Textractor/vnrhook/texthook.cc

359 lines
9.9 KiB
C++
Raw Normal View History

// texthook.cc
// 8/24/2013 jichi
// Branch: ITH_DLL/texthook.cpp, rev 128
// 8/24/2013 TODO: Clean up this file
#ifdef _MSC_VER
# pragma warning (disable:4100) // C4100: unreference formal parameter
# pragma warning (disable:4018) // C4018: sign/unsigned mismatch
//# pragma warning (disable:4733) // C4733: Inline asm assigning to 'FS:0' : handler not registered as safe handler
#endif // _MSC_VER
2018-11-10 23:29:12 -05:00
#include "texthook.h"
2018-08-25 15:45:25 -04:00
#include "MinHook.h"
2018-08-23 11:53:23 -04:00
#include "engine/match.h"
#include "main.h"
#include "const.h"
#include "ithsys/ithsys.h"
2018-08-23 15:25:33 -04:00
#include "growl.h"
2018-08-25 15:45:25 -04:00
#include <Psapi.h>
2018-11-10 23:29:12 -05:00
extern std::unique_ptr<WinMutex> sectionMutex;
bool trigger = 0;
void SetTrigger()
{
trigger = true;
}
// - Unnamed helpers -
namespace { // unnamed
2018-08-26 15:14:45 -04:00
#ifndef _WIN64
BYTE common_hook[] = {
2018-08-25 15:45:25 -04:00
0x9c, // pushfd
0x60, // pushad
0x9c, // pushfd ; Artikash 11/4/2018: not sure why pushfd happens twice. Anyway, after this a total of 0x28 bytes are pushed
0x8d, 0x44, 0x24, 0x28, // lea eax,[esp+0x28]
0x50, // push eax ; dwDatabase
0xb9, 0,0,0,0, // mov ecx,@this
0xbb, 0,0,0,0, // mov ebx,@TextHook::Send
0xff, 0xd3, // call ebx
2018-08-25 15:45:25 -04:00
0x9d, // popfd
0x61, // popad
0x9d, // popfd
0x68, 0,0,0,0, // push @original
0xc3 // ret ; basically absolute jmp to @original
2018-08-25 15:45:25 -04:00
};
2018-08-26 15:14:45 -04:00
#else
const BYTE common_hook[] = {
0x9c, // push rflags
0x50, // push rax
0x53, // push rbx
0x51, // push rcx
0x52, // push rdx
0x54, // push rsp
0x55, // push rbp
0x56, // push rsi
0x57, // push rdi
0x41, 0x50, // push r8
0x41, 0x51, // push r9
0x41, 0x52, // push r10
0x41, 0x53, // push r11
0x41, 0x54, // push r12
0x41, 0x55, // push r13
0x41, 0x56, // push r14
0x41, 0x57, // push r15
0x48, 0x8b, 0xd4, // mov rdx,rsp
0x48, 0xb9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, // mov rcx, ?? ; pointer to TextHook
0xff, 0x15, 0x02, 0x0, 0x0, 0x0, 0xeb, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, // call TextHook::Send
0x41, 0x5f, // pop r15
0x41, 0x5e, // pop r14
0x41, 0x5d, // pop r13
0x41, 0x5c, // pop r12
0x41, 0x5b, // pop r11
0x41, 0x5a, // pop r10
0x41, 0x59, // pop r9
0x41, 0x58, // pop r8
0x5f, // pop rdi
0x5e, // pop rsi
0x5d, // pop rbp
0x5c, // pop rsp
0x5a, // pop rdx
0x59, // pop rcx
0x5b, // pop rbx
0x58, // pop rax
0x9d, // pop rflags
0xff, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 // jmp @original
};
#endif
} // unnamed namespace
// - TextHook methods -
2018-08-25 15:45:25 -04:00
bool TextHook::InsertHook()
2018-08-07 15:44:13 -04:00
{
2018-08-25 15:45:25 -04:00
//ConsoleOutput("vnrcli:InsertHook: enter");
LOCK(*sectionMutex);
2018-11-01 21:59:13 -04:00
if (hp.type & USING_UTF8) hp.codepage = CP_UTF8;
if (hp.type & DIRECT_READ) return InsertReadCode();
2018-08-07 15:44:13 -04:00
#ifndef _WIN64
else return InsertHookCode();
2018-08-07 15:44:13 -04:00
#endif
2018-08-25 15:45:25 -04:00
//ConsoleOutput("vnrcli:InsertHook: leave");
return false;
2018-08-07 15:44:13 -04:00
}
#ifndef _WIN64
// jichi 5/11/2014:
// - dwDataBase: the stack address
void TextHook::Send(DWORD dwDataBase)
{
__try
{
DWORD dwCount,
dwAddr,
dwDataIn,
dwRetn,
dwSplit;
BYTE pbData[PIPE_BUFFER_SIZE];
DWORD dwType = hp.type;
dwAddr = hp.insertion_address;
dwRetn = *(DWORD*)dwDataBase; // first value on stack (if hooked start of function, this is return address)
/** jichi 12/24/2014
* @param addr function address
* @param frame real address of the function, supposed to be the same as addr
* @param stack address of current stack - 4
* @return If success, which is reverted
*/
2018-11-10 23:29:12 -05:00
if (trigger)
trigger = Engine::InsertDynamicHook((LPVOID)dwAddr, *(DWORD *)(dwDataBase - 0x1c), *(DWORD *)(dwDataBase - 0x18));
// jichi 10/24/2014: generic hook function
if (hp.hook_fun && !hp.hook_fun(dwDataBase, &hp))
hp.hook_fun = nullptr;
if (dwType & HOOK_EMPTY) return; // jichi 10/24/2014: dummy hook only for dynamic hook
dwCount = 0;
dwSplit = 0;
dwDataIn = *(DWORD *)(dwDataBase + hp.offset); // default value
if (hp.text_fun) {
hp.text_fun(dwDataBase, &hp, 0, &dwDataIn, &dwSplit, &dwCount);
}
else {
if (dwDataIn == 0)
return;
if (dwType & FIXING_SPLIT)
dwSplit = FIXED_SPLIT_VALUE; // fuse all threads, and prevent floating
else if (dwType & USING_SPLIT) {
dwSplit = *(DWORD *)(dwDataBase + hp.split);
if (dwType & SPLIT_INDIRECT) {
if (IthGetMemoryRange((LPVOID)(dwSplit + hp.split_index), 0, 0)) dwSplit = *(DWORD *)(dwSplit + hp.split_index);
else return;
}
}
if (dwType & DATA_INDIRECT) {
if (IthGetMemoryRange((LPVOID)(dwDataIn + hp.index), 0, 0)) dwDataIn = *(DWORD *)(dwDataIn + hp.index);
else return;
2018-08-25 15:45:25 -04:00
}
dwCount = GetLength(dwDataBase, dwDataIn);
2018-08-25 15:45:25 -04:00
}
// jichi 12/25/2013: validate data size
if (dwCount == 0 || dwCount > PIPE_BUFFER_SIZE - sizeof(ThreadParam)) return;
if (hp.length_offset == 1) {
dwDataIn &= 0xffff;
if ((dwType & BIG_ENDIAN) && (dwDataIn >> 8))
dwDataIn = _byteswap_ushort(dwDataIn & 0xffff);
if (dwCount == 1)
dwDataIn &= 0xff;
2018-11-10 23:29:12 -05:00
*(WORD*)pbData = dwDataIn & 0xffff;
2018-08-25 15:45:25 -04:00
}
else
2018-11-10 23:29:12 -05:00
::memcpy(pbData, (void*)dwDataIn, dwCount);
2018-08-25 15:45:25 -04:00
// jichi 10/14/2014: Add filter function
2018-11-10 23:29:12 -05:00
if (hp.filter_fun && !hp.filter_fun(pbData, &dwCount, &hp, 0) || dwCount <= 0) return;
2018-08-25 15:45:25 -04:00
if (dwType & (NO_CONTEXT | FIXING_SPLIT))
dwRetn = 0;
2018-11-10 23:29:12 -05:00
TextOutput({ GetCurrentProcessId(), dwAddr, dwRetn, dwSplit }, pbData, dwCount);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
ConsoleOutput("Textractor: Send ERROR (likely an incorrect H-code)");
2018-08-25 15:45:25 -04:00
}
}
2018-08-25 15:45:25 -04:00
bool TextHook::InsertHookCode()
{
2018-08-25 15:45:25 -04:00
// jichi 9/17/2013: might raise 0xC0000005 AccessViolationException on win7
// Artikash 10/30/2018: No, I think that's impossible now that I moved to minhook
2018-10-30 20:50:50 -04:00
if (hp.type & MODULE_OFFSET) // Map hook offset to real address
if (hp.type & FUNCTION_OFFSET)
if (FARPROC function = GetProcAddress(GetModuleHandleW(hp.module), hp.function)) hp.insertion_address += (uint64_t)function;
else return ConsoleOutput("Textractor: InsertHookCode FAILED: function not present"), false;
else if (HMODULE moduleBase = GetModuleHandleW(hp.module)) hp.insertion_address += (uint64_t)moduleBase;
else return ConsoleOutput("Textractor: InsertHookCode FAILED: module not present"), false;
2018-08-25 15:45:25 -04:00
2018-11-10 23:29:12 -05:00
void* original;
insert:
2018-11-10 23:29:12 -05:00
if (MH_STATUS err = MH_CreateHook((void*)hp.insertion_address, (void*)trampoline, &original))
2018-08-29 17:15:59 -04:00
if (err == MH_ERROR_ALREADY_CREATED)
{
RemoveHook(hp.insertion_address);
2018-08-29 17:15:59 -04:00
goto insert; // FIXME: i'm too lazy to do this properly right now...
}
2018-08-26 22:21:15 -04:00
else
{
ConsoleOutput(("Textractor: InsertHookCode FAILED: error " + std::string(MH_StatusToString(err))).c_str());
2018-08-26 22:21:15 -04:00
return false;
}
2018-08-25 15:45:25 -04:00
*(TextHook**)(common_hook + 9) = this;
*(void(TextHook::**)(DWORD))(common_hook + 14) = &TextHook::Send;
2018-11-10 23:29:12 -05:00
*(void**)(common_hook + 24) = original;
2018-08-25 15:45:25 -04:00
memcpy(trampoline, common_hook, sizeof(common_hook));
2018-08-26 15:14:45 -04:00
//BYTE* original;
//MH_CreateHook((void*)hp.address, (void*)trampoline, (void**)&original);
//memcpy(trampoline, common_hook, sizeof(common_hook));
//void* thisPtr = (void*)this;
//memcpy(trampoline + 30, &thisPtr, sizeof(void*));
//auto sendPtr = (void(TextHook::*)(void*))&TextHook::Send;
//memcpy(trampoline + 46, &sendPtr, sizeof(sendPtr));
//memcpy(trampoline + sizeof(common_hook) - 8, &original, sizeof(void*));
if (MH_EnableHook((void*)hp.insertion_address) != MH_OK) return false;
2018-08-25 15:45:25 -04:00
return true;
}
2018-08-07 15:44:13 -04:00
#endif // _WIN32
2018-11-10 23:29:12 -05:00
DWORD WINAPI Reader(LPVOID hookPtr)
2018-08-07 15:44:13 -04:00
{
2018-08-26 22:21:15 -04:00
TextHook* hook = (TextHook*)hookPtr;
2018-08-07 15:44:13 -04:00
BYTE buffer[PIPE_BUFFER_SIZE] = {};
unsigned int changeCount = 0;
2018-08-23 13:15:24 -04:00
int dataLen = 0;
__try
2018-08-07 15:44:13 -04:00
{
const void* currentAddress = (void*)hook->hp.insertion_address;
while (true)
2018-08-07 15:44:13 -04:00
{
if (hook->hp.type & DATA_INDIRECT) currentAddress = *((char**)hook->hp.insertion_address + hook->hp.index);
Sleep(500);
2018-11-10 23:29:12 -05:00
if (memcmp(buffer, currentAddress, dataLen + 1) == 0)
{
changeCount = 0;
continue;
}
if (++changeCount > 10)
{
ConsoleOutput("Textractor: memory constantly changing, useless to read");
break;
}
2018-08-07 15:44:13 -04:00
if (hook->hp.type & USING_UNICODE)
dataLen = wcslen((const wchar_t*)currentAddress) * 2;
else
dataLen = strlen((const char*)currentAddress);
2018-08-07 15:44:13 -04:00
2018-11-10 23:29:12 -05:00
memcpy(buffer, currentAddress, dataLen + 1);
TextOutput({ GetCurrentProcessId(), hook->hp.insertion_address, 0, 0 }, buffer, dataLen);
}
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
2018-11-10 23:29:12 -05:00
ConsoleOutput("Textractor: Reader ERROR (likely an incorrect R-code)");
2018-08-07 15:44:13 -04:00
}
2018-09-29 16:05:08 -04:00
ConsoleOutput("Textractor: remove read code");
2018-08-07 15:44:13 -04:00
hook->ClearHook();
return 0;
}
2018-08-25 15:45:25 -04:00
bool TextHook::InsertReadCode()
2018-08-07 15:44:13 -04:00
{
2018-09-02 18:28:37 -04:00
//RemoveHook(hp.address); // Artikash 8/25/2018: clear existing
2018-11-10 23:29:12 -05:00
readerHandle = CreateThread(nullptr, 0, Reader, this, 0, nullptr);
2018-08-25 15:45:25 -04:00
return true;
2018-08-07 15:44:13 -04:00
}
2018-11-10 23:29:12 -05:00
void TextHook::InitHook(HookParam h, LPCSTR name, DWORD set_flag)
{
LOCK(*sectionMutex);
2018-11-10 23:29:12 -05:00
this->hp = h;
hp.insertion_address = hp.address;
2018-08-25 15:45:25 -04:00
hp.type |= set_flag;
strcpy_s<HOOK_NAME_SIZE>(hookName, name);
}
2018-08-25 15:45:25 -04:00
void TextHook::RemoveHookCode()
{
MH_DisableHook((void*)hp.insertion_address);
MH_RemoveHook((void*)hp.insertion_address);
}
2018-08-25 15:45:25 -04:00
void TextHook::RemoveReadCode()
2018-08-04 18:01:59 -04:00
{
TerminateThread(readerHandle, 0);
CloseHandle(readerHandle);
2018-08-04 18:01:59 -04:00
}
2018-08-25 15:45:25 -04:00
void TextHook::ClearHook()
{
LOCK(*sectionMutex);
ConsoleOutput(("Textractor: removing hook: " + std::string(hookName)).c_str());
2018-08-25 15:45:25 -04:00
if (hp.type & DIRECT_READ) RemoveReadCode();
else RemoveHookCode();
NotifyHookRemove(hp.insertion_address);
2018-08-25 15:45:25 -04:00
memset(this, 0, sizeof(TextHook)); // jichi 11/30/2013: This is the original code of ITH
}
int TextHook::GetLength(DWORD base, DWORD in)
{
2018-08-25 15:45:25 -04:00
if (base == 0)
return 0;
int len;
switch (hp.length_offset) {
default: // jichi 12/26/2013: I should not put this default branch to the end
len = *((int *)base + hp.length_offset);
if (len >= 0) {
if (hp.type & USING_UNICODE)
len <<= 1;
break;
}
else if (len != -1)
break;
//len == -1 then continue to case 0.
case 0:
if (hp.type & USING_UNICODE)
len = wcslen((const wchar_t *)in) << 1;
else
len = strlen((const char *)in);
break;
case 1:
if (hp.type & USING_UNICODE)
len = 2;
else {
if (hp.type & BIG_ENDIAN)
in >>= 8;
len = LeadByteTable[in & 0xff]; //Slightly faster than IsDBCSLeadByte
}
break;
}
// jichi 12/25/2013: This function originally return -1 if failed
//return len;
return max(0, len);
}
// EOF