Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upGitHub is where the world builds software
Millions of developers and companies build, ship, and maintain their software on GitHub — the largest and most advanced development platform in the world.
Fix can not createwith some protected exe #140
Conversation
| } | ||
| ++pImageImport; | ||
| } | ||
| OutputDebugString(TEXT("[This PE file has an import table, but the import table size is marked as 0. This is an error.") |
bgianfo
Sep 4, 2020
Member
We should use DETOUR_TRACE instead of OutputDebugStrring?
We should use DETOUR_TRACE instead of OutputDebugStrring?
sonyps5201314
Sep 5, 2020
•
Author
Contributor
DETOUR_TRACE can not output any message if no define DETOUR_DEBUG, I use OutputDebugString to force output message for tell user to pay attention to this is a unnormal exe.
DETOUR_TRACE can not output any message if no define DETOUR_DEBUG, I use OutputDebugString to force output message for tell user to pay attention to this is a unnormal exe.
sylveon
Sep 5, 2020
Should finish with a ] if it starts with [. Also OutputDebugString doesn't automatically append a new line, so you want to add \n at the end of the string.
Should finish with a ] if it starts with [. Also OutputDebugString doesn't automatically append a new line, so you want to add \n at the end of the string.
sonyps5201314
Sep 5, 2020
Author
Contributor
\r\n is in next line, this is a const string concat operation.
\r\n is in next line, this is a const string concat operation.
bgianfo
Sep 6, 2020
Member
DETOUR_TRACE can not output any message if no define DETOUR_DEBUG, I use OutputDebugString to force output message for tell user to pay attention to this is a unnormal exe.
So the users is going to just happen to be running under a debugger?
OutputDebugString only outputs a message if a debugger is attached.
It's not really detours job to emit messages as library.
I think it would make more sense to just return a rich
error code in LastError, and let the caller handle that case
explicitly.
DETOUR_TRACE can not output any message if no define DETOUR_DEBUG, I use OutputDebugString to force output message for tell user to pay attention to this is a unnormal exe.
So the users is going to just happen to be running under a debugger?
OutputDebugString only outputs a message if a debugger is attached.
It's not really detours job to emit messages as library.
I think it would make more sense to just return a rich
error code in LastError, and let the caller handle that case
explicitly.
sonyps5201314
Sep 6, 2020
Author
Contributor
Dbgview and many debug tools can capture the debug output statements of the application without being debugged.
In fact, it doesn't matter whether the user notices this message, it's like an MFC running warning.
like
TRACE(traceAppMsg, 0, _T("Warning: calling DestroyWindow in CWnd::~CWnd; ")
_T("OnDestroy or PostNcDestroy in derived class will not be called.\n"));
in
CWnd::~CWnd()
{
if (m_hWnd != NULL &&
this != (CWnd*)&wndTop && this != (CWnd*)&wndBottom &&
this != (CWnd*)&wndTopMost && this != (CWnd*)&wndNoTopMost)
{
TRACE(traceAppMsg, 0, _T("Warning: calling DestroyWindow in CWnd::~CWnd; ")
_T("OnDestroy or PostNcDestroy in derived class will not be called.\n"));
DestroyWindow();
}
The user cannot handle it because the only way to deal with it is to modify the PE file on the disk, but this file may contain a digital signature, and the modification may be illegal, and it only has a problem when it is launched through Detours' createwith API. The user uses Explorer. exe starts it, or directly calls the CreateProcess function to start it, there is no problem, these are enough to prove a defect of Detours.
The only improvement is that calling OutputDebugString in a non-debugging state may modify the value of LastError of the current thread, which has been fixed in the latest submission.
Dbgview and many debug tools can capture the debug output statements of the application without being debugged.
In fact, it doesn't matter whether the user notices this message, it's like an MFC running warning.
like
TRACE(traceAppMsg, 0, _T("Warning: calling DestroyWindow in CWnd::~CWnd; ")
_T("OnDestroy or PostNcDestroy in derived class will not be called.\n"));in
CWnd::~CWnd()
{
if (m_hWnd != NULL &&
this != (CWnd*)&wndTop && this != (CWnd*)&wndBottom &&
this != (CWnd*)&wndTopMost && this != (CWnd*)&wndNoTopMost)
{
TRACE(traceAppMsg, 0, _T("Warning: calling DestroyWindow in CWnd::~CWnd; ")
_T("OnDestroy or PostNcDestroy in derived class will not be called.\n"));
DestroyWindow();
}The user cannot handle it because the only way to deal with it is to modify the PE file on the disk, but this file may contain a digital signature, and the modification may be illegal, and it only has a problem when it is launched through Detours' createwith API. The user uses Explorer. exe starts it, or directly calls the CreateProcess function to start it, there is no problem, these are enough to prove a defect of Detours.
The only improvement is that calling OutputDebugString in a non-debugging state may modify the value of LastError of the current thread, which has been fixed in the latest submission.
|
Thanks for the contribution! It looks like you might have mistakenly included all of the other commits from your other PRs here? |
…se online、commercial、prorected game dnf.exe https://dnf.qq.com/, but this exe can start run by explorer.
62b7fbf
to
b3d45f4
|
@bgianfo, I have rebased to only include this commit. |
| while(ImageImport.Name) | ||
| { | ||
| inh.IMPORT_DIRECTORY.Size+=sizeof(IMAGE_IMPORT_DESCRIPTOR); | ||
| if(!ReadProcessMemory(hProcess,pImageImport,&ImageImport,sizeof(ImageImport),NULL)) |
bgianfo
Sep 6, 2020
Member
I think you could simplify this code by switching this to a do-while loop, that way the initial ReadProcessMemory doesn't need to be special cased.
I think you could simplify this code by switching this to a do-while loop, that way the initial ReadProcessMemory doesn't need to be special cased.
sonyps5201314
Sep 6, 2020
Author
Contributor
I don't quite understand your expression, and here ImageImport.Name is a judgment condition, so I think it is more appropriate to use a while-do loop.
I don't quite understand your expression, and here ImageImport.Name is a judgment condition, so I think it is more appropriate to use a while-do loop.
halx99
Sep 28, 2020
•
The loop maybe better:
for (int count=0;;++count) {
if (!ReadProcessMemory(hProcess, pImageImport, &ImageImport, sizeof(ImageImport), NULL)) {
DETOUR_TRACE(("ReadProcessMemory failed: %u\n", GetLastError()));;
goto finish;
}
if (ImageImport.Name) {
inh.IMPORT_DIRECTORY.Size += sizeof(IMAGE_IMPORT_DESCRIPTOR);
++pImageImport;
continue;
}
if(count) inh.IMPORT_DIRECTORY.Size += sizeof(IMAGE_IMPORT_DESCRIPTOR);
break;
}
The loop maybe better:
for (int count=0;;++count) {
if (!ReadProcessMemory(hProcess, pImageImport, &ImageImport, sizeof(ImageImport), NULL)) {
DETOUR_TRACE(("ReadProcessMemory failed: %u\n", GetLastError()));;
goto finish;
}
if (ImageImport.Name) {
inh.IMPORT_DIRECTORY.Size += sizeof(IMAGE_IMPORT_DESCRIPTOR);
++pImageImport;
continue;
}
if(count) inh.IMPORT_DIRECTORY.Size += sizeof(IMAGE_IMPORT_DESCRIPTOR);
break;
}
halx99
Sep 28, 2020
Updated
Updated
sonyps5201314
Sep 28, 2020
Author
Contributor
Although the code becomes able to get the correct result after you update and fix it, but at the same time it is difficult to read. In my original code, only run inh.IMPORT_DIRECTORY.Size+=sizeof(IMAGE_IMPORT_DESCRIPTOR); under the condition of ImageImport.Name , and you changed this code but first executed inh.IMPORT_DIRECTORY.Size+=sizeof(IMAGE_IMPORT_DESCRIPTOR); and ignored the conditions of ImageImport.Name. It seems that it is just to make the result correct, so I think it breaks the readability and there is no need to modify it.
Although the code becomes able to get the correct result after you update and fix it, but at the same time it is difficult to read. In my original code, only run inh.IMPORT_DIRECTORY.Size+=sizeof(IMAGE_IMPORT_DESCRIPTOR); under the condition of ImageImport.Name , and you changed this code but first executed inh.IMPORT_DIRECTORY.Size+=sizeof(IMAGE_IMPORT_DESCRIPTOR); and ignored the conditions of ImageImport.Name. It seems that it is just to make the result correct, so I think it breaks the readability and there is no need to modify it.
halx99
Sep 28, 2020
why, it's easy to unstand, just calc size until the name is null
why, it's easy to unstand, just calc size until the name is null
halx99
Sep 29, 2020
Update again, the latest code logical is equal to your original code
Update again, the latest code logical is equal to your original code
sonyps5201314
Sep 29, 2020
Author
Contributor
OK, now the code has been adjusted to be more in line with official recommendations.
OK, now the code has been adjusted to be more in line with official recommendations.
…ty checks are performed.
bc81266
to
107d601
518a1a4
to
9d58115

Formed in 2009, the Archive Team (not to be confused with the archive.org Archive-It Team) is a rogue archivist collective dedicated to saving copies of rapidly dying or deleted websites for the sake of history and digital heritage. The group is 100% composed of volunteers and interested parties, and has expanded into a large amount of related projects for saving online and digital history.

fix can not use createwith api to start some unnormal exe, like chinese online、commercial、prorected game dnf.exe https://dnf.qq.com/, but this exe can start run by explorer.