374 lines
9.6 KiB
C++
374 lines
9.6 KiB
C++
// texthook.cc
|
|
// 8/24/2013 jichi
|
|
// Branch: ITH_DLL/texthook.cpp, rev 128
|
|
// 8/24/2013 TODO: Clean up this file
|
|
|
|
#ifdef _MSC_VER
|
|
# pragma warning (disable:4100) // C4100: unreference formal parameter
|
|
# pragma warning (disable:4018) // C4018: sign/unsigned mismatch
|
|
//# pragma warning (disable:4733) // C4733: Inline asm assigning to 'FS:0' : handler not registered as safe handler
|
|
#endif // _MSC_VER
|
|
|
|
#include "hijack/texthook.h"
|
|
#include "MinHook.h"
|
|
#include "engine/match.h"
|
|
#include "except.h"
|
|
#include "main.h"
|
|
#include "pipe.h"
|
|
#include "const.h"
|
|
#include "ithsys/ithsys.h"
|
|
#include "disasm/disasm.h"
|
|
#include "growl.h"
|
|
#include <Psapi.h>
|
|
|
|
TextHook *hookman;
|
|
|
|
// - Unnamed helpers -
|
|
|
|
#ifndef _WIN64
|
|
namespace { // unnamed
|
|
|
|
const BYTE common_hook[] = {
|
|
0x9c, // pushfd
|
|
0x60, // pushad
|
|
0x9c, // pushfd
|
|
0x8d,0x54,0x24,0x28, // lea edx,[esp+0x28] ; esp value
|
|
0x8b,0x32, // mov esi,[edx] ; return address
|
|
0xb9, 0,0,0,0, // mov ecx, $ ; pointer to TextHook
|
|
0xe8, 0,0,0,0, // call @hook
|
|
0x9d, // popfd
|
|
0x61, // popad
|
|
0x9d, // popfd
|
|
0xe9 // jmp @original
|
|
};
|
|
|
|
DWORD Hash(std::wstring module)
|
|
{
|
|
DWORD hash = 0;
|
|
for (auto i : module) hash = _rotr(hash, 7) + i;
|
|
return hash;
|
|
}
|
|
|
|
//copy original instruction
|
|
//jmp back
|
|
DWORD GetModuleBase(DWORD hash)
|
|
{
|
|
HMODULE allModules[1000];
|
|
DWORD size;
|
|
EnumProcessModules(GetCurrentProcess(), allModules, sizeof(allModules), &size);
|
|
wchar_t name[MAX_PATH];
|
|
for (int i = 0; i < size / sizeof(HMODULE); ++i)
|
|
{
|
|
GetModuleFileNameW(allModules[i], name, MAX_PATH);
|
|
_wcslwr(name);
|
|
if (Hash(wcsrchr(name, L'\\') + 1) == hash) return (DWORD)allModules[i];
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
__declspec(naked) // jichi 10/2/2013: No prolog and epilog
|
|
int ProcessHook(DWORD dwDataBase, DWORD dwRetn, TextHook *hook) // Use SEH to ensure normal execution even bad hook inserted.
|
|
{
|
|
// jichi 12/17/2013: The function parameters here are meaning leass. The parameters are in esi and edi
|
|
__asm
|
|
{
|
|
push esi
|
|
push edx
|
|
call TextHook::Send
|
|
retn // jichi 12/13/2013: return near, see: http://stackoverflow.com/questions/1396909/ret-retn-retf-how-to-use-them
|
|
}
|
|
}
|
|
|
|
} // unnamed namespace
|
|
#endif // _WIN32
|
|
|
|
// - TextHook methods -
|
|
|
|
bool TextHook::InsertHook()
|
|
{
|
|
bool ret = false;
|
|
//ConsoleOutput("vnrcli:InsertHook: enter");
|
|
WaitForSingleObject(hmMutex, 0);
|
|
if (hp.type & DIRECT_READ) ret = InsertReadCode();
|
|
#ifndef _WIN64
|
|
else ret = InsertHookCode();
|
|
#endif
|
|
ReleaseMutex(hmMutex);
|
|
//ConsoleOutput("vnrcli:InsertHook: leave");
|
|
return ret;
|
|
}
|
|
|
|
#ifndef _WIN64
|
|
// jichi 12/2/2013: This function mostly return 0.
|
|
// It return the hook address only for auxiliary case.
|
|
// However, because no known hooks are auxiliary, this function always return 0.
|
|
//
|
|
// jichi 5/11/2014:
|
|
// - dwDataBase: the stack address
|
|
// - dwRetn: the return address of the hook
|
|
DWORD TextHook::Send(DWORD dwDataBase, DWORD dwRetn)
|
|
{
|
|
DWORD ret = 0;
|
|
ITH_WITH_SEH(ret = UnsafeSend(dwDataBase, dwRetn));
|
|
return ret;
|
|
}
|
|
|
|
DWORD TextHook::UnsafeSend(DWORD dwDataBase, DWORD dwRetn)
|
|
{
|
|
DWORD dwCount,
|
|
dwAddr,
|
|
dwDataIn,
|
|
dwSplit;
|
|
BYTE pbData[PIPE_BUFFER_SIZE];
|
|
DWORD dwType = hp.type;
|
|
|
|
dwAddr = hp.address;
|
|
|
|
/** jichi 12/24/2014
|
|
* @param addr function address
|
|
* @param frame real address of the function, supposed to be the same as addr
|
|
* @param stack address of current stack - 4
|
|
* @return If success, which is reverted
|
|
*/
|
|
if (::trigger)
|
|
::trigger = Engine::InsertDynamicHook((LPVOID)dwAddr, *(DWORD *)(dwDataBase - 0x1c), *(DWORD *)(dwDataBase - 0x18));
|
|
|
|
// jichi 10/24/2014: generic hook function
|
|
if (hp.hook_fun && !hp.hook_fun(dwDataBase, &hp))
|
|
hp.hook_fun = nullptr;
|
|
|
|
if (dwType & HOOK_EMPTY) // jichi 10/24/2014: dummy hook only for dynamic hook
|
|
return 0;
|
|
|
|
dwCount = 0;
|
|
dwSplit = 0;
|
|
dwDataIn = *(DWORD *)(dwDataBase + hp.offset); // default value
|
|
|
|
if (hp.text_fun) {
|
|
hp.text_fun(dwDataBase, &hp, 0, &dwDataIn, &dwSplit, &dwCount);
|
|
}
|
|
else {
|
|
if (dwDataIn == 0)
|
|
return 0;
|
|
if (dwType & FIXING_SPLIT)
|
|
dwSplit = FIXED_SPLIT_VALUE; // fuse all threads, and prevent floating
|
|
else if (dwType & USING_SPLIT) {
|
|
dwSplit = *(DWORD *)(dwDataBase + hp.split);
|
|
if (dwType & SPLIT_INDIRECT) {
|
|
if (IthGetMemoryRange((LPVOID)(dwSplit + hp.split_index), 0, 0))
|
|
dwSplit = *(DWORD *)(dwSplit + hp.split_index);
|
|
else
|
|
return 0;
|
|
}
|
|
}
|
|
if (dwType & DATA_INDIRECT) {
|
|
if (IthGetMemoryRange((LPVOID)(dwDataIn + hp.index), 0, 0))
|
|
dwDataIn = *(DWORD *)(dwDataIn + hp.index);
|
|
else
|
|
return 0;
|
|
}
|
|
dwCount = GetLength(dwDataBase, dwDataIn);
|
|
}
|
|
// jichi 12/25/2013: validate data size
|
|
if (dwCount == 0 || dwCount > PIPE_BUFFER_SIZE - sizeof(ThreadParam))
|
|
return 0;
|
|
|
|
if (hp.length_offset == 1) {
|
|
dwDataIn &= 0xffff;
|
|
if ((dwType & BIG_ENDIAN) && (dwDataIn >> 8))
|
|
dwDataIn = _byteswap_ushort(dwDataIn & 0xffff);
|
|
if (dwCount == 1)
|
|
dwDataIn &= 0xff;
|
|
*(WORD *)(pbData + sizeof(ThreadParam)) = dwDataIn & 0xffff;
|
|
}
|
|
else
|
|
::memcpy(pbData + sizeof(ThreadParam), (void *)dwDataIn, dwCount);
|
|
|
|
// jichi 10/14/2014: Add filter function
|
|
if (hp.filter_fun && !hp.filter_fun(pbData + sizeof(ThreadParam), &dwCount, &hp, 0) || dwCount <= 0) {
|
|
return 0;
|
|
}
|
|
|
|
if (dwType & (NO_CONTEXT | FIXING_SPLIT))
|
|
dwRetn = 0;
|
|
|
|
*(ThreadParam*)pbData = { GetCurrentProcessId(), dwAddr, dwRetn, dwSplit };
|
|
if (dwCount) {
|
|
DWORD unused;
|
|
|
|
//CliLockPipe();
|
|
WriteFile(::hookPipe, pbData, dwCount + sizeof(ThreadParam), &unused, nullptr);
|
|
//CliUnlockPipe();
|
|
}
|
|
return 0;
|
|
|
|
}
|
|
|
|
bool TextHook::InsertHookCode()
|
|
{
|
|
bool ret = false;
|
|
// jichi 9/17/2013: might raise 0xC0000005 AccessViolationException on win7
|
|
__try { ret = UnsafeInsertHookCode(); }
|
|
__except (1) {};
|
|
return ret;
|
|
}
|
|
|
|
|
|
bool TextHook::UnsafeInsertHookCode()
|
|
{
|
|
if (hp.module && (hp.type & MODULE_OFFSET)) // Map hook offset to real address.
|
|
{
|
|
if (DWORD base = GetModuleBase(hp.module)) hp.address += base;
|
|
else return ConsoleOutput("NextHooker: UnsafeInsertHookCode: FAILED: module not present"), false;
|
|
hp.type &= ~MODULE_OFFSET;
|
|
}
|
|
|
|
BYTE* original;
|
|
if (MH_CreateHook((void*)hp.address, (void*)trampoline, (void**)&original) != MH_OK) return false;
|
|
|
|
void* thisPtr = (void*)this;
|
|
void* funcPtr = (void*)((BYTE*)ProcessHook - (BYTE*)(trampoline + 19));
|
|
DWORD dist = original - (trampoline + sizeof(common_hook)) - 4;
|
|
|
|
memcpy(trampoline, common_hook, sizeof(common_hook));
|
|
memcpy(trampoline + 10, &thisPtr, sizeof(void*));
|
|
memcpy(trampoline + 15, &funcPtr, sizeof(void*));
|
|
memcpy(trampoline + sizeof(common_hook), &dist, sizeof(dist));
|
|
|
|
if (MH_EnableHook((void*)hp.address) != MH_OK) return false;
|
|
|
|
return true;
|
|
}
|
|
#endif // _WIN32
|
|
|
|
DWORD WINAPI ReaderThread(LPVOID threadParam)
|
|
{
|
|
TextHook* hook = (TextHook*)threadParam;
|
|
BYTE buffer[PIPE_BUFFER_SIZE] = {};
|
|
unsigned int changeCount = 0;
|
|
int dataLen = 0;
|
|
const char* currentAddress = (char*)hook->hp.address;
|
|
while (true)
|
|
{
|
|
Sleep(500);
|
|
if (memcmp(buffer + sizeof(ThreadParam), currentAddress, dataLen + 1) == 0)
|
|
{
|
|
changeCount = 0;
|
|
continue;
|
|
}
|
|
if (++changeCount > 10)
|
|
{
|
|
ConsoleOutput("NextHooker: memory constantly changing, useless to read");
|
|
ConsoleOutput("NextHooker: remove read code");
|
|
break;
|
|
}
|
|
|
|
if (hook->hp.type & USING_UNICODE)
|
|
dataLen = wcslen((const wchar_t*)currentAddress) * 2;
|
|
else
|
|
dataLen = strlen(currentAddress);
|
|
|
|
*(ThreadParam*)buffer = { GetCurrentProcessId(), hook->hp.address, 0, 0 };
|
|
memcpy(buffer + sizeof(ThreadParam), currentAddress, dataLen + 1);
|
|
DWORD unused;
|
|
WriteFile(::hookPipe, buffer, dataLen + sizeof(ThreadParam), &unused, nullptr);
|
|
}
|
|
hook->ClearHook();
|
|
return 0;
|
|
}
|
|
|
|
bool TextHook::InsertReadCode()
|
|
{
|
|
RemoveHook(hp.address); // Artikash 8/25/2018: clear existing
|
|
if (!IthGetMemoryRange((LPCVOID)hp.address, 0, 0))
|
|
{
|
|
ConsoleOutput("NextHooker:InsertReadCode failed: cannot access read address");
|
|
return false;
|
|
}
|
|
hp.readerHandle = CreateThread(nullptr, 0, ReaderThread, this, 0, nullptr);
|
|
return true;
|
|
}
|
|
|
|
void TextHook::InitHook(const HookParam &h, LPCSTR name, WORD set_flag)
|
|
{
|
|
WaitForSingleObject(hmMutex, 0);
|
|
hp = h;
|
|
hp.type |= set_flag;
|
|
if (name && name != hook_name) SetHookName(name);
|
|
ReleaseMutex(hmMutex);
|
|
}
|
|
|
|
void TextHook::RemoveHookCode()
|
|
{
|
|
MH_DisableHook((void*)hp.address);
|
|
}
|
|
|
|
void TextHook::RemoveReadCode()
|
|
{
|
|
TerminateThread(hp.readerHandle, 0);
|
|
CloseHandle(hp.readerHandle);
|
|
}
|
|
|
|
void TextHook::ClearHook()
|
|
{
|
|
WaitForSingleObject(hmMutex, 0);
|
|
ConsoleOutput("NextHooker:RemoveHook: enter");
|
|
if (hp.type & DIRECT_READ) RemoveReadCode();
|
|
else RemoveHookCode();
|
|
NotifyHookRemove(hp.address);
|
|
if (hook_name) delete[] hook_name;
|
|
memset(this, 0, sizeof(TextHook)); // jichi 11/30/2013: This is the original code of ITH
|
|
//if (current_available>this)
|
|
// current_available = this;
|
|
currentHook--;
|
|
ConsoleOutput("NextHooker:RemoveHook: leave");
|
|
ReleaseMutex(hmMutex);
|
|
}
|
|
|
|
void TextHook::SetHookName(LPCSTR name)
|
|
{
|
|
name_length = strlen(name) + 1;
|
|
if (hook_name) delete[] hook_name;
|
|
hook_name = new char[name_length];
|
|
strcpy(hook_name, name);
|
|
}
|
|
|
|
int TextHook::GetLength(DWORD base, DWORD in)
|
|
{
|
|
if (base == 0)
|
|
return 0;
|
|
int len;
|
|
switch (hp.length_offset) {
|
|
default: // jichi 12/26/2013: I should not put this default branch to the end
|
|
len = *((int *)base + hp.length_offset);
|
|
if (len >= 0) {
|
|
if (hp.type & USING_UNICODE)
|
|
len <<= 1;
|
|
break;
|
|
}
|
|
else if (len != -1)
|
|
break;
|
|
//len == -1 then continue to case 0.
|
|
case 0:
|
|
if (hp.type & USING_UNICODE)
|
|
len = wcslen((const wchar_t *)in) << 1;
|
|
else
|
|
len = strlen((const char *)in);
|
|
break;
|
|
case 1:
|
|
if (hp.type & USING_UNICODE)
|
|
len = 2;
|
|
else {
|
|
if (hp.type & BIG_ENDIAN)
|
|
in >>= 8;
|
|
len = LeadByteTable[in & 0xff]; //Slightly faster than IsDBCSLeadByte
|
|
}
|
|
break;
|
|
}
|
|
// jichi 12/25/2013: This function originally return -1 if failed
|
|
//return len;
|
|
return max(0, len);
|
|
}
|
|
|
|
// EOF
|