C / C++ / MFC

6-Mar-06 5:08

Hi all,

Since a few weeks I am playing with detour and winapi functions.
I hooked DirectDrawCreate and GetProcAdress. In the function GetProcAdress I want to return the adress of the api function "DirectDrawCreate" without detour does some 1 got the solution for this? Below the code I made so far:

<br />
<br />
DETOUR_TRAMPOLINE( HWND __stdcall zDirectDrawCreate(GUID* lpGUID , LPDIRECTDRAW* lplpDD , IUnknown* pUnkOuter) ,DirectDrawCreate );<br />
<br />
HWND __stdcall sDirectDrawCreate(GUID* lpGUID , LPDIRECTDRAW* lplpDD , IUnknown* pUnkOuter) <br />
{<br />
return zDirectDrawCreate(lpGUID , lplpDD , pUnkOuter); // Give PB the HRESULT<br />
}<br />
<br />
<br />
<br />
DETOUR_TRAMPOLINE(FARPROC WINAPI zGetProcAddress (HMODULE hModule, LPCSTR lp),GetProcAddress);<br />
<br />
FARPROC WINAPI sGetProcAddress (HMODULE hModule, LPCSTR lp)<br />
{<br />
if(HIWORD(lp))<br />
{<br />
<br />
<br />
if(!strcmp(lp, "GetProcAddress")) return (FARPROC) zGetProcAddress;<br />
//else if (!strcmp(lp, "DirectDrawCreate")) return // how can I return here the adress of the DirectDrawCreate api function without detour.. detour make jumps 0xE9 or 0x90.<br />
<br />
}<br />
return zGetProcAddress(hModule, lp);<br />
}<br />
<br />
void Detour_PB_DirectDraw()<br />
{ <br />
DetourFunctionWithTrampoline((PBYTE)zDirectDrawCreate,(PBYTE)sDirectDrawCreate);<br />
}<br />
<br />
void Detour_PB_GetProcAddress()<br />
{<br />
DetourFunctionWithTrampoline((PBYTE)zGetProcAddress,(PBYTE)sGetProcAddress);<br />
}<br />
<br />
bool WINAPI DllMain(HINSTANCE hInst, DWORD dwReason, PVOID pvReserved)<br />
{<br />
if(dwReason == DLL_PROCESS_ATTACH) <br />
{<br />
<br />
Detour_PB_GetProcAddress(); <br />
Detour_PB_DirectDraw();<br />
<br />
}<br />
<br />
else if(dwReason == DLL_PROCESS_DETACH)<br />
{<br />
<br />
}<br />
<br />
return true; <br />
}<br />

Stephen Hewitt6-Mar-06 11:46

6-Mar-06 11:46

Return the address of the trampoline. i.e.

DETOUR_TRAMPOLINE(FARPROC WINAPI zGetProcAddress (HMODULE hModule, LPCSTR lp),GetProcAddress);

FARPROC WINAPI sGetProcAddress (HMODULE hModule, LPCSTR lp)
{
     if(HIWORD(lp))
     {
          if(!strcmp(lp, "GetProcAddress")) return (FARPROC) zGetProcAddress;
          else if (!strcmp(lp, "DirectDrawCreate")) return (FARPROC)&zDirectDrawCreate;
     }
     return zGetProcAddress(hModule, lp);
}

If you look at the machine code for the trampoline it will consist of a few bytes from the detoured API followed by a jump. Don't let this fool you; calling it will have the same effect as the original API.

Also I think the following:

(FARPROC) zGetProcAddress

Should be:

(FARPROC)&sGetProcAddress

Steve

David-coder7-Mar-06 6:06

7-Mar-06 6:06

But If I am right then you retour the adress of the detoured function. I want to return the adress there of the unmodified api "DirectDrawCreate"

Stephen Hewitt7-Mar-06 12:08

7-Mar-06 12:08

Detours works by overwriting the target function - The address of the original function is no longer the address of the original function. Detours copies the overwritten data into the trampoline and then puts in the trampoline to the original function after the overwritten code. In short calling the trampoline (as my code did) has the effect of calling the original function.

Steve

David-coder8-Mar-06 3:46

8-Mar-06 3:46

I know how detours works. But I want the adress of the unmodified api"DirectDrawCreate" before I hook those functions.
The question is how can I do that.

Do I have to get it with:

int DirectDrawCreate = (int)GetProcAddress(LoadLibrary("ddraw.dll"), "DirectDrawCreate");
Then read the bytes and copy them with CopyMemory()
And then hook the api's

Stephen Hewitt8-Mar-06 11:29

8-Mar-06 11:29

Here's how I use detours:

DETOUR_TRAMPOLINE( BOOL WINAPI Tram_EnableWindow(HWND hWnd, BOOL bEnable),
     EnableWindow )
 
BOOL WINAPI My_EnableWindow( HWND hWnd, BOOL bEnable )
{
     // Do stuff here.
 
     return Tram_EnableWindow(hWnd, bEnable); // Call original API.
}
  
void ApplyDetours()
{
     DetourFunctionWithTrampoline((PBYTE)Tram_EnableWindow, (PBYTE)My_EnableWindow); // Apply.
}
 
void RemoveDetours()
{
     DetourRemove((PBYTE)Tram_EnableWindow, (PBYTE)My_EnableWindow); // Remove.
}

Because of the way Detours works, the address of the API before the detours is applied is the address of the modified function after it is applied - This is why it's do powerful as the hook function is called regardless of the calling mechanism (unlike IAT patching for example). The address of the original function after the detours has been applied is the address of the trampoline function. I don't know what you mean when you say, "Then read the bytes and copy them with CopyMemory()" - Detours takes care of all this for you.

Steve

David-coder9-Mar-06 7:29

9-Mar-06 7:29

A program that I use detects I use detours on "DirectDrawCreate" They use "GetProcAdress" to detect it. detour make jumps 0xE9 or 0x90 thats wot they see.

IAT patching sounds like a solution for this problem can you show me a example maybe ?

Stephen Hewitt9-Mar-06 11:25

9-Mar-06 11:25

IAT patching will only work if the DLL is not dynamically loaded. Is this the case? To check you the export table of the .EXE and see if it contains the API using "Depends.exe" or some such tool.

Steve

David-coder20-Mar-06 2:47

Re: Arrays and SendMessage

20-Mar-06 2:47

Well its an api function that is used in a game....
pbcl.dll which is dynamically loaded calls "DirectDrawCreate" in ddraw.dll

Is there a solution for my problem ?

Arrays and SendMessage

Waldermort6-Mar-06 4:33

Waldermort

6-Mar-06 4:33

I'm trying to pass an array of char* to a dialog box through the Sendmessage function. I seem to have no problem sending the message, but I'm not quite sure how to get access to the data from the dialog box. I'm not using MFC btw.

From my winmain I have

HWND hdlg;
char *items[4];
hdlg = CreateDialog(GetModuleHandle(NULL),MAKEINTRESOURCE(IDD_MERGE),hwnd,MergeProc);
data->get_dialog_items(items);
SendMessage(hdlg,WM_NOTIFY,MAKEWPARAM(SD_IMPORT_MERGE,items),0);

I think I have to use a typecast of some sort but everything I have tried so far is giving mw compilation errors. Any help would be greatly apprecitaed.

Iain Clarke, Warrior Programmer6-Mar-06 4:46

Iain Clarke, Warrior Programmer

6-Mar-06 4:46

I don't know the code SD_IMPORT_MERGE that you are using, but it probably doesn't matter.

The other part of MAKEWPARAM would normally be a control ID rather than an abritrary variable, and you'd have a structure pointed to by LPARAM. I can't remember its off the top of my head though.

If all you are doing is sending a custom message to the dialog saying "here's a lump of text", why not use

UINT g_myTextMessage = RegisterWindowMessage ("Some unique string here");
.....

char *items [4];
...
SendMessage (hDlg, g_myTextMessage, 0, (LPARAM)items);

...

and in your dialog class:

...
ON_REGISTERED_MESSAGE (g_myTextMessage, OnSendATextMessage)
...

LRESULT CMyDialog::OnSendATextMessage (WPARAM wParam, LPARAM lParam)
{
    char **items = (char **)lParam;
    ASSERT(items);
    if (!items) return 1;

    lstrcpy (items [0], "Some Text");
    lstrcpy (m_myBuffer, items [1]);
    
etc

    return 0;
}

This is without reference, so please make sure of the names!

Good luck,

Iain.

Re: Arrays and SendMessage

Waldermort6-Mar-06 4:56

Waldermort

6-Mar-06 4:56

Iain Clarke wrote:
I don't know the code SD_IMPORT_MERGE that you are using, but it probably doesn't matter.

SD_IMPORT_MERGE is an identifier I am can trap within WM_NOTIFY. Not thats its very important it's just the way I was trying to get this to work.

Normaly when passing an of chars to a function I would define the function as MyFunction(char *foo[]), I was trying to derefrence using the same form. I noticed you used a double pointer which makes a little more sense.

Thankyou, I have got it working now.

isolate differents parts of the string

SWDevil6-Mar-06 4:20

SWDevil

6-Mar-06 4:20

I have a CString object which contains a string in the format: 00:11.2 (for example).

I have to isolate each of the parts of the string.
For example i need to get:
str1 = 00
str2 = 11
str3 = 2

how can I do this?

toxcct6-Mar-06 4:24

toxcct

6-Mar-06 4:24

CString::Mid()[^] ?

Roger Stoltz6-Mar-06 5:01

Roger Stoltz

6-Mar-06 5:01

Yep, combined with CString::FindOneOf() where you provide the chars that separate different "parts" of the string.

It's supposed to be hard, otherwise anybody could do it!

SWDevil6-Mar-06 5:04

SWDevil

6-Mar-06 5:04

Is there a way to trim part of the string?
(I want to read part of the string and then trim that part..)
For instance,after I find where the ":" is located, I want to trim the right most part of the string, and so forth for the other parts of the string...

David Crow6-Mar-06 5:41

David Crow

6-Mar-06 5:41

SWDevil wrote:
For instance,after I find where the ":" is located, I want to trim the right most part of the string...

CString str = "00:11.2";
int nIndex = str.Find(':');
str = str.Left(nIndex);
or
str = str.Mid(0, nIndex + 1);

"Let us be thankful for the fools. But for them the rest of us could not succeed." - Mark Twain

"There is no death, only a change of worlds." - Native American Proverb