Skip to content

Instantly share code, notes, and snippets.

@K900
Created June 20, 2020 06:04
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save K900/6bb50f0e9f4b07471225a1017e930ff5 to your computer and use it in GitHub Desktop.
Save K900/6bb50f0e9f4b07471225a1017e930ff5 to your computer and use it in GitHub Desktop.
So this turned out easier than I expected
#include "pch.h"
#include <winsock.h>
#include <detours.h>
#include <map>
#pragma comment(lib, "user32.lib")
#pragma comment(lib, "ws2_32.lib")
static std::map<HANDLE, char*> HANDLE_TO_POINTER;
HANDLE(WINAPI* Real_WSAAsyncGetHostByName)(HWND hwnd, u_int msg, CONST char* name, char* buf, int bufsize) = WSAAsyncGetHostByName;
BOOL(WINAPI* Real_GetMessageA)(LPMSG msg, HWND hwnd, UINT filterMin, UINT filterMax) = GetMessageA;
BOOL WINAPI Mine_GetMessageA(LPMSG msg, HWND hwnd, UINT filterMin, UINT filterMax) {
BOOL result = Real_GetMessageA(msg, hwnd, filterMin, filterMax);
if (result < 0) {
return result;
}
if (msg->message == 0x8001) {
if (!WSAGETASYNCERROR(msg->lParam)) {
HOSTENT* host = reinterpret_cast<HOSTENT*>(HANDLE_TO_POINTER[(HANDLE)msg->wParam]);
if (host->h_addrtype == AF_INET) {
host->h_length = 4;
}
}
}
return result;
}
HANDLE WINAPI Mine_WSAAsyncGetHostByName(HWND hwnd, u_int msg, char* name, char* buf, int bufsize) {
HANDLE handle = Real_WSAAsyncGetHostByName(hwnd, msg, name, buf, bufsize);
HANDLE_TO_POINTER[handle] = buf;
return handle;
}
BOOL WINAPI DllMain(HINSTANCE hinst, DWORD dwReason, LPVOID reserved)
{
if (DetourIsHelperProcess()) {
return TRUE;
}
if (dwReason == DLL_PROCESS_ATTACH) {
DetourRestoreAfterWith();
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach(&(PVOID&)Real_WSAAsyncGetHostByName, Mine_WSAAsyncGetHostByName);
DetourAttach(&(PVOID&)Real_GetMessageA, Mine_GetMessageA);
DetourTransactionCommit();
}
else if (dwReason == DLL_PROCESS_DETACH) {
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourDetach(&(PVOID&)Real_WSAAsyncGetHostByName, Mine_WSAAsyncGetHostByName);
DetourDetach(&(PVOID&)Real_GetMessageA, Mine_GetMessageA);
DetourTransactionCommit();
}
return TRUE;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment