From 53885cd5e7c30eb1fca4531a15d33f1c494df6f1 Mon Sep 17 00:00:00 2001 From: Boring <1079299053@qq.com> Date: Sat, 1 Oct 2022 17:28:23 +0800 Subject: [PATCH] fix release errors --- MemoryModule/MmpDotNet.cpp | 83 ++++++++++++++++-------------------- MemoryModule/MmpDotNet.h | 8 ++++ MemoryModule/MmpGlobalData.h | 22 ++++++++++ MemoryModule/MmpTls.cpp | 29 +++++++------ MemoryModulePP.sln | 4 +- test/test.vcxproj | 10 ++++- 6 files changed, 92 insertions(+), 64 deletions(-) diff --git a/MemoryModule/MmpDotNet.cpp b/MemoryModule/MmpDotNet.cpp index 26389ad..242b8bd 100644 --- a/MemoryModule/MmpDotNet.cpp +++ b/MemoryModule/MmpDotNet.cpp @@ -1,13 +1,6 @@ #include "stdafx.h" #include <3rdparty/Detours/detours.h> -typedef HRESULT (WINAPI* GetFileVersion_T)( - LPCWSTR szFilename, - LPWSTR szBuffer, - DWORD cchBuffer, - DWORD* dwLength -); - typedef struct _MMP_FAKE_HANDLE_LIST_ENTRY { LIST_ENTRY InMmpFakeHandleList; HANDLE hObject; @@ -15,19 +8,6 @@ typedef struct _MMP_FAKE_HANDLE_LIST_ENTRY { BOOL bImageMapping; }MMP_FAKE_HANDLE_LIST_ENTRY, * PMMP_FAKE_HANDLE_LIST_ENTRY; -static decltype(&CreateFileW) OriginCreateFileW = CreateFileW; -static decltype(&GetFileInformationByHandle) OriginGetFileInformationByHandle = GetFileInformationByHandle; -static decltype(&GetFileAttributesExW) OriginGetFileAttributesExW = GetFileAttributesExW; -static decltype(&GetFileSize) OriginGetFileSize = GetFileSize; -static decltype(&GetFileSizeEx) OriginGetFileSizeEx = GetFileSizeEx; -static decltype(&CreateFileMappingW) OriginCreateFileMappingW = CreateFileMappingW; -static decltype(&MapViewOfFileEx) OriginMapViewOfFileEx = MapViewOfFileEx; -static decltype(&MapViewOfFile) OriginMapViewOfFile = MapViewOfFile; -static decltype(&UnmapViewOfFile)OriginUnmapViewOfFile = UnmapViewOfFile; -static decltype(&CloseHandle)OriginCloseHandle = CloseHandle; -static GetFileVersion_T OriginGetFileVersion1 = nullptr; -static GetFileVersion_T OriginGetFileVersion2 = nullptr; - BOOL MmpIsMemoryModuleFileName( _In_ LPCWSTR lpFileName, _Out_opt_ PLDR_DATA_TABLE_ENTRY *LdrEntry) { @@ -127,7 +107,7 @@ HANDLE WINAPI HookCreateFileW( return hEvent; } - return OriginCreateFileW( + return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileW( lpFileName, dwDesiredAccess, dwShareMode, @@ -154,7 +134,7 @@ BOOL WINAPI HookGetFileInformationByHandle( return TRUE; } else { - return OriginGetFileInformationByHandle( + return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileInformationByHandle( hFile, lpFileInformation ); @@ -186,7 +166,7 @@ BOOL WINAPI HookGetFileAttributesExW( } } - return OriginGetFileAttributesExW( + return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileAttributesExW( lpFileName, fInfoLevelId, lpFileInformation @@ -207,7 +187,7 @@ DWORD WINAPI HookGetFileSize( return module->dwImageFileSize; } else { - return OriginGetFileSize( + return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSize( hFile, lpFileSizeHigh ); @@ -228,7 +208,7 @@ BOOL WINAPI HookGetFileSizeEx( return TRUE; } else { - return OriginGetFileSizeEx( + return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSizeEx( hFile, lpFileSize ); @@ -252,7 +232,7 @@ HANDLE WINAPI HookCreateFileMappingW( return hEvent; } - return OriginCreateFileMappingW( + return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileMappingW( hFile, lpFileMappingAttributes, flProtect, @@ -288,7 +268,7 @@ LPVOID WINAPI HookMapViewOfFileEx( return hModule; } - return OriginMapViewOfFileEx( + return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginMapViewOfFileEx( hFileMappingObject, dwDesiredAccess, dwFileOffsetHigh, @@ -324,14 +304,14 @@ BOOL WINAPI HookUnmapViewOfFile(_In_ LPCVOID lpBaseAddress) { return TRUE; } - return OriginUnmapViewOfFile(lpBaseAddress); + return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginUnmapViewOfFile(lpBaseAddress); } BOOL WINAPI HookCloseHandle(_In_ _Post_ptr_invalid_ HANDLE hObject) { auto iter = MmpFindHandleEntry(hObject); if (iter)MmpFreeHandleEntry(iter); - return OriginCloseHandle(hObject); + return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCloseHandle(hObject); } HRESULT WINAPI HookGetFileVersion( @@ -374,7 +354,7 @@ HRESULT WINAPI HookGetFileVersion( } - return OriginGetFileVersion1( + return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion1( szFilename, szBuffer, cchBuffer, @@ -389,28 +369,39 @@ BOOL WINAPI MmpPreInitializeHooksForDotNet() { if (!MmpGlobalDataPtr->MmpDotNet.PreHooked) { HMODULE hModule = LoadLibraryW(L"mscoree.dll"); if (hModule) { - OriginGetFileVersion2 = (GetFileVersion_T)GetProcAddress(hModule, "GetFileVersion"); - if (OriginGetFileVersion2) { + MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion2 = (GetFileVersion_T)GetProcAddress(hModule, "GetFileVersion"); + if (MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion2) { GetSystemTimeAsFileTime(&MmpGlobalDataPtr->MmpDotNet.AssemblyTimes); InitializeCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock); InitializeListHead(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListHead); + MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileW = CreateFileW; + MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileInformationByHandle = GetFileInformationByHandle; + MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileAttributesExW = GetFileAttributesExW; + MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSize = GetFileSize; + MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSizeEx = GetFileSizeEx; + MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileMappingW = CreateFileMappingW; + MmpGlobalDataPtr->MmpDotNet.Hooks.OriginMapViewOfFileEx = MapViewOfFileEx; + MmpGlobalDataPtr->MmpDotNet.Hooks.OriginMapViewOfFile = MapViewOfFile; + MmpGlobalDataPtr->MmpDotNet.Hooks.OriginUnmapViewOfFile = UnmapViewOfFile; + MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCloseHandle = CloseHandle; + DetourTransactionBegin(); DetourUpdateThread(NtCurrentThread()); - DetourAttach((PVOID*)&OriginCreateFileW, HookCreateFileW); - DetourAttach((PVOID*)&OriginGetFileInformationByHandle, HookGetFileInformationByHandle); - DetourAttach((PVOID*)&OriginGetFileAttributesExW, HookGetFileAttributesExW); - DetourAttach((PVOID*)&OriginGetFileSize, HookGetFileSize); - DetourAttach((PVOID*)&OriginGetFileSizeEx, HookGetFileSizeEx); - DetourAttach((PVOID*)&OriginCreateFileMappingW, HookCreateFileMappingW); - DetourAttach((PVOID*)&OriginMapViewOfFileEx, HookMapViewOfFileEx); - DetourAttach((PVOID*)&OriginMapViewOfFile, HookMapViewOfFile); - DetourAttach((PVOID*)&OriginUnmapViewOfFile, HookUnmapViewOfFile); - DetourAttach((PVOID*)&OriginCloseHandle, HookCloseHandle); - DetourAttach((PVOID*)&OriginGetFileVersion2, HookGetFileVersion); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileW, HookCreateFileW); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileInformationByHandle, HookGetFileInformationByHandle); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileAttributesExW, HookGetFileAttributesExW); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSize, HookGetFileSize); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSizeEx, HookGetFileSizeEx); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileMappingW, HookCreateFileMappingW); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginMapViewOfFileEx, HookMapViewOfFileEx); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginMapViewOfFile, HookMapViewOfFile); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginUnmapViewOfFile, HookUnmapViewOfFile); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCloseHandle, HookCloseHandle); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion2, HookGetFileVersion); DetourTransactionCommit(); @@ -427,8 +418,8 @@ BOOL WINAPI MmpPreInitializeHooksForDotNet() { BOOL WINAPI MmpInitializeHooksForDotNet() { HMODULE hModule = GetModuleHandleW(L"mscoreei.dll"); if (hModule) { - OriginGetFileVersion1 = (GetFileVersion_T)GetProcAddress(hModule, "GetFileVersion"); - if (OriginGetFileVersion1) { + MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion1 = (GetFileVersion_T)GetProcAddress(hModule, "GetFileVersion"); + if (MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion1) { EnterCriticalSection(NtCurrentPeb()->FastPebLock); @@ -440,7 +431,7 @@ BOOL WINAPI MmpInitializeHooksForDotNet() { if (!MmpGlobalDataPtr->MmpDotNet.Initialized) { DetourTransactionBegin(); DetourUpdateThread(NtCurrentThread()); - DetourAttach((PVOID*)&OriginGetFileVersion1, HookGetFileVersion); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion1, HookGetFileVersion); DetourTransactionCommit(); MmpGlobalDataPtr->MmpDotNet.Initialized = TRUE; } diff --git a/MemoryModule/MmpDotNet.h b/MemoryModule/MmpDotNet.h index cecd4d7..14253e5 100644 --- a/MemoryModule/MmpDotNet.h +++ b/MemoryModule/MmpDotNet.h @@ -1,3 +1,11 @@ #pragma once + +typedef HRESULT(WINAPI* GetFileVersion_T)( + LPCWSTR szFilename, + LPWSTR szBuffer, + DWORD cchBuffer, + DWORD* dwLength + ); + BOOL WINAPI MmpPreInitializeHooksForDotNet(); BOOL WINAPI MmpInitializeHooksForDotNet(); \ No newline at end of file diff --git a/MemoryModule/MmpGlobalData.h b/MemoryModule/MmpGlobalData.h index 56d2d91..d672a7f 100644 --- a/MemoryModule/MmpGlobalData.h +++ b/MemoryModule/MmpGlobalData.h @@ -24,6 +24,13 @@ typedef struct _MMP_TLS_DATA { CRITICAL_SECTION MmpTlspLock; LIST_ENTRY MmpThreadLocalStoragePointer; DWORD MmpActiveThreadCount; + + struct { + decltype(&NtCreateThread) OriginNtCreateThread; + decltype(&NtCreateThreadEx) OriginNtCreateThreadEx; + decltype(&NtSetInformationProcess) OriginNtSetInformationProcess; + decltype(&LdrShutdownThread) OriginLdrShutdownThread; + }Hooks; }MMP_TLS_DATA, * PMMP_TLS_DATA; //MmpDotNet.cpp @@ -35,6 +42,21 @@ typedef struct _MMP_DOT_NET_DATA { BOOLEAN PreHooked; BOOLEAN Initialized; + + struct { + decltype(&CreateFileW) OriginCreateFileW; + decltype(&GetFileInformationByHandle) OriginGetFileInformationByHandle; + decltype(&GetFileAttributesExW) OriginGetFileAttributesExW; + decltype(&GetFileSize) OriginGetFileSize; + decltype(&GetFileSizeEx) OriginGetFileSizeEx; + decltype(&CreateFileMappingW) OriginCreateFileMappingW; + decltype(&MapViewOfFileEx) OriginMapViewOfFileEx; + decltype(&MapViewOfFile) OriginMapViewOfFile; + decltype(&UnmapViewOfFile)OriginUnmapViewOfFile; + decltype(&CloseHandle)OriginCloseHandle; + GetFileVersion_T OriginGetFileVersion1; + GetFileVersion_T OriginGetFileVersion2; + }Hooks; }MMP_DOT_NET_DATA, * PMMP_DOT_NET_DATA; typedef struct _MMP_GLOBAL_DATA { diff --git a/MemoryModule/MmpTls.cpp b/MemoryModule/MmpTls.cpp index de7cb0e..7887635 100644 --- a/MemoryModule/MmpTls.cpp +++ b/MemoryModule/MmpTls.cpp @@ -55,11 +55,6 @@ typedef struct _MMP_TLSP_RECORD { PVOID* TlspMmpBlock; }MMP_TLSP_RECORD, * PMMP_TLSP_RECORD; -decltype(&NtCreateThread) OriginNtCreateThread = NtCreateThread; -decltype(&NtCreateThreadEx) OriginNtCreateThreadEx = NtCreateThreadEx; -decltype(&NtSetInformationProcess) OriginNtSetInformationProcess = NtSetInformationProcess; -decltype(&LdrShutdownThread) OriginLdrShutdownThread = LdrShutdownThread; - typedef struct _THREAD_CONTEXT { PTHREAD_START_ROUTINE ThreadStartRoutine; LPVOID ThreadParameter; @@ -262,7 +257,7 @@ NTSTATUS NTAPI HookNtCreateThread( Context.Rdx = ULONG64(_Context); #endif - status = OriginNtCreateThread( + status = MmpGlobalDataPtr->MmpTls.Hooks.OriginNtCreateThread( ThreadHandle, DesiredAccess, ObjectAttributes, @@ -299,7 +294,7 @@ NTSTATUS NTAPI HookNtCreateThreadEx( Context->ThreadStartRoutine = PTHREAD_START_ROUTINE(StartRoutine); Context->ThreadParameter = Argument; - NTSTATUS status = OriginNtCreateThreadEx( + NTSTATUS status = MmpGlobalDataPtr->MmpTls.Hooks.OriginNtCreateThreadEx( ThreadHandle, DesiredAccess, ObjectAttributes, @@ -382,7 +377,7 @@ VOID NTAPI HookLdrShutdownThread(VOID) { // // Call the original function // - OriginLdrShutdownThread(); + MmpGlobalDataPtr->MmpTls.Hooks.OriginLdrShutdownThread(); } BOOL NTAPI PreHookNtSetInformationProcess() { @@ -463,7 +458,7 @@ NTSTATUS NTAPI HookNtSetInformationProcess( _In_ ULONG ProcessInformationLength) { if (ProcessInformationClass != ProcessTlsInformation) { - return OriginNtSetInformationProcess( + return MmpGlobalDataPtr->MmpTls.Hooks.OriginNtSetInformationProcess( ProcessHandle, ProcessInformationClass, ProcessInformation, @@ -537,7 +532,7 @@ NTSTATUS NTAPI HookNtSetInformationProcess( } } - status = OriginNtSetInformationProcess( + status = MmpGlobalDataPtr->MmpTls.Hooks.OriginNtSetInformationProcess( hProcess, ProcessInformationClass, Tls, @@ -826,12 +821,18 @@ BOOL NTAPI MmpTlsInitialize() { // // Hook functions // + + MmpGlobalDataPtr->MmpTls.Hooks.OriginNtCreateThread = NtCreateThread; + MmpGlobalDataPtr->MmpTls.Hooks.OriginNtCreateThreadEx = NtCreateThreadEx; + MmpGlobalDataPtr->MmpTls.Hooks.OriginLdrShutdownThread = LdrShutdownThread; + MmpGlobalDataPtr->MmpTls.Hooks.OriginNtSetInformationProcess = NtSetInformationProcess; + DetourTransactionBegin(); DetourUpdateThread(NtCurrentThread()); - DetourAttach((PVOID*)&OriginNtCreateThread, HookNtCreateThread); - DetourAttach((PVOID*)&OriginNtCreateThreadEx, HookNtCreateThreadEx); - DetourAttach((PVOID*)&OriginLdrShutdownThread, HookLdrShutdownThread); - DetourAttach((PVOID*)&OriginNtSetInformationProcess, HookNtSetInformationProcess); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpTls.Hooks.OriginNtCreateThread, HookNtCreateThread); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpTls.Hooks.OriginNtCreateThreadEx, HookNtCreateThreadEx); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpTls.Hooks.OriginLdrShutdownThread, HookLdrShutdownThread); + DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpTls.Hooks.OriginNtSetInformationProcess, HookNtSetInformationProcess); DetourTransactionCommit(); return TRUE; diff --git a/MemoryModulePP.sln b/MemoryModulePP.sln index 77f852f..21ce55a 100644 --- a/MemoryModulePP.sln +++ b/MemoryModulePP.sln @@ -21,8 +21,8 @@ Global {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Debug|x64.Build.0 = Debug|x64 {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Debug|x86.ActiveCfg = DebugDll|Win32 {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Debug|x86.Build.0 = DebugDll|Win32 - {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Release|x64.ActiveCfg = ReleaseDll|x64 - {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Release|x64.Build.0 = ReleaseDll|x64 + {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Release|x64.ActiveCfg = Release|x64 + {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Release|x64.Build.0 = Release|x64 {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Release|x86.ActiveCfg = ReleaseDll|Win32 {5B1F46DB-036E-4A50-AF5F-F5D6584D42C6}.Release|x86.Build.0 = ReleaseDll|Win32 {5B3131BA-178A-4A28-BD54-315A45C97ED1}.Debug|x64.ActiveCfg = Debug|x64 diff --git a/test/test.vcxproj b/test/test.vcxproj index 5b0935c..2d10375 100644 --- a/test/test.vcxproj +++ b/test/test.vcxproj @@ -122,6 +122,7 @@ true WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) true + MultiThreaded Console @@ -140,22 +141,27 @@ true NDEBUG;_CONSOLE;%(PreprocessorDefinitions) true + MultiThreaded Console true true true + + - true + + - true + +