| 296 | } |
| 297 | |
| 298 | PVOID WINAPI DetourGetEntryPoint(_In_opt_ HMODULE hModule) |
| 299 | { |
| 300 | PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hModule; |
| 301 | if (hModule == NULL) { |
| 302 | pDosHeader = (PIMAGE_DOS_HEADER)GetModuleHandleW(NULL); |
| 303 | } |
| 304 | |
| 305 | __try { |
| 306 | #pragma warning(suppress:6011) // GetModuleHandleW(NULL) never returns NULL. |
| 307 | if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) { |
| 308 | SetLastError(ERROR_BAD_EXE_FORMAT); |
| 309 | return NULL; |
| 310 | } |
| 311 | |
| 312 | PIMAGE_NT_HEADERS pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pDosHeader + |
| 313 | pDosHeader->e_lfanew); |
| 314 | if (pNtHeader->Signature != IMAGE_NT_SIGNATURE) { |
| 315 | SetLastError(ERROR_INVALID_EXE_SIGNATURE); |
| 316 | return NULL; |
| 317 | } |
| 318 | if (pNtHeader->FileHeader.SizeOfOptionalHeader == 0) { |
| 319 | SetLastError(ERROR_EXE_MARKED_INVALID); |
| 320 | return NULL; |
| 321 | } |
| 322 | |
| 323 | PDETOUR_CLR_HEADER pClrHeader = NULL; |
| 324 | if (pNtHeader->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC) { |
| 325 | if (((PIMAGE_NT_HEADERS32)pNtHeader)->CLR_DIRECTORY.VirtualAddress != 0 && |
| 326 | ((PIMAGE_NT_HEADERS32)pNtHeader)->CLR_DIRECTORY.Size != 0) { |
| 327 | pClrHeader = (PDETOUR_CLR_HEADER) |
| 328 | (((PBYTE)pDosHeader) |
| 329 | + ((PIMAGE_NT_HEADERS32)pNtHeader)->CLR_DIRECTORY.VirtualAddress); |
| 330 | } |
| 331 | } |
| 332 | else if (pNtHeader->OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC) { |
| 333 | if (((PIMAGE_NT_HEADERS64)pNtHeader)->CLR_DIRECTORY.VirtualAddress != 0 && |
| 334 | ((PIMAGE_NT_HEADERS64)pNtHeader)->CLR_DIRECTORY.Size != 0) { |
| 335 | pClrHeader = (PDETOUR_CLR_HEADER) |
| 336 | (((PBYTE)pDosHeader) |
| 337 | + ((PIMAGE_NT_HEADERS64)pNtHeader)->CLR_DIRECTORY.VirtualAddress); |
| 338 | } |
| 339 | } |
| 340 | |
| 341 | if (pClrHeader != NULL) { |
| 342 | // For MSIL assemblies, we want to use the _Cor entry points. |
| 343 | |
| 344 | HMODULE hClr = GetModuleHandleW(L"MSCOREE.DLL"); |
| 345 | if (hClr == NULL) { |
| 346 | return NULL; |
| 347 | } |
| 348 | |
| 349 | SetLastError(NO_ERROR); |
| 350 | return (PVOID)GetProcAddress(hClr, "_CorExeMain"); |
| 351 | } |
| 352 | |
| 353 | SetLastError(NO_ERROR); |
| 354 | |
| 355 | // Pure resource DLLs have neither an entry point nor CLR information |
no outgoing calls
no test coverage detected
searching dependent graphs…