From 528ec4379c0740cea9fed3545798eba1f20c36e2 Mon Sep 17 00:00:00 2001
From: Kevin Trocolli <pitok236@gmail.com>
Date: Fri, 15 Sep 2023 19:57:11 -0400
Subject: [PATCH] createprocess: add replace_all flag

---
 carolhook/dllmain.c     |  2 +-
 hooklib/createprocess.c | 19 ++++++++++++-------
 hooklib/createprocess.h | 13 +++++--------
 3 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/carolhook/dllmain.c b/carolhook/dllmain.c
index a80ea07..eca445b 100644
--- a/carolhook/dllmain.c
+++ b/carolhook/dllmain.c
@@ -124,7 +124,7 @@ static DWORD CALLBACK carol_pre_startup(void)
         goto fail;
     }
     
-    hr = createprocess_push_hook_a(".\\15312firm\\firmupdate_1113.exe", "inject -d -k carolhook.dll ", NULL);
+    hr = createprocess_push_hook_a(".\\15312firm\\firmupdate_1113.exe", "inject -d -k carolhook.dll ", NULL, false);
     
     if (FAILED(hr)) {
         goto fail;
diff --git a/hooklib/createprocess.c b/hooklib/createprocess.c
index d411aaf..e44ebdb 100644
--- a/hooklib/createprocess.c
+++ b/hooklib/createprocess.c
@@ -86,7 +86,7 @@ static size_t process_nsyms_w = 0;
 
 static CRITICAL_SECTION createproc_lock;
 
-HRESULT createprocess_push_hook_w(const wchar_t *name, const wchar_t *head, const wchar_t *tail) {
+HRESULT createprocess_push_hook_w(const wchar_t *name, const wchar_t *head, const wchar_t *tail, bool replace_all) {
     struct process_hook_sym_w *new_mem;
     struct process_hook_sym_w *new_proc;
     HRESULT hr;
@@ -112,6 +112,7 @@ HRESULT createprocess_push_hook_w(const wchar_t *name, const wchar_t *head, cons
     new_proc->name = name;
     new_proc->head = head;
     new_proc->tail = tail;
+    new_proc->replace_all = replace_all;
 
     process_syms_w = new_mem;
     process_nsyms_w++;
@@ -120,7 +121,7 @@ HRESULT createprocess_push_hook_w(const wchar_t *name, const wchar_t *head, cons
     return S_OK;
 }
 
-HRESULT createprocess_push_hook_a(const char *name, const char *head, const char *tail) {
+HRESULT createprocess_push_hook_a(const char *name, const char *head, const char *tail, bool replace_all) {
     struct process_hook_sym_a *new_mem;
     struct process_hook_sym_a *new_proc;
 
@@ -146,6 +147,7 @@ HRESULT createprocess_push_hook_a(const char *name, const char *head, const char
     new_proc->name = name;
     new_proc->head = head;
     new_proc->tail = tail;
+    new_proc->replace_all = replace_all;
 
     process_syms_a = new_mem;
     process_nsyms_a++;
@@ -184,17 +186,20 @@ static BOOL WINAPI my_CreateProcessA(
 )
 {
     for (int i = 0; i < process_nsyms_a; i++) {
-        if (strncmp(process_syms_a->name, lpCommandLine, strlen(process_syms_a->name))) {
+        if (strncmp(process_syms_a[i].name, lpCommandLine, strlen(process_syms_a[i].name))) {
             continue;
         }
 
         dprintf("CreateProcess: Hooking child process %s %s\n", lpApplicationName, lpCommandLine);
         char new_cmd[MAX_PATH] = {0};
-        strcat_s(new_cmd, MAX_PATH, process_syms_a->head);
-        strcat_s(new_cmd, MAX_PATH, lpCommandLine);
+        strcat_s(new_cmd, MAX_PATH, process_syms_a[i].head);
 
-        if (process_syms_a->tail != NULL) {
-            strcat_s(new_cmd, MAX_PATH, process_syms_a->tail);
+        if (!process_syms_a[i].replace_all) {            
+            strcat_s(new_cmd, MAX_PATH, lpCommandLine);
+        }
+
+        if (process_syms_a[i].tail != NULL) {
+            strcat_s(new_cmd, MAX_PATH, process_syms_a[i].tail);
         }
 
         dprintf("CreateProcess: Replaced CreateProcessA %s\n", new_cmd);
diff --git a/hooklib/createprocess.h b/hooklib/createprocess.h
index 93ed8f7..bf226d5 100644
--- a/hooklib/createprocess.h
+++ b/hooklib/createprocess.h
@@ -1,24 +1,21 @@
 #pragma once
 
 #include <windows.h>
+#include <stdbool.h>
 
-HRESULT createprocess_push_hook_w(const wchar_t *name, const wchar_t *head, const wchar_t *tail);
-HRESULT createprocess_push_hook_a(const char *name, const char *head, const char *tail);
+HRESULT createprocess_push_hook_w(const wchar_t *name, const wchar_t *head, const wchar_t *tail, bool replace_all);
+HRESULT createprocess_push_hook_a(const char *name, const char *head, const char *tail, bool replace_all);
 
 struct process_hook_sym_w {
     const wchar_t *name;
-    size_t name_size;
     const wchar_t *head;
-    size_t head_size;
     const wchar_t *tail;
-    size_t tail_size;
+    bool replace_all;
 };
 
 struct process_hook_sym_a {
     const char *name;
-    size_t name_size;
     const char *head;
-    size_t head_size;
     const char *tail;
-    size_t tail_size;
+    bool replace_all;
 };
\ No newline at end of file