#include <thread>
#include <windows.h>

#ifndef __IATHOOK_H
#define __IATHOOK_H

#include <iostream>
#include <windows.h>
#include <cstdint>
/*
 * Most of this code was stolen from wikipedia. I've optimized it a tad and put it into a class.
 */
namespace Iat_hook
{

	void** find(const char* function, HMODULE module)
	{
		if (!module)
			module = GetModuleHandle(0);

		PIMAGE_DOS_HEADER img_dos_headers = (PIMAGE_DOS_HEADER)module;
		PIMAGE_NT_HEADERS img_nt_headers = (PIMAGE_NT_HEADERS)((byte*)img_dos_headers + img_dos_headers->e_lfanew);
		PIMAGE_IMPORT_DESCRIPTOR img_import_desc = (PIMAGE_IMPORT_DESCRIPTOR)((byte*)img_dos_headers + img_nt_headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
		if (img_dos_headers->e_magic != IMAGE_DOS_SIGNATURE)
			printf("ERROR: e_magic is no valid DOS signature\n");

		for (IMAGE_IMPORT_DESCRIPTOR *iid = img_import_desc; iid->Name != 0; iid++) {
			for (int func_idx = 0; *(func_idx + (void**)(iid->FirstThunk + (size_t)module)) != nullptr; func_idx++) {
				char* mod_func_name = (char*)(*(func_idx + (size_t*)(iid->OriginalFirstThunk + (size_t)module)) + (size_t)module + 2);
				const intptr_t nmod_func_name = (intptr_t)mod_func_name;
				if (nmod_func_name >= 0) {
					if (!::strcmp(function, mod_func_name))
						return func_idx + (void**)(iid->FirstThunk + (size_t)module);
				}
			}
		}

		return 0;

	}

	uintptr_t detour_iat_ptr(const char* function, void* newfunction, HMODULE module = 0)
	{
		auto&& func_ptr = find(function, module);
		if (*func_ptr == newfunction || *func_ptr == nullptr)
			return 0;

		DWORD old_rights, new_rights = PAGE_READWRITE;
		VirtualProtect(func_ptr, sizeof(uintptr_t), new_rights, &old_rights);
		uintptr_t ret = (uintptr_t)*func_ptr;
		*func_ptr = newfunction;
		VirtualProtect(func_ptr, sizeof(uintptr_t), old_rights, &new_rights);
		return ret;
	}
};


#endif //__IATHOOK_H


using GetVolumeInformationHook = BOOL(__stdcall*)(_In_opt_ LPCSTR lpRootPathName,
	_Out_writes_opt_(nVolumeNameSize) LPSTR lpVolumeNameBuffer,
	_In_ DWORD nVolumeNameSize,
	_Out_opt_ LPDWORD lpVolumeSerialNumber,
	_Out_opt_ LPDWORD lpMaximumComponentLength,
	_Out_opt_ LPDWORD lpFileSystemFlags,
	_Out_writes_opt_(nFileSystemNameSize) LPSTR lpFileSystemNameBuffer,
	_In_ DWORD nFileSystemNameSize);

GetVolumeInformationHook pVolumeHook;

BOOL __stdcall hooked_volume(_In_opt_ LPCSTR lpRootPathName,
	_Out_writes_opt_(nVolumeNameSize) LPSTR lpVolumeNameBuffer,
	_In_ DWORD nVolumeNameSize,
	_Out_opt_ LPDWORD lpVolumeSerialNumber,
	_Out_opt_ LPDWORD lpMaximumComponentLength,
	_Out_opt_ LPDWORD lpFileSystemFlags,
	_Out_writes_opt_(nFileSystemNameSize) LPSTR lpFileSystemNameBuffer,
	_In_ DWORD nFileSystemNameSize)
{
	return pVolumeHook(lpRootPathName,
		lpVolumeNameBuffer,
		nVolumeNameSize,
		(LPDWORD)818675177/*a whitelisted serial goes here*/,
		lpMaximumComponentLength,
		lpFileSystemFlags,
		lpFileSystemNameBuffer,
		nFileSystemNameSize);
}

int IatHook()
{

	pVolumeHook = (GetVolumeInformationHook)Iat_hook::detour_iat_ptr("GetVolumeInformationA", (void*)hooked_volume);


	return 0;
}

BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved)
{
	if (dwReason == DLL_PROCESS_ATTACH)
	{

		DisableThreadLibraryCalls(hModule);
		CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)IatHook, NULL, NULL, NULL);
		return TRUE;

	}
	return TRUE;
}