detours 0.2.0

Detours is a software package for monitoring and instrumenting API calls on Windows.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

//////////////////////////////////////////////////////////////////////////////
//
//  Unit Test Image Corruptor (corruptor.cpp of unittests.exe)
//
//  Microsoft Research Detours Package
//
//  Copyright (c) Microsoft Corporation.  All rights reserved.
//
#include "windows.h"
#include "corruptor.h"

ImageCorruptor::ImageCorruptor(PIMAGE_DOS_HEADER Header)
{
    m_TargetDosHeader = Header;
    m_OriginalDosHeader = *Header;
    m_OriginalDosProtection = 0;
    m_TargetNtHeaders = (PIMAGE_NT_HEADERS)((PBYTE)Header + Header->e_lfanew);
    m_OriginalNtHeaders = *m_TargetNtHeaders;
    m_OriginalNtProtection = 0;

    VirtualProtect(
            m_TargetDosHeader,
            sizeof(*m_TargetDosHeader),
            PAGE_READWRITE,
            &m_OriginalDosProtection);

    VirtualProtect(
            m_TargetNtHeaders,
            sizeof(*m_TargetNtHeaders),
            PAGE_READWRITE,
            &m_OriginalNtProtection);
}

ImageCorruptor::~ImageCorruptor()
{
    // Restore original header contents.
    //
    *m_TargetDosHeader = m_OriginalDosHeader;
    *m_TargetNtHeaders = m_OriginalNtHeaders;

    // Restore original protection of DOS header.
    //
    DWORD OldProtection {};
    VirtualProtect(
            m_TargetDosHeader,
            sizeof(*m_TargetDosHeader),
            m_OriginalDosProtection,
            &OldProtection);

    // Restore original protection of NT headers.
    //
    VirtualProtect(
            m_TargetNtHeaders,
            sizeof(*m_TargetNtHeaders),
            m_OriginalNtProtection,
            &OldProtection);
}

void ImageCorruptor::ModifyDosMagic(WORD Value)
{
    m_TargetDosHeader->e_magic = Value;
}

void ImageCorruptor::ModifyNtSignature(ULONG Value)
{
    m_TargetNtHeaders->Signature = Value;
}