Context Navigation

source: Daodan/src/Daodan_Patch.c@ 1007

Last change on this file since 1007 was 995, checked in by alloc, 11 years ago
Daodan: Revamped some code, added quite a few comments to patches, updated options/patches names and descriptions
File size: 6.6 KB

Rev	Line
[272]	1	#include "Daodan_Patch.h"
[994]	2	#include "Patches/Utility.h"
[983]	3	#include <beaengine/BeaEngine.h>
	4
[272]	5	#include <windows.h>
[351]	6	#include <stdlib.h>
[346]	7	#include <string.h>
[272]	8
	9	bool DDrPatch_MakeJump(void* from, void* to)
	10	{
	11	DWORD oldp;
	12
	13	if (VirtualProtect(from, 5, PAGE_EXECUTE_READWRITE, &oldp))
	14	{
[689]	15	((unsigned char)from) = 0xe9; // jmp rel32
[677]	16	from = (char*)from + 1;
[272]	17	(int)from = (unsigned int)to - (unsigned int)from - 4;
	18	VirtualProtect(from, 5, oldp, &oldp);
	19	return true;
	20	}
	21	else
	22	return false;
	23	}
	24
	25	bool DDrPatch_MakeCall(void* from, void* to)
	26	{
	27	DWORD oldp;
	28
	29	if (VirtualProtect(from, 5, PAGE_EXECUTE_READWRITE, &oldp))
	30	{
[689]	31	((unsigned char)from) = 0xe8; // call rel32
[677]	32	from = (char*)from + 1;
[272]	33	(int)from = (unsigned int)to - (unsigned int)from - 4;
	34	VirtualProtect(from, 5, oldp, &oldp);
	35	return true;
	36	}
	37	else
	38	return false;
	39	}
	40
[983]	41	void* DDrPatch_MakeDetour(void* from, void* to)
	42	{
	43	int len = 0;
[995]	44
[983]	45	/*
[995]	46	STARTUPMESSAGE("Orig before", 0);
	47	DDrPatch_PrintDisasm(from, 10, 0);
[983]	48	*/
	49	DISASM disasm;
	50	memset(&disasm, 0, sizeof(DISASM));
	51	disasm.EIP = (UIntPtr) from;
	52
	53	char* trampoline = malloc(40);
	54	DDrPatch_NOOP(trampoline, 40);
	55	int pos = 0;
	56	int branches = 0;
	57
	58	while (((void*)disasm.EIP - from) < 5) {
	59	len = Disasm(&disasm);
	60	if (len != UNKNOWN_OPCODE) {
	61	if ((disasm.Instruction.Category & 0xffff) == CONTROL_TRANSFER) {
	62	if (disasm.Prefix.Number > 0) {
[993]	63	STARTUPMESSAGE("Detour: Branch in trampoline area from address 0x%08x with prefixes", from);
[983]	64	return (void*)-1;
	65	}
	66	branches++;
	67	int target = disasm.Instruction.AddrValue;
	68	bool targetInTrampoline = ((void*)disasm.Instruction.AddrValue - from) < 5;
	69	switch (disasm.Instruction.BranchType) {
	70	case JmpType:
	71	case CallType:
	72	if (targetInTrampoline) {
	73	int offset = disasm.Instruction.AddrValue - disasm.EIP;
	74	if (disasm.Instruction.BranchType == JmpType)
	75	DDrPatch_MakeJump(&trampoline[pos], &trampoline[pos]+offset);
	76	else
	77	DDrPatch_MakeCall(&trampoline[pos], &trampoline[pos]+offset);
	78	} else {
	79	if (disasm.Instruction.BranchType == JmpType)
	80	DDrPatch_MakeJump(&trampoline[pos], (void*)target);
	81	else
	82	DDrPatch_MakeCall(&trampoline[pos], (void*)target);
	83	}
	84	pos += 5;
	85	break;
	86	case RetType:
	87	case JECXZ:
	88	memcpy(&trampoline[pos], (void*)disasm.EIP, len);
	89	pos += len;
	90	break;
	91	// Opcode +1
	92	case JO:
	93	case JC:
	94	case JE:
	95	case JNA:
	96	case JS:
	97	case JP:
	98	case JL:
	99	case JNG:
	100	if (targetInTrampoline) {
	101	memcpy(&trampoline[pos], (void*)disasm.EIP, len);
	102	pos += len;
	103	} else {
	104	trampoline[pos++] = disasm.Instruction.Opcode + 1;
	105	trampoline[pos++] = 5;
	106	DDrPatch_MakeJump(&trampoline[pos], (void*)target);
	107	pos += 5;
	108	}
	109	break;
	110	// Opcode -1
	111	case JNO:
	112	case JNC:
	113	case JNE:
	114	case JA:
	115	case JNS:
	116	case JNP:
	117	case JNL:
	118	case JG:
	119	if (targetInTrampoline) {
	120	memcpy(&trampoline[pos], (void*)disasm.EIP, len);
	121	pos += len;
	122	} else {
	123	trampoline[pos++] = disasm.Instruction.Opcode - 1;
	124	trampoline[pos++] = 5;
	125	DDrPatch_MakeJump(&trampoline[pos], (void*)target);
	126	pos += 5;
	127	}
	128	break;
	129	default:
[993]	130	STARTUPMESSAGE("Detour: Unknown branch in trampoline area from address 0x%08x", from);
[983]	131	return (void*)-1;
	132	}
	133	} else {
	134	memcpy(&trampoline[pos], (void*)disasm.EIP, len);
	135	pos += len;
	136	}
	137	disasm.EIP += (UIntPtr)len;
	138	}
	139	else {
[993]	140	STARTUPMESSAGE("Detour: Unknown opcode in trampoline area from address 0x%08x", from);
[983]	141	return (void*)-1;
	142	}
	143	}
	144
	145	if (branches > 1) {
[993]	146	STARTUPMESSAGE("Detour: Too many branches in trampoline'd code from address 0x%08x: %d", from, branches);
[983]	147	return (void*)-1;
	148	}
	149
	150
	151	DDrPatch_MakeJump(&trampoline[pos], (void*)disasm.EIP);
	152	DDrPatch_NOOP(from, (void*)disasm.EIP - from);
[990]	153
	154	DWORD oldp;
	155	if (!VirtualProtect(trampoline, 40, PAGE_EXECUTE_READWRITE, &oldp)) {
[993]	156	STARTUPMESSAGE("Detour: Could not mark page for trampoline as executable: from address 0x%08x", from);
[990]	157	return (void*)-1;
	158	}
[983]	159	DDrPatch_MakeJump(from, to);
[995]	160
[983]	161	/*
[995]	162	STARTUPMESSAGE("Trampoline", 0);
	163	DDrPatch_PrintDisasm(trampoline, 10, 6);
[983]	164
[995]	165	STARTUPMESSAGE("Orig after", 0);
	166	DDrPatch_PrintDisasm(disasm.EIP, 7, 0);
	167
	168	STARTUPMESSAGE("Orig start after", 0);
	169	DDrPatch_PrintDisasm(from, 3, 6);
[990]	170	*/
[983]	171	return trampoline;
	172	}
	173
[689]	174	bool DDrPatch_String(char* dest, const unsigned char* string, int length)
[272]	175	{
	176	DWORD oldp;
	177
	178	if (VirtualProtect(dest, length, PAGE_EXECUTE_READWRITE, &oldp))
	179	{
	180	memcpy(dest, string, length);
	181	VirtualProtect(dest, length, oldp, &oldp);
	182	return true;
	183	}
	184	else
	185	return false;
	186	}
	187
[689]	188	bool DDrPatch_Byte(char* dest, unsigned char value)
[272]	189	{
	190	DWORD oldp;
	191
	192	if (VirtualProtect(dest, 1, PAGE_EXECUTE_READWRITE, &oldp))
	193	{
	194	*dest = value;
	195	VirtualProtect(dest, 1, oldp, &oldp);
	196	return true;
	197	}
	198	else
	199	return false;
	200	}
	201
[689]	202	bool DDrPatch_Int32(int* dest, unsigned int value)
[272]	203	{
	204	DWORD oldp;
	205
	206	if (VirtualProtect(dest, 4, PAGE_EXECUTE_READWRITE, &oldp))
	207	{
	208	*dest = value;
	209	VirtualProtect(dest, 4, oldp, &oldp);
	210	return true;
	211	}
	212	else
	213	return false;
	214	}
	215
[689]	216	bool DDrPatch_Int16(short* dest, unsigned short value)
[272]	217	{
	218	DWORD oldp;
	219
	220	if (VirtualProtect(dest, 2, PAGE_EXECUTE_READWRITE, &oldp))
	221	{
	222	*dest = value;
	223	VirtualProtect(dest, 2, oldp, &oldp);
	224	return true;
	225	}
	226	else
	227	return false;
	228	}
[346]	229
[351]	230	bool DDrPatch_NOOP(char* dest, unsigned int length)
	231	{
	232	DWORD oldp;
	233
	234	if (VirtualProtect(dest, length, PAGE_EXECUTE_READWRITE, &oldp))
	235	{
	236	memset(dest, 0x90, length);
	237	VirtualProtect(dest, length, oldp, &oldp);
	238	return true;
	239	}
	240	else
	241	return false;
	242	}
[994]	243
	244
	245	void DDrPatch_PrintDisasm(void* addr, int instLimit, int sizeLimit)
	246	{
	247	DISASM MyDisasm;
	248	int len = 0;
	249	int size = 0;
	250	int i = 0;
	251
	252	memset(&MyDisasm, 0, sizeof(DISASM));
	253
	254	MyDisasm.EIP = (UIntPtr) addr;
	255
	256	STARTUPMESSAGE("", 0);
	257	STARTUPMESSAGE("Disassembly @ 0x%06x", addr);
	258
	259	if (sizeLimit <= 0)
	260	sizeLimit = 20 * instLimit;
	261
	262	while ((i < instLimit) && (size < sizeLimit)) {
	263	len = Disasm(&MyDisasm);
	264	if (len != UNKNOWN_OPCODE) {
	265	size += len;
	266	STARTUPMESSAGE(" %s, Opcode: 0x%x, len: %d, branch: %d, to: 0x%06x", MyDisasm.CompleteInstr, MyDisasm.Instruction.Opcode, len, MyDisasm.Instruction.BranchType, MyDisasm.Instruction.AddrValue);
	267	STARTUPMESSAGE(" Cat: 0x%04x, prefix count: %d", MyDisasm.Instruction.Category & 0xffff, MyDisasm.Prefix.Number );
	268
	269	MyDisasm.EIP += (UIntPtr)len;
	270	i++;
	271	}
	272	};
	273
	274	STARTUPMESSAGE("", 0);
	275	}
	276

Note: See TracBrowser for help on using the repository browser.

Download in other formats: