Function wrap hooks
| 151 | } |
| 152 | // Function wrap hooks |
| 153 | int32_t InitFunctionHookByName(Hook_Info* OutputInfo, bool WrapFunction, bool CheckKBase , const char* ModulName, const char* FName, void* HookedF, int32_t* OutErrorCode) |
| 154 | { |
| 155 | if (OutputInfo > NULL && FName > NULL && HookedF > NULL) |
| 156 | { |
| 157 | if (ColdHook_Vars::Inited) |
| 158 | { |
| 159 | FARPROC RequestedFAddress = NULL; |
| 160 | HMODULE RequestedM = NULL; |
| 161 | |
| 162 | ULONG_PTR TNextInstruction = NULL; |
| 163 | SIZE_T TrampolineISize = NULL; |
| 164 | SIZE_T MaxHSize = 5; |
| 165 | DWORD OldP = NULL; |
| 166 | int32_t Code = NULL; |
| 167 | |
| 168 | BYTE HookDataB[0x100] = { 0 }; |
| 169 | bool BytesStored = false; |
| 170 | |
| 171 | void* Redirection = NULL; |
| 172 | void* JumpTo = NULL; |
| 173 | |
| 174 | // Read module |
| 175 | RequestedM = GetModuleHandleA(ModulName); |
| 176 | |
| 177 | if (RequestedM > NULL) |
| 178 | { |
| 179 | // Get function pointer |
| 180 | RequestedFAddress = GetProcAddress(RequestedM, FName); |
| 181 | |
| 182 | // Latest windows uses mostly the kernel32 dll as a "bridge" to jump to the reals functions in the kernelbase module. |
| 183 | if (ModulName > NULL) { |
| 184 | if (CheckKBase && ColdHook_Service::Is64BitProcess()) { |
| 185 | HMODULE hKernelBase = GetModuleHandleA("kernelbase.dll"); |
| 186 | HMODULE hKernel32 = GetModuleHandleA("kernel32.dll"); |
| 187 | FARPROC RequestedKbaseF = GetProcAddress(hKernelBase, FName); |
| 188 | if (RequestedM == hKernel32) { |
| 189 | if (hKernelBase > NULL && RequestedKbaseF > NULL) { |
| 190 | // if the first 8 bytes are same, we continue using the requested module name |
| 191 | if (std::memcmp((void*)RequestedFAddress, (void*)RequestedKbaseF, 8) != 0) { |
| 192 | RequestedM = hKernelBase; |
| 193 | RequestedFAddress = RequestedKbaseF; |
| 194 | } |
| 195 | } |
| 196 | } |
| 197 | } |
| 198 | } |
| 199 | |
| 200 | if (RequestedFAddress > NULL) |
| 201 | { |
| 202 | if (!ColdHook_Service::IsAddressRegisteredAsHook((void*)RequestedFAddress)) |
| 203 | { |
| 204 | SIZE_T ChangedHookSize = NULL; |
| 205 | |
| 206 | Redirection = ColdHook_Service::AllocateTrampoline((ULONG_PTR)RequestedM, 0x1000, &Code, &ChangedHookSize); |
| 207 | if (ChangedHookSize != NULL) { |
| 208 | MaxHSize = ChangedHookSize; |
| 209 | } |
| 210 | if (WrapFunction) |
no test coverage detected