admin/bb107-MemoryModulePP
1
0
Fork 0
mirror of https://github.com/bb107/MemoryModulePP synced 2026-06-08 13:15:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactoring

Browse Source
This commit is contained in:
Boring
2022-10-11 07:47:31 +08:00
parent d1787b1dbe
commit e64ee25bac
15 changed files with 364 additions and 897 deletions
Download Patch File Download Diff File Expand all files Collapse all files
MemoryModule/MmpDotNet.cpp
+55 -55
View File
@@ -59,17 +59,17 @@ VOID MmpInsertHandleEntry(
entry->value = value;
entry->bImageMapping = bImageMapping;
EnterCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock);
InsertTailList(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListHead, &entry->InMmpFakeHandleList);
LeaveCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock);
EnterCriticalSection(&MmpGlobalDataPtr->MmpDotNet->MmpFakeHandleListLock);
InsertTailList(&MmpGlobalDataPtr->MmpDotNet->MmpFakeHandleListHead, &entry->InMmpFakeHandleList);
LeaveCriticalSection(&MmpGlobalDataPtr->MmpDotNet->MmpFakeHandleListLock);
}
PMMP_FAKE_HANDLE_LIST_ENTRY MmpFindHandleEntry(HANDLE hObject) {
PMMP_FAKE_HANDLE_LIST_ENTRY result = nullptr;
EnterCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock);
EnterCriticalSection(&MmpGlobalDataPtr->MmpDotNet->MmpFakeHandleListLock);
for (auto entry = MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListHead.Flink; entry != &MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListHead; entry = entry->Flink) {
for (auto entry = MmpGlobalDataPtr->MmpDotNet->MmpFakeHandleListHead.Flink; entry != &MmpGlobalDataPtr->MmpDotNet->MmpFakeHandleListHead; entry = entry->Flink) {
auto CurEntry = CONTAINING_RECORD(entry, MMP_FAKE_HANDLE_LIST_ENTRY, MMP_FAKE_HANDLE_LIST_ENTRY::InMmpFakeHandleList);
if (CurEntry->hObject == hObject) {
@@ -79,15 +79,15 @@ PMMP_FAKE_HANDLE_LIST_ENTRY MmpFindHandleEntry(HANDLE hObject) {
}
LeaveCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock);
LeaveCriticalSection(&MmpGlobalDataPtr->MmpDotNet->MmpFakeHandleListLock);
return result;
}
VOID MmpFreeHandleEntry(PMMP_FAKE_HANDLE_LIST_ENTRY lpHandleEntry) {
EnterCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock);
EnterCriticalSection(&MmpGlobalDataPtr->MmpDotNet->MmpFakeHandleListLock);
RemoveEntryList(&lpHandleEntry->InMmpFakeHandleList);
RtlFreeHeap(RtlProcessHeap(), 0, lpHandleEntry);
LeaveCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock);
LeaveCriticalSection(&MmpGlobalDataPtr->MmpDotNet->MmpFakeHandleListLock);
}
HANDLE WINAPI HookCreateFileW(
@@ -107,7 +107,7 @@ HANDLE WINAPI HookCreateFileW(
return hEvent;
}
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileW(
return MmpGlobalDataPtr->MmpDotNet->Hooks.OriginCreateFileW(
lpFileName,
dwDesiredAccess,
dwShareMode,
@@ -128,13 +128,13 @@ BOOL WINAPI HookGetFileInformationByHandle(
auto entry = (PLDR_DATA_TABLE_ENTRY)iter->value;
auto module = MapMemoryModuleHandle((HMEMORYMODULE)entry->DllBase);
lpFileInformation->ftCreationTime = lpFileInformation->ftLastAccessTime = lpFileInformation->ftLastWriteTime = MmpGlobalDataPtr->MmpDotNet.AssemblyTimes;
lpFileInformation->ftCreationTime = lpFileInformation->ftLastAccessTime = lpFileInformation->ftLastWriteTime = MmpGlobalDataPtr->MmpDotNet->AssemblyTimes;
lpFileInformation->nFileSizeLow = module->dwImageFileSize;
return TRUE;
}
else {
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileInformationByHandle(
return MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileInformationByHandle(
hFile,
lpFileInformation
);
@@ -157,7 +157,7 @@ BOOL WINAPI HookGetFileAttributesExW(
LPWIN32_FILE_ATTRIBUTE_DATA data = (LPWIN32_FILE_ATTRIBUTE_DATA)lpFileInformation;
auto module = MapMemoryModuleHandle((HMEMORYMODULE)entry->DllBase);
data->ftCreationTime = data->ftLastAccessTime = data->ftLastWriteTime = MmpGlobalDataPtr->MmpDotNet.AssemblyTimes;
data->ftCreationTime = data->ftLastAccessTime = data->ftLastWriteTime = MmpGlobalDataPtr->MmpDotNet->AssemblyTimes;
data->nFileSizeLow = module->dwImageFileSize;
return TRUE;
}
@@ -166,7 +166,7 @@ BOOL WINAPI HookGetFileAttributesExW(
}
}
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileAttributesExW(
return MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileAttributesExW(
lpFileName,
fInfoLevelId,
lpFileInformation
@@ -187,7 +187,7 @@ DWORD WINAPI HookGetFileSize(
return module->dwImageFileSize;
}
else {
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSize(
return MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileSize(
hFile,
lpFileSizeHigh
);
@@ -208,7 +208,7 @@ BOOL WINAPI HookGetFileSizeEx(
return TRUE;
}
else {
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSizeEx(
return MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileSizeEx(
hFile,
lpFileSize
);
@@ -232,7 +232,7 @@ HANDLE WINAPI HookCreateFileMappingW(
return hEvent;
}
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileMappingW(
return MmpGlobalDataPtr->MmpDotNet->Hooks.OriginCreateFileMappingW(
hFile,
lpFileMappingAttributes,
flProtect,
@@ -268,7 +268,7 @@ LPVOID WINAPI HookMapViewOfFileEx(
return hModule;
}
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginMapViewOfFileEx(
return MmpGlobalDataPtr->MmpDotNet->Hooks.OriginMapViewOfFileEx(
hFileMappingObject,
dwDesiredAccess,
dwFileOffsetHigh,
@@ -304,14 +304,14 @@ BOOL WINAPI HookUnmapViewOfFile(_In_ LPCVOID lpBaseAddress) {
return TRUE;
}
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginUnmapViewOfFile(lpBaseAddress);
return MmpGlobalDataPtr->MmpDotNet->Hooks.OriginUnmapViewOfFile(lpBaseAddress);
}
BOOL WINAPI HookCloseHandle(_In_ _Post_ptr_invalid_ HANDLE hObject) {
auto iter = MmpFindHandleEntry(hObject);
if (iter)MmpFreeHandleEntry(iter);
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCloseHandle(hObject);
return MmpGlobalDataPtr->MmpDotNet->Hooks.OriginCloseHandle(hObject);
}
HRESULT WINAPI HookGetFileVersion(
@@ -354,7 +354,7 @@ HRESULT WINAPI HookGetFileVersion(
}
return MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion1(
return MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileVersion1(
szFilename,
szBuffer,
cchBuffer,
@@ -366,74 +366,74 @@ BOOL WINAPI MmpPreInitializeHooksForDotNet() {
EnterCriticalSection(NtCurrentPeb()->FastPebLock);
if (!MmpGlobalDataPtr->MmpDotNet.PreHooked) {
if (!MmpGlobalDataPtr->MmpDotNet->PreHooked) {
HMODULE hModule = LoadLibraryW(L"mscoree.dll");
if (hModule) {
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion2 = (GetFileVersion_T)GetProcAddress(hModule, "GetFileVersion");
if (MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion2) {
MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileVersion2 = (GetFileVersion_T)GetProcAddress(hModule, "GetFileVersion");
if (MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileVersion2) {
GetSystemTimeAsFileTime(&MmpGlobalDataPtr->MmpDotNet.AssemblyTimes);
GetSystemTimeAsFileTime(&MmpGlobalDataPtr->MmpDotNet->AssemblyTimes);
InitializeCriticalSection(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListLock);
InitializeListHead(&MmpGlobalDataPtr->MmpDotNet.MmpFakeHandleListHead);
InitializeCriticalSection(&MmpGlobalDataPtr->MmpDotNet->MmpFakeHandleListLock);
InitializeListHead(&MmpGlobalDataPtr->MmpDotNet->MmpFakeHandleListHead);
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileW = CreateFileW;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileInformationByHandle = GetFileInformationByHandle;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileAttributesExW = GetFileAttributesExW;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSize = GetFileSize;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSizeEx = GetFileSizeEx;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileMappingW = CreateFileMappingW;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginMapViewOfFileEx = MapViewOfFileEx;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginMapViewOfFile = MapViewOfFile;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginUnmapViewOfFile = UnmapViewOfFile;
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCloseHandle = CloseHandle;
MmpGlobalDataPtr->MmpDotNet->Hooks.OriginCreateFileW = CreateFileW;
MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileInformationByHandle = GetFileInformationByHandle;
MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileAttributesExW = GetFileAttributesExW;
MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileSize = GetFileSize;
MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileSizeEx = GetFileSizeEx;
MmpGlobalDataPtr->MmpDotNet->Hooks.OriginCreateFileMappingW = CreateFileMappingW;
MmpGlobalDataPtr->MmpDotNet->Hooks.OriginMapViewOfFileEx = MapViewOfFileEx;
MmpGlobalDataPtr->MmpDotNet->Hooks.OriginMapViewOfFile = MapViewOfFile;
MmpGlobalDataPtr->MmpDotNet->Hooks.OriginUnmapViewOfFile = UnmapViewOfFile;
MmpGlobalDataPtr->MmpDotNet->Hooks.OriginCloseHandle = CloseHandle;
DetourTransactionBegin();
DetourUpdateThread(NtCurrentThread());
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileW, HookCreateFileW);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileInformationByHandle, HookGetFileInformationByHandle);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileAttributesExW, HookGetFileAttributesExW);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSize, HookGetFileSize);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileSizeEx, HookGetFileSizeEx);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCreateFileMappingW, HookCreateFileMappingW);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginMapViewOfFileEx, HookMapViewOfFileEx);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginMapViewOfFile, HookMapViewOfFile);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginUnmapViewOfFile, HookUnmapViewOfFile);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginCloseHandle, HookCloseHandle);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion2, HookGetFileVersion);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet->Hooks.OriginCreateFileW, HookCreateFileW);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileInformationByHandle, HookGetFileInformationByHandle);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileAttributesExW, HookGetFileAttributesExW);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileSize, HookGetFileSize);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileSizeEx, HookGetFileSizeEx);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet->Hooks.OriginCreateFileMappingW, HookCreateFileMappingW);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet->Hooks.OriginMapViewOfFileEx, HookMapViewOfFileEx);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet->Hooks.OriginMapViewOfFile, HookMapViewOfFile);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet->Hooks.OriginUnmapViewOfFile, HookUnmapViewOfFile);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet->Hooks.OriginCloseHandle, HookCloseHandle);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileVersion2, HookGetFileVersion);
DetourTransactionCommit();
MmpGlobalDataPtr->MmpDotNet.PreHooked = TRUE;
MmpGlobalDataPtr->MmpDotNet->PreHooked = TRUE;
}
}
}
LeaveCriticalSection(NtCurrentPeb()->FastPebLock);
return MmpGlobalDataPtr->MmpDotNet.PreHooked;
return MmpGlobalDataPtr->MmpDotNet->PreHooked;
}
BOOL WINAPI MmpInitializeHooksForDotNet() {
HMODULE hModule = GetModuleHandleW(L"mscoreei.dll");
if (hModule) {
MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion1 = (GetFileVersion_T)GetProcAddress(hModule, "GetFileVersion");
if (MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion1) {
MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileVersion1 = (GetFileVersion_T)GetProcAddress(hModule, "GetFileVersion");
if (MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileVersion1) {
EnterCriticalSection(NtCurrentPeb()->FastPebLock);
if (!MmpGlobalDataPtr->MmpDotNet.PreHooked) {
if (!MmpGlobalDataPtr->MmpDotNet->PreHooked) {
LeaveCriticalSection(NtCurrentPeb()->FastPebLock);
return FALSE;
}
if (!MmpGlobalDataPtr->MmpDotNet.Initialized) {
if (!MmpGlobalDataPtr->MmpDotNet->Initialized) {
DetourTransactionBegin();
DetourUpdateThread(NtCurrentThread());
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet.Hooks.OriginGetFileVersion1, HookGetFileVersion);
DetourAttach((PVOID*)&MmpGlobalDataPtr->MmpDotNet->Hooks.OriginGetFileVersion1, HookGetFileVersion);
DetourTransactionCommit();
MmpGlobalDataPtr->MmpDotNet.Initialized = TRUE;
MmpGlobalDataPtr->MmpDotNet->Initialized = TRUE;
}
LeaveCriticalSection(NtCurrentPeb()->FastPebLock);