Re: DirectShow question

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Chris P. [MVP] (msdn_at_chrisnet.net)
Date: 12/09/04 

Date: Thu, 9 Dec 2004 09:48:02 -0500

On Wed, 8 Dec 2004 19:15:21 +0100, Alessandro Angeli [MVP::DigitalMedia]
wrote:

>
> The idea to not use Detours is simple: do the same stuff
> Detours does on my own.
>
> In the very end, what Detours does is quite "easy": Detours
> copies N bytes from the start of the function (F) to
> somewhere else (G), then overwrites the first 5 bytes of F
> with a jump instruction to your function (H) and last
> appends to G a jump to &F[N]. The difficulty is only in the
> choice of N: N must be >= 5, it must not go beyond the end
> of F and must contain an integral number of instructions.
> This last part requires the code of F to be disassembled and
> it is not difficult but very long to write given the mess of
> the IA-32 opcodes. Of course, you need to VirtualProtect()
> both the segments of F and G so that you can write to them
> and them VirtualProtect() them as they were before.
>
> Since I didn't want to write a table of IA-32 opcodes by
> hand, I decided that I would copy the whole body of F, that
> is N = size_of_body(F). This would also make the appended
> jump not needed. Of course, there is no way to know where F
> ends without disassembling the code. But I could then copy
> the whole code segment where F resides (practically the
> whole DLL code chunk). This wastes some memory, but doesn't
> require me to know anything about IA-32 opcodes (but the
> jump opcode I have to write). The idea is that either F lies
> wholly inside this segment, or it has to perform an absolute
> jump somewhere else sooner or later, and this jump would
> still work to the original code I didn't copy. Since I copy
> the whole segment, this works even if F jump backwards in
> the segment.
>
> I had to make an assumption that F contains at least 5
> bytes, but this quite a safe assumptions (Detours actually
> checks) given that shorter-than-5-bytes instructions are not
> unconditional jumps and thus there must be other
> instructions that follow.
>
> So, let's say I want to detour F with my function H and get
> a pointer to the original function in G, I do the following
> (no error-checking or resource releasing):
>

Very cool. Although I'm not really comfortable with patching in
productions systems, it seems as though it should work in most cases.
Things might get a little more complicated when you start thinking about
different CPU types running differing builds but it's workable.

-Chris

Relevant Pages

  • Re: DirectShow question
    ... Detours does on my own. ... appends to G a jump to &F. ... wholly inside this segment, or it has to perform an absolute ... LPVOID F, /// function to detour ...
    (microsoft.public.win32.programmer.directx.audio)
  • Re: Which assembler can handle the BIG stuff ?
    ... >>PC-relative instructions. ... you don't know the meaning of the term "segment". ... > We use jump tables to jump, not to call pointers, but ... > That is except with idiot ASM programmers in this newsgroup who don't know any ...
    (alt.lang.asm)
  • Re: Problem with NASM
    ... I am using the DOS versions of NASM which may be slighty older than the Win ... to use a CS segment override to access data in the DS segment, ... a lot of bootsectors that count on that, *without* the far jump. ... In a way, a bootsector isn't a good project for a beginner, although a lot of 'em want to do it - too hard to troubleshoot, and too easy to get something that works on "my machine" but isn't "generic". ...
    (alt.lang.asm)
  • Re: EM64T how to switch from 64bit mode back to compatibility mode?
    ... a segment I have already defined but all attempts to jump there failed. ... need to reload the GDT and I still have the problem that the EIP points ...
    (comp.lang.asm.x86)
  • Re: Which assembler can handle the BIG stuff ?
    ... >a jump table, each case *always* consumes four bytes. ... segment nor a CODE segment. ... calculated from the offset. ... a table where jmp instructions are stored to ...
    (alt.lang.asm)