detours 0.2.0

Detours is a software package for monitoring and instrumenting API calls on Windows.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

#define _CRT_RAND_S

#include <stdlib.h>

#include <iostream>
#include <windows.h>
#include <detours.h>

#include "payloadguid.hpp"

HANDLE hParent = NULL;

__declspec(noreturn) void HandleApiFailure(const char* api)
{
    DWORD lastErr = GetLastError();
    std::cout << "payloadtarget.exe: " << api << " failed (" << lastErr << ')' << std::endl;

    if (hParent)
    {
        CloseHandle(hParent);
    }

    ExitProcess(1);
}

int main()
{
    DWORD payloadSize;
    void* payloadAddr = DetourFindPayloadEx(PARENT_HANDLE_PAYLOAD, &payloadSize);
    if (!payloadAddr || payloadSize != sizeof(HANDLE))
    {
        HandleApiFailure("DetourFindPayloadEx");
    }

    hParent = *static_cast<HANDLE*>(payloadAddr);

    DWORD randomPayloadSize;
    void* randomPayload = DetourFindRemotePayload(hParent, RANDOM_DATA_PAYLOAD, &randomPayloadSize);
    if (!randomPayload || randomPayloadSize != sizeof(random_payload_t))
    {
        HandleApiFailure("DetourFindRemotePayload");
    }

    random_payload_t randomData;
    if (rand_s(&randomData) != 0)
    {
        HandleApiFailure("rand_s");
    }


    if (!WriteProcessMemory(hParent, randomPayload, &randomData, sizeof(randomData), NULL))
    {
        HandleApiFailure("WriteProcessMemory");
    }

    CloseHandle(hParent);
    hParent = NULL;

    // conversion to int return type is potentially undefined
    ExitProcess(randomData);
}