add more debug info

HVNCInjection/src/NtApiHooks.c

@@ -91,23 +91,15 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
 #endif
     }
 
-    // Helper function for case-insensitive wide string comparison
+    // Helper function for case-insensitive wide string comparison.
+    // Uses CompareStringOrdinal so Cyrillic, Greek, and other non-ASCII
+    // characters are properly case-folded (fixing crashes on Russian/Chinese
+    // Windows where the ASCII-only approach produced false mismatches).
     int wcsnicmp_custom(const WCHAR* s1, const WCHAR* s2, SIZE_T count) {
-        for (SIZE_T i = 0; i < count; i++) {
+        if (count == 0) return 0;
-            WCHAR c1 = s1[i];
+        int result = CompareStringOrdinal(s1, (int)count, s2, (int)count, TRUE);
-            WCHAR c2 = s2[i];
+        if (result == CSTR_EQUAL) return 0;
-
+        return (result == CSTR_LESS_THAN) ? -1 : 1;
-            // Convert to uppercase for comparison
-            if (c1 >= L'a' && c1 <= L'z') c1 = c1 - L'a' + L'A';
-            if (c2 >= L'a' && c2 <= L'z') c2 = c2 - L'a' + L'A';
-
-            // Also handle backslash vs forward slash
-            if (c1 == L'/') c1 = L'\\';
-            if (c2 == L'/') c2 = L'\\';
-
-            if (c1 != c2) return (c1 < c2) ? -1 : 1;
-        }
-        return 0;
     }
 
     // Helper function to normalize NT paths - skip \??\ prefix if present
@@ -450,11 +442,10 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
 
         if (!OriginalNtCreateFile) return 0xC0000001L; // STATUS_UNSUCCESSFUL
 
-        // Only attempt redirection if hooks are properly initialized and we have the original function
+        __try {
             if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
                 SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR);
 
-            // Log all paths for debugging
                 if (g_LogFile != INVALID_HANDLE_VALUE && pathLength > 0) {
                     WCHAR tempPath[512] = { 0 };
                     SIZE_T copyLen = pathLength < 511 ? pathLength : 511;
@@ -486,6 +477,12 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
                     }
                 }
             }
+        }
+        __except (EXCEPTION_EXECUTE_HANDLER) {
+            char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtCreateFile exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
+            if (originalString) { ObjectAttributes->ObjectName = originalString; originalString = NULL; }
+            if (buffer) { HeapFree(GetProcessHeap(), 0, buffer); buffer = NULL; }
+        }
 
         NTSTATUS result = OriginalNtCreateFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock,
             AllocationSize, FileAttributes, ShareAccess, CreateDisposition,
@@ -513,10 +510,10 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
         UNICODE_STRING newString = { 0 };
         WCHAR* buffer = NULL;
 
+        __try {
             if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
                 SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR);
 
-            // Log all paths for debugging
                 if (g_LogFile != INVALID_HANDLE_VALUE && pathLength > 0) {
                     WCHAR tempPath[512] = { 0 };
                     SIZE_T copyLen = pathLength < 511 ? pathLength : 511;
@@ -548,6 +545,12 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
                     }
                 }
             }
+        }
+        __except (EXCEPTION_EXECUTE_HANDLER) {
+            char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtOpenFile exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
+            if (originalString) { ObjectAttributes->ObjectName = originalString; originalString = NULL; }
+            if (buffer) { HeapFree(GetProcessHeap(), 0, buffer); buffer = NULL; }
+        }
 
         NTSTATUS result = OriginalNtOpenFile(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, ShareAccess, OpenOptions);
 
@@ -566,6 +569,7 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
         UNICODE_STRING newString = { 0 };
         WCHAR* buffer = NULL;
 
+        __try {
             if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
                 SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR);
 
@@ -582,6 +586,12 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
                     }
                 }
             }
+        }
+        __except (EXCEPTION_EXECUTE_HANDLER) {
+            char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtDeleteFile exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
+            if (originalString) { ObjectAttributes->ObjectName = originalString; originalString = NULL; }
+            if (buffer) { HeapFree(GetProcessHeap(), 0, buffer); buffer = NULL; }
+        }
 
         NTSTATUS result = OriginalNtDeleteFile(ObjectAttributes);
 
@@ -609,6 +619,7 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
             WCHAR FileName[1];
         } FILE_RENAME_INFO;
 
+        __try {
             if (g_HooksInitialized && FileInformation && (FileInformationClass == FileRenameInformation || FileInformationClass == FileRenameInformationEx)) {
                 FILE_RENAME_INFO* renameInfo = (FILE_RENAME_INFO*)FileInformation;
                 if (renameInfo->FileNameLength > 0) {
@@ -639,6 +650,10 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
                     }
                 }
             }
+        }
+        __except (EXCEPTION_EXECUTE_HANDLER) {
+            char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtSetInfoFile exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
+        }
 
         return OriginalNtSetInformationFile(FileHandle, IoStatusBlock, FileInformation, Length, FileInformationClass);
     }
@@ -653,6 +668,7 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
         UNICODE_STRING newString = { 0 };
         WCHAR* buffer = NULL;
 
+        __try {
             if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
                 SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR);
 
@@ -669,6 +685,12 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
                     }
                 }
             }
+        }
+        __except (EXCEPTION_EXECUTE_HANDLER) {
+            char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtQueryAttribs exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
+            if (originalString) { ObjectAttributes->ObjectName = originalString; originalString = NULL; }
+            if (buffer) { HeapFree(GetProcessHeap(), 0, buffer); buffer = NULL; }
+        }
 
         NTSTATUS result = OriginalNtQueryAttributesFile(ObjectAttributes, FileInformation);
 
@@ -690,6 +712,7 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
         UNICODE_STRING newString = { 0 };
         WCHAR* buffer = NULL;
 
+        __try {
             if (g_HooksInitialized && ObjectAttributes && ObjectAttributes->ObjectName && ObjectAttributes->ObjectName->Buffer) {
                 SIZE_T pathLength = ObjectAttributes->ObjectName->Length / sizeof(WCHAR);
 
@@ -706,6 +729,12 @@ static inline void _hvnc_wcsncpy_s(wchar_t *dst, size_t dstSize, const wchar_t *
                     }
                 }
             }
+        }
+        __except (EXCEPTION_EXECUTE_HANDLER) {
+            char _excMsg[64]; sprintf_s(_excMsg, 64, "[HOOK] NtQueryFullAttribs exception: 0x%X", GetExceptionCode()); CrashLog(_excMsg);
+            if (originalString) { ObjectAttributes->ObjectName = originalString; originalString = NULL; }
+            if (buffer) { HeapFree(GetProcessHeap(), 0, buffer); buffer = NULL; }
+        }
 
         NTSTATUS result = OriginalNtQueryFullAttributesFile(ObjectAttributes, FileInformation);