diff --git a/AntiHooking/AntiHooking.pro b/AntiHooking/AntiHooking.pro index 44250e5d..c18583bc 100644 --- a/AntiHooking/AntiHooking.pro +++ b/AntiHooking/AntiHooking.pro @@ -12,8 +12,11 @@ contains(QT_ARCH, i386) { contains(QT_ARCH, x86_64) { LIBS += -L$$PWD/../libs/windows/lib/x64 } +contains(QT_ARCH, arm64) { + LIBS += -L$$PWD/../libs/windows/lib/arm64 +} -LIBS += -lNktHookLib +LIBS += -ldetours DEFINES += ANTIHOOKING_LIBRARY SOURCES += antihookingprotection.cpp HEADERS += antihookingprotection.h diff --git a/AntiHooking/antihookingprotection.cpp b/AntiHooking/antihookingprotection.cpp index c91bf914..8953f8a1 100644 --- a/AntiHooking/antihookingprotection.cpp +++ b/AntiHooking/antihookingprotection.cpp @@ -1,6 +1,9 @@ #include "antihookingprotection.h" -#include +#define WIN32_LEAN_AND_MEAN +#include + +#include typedef HMODULE (WINAPI *LoadLibraryAFunc)(LPCSTR lpLibFileName); typedef HMODULE (WINAPI *LoadLibraryWFunc)(LPCWSTR lpLibFileName); @@ -12,25 +15,35 @@ class AntiHookingProtection public: static void enable() { - #ifdef QT_DEBUG - s_HookManager.SetEnableDebugOutput(true); - #endif + DetourTransactionBegin(); + DetourUpdateThread(GetCurrentThread()); - HINSTANCE kernel32Handle = NktHookLibHelpers::GetModuleBaseAddress(L"kernel32.dll"); - SIZE_T hookId; + s_RealLoadLibraryA = LoadLibraryA; + DetourAttach(&(PVOID&)s_RealLoadLibraryA, LoadLibraryAHook); - s_HookManager.Hook(&hookId, (LPVOID*)&s_RealLoadLibraryA, - NktHookLibHelpers::GetProcedureAddress(kernel32Handle, "LoadLibraryA"), - (LPVOID)AntiHookingProtection::LoadLibraryAHook); - s_HookManager.Hook(&hookId, (LPVOID*)&s_RealLoadLibraryW, - NktHookLibHelpers::GetProcedureAddress(kernel32Handle, "LoadLibraryW"), - (LPVOID)AntiHookingProtection::LoadLibraryWHook); - s_HookManager.Hook(&hookId, (LPVOID*)&s_RealLoadLibraryExA, - NktHookLibHelpers::GetProcedureAddress(kernel32Handle, "LoadLibraryExA"), - (LPVOID)AntiHookingProtection::LoadLibraryExAHook); - s_HookManager.Hook(&hookId, (LPVOID*)&s_RealLoadLibraryExW, - NktHookLibHelpers::GetProcedureAddress(kernel32Handle, "LoadLibraryExW"), - (LPVOID)AntiHookingProtection::LoadLibraryExWHook); + s_RealLoadLibraryW = LoadLibraryW; + DetourAttach(&(PVOID&)s_RealLoadLibraryW, LoadLibraryWHook); + + s_RealLoadLibraryExA = LoadLibraryExA; + DetourAttach(&(PVOID&)s_RealLoadLibraryExA, LoadLibraryExAHook); + + s_RealLoadLibraryExW = LoadLibraryExW; + DetourAttach(&(PVOID&)s_RealLoadLibraryExW, LoadLibraryExWHook); + + DetourTransactionCommit(); + } + + static void disable() + { + DetourTransactionBegin(); + DetourUpdateThread(GetCurrentThread()); + + DetourDetach(&(PVOID&)s_RealLoadLibraryA, LoadLibraryAHook); + DetourDetach(&(PVOID&)s_RealLoadLibraryW, LoadLibraryWHook); + DetourDetach(&(PVOID&)s_RealLoadLibraryExA, LoadLibraryExAHook); + DetourDetach(&(PVOID&)s_RealLoadLibraryExW, LoadLibraryExWHook); + + DetourTransactionCommit(); } private: @@ -124,7 +137,6 @@ private: return s_RealLoadLibraryExW(lpLibFileName, hFile, dwFlags); } - static CNktHookLib s_HookManager; static LoadLibraryAFunc s_RealLoadLibraryA; static LoadLibraryWFunc s_RealLoadLibraryW; static LoadLibraryExAFunc s_RealLoadLibraryExA; @@ -209,7 +221,6 @@ private: }; }; -CNktHookLib AntiHookingProtection::s_HookManager; LoadLibraryAFunc AntiHookingProtection::s_RealLoadLibraryA; LoadLibraryWFunc AntiHookingProtection::s_RealLoadLibraryW; LoadLibraryExAFunc AntiHookingProtection::s_RealLoadLibraryExA; @@ -218,14 +229,26 @@ LoadLibraryExWFunc AntiHookingProtection::s_RealLoadLibraryExW; AH_EXPORT void AntiHookingDummyImport() {} extern "C" -BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID) +BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) { + if (DetourIsHelperProcess()) { + return TRUE; + } + switch (fdwReason) { case DLL_PROCESS_ATTACH: + DetourRestoreAfterWith(); AntiHookingProtection::enable(); DisableThreadLibraryCalls(hinstDLL); break; + case DLL_PROCESS_DETACH: + // Ignore DLL_PROCESS_DETACH on process exit. No need to waste time + // unhooking everything if the whole process is being destroyed. + if (lpvReserved == NULL) { + AntiHookingProtection::disable(); + } + break; } return TRUE; diff --git a/app/app.pro b/app/app.pro index 4f422ea6..b538ae07 100644 --- a/app/app.pro +++ b/app/app.pro @@ -404,13 +404,11 @@ INCLUDEPATH += $$PWD/../h264bitstream/h264bitstream DEPENDPATH += $$PWD/../h264bitstream/h264bitstream !winrt { - contains(QT_ARCH, i386)|contains(QT_ARCH, x86_64) { - win32:CONFIG(release, debug|release): LIBS += -L$$OUT_PWD/../AntiHooking/release/ -lAntiHooking - else:win32:CONFIG(debug, debug|release): LIBS += -L$$OUT_PWD/../AntiHooking/debug/ -lAntiHooking + win32:CONFIG(release, debug|release): LIBS += -L$$OUT_PWD/../AntiHooking/release/ -lAntiHooking + else:win32:CONFIG(debug, debug|release): LIBS += -L$$OUT_PWD/../AntiHooking/debug/ -lAntiHooking - INCLUDEPATH += $$PWD/../AntiHooking - DEPENDPATH += $$PWD/../AntiHooking - } + INCLUDEPATH += $$PWD/../AntiHooking + DEPENDPATH += $$PWD/../AntiHooking } unix:!macx: { diff --git a/app/main.cpp b/app/main.cpp index 5c1fc511..c7e43c87 100644 --- a/app/main.cpp +++ b/app/main.cpp @@ -22,7 +22,7 @@ #include "streaming/video/ffmpeg.h" #endif -#if defined(Q_OS_WIN32) && defined(Q_PROCESSOR_X86) +#if defined(Q_OS_WIN32) #include "antihookingprotection.h" #elif defined(Q_OS_LINUX) #include @@ -293,10 +293,9 @@ int main(int argc, char *argv[]) SetUnhandledExceptionFilter(UnhandledExceptionHandler); #endif -#if defined(Q_OS_WIN32) && defined(Q_PROCESSOR_X86) +#if defined(Q_OS_WIN32) // Force AntiHooking.dll to be statically imported and loaded - // by ntdll on x86/x64 platforms by calling a dummy function. - // AntiHooking.dll is not currently built for ARM64. + // by ntdll on Win32 platforms by calling a dummy function. AntiHookingDummyImport(); #elif defined(Q_OS_LINUX) // Force libssl.so to be directly linked to our binary, so diff --git a/libs b/libs index 5ef8a666..6a7c1b24 160000 --- a/libs +++ b/libs @@ -1 +1 @@ -Subproject commit 5ef8a666ebd9d47ec6dfbc2a59e9182cb6229af5 +Subproject commit 6a7c1b244c4e15ee9272ee86625e6585931bcd11 diff --git a/moonlight-qt.pro b/moonlight-qt.pro index 97fc3d20..a13627df 100644 --- a/moonlight-qt.pro +++ b/moonlight-qt.pro @@ -8,11 +8,8 @@ SUBDIRS = \ # Build the dependencies in parallel before the final app app.depends = qmdnsengine moonlight-common-c h264bitstream win32:!winrt { - contains(QT_ARCH, i386)|contains(QT_ARCH, x86_64) { - # We don't build AntiHooking.dll for ARM64 (yet?) - SUBDIRS += AntiHooking - app.depends += AntiHooking - } + SUBDIRS += AntiHooking + app.depends += AntiHooking } !winrt:win32|macx { SUBDIRS += soundio