Skip to content

UninstallHook raised exception #7

Description

@hafedh-trimeche

Hello,

Please note this exception raised by FastMM:

FastMM_GetMem_GetSmallBlock($0000000001d4f7d0)
@GetMem(??)
@NewUnicodeString(16)
@UStrSetLength('',16)
_UInt64ToHexString(140718007382672,16,12,'0','')
IntToHex(??,??,'')
WideFormatBuf($00000080000043c0,4095,$0000000000fd8c34,34,([0]=(((_Reserved1=140718007382672,VType=5)))),(CurrencyString='',CurrencyFormat=0,CurrencyDecimals=0,DateSeparator='-',TimeSeparator=':',ListSeparator=#$0,ShortDateFormat='',LongDateFormat='yyyy-mm-dd',TimeAMString='',TimePMString='',ShortTimeFormat='',LongTimeFormat='hh:nn:ss.zzz',ShortMonthNames=([1]='',[2]='',[3]='',[4]='',[5]='',[6]='',[7]='',[8]='',[9]='',[10]='',[11]='',[12]='')))
FormatBuf(??,??,(??),??,([0]=(((_Reserved1=140718007382672,VType=5)))),(CurrencyString='',CurrencyFormat=0,CurrencyDecimals=0,DateSeparator='-',TimeSeparator=':',ListSeparator=#$0,ShortDateFormat='',LongDateFormat='yyyy-mm-dd',TimeAMString='',TimePMString='',ShortTimeFormat='',LongTimeFormat='hh:nn:ss.zzz',ShortMonthNames=([1]='',[2]='',[3]='',[4]='',[5]='',[6]='',[7]='',[8]='',[9]='',[10]='',[11]='',[12]='')))
FmtStr('','Attempting to uninstall hook at %p',([0]=(((_Reserved1=140718007382672,VType=5))),[1]=(((_Reserved1=0,VType=0))),[2]=(((_Reserved1=16616176,VType=0))),[3]=(((_Reserved1=140718007382016,VType=0))),[4]=(((_Reserved1=549755839664,VType=0))),[5]=(((_Reserved1=140717961651723,VType=14))),[6]=(((_Reserved1=2731615780864,VType=112)))),(CurrencyString='',CurrencyFormat=0,CurrencyDecimals=0,DateSeparator='-',TimeSeparator=':',ListSeparator=#$0,ShortDateFormat='',LongDateFormat='yyyy-mm-dd',TimeAMString='',TimePMString='',ShortTimeFormat='',LongTimeFormat='hh:nn:ss.zzz',ShortMonthNames=([1]='',[2]='',[3]='',[4]='',[5]='',[6]='',[7]='',[8]='',[9]='',[10]='',[11]='',[12]='')))
Format(??,([0]=(((_Reserved1=??,VType=??)))),(CurrencyString='',CurrencyFormat=0,CurrencyDecimals=0,DateSeparator='-',TimeSeparator=':',ListSeparator=#$0,ShortDateFormat='',LongDateFormat='yyyy-mm-dd',TimeAMString='',TimePMString='',ShortTimeFormat='',LongTimeFormat='hh:nn:ss.zzz',ShortMonthNames=([1]='',[2]='',[3]='',[4]='',[5]='',[6]='',[7]='',[8]='',[9]='',[10]='',[11]='',[12]='')),'')
Format(??,([0]=(((_Reserved1=??,VType=??)))),'')
OutputDebugStringFmt('Attempting to uninstall hook at %p',([0]=(((_Reserved1=140718007382672,VType=5)))))
UninstallHook($00007ffb76d7f290,??)
HookedNtQueryVirtualMemory(18446744073709551615,$0000027c25fd0000,MemoryRegionInformation,$00000080000fde18,48,nil)
HookedNtQueryVirtualMemory(18446744073709551615,$0000027c25fd0000,MemoryRegionInformation,$00000080000fde18,48,nil)

Raised inside:

function UninstallHook(
  const ATargetFunc: Pointer;   // Address of the hooked function.
  const AOrigBytes: TBytes      // The original bytes saved during InstallHook.
): Boolean;
var
  LOldProtect: DWORD;           // Stores original memory protection flags.
begin
  Result := False; // Assume failure.

  // Validate input pointer and original bytes length.
  if (ATargetFunc = nil) or (Length(AOrigBytes) <> HOOK_SIZE) then
  begin
    OutputDebugStringFmt('UninstallHook Error: TargetFunc (%p) is nil or OrigBytes length mismatch (%d vs %d).', [ATargetFunc, Length(AOrigBytes), HOOK_SIZE]);
    Exit;
  end;

  OutputDebugStringFmt('Attempting to uninstall hook at %p', [ATargetFunc]);

  // 1. Make the target function's memory writable and executable.
  if VirtualProtect(ATargetFunc, HOOK_SIZE, PAGE_EXECUTE_READWRITE, LOldProtect) then
  try
    // 2. Write the saved original bytes back to the target function's entry point.
    Move(AOrigBytes[0], ATargetFunc^, HOOK_SIZE);

    // 3. Flush the CPU's instruction cache for the modified memory range.
    FlushInstructionCache(GetCurrentProcess, ATargetFunc, HOOK_SIZE);

    Result := True; // Hook removal successful.
    OutputDebugStringFmt('Hook uninstalled successfully at %p', [ATargetFunc]);
  finally
    // 4. Restore the original memory protection flags.
    VirtualProtect(ATargetFunc, HOOK_SIZE, LOldProtect, LOldProtect);
  end
  else
  begin
    // VirtualProtect failed. Log error.
    OutputDebugStringFmt('UninstallHook Error: VirtualProtect PAGE_EXECUTE_READWRITE failed for %p. Error: %d', [ATargetFunc, GetLastError]);
  end;
end;

Best regards.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions