About hotpatchable dlls on ReactOS

[Hermès BÉLUSCA - MAÏTO]

Hi guys !

 

It seems to appear that some games need standard APIs hotpatchable, in the
sense of MS: few extra bytes present in the prologue of the functions that
allow somebody to detour the API. I knew that this feature was useful for
windows updates, but what I didn’t know is that there are other programs
that use it: see this answer from James on the “Epic Win!” forum thread:
http://www.reactos.org/forum/viewtopic.php?f=2
<http://www.reactos.org/forum/viewtopic.php?f=2&t=10972&p=106823#p106814>
&t=10972&p=106823#p106814 , and the following post is something that I’ve
found about this subject, and the fact that Wine already have done something
about that.

 

So my question: should we support/create hotpatchable images (of the
standard dlls and maybe ?? exes) in ReactOS ? Is it already done ? If not,
what needs to be added ? It seems that MSVC and GCC handle that a bit
differently.

 

Cheers,

Hermès BÉLUSCA - MAÏTO

[Ged Murphy]

Are you referring to .msp’s ?

 

From: ros-dev-bounces(a)reactos.org [mailto:[e-mail]] On
Behalf Of Hermès BÉLUSCA - MAÏTO
Sent: 28 February 2014 13:53
To: ReactOS Development List
Subject: [ros-dev] About hotpatchable dlls on ReactOS

 

Hi guys !

 

It seems to appear that some games need standard APIs hotpatchable, in the
sense of MS: few extra bytes present in the prologue of the functions that
allow somebody to detour the API. I knew that this feature was useful for
windows updates, but what I didn’t know is that there are other programs
that use it: see this answer from James on the “Epic Win!” forum thread:
http://www.reactos.org/forum/viewtopic.php?f=2
<http://www.reactos.org/forum/viewtopic.php?f=2&t=10972&p=106823#p106814>
&t=10972&p=106823#p106814 , and the following post is something that I’ve
found about this subject, and the fact that Wine already have done something
about that.

 

So my question: should we support/create hotpatchable images (of the
standard dlls and maybe ?? exes) in ReactOS ? Is it already done ? If not,
what needs to be added ? It seems that MSVC and GCC handle that a bit
differently.

 

Cheers,

Hermès BÉLUSCA - MAÏTO

[Sven Barth]

Am 28.02.2014 14:54, schrieb Ged Murphy:
>  
>  Are you referring to .msp's ?
>
>  
I think he merely means that some games seem to utilize the hotpatch* 
nature of Windows DLLs to hook in their own code. Not that I'd not like 
to have the full hotpatch functionality in ReactOS... ;)

(*) A nop-like instruction near the beginning of a function which can be 
replaced by a relative jump to a few bytes back where a jump to an 
alternative implementation can be included. Normally used to implement a 
patched version of the function for Windows' hotpatching functionality.

Regards,
Sven

[Hermès BÉLUSCA - MAÏTO]

Yep it’s what I was referring to.

 

De : ros-dev-bounces(a)reactos.org [mailto:[e-mail]] De la
part de Sven Barth
Envoyé : vendredi 28 février 2014 15:14
À : ros-dev(a)reactos.org
Objet : Re: [ros-dev] About hotpatchable dlls on ReactOS

 

Am 28.02.2014 14:54, schrieb Ged Murphy:

Are you referring to .msp’s ?

 

I think he merely means that some games seem to utilize the hotpatch* nature
of Windows DLLs to hook in their own code. Not that I'd not like to have the
full hotpatch functionality in ReactOS... ;)

(*) A nop-like instruction near the beginning of a function which can be
replaced by a relative jump to a few bytes back where a jump to an
alternative implementation can be included. Normally used to implement a
patched version of the function for Windows' hotpatching functionality.

Regards,
Sven

[Hermès BÉLUSCA - MAÏTO]

Not exactly. I’m referring to the fact that, starting with Windows XP sp1
(or 2), and in windows 2k3, usual dlls like kernel32, user32 and others (and
maybe some exes) have, in the prologue of their exported APIs, two bytes
that allows for detouring the API (that allows for in-memory hotpatch).
Maybe that it’s used when patching a core dll, when you cannot modify its
file directly without any reboot (otherwise you would need to reboot for the
effects to take change). Here it also appears that some games and some
applications try to patch in-memory some of those Apis, and if they cannot,
they fail.

 

Searching on wine commits / mailing lists for “hotpatch” and
“DECLSPEC_HOTPATCH” (altough that it’s something which doesn’t exist in the
PSDK) may give more precision on that subject.

 

Hermes

 

De : ros-dev-bounces(a)reactos.org [mailto:[e-mail]] De la
part de Ged Murphy
Envoyé : vendredi 28 février 2014 14:55
À : 'ReactOS Development List'
Objet : Re: [ros-dev] About hotpatchable dlls on ReactOS

 

Are you referring to .msp’s ?

 

From: ros-dev-bounces(a)reactos.org [mailto:[e-mail]] On
Behalf Of Hermès BÉLUSCA - MAÏTO
Sent: 28 February 2014 13:53
To: ReactOS Development List
Subject: [ros-dev] About hotpatchable dlls on ReactOS

 

Hi guys !

 

It seems to appear that some games need standard APIs hotpatchable, in the
sense of MS: few extra bytes present in the prologue of the functions that
allow somebody to detour the API. I knew that this feature was useful for
windows updates, but what I didn’t know is that there are other programs
that use it: see this answer from James on the “Epic Win!” forum thread:
http://www.reactos.org/forum/viewtopic.php?f=2
<http://www.reactos.org/forum/viewtopic.php?f=2&t=10972&p=106823#p106814>
&t=10972&p=106823#p106814 , and the following post is something that I’ve
found about this subject, and the fact that Wine already have done something
about that.

 

So my question: should we support/create hotpatchable images (of the
standard dlls and maybe ?? exes) in ReactOS ? Is it already done ? If not,
what needs to be added ? It seems that MSVC and GCC handle that a bit
differently.

 

Cheers,

Hermès BÉLUSCA - MAÏTO

[Ged Murphy]

Ahh, the detours trampoline. Hand over £10k to Microsoft and you can have
their source ;)

 

 

From: ros-dev-bounces(a)reactos.org [mailto:[e-mail]] On
Behalf Of Hermès BÉLUSCA - MAÏTO
Sent: 28 February 2014 14:29
To: 'ReactOS Development List'
Subject: Re: [ros-dev] About hotpatchable dlls on ReactOS

 

Not exactly. I’m referring to the fact that, starting with Windows XP sp1
(or 2), and in windows 2k3, usual dlls like kernel32, user32 and others (and
maybe some exes) have, in the prologue of their exported APIs, two bytes
that allows for detouring the API (that allows for in-memory hotpatch).
Maybe that it’s used when patching a core dll, when you cannot modify its
file directly without any reboot (otherwise you would need to reboot for the
effects to take change). Here it also appears that some games and some
applications try to patch in-memory some of those Apis, and if they cannot,
they fail.

 

Searching on wine commits / mailing lists for “hotpatch” and
“DECLSPEC_HOTPATCH” (altough that it’s something which doesn’t exist in the
PSDK) may give more precision on that subject.

 

Hermes

 

De : ros-dev-bounces(a)reactos.org <mailto:[e-mail]>
[mailto:[e-mail]] De la part de Ged Murphy
Envoyé : vendredi 28 février 2014 14:55
À : 'ReactOS Development List'
Objet : Re: [ros-dev] About hotpatchable dlls on ReactOS

 

Are you referring to .msp’s ?

 

From: ros-dev-bounces(a)reactos.org <mailto:[e-mail]>
[mailto:[e-mail]] On Behalf Of Hermès BÉLUSCA - MAÏTO
Sent: 28 February 2014 13:53
To: ReactOS Development List
Subject: [ros-dev] About hotpatchable dlls on ReactOS

 

Hi guys !

 

It seems to appear that some games need standard APIs hotpatchable, in the
sense of MS: few extra bytes present in the prologue of the functions that
allow somebody to detour the API. I knew that this feature was useful for
windows updates, but what I didn’t know is that there are other programs
that use it: see this answer from James on the “Epic Win!” forum thread:
http://www.reactos.org/forum/viewtopic.php?f=2
<http://www.reactos.org/forum/viewtopic.php?f=2&t=10972&p=106823#p106814>
&t=10972&p=106823#p106814 , and the following post is something that I’ve
found about this subject, and the fact that Wine already have done something
about that.

 

So my question: should we support/create hotpatchable images (of the
standard dlls and maybe ?? exes) in ReactOS ? Is it already done ? If not,
what needs to be added ? It seems that MSVC and GCC handle that a bit
differently.

 

Cheers,

Hermès BÉLUSCA - MAÏTO

[Steven Edwards]

Here is a reimplementation for those that don't want to pay the 10k

http://www.codeproject.com/Articles/44326/MinHook-The-Minimalistic-x86-x64-…

On Fri, Feb 28, 2014 at 7:11 AM, Ged Murphy
<gedmurphy.maillists(a)gmail.com>wrote;wrote:

>   Ahh, the detours trampoline. Hand over £10k to
> Microsoft and you can have
>  their source ;)
>
>
>
>
>
>  *From:* ros-dev-bounces(a)reactos.org [mailto:[e-mail]] *On
>  Behalf Of *Hermès BÉLUSCA - MAÏTO
>  *Sent:* 28 February 2014 14:29
>  *To:* 'ReactOS Development List'
>  *Subject:* Re: [ros-dev] About hotpatchable dlls on ReactOS
>
>
>
>  Not exactly. I'm referring to the fact that, starting with Windows XP sp1
>  (or 2), and in windows 2k3, usual dlls like kernel32, user32 and others
>  (and maybe some exes) have, in the prologue of their exported APIs, two
>  bytes that allows for detouring the API (that allows for in-memory
>  hotpatch). Maybe that it's used when patching a core dll, when you cannot
>  modify its file directly without any reboot (otherwise you would need to
>  reboot for the effects to take change). Here it also appears that some
>  games and some applications try to patch in-memory some of those Apis, and
>  if they cannot, they fail.
>
>
>
>  Searching on wine commits / mailing lists for "hotpatch" and
>  "DECLSPEC_HOTPATCH" (altough that it's something which doesn't exist in
> the
>  PSDK) may give more precision on that subject.
>
>
>
>  Hermes
>
>
>
>  *De :* ros-dev-bounces(a)reactos.org
> [mailto:[e-mail]<[e-mail]>]
>  *De la part de* Ged Murphy
>  *Envoyé :* vendredi 28 février 2014 14:55
>  *À :* 'ReactOS Development List'
>  *Objet :* Re: [ros-dev] About hotpatchable dlls on ReactOS
>
>
>
>  Are you referring to .msp's ?
>
>
>
>  *From:* ros-dev-bounces(a)reactos.org
> [mailto:[e-mail]<[e-mail]>]
>  *On Behalf Of *Hermès BÉLUSCA - MAÏTO
>  *Sent:* 28 February 2014 13:53
>  *To:* ReactOS Development List
>  *Subject:* [ros-dev] About hotpatchable dlls on ReactOS
>
>
>
>  Hi guys !
>
>
>
>  It seems to appear that some games need standard APIs hotpatchable, in the
>  sense of MS: few extra bytes present in the prologue of the functions that
>  allow somebody to detour the API. I knew that this feature was useful for
>  windows updates, but what I didn't know is that there are other programs
>  that use it: see this answer from James on the "Epic Win!" forum thread:
>  http://www.reactos.org/forum/viewtopic.php?f=2&t=10972&p=106823#p10… ,
>  and the following post is something that I've found about this subject, and
>  the fact that Wine already have done something about that.
>
>
>
>  So my question: should we support/create hotpatchable images (of the
>  standard dlls and maybe ?? exes) in ReactOS ? Is it already done ? If not,
>  what needs to be added ? It seems that MSVC and GCC handle that a bit
>  differently.
>
>
>
>  Cheers,
>
>  Hermès BÉLUSCA - MAÏTO
>
>  _______________________________________________
>  Ros-dev mailing list
>  Ros-dev(a)reactos.org
>  http://www.reactos.org/mailman/listinfo/ros-dev
>  


-- 
Steven Edwards

"There is one thing stronger than all the armies in the world, and that is
an idea whose time has come." - Victor Hugo