From c42bd8c3aff1805330d52e2d5b87ced9df2f820f Mon Sep 17 00:00:00 2001 From: Valentin Radu Date: Fri, 3 Sep 2021 00:04:53 +0300 Subject: [PATCH] Support for Microsoft Detours library * Added support for hooking functions using the Microsoft Detours library; this, in theory, means that the application can now at least compile just fine on ARM64; although that is the case, it currently does not support dynamically patching CTray::Init as I have yet to come up with assembly to do that. Also, it is uterly untested on ARM64 as I do not have a machine to test on. * Removed x86 support, compilation targets are now only amd64 and ARM64 --- .gitmodules | 3 + ExplorerPatcher.sln | 12 +-- ExplorerPatcher/ExplorerPatcher.vcxproj | 97 +++++++++++++------------ ExplorerPatcher/dllmain.c | 75 ++++++++++++++----- libs/Detours | 1 + 5 files changed, 118 insertions(+), 70 deletions(-) create mode 160000 libs/Detours diff --git a/.gitmodules b/.gitmodules index f7a87b2..367508e 100644 --- a/.gitmodules +++ b/.gitmodules @@ -4,3 +4,6 @@ [submodule "libs/funchook"] path = libs/funchook url = https://github.com/kubo/funchook +[submodule "libs/Detours"] + path = libs/Detours + url = https://github.com/microsoft/Detours diff --git a/ExplorerPatcher.sln b/ExplorerPatcher.sln index 9bc5da6..f308b59 100644 --- a/ExplorerPatcher.sln +++ b/ExplorerPatcher.sln @@ -7,20 +7,20 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ExplorerPatcher", "Explorer EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|ARM64 = Debug|ARM64 Debug|x64 = Debug|x64 - Debug|x86 = Debug|x86 + Release|ARM64 = Release|ARM64 Release|x64 = Release|x64 - Release|x86 = Release|x86 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution + {DB3E4319-2969-42B6-B7E8-BB57AA8C9FA9}.Debug|ARM64.ActiveCfg = Debug|x64 + {DB3E4319-2969-42B6-B7E8-BB57AA8C9FA9}.Debug|ARM64.Build.0 = Debug|x64 {DB3E4319-2969-42B6-B7E8-BB57AA8C9FA9}.Debug|x64.ActiveCfg = Debug|x64 {DB3E4319-2969-42B6-B7E8-BB57AA8C9FA9}.Debug|x64.Build.0 = Debug|x64 - {DB3E4319-2969-42B6-B7E8-BB57AA8C9FA9}.Debug|x86.ActiveCfg = Debug|Win32 - {DB3E4319-2969-42B6-B7E8-BB57AA8C9FA9}.Debug|x86.Build.0 = Debug|Win32 + {DB3E4319-2969-42B6-B7E8-BB57AA8C9FA9}.Release|ARM64.ActiveCfg = Release|ARM64 + {DB3E4319-2969-42B6-B7E8-BB57AA8C9FA9}.Release|ARM64.Build.0 = Release|ARM64 {DB3E4319-2969-42B6-B7E8-BB57AA8C9FA9}.Release|x64.ActiveCfg = Release|x64 {DB3E4319-2969-42B6-B7E8-BB57AA8C9FA9}.Release|x64.Build.0 = Release|x64 - {DB3E4319-2969-42B6-B7E8-BB57AA8C9FA9}.Release|x86.ActiveCfg = Release|Win32 - {DB3E4319-2969-42B6-B7E8-BB57AA8C9FA9}.Release|x86.Build.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE diff --git a/ExplorerPatcher/ExplorerPatcher.vcxproj b/ExplorerPatcher/ExplorerPatcher.vcxproj index 4e1c6fb..f343504 100644 --- a/ExplorerPatcher/ExplorerPatcher.vcxproj +++ b/ExplorerPatcher/ExplorerPatcher.vcxproj @@ -1,13 +1,13 @@ - + Debug - Win32 + ARM64 - + Release - Win32 + ARM64 Debug @@ -26,26 +26,26 @@ ExplorerPatcher - - Application + + DynamicLibrary true v142 Unicode - - Application - false + + DynamicLibrary + true v142 - true Unicode - + DynamicLibrary - true + false v142 + true Unicode - + DynamicLibrary false v142 @@ -57,16 +57,16 @@ - + - + - + - + @@ -75,16 +75,17 @@ $(SolutionDir)$(Platform)\$(Configuration)\ dxgi - - true + + false + $(SolutionDir)$(Platform)\$(Configuration)\ dxgi true dxgi - - false + + true dxgi @@ -95,7 +96,7 @@ true NDEBUG;_CONSOLE;%(PreprocessorDefinitions) true - $(SolutionDir)libs\funchook\include;$(SolutionDir)libs\libvalinet;$(SolutionDir)libs\funchook\distorm\include;%(AdditionalIncludeDirectories) + $(SolutionDir)libs\funchook\include;$(SolutionDir)libs\libvalinet;$(SolutionDir)libs\funchook\distorm\include;$(SolutionDir)libs\Detours\include;%(AdditionalIncludeDirectories) MultiThreaded @@ -103,8 +104,8 @@ true true true - $(SolutionDir)libs\funchook\build\Release\funchook.lib;$(SolutionDir)libs\funchook\build\Release\distorm.lib;%(AdditionalLibraryDirectories) - $(SolutionDir)libs\funchook\build\Release\funchook.lib;$(SolutionDir)libs\funchook\build\Release\distorm.lib;%(AdditionalDependencies) + $(SolutionDir)libs\funchook\build\Release\;$(SolutionDir)libs\Detours\lib.X64;%(AdditionalLibraryDirectories) + %(AdditionalDependencies) @@ -115,26 +116,33 @@ - + Level3 + true + true true - _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) true - MultiThreadedDebug + $(SolutionDir)libs\funchook\include;$(SolutionDir)libs\libvalinet;$(SolutionDir)libs\funchook\distorm\include;$(SolutionDir)libs\Detours\include;%(AdditionalIncludeDirectories) + MultiThreaded Console + true + true true + $(SolutionDir)libs\funchook\build\Release\;$(SolutionDir)libs\Detours\lib.ARM64;%(AdditionalLibraryDirectories) + %(AdditionalDependencies) - - - - + + + + @@ -142,14 +150,14 @@ true _DEBUG;_CONSOLE;%(PreprocessorDefinitions) true - $(SolutionDir)libs\funchook\include;$(SolutionDir)libs\libvalinet;$(SolutionDir)libs\funchook\distorm\include;%(AdditionalIncludeDirectories) + $(SolutionDir)libs\funchook\include;$(SolutionDir)libs\libvalinet;$(SolutionDir)libs\funchook\distorm\include;$(SolutionDir)libs\Detours\include;%(AdditionalIncludeDirectories) MultiThreadedDebug Console true - $(SolutionDir)libs\funchook\build\Release\funchook.lib;$(SolutionDir)libs\funchook\build\Release\distorm.lib;%(AdditionalLibraryDirectories) - $(SolutionDir)libs\funchook\build\Release\funchook.lib;$(SolutionDir)libs\funchook\build\Release\distorm.lib;%(AdditionalDependencies) + $(SolutionDir)libs\funchook\build\Release\;$(SolutionDir)libs\Detours\lib.X64;%(AdditionalLibraryDirectories) + %(AdditionalDependencies) @@ -160,30 +168,29 @@ - + Level3 - true - true true - NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) true - MultiThreaded + $(SolutionDir)libs\funchook\include;$(SolutionDir)libs\libvalinet;$(SolutionDir)libs\funchook\distorm\include;$(SolutionDir)libs\Detours\include;%(AdditionalIncludeDirectories) + MultiThreadedDebug Console - true - true true + $(SolutionDir)libs\funchook\build\Release\;$(SolutionDir)libs\Detours\lib.ARM64;%(AdditionalLibraryDirectories) + %(AdditionalDependencies) - - - - + + + + diff --git a/ExplorerPatcher/dllmain.c b/ExplorerPatcher/dllmain.c index 569692a..6c4ff3e 100644 --- a/ExplorerPatcher/dllmain.c +++ b/ExplorerPatcher/dllmain.c @@ -1,9 +1,60 @@ +#ifndef _M_AMD64 +#ifndef _M_ARM64 +#error This application only supports the amd64 or ARM64 architectures. Compilation aborted. +#endif +#endif +#define HOOK_WITH_FUNCHOOK 0 +#define HOOK_WITH_DETOURS 1 +#define HOW_TO_HOOK HOOK_WITH_FUNCHOOK #include #include #include #include +#if HOW_TO_HOOK == HOOK_WITH_FUNCHOOK +#ifdef _M_ARM64 +#error Cannot compile for ARM64 using funchook. Change the source to hook with Detours and try again. Compilation aborted. +#endif #include #include +#pragma comment(lib, "funchook.lib") +#pragma comment(lib, "distorm.lib") +#elif HOW_TO_HOOK == HOOK_WITH_DETOURS +#include +#pragma comment(lib, "detours.lib") +void* funchook_create(void) +{ + return 1; +} +int funchook_uninstall( + void* _this, + int flags +) +{ + return 0; +} +int funchook_destroy(void* _this) +{ + return 0; +} +int funchook_prepare( + void* funchook, + void** target_func, + void* hook_func +) +{ + DetourTransactionBegin(); + DetourUpdateThread(GetCurrentThread()); + DetourAttach(target_func, hook_func); + return DetourTransactionCommit(); +} +int funchook_install( + void* funchook, + int flags +) +{ + return 0; +} +#endif #include #include #pragma comment(lib, "Psapi.lib") // required by funchook @@ -201,7 +252,11 @@ L"\r\n"; HWND archivehWnd; +#if HOW_TO_HOOK == HOOK_WITH_FUNCHOOK funchook_t* funchook = NULL; +#elif HOW_TO_HOOK == HOOK_WITH_DETOURS +void* funchook = NULL; +#endif HMODULE hModule = NULL; HANDLE hIsWinXShown = NULL; @@ -3271,6 +3326,7 @@ __declspec(dllexport) DWORD WINAPI main( (PDWORD)(&dwNumberOfBytes) ); printf("Copied %d bytes to disassemble.\n", BYTES_TO_DISASSEMBLE); +#if HOW_TO_HOOK == HOOK_WITH_FUNCHOOK _DecodedInst decodedInstructions[1000]; UINT decodedInstructionsCount = 0; _DecodeResult res = distorm_decode( @@ -3317,25 +3373,6 @@ __declspec(dllexport) DWORD WINAPI main( start = 0; strat++; } -#ifdef DEBUG - /*res = distorm_decode( - 0, - (const unsigned char*)m, - BYTES_TO_DISASSEMBLE, - Decode64Bits, - decodedInstructions, - 1000, - &decodedInstructionsCount - ); - for (UINT i = 0; i < decodedInstructionsCount; ++i) - { - printf( - "0x%p\t%s\t%s\n", - decodedInstructions[i].offset, - decodedInstructions[i].mnemonic.p, - decodedInstructions[i].instructionHex.p - ); - }*/ #endif VirtualProtect( (LPVOID)CTray_Init, diff --git a/libs/Detours b/libs/Detours new file mode 160000 index 0000000..45a76a3 --- /dev/null +++ b/libs/Detours @@ -0,0 +1 @@ +Subproject commit 45a76a359989aa0ce037440449976a777fd01e63