| 863 | } |
| 864 | |
| 865 | BOOL WINAPI DetourRestoreAfterWithEx(_In_reads_bytes_(cbData) PVOID pvData, |
| 866 | _In_ DWORD cbData) |
| 867 | { |
| 868 | PDETOUR_EXE_RESTORE pder = (PDETOUR_EXE_RESTORE)pvData; |
| 869 | |
| 870 | if (pder->cb != sizeof(*pder) || pder->cb > cbData) { |
| 871 | SetLastError(ERROR_BAD_EXE_FORMAT); |
| 872 | return FALSE; |
| 873 | } |
| 874 | |
| 875 | DWORD dwPermIdh = ~0u; |
| 876 | DWORD dwPermInh = ~0u; |
| 877 | DWORD dwPermClr = ~0u; |
| 878 | DWORD dwIgnore; |
| 879 | BOOL fSucceeded = FALSE; |
| 880 | BOOL fUpdated32To64 = FALSE; |
| 881 | |
| 882 | if (pder->pclr != NULL && pder->clr.Flags != ((PDETOUR_CLR_HEADER)pder->pclr)->Flags) { |
| 883 | // If we had to promote the 32/64-bit agnostic IL to 64-bit, we can't restore |
| 884 | // that. |
| 885 | fUpdated32To64 = TRUE; |
| 886 | } |
| 887 | |
| 888 | if (DetourVirtualProtectSameExecute(pder->pidh, pder->cbidh, |
| 889 | PAGE_EXECUTE_READWRITE, &dwPermIdh)) { |
| 890 | if (DetourVirtualProtectSameExecute(pder->pinh, pder->cbinh, |
| 891 | PAGE_EXECUTE_READWRITE, &dwPermInh)) { |
| 892 | |
| 893 | CopyMemory(pder->pidh, &pder->idh, pder->cbidh); |
| 894 | CopyMemory(pder->pinh, &pder->inh, pder->cbinh); |
| 895 | |
| 896 | if (pder->pclr != NULL && !fUpdated32To64) { |
| 897 | if (DetourVirtualProtectSameExecute(pder->pclr, pder->cbclr, |
| 898 | PAGE_EXECUTE_READWRITE, &dwPermClr)) { |
| 899 | CopyMemory(pder->pclr, &pder->clr, pder->cbclr); |
| 900 | VirtualProtect(pder->pclr, pder->cbclr, dwPermClr, &dwIgnore); |
| 901 | fSucceeded = TRUE; |
| 902 | } |
| 903 | } |
| 904 | else { |
| 905 | fSucceeded = TRUE; |
| 906 | } |
| 907 | VirtualProtect(pder->pinh, pder->cbinh, dwPermInh, &dwIgnore); |
| 908 | } |
| 909 | VirtualProtect(pder->pidh, pder->cbidh, dwPermIdh, &dwIgnore); |
| 910 | } |
| 911 | // Delete the payload after successful recovery to prevent repeated restore |
| 912 | if (fSucceeded) { |
| 913 | DetourFreePayload(pder); |
| 914 | pder = NULL; |
| 915 | } |
| 916 | return fSucceeded; |
| 917 | } |
| 918 | |
| 919 | BOOL WINAPI DetourRestoreAfterWith() |
| 920 | { |
no test coverage detected
searching dependent graphs…