|
Hi all,
Since a few weeks I am playing with detour and winapi functions.
I hooked DirectDrawCreate and GetProcAdress. In the function GetProcAdress I want to return the adress of the api function "DirectDrawCreate" without detour does some 1 got the solution for this? Below the code I made so far:
<br />
<br />
DETOUR_TRAMPOLINE( HWND __stdcall zDirectDrawCreate(GUID* lpGUID , LPDIRECTDRAW* lplpDD , IUnknown* pUnkOuter) ,DirectDrawCreate );<br />
<br />
HWND __stdcall sDirectDrawCreate(GUID* lpGUID , LPDIRECTDRAW* lplpDD , IUnknown* pUnkOuter) <br />
{<br />
return zDirectDrawCreate(lpGUID , lplpDD , pUnkOuter);
}<br />
<br />
<br />
<br />
DETOUR_TRAMPOLINE(FARPROC WINAPI zGetProcAddress (HMODULE hModule, LPCSTR lp),GetProcAddress);<br />
<br />
FARPROC WINAPI sGetProcAddress (HMODULE hModule, LPCSTR lp)<br />
{<br />
if(HIWORD(lp))<br />
{<br />
<br />
<br />
if(!strcmp(lp, "GetProcAddress")) return (FARPROC) zGetProcAddress;<br />
<br />
}<br />
return zGetProcAddress(hModule, lp);<br />
}<br />
<br />
void Detour_PB_DirectDraw()<br />
{ <br />
DetourFunctionWithTrampoline((PBYTE)zDirectDrawCreate,(PBYTE)sDirectDrawCreate);<br />
}<br />
<br />
void Detour_PB_GetProcAddress()<br />
{<br />
DetourFunctionWithTrampoline((PBYTE)zGetProcAddress,(PBYTE)sGetProcAddress);<br />
}<br />
<br />
bool WINAPI DllMain(HINSTANCE hInst, DWORD dwReason, PVOID pvReserved)<br />
{<br />
if(dwReason == DLL_PROCESS_ATTACH) <br />
{<br />
<br />
Detour_PB_GetProcAddress(); <br />
Detour_PB_DirectDraw();<br />
<br />
}<br />
<br />
else if(dwReason == DLL_PROCESS_DETACH)<br />
{<br />
<br />
}<br />
<br />
return true; <br />
}<br />
|
|
|
|
|
Return the address of the trampoline. i.e.
DETOUR_TRAMPOLINE(FARPROC WINAPI zGetProcAddress (HMODULE hModule, LPCSTR lp),GetProcAddress);
FARPROC WINAPI sGetProcAddress (HMODULE hModule, LPCSTR lp)
{
if(HIWORD(lp))
{
if(!strcmp(lp, "GetProcAddress")) return (FARPROC) zGetProcAddress;
else if (!strcmp(lp, "DirectDrawCreate")) return (FARPROC)&zDirectDrawCreate;
}
return zGetProcAddress(hModule, lp);
}
If you look at the machine code for the trampoline it will consist of a few bytes from the detoured API followed by a jump. Don't let this fool you; calling it will have the same effect as the original API.
Also I think the following:
(FARPROC) zGetProcAddress
Should be:
(FARPROC)&sGetProcAddress
Steve
|
|
|
|
|
But If I am right then you retour the adress of the detoured function. I want to return the adress there of the unmodified api "DirectDrawCreate"
|
|
|
|
|
Detours works by overwriting the target function - The address of the original function is no longer the address of the original function. Detours copies the overwritten data into the trampoline and then puts in the trampoline to the original function after the overwritten code. In short calling the trampoline (as my code did) has the effect of calling the original function.
Steve
|
|
|
|
|
I know how detours works. But I want the adress of the unmodified api"DirectDrawCreate" before I hook those functions.
The question is how can I do that.
Do I have to get it with:
int DirectDrawCreate = (int)GetProcAddress(LoadLibrary("ddraw.dll"), "DirectDrawCreate");
Then read the bytes and copy them with CopyMemory()
And then hook the api's
|
|
|
|
|
Here's how I use detours:
DETOUR_TRAMPOLINE( BOOL WINAPI Tram_EnableWindow(HWND hWnd, BOOL bEnable),
EnableWindow )
BOOL WINAPI My_EnableWindow( HWND hWnd, BOOL bEnable )
{
return Tram_EnableWindow(hWnd, bEnable);
}
void ApplyDetours()
{
DetourFunctionWithTrampoline((PBYTE)Tram_EnableWindow, (PBYTE)My_EnableWindow);
}
void RemoveDetours()
{
DetourRemove((PBYTE)Tram_EnableWindow, (PBYTE)My_EnableWindow);
}
Because of the way Detours works, the address of the API before the detours is applied is the address of the modified function after it is applied - This is why it's do powerful as the hook function is called regardless of the calling mechanism (unlike IAT patching for example). The address of the original function after the detours has been applied is the address of the trampoline function. I don't know what you mean when you say, "Then read the bytes and copy them with CopyMemory()" - Detours takes care of all this for you.
Steve
|
|
|
|
|
A program that I use detects I use detours on "DirectDrawCreate" They use "GetProcAdress" to detect it. detour make jumps 0xE9 or 0x90 thats wot they see.
IAT patching sounds like a solution for this problem can you show me a example maybe ?
|
|
|
|
|
IAT patching will only work if the DLL is not dynamically loaded. Is this the case? To check you the export table of the .EXE and see if it contains the API using "Depends.exe" or some such tool.
Steve
|
|
|
|
|
Well its an api function that is used in a game....
pbcl.dll which is dynamically loaded calls "DirectDrawCreate" in ddraw.dll
Is there a solution for my problem ?
|
|
|
|
|
I'm trying to pass an array of char* to a dialog box through the Sendmessage function. I seem to have no problem sending the message, but I'm not quite sure how to get access to the data from the dialog box. I'm not using MFC btw.
From my winmain I have
HWND hdlg;
char *items[4];
hdlg = CreateDialog(GetModuleHandle(NULL),MAKEINTRESOURCE(IDD_MERGE),hwnd,MergeProc);
data->get_dialog_items(items);
SendMessage(hdlg,WM_NOTIFY,MAKEWPARAM(SD_IMPORT_MERGE,items),0);
I think I have to use a typecast of some sort but everything I have tried so far is giving mw compilation errors. Any help would be greatly apprecitaed.
|
|
|
|
|
I don't know the code SD_IMPORT_MERGE that you are using, but it probably doesn't matter.
The other part of MAKEWPARAM would normally be a control ID rather than an abritrary variable, and you'd have a structure pointed to by LPARAM. I can't remember its off the top of my head though.
If all you are doing is sending a custom message to the dialog saying "here's a lump of text", why not use
UINT g_myTextMessage = RegisterWindowMessage ("Some unique string here");
.....
char *items [4];
...
SendMessage (hDlg, g_myTextMessage, 0, (LPARAM)items);
...
and in your dialog class:
...
ON_REGISTERED_MESSAGE (g_myTextMessage, OnSendATextMessage)
...
LRESULT CMyDialog::OnSendATextMessage (WPARAM wParam, LPARAM lParam)
{
char **items = (char **)lParam;
ASSERT(items);
if (!items) return 1;
lstrcpy (items [0], "Some Text");
lstrcpy (m_myBuffer, items [1]);
etc
return 0;
}
This is without reference, so please make sure of the names!
Good luck,
Iain.
|
|
|
|
|
Iain Clarke wrote: I don't know the code SD_IMPORT_MERGE that you are using, but it probably doesn't matter.
SD_IMPORT_MERGE is an identifier I am can trap within WM_NOTIFY. Not thats its very important it's just the way I was trying to get this to work.
Normaly when passing an of chars to a function I would define the function as MyFunction(char *foo[]), I was trying to derefrence using the same form. I noticed you used a double pointer which makes a little more sense.
Thankyou, I have got it working now.
|
|
|
|
|
I have a CString object which contains a string in the format: 00:11.2 (for example).
I have to isolate each of the parts of the string.
For example i need to get:
str1 = 00
str2 = 11
str3 = 2
how can I do this?
|
|
|
|
|
|
Yep, combined with CString::FindOneOf() where you provide the chars that separate different "parts" of the string.
It's supposed to be hard, otherwise anybody could do it!
|
|
|
|
|
Is there a way to trim part of the string?
(I want to read part of the string and then trim that part..)
For instance,after I find where the ":" is located, I want to trim the right most part of the string, and so forth for the other parts of the string...
|
|
|
|
|
SWDevil wrote: For instance,after I find where the ":" is located, I want to trim the right most part of the string...
CString str = "00:11.2";
int nIndex = str.Find(':');
str = str.Left(nIndex);
or
str = str.Mid(0, nIndex + 1);
"Let us be thankful for the fools. But for them the rest of us could not succeed." - Mark Twain
"There is no death, only a change of worlds." - Native American Proverb
|
|
|
|
|
sscanf(...) and its variants were designed for that kind of thing...
Read up on them to see how easy it would be to extract the components of the string.
Peace!
-=- James
If you think it costs a lot to do it right, just wait until you find out how much it costs to do it wrong!
Avoid driving a vehicle taller than you and remember that Professional Driver on Closed Course does not mean your Dumb Ass on a Public Road!
DeleteFXPFiles & CheckFavorites (Please rate this post!)
|
|
|
|
|
Hi All,
The problem I seem to be having is that events seem to be disappearing (i.e. no-one gets them). I have essentially 3 threads in a console application. The "control" class creates a number of events like:
m_stSyncEvents.m_hSyncRxStart = ::CreateEvent (NULL, FALSE, FALSE, NULL);
Later on, the code creates two threads. These threads then do a ::SetEvent (m_stSyncEvents.m_hSyncRxStart) when they finished their initialisation. The threads themselves have a common thead function and use the fastdelegate code to call back into the class. After the threads are created I do a:
::WaitForMultipleObjects (2, ahThreadSync, TRUE, INFINITE);
with ahThreadSync being handles to the event handles per thread.
The problem now comes that the second task that is created is not sending events or receiving them 100%. 2 /10 times it works perfectly. However the other times, the second thread does not send the event (but SetEvent is not failing) or it does not receive the abort event from the control class, which is created in a similar way except it is in manual reset mode. In each case the thread is running.
Any Ideas??
regards,
Rich
"Programming today is a race between software engineers striving to build bigger and
better idiot-proof programs, and the Universe trying to produce bigger and better idiots.
So far the Universe is winning." -- Rich Cook
|
|
|
|
|
Are you suggesting BOTH of the 'alternate' threads are each setting m_stSyncEvents.m_hSyncRxStart? If so, you need two separate events. Each of those worker threads should set its own private event, and the waiting thread needs to wait on both of those separate events.
I would also have each thread own it own abort event.
People that start writing code immediately are programmers (or hackers), people that ask questions first are Software Engineers - Graham Shanks
|
|
|
|
|
Blake Miller wrote: Are you suggesting BOTH of the 'alternate' threads are each setting m_stSyncEvents.m_hSyncRxStart?
No. Each thread has its own event. There is a separate event created per thread object.
Blake Miller wrote: I would also have each thread own it own abort event.
The design was for a simplified exit mechanism. The threads wait on multiple events depending on what it is currently upto. Having a single 'abort' event that could trigger all threads to exit, was the reason for this.
"Programming today is a race between software engineers striving to build bigger and
better idiot-proof programs, and the Universe trying to produce bigger and better idiots.
So far the Universe is winning." -- Rich Cook
|
|
|
|
|
if a error occur in a function ,return false or handle it inside of function.
for example:
void fun()
{
bool isFail = openfile(...);
if(isFail)
{
::MessageBox(0,"open file fail",0,0);
exit(0);
}
}
bool fun()
{
bool isFail = openfile(...);
if(isFail)
{
return false;
}
........
return true;
}
|
|
|
|
|
|
sorry ,the question :
which error handle is right and commmon?
|
|
|
|
|
I wrappered a class to play video using DirectShow, almost following the sample "playwnd", but i found it cannot destroy the media window by the destructor, unless I destroy the parent window. I checked the state of the player window, it was stopped, but I could still saw it was running after the destructor invoked... Following list the destructor, what is the problem?
<br />
CMediaPlay::~CMediaPlay(void) {<br />
HRESULT hr;<br />
<br />
if (m_pMediaControl)<br />
{<br />
LIF( m_pMediaControl->Stop());<br />
OAFilterState fs;<br />
LIF( m_pMediaControl->GetState(200L, &fs));<br />
if (fs == State_Stopped)<br />
Msg(_T("Successfully stopped the filter run"));<br />
}<br />
<br />
if(m_pVideoWindow)<br />
{<br />
LIF(m_pVideoWindow->put_Visible(OAFALSE));<br />
LIF(m_pVideoWindow->put_Owner(NULL));<br />
}<br />
<br />
if (m_pMediaEventEx)<br />
LIF(m_pMediaEventEx->SetNotifyWindow((OAHWND)NULL, 0, 0));<br />
<br />
#ifdef REGISTER_FILTERGRAPH<br />
if (g_dwGraphRegister)<br />
{<br />
RemoveGraphFromRot(g_dwGraphRegister);<br />
g_dwGraphRegister = 0;<br />
}<br />
#endif<br />
<br />
SAFE_RELEASE(m_pFileSource );<br />
SAFE_RELEASE(m_pVideoDecoder );<br />
SAFE_RELEASE(m_pAVISplitter );<br />
SAFE_RELEASE(m_pSourceReader );<br />
<br />
SAFE_RELEASE(m_pMediaEventEx );<br />
SAFE_RELEASE(m_pMediaSeeking );<br />
SAFE_RELEASE(m_pVideoFrameStep );<br />
SAFE_RELEASE(m_pMediaControl );<br />
SAFE_RELEASE(m_pBasicAudio );<br />
SAFE_RELEASE(m_pBasicVideo );<br />
SAFE_RELEASE(m_pVideoWindow );<br />
SAFE_RELEASE(m_pGraphBuilder );<br />
}<br />
<font=sans-serif>|-|3llo Wo|2ld
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
