| 19 | static DetourOperation* s_pPendingOperations = nullptr; |
| 20 | |
| 21 | bool DetourIsImported(PUCHAR pCode, PUCHAR pAddress) { |
| 22 | MEMORY_BASIC_INFORMATION mbi; |
| 23 | SIZE_T len; |
| 24 | NTSTATUS status = ZwQueryVirtualMemory(ZwCurrentProcess(), |
| 25 | pCode, |
| 26 | MemoryBasicInformation, |
| 27 | &mbi, |
| 28 | sizeof(mbi), |
| 29 | &len); |
| 30 | if (!NT_SUCCESS(status)) { |
| 31 | return false; |
| 32 | } |
| 33 | __try { |
| 34 | PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)mbi.AllocationBase; |
| 35 | if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) { |
| 36 | return false; |
| 37 | } |
| 38 | |
| 39 | PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((PUCHAR)pDosHeader + |
| 40 | pDosHeader->e_lfanew); |
| 41 | if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) { |
| 42 | return false; |
| 43 | } |
| 44 | if (pAddress >= ((PUCHAR)pDosHeader + |
| 45 | pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress) |
| 46 | && pAddress < ((PUCHAR)pDosHeader |
| 47 | + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress |
| 48 | + pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size)) { |
| 49 | return true; |
| 50 | } |
| 51 | } |
| 52 | __except (GetExceptionCode() == STATUS_ACCESS_VIOLATION |
| 53 | ? EXCEPTION_EXECUTE_HANDLER : EXCEPTION_CONTINUE_SEARCH) { |
| 54 | return false; |
| 55 | } |
| 56 | return false; |
| 57 | } |
| 58 | |
| 59 | ULONG_PTR Detour2gbBelow(ULONG_PTR address) { |
| 60 | return (address > (ULONG_PTR)0x7ff80000) ? address - 0x7ff80000 : 0x80000; |