detours 0.2.0

Detours is a software package for monitoring and instrumenting API calls on Windows.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130

//////////////////////////////////////////////////////////////////////////////
//
//  Detour Test Program (slept.cpp of slept.dll)
//
//  Microsoft Research Detours Package
//
//  Copyright (c) Microsoft Corporation.  All rights reserved.
//
#include <stdio.h>
#include <windows.h>
#include "detours.h"
#include "slept.h"

#include "verify.cpp"

static BOOL fBroke = FALSE;
static LONG dwSlept = 0;
static DWORD (WINAPI * TrueSleepEx)(DWORD dwMilliseconds, BOOL bAlertable) = SleepEx;

DWORD WINAPI UntimedSleepEx(DWORD dwMilliseconds, BOOL bAlertable)
{
    return TrueSleepEx(dwMilliseconds, bAlertable);
}

DWORD WINAPI TimedSleepEx(DWORD dwMilliseconds, BOOL bAlertable)
{
    DWORD dwBeg = GetTickCount();
    DWORD ret = TrueSleepEx(dwMilliseconds, bAlertable);
    DWORD dwEnd = GetTickCount();

    if (!fBroke) {
        fBroke = TRUE;
        // DebugBreak();
    }

    InterlockedExchangeAdd(&dwSlept, dwEnd - dwBeg);
    return ret;
}

DWORD WINAPI GetSleptTicks(VOID)
{
    return dwSlept;
}

DWORD WINAPI TestTicks(VOID)
{
    return TestTicksEx(0);
}

DWORD WINAPI TestTicksEx(DWORD Add)
{
    PDWORD pdw = new DWORD [Add + 1];

    if (pdw != NULL) {
        pdw[0] = dwSlept;
        for (DWORD n = 1; n < Add + 1; n++) {
            pdw[n] = pdw[n-1] + 1;
        }

        for (DWORD n = 1; n < Add + 1; n++) {
            pdw[n-1] = pdw[n-1] - 1;
        }

        for (DWORD n = 1; n < Add + 1; n++) {
            pdw[n] = pdw[n-1] + 1;
        }

        Add = pdw[Add] - Add;

        delete [] pdw;
    }
    else {
        Add = dwSlept + Add;
    }

    return Add;
}

BOOL WINAPI DllMain(HINSTANCE hinst, DWORD dwReason, LPVOID reserved)
{
    LONG error;
    (void)hinst;
    (void)reserved;

    if (DetourIsHelperProcess()) {
        return TRUE;
    }

    if (dwReason == DLL_PROCESS_ATTACH) {
        DetourRestoreAfterWith();

        printf("slept" DETOURS_STRINGIFY(DETOURS_BITS) ".dll: "
               " Starting.\n");
        PVOID pbExeEntry = DetourGetEntryPoint(NULL);
        PVOID pbDllEntry = DetourGetEntryPoint(hinst);
        printf("slept" DETOURS_STRINGIFY(DETOURS_BITS) ".dll: "
               " ExeEntry=%p, DllEntry=%p\n", pbExeEntry, pbDllEntry);

        Verify("SleepEx", (PVOID)SleepEx);
        printf("\n");
        fflush(stdout);

        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)TrueSleepEx, TimedSleepEx);
        error = DetourTransactionCommit();

        if (error == NO_ERROR) {
            printf("slept" DETOURS_STRINGIFY(DETOURS_BITS) ".dll: "
                   " Detoured SleepEx() @ %p.\n", TrueSleepEx);
        }
        else {
            printf("slept" DETOURS_STRINGIFY(DETOURS_BITS) ".dll: "
                   " Error detouring SleepEx(): %ld\n", error);
        }
    }
    else if (dwReason == DLL_PROCESS_DETACH) {
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourDetach(&(PVOID&)TrueSleepEx, TimedSleepEx);
        error = DetourTransactionCommit();
        printf("slept" DETOURS_STRINGIFY(DETOURS_BITS) ".dll: "
               " Removed SleepEx() detour (%ld), slept %ld ticks.\n", error, dwSlept);
        fflush(stdout);
    }
    return TRUE;
}

//
///////////////////////////////////////////////////////////////// End of File.