RawPeApi 3th

// FakeProc.cpp part of RawPeApi Library // Write by SunLine lisunlin0@yahoo.com.cn 2007.7 #include <windows.h> #include "..\inc\RawPeApi.h" #include "fakeproc.h" FARPROC TrueProc[] = { (FARPROC)FreeLibrary, (FARPROC)FreeLibraryAndExitThread, (FARPROC)GetModuleFileNameA, (FARPROC)GetModuleFileNameW, (FARPROC)GetModuleHandleA, (FARPROC)GetModuleHandleW, (FARPROC)GetProcAddress, (FARPROC)LoadLibraryA, (FARPROC)LoadLibraryW, (FARPROC)LoadLibraryExA, (FARPROC)LoadLibraryExW, 0 }; FARPROC FakeProc[] = { (FARPROC)fFreeLibrary, (FARPROC)fFreeLibraryAndExitThread, (FARPROC)fGetModuleFileNameA, (FARPROC)fGetModuleFileNameW, (FARPROC)fGetModuleHandleA, (FARPROC)fGetModuleHandleW, (FARPROC)fGetProcAddress, (FARPROC)fLoadLibraryA, (FARPROC)fLoadLibraryW, (FARPROC)fLoadLibraryExA, (FARPROC)fLoadLibraryExW, 0 }; BOOL __stdcall fFreeLibrary(HMODULE hLibModule) { BOOL bRet; bRet = _FreeLibrary(hLibModule); if(GetLastError() == ERROR_MOD_NOT_FOUND) bRet = FreeLibrary(hLibModule); return bRet; } VOID __stdcall fFreeLibraryAndExitThread(HMODULE hLibModule, DWORD dwExitCode) { fFreeLibrary(hLibModule); ExitThread(dwExitCode); } DWORD __stdcall fGetModuleFileNameA(HMODULE hModule, LPCH lpFilename, DWORD nSize) { ULONG nRet = 0; nRet = _GetModuleFileNameA(hModule, lpFilename, nSize); if((0 == nRet) && (ERROR_MOD_NOT_FOUND == GetLastError())) nRet = GetModuleFileNameA(hModule, lpFilename, nSize); return nRet; } DWORD __stdcall fGetModuleFileNameW(HMODULE hModule, LPWCH lpFilename, DWORD nSize) { ULONG nRet = 0; nRet = _GetModuleFileNameW(hModule, lpFilename, nSize); if((0 == nRet) && (ERROR_MOD_NOT_FOUND == GetLastError())) nRet = GetModuleFileNameW(hModule, lpFilename, nSize); return nRet; } HMODULE __stdcall fGetModuleHandleA(LPCSTR lpModuleName) { WCHAR pModuleName[MAX_PATH]; if(MultiByteToWideChar(CP_THREAD_ACP, 0, lpModuleName, -1, pModuleName, MAX_PATH)) return fGetModuleHandleW(pModuleName); return NULL; } HMODULE __stdcall fGetModuleHandleW(LPCWSTR lpModuleName) { HMODULE hRet; hRet = _GetModuleHandleW(lpModuleName); if(NULL == hRet) hRet = GetModuleHandleW(lpModuleName); return hRet; } FARPROC __stdcall fGetProcAddress(HMODULE hModule, LPCSTR lpProcName) { FARPROC pRet = NULL; UINT uNameLen = 0; CHAR szModName[MAX_PATH]; uNameLen = _GetModuleFileNameA(hModule, szModName, MAX_PATH); if(ERROR_MOD_NOT_FOUND == GetLastError()) { FARPROC pf; pRet = GetProcAddress(hModule, lpProcName); for(int i = 0; pf = TrueProc[i]; i++) if(pf == pRet) { pRet = FakeProc[i]; break; } } else pRet = _GetProcAddress(hModule, lpProcName); return pRet; } HINSTANCE __stdcall fLoadLibraryA(LPCSTR lpLibFileName) { return fLoadLibraryExA(lpLibFileName, NULL, 0); } HINSTANCE __stdcall fLoadLibraryW(LPCWSTR lpLibFileName) { return fLoadLibraryExW(lpLibFileName, NULL, 0); } HINSTANCE __stdcall fLoadLibraryExA(LPCSTR lpLibFileName, HANDLE hFile, DWORD dwFlags) { HINSTANCE hRet = NULL; WCHAR name[MAX_PATH]; if(MultiByteToWideChar(CP_THREAD_ACP, 0, lpLibFileName, -1, name, MAX_PATH)) hRet = fLoadLibraryExW(name, hFile, dwFlags); return hRet; } HINSTANCE __stdcall fLoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags) { HINSTANCE hRet = NULL; hRet = _LoadLibraryExW(NULL, lpLibFileName, hFile, dwFlags); if(0 == hRet) hRet = LoadLibraryExW(lpLibFileName, hFile, dwFlags); return hRet; };