❓ Changing GPU info using MS Detours 3.0.

Hi everyone,
I'm trying to hook a WMI functions using the Microsoft Detours 3.0 and change the GPU information. But I have a troubles...

Information about the GPU is returned by the following method:

Code:

IEnumWbemClassObject::CreateInstanceEnum(_bstr_t("Win32_VideoController"), 
                                                         WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, 
                                                         NULL, 
                                                         &instanceEnum);

So I need to hook it. I tried to do this as follows:

Code:

typedef HRESULT(WINAPI IWbemServices::*tm_CreateInstanceEnum) (const BSTR strClass, LONG lFlags, IWbemContext *pCtx, IEnumWbemClassObject **ppEnum);
tm_CreateInstanceEnum True_CreateInstanceEnum = &IWbemServices::CreateInstanceEnum;

Code:

// My function
__declspec(dllexport) HRESULT WINAPI Hooked_CreateInstanceEnum(const BSTR strClass, LONG lFlags, IWbemContext *pCtx, IEnumWbemClassObject **ppEnum)
{
       MessageBox(0, L" Hooked!!!", L"Oh yeah, you did it !", MB_OK);
       //return True_CreateInstanceEnum(strClass, lFlags, pCtx, ppEnum); // this is wrong
       return 0;
}

Code:

BOOL APIENTRY DllMain(HINSTANCE hinst, DWORD dwReason, LPVOID reserved)
{
	if (dwReason == DLL_PROCESS_ATTACH)
	{
                DetourRestoreAfterWith();
	        DetourTransactionBegin();
                DetourAttach((PVOID*)&True_CreateInstanceEnum, Hooked_CreateInstanceEnum);
		DetourTransactionCommit();
        }
        else if (dwReason == DLL_PROCESS_DETACH)
        {
                DetourTransactionBegin();
		DetourUpdateThread(GetCurrentThread());
                DetourDetach((PVOID*)&True_CreateInstanceEnum, Hooked_CreateInstanceEnum);
                DetourTransactionCommit();
        }
{

It didn't hook anything. And I do not know why ...

However I suppose that I chose the wrong way and there are other solutions.

Does anyone know how to hook it correct?

Okay no one answered...
I decided to approach the solution differently and now I'm trying to hooks a Get method. So I got this code:

Code:

 
typedef HRESULT (WINAPI * True_GetFn)(LPCWSTR wszName, LONG lFlags, VARIANT *pVal, CIMTYPE *pvtType, LONG *plFlavor);
True_GetFn p_Get = nullptr;
 
__declspec(dllexport) HRESULT WINAPI Hooked_Get(LPCWSTR wszName, LONG lFlags, VARIANT *pVal, CIMTYPE *pvtType, LONG *plFlavor)
{
	if (wcsstr(wszName, L"VideoProcessor") != NULL || wcsstr(wszName, L"Name") != NULL || wcsstr(wszName, L"AdapterCompatibility") != NULL || wcsstr(wszName, L"SystemName") != NULL)
	{
		pVal->vt = VT_BSTR; 
		V_BSTR(pVal) = L"NO_DATA";
	}
	else if (wcsstr(wszName, L"AdapterRAM") != NULL)
	{
		pVal->vt = VT_UI4;
		V_BSTR(pVal) = L"0";
	}
	return p_Get(wszName, lFlags, pVal, pvtType, plFlavor);
}
 
PVOID SetDetour(PVOID* ppTarget, PVOID pHandler)
{
	if (DetourTransactionBegin() != NO_ERROR)
		return FALSE;
 
	if (DetourUpdateThread(GetCurrentThread()) != NO_ERROR)
	{
		DetourTransactionCommit();
		return NULL;
	}
 
	PDETOUR_TRAMPOLINE pTrampoline = NULL;
 
	if (DetourAttachEx(ppTarget, pHandler, &pTrampoline, NULL, NULL) != NO_ERROR)
	{
		DetourTransactionCommit();
		return NULL;
	}
 
	if (DetourTransactionCommit() != NO_ERROR)
	{
		DetourTransactionAbort();
		return NULL;
	}
 
	return pTrampoline;
}
 
BOOL APIENTRY DllMain(HINSTANCE hinst, DWORD dwReason, LPVOID reserved)
{
 
	HMODULE hLib = LoadLibraryA("fastprox.dll");
	if (hLib)
	{
		p_Get = (True_GetFn)GetProcAddress(hLib, "GetCWbemObject...");
		if (p_Get)
		{
			if (dwReason == DLL_PROCESS_ATTACH)
			{
				SetDetour((PVOID*)&p_Get, Hooked_Get);
			}
			else if (dwReason == DLL_PROCESS_DETACH)
			{
				DetourTransactionBegin();
				DetourUpdateThread(GetCurrentThread());
				DetourDetach((PVOID*)&p_Get, Hooked_Get);
				DetourTransactionCommit();
			}
		}
	}
        return TRUE;
}

It's compiling fine... but an error occurs when I launch a program with the attached DLL via the WITHDLL.EXE that is included in the MS Detours package.

For example, I launched the dxdiag.exe and then I see these windows:

Any ideas on why this happened and how to solve it?

First: you are trying hook a class instance not something static, so you can't do that, you will need search on your target process the addr of instance + your addr target function, now, by default every class works allocating memory for one instance and every of his functions(methods) uses that memory... so your function
convertion it's:

Code:

typedef HRESULT(__stdcall*C_CreateInstanceEnum)(void *pThis, const BSTR strClass, LONG lFlags, IWbemContext  *pCtx, IEnumWbemClassObject **ppEnum);

C_CreateInstanceEnum NewCreateInstanceEnum = (C_CreateInstanceEnum)0x1337; // put your instance pointer + your function target pointer

HRESULT __stdcall N_CreateInstanceEnum(void *pThis, const BSTR strClass, LONG lFlags, IWbemContext  *pCtx, IEnumWbemClassObject **ppEnum)
{
	// do de l33t magic staff...


	return NewCreateInstanceEnum(pThis, strClass, lFlags, pCtx, ppEnum);
}



void InitHook()
{
	DetourTransactionBegin();
	DetourUpdateThread(GetCurrentThread());
	DetourAttach(&(PVOID&)NewCreateInstanceEnum, N_CreateInstanceEnum);
	DetourTransactionCommit();

	return;
}

but if you know something of assembly so your won't need do this..., just make a jump to a clean function (naked), and call the original function, alter the parameters through esp and voila... cheers.

❓ Changing GPU info using MS Detours 3.0.

Post a Reply

Similar Threads

Tags for this Thread