SourceCodeSky

// This is the main DLL file.

#include "stdafx.h"
#include "wfspyhook.h"

using namespace System;
using namespace System::Runtime::InteropServices;
using namespace wfspy;
using namespace System::Reflection;

wchar_t __gc* GetAssemblyPath()
{
    return PtrToStringChars(Assembly::GetExecutingAssembly()->Location);
}

HMODULE GetThisModuleHandle()
{
    wchar_t __pin* wszModule = GetAssemblyPath();
    return GetModuleHandle(wszModule);
}

wchar_t __gc* GetFileMappingName(int processId = GetCurrentProcessId(), int threadId = GetCurrentThreadId())
{
    String* fileMappingName = String::Format(S"wfavhook_{0}_{1}_filemap", __box(processId), __box(threadId)); 
    return PtrToStringChars(fileMappingName);
}

wchar_t __gc* GetEventName(int processId = GetCurrentProcessId(), int threadId = GetCurrentThreadId())
{
    String* eventName = String::Format(S"wfavhook_{0}_{1}_event", __box(processId), __box(threadId)); 
    return PtrToStringChars(eventName);
}

template<class T>
void _Win32X(T t)
{
    if (t == NULL)
        Marshal::ThrowExceptionForHR(HRESULT_FROM_WIN32(GetLastError()));
}

struct WFAVCommunicationData
{
    BOOL m_bErrorFlag;
    HANDLE m_hFileMap; //Stored to help in cleanup
    HANDLE m_hEvent; //To be set when assembly is injected
    DWORD m_dwAssemblyPathSize;
    DWORD m_dwTypeNameSize;
    DWORD m_dwDataSize; //Length of additional data
    BYTE ab[1];
    
    //Assembly name starts at offset 0
    LPWSTR _GetAssemblyName()
    {
        return reinterpret_cast<LPWSTR>(&ab[0]);
    }
    
    //Immediately after the assembly name
    LPWSTR _GetTypeName()
    {
        return reinterpret_cast<LPWSTR>(&ab[m_dwAssemblyPathSize]);
    }
    
    //Immediately after the type name
    BYTE* _GetData()
    {
        return (&ab[m_dwAssemblyPathSize + m_dwTypeNameSize]);
    }
    
    //managed variants of the above methods
    String* GetAssemblyName()
    {
        return _GetAssemblyName();
    }
    
    String* GetTypeName()
    {
        return _GetTypeName();
    }
    
    Byte GetData() []
    {
        Byte data[] = new Byte[m_dwDataSize];
        Marshal::Copy(IntPtr(_GetData()), data, 0, m_dwDataSize);

        return data;
    }
    
    void Cleanup()
    {
        if (m_hEvent)
            CloseHandle(m_hEvent);

        if (m_hFileMap)
            CloseHandle(m_hFileMap);
    }
    
    static WFAVCommunicationData* Construct(int processID, int threadID, String* assemblyPath, String* typeName, Byte additionalData[])
    {
        DWORD dwAssemblyPathSize = (assemblyPath->Length + 1)*sizeof(WCHAR);
        DWORD dwTypeNameSize = (typeName->Length + 1)*sizeof(WCHAR);
        DWORD dwDataSize = additionalData->Length;
    
        DWORD cbTotalLen = 
                dwAssemblyPathSize + dwTypeNameSize + dwDataSize + //Length of data
                sizeof(DWORD)*3 + //Length of the data length holders
                sizeof(WFAVCommunicationData); //Size of structure itself
        
        WFAVCommunicationData* pwfcd = NULL;

        try
        {
            wchar_t __pin * wszFileMappingName = GetFileMappingName(processID, threadID);
            HANDLE hFileMapping = CreateFileMapping(NULL, NULL, PAGE_READWRITE, 0, cbTotalLen, wszFileMapping[!==More==!]