Skip to content

Commit

Permalink
7thWrapperLoader: Use guard logic only recursive hooks
Browse files Browse the repository at this point in the history
  • Loading branch information
julianxhokaxhiu committed Nov 27, 2022
1 parent 5bc6974 commit 70e95e5
Showing 1 changed file with 16 additions and 34 deletions.
50 changes: 16 additions & 34 deletions 7thWrapperLoader/dllmain.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ static BOOL(WINAPI* TrueGetFileSizeEx)(HANDLE hFile, PLARGE_INTEGER lpFileSize)

DWORD currentMainThreadId = 0;
HANDLE currentMainThread = nullptr;
BOOL in7thHeaven = false;
BOOL inDotNetCode = false;

// FUNCTIONS -------------------------------------

Expand All @@ -96,11 +96,11 @@ HANDLE WINAPI _CreateFileW(LPCWSTR lpFileName, DWORD dwDesiredAccess, DWORD dwSh

if (exports.CreateFileW)
{
if (!in7thHeaven && GetCurrentThreadId() == currentMainThreadId)
if (!inDotNetCode && GetCurrentThreadId() == currentMainThreadId)
{
in7thHeaven = true;
inDotNetCode = true;
ret = exports.CreateFileW(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
in7thHeaven = false;
inDotNetCode = false;
}
}

Expand All @@ -116,11 +116,9 @@ BOOL WINAPI _ReadFile(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead,

if (exports.ReadFile)
{
if (!in7thHeaven && GetCurrentThreadId() == currentMainThreadId)
if (GetCurrentThreadId() == currentMainThreadId)
{
in7thHeaven = true;
ret = exports.ReadFile(hFile, lpBuffer, nNumberOfBytesToRead, lpNumberOfBytesRead, lpOverlapped);
in7thHeaven = false;
}
}

Expand All @@ -134,11 +132,9 @@ HANDLE WINAPI _FindFirstFileW(LPCWSTR lpFileName, LPWIN32_FIND_DATAW lpFindFileD
{
if (exports.FindFirstFileW)
{
if (!in7thHeaven && GetCurrentThreadId() == currentMainThreadId)
if (GetCurrentThreadId() == currentMainThreadId)
{
in7thHeaven = true;
exports.FindFirstFileW(lpFileName, lpFindFileData);
in7thHeaven = false;
}
}

Expand All @@ -151,11 +147,9 @@ DWORD WINAPI _SetFilePointer(HANDLE hFile, LONG lDistanceToMove, PLONG lpDistanc

if (exports.SetFilePointer)
{
if (!in7thHeaven && GetCurrentThreadId() == currentMainThreadId)
if (GetCurrentThreadId() == currentMainThreadId)
{
in7thHeaven = true;
ret = exports.SetFilePointer(hFile, lDistanceToMove, lpDistanceToMoveHigh, dwMoveMethod);
in7thHeaven = false;
}
}

Expand All @@ -171,11 +165,9 @@ BOOL WINAPI _SetFilePointerEx(HANDLE hFile, LARGE_INTEGER liDistanceToMove, PLAR

if (exports.SetFilePointer)
{
if (!in7thHeaven && GetCurrentThreadId() == currentMainThreadId)
if (GetCurrentThreadId() == currentMainThreadId)
{
in7thHeaven = true;
ret = exports.SetFilePointerEx(hFile, liDistanceToMove, lpNewFilePointer, dwMoveMethod);
in7thHeaven = false;
}
}

Expand All @@ -189,11 +181,9 @@ BOOL WINAPI _CloseHandle(HANDLE hObject)
{
if (exports.CloseHandle)
{
if (!in7thHeaven && GetCurrentThreadId() == currentMainThreadId)
if (GetCurrentThreadId() == currentMainThreadId)
{
in7thHeaven = true;
exports.CloseHandle(hObject);
in7thHeaven = false;
}
}

Expand All @@ -206,11 +196,9 @@ DWORD WINAPI _GetFileType(HANDLE hFile)

if (exports.GetFileType)
{
if (!in7thHeaven && GetCurrentThreadId() == currentMainThreadId)
if (GetCurrentThreadId() == currentMainThreadId)
{
in7thHeaven = true;
ret = exports.GetFileType(hFile);
in7thHeaven = false;
}
}

Expand All @@ -226,11 +214,11 @@ BOOL WINAPI _GetFileInformationByHandle(HANDLE hFile, LPBY_HANDLE_FILE_INFORMATI

if (exports.GetFileInformationByHandle)
{
if (!in7thHeaven && GetCurrentThreadId() == currentMainThreadId)
if (!inDotNetCode && GetCurrentThreadId() == currentMainThreadId)
{
in7thHeaven = true;
inDotNetCode = true;
ret = exports.GetFileInformationByHandle(hFile, lpFileInformation);
in7thHeaven = false;
inDotNetCode = false;
}
}

Expand All @@ -243,11 +231,9 @@ BOOL WINAPI _DuplicateHandle(HANDLE hSourceProcessHandle, HANDLE hSourceHandle,

if (exports.DuplicateHandle)
{
if (!in7thHeaven && GetCurrentThreadId() == currentMainThreadId)
if (GetCurrentThreadId() == currentMainThreadId)
{
in7thHeaven = true;
exports.DuplicateHandle(hSourceProcessHandle, hSourceHandle, hTargetProcessHandle, lpTargetHandle, dwDesiredAccess, bInheritHandle, dwOptions);
in7thHeaven = false;
}
}

Expand All @@ -260,11 +246,9 @@ DWORD WINAPI _GetFileSize(HANDLE hFile, LPDWORD lpFileSizeHigh)

if (exports.GetFileSize)
{
if (!in7thHeaven && GetCurrentThreadId() == currentMainThreadId)
if (GetCurrentThreadId() == currentMainThreadId)
{
in7thHeaven = true;
ret = exports.GetFileSize(hFile, lpFileSizeHigh);
in7thHeaven = false;
}
}

Expand All @@ -280,11 +264,9 @@ BOOL WINAPI _GetFileSizeEx(HANDLE hFile, PLARGE_INTEGER lpFileSize)

if (exports.GetFileSizeEx)
{
if (!in7thHeaven && GetCurrentThreadId() == currentMainThreadId)
if (GetCurrentThreadId() == currentMainThreadId)
{
in7thHeaven = true;
ret = exports.GetFileSizeEx(hFile, lpFileSize);
in7thHeaven = false;
}
}

Expand Down

0 comments on commit 70e95e5

Please sign in to comment.