From 1a4cc6a224210b7b3f08542f63a72316b7e2dcbe Mon Sep 17 00:00:00 2001 From: Sam Hocevar Date: Fri, 17 Sep 2010 23:09:03 +0000 Subject: [PATCH] Add a few comments in the code for new Win32 strategies. --- src/libzzuf/sys.c | 2 ++ src/myfork.c | 11 ++++++++--- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/src/libzzuf/sys.c b/src/libzzuf/sys.c index d889939..ea5d7d1 100644 --- a/src/libzzuf/sys.c +++ b/src/libzzuf/sys.c @@ -103,6 +103,8 @@ static void insert_func(void *module, void *old, void *new) if(*func != old) continue; + /* FIXME: The StarCraft 2 hack uses two methods for function + * diversion. See HookSsdt() and HookHotPatch(). */ VirtualProtect(func, sizeof(func), PAGE_EXECUTE_READWRITE, &dummy); WriteProcessMemory(GetCurrentProcess(), func, &new, sizeof(new), NULL); diff --git a/src/myfork.c b/src/myfork.c index 20d3ea1..d0cc0d6 100644 --- a/src/myfork.c +++ b/src/myfork.c @@ -385,14 +385,19 @@ static int dll_inject(void *process, void *epaddr, char const *lib) memcpy(code + loaderlen + jumperlen, lib, liblen); /* Backup the old entry point code */ - ReadProcessMemory(process, epaddr, code + loaderlen, - jumperlen, &tmp); + ReadProcessMemory(process, epaddr, code + loaderlen, jumperlen, &tmp); if(tmp != jumperlen) return -1; + /* XXX: at this point, the StarCraft 2 hack replaces the entry point + * contents with a jump to self, then waits until the program counter + * actually reaches the entry point. Not sure whether it is needed. */ + /* FIXME: the GetProcAddress calls assume the library was loaded at * the same address in the child process. This is wrong since Vista - * and its address space randomisation. */ + * and its address space randomisation. The StarCraft 2 hack remotely + * parses the target process's module list in order to find the + * kernel32.dll address. Have a look at _RemoteGetProcAddress(). */ kernel32 = LoadLibrary("kernel32.dll"); if(!kernel32) return -1;