shadowMap/shadowMap.cpp at master · luciouskami/shadowMap · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159

#include <windows.h>
#include <vector>
#include <assert.h>

#include "shadowMap.h"


PVOID							g_mapAddress;
std::vector<SHADOW_MAP_TABLE>	g_mapTable;


/**
 * VEH
 */
LONG WINAPI VEH(PEXCEPTION_POINTERS ExceptionInfo)
{
	PVOID	crashAddr = ExceptionInfo->ExceptionRecord->ExceptionAddress;

	for (auto secinfo : g_mapTable)
	{
		if (secinfo.realAddress <= (ULONG_PTR)crashAddr &&
			(secinfo.realAddress + secinfo.realSize) >= (ULONG_PTR)crashAddr)
		{

#ifdef _WIN64
			ExceptionInfo->ContextRecord->Rip = \
				(ULONG_PTR)crashAddr - secinfo.realAddress + secinfo.mapAddress;
#else
			ExceptionInfo->ContextRecord->Eip = \
				(ULONG_PTR)crashAddr - secinfo.realAddress + secinfo.mapAddress;
#endif

			return EXCEPTION_CONTINUE_EXECUTION;
		}


		if (secinfo.mapAddress <= (ULONG_PTR)crashAddr &&
			(secinfo.mapAddress + secinfo.mapSize) >= (ULONG_PTR)crashAddr)
		{

#ifdef _WIN64
			ExceptionInfo->ContextRecord->Rip = \
				(ULONG_PTR)crashAddr - secinfo.mapAddress + secinfo.realAddress;
			ExceptionInfo->ExceptionRecord->ExceptionAddress = (PVOID) \
				((ULONG_PTR)crashAddr - secinfo.mapAddress + secinfo.realAddress);

#else
			ExceptionInfo->ContextRecord->Eip = \
				(ULONG_PTR)crashAddr - secinfo.mapAddress + secinfo.realAddress;
			ExceptionInfo->ExceptionRecord->ExceptionAddress = (PVOID) \
				((ULONG_PTR)crashAddr - secinfo.mapAddress + secinfo.realAddress);
#endif

			return EXCEPTION_CONTINUE_EXECUTION;
		}

	}

	return EXCEPTION_CONTINUE_SEARCH;
}


/**
* °²×°hook
*/
BOOL WINAPI shadowMap_InstallHook(HMODULE hModule)
{
	assert(hModule);

	PIMAGE_DOS_HEADER		doshead_ptr;
	PIMAGE_NT_HEADERS		nthead_ptr;
	PIMAGE_SECTION_HEADER	sec_ptr;
	SHADOW_MAP_TABLE		shadow_section;
	HANDLE					hProcess;

	doshead_ptr = (PIMAGE_DOS_HEADER)hModule;
	if (doshead_ptr->e_magic != IMAGE_DOS_SIGNATURE)
	{
		return FALSE;
	}

	nthead_ptr = (PIMAGE_NT_HEADERS)((ULONG_PTR)hModule + doshead_ptr->e_lfanew);
	if (nthead_ptr->Signature != IMAGE_NT_SIGNATURE)
	{
		return FALSE;
	}

	g_mapAddress = VirtualAlloc(NULL, nthead_ptr->OptionalHeader.SizeOfImage, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
	if (g_mapAddress == NULL)
	{
		return FALSE;
	}

	sec_ptr = IMAGE_FIRST_SECTION(nthead_ptr);

	g_mapTable.clear();
	AddVectoredExceptionHandler(0, VEH);
	hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId());

	for (int i = 0; i < nthead_ptr->FileHeader.NumberOfSections; i++)
	{
		if (sec_ptr->Characteristics & IMAGE_SCN_MEM_EXECUTE)
		{
			shadow_section.mapAddress = (ULONG_PTR)g_mapAddress + sec_ptr->VirtualAddress;
			shadow_section.mapSize = sec_ptr->Misc.VirtualSize;
			shadow_section.realAddress = (ULONG_PTR)hModule + sec_ptr->VirtualAddress;
			shadow_section.realSize = sec_ptr->Misc.VirtualSize;
			shadow_section.oldProtect = sec_ptr->Characteristics;

			memcpy((void*)shadow_section.mapAddress,
				   (void*)shadow_section.realAddress,
				   sec_ptr->Misc.VirtualSize);


			g_mapTable.push_back(shadow_section);
		}
		sec_ptr++;
	}


	for (auto secinfo:g_mapTable)
	{
		VirtualProtectEx(hProcess, (LPVOID)secinfo.realAddress,
						 secinfo.realSize,
						 PAGE_READONLY,
						 &secinfo.oldProtect);
	}

	CloseHandle(hProcess);

	return TRUE;
}

/**
* Ð¶ÔØHook
*/
BOOL WINAPI shadowMap_UnloadHook()
{
	return TRUE;
}

/**
* ¶ÁshadowMapÄÚ´æ
*/
BOOL WINAPI shadowMap_ReadMem(PVOID addr, UCHAR *buf, ULONG size)
{
	return TRUE;
}

/**
* Ð´shadowMapÄÚ´æ
*/
BOOL WINAPI shadowMap_WriteMem(PVOID addr, UCHAR *buf, ULONG size)
{
	return TRUE;
}