using System; using System.Collections.Concurrent; using System.Collections.Generic; using System.Linq; using System.Runtime.InteropServices; using Dalamud.Logging.Internal; using Dalamud.Memory; using Iced.Intel; namespace Dalamud.Hooking.Internal; /// /// This class manages the final disposition of hooks, cleaning up any that have not reverted their changes. /// [ServiceManager.EarlyLoadedService] internal class HookManager : IDisposable, IServiceType { /// /// Logger shared with /// internal static readonly ModuleLog Log = new("HM"); [ServiceManager.ServiceConstructor] private HookManager() { } /// /// Gets sync root object for hook enabling/disabling. /// internal static object HookEnableSyncRoot { get; } = new(); /// /// Gets a static list of tracked and registered hooks. /// internal static ConcurrentDictionary TrackedHooks { get; } = new(); /// /// Gets a static dictionary of unhookers for a hooked address. /// internal static ConcurrentDictionary Unhookers { get; } = new(); /// /// Creates a new Unhooker instance for the provided address if no such unhooker was already registered, or returns /// an existing instance if the address registered previously. /// /// The address of the instruction. /// The minimum amount of bytes to restore when unhooking. Defaults to 0. /// The maximum amount of bytes to restore when unhooking. Defaults to 0x32. /// A new Unhooker instance. public static Unhooker RegisterUnhooker(IntPtr address, int minBytes = 0, int maxBytes = 0x32) { Log.Verbose($"Registering hook at 0x{address.ToInt64():X} (minBytes=0x{minBytes:X}, maxBytes=0x{maxBytes:X})"); return Unhookers.GetOrAdd(address, _ => new Unhooker(address, minBytes, maxBytes)); } /// /// Gets a static dictionary of the number of hooks on a given address. /// internal static ConcurrentDictionary> MultiHookTracker { get; } = new(); /// public void Dispose() { RevertHooks(); TrackedHooks.Clear(); Unhookers.Clear(); } /// /// Follow a JMP or Jcc instruction to the next logical location. /// /// Address of the instruction. /// The address referenced by the jmp. internal static IntPtr FollowJmp(IntPtr address) { while (true) { var hasOtherHooks = HookManager.Unhookers.ContainsKey(address); if (hasOtherHooks) { // This address has been hooked already. Do not follow a jmp into a trampoline of our own making. Log.Verbose($"Detected hook trampoline at {address.ToInt64():X}, stopping jump resolution."); return address; } if (address.ToInt64() <= 0) throw new InvalidOperationException($"Address was <= 0, this can't be happening?! ({address:X})"); var bytes = MemoryHelper.ReadRaw(address, 8); var codeReader = new ByteArrayCodeReader(bytes); var decoder = Decoder.Create(64, codeReader); decoder.IP = (ulong)address.ToInt64(); decoder.Decode(out var inst); if (inst.Mnemonic == Mnemonic.Jmp) { var kind = inst.Op0Kind; IntPtr newAddress; switch (inst.Op0Kind) { case OpKind.NearBranch64: case OpKind.NearBranch32: case OpKind.NearBranch16: newAddress = (IntPtr)inst.NearBranchTarget; break; case OpKind.Immediate16: case OpKind.Immediate8to16: case OpKind.Immediate8to32: case OpKind.Immediate8to64: case OpKind.Immediate32to64: case OpKind.Immediate32 when IntPtr.Size == 4: case OpKind.Immediate64: newAddress = (IntPtr)inst.GetImmediate(0); break; case OpKind.Memory when inst.IsIPRelativeMemoryOperand: newAddress = (IntPtr)inst.IPRelativeMemoryAddress; newAddress = Marshal.ReadIntPtr(newAddress); break; case OpKind.Memory: newAddress = (IntPtr)inst.MemoryDisplacement64; newAddress = Marshal.ReadIntPtr(newAddress); break; default: var debugBytes = string.Join(" ", bytes.Take(inst.Length).Select(b => $"{b:X2}")); throw new Exception($"Unknown OpKind {inst.Op0Kind} from {debugBytes}"); } Log.Verbose($"Resolving assembly jump ({kind}) from {address.ToInt64():X} to {newAddress.ToInt64():X}"); address = newAddress; } else { break; } } return address; } private static void RevertHooks() { foreach (var unhooker in Unhookers.Values) { unhooker.Unhook(); } } }