Changeset 4656 for zzufTweet

Timestamp:

Sep 23, 2010, 12:06:46 AM (10 years ago)

Author:

Sam Hocevar

Message:

CreateFile?() diversion proof of concept.

Location:

zzuf/trunk

Files:

• configure.ac (modified) (1 diff)
• msvc/config.h (modified) (1 diff)
• msvc/libzzuf.vcxproj (modified) (1 diff)
• src/libzzuf/lib-load.h (modified) (1 diff)
• src/libzzuf/lib-win32.c (added)
• src/libzzuf/sys.c (modified) (2 diffs)

zzuf/trunk/configure.ac

@@ -55 +55 @@
 AC_CHECK_FUNCS(__open64 __lseek64 __fopen64 __freopen64 __ftello64 __fseeko64 __fsetpos64)
 AC_CHECK_FUNCS(__fgets_chk __fgets_unlocked_chk __fread_chk __fread_unlocked_chk __read_chk __recv_chk __recvfrom_chk)
+AC_CHECK_FUNCS(CreateFile)
 
 AC_CHECK_TYPES(sighandler_t, [], [],

zzuf/trunk/msvc/config.h

@@ -26 +26 @@
 #define HAVE_BIND 1
 #define HAVE_CONNECT 1
+#define HAVE_CREATEFILE 1
 /* #undef HAVE_DLFCN_H */
 #define HAVE_DUP 1

zzuf/trunk/msvc/libzzuf.vcxproj

@@ -127 +127 @@
     <ClCompile Include="..\src\libzzuf\lib-signal.c" />
     <ClCompile Include="..\src\libzzuf\lib-stream.c" />
+    <ClCompile Include="..\src\libzzuf\lib-win32.c" />
     <ClCompile Include="..\src\libzzuf\libzzuf.c" />
     <ClCompile Include="..\src\libzzuf\network.c" />

zzuf/trunk/src/libzzuf/lib-load.h

@@ -54 +54 @@
 #   define DIVERT_END { NULL, NULL, NULL, NULL }
 
-extern zzuf_table_t table_stream[];
+extern zzuf_table_t table_stream[],
+                    table_win32[];
 
 #endif
-

zzuf/trunk/src/libzzuf/sys.c

@@ -94 +94 @@
     static zzuf_table_t *list[] =
     {
-        table_stream
+        table_stream,
+        table_win32,
     };
 
     zzuf_table_t *diversion;
+    void *lib;
     unsigned long dummy;
     import_t import;
@@ -109 +111 @@
         return;
 
-    for (k = 0; k < sizeof(list) / sizeof(*list); k++)
+    for (k = 0, diversion = NULL; k < sizeof(list) / sizeof(*list); )
     {
-        for (diversion = list[k]; diversion->lib; diversion++)
+        if (!diversion)
+            diversion = list[k];
+
+        if (!diversion->lib)
         {
-            void *lib = GetModuleHandleA(diversion->lib);
-            *diversion->old = (void *)GetProcAddress(lib, diversion->name);
+            k++;
+            diversion = NULL;
+            continue;
+        }
 
-            for(j = 0; import[j].Name; j++)
+        lib = GetModuleHandleA(diversion->lib);
+        *diversion->old = (void *)GetProcAddress(lib, diversion->name);
+
+        for(j = 0; import[j].Name; j++)
+        {
+            char *name = (char *)module + import[j].Name;
+            if(lstrcmpiA(name, diversion->lib) != 0)
+                continue;
+
+            thunk = (thunk_t)((char *)module + import->FirstThunk);
+            for(i = 0; thunk[i].u1.Function; i++)
             {
-                char *name = (char *)module + import[j].Name;
-                if(lstrcmpiA(name, diversion->lib) != 0)
+                void **func = (void **)&thunk[i].u1.Function;
+                if(*func != *diversion->old)
                     continue;
 
-                thunk = (thunk_t)((char *)module + import->FirstThunk);
-                for(i = 0; thunk[i].u1.Function; i++)
-                {
-                    void **func = (void **)&thunk[i].u1.Function;
-                    if(*func != *diversion->old)
-                        continue;
-
-                    /* FIXME: The StarCraft 2 hack uses two methods for function
-                     * diversion. See HookSsdt() and HookHotPatch(). */
-                    VirtualProtect(func, sizeof(func), PAGE_EXECUTE_READWRITE, &dummy);
-                    WriteProcessMemory(GetCurrentProcess(), func, &diversion->new,
-                                       sizeof(diversion->new), NULL);
-                }
+                /* FIXME: The StarCraft 2 hack uses two methods for function
+                    * diversion. See HookSsdt() and HookHotPatch(). */
+                VirtualProtect(func, sizeof(func), PAGE_EXECUTE_READWRITE, &dummy);
+                WriteProcessMemory(GetCurrentProcess(), func, &diversion->new,
+                                    sizeof(diversion->new), NULL);
             }
         }
+
+        diversion++;
     }
 }