Add hooking library to hook windows api with standard name (without the _ like fopen) - use include_next to include system header

Author: vricosti

3rdparty/easyhook/bin/EasyHook32.dll

@@ -11,23 +11,28 @@ list(REMOVE_ITEM lib_src ${CMAKE_CURRENT_SOURCE_DIR}/src/_tdirent.c)
 
 include_directories(../windevblk/include)
 
+
+
 add_library(
-	posix4msvc
+	posix4msvc SHARED
 	${lib_src}
 )
 
-
+add_definitions(-DDLLEXPORTS)
 
 target_include_directories(
 	posix4msvc PUBLIC
     include
 	include/bsd
 	include/sys/arch
+	3rdparty/easyhook/include
 	src
 )
 
+#../3rdparty/easyhook/lib/EasyHook32.lib
 
 target_link_libraries(
         posix4msvc
 		windevblk
+		C:/Developer/msys64/home/Vincent/posix4win/util-linux/posix4msvc/3rdparty/easyhook/lib/EasyHook32.lib
 )

3rdparty/easyhook/bin/EasyHook64.dll

@@ -2,7 +2,7 @@
 #define	_BSD_STRING_H_
 
 //#include <sys/cdefs.h>
-
+#include_next "string.h"
 #include <stddef.h>
 
 #ifdef __cplusplus

3rdparty/easyhook/include/easyhook.h

@@ -2,6 +2,11 @@
 #ifndef _P4MSVC_GETOPT_H_
 #define _P4MSVC_GETOPT_H_
 
+#ifdef DLLEXPORTS
+#define P4W_API __declspec(dllexport)
+#else
+#define P4W_API __declspec(dllimport)
+#endif
 
 #ifdef  __cplusplus
 extern "C" {
@@ -11,8 +16,8 @@ extern const int no_argument;
 extern const int required_argument;
 extern const int optional_argument;
 
-extern char* optarg;
-extern int optind, opterr, optopt;
+P4W_API extern char* optarg;
+P4W_API extern int optind, opterr, optopt;
 
 struct option {
   const char* name;

3rdparty/easyhook/lib/EasyHook32.lib

@@ -0,0 +1,23 @@
+
+#ifndef _P4MSVC_STDIO_H_
+#define _P4MSVC_STDIO_H_
+
+#include_next <stdio.h>
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+FILE *__cdecl posix_fopen(const char *path, const char *mode);
+
+//FILE *fdopen(int fd, const char *mode);
+
+//FILE *freopen(const char *path, const char *mode, FILE *stream);
+
+
+#ifdef  __cplusplus
+}
+#endif
+
+
+#endif /*_P4MSVC_STDIO_H_*/

3rdparty/easyhook/lib/EasyHook64.lib

@@ -10,7 +10,7 @@
 #define _STDLIB_EX_H_
 
 //#include <sys/cdefs.h>
-#include <stdlib.h>
+#include_next <stdlib.h>
 
 #ifdef __cplusplus
 extern "C" {

CMakeLists.txt

@@ -13,8 +13,8 @@
 #include <sys/types.h>
 #include <sys/types_ex.h>
 #include <strings.h>
-#include <stdio.h>
-#include <stdlib_ex.h>
+#include "stdio.h"
+#include "stdlib.h"
 
 /***********************************************************************/
 // Since sys/stat.h is already defined by microsoft we include missing definitions

include/bsd/string.h

@@ -0,0 +1,14 @@
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include "stdio.h"
+#include <errno.h>
+
+#include <get_osfhandle-nothrow.h>
+#include "windevblk.h"
+
+
+FILE *__cdecl 
+posix_fopen(const char *path, const char *mode)
+{
+    return fopen(path, mode);
+}

include/getopt.h

@@ -0,0 +1,29 @@
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+
+
+HINSTANCE	        g_hInstance = NULL;
+void init(void);
+void cleanup(void);
+
+
+BOOL APIENTRY DllMain(HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved)
+{
+	switch (ul_reason_for_call)
+	{
+	case DLL_PROCESS_ATTACH:
+        GetModuleHandleEx(0, NULL, &g_hInstance);
+        init();
+		break;
+	case DLL_THREAD_ATTACH:
+		break;
+
+	case DLL_THREAD_DETACH:
+		break;
+
+	case DLL_PROCESS_DETACH:
+        cleanup();
+		break;
+	}
+	return TRUE;
+}

include/stdio.h

@@ -1,4 +1,4 @@
-#include <stdlib_ex.h>
+#include "stdlib.h"
 
 
 int __cdecl

include/stdlib_ex.h renamed to include/stdlib.h

@@ -0,0 +1,94 @@
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include "stdio.h"
+
+#include "easyhook.h"
+
+static BOOL g_isInited = FALSE;
+static CRITICAL_SECTION g_critSec;
+
+static HOOK_TRACE_INFO g_hHook;
+
+void init(void);
+void cleanup(void);
+void init_hooking(void);
+void cleanup_hooking(void);
+
+// Some useful macros
+#define PPCAT_NX(A, B) A ## B
+#define PPCAT(A, B) PPCAT_NX(A, B)
+#define STRINGIZE_NX(A) #A
+#define STRINGIZE(A) STRINGIZE_NX(A)
+
+#ifndef ARRAY_SIZE
+# define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
+#endif
+
+#ifdef _DEBUG
+#define REL_OR_DBG_SUFFIX d
+#else
+#define REL_OR_DBG_SUFFIX
+#endif
+#define DEBUG_OR_RELEASE(x) STRINGIZE(PPCAT(T1, REL_OR_DBG_SUFFIX))
+
+typedef struct _HOOKING_INFO
+{
+    TCHAR ModuleName[MAX_PATH];
+    TCHAR FuncName[MAX_PATH];
+    void* InHookProc;
+} HOOKING_INFO, *PHOOKING_INFO;
+
+static HOOKING_INFO g_HookingInfo[] =
+{
+    { TEXT("ucrtbased"), TEXT("fopen"), posix_fopen },
+};
+
+void init(void)
+{
+    InitializeCriticalSection(&g_critSec);
+
+    if(!g_isInited)
+    {
+        init_hooking();
+        g_isInited = TRUE;
+    }
+    DeleteCriticalSection(&g_critSec);
+}
+
+void cleanup(void)
+{
+
+    cleanup_hooking();
+}
+
+void init_hooking(void)
+{
+    NTSTATUS result;
+    ULONG ACLEntries[1] = { 0 };
+    ZeroMemory(&g_hHook, sizeof(HOOK_TRACE_INFO));
+
+#ifndef LHINSTALLHOOK
+# define LHINSTALLHOOK(a,b,c) (LhInstallHook(GetProcAddress(GetModuleHandle(a), b), c, NULL, &g_hHook))
+#endif
+
+    for (size_t i = 0; i < ARRAY_SIZE(g_HookingInfo); i++)
+    {
+        PHOOKING_INFO pHookInfo = &g_HookingInfo[i];
+        result = LHINSTALLHOOK(pHookInfo->ModuleName, pHookInfo->FuncName, pHookInfo->InHookProc);
+        if (FAILED(result))
+            break;
+    }
+
+    if (SUCCEEDED(result))
+    {
+        LhSetInclusiveACL(ACLEntries, 1, &g_hHook);
+    }
+
+#undef LHINSTALLHOOK;
+}
+
+void cleanup_hooking(void)
+{
+    LhUninstallHook(&g_hHook);
+    LhWaitForPendingRemovals();
+}

include/unistd.h

@@ -60,11 +60,7 @@ lseek(int fd, long offset, int origin)
         HDEVBLK hDevBlk = DevBlkFromDiskHandle(handle);
         if (hDevBlk)
         {
-            liOffset.QuadPart = offset;
-            if (DevBlkSetPointerEx(handle, liOffset, &liNewOffset, origin))
-            {
-                lret = liNewOffset.LowPart;
-            }
+            lret = DevBlkSetPointer(hDevBlk, offset, (void*)0, origin);
         }
         else
         {
@@ -130,7 +126,7 @@ read(int fd, void *buf, size_t count)
         HDEVBLK hDevBlk = DevBlkFromDiskHandle(handle);
         if (hDevBlk)
         {
-            if (DevBlkRead(hDevBlk, buf, count, &dwReadLen))
+            if (DevBlkRead(hDevBlk, buf, count, &dwReadLen, NULL))
             {
                 size = dwReadLen;
             }

src/FILEio.c

@@ -29,4 +29,16 @@ fdopendir
 faccessat
 basename
 lseek64
-mkstemp
+mkstemp
+getopt
+geteuid
+getuid
+getgid
+getegid
+seteuid
+setegid
+ttyname
+ttyname_r
+fchmod
+link
+realpath

src/dllmain.c

@@ -1,4 +1,4 @@
-#include <bsd/string.h>
+//#include <bsd/string.h>
 #include <string.h>
 
 #if !HAVE_STRLCAT