-
Notifications
You must be signed in to change notification settings - Fork 25
/
hookutils.h
43 lines (37 loc) · 1.7 KB
/
hookutils.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
#pragma once
#include <windows.h>
// copied from metahook
struct hook_s
{
void* pOldFuncAddr;
void* pNewFuncAddr;
void* pClass;
int iTableIndex;
int iFuncIndex;
HMODULE hModule;
const char* pszModuleName;
const char* pszFuncName;
struct hook_s* pNext;
void* pInfo;
};
typedef struct hook_s hook_t;
void FreeAllHook(void);
DWORD GetModuleBase(HMODULE hModule);
DWORD GetModuleSize(HMODULE hModule);
hook_t* FindInlineHooked(void* pOldFuncAddr);
hook_t* FindVFTHooked(void* pClass, int iTableIndex, int iFuncIndex);
hook_t* FindIATHooked(HMODULE hModule, const char* pszModuleName, const char* pszFuncName);
BOOL UnHook(hook_t* pHook);
hook_t* InlineHook(void* pOldFuncAddr, void* pNewFuncAddr, void*& pCallBackFuncAddr);
hook_t* InlineHookFromCallOpcode(void* pOldFuncAddr, void* pNewFuncAddr, void*& pCallBackFuncAddr, void*& pFuncAddr);
hook_t* VFTHook(void* pClass, int iTableIndex, int iFuncIndex, void* pNewFuncAddr, void*& pCallBackFuncAddr);
hook_t* IATHook(HMODULE hModule, const char* pszModuleName, const char* pszFuncName, void* pNewFuncAddr, void*& pCallBackFuncAddr);
hook_t* IATHookOrdinal(HMODULE hModule, const char* pszModuleName, int ordinal, void* pNewFuncAddr, void*& pCallBackFuncAddr);
void *GetClassFuncAddr(...);
void WriteDWORD(void *pAddress, DWORD dwValue);
DWORD ReadDWORD(void *pAddress);
DWORD WriteMemory(void *pAddress, BYTE *pData, DWORD dwDataSize);
DWORD ReadMemory(void *pAddress, BYTE *pData, DWORD dwDataSize);
DWORD FindPattern(PCHAR pattern, PCHAR mask, DWORD start, DWORD end, DWORD offset = 0);
DWORD FindPattern(PCHAR pattern, DWORD patternLength, DWORD start, DWORD end, DWORD offset = 0, DWORD refNumber = 1);
DWORD FindPush(DWORD start, DWORD end, PCHAR Message, DWORD refNumber = 1);