Janne Mattila's blog : C/C++

Modifying application behavior with Detours (for Application Compatibility reasons)

jannemattila — Thu, 03 Dec 2009 21:06:08 GMT

My previous post was about Application Compatibility Toolkit and shims. But what if you have a bit different situation...

Imagine that I have my good old My Windows App application that has been working correctly in the past. Now it’s not maintained anymore and it seems that no one has created similar application that fulfills my needs... And now something has come up that makes this application useless in your Windows 7. Let’s take a look.

Here’s my My Windows App application that has very interesting check before you can do anything with it (notice the longest menu item text ever!):

And when you click the menu item you’ll get this kind of error and application exits:

Clearly this is not something want. You want to continue using your application despite it weird flaws etc. But since it’s not maintained anymore there’s nothing you can do with it... No support, no hot fixes... no help whatsoever... And for this particular case there isn’t readymade shim that could fix the application. So you’re left without your nice application... Unless you’re ready to do some engineering :-)

Let’s do some digging for the application itself before rushing to the solution. First I’ll do dumpbin /imports “My Windows App.exe” to see what the application actually imports. I can also use dumpbin /disasm to take closer look of it but PEBrowse does both jobs better than dumpbin so I’ll use that instead.
And since I suspect my applications “insane sanity check” to have something to do with date time functions I’ll identify GetSystemTime as potential candidate from Import Address Table (IAT). After some browsing at the PEBrowse I’m able to find this kind of disassembly:

Here is same output in text format:

CALL    DWORD PTR [KERNEL32.DLL!GetSystemTime]; (0x41A2AC) 
CMP     ESI,ESP      
CALL    0x40159F      
MOVZX    EAX,WORD PTR [EBP-0x84]
CMP     EAX,0x7D0    ; NOTE: 0x7D0 = 2000 
JE     0x404545      ; (*+0x34) 
MOV     ESI,ESP      
PUSH    0x10        
PUSH    'Error'      ; (0x416C2C) 
PUSH    'This application works in year 2000 only!'; (0x4177B8) 
MOV     EAX,DWORD PTR [EBP+0x8]
PUSH    EAX        
CALL    DWORD PTR [USER32.DLL!MessageBoxW]; (0x41A3E8) 
CMP     ESI,ESP      
CALL    0x40159F      
MOV     ESI,ESP      
MOV     EAX,DWORD PTR [EBP+0x8]
PUSH    EAX        
CALL    DWORD PTR [USER32.DLL!DestroyWindow]; (0x41A3A4) 
CMP     ESI,ESP      
CALL    0x40159F      
PUSH    0x0        
PUSH    'Do something'   ; (0x416F10) 
PUSH    'Whoo-hoo! This works correctly.'; (0x417778) 
MOV     EAX,DWORD PTR [EBP+0x8]
PUSH    EAX        
CALL    DWORD PTR [USER32.DLL!MessageBoxW]; (0x41A3E8)

Line 1 shows that GetSystemTime gets called and it fills SYSTEMTIME structure. Value from SYSTEMTIME structure (wYear) is then compared to the value 2000 on line 5. And if that value isn’t 2000 then user is displayed error message (see line 8 to 13). After error message application is closed (line 19).

I could do nasty fix (that would be easy in this example)... which would be editing the executable to bypass that check but I’m not going to do that. I don’t want to touch the executable itself.

But now we know that in order to fix this exact issue we can just _handle_ returned structure from GetSystemTime function. We need to change it to return 2000 instead of current year.

Now it’s time to bring in Detours created by Microsoft Research. Detours allows you to do exactly what we want in this case. It allows you to _detour_ function calls so that your component gets called when application tries to call that function. In order to use Detours you just need to download it and run nmake on the installation directory to build the detours itself and all the samples too. Then we’re ready to proceed to next stage.

So I’ll quickly create new Win32 project with application type DLL and name the project “My Getsystemtime” (using simple.cpp as an example from the samples\simple –folder). Then I’ll add following code to it:

#define WIN32_LEAN_AND_MEAN       // Exclude rarely-used stuff from Windows headers
#include <windows.h>
#include "detours.h"

static VOID (WINAPI * TrueGetSystemTime)(LPSYSTEMTIME lpSystemTime) = GetSystemTime;

VOID WINAPI MyGetSystemTime(LPSYSTEMTIME lpSystemTime)
{
  OutputDebugString(TEXT("'My GetSystemTime' called (faking year 2000 :-)!"));
  TrueGetSystemTime(lpSystemTime);
  lpSystemTime->wYear = 2000;
}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call,LPVOID lpReserved)
{
  LONG error;
  switch (ul_reason_for_call)
  {
  case DLL_PROCESS_ATTACH:
    OutputDebugString(TEXT("Attaching 'Fake GetSystemtime'..."));

    DetourRestoreAfterWith();
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourAttach(&(PVOID&)TrueGetSystemTime, MyGetSystemTime);
    error = DetourTransactionCommit();

    if (error == NO_ERROR) 
    {
      OutputDebugString(TEXT("Attaching 'Fake GetSystemtime'... Done!"));
    }
    else 
    {
      OutputDebugString(TEXT("Attaching 'Fake GetSystemtime'... Failed!"));
    }
    break;
  case DLL_PROCESS_DETACH:
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourDetach(&(PVOID&)TrueGetSystemTime, MyGetSystemTime);
    error = DetourTransactionCommit();

    OutputDebugString(TEXT("Detaching 'Fake GetSystemtime'."));
    break;
  }
  return TRUE;
}

And in order this code to be build correctly I’ll also need to add include folder that points to the detours installation folder and include folder underneath it. I also need to add detours.lib and detoured.lib so that linker is happy too.

Now I have my newly built DLL that I use to modify behavior of My Windows App. Detours installation package also contains command line tool withdll.exe so that you can easily test you detour DLL. I’ll just launch my application using following command line and then all should be fine (assuming that everything is at the same folder):

withdll.exe /d:"My GetSystemtime.dll" "My Windows App.exe"

And if I now click the interesting menu item I’ll see this (since my application changes the year to be 2000 on line 11 in above code sample):

And since I used OutputDebugString for demonstration purposes I’m able to verify the behavior using DebugView:

So we’re able to modify functionality of the application without touching the executable itself. This example was a bit different than my previous application compatibility one. This is much more engineering kind of solution than to use readymade tools for fixing applications. But both have it’s time and it’s place. I’ll probably continue posting more information to this category so stay tuned!

Anyways... Happy hacking!

J

My Chess (another chess application)

jannemattila — Thu, 22 Oct 2009 14:43:04 GMT

I came up with the idea of My Chess when I wanted to play games with my friends and I noticed that I don’t have time to do that :-) So I decided to write an application that allows me to play chess with my friends just by using small amount of time every now and then (approach is pretty different compared to the “normal” chess). Small amount of time means something like 10 seconds per move so and not more... Of course if you WANT to use more time you’re allowed to do that.

Here is list of other features that I wanted from My Chess:

Possibility to play offline. In another words I don’t want to think about the transport at all. I would just like to pass the transport related stuff to someone else.
Mobile version of the application (HTC Touch Pro since I have one)
“Social chess”: I wanted to have possibility to add comment when making move. Just because I want to tell to my opponents how good move I have made and remind them about their bad ones :-)
Game should be fast and easy. You should be able to make your move with just few clicks.

I decided to go with C++ since I didn’t want to take start up delay of .NET application on my mobile device. This one was easy decision :-)

Then I thought that I could use email as my transport because it automatically solves issues with the connectivity. On desktop I could rely on Outlook and mobile device I could rely on Pocket Outlook. More about technical details later in this post.

But then I was forced to think proper way to solve how to transmit the game state. I mean that how could I pass the current state of the game to my opponent so that it would be easy for him/her to continue from that state. Use of attachment at the email was one option. But the story for the end user on mobile device with attachments isn’t that good so I didn’t use effort on this option. I took another approach which was to define URL format that I could use to serialize the game state. Here is one example game state:
my://chess/MczrFh7z?w=player1@contoso.com%26b=player2@contoso.com

Game state uses my protocol which I have mapped to application (Registering an Application to a URL Protocol on MSDN). Of course My Chess is configured according to the article so that it will called when my protocol is launched. Here is example .reg how custom application can be mapped to protocol:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\my]
@="URL:My Chess Protocol"
"URL Protocol"=""

[HKEY_CLASSES_ROOT\my\shell]

[HKEY_CLASSES_ROOT\my\shell\open]

[HKEY_CLASSES_ROOT\my\shell\open\command]
@="\"C:\\path\\My Chess (x64).exe\" %1"

So it really is that simple. Just define own key under HKEY_CLASSES_ROOT and set path to your application and it will be called automatically by the OS.

If you look the same with regedit it looks like this:

If you now open up links starting with my protocol they will eventually take you to the configured application. But you probably see this kind of security dialogs before your own application starts (at least for the first time):

Just uncheck “Always ask before opening this type of address” and press Allow.

Same goes with this dialog. Just check “Do not show me the warning for this program again” and press Allow.

NOTE: Make sure you understand the consequences of allowing protocol to map to application. If you’re application doesn’t validate data correctly it may lead to security issues when someone passes malicious data to your application. Remember you have been warned!

After that you should finally be at your application and you can use the information passed on the command line to execute the required actions.

So basically now I have tools to build the application... But I haven’t yet solved the “creating the email message” part of this solution. Remember I have both desktop application and mobile application to built.

On desktop I’m using Outlook as my mail transport and it has pretty good instructions in here:
How to use an Outlook Object Model from Visual C++ by using a #import statement
How To Send a Message by Outlook Object Model with VC++

Using Outlook on desktop with C++ is almost as easy as using it from .NET. It’s straight forward thing. So far so good right!

On mobile device things aren’t quite that easy since you need to use MAPI for sending the mail message. Here are few examples for that:
Getting Started with MAPI
Practical Use of MAPI
MAPI on Windows Mobile 6: Programmatically retrieve mail BODY (sample code)

But as always things aren’t as easy as they first seem to be. Since even if I did register my protocol at the mobile device it didn’t work as I expected. The problem was that Pocket Outlook always launched the URL to the default browser even if I had registration done to my own protocol. After some digging I found out that there are many security features that prevent that from happening. So in order to do it the right way I should have to edit/configure some files to allow protocol to be launched correctly. But since this is more concept than production kind-of-application I took another route... I chose to *hijack* MMS protocol for my custom application :-) I did that because it’s one of those protocols that are configured properly to the system. It normally launches Windows Media Player but I changed that to launch My Chess instead. This is the reason why you see two links at the emails underneath. The URL structure is exactly the same... Only the protocol part is either my or mms depending on the link. I admit that this one was dirty hack...

Now we have solved pretty much everything. But what about graphics then? Well I used images from Wikipedia at the Chess piece article (example King where you can see the licenses as well). Graphics is another interesting difference between desktop application and mobile application since GDI+ headers and libraries aren’t available for the mobile environment :-( But I wanted to use GDI+ on my desktop application even if I was forced to use GDI at the mobile application. Yeah I know... someone else would have built them using the same codebase but not me.

I used following functionalities from GDI+: Bitmap, Graphics (DrawImage, DrawCachedBitmap, DrawRectangle, FillRectangle), Graphics::FromImage, FontFamily, Font, SolidBrush, Pen, CachedBitmap etc.

I used following functionalities from GDI: DeleteDC, DeleteObject, CreateCompatibleDC, CreateCompatibleBitmap, SelectObject, Rectangle, TransparentBlt, BitBlt etc.

Are you already eager to see the final outcome? Well here it goes:

Desktop version:

Mobile version (screenshot from emulator. It looks better on real device):

So how does it work in real life? Here is small example:

First if start My Chess without parameters so it creates automatically new game (in this example I play against myself):

In order to update the registry correctly for the protocol My Chess needs to be run for the first time in the “Run as administrator” –mode:

So now you have new game and you can use mouse to make the move (see simple coloring to indicate the move):

When you have done that you can press Send menu which then creates email message for you where you can add your own comment to your move (everything else is generated.. you just need to add last line):

Now the game state is passed to the opponent as just normal email. When opponent receives it and presses the link following security prompt is displayed (Note: on mobile device application is launched directly without any dialogs):

After that My Chess is opened and it’s opens the current game state directly:

And now you’re ready to make your move and then send it to the opponent with some nasty comment of course.

Current status of the My Chess is pretty much experimental / concept state since I haven’t yet implemented all the necessary functions to make it _real_ chess application:

Move validation is currently missing and all special moves haven’t been implemented (promotion is only special move that has been implemented)
Currently there isn’t way to see previous move or move history (it’s stored behind the covers but it’s not visible). I’m going to implement animations so that when user opens My Chess something like last 3 moves of the game would be animated. And user could browse the move history (with animations of course!) to see what has happened previously on the game.
I could CC the email message to email box that could be read by machine. It then could insert the game state to database, create some statistics about the games, history of games etc. This brings more possibilities to extend the game in the future. But I probably leave this to someone else...

By the way... you might have noticed that I used chess as in my URL to define which game should be launched from the my protocol. This indicates that something else might come in the future. That remains to be seen!

How could you use information provided in this blog entry for your own needs? Well here’s one: I have many times heard that customers need to “Send shortcuts” from their existing applications to each other. This could be way to do that. Just add functionality to “copy shortcut” from applications current state and then allow user to send it. Then at the receiving end you could create “proxy application” that interprets received information and opens the application into same state that the other user had. It could be pretty good improvement in many cases.

Anyways... Happy hacking!

J

My Notes (a small application between notepad and OneNote)

jannemattila — Thu, 30 Apr 2009 10:20:59 GMT

I have been using Windows 7 and Windows Server 2008 R2 since the first beta. And I mean on my “production” laptops. And I have to say that I haven’t had any major issues with them. In fact I’ve used to them so much that I don’t want to use older versions anymore :-) And there are few improvements in them that I specially enjoy. Of course the biggest one is the new taskbar... But surprisingly I have also found new application that I have “always needed”: Sticky Notes!

Sticky Notes is small application where you can write small notes to yourself. I call it “something between notepad and OneNote”. Reason for that is the fact that notepad is lightweight but it doesn’t contain any features. OneNote is full-blown application with tons of features. Sticky Notes lives between those too... It contains just enough features that make it useful and it also looks nice! The only issue I’m having with the Sticky Notes is the fact that it comes with Windows 7 only :-( So in my main “production” laptop (which is R2) I don’t have sticky notes.

For me it was a bit disappointing but I still understood the logic for that. Of course Sticky Notes isn’t “something that you would expect on the server” but since I really need this kind of application... I was forced to create one :-)

Normally when I create application I’ll just create new .NET project and start writing the application. But now I don’t want to suffer this penalty (screenshot taken from “File –> New Project: Windows Forms Application –> Run”):

Downside of .NET applications is the memory usage. Normally I don’t care about it but since now I’m going to create application that will be “always on” I just have to care about it. I don’t want to waste too much memory (I only have 8 GB of it :-). Therefore I decided to go with the native way (Win32, C/C++ or whatever you like to call it). It gives me possibility to be in control of all the used resources.

And here is the result “My Notes” application:

I’ve hidden the menus and tried to make the borders as small as possible. I don’t want to waste space as much the normal Windows application does:

“Standard” windows application doesn’t look that good either. So therefore I wanted to give it a bit more “fresh and appealing looks”. I used GDI+ and LinearGradientBrush to make it fancier. In case your wondering how to add GDI+ to your native application then it’s just this simple:

GdiplusStartupInput gdiplusStartupInput;
ULONG_PTR gdiplusToken;

GdiplusStartup(&gdiplusToken, &gdiplusStartupInput, NULL);
// ...
GdiplusShutdown(gdiplusToken);

See more about GDI+ on MSDN if your interested.

Even if I wanted the application to small borders I didn’t want to completely remove the menus. I used same thing as in IE for example... pressing Alt brings in the menu:

I also wanted to give myself possibility to extend the application little bit more and I also added context menu to the edit surface. I don’t know yet what to put there but it’s nice to have if I need it someday :-)

I had to add “graphical menu” for basic operations like New and Close (just for fun):

Graphical menu is only visible if mouse is on top of the so called caption bar (as in screenshot).

And of course this should be in x64 since I’m running my R2 on x64:

If your wondering why you don’t have the option to use x64 then you haven’t most likely checked the option in the Visual Studio setup. Just go to Control Panel and locate VS and select option to change the setup:

Then just check the x64 if that’s what you want:

And last but not least... I’ve put my My Notes to the Live Mesh folder and synchronized my content to other devices. It’s simple and since I’m saving my note content to Rich Text Format (RTF) I can open up my notes even in my Windows Mobile. So now I have pretty good solution for my notes.

Anyways... Happy hacking!

J