Initial commit

vendor/DllNotify/DllNotify.cpp

@@ -0,0 +1,80 @@
+#include "DllNotify.h"
+#include "D2Template.h"
+
+using namespace dllnotify;
+
+DllNotify::DllNotify() 
+{
+}
+
+static bool m_d2expres_loaded;
+static bool m_sgd2freeres_loaded;
+
+bool DllNotify::is_d2expres() {
+	return m_d2expres_loaded;
+}
+
+bool DllNotify::is_sgd2freeres() {
+	return m_sgd2freeres_loaded;
+}
+
+VOID CALLBACK DllNotify::LdrDllNotification(
+	_In_      ULONG NotificationReason,
+	_In_      PCLDR_DLL_NOTIFICATION_DATA NotificationData,
+	_In_opt_  PVOID Context
+)
+{
+	if (NotificationReason == LDR_DLL_NOTIFICATION_REASON_LOADED)
+	{
+		// D2Expres.dll want load?
+		if (lstrcmpiW(NotificationData->Loaded.BaseDllName->Buffer, L"d2expres.dll") == 0) {
+			DLLBASE_D2EXPRES = (DWORD)NotificationData->Loaded.DllBase;
+			m_d2expres_loaded = true;
+		}
+
+		// SGD2FreeRes.dll want load?
+		if (lstrcmpiW(NotificationData->Loaded.BaseDllName->Buffer, L"SGD2FreeRes.dll") == 0) {
+			DLLBASE_SGD2FREERES = (DWORD)NotificationData->Loaded.DllBase;
+			m_sgd2freeres_loaded = true;
+		}
+	}
+}
+
+static PVOID cookie;
+static DllNotify::PLDR_REGISTER_DLL_NOTIFICATION    p_LdrRegisterDllNotification;
+static DllNotify::PLDR_UNREGISTER_DLL_NOTIFICATION  p_LdrUnRegisterDllNotification;
+
+BOOL DllNotify::Init_Dllnotify()
+{
+	NTSTATUS status = 1;
+	HMODULE ntdll = GetModuleHandleW(L"ntdll.dll");
+
+	p_LdrRegisterDllNotification = (PLDR_REGISTER_DLL_NOTIFICATION)GetProcAddress(ntdll, "LdrRegisterDllNotification");
+	p_LdrUnRegisterDllNotification = (PLDR_UNREGISTER_DLL_NOTIFICATION)GetProcAddress(ntdll, "LdrUnRegisterDllNotification");
+
+	if (p_LdrRegisterDllNotification)
+	{
+		status = p_LdrRegisterDllNotification(
+			0, // must be zero
+			LdrDllNotification,
+			0, // context,
+			&cookie
+		);
+	}
+
+	return status == 0;
+}
+
+
+BOOL DllNotify::Uninit_Dllnotify()
+{
+	NTSTATUS status = 1;
+
+	if (p_LdrUnRegisterDllNotification)
+	{
+		status = p_LdrUnRegisterDllNotification(cookie);
+		cookie = 0;
+	}
+
+	return status == 0;
+}

vendor/DllNotify/DllNotify.h

@@ -0,0 +1,73 @@
+#pragma once
+
+#include <windows.h>
+#include <NTSecAPI.h>
+
+#define LDR_DLL_NOTIFICATION_REASON_LOADED 1
+#define LDR_DLL_NOTIFICATION_REASON_UNLOADED 2
+
+namespace dllnotify
+{
+	class DllNotify
+	{
+	public:
+		DllNotify();
+		virtual ~DllNotify() noexcept {}
+		
+		typedef const UNICODE_STRING* PCUNICODE_STRING;
+
+		typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA {
+			ULONG Flags;                    //Reserved.
+			PCUNICODE_STRING FullDllName;   //The full path name of the DLL module.
+			PCUNICODE_STRING BaseDllName;   //The base file name of the DLL module.
+			PVOID DllBase;                  //A pointer to the base address for the DLL in memory.
+			ULONG SizeOfImage;              //The size of the DLL image, in bytes.
+		} LDR_DLL_LOADED_NOTIFICATION_DATA, * PLDR_DLL_LOADED_NOTIFICATION_DATA;
+
+		typedef struct _LDR_DLL_UNLOADED_NOTIFICATION_DATA {
+			ULONG Flags;                    //Reserved.
+			PCUNICODE_STRING FullDllName;   //The full path name of the DLL module.
+			PCUNICODE_STRING BaseDllName;   //The base file name of the DLL module.
+			PVOID DllBase;                  //A pointer to the base address for the DLL in memory.
+			ULONG SizeOfImage;              //The size of the DLL image, in bytes.
+		} LDR_DLL_UNLOADED_NOTIFICATION_DATA, * PLDR_DLL_UNLOADED_NOTIFICATION_DATA;
+
+		typedef union _LDR_DLL_NOTIFICATION_DATA {
+			LDR_DLL_LOADED_NOTIFICATION_DATA Loaded;
+			LDR_DLL_UNLOADED_NOTIFICATION_DATA Unloaded;
+		} LDR_DLL_NOTIFICATION_DATA, * PLDR_DLL_NOTIFICATION_DATA;
+
+		typedef const _LDR_DLL_NOTIFICATION_DATA* PCLDR_DLL_NOTIFICATION_DATA;
+
+		typedef VOID(CALLBACK* PLDR_DLL_NOTIFICATION_FUNCTION)(
+			_In_      ULONG NotificationReason,
+			_In_      PCLDR_DLL_NOTIFICATION_DATA NotificationData,
+			_In_opt_  PVOID Context
+			);
+
+		typedef NTSTATUS(NTAPI* PLDR_REGISTER_DLL_NOTIFICATION)(
+			_In_      ULONG Flags,
+			_In_      PLDR_DLL_NOTIFICATION_FUNCTION NotificationFunction,
+			_In_opt_  PVOID Context,
+			_Out_     PVOID* Cookie
+			);
+
+
+		typedef NTSTATUS(NTAPI* PLDR_UNREGISTER_DLL_NOTIFICATION)(
+			_In_  PVOID Cookie
+			);
+
+		static BOOL Init_Dllnotify();
+		static BOOL Uninit_Dllnotify();
+		static bool is_d2expres();
+		static bool is_sgd2freeres();
+
+
+	private:
+		static VOID CALLBACK LdrDllNotification(
+			_In_      ULONG NotificationReason,
+			_In_      PCLDR_DLL_NOTIFICATION_DATA NotificationData,
+			_In_opt_  PVOID Context
+		);
+	};
+}