Hooking of internal functions

[Anixx]

Would not it be better to avoid the need for symbols downloads (which are not available for insider builds, for instance) by allowing to hook a function by its decorated/mangled name, with an important addition that this name would be authomatically modified by the hooking utility according to the current architecture?

For instance, if I am hooking a function ?SetXML@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z:

Wh_SetFunctionHook((void*)GetProcAddress(LoadLibraryW(L"dui70.dll"), 
            "?SetXML@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z");

It would work only on x64 and ARM. If I want it to work also on x86, I also have to hook the function ?SetXML@DUIXmlParser@DirectUI@@QAAJPBGPAUHINSTANCE__@@1@Z. Would not it be more handy, if the hooking utility automatically modified the function's name for the current architecture, so that neither multiple attempts nor downloading symbols would be needed?

[m417z]

Such exports aren't that common. You can find them in DUI dlls, but I didn't see such exports in any other Windows dll. Most other usages of symbol hooks are cases where the functions aren't exported in any way.

[Anixx]

Would it be safe to just try to hook ?SetXML@DUIXmlParser@DirectUI@@QEAAJPEBGPEAUHINSTANCE__@@1@Z for 64-bit and ?SetXML@DUIXmlParser@DirectUI@@QAAJPBGPAUHINSTANCE__@@1@Z for x86 and drop symbols hooking?

[m417z]

Yes, it will work, other mods do that, for example:
https://github.com/ramensoftware/windhawk-mods/blob/e60778e52d2aeea1d6c72903fb7f79aa7020a35d/mods/icon-resource-redirect.wh.cpp#L2771

What do you mean by "safe"? The export name might change. In the example I linked, it has two 64-bit variants depending on the Windows version:

• ?_SetXMLFromResource@DUIXmlParser@DirectUI@@IAEJPBG0PAUHINSTANCE__@@11@Z
• ?_SetXMLFromResource@DUIXmlParser@DirectUI@@IEAAJPEBG0PEAUHINSTANCE__@@11@Z

But any undocumented part can change at any time.

[Anixx]

Well, the first translates to

private: long __thiscall DirectUI::DUIXmlParser::_SetXMLFromResource(
    wchar_t const *,
    wchar_t const *,
    struct HINSTANCE__ *,
    wchar_t const *,
    wchar_t const *
)

and the second one to

private: long __cdecl DirectUI::DUIXmlParser::_SetXMLFromResource(
    wchar_t const *,
    wchar_t const *,
    struct HINSTANCE__ *,
    wchar_t const *,
    wchar_t const *
)

so even if one used a symbol hook, they would have to change the program between these Windows versions.

[m417z]

According to https://www.demangler.com/ it's:

• long DirectUI::DUIXmlParser::_SetXMLFromResource(unsigned short const *,unsigned short const *,struct HINSTANCE__ *,struct HINSTANCE__ *,struct HINSTANCE__ *)
• long DirectUI::DUIXmlParser::_SetXMLFromResource(unsigned short const * __ptr64,unsigned short const * __ptr64,struct HINSTANCE__ * __ptr64,struct HINSTANCE__ * __ptr64,struct HINSTANCE__ * __ptr64) __ptr64

In any case, sure, symbols can change too.