Initial commit

.github/workflows/build.yml

@@ -0,0 +1,93 @@
+name: build
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  build:
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: cmd
+
+    strategy:
+      matrix:
+        arch:
+          - x64
+          - x86
+
+    steps:
+    - uses: actions/checkout@main
+      with:
+        fetch-depth: 1
+        submodules: true
+
+    - uses: ilammy/msvc-dev-cmd@v1
+      with:
+        arch: ${{ matrix.arch }}
+        vsversion: 2022
+
+    - uses: actions/setup-dotnet@main
+      with:
+        dotnet-version: 8.0.x
+
+    - name: Build detours
+      run: nmake
+      working-directory: detours
+
+    - name: Build the detours DLL
+      working-directory: detours-dll
+      run: |
+        mkdir bin.${{ matrix.arch }}
+        pushd bin.${{ matrix.arch }}
+        cl.exe /nologo /LD /TP /DUNICODE /DWIN32 /D_WINDOWS /EHsc /W4 /WX /Zi /O2 /Ob1 /DNDEBUG /Fodetours.obj /Fddetours.pdb ..\detours.cpp ^
+            /link /def:..\detours.def "%GITHUB_WORKSPACE%\detours\lib.${{ matrix.arch }}\detours.lib"
+        popd
+
+    - name: Apply detours.h patch
+      if: ${{ matrix.arch == 'x64' }}
+      shell: pwsh
+      run: "@(Get-Content \".\\detours\\src\\detours.h\")[0..866+920..1234] | Set-Content \".\\detours\\include\\detours.h\""
+
+    - name: Build detours metadata
+      if: ${{ matrix.arch == 'x64' }}
+      working-directory: detours-meta
+      run: dotnet build /p:BuildConfig=""
+
+    - name: Build and publish withdll
+      if: ${{ matrix.arch == 'x64' }}
+      working-directory: withdll
+      run: dotnet publish -r win-x64 -c Release -o "%GITHUB_WORKSPACE%\withdll\bin.x64"
+
+    - uses: actions/upload-artifact@main
+      with:
+        name: detours-${{ matrix.arch }}
+        path: |
+          detours/bin.${{ matrix.arch }}/syelog.exe
+          detours/bin.${{ matrix.arch }}/syelog.pdb
+          detours/bin.${{ matrix.arch }}/trcapi*.dll
+          detours/bin.${{ matrix.arch }}/trcapi*.pdb
+          detours/bin.${{ matrix.arch }}/trcmem*.dll
+          detours/bin.${{ matrix.arch }}/trcmem*.pdb
+          detours/bin.${{ matrix.arch }}/trcreg*.dll
+          detours/bin.${{ matrix.arch }}/trcreg*.pdb
+          detours/bin.${{ matrix.arch }}/trcssl*.dll
+          detours/bin.${{ matrix.arch }}/trcssl*.pdb
+          detours/bin.${{ matrix.arch }}/trctcp*.dll
+          detours/bin.${{ matrix.arch }}/trctcp*.pdb
+
+    - uses: actions/upload-artifact@main
+      with:
+        name: detours-meta
+        path: detours-meta/winmd/detours.winmd
+      if: ${{ matrix.arch == 'x64' }}
+
+    - uses: actions/upload-artifact@main
+      with:
+        name: withdll
+        path: |
+          withdll/bin.x64/withdll.exe
+          withdll/bin.x64/withdll.pdb
+      if: ${{ matrix.arch == 'x64' }}

.gitignore

@@ -0,0 +1,11 @@
+.vs/
+
+detours-meta/winmd/
+
+bin.*/
+
+bin/
+obj/
+
+*.csproj.user
+withdll/Properties/

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "detours"]
+	path = detours
+	url = https://github.com/microsoft/Detours.git

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Sebastian Solnica
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,28 @@
+
+## withdll - a small tool to perform DLL injections
+
+![build](https://github.com/lowleveldesign/withdll/workflows/build/badge.svg)
+
+This project is inspired by a sample with the same name from the [Detours repository](https://github.com/microsoft/Detours). I decided to create it as I was missing some features in the Detours' sample (most importantly, a way to inject a DLL into a running process). To make things more interesting, I decided to implement it in C#, using generated Detours bindings and NativeAOT with static detours linking. If you are interested in the binding generation, have a look at [this post](https://lowleveldesign.wordpress.com/2023/11/22/generating-c-bindings-for-native-windows-libraries/) on my blog.
+
+You may **download the compiled binaries from the [release page](https://github.com/lowleveldesign/withdll/releases)**. Each release also contains compiled Detours sample libraries that are examples of WinAPI functions tracers. I write more on how to use them in [a guide on https://wtrace.net](https://wtrace.net/guides/using-withdll-and-detours-to-trace-winapi/).
+
+Although withdll is a 64-bit application, it **supports injecting DLLs into both 32-bit and 64-bit processes**. 
+
+Example command lines:
+
+```
+withdll.exe -d trcapi64.dll C:\Windows\System32\winver.exe
+withdll.exe -d trcapi32.dll C:\Windows\SysWow64\winver.exe
+
+withdll.exe -d trcapi32.dll 1234
+```
+
+Additionally, you may install withdll as a **Image File Execution Options debugger** for a given executable, which would allow you to inject a DLL (or DLLs) on every application launch. The **--debug** option is required for this to work so please make sure you add it, for example:
+
+```
+Windows Registry Editor Version 5.00
+
+[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winver.exe]
+"Debugger"="c:\\tools\\withdll.exe --debug -d c:\\tools\\trcapi64.dll"
+```

build-all.bat

@@ -0,0 +1,48 @@
+@echo off
+
+set "blddir=%~d0%~p0"
+
+if not exist "%blddir%detours\src" (
+    pushd "%blddir%detours"
+    git submodule update --init detours
+    if errorlevel 1 exit /b 1
+    popd
+)
+
+set "bldconf=%1"
+
+echo "Building detours and detours.dll"
+cmd /c %blddir%build-detours.bat x86 %bldconf%
+if errorlevel 1 exit /b 2
+
+cmd /c %blddir%build-detours.bat x64 %bldconf%
+if errorlevel 1 exit /b 3
+
+echo "Patching Detours header for metadata generation"
+powershell -Command "@(Get-Content '%blddir%\detours\src\detours.h')[0..866+920..1234] | Set-Content '%blddir%\detours\include\detours.h'"
+
+echo "Building Detours metadata"
+pushd "%blddir%detours-meta"
+dotnet clean
+dotnet build /p:BuildConfig="%bldconf%"
+if errorlevel 1 (
+    popd
+    exit /b 3
+)
+popd
+
+echo "Building withdll"
+
+if /I "%bldconf%" == "Debug" (
+    set withdllConfig=Debug
+) else (
+    set withdllConfig=Release
+)
+
+pushd "%blddir%withdll"
+dotnet publish -r win-x64 -c %withdllConfig% -o "%blddir%withdll\bin.x64%bldconf%"
+if errorlevel 1 (
+    popd
+    exit /b 3
+)
+popd

build-detours.bat

@@ -0,0 +1,54 @@
+@echo off
+
+if "%1" == "" (
+    set bldarch=x64
+) else (
+    set "bldarch=%1"
+)
+
+if /I "%2" == "DEBUG" (
+    set DETOURS_CONFIG=Debug
+) else (
+    set DETOURS_CONFIG=
+)
+
+echo "Building detours (%bldarch%%DETOURS_CONFIG%)"
+
+set "currdir=%~d0%~p0"
+
+if EXIST "c:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\vcvarsall.bat" (
+    call "c:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\vcvarsall.bat" %bldarch%
+) else (
+    call "c:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvarsall.bat" %bldarch%
+)
+if errorlevel 1 exit /b 1
+
+pushd "%currdir%detours"
+nmake
+if errorlevel 1 (
+    popd
+    exit /b 2
+)
+popd
+
+pushd "%currdir%detours-dll"
+
+if "%DETOURS_CONFIG%" == "Debug" (
+    mkdir "bin.%bldarch%%DETOURS_CONFIG%"
+    cd "bin.%bldarch%%DETOURS_CONFIG%"
+
+    cl.exe /nologo /LD /TP /DUNICODE /DWIN32 /D_WINDOWS /EHsc /W4 /WX /Zi /Ob0 /Od /RTC1 /Fodetours.obj /Fddetours.pdb ..\detours.cpp ^
+        /link /def:..\detours.def "%currdir%detours\lib.%bldarch%%DETOURS_CONFIG%\detours.lib"
+) else (
+    mkdir "bin.%bldarch%"
+    cd "bin.%bldarch%"
+
+    cl.exe /nologo /LD /TP /DUNICODE /DWIN32 /D_WINDOWS /EHsc /W4 /WX /Zi /O2 /Ob1 /DNDEBUG /Fodetours.obj /Fddetours.pdb ..\detours.cpp ^
+        /link /def:..\detours.def "%currdir%detours\lib.%bldarch%\detours.lib"
+)
+if errorlevel 1 (
+    popd
+    exit /b 2
+)
+
+popd

detours-dll/detours.cpp

@@ -0,0 +1,16 @@
+#include <windows.h>
+
+BOOL APIENTRY DllMain(HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved) {
+    UNREFERENCED_PARAMETER(lpReserved);
+
+    switch (ul_reason_for_call) {
+    case DLL_PROCESS_ATTACH:
+        ::DisableThreadLibraryCalls(hModule);
+        break;
+    case DLL_PROCESS_DETACH:
+        break;
+    default:
+        break;
+    }
+    return TRUE;
+}

detours-dll/detours.def

@@ -0,0 +1,20 @@
+LIBRARY detours
+EXPORTS
+
+	DetourTransactionBegin
+	DetourTransactionAbort
+	DetourTransactionCommit
+	DetourTransactionCommitEx
+	DetourUpdateThread
+	DetourAttach
+	DetourDetach
+	DetourCreateProcessWithDllExW
+	DetourCreateProcessWithDllsW
+	DetourFinishHelperProcess
+	DetourGetContainingModule
+	DetourEnumerateModules
+	DetourGetEntryPoint
+	DetourGetModuleSize
+	DetourEnumerateExports
+	DetourEnumerateImports
+	DetourEnumerateImportsEx

detours-meta/generate.proj

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project Sdk="Microsoft.Windows.WinmdGenerator/0.55.45-preview">
+    <PropertyGroup Label="Globals">
+        <OutputWinmd>winmd/detours.winmd</OutputWinmd>
+        <WinmdVersion>0.1.0.0</WinmdVersion>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <Headers Include="../detours/include/detours.h" />
+
+        <ImportLibs Include="../detours-dll/bin.x64$(BuildConfig)/detours.lib">
+            <StaticLibs>detours=detours</StaticLibs>
+        </ImportLibs>
+
+        <Partition Include="main.cpp">
+            <TraverseFiles>@(Headers)</TraverseFiles>
+            <Namespace>Microsoft.Detours</Namespace>
+            <ExcludeFromCrossarch>true</ExcludeFromCrossarch>
+        </Partition> 
+    </ItemGroup>
+</Project>

detours-meta/main.cpp

@@ -0,0 +1,2 @@
+#include <windows.h>
+#include "detours.h"