/*Copyright (c) 2009, Tom Wright All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * The name of Tom Wright may not be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ using System; using System.Runtime.InteropServices; using System.Text; using System.Diagnostics; using System.Threading; using System.Collections.Generic; [StructLayout(LayoutKind.Sequential, Pack=1)] unsafe public struct DosHeader { public ushort e_magic; // Magic number char e_cblp; // Bytes on last page of file char e_cp; // Pages in file char e_crlc; // Relocations char e_cparhdr; // Size of header in paragraphs char e_minalloc; // Minimum extra paragraphs needed char e_maxalloc; // Maximum extra paragraphs needed char e_ss; // Initial (relative) SS value char e_sp; // Initial SP value char e_csum; // Checksum char e_ip; // Initial IP value char e_cs; // Initial (relative) CS value char e_lfarlc; // File address of relocation table char e_ovno; // Overlay number fixed char e_reos[4]; // Reserved words char e_oemid; // OEM identifier (for e_oeminfo) char e_oeminfo; // OEM information; e_oemid specific fixed char e_res2[10]; // Reserved words public int pe_header_off; // File address of new exe header } unsafe class PatchedDll { [DllImport("kernel32.dll")] static extern IntPtr LoadLibrary(string s); static int PE_HEADER_IMPORT_TABLE_OFF = 0x80; static int IMPORT_NAME_NAME_OFFSET = 2; static int IMPORT_POINTER_TABLE_OFF = 16; public byte* base_address; public byte* import_table; public int* pointer_table; public int* name_table; public PatchedDll(string libraryName) { DosHeader* header = (DosHeader*) LoadLibrary(libraryName); this.base_address = (byte*) header; int magic = * (int*) (base_address + header->pe_header_off); if(magic != 17744){ throw new Exception("wrong magic number for PE header"); } int import_table_offset = * (int *) (base_address + header->pe_header_off + PE_HEADER_IMPORT_TABLE_OFF); this.import_table = base_address + import_table_offset; int pointer_table_off = *( (int*) (import_table + IMPORT_POINTER_TABLE_OFF)); this.pointer_table = (int*) (base_address + pointer_table_off); int name_table_off = *((int *) import_table); this.name_table = (int*) (base_address + name_table_off); } unsafe public Dictionary GetSymbolIndexes(Dictionary patchings) { int* entry = this.name_table; Dictionary symbolIndexes = new Dictionary (); int index = 0; while((*entry) != 0){ if (*entry >> 31 != 0){ entry++; index++; continue; } byte* name = (byte*) base_address + *entry + IMPORT_NAME_NAME_OFFSET; string nameStr = Marshal.PtrToStringAnsi(new IntPtr(name)); Console.WriteLine("testing name: {0}", nameStr); if (patchings.ContainsKey(nameStr)){ Console.WriteLine("Found match"); symbolIndexes[nameStr] = index; } index++; entry++; } return symbolIndexes; } unsafe static public void Patch(string libraryName, Dictionary patchings) { PatchedDll dll = new PatchedDll(libraryName); Dictionary symbolIndexes = dll.GetSymbolIndexes(patchings); foreach (string name in new List(symbolIndexes.Keys)){ dll.pointer_table[symbolIndexes[name]] = (int) Marshal.GetFunctionPointerForDelegate((Delegate) patchings[name]); symbolIndexes.Remove(name); } if (symbolIndexes.Count != 0){ throw new Exception("Could not patch all symbols - dll is half-patched."); } } }