admin/bb107-MemoryModulePP
1
0
Fork 0
mirror of https://github.com/bb107/MemoryModulePP synced 2026-06-08 13:15:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix release errors

Browse Source
This commit is contained in:
Boring
2022-10-01 17:28:23 +08:00
parent ad7986eb6c
commit 53885cd5e7
6 changed files with 92 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MemoryModule/MmpDotNet.cpp
+37 -46
View File
@@ -1,13 +1,6 @@
#include "stdafx.h"
#include <3rdparty/Detours/detours.h>
typedef HRESULT (WINAPI* GetFileVersion_T)(
LPCWSTR szFilename,
LPWSTR szBuffer,
DWORD cchBuffer,
DWORD* dwLength
);
typedef struct _MMP_FAKE_HANDLE_LIST_ENTRY {
LIST_ENTRY InMmpFakeHandleList;
HANDLE hObject;
@@ -15,19 +8,6 @@ typedef struct _MMP_FAKE_HANDLE_LIST_ENTRY {
BOOL bImageMapping;
}MMP_FAKE_HANDLE_LIST_ENTRY, * PMMP_FAKE_HANDLE_LIST_ENTRY;
static decltype(&CreateFileW) OriginCreateFileW = CreateFileW;
static decltype(&GetFileInformationByHandle) OriginGetFileInformationByHandle = GetFileInformationByHandle;
static decltype(&GetFileAttributesExW) OriginGetFileAttributesExW = GetFileAttributesExW;
static decltype(&GetFileSize) OriginGetFileSize = GetFileSize;
static decltype(&GetFileSizeEx) OriginGetFileSizeEx = GetFileSizeEx;
static decltype(&CreateFileMappingW) OriginCreateFileMappingW = CreateFileMappingW;
static decltype(&MapViewOfFileEx) OriginMapViewOfFileEx = MapViewOfFileEx;
static decltype(&MapViewOfFile) OriginMapViewOfFile = MapViewOfFile;
static decltype(&UnmapViewOfFile)OriginUnmapViewOfFile = UnmapViewOfFile;
static decltype(&CloseHandle)OriginCloseHandle = CloseHandle;
static GetFileVersion_T OriginGetFileVersion1 = nullptr;
static GetFileVersion_T OriginGetFileVersion2 = nullptr;
BOOL MmpIsMemoryModuleFileName(
_In_ LPCWSTR lpFileName,
_Out_opt_ PLDR_DATA_TABLE_ENTRY *LdrEntry) {
@@ -127,7 +107,7 @@ HANDLE WINAPI HookCreateFileW(
return hEvent;
}
return OriginCreateFileW(
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileW(
lpFileName,
dwDesiredAccess,
dwShareMode,
@@ -154,7 +134,7 @@ BOOL WINAPI HookGetFileInformationByHandle(
return TRUE;
}
else {
return OriginGetFileInformationByHandle(
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileInformationByHandle(
hFile,
lpFileInformation
);
@@ -186,7 +166,7 @@ BOOL WINAPI HookGetFileAttributesExW(
}
}
return OriginGetFileAttributesExW(
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileAttributesExW(
lpFileName,
fInfoLevelId,
lpFileInformation
@@ -207,7 +187,7 @@ DWORD WINAPI HookGetFileSize(
return module->dwImageFileSize;
}
else {
return OriginGetFileSize(
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSize(
hFile,
lpFileSizeHigh
);
@@ -228,7 +208,7 @@ BOOL WINAPI HookGetFileSizeEx(
return TRUE;
}
else {
return OriginGetFileSizeEx(
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSizeEx(
hFile,
lpFileSize
);
@@ -252,7 +232,7 @@ HANDLE WINAPI HookCreateFileMappingW(
return hEvent;
}
return OriginCreateFileMappingW(
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileMappingW(
hFile,
lpFileMappingAttributes,
flProtect,
@@ -288,7 +268,7 @@ LPVOID WINAPI HookMapViewOfFileEx(
return hModule;
}
return OriginMapViewOfFileEx(
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginMapViewOfFileEx(
hFileMappingObject,
dwDesiredAccess,
dwFileOffsetHigh,
@@ -324,14 +304,14 @@ BOOL WINAPI HookUnmapViewOfFile(_In_ LPCVOID lpBaseAddress) {
return TRUE;
}
return OriginUnmapViewOfFile(lpBaseAddress);
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginUnmapViewOfFile(lpBaseAddress);
}
BOOL WINAPI HookCloseHandle(_In_ _Post_ptr_invalid_ HANDLE hObject) {
auto iter = MmpFindHandleEntry(hObject);
if (iter)MmpFreeHandleEntry(iter);
return OriginCloseHandle(hObject);
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCloseHandle(hObject);
}
HRESULT WINAPI HookGetFileVersion(
@@ -374,7 +354,7 @@ HRESULT WINAPI HookGetFileVersion(
}
return OriginGetFileVersion1(
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion1(
szFilename,
szBuffer,
cchBuffer,
@@ -389,28 +369,39 @@ BOOL WINAPI MmpPreInitializeHooksForDotNet() {
if (!MmpGlobalDataPtr->MmpDotNet.PreHooked) {
HMODULE hModule = LoadLibraryW(L"mscoree.dll");
if (hModule) {
OriginGetFileVersion2 = (GetFileVersion_T)GetProcAddress(hModule, "GetFileVersion");
if (OriginGetFileVersion2) {
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion2 = (GetFileVersion_T)GetProcAddress(hModule, "GetFileVersion");
if (MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion2) {
GetSystemTimeAsFileTime(&MmpGlobalDataPtr->MmpDotNet.AssemblyTimes);
InitializeCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock);
InitializeListHead(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListHead);
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileW = CreateFileW;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileInformationByHandle = GetFileInformationByHandle;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileAttributesExW = GetFileAttributesExW;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSize = GetFileSize;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSizeEx = GetFileSizeEx;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileMappingW = CreateFileMappingW;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginMapViewOfFileEx = MapViewOfFileEx;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginMapViewOfFile = MapViewOfFile;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginUnmapViewOfFile = UnmapViewOfFile;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCloseHandle = CloseHandle;
DetourTransactionBegin();
DetourUpdateThread(NtCurrentThread());
DetourAttach((PVOID*)&OriginCreateFileW, HookCreateFileW);
DetourAttach((PVOID*)&OriginGetFileInformationByHandle, HookGetFileInformationByHandle);
DetourAttach((PVOID*)&OriginGetFileAttributesExW, HookGetFileAttributesExW);
DetourAttach((PVOID*)&OriginGetFileSize, HookGetFileSize);
DetourAttach((PVOID*)&OriginGetFileSizeEx, HookGetFileSizeEx);
DetourAttach((PVOID*)&OriginCreateFileMappingW, HookCreateFileMappingW);
DetourAttach((PVOID*)&OriginMapViewOfFileEx, HookMapViewOfFileEx);
DetourAttach((PVOID*)&OriginMapViewOfFile, HookMapViewOfFile);
DetourAttach((PVOID*)&OriginUnmapViewOfFile, HookUnmapViewOfFile);
DetourAttach((PVOID*)&OriginCloseHandle, HookCloseHandle);
DetourAttach((PVOID*)&OriginGetFileVersion2, HookGetFileVersion);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileW, HookCreateFileW);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileInformationByHandle, HookGetFileInformationByHandle);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileAttributesExW, HookGetFileAttributesExW);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSize, HookGetFileSize);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSizeEx, HookGetFileSizeEx);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileMappingW, HookCreateFileMappingW);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginMapViewOfFileEx, HookMapViewOfFileEx);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginMapViewOfFile, HookMapViewOfFile);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginUnmapViewOfFile, HookUnmapViewOfFile);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCloseHandle, HookCloseHandle);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion2, HookGetFileVersion);
DetourTransactionCommit();
@@ -427,8 +418,8 @@ BOOL WINAPI MmpPreInitializeHooksForDotNet() {
BOOL WINAPI MmpInitializeHooksForDotNet() {
HMODULE hModule = GetModuleHandleW(L"mscoreei.dll");
if (hModule) {
OriginGetFileVersion1 = (GetFileVersion_T)GetProcAddress(hModule, "GetFileVersion");
if (OriginGetFileVersion1) {
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion1 = (GetFileVersion_T)GetProcAddress(hModule, "GetFileVersion");
if (MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion1) {
EnterCriticalSection(NtCurrentPeb()->FastPebLock);
@@ -440,7 +431,7 @@ BOOL WINAPI MmpInitializeHooksForDotNet() {
if (!MmpGlobalDataPtr->MmpDotNet.Initialized) {
DetourTransactionBegin();
DetourUpdateThread(NtCurrentThread());
DetourAttach((PVOID*)&OriginGetFileVersion1, HookGetFileVersion);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion1, HookGetFileVersion);
DetourTransactionCommit();
MmpGlobalDataPtr->MmpDotNet.Initialized = TRUE;
}
MemoryModule/MmpDotNet.h
+8
View File
@@ -1,3 +1,11 @@
#pragma once
typedef HRESULT(WINAPI* GetFileVersion_T)(
LPCWSTR szFilename,
LPWSTR szBuffer,
DWORD cchBuffer,
DWORD* dwLength
);
BOOL WINAPI MmpPreInitializeHooksForDotNet();
BOOL WINAPI MmpInitializeHooksForDotNet();
MemoryModule/MmpGlobalData.h
+22
View File
@@ -24,6 +24,13 @@ typedef struct _MMP_TLS_DATA {
CRITICAL_SECTION MmpTlspLock;
LIST_ENTRY MmpThreadLocalStoragePointer;
DWORD MmpActiveThreadCount;
struct {
decltype(&NtCreateThread) OriginNtCreateThread;
decltype(&NtCreateThreadEx) OriginNtCreateThreadEx;
decltype(&NtSetInformationProcess) OriginNtSetInformationProcess;
decltype(&LdrShutdownThread) OriginLdrShutdownThread;
}Hooks;
}MMP_TLS_DATA, * PMMP_TLS_DATA;
//MmpDotNet.cpp
@@ -35,6 +42,21 @@ typedef struct _MMP_DOT_NET_DATA {
BOOLEAN PreHooked;
BOOLEAN Initialized;
struct {
decltype(&CreateFileW) OriginCreateFileW;
decltype(&GetFileInformationByHandle) OriginGetFileInformationByHandle;
decltype(&GetFileAttributesExW) OriginGetFileAttributesExW;
decltype(&GetFileSize) OriginGetFileSize;
decltype(&GetFileSizeEx) OriginGetFileSizeEx;
decltype(&CreateFileMappingW) OriginCreateFileMappingW;
decltype(&MapViewOfFileEx) OriginMapViewOfFileEx;
decltype(&MapViewOfFile) OriginMapViewOfFile;
decltype(&UnmapViewOfFile)OriginUnmapViewOfFile;
decltype(&CloseHandle)OriginCloseHandle;
GetFileVersion_T OriginGetFileVersion1;
GetFileVersion_T OriginGetFileVersion2;
}Hooks;
}MMP_DOT_NET_DATA, * PMMP_DOT_NET_DATA;
typedef struct _MMP_GLOBAL_DATA {
MemoryModule/MmpTls.cpp
+15 -14
View File
@@ -55,11 +55,6 @@ typedef struct _MMP_TLSP_RECORD {
PVOID* TlspMmpBlock;
}MMP_TLSP_RECORD, * PMMP_TLSP_RECORD;
decltype(&NtCreateThread) OriginNtCreateThread = NtCreateThread;
decltype(&NtCreateThreadEx) OriginNtCreateThreadEx = NtCreateThreadEx;
decltype(&NtSetInformationProcess) OriginNtSetInformationProcess = NtSetInformationProcess;
decltype(&LdrShutdownThread) OriginLdrShutdownThread = LdrShutdownThread;
typedef struct _THREAD_CONTEXT {
PTHREAD_START_ROUTINE ThreadStartRoutine;
LPVOID ThreadParameter;
@@ -262,7 +257,7 @@ NTSTATUS NTAPI HookNtCreateThread(
Context.Rdx = ULONG64(_Context);
#endif
status = OriginNtCreateThread(
status = MmpGlobalDataPtr->MmpTls.Hooks.OriginNtCreateThread(
ThreadHandle,
DesiredAccess,
ObjectAttributes,
@@ -299,7 +294,7 @@ NTSTATUS NTAPI HookNtCreateThreadEx(
Context->ThreadStartRoutine = PTHREAD_START_ROUTINE(StartRoutine);
Context->ThreadParameter = Argument;
NTSTATUS status = OriginNtCreateThreadEx(
NTSTATUS status = MmpGlobalDataPtr->MmpTls.Hooks.OriginNtCreateThreadEx(
ThreadHandle,
DesiredAccess,
ObjectAttributes,
@@ -382,7 +377,7 @@ VOID NTAPI HookLdrShutdownThread(VOID) {
//
// Call the original function
//
OriginLdrShutdownThread();
MmpGlobalDataPtr->MmpTls.Hooks.OriginLdrShutdownThread();
}
BOOL NTAPI PreHookNtSetInformationProcess() {
@@ -463,7 +458,7 @@ NTSTATUS NTAPI HookNtSetInformationProcess(
_In_ ULONG ProcessInformationLength) {
if (ProcessInformationClass != ProcessTlsInformation) {
return OriginNtSetInformationProcess(
return MmpGlobalDataPtr->MmpTls.Hooks.OriginNtSetInformationProcess(
ProcessHandle,
ProcessInformationClass,
ProcessInformation,
@@ -537,7 +532,7 @@ NTSTATUS NTAPI HookNtSetInformationProcess(
}
}
status = OriginNtSetInformationProcess(
status = MmpGlobalDataPtr->MmpTls.Hooks.OriginNtSetInformationProcess(
hProcess,
ProcessInformationClass,
Tls,
@@ -826,12 +821,18 @@ BOOL NTAPI MmpTlsInitialize() {
//
// Hook functions
//
MmpGlobalDataPtr->MmpTls.Hooks.OriginNtCreateThread = NtCreateThread;
MmpGlobalDataPtr->MmpTls.Hooks.OriginNtCreateThreadEx = NtCreateThreadEx;
MmpGlobalDataPtr->MmpTls.Hooks.OriginLdrShutdownThread = LdrShutdownThread;
MmpGlobalDataPtr->MmpTls.Hooks.OriginNtSetInformationProcess = NtSetInformationProcess;
DetourTransactionBegin();
DetourUpdateThread(NtCurrentThread());
DetourAttach((PVOID*)&OriginNtCreateThread, HookNtCreateThread);
DetourAttach((PVOID*)&OriginNtCreateThreadEx, HookNtCreateThreadEx);
DetourAttach((PVOID*)&OriginLdrShutdownThread, HookLdrShutdownThread);
DetourAttach((PVOID*)&OriginNtSetInformationProcess, HookNtSetInformationProcess);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpTls.Hooks.OriginNtCreateThread, HookNtCreateThread);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpTls.Hooks.OriginNtCreateThreadEx, HookNtCreateThreadEx);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpTls.Hooks.OriginLdrShutdownThread, HookLdrShutdownThread);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpTls.Hooks.OriginNtSetInformationProcess, HookNtSetInformationProcess);
DetourTransactionCommit();
return TRUE;