|
|
#ifndef _VIEW_H_
#define _VIEW_H_
//
// Constant declarations
//
#define X86_BREAKPOINT 0xcc
#define MAX_MAP_SIZE 0x80000000
#define MAP_STRIDE_BITS 10
typedef enum { None = 0, Call, Jump, Map, ThreadStart, } BPType;
//
// Structure definitions
//
typedef struct _VIEWCHAIN { BOOL bMapped; BOOL bTraced; BPType bpType; DWORD dwAddress; DWORD dwMapExtreme; BYTE jByteReplaced; struct _VIEWCHAIN *pNext; } VIEWCHAIN, *PVIEWCHAIN;
//
// Macros
//
#define WRITEBYTE(x, y) \
{ \ { \ DWORD dwOldProtect; \ \ VirtualProtect((LPVOID)(x), \ sizeof(BYTE), \ PAGE_READWRITE, \ &dwOldProtect); \ *(PBYTE)(x) = (y); \ } \ \ }
#define WRITEWORD(x, y) \
{ \ { \ DWORD dwOldProtect; \ \ VirtualProtect((LPVOID)(x), \ sizeof(WORD), \ PAGE_READWRITE, \ &dwOldProtect); \ *(WORD *)(x) = (y); \ } \ \ }
/*
#define WRITEBYTE(x, y) \
{ \ __try \ { \ *(PBYTE)(x) = (y); \ } \ __except(EXCEPTION_EXECUTE_HANDLER) \ { \ DWORD dwOldProtect; \ \ VirtualProtect((LPVOID)(x), \ sizeof(BYTE), \ PAGE_READWRITE, \ &dwOldProtect); \ *(PBYTE)(x) = (y); \ } \ \ }
#define WRITEWORD(x, y) \
{ \ __try \ { \ *(WORD *)(x) = (y); \ } \ __except(EXCEPTION_EXECUTE_HANDLER) \ { \ DWORD dwOldProtect; \ \ VirtualProtect((LPVOID)(x), \ sizeof(WORD), \ PAGE_READWRITE, \ &dwOldProtect); \ *(WORD *)(x) = (y); \ } \ \ } */
//
// Structure definitions
//
typedef struct _TAGGEDADDRESS { DWORD dwAddress; WORD wBytesReplaced; struct _TAGGEDADDRESS *pNext; } TAGGEDADDRESS, *PTAGGEDADDRESS;
typedef struct _BRANCHADDRESS { DWORD dwAddress; struct _BRANCHADDRESS *pNext; } BRANCHADDRESS, *PBRANCHADDRESS;
//
// Function definitions
//
PVIEWCHAIN AddViewToMonitor(DWORD dwAddress, BPType bpType);
BOOL InitializeViewData(VOID);
PVIEWCHAIN RestoreAddressFromView(DWORD dwAddress, BOOL bResetData);
PVIEWCHAIN FindMappedView(DWORD dwAddress);
PVIEWCHAIN FindView(DWORD dwAddress);
BOOL MapCode(PVIEWCHAIN pvMap);
BOOL PushBranch(DWORD dwAddress);
DWORD PopBranch(VOID);
BOOL AddTaggedAddress(DWORD dwAddress);
BOOL RestoreTaggedAddresses(VOID);
VOID LockMapper(VOID);
VOID UnlockMapper(VOID);
#endif //_VIEW_H_
|