Method CheckIATHook

WinArk/ProcessATHookTable.cpp:313–506

}

void CProcessATHookTable::CheckIATHook(const std::shared_ptr<WinSys::ModuleInfo>& m) {
	PEParser parser(m->Path.c_str());
	if (!parser.IsValid())
		return;
	if (!parser.HasImports())
		return;

	bool isSystemFile = parser.IsSystemFile();
	if (isSystemFile)
		return;

	SubsystemType type  = parser.GetSubsystemType();
	if (type == SubsystemType::Native) {
		return;
	}
	std::vector<ImportedLibrary> libs = parser.GetImports();
	for (const auto& lib : libs) {
		void* iat = (byte*)m->Base + lib.IAT;
		SIZE_T size = 0;
		bool isPe64 = parser.IsPe64();
		if (isPe64)
			size = lib.Symbols.size() * sizeof(ULONG_PTR);
		else
			size = lib.Symbols.size() * sizeof(DWORD);
		void* buffer = malloc(size);
		if (!buffer)
			continue;
		bool ok = ReadProcessMemory(m_hProcess, iat, buffer, size, &size);
		if (ok) {
			int index = 0;
			for (auto& item : lib.Symbols) {
				DWORD64 address = 0;
				int inc = 0;
				if (isPe64) {
					address = *((PULONG_PTR)buffer + index);
					inc = 8;
				}
				else {
					address = *((PULONG)buffer + index);
					inc = 4;
				}
				
				auto& symbols = SymbolManager::Get();
				DWORD64 offset = 0;
				auto symbol = symbols.GetSymbolFromAddress(m_Pid, address, &offset);
				if (symbol) {
					auto sym = symbol->GetSymbolInfo();
					std::string symName(sym->Name);
					std::wstring wlibName = Helpers::StringToWstring(lib.Name);
					std::vector<std::wstring> hosts = GetApiSetHostName(wlibName);
					std::vector<ULONG_PTR> orgAddresses;
					ULONG_PTR orgAddress = 0;
					if (hosts.size() > 0) {
						for (const auto& host : hosts) {
							orgAddresses = GetExportedProcAddr(host, item.Name, isPe64);
							if (orgAddresses.size() > 0 ) {
								break;
							}