Lenheart
/
DNF_DLL
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
DNF_DLL/test/Detours/samples/tracebld/trcbld.cpp

4574 lines
129 KiB
C++
Raw Blame History

/////////////////////////////////////////////////////////////////////////////
//
// Detours Test Program (trcbld.cpp of trcbld.dll)
//
// Microsoft Research Detours Package
//
// Copyright (c) Microsoft Corporation. All rights reserved.
//
#define _WIN32_WINNT 0x0500
#define WIN32
#define NT
#define DBG_TRACE 0
#include <windows.h>
#include <stdio.h>
#pragma warning(push)
#if _MSC_VER > 1400
#pragma warning(disable:6102 6103) // /analyze warnings
#endif
#include <strsafe.h>
#pragma warning(pop)
#include "detours.h"
#include "tracebld.h"
#define PULONG_PTR PVOID
#define PLONG_PTR PVOID
#define ULONG_PTR PVOID
//////////////////////////////////////////////////////////////////////////////
#pragma warning(disable:4127) // Many of our asserts are constants.
#define DEBUG_BREAK() DebugBreak()
#define ASSERT_ALWAYS(x) \
do { \
if (!(x)) { \
AssertFailed(#x, __FILE__, __LINE__); \
DebugBreak(); \
} \
} while (0)
#ifndef NDEBUG
#define ASSERT(x) ASSERT_ALWAYS(x)
#else
#define ASSERT(x)
#endif
#define UNUSED(c) (c) = (c)
//////////////////////////////////////////////////////////////////////////////
static HMODULE s_hInst = NULL;
static HMODULE s_hKernel32 = NULL;
static CHAR s_szDllPath[MAX_PATH];
static TBLOG_PAYLOAD s_Payload;
static TBLOG_PAYLOAD s_ChildPayload;
static CRITICAL_SECTION s_csChildPayload;
static DWORD s_nTraceProcessId = 0;
static LONG s_nChildCnt = 0;
static CRITICAL_SECTION s_csPipe; // Guards access to hPipe.
static HANDLE s_hPipe = INVALID_HANDLE_VALUE;
static TBLOG_MESSAGE s_rMessage;
// Logging Functions.
//
VOID Tblog(PCSTR pszMsgf, ...);
VOID TblogV(PCSTR pszMsgf, va_list args);
VOID VSafePrintf(PCSTR pszMsg, va_list args, PCHAR pszBuffer, LONG cbBuffer);
PCHAR SafePrintf(PCHAR pszBuffer, LONG cbBuffer, PCSTR pszMsg, ...);
LONG EnterFunc();
VOID ExitFunc();
VOID Print(PCSTR psz, ...);
VOID NoteRead(PCSTR psz);
VOID NoteRead(PCWSTR pwz);
VOID NoteWrite(PCSTR psz);
VOID NoteWrite(PCWSTR pwz);
VOID NoteDelete(PCSTR psz);
VOID NoteDelete(PCWSTR pwz);
VOID NoteCleanup(PCSTR psz);
VOID NoteCleanup(PCWSTR pwz);
PBYTE LoadFile(HANDLE hFile, DWORD cbFile);
static PCHAR RemoveReturns(PCHAR pszBuffer);
static PWCHAR RemoveReturns(PWCHAR pwzBuffer);
VOID AssertFailed(CONST PCHAR pszMsg, CONST PCHAR pszFile, ULONG nLine);
int WINAPI Mine_EntryPoint(VOID);
VOID WINAPI Mine_ExitProcess(UINT a0);
//////////////////////////////////////////////////////////////////////////////
//
int (WINAPI * Real_EntryPoint)(VOID)
= NULL;
BOOL (WINAPI * Real_CreateDirectoryW)(LPCWSTR a0,
LPSECURITY_ATTRIBUTES a1)
= CreateDirectoryW;
BOOL (WINAPI * Real_CreateDirectoryExW)(LPCWSTR a0,
LPCWSTR a1,
LPSECURITY_ATTRIBUTES a2)
= CreateDirectoryExW;
HANDLE (WINAPI * Real_CreateFileW)(LPCWSTR a0,
DWORD a1,
DWORD a2,
LPSECURITY_ATTRIBUTES a3,
DWORD a4,
DWORD a5,
HANDLE a6)
= CreateFileW;
HANDLE (WINAPI * Real_CreateFileMappingW)(HANDLE hFile,
LPSECURITY_ATTRIBUTES lpAttributes,
DWORD flProtect,
DWORD dwMaximumSizeHigh,
DWORD dwMaximumSizeLow,
LPCWSTR lpName
)
= CreateFileMappingW;
BOOL (WINAPI * Real_CreatePipe)(PHANDLE hReadPipe,
PHANDLE hWritePipe,
LPSECURITY_ATTRIBUTES lpPipeAttributes,
DWORD nSize)
= CreatePipe;
BOOL (WINAPI * Real_CloseHandle)(HANDLE a0)
= CloseHandle;
BOOL (WINAPI * Real_DuplicateHandle)(HANDLE hSourceProcessHandle,
HANDLE hSourceHandle,
HANDLE hTargetProcessHandle,
LPHANDLE lpTargetHandle,
DWORD dwDesiredAccess,
BOOL bInheritHandle,
DWORD dwOptions)
= DuplicateHandle;
BOOL (WINAPI * Real_CreateProcessW)(LPCWSTR lpApplicationName,
LPWSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCWSTR lpCurrentDirectory,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation)
= CreateProcessW;
BOOL (WINAPI * Real_CreateProcessA)(LPCSTR lpApplicationName,
LPSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCSTR lpCurrentDirectory,
LPSTARTUPINFOA lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation)
= CreateProcessA;
BOOL (WINAPI * Real_DeleteFileW)(LPCWSTR a0)
= DeleteFileW;
BOOL (WINAPI * Real_DeviceIoControl)(HANDLE a0,
DWORD dwIoControlCode,
LPVOID lpInBuffer,
DWORD nInBufferSize,
LPVOID lpOutBuffer,
DWORD nOutBufferSize,
LPDWORD lpBytesReturned,
LPOVERLAPPED lpOverlapped)
= DeviceIoControl;
DWORD (WINAPI * Real_GetFileAttributesW)(LPCWSTR a0)
= GetFileAttributesW;
BOOL (WINAPI * Real_MoveFileWithProgressW)(LPCWSTR lpExistingFileName,
LPCWSTR lpNewFileName,
LPPROGRESS_ROUTINE lpProgressRoutine,
LPVOID lpData,
DWORD dwFlags)
= MoveFileWithProgressW;
BOOL (WINAPI * Real_MoveFileA)(LPCSTR a0,
LPCSTR a1)
= MoveFileA;
BOOL (WINAPI * Real_MoveFileW)(LPCWSTR a0,
LPCWSTR a12)
= MoveFileW;
BOOL (WINAPI * Real_MoveFileExA)(LPCSTR a0,
LPCSTR a1,
DWORD a2)
= MoveFileExA;
BOOL (WINAPI * Real_MoveFileExW)(LPCWSTR a0,
LPCWSTR a1,
DWORD a2)
= MoveFileExW;
BOOL (WINAPI * Real_CopyFileExA)(LPCSTR a0,
LPCSTR a1,
LPPROGRESS_ROUTINE a2,
LPVOID a4,
LPBOOL a5,
DWORD a6)
= CopyFileExA;
BOOL (WINAPI * Real_CopyFileExW)(LPCWSTR a0,
LPCWSTR a1,
LPPROGRESS_ROUTINE a2,
LPVOID a4,
LPBOOL a5,
DWORD a6)
= CopyFileExW;
BOOL (WINAPI * Real_PrivCopyFileExW)(LPCWSTR lpExistingFileName,
LPCWSTR lpNewFileName,
LPPROGRESS_ROUTINE lpProgressRoutine,
LPVOID lpData,
LPBOOL pbCancel,
DWORD dwCopyFlags)
= NULL;
BOOL (WINAPI * Real_CreateHardLinkA)(LPCSTR a0,
LPCSTR a1,
LPSECURITY_ATTRIBUTES a2)
= CreateHardLinkA;
BOOL (WINAPI * Real_CreateHardLinkW)(LPCWSTR a0,
LPCWSTR a1,
LPSECURITY_ATTRIBUTES a2)
= CreateHardLinkW;
BOOL (WINAPI * Real_SetStdHandle)(DWORD a0,
HANDLE a1)
= SetStdHandle;
HMODULE (WINAPI * Real_LoadLibraryA)(LPCSTR a0)
= LoadLibraryA;
HMODULE (WINAPI * Real_LoadLibraryW)(LPCWSTR a0)
= LoadLibraryW;
HMODULE (WINAPI * Real_LoadLibraryExA)(LPCSTR a0,
HANDLE a1,
DWORD a2)
= LoadLibraryExA;
HMODULE (WINAPI * Real_LoadLibraryExW)(LPCWSTR a0,
HANDLE a1,
DWORD a2)
= LoadLibraryExW;
DWORD (WINAPI * Real_SetFilePointer)(HANDLE hFile,
LONG lDistanceToMove,
PLONG lpDistanceToMoveHigh,
DWORD dwMoveMethod)
= SetFilePointer;
BOOL (WINAPI * Real_SetFilePointerEx)(HANDLE hFile,
LARGE_INTEGER liDistanceToMove,
PLARGE_INTEGER lpNewFilePointer,
DWORD dwMoveMethod)
= SetFilePointerEx;
BOOL (WINAPI * Real_ReadFile)(HANDLE a0,
LPVOID a1,
DWORD a2,
LPDWORD a3,
LPOVERLAPPED a4)
= ReadFile;
BOOL (WINAPI * Real_ReadFileEx)(HANDLE a0,
LPVOID a1,
DWORD a2,
LPOVERLAPPED a3,
LPOVERLAPPED_COMPLETION_ROUTINE a4)
= ReadFileEx;
BOOL (WINAPI * Real_WriteFile)(HANDLE a0,
LPCVOID a1,
DWORD a2,
LPDWORD a3,
LPOVERLAPPED a4)
= WriteFile;
BOOL (WINAPI * Real_WriteFileEx)(HANDLE a0,
LPCVOID a1,
DWORD a2,
LPOVERLAPPED a3,
LPOVERLAPPED_COMPLETION_ROUTINE a4)
= WriteFileEx;
BOOL (WINAPI * Real_WriteConsoleA)(HANDLE a0,
const VOID* a1,
DWORD a2,
LPDWORD a3,
LPVOID a4)
= WriteConsoleA;
BOOL (WINAPI * Real_WriteConsoleW)(HANDLE a0,
const VOID* a1,
DWORD a2,
LPDWORD a3,
LPVOID a4)
= WriteConsoleW;
VOID (WINAPI * Real_ExitProcess)(UINT a0)
= ExitProcess;
DWORD (WINAPI * Real_ExpandEnvironmentStringsA)(PCSTR lpSrc, PCHAR lpDst, DWORD nSize)
= ExpandEnvironmentStringsA;
DWORD (WINAPI * Real_ExpandEnvironmentStringsW)(PCWSTR lpSrc, PWCHAR lpDst, DWORD nSize)
= ExpandEnvironmentStringsW;
DWORD (WINAPI * Real_GetEnvironmentVariableA)(PCSTR lpName, PCHAR lpBuffer, DWORD nSize)
= GetEnvironmentVariableA;
DWORD (WINAPI * Real_GetEnvironmentVariableW)(PCWSTR lpName, PWCHAR lpBuffer, DWORD nSize)
= GetEnvironmentVariableW;
PCWSTR (CDECL * Real_wgetenv)(PCWSTR var) = NULL;
PCSTR (CDECL * Real_getenv)(PCSTR var) = NULL;
DWORD (CDECL * Real_getenv_s)(DWORD *pValue, PCHAR pBuffer, DWORD cBuffer, PCSTR varname) = NULL;
DWORD (CDECL * Real_wgetenv_s)(DWORD *pValue, PWCHAR pBuffer, DWORD cBuffer, PCWSTR varname) = NULL;
DWORD (CDECL * Real_dupenv_s)(PCHAR *ppBuffer, DWORD *pcBuffer, PCSTR varname) = NULL;
DWORD (CDECL * Real_wdupenv_s)(PWCHAR *ppBuffer, DWORD *pcBuffer, PCWSTR varname) = NULL;
//////////////////////////////////////////////////////////////////////////////
//
static VOID Copy(PWCHAR pwzDst, PCWSTR pwzSrc)
{
while (*pwzSrc) {
*pwzDst++ = *pwzSrc++;
}
*pwzDst = '\0';
}
static DWORD Size(PCWSTR pwzSrc)
{
DWORD c = 0;
while (pwzSrc[c]) {
c++;
}
return c;
}
static PCWSTR Save(PCWSTR pwzSrc)
{
DWORD c = (Size(pwzSrc) + 1) * sizeof(WCHAR);
PWCHAR pwzDst = (PWCHAR)GlobalAlloc(GPTR, c);
CopyMemory(pwzDst, pwzSrc, c);
return pwzDst;
}
static BOOL HasSpace(PCWSTR pwz)
{
for (; *pwz; pwz++) {
if (*pwz == ' ' || *pwz == '\t' || *pwz == '\r' || *pwz == '\n') {
return TRUE;
}
}
return FALSE;
}
static BOOL HasChar(PCWSTR pwz, WCHAR w)
{
for (; *pwz; pwz++) {
if (*pwz == w) {
return TRUE;
}
}
return FALSE;
}
static DWORD Compare(PCWSTR pwzA, PCWSTR pwzB)
{
for (;;) {
WCHAR cA = *pwzA++;
WCHAR cB = *pwzB++;
if (cA >= 'A' && cA <= 'Z') {
cA += ('a' - 'A');
}
if (cB >= 'A' && cB <= 'Z') {
cB += ('a' - 'A');
}
if (cA == 0 && cB == 0) {
return 0;
}
if (cA != cB) {
return cA - cB;
}
}
}
static DWORD Compare(PCWSTR pwzA, PCSTR pszB)
{
for (;;) {
WCHAR cA = *pwzA++;
WCHAR cB = *pszB++;
if (cA >= 'A' && cA <= 'Z') {
cA += ('a' - 'A');
}
if (cB >= 'A' && cB <= 'Z') {
cB += ('a' - 'A');
}
if (cA == 0 && cB == 0) {
return 0;
}
if (cA != cB) {
return cA - cB;
}
}
}
static DWORD Compare(PCSTR pszA, PCSTR pszB)
{
for (;;) {
CHAR cA = *pszA++;
CHAR cB = *pszB++;
if (cA >= 'A' && cA <= 'Z') {
cA += ('a' - 'A');
}
if (cB >= 'A' && cB <= 'Z') {
cB += ('a' - 'A');
}
if (cA == 0 && cB == 0) {
return 0;
}
if (cA != cB) {
return cA - cB;
}
}
}
//////////////////////////////////////////////////////////////////////////////
static PCSTR s_rpszMsvcrNames[] = {
"msvcr80.dll",
"msvcr80d.dll",
"msvcr71.dll",
"msvcr71d.dll",
"msvcr70.dll",
"msvcr70d.dll",
NULL
};
HMODULE s_hMsvcr = NULL;
PCSTR s_pszMsvcr = NULL;
static BOOL WINAPI ImportFileCallback(PVOID pContext, HMODULE hFile, PCSTR pszFile)
{
UNUSED(pContext);
if (pszFile != NULL) {
for (int i = 0; s_rpszMsvcrNames[i]; i++) {
if (Compare(pszFile, s_rpszMsvcrNames[i]) == 0) {
s_hMsvcr = hFile;
s_pszMsvcr = s_rpszMsvcrNames[i];
return FALSE;
}
}
}
return TRUE;
}
BOOL FindMsvcr()
{
DetourEnumerateImports(NULL, NULL, ImportFileCallback, NULL);
if (s_hMsvcr != NULL) {
return TRUE;
}
return FALSE;
}
BOOL FindProc(PVOID * ppvCode, PCSTR pwzFunc)
{
PVOID pv = GetProcAddress(s_hMsvcr, pwzFunc);
if (pv != NULL) {
*ppvCode = pv;
return TRUE;
}
else {
*ppvCode = NULL;
return FALSE;
}
}
//////////////////////////////////////////////////////////////////////////////
//
struct EnvInfo
{
DWORD m_nHash;
DWORD m_nIndex;
PCWSTR m_pwzVar;
PCWSTR m_pwzVal;
BOOL m_fDefined;
BOOL m_fUsed;
BOOL m_fOriginal;
};
//////////////////////////////////////////////////////////////////////////////
//
class EnvVars
{
private:
static CRITICAL_SECTION s_csLock;
static DWORD s_nVars;
static DWORD s_nCapacity;
static EnvInfo ** s_pVars;
private:
static DWORD Hash(PCWSTR pwzVar)
{
DWORD hash = 5381;
while (*pwzVar != 0) {
WCHAR c = *pwzVar++;
if (c >= 'A' && c <= 'Z') {
c += ('a' - 'A');
}
hash = ((hash << 5) + hash) + c;
}
return hash;
}
static VOID LockAcquire()
{
EnterCriticalSection(&s_csLock);
}
static VOID LockRelease()
{
LeaveCriticalSection(&s_csLock);
}
static VOID Resize(DWORD nCapacity);
static VOID Set(EnvInfo *info);
static EnvInfo * Find(PCWSTR pwzVar);
public:
static BOOL Equal(PCWSTR pwzA, PCWSTR pwzB)
{
return (Compare(pwzA, pwzB) == 0);
}
public:
static VOID Initialize();
static VOID Dump();
static VOID Add(PCWSTR pwzVar, PCWSTR pwzVal);
static VOID Used(PCWSTR pwzVar);
static VOID Used(PCSTR pszVar);
};
CRITICAL_SECTION EnvVars::s_csLock;
DWORD EnvVars::s_nVars = 0;
DWORD EnvVars::s_nCapacity = 0;
EnvInfo ** EnvVars::s_pVars = NULL;
VOID EnvVars::Initialize()
{
InitializeCriticalSection(&s_csLock);
Resize(919);
}
VOID EnvVars::Resize(DWORD nCapacity)
{
if (nCapacity > s_nCapacity) {
DWORD nOld = s_nCapacity;
EnvInfo ** pOld = s_pVars;
// DEBUG_BREAK();
s_pVars = (EnvInfo **)GlobalAlloc(GPTR, nCapacity * sizeof(EnvInfo *));
s_nCapacity = nCapacity;
if (pOld != NULL) {
for (DWORD n = 0; n < nOld; n++) {
if (pOld[n] != NULL) {
Set(pOld[n]);
}
}
GlobalFree((HGLOBAL)pOld);
pOld = NULL;
}
}
}
VOID EnvVars::Set(EnvInfo *info)
{
DWORD hash = info->m_nHash;
DWORD slot = hash % s_nCapacity;
DWORD death = 0;
// Find an empty slot.
for (; s_pVars[slot] != NULL; slot = (slot + 1) % s_nCapacity) {
if (++death > s_nCapacity) {
// We should have dropped out at some point...
DEBUG_BREAK();
}
}
s_pVars[slot] = info;
}
EnvInfo * EnvVars::Find(PCWSTR pwzVar)
{
DWORD hash = Hash(pwzVar);
DWORD slot = hash % s_nCapacity;
LockAcquire();
// Find the the matching slot, or an empty one.
for (; s_pVars[slot] != NULL; slot = (slot + 1) % s_nCapacity) {
if (Equal(s_pVars[slot]->m_pwzVar, pwzVar)) {
LockRelease();
return s_pVars[slot];
}
}
LockRelease();
return NULL;
}
VOID EnvVars::Add(PCWSTR pwzVar, PCWSTR pwzVal)
{
if (pwzVar == NULL) {
return;
}
WCHAR wzVar[MAX_PATH];
PWCHAR pwzDst = wzVar;
while (*pwzVar) {
if (*pwzVar >= 'a' && *pwzVar <= 'z') {
*pwzDst++ = *pwzVar - ('a' - 'A');
}
else {
*pwzDst++ = *pwzVar;
}
pwzVar++;
}
*pwzDst = '\0';
pwzVar = wzVar;
WCHAR wzVal[] = L"";
if (pwzVal != NULL) {
while (*pwzVal == ' ' || *pwzVal == '\t') {
*pwzVal++;
}
}
else {
pwzVal = wzVal;
}
// Tblog("<!-- ::Add var=[%le] val=[%le] -->\n", pwzVar, pwzVal);
LockAcquire();
// DEBUG_BREAK();
DWORD hash = Hash(pwzVar);
DWORD slot = hash % s_nCapacity;
EnvInfo *info = NULL;
DWORD death = 0;
// Find the the matching slot, or an empty one.
for (; s_pVars[slot] != NULL; slot = (slot + 1) % s_nCapacity) {
if (Equal(s_pVars[slot]->m_pwzVar, pwzVar)) {
LockRelease();
return;
}
if (++death > s_nCapacity) {
// We should have dropped out at some point...
DEBUG_BREAK();
}
}
// Add the var to list of known vars.
info = (EnvInfo *)GlobalAlloc(GPTR, sizeof(EnvInfo));
info->m_nHash = hash;
info->m_nIndex = s_nVars++;
info->m_pwzVar = Save(pwzVar);
info->m_pwzVal = Save(pwzVal);
if (pwzVal[0] == '\0') {
info->m_fDefined = FALSE;
info->m_fUsed = TRUE;
}
else {
info->m_fDefined = TRUE;
}
s_pVars[slot] = info;
// Check if we should grow the table.
if (s_nVars > (s_nCapacity / 2)) {
Resize(s_nCapacity * 2 - 1);
}
LockRelease();
}
VOID EnvVars::Used(PCWSTR pwzVar)
{
if (pwzVar != NULL) {
// Tblog("<!-- Used [%le] -->\n", pwzVar);
EnvInfo *pInfo = Find(pwzVar);
if (pInfo) {
pInfo->m_fUsed = TRUE;
}
#if 0
else {
Add(pwzVar, NULL);
}
#endif
}
}
VOID EnvVars::Used(PCSTR pszVar)
{
if (pszVar != NULL) {
WCHAR wzVar[MAX_PATH];
PWCHAR pwzVar = wzVar;
while (*pszVar) {
*pwzVar++ = *pszVar++;
}
*pwzVar = '\0';
Used(wzVar);
}
}
VOID EnvVars::Dump()
{
if (s_nVars == 0) {
return;
}
LockAcquire();
Tblog("<t:Vars>\n");
// Remove any variables that match the original environment.
PCWSTR pwzz = s_Payload.wzzEnvironment;
while (*pwzz) {
WCHAR wzVar[MAX_PATH];
PWCHAR pwzVar = wzVar;
while (*pwzz && *pwzz != '=') {
*pwzVar++ = *pwzz++;
}
*pwzVar = '\0';
if (*pwzz == '=') {
pwzz++;
}
EnvInfo *pInfo = Find(wzVar);
if (pInfo) {
if (Compare(pwzz, pInfo->m_pwzVal) == 0) {
pInfo->m_fUsed = FALSE;
}
}
pwzz += Size(pwzz) + 1;
}
EnvInfo ** pSorted = (EnvInfo **)GlobalAlloc(GPTR, s_nVars * sizeof(EnvInfo *));
for (DWORD n = 0; n < s_nCapacity; n++) {
if (s_pVars[n] != NULL) {
if (s_pVars[n]->m_nIndex > s_nVars) {
DEBUG_BREAK();
}
pSorted[s_pVars[n]->m_nIndex] = s_pVars[n];
}
}
for (DWORD n = 0; n < s_nVars; n++) {
EnvInfo *pInfo = pSorted[n];
if (pInfo == NULL) {
Print("<!-- Warning: Missing %d of %d -->\n", n, s_nVars);
continue;
}
if (pInfo->m_fUsed && pInfo->m_pwzVal[0]) {
Print("<t:Var var=\"%le\">%le</t:Var>\n", pInfo->m_pwzVar, pInfo->m_pwzVal);
}
}
GlobalFree((HGLOBAL)pSorted);
Tblog("</t:Vars>\n");
LockRelease();
}
void SaveEnvironment()
{
LPWCH pwStrings = GetEnvironmentStringsW();
PCWSTR pwEnv = (PCWSTR)pwStrings;
while (*pwEnv != '\0') {
WCHAR wzVar[MAX_PATH];
PWCHAR pwzDst = wzVar;
PCWSTR pwzVal = NULL;
if (*pwEnv == '=') {
*pwzDst++ = *pwEnv++;
}
while (*pwEnv != '\0' && *pwEnv != '=') {
*pwzDst++ = *pwEnv++;
}
*pwzDst++ = '\0';
if (*pwEnv == '=') {
pwEnv++;
}
pwzVal = pwEnv;
while (*pwEnv != '\0') {
pwEnv++;
}
if (*pwEnv == '\0') {
pwEnv++;
}
if (wzVar[0] != '=') {
EnvVars::Add(wzVar, pwzVal);
}
}
FreeEnvironmentStringsW(pwStrings);
}
//////////////////////////////////////////////////////////////////////////////
//
struct ProcInfo
{
HANDLE m_hProc;
DWORD m_nProcId;
DWORD m_nProc;
};
class Procs
{
private:
static CRITICAL_SECTION s_csLock;
static DWORD s_nProcs;
static ProcInfo s_rProcs[4049];
private:
static ProcInfo& HashToSlot(HANDLE handle)
{
return s_rProcs[((DWORD_PTR)handle) % ARRAYSIZE(s_rProcs)];
}
static VOID LockAcquire()
{
EnterCriticalSection(&s_csLock);
}
static VOID LockRelease()
{
LeaveCriticalSection(&s_csLock);
}
public:
static VOID Initialize();
static ProcInfo * Create(HANDLE hProc, DWORD nProcId);
static BOOL Close(HANDLE hProc);
};
CRITICAL_SECTION Procs::s_csLock;
DWORD Procs::s_nProcs = 0;
ProcInfo Procs::s_rProcs[4049];
VOID Procs::Initialize()
{
InitializeCriticalSection(&s_csLock);
for (DWORD i = 0; i < ARRAYSIZE(s_rProcs); i++) {
s_rProcs[i].m_hProc = INVALID_HANDLE_VALUE;
}
}
ProcInfo * Procs::Create(HANDLE hProc, DWORD nProcId)
{
LockAcquire();
s_nProcs++;
ProcInfo& slot = HashToSlot(hProc);
slot.m_hProc = hProc;
slot.m_nProcId = nProcId;
slot.m_nProc = s_nProcs;
Print("<!-- CreateProcess (%d)-->\n", slot.m_nProc);
LockRelease();
return &slot;
}
BOOL Procs::Close(HANDLE hProc)
{
BOOL first = false;
LockAcquire();
ProcInfo& slot = HashToSlot(hProc);
if (slot.m_hProc == hProc) {
first = true;
Print("<!-- CloseProcess (%d)-->\n", slot.m_nProc);
slot.m_hProc = INVALID_HANDLE_VALUE;
slot.m_nProcId = 0;
slot.m_nProc = 0;
s_nProcs--;
}
LockRelease();
return first;
}
//////////////////////////////////////////////////////////////////////////////
//
struct FileInfo
{
DWORD m_nHash;
DWORD m_nIndex;
BOOL m_fCantRead; // Set for file that are opened Create
BOOL m_fRead;
BOOL m_fWrite;
BOOL m_fDelete;
BOOL m_fCleanup;
BOOL m_fSystemPath;
BOOL m_fTemporaryPath;
BOOL m_fTemporaryFile;
DWORD m_cbRead;
DWORD m_cbWrite;
BOOL m_fAppend;
BOOL m_fAbsorbed; // Absorbed by TraceBld.
BOOL m_fDirectory;
PCWSTR m_pwzPath;
PBYTE m_pbContent;
DWORD m_cbContent;
};
//////////////////////////////////////////////////////////////////////////////
//
class FileNames
{
private:
static CRITICAL_SECTION s_csLock;
static DWORD s_nFiles;
static DWORD s_nCapacity;
static FileInfo ** s_pFiles;
public:
static WCHAR s_wzSysPath[MAX_PATH];
static WCHAR s_wzS64Path[MAX_PATH];
static WCHAR s_wzTmpPath[MAX_PATH];
static WCHAR s_wzExePath[MAX_PATH];
static DWORD s_wcSysPath;
static DWORD s_wcS64Path;
static DWORD s_wcTmpPath;
static DWORD s_wcExePath;
private:
static DWORD Hash(PCWSTR pwzFile)
{
DWORD hash = 5381;
while (*pwzFile != 0) {
WCHAR c = *pwzFile++;
if (c >= 'A' && c <= 'Z') {
c += ('a' - 'A');
}
hash = ((hash << 5) + hash) + c;
}
return hash;
}
static VOID LockAcquire()
{
EnterCriticalSection(&s_csLock);
}
static VOID LockRelease()
{
LeaveCriticalSection(&s_csLock);
}
static VOID Resize(DWORD nCapacity);
static VOID Set(FileInfo *info);
static VOID Replace(PWCHAR pwzBuffer, PWCHAR pwzDstEnd, DWORD cwOld, PCWSTR pwzNew);
public:
static BOOL Equal(PCWSTR pwzA, PCWSTR pwzB)
{
return (Compare(pwzA, pwzB) == 0);
}
static BOOL PrefixMatch(PCWSTR pwzFile, PCWSTR pwzPrefix)
{
for (;;) {
WCHAR cFile = *pwzFile++;
WCHAR cPrefix = *pwzPrefix++;
if (cFile >= 'A' && cFile <= 'Z') {
cFile += ('a' - 'A');
}
if (cPrefix >= 'A' && cPrefix <= 'Z') {
cPrefix += ('a' - 'A');
}
if (cPrefix == 0) {
return TRUE;
}
if (cFile != cPrefix) {
return FALSE;
}
}
}
static BOOL SuffixMatch(PCWSTR pwzFile, PCWSTR pwzSuffix)
{
// Move both pointers to the end of the strings.
PCWSTR pwzFileBeg = pwzFile;
while (*pwzFile) {
pwzFile++;
}
PCWSTR pwzSuffixBeg = pwzSuffix;
while (*pwzSuffix) {
pwzSuffix++;
}
// Now walk backwards comparing strings.
for (;;) {
WCHAR cFile = (pwzFile > pwzFileBeg) ? *--pwzFile : 0;
WCHAR cSuffix = (pwzSuffix > pwzSuffixBeg) ? *--pwzSuffix : 0;
if (cFile >= 'A' && cFile <= 'Z') {
cFile += ('a' - 'A');
}
if (cSuffix >= 'A' && cSuffix <= 'Z') {
cSuffix += ('a' - 'A');
}
if (cSuffix == 0) {
return TRUE;
}
if (cFile != cSuffix) {
return FALSE;
}
}
}
static VOID EndInSlash(PWCHAR pwzPath)
{
if (*pwzPath) {
while (*pwzPath) {
pwzPath++;
}
if (pwzPath[-1] != '\\') {
*pwzPath++ = '\\';
*pwzPath = '\0';
}
}
}
public:
static VOID Initialize();
static VOID Dump();
static FileInfo * FindPartial(PCWSTR pwzPath);
static FileInfo * FindPartial(PCSTR pszPath);
static FileInfo * FindFull(PCWSTR pwzPath);
static PCWSTR ParameterizeName(PWCHAR pwzDst, DWORD cMaxDst, PCWSTR pwzPath);
static PCWSTR ParameterizeName(PWCHAR pwzDst, DWORD cMaxDst, FileInfo *pInfo);
static VOID ParameterizeLine(PWCHAR pwzDst, PWCHAR pwzDstEnd);
};
CRITICAL_SECTION FileNames::s_csLock;
DWORD FileNames::s_nFiles = 0;
DWORD FileNames::s_nCapacity = 0;
FileInfo ** FileNames::s_pFiles;
WCHAR FileNames::s_wzSysPath[MAX_PATH];
WCHAR FileNames::s_wzS64Path[MAX_PATH];
WCHAR FileNames::s_wzTmpPath[MAX_PATH];
WCHAR FileNames::s_wzExePath[MAX_PATH];
DWORD FileNames::s_wcSysPath;
DWORD FileNames::s_wcS64Path;
DWORD FileNames::s_wcTmpPath;
DWORD FileNames::s_wcExePath;
VOID FileNames::Initialize()
{
InitializeCriticalSection(&s_csLock);
s_wzSysPath[0] = '\0';
GetSystemDirectoryW(s_wzSysPath, ARRAYSIZE(s_wzSysPath));
EndInSlash(s_wzSysPath);
s_wzS64Path[0] = '\0';
GetWindowsDirectoryW(s_wzS64Path, ARRAYSIZE(s_wzS64Path));
EndInSlash(s_wzS64Path);
Copy(s_wzS64Path + Size(s_wzS64Path), L"SysWOW64\\");
s_wzTmpPath[0] = '\0';
GetTempPathW(ARRAYSIZE(s_wzTmpPath), s_wzTmpPath);
EndInSlash(s_wzTmpPath);
s_wzExePath[0] = '\0';
GetModuleFileNameW(NULL, s_wzExePath, ARRAYSIZE(s_wzExePath));
PWCHAR pwzLast = s_wzExePath;
for (PWCHAR pwz = s_wzExePath; *pwz; pwz++) {
if (*pwz == '\\') {
pwzLast = pwz;
}
}
if (*pwzLast == '\\') {
*++pwzLast = '\0';
}
s_wcSysPath = Size(s_wzSysPath);
s_wcS64Path = Size(s_wzS64Path);
s_wcTmpPath = Size(s_wzTmpPath);
s_wcExePath = Size(s_wzExePath);
Resize(4049);
}
VOID FileNames::Resize(DWORD nCapacity)
{
if (nCapacity > s_nCapacity) {
DWORD nOld = s_nCapacity;
FileInfo ** pOld = s_pFiles;
s_pFiles = (FileInfo **)GlobalAlloc(GPTR, nCapacity * sizeof(FileInfo *));
s_nCapacity = nCapacity;
if (pOld != NULL) {
for (DWORD n = 0; n < nOld; n++) {
if (pOld[n] != NULL) {
Set(pOld[n]);
}
}
GlobalFree((HGLOBAL)pOld);
pOld = NULL;
}
s_nCapacity = nCapacity;
}
}
VOID FileNames::Set(FileInfo *info)
{
DWORD hash = info->m_nHash;
DWORD slot = hash % s_nCapacity;
DWORD death = 0;
// Find an empty slot.
for (; s_pFiles[slot] != NULL; slot = (slot + 1) % s_nCapacity) {
if (++death > s_nCapacity) {
// We should have dropped out at some point...
DEBUG_BREAK();
}
}
s_pFiles[slot] = info;
}
FileInfo * FileNames::FindFull(PCWSTR pwzPath)
{
if (pwzPath == NULL) {
return NULL;
}
LockAcquire();
DWORD hash = Hash(pwzPath);
DWORD slot = hash % s_nCapacity;
FileInfo *info = NULL;
DWORD death = 0;
// Find the the matching slot, or an empty one.
for (; s_pFiles[slot] != NULL; slot = (slot + 1) % s_nCapacity) {
if (Equal(s_pFiles[slot]->m_pwzPath, pwzPath)) {
info = s_pFiles[slot];
goto succeed;
}
if (++death > s_nCapacity) {
// We should have dropped out at some point...
DEBUG_BREAK();
}
}
// Add the file to list of known files.
info = (FileInfo *)GlobalAlloc(GPTR, sizeof(FileInfo));
info->m_nHash = hash;
info->m_nIndex = s_nFiles++;
info->m_pwzPath = Save(pwzPath);
info->m_fSystemPath = (PrefixMatch(info->m_pwzPath, s_wzSysPath) ||
PrefixMatch(info->m_pwzPath, s_wzS64Path));
info->m_fTemporaryPath = PrefixMatch(info->m_pwzPath, s_wzTmpPath);
info->m_fTemporaryFile = SuffixMatch(info->m_pwzPath, L".tmp");
s_pFiles[slot] = info;
// Check if we should grow the table.
if (s_nFiles > (s_nCapacity / 2)) {
Resize(s_nCapacity * 2 - 1);
}
succeed:
LockRelease();
return info;
}
FileInfo * FileNames::FindPartial(PCWSTR pwzPath)
{
WCHAR wzPath[MAX_PATH];
PWCHAR pwzFile = NULL;
if (!GetFullPathNameW(pwzPath, ARRAYSIZE(wzPath), wzPath, &pwzFile)) {
return FindFull(pwzPath);
}
else {
return FindFull(wzPath);
}
}
FileInfo * FileNames::FindPartial(PCSTR pwzPath)
{
WCHAR wzPath[MAX_PATH];
PWCHAR pwzFile = wzPath;
while (*pwzPath) {
*pwzFile++ = *pwzPath++;
}
*pwzFile = '\0';
return FindPartial(wzPath);
}
PCWSTR FileNames::ParameterizeName(PWCHAR pwzDst, DWORD cMaxDst, FileInfo *pInfo)
{
return ParameterizeName(pwzDst, cMaxDst, pInfo->m_pwzPath);
}
PCWSTR FileNames::ParameterizeName(PWCHAR pwzDst, DWORD cMaxDst, PCWSTR pwzPath)
{
if (PrefixMatch(pwzPath, s_wzSysPath)) {
Copy(pwzDst, L"%SYSDIR%\\");
Copy(pwzDst + Size(pwzDst), pwzPath + s_wcSysPath);
goto finish;
}
else if (PrefixMatch(pwzPath, s_wzS64Path)) {
Copy(pwzDst, L"%SYSDIR%\\");
Copy(pwzDst + Size(pwzDst), pwzPath + s_wcS64Path);
goto finish;
}
else if (PrefixMatch(pwzPath, s_wzTmpPath)) {
Copy(pwzDst, L"%TMPDIR%\\");
Copy(pwzDst + Size(pwzDst), pwzPath + s_wcTmpPath);
goto finish;
}
else {
Copy(pwzDst, pwzPath);
finish:
#if 0 // to convert to all lower case.
for (PWCHAR pwz = pwzDst; *pwz && pwz < pwzDst + cMaxDst; pwz++) {
if (*pwz >= 'A' && *pwz <= 'Z') {
*pwz = 'a' + (*pwz - 'A');
}
}
#else
(void)cMaxDst;
#endif
return pwzDst;
}
}
VOID FileNames::Replace(PWCHAR pwzDst, PWCHAR pwzDstEnd, DWORD cwOld, PCWSTR pwzNew)
{
DWORD cwNew = Size(pwzNew);
DWORD cwDst = Size(pwzDst);
if (cwOld < cwNew) { // We have to insert.
if ((cwDst + cwNew - cwOld) >= (DWORD)(pwzDstEnd - pwzDst)) {
// Won't fit, so abort.
return;
}
PWCHAR pwzTo = pwzDst + cwDst + (cwNew - cwOld);
PWCHAR pwzFm = pwzDst + cwDst;
while (pwzTo >= pwzDst) {
*pwzTo-- = *pwzFm--;
}
}
else if (cwOld > cwNew) { // We have to remove.
PWCHAR pwzTo = pwzDst + cwNew;
PWCHAR pwzFm = pwzDst + cwOld;
while (*pwzFm) {
*pwzTo++ = *pwzFm++;
}
*pwzTo = '\0';
}
// Now write the new string.
while (*pwzNew) {
*pwzDst++ = *pwzNew++;
}
}
VOID FileNames::ParameterizeLine(PWCHAR pwzDst, PWCHAR pwzDstEnd)
{
for (; *pwzDst != '\0'; pwzDst++) {
if (PrefixMatch(pwzDst, s_wzSysPath)) {
Replace(pwzDst, pwzDstEnd, s_wcSysPath, L"%SYSDIR%\\");
}
else if (PrefixMatch(pwzDst, s_wzS64Path)) {
Replace(pwzDst, pwzDstEnd, s_wcS64Path, L"%SYSDIR%\\");
}
else if (PrefixMatch(pwzDst, s_wzTmpPath)) {
Replace(pwzDst, pwzDstEnd, s_wcTmpPath, L"%TMPDIR%\\");
}
}
}
VOID FileNames::Dump()
{
WCHAR wzPath[MAX_PATH];
if (s_nFiles == 0) {
return;
}
LockAcquire();
Tblog("<t:Files>\n");
FileInfo ** pSorted = (FileInfo **)GlobalAlloc(GPTR, s_nFiles * sizeof(FileInfo *));
for (DWORD n = 0; n < s_nCapacity; n++) {
if (s_pFiles[n] != NULL) {
if (s_pFiles[n]->m_nIndex > s_nFiles) {
DEBUG_BREAK();
}
pSorted[s_pFiles[n]->m_nIndex] = s_pFiles[n];
}
}
for (DWORD n = 0; n < s_nFiles; n++) {
FileInfo *pInfo = pSorted[n];
if (pInfo == NULL) {
Print("<!-- Warning: Missing %d of %d -->\n", n, s_nFiles);
continue;
}
BOOL fRead = pInfo->m_fRead;
BOOL fWrite = pInfo->m_fWrite;
BOOL fDelete = (pInfo->m_fDelete);
BOOL fCleanup = (pInfo->m_fCleanup);
BOOL fAppend = (pInfo->m_fAppend);
#if 0
if (fDelete && !fRead && !fWrite) {
Print("<!-- Discarding: %ls -->\n", pInfo->m_pwzPath);
// Discard pipe files only passed to children.
continue;
}
#endif
if (pInfo->m_fAbsorbed) {
// Discard response fles
continue;
}
if (PrefixMatch(pInfo->m_pwzPath, s_wzExePath) ||
PrefixMatch(pInfo->m_pwzPath, s_wzSysPath) ||
PrefixMatch(pInfo->m_pwzPath, s_wzS64Path)) {
// Discard files from exec directory (because considered internal to code).
continue;
}
#if 1 // Ignore PIPEs.
if (FileNames::PrefixMatch(pInfo->m_pwzPath, L"\\\\.\\PIPE\\")) {
continue;
}
#endif
if (FileNames::SuffixMatch(pInfo->m_pwzPath, L"\\conout$")) {
continue;
}
if (FileNames::SuffixMatch(pInfo->m_pwzPath, L"\\conin$")) {
continue;
}
if (FileNames::SuffixMatch(pInfo->m_pwzPath, L"\\nul")) {
continue;
}
ParameterizeName(wzPath, ARRAYSIZE(wzPath), pInfo);
if (pInfo->m_fDirectory) {
Print("<t:File mkdir=\"true\">%ls</t:File>\n", wzPath);
continue;
}
if (!fRead && !fWrite && !fDelete && !fCleanup) {
// Discard do "none" files.
continue;
}
if (pInfo->m_pbContent == NULL ||
pInfo->m_fDelete ||
pInfo->m_fCleanup ||
pInfo->m_fWrite) {
Print("<t:File%s%s%s%s%s>%ls</t:File>\n",
fRead ? " read=\"true\"" : "",
fWrite ? " write=\"true\"" : "",
fDelete ? " delete=\"true\"" : "",
fCleanup ? " cleanup=\"true\"" : "",
fAppend ? " append=\"true\"" : "",
// size=\"%d\" pInfo->m_cbContent,
wzPath);
}
else if ((pInfo->m_pbContent)[0] == 0xff && (pInfo->m_pbContent)[1] == 0xfe) {
// Unicode
Print("<t:File%s%s%s%s%s>%ls<t:Data>%le</t:Data></t:File>\n",
fRead ? " read=\"true\"" : "",
fWrite ? " write=\"true\"" : "",
fDelete ? " delete=\"true\"" : "",
fCleanup ? " cleanup=\"true\"" : "",
fAppend ? " append=\"true\"" : "",
// size=\"%d\" pInfo->m_cbContent,
wzPath,
RemoveReturns((PWCHAR)pInfo->m_pbContent));
}
else {
// Ascii
Print("<t:File%s%s%s%s%s>%ls<t:Data>%he</t:Data></t:File>\n",
fRead ? " read=\"true\"" : "",
fWrite ? " write=\"true\"" : "",
fDelete ? " delete=\"true\"" : "",
fCleanup ? " cleanup=\"true\"" : "",
fAppend ? " append=\"true\"" : "",
// size=\"%d\" pInfo->m_cbContent,
wzPath,
RemoveReturns((PCHAR)pInfo->m_pbContent));
}
if (pInfo->m_pbContent != NULL) {
GlobalFree((HGLOBAL)pInfo->m_pbContent);
pInfo->m_pbContent = NULL;
}
}
GlobalFree((HGLOBAL)pSorted);
Tblog("</t:Files>\n");
LockRelease();
}
//////////////////////////////////////////////////////////////////////////////
//
class OpenFiles
{
private:
struct SLOT
{
HANDLE m_hHandle;
FileInfo * m_pFile;
ProcInfo * m_pProc;
};
private:
static CRITICAL_SECTION s_csLock;
static DWORD s_nHandles;
static SLOT s_rHandles[4049];
private:
static SLOT& HashToSlot(HANDLE handle)
{
return s_rHandles[((DWORD_PTR)handle) % ARRAYSIZE(s_rHandles)];
}
static VOID LockAcquire()
{
EnterCriticalSection(&s_csLock);
}
static VOID LockRelease()
{
LeaveCriticalSection(&s_csLock);
}
public:
static VOID Initialize();
static VOID SetWrite(HANDLE hFile, DWORD cbData)
{
SLOT& slot = HashToSlot(hFile);
if (slot.m_hHandle == hFile) {
slot.m_pFile->m_fWrite = TRUE;
slot.m_pFile->m_cbWrite += cbData;
}
}
static VOID SetRead(HANDLE hFile, DWORD cbData)
{
SLOT& slot = HashToSlot(hFile);
if (slot.m_hHandle == hFile) {
slot.m_pFile->m_fRead = TRUE;
slot.m_pFile->m_cbRead += cbData;
}
}
static BOOL Forget(HANDLE handle);
static BOOL Remember(HANDLE hFile, FileInfo *pInfo);
static BOOL Remember(HANDLE hProc, ProcInfo *pInfo);
static FileInfo * RecallFile(HANDLE hFile);
static ProcInfo * RecallProc(HANDLE hProc);
};
CRITICAL_SECTION OpenFiles::s_csLock; // Guards access to OpenFile stuctures.
DWORD OpenFiles::s_nHandles = 0;
OpenFiles::SLOT OpenFiles::s_rHandles[4049];
VOID OpenFiles::Initialize()
{
InitializeCriticalSection(&s_csLock);
for (DWORD n = 0; n < ARRAYSIZE(s_rHandles); n++) {
s_rHandles[n].m_hHandle = INVALID_HANDLE_VALUE;
s_rHandles[n].m_pFile = NULL;
s_rHandles[n].m_pProc = NULL;
}
}
BOOL OpenFiles::Forget(HANDLE handle)
{
LockAcquire();
OpenFiles::SLOT& slot = HashToSlot(handle);
if (slot.m_hHandle == handle ) {
slot.m_hHandle = INVALID_HANDLE_VALUE;
slot.m_pFile = NULL;
slot.m_pProc = NULL;
s_nHandles--;
}
LockRelease();
return FALSE;
}
BOOL OpenFiles::Remember(HANDLE hFile, FileInfo *pFile)
{
LockAcquire();
OpenFiles::SLOT& slot = HashToSlot(hFile);
if (slot.m_hHandle != hFile && slot.m_hHandle != INVALID_HANDLE_VALUE) {
// hash collision
DEBUG_BREAK();
}
slot.m_hHandle = hFile;
slot.m_pFile = pFile;
slot.m_pProc = NULL;
s_nHandles++;
LockRelease();
return TRUE;
}
BOOL OpenFiles::Remember(HANDLE hProc, ProcInfo *pProc)
{
LockAcquire();
OpenFiles::SLOT& slot = HashToSlot(hProc);
if (slot.m_hHandle != hProc && slot.m_hHandle != INVALID_HANDLE_VALUE) {
// hash collision
DEBUG_BREAK();
}
slot.m_hHandle = hProc;
slot.m_pProc = pProc;
slot.m_pFile = NULL;
s_nHandles++;
LockRelease();
return TRUE;
}
FileInfo * OpenFiles::RecallFile(HANDLE hFile)
{
LockAcquire();
OpenFiles::SLOT& slot = HashToSlot(hFile);
if (slot.m_hHandle == hFile) {
LockRelease();
return slot.m_pFile;
}
LockRelease();
return NULL;
}
ProcInfo * OpenFiles::RecallProc(HANDLE hProc)
{
LockAcquire();
OpenFiles::SLOT& slot = HashToSlot(hProc);
if (slot.m_hHandle == hProc) {
LockRelease();
return slot.m_pProc;
}
LockRelease();
return NULL;
}
///////////////////////////////////////////////////////////////////// VPrintf.
//
// Completely side-effect free printf replacement (but no FP numbers).
//
static PCHAR do_base(PCHAR pszOut, UINT64 nValue, UINT nBase, PCSTR pszDigits)
{
CHAR szTmp[96];
int nDigit = sizeof(szTmp)-2;
for (; nDigit >= 0; nDigit--) {
szTmp[nDigit] = pszDigits[nValue % nBase];
nValue /= nBase;
}
for (nDigit = 0; nDigit < sizeof(szTmp) - 2 && szTmp[nDigit] == '0'; nDigit++) {
// skip leading zeros.
}
for (; nDigit < sizeof(szTmp) - 1; nDigit++) {
*pszOut++ = szTmp[nDigit];
}
*pszOut = '\0';
return pszOut;
}
static PCHAR do_str(PCHAR pszOut, PCHAR pszEnd, PCSTR pszIn)
{
while (*pszIn && pszOut < pszEnd) {
*pszOut++ = *pszIn++;
}
*pszOut = '\0';
return pszOut;
}
static PCHAR do_wstr(PCHAR pszOut, PCHAR pszEnd, PCWSTR pszIn)
{
while (*pszIn && pszOut < pszEnd) {
*pszOut++ = (CHAR)*pszIn++;
}
*pszOut = '\0';
return pszOut;
}
static PCHAR do_estr(PCHAR pszOut, PCHAR pszEnd, PCSTR pszIn)
{
while (*pszIn && pszOut < pszEnd) {
if (*pszIn == '<') {
if (pszOut + 4 > pszEnd) {
break;
}
pszIn++;
*pszOut++ = '&';
*pszOut++ = 'l';
*pszOut++ = 't';
*pszOut++ = ';';
}
else if (*pszIn == '>') {
if (pszOut + 4 > pszEnd) {
break;
}
pszIn++;
*pszOut++ = '&';
*pszOut++ = 'g';
*pszOut++ = 't';
*pszOut++ = ';';
}
else if (*pszIn == '&') {
if (pszOut + 5 > pszEnd) {
break;
}
pszIn++;
*pszOut++ = '&';
*pszOut++ = 'a';
*pszOut++ = 'm';
*pszOut++ = 'p';
*pszOut++ = ';';
}
else if (*pszIn == '\"') {
if (pszOut + 6 > pszEnd) {
break;
}
pszIn++;
*pszOut++ = '&';
*pszOut++ = 'q';
*pszOut++ = 'u';
*pszOut++ = 'o';
*pszOut++ = 't';
*pszOut++ = ';';
}
else if (*pszIn == '\'') {
if (pszOut + 6 > pszEnd) {
break;
}
pszIn++;
*pszOut++ = '&';
*pszOut++ = 'a';
*pszOut++ = 'p';
*pszOut++ = 'o';
*pszOut++ = 's';
*pszOut++ = ';';
}
else if (*pszIn < ' ') {
BYTE c = (BYTE)(*pszIn++);
if (c < 10 && pszOut + 4 <= pszEnd) {
*pszOut++ = '&';
*pszOut++ = '#';
*pszOut++ = '0' + (c % 10);
*pszOut++ = ';';
}
else if (c < 100 && pszOut + 5 <= pszEnd) {
*pszOut++ = '&';
*pszOut++ = '#';
*pszOut++ = '0' + ((c / 10) % 10);
*pszOut++ = '0' + (c % 10);
*pszOut++ = ';';
}
else if (c < 1000 && pszOut + 6 <= pszEnd) {
*pszOut++ = '&';
*pszOut++ = '#';
*pszOut++ = '0' + ((c / 100) % 10);
*pszOut++ = '0' + ((c / 10) % 10);
*pszOut++ = '0' + (c % 10);
*pszOut++ = ';';
}
else {
break;
}
}
else {
*pszOut++ = *pszIn++;
}
}
*pszOut = '\0';
return pszOut;
}
static PCHAR do_ewstr(PCHAR pszOut, PCHAR pszEnd, PCWSTR pszIn)
{
while (*pszIn && pszOut < pszEnd) {
if (*pszIn == '<') {
if (pszOut + 4 > pszEnd) {
break;
}
pszIn++;
*pszOut++ = '&';
*pszOut++ = 'l';
*pszOut++ = 't';
*pszOut++ = ';';
}
else if (*pszIn == '>') {
if (pszOut + 4 > pszEnd) {
break;
}
pszIn++;
*pszOut++ = '&';
*pszOut++ = 'g';
*pszOut++ = 't';
*pszOut++ = ';';
}
else if (*pszIn == '&') {
if (pszOut + 5 > pszEnd) {
break;
}
pszIn++;
*pszOut++ = '&';
*pszOut++ = 'a';
*pszOut++ = 'm';
*pszOut++ = 'p';
*pszOut++ = ';';
}
else if (*pszIn == '\"') {
if (pszOut + 6 > pszEnd) {
break;
}
pszIn++;
*pszOut++ = '&';
*pszOut++ = 'q';
*pszOut++ = 'u';
*pszOut++ = 'o';
*pszOut++ = 't';
*pszOut++ = ';';
}
else if (*pszIn == '\'') {
if (pszOut + 6 > pszEnd) {
break;
}
pszIn++;
*pszOut++ = '&';
*pszOut++ = 'a';
*pszOut++ = 'p';
*pszOut++ = 'o';
*pszOut++ = 's';
*pszOut++ = ';';
}
else if (*pszIn < ' ' || *pszIn > 127) {
WCHAR c = *pszIn++;
if (c < 10 && pszOut + 4 <= pszEnd) {
*pszOut++ = '&';
*pszOut++ = '#';
*pszOut++ = '0' + (CHAR)(c % 10);
*pszOut++ = ';';
}
else if (c < 100 && pszOut + 5 <= pszEnd) {
*pszOut++ = '&';
*pszOut++ = '#';
*pszOut++ = '0' + (CHAR)((c / 10) % 10);
*pszOut++ = '0' + (CHAR)(c % 10);
*pszOut++ = ';';
}
else if (c < 1000 && pszOut + 6 <= pszEnd) {
*pszOut++ = '&';
*pszOut++ = '#';
*pszOut++ = '0' + (CHAR)((c / 100) % 10);
*pszOut++ = '0' + (CHAR)((c / 10) % 10);
*pszOut++ = '0' + (CHAR)(c % 10);
*pszOut++ = ';';
}
else {
break;
}
}
else {
*pszOut++ = (CHAR)*pszIn++;
}
}
*pszOut = '\0';
return pszOut;
}
#if _MSC_VER >= 1900
#pragma warning(push)
#pragma warning(disable:4456) // declaration hides previous local declaration
#endif
VOID VSafePrintf(PCSTR pszMsg, va_list args, PCHAR pszBuffer, LONG cbBuffer)
{
PCHAR pszOut = pszBuffer;
PCHAR pszEnd = pszBuffer + cbBuffer - 1;
pszBuffer[0] = '\0';
__try {
while (*pszMsg && pszOut < pszEnd) {
if (*pszMsg == '%') {
CHAR szHead[4] = "";
INT nLen;
INT nWidth = 0;
INT nPrecision = 0;
BOOL fLeft = FALSE;
BOOL fPositive = FALSE;
BOOL fPound = FALSE;
BOOL fBlank = FALSE;
BOOL fZero = FALSE;
BOOL fDigit = FALSE;
BOOL fSmall = FALSE;
BOOL fLarge = FALSE;
BOOL f64Bit = FALSE;
PCSTR pszArg = pszMsg;
pszMsg++;
for (; (*pszMsg == '-' ||
*pszMsg == '+' ||
*pszMsg == '#' ||
*pszMsg == ' ' ||
*pszMsg == '0'); pszMsg++) {
switch (*pszMsg) {
case '-': fLeft = TRUE; break;
case '+': fPositive = TRUE; break;
case '#': fPound = TRUE; break;
case ' ': fBlank = TRUE; break;
case '0': fZero = TRUE; break;
}
}
if (*pszMsg == '*') {
nWidth = va_arg(args, INT);
pszMsg++;
}
else {
while (*pszMsg >= '0' && *pszMsg <= '9') {
nWidth = nWidth * 10 + (*pszMsg++ - '0');
}
}
if (*pszMsg == '.') {
pszMsg++;
fDigit = TRUE;
if (*pszMsg == '*') {
nPrecision = va_arg(args, INT);
pszMsg++;
}
else {
while (*pszMsg >= '0' && *pszMsg <= '9') {
nPrecision = nPrecision * 10 + (*pszMsg++ - '0');
}
}
}
if (*pszMsg == 'h') {
fSmall = TRUE;
pszMsg++;
}
else if (*pszMsg == 'l') {
fLarge = TRUE;
pszMsg++;
}
else if (*pszMsg == 'I' && pszMsg[1] == '6' && pszMsg[2] == '4') {
f64Bit = TRUE;
pszMsg += 3;
}
if (*pszMsg == 's' || *pszMsg == 'e' || *pszMsg == 'c') {
// We ignore the length, precision, and alignment
// to avoid using a temporary buffer.
if (*pszMsg == 's') { // [GalenH] need to not use temp.
PVOID pvData = va_arg(args, PVOID);
pszMsg++;
if (fSmall) {
fLarge = FALSE;
}
__try {
if (pvData == NULL) {
pszOut = do_str(pszOut, pszEnd, "-NULL-");
}
else if (fLarge) {
pszOut = do_wstr(pszOut, pszEnd, (PWCHAR)pvData);
}
else {
pszOut = do_str(pszOut, pszEnd, (PCHAR)pvData);
}
} __except(EXCEPTION_EXECUTE_HANDLER) {
pszOut = do_str(pszOut, pszEnd, "-");
pszOut = do_base(pszOut, (UINT64)pvData, 16,
"0123456789ABCDEF");
pszOut = do_str(pszOut, pszEnd, "-");
}
}
else if (*pszMsg == 'e') { // Escape the string.
PVOID pvData = va_arg(args, PVOID);
pszMsg++;
if (fSmall) {
fLarge = FALSE;
}
__try {
if (pvData == NULL) {
pszOut = do_str(pszOut, pszEnd, "-NULL-");
}
else if (fLarge) {
pszOut = do_ewstr(pszOut, pszEnd, (PWCHAR)pvData);
}
else {
pszOut = do_estr(pszOut, pszEnd, (PCHAR)pvData);
}
} __except(EXCEPTION_EXECUTE_HANDLER) {
pszOut = do_str(pszOut, pszEnd, "-");
pszOut = do_base(pszOut, (UINT64)pvData, 16,
"0123456789ABCDEF");
pszOut = do_str(pszOut, pszEnd, "-");
}
}
else {
CHAR szTemp[2];
pszMsg++;
szTemp[0] = (CHAR)va_arg(args, INT);
szTemp[1] = '\0';
pszOut = do_str(pszOut, pszEnd, szTemp);
}
}
else if (*pszMsg == 'd' || *pszMsg == 'i' || *pszMsg == 'o' ||
*pszMsg == 'x' || *pszMsg == 'X' || *pszMsg == 'b' ||
*pszMsg == 'u') {
CHAR szTemp[128];
UINT64 value;
if (f64Bit) {
value = va_arg(args, UINT64);
}
else {
value = va_arg(args, UINT);
}
if (*pszMsg == 'x') {
pszMsg++;
nLen = (int)(do_base(szTemp, value, 16, "0123456789abcdef") - szTemp);
if (fPound && value) {
do_str(szHead, szHead + sizeof(szHead) - 1, "0x");
}
}
else if (*pszMsg == 'X') {
pszMsg++;
nLen = (int)(do_base(szTemp, value, 16, "0123456789ABCDEF") - szTemp);
if (fPound && value) {
do_str(szHead, szHead + sizeof(szHead) - 1, "0X");
}
}
else if (*pszMsg == 'd') {
pszMsg++;
if ((INT64)value < 0) {
value = -(INT64)value;
do_str(szHead, szHead + sizeof(szHead) - 1, "-");
}
else if (fPositive) {
if (value > 0) {
do_str(szHead, szHead + sizeof(szHead) - 1, "+");
}
}
else if (fBlank) {
if (value > 0) {
do_str(szHead, szHead + sizeof(szHead) - 1, " ");
}
}
nLen = (int)(do_base(szTemp, value, 10, "0123456789") - szTemp);
nPrecision = 0;
}
else if (*pszMsg == 'u') {
pszMsg++;
nLen = (int)(do_base(szTemp, value, 10, "0123456789") - szTemp);
nPrecision = 0;
}
else if (*pszMsg == 'o') {
pszMsg++;
nLen = (int)(do_base(szTemp, value, 8, "01234567") - szTemp);
nPrecision = 0;
if (fPound && value) {
do_str(szHead, szHead + sizeof(szHead) - 1, "0");
}
}
else if (*pszMsg == 'b') {
pszMsg++;
nLen = (int)(do_base(szTemp, value, 2, "01") - szTemp);
nPrecision = 0;
if (fPound && value) {
do_str(szHead, szHead + sizeof(szHead) - 1, "0b");
}
}
else {
pszMsg++;
if ((INT64)value < 0) {
value = -(INT64)value;
do_str(szHead, szHead + sizeof(szHead) - 1, "-");
}
else if (fPositive) {
if (value > 0) {
do_str(szHead, szHead + sizeof(szHead) - 1, "+");
}
}
else if (fBlank) {
if (value > 0) {
do_str(szHead, szHead + sizeof(szHead) - 1, " ");
}
}
nLen = (int)(do_base(szTemp, value, 10, "0123456789") - szTemp);
nPrecision = 0;
}
INT nHead = 0;
for (; szHead[nHead]; nHead++) {
// Count characters in head string.
}
if (fLeft) {
if (nHead) {
pszOut = do_str(pszOut, pszEnd, szHead);
nLen += nHead;
}
pszOut = do_str(pszOut, pszEnd, szTemp);
for (; nLen < nWidth && pszOut < pszEnd; nLen++) {
*pszOut++ = ' ';
}
}
else if (fZero) {
if (nHead) {
pszOut = do_str(pszOut, pszEnd, szHead);
nLen += nHead;
}
for (; nLen < nWidth && pszOut < pszEnd; nLen++) {
*pszOut++ = '0';
}
pszOut = do_str(pszOut, pszEnd, szTemp);
}
else {
if (nHead) {
nLen += nHead;
}
for (; nLen < nWidth && pszOut < pszEnd; nLen++) {
*pszOut++ = ' ';
}
if (nHead) {
pszOut = do_str(pszOut, pszEnd, szHead);
}
pszOut = do_str(pszOut, pszEnd, szTemp);
}
}
else if (*pszMsg == 'p') {
CHAR szTemp[64];
ULONG_PTR value;
value = va_arg(args, ULONG_PTR);
if (*pszMsg == 'p') {
pszMsg++;
nLen = (int)(do_base(szTemp, (UINT64)value, 16, "0123456789abcdef") - szTemp);
if (fPound && value) {
do_str(szHead, szHead + sizeof(szHead) - 1, "0x");
}
}
else {
pszMsg++;
nLen = (int)(do_base(szTemp, (UINT64)value, 16, "0123456789ABCDEF") - szTemp);
if (fPound && value) {
do_str(szHead, szHead + sizeof(szHead) - 1, "0x");
}
}
INT nHead = 0;
for (; szHead[nHead]; nHead++) {
// Count characters in head string.
}
if (nHead) {
pszOut = do_str(pszOut, pszEnd, szHead);
nLen += nHead;
}
for (; nLen < nWidth && pszOut < pszEnd; nLen++) {
*pszOut++ = '0';
}
pszOut = do_str(pszOut, pszEnd, szTemp);
}
else {
pszMsg++;
while (pszArg < pszMsg && pszOut < pszEnd) {
*pszOut++ = *pszArg++;
}
}
}
else {
if (pszOut < pszEnd) {
*pszOut++ = *pszMsg++;
}
}
}
*pszOut = '\0';
pszBuffer[cbBuffer - 1] = '\0';
} __except(EXCEPTION_EXECUTE_HANDLER) {
PCHAR pszOut = pszBuffer;
*pszOut = '\0';
pszOut = do_str(pszOut, pszEnd, "-exception:");
pszOut = do_base(pszOut, (UINT64)GetExceptionCode(), 10, "0123456789");
pszOut = do_str(pszOut, pszEnd, "-");
}
}
#if _MSC_VER >= 1900
#pragma warning(pop)
#endif
PCHAR SafePrintf(PCHAR pszBuffer, LONG cbBuffer, PCSTR pszMsg, ...)
{
va_list args;
va_start(args, pszMsg);
VSafePrintf(pszMsg, args, pszBuffer, cbBuffer);
va_end(args);
while (*pszBuffer) {
pszBuffer++;
}
return pszBuffer;
}
//////////////////////////////////////////////////////////////////////////////
//
BOOL TblogOpen()
{
EnterCriticalSection(&s_csPipe);
WCHAR wzPipe[256];
StringCchPrintfW(wzPipe, ARRAYSIZE(wzPipe), L"%ls.%d", TBLOG_PIPE_NAMEW, s_nTraceProcessId);
for (int retries = 0; retries < 10; retries++) {
WaitNamedPipeW(wzPipe, 10000); // Wait up to 10 seconds for a pipe to appear.
s_hPipe = Real_CreateFileW(wzPipe, GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
if (s_hPipe != INVALID_HANDLE_VALUE) {
DWORD dwMode = PIPE_READMODE_MESSAGE;
if (SetNamedPipeHandleState(s_hPipe, &dwMode, NULL, NULL)) {
LeaveCriticalSection(&s_csPipe);
return TRUE;
}
}
}
LeaveCriticalSection(&s_csPipe);
// Couldn't open pipe.
DEBUG_BREAK();
Real_ExitProcess(9990);
return FALSE;
}
VOID TblogV(PCSTR pszMsgf, va_list args)
{
if (s_hPipe == INVALID_HANDLE_VALUE) {
return;
}
EnterCriticalSection(&s_csPipe);
DWORD cbWritten = 0;
PCHAR pszBuf = s_rMessage.szMessage;
VSafePrintf(pszMsgf, args,
pszBuf, (int)(s_rMessage.szMessage + sizeof(s_rMessage.szMessage) - pszBuf));
PCHAR pszEnd = s_rMessage.szMessage;
for (; *pszEnd; pszEnd++) {
// no internal contents.
}
s_rMessage.nBytes = (DWORD)(pszEnd - ((PCSTR)&s_rMessage));
// If the write fails, then we abort
if (s_hPipe != INVALID_HANDLE_VALUE) {
if (!Real_WriteFile(s_hPipe, &s_rMessage, s_rMessage.nBytes, &cbWritten, NULL)) {
Real_ExitProcess(9991);
}
}
LeaveCriticalSection(&s_csPipe);
}
VOID Tblog(PCSTR pszMsgf, ...)
{
if (s_hPipe == INVALID_HANDLE_VALUE) {
return;
}
va_list args;
va_start(args, pszMsgf);
TblogV(pszMsgf, args);
va_end(args);
}
VOID TblogClose()
{
EnterCriticalSection(&s_csPipe);
if (s_hPipe != INVALID_HANDLE_VALUE) {
DWORD cbWritten = 0;
s_rMessage.nBytes = 0;
Real_WriteFile(s_hPipe, &s_rMessage, 4, &cbWritten, NULL);
FlushFileBuffers(s_hPipe);
Real_CloseHandle(s_hPipe);
s_hPipe = INVALID_HANDLE_VALUE;
}
LeaveCriticalSection(&s_csPipe);
}
/////////////////////////////////////////////////////////////
// Detours
//
static BOOL IsInherited(HANDLE hHandle)
{
DWORD dwFlags;
if (GetHandleInformation(hHandle, &dwFlags)) {
return (dwFlags & HANDLE_FLAG_INHERIT) ? TRUE : FALSE;
}
return FALSE;
}
static void SaveStdHandleName(HANDLE hFile, PWCHAR pwzBuffer, BOOL *fAppend)
{
pwzBuffer[0] = '\0';
if ((hFile != INVALID_HANDLE_VALUE) && IsInherited(hFile)) {
FileInfo * pInfo = OpenFiles::RecallFile(hFile);
if (pInfo) {
Copy(pwzBuffer, pInfo->m_pwzPath);
if (pInfo->m_fAppend && fAppend != NULL) {
*fAppend = TRUE;
}
}
}
}
static void LoadStdHandleName(DWORD id, PCWSTR pwzBuffer, BOOL fAppend)
{
HANDLE hFile = GetStdHandle(id);
if ((hFile != INVALID_HANDLE_VALUE) && pwzBuffer[0] != '\0') {
FileInfo *pInfo = FileNames::FindPartial(pwzBuffer);
if (fAppend) {
pInfo->m_fAppend = TRUE;
}
OpenFiles::Remember(hFile, pInfo);
}
}
BOOL CreateProcessInternals(HANDLE hProcess, DWORD nProcessId, PCHAR pszId,
HANDLE hStdin, HANDLE hStdout, HANDLE hStderr)
{
EnterCriticalSection(&s_csChildPayload);
ProcInfo *proc = Procs::Create(hProcess, nProcessId);
OpenFiles::Remember(hProcess, proc);
ZeroMemory(&s_ChildPayload, sizeof(s_ChildPayload));
CopyMemory(&s_ChildPayload, &s_Payload, sizeof(s_ChildPayload));
s_ChildPayload.nParentProcessId = GetCurrentProcessId();
s_ChildPayload.rGeneology[s_ChildPayload.nGeneology]
= (DWORD)InterlockedIncrement(&s_nChildCnt);
s_ChildPayload.nGeneology++;
SaveStdHandleName(hStdin, s_ChildPayload.wzStdin, NULL);
SaveStdHandleName(hStdout, s_ChildPayload.wzStdout, &s_ChildPayload.fStdoutAppend);
SaveStdHandleName(hStderr, s_ChildPayload.wzStderr, &s_ChildPayload.fStderrAppend);
DetourCopyPayloadToProcess(hProcess, s_guidTrace, &s_ChildPayload, sizeof(s_ChildPayload));
for (DWORD i = 0; i < s_ChildPayload.nGeneology; i++) {
pszId = SafePrintf(pszId, 16, "%d.", s_ChildPayload.rGeneology[i]);
}
*pszId = '\0';
LeaveCriticalSection(&s_csChildPayload);
return TRUE;
}
BOOL WINAPI Mine_CreateProcessW(LPCWSTR lpApplicationName,
LPWSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCWSTR lpCurrentDirectory,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation)
{
EnterFunc();
if (lpCommandLine == NULL) {
lpCommandLine = (LPWSTR)lpApplicationName;
}
CHAR szProc[MAX_PATH];
BOOL rv = 0;
__try {
LPPROCESS_INFORMATION ppi = lpProcessInformation;
PROCESS_INFORMATION pi;
if (ppi == NULL) {
ppi = &pi;
}
rv = DetourCreateProcessWithDllExW(lpApplicationName,
lpCommandLine,
lpProcessAttributes,
lpThreadAttributes,
bInheritHandles,
dwCreationFlags | CREATE_SUSPENDED,
lpEnvironment,
lpCurrentDirectory,
lpStartupInfo,
ppi,
s_szDllPath,
Real_CreateProcessW);
if (rv) {
HANDLE hStdin = GetStdHandle(STD_INPUT_HANDLE);
HANDLE hStdout = GetStdHandle(STD_OUTPUT_HANDLE);
HANDLE hStderr = GetStdHandle(STD_ERROR_HANDLE);
if (lpStartupInfo != NULL && (lpStartupInfo->dwFlags & STARTF_USESTDHANDLES) != 0) {
hStdin = lpStartupInfo->hStdInput;
hStdout = lpStartupInfo->hStdOutput;
hStderr = lpStartupInfo->hStdError;
}
CreateProcessInternals(ppi->hProcess, ppi->dwProcessId,
szProc, hStdin, hStdout, hStderr);
Print("<t:Child id=\"::%hs::\">\n", szProc);
WCHAR wzPath[MAX_PATH];
FileInfo *pInfo = NULL;
if (lpApplicationName == NULL) {
PWCHAR pwzDst = wzPath;
PWCHAR pwzSrc = lpCommandLine;
if (*pwzSrc == '\"') {
WCHAR cQuote = *pwzSrc++;
while (*pwzSrc && *pwzSrc != cQuote) {
*pwzDst++ = *pwzSrc++;
}
*pwzDst++ = '\0';
}
else {
while (*pwzSrc && *pwzSrc != ' ' && *pwzSrc != '\t') {
if (*pwzSrc == '\t') {
*pwzSrc = ' ';
}
*pwzDst++ = *pwzSrc++;
}
*pwzDst++ = '\0';
}
pInfo = FileNames::FindPartial(wzPath);
}
else {
pInfo = FileNames::FindPartial(lpApplicationName);
}
Print("<t:Executable>%ls</t:Executable>\n",
FileNames::ParameterizeName(wzPath, ARRAYSIZE(wzPath), pInfo));
Print("<t:Line>%le</t:Line>\n", lpCommandLine);
Print("</t:Child>\n");
if (pInfo) {
pInfo->m_fAbsorbed = true;
}
if (!(dwCreationFlags & CREATE_SUSPENDED)) {
ResumeThread(ppi->hThread);
}
if (ppi == &pi) {
Real_CloseHandle(ppi->hThread);
Real_CloseHandle(ppi->hProcess);
}
}
} __finally {
ExitFunc();
if (!rv) {
Print("<!-- Warning: CreateProcessW failed %d: %ls; %ls -->\n",
GetLastError(), lpApplicationName, lpCommandLine);
}
}
return rv;
}
BOOL WINAPI Mine_CreateProcessA(LPCSTR lpApplicationName,
LPSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCSTR lpCurrentDirectory,
LPSTARTUPINFOA lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation)
{
EnterFunc();
if (lpCommandLine == NULL) {
lpCommandLine = (LPSTR)lpApplicationName;
}
CHAR szProc[MAX_PATH];
BOOL rv = 0;
__try {
LPPROCESS_INFORMATION ppi = lpProcessInformation;
PROCESS_INFORMATION pi;
if (ppi == NULL) {
ppi = &pi;
}
rv = DetourCreateProcessWithDllExA(lpApplicationName,
lpCommandLine,
lpProcessAttributes,
lpThreadAttributes,
bInheritHandles,
dwCreationFlags | CREATE_SUSPENDED,
lpEnvironment,
lpCurrentDirectory,
lpStartupInfo,
ppi,
s_szDllPath,
Real_CreateProcessA);
if (rv) {
HANDLE hStdin = GetStdHandle(STD_INPUT_HANDLE);
HANDLE hStdout = GetStdHandle(STD_OUTPUT_HANDLE);
HANDLE hStderr = GetStdHandle(STD_ERROR_HANDLE);
if (lpStartupInfo != NULL && (lpStartupInfo->dwFlags & STARTF_USESTDHANDLES) != 0) {
hStdin = lpStartupInfo->hStdInput;
hStdout = lpStartupInfo->hStdOutput;
hStderr = lpStartupInfo->hStdError;
}
CreateProcessInternals(ppi->hProcess, ppi->dwProcessId,
szProc, hStdin, hStdout, hStderr);
Print("<t:Child id=\"::%hs::\">\n", szProc);
WCHAR wzPath[MAX_PATH];
FileInfo *pInfo = NULL;
if (lpApplicationName == NULL) {
PCHAR pszDst = szProc;
PCHAR pszSrc = lpCommandLine;
if (*pszSrc == '\"') {
CHAR cQuote = *pszSrc++;
while (*pszSrc && *pszSrc != cQuote) {
*pszDst++ = *pszSrc++;
}
*pszDst++ = '\0';
}
else {
while (*pszSrc && *pszSrc != ' ' && *pszSrc != '\t') {
if (*pszSrc == '\t') {
*pszSrc = ' ';
}
*pszDst++ = *pszSrc++;
}
*pszDst++ = '\0';
}
pInfo = FileNames::FindPartial(szProc);
}
else {
pInfo = FileNames::FindPartial(lpApplicationName);
}
Print("<t:Executable>%ls</t:Executable>\n",
FileNames::ParameterizeName(wzPath, ARRAYSIZE(wzPath), pInfo));
Print("<t:Line>%he</t:Line>\n", lpCommandLine);
Print("</t:Child>\n");
if (pInfo) {
pInfo->m_fAbsorbed = true;
}
if (!(dwCreationFlags & CREATE_SUSPENDED)) {
ResumeThread(ppi->hThread);
}
if (ppi == &pi) {
Real_CloseHandle(ppi->hThread);
Real_CloseHandle(ppi->hProcess);
}
}
} __finally {
ExitFunc();
if (!rv) {
Print("<!-- Warning: CreateProcessA failed %d: %hs; %hs -->\n",
GetLastError(), lpApplicationName, lpCommandLine);
}
}
return rv;
}
//
//////////////////////////////////////////////////////////////////////////////
BOOL WINAPI Mine_CopyFileExA(LPCSTR a0,
LPCSTR a1,
LPPROGRESS_ROUTINE a2,
LPVOID a3,
LPBOOL a4,
DWORD a5)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_CopyFileExA(a0, a1, a2, a3, a4, a5);
} __finally {
ExitFunc();
if (rv) {
#if 0
Print("<!-- CopyFileExA %he to %he -->\n", a0, a1);
#endif
NoteRead(a0);
NoteWrite(a1);
}
};
return rv;
}
BOOL WINAPI Mine_CopyFileExW(LPCWSTR a0,
LPCWSTR a1,
LPPROGRESS_ROUTINE a2,
LPVOID a3,
LPBOOL a4,
DWORD a5)
{
EnterFunc();
BOOL rv = 0;
__try {
#if 0
Print("\n");
Print("<!-- CopyFileExW %le to %le before -->\n", a0, a1);
#endif
rv = Real_CopyFileExW(a0, a1, a2, a3, a4, a5);
} __finally {
ExitFunc();
if (rv) {
#if 0
Print("<!-- CopyFileExW %le to %le -->\n", a0, a1);
#endif
NoteRead(a0);
NoteWrite(a1);
}
};
return rv;
}
BOOL WINAPI Mine_PrivCopyFileExW(LPCWSTR a0,
LPCWSTR a1,
LPPROGRESS_ROUTINE a2,
LPVOID a3,
LPBOOL a4,
DWORD a5)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_PrivCopyFileExW(a0, a1, a2, a3, a4, a5);
} __finally {
ExitFunc();
if (rv) {
#if 0
Print("<!-- PrivCopyFileExW %le to %le -->\n", a0, a1);
#endif
NoteRead(a0);
NoteWrite(a1);
}
};
return rv;
}
BOOL WINAPI Mine_CreateHardLinkA(LPCSTR a0,
LPCSTR a1,
LPSECURITY_ATTRIBUTES a2)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_CreateHardLinkA(a0, a1, a2);
} __finally {
ExitFunc();
if (rv) {
#if 0
Print("<!-- CreateHardLinkA %he to %he -->\n", a0, a1);
#endif
NoteRead(a1);
NoteWrite(a0);
}
};
return rv;
}
BOOL WINAPI Mine_CreateHardLinkW(LPCWSTR a0,
LPCWSTR a1,
LPSECURITY_ATTRIBUTES a2)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_CreateHardLinkW(a0, a1, a2);
} __finally {
ExitFunc();
if (rv) {
#if 0
Print("<!-- CreateHardLinkW %le to %le -->\n", a0, a1);
#endif
NoteRead(a1);
NoteWrite(a0);
}
};
return rv;
}
BOOL WINAPI Mine_CloseHandle(HANDLE a0)
{
/*int nIndent =*/ EnterFunc();
BOOL rv = 0;
__try {
ProcInfo * pProc = OpenFiles::RecallProc(a0);
if (pProc != NULL) {
Procs::Close(pProc->m_hProc);
}
FileInfo * pFile = OpenFiles::RecallFile(a0);
if (pFile != NULL) {
DWORD dwErr = GetLastError();
pFile->m_cbContent = GetFileSize(a0, NULL);
if (pFile->m_cbContent == INVALID_FILE_SIZE) {
pFile->m_cbContent = 0;
}
if (pFile->m_fCantRead) {
if (pFile->m_fRead) {
#if 0
Print("<!-- Warning: Removing read from %le -->\n", pFile->m_pwzPath);
#endif
pFile->m_fRead = FALSE;
}
}
// Here we should think about reading the file contents as appropriate.
if (pFile->m_fTemporaryPath && pFile->m_fRead && !pFile->m_fAbsorbed &&
!pFile->m_fDelete && !pFile->m_fCleanup && !pFile->m_fWrite &&
pFile->m_pbContent == NULL &&
pFile->m_cbContent < 16384) {
pFile->m_pbContent = LoadFile(a0, pFile->m_cbContent);
}
SetLastError(dwErr);
}
rv = Real_CloseHandle(a0);
} __finally {
ExitFunc();
if (rv /* && nIndent == 0*/) {
OpenFiles::Forget(a0);
}
};
return rv;
}
BOOL WINAPI Mine_DuplicateHandle(HANDLE hSourceProcessHandle,
HANDLE hSourceHandle,
HANDLE hTargetProcessHandle,
LPHANDLE lpTargetHandle,
DWORD dwDesiredAccess,
BOOL bInheritHandle,
DWORD dwOptions)
{
HANDLE hTemp = INVALID_HANDLE_VALUE;
EnterFunc();
BOOL rv = 0;
__try {
if (lpTargetHandle == NULL) {
lpTargetHandle = &hTemp;
}
*lpTargetHandle = INVALID_HANDLE_VALUE;
rv = Real_DuplicateHandle(hSourceProcessHandle,
hSourceHandle,
hTargetProcessHandle,
lpTargetHandle,
dwDesiredAccess,
bInheritHandle,
dwOptions);
} __finally {
ExitFunc();
if (*lpTargetHandle != INVALID_HANDLE_VALUE) {
FileInfo *pInfo = OpenFiles::RecallFile(hSourceHandle);
if (pInfo) {
OpenFiles::Remember(*lpTargetHandle, pInfo);
}
}
};
return rv;
}
static LONG s_nPipeCnt = 0;
BOOL WINAPI Mine_CreatePipe(PHANDLE hReadPipe,
PHANDLE hWritePipe,
LPSECURITY_ATTRIBUTES lpPipeAttributes,
DWORD nSize)
{
HANDLE hRead = INVALID_HANDLE_VALUE;
HANDLE hWrite = INVALID_HANDLE_VALUE;
if (hReadPipe == NULL) {
hReadPipe = &hRead;
}
if (hWritePipe == NULL) {
hWritePipe = &hWrite;
}
/*int nIndent = */ EnterFunc();
BOOL rv = 0;
__try {
rv = Real_CreatePipe(hReadPipe, hWritePipe, lpPipeAttributes, nSize);
} __finally {
ExitFunc();
if (rv) {
CHAR szPipe[128];
SafePrintf(szPipe, ARRAYSIZE(szPipe), "\\\\.\\PIPE\\Temp.%d.%d",
GetCurrentProcessId(),
InterlockedIncrement(&s_nPipeCnt));
FileInfo *pInfo = FileNames::FindPartial(szPipe);
pInfo->m_fCleanup = TRUE;
OpenFiles::Remember(*hReadPipe, pInfo);
OpenFiles::Remember(*hWritePipe, pInfo);
}
};
return rv;
}
BOOL WINAPI Mine_CreateDirectoryW(LPCWSTR a0,
LPSECURITY_ATTRIBUTES a1)
{
/* int nIndent = */ EnterFunc();
BOOL rv = 0;
__try {
rv = Real_CreateDirectoryW(a0, a1);
} __finally {
ExitFunc();
if (rv) {
FileInfo *pInfo = FileNames::FindPartial(a0);
pInfo->m_fDirectory = TRUE;
}
};
return rv;
}
BOOL WINAPI Mine_CreateDirectoryExW(LPCWSTR a0,
LPCWSTR a1,
LPSECURITY_ATTRIBUTES a2)
{
/* int nIndent = */ EnterFunc();
BOOL rv = 0;
__try {
rv = Real_CreateDirectoryExW(a0, a1, a2);
} __finally {
ExitFunc();
if (rv) {
FileInfo *pInfo = FileNames::FindPartial(a1);
pInfo->m_fDirectory = TRUE;
}
};
return rv;
}
HANDLE WINAPI Mine_CreateFileW(LPCWSTR a0,
DWORD access,
DWORD share,
LPSECURITY_ATTRIBUTES a3,
DWORD create,
DWORD flags,
HANDLE a6)
{
/* int nIndent = */ EnterFunc();
HANDLE rv = 0;
__try {
rv = Real_CreateFileW(a0, access, share, a3, create, flags, a6);
} __finally {
ExitFunc();
#if 0
Print("<!-- CreateFileW(%le, ac=%08x, cr=%08x, fl=%08x -->\n",
a0,
access,
create,
flags);
#endif
if (access != 0 && /* nIndent == 0 && */ rv != INVALID_HANDLE_VALUE) {
FileInfo *pInfo = FileNames::FindPartial(a0);
// FILE_FLAG_WRITE_THROUGH 0x80000000
// FILE_FLAG_OVERLAPPED 0x40000000
// FILE_FLAG_NO_BUFFERING 0x20000000
// FILE_FLAG_RANDOM_ACCESS 0x10000000
// FILE_FLAG_SEQUENTIAL_SCAN 0x08000000
// FILE_FLAG_DELETE_ON_CLOSE 0x04000000
// FILE_FLAG_BACKUP_SEMANTICS 0x02000000
// FILE_FLAG_POSIX_SEMANTICS 0x01000000
// FILE_FLAG_OPEN_REPARSE_POINT 0x00200000
// FILE_FLAG_OPEN_NO_RECALL 0x00100000
// FILE_FLAG_FIRST_PIPE_INSTANCE 0x00080000
// FILE_ATTRIBUTE_ENCRYPTED 0x00004000
// FILE_ATTRIBUTE_NOT_CONTENT_INDEXED 0x00002000
// FILE_ATTRIBUTE_OFFLINE 0x00001000
// FILE_ATTRIBUTE_COMPRESSED 0x00000800
// FILE_ATTRIBUTE_REPARSE_POINT 0x00000400
// FILE_ATTRIBUTE_SPARSE_FILE 0x00000200
// FILE_ATTRIBUTE_TEMPORARY 0x00000100
// FILE_ATTRIBUTE_NORMAL 0x00000080
// FILE_ATTRIBUTE_DEVICE 0x00000040
// FILE_ATTRIBUTE_ARCHIVE 0x00000020
// FILE_ATTRIBUTE_DIRECTORY 0x00000010
// FILE_ATTRIBUTE_SYSTEM 0x00000004
// FILE_ATTRIBUTE_HIDDEN 0x00000002
// FILE_ATTRIBUTE_READONLY 0x00000001
// CREATE_NEW 1
// CREATE_ALWAYS 2
// OPEN_EXISTING 3
// OPEN_ALWAYS 4
// TRUNCATE_EXISTING 5
if (create == CREATE_NEW ||
create == CREATE_ALWAYS ||
create == TRUNCATE_EXISTING) {
if (!pInfo->m_fRead) {
pInfo->m_fCantRead = TRUE;
}
}
else if (create == OPEN_EXISTING) {
}
else if (create == OPEN_ALWAYS) {
// pInfo->m_fAppend = TRUE; // !!!
}
if ((flags & FILE_FLAG_DELETE_ON_CLOSE)) {
pInfo->m_fCleanup = TRUE;
}
OpenFiles::Remember(rv, pInfo);
}
};
return rv;
}
HANDLE WINAPI Mine_CreateFileMappingW(HANDLE hFile,
LPSECURITY_ATTRIBUTES a1,
DWORD flProtect,
DWORD a3,
DWORD a4,
LPCWSTR a5)
{
/* int nIndent = */ EnterFunc();
HANDLE rv = 0;
__try {
rv = Real_CreateFileMappingW(hFile, a1, flProtect, a3, a4, a5);
} __finally {
ExitFunc();
if (rv != INVALID_HANDLE_VALUE) {
FileInfo *pInfo = OpenFiles::RecallFile(hFile);
if (pInfo != NULL) {
switch (flProtect) {
case PAGE_READONLY:
pInfo->m_fRead = TRUE;
break;
case PAGE_READWRITE:
pInfo->m_fRead = TRUE;
pInfo->m_fWrite = TRUE;
break;
case PAGE_WRITECOPY:
pInfo->m_fRead = TRUE;
break;
case PAGE_EXECUTE_READ:
pInfo->m_fRead = TRUE;
break;
case PAGE_EXECUTE_READWRITE:
pInfo->m_fRead = TRUE;
pInfo->m_fWrite = TRUE;
break;
}
}
}
};
return rv;
}
BOOL WINAPI Mine_DeleteFileW(LPCWSTR a0)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_DeleteFileW(a0);
} __finally {
ExitFunc();
#if 0
Print("<!-- DeleteFileW(%le -->\n", a0);
#endif
NoteDelete(a0);
};
return rv;
}
static VOID Dump(LPVOID pvData, DWORD cbData)
{
CHAR szBuffer[128];
PBYTE pbData = (PBYTE)pvData;
for (DWORD i = 0; i < cbData; i += 16) {
PCHAR psz = szBuffer;
psz = SafePrintf(psz, (LONG)(szBuffer + ARRAYSIZE(szBuffer) - psz), "%4d: ", i);
for (DWORD j = i; j < i + 16; j++) {
if (j < cbData) {
psz = SafePrintf(psz, (LONG)(szBuffer + ARRAYSIZE(szBuffer) - psz),
"%02x", pbData[j]);
}
else {
psz = SafePrintf(psz, (LONG)(szBuffer + ARRAYSIZE(szBuffer) - psz), " ");
}
}
for (DWORD j = i; j < i + 16; j++) {
if (j < cbData) {
if (pbData[j] >= ' ' && pbData[j] <= 127) {
psz = SafePrintf(psz, (LONG)(szBuffer + ARRAYSIZE(szBuffer) - psz),
"%c", pbData[j]);
}
else {
psz = SafePrintf(psz, (LONG)(szBuffer + ARRAYSIZE(szBuffer) - psz), ".");
}
}
else {
psz = SafePrintf(psz, (LONG)(szBuffer + ARRAYSIZE(szBuffer) - psz), " ");
}
}
Print("%s\n", szBuffer);
}
}
BOOL WINAPI Mine_DeviceIoControl(HANDLE a0,
DWORD a1,
LPVOID a2,
DWORD a3,
LPVOID a4,
DWORD a5,
LPDWORD a6,
LPOVERLAPPED a7)
{
EnterFunc();
DWORD d6 = 0;
if (a6 == NULL) {
a6 = &d6;
}
BOOL rv = 0;
__try {
rv = Real_DeviceIoControl(a0, a1, a2, a3, a4, a5, a6, a7);
} __finally {
ExitFunc();
OpenFiles::SetRead(a0, 0);
OpenFiles::SetWrite(a0, 0);
if (rv && a1 != 0x390008 && a1 != 0x4d0008 && a1 != 0x6d0008) {
FileInfo *pInfo = OpenFiles::RecallFile(a0);
DWORD DeviceType = (a1 & 0xffff0000) >> 16;
DWORD Access = (a1 & 0x0000c000) >> 14;
DWORD Function = (a1 & 0x00003ffc) >> 2;
DWORD Method = (a1 & 0x00000003) >> 0;
if (pInfo) {
Print("<!-- DeviceIoControl %x [dev=%x,acc=%x,fun=%x,mth=%x] on %ls! -->\n",
a1, DeviceType, Access, Function, Method, pInfo->m_pwzPath);
}
else {
Print("<!-- DeviceIoControl %x [dev=%x,acc=%x,fun=%x,mth=%x,in=%d,out=%d/%d] on (%x)! -->\n",
a1, DeviceType, Access, Function, Method, a3, *a6, a5, a0);
if (a3 > 0) {
Dump(a2, a3);
}
if (a5 > 0) {
Dump(a4, (*a6 < a5) ? *a6 : a5);
}
}
}
};
return rv;
}
DWORD WINAPI Mine_GetFileAttributesW(LPCWSTR a0)
{
EnterFunc();
DWORD rv = 0;
__try {
rv = Real_GetFileAttributesW(a0);
} __finally {
ExitFunc();
};
return rv;
}
BOOL WINAPI Mine_MoveFileWithProgressW(LPCWSTR a0,
LPCWSTR a1,
LPPROGRESS_ROUTINE a2,
LPVOID a3,
DWORD a4)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_MoveFileWithProgressW(a0, a1, a2, a3, a4);
} __finally {
ExitFunc();
if (rv) {
NoteRead(a0);
NoteWrite(a1);
}
};
return rv;
}
BOOL WINAPI Mine_MoveFileA(LPCSTR a0,
LPCSTR a1)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_MoveFileA(a0, a1);
} __finally {
ExitFunc();
if (rv) {
NoteRead(a0);
NoteCleanup(a0);
NoteWrite(a1);
}
};
return rv;
}
BOOL WINAPI Mine_MoveFileW(LPCWSTR a0,
LPCWSTR a1)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_MoveFileW(a0, a1);
} __finally {
ExitFunc();
if (rv) {
NoteRead(a0);
NoteCleanup(a0);
NoteWrite(a1);
}
};
return rv;
}
BOOL WINAPI Mine_MoveFileExA(LPCSTR a0,
LPCSTR a1,
DWORD a2)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_MoveFileExA(a0, a1, a2);
} __finally {
ExitFunc();
if (rv) {
NoteRead(a0);
NoteCleanup(a0);
NoteWrite(a1);
}
};
return rv;
}
BOOL WINAPI Mine_MoveFileExW(LPCWSTR a0,
LPCWSTR a1,
DWORD a2)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_MoveFileExW(a0, a1, a2);
} __finally {
ExitFunc();
if (rv) {
NoteRead(a0);
NoteCleanup(a0);
NoteWrite(a1);
}
};
return rv;
}
void SetHandle(PCSTR pszName, HANDLE h)
{
#if 0
FileInfo *pInfo = OpenFiles::RecallFile(h);
if (pInfo != NULL) {
Tblog("<!-- hset: %hs (%x) %ls -->\n", pszName, h, pInfo->m_pwzPath);
}
else {
Tblog("<!-- hset: %hs (%x) ***Unknown*** -->\n", pszName, h);
}
#else
(void)pszName;
(void)h;
#endif
}
BOOL WINAPI Mine_SetStdHandle(DWORD a0,
HANDLE a1)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_SetStdHandle(a0, a1);
if (rv && a1 != 0) {
switch (a0) {
case STD_INPUT_HANDLE:
SetHandle("stdin", a1);
break;
case STD_OUTPUT_HANDLE:
SetHandle("stdout", a1);
break;
case STD_ERROR_HANDLE:
SetHandle("stderr", a1);
break;
}
}
} __finally {
ExitFunc();
};
return rv;
}
HMODULE WINAPI Mine_LoadLibraryA(LPCSTR a0)
{
EnterFunc();
HMODULE rv = 0;
__try {
rv = Real_LoadLibraryA(a0);
} __finally {
ExitFunc();
};
return rv;
}
HMODULE WINAPI Mine_LoadLibraryW(LPCWSTR a0)
{
EnterFunc();
HMODULE rv = 0;
__try {
rv = Real_LoadLibraryW(a0);
} __finally {
ExitFunc();
};
return rv;
}
HMODULE WINAPI Mine_LoadLibraryExA(LPCSTR a0,
HANDLE a1,
DWORD a2)
{
EnterFunc();
HMODULE rv = 0;
__try {
rv = Real_LoadLibraryExA(a0, a1, a2);
} __finally {
ExitFunc();
};
return rv;
}
HMODULE WINAPI Mine_LoadLibraryExW(LPCWSTR a0,
HANDLE a1,
DWORD a2)
{
EnterFunc();
HMODULE rv = 0;
__try {
rv = Real_LoadLibraryExW(a0, a1, a2);
} __finally {
ExitFunc();
};
return rv;
}
DWORD WINAPI Mine_SetFilePointer(HANDLE hFile,
LONG lDistanceToMove,
PLONG lpDistanceToMoveHigh,
DWORD dwMoveMethod)
{
EnterFunc();
DWORD rv = 0;
__try {
rv = Real_SetFilePointer(hFile,
lDistanceToMove,
lpDistanceToMoveHigh,
dwMoveMethod);
} __finally {
LONG high = 0;
if (lpDistanceToMoveHigh == NULL) {
lpDistanceToMoveHigh = &high;
}
FileInfo * pInfo = OpenFiles::RecallFile(hFile);
if (pInfo != NULL) {
if (dwMoveMethod == FILE_END && lDistanceToMove == 0xffffffff) {
#if 0
Print("<!-- SetFilePointer(APPEND, %le) -->\n",
pInfo->m_pwzPath);
#endif
pInfo->m_fAppend = TRUE;
}
#if 0
else if (dwMoveMethod == FILE_END) {
Print("<!-- SetFilePointer(END:%08x:%08x, %le) -->\n",
(int)lDistanceToMove,
*lpDistanceToMoveHigh,
pInfo->m_pwzPath);
}
else if (dwMoveMethod == FILE_BEGIN) {
Print("<!-- SetFilePointer(BEG:%08x:%08x, %le) -->\n",
(int)lDistanceToMove,
*lpDistanceToMoveHigh,
pInfo->m_pwzPath);
}
else if (dwMoveMethod == FILE_CURRENT) {
Print("<!-- SetFilePointer(CUR:%08x:%08x, %le) -->\n",
(int)lDistanceToMove,
*lpDistanceToMoveHigh,
pInfo->m_pwzPath);
}
#endif
}
ExitFunc();
};
return rv;
}
BOOL WINAPI Mine_SetFilePointerEx(HANDLE hFile,
LARGE_INTEGER liDistanceToMove,
PLARGE_INTEGER lpNewFilePointer,
DWORD dwMoveMethod)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_SetFilePointerEx(hFile,
liDistanceToMove,
lpNewFilePointer,
dwMoveMethod);
} __finally {
#if 0
FileInfo * pInfo = OpenFiles::RecallFile(hFile);
if (pInfo != NULL) {
if (dwMoveMethod == FILE_END) {
Print("<!-- SetFilePointerEx(END:%I64d, %le) -->\n",
liDistanceToMove.QuadPart,
pInfo->m_pwzPath);
}
else if (dwMoveMethod == FILE_BEGIN) {
Print("<!-- SetFilePointerEx(BEG:%I64d, %le) -->\n",
liDistanceToMove.QuadPart,
pInfo->m_pwzPath);
}
else if (dwMoveMethod == FILE_CURRENT) {
Print("<!-- SetFilePointerEx(CUR:%I64d, %le) -->\n",
liDistanceToMove.QuadPart,
pInfo->m_pwzPath);
}
}
#endif
ExitFunc();
};
return rv;
}
BOOL WINAPI Mine_ReadFile(HANDLE a0,
LPVOID a1,
DWORD a2,
LPDWORD a3,
LPOVERLAPPED a4)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_ReadFile(a0, a1, a2, a3, a4);
} __finally {
if (rv) {
OpenFiles::SetRead(a0, a2);
}
ExitFunc();
};
return rv;
}
BOOL WINAPI Mine_ReadFileEx(HANDLE a0,
LPVOID a1,
DWORD a2,
LPOVERLAPPED a3,
LPOVERLAPPED_COMPLETION_ROUTINE a4)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_ReadFileEx(a0, a1, a2, a3, a4);
} __finally {
if (rv) {
OpenFiles::SetRead(a0, a2);
}
ExitFunc();
};
return rv;
}
BOOL WINAPI Mine_WriteFile(HANDLE a0,
LPCVOID a1,
DWORD a2,
LPDWORD a3,
LPOVERLAPPED a4)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_WriteFile(a0, a1, a2, a3, a4);
} __finally {
OpenFiles::SetWrite(a0, a2);
ExitFunc();
};
return rv;
}
BOOL WINAPI Mine_WriteFileEx(HANDLE a0,
LPCVOID a1,
DWORD a2,
LPOVERLAPPED a3,
LPOVERLAPPED_COMPLETION_ROUTINE a4)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_WriteFileEx(a0, a1, a2, a3, a4);
} __finally {
OpenFiles::SetWrite(a0, a2);
ExitFunc();
};
return rv;
}
BOOL WINAPI Mine_WriteConsoleA(HANDLE a0,
const VOID* a1,
DWORD a2,
LPDWORD a3,
LPVOID a4)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_WriteConsoleA(a0, a1, a2, a3, a4);
} __finally {
OpenFiles::SetWrite(a0, a2);
ExitFunc();
};
return rv;
}
BOOL WINAPI Mine_WriteConsoleW(HANDLE a0,
const VOID* a1,
DWORD a2,
LPDWORD a3,
LPVOID a4)
{
EnterFunc();
BOOL rv = 0;
__try {
rv = Real_WriteConsoleW(a0, a1, a2, a3, a4);
} __finally {
OpenFiles::SetWrite(a0, a2);
ExitFunc();
};
return rv;
}
//////////////////////////////////////////////////////////////////////////////
//
DWORD WINAPI Mine_ExpandEnvironmentStringsA(PCSTR lpSrc, PCHAR lpDst, DWORD nSize)
{
EnterFunc();
DWORD rv = 0;
__try {
rv = Real_ExpandEnvironmentStringsA(lpSrc, lpDst, nSize);
}
__finally {
if (rv > 0) {
#if 0
Print("<!-- ExpandEnvironmentStringsA(%he) -->\n", lpSrc);
#endif
}
ExitFunc();
};
return rv;
}
DWORD WINAPI Mine_ExpandEnvironmentStringsW(PCWSTR lpSrc, PWCHAR lpDst, DWORD nSize)
{
EnterFunc();
DWORD rv = 0;
__try {
rv = Real_ExpandEnvironmentStringsW(lpSrc, lpDst, nSize);
}
__finally {
if (rv > 0) {
#if 0
Print("<!-- ExpandEnvironmentStringsW(%le) -->\n", lpSrc);
#endif
}
ExitFunc();
};
return rv;
}
DWORD WINAPI Mine_GetEnvironmentVariableA(PCSTR lpName, PCHAR lpBuffer, DWORD nSize)
{
EnterFunc();
DWORD rv = 0;
__try {
rv = Real_GetEnvironmentVariableA(lpName, lpBuffer, nSize);
// if (rv > 0 && rv < nSize && lpBuffer != NULL) {
// EnvVars::Used(lpName);
// }
}
__finally {
EnvVars::Used(lpName);
ExitFunc();
};
return rv;
}
DWORD WINAPI Mine_GetEnvironmentVariableW(PCWSTR lpName, PWCHAR lpBuffer, DWORD nSize)
{
EnterFunc();
DWORD rv = 0;
__try {
rv = Real_GetEnvironmentVariableW(lpName, lpBuffer, nSize);
// if (rv > 0 && rv < nSize && lpBuffer != NULL) {
// EnvVars::Used(lpName);
// }
}
__finally {
EnvVars::Used(lpName);
ExitFunc();
};
return rv;
}
PCWSTR CDECL Mine_wgetenv(PCWSTR var)
{
EnterFunc();
PCWSTR rv = 0;
__try {
rv = Real_wgetenv(var);
// if (rv != NULL) {
// EnvVars::Used(var);
// }
}
__finally {
EnvVars::Used(var);
ExitFunc();
}
return rv;
}
PCSTR CDECL Mine_getenv(PCSTR var)
{
EnterFunc();
PCSTR rv = 0;
__try {
rv = Real_getenv(var);
// if (rv) {
// EnvVars::Used(var);
// }
}
__finally {
EnvVars::Used(var);
ExitFunc();
}
return rv;
}
DWORD CDECL Mine_getenv_s(DWORD *pValue, PCHAR pBuffer, DWORD cBuffer, PCSTR varname)
{
EnterFunc();
DWORD rv = 0;
__try {
DWORD value;
if (pValue == NULL) {
pValue = &value;
}
rv = Real_getenv_s(pValue, pBuffer, cBuffer, varname);
// if (rv == 0 && *pValue > 0) {
// EnvVars::Used(varname);
// }
}
__finally {
EnvVars::Used(varname);
ExitFunc();
}
return rv;
}
DWORD CDECL Mine_wgetenv_s(DWORD *pValue, PWCHAR pBuffer, DWORD cBuffer, PCWSTR varname)
{
EnterFunc();
DWORD rv = 0;
__try {
DWORD value;
if (pValue == NULL) {
pValue = &value;
}
rv = Real_wgetenv_s(pValue, pBuffer, cBuffer, varname);
// if (rv == 0 && *pValue > 0) {
// EnvVars::Used(varname);
// }
}
__finally {
EnvVars::Used(varname);
ExitFunc();
}
return rv;
}
DWORD CDECL Mine_dupenv_s(PCHAR *ppBuffer, DWORD *pcBuffer, PCSTR varname)
{
EnterFunc();
DWORD rv = 0;
__try {
PCHAR pb;
DWORD cb;
if (ppBuffer == NULL) {
ppBuffer = &pb;
}
if (pcBuffer == NULL) {
pcBuffer = &cb;
}
rv = Real_dupenv_s(ppBuffer, pcBuffer, varname);
// if (rv == 0 && *pcBuffer > 0 && *ppBuffer != NULL) {
// EnvVars::Used(varname);
// }
}
__finally {
EnvVars::Used(varname);
ExitFunc();
}
return rv;
}
DWORD CDECL Mine_wdupenv_s(PWCHAR *ppBuffer, DWORD *pcBuffer, PCWSTR varname)
{
EnterFunc();
DWORD rv = 0;
__try {
PWCHAR pb;
DWORD cb;
if (ppBuffer == NULL) {
ppBuffer = &pb;
}
if (pcBuffer == NULL) {
pcBuffer = &cb;
}
rv = Real_wdupenv_s(ppBuffer, pcBuffer, varname);
// if (rv == 0 && *pcBuffer > 0 && *ppBuffer != NULL) {
// EnvVars::Used(varname);
// }
}
__finally {
EnvVars::Used(varname);
ExitFunc();
}
return rv;
}
/////////////////////////////////////////////////////////////
// AttachDetours
//
LONG AttachDetours(VOID)
{
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach(&(PVOID&)Real_EntryPoint, Mine_EntryPoint);
DetourAttach(&(PVOID&)Real_ExitProcess, Mine_ExitProcess);
DetourAttach(&(PVOID&)Real_CopyFileExA, Mine_CopyFileExA);
DetourAttach(&(PVOID&)Real_CopyFileExW, Mine_CopyFileExW);
DetourAttach(&(PVOID&)Real_PrivCopyFileExW, Mine_PrivCopyFileExW);
DetourAttach(&(PVOID&)Real_CreateHardLinkA, Mine_CreateHardLinkA);
DetourAttach(&(PVOID&)Real_CreateHardLinkW, Mine_CreateHardLinkW);
DetourAttach(&(PVOID&)Real_CreateDirectoryW, Mine_CreateDirectoryW);
DetourAttach(&(PVOID&)Real_CreateDirectoryExW, Mine_CreateDirectoryExW);
DetourAttach(&(PVOID&)Real_CreateFileW, Mine_CreateFileW);
DetourAttach(&(PVOID&)Real_CreatePipe, Mine_CreatePipe);
DetourAttach(&(PVOID&)Real_CreateFileMappingW, Mine_CreateFileMappingW);
DetourAttach(&(PVOID&)Real_CloseHandle, Mine_CloseHandle);
DetourAttach(&(PVOID&)Real_DuplicateHandle, Mine_DuplicateHandle);
DetourAttach(&(PVOID&)Real_CreateProcessW, Mine_CreateProcessW);
DetourAttach(&(PVOID&)Real_CreateProcessA, Mine_CreateProcessA);
DetourAttach(&(PVOID&)Real_DeleteFileW, Mine_DeleteFileW);
DetourAttach(&(PVOID&)Real_DeviceIoControl, Mine_DeviceIoControl);
DetourAttach(&(PVOID&)Real_GetFileAttributesW, Mine_GetFileAttributesW);
DetourAttach(&(PVOID&)Real_MoveFileA, Mine_MoveFileA);
DetourAttach(&(PVOID&)Real_MoveFileW, Mine_MoveFileW);
DetourAttach(&(PVOID&)Real_MoveFileExA, Mine_MoveFileExA);
DetourAttach(&(PVOID&)Real_MoveFileExW, Mine_MoveFileExW);
DetourAttach(&(PVOID&)Real_MoveFileWithProgressW, Mine_MoveFileWithProgressW);
DetourAttach(&(PVOID&)Real_SetStdHandle, Mine_SetStdHandle);
DetourAttach(&(PVOID&)Real_LoadLibraryA, Mine_LoadLibraryA);
DetourAttach(&(PVOID&)Real_LoadLibraryW, Mine_LoadLibraryW);
DetourAttach(&(PVOID&)Real_LoadLibraryExA, Mine_LoadLibraryExA);
DetourAttach(&(PVOID&)Real_LoadLibraryExW, Mine_LoadLibraryExW);
DetourAttach(&(PVOID&)Real_SetFilePointer, Mine_SetFilePointer);
DetourAttach(&(PVOID&)Real_SetFilePointerEx, Mine_SetFilePointerEx);
DetourAttach(&(PVOID&)Real_ReadFile, Mine_ReadFile);
DetourAttach(&(PVOID&)Real_ReadFileEx, Mine_ReadFileEx);
DetourAttach(&(PVOID&)Real_WriteFile, Mine_WriteFile);
DetourAttach(&(PVOID&)Real_WriteFileEx, Mine_WriteFileEx);
DetourAttach(&(PVOID&)Real_WriteConsoleA, Mine_WriteConsoleA);
DetourAttach(&(PVOID&)Real_WriteConsoleW, Mine_WriteConsoleW);
DetourAttach(&(PVOID&)Real_ExpandEnvironmentStringsA, Mine_ExpandEnvironmentStringsA);
DetourAttach(&(PVOID&)Real_ExpandEnvironmentStringsW, Mine_ExpandEnvironmentStringsW);
DetourAttach(&(PVOID&)Real_GetEnvironmentVariableA, Mine_GetEnvironmentVariableA);
DetourAttach(&(PVOID&)Real_GetEnvironmentVariableW, Mine_GetEnvironmentVariableW);
return DetourTransactionCommit();
}
LONG DetachDetours(VOID)
{
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourDetach(&(PVOID&)Real_EntryPoint, Mine_EntryPoint);
DetourAttach(&(PVOID&)Real_ExitProcess, Mine_ExitProcess);
DetourDetach(&(PVOID&)Real_CopyFileExA, Mine_CopyFileExA);
DetourDetach(&(PVOID&)Real_CopyFileExW, Mine_CopyFileExW);
DetourDetach(&(PVOID&)Real_PrivCopyFileExW, Mine_PrivCopyFileExW);
DetourDetach(&(PVOID&)Real_CreateHardLinkA, Mine_CreateHardLinkA);
DetourDetach(&(PVOID&)Real_CreateHardLinkW, Mine_CreateHardLinkW);
DetourDetach(&(PVOID&)Real_CreateDirectoryW, Mine_CreateDirectoryW);
DetourDetach(&(PVOID&)Real_CreateDirectoryExW, Mine_CreateDirectoryExW);
DetourDetach(&(PVOID&)Real_CreateFileW, Mine_CreateFileW);
DetourDetach(&(PVOID&)Real_CreatePipe, Mine_CreatePipe);
DetourDetach(&(PVOID&)Real_CreateFileMappingW, Mine_CreateFileMappingW);
DetourDetach(&(PVOID&)Real_CloseHandle, Mine_CloseHandle);
DetourDetach(&(PVOID&)Real_DuplicateHandle, Mine_DuplicateHandle);
DetourDetach(&(PVOID&)Real_CreateProcessW, Mine_CreateProcessW);
DetourDetach(&(PVOID&)Real_CreateProcessA, Mine_CreateProcessA);
DetourDetach(&(PVOID&)Real_DeleteFileW, Mine_DeleteFileW);
DetourDetach(&(PVOID&)Real_DeviceIoControl, Mine_DeviceIoControl);
DetourDetach(&(PVOID&)Real_GetFileAttributesW, Mine_GetFileAttributesW);
DetourDetach(&(PVOID&)Real_MoveFileA, Mine_MoveFileA);
DetourDetach(&(PVOID&)Real_MoveFileW, Mine_MoveFileW);
DetourDetach(&(PVOID&)Real_MoveFileExA, Mine_MoveFileExA);
DetourDetach(&(PVOID&)Real_MoveFileExW, Mine_MoveFileExW);
DetourDetach(&(PVOID&)Real_MoveFileWithProgressW, Mine_MoveFileWithProgressW);
DetourDetach(&(PVOID&)Real_SetStdHandle, Mine_SetStdHandle);
DetourDetach(&(PVOID&)Real_LoadLibraryA, Mine_LoadLibraryA);
DetourDetach(&(PVOID&)Real_LoadLibraryW, Mine_LoadLibraryW);
DetourDetach(&(PVOID&)Real_LoadLibraryExA, Mine_LoadLibraryExA);
DetourDetach(&(PVOID&)Real_LoadLibraryExW, Mine_LoadLibraryExW);
DetourDetach(&(PVOID&)Real_SetFilePointer, Mine_SetFilePointer);
DetourDetach(&(PVOID&)Real_SetFilePointerEx, Mine_SetFilePointerEx);
DetourDetach(&(PVOID&)Real_ReadFile, Mine_ReadFile);
DetourDetach(&(PVOID&)Real_ReadFileEx, Mine_ReadFileEx);
DetourDetach(&(PVOID&)Real_WriteFile, Mine_WriteFile);
DetourDetach(&(PVOID&)Real_WriteFileEx, Mine_WriteFileEx);
DetourDetach(&(PVOID&)Real_WriteConsoleA, Mine_WriteConsoleA);
DetourDetach(&(PVOID&)Real_WriteConsoleW, Mine_WriteConsoleW);
DetourDetach(&(PVOID&)Real_ExpandEnvironmentStringsA, Mine_ExpandEnvironmentStringsA);
DetourDetach(&(PVOID&)Real_ExpandEnvironmentStringsW, Mine_ExpandEnvironmentStringsW);
DetourDetach(&(PVOID&)Real_GetEnvironmentVariableA, Mine_GetEnvironmentVariableA);
DetourDetach(&(PVOID&)Real_GetEnvironmentVariableW, Mine_GetEnvironmentVariableW);
if (Real_getenv) { DetourDetach(&(PVOID&)Real_getenv, Mine_getenv); }
if (Real_getenv_s) { DetourDetach(&(PVOID&)Real_getenv_s, Mine_getenv_s); }
if (Real_wgetenv) { DetourDetach(&(PVOID&)Real_wgetenv, Mine_wgetenv); }
if (Real_wgetenv_s) { DetourDetach(&(PVOID&)Real_wgetenv, Mine_wgetenv_s); }
if (Real_dupenv_s) { DetourDetach(&(PVOID&)Real_dupenv_s, Mine_dupenv_s); }
if (Real_wdupenv_s) { DetourDetach(&(PVOID&)Real_wdupenv_s, Mine_wdupenv_s); }
return DetourTransactionCommit();
}
//
//////////////////////////////////////////////////////////////////////////////
VOID NoteRead(PCSTR psz)
{
FileInfo *pInfo = FileNames::FindPartial(psz);
pInfo->m_fRead = TRUE;
}
VOID NoteRead(PCWSTR pwz)
{
FileInfo *pInfo = FileNames::FindPartial(pwz);
pInfo->m_fRead = TRUE;
}
VOID NoteWrite(PCSTR psz)
{
FileInfo *pInfo = FileNames::FindPartial(psz);
pInfo->m_fWrite = TRUE;
if (!pInfo->m_fRead) {
pInfo->m_fCantRead = TRUE;
}
}
VOID NoteWrite(PCWSTR pwz)
{
FileInfo *pInfo = FileNames::FindPartial(pwz);
pInfo->m_fWrite = TRUE;
if (!pInfo->m_fRead) {
pInfo->m_fCantRead = TRUE;
}
}
VOID NoteDelete(PCSTR psz)
{
FileInfo *pInfo = FileNames::FindPartial(psz);
if (pInfo->m_fWrite || pInfo->m_fRead) {
pInfo->m_fCleanup = TRUE;
}
else {
pInfo->m_fDelete = TRUE;
}
if (!pInfo->m_fRead) {
pInfo->m_fCantRead = TRUE;
}
}
VOID NoteDelete(PCWSTR pwz)
{
FileInfo *pInfo = FileNames::FindPartial(pwz);
if (pInfo->m_fWrite || pInfo->m_fRead) {
pInfo->m_fCleanup = TRUE;
}
else {
pInfo->m_fDelete = TRUE;
}
if (!pInfo->m_fRead) {
pInfo->m_fCantRead = TRUE;
}
}
VOID NoteCleanup(PCSTR psz)
{
FileInfo *pInfo = FileNames::FindPartial(psz);
pInfo->m_fCleanup = TRUE;
}
VOID NoteCleanup(PCWSTR pwz)
{
FileInfo *pInfo = FileNames::FindPartial(pwz);
pInfo->m_fCleanup = TRUE;
}
////////////////////////////////////////////////////////////// Logging System.
//
static BOOL s_bLog = 1;
static LONG s_nTlsIndent = -1;
static LONG s_nTlsThread = -1;
static LONG s_nThreadCnt = 0;
LONG EnterFunc()
{
DWORD dwErr = GetLastError();
LONG nIndent = 0;
LONG nThread = 0;
if (s_nTlsIndent >= 0) {
nIndent = (LONG)(LONG_PTR)TlsGetValue(s_nTlsIndent);
TlsSetValue(s_nTlsIndent, (PVOID)(LONG_PTR)(nIndent + 1));
}
if (s_nTlsThread >= 0) {
nThread = (LONG)(LONG_PTR)TlsGetValue(s_nTlsThread);
}
SetLastError(dwErr);
return nIndent;
}
VOID ExitFunc()
{
DWORD dwErr = GetLastError();
LONG nIndent = 0;
LONG nThread = 0;
if (s_nTlsIndent >= 0) {
nIndent = (LONG)(LONG_PTR)TlsGetValue(s_nTlsIndent) - 1;
ASSERT(nIndent >= 0);
TlsSetValue(s_nTlsIndent, (PVOID)(LONG_PTR)nIndent);
}
if (s_nTlsThread >= 0) {
nThread = (LONG)(LONG_PTR)TlsGetValue(s_nTlsThread);
}
SetLastError(dwErr);
}
VOID Print(const CHAR *psz, ...)
{
DWORD dwErr = GetLastError();
if (s_bLog && psz) {
va_list args;
va_start(args, psz);
TblogV(psz, args);
va_end(args);
}
SetLastError(dwErr);
}
VOID AssertFailed(CONST PCHAR pszMsg, CONST PCHAR pszFile, ULONG nLine)
{
Tblog("ASSERT(%hs) failed in %s, line %d.\n", pszMsg, pszFile, nLine);
}
//////////////////////////////////////////////////////////////////////////////
//
// DLL module information
//
BOOL ThreadAttach(HMODULE hDll)
{
(void)hDll;
if (s_nTlsIndent >= 0) {
TlsSetValue(s_nTlsIndent, (PVOID)0);
}
if (s_nTlsThread >= 0) {
LONG nThread = InterlockedIncrement(&s_nThreadCnt);
TlsSetValue(s_nTlsThread, (PVOID)(LONG_PTR)nThread);
}
return TRUE;
}
BOOL ThreadDetach(HMODULE hDll)
{
(void)hDll;
if (s_nTlsIndent >= 0) {
TlsSetValue(s_nTlsIndent, (PVOID)0);
}
if (s_nTlsThread >= 0) {
TlsSetValue(s_nTlsThread, (PVOID)0);
}
return TRUE;
}
BOOL ProcessAttach(HMODULE hDll)
{
InitializeCriticalSection(&s_csPipe);
InitializeCriticalSection(&s_csChildPayload);
Procs::Initialize();
EnvVars::Initialize();
FileNames::Initialize();
OpenFiles::Initialize();
s_bLog = FALSE;
s_nTlsIndent = TlsAlloc();
s_nTlsThread = TlsAlloc();
s_hInst = hDll;
s_hKernel32 = NULL;
PBYTE xCreate = (PBYTE)DetourCodeFromPointer((PVOID)Real_CreateProcessW, NULL);
PTBLOG_PAYLOAD pPayload = NULL;
for (HMODULE hMod = NULL; (hMod = DetourEnumerateModules(hMod)) != NULL;) {
ULONG cbData;
PVOID pvData = DetourFindPayload(hMod, s_guidTrace, &cbData);
if (pvData != NULL && pPayload == NULL) {
pPayload = (PTBLOG_PAYLOAD)pvData;
}
ULONG cbMod = DetourGetModuleSize(hMod);
if (((PBYTE)hMod) < xCreate && ((PBYTE)hMod + cbMod) > xCreate) {
s_hKernel32 = hMod;
}
}
ZeroMemory(&s_Payload, sizeof(s_Payload));
if (pPayload == NULL) {
return FALSE;
}
CopyMemory(&s_Payload, pPayload, sizeof(s_Payload));
LoadStdHandleName(STD_INPUT_HANDLE, s_Payload.wzStdin, FALSE);
LoadStdHandleName(STD_OUTPUT_HANDLE, s_Payload.wzStdout, s_Payload.fStdoutAppend);
LoadStdHandleName(STD_ERROR_HANDLE, s_Payload.wzStderr, s_Payload.fStderrAppend);
s_nTraceProcessId = s_Payload.nTraceProcessId;
GetModuleFileNameA(s_hInst, s_szDllPath, ARRAYSIZE(s_szDllPath));
// Find hidden functions.
Real_PrivCopyFileExW =
(BOOL (WINAPI *)(LPCWSTR, LPCWSTR, LPPROGRESS_ROUTINE, LPVOID, LPBOOL, DWORD))
GetProcAddress(s_hKernel32, "PrivCopyFileExW");
if (Real_PrivCopyFileExW == NULL) {
DEBUG_BREAK();
}
LONG error = AttachDetours();
if (error != NO_ERROR) {
DEBUG_BREAK();
Tblog("<!-- Error attaching detours: %d -->\n", error);
}
ThreadAttach(hDll);
s_bLog = TRUE;
return TRUE;
}
BOOL ProcessDetach(HMODULE hDll)
{
ThreadDetach(hDll);
s_bLog = FALSE;
LONG error = DetachDetours();
if (error != NO_ERROR) {
Tblog("<!-- Error detaching detours: %d -->\n", error);
}
TblogClose();
if (s_nTlsIndent >= 0) {
TlsFree(s_nTlsIndent);
}
if (s_nTlsThread >= 0) {
TlsFree(s_nTlsThread);
}
return TRUE;
}
inline VOID UpdateIfRoom(PWCHAR& pwzDst, PWCHAR pwzDstEnd, WCHAR c)
{
if (pwzDst < pwzDstEnd) {
*pwzDst++ = c; // Write character if room in buffer.
}
else {
pwzDst++; // If no room, just advance pointer (to alloc calculation)
}
}
static PCHAR RemoveReturns(PCHAR pszBuffer)
{
PCHAR pszIn = pszBuffer;
PCHAR pszOut = pszBuffer;
while (*pszIn) {
if (*pszIn == '\r') {
pszIn++;
continue;
}
*pszOut++ = *pszIn++;
}
*pszOut = '\0';
return pszBuffer;
}
static PWCHAR RemoveReturns(PWCHAR pwzBuffer)
{
PWCHAR pwzIn = pwzBuffer;
PWCHAR pwzOut = pwzBuffer;
while (*pwzIn) {
if (*pwzIn == '\r') {
pwzIn++;
continue;
}
*pwzOut++ = *pwzIn++;
}
*pwzOut = '\0';
return pwzBuffer;
}
PBYTE LoadFile(HANDLE hFile, DWORD cbFile)
{
PBYTE pbFile = (PBYTE)GlobalAlloc(GPTR, cbFile + 3);
if (pbFile == NULL) {
return NULL;
}
DWORD cbRead = 0;
Real_SetFilePointer(hFile, 0, NULL, FILE_BEGIN);
Real_ReadFile(hFile, pbFile, cbFile, &cbRead, NULL);
// Make sure the file is zero terminated.
pbFile[cbRead + 0] = 0;
pbFile[cbRead + 1] = 0;
pbFile[cbRead + 2] = 0;
return pbFile;
}
PWCHAR More(PCWSTR pwzPath, PWCHAR pwzDst, PWCHAR pwzDstEnd)
{
HANDLE hFile = Real_CreateFileW(pwzPath, GENERIC_READ, 0, NULL, OPEN_EXISTING, 0, NULL);
if (hFile == INVALID_HANDLE_VALUE) {
return NULL;
}
FileInfo *pInfo = FileNames::FindPartial(pwzPath);
pInfo->m_fAbsorbed = true;
DWORD cbFile = Real_SetFilePointer(hFile, 0, NULL, FILE_END);
DWORD cbRead = 0;
PCHAR pszFile = (PCHAR)GlobalAlloc(GPTR, cbFile + 2); // 2 bytes null for Unicode or Ascii.
if (pszFile != NULL) {
Real_SetFilePointer(hFile, 0, NULL, FILE_BEGIN);
Real_ReadFile(hFile, pszFile, cbFile, &cbRead, NULL);
if (((PUCHAR)pszFile)[0] == 0xff && ((PUCHAR)pszFile)[1] == 0xfe) {
// Unicode
PWCHAR pwzFile = ((PWCHAR)pszFile) + 1;
PCWSTR pwzIn = pwzFile;
while (*pwzIn) {
if (*pwzIn == ' ' || *pwzIn == '\t' || *pwzIn == '\r' || *pwzIn == '\n') {
UpdateIfRoom(pwzDst, pwzDstEnd, ' ');
while (*pwzIn == ' ' || *pwzIn == '\t' || *pwzIn == '\r' || *pwzIn == '\n') {
pwzIn++;
}
}
else {
UpdateIfRoom(pwzDst, pwzDstEnd, *pwzIn++);
}
}
}
else {
PCSTR pszIn = pszFile;
while (*pszIn) {
if (*pszIn == ' ' || *pszIn == '\t' || *pszIn == '\r' || *pszIn == '\n') {
UpdateIfRoom(pwzDst, pwzDstEnd, ' ');
while (*pszIn == ' ' || *pszIn == '\t' || *pszIn == '\r' || *pszIn == '\n') {
pszIn++;
}
}
else {
UpdateIfRoom(pwzDst, pwzDstEnd, *pszIn++);
}
}
}
GlobalFree(pszFile);
}
Real_CloseHandle(hFile);
return pwzDst;
}
// This function is called twice. On the first call, pwzDstEnd <= pwzDst and
// no data is copied, but pwzDst is advanced so we can see how big of a
// buffer is needed to hold the command line.
//
// On the second call, the command line is actually populated.
PWCHAR LoadCommandLine(PCWSTR pwz, PWCHAR pwzDst, PWCHAR pwzDstEnd)
{
while (*pwz) {
PCWSTR pwzArgBeg = NULL;
PCWSTR pwzArgEnd = NULL;
WCHAR cQuote = '\0';
BOOL fMore = false;
if (*pwz == '@') {
fMore = true;
pwz++;
}
if (*pwz == '\"' || *pwz == '\'') {
cQuote = *pwz++;
pwzArgBeg = pwz;
while (*pwz != '\0' && *pwz != cQuote) {
pwz++;
}
pwzArgEnd = pwz;
if (*pwz == cQuote) {
pwz++;
}
}
else {
pwzArgBeg = pwz;
while (*pwz != '\0' && *pwz != ' ' && *pwz != '\t' && *pwz != '\n' && *pwz != '\r') {
pwz++;
}
pwzArgEnd = pwz;
}
if (fMore) {
// More arguments!
WCHAR wzPath[MAX_PATH];
PWCHAR pwzPath = wzPath;
PCWSTR pwzTmp = pwzArgBeg + 1;
while (pwzTmp < pwzArgEnd && pwzPath < wzPath + ARRAYSIZE(wzPath)-2) {
*pwzPath++ = *pwzTmp++;
}
*pwzPath = '\0';
PWCHAR pwzOut = More(wzPath, pwzDst, pwzDstEnd);
if (pwzOut != NULL) {
pwzDst = pwzOut;
cQuote = 0;
pwzArgBeg = pwzArgEnd;
}
}
if (cQuote) {
UpdateIfRoom(pwzDst, pwzDstEnd, cQuote);
}
for (; pwzArgBeg < pwzArgEnd; pwzArgBeg++) {
UpdateIfRoom(pwzDst, pwzDstEnd, *pwzArgBeg);
}
if (cQuote) {
UpdateIfRoom(pwzDst, pwzDstEnd, cQuote);
}
if (*pwz) {
UpdateIfRoom(pwzDst, pwzDstEnd, ' ');
}
// skip over separating spaces.
while (*pwz == ' ' || *pwz == '\t' || *pwz == '\n' || *pwz == '\r') {
pwz++;
}
}
return pwzDst;
}
void TestHandle(PCSTR pszName, HANDLE h)
{
FileInfo *pInfo = OpenFiles::RecallFile(h);
if (pInfo != NULL) {
#if 1 // Ignore PIPEs.
if (FileNames::PrefixMatch(pInfo->m_pwzPath, L"\\\\.\\PIPE\\")) {
// Ignore;
}
else
#endif
if (FileNames::SuffixMatch(pInfo->m_pwzPath, L"\\conout$")) {
// Ignore;
}
else if (FileNames::SuffixMatch(pInfo->m_pwzPath, L"\\conin$")) {
// Ignore;
}
else if (FileNames::SuffixMatch(pInfo->m_pwzPath, L"\\nul")) {
// Ignore;
}
else {
Tblog("<%hs%hs>%le</%hs>\n",
pszName, pInfo->m_fAppend ? " append=\"true\"" : "", pInfo->m_pwzPath, pszName);
}
}
else {
Tblog("<!-- hand: %hs (%x) ***Unknown*** -->\n", pszName, h);
}
}
LONG WINAPI DetourAttachIf(PVOID *ppPointer, PVOID pDetour)
{
if (*ppPointer == NULL) {
Tblog("<!-- DetourAttachIf failed: %p -->\n", pDetour);
return NO_ERROR;
}
PDETOUR_TRAMPOLINE pRealTrampoline;
PVOID pRealTarget;
PVOID pRealDetour;
LONG err = DetourAttachEx(ppPointer, pDetour, &pRealTrampoline, &pRealTarget, &pRealDetour);
if (err == NO_ERROR) {
// Tblog("<!-- DetourAttachIf %p at %p -->\n", pDetour, pRealTarget);
return NO_ERROR;
}
return err;
}
int WINAPI Mine_EntryPoint(VOID)
{
// This function is invoked instead of the process EntryPoint (Real_EntryPoint).
TblogOpen();
SaveEnvironment();
{
CHAR szExeName[MAX_PATH];
CHAR szId[128];
CHAR szParent[128];
WCHAR wzPath[MAX_PATH];
PCHAR pszExeName = szExeName;
// Get the base command line (skipping over the executable name)
PCWSTR pwzLine = GetCommandLineW();
if (*pwzLine == '\"') {
pwzLine++;
while (*pwzLine && *pwzLine != '\"') {
pwzLine++;
}
if (*pwzLine == '\"') {
pwzLine++;
}
}
else {
while (*pwzLine && *pwzLine != ' ' && *pwzLine != '\t') {
pwzLine++;
}
}
while (*pwzLine && (*pwzLine == ' ' || *pwzLine == '\t')) {
pwzLine++;
}
// Get the root executable name.
if (GetModuleFileNameA(0, szExeName, ARRAYSIZE(szExeName))) {
PCHAR psz = szExeName;
while (*psz) {
psz++;
}
while (psz > szExeName && psz[-1] != ':' && psz[-1] != '\\' && psz[-1] != '/') {
psz--;
}
pszExeName = psz;
while (*psz && *psz != '.') {
psz++;
}
*psz = '\0';
}
else {
szExeName[0] = '\0';
}
// Start the XML process node.
Tblog("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n");
{
PCHAR pszId = szId;
PCHAR pszParent = szParent;
for (DWORD i = 0; i < s_Payload.nGeneology; i++) {
pszId = SafePrintf(pszId, 16, "%d.", s_Payload.rGeneology[i]);
if (i < s_Payload.nGeneology - 1) {
pszParent = SafePrintf(pszParent, 16, "%d.", s_Payload.rGeneology[i]);
}
}
*pszId = '\0';
*pszParent = '\0';
if (szParent[0] == '\0') {
Tblog("<t:Process id=\"::%hs::\"", szId);
}
else {
Tblog("<t:Process id=\"::%hs::\" parentId=\"::%hs::\"", szId, szParent);
}
Tblog(" par=\"%ls\" exe=\"%hs\"", s_Payload.wzParents, pszExeName);
BOOL drop = false;
PCWSTR pwzz = s_Payload.wzzDrop;
while (*pwzz) {
if (Compare(pwzz, pszExeName) == 0) {
// match
drop = true;
break;
}
pwzz += Size(pwzz) + 1;
}
if (drop) {
Tblog(" drop=\"true\"");
}
}
{
PWCHAR pwz = s_Payload.wzParents;
while (*pwz) {
pwz++;
}
*pwz++ = '/';
PCSTR psz = pszExeName;
while (*psz) {
*pwz++ = *psz++;
}
*pwz = '\0';
}
if (HasChar(pwzLine, '|')) {
Tblog(" pipes=\"true\"");
}
if (HasChar(pwzLine, '>')) {
Tblog(" redirects=\"true\"");
}
Tblog(" xmlns:t=\"http://schemas.microsoft.com/research/tracebld/2008\">\n");
// Get the directory.
DWORD dwSize = GetCurrentDirectoryA(ARRAYSIZE(szExeName), szExeName);
if (dwSize > 0 && dwSize < ARRAYSIZE(szExeName)) {
Tblog("<t:Directory>%hs</t:Directory>\n", szExeName);
}
// Get the real executable name.
wzPath[0] = '\0';
if (GetModuleFileNameA(0, szExeName, ARRAYSIZE(szExeName))) {
FileInfo *pInfo = FileNames::FindPartial(szExeName);
Tblog("<t:Executable>%ls</t:Executable>\n",
FileNames::ParameterizeName(wzPath, ARRAYSIZE(wzPath), pInfo));
}
// Construct the processed command line.
PWCHAR pwzDstEnd = (PWCHAR)pwzLine;
PWCHAR pwzDst = pwzDstEnd;
pwzDst = LoadCommandLine(pwzLine, pwzDst, pwzDstEnd);
DWORD wcNew = (DWORD)((pwzDst - pwzDstEnd) + 1);
PWCHAR pwzFin = (PWCHAR)GlobalAlloc(GPTR, wcNew * sizeof(WCHAR));
pwzDst = pwzFin;
pwzDstEnd = pwzFin + wcNew;
pwzDst = LoadCommandLine(pwzLine, pwzDst, pwzDstEnd);
*pwzDst = '\0';
FileNames::ParameterizeLine(pwzFin, pwzFin + wcNew);
if (HasSpace(wzPath)) {
Tblog("<t:Line>&quot;%le&quot; %le</t:Line>\n", wzPath, pwzFin);
}
else {
Tblog("<t:Line>%le %le</t:Line>\n", wzPath, pwzFin);
}
TestHandle("t:StdIn", GetStdHandle(STD_INPUT_HANDLE));
TestHandle("t:StdOut", GetStdHandle(STD_OUTPUT_HANDLE));
TestHandle("t:StdErr", GetStdHandle(STD_ERROR_HANDLE));
}
if (FindMsvcr()) {
FindProc(&(PVOID&)Real_getenv, "getenv");
FindProc(&(PVOID&)Real_wgetenv, "_wgetenv");
FindProc(&(PVOID&)Real_getenv_s, "getenv_s");
FindProc(&(PVOID&)Real_wgetenv_s, "_wgetenv_s");
FindProc(&(PVOID&)Real_dupenv_s, "_dupenv_s");
FindProc(&(PVOID&)Real_wdupenv_s, "_wdupenv_s");
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttachIf(&(PVOID&)Real_getenv, Mine_getenv);
DetourAttachIf(&(PVOID&)Real_getenv_s, Mine_getenv_s);
DetourAttachIf(&(PVOID&)Real_wgetenv, Mine_wgetenv);
DetourAttachIf(&(PVOID&)Real_wgetenv, Mine_wgetenv_s);
DetourAttachIf(&(PVOID&)Real_dupenv_s, Mine_dupenv_s);
DetourAttachIf(&(PVOID&)Real_wdupenv_s, Mine_wdupenv_s);
DetourTransactionCommit();
}
return Real_EntryPoint();
}
VOID WINAPI Mine_ExitProcess(UINT a0)
{
if (a0 & 0x80000000) {
Tblog("<t:Return>%d</t:Return>\n", -(int)a0);
}
else {
Tblog("<t:Return>%d</t:Return>\n", a0);
}
FileNames::Dump();
EnvVars::Dump();
TblogClose();
Real_ExitProcess(a0);
}
BOOL APIENTRY DllMain(HINSTANCE hModule, DWORD dwReason, PVOID lpReserved)
{
(void)hModule;
(void)lpReserved;
if (DetourIsHelperProcess()) {
return TRUE;
}
if (dwReason == DLL_PROCESS_ATTACH) {
DetourRestoreAfterWith();
Real_EntryPoint = (int (WINAPI *)(VOID))DetourGetEntryPoint(NULL);
return ProcessAttach(hModule);
}
else if (dwReason == DLL_PROCESS_DETACH) {
return ProcessDetach(hModule);
}
else if (dwReason == DLL_THREAD_ATTACH) {
return ThreadAttach(hModule);
}
else if (dwReason == DLL_THREAD_DETACH) {
return ThreadDetach(hModule);
}
return TRUE;
}
//
///////////////////////////////////////////////////////////////// End of File.
Reference in New Issue View Git Blame Copy Permalink