You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
162 lines
5.6 KiB
162 lines
5.6 KiB
/*
|
|
* EAT-based hooking for x86/x64.
|
|
*
|
|
* Big thanks to ez (https://github.com/ezdiy/) for making this!
|
|
*
|
|
* Creates "hooks" by modifying the module's export address table.
|
|
* The procedure works in three main parts:
|
|
*
|
|
* 1. Reading the module's PE file and getting all exported functions.
|
|
* 2. Finding the right function to "hook" by simple address lookup
|
|
* 3. Modify the entry to point to the hook.
|
|
*
|
|
* The idea is based on the fact that the export table allows forwarding imports:
|
|
*
|
|
* https://en.wikibooks.org/wiki/X86_Disassembly/Windows_Executable_Files#Forwarding
|
|
*
|
|
* You can also find some reference material on the same page to understand this code better.
|
|
*
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#pragma warning( disable : 4267 90 )
|
|
|
|
#include <windows.h>
|
|
|
|
// PE format uses RVAs (Relative Virtual Addresses) to save addresses relative to the base of the module
|
|
// More info: https://en.wikibooks.org/wiki/X86_Disassembly/Windows_Executable_Files#Relative_Virtual_Addressing_(RVA)
|
|
//
|
|
// This helper macro converts the saved RVA to a fully valid pointer to the data in the PE file
|
|
#define RVA2PTR(t,base,rva) ((t)(((PCHAR) base) + rva))
|
|
|
|
// A helper function to write into protected memory
|
|
inline int vpmemcpy(void *dst, void *src, size_t sz)
|
|
{
|
|
DWORD oldp;
|
|
// Make the memory page writeable
|
|
if (!VirtualProtect(dst, sz, PAGE_READWRITE, &oldp))
|
|
return 1;
|
|
memcpy(dst, src, sz);
|
|
// Restore the protection level
|
|
VirtualProtect(dst, sz, oldp, &oldp);
|
|
return 0;
|
|
}
|
|
|
|
|
|
/**
|
|
* \brief Replaces the specified function entry in the EAT with a forward to a custom one, thus creating the "hook" effect.
|
|
* \param hostDll The address of the module to hook.
|
|
* \param originalFunction Address of the original function.
|
|
* \param forwardFunctionEntry Name of the function to add a forward to. Must be of form `dll.API`.
|
|
* \return TRUE, if hooking succeeded, otherwise, FALSE.
|
|
*/
|
|
inline BOOL ezHook(HMODULE hostDll, void *originalFunction, char *forwardFunctionEntry)
|
|
{
|
|
/*
|
|
* Note that we are not doing any trampoline magic or editing the assembly!
|
|
*
|
|
* Instead, we are reading the module's PE file, find the original function's entry in the export address table (EAT),
|
|
* and replace it with a forward import.
|
|
*
|
|
* This ultimately will fool the game/executable to call our hook, while keeping original function intact.
|
|
*
|
|
* Thus, in order to work, the proxy DLL has to export the hook, because we are essentially
|
|
* asking the game to call our hook without ever going to the original function (unlike with trampolines).
|
|
*/
|
|
|
|
size_t fwdlen = strlen(forwardFunctionEntry);
|
|
|
|
// The module always starts with a DOS (or "MZ") header
|
|
IMAGE_DOS_HEADER *mz = (PIMAGE_DOS_HEADER)hostDll;
|
|
|
|
// Next, get the NT headers. The offset to them is saved in e_lfanew
|
|
IMAGE_NT_HEADERS *nt = RVA2PTR(PIMAGE_NT_HEADERS, mz, mz->e_lfanew);
|
|
|
|
// Get the pointer to the data directory of the exports
|
|
IMAGE_DATA_DIRECTORY *edirp = &nt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
|
|
IMAGE_DATA_DIRECTORY edir = *edirp;
|
|
|
|
// Finally, the virtual address in the data direcotry tells the location of the exports table
|
|
IMAGE_EXPORT_DIRECTORY *exports = RVA2PTR(PIMAGE_EXPORT_DIRECTORY, mz, edir.VirtualAddress);
|
|
|
|
// Read the addrress of the function list and the address of function names
|
|
DWORD *addrs = RVA2PTR(DWORD*, mz, exports->AddressOfFunctions);
|
|
// DWORD* names = RVA2PTR(DWORD*, mz, exports->AddressOfNames);
|
|
|
|
// Iterate through all functions
|
|
for (unsigned i = 0; i < exports->NumberOfFunctions; i++)
|
|
{
|
|
//char* name = RVA2PTR(char*, mz, names[i]); // Name of the exported function
|
|
void *addr = RVA2PTR(void*, mz, addrs[i]); // Address of the exported function
|
|
|
|
// Check if we have the function we need to modify
|
|
if (addr == originalFunction)
|
|
{
|
|
DWORD fptr = edir.VirtualAddress + edir.Size;
|
|
int err = 0;
|
|
|
|
// Update the entry to go the the last entry (which we will populate in the next memcpy)
|
|
err |= vpmemcpy(&addrs[i], &fptr, sizeof(fptr));
|
|
|
|
// Add the forwarding import to our function at the end of the EAT
|
|
err |= vpmemcpy(((char*)exports + edir.Size), forwardFunctionEntry, fwdlen);
|
|
|
|
// Increment the size of the export data directory
|
|
// and write the new export data directory
|
|
edir.Size += fwdlen + 1;
|
|
err |= vpmemcpy(edirp, &edir, sizeof(edir));
|
|
return err == 0;
|
|
}
|
|
}
|
|
return FALSE;
|
|
}
|
|
|
|
|
|
/**
|
|
* \brief Hooks the given function through the Import Address Table
|
|
* \param dll Module to hook
|
|
* \param targetFunction Address of the target function to hook
|
|
* \param detourFunction Address of the detour function
|
|
* \return TRUE if successful, otherwise FALSE
|
|
*/
|
|
inline BOOL iat_hook(HMODULE dll, char const* targetDLL, void *targetFunction, void *detourFunction)
|
|
{
|
|
IMAGE_DOS_HEADER *mz = (PIMAGE_DOS_HEADER)dll;
|
|
|
|
IMAGE_NT_HEADERS *nt = RVA2PTR(PIMAGE_NT_HEADERS, mz, mz->e_lfanew);
|
|
|
|
IMAGE_IMPORT_DESCRIPTOR *imports = RVA2PTR(PIMAGE_IMPORT_DESCRIPTOR, mz, nt->OptionalHeader.DataDirectory[
|
|
IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
|
|
|
|
for (int i = 0; imports[i].Characteristics; i++)
|
|
{
|
|
char *name = RVA2PTR(char*, mz, imports[i].Name);
|
|
|
|
if(lstrcmpiA(name, targetDLL) != 0)
|
|
continue;
|
|
|
|
void **thunk = RVA2PTR(void**, mz, imports[i].FirstThunk);
|
|
void **nextThunk = RVA2PTR(void**, mz, imports[i+1].FirstThunk);
|
|
|
|
for (; thunk && thunk < nextThunk; thunk++)
|
|
{
|
|
void *import = *thunk;
|
|
|
|
if (import != targetFunction)
|
|
continue;
|
|
|
|
DWORD oldState;
|
|
if (!VirtualProtect(thunk, sizeof(void*), PAGE_READWRITE, &oldState))
|
|
return FALSE;
|
|
|
|
*thunk = (void*)detourFunction;
|
|
|
|
VirtualProtect(thunk, sizeof(void*), oldState, &oldState);
|
|
|
|
return TRUE;
|
|
}
|
|
}
|
|
|
|
return FALSE;
|
|
}
|