8

DetourFindPayload

Brian Gianforcaro edited this page 2021-03-06 00:51:42 -08:00

Table of Contents

• DetourFindPayload
• Definition
• Parameters
• Return value
• Error codes
• Remarks
• Related Samples

DetourFindPayload

Return the address of the specified payload within a module.

Definition

_Writable_bytes_(*pcbData)
_Readable_bytes_(*pcbData)
_Success_(return != NULL)
PVOID DetourFindPayload(
    _In_opt_  HMODULE hModule,
    _In_      REFGUID rguid,
    _Out_opt_ DWORD  *pcbData
);

Parameters

hModule

Module holding the specified payload.

rguid

GUID of the specified payload.

pcbData

Variable to receive the size in bytes of the specified payload.

Return value

Pointer to the specified payload or NULL if the payload doesn't exist.

Error codes

The function sets one of the following error codes if it was unable to search the module for the target payload. The error code may be retrieved after the function has returned by calling GetLastError.

ERROR_BAD_EXE_FORMAT

The MZ header of specified module is invalid.

ERROR_EXE_MARKED_INVALID

The NT COFF header of the specified module is invalid.

ERROR_INVALID_EXE_SIGNATURE

The NT COFF header of the specified module has an invalid signature.

Remarks

DetourFindPayload returns the address of the specified payload within a module. Payloads can either be created at compile link time, see the Einst, or can be inserted it an existing binary using the DetourBinarySetPayload API.

For more information on binary editing with Detours and payloads, see Payloads and DLL Import Editing in the Detours Overview.

Related Samples

Einst, Tracebld.

Overview

• Home
• Frequently Asked Questions
• Using Detours
• Interception of Binary Functions
• Payloads and DLL Import Editing
• Detouring 32-bit and 64-bit Processes
• Samples

API Reference

• Detouring Target Functions
• Finding Target Functions
• Accessing Loaded Binaries and Payloads
• Modifying Binaries
• Inserting DLLs and Payloads Into New Processes