Method CheckEATHook

WinArk/ProcessATHookTable.cpp:195–233

}

void CProcessATHookTable::CheckEATHook(const std::shared_ptr<WinSys::ModuleInfo>& m) {
	PEParser parser(m->Path.c_str());
	if (!parser.HasExports())
		return;
	std::vector<ExportedSymbol> exports = parser.GetExports();
	void* eat = (byte*)m->Base + parser.GetEAT();
	SIZE_T size = 0;
	size = exports.size() * sizeof(DWORD);
	void* buffer = malloc(size);
	if (!buffer)
		return;
	bool ok = ReadProcessMemory(m_hProcess, eat, buffer, size, &size);
	if (ok) {
		PULONG pAddr = (PULONG)buffer;
		int idx = 0;
		for (auto& item : exports) {
			DWORD address = *pAddr;
			if (address != item.Address) {
				EATHookInfo info;
				info.TargetAddress = (ULONG_PTR)m->Base + address;
				info.Address = item.Address + (ULONG_PTR)m->Base;
				CString addr;
				addr.Format(L"0x%p", (ULONG_PTR)eat + idx * 4);
				info.Name = m->Name;
				info.Name += L"_" + addr;
				info.Type = ATHookType::EAT;
				auto m = GetModuleByAddress(info.TargetAddress);
				if (m != nullptr) {
					info.TargetModule = m->Path;
				}
				m_Table.data.info.push_back(info);
			}
			idx++;
			pAddr++;
		}
	}
	free(buffer);
	buffer = nullptr;
}

std::shared_ptr<WinSys::ModuleInfo> CProcessATHookTable::GetModuleByName(std::wstring name) {
	for (auto m : m_Modules) {