Skip to content

Commit

Permalink
Move CreateFile hook from kernel32 to kernelbase; fixes Vol. 2 asset …
Browse files Browse the repository at this point in the history
…swaps for Vol. 2 spooky update
  • Loading branch information
Prof9 committed Nov 1, 2023
1 parent db1c46e commit 5a60e40
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions chaudloader/src/hooks/stage1.rs
Original file line number Diff line number Diff line change
Expand Up @@ -118,9 +118,9 @@ unsafe fn on_create_file(

/// Install hooks into the process.
pub unsafe fn install() -> Result<(), anyhow::Error> {
static KERNEL32: std::sync::LazyLock<windows_libloader::ModuleHandle> =
static KERNELBASE: std::sync::LazyLock<windows_libloader::ModuleHandle> =
std::sync::LazyLock::new(|| unsafe {
windows_libloader::ModuleHandle::get("kernel32.dll").unwrap()
windows_libloader::ModuleHandle::get("kernelbase.dll").unwrap()
});

// BNLC actually uses both CreateFileA and CreateFileW... It seems like the third-party code uses CreateFileW but the BNLC code itself uses CreateFileA...
Expand All @@ -129,7 +129,7 @@ pub unsafe fn install() -> Result<(), anyhow::Error> {
unsafe {
CreateFileWHook
.initialize(
std::mem::transmute(KERNEL32.get_symbol_address("CreateFileW").unwrap()),
std::mem::transmute(KERNELBASE.get_symbol_address("CreateFileW").unwrap()),
{
move |lp_file_name,
dw_desired_access,
Expand Down Expand Up @@ -159,7 +159,7 @@ pub unsafe fn install() -> Result<(), anyhow::Error> {

CreateFileAHook
.initialize(
std::mem::transmute(KERNEL32.get_symbol_address("CreateFileA").unwrap()),
std::mem::transmute(KERNELBASE.get_symbol_address("CreateFileA").unwrap()),
{
move |lp_file_name,
dw_desired_access,
Expand Down

0 comments on commit 5a60e40

Please sign in to comment.