darkmode/uimport.pas at main · plainlib/darkmode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
unit uImport;

{$NOTES OFF}
{$HINTS OFF}
{$WARNINGS OFF}

{$mode objfpc}{$H+}

interface

{$IFDEF WINDOWS}

uses
  Classes, SysUtils, Windows;

function FindImportLibrary(hModule: THandle; pLibName: PAnsiChar): PPointer;
function FindImportFunction(pLibrary: PPointer; pFunction: Pointer): PPointer;
function ReplaceImportFunction(pOldFunction: PPointer; pNewFunction: Pointer): Pointer;

function FindDelayImportLibrary(hModule: THandle; pLibName: PAnsiChar): Pointer;
function FindDelayImportFunction(hModule: THandle; pImpDesc: PIMAGE_DELAYLOAD_DESCRIPTOR; pFuncName: PAnsiChar): PPointer;
procedure ReplaceDelayImportFunction(hModule: THandle; pImpDesc: PIMAGE_DELAYLOAD_DESCRIPTOR; pFuncName: PAnsiChar; pNewFunction: Pointer);

implementation

type
{$IFDEF WIN64}
  PIMAGE_NT_HEADERS = PIMAGE_NT_HEADERS64;
{$ELSE}
  PIMAGE_NT_HEADERS = PIMAGE_NT_HEADERS32;
{$ENDIF}

function FindImageDirectory(hModule: THandle; Index: Integer; out DataDir: PIMAGE_DATA_DIRECTORY): Pointer;
var
  pNTHeaders: PIMAGE_NT_HEADERS;
  pModule: PByte absolute hModule;
  pDosHeader: PIMAGE_DOS_HEADER absolute hModule;
begin
  if pDosHeader^.e_magic = IMAGE_DOS_SIGNATURE then
  begin
    pNTHeaders := @pModule[pDosHeader^.e_lfanew];
    if pNTHeaders^.Signature = IMAGE_NT_SIGNATURE then
    begin
      DataDir := @pNTHeaders^.OptionalHeader.DataDirectory[Index];
      Result := @pModule[DataDir^.VirtualAddress];
      Exit;
    end;
  end;
  Result := nil;
end;

function FindImportLibrary(hModule: THandle; pLibName: PAnsiChar): PPointer;
var
  pEnd: PByte;
  pImpDir: PIMAGE_DATA_DIRECTORY;
  pImpDesc: PIMAGE_IMPORT_DESCRIPTOR;
  pModule: PAnsiChar absolute hModule;
begin
  pImpDesc := FindImageDirectory(hModule, IMAGE_DIRECTORY_ENTRY_IMPORT, pImpDir);
  if pImpDesc = nil then Exit(nil);

  pEnd := PByte(pImpDesc) + pImpDir^.Size;

  while (PByte(pImpDesc) < pEnd) and (pImpDesc^.FirstThunk <> 0) do
  begin
    if StrIComp(@pModule[pImpDesc^.Name], pLibName) = 0 then
    begin
      Result := @pModule[pImpDesc^.FirstThunk];
      Exit;
    end;
    Inc(pImpDesc);
  end;
  Result := nil;
end;

function FindImportFunction(pLibrary: PPointer; pFunction: Pointer): PPointer;
begin
  while Assigned(pLibrary^) do
  begin
    if pLibrary^ = pFunction then Exit(pLibrary);
    Inc(pLibrary);
  end;
  Result := nil;
end;

function ReplaceImportFunction(pOldFunction: PPointer; pNewFunction: Pointer): Pointer;
var
  dwOldProtect: DWORD = 0;
begin
  if VirtualProtect(pOldFunction, SizeOf(Pointer), PAGE_READWRITE, dwOldProtect) then
  begin
    Result := pOldFunction^;
    pOldFunction^ := pNewFunction;
    VirtualProtect(pOldFunction, SizeOf(Pointer), dwOldProtect, dwOldProtect);
  end;
end;

function FindDelayImportLibrary(hModule: THandle; pLibName: PAnsiChar): Pointer;
var
  pEnd: PByte;
  pImpDir: PIMAGE_DATA_DIRECTORY;
  pImpDesc: PIMAGE_DELAYLOAD_DESCRIPTOR;
  pModule: PAnsiChar absolute hModule;
begin
  pImpDesc := FindImageDirectory(hModule, IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT, pImpDir);
  if pImpDesc = nil then Exit(nil);

  pEnd := PByte(pImpDesc) + pImpDir^.Size;

  while (PByte(pImpDesc) < pEnd) and (pImpDesc^.DllNameRVA > 0) do
  begin
    if StrIComp(@pModule[pImpDesc^.DllNameRVA], pLibName) = 0 then
      Exit(pImpDesc);

    Inc(pImpDesc);
  end;
  Result := nil;
end;

function FindDelayImportFunction(hModule: THandle;
  pImpDesc: PIMAGE_DELAYLOAD_DESCRIPTOR; pFuncName: PAnsiChar): PPointer;
var
  pImpName: PIMAGE_IMPORT_BY_NAME;
  pImgThunkName: PIMAGE_THUNK_DATA;
  pImgThunkAddr: PIMAGE_THUNK_DATA;
  pModule: PAnsiChar absolute hModule;
begin
  pImgThunkName:= @pModule[pImpDesc^.ImportNameTableRVA];
  pImgThunkAddr:= @pModule[pImpDesc^.ImportAddressTableRVA];

  while (pImgThunkName^.u1.Ordinal <> 0) do
  begin
    if not (IMAGE_SNAP_BY_ORDINAL(pImgThunkName^.u1.Ordinal)) then
    begin
      pImpName:= @pModule[pImgThunkName^.u1.AddressOfData];
      if (StrIComp(pImpName^.Name, pFuncName) = 0) then
        Exit(PPointer(@pImgThunkAddr^.u1._Function));
    end;
    Inc(pImgThunkName);
    Inc(pImgThunkAddr);
  end;
  Result:= nil;
end;

procedure ReplaceDelayImportFunction(hModule: THandle;
  pImpDesc: PIMAGE_DELAYLOAD_DESCRIPTOR; pFuncName: PAnsiChar;
  pNewFunction: Pointer);
var
  pOldFunction: PPointer;
begin
  pOldFunction:= FindDelayImportFunction(hModule, pImpDesc, pFuncName);
  if Assigned(pOldFunction) then ReplaceImportFunction(pOldFunction, pNewFunction);
end;

end.

{$ELSE}

implementation

end.
{$ENDIF}