-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathuwhook.cpp
More file actions
73 lines (58 loc) · 1.92 KB
/
uwhook.cpp
File metadata and controls
73 lines (58 loc) · 1.92 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
#include "uwhook.hpp"
#include <cstring>
#ifdef _WIN32
#include <windows.h>
#include <memoryapi.h>
#include <processthreadsapi.h>
#else
#include <sys/mman.h>
#include <unistd.h>
#include <fcntl.h>
#endif
#ifdef __clang__
__attribute__((used))
#endif
void *uwHookCallerRip;
#ifdef _WIN32
static bool write_memory(void *dest, const void *src, size_t len) {
SIZE_T writ = 0;
return WriteProcessMemory(GetCurrentProcess(), dest, src, len, &writ) && writ == len;
}
#else
static bool write_memory(void *dest, const void *src, size_t len) {
static int mem = open("/proc/self/mem", O_WRONLY);
if (mem < 0)
return false;
lseek(mem, reinterpret_cast<off_t>(dest), SEEK_SET);
if (write(mem, src, len) != len)
return false;
__builtin___clear_cache(reinterpret_cast<char *>(dest), reinterpret_cast<char *>(dest) + len);
return true;
}
#endif
UWHook::UWHook(void *fnc, void *hook, bool useTrampoline) : fnc(fnc), hook(hook), useTrampoline(useTrampoline) {
memcpy(original.data(), fnc, original_len);
restore();
}
void *UWHook::getTrampolineCaller() { return reinterpret_cast<uint8_t *>(uwHookCallerRip) - 6; }
bool UWHook::release() {
const bool success = write_memory(fnc, original.data(), original_len);
if (success)
released = true; // Hook is now inactive
return success;
}
bool UWHook::restore() {
uint8_t test[] = {0xff, static_cast<uint8_t>(useTrampoline ? 0x15 : 0x25), 0x00, 0x00, 0x00, 0x00, 0xef, 0xbe, 0xad, 0xde, 0xef, 0xbe, 0xad, 0xde};
static_assert(sizeof(test) == original_len);
memcpy(test + 6, &hook, 8);
const bool success = write_memory(fnc, test, sizeof(test));
if (success)
released = false; // Hook is now active
return success;
}
UWHookRelease::UWHookRelease(UWHook& hook) : hook(hook) { active = hook.isActive() && hook.release(); }
UWHookRelease::~UWHookRelease() {
if (active)
hook.restore();
}
void UWHook::noop() {}