MCPcopy Create free account
hub / github.com/acl-dev/acl / DetourGetEntryPoint

Function DetourGetEntryPoint

lib_fiber/cpp/src/detours/modules.cpp:298–369  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

296}
297
298PVOID WINAPI DetourGetEntryPoint(_In_opt_ HMODULE hModule)
299{
300 PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hModule;
301 if (hModule == NULL) {
302 pDosHeader = (PIMAGE_DOS_HEADER)GetModuleHandleW(NULL);
303 }
304
305 __try {
306#pragma warning(suppress:6011) // GetModuleHandleW(NULL) never returns NULL.
307 if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
308 SetLastError(ERROR_BAD_EXE_FORMAT);
309 return NULL;
310 }
311
312 PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader +
313 pDosHeader->e_lfanew);
314 if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) {
315 SetLastError(ERROR_INVALID_EXE_SIGNATURE);
316 return NULL;
317 }
318 if (pNtHeader->FileHeader.SizeOfOptionalHeader == 0) {
319 SetLastError(ERROR_EXE_MARKED_INVALID);
320 return NULL;
321 }
322
323 PDETOUR_CLR_HEADER pClrHeader = NULL;
324 if (pNtHeader->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
325 if (((PIMAGE_NT_HEADERS32)pNtHeader)->CLR_DIRECTORY.VirtualAddress != 0 &&
326 ((PIMAGE_NT_HEADERS32)pNtHeader)->CLR_DIRECTORY.Size != 0) {
327 pClrHeader = (PDETOUR_CLR_HEADER)
328 (((PBYTE)pDosHeader)
329 + ((PIMAGE_NT_HEADERS32)pNtHeader)->CLR_DIRECTORY.VirtualAddress);
330 }
331 }
332 else if (pNtHeader->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) {
333 if (((PIMAGE_NT_HEADERS64)pNtHeader)->CLR_DIRECTORY.VirtualAddress != 0 &&
334 ((PIMAGE_NT_HEADERS64)pNtHeader)->CLR_DIRECTORY.Size != 0) {
335 pClrHeader = (PDETOUR_CLR_HEADER)
336 (((PBYTE)pDosHeader)
337 + ((PIMAGE_NT_HEADERS64)pNtHeader)->CLR_DIRECTORY.VirtualAddress);
338 }
339 }
340
341 if (pClrHeader != NULL) {
342 // For MSIL assemblies, we want to use the _Cor entry points.
343
344 HMODULE hClr = GetModuleHandleW(L"MSCOREE.DLL");
345 if (hClr == NULL) {
346 return NULL;
347 }
348
349 SetLastError(NO_ERROR);
350 return (PVOID)GetProcAddress(hClr, "_CorExeMain");
351 }
352
353 SetLastError(NO_ERROR);
354
355 // Pure resource DLLs have neither an entry point nor CLR information

Callers 1

DetourFindFunctionFunction · 0.85

Calls

no outgoing calls

Tested by

no test coverage detected

Used in the wild real call sites across dependent graphs

searching dependent graphs…