You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
473 lines
12 KiB
473 lines
12 KiB
/*
|
|
* main.cpp -- The main "entry point" and the main logic of the DLL.
|
|
*
|
|
* Here, we define and initialize struct Main that contains the main code of this DLL.
|
|
*
|
|
* The main procedure goes as follows:
|
|
* 1. The loader checks that PatchLoader.dll and mono.dll exist
|
|
* 2. mono.dll is loaded into memory and some of its functions are looked up
|
|
* 3. mono_jit_init_version is hooked with the help of MinHook
|
|
*
|
|
* Then, the loader waits until Unity creates its root domain for mono (which is done with mono_jit_init_version).
|
|
*
|
|
* Inside mono_jit_init_version hook:
|
|
* 1. Call the original mono_jit_init_version to get the Unity root domain
|
|
* 2. Load PatchLoader.dll into the root domain
|
|
* 3. Find and invoke PatchLoader.Loader.Run()
|
|
*
|
|
* Rest of the work is done on the managed side.
|
|
*
|
|
*/
|
|
|
|
#pragma warning( disable : 4267 100 152 6387 4456 6011 )
|
|
|
|
#include "winapi_util.h"
|
|
#include <Windows.h>
|
|
|
|
#include "config.h"
|
|
#include "mono.h"
|
|
#include "hook.h"
|
|
#include "assert_util.h"
|
|
#include "proxy.h"
|
|
#include <synchapi.h>
|
|
|
|
#include <intrin.h>
|
|
|
|
EXTERN_C IMAGE_DOS_HEADER __ImageBase; // This is provided by MSVC with the infomration about this DLL
|
|
|
|
HANDLE unhandledMutex;
|
|
void ownMonoJitParseOptions(int argc, char * argv[]);
|
|
BOOL setOptions = FALSE;
|
|
|
|
void unhandledException(void* exc, void* data)
|
|
{
|
|
WaitForSingleObject(unhandledMutex, INFINITE);
|
|
|
|
void* exception = NULL;
|
|
void* mstr = mono_object_to_string(exc, &exception);
|
|
|
|
if (exception != NULL)
|
|
{
|
|
#ifdef _VERBOSE
|
|
void* monostr = mono_object_to_string(exception, &exception);
|
|
if (exception != NULL)
|
|
{
|
|
DEBUG_BREAK;
|
|
LOG("An error occurred while stringifying uncaught error, but the error could not be stringified.\n");
|
|
ASSERT(FALSE, L"Uncaught exception; could not stringify");
|
|
}
|
|
else
|
|
{
|
|
char* str = mono_string_to_utf8(monostr);
|
|
DEBUG_BREAK;
|
|
LOG("An error occurred stringifying uncaught error: %s\n", str);
|
|
|
|
size_t len = MultiByteToWideChar(CP_UTF8, 0, str, -1, NULL, 0);
|
|
wchar_t* wstr = memalloc(sizeof(wchar_t) * len);
|
|
MultiByteToWideChar(CP_UTF8, 0, str, -1, wstr, len);
|
|
|
|
ASSERT_F(FALSE, L"Uncaught exception; stringify failed: %s", wstr);
|
|
|
|
memfree(wstr);
|
|
mono_free(str);
|
|
}
|
|
#else
|
|
ASSERT(FALSE, L"Could not stringify uncaught exception");
|
|
#endif
|
|
}
|
|
|
|
char* str = mono_string_to_utf8(mstr);
|
|
DEBUG_BREAK;
|
|
LOG("Uncaught exception: %s\n", str);
|
|
|
|
size_t len = MultiByteToWideChar(CP_UTF8, 0, str, -1, NULL, 0);
|
|
wchar_t* wstr = memalloc(sizeof(wchar_t) * len);
|
|
MultiByteToWideChar(CP_UTF8, 0, str, -1, wstr, len);
|
|
|
|
#ifdef _VERBOSE
|
|
ASSERT(FALSE, L"Uncaught exception; see doorstop.log for details");
|
|
#else
|
|
ASSERT_F(FALSE, L"Uncaught exception: %s", wstr);
|
|
#endif
|
|
|
|
memfree(wstr);
|
|
mono_free(str);
|
|
|
|
ReleaseMutex(unhandledMutex);
|
|
}
|
|
|
|
// The hook for mono_jit_init_version
|
|
// We use this since it will always be called once to initialize Mono's JIT
|
|
void *ownMonoJitInitVersion(const char *root_domain_name, const char *runtime_version)
|
|
{
|
|
// Call the original mono_jit_init_version to initialize the Unity Root Domain
|
|
if (debug) {
|
|
char* opts[1];
|
|
opts[0] = "";
|
|
ownMonoJitParseOptions(0, opts);
|
|
}
|
|
#ifdef WIN32
|
|
if (debug_info) {
|
|
mono_debug_init(MONO_DEBUG_FORMAT_MONO);
|
|
}
|
|
#endif
|
|
|
|
void *domain = mono_jit_init_version(root_domain_name, runtime_version);
|
|
|
|
if (debug_info) {
|
|
#ifdef WIN64
|
|
mono_debug_init(MONO_DEBUG_FORMAT_MONO);
|
|
#endif
|
|
mono_debug_domain_create(domain);
|
|
}
|
|
|
|
size_t len = WideCharToMultiByte(CP_UTF8, 0, targetAssembly, -1, NULL, 0, NULL, NULL);
|
|
char *dll_path = memalloc(sizeof(char) * len);
|
|
WideCharToMultiByte(CP_UTF8, 0, targetAssembly, -1, dll_path, len, NULL, NULL);
|
|
|
|
LOG("Loading assembly: %s\n", dll_path);
|
|
// Load our custom assembly into the domain
|
|
void *assembly = mono_domain_assembly_open(domain, dll_path);
|
|
|
|
if (assembly == NULL)
|
|
LOG("Failed to load assembly\n");
|
|
|
|
memfree(dll_path);
|
|
ASSERT_SOFT(assembly != NULL, domain);
|
|
|
|
// Get assembly's image that contains CIL code
|
|
void *image = mono_assembly_get_image(assembly);
|
|
ASSERT_SOFT(image != NULL, domain);
|
|
|
|
// Note: we use the runtime_invoke route since jit_exec will not work on DLLs
|
|
|
|
// Create a descriptor for a random Main method
|
|
void *desc = mono_method_desc_new("*:Main", FALSE);
|
|
|
|
// Find the first possible Main method in the assembly
|
|
void *method = mono_method_desc_search_in_image(desc, image);
|
|
ASSERT_SOFT(method != NULL, domain);
|
|
|
|
void *signature = mono_method_signature(method);
|
|
|
|
// Get the number of parameters in the signature
|
|
UINT32 params = mono_signature_get_param_count(signature);
|
|
|
|
void **args = NULL;
|
|
wchar_t *app_path = NULL;
|
|
if (params == 1)
|
|
{
|
|
// If there is a parameter, it's most likely a string[].
|
|
// Populate it as follows
|
|
// 0 => path to the game's executable
|
|
// 1 => --doorstop-invoke
|
|
|
|
get_module_path(NULL, &app_path, NULL, 0);
|
|
|
|
void *exe_path = MONO_STRING(app_path);
|
|
void *doorstop_handle = MONO_STRING(L"--doorstop-invoke");
|
|
|
|
void *args_array = mono_array_new(domain, mono_get_string_class(), 2);
|
|
|
|
SET_ARRAY_REF(args_array, 0, exe_path);
|
|
SET_ARRAY_REF(args_array, 1, doorstop_handle);
|
|
|
|
args = memalloc(sizeof(void*) * 1);
|
|
_ASSERTE(args != nullptr);
|
|
args[0] = args_array;
|
|
}
|
|
|
|
LOG("Installing uncaught exception handler\n");
|
|
|
|
mono_install_unhandled_exception_hook(unhandledException, NULL);
|
|
|
|
wchar_t* dll_path_w; // self path
|
|
size_t dll_path_len = get_module_path((HINSTANCE)&__ImageBase, &dll_path_w, NULL, 0);
|
|
char* self_dll_path = memalloc(dll_path_len + 1);
|
|
WideCharToMultiByte(CP_UTF8, 0, dll_path_w, -1, self_dll_path, dll_path_len + 1, NULL, NULL);
|
|
|
|
mono_dllmap_insert(NULL, "i:bsipa-doorstop", NULL, self_dll_path, NULL); // remap `bsipa-doorstop` to this assembly
|
|
|
|
memfree(self_dll_path);
|
|
memfree(dll_path_w);
|
|
|
|
|
|
unhandledMutex = CreateMutexW(NULL, FALSE, NULL);
|
|
|
|
LOG("Invoking method!\n");
|
|
|
|
void* exception = NULL;
|
|
mono_runtime_invoke(method, NULL, args, &exception);
|
|
|
|
WaitForSingleObject(unhandledMutex, INFINITE); // if the EH is triggered, wait for it
|
|
|
|
if (args != NULL)
|
|
{
|
|
memfree(app_path);
|
|
memfree(args);
|
|
NULL;
|
|
}
|
|
|
|
#ifdef _VERBOSE
|
|
if (exception != NULL)
|
|
{
|
|
void* monostr = mono_object_to_string(exception, &exception);
|
|
if (exception != NULL)
|
|
LOG("An error occurred while invoking the injector, but the error could not be stringified.\n")
|
|
else
|
|
{
|
|
char* str = mono_string_to_utf8(monostr);
|
|
LOG("An error occurred invoking the injector: %s\n", str);
|
|
mono_free(str);
|
|
}
|
|
}
|
|
#endif
|
|
|
|
cleanupConfig();
|
|
|
|
free_logger();
|
|
|
|
ReleaseMutex(unhandledMutex);
|
|
|
|
return domain;
|
|
}
|
|
|
|
void ownMonoJitParseOptions(int argc, char * argv[])
|
|
{
|
|
setOptions = TRUE;
|
|
|
|
int size = argc;
|
|
#ifdef WIN64
|
|
if (debug) size += 2;
|
|
#elif defined(WIN32)
|
|
if (debug) size += 1;
|
|
#endif
|
|
|
|
char** arguments = memalloc(sizeof(char*) * size);
|
|
_ASSERTE(arguments != nullptr);
|
|
memcpy(arguments, argv, sizeof(char*) * argc);
|
|
if (debug) {
|
|
//arguments[argc++] = "--debug";
|
|
#ifdef WIN64
|
|
arguments[argc++] = "--soft-breakpoints";
|
|
#endif
|
|
if (debug_server)
|
|
arguments[argc] = "--debugger-agent=transport=dt_socket,address=0.0.0.0:10000,server=y";
|
|
else
|
|
arguments[argc] = "--debugger-agent=transport=dt_socket,address=127.0.0.1:10000,server=n";
|
|
}
|
|
|
|
mono_jit_parse_options(size, arguments);
|
|
|
|
memfree(arguments);
|
|
}
|
|
|
|
BOOL initialized = FALSE;
|
|
|
|
void init(HMODULE module)
|
|
{
|
|
if (!initialized)
|
|
{
|
|
initialized = TRUE;
|
|
LOG("Got mono.dll at %p\n", module);
|
|
loadMonoFunctions(module);
|
|
}
|
|
}
|
|
|
|
void * WINAPI hookGetProcAddress(HMODULE module, char const *name)
|
|
{
|
|
if (lstrcmpA(name, "mono_jit_init_version") == 0)
|
|
{
|
|
init(module);
|
|
return (void*)&ownMonoJitInitVersion;
|
|
}
|
|
if (lstrcmpA(name, "mono_jit_parse_options") == 0 && debug)
|
|
{
|
|
init(module);
|
|
return (void*)&ownMonoJitParseOptions;
|
|
}
|
|
return (void*)GetProcAddress(module, name);
|
|
}
|
|
|
|
BOOL hookGetMessage(
|
|
BOOL isW,
|
|
LPMSG msg,
|
|
HWND hwnd,
|
|
UINT wMsgFilterMin,
|
|
UINT wMsgFilterMax
|
|
);
|
|
|
|
BOOL WINAPI hookGetMessageA(LPMSG msg, HWND hwnd, UINT wMsgFilterMin, UINT wMsgFilterMax)
|
|
{
|
|
return hookGetMessage(FALSE, msg, hwnd, wMsgFilterMin, wMsgFilterMax);
|
|
}
|
|
BOOL WINAPI hookGetMessageW(LPMSG msg, HWND hwnd, UINT wMsgFilterMin, UINT wMsgFilterMax)
|
|
{
|
|
return hookGetMessage(TRUE, msg, hwnd, wMsgFilterMin, wMsgFilterMax);
|
|
}
|
|
|
|
typedef BOOL(*GetMessageHook)(BOOL isW, BOOL result, LPMSG msg, HWND hwnd, UINT filterMin, UINT filterMax);
|
|
|
|
GetMessageHook getMessageHook = NULL;
|
|
|
|
__declspec(dllexport) void __stdcall SetGetMessageHook(GetMessageHook hook) {
|
|
getMessageHook = hook;
|
|
}
|
|
|
|
BOOL hookGetMessage(
|
|
BOOL isW,
|
|
LPMSG msg,
|
|
HWND hwnd,
|
|
UINT wMsgFilterMin,
|
|
UINT wMsgFilterMax
|
|
)
|
|
{
|
|
BOOL loop = FALSE;
|
|
|
|
BOOL result;
|
|
|
|
do {
|
|
if (isW) {
|
|
result = GetMessageW(msg, hwnd, wMsgFilterMin, wMsgFilterMax);
|
|
} else {
|
|
result = GetMessageA(msg, hwnd, wMsgFilterMin, wMsgFilterMax);
|
|
}
|
|
|
|
if (getMessageHook) {
|
|
loop = getMessageHook(isW, result, msg, hwnd, wMsgFilterMin, wMsgFilterMax);
|
|
}
|
|
} while (loop);
|
|
|
|
return result;
|
|
}
|
|
|
|
BOOL hookPeekMessage(
|
|
BOOL isW,
|
|
LPMSG msg,
|
|
HWND hwnd,
|
|
UINT wMsgFilterMin,
|
|
UINT wMsgFilterMax,
|
|
UINT wRemoveMsg
|
|
);
|
|
|
|
BOOL WINAPI hookPeekMessageA(LPMSG msg, HWND hwnd, UINT wMsgFilterMin, UINT wMsgFilterMax, UINT wRemoveMsg)
|
|
{
|
|
return hookPeekMessage(FALSE, msg, hwnd, wMsgFilterMin, wMsgFilterMax, wRemoveMsg);
|
|
}
|
|
BOOL WINAPI hookPeekMessageW(LPMSG msg, HWND hwnd, UINT wMsgFilterMin, UINT wMsgFilterMax, UINT wRemoveMsg)
|
|
{
|
|
return hookPeekMessage(TRUE, msg, hwnd, wMsgFilterMin, wMsgFilterMax, wRemoveMsg);
|
|
}
|
|
|
|
typedef BOOL(*PeekMessageHook)(BOOL isW, BOOL result, LPMSG msg, HWND hwnd, UINT filterMin, UINT filterMax, UINT* wRemoveMsg);
|
|
|
|
PeekMessageHook peekMessageHook = NULL;
|
|
|
|
__declspec(dllexport) void __stdcall SetPeekMessageHook(PeekMessageHook hook) {
|
|
peekMessageHook = hook;
|
|
}
|
|
|
|
BOOL hookPeekMessage(
|
|
BOOL isW,
|
|
LPMSG msg,
|
|
HWND hwnd,
|
|
UINT wMsgFilterMin,
|
|
UINT wMsgFilterMax,
|
|
UINT wRemoveMsg
|
|
)
|
|
{
|
|
BOOL loop = FALSE;
|
|
|
|
BOOL result;
|
|
|
|
do {
|
|
if (isW) {
|
|
result = PeekMessageW(msg, hwnd, wMsgFilterMin, wMsgFilterMax, wRemoveMsg);
|
|
}
|
|
else {
|
|
result = PeekMessageA(msg, hwnd, wMsgFilterMin, wMsgFilterMax, wRemoveMsg);
|
|
}
|
|
|
|
if (peekMessageHook) {
|
|
loop = peekMessageHook(isW, result, msg, hwnd, wMsgFilterMin, wMsgFilterMax, &wRemoveMsg);
|
|
}
|
|
} while (loop);
|
|
|
|
return result;
|
|
}
|
|
|
|
BOOL WINAPI DllMain(HINSTANCE hInstDll, DWORD reasonForDllLoad, LPVOID reserved)
|
|
{
|
|
if (reasonForDllLoad != DLL_PROCESS_ATTACH)
|
|
return TRUE;
|
|
|
|
hHeap = GetProcessHeap();
|
|
|
|
init_logger();
|
|
|
|
LOG("Doorstop started!\n");
|
|
|
|
wchar_t *dll_path = NULL;
|
|
size_t dll_path_len = get_module_path((HINSTANCE)&__ImageBase, &dll_path, NULL, 0);
|
|
|
|
LOG("DLL Path: %S\n", dll_path);
|
|
|
|
wchar_t *dll_name = get_file_name_no_ext(dll_path, dll_path_len);
|
|
|
|
LOG("Doorstop DLL Name: %S\n", dll_name);
|
|
|
|
loadProxy(dll_name);
|
|
loadConfig();
|
|
|
|
// If the loader is disabled, don't inject anything.
|
|
if (enabled)
|
|
{
|
|
LOG("Doorstop enabled!\n");
|
|
ASSERT_SOFT(GetFileAttributesW(targetAssembly) != INVALID_FILE_ATTRIBUTES, TRUE);
|
|
|
|
HMODULE targetModule = GetModuleHandleA("UnityPlayer");
|
|
|
|
if(targetModule == NULL)
|
|
{
|
|
LOG("No UnityPlayer.dll; using EXE as the hook target.");
|
|
targetModule = GetModuleHandleA(NULL);
|
|
}
|
|
|
|
LOG("Installing IAT hook\n");
|
|
if (!iat_hook(targetModule, "kernel32.dll", &GetProcAddress, &hookGetProcAddress))
|
|
{
|
|
LOG("Failed to install IAT hook!\n");
|
|
free_logger();
|
|
}
|
|
|
|
LOG("Hook installed!\n");
|
|
|
|
LOG("Attempting to install GetMessageA and GetMessageW hooks\n");
|
|
|
|
if (!iat_hook(targetModule, "user32.dll", &GetMessageA, &hookGetMessageA)) {
|
|
LOG("Could not hook GetMessageA! (not an error)\n");
|
|
}
|
|
if (!iat_hook(targetModule, "user32.dll", &GetMessageW, &hookGetMessageW)) {
|
|
LOG("Could not hook GetMessageW! (not an error)\n");
|
|
}
|
|
|
|
LOG("Attempting to install PeekMessageA and PeekMessageW hooks\n");
|
|
|
|
if (!iat_hook(targetModule, "user32.dll", &PeekMessageA, &hookPeekMessageA)) {
|
|
LOG("Could not hook PeekMessageA! (not an error)\n");
|
|
}
|
|
if (!iat_hook(targetModule, "user32.dll", &PeekMessageW, &hookPeekMessageW)) {
|
|
LOG("Could not hook PeekMessageW! (not an error)\n");
|
|
}
|
|
}
|
|
else
|
|
{
|
|
LOG("Doorstop disabled! memfreeing resources\n");
|
|
free_logger();
|
|
}
|
|
|
|
memfree(dll_name);
|
|
memfree(dll_path);
|
|
|
|
return TRUE;
|
|
}
|