@@ -51,56 +51,67 @@ BOOL DllMain(HINSTANCE hInstance, ULONG ulReason, LPVOID pvReserved)
5151 g_hInst = hInstance;
5252 if (ulReason == DLL_PROCESS_ATTACH )
5353 {
54- RedirectCreateFileA();
55- RedirectCreateFileW();
54+ if (dumpFile[0 ]) // only execute if it was injected by pipedmd
55+ {
56+ // origWriteFile = getWriteFileFunc();
57+ RedirectCreateFileA();
58+ RedirectCreateFileW();
59+ }
5660 }
5761 return true ;
5862}
5963
6064alias typeof (&CreateFileA) fnCreateFileA;
6165alias typeof (&CreateFileW) fnCreateFileW;
66+ alias typeof (&WriteFile) fnWriteFile;
6267__gshared fnCreateFileA origCreateFileA;
6368__gshared fnCreateFileW origCreateFileW;
69+ __gshared fnWriteFile origWriteFile;
70+
71+ __gshared fnCreateFileA myCF = &MyCreateFileA;
6472
6573alias typeof (&VirtualProtect) fnVirtualProtect;
6674
67- void RedirectCreateFileA ()
75+ fnVirtualProtect getVirtualProtectFunc ()
6876{
69- version (msgbox) MessageBoxA(null , " RedirectCreateFileA" , " filemonitor" , MB_OK );
70- ubyte * jmpAdr = cast (ubyte * )&CreateFileA;
71- auto impTableEntry = cast (fnCreateFileA* ) (* cast (void ** )(jmpAdr + 2 ));
72- origCreateFileA = * impTableEntry;
73-
74- DWORD oldProtect, newProtect;
7577 version (all )
7678 {
77- VirtualProtect(impTableEntry, (* impTableEntry).sizeof, PAGE_READWRITE , &oldProtect);
78- * impTableEntry = &MyCreateFileA;
79- VirtualProtect(impTableEntry, (* impTableEntry).sizeof, oldProtect, &newProtect);
79+ HANDLE krnl = GetModuleHandleA(" kernel32.dll" );
80+ return cast (fnVirtualProtect) GetProcAddress(krnl, " VirtualProtect" );
8081 }
8182 else
8283 {
83- char [16 ] func;
84- char * p = func.ptr;
85- mixin ({
86- string s;
87- foreach (c; [ ' V' ,' i' ,' r' ,' t' ,' u' ,' a' ,' l' ,' P' ,' r' ,' o' ,' t' ,' e' ,' c' ,' t' ])
88- { s ~= " *p++ = '" ; s ~= c; s ~= " ';" ; }
89- return s;
90- }());
91- * p = 0 ;
84+ return &VirtualProtect;
85+ }
86+ }
9287
88+ fnWriteFile getWriteFileFunc ()
89+ {
90+ version (all )
91+ {
9392 HANDLE krnl = GetModuleHandleA(" kernel32.dll" );
94- if (fnVirtualProtect fn = cast (fnVirtualProtect) GetProcAddress(krnl, func.ptr))
95- {
96- DWORD oldProtect, newProtect;
97- fn(impTableEntry, (* impTableEntry).sizeof, PAGE_READWRITE , &oldProtect);
98- * impTableEntry = &MyCreateFileA;
99- fn(impTableEntry, (* impTableEntry).sizeof, oldProtect, &newProtect);
100- }
93+ return cast (fnWriteFile) GetProcAddress(krnl, " WriteFile" );
94+ }
95+ else
96+ {
97+ return &WriteFile;
10198 }
10299}
103100
101+ void RedirectCreateFileA ()
102+ {
103+ version (msgbox) MessageBoxA(null , " RedirectCreateFileA" , " filemonitor" , MB_OK );
104+ ubyte * jmpAdr = cast (ubyte * )&CreateFileA;
105+ auto impTableEntry = cast (fnCreateFileA* ) (* cast (void ** )(jmpAdr + 2 ));
106+ origCreateFileA = * impTableEntry;
107+
108+ DWORD oldProtect, newProtect;
109+ auto pfnVirtualProtect = getVirtualProtectFunc();
110+ pfnVirtualProtect(impTableEntry, (* impTableEntry).sizeof, PAGE_READWRITE , &oldProtect);
111+ * impTableEntry = &MyCreateFileA;
112+ pfnVirtualProtect(impTableEntry, (* impTableEntry).sizeof, oldProtect, &newProtect);
113+ }
114+
104115void RedirectCreateFileW ()
105116{
106117 version (msgbox) MessageBoxA(null , " RedirectCreateFileW" , " filemonitor" , MB_OK );
@@ -109,12 +120,10 @@ void RedirectCreateFileW()
109120 origCreateFileW = * impTableEntry;
110121
111122 DWORD oldProtect, newProtect;
112- version (all )
113- {
114- VirtualProtect(impTableEntry, (* impTableEntry).sizeof, PAGE_READWRITE , &oldProtect);
115- * impTableEntry = &MyCreateFileW;
116- VirtualProtect(impTableEntry, (* impTableEntry).sizeof, oldProtect, &newProtect);
117- }
123+ auto pfnVirtualProtect = getVirtualProtectFunc();
124+ pfnVirtualProtect(impTableEntry, (* impTableEntry).sizeof, PAGE_READWRITE , &oldProtect);
125+ * impTableEntry = &MyCreateFileW;
126+ pfnVirtualProtect(impTableEntry, (* impTableEntry).sizeof, oldProtect, &newProtect);
118127}
119128
120129extern (Windows ) HANDLE
@@ -146,8 +155,8 @@ MyCreateFileA(
146155 WaitForSingleObject(hndMutex, INFINITE );
147156
148157 size_t length = mystrlen(lpFileName);
149- WriteFile (hndDumpFile, lpFileName, length, &length, null );
150- WriteFile (hndDumpFile, " \n " .ptr, 1 , &length, null );
158+ origWriteFile (hndDumpFile, lpFileName, length, &length, null );
159+ origWriteFile (hndDumpFile, " \n " .ptr, 1 , &length, null );
151160
152161 if (hndMutex != INVALID_HANDLE_VALUE )
153162 ReleaseMutex(hndMutex);
@@ -185,7 +194,7 @@ MyCreateFileW(
185194 ushort bom = 0xFEFF ;
186195 size_t written;
187196 if (hndDumpFile != INVALID_HANDLE_VALUE )
188- WriteFile (hndDumpFile, &bom, 2 , &written, null );
197+ origWriteFile (hndDumpFile, &bom, 2 , &written, null );
189198
190199 if (hndMutex != INVALID_HANDLE_VALUE )
191200 ReleaseMutex(hndMutex);
@@ -197,8 +206,8 @@ MyCreateFileW(
197206 WaitForSingleObject(hndMutex, INFINITE );
198207
199208 size_t length = mystrlen(lpFileName);
200- WriteFile (hndDumpFile, lpFileName, 2 * length, &length, null );
201- WriteFile (hndDumpFile, " \n " .ptr, 2 , &length, null );
209+ origWriteFile (hndDumpFile, lpFileName, 2 * length, &length, null );
210+ origWriteFile (hndDumpFile, " \n " .ptr, 2 , &length, null );
202211
203212 if (hndMutex != INVALID_HANDLE_VALUE )
204213 ReleaseMutex(hndMutex);
@@ -239,6 +248,7 @@ size_t mystrlen(const(wchar)* str) nothrow
239248// /////// shut up compiler generated GC info failing to link
240249extern (C )
241250{
251+ __gshared int D10TypeInfo_i6__initZ;
242252 __gshared int D10TypeInfo_v6__initZ;
243253 __gshared int D16TypeInfo_Pointer6__vtblZ;
244254 __gshared int D17TypeInfo_Function6__vtblZ;
0 commit comments