DriverInjectDll/hooklib.cpp at master · strivexjun/DriverInjectDll · GitHub

History

56 lines (51 loc) · 1.4 KB

Raw

#include "hooklib.h"

static HOOK hook_internal(ULONG_PTR addr, void* newfunc)

{

//allocate structure

HOOK hook = (HOOK)RtlAllocateMemory(true, sizeof(HOOKSTRUCT));

//set hooking address

hook->addr = addr;

//set hooking opcode

#ifdef _WIN64

hook->hook.mov = 0xB848;

#else

hook->hook.mov = 0xB8;

#endif

hook->hook.addr = (ULONG_PTR)newfunc;

hook->hook.push = 0x50;

hook->hook.ret = 0xc3;

//set original data

RtlCopyMemory(&hook->orig, (const void*)addr, sizeof(HOOKOPCODES));

if(!NT_SUCCESS(RtlSuperCopyMemory((void*)addr, &hook->hook, sizeof(HOOKOPCODES))))

{

RtlFreeMemory(hook);

return 0;

}

return hook;

}

HOOK Hooklib::Hook(PVOID api, void* newfunc)

{

ULONG_PTR addr = (ULONG_PTR)api;

if(!addr)

return 0;

DPRINT("[DeugMessage] hook(0x%p, 0x%p)\r\n", addr, newfunc);

return hook_internal(addr, newfunc);

}

bool Hooklib::Hook(HOOK hook)

{

if(!hook)

return false;

return (NT_SUCCESS(RtlSuperCopyMemory((void*)hook->addr, &hook->hook, sizeof(HOOKOPCODES))));

}

bool Hooklib::Unhook(HOOK hook, bool free)

{

if(!hook || !hook->addr)

return false;

if(NT_SUCCESS(RtlSuperCopyMemory((void*)hook->addr, hook->orig, sizeof(HOOKOPCODES))))

{

if(free)

RtlFreeMemory(hook);

return true;

}

return false;

}

DriverInjectDll/hooklib.cpp at master · strivexjun/DriverInjectDll · GitHub

Expand file tree

Breadcrumbs

hooklib.cpp

Latest commit

History

Breadcrumbs

hooklib.cpp

File metadata and controls