Use of hooks/api interception to inject GoldSRC extensions

Discussion in 'Sega Dreamcast Development and Research' started by TerdFerguson, Dec 30, 2016.

  1. TerdFerguson

    TerdFerguson ls ~/

    Joined:
    Apr 27, 2015
    Messages:
    760
    Likes Received:
    473
    This thread is dedicated to the discussion of using hacks to inject the Initialize() function from Half-Life SDK client dll

    If you don't know what this is about see these posts
    http://assemblergames.com/l/threads...k-extension-dlls-cleanly-to-windows-ce.64408/
    http://assemblergames.com/l/threads...leanly-to-windows-ce.64408/page-3#post-924191

    Source code is here
    https://github.com/FaucetDC/hldc-sdk
    Only 'OldSourceCode' port is completed, but that's all that's needed right now

    In the Git is "En4CEr", a windows CE API interceptor example program from drdobbs.com. But it uses MFC, which in the standard Dreamcast WCE SDK the MFC libraries aren't included, and it looks like the public libraries are only for certain CPUs and not SH4. MFC was included in WCE 3.0+, Dreamcast is WCE 2.12
    http://www.drdobbs.com/cpp/spy-a-windows-ce-api-interceptor/184405459

    From what I understand, all API calls are passed through the kernel no matter what, the API interceptor would as the name implies intercept and API call and run a different piece of code instead

    I think the best approach for someone who attempts this is:
    • Look at the entry points of the binary in disassembly
    • Find the most easily accessible API call before the engine begins to fully load up
    • Suspend the Half-Life process/thread immediately after execution
    • Load client.dll into memory
    • Execute En4CEr, waiting for Half-Life process/thread resume
    • Resume Half-Life process thread
    • An API call in the entry point of the program is intercepted to call Initialize() in client.dll
    • En4CEr closes immediately after executing Initialize()
    • Post results
    I don't have the coding chops to give this a proper attempt, but everything is on the table for someone who wants to attempt it

    Again judging from this it probably can be done. Even if it isn't (and it probably won't be) as simple as what I outlined. It's an unexplored frontier for this particular machine and it would be really cool if someone gave an attempt at this justice
     

    Attached Files:

Share This Page