// host.cc // 8/24/2013 jichi // Branch IHF/main.cpp, rev 111 #include "host.h" #include "pipe.h" #include "winmutex.h" #include #include "../vnrhook/include/const.h" #include "../vnrhook/include/defs.h" #include "../vnrhook/include/types.h" #include HANDLE preventDuplicationMutex; std::unordered_map textThreadsByParams(10); std::unordered_map processRecordsByIds(2); CRITICAL_SECTION hostCs; ThreadEventCallback onCreate(nullptr), onRemove(nullptr); ProcessEventCallback onAttach(nullptr), onDetach(nullptr); WORD nextThreadNumber(0); #define HOST_LOCK CriticalSectionLocker hostLocker(&hostCs) // Synchronized scope for accessing private data namespace Host { DLLEXPORT bool Start() { InitializeCriticalSection(&hostCs); return true; } DLLEXPORT void Open() { TextThread* console = textThreadsByParams[{ 0, -1UL, -1UL, -1UL }] = new TextThread({ 0, -1UL, -1UL, -1UL }, nextThreadNumber++, USING_UNICODE); if (onCreate) onCreate(console); CreateNewPipe(); } DLLEXPORT void Close() { // Artikash 7/25/2018: This is only called when NextHooker is closed, at which point Windows should free everything itself...right? //EnterCriticalSection(&hostCs); //DestroyWindow(dummyWindow); //RemoveThreads([](auto one, auto two) { return true; }, {}); ////for (auto i : processRecordsByIds) UnregisterProcess(i.first); // Artikash 7/24/2018 FIXME: This segfaults since UnregisterProcess invalidates the iterator //LeaveCriticalSection(&hostCs); //DeleteCriticalSection(&hostCs); //CloseHandle(preventDuplicationMutex); } DLLEXPORT bool InjectProcess(DWORD processId, DWORD timeout) { if (processId == GetCurrentProcessId()) return false; CloseHandle(CreateMutexW(nullptr, FALSE, (ITH_HOOKMAN_MUTEX_ + std::to_wstring(processId)).c_str())); if (GetLastError() == ERROR_ALREADY_EXISTS) { AddConsoleOutput(L"already injected"); return false; } HMODULE textHooker = LoadLibraryExW(ITH_DLL, nullptr, DONT_RESOLVE_DLL_REFERENCES); wchar_t textHookerPath[MAX_PATH]; unsigned int textHookerPathSize = GetModuleFileNameW(textHooker, textHookerPath, MAX_PATH) * 2 + 2; FreeLibrary(textHooker); if (HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId)) if (LPVOID remoteData = VirtualAllocEx(processHandle, nullptr, textHookerPathSize, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE)) if (WriteProcessMemory(processHandle, remoteData, textHookerPath, textHookerPathSize, nullptr)) if (HANDLE thread = CreateRemoteThread(processHandle, nullptr, 0, (LPTHREAD_START_ROUTINE)LoadLibraryW, remoteData, 0, nullptr)) { WaitForSingleObject(thread, timeout); CloseHandle(thread); VirtualFreeEx(processHandle, remoteData, 0, MEM_RELEASE); CloseHandle(processHandle); return true; } AddConsoleOutput(L"couldn't inject dll"); return false; } DLLEXPORT bool DetachProcess(DWORD processId) { DWORD command = HOST_COMMAND_DETACH; DWORD unused; return WriteFile(processRecordsByIds[processId].hostPipe, &command, sizeof(command), &unused, nullptr); } DLLEXPORT bool InsertHook(DWORD pid, HookParam hp, std::string name) { BYTE buffer[PIPE_BUFFER_SIZE] = {}; *(DWORD*)buffer = HOST_COMMAND_NEW_HOOK; *(HookParam*)(buffer + sizeof(DWORD)) = hp; if (name.size()) strcpy((char*)buffer + sizeof(DWORD) + sizeof(HookParam), name.c_str()); DWORD unused; return WriteFile(processRecordsByIds[pid].hostPipe, buffer, sizeof(DWORD) + sizeof(HookParam) + name.size(), &unused, nullptr); } DLLEXPORT bool RemoveHook(DWORD pid, DWORD addr) { BYTE buffer[sizeof(DWORD) * 2] = {}; *(DWORD*)buffer = HOST_COMMAND_REMOVE_HOOK; *(DWORD*)(buffer + sizeof(DWORD)) = addr; DWORD unused; return WriteFile(processRecordsByIds[pid].hostPipe, buffer, sizeof(DWORD) * 2, &unused, nullptr); } DLLEXPORT HookParam GetHookParam(DWORD pid, DWORD addr) { HOST_LOCK; HookParam ret = {}; ProcessRecord pr = processRecordsByIds[pid]; if (pr.hookman_map == nullptr) return ret; MutexLocker locker(pr.hookman_mutex); const Hook* hooks = (const Hook*)pr.hookman_map; for (int i = 0; i < MAX_HOOK; ++i) if ((DWORD)hooks[i].Address() == addr) ret = hooks[i].hp; return ret; } DLLEXPORT std::wstring GetHookName(DWORD pid, DWORD addr) { if (pid == 0) return L"Console"; HOST_LOCK; std::string buffer = ""; ProcessRecord pr = processRecordsByIds[pid]; if (pr.hookman_map == nullptr) return L""; MutexLocker locker(pr.hookman_mutex); const Hook* hooks = (const Hook*)pr.hookman_map; for (int i = 0; i < MAX_HOOK; ++i) if ((DWORD)hooks[i].Address() == addr) { buffer.resize(hooks[i].NameLength()); ReadProcessMemory(pr.process_handle, hooks[i].Name(), &buffer[0], hooks[i].NameLength(), nullptr); } USES_CONVERSION; return std::wstring(A2W(buffer.c_str())); } DLLEXPORT TextThread* GetThread(DWORD number) { HOST_LOCK; for (auto i : textThreadsByParams) if (i.second->Number() == number) return i.second; return nullptr; } DLLEXPORT void AddConsoleOutput(std::wstring text) { HOST_LOCK; textThreadsByParams[{ 0, -1UL, -1UL, -1UL }]->AddSentence(std::wstring(text)); } DLLEXPORT void RegisterThreadCreateCallback(ThreadEventCallback cf) { onCreate = cf; } DLLEXPORT void RegisterThreadRemoveCallback(ThreadEventCallback cf) { onRemove = cf; } DLLEXPORT void RegisterProcessAttachCallback(ProcessEventCallback cf) { onAttach = cf; } DLLEXPORT void RegisterProcessDetachCallback(ProcessEventCallback cf) { onDetach = cf; } } void DispatchText(DWORD pid, DWORD hook, DWORD retn, DWORD split, const BYTE * text, int len) { // jichi 2/27/2013: When PID is zero, the text comes from console, which I don't need if (!text || !pid || len <= 0) return; HOST_LOCK; ThreadParameter tp = { pid, hook, retn, split }; TextThread *it; if ((it = textThreadsByParams[tp]) == nullptr) { it = textThreadsByParams[tp] = new TextThread(tp, nextThreadNumber++, Host::GetHookParam(pid, hook).type); if (onCreate) onCreate(it); } it->AddText(text, len); } void RemoveThreads(bool(*RemoveIf)(ThreadParameter, ThreadParameter), ThreadParameter cmp) { HOST_LOCK; std::vector removedThreads; for (auto i : textThreadsByParams) if (RemoveIf(i.first, cmp)) { if (onRemove) onRemove(i.second); //delete i.second; // Artikash 7/24/2018: FIXME: Qt GUI updates on another thread, so I can't delete this yet. i.second->Clear(); // Temp workaround to free some memory. removedThreads.push_back(i.first); } for (auto i : removedThreads) textThreadsByParams.erase(i); } void RegisterProcess(DWORD pid, HANDLE hostPipe) { HOST_LOCK; ProcessRecord record; record.hostPipe = hostPipe; record.hookman_section = OpenFileMappingW(FILE_MAP_READ, FALSE, (ITH_SECTION_ + std::to_wstring(pid)).c_str()); record.hookman_map = MapViewOfFile(record.hookman_section, FILE_MAP_READ, 0, 0, HOOK_SECTION_SIZE / 2); // jichi 1/16/2015: Changed to half to hook section size record.process_handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid); record.hookman_mutex = OpenMutexW(MUTEX_ALL_ACCESS, FALSE, (ITH_HOOKMAN_MUTEX_ + std::to_wstring(pid)).c_str()); processRecordsByIds[pid] = record; if (onAttach) onAttach(pid); } void UnregisterProcess(DWORD pid) { HOST_LOCK; ProcessRecord pr = processRecordsByIds[pid]; if (!pr.hostPipe) return; CloseHandle(pr.hookman_mutex); UnmapViewOfFile(pr.hookman_map); CloseHandle(pr.process_handle); CloseHandle(pr.hookman_section); processRecordsByIds.erase(pid); RemoveThreads([](auto one, auto two) { return one.pid == two.pid; }, { pid, 0, 0, 0 }); if (onDetach) onDetach(pid); } // EOF