_FILE_MACHINE_IA64,\n#elif defined(DETOURS_ARM64)\n IMAGE_FILE_MACHINE_ARM64,\n#else\n#error Must define one of DETOURS_X64 or DETOURS_IA64 or DETOURS_ARM64 on 64-bit.\n#endif\n der)) {\n return FALSE;\n }\n bIs32BitExe = FALSE;\n }\n#endif // DETOURS_64BIT\n\n // Now decide if we can insert the detour.\n\n#if defined(DETOURS_32BIT)\n if (bIs32BitProcess) {\n // 32-bit native or 32-bit managed process on any platform.\n if (!UpdateImports32(hProcess, hModule, rlpDlls, nDlls)) {\n return FALSE;\n }\n }\n else {\n // 64-bit native or 64-bit managed process.\n //\n // Can't detour a 64-bit process with 32-bit code.\n // Note: This happens for 32-bit PE binaries containing only\n // manage code that have been marked as 64-bit ready.\n //\n SetLastError(ERROR_INVALID_HANDLE);\n return FALSE;\n }\n#elif defined(DETOURS_64BIT)\n if (bIs32BitProcess || bIs32BitExe) {\n // Can't detour a 32-bit process with 64-bit code.\n SetLastError(ERROR_INVALID_HANDLE);\n return FALSE;\n }\n else {\n // 64-bit native or 64-bit managed process on any platform.\n if (!UpdateImports64(hProcess, hModule, rlpDlls, nDlls)) {\n return FALSE;\n }\n }\n#else\n#pragma Must define one of DETOURS_32BIT or DETOURS_64BIT.\n#endif // DETOURS_64BIT\n\n /////////////////////////////////////////////////// Update the CLR header.\n //\n if (der.pclr != NULL) {\n DETOUR_CLR_HEADER clr;\n CopyMemory(&clr, &der.clr, sizeof(clr));\n clr.Flags &= ~COMIMAGE_FLAGS_ILONLY; // Clear the IL_ONLY flag.\n\n DWORD dwProtect;\n if (!DetourVirtualProtectSameExecuteEx(hProcess, der.pclr, sizeof(clr), PAGE_READWRITE, &dwProtect)) {\n DETOUR_TRACE((\"VirtualProtectEx(clr) write failed: %lu\\n\", GetLastError()));\n return FALSE;\n }\n\n if (!WriteProcessMemory(hProcess, der.pclr, &clr, sizeof(clr), NULL)) {\n DETOUR_TRACE((\"WriteProcessMemory(clr) failed: %lu\\n\", GetLastError()));\n return FALSE;\n }\n\n if (!VirtualProtectEx(hProcess, der.pclr, sizeof(clr), dwProtect, &dwProtect)) {\n DETOUR_TRACE((\"VirtualProtectEx(clr) restore failed: %lu\\n\", GetLastError()));\n return FALSE;\n }\n DETOUR_TRACE((\"CLR: %p..%p\\n\", der.pclr, der.pclr + der.cbclr));\n\n#if DETOURS_64BIT\n if (der.clr.Flags & COMIMAGE_FLAGS_32BITREQUIRED) { // Is the 32BIT Required Flag set?\n // X64 never gets here because the process appears as a WOW64 process.\n // However, on IA64, it doesn't appear to be a WOW process.\n DETOUR_TRACE((\"CLR Requires 32-bit\\n\"));\n SetLastError(ERROR_INVALID_HANDLE);\n return FALSE;\n }\n#endif // DETOURS_64BIT\n }\n\n //////////////////////////////// Save the undo data to the target process.\n //\n if (!DetourCopyPayloadToProcess(hProcess, DETOUR_EXE_RESTORE_GUID, &der, sizeof(der))) {\n DETOUR_TRACE((\"DetourCopyPayloadToProcess failed: %lu\\n\", GetLastError()));\n return FALSE;\n }\n return TRUE;\n}\n\n//////////////////////////////////////////////////////////////////////////////\n//\nBOOL WINAPI DetourCreateProcessWithDllA(_In_opt_ LPCSTR lpApplicationName,\n _Inout_opt_ LPSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOA lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ LPCSTR lpDllName,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA)\n{\n DWORD dwMyCreationFlags = (dwCreationFlags | CREATE_SUSPENDED);\n PROCESS_INFORMATION pi;\n BOOL fResult = FALSE;\n\n if (pfCreateProcessA == NULL) {\n pfCreateProcessA = CreateProcessA;\n }\n\n fResult = pfCreateProcessA(lpApplicationName,\n lpCommandLine,\n lpProcessAttributes,\n lpThreadAttributes,\n bInheritHandles,\n dwMyCreationFlags,\n lpEnvironment,\n lpCurrentDirectory,\n lpStartupInfo,\n &pi);\n\n if (lpProcessInformation != NULL) {\n CopyMemory(lpProcessInformation, &pi, sizeof(pi));\n }\n\n if (!fResult) {\n return FALSE;\n }\n\n LPCSTR rlpDlls[2];\n DWORD nDlls = 0;\n if (lpDllName != NULL) {\n rlpDlls[nDlls++] = lpDllName;\n }\n\n if (!DetourUpdateProcessWithDll(pi.hProcess, rlpDlls, nDlls)) {\n TerminateProcess(pi.hProcess, ~0u);\n return FALSE;\n }\n\n if (!(dwCreationFlags & CREATE_SUSPENDED)) {\n ResumeThread(pi.hThread);\n }\n return TRUE;\n}\n\n\nBOOL WINAPI DetourCreateProcessWithDllW(_In_opt_ LPCWSTR lpApplicationName,\n _Inout_opt_ LPWSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCWSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOW lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ LPCSTR lpDllName,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW)\n{\n DWORD dwMyCreationFlags = (dwCreationFlags | CREATE_SUSPENDED);\n PROCESS_INFORMATION pi;\n\n if (pfCreateProcessW == NULL) {\n pfCreateProcessW = CreateProcessW;\n }\n\n BOOL fResult = pfCreateProcessW(lpApplicationName,\n lpCommandLine,\n lpProcessAttributes,\n lpThreadAttributes,\n bInheritHandles,\n dwMyCreationFlags,\n lpEnvironment,\n lpCurrentDirectory,\n lpStartupInfo,\n &pi);\n\n if (lpProcessInformation) {\n CopyMemory(lpProcessInformation, &pi, sizeof(pi));\n }\n\n if (!fResult) {\n return FALSE;\n }\n\n LPCSTR rlpDlls[2];\n DWORD nDlls = 0;\n if (lpDllName != NULL) {\n rlpDlls[nDlls++] = lpDllName;\n }\n\n if (!DetourUpdateProcessWithDll(pi.hProcess, rlpDlls, nDlls)) {\n TerminateProcess(pi.hProcess, ~0u);\n return FALSE;\n }\n\n if (!(dwCreationFlags & CREATE_SUSPENDED)) {\n ResumeThread(pi.hThread);\n }\n return TRUE;\n}\n\nBOOL WINAPI DetourCopyPayloadToProcess(_In_ HANDLE hProcess,\n _In_ REFGUID rguid,\n _In_reads_bytes_(cbData) LPCVOID pvData,\n _In_ DWORD cbData)\n{\n return DetourCopyPayloadToProcessEx(hProcess, rguid, pvData, cbData) != NULL;\n}\n\n_Success_(return != NULL)\nPVOID WINAPI DetourCopyPayloadToProcessEx(_In_ HANDLE hProcess,\n _In_ REFGUID rguid,\n _In_reads_bytes_(cbData) LPCVOID pvData,\n _In_ DWORD cbData)\n{\n if (hProcess == NULL) {\n SetLastError(ERROR_INVALID_HANDLE);\n return NULL;\n }\n\n DWORD cbTotal = (sizeof(IMAGE_DOS_HEADER) +\n sizeof(IMAGE_NT_HEADERS) +\n sizeof(IMAGE_SECTION_HEADER) +\n sizeof(DETOUR_SECTION_HEADER) +\n sizeof(DETOUR_SECTION_RECORD) +\n cbData);\n\n PBYTE pbBase = (PBYTE)VirtualAllocEx(hProcess, NULL, cbTotal,\n MEM_COMMIT, PAGE_READWRITE);\n if (pbBase == NULL) {\n DETOUR_TRACE((\"VirtualAllocEx(%lu) failed: %lu\\n\", cbTotal, GetLastError()));\n return NULL;\n }\n\n // As you can see in the following code,\n // the memory layout of the payload range \"[pbBase, pbBase+cbTotal]\" is a PE executable file,\n // so DetourFreePayload can use \"DetourGetContainingModule(Payload pointer)\" to get the above \"pbBase\" pointer,\n // pbBase: the memory block allocated by VirtualAllocEx will be released in DetourFreePayload by VirtualFree.\n\n PBYTE pbTarget = pbBase;\n IMAGE_DOS_HEADER idh;\n IMAGE_NT_HEADERS inh;\n IMAGE_SECTION_HEADER ish;\n DETOUR_SECTION_HEADER dsh;\n DETOUR_SECTION_RECORD dsr;\n SIZE_T cbWrote = 0;\n\n ZeroMemory(&idh, sizeof(idh));\n idh.e_magic = IMAGE_DOS_SIGNATURE;\n idh.e_lfanew = sizeof(idh);\n if (!WriteProcessMemory(hProcess, pbTarget, &idh, sizeof(idh), &cbWrote) ||\n cbWrote != sizeof(idh)) {\n DETOUR_TRACE((\"WriteProcessMemory(idh) failed: %lu\\n\", GetLastError()));\n return NULL;\n }\n pbTarget += sizeof(idh);\n\n ZeroMemory(&inh, sizeof(inh));\n inh.Signature = IMAGE_NT_SIGNATURE;\n inh.FileHeader.SizeOfOptionalHeader = sizeof(inh.OptionalHeader);\n inh.FileHeader.Characteristics = IMAGE_FILE_DLL;\n inh.FileHeader.NumberOfSections = 1;\n inh.OptionalHeader.Magic = IMAGE_NT_OPTIONAL_HDR_MAGIC;\n if (!WriteProcessMemory(hProcess, pbTarget, &inh, sizeof(inh), &cbWrote) ||\n cbWrote != sizeof(inh)) {\n return NULL;\n }\n pbTarget += sizeof(inh);\n\n ZeroMemory(&ish, sizeof(ish));\n memcpy(ish.Name, \".detour\", sizeof(ish.Name));\n ish.VirtualAddress = (DWORD)((pbTarget + sizeof(ish)) - pbBase);\n ish.SizeOfRawData = (sizeof(DETOUR_SECTION_HEADER) +\n sizeof(DETOUR_SECTION_RECORD) +\n cbData);\n if (!WriteProcessMemory(hProcess, pbTarget, &ish, sizeof(ish), &cbWrote) ||\n cbWrote != sizeof(ish)) {\n return NULL;\n }\n pbTarget += sizeof(ish);\n\n ZeroMemory(&dsh, sizeof(dsh));\n dsh.cbHeaderSize = sizeof(dsh);\n dsh.nSignature = DETOUR_SECTION_HEADER_SIGNATURE;\n dsh.nDataOffset = sizeof(DETOUR_SECTION_HEADER);\n dsh.cbDataSize = (sizeof(DETOUR_SECTION_HEADER) +\n sizeof(DETOUR_SECTION_RECORD) +\n cbData);\n if (!WriteProcessMemory(hProcess, pbTarget, &dsh, sizeof(dsh), &cbWrote) ||\n cbWrote != sizeof(dsh)) {\n return NULL;\n }\n pbTarget += sizeof(dsh);\n\n ZeroMemory(&dsr, sizeof(dsr));\n dsr.cbBytes = cbData + sizeof(DETOUR_SECTION_RECORD);\n dsr.nReserved = 0;\n dsr.guid = rguid;\n if (!WriteProcessMemory(hProcess, pbTarget, &dsr, sizeof(dsr), &cbWrote) ||\n cbWrote != sizeof(dsr)) {\n return NULL;\n }\n pbTarget += sizeof(dsr);\n\n if (!WriteProcessMemory(hProcess, pbTarget, pvData, cbData, &cbWrote) ||\n cbWrote != cbData) {\n return NULL;\n }\n\n DETOUR_TRACE((\"Copied %lu byte payload into target process at %p\\n\",\n cbData, pbTarget));\n \n SetLastError(NO_ERROR);\n return pbTarget;\n}\n\nstatic BOOL s_fSearchedForHelper = FALSE;\nstatic PDETOUR_EXE_HELPER s_pHelper = NULL;\n\nVOID CALLBACK DetourFinishHelperProcess(_In_ HWND,\n _In_ HINSTANCE,\n _In_ LPSTR,\n _In_ INT)\n{\n LPCSTR * rlpDlls = NULL;\n DWORD Result = 9900;\n DWORD cOffset = 0;\n DWORD cSize = 0;\n HANDLE hProcess = NULL;\n\n if (s_pHelper == NULL) {\n DETOUR_TRACE((\"DetourFinishHelperProcess called with s_pHelper = NULL.\\n\"));\n Result = 9905;\n goto Cleanup;\n }\n\n hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, s_pHelper->pid);\n if (hProcess == NULL) {\n DETOUR_TRACE((\"OpenProcess(pid=%lu) failed: %lu\\n\",\n s_pHelper->pid, GetLastError()));\n Result = 9901;\n goto Cleanup;\n }\n\n rlpDlls = new NOTHROW LPCSTR [s_pHelper->nDlls];\n cSize = s_pHelper->cb - sizeof(DETOUR_EXE_HELPER);\n for (DWORD n = 0; n < s_pHelper->nDlls; n++) {\n size_t cchDest = 0;\n HRESULT hr = StringCchLengthA(&s_pHelper->rDlls[cOffset], cSize - cOffset, &cchDest);\n if (!SUCCEEDED(hr)) {\n Result = 9902;\n goto Cleanup;\n }\n\n rlpDlls[n] = &s_pHelper->rDlls[cOffset];\n cOffset += (DWORD)cchDest + 1;\n }\n\n if (!DetourUpdateProcessWithDll(hProcess, rlpDlls, s_pHelper->nDlls)) {\n DETOUR_TRACE((\"DetourUpdateProcessWithDll(pid=%lu) failed: %lu\\n\",\n s_pHelper->pid, GetLastError()));\n Result = 9903;\n goto Cleanup;\n }\n Result = 0;\n\n Cleanup:\n if (rlpDlls != NULL) {\n delete[] rlpDlls;\n rlpDlls = NULL;\n }\n\n // Note: s_pHelper is allocated as part of injecting the payload in DetourCopyPayloadToProcess(..),\n // it's a fake section and not data allocated by the system PE loader.\n\n // Delete the payload after execution to release the memory occupied by it\n if (s_pHelper != NULL) {\n DetourFreePayload(s_pHelper);\n s_pHelper = NULL;\n }\n\n ExitProcess(Result);\n}\n\nBOOL WINAPI DetourIsHelperProcess(VOID)\n{\n PVOID pvData;\n DWORD cbData;\n\n if (s_fSearchedForHelper) {\n return (s_pHelper != NULL);\n }\n\n s_fSearchedForHelper = TRUE;\n pvData = DetourFindPayloadEx(DETOUR_EXE_HELPER_GUID, &cbData);\n\n if (pvData == NULL || cbData < sizeof(DETOUR_EXE_HELPER)) {\n return FALSE;\n }\n\n s_pHelper = (PDETOUR_EXE_HELPER)pvData;\n if (s_pHelper->cb < sizeof(*s_pHelper)) {\n s_pHelper = NULL;\n return FALSE;\n }\n\n return TRUE;\n}\n\nstatic\nBOOL WINAPI AllocExeHelper(_Out_ PDETOUR_EXE_HELPER *pHelper,\n _In_ DWORD dwTargetPid,\n _In_ DWORD nDlls,\n _In_reads_(nDlls) LPCSTR *rlpDlls)\n{\n PDETOUR_EXE_HELPER Helper = NULL;\n BOOL Result = FALSE;\n _Field_range_(0, cSize - 4) DWORD cOffset = 0;\n DWORD cSize = 4;\n\n if (pHelper == NULL) {\n goto Cleanup;\n }\n *pHelper = NULL;\n\n if (nDlls < 1 || nDlls > 4096) {\n SetLastError(ERROR_INVALID_PARAMETER);\n goto Cleanup;\n }\n\n for (DWORD n = 0; n < nDlls; n++) {\n HRESULT hr;\n size_t cchDest = 0;\n\n hr = StringCchLengthA(rlpDlls[n], 4096, &cchDest);\n if (!SUCCEEDED(hr)) {\n goto Cleanup;\n }\n\n cSize += (DWORD)cchDest + 1;\n }\n\n Helper = (PDETOUR_EXE_HELPER) new NOTHROW BYTE[sizeof(DETOUR_EXE_HELPER) + cSize];\n if (Helper == NULL) {\n goto Cleanup;\n }\n\n Helper->cb = sizeof(DETOUR_EXE_HELPER) + cSize;\n Helper->pid = dwTargetPid;\n Helper->nDlls = nDlls;\n\n for (DWORD n = 0; n < nDlls; n++) {\n HRESULT hr;\n size_t cchDest = 0;\n\n if (cOffset > 0x10000 || cSize > 0x10000 || cOffset + 2 >= cSize) {\n goto Cleanup;\n }\n\n if (cOffset + 2 >= cSize || cOffset + 65536 < cSize) {\n goto Cleanup;\n }\n\n _Analysis_assume_(cOffset + 1 < cSize);\n _Analysis_assume_(cOffset < 0x10000);\n _Analysis_assume_(cSize < 0x10000);\n\n PCHAR psz = &Helper->rDlls[cOffset];\n\n hr = StringCchCopyA(psz, cSize - cOffset, rlpDlls[n]);\n if (!SUCCEEDED(hr)) {\n goto Cleanup;\n }\n\n// REVIEW 28020 The expression '1<=_Param_(2)& &_Param_(2)<=2147483647' is not true at this call.\n// REVIEW 28313 Analysis will not proceed past this point because of annotation evaluation. The annotation expression *_Param_(3)<_Param_(2)&&*_Param_(3)<=stringLength$(_Param_(1)) cannot be true under any assumptions at this point in the program.\n#pragma warning(suppress:28020 28313)\n hr = StringCchLengthA(psz, cSize - cOffset, &cchDest);\n if (!SUCCEEDED(hr)) {\n goto Cleanup;\n }\n\n // Replace \"32.\" with \"64.\" or \"64.\" with \"32.\"\n\n for (DWORD c = (DWORD)cchDest + 1; c > 3; c--) {\n#if DETOURS_32BIT\n if (psz[c - 3] == '3' && psz[c - 2] == '2' && psz[c - 1] == '.') {\n psz[c - 3] = '6'; psz[c - 2] = '4';\n break;\n }\n#else\n if (psz[c - 3] == '6' && psz[c - 2] == '4' && psz[c - 1] == '.') {\n psz[c - 3] = '3'; psz[c - 2] = '2';\n break;\n }\n#endif\n }\n\n cOffset += (DWORD)cchDest + 1;\n }\n\n *pHelper = Helper;\n Helper = NULL;\n Result = TRUE;\n\n Cleanup:\n if (Helper != NULL) {\n delete[] (PBYTE)Helper;\n Helper = NULL;\n }\n return Result;\n}\n\nstatic\nVOID WINAPI FreeExeHelper(PDETOUR_EXE_HELPER *pHelper)\n{\n if (*pHelper != NULL) {\n delete[] (PBYTE)*pHelper;\n *pHelper = NULL;\n }\n}\n\nBOOL WINAPI DetourProcessViaHelperA(_In_ DWORD dwTargetPid,\n _In_ LPCSTR lpDllName,\n _In_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA)\n{\n return DetourProcessViaHelperDllsA(dwTargetPid, 1, &lpDllName, pfCreateProcessA);\n}\n\n\nBOOL WINAPI DetourProcessViaHelperDllsA(_In_ DWORD dwTargetPid,\n _In_ DWORD nDlls,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA)\n{\n BOOL Result = FALSE;\n PROCESS_INFORMATION pi;\n STARTUPINFOA si;\n CHAR szExe[MAX_PATH];\n CHAR szCommand[MAX_PATH];\n PDETOUR_EXE_HELPER helper = NULL;\n HRESULT hr;\n DWORD nLen = GetEnvironmentVariableA(\"WINDIR\", szExe, ARRAYSIZE(szExe));\n\n DETOUR_TRACE((\"DetourProcessViaHelperDlls(pid=%lu,dlls=%lu)\\n\", dwTargetPid, nDlls));\n if (nDlls < 1 || nDlls > 4096) {\n SetLastError(ERROR_INVALID_PARAMETER);\n goto Cleanup;\n }\n if (!AllocExeHelper(&helper, dwTargetPid, nDlls, rlpDlls)) {\n goto Cleanup;\n }\n\n if (nLen == 0 || nLen >= ARRAYSIZE(szExe)) {\n goto Cleanup;\n }\n\n#if DETOURS_OPTION_BITS\n#if DETOURS_32BIT\n hr = StringCchCatA(szExe, ARRAYSIZE(szExe), \"\\\\sysnative\\\\rundll32.exe\");\n#else // !DETOURS_32BIT\n hr = StringCchCatA(szExe, ARRAYSIZE(szExe), \"\\\\syswow64\\\\rundll32.exe\");\n#endif // !DETOURS_32BIT\n#else // DETOURS_OPTIONS_BITS\n hr = StringCchCatA(szExe, ARRAYSIZE(szExe), \"\\\\system32\\\\rundll32.exe\");\n#endif // DETOURS_OPTIONS_BITS\n if (!SUCCEEDED(hr)) {\n goto Cleanup;\n }\n\n //for East Asia languages and so on, like Chinese, print format with \"%hs\" can not work fine before user call _tsetlocale(LC_ALL,_T(\".ACP\"));\n //so we can't use \"%hs\" in format string, because the dll that contain this code would inject to any process, even not call _tsetlocale(LC_ALL,_T(\".ACP\")) before\n hr = StringCchPrintfA(szCommand, ARRAYSIZE(szCommand),\n \"rundll32.exe \\\"%s\\\",#1\", &helper->rDlls[0]);\n if (!SUCCEEDED(hr)) {\n goto Cleanup;\n }\n\n ZeroMemory(&pi, sizeof(pi));\n ZeroMemory(&si, sizeof(si));\n si.cb = sizeof(si);\n\n DETOUR_TRACE((\"DetourProcessViaHelperDlls(\\\"%hs\\\", \\\"%hs\\\")\\n\", szExe, szCommand));\n if (pfCreateProcessA(szExe, szCommand, NULL, NULL, FALSE, CREATE_SUSPENDED,\n NULL, NULL, &si, &pi)) {\n\n if (!DetourCopyPayloadToProcess(pi.hProcess,\n DETOUR_EXE_HELPER_GUID,\n helper, helper->cb)) {\n DETOUR_TRACE((\"DetourCopyPayloadToProcess failed: %lu\\n\", GetLastError()));\n TerminateProcess(pi.hProcess, ~0u);\n CloseHandle(pi.hProcess);\n CloseHandle(pi.hThread);\n goto Cleanup;\n }\n\n ResumeThread(pi.hThread);\n WaitForSingleObject(pi.hProcess, INFINITE);\n\n DWORD dwResult = 500;\n GetExitCodeProcess(pi.hProcess, &dwResult);\n\n CloseHandle(pi.hProcess);\n CloseHandle(pi.hThread);\n\n if (dwResult != 0) {\n DETOUR_TRACE((\"Rundll32.exe failed: result=%lu\\n\", dwResult));\n goto Cleanup;\n }\n Result = TRUE;\n }\n else {\n DETOUR_TRACE((\"CreateProcess failed: %lu\\n\", GetLastError()));\n goto Cleanup;\n }\n\n Cleanup:\n FreeExeHelper(&helper);\n return Result;\n}\n\nBOOL WINAPI DetourProcessViaHelperW(_In_ DWORD dwTargetPid,\n _In_ LPCSTR lpDllName,\n _In_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW)\n{\n return DetourProcessViaHelperDllsW(dwTargetPid, 1, &lpDllName, pfCreateProcessW);\n}\n\nBOOL WINAPI DetourProcessViaHelperDllsW(_In_ DWORD dwTargetPid,\n _In_ DWORD nDlls,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW)\n{\n BOOL Result = FALSE;\n PROCESS_INFORMATION pi;\n STARTUPINFOW si;\n WCHAR szExe[MAX_PATH];\n WCHAR szCommand[MAX_PATH];\n PDETOUR_EXE_HELPER helper = NULL;\n HRESULT hr;\n WCHAR szDllName[MAX_PATH];\n int cchWrittenWideChar;\n DWORD nLen = GetEnvironmentVariableW(L\"WINDIR\", szExe, ARRAYSIZE(szExe));\n\n DETOUR_TRACE((\"DetourProcessViaHelperDlls(pid=%lu,dlls=%lu)\\n\", dwTargetPid, nDlls));\n if (nDlls < 1 || nDlls > 4096) {\n SetLastError(ERROR_INVALID_PARAMETER);\n goto Cleanup;\n }\n if (!AllocExeHelper(&helper, dwTargetPid, nDlls, rlpDlls)) {\n goto Cleanup;\n }\n\n if (nLen == 0 || nLen >= ARRAYSIZE(szExe)) {\n goto Cleanup;\n }\n\n#if DETOURS_OPTION_BITS\n#if DETOURS_32BIT\n hr = StringCchCatW(szExe, ARRAYSIZE(szExe), L\"\\\\sysnative\\\\rundll32.exe\");\n#else // !DETOURS_32BIT\n hr = StringCchCatW(szExe, ARRAYSIZE(szExe), L\"\\\\syswow64\\\\rundll32.exe\");\n#endif // !DETOURS_32BIT\n#else // DETOURS_OPTIONS_BITS\n hr = StringCchCatW(szExe, ARRAYSIZE(szExe), L\"\\\\system32\\\\rundll32.exe\");\n#endif // DETOURS_OPTIONS_BITS\n if (!SUCCEEDED(hr)) {\n goto Cleanup;\n }\n\n //for East Asia languages and so on, like Chinese, print format with \"%hs\" can not work fine before user call _tsetlocale(LC_ALL,_T(\".ACP\"));\n //so we can't use \"%hs\" in format string, because the dll that contain this code would inject to any process, even not call _tsetlocale(LC_ALL,_T(\".ACP\")) before\n \n cchWrittenWideChar = MultiByteToWideChar(CP_ACP, 0, &helper->rDlls[0], -1, szDllName, ARRAYSIZE(szDllName));\n if (cchWrittenWideChar >= ARRAYSIZE(szDllName) || cchWrittenWideChar <= 0) {\n goto Cleanup;\n }\n hr = StringCchPrintfW(szCommand, ARRAYSIZE(szCommand),\n L\"rundll32.exe \\\"%s\\\",#1\", szDllName);\n if (!SUCCEEDED(hr)) {\n goto Cleanup;\n }\n\n ZeroMemory(&pi, sizeof(pi));\n ZeroMemory(&si, sizeof(si));\n si.cb = sizeof(si);\n\n DETOUR_TRACE((\"DetourProcessViaHelperDlls(\\\"%ls\\\", \\\"%ls\\\")\\n\", szExe, szCommand));\n if (pfCreateProcessW(szExe, szCommand, NULL, NULL, FALSE, CREATE_SUSPENDED,\n NULL, NULL, &si, &pi)) {\n\n if (!DetourCopyPayloadToProcess(pi.hProcess,\n DETOUR_EXE_HELPER_GUID,\n helper, helper->cb)) {\n DETOUR_TRACE((\"DetourCopyPayloadToProcess failed: %lu\\n\", GetLastError()));\n TerminateProcess(pi.hProcess, ~0u);\n CloseHandle(pi.hProcess);\n CloseHandle(pi.hThread);\n goto Cleanup;\n }\n\n ResumeThread(pi.hThread);\n WaitForSingleObject(pi.hProcess, INFINITE);\n\n DWORD dwResult = 500;\n GetExitCodeProcess(pi.hProcess, &dwResult);\n\n CloseHandle(pi.hProcess);\n CloseHandle(pi.hThread);\n\n if (dwResult != 0) {\n DETOUR_TRACE((\"Rundll32.exe failed: result=%lu\\n\", dwResult));\n goto Cleanup;\n }\n Result = TRUE;\n }\n else {\n DETOUR_TRACE((\"CreateProcess failed: %lu\\n\", GetLastError()));\n goto Cleanup;\n }\n\n Cleanup:\n FreeExeHelper(&helper);\n return Result;\n}\n\nBOOL WINAPI DetourCreateProcessWithDllExA(_In_opt_ LPCSTR lpApplicationName,\n _Inout_opt_ LPSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOA lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ LPCSTR lpDllName,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA)\n{\n if (pfCreateProcessA == NULL) {\n pfCreateProcessA = CreateProcessA;\n }\n\n PROCESS_INFORMATION backup;\n if (lpProcessInformation == NULL) {\n lpProcessInformation = &backup;\n ZeroMemory(&backup, sizeof(backup));\n }\n\n if (!pfCreateProcessA(lpApplicationName,\n lpCommandLine,\n lpProcessAttributes,\n lpThreadAttributes,\n bInheritHandles,\n dwCreationFlags | CREATE_SUSPENDED,\n lpEnvironment,\n lpCurrentDirectory,\n lpStartupInfo,\n lpProcessInformation)) {\n return FALSE;\n }\n\n LPCSTR szDll = lpDllName;\n\n if (!DetourUpdateProcessWithDll(lpProcessInformation->hProcess, &szDll, 1) &&\n !DetourProcessViaHelperA(lpProcessInformation->dwProcessId,\n lpDllName,\n pfCreateProcessA)) {\n\n TerminateProcess(lpProcessInformation->hProcess, ~0u);\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n return FALSE;\n }\n\n if (!(dwCreationFlags & CREATE_SUSPENDED)) {\n ResumeThread(lpProcessInformation->hThread);\n }\n\n if (lpProcessInformation == &backup) {\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n }\n\n return TRUE;\n}\n\nBOOL WINAPI DetourCreateProcessWithDllExW(_In_opt_ LPCWSTR lpApplicationName,\n _Inout_opt_ LPWSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCWSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOW lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ LPCSTR lpDllName,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW)\n{\n if (pfCreateProcessW == NULL) {\n pfCreateProcessW = CreateProcessW;\n }\n\n PROCESS_INFORMATION backup;\n if (lpProcessInformation == NULL) {\n lpProcessInformation = &backup;\n ZeroMemory(&backup, sizeof(backup));\n }\n\n if (!pfCreateProcessW(lpApplicationName,\n lpCommandLine,\n lpProcessAttributes,\n lpThreadAttributes,\n bInheritHandles,\n dwCreationFlags | CREATE_SUSPENDED,\n lpEnvironment,\n lpCurrentDirectory,\n lpStartupInfo,\n lpProcessInformation)) {\n return FALSE;\n }\n\n\n LPCSTR sz = lpDllName;\n\n if (!DetourUpdateProcessWithDll(lpProcessInformation->hProcess, &sz, 1) &&\n !DetourProcessViaHelperW(lpProcessInformation->dwProcessId,\n lpDllName,\n pfCreateProcessW)) {\n\n TerminateProcess(lpProcessInformation->hProcess, ~0u);\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n return FALSE;\n }\n\n if (!(dwCreationFlags & CREATE_SUSPENDED)) {\n ResumeThread(lpProcessInformation->hThread);\n }\n\n if (lpProcessInformation == &backup) {\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n }\n return TRUE;\n}\n\nBOOL WINAPI DetourCreateProcessWithDllsA(_In_opt_ LPCSTR lpApplicationName,\n _Inout_opt_ LPSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOA lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ DWORD nDlls,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA)\n{\n if (pfCreateProcessA == NULL) {\n pfCreateProcessA = CreateProcessA;\n }\n\n PROCESS_INFORMATION backup;\n if (lpProcessInformation == NULL) {\n lpProcessInformation = &backup;\n ZeroMemory(&backup, sizeof(backup));\n }\n\n if (!pfCreateProcessA(lpApplicationName,\n lpCommandLine,\n lpProcessAttributes,\n lpThreadAttributes,\n bInheritHandles,\n dwCreationFlags | CREATE_SUSPENDED,\n lpEnvironment,\n lpCurrentDirectory,\n lpStartupInfo,\n lpProcessInformation)) {\n return FALSE;\n }\n\n if (!DetourUpdateProcessWithDll(lpProcessInformation->hProcess, rlpDlls, nDlls) &&\n !DetourProcessViaHelperDllsA(lpProcessInformation->dwProcessId,\n nDlls,\n rlpDlls,\n pfCreateProcessA)) {\n\n TerminateProcess(lpProcessInformation->hProcess, ~0u);\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n return FALSE;\n }\n\n if (!(dwCreationFlags & CREATE_SUSPENDED)) {\n ResumeThread(lpProcessInformation->hThread);\n }\n\n if (lpProcessInformation == &backup) {\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n }\n\n return TRUE;\n}\n\nBOOL WINAPI DetourCreateProcessWithDllsW(_In_opt_ LPCWSTR lpApplicationName,\n _Inout_opt_ LPWSTR lpCommandLine,\n _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,\n _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,\n _In_ BOOL bInheritHandles,\n _In_ DWORD dwCreationFlags,\n _In_opt_ LPVOID lpEnvironment,\n _In_opt_ LPCWSTR lpCurrentDirectory,\n _In_ LPSTARTUPINFOW lpStartupInfo,\n _Out_ LPPROCESS_INFORMATION lpProcessInformation,\n _In_ DWORD nDlls,\n _In_reads_(nDlls) LPCSTR *rlpDlls,\n _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW)\n{\n if (pfCreateProcessW == NULL) {\n pfCreateProcessW = CreateProcessW;\n }\n\n PROCESS_INFORMATION backup;\n if (lpProcessInformation == NULL) {\n lpProcessInformation = &backup;\n ZeroMemory(&backup, sizeof(backup));\n }\n\n if (!pfCreateProcessW(lpApplicationName,\n lpCommandLine,\n lpProcessAttributes,\n lpThreadAttributes,\n bInheritHandles,\n dwCreationFlags | CREATE_SUSPENDED,\n lpEnvironment,\n lpCurrentDirectory,\n lpStartupInfo,\n lpProcessInformation)) {\n return FALSE;\n }\n\n\n if (!DetourUpdateProcessWithDll(lpProcessInformation->hProcess, rlpDlls, nDlls) &&\n !DetourProcessViaHelperDllsW(lpProcessInformation->dwProcessId,\n nDlls,\n rlpDlls,\n pfCreateProcessW)) {\n\n TerminateProcess(lpProcessInformation->hProcess, ~0u);\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n return FALSE;\n }\n\n if (!(dwCreationFlags & CREATE_SUSPENDED)) {\n ResumeThread(lpProcessInformation->hThread);\n }\n\n if (lpProcessInformation == &backup) {\n CloseHandle(lpProcessInformation->hProcess);\n CloseHandle(lpProcessInformation->hThread);\n }\n return TRUE;\n}\n\n//\n///////////////////////////////////////////////////////////////// End of File.\n"
},
{
"path": "001.NVL/BKEngine/BKEFileNameDumper/Detours/detours.cpp",
"content": "//////////////////////////////////////////////////////////////////////////////\n//\n// Core Detours Functionality (detours.cpp of detours.lib)\n//\n// Microsoft Research Detours Package, Version 4.0.1\n//\n// Copyright (c) Microsoft Corporation. All rights reserved.\n//\n\n\n//#define DETOUR_DEBUG 1\n#define DETOURS_INTERNAL\n#include \"detours.h\"\n\n#if DETOURS_VERSION != 0x4c0c1 // 0xMAJORcMINORcPATCH\n#error detours.h version mismatch\n#endif\n\n#define NOTHROW\n\n//////////////////////////////////////////////////////////////////////////////\n//\n\n#ifdef _DEBUG\nextern \"C\" IMAGE_DOS_HEADER __ImageBase;\nint Detour_AssertExprWithFunctionName(int reportType, const char* filename, int linenumber, const char* FunctionName, const char* msg)\n{\n int nRet = 0;\n DWORD dwLastError = GetLastError();\n CHAR szModuleNameWithFunctionName[MAX_PATH * 2];\n szModuleNameWithFunctionName[0] = 0;\n GetModuleFileNameA((HMODULE)&__ImageBase, szModuleNameWithFunctionName, ARRAYSIZE(szModuleNameWithFunctionName));\n StringCchCatNA(szModuleNameWithFunctionName, ARRAYSIZE(szModuleNameWithFunctionName), \",\", ARRAYSIZE(szModuleNameWithFunctionName) - strlen(szModuleNameWithFunctionName) - 1);\n StringCchCatNA(szModuleNameWithFunctionName, ARRAYSIZE(szModuleNameWithFunctionName), FunctionName, ARRAYSIZE(szModuleNameWithFunctionName) - strlen(szModuleNameWithFunctionName) - 1);\n SetLastError(dwLastError);\n nRet = _CrtDbgReport(reportType, filename, linenumber, szModuleNameWithFunctionName, msg);\n SetLastError(dwLastError);\n return nRet;\n}\n#endif// _DEBUG\n\n//////////////////////////////////////////////////////////////////////////////\n//\nstruct _DETOUR_ALIGN\n{\n BYTE obTarget : 3;\n BYTE obTrampoline : 5;\n};\n\nC_ASSERT(sizeof(_DETOUR_ALIGN) == 1);\n\n//////////////////////////////////////////////////////////////////////////////\n//\n// Region reserved for system DLLs, which cannot be used for trampolines.\n//\nstatic PVOID s_pSystemRegionLowerBound = (PVOID)(ULONG_PTR)0x70000000;\nstatic PVOID s_pSystemRegionUpperBound = (PVOID)(ULONG_PTR)0x80000000;\n\n//////////////////////////////////////////////////////////////////////////////\n//\nstatic bool detour_is_imported(PBYTE pbCode, PBYTE pbAddress)\n{\n MEMORY_BASIC_INFORMATION mbi;\n VirtualQuery((PVOID)pbCode, &mbi, sizeof(mbi));\n __try {\n PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)mbi.AllocationBase;\n if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {\n return false;\n }\n\n PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader +\n pDosHeader->e_lfanew);\n if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) {\n return false;\n }\n\n if (pbAddress >= ((PBYTE)pDosHeader +\n pNtHeader->OptionalHeader\n .DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress) &&\n pbAddress < ((PBYTE)pDosHeader +\n pNtHeader->OptionalHeader\n .DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress +\n pNtHeader->OptionalHeader\n .DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size)) {\n return true;\n }\n }\n#pragma prefast(suppress:28940, \"A bad pointer means this probably isn't a PE header.\")\n __except(GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ?\n EXCEPTION_EXECUTE_HANDLER : EXCEPTION_CONTINUE_SEARCH) {\n return false;\n }\n return false;\n}\n\ninline ULONG_PTR detour_2gb_below(ULONG_PTR address)\n{\n return (address > (ULONG_PTR)0x7ff80000) ? address - 0x7ff80000 : 0x80000;\n}\n\ninline ULONG_PTR detour_2gb_above(ULONG_PTR address)\n{\n#if defined(DETOURS_64BIT)\n return (address < (ULONG_PTR)0xffffffff80000000) ? address + 0x7ff80000 : (ULONG_PTR)0xfffffffffff80000;\n#else\n return (address < (ULONG_PTR)0x80000000) ? address + 0x7ff80000 : (ULONG_PTR)0xfff80000;\n#endif\n}\n\n///////////////////////////////////////////////////////////////////////// X86.\n//\n#ifdef DETOURS_X86\n\nstruct _DETOUR_TRAMPOLINE\n{\n BYTE rbCode[30]; // target code + jmp to pbRemain\n BYTE cbCode; // size of moved target code.\n BYTE cbCodeBreak; // padding to make debugging easier.\n BYTE rbRestore[22]; // original target code.\n BYTE cbRestore; // size of original target code.\n BYTE cbRestoreBreak; // padding to make debugging easier.\n _DETOUR_ALIGN rAlign[8]; // instruction alignment array.\n PBYTE pbRemain; // first instruction after moved code. [free list]\n PBYTE pbDetour; // first instruction of detour function.\n};\n\nC_ASSERT(sizeof(_DETOUR_TRAMPOLINE) == 72);\n\nenum {\n SIZE_OF_JMP = 5\n};\n\ninline PBYTE detour_gen_jmp_immediate(PBYTE pbCode, PBYTE pbJmpVal)\n{\n PBYTE pbJmpSrc = pbCode + 5;\n *pbCode++ = 0xE9; // jmp +imm32\n *((INT32*&)pbCode)++ = (INT32)(pbJmpVal - pbJmpSrc);\n return pbCode;\n}\n\ninline PBYTE detour_gen_jmp_indirect(PBYTE pbCode, PBYTE *ppbJmpVal)\n{\n *pbCode++ = 0xff; // jmp [+imm32]\n *pbCode++ = 0x25;\n *((INT32*&)pbCode)++ = (INT32)((PBYTE)ppbJmpVal);\n return pbCode;\n}\n\ninline PBYTE detour_gen_brk(PBYTE pbCode, PBYTE pbLimit)\n{\n while (pbCode < pbLimit) {\n *pbCode++ = 0xcc; // brk;\n }\n return pbCode;\n}\n\ninline PBYTE detour_skip_jmp(PBYTE pbCode, PVOID *ppGlobals)\n{\n if (pbCode == NULL) {\n return NULL;\n }\n if (ppGlobals != NULL) {\n *ppGlobals = NULL;\n }\n\n // First, skip over the import vector if there is one.\n if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [imm32]\n // Looks like an import alias jump, then get the code it points to.\n PBYTE pbTarget = *(UNALIGNED PBYTE *)&pbCode[2];\n if (detour_is_imported(pbCode, pbTarget)) {\n PBYTE pbNew = *(UNALIGNED PBYTE *)pbTarget;\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n\n // Then, skip over a patch jump\n if (pbCode[0] == 0xeb) { // jmp +imm8\n PBYTE pbNew = pbCode + 2 + *(CHAR *)&pbCode[1];\n DETOUR_TRACE((\"%p->%p: skipped over short jump.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n\n // First, skip over the import vector if there is one.\n if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [imm32]\n // Looks like an import alias jump, then get the code it points to.\n PBYTE pbTarget = *(UNALIGNED PBYTE *)&pbCode[2];\n if (detour_is_imported(pbCode, pbTarget)) {\n pbNew = *(UNALIGNED PBYTE *)pbTarget;\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n // Finally, skip over a long jump if it is the target of the patch jump.\n else if (pbCode[0] == 0xe9) { // jmp +imm32\n pbNew = pbCode + 5 + *(UNALIGNED INT32 *)&pbCode[1];\n DETOUR_TRACE((\"%p->%p: skipped over long jump.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n return pbCode;\n}\n\ninline void detour_find_jmp_bounds(PBYTE pbCode,\n PDETOUR_TRAMPOLINE *ppLower,\n PDETOUR_TRAMPOLINE *ppUpper)\n{\n // We have to place trampolines within +/- 2GB of code.\n ULONG_PTR lo = detour_2gb_below((ULONG_PTR)pbCode);\n ULONG_PTR hi = detour_2gb_above((ULONG_PTR)pbCode);\n DETOUR_TRACE((\"[%p..%p..%p]\\n\", (PVOID)lo, pbCode, (PVOID)hi));\n\n // And, within +/- 2GB of relative jmp targets.\n if (pbCode[0] == 0xe9) { // jmp +imm32\n PBYTE pbNew = pbCode + 5 + *(UNALIGNED INT32 *)&pbCode[1];\n\n if (pbNew < pbCode) {\n hi = detour_2gb_above((ULONG_PTR)pbNew);\n }\n else {\n lo = detour_2gb_below((ULONG_PTR)pbNew);\n }\n DETOUR_TRACE((\"[%p..%p..%p] +imm32\\n\", (PVOID)lo, pbCode, (PVOID)hi));\n }\n\n *ppLower = (PDETOUR_TRAMPOLINE)lo;\n *ppUpper = (PDETOUR_TRAMPOLINE)hi;\n}\n\ninline BOOL detour_does_code_end_function(PBYTE pbCode)\n{\n if (pbCode[0] == 0xeb || // jmp +imm8\n pbCode[0] == 0xe9 || // jmp +imm32\n pbCode[0] == 0xe0 || // jmp eax\n pbCode[0] == 0xc2 || // ret +imm8\n pbCode[0] == 0xc3 || // ret\n pbCode[0] == 0xcc) { // brk\n return TRUE;\n }\n else if (pbCode[0] == 0xf3 && pbCode[1] == 0xc3) { // rep ret\n return TRUE;\n }\n else if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [+imm32]\n return TRUE;\n }\n else if ((pbCode[0] == 0x26 || // jmp es:\n pbCode[0] == 0x2e || // jmp cs:\n pbCode[0] == 0x36 || // jmp ss:\n pbCode[0] == 0x3e || // jmp ds:\n pbCode[0] == 0x64 || // jmp fs:\n pbCode[0] == 0x65) && // jmp gs:\n pbCode[1] == 0xff && // jmp [+imm32]\n pbCode[2] == 0x25) {\n return TRUE;\n }\n return FALSE;\n}\n\ninline ULONG detour_is_code_filler(PBYTE pbCode)\n{\n // 1-byte through 11-byte NOPs.\n if (pbCode[0] == 0x90) {\n return 1;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x90) {\n return 2;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x00) {\n return 3;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x40 &&\n pbCode[3] == 0x00) {\n return 4;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x44 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00) {\n return 5;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x0F && pbCode[2] == 0x1F &&\n pbCode[3] == 0x44 && pbCode[4] == 0x00 && pbCode[5] == 0x00) {\n return 6;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x80 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00) {\n return 7;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x84 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00) {\n return 8;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x0F && pbCode[2] == 0x1F &&\n pbCode[3] == 0x84 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00) {\n return 9;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x66 && pbCode[2] == 0x0F &&\n pbCode[3] == 0x1F && pbCode[4] == 0x84 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00 &&\n pbCode[9] == 0x00) {\n return 10;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x66 && pbCode[2] == 0x66 &&\n pbCode[3] == 0x0F && pbCode[4] == 0x1F && pbCode[5] == 0x84 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00 &&\n pbCode[9] == 0x00 && pbCode[10] == 0x00) {\n return 11;\n }\n\n // int 3.\n if (pbCode[0] == 0xcc) {\n return 1;\n }\n return 0;\n}\n\n#endif // DETOURS_X86\n\n///////////////////////////////////////////////////////////////////////// X64.\n//\n#ifdef DETOURS_X64\n\nstruct _DETOUR_TRAMPOLINE\n{\n // An X64 instuction can be 15 bytes long.\n // In practice 11 seems to be the limit.\n BYTE rbCode[30]; // target code + jmp to pbRemain.\n BYTE cbCode; // size of moved target code.\n BYTE cbCodeBreak; // padding to make debugging easier.\n BYTE rbRestore[30]; // original target code.\n BYTE cbRestore; // size of original target code.\n BYTE cbRestoreBreak; // padding to make debugging easier.\n _DETOUR_ALIGN rAlign[8]; // instruction alignment array.\n PBYTE pbRemain; // first instruction after moved code. [free list]\n PBYTE pbDetour; // first instruction of detour function.\n BYTE rbCodeIn[8]; // jmp [pbDetour]\n};\n\nC_ASSERT(sizeof(_DETOUR_TRAMPOLINE) == 96);\n\nenum {\n SIZE_OF_JMP = 5\n};\n\ninline PBYTE detour_gen_jmp_immediate(PBYTE pbCode, PBYTE pbJmpVal)\n{\n PBYTE pbJmpSrc = pbCode + 5;\n *pbCode++ = 0xE9; // jmp +imm32\n *((INT32*&)pbCode)++ = (INT32)(pbJmpVal - pbJmpSrc);\n return pbCode;\n}\n\ninline PBYTE detour_gen_jmp_indirect(PBYTE pbCode, PBYTE *ppbJmpVal)\n{\n PBYTE pbJmpSrc = pbCode + 6;\n *pbCode++ = 0xff; // jmp [+imm32]\n *pbCode++ = 0x25;\n *((INT32*&)pbCode)++ = (INT32)((PBYTE)ppbJmpVal - pbJmpSrc);\n return pbCode;\n}\n\ninline PBYTE detour_gen_brk(PBYTE pbCode, PBYTE pbLimit)\n{\n while (pbCode < pbLimit) {\n *pbCode++ = 0xcc; // brk;\n }\n return pbCode;\n}\n\ninline PBYTE detour_skip_jmp(PBYTE pbCode, PVOID *ppGlobals)\n{\n if (pbCode == NULL) {\n return NULL;\n }\n if (ppGlobals != NULL) {\n *ppGlobals = NULL;\n }\n\n // First, skip over the import vector if there is one.\n if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [+imm32]\n // Looks like an import alias jump, then get the code it points to.\n PBYTE pbTarget = pbCode + 6 + *(UNALIGNED INT32 *)&pbCode[2];\n if (detour_is_imported(pbCode, pbTarget)) {\n PBYTE pbNew = *(UNALIGNED PBYTE *)pbTarget;\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n\n // Then, skip over a patch jump\n if (pbCode[0] == 0xeb) { // jmp +imm8\n PBYTE pbNew = pbCode + 2 + *(CHAR *)&pbCode[1];\n DETOUR_TRACE((\"%p->%p: skipped over short jump.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n\n // First, skip over the import vector if there is one.\n if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [+imm32]\n // Looks like an import alias jump, then get the code it points to.\n PBYTE pbTarget = pbCode + 6 + *(UNALIGNED INT32 *)&pbCode[2];\n if (detour_is_imported(pbCode, pbTarget)) {\n pbNew = *(UNALIGNED PBYTE *)pbTarget;\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n // Finally, skip over a long jump if it is the target of the patch jump.\n else if (pbCode[0] == 0xe9) { // jmp +imm32\n pbNew = pbCode + 5 + *(UNALIGNED INT32 *)&pbCode[1];\n DETOUR_TRACE((\"%p->%p: skipped over long jump.\\n\", pbCode, pbNew));\n pbCode = pbNew;\n }\n }\n return pbCode;\n}\n\ninline void detour_find_jmp_bounds(PBYTE pbCode,\n PDETOUR_TRAMPOLINE *ppLower,\n PDETOUR_TRAMPOLINE *ppUpper)\n{\n // We have to place trampolines within +/- 2GB of code.\n ULONG_PTR lo = detour_2gb_below((ULONG_PTR)pbCode);\n ULONG_PTR hi = detour_2gb_above((ULONG_PTR)pbCode);\n DETOUR_TRACE((\"[%p..%p..%p]\\n\", (PVOID)lo, pbCode, (PVOID)hi));\n\n // And, within +/- 2GB of relative jmp vectors.\n if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [+imm32]\n PBYTE pbNew = pbCode + 6 + *(UNALIGNED INT32 *)&pbCode[2];\n\n if (pbNew < pbCode) {\n hi = detour_2gb_above((ULONG_PTR)pbNew);\n }\n else {\n lo = detour_2gb_below((ULONG_PTR)pbNew);\n }\n DETOUR_TRACE((\"[%p..%p..%p] [+imm32]\\n\", (PVOID)lo, pbCode, (PVOID)hi));\n }\n // And, within +/- 2GB of relative jmp targets.\n else if (pbCode[0] == 0xe9) { // jmp +imm32\n PBYTE pbNew = pbCode + 5 + *(UNALIGNED INT32 *)&pbCode[1];\n\n if (pbNew < pbCode) {\n hi = detour_2gb_above((ULONG_PTR)pbNew);\n }\n else {\n lo = detour_2gb_below((ULONG_PTR)pbNew);\n }\n DETOUR_TRACE((\"[%p..%p..%p] +imm32\\n\", (PVOID)lo, pbCode, (PVOID)hi));\n }\n\n *ppLower = (PDETOUR_TRAMPOLINE)lo;\n *ppUpper = (PDETOUR_TRAMPOLINE)hi;\n}\n\ninline BOOL detour_does_code_end_function(PBYTE pbCode)\n{\n if (pbCode[0] == 0xeb || // jmp +imm8\n pbCode[0] == 0xe9 || // jmp +imm32\n pbCode[0] == 0xe0 || // jmp eax\n pbCode[0] == 0xc2 || // ret +imm8\n pbCode[0] == 0xc3 || // ret\n pbCode[0] == 0xcc) { // brk\n return TRUE;\n }\n else if (pbCode[0] == 0xf3 && pbCode[1] == 0xc3) { // rep ret\n return TRUE;\n }\n else if (pbCode[0] == 0xff && pbCode[1] == 0x25) { // jmp [+imm32]\n return TRUE;\n }\n else if ((pbCode[0] == 0x26 || // jmp es:\n pbCode[0] == 0x2e || // jmp cs:\n pbCode[0] == 0x36 || // jmp ss:\n pbCode[0] == 0x3e || // jmp ds:\n pbCode[0] == 0x64 || // jmp fs:\n pbCode[0] == 0x65) && // jmp gs:\n pbCode[1] == 0xff && // jmp [+imm32]\n pbCode[2] == 0x25) {\n return TRUE;\n }\n return FALSE;\n}\n\ninline ULONG detour_is_code_filler(PBYTE pbCode)\n{\n // 1-byte through 11-byte NOPs.\n if (pbCode[0] == 0x90) {\n return 1;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x90) {\n return 2;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x00) {\n return 3;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x40 &&\n pbCode[3] == 0x00) {\n return 4;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x44 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00) {\n return 5;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x0F && pbCode[2] == 0x1F &&\n pbCode[3] == 0x44 && pbCode[4] == 0x00 && pbCode[5] == 0x00) {\n return 6;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x80 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00) {\n return 7;\n }\n if (pbCode[0] == 0x0F && pbCode[1] == 0x1F && pbCode[2] == 0x84 &&\n pbCode[3] == 0x00 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00) {\n return 8;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x0F && pbCode[2] == 0x1F &&\n pbCode[3] == 0x84 && pbCode[4] == 0x00 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00) {\n return 9;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x66 && pbCode[2] == 0x0F &&\n pbCode[3] == 0x1F && pbCode[4] == 0x84 && pbCode[5] == 0x00 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00 &&\n pbCode[9] == 0x00) {\n return 10;\n }\n if (pbCode[0] == 0x66 && pbCode[1] == 0x66 && pbCode[2] == 0x66 &&\n pbCode[3] == 0x0F && pbCode[4] == 0x1F && pbCode[5] == 0x84 &&\n pbCode[6] == 0x00 && pbCode[7] == 0x00 && pbCode[8] == 0x00 &&\n pbCode[9] == 0x00 && pbCode[10] == 0x00) {\n return 11;\n }\n\n // int 3.\n if (pbCode[0] == 0xcc) {\n return 1;\n }\n return 0;\n}\n\n#endif // DETOURS_X64\n\n//////////////////////////////////////////////////////////////////////// IA64.\n//\n#ifdef DETOURS_IA64\n\nstruct _DETOUR_TRAMPOLINE\n{\n // On the IA64, a trampoline is used for both incoming and outgoing calls.\n //\n // The trampoline contains the following bundles for the outgoing call:\n // movl gp=target_gp;\n // \n // brl target_code;\n //\n // The trampoline contains the following bundles for the incoming call:\n // alloc r41=ar.pfs, b, 0, 8, 0\n // mov r40=rp\n //\n // adds r50=0, r39\n // adds r49=0, r38\n // adds r48=0, r37 ;;\n //\n // adds r47=0, r36\n // adds r46=0, r35\n // adds r45=0, r34\n //\n // adds r44=0, r33\n // adds r43=0, r32\n // adds r42=0, gp ;;\n //\n // movl gp=ffffffff`ffffffff ;;\n //\n // brl.call.sptk.few rp=disas!TestCodes+20e0 (00000000`00404ea0) ;;\n //\n // adds gp=0, r42\n // mov rp=r40, +0 ;;\n // mov.i ar.pfs=r41\n //\n // br.ret.sptk.many rp ;;\n //\n // This way, we only have to relocate a single bundle.\n //\n // The complicated incoming trampoline is required because we have to\n // create an additional stack frame so that we save and restore the gp.\n // We must do this because gp is a caller-saved register, but not saved\n // if the caller thinks the target is in the same DLL, which changes\n // when we insert a detour.\n //\n DETOUR_IA64_BUNDLE bMovlTargetGp; // Bundle which sets target GP\n BYTE rbCode[sizeof(DETOUR_IA64_BUNDLE)]; // moved bundle.\n DETOUR_IA64_BUNDLE bBrlRemainEip; // Brl to pbRemain\n // This must be adjacent to bBranchIslands.\n\n // Each instruction in the moved bundle could be a IP-relative chk or branch or call.\n // Any such instructions are changed to point to a brl in bBranchIslands.\n // This must be adjacent to bBrlRemainEip -- see \"pbPool\".\n DETOUR_IA64_BUNDLE bBranchIslands[DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE];\n\n // Target of brl inserted in target function\n DETOUR_IA64_BUNDLE bAllocFrame; // alloc frame\n DETOUR_IA64_BUNDLE bSave37to39; // save r37, r38, r39.\n DETOUR_IA64_BUNDLE bSave34to36; // save r34, r35, r36.\n DETOUR_IA64_BUNDLE bSaveGPto33; // save gp, r32, r33.\n DETOUR_IA64_BUNDLE bMovlDetourGp; // set detour GP.\n DETOUR_IA64_BUNDLE bCallDetour; // call detour.\n DETOUR_IA64_BUNDLE bPopFrameGp; // pop frame and restore gp.\n DETOUR_IA64_BUNDLE bReturn; // return to caller.\n\n PLABEL_DESCRIPTOR pldTrampoline;\n\n BYTE rbRestore[sizeof(DETOUR_IA64_BUNDLE)]; // original target bundle.\n BYTE cbRestore; // size of original target code.\n BYTE cbCode; // size of moved target code.\n _DETOUR_ALIGN rAlign[14]; // instruction alignment array.\n PBYTE pbRemain; // first instruction after moved code. [free list]\n PBYTE pbDetour; // first instruction of detour function.\n PPLABEL_DESCRIPTOR ppldDetour; // [pbDetour,gpDetour]\n PPLABEL_DESCRIPTOR ppldTarget; // [pbTarget,gpDetour]\n};\n\nC_ASSERT(sizeof(DETOUR_IA64_BUNDLE) == 16);\nC_ASSERT(sizeof(_DETOUR_TRAMPOLINE) == 256 + DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE * 16);\n\nenum {\n SIZE_OF_JMP = sizeof(DETOUR_IA64_BUNDLE)\n};\n\ninline PBYTE detour_skip_jmp(PBYTE pPointer, PVOID *ppGlobals)\n{\n PBYTE pGlobals = NULL;\n PBYTE pbCode = NULL;\n\n if (pPointer != NULL) {\n PPLABEL_DESCRIPTOR ppld = (PPLABEL_DESCRIPTOR)pPointer;\n pbCode = (PBYTE)ppld->EntryPoint;\n pGlobals = (PBYTE)ppld->GlobalPointer;\n }\n if (ppGlobals != NULL) {\n *ppGlobals = pGlobals;\n }\n if (pbCode == NULL) {\n return NULL;\n }\n\n DETOUR_IA64_BUNDLE *pb = (DETOUR_IA64_BUNDLE *)pbCode;\n\n // IA64 Local Import Jumps look like:\n // addl r2=ffffffff`ffe021c0, gp ;;\n // ld8 r2=[r2]\n // nop.i 0 ;;\n //\n // ld8 r3=[r2], 8 ;;\n // ld8 gp=[r2]\n // mov b6=r3, +0\n //\n // nop.m 0\n // nop.i 0\n // br.cond.sptk.few b6\n //\n\n // 002024000200100b\n if ((pb[0].wide[0] & 0xfffffc000603ffff) == 0x002024000200100b &&\n pb[0].wide[1] == 0x0004000000203008 &&\n pb[1].wide[0] == 0x001014180420180a &&\n pb[1].wide[1] == 0x07000830c0203008 &&\n pb[2].wide[0] == 0x0000000100000010 &&\n pb[2].wide[1] == 0x0080006000000200) {\n\n ULONG64 offset =\n ((pb[0].wide[0] & 0x0000000001fc0000) >> 18) | // imm7b\n ((pb[0].wide[0] & 0x000001ff00000000) >> 25) | // imm9d\n ((pb[0].wide[0] & 0x00000000f8000000) >> 11); // imm5c\n if (pb[0].wide[0] & 0x0000020000000000) { // sign\n offset |= 0xffffffffffe00000;\n }\n PBYTE pbTarget = pGlobals + offset;\n DETOUR_TRACE((\"%p: potential import jump, target=%p\\n\", pb, pbTarget));\n\n if (detour_is_imported(pbCode, pbTarget) && *(PBYTE*)pbTarget != NULL) {\n DETOUR_TRACE((\"%p: is import jump, label=%p\\n\", pb, *(PBYTE *)pbTarget));\n\n PPLABEL_DESCRIPTOR ppld = (PPLABEL_DESCRIPTOR)*(PBYTE *)pbTarget;\n pbCode = (PBYTE)ppld->EntryPoint;\n pGlobals = (PBYTE)ppld->GlobalPointer;\n if (ppGlobals != NULL) {\n *ppGlobals = pGlobals;\n }\n }\n }\n return pbCode;\n}\n\n\ninline void detour_find_jmp_bounds(PBYTE pbCode,\n PDETOUR_TRAMPOLINE *ppLower,\n PDETOUR_TRAMPOLINE *ppUpper)\n{\n (void)pbCode;\n *ppLower = (PDETOUR_TRAMPOLINE)(ULONG_PTR)0x0000000000080000;\n *ppUpper = (PDETOUR_TRAMPOLINE)(ULONG_PTR)0xfffffffffff80000;\n}\n\ninline BOOL detour_does_code_end_function(PBYTE pbCode)\n{\n // Routine not needed on IA64.\n (void)pbCode;\n return FALSE;\n}\n\ninline ULONG detour_is_code_filler(PBYTE pbCode)\n{\n // Routine not needed on IA64.\n (void)pbCode;\n return 0;\n}\n\n#endif // DETOURS_IA64\n\n#ifdef DETOURS_ARM\n\nstruct _DETOUR_TRAMPOLINE\n{\n // A Thumb-2 instruction can be 2 or 4 bytes long.\n BYTE rbCode[62]; // target code + jmp to pbRemain\n BYTE cbCode; // size of moved target code.\n BYTE cbCodeBreak; // padding to make debugging easier.\n BYTE rbRestore[22]; // original target code.\n BYTE cbRestore; // size of original target code.\n BYTE cbRestoreBreak; // padding to make debugging easier.\n _DETOUR_ALIGN rAlign[8]; // instruction alignment array.\n PBYTE pbRemain; // first instruction after moved code. [free list]\n PBYTE pbDetour; // first instruction of detour function.\n};\n\nC_ASSERT(sizeof(_DETOUR_TRAMPOLINE) == 104);\n\nenum {\n SIZE_OF_JMP = 8\n};\n\ninline PBYTE align4(PBYTE pValue)\n{\n return (PBYTE)(((ULONG)pValue) & ~(ULONG)3u);\n}\n\ninline ULONG fetch_thumb_opcode(PBYTE pbCode)\n{\n ULONG Opcode = *(UINT16 *)&pbCode[0];\n if (Opcode >= 0xe800) {\n Opcode = (Opcode << 16) | *(UINT16 *)&pbCode[2];\n }\n return Opcode;\n}\n\ninline void write_thumb_opcode(PBYTE &pbCode, ULONG Opcode)\n{\n if (Opcode >= 0x10000) {\n *((UINT16*&)pbCode)++ = Opcode >> 16;\n }\n *((UINT16*&)pbCode)++ = (UINT16)Opcode;\n}\n\nPBYTE detour_gen_jmp_immediate(PBYTE pbCode, PBYTE *ppPool, PBYTE pbJmpVal)\n{\n PBYTE pbLiteral;\n if (ppPool != NULL) {\n *ppPool = *ppPool - 4;\n pbLiteral = *ppPool;\n }\n else {\n pbLiteral = align4(pbCode + 6);\n }\n\n *((PBYTE*&)pbLiteral) = DETOURS_PBYTE_TO_PFUNC(pbJmpVal);\n LONG delta = pbLiteral - align4(pbCode + 4);\n\n write_thumb_opcode(pbCode, 0xf8dff000 | delta); // LDR PC,[PC+n]\n\n if (ppPool == NULL) {\n if (((ULONG)pbCode & 2) != 0) {\n write_thumb_opcode(pbCode, 0xdefe); // BREAK\n }\n pbCode += 4;\n }\n return pbCode;\n}\n\ninline PBYTE detour_gen_brk(PBYTE pbCode, PBYTE pbLimit)\n{\n while (pbCode < pbLimit) {\n write_thumb_opcode(pbCode, 0xdefe);\n }\n return pbCode;\n}\n\ninline PBYTE detour_skip_jmp(PBYTE pbCode, PVOID *ppGlobals)\n{\n if (pbCode == NULL) {\n return NULL;\n }\n if (ppGlobals != NULL) {\n *ppGlobals = NULL;\n }\n\n // Skip over the import jump if there is one.\n pbCode = (PBYTE)DETOURS_PFUNC_TO_PBYTE(pbCode);\n ULONG Opcode = fetch_thumb_opcode(pbCode);\n\n if ((Opcode & 0xfbf08f00) == 0xf2400c00) { // movw r12,#xxxx\n ULONG Opcode2 = fetch_thumb_opcode(pbCode+4);\n\n if ((Opcode2 & 0xfbf08f00) == 0xf2c00c00) { // movt r12,#xxxx\n ULONG Opcode3 = fetch_thumb_opcode(pbCode+8);\n if (Opcode3 == 0xf8dcf000) { // ldr pc,[r12]\n PBYTE pbTarget = (PBYTE)(((Opcode2 << 12) & 0xf7000000) |\n ((Opcode2 << 1) & 0x08000000) |\n ((Opcode2 << 16) & 0x00ff0000) |\n ((Opcode >> 4) & 0x0000f700) |\n ((Opcode >> 15) & 0x00000800) |\n ((Opcode >> 0) & 0x000000ff));\n if (detour_is_imported(pbCode, pbTarget)) {\n PBYTE pbNew = *(PBYTE *)pbTarget;\n pbNew = DETOURS_PFUNC_TO_PBYTE(pbNew);\n DETOUR_TRACE((\"%p->%p: skipped over import table.\\n\", pbCode, pbNew));\n return pbNew;\n }\n }\n }\n }\n return pbCode;\n}\n\ninline void detour_find_jmp_bounds(PBYTE pbCode,\n PDETOUR_TRAMPOLINE *ppLower,\n PDETOUR_TRAMPOLINE *ppUpper)\n{\n // We have to place trampolines within +/- 2GB of code.\n ULONG_PTR lo = detour_2gb_below((ULONG_PTR)pbCode);\n ULONG_PTR hi = detour_2gb_above((ULONG_PTR)pbCode);\n DETOUR_TRACE((\"[%p..%p..%p]\\n\", (PVOID)lo, pbCode, (PVOID)hi));\n\n *ppLower = (PDETOUR_TRAMPOLINE)lo;\n *ppUpper = (PDETOUR_TRAMPOLINE)hi;\n}\n\n\ninline BOOL detour_does_code_end_function(PBYTE pbCode)\n{\n ULONG Opcode = fetch_thumb_opcode(pbCode);\n if ((Opcode & 0xffffff87) == 0x4700 || // bx \n (Opcode & 0xf800d000) == 0xf0009000) { // b \n return TRUE;\n }\n if ((Opcode & 0xffff8000) == 0xe8bd8000) { // pop {...,pc}\n __debugbreak();\n return TRUE;\n }\n if ((Opcode & 0xffffff00) == 0x0000bd00) { // pop {...,pc}\n __debugbreak();\n return TRUE;\n }\n return FALSE;\n}\n\ninline ULONG detour_is_code_filler(PBYTE pbCode)\n{\n if (pbCode[0] == 0x00 && pbCode[1] == 0xbf) { // nop.\n return 2;\n }\n if (pbCode[0] == 0x00 && pbCode[1] == 0x00) { // zero-filled padding.\n return 2;\n }\n return 0;\n}\n\n#endif // DETOURS_ARM\n\n#ifdef DETOURS_ARM64\n\nstruct _DETOUR_TRAMPOLINE\n{\n // An ARM64 instruction is 4 bytes long.\n //\n // The overwrite is always composed of 3 instructions (12 bytes) which perform an indirect jump\n // using _DETOUR_TRAMPOLINE::pbDetour as the address holding the target location.\n //\n // Copied instructions can expand.\n //\n // The scheme using MovImmediate can cause an instruction\n // to grow as much as 6 times.\n // That would be Bcc or Tbz with a large address space:\n // 4 instructions to form immediate\n // inverted tbz/bcc\n // br\n //\n // An expansion of 4 is not uncommon -- bl/blr and small address space:\n // 3 instructions to form immediate\n // br or brl\n //\n // A theoretical maximum for rbCode is thefore 4*4*6 + 16 = 112 (another 16 for jmp to pbRemain).\n //\n // With literals, the maximum expansion is 5, including the literals: 4*4*5 + 16 = 96.\n //\n // The number is rounded up to 128. m_rbScratchDst should match this.\n //\n BYTE rbCode[128]; // target code + jmp to pbRemain\n BYTE cbCode; // size of moved target code.\n BYTE cbCodeBreak[3]; // padding to make debugging easier.\n BYTE rbRestore[24]; // original target code.\n BYTE cbRestore; // size of original target code.\n BYTE cbRestoreBreak[3]; // padding to make debugging easier.\n _DETOUR_ALIGN rAlign[8]; // instruction alignment array.\n PBYTE pbRemain; // first instruction after moved code. [free list]\n PBYTE pbDetour; // first instruction of detour function.\n};\n\nC_ASSERT(sizeof(_DETOUR_TRAMPOLINE) == 184);\n\nenum {\n SIZE_OF_JMP = 12\n};\n\ninline ULONG fetch_opcode(PBYTE pbCode)\n{\n return *(ULONG *)pbCode;\n}\n\ninline void write_opcode(PBYTE &pbCode, ULONG Opcode)\n{\n *(ULONG *)pbCode = Opcode;\n pbCode += 4;\n}\n\nstruct ARM64_INDIRECT_JMP {\n struct {\n ULONG Rd : 5;\n ULONG immhi : 19;\n ULONG iop : 5;\n ULONG immlo : 2;\n ULONG op : 1;\n } ardp;\n\n struct {\n ULONG Rt : 5;\n ULONG Rn : 5;\n ULONG imm : 12;\n ULONG opc : 2;\n ULONG iop1 : 2;\n ULONG V : 1;\n ULONG iop2 : 3;\n ULONG size : 2;\n } ldr;\n\n ULONG br;\n};\n\n#pragma warning(push)\n#pragma warning(disable:4201)\n\nunion ARM64_INDIRECT_IMM {\n struct {\n ULONG64 pad : 12;\n ULONG64 adrp_immlo : 2;\n ULONG64 adrp_immhi : 19;\n };\n\n LONG64 value;\n};\n\n#pragma warning(pop)\n\nPBYTE detour_gen_jmp_indirect(BYTE *pbCode, ULONG64 *pbJmpVal)\n{\n // adrp x17, [jmpval]\n // ldr x17, [x17, jmpval]\n // br x17\n\n struct ARM64_INDIRECT_JMP *pIndJmp;\n union ARM64_INDIRECT_IMM jmpIndAddr;\n\n jmpIndAddr.value = (((LONG64)pbJmpVal) & 0xFFFFFFFFFFFFF000) - \n (((LONG64)pbCode) & 0xFFFFFFFFFFFFF000);\n\n pIndJmp = (struct ARM64_INDIRECT_JMP *)pbCode;\n pbCode = (BYTE *)(pIndJmp + 1);\n\n pIndJmp->ardp.Rd = 17;\n pIndJmp->ardp.immhi = jmpIndAddr.adrp_immhi;\n pIndJmp->ardp.iop = 0x10;\n pIndJmp->ardp.immlo = jmpIndAddr.adrp_immlo;\n pIndJmp->ardp.op = 1;\n\n pIndJmp->ldr.Rt = 17;\n pIndJmp->ldr.Rn = 17;\n pIndJmp->ldr.imm = (((ULONG64)pbJmpVal) & 0xFFF) / 8;\n pIndJmp->ldr.opc = 1;\n pIndJmp->ldr.iop1 = 1;\n pIndJmp->ldr.V = 0;\n pIndJmp->ldr.iop2 = 7;\n pIndJmp->ldr.size = 3;\n\n pIndJmp->br = 0xD61F0220;\n\n return pbCode;\n}\n\nPBYTE detour_gen_jmp_immediate(PBYTE pbCode, PBYTE *ppPool, PBYTE pbJmpVal)\n{\n PBYTE pbLiteral;\n if (ppPool != NULL) {\n *ppPool = *ppPool - 8;\n pbLiteral = *ppPool;\n }\n else {\n pbLiteral = pbCode + 8;\n }\n\n *((PBYTE*&)pbLiteral) = pbJmpVal;\n LONG delta = (LONG)(pbLiteral - pbCode);\n\n write_opcode(pbCode, 0x58000011 | ((delta / 4) << 5)); // LDR X17,[PC+n]\n write_opcode(pbCode, 0xd61f0000 | (17 << 5)); // BR X17\n\n if (ppPool == NULL) {\n pbCode += 8;\n }\n return pbCode;\n}\n\ninline PBYTE detour_gen_brk(PBYTE pbCode, PBYTE pbLimit)\n{\n while (pbCode < pbLimit) {\n write_opcode(pbCode, 0xd4100000 | (0xf000 << 5));\n }\n return pbCode;\n}\n\ninline INT64 detour_sign_extend(UINT64 value, UINT bits)\n{\n const UINT left = 64 - bits;\n const INT64 m1 = -1;\n const INT64 wide = (INT64)(value << left);\n const INT64 sign = (wide < 0) ? (m1 << left) : 0;\n return value | sign;\n}\n\ninline PBYTE detour_skip_jmp(PBYTE pbCode, PVOID *ppGlobals)\n{\n if (pbCode == NULL) {\n return NULL;\n }\n if (ppGlobals != NULL) {\n *ppGlobals = NULL;\n }\n\n // Skip over the import jump if there is one.\n pbCode = (PBYTE)pbCode;\n ULONG Opcode = fetch_opcode(pbCode);\n\n if ((Opcode & 0x9f00001f) == 0x90000010) { // adrp x16, IAT\n ULONG Opcode2 = fetch_opcode(pbCode + 4);\n\n if ((Opcode2 & 0xffe003ff) == 0xf9400210) { // ldr x16, [x16, IAT]\n ULONG Opcode3 = fetch_opcode(pbCode + 8);\n\n if (Opcode3 == 0xd61f0200) { // br x16\n\n/* https://static.docs.arm.com/ddi0487/bb/DDI0487B_b_armv8_arm.pdf\n The ADRP instruction shifts a signed, 21-bit immediate left by 12 bits, adds it to the value of the program counter with\n the bottom 12 bits cleared to zero, and then writes the result to a general-purpose register. This permits the\n calculation of the address at a 4KB aligned memory region. In conjunction with an ADD (immediate) instruction, or\n a Load/Store instruction with a 12-bit immediate offset, this allows for the calculation of, or access to, any address\n within +/- 4GB of the current PC.\n\nPC-rel. addressing\n This section describes the encoding of the PC-rel. addressing instruction class. The encodings in this section are\n decoded from Data Processing -- Immediate on page C4-226.\n Add/subtract (immediate)\n This section describes the encoding of the Add/subtract (immediate) instruction class. The encodings in this section\n are decoded from Data Processing -- Immediate on page C4-226.\n Decode fields\n Instruction page\n op\n 0 ADR\n 1 ADRP\n\nC6.2.10 ADRP\n Form PC-relative address to 4KB page adds an immediate value that is shifted left by 12 bits, to the PC value to\n form a PC-relative address, with the bottom 12 bits masked out, and writes the result to the destination register.\n ADRP ,