Function FindPayloadInRemoteDetourSection

lib_fiber/cpp/src/detours/creatwth.cpp:189–241

}

static PVOID FindPayloadInRemoteDetourSection(_In_ HANDLE hProcess,
                                               _In_ REFGUID rguid,
                                               _Out_opt_ DWORD *pcbData,
                                               _In_ PVOID pvRemoteDetoursSection)
{
    if (pcbData) {
        *pcbData = 0;
    }

    PBYTE pbData = (PBYTE)pvRemoteDetoursSection;

    DETOUR_SECTION_HEADER header;
    if (!ReadProcessMemory(hProcess, pbData, &header, sizeof(header), NULL)) {
        DETOUR_TRACE(("ReadProcessMemory(dsh@%p..%p) failed: %lu\n",
            pbData,
            pbData + sizeof(header),
            GetLastError()));
        return NULL;
    }

    if (header.cbHeaderSize < sizeof(DETOUR_SECTION_HEADER) ||
        header.nSignature != DETOUR_SECTION_HEADER_SIGNATURE) {
        SetLastError(ERROR_EXE_MARKED_INVALID);
        return NULL;
    }

    if (header.nDataOffset == 0) {
        header.nDataOffset = header.cbHeaderSize;
    }

    for (PVOID pvSection = pbData + header.nDataOffset; pvSection < pbData + header.cbDataSize;) {
        DETOUR_SECTION_RECORD section;
        if (!ReadProcessMemory(hProcess, pvSection, &section, sizeof(section), NULL)) {
            DETOUR_TRACE(("ReadProcessMemory(dsr@%p..%p) failed: %lu\n",
                pvSection,
                (PBYTE)pvSection + sizeof(section),
                GetLastError()));
            return NULL;
        }

        if (DetourAreSameGuid(section.guid, rguid)) {
            if (pcbData) {
                *pcbData = section.cbBytes - sizeof(section);
            }
            SetLastError(NO_ERROR);
            return (DETOUR_SECTION_RECORD *)pvSection + 1;
        }

        pvSection = (PBYTE)pvSection + section.cbBytes;
    }

    return NULL;
}

_Success_(return != NULL)
PVOID WINAPI DetourFindRemotePayload(_In_ HANDLE hProcess,