detours 0.2.0

Detours is a software package for monitoring and instrumenting API calls on Windows.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104

//////////////////////////////////////////////////////////////////////////////
//
//  Test the different system region bounds (region.cpp of region.exe)
//
//  Microsoft Research Detours Package
//
//  Copyright (c) Microsoft Corporation.  All rights reserved.
//
#include <stdio.h>

#include <windows.h>
#include <detours.h>

//////////////////////////////////////////////////////////////////////////////
//
static DWORD (WINAPI * TrueSleepEx)(DWORD dwMilliseconds, BOOL bAlertable) = SleepEx;

DWORD WINAPI LoudSleepEx(DWORD dwMilliseconds, BOOL bAlertable)
{
    DWORD dwBeg = GetTickCount();
    DWORD ret = TrueSleepEx(dwMilliseconds, bAlertable);
    DWORD dwEnd = GetTickCount();

    printf("Slept %lu ticks.\n", dwEnd - dwBeg);
    return ret;
}

//////////////////////////////////////////////////////////////////////////////
//
PVOID AttachAndDetach(DWORD dwMilliseconds)
{
    LONG error;
    PVOID trampoline;

    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourAttach(&(PVOID&)TrueSleepEx, LoudSleepEx);
    error = DetourTransactionCommit();

    printf("Attach: %ld, Trampoline: %p\n", error, TrueSleepEx);

    trampoline = TrueSleepEx;

    printf("\n");
    printf("Sleep(%lu)\n", dwMilliseconds);
    Sleep(dwMilliseconds);
    printf("\n");

    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourDetach(&(PVOID&)TrueSleepEx, LoudSleepEx);
    error = DetourTransactionCommit();

    return trampoline;
}

int main(int argc, char **argv)
{
    (void)argc;
    (void)argv;

    // First, save the default system region.

    PVOID pDefaultLower = DetourSetSystemRegionLowerBound(NULL);
    PVOID pDefaultUpper = DetourSetSystemRegionUpperBound(NULL);

    // Now attach the detour with the default system region.

    DetourSetSystemRegionLowerBound(pDefaultLower);
    DetourSetSystemRegionUpperBound(pDefaultUpper);

    printf("%p..%p: ", pDefaultLower, pDefaultUpper);
    PVOID pTramp1 = AttachAndDetach(10);

    printf("%p..%p: ", pDefaultLower, pDefaultUpper);
    PVOID pTramp2 = AttachAndDetach(10);

    // Now attach the detour with a smaller system region.

    PVOID pSmallerLower = (PVOID)( ((ULONG_PTR)pTramp1) & ~(ULONG_PTR)0x3fffffff );
    PVOID pSmallerUpper = (PVOID)( ((ULONG_PTR)pTramp1 + 0x3fffffff) & ~(ULONG_PTR)0x3fffffff );

    DetourSetSystemRegionLowerBound(pSmallerLower);
    DetourSetSystemRegionUpperBound(pSmallerUpper);

    printf("%p..%p: ", pSmallerLower, pSmallerUpper);
    PVOID pTramp3 = AttachAndDetach(20);

    printf("Sleep(30)\n");
    Sleep(30);
    printf("\n");

    if (pTramp1 != pTramp2) {
        printf("!!!!!! Trampoling allocation is not deterministic.  %p != %p\n", pTramp1, pTramp2);
        return 1;
    }
    else if (pTramp2 == pTramp3) {
        printf("!!!!!! Trampoling allocation doesn't skip region.  %p == %p\n", pTramp2, pTramp3);
        return 2;
    }

    return 0;
}