Skip to content

Commit e5d5d10

Browse files
RenardDevRenardDev
authored
Add files via upload
1 parent 9c47fcc commit e5d5d10

File tree

5 files changed

+305
-200
lines changed

5 files changed

+305
-200
lines changed

Diff for: ‎Detours.cpp

+91-87
Original file line numberDiff line numberDiff line change
@@ -7540,7 +7540,42 @@ namespace Detours {
75407540
} CACHED_OPERATION, *PCACHED_OPERATION;
75417541

75427542
static std::deque<CACHED_OPERATION> g_CachedOperations;
7543-
static std::unordered_map<const void*, std::unique_ptr<INSTRUCTION>> g_CachedInstructions;
7543+
7544+
PRD_OPERAND GetReadOperand(PRD_OPERAND pOperands, unsigned char unCount) {
7545+
if (!pOperands || !unCount) {
7546+
return nullptr;
7547+
}
7548+
7549+
for (unsigned char i = 0; i < unCount; ++i) {
7550+
if (pOperands[i].Access.Read) {
7551+
if ((pOperands[i].Type == RD_OP_IMM) && !pOperands[i].Info.Immediate.Imm) {
7552+
continue;
7553+
}
7554+
7555+
return &pOperands[i];
7556+
}
7557+
}
7558+
7559+
return nullptr;
7560+
}
7561+
7562+
PRD_OPERAND GetWriteOperand(PRD_OPERAND pOperands, unsigned char unCount) {
7563+
if (!pOperands || !unCount) {
7564+
return nullptr;
7565+
}
7566+
7567+
for (unsigned char i = 0; i < unCount; ++i) {
7568+
if (pOperands[i].Access.Write) {
7569+
if ((pOperands[i].Type == RD_OP_IMM) && !pOperands[i].Info.Immediate.Imm) {
7570+
continue;
7571+
}
7572+
7573+
return &pOperands[i];
7574+
}
7575+
}
7576+
7577+
return nullptr;
7578+
}
75447579

75457580
static void FixMemoryHookAddress(const PCONTEXT pCTX, const void* pExceptionAddress, MEMORY_HOOK_OPERATION unOperation, const void* pAddress, void* pNewAddress) {
75467581
if (!pCTX || !pAddress || !pNewAddress) {
@@ -7571,58 +7606,33 @@ namespace Detours {
75717606
}
75727607
}
75737608

7574-
PINSTRUCTION pInsn = nullptr;
7575-
7576-
{
7577-
bool bIsCachedInstruction = false;
7578-
7579-
auto it = g_CachedInstructions.find(pExceptionAddress);
7580-
if (it != g_CachedInstructions.end()) {
7581-
pInsn = it->second.get();
7582-
bIsCachedInstruction = true;
7583-
}
7584-
7585-
if (!bIsCachedInstruction) {
7586-
auto pInstruction = std::make_unique<INSTRUCTION>();
7587-
if (!pInstruction) {
7588-
return;
7589-
}
7590-
7609+
INSTRUCTION insn;
75917610
#ifdef _M_X64
7592-
if (!RD_SUCCESS(RdDecode(pInstruction.get(), reinterpret_cast<unsigned char*>(const_cast<void*>(pExceptionAddress)), RD_CODE_64, RD_DATA_64))) {
7611+
if (!RD_SUCCESS(RdDecode(&insn, reinterpret_cast<unsigned char*>(const_cast<void*>(pExceptionAddress)), RD_CODE_64, RD_DATA_64))) {
75937612
#elif _M_IX86
7594-
if (!RD_SUCCESS(RdDecode(pInstruction.get(), reinterpret_cast<unsigned char*>(const_cast<void*>(pExceptionAddress)), RD_CODE_32, RD_DATA_32))) {
7613+
if (!RD_SUCCESS(RdDecode(&insn, reinterpret_cast<unsigned char*>(const_cast<void*>(pExceptionAddress)), RD_CODE_32, RD_DATA_32))) {
75957614
#endif
7596-
return;
7597-
}
7598-
7599-
pInsn = pInstruction.get();
7600-
g_CachedInstructions.emplace_hint(it, std::make_pair(pExceptionAddress, std::move(pInstruction)));
7601-
}
7602-
}
7603-
7604-
if (!pInsn) {
76057615
return;
76067616
}
76077617

76087618
switch (unOperation) {
76097619
case MEMORY_HOOK_OPERATION::MEMORY_READ: {
7610-
if (pInsn->OperandsCount) {
7611-
auto ReadOperand = pInsn->Operands[pInsn->OperandsCount - 1];
7612-
if (!ReadOperand.Access.Read) {
7620+
if (insn.OperandsCount) {
7621+
auto pReadOperand = GetReadOperand(insn.Operands, insn.OperandsCount);
7622+
if (!pReadOperand) {
76137623
return;
76147624
}
76157625

7616-
if (ReadOperand.Type == RD_OP_NOT_PRESENT) {
7626+
if (pReadOperand->Type == RD_OP_NOT_PRESENT) {
76177627
return;
7618-
} else if (ReadOperand.Type == RD_OP_REG) {
7619-
ULONG_PTR unValue = GetRegisterValue(pCTX, ReadOperand.Info.Register.Reg, ReadOperand.Info.Register.Size);
7628+
} else if (pReadOperand->Type == RD_OP_REG) {
7629+
ULONG_PTR unValue = GetRegisterValue(pCTX, pReadOperand->Info.Register.Reg, pReadOperand->Info.Register.Size);
76207630
if (reinterpret_cast<ULONG_PTR>(pAddress) == unValue) {
7621-
SetRegisterValue(pCTX, ReadOperand.Info.Register.Reg, ReadOperand.Info.Register.Size, reinterpret_cast<size_t>(pNewAddress));
7622-
g_CachedOperations.emplace_back(const_cast<void*>(pExceptionAddress), unOperation, const_cast<void*>(pAddress), ReadOperand, pNewAddress);
7631+
SetRegisterValue(pCTX, pReadOperand->Info.Register.Reg, pReadOperand->Info.Register.Size, reinterpret_cast<size_t>(pNewAddress));
7632+
g_CachedOperations.emplace_back(const_cast<void*>(pExceptionAddress), unOperation, const_cast<void*>(pAddress), *pReadOperand, pNewAddress);
76237633
return;
76247634
}
7625-
} else if (ReadOperand.Type == RD_OP_MEM) {
7635+
} else if (pReadOperand->Type == RD_OP_MEM) {
76267636
#ifdef _M_X64
76277637
unsigned long long unBase = 0;
76287638
unsigned long long unIndex = 0;
@@ -7632,42 +7642,42 @@ namespace Detours {
76327642
#endif
76337643
unsigned long long unDisp = 0;
76347644

7635-
if (ReadOperand.Info.Memory.HasBase) {
7636-
unBase = GetRegisterValue(pCTX, ReadOperand.Info.Memory.Base, ReadOperand.Info.Memory.BaseSize);
7645+
if (pReadOperand->Info.Memory.HasBase) {
7646+
unBase = GetRegisterValue(pCTX, pReadOperand->Info.Memory.Base, pReadOperand->Info.Memory.BaseSize);
76377647
}
76387648

7639-
if (ReadOperand.Info.Memory.HasIndex) {
7640-
unIndex = GetRegisterValue(pCTX, ReadOperand.Info.Memory.Index, ReadOperand.Info.Memory.IndexSize) * ReadOperand.Info.Memory.Scale;
7649+
if (pReadOperand->Info.Memory.HasIndex) {
7650+
unIndex = GetRegisterValue(pCTX, pReadOperand->Info.Memory.Index, pReadOperand->Info.Memory.IndexSize) * pReadOperand->Info.Memory.Scale;
76417651
}
76427652

7643-
if (ReadOperand.Info.Memory.HasDisp) {
7644-
unDisp = ReadOperand.Info.Memory.Disp;
7653+
if (pReadOperand->Info.Memory.HasDisp) {
7654+
unDisp = pReadOperand->Info.Memory.Disp;
76457655
}
76467656

76477657
if (reinterpret_cast<ULONG_PTR>(pAddress) == unBase + unIndex + unDisp) {
76487658
if (unBase) {
76497659
const size_t unOffset = reinterpret_cast<size_t>(pAddress) - unBase;
7650-
SetRegisterValue(pCTX, ReadOperand.Info.Memory.Base, ReadOperand.Info.Memory.BaseSize, reinterpret_cast<size_t>(pNewAddress) - unOffset);
7651-
ReadOperand.Info.Memory.HasIndex = false;
7652-
g_CachedOperations.emplace_back(const_cast<void*>(pExceptionAddress), unOperation, const_cast<void*>(pAddress), ReadOperand, static_cast<char*>(pNewAddress) - unOffset);
7660+
SetRegisterValue(pCTX, pReadOperand->Info.Memory.Base, pReadOperand->Info.Memory.BaseSize, reinterpret_cast<size_t>(pNewAddress) - unOffset);
7661+
pReadOperand->Info.Memory.HasIndex = false;
7662+
g_CachedOperations.emplace_back(const_cast<void*>(pExceptionAddress), unOperation, const_cast<void*>(pAddress), *pReadOperand, static_cast<char*>(pNewAddress) - unOffset);
76537663
return;
76547664
}
76557665

76567666
if (unIndex) {
76577667
const size_t unOffset = reinterpret_cast<size_t>(pAddress) - unIndex;
7658-
SetRegisterValue(pCTX, ReadOperand.Info.Memory.Index, ReadOperand.Info.Memory.IndexSize, reinterpret_cast<size_t>(pNewAddress) - unOffset);
7659-
ReadOperand.Info.Memory.HasBase = false;
7660-
g_CachedOperations.emplace_back(const_cast<void*>(pExceptionAddress), unOperation, const_cast<void*>(pAddress), ReadOperand, static_cast<char*>(pNewAddress) - unOffset);
7668+
SetRegisterValue(pCTX, pReadOperand->Info.Memory.Index, pReadOperand->Info.Memory.IndexSize, reinterpret_cast<size_t>(pNewAddress) - unOffset);
7669+
pReadOperand->Info.Memory.HasBase = false;
7670+
g_CachedOperations.emplace_back(const_cast<void*>(pExceptionAddress), unOperation, const_cast<void*>(pAddress), *pReadOperand, static_cast<char*>(pNewAddress) - unOffset);
76617671
return;
76627672
}
76637673
}
7664-
} else if (ReadOperand.Type == RD_OP_IMM) {
7674+
} else if (pReadOperand->Type == RD_OP_IMM) {
76657675
__debugbreak(); // TODO: Implement.
7666-
} else if (ReadOperand.Type == RD_OP_OFFS) {
7676+
} else if (pReadOperand->Type == RD_OP_OFFS) {
76677677
__debugbreak(); // TODO: Implement.
7668-
} else if (ReadOperand.Type == RD_OP_ADDR) {
7678+
} else if (pReadOperand->Type == RD_OP_ADDR) {
76697679
__debugbreak(); // TODO: Implement.
7670-
} else if (ReadOperand.Type == RD_OP_CONST) {
7680+
} else if (pReadOperand->Type == RD_OP_CONST) {
76717681
__debugbreak(); // TODO: Implement.
76727682
}
76737683
}
@@ -7676,28 +7686,22 @@ namespace Detours {
76767686
}
76777687

76787688
case MEMORY_HOOK_OPERATION::MEMORY_WRITE: {
7679-
if (pInsn->OperandsCount) {
7680-
auto WriteOperand = pInsn->Operands[pInsn->OperandsCount - 1];
7681-
if (!WriteOperand.Access.Write) {
7682-
if (pInsn->OperandsCount > 1) {
7683-
WriteOperand = pInsn->Operands[pInsn->OperandsCount - 2];
7684-
}
7685-
7686-
if (!WriteOperand.Access.Write) {
7687-
return;
7688-
}
7689+
if (insn.OperandsCount) {
7690+
auto pWriteOperand = GetWriteOperand(insn.Operands, insn.OperandsCount);
7691+
if (!pWriteOperand) {
7692+
return;
76897693
}
76907694

7691-
if (WriteOperand.Type == RD_OP_NOT_PRESENT) {
7695+
if (pWriteOperand->Type == RD_OP_NOT_PRESENT) {
76927696
return;
7693-
} else if (WriteOperand.Type == RD_OP_REG) {
7694-
ULONG_PTR unValue = GetRegisterValue(pCTX, WriteOperand.Info.Register.Reg, WriteOperand.Info.Register.Size);
7697+
} else if (pWriteOperand->Type == RD_OP_REG) {
7698+
ULONG_PTR unValue = GetRegisterValue(pCTX, pWriteOperand->Info.Register.Reg, pWriteOperand->Info.Register.Size);
76957699
if (reinterpret_cast<ULONG_PTR>(pAddress) == unValue) {
7696-
SetRegisterValue(pCTX, WriteOperand.Info.Register.Reg, WriteOperand.Info.Register.Size, reinterpret_cast<size_t>(pNewAddress));
7697-
g_CachedOperations.emplace_back(const_cast<void*>(pExceptionAddress), unOperation, const_cast<void*>(pAddress), WriteOperand, pNewAddress);
7700+
SetRegisterValue(pCTX, pWriteOperand->Info.Register.Reg, pWriteOperand->Info.Register.Size, reinterpret_cast<size_t>(pNewAddress));
7701+
g_CachedOperations.emplace_back(const_cast<void*>(pExceptionAddress), unOperation, const_cast<void*>(pAddress), *pWriteOperand, pNewAddress);
76987702
return;
76997703
}
7700-
} else if (WriteOperand.Type == RD_OP_MEM) {
7704+
} else if (pWriteOperand->Type == RD_OP_MEM) {
77017705
#ifdef _M_X64
77027706
unsigned long long unBase = 0;
77037707
unsigned long long unIndex = 0;
@@ -7707,42 +7711,42 @@ namespace Detours {
77077711
#endif
77087712
unsigned long long unDisp = 0;
77097713

7710-
if (WriteOperand.Info.Memory.HasBase) {
7711-
unBase = GetRegisterValue(pCTX, WriteOperand.Info.Memory.Base, WriteOperand.Info.Memory.BaseSize);
7714+
if (pWriteOperand->Info.Memory.HasBase) {
7715+
unBase = GetRegisterValue(pCTX, pWriteOperand->Info.Memory.Base, pWriteOperand->Info.Memory.BaseSize);
77127716
}
77137717

7714-
if (WriteOperand.Info.Memory.HasIndex) {
7715-
unIndex = GetRegisterValue(pCTX, WriteOperand.Info.Memory.Index, WriteOperand.Info.Memory.IndexSize) * WriteOperand.Info.Memory.Scale;
7718+
if (pWriteOperand->Info.Memory.HasIndex) {
7719+
unIndex = GetRegisterValue(pCTX, pWriteOperand->Info.Memory.Index, pWriteOperand->Info.Memory.IndexSize) * pWriteOperand->Info.Memory.Scale;
77167720
}
77177721

7718-
if (WriteOperand.Info.Memory.HasDisp) {
7719-
unDisp = WriteOperand.Info.Memory.Disp;
7722+
if (pWriteOperand->Info.Memory.HasDisp) {
7723+
unDisp = pWriteOperand->Info.Memory.Disp;
77207724
}
77217725

77227726
if (reinterpret_cast<ULONG_PTR>(pAddress) == unBase + unIndex + unDisp) {
77237727
if (unBase) {
77247728
const size_t unOffset = reinterpret_cast<size_t>(pAddress) - unBase;
7725-
SetRegisterValue(pCTX, WriteOperand.Info.Memory.Base, WriteOperand.Info.Memory.BaseSize, reinterpret_cast<size_t>(pNewAddress) - unOffset);
7726-
WriteOperand.Info.Memory.HasIndex = false;
7727-
g_CachedOperations.emplace_back(const_cast<void*>(pExceptionAddress), unOperation, const_cast<void*>(pAddress), WriteOperand, static_cast<char*>(pNewAddress) - unOffset);
7729+
SetRegisterValue(pCTX, pWriteOperand->Info.Memory.Base, pWriteOperand->Info.Memory.BaseSize, reinterpret_cast<size_t>(pNewAddress) - unOffset);
7730+
pWriteOperand->Info.Memory.HasIndex = false;
7731+
g_CachedOperations.emplace_back(const_cast<void*>(pExceptionAddress), unOperation, const_cast<void*>(pAddress), *pWriteOperand, static_cast<char*>(pNewAddress) - unOffset);
77287732
return;
77297733
}
77307734

77317735
if (unIndex) {
77327736
const size_t unOffset = reinterpret_cast<size_t>(pAddress) - unIndex;
7733-
SetRegisterValue(pCTX, WriteOperand.Info.Memory.Index, WriteOperand.Info.Memory.IndexSize, reinterpret_cast<size_t>(pNewAddress) - unOffset);
7734-
WriteOperand.Info.Memory.HasBase = false;
7735-
g_CachedOperations.emplace_back(const_cast<void*>(pExceptionAddress), unOperation, const_cast<void*>(pAddress), WriteOperand, static_cast<char*>(pNewAddress) - unOffset);
7737+
SetRegisterValue(pCTX, pWriteOperand->Info.Memory.Index, pWriteOperand->Info.Memory.IndexSize, reinterpret_cast<size_t>(pNewAddress) - unOffset);
7738+
pWriteOperand->Info.Memory.HasBase = false;
7739+
g_CachedOperations.emplace_back(const_cast<void*>(pExceptionAddress), unOperation, const_cast<void*>(pAddress), *pWriteOperand, static_cast<char*>(pNewAddress) - unOffset);
77367740
return;
77377741
}
77387742
}
7739-
} else if (WriteOperand.Type == RD_OP_IMM) {
7743+
} else if (pWriteOperand->Type == RD_OP_IMM) {
77407744
__debugbreak(); // TODO: Implement.
7741-
} else if (WriteOperand.Type == RD_OP_OFFS) {
7745+
} else if (pWriteOperand->Type == RD_OP_OFFS) {
77427746
__debugbreak(); // TODO: Implement.
7743-
} else if (WriteOperand.Type == RD_OP_ADDR) {
7747+
} else if (pWriteOperand->Type == RD_OP_ADDR) {
77447748
__debugbreak(); // TODO: Implement.
7745-
} else if (WriteOperand.Type == RD_OP_CONST) {
7749+
} else if (pWriteOperand->Type == RD_OP_CONST) {
77467750
__debugbreak(); // TODO: Implement.
77477751
}
77487752
}
@@ -7912,7 +7916,7 @@ namespace Detours {
79127916
}
79137917
}
79147918

7915-
const bool bResult = pRecord->m_pCallBack(pCTX, pExceptionAddress, unOperation, pAddress, &pNewAddress);
7919+
const bool bResult = pRecord->m_pCallBack(pCTX, pExceptionAddress, unOperation, pRecord->m_pAddress, pAddress, &pNewAddress);
79167920
if (bResult) {
79177921
FixMemoryHookAddress(pCTX, pExceptionAddress, unOperation, pAddress, pNewAddress);
79187922
}

Diff for: ‎Detours.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -5545,7 +5545,7 @@ namespace Detours {
55455545
// Memory Hook CallBack
55465546
// ----------------------------------------------------------------
55475547

5548-
using fnMemoryHookCallBack = bool(*)(const PCONTEXT pCTX, const void* pExceptionAddress, MEMORY_HOOK_OPERATION unOperation, const void* pAddress, void** pNewAddress);
5548+
using fnMemoryHookCallBack = bool(*)(const PCONTEXT pCTX, const void* pExceptionAddress, MEMORY_HOOK_OPERATION unOperation, const void* pHookAddress, const void* pAccessAddress, void** pNewAccessAddress);
55495549

55505550
// ----------------------------------------------------------------
55515551
// Memory Hook

Diff for: ‎interrupts32.asm

+50-45
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,50 @@
1-
.686
2-
.model flat, C
3-
4-
.stack
5-
6-
.data
7-
8-
.code
9-
CallInterrupt proc
10-
push eax
11-
push ecx
12-
push edx
13-
push ebx
14-
; push esp
15-
push ebp
16-
push esi
17-
push edi
18-
19-
add esp, 1Ch
20-
add esp, 04h
21-
22-
mov eax, dword ptr [esp+00h]
23-
mov ecx, dword ptr [esp+04h]
24-
mov edx, dword ptr [esp+08h]
25-
mov ebx, dword ptr [esp+0Ch]
26-
mov ebp, dword ptr [esp+10h]
27-
mov esi, dword ptr [esp+14h]
28-
mov edi, dword ptr [esp+18h]
29-
30-
sub esp, 04h
31-
sub esp, 1Ch
32-
33-
int 7Eh
34-
35-
pop edi
36-
pop esi
37-
pop ebp
38-
; pop esp
39-
pop ebx
40-
pop edx
41-
pop ecx
42-
pop eax
43-
ret
44-
CallInterrupt endp
45-
end
1+
.686
2+
.model flat, C
3+
4+
.stack
5+
6+
.data
7+
8+
.code
9+
CallInterrupt proc
10+
push eax
11+
push ecx
12+
push edx
13+
push ebx
14+
; push esp
15+
push ebp
16+
push esi
17+
push edi
18+
19+
add esp, 1Ch
20+
add esp, 04h
21+
22+
mov eax, dword ptr [esp+00h]
23+
mov ecx, dword ptr [esp+04h]
24+
mov edx, dword ptr [esp+08h]
25+
mov ebx, dword ptr [esp+0Ch]
26+
mov ebp, dword ptr [esp+10h]
27+
mov esi, dword ptr [esp+14h]
28+
mov edi, dword ptr [esp+18h]
29+
30+
sub esp, 04h
31+
sub esp, 1Ch
32+
33+
int 7Eh
34+
35+
pop edi
36+
pop esi
37+
pop ebp
38+
; pop esp
39+
pop ebx
40+
pop edx
41+
pop ecx
42+
pop eax
43+
ret
44+
CallInterrupt endp
45+
46+
CallInrerruptReturn proc
47+
add esp, 4
48+
iretd
49+
CallInrerruptReturn endp
50+
end

0 commit comments

Comments
 (0)