chenx221/Textractor
1
0
Fork 0
forked from Public-Mirror/Textractor
Code Pull Requests Activity

finally, hooks work in x64!

Browse Source
This commit is contained in:
Akash Mozumdar 2018-12-20 11:46:11 -05:00
parent 7ec7253ec3
commit 7cd464661b
2 changed files with 129 additions and 105 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

228
vnrhook/texthook.cc
View File

@ -14,6 +14,7 @@
#include "engine/match.h" #include "engine/match.h"
#include "main.h" #include "main.h"
#include "const.h" #include "const.h"
#include "defs.h"
#include "text.h" #include "text.h"
#include "ithsys/ithsys.h" #include "ithsys/ithsys.h"
#include "growl.h" #include "growl.h"
@ -27,61 +28,71 @@ namespace { // unnamed
#ifndef _WIN64 #ifndef _WIN64
BYTE common_hook[] = { BYTE common_hook[] = {
0x9c, // pushfd 0x9c, // pushfd
0x60, // pushad 0x60, // pushad
0x9c, // pushfd ; Artikash 11/4/2018: not sure why pushfd happens twice. Anyway, after this a total of 0x28 bytes are pushed 0x9c, // pushfd ; Artikash 11/4/2018: not sure why pushfd happens twice. Anyway, after this a total of 0x28 bytes are pushed
0x8d, 0x44, 0x24, 0x28, // lea eax,[esp+0x28] 0x8d, 0x44, 0x24, 0x28, // lea eax,[esp+0x28]
0x50, // push eax ; dwDatabase 0x50, // push eax ; dwDatabase
0xb9, 0,0,0,0, // mov ecx,@this 0xb9, 0,0,0,0, // mov ecx,@this
0xbb, 0,0,0,0, // mov ebx,@TextHook::Send 0xbb, 0,0,0,0, // mov ebx,@TextHook::Send
0xff, 0xd3, // call ebx 0xff, 0xd3, // call ebx
0x9d, // popfd 0x9d, // popfd
0x61, // popad 0x61, // popad
0x9d, // popfd 0x9d, // popfd
0x68, 0,0,0,0, // push @original 0x68, 0,0,0,0, // push @original
0xc3 // ret ; basically absolute jmp to @original 0xc3 // ret ; basically absolute jmp to @original
}; };
#else #else
const BYTE common_hook[] = { BYTE common_hook[] = {
0x9c, // push rflags 0x9c, // push rflags
0x50, // push rax 0x50, // push rax
0x53, // push rbx 0x53, // push rbx
0x51, // push rcx 0x51, // push rcx
0x52, // push rdx 0x52, // push rdx
0x54, // push rsp 0x54, // push rsp
0x55, // push rbp 0x55, // push rbp
0x56, // push rsi 0x56, // push rsi
0x57, // push rdi 0x57, // push rdi
0x41, 0x50, // push r8 0x41, 0x50, // push r8
0x41, 0x51, // push r9 0x41, 0x51, // push r9
0x41, 0x52, // push r10 0x41, 0x52, // push r10
0x41, 0x53, // push r11 0x41, 0x53, // push r11
0x41, 0x54, // push r12 0x41, 0x54, // push r12
0x41, 0x55, // push r13 0x41, 0x55, // push r13
0x41, 0x56, // push r14 0x41, 0x56, // push r14
0x41, 0x57, // push r15 0x41, 0x57, // push r15
0x48, 0x8b, 0xd4, // mov rdx,rsp // https://docs.microsoft.com/en-us/cpp/build/x64-calling-convention
0x48, 0xb9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, // mov rcx, ?? ; pointer to TextHook // https://stackoverflow.com/questions/43358429/save-value-of-xmm-registers
0xff, 0x15, 0x02, 0x0, 0x0, 0x0, 0xeb, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, // call TextHook::Send 0x48, 0x83, 0xec, 0x20, // sub rsp,0x20
0x41, 0x5f, // pop r15 0xc5, 0xfa, 0x7f, 0x24, 0x24, // vmovdqu [rsp],xmm4
0x41, 0x5e, // pop r14 0xc5, 0xfa, 0x7f, 0x6c, 0x24, 0x10, // vmovdqu [rsp+0x10],xmm5
0x41, 0x5d, // pop r13 0x48, 0x8d, 0x94, 0x24, 0xa8, 0x00, 0x00, 0x00, // lea rdx,[rsp+0xa8]
0x41, 0x5c, // pop r12 0x48, 0xb9, 0,0,0,0,0,0,0,0, // mov rcx,@this
0x41, 0x5b, // pop r11 0x48, 0xb8, 0,0,0,0,0,0,0,0, // mov rax,@TextHook::Send
0x41, 0x5a, // pop r10 0xff, 0xd0, // call rax
0x41, 0x59, // pop r9 0xc5, 0xfa, 0x6f, 0x6c, 0x24, 0x10, // vmovdqu xmm5,XMMWORD PTR[rsp + 0x10]
0x41, 0x58, // pop r8 0xc5, 0xfa, 0x6f, 0x24, 0x24, // vmovdqu xmm4,XMMWORD PTR[rsp]
0x5f, // pop rdi 0x48, 0x83, 0xc4, 0x20, // add rsp,0x20
0x5e, // pop rsi 0x41, 0x5f, // pop r15
0x5d, // pop rbp 0x41, 0x5e, // pop r14
0x5c, // pop rsp 0x41, 0x5d, // pop r13
0x5a, // pop rdx 0x41, 0x5c, // pop r12
0x59, // pop rcx 0x41, 0x5b, // pop r11
0x5b, // pop rbx 0x41, 0x5a, // pop r10
0x58, // pop rax 0x41, 0x59, // pop r9
0x9d, // pop rflags 0x41, 0x58, // pop r8
0xff, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 // jmp @original 0x5f, // pop rdi
0x5e, // pop rsi
0x5d, // pop rbp
0x5c, // pop rsp
0x5a, // pop rdx
0x59, // pop rcx
0x5b, // pop rbx
0x58, // pop rax
0x9d, // pop rflags
0xff, 0x25, 0x00, 0x00, 0x00, 0x00, // jmp qword ptr [0] ; relative to next instruction (i.e. jmp @original)
0,0,0,0,0,0,0,0 // @original
}; };
#endif #endif
@ -103,62 +114,46 @@ bool TextHook::Insert(HookParam h, DWORD set_flag)
hp.type |= set_flag; hp.type |= set_flag;
if (hp.type & USING_UTF8) hp.codepage = CP_UTF8; if (hp.type & USING_UTF8) hp.codepage = CP_UTF8;
if (hp.type & DIRECT_READ) return InsertReadCode(); if (hp.type & DIRECT_READ) return InsertReadCode();
#ifndef _WIN64
else return InsertHookCode(); else return InsertHookCode();
#endif
return false;
} }
#ifndef _WIN64
// jichi 5/11/2014: // jichi 5/11/2014:
// - dwDataBase: the stack address // - dwDataBase: the stack address
void TextHook::Send(DWORD dwDataBase) #ifndef _WIN64
void TextHook::Send(uintptr_t dwDataBase)
{ {
__try __try
{ {
DWORD dwCount, DWORD dwCount = 0,
dwAddr, dwSplit = 0,
dwDataIn, dwDataIn = *(DWORD*)(dwDataBase + hp.offset), // default values
dwRetn, dwRetn = *(DWORD*)dwDataBase; // first value on stack (if hooked start of function, this is return address)
dwSplit;
BYTE pbData[PIPE_BUFFER_SIZE];
DWORD dwType = hp.type;
dwAddr = address; if (trigger) trigger = Engine::InsertDynamicHook(location, *(DWORD *)(dwDataBase - 0x1c), *(DWORD *)(dwDataBase - 0x18));
dwRetn = *(DWORD*)dwDataBase; // first value on stack (if hooked start of function, this is return address)
if (trigger)
trigger = Engine::InsertDynamicHook((LPVOID)dwAddr, *(DWORD *)(dwDataBase - 0x1c), *(DWORD *)(dwDataBase - 0x18));
// jichi 10/24/2014: generic hook function // jichi 10/24/2014: generic hook function
if (hp.hook_fun && !hp.hook_fun(dwDataBase, &hp)) if (hp.hook_fun && !hp.hook_fun(dwDataBase, &hp)) hp.hook_fun = nullptr;
hp.hook_fun = nullptr;
if (dwType & HOOK_EMPTY) return; // jichi 10/24/2014: dummy hook only for dynamic hook if (hp.type & HOOK_EMPTY) return; // jichi 10/24/2014: dummy hook only for dynamic hook
dwCount = 0;
dwSplit = 0;
dwDataIn = *(DWORD *)(dwDataBase + hp.offset); // default value
if (hp.text_fun) { if (hp.text_fun) {
hp.text_fun(dwDataBase, &hp, 0, &dwDataIn, &dwSplit, &dwCount); hp.text_fun(dwDataBase, &hp, 0, &dwDataIn, &dwSplit, &dwCount);
} }
else { else {
if (dwDataIn == 0) return; if (hp.type & FIXING_SPLIT) dwSplit = FIXED_SPLIT_VALUE; // fuse all threads, and prevent floating
if (dwType & FIXING_SPLIT) dwSplit = FIXED_SPLIT_VALUE; // fuse all threads, and prevent floating else if (hp.type & USING_SPLIT) {
else if (dwType & USING_SPLIT) {
dwSplit = *(DWORD *)(dwDataBase + hp.split); dwSplit = *(DWORD *)(dwDataBase + hp.split);
if (dwType & SPLIT_INDIRECT) dwSplit = *(DWORD *)(dwSplit + hp.split_index); if (hp.type & SPLIT_INDIRECT) dwSplit = *(DWORD *)(dwSplit + hp.split_index);
} }
if (dwType & DATA_INDIRECT) dwDataIn = *(DWORD *)(dwDataIn + hp.index); if (hp.type & DATA_INDIRECT) dwDataIn = *(DWORD *)(dwDataIn + hp.index);
dwCount = GetLength(dwDataBase, dwDataIn); dwCount = GetLength(dwDataBase, dwDataIn);
} }
if (dwCount == 0 || dwCount > PIPE_BUFFER_SIZE - sizeof(ThreadParam)) return; if (dwCount == 0 || dwCount > PIPE_BUFFER_SIZE - sizeof(ThreadParam)) return;
BYTE pbData[PIPE_BUFFER_SIZE];
if (hp.length_offset == 1) { if (hp.length_offset == 1) {
dwDataIn &= 0xffff; dwDataIn &= 0xffff;
if ((dwType & BIG_ENDIAN) && (dwDataIn >> 8)) dwDataIn = _byteswap_ushort(dwDataIn & 0xffff); if ((hp.type & BIG_ENDIAN) && (dwDataIn >> 8)) dwDataIn = _byteswap_ushort(dwDataIn & 0xffff);
if (dwCount == 1) dwDataIn &= 0xff; if (dwCount == 1) dwDataIn &= 0xff;
*(WORD*)pbData = dwDataIn & 0xffff; *(WORD*)pbData = dwDataIn & 0xffff;
} }
@ -166,15 +161,53 @@ void TextHook::Send(DWORD dwDataBase)
if (hp.filter_fun && !hp.filter_fun(pbData, &dwCount, &hp, 0) || dwCount <= 0) return; if (hp.filter_fun && !hp.filter_fun(pbData, &dwCount, &hp, 0) || dwCount <= 0) return;
if (dwType & (NO_CONTEXT | FIXING_SPLIT)) dwRetn = 0; if (hp.type & (NO_CONTEXT | FIXING_SPLIT)) dwRetn = 0;
TextOutput({ GetCurrentProcessId(), dwAddr, dwRetn, dwSplit }, pbData, dwCount); TextOutput({ GetCurrentProcessId(), address, dwRetn, dwSplit }, pbData, dwCount);
} }
__except (EXCEPTION_EXECUTE_HANDLER) __except (EXCEPTION_EXECUTE_HANDLER)
{ {
ConsoleOutput("Textractor: Send ERROR (likely an incorrect H-code)"); ConsoleOutput("Textractor: Send ERROR (likely an incorrect H-code)");
} }
} }
#else // _WIN32
void TextHook::Send(uintptr_t dwDataBase)
{
__try
{
int count = 0;
ThreadParam tp = { GetCurrentProcessId(), address, *(uintptr_t*)dwDataBase, 0 }; // first value on stack (if hooked start of function, this is return address)
uintptr_t data = *(uintptr_t*)(dwDataBase + hp.offset); // default value
if (hp.type & USING_SPLIT)
{
tp.ctx2 = *(uintptr_t*)(dwDataBase + hp.split);
if (hp.type & SPLIT_INDIRECT) tp.ctx2 = *(uintptr_t*)(tp.ctx2 + hp.split_index);
}
if (hp.type & DATA_INDIRECT) data = *(uintptr_t*)(data + hp.index);
count = GetLength(dwDataBase, data);
if (count == 0) return;
BYTE pbData[PIPE_BUFFER_SIZE];
if (hp.length_offset == 1)
{
data &= 0xffff;
if ((hp.type & BIG_ENDIAN) && (data >> 8)) data = _byteswap_ushort(data & 0xffff);
if (count == 1) data &= 0xff;
*(WORD*)pbData = data & 0xffff;
}
else ::memcpy(pbData, (void*)data, count);
if (hp.type & (NO_CONTEXT | FIXING_SPLIT)) tp.ctx = 0;
TextOutput(tp, pbData, count);
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
ConsoleOutput("Textractor: Send ERROR (likely an incorrect H-code)");
}
}
#endif // _WIN64
bool TextHook::InsertHookCode() bool TextHook::InsertHookCode()
{ {
@ -203,23 +236,16 @@ insert:
#ifndef _WIN64 #ifndef _WIN64
*(TextHook**)(common_hook + 9) = this; *(TextHook**)(common_hook + 9) = this;
*(void(TextHook::**)(DWORD))(common_hook + 14) = &TextHook::Send; *(void(TextHook::**)(uintptr_t))(common_hook + 14) = &TextHook::Send;
*(void**)(common_hook + 24) = original; *(void**)(common_hook + 24) = original;
memcpy(trampoline, common_hook, sizeof(common_hook));
#else // _WIN32 #else // _WIN32
BYTE* original; *(TextHook**)(common_hook + 50) = this;
MH_CreateHook((void*)hp.address, (void*)trampoline, (void**)&original); *(void(TextHook::**)(uintptr_t))(common_hook + 60) = &TextHook::Send;
memcpy(trampoline, common_hook, sizeof(common_hook)); *(void**)(common_hook + 116) = original;
void* thisPtr = (void*)this;
memcpy(trampoline + 30, &thisPtr, sizeof(void*));
auto sendPtr = (void(TextHook::*)(void*))&TextHook::Send;
memcpy(trampoline + 46, &sendPtr, sizeof(sendPtr));
memcpy(trampoline + sizeof(common_hook) - 8, &original, sizeof(void*));
#endif // _WIN64 #endif // _WIN64
memcpy(trampoline, common_hook, sizeof(common_hook));
return MH_EnableHook(location) == MH_OK; return MH_EnableHook(location) == MH_OK;
} }
#endif // _WIN32
DWORD WINAPI TextHook::Reader(LPVOID hookPtr) DWORD WINAPI TextHook::Reader(LPVOID hookPtr)
{ {
@ -290,14 +316,12 @@ void TextHook::Clear()
memset(this, 0, sizeof(TextHook)); // jichi 11/30/2013: This is the original code of ITH memset(this, 0, sizeof(TextHook)); // jichi 11/30/2013: This is the original code of ITH
} }
int TextHook::GetLength(DWORD base, DWORD in) int TextHook::GetLength(uintptr_t base, uintptr_t in)
{ {
if (base == 0)
return 0;
int len; int len;
switch (hp.length_offset) { switch (hp.length_offset) {
default: // jichi 12/26/2013: I should not put this default branch to the end default: // jichi 12/26/2013: I should not put this default branch to the end
len = *((int *)base + hp.length_offset); len = *((uintptr_t*)base + hp.length_offset);
if (len >= 0) { if (len >= 0) {
if (hp.type & USING_UNICODE) if (hp.type & USING_UNICODE)
len <<= 1; len <<= 1;

6
vnrhook/texthook.h
View File

@ -32,13 +32,13 @@ private:
static DWORD WINAPI Reader(LPVOID hookPtr); static DWORD WINAPI Reader(LPVOID hookPtr);
bool InsertHookCode(); bool InsertHookCode();
bool InsertReadCode(); bool InsertReadCode();
void Send(DWORD dwDatabase); void Send(uintptr_t dwDatabase);
int GetLength(DWORD base, DWORD in); // jichi 12/25/2013: Return 0 if failed int GetLength(uintptr_t base, uintptr_t in); // jichi 12/25/2013: Return 0 if failed
void RemoveHookCode(); void RemoveHookCode();
void RemoveReadCode(); void RemoveReadCode();
HANDLE readerThread, readerEvent; HANDLE readerThread, readerEvent;
BYTE trampoline[120]; BYTE trampoline[130];
}; };