-------------------------------------------------------------------------
| 197 | |
| 198 | //------------------------------------------------------------------------- |
| 199 | static VOID ProcessThreadIPs(HANDLE hThread, UINT pos, UINT action) |
| 200 | { |
| 201 | // If the thread suspended in the overwritten area, |
| 202 | // move IP to the proper address. |
| 203 | |
| 204 | CONTEXT c; |
| 205 | #if defined(_M_X64) || defined(__x86_64__) |
| 206 | DWORD64 *pIP = &c.Rip; |
| 207 | #else |
| 208 | DWORD *pIP = &c.Eip; |
| 209 | #endif |
| 210 | UINT count; |
| 211 | |
| 212 | c.ContextFlags = CONTEXT_CONTROL; |
| 213 | if (!GetThreadContext(hThread, &c)) |
| 214 | return; |
| 215 | |
| 216 | if (pos == ALL_HOOKS_POS) |
| 217 | { |
| 218 | pos = 0; |
| 219 | count = g_hooks.size; |
| 220 | } |
| 221 | else |
| 222 | { |
| 223 | count = pos + 1; |
| 224 | } |
| 225 | |
| 226 | for (; pos < count; ++pos) |
| 227 | { |
| 228 | PHOOK_ENTRY pHook = &g_hooks.pItems[pos]; |
| 229 | BOOL enable; |
| 230 | DWORD_PTR ip; |
| 231 | |
| 232 | switch (action) |
| 233 | { |
| 234 | case ACTION_DISABLE: |
| 235 | enable = FALSE; |
| 236 | break; |
| 237 | |
| 238 | case ACTION_ENABLE: |
| 239 | enable = TRUE; |
| 240 | break; |
| 241 | |
| 242 | default: // ACTION_APPLY_QUEUED |
| 243 | enable = pHook->queueEnable; |
| 244 | break; |
| 245 | } |
| 246 | if (pHook->isEnabled == enable) |
| 247 | continue; |
| 248 | |
| 249 | if (enable) |
| 250 | ip = FindNewIP(pHook, *pIP); |
| 251 | else |
| 252 | ip = FindOldIP(pHook, *pIP); |
| 253 | |
| 254 | if (ip != 0) |
| 255 | { |
| 256 | *pIP = ip; |