/*FastDetour Lib v1.02 (c) 2006 Pansemuckl@hotmail.com for netCoders.cjb.netDescription:Replacement for Microsoft Detours Library. Redirect (API) functions.Benefits:- Fast instruction disassembler- OO class more convient- Optimized for the use with PB (set/remove detours often -> fast)- No more annoying ms:detours bugs such as- hooked func too small causes crash- memory (heap) leak on multiple detour/remove- Check EXPORTED functions for (foreign) detours- Restore EXPORTED functions from file image - ...To do:- Bugfixes (please report)- 64 bit...Limitations:Make sure the function to be detoured is at least 20 bytes of code!Usage:See example. Make sure to #include "./FastDetours/FastDetours.h"License:Free to use.Disclaimer: This software is provided as is without any guarantees or warranty.I'M NOT RESPONSIBLE FOR ANY CORRECT OR INCORRECT USE OF THIS SOFTWARE. I CAN'T BE HELD RESPONSIBLE FOR ANY DIRECT OR INDIRECT DAMAGE OR LOSS OR ANY CONSEQUENCES CAUSED BY THE USE OF THIS SOFTWARE IN ANY CASE.In addition, even if this software is defective, I'm not under obligation to correct or support it.*/#pragma once#include <windows.h>//#pragma comment(lib, "./FastDetours/FastDetours.lib")class CFastDetour{public: CFastDetour(); ~CFastDetour(); // Input: ptr to the function to be detoured (eg. LoadLibraryA) VOID SetTarget( PBYTE lpTarget ); // Input: ptr to the function hook (eg. LoadLibrary_hook) VOID SetDestination( PBYTE lpDestination ); // This will create & set the detour, and set it in place. // Returns: TRUE on success. Detour will be set. BOOL CreateDetour( ); // Same as CreateDetourx, but PB-proof detour code BOOL CreatePBDetour( ); // Experts usage, e.g. // LoadLibrary_t pLoadLibrary = (LoadLibrary_t)CreateDetourEx( LoadLibraryA, LoadLibrary_hook ); // Returns: PTR to Trampoline PVOID CreateDetourEx( PBYTE lpTarget, PBYTE lpDestination ); // Same as CreateDetoursEx, but PB-proof detour code PVOID CreatePBDetourEx( PBYTE lpTarget, PBYTE lpDestination ); // Remove & delete tramp for another call of CreateDetours // Returns: TRUE on success. BOOL DeleteDetour( ); // Enabled/set detour (at lpTarget) // Returns: TRUE on success. BOOL SetDetour( ); // Disable/remove detour (at lpTarget) // Returns: TRUE on success. BOOL RemoveDetour( ); // Check if detoured. // Returns: TRUE if detour is set. BOOL IsDetoured( ); // Check if detour exists // Returns: TRUE if Create(PB)Detour(Ex) was called. BOOL IsCreated( ); // Return ptr to Trampoline // Returns: PTR to Trampoline PVOID GetTrampoline( ); // Receive opcode instruction length // Returns: Number of bytes that had to be moved from lpFrom INT InstuctionLen( ); // Create a process and inject a library // Notice: SetDefaultPath yourself VOID ExecuteWithLibrary( LPCSTR lpApplicationPath, LPCSTR lpLibraryPath, LPSTR lpCmdline ); // GetExportAddrFromFile returns file offset of a function/EXPORT from it's image on disk // Returns: Filepos(!) of szFunction within szFile DWORD GetExportAddrFromFile( PCHAR szFile, PCHAR szFunction ); // Expert: GetExportAddrFromFile + read iBufSize opcodes to szBuf DWORD GetExportAddrFromFileEx( PCHAR szFile, PCHAR szFunction, PBYTE lpBuf, INT iBufSize ); // Read EXPORT szFunction of szModule to lpBuf, iBufSize bytes. // Returns: TRUE if successful. BOOL ReadExportFromFile( PCHAR szModule, PCHAR szFunction, PBYTE lpBuf, INT iBufSize ); // Write lpBuf to EXPORT szFunction of szModule to its location in memory // szModule needs to be loaded // Returns: TRUE if successful. BOOL WriteExportToMemory( PCHAR szModule, PCHAR szFunction, PBYTE lpBuf, INT iBufSize ); // Detect possible (foreign) detours // Checks file/memory for differences of szFunction from szModule (some bytes) // Returns: TRUE if successful. Result is written to bResult BOOL IsFunctionDetoured( PCHAR szModule, PCHAR szFunction, PBOOL bResult );private: PBYTE lpFrom, lpTo; PBYTE pbDetoured, pbOriginal, pbTramp; BOOL bIsDetoured; INT iTrampLen; // zero shit VOID InitValues( ); PVOID DoExec( );};// Decompile code at lpBuf, return length of instruction in bytes// Example: DWORD dwLen; FastDisasmGetInstructionLen( (PBYTE)MessageBoxA, &dwLen );void FastDisasmGetInstructionLen( PBYTE lpBuf, LPDWORD dwSize );