MCPcopy Create free account
hub / github.com/BeneficialCode/WinArk / DetourDetach

Function DetourDetach

KernelLibrary/detours.cpp:1065–1136  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

1063}
1064
1065NTSTATUS NTAPI DetourDetach(_Inout_ PVOID* ppPointer,
1066 _In_ PVOID pDetour) {
1067 NTSTATUS error = STATUS_SUCCESS;
1068
1069 if (pDetour == nullptr) {
1070 return STATUS_INVALID_HANDLE;
1071 }
1072 if (ppPointer == NULL) {
1073 return STATUS_INVALID_HANDLE;
1074 }
1075 if (*ppPointer == NULL) {
1076 error = STATUS_INVALID_HANDLE;
1077 DbgBreakPoint();
1078 return error;
1079 }
1080
1081 DetourOperation* o = new (NonPagedPool) DetourOperation;
1082 if (o == NULL) {
1083 error = STATUS_NO_MEMORY;
1084 fail:
1085 DbgBreakPoint();
1086 stop:
1087 if (o != NULL) {
1088 delete o;
1089 o = NULL;
1090 }
1091 return error;
1092 }
1093
1094#ifdef DETOURS_IA64
1095
1096#else // !DETOURS_IA64
1097 PDETOUR_TRAMPOLINE pTrampoline =
1098 (PDETOUR_TRAMPOLINE)DetourCodeFromPointer(*ppPointer, NULL);
1099 pDetour = DetourCodeFromPointer(pDetour, NULL);
1100#endif // !DETOURS_IA64
1101
1102 ////////////////////////////////////// Verify that Trampoline is in place.
1103 //
1104 LONG target = pTrampoline->cbRestore;
1105 PUCHAR pTarget = pTrampoline->pRemain - target;
1106 if (target == 0 || target > sizeof(pTrampoline->rbCode)) {
1107 error = STATUS_INVALID_BLOCK_LENGTH;
1108 if (s_fIgnoreTooSmall) {
1109 goto stop;
1110 }
1111 else {
1112 DbgBreakPoint();
1113 goto fail;
1114 }
1115 }
1116
1117 if (pTrampoline->pDetour != pDetour) {
1118 error = STATUS_INVALID_BLOCK_LENGTH;
1119 if (s_fIgnoreTooSmall) {
1120 goto stop;
1121 }
1122 else {

Callers 3

UnbypassMethod · 0.85
UnbypassMethod · 0.85
UnhookDbgSysMethod · 0.85

Calls 1

DetourCodeFromPointerFunction · 0.85

Tested by

no test coverage detected