@@ -51,56 +51,67 @@ BOOL DllMain(HINSTANCE hInstance, ULONG ulReason, LPVOID pvReserved)
51
51
g_hInst = hInstance;
52
52
if (ulReason == DLL_PROCESS_ATTACH )
53
53
{
54
- RedirectCreateFileA();
55
- RedirectCreateFileW();
54
+ if (dumpFile[0 ]) // only execute if it was injected by pipedmd
55
+ {
56
+ // origWriteFile = getWriteFileFunc();
57
+ RedirectCreateFileA();
58
+ RedirectCreateFileW();
59
+ }
56
60
}
57
61
return true ;
58
62
}
59
63
60
64
alias typeof (&CreateFileA) fnCreateFileA;
61
65
alias typeof (&CreateFileW) fnCreateFileW;
66
+ alias typeof (&WriteFile) fnWriteFile;
62
67
__gshared fnCreateFileA origCreateFileA;
63
68
__gshared fnCreateFileW origCreateFileW;
69
+ __gshared fnWriteFile origWriteFile;
70
+
71
+ __gshared fnCreateFileA myCF = &MyCreateFileA;
64
72
65
73
alias typeof (&VirtualProtect) fnVirtualProtect;
66
74
67
- void RedirectCreateFileA ()
75
+ fnVirtualProtect getVirtualProtectFunc ()
68
76
{
69
- version (msgbox) MessageBoxA(null , " RedirectCreateFileA" , " filemonitor" , MB_OK );
70
- ubyte * jmpAdr = cast (ubyte * )&CreateFileA;
71
- auto impTableEntry = cast (fnCreateFileA* ) (* cast (void ** )(jmpAdr + 2 ));
72
- origCreateFileA = * impTableEntry;
73
-
74
- DWORD oldProtect, newProtect;
75
77
version (all )
76
78
{
77
- VirtualProtect(impTableEntry, (* impTableEntry).sizeof, PAGE_READWRITE , &oldProtect);
78
- * impTableEntry = &MyCreateFileA;
79
- VirtualProtect(impTableEntry, (* impTableEntry).sizeof, oldProtect, &newProtect);
79
+ HANDLE krnl = GetModuleHandleA(" kernel32.dll" );
80
+ return cast (fnVirtualProtect) GetProcAddress(krnl, " VirtualProtect" );
80
81
}
81
82
else
82
83
{
83
- char [16 ] func;
84
- char * p = func.ptr;
85
- mixin ({
86
- string s;
87
- foreach (c; [ ' V' ,' i' ,' r' ,' t' ,' u' ,' a' ,' l' ,' P' ,' r' ,' o' ,' t' ,' e' ,' c' ,' t' ])
88
- { s ~= " *p++ = '" ; s ~= c; s ~= " ';" ; }
89
- return s;
90
- }());
91
- * p = 0 ;
84
+ return &VirtualProtect;
85
+ }
86
+ }
92
87
88
+ fnWriteFile getWriteFileFunc ()
89
+ {
90
+ version (all )
91
+ {
93
92
HANDLE krnl = GetModuleHandleA(" kernel32.dll" );
94
- if (fnVirtualProtect fn = cast (fnVirtualProtect) GetProcAddress(krnl, func.ptr))
95
- {
96
- DWORD oldProtect, newProtect;
97
- fn(impTableEntry, (* impTableEntry).sizeof, PAGE_READWRITE , &oldProtect);
98
- * impTableEntry = &MyCreateFileA;
99
- fn(impTableEntry, (* impTableEntry).sizeof, oldProtect, &newProtect);
100
- }
93
+ return cast (fnWriteFile) GetProcAddress(krnl, " WriteFile" );
94
+ }
95
+ else
96
+ {
97
+ return &WriteFile;
101
98
}
102
99
}
103
100
101
+ void RedirectCreateFileA ()
102
+ {
103
+ version (msgbox) MessageBoxA(null , " RedirectCreateFileA" , " filemonitor" , MB_OK );
104
+ ubyte * jmpAdr = cast (ubyte * )&CreateFileA;
105
+ auto impTableEntry = cast (fnCreateFileA* ) (* cast (void ** )(jmpAdr + 2 ));
106
+ origCreateFileA = * impTableEntry;
107
+
108
+ DWORD oldProtect, newProtect;
109
+ auto pfnVirtualProtect = getVirtualProtectFunc();
110
+ pfnVirtualProtect(impTableEntry, (* impTableEntry).sizeof, PAGE_READWRITE , &oldProtect);
111
+ * impTableEntry = &MyCreateFileA;
112
+ pfnVirtualProtect(impTableEntry, (* impTableEntry).sizeof, oldProtect, &newProtect);
113
+ }
114
+
104
115
void RedirectCreateFileW ()
105
116
{
106
117
version (msgbox) MessageBoxA(null , " RedirectCreateFileW" , " filemonitor" , MB_OK );
@@ -109,12 +120,10 @@ void RedirectCreateFileW()
109
120
origCreateFileW = * impTableEntry;
110
121
111
122
DWORD oldProtect, newProtect;
112
- version (all )
113
- {
114
- VirtualProtect(impTableEntry, (* impTableEntry).sizeof, PAGE_READWRITE , &oldProtect);
115
- * impTableEntry = &MyCreateFileW;
116
- VirtualProtect(impTableEntry, (* impTableEntry).sizeof, oldProtect, &newProtect);
117
- }
123
+ auto pfnVirtualProtect = getVirtualProtectFunc();
124
+ pfnVirtualProtect(impTableEntry, (* impTableEntry).sizeof, PAGE_READWRITE , &oldProtect);
125
+ * impTableEntry = &MyCreateFileW;
126
+ pfnVirtualProtect(impTableEntry, (* impTableEntry).sizeof, oldProtect, &newProtect);
118
127
}
119
128
120
129
extern (Windows ) HANDLE
@@ -146,8 +155,8 @@ MyCreateFileA(
146
155
WaitForSingleObject(hndMutex, INFINITE );
147
156
148
157
size_t length = mystrlen(lpFileName);
149
- WriteFile (hndDumpFile, lpFileName, length, &length, null );
150
- WriteFile (hndDumpFile, " \n " .ptr, 1 , &length, null );
158
+ origWriteFile (hndDumpFile, lpFileName, length, &length, null );
159
+ origWriteFile (hndDumpFile, " \n " .ptr, 1 , &length, null );
151
160
152
161
if (hndMutex != INVALID_HANDLE_VALUE )
153
162
ReleaseMutex(hndMutex);
@@ -185,7 +194,7 @@ MyCreateFileW(
185
194
ushort bom = 0xFEFF ;
186
195
size_t written;
187
196
if (hndDumpFile != INVALID_HANDLE_VALUE )
188
- WriteFile (hndDumpFile, &bom, 2 , &written, null );
197
+ origWriteFile (hndDumpFile, &bom, 2 , &written, null );
189
198
190
199
if (hndMutex != INVALID_HANDLE_VALUE )
191
200
ReleaseMutex(hndMutex);
@@ -197,8 +206,8 @@ MyCreateFileW(
197
206
WaitForSingleObject(hndMutex, INFINITE );
198
207
199
208
size_t length = mystrlen(lpFileName);
200
- WriteFile (hndDumpFile, lpFileName, 2 * length, &length, null );
201
- WriteFile (hndDumpFile, " \n " .ptr, 2 , &length, null );
209
+ origWriteFile (hndDumpFile, lpFileName, 2 * length, &length, null );
210
+ origWriteFile (hndDumpFile, " \n " .ptr, 2 , &length, null );
202
211
203
212
if (hndMutex != INVALID_HANDLE_VALUE )
204
213
ReleaseMutex(hndMutex);
@@ -239,6 +248,7 @@ size_t mystrlen(const(wchar)* str) nothrow
239
248
// /////// shut up compiler generated GC info failing to link
240
249
extern (C )
241
250
{
251
+ __gshared int D10TypeInfo_i6__initZ;
242
252
__gshared int D10TypeInfo_v6__initZ;
243
253
__gshared int D16TypeInfo_Pointer6__vtblZ;
244
254
__gshared int D17TypeInfo_Function6__vtblZ;
0 commit comments