()
| 271 | /// information about `ntdll.dll` (base address and end address) for use in syscall tracing. |
| 272 | #[allow(static_mut_refs)] |
| 273 | pub fn initialize_hooks() { |
| 274 | unsafe { |
| 275 | // Add vectored exception handlers for system call handling |
| 276 | H1 = AddVectoredExceptionHandler(CALL_FIRST, Some(AddHwBp)); |
| 277 | H2 = AddVectoredExceptionHandler(CALL_FIRST, Some(HandlerHwBp)); |
| 278 | |
| 279 | // Allocate memory for saving the CPU context during exception handling |
| 280 | SAVED_CONTEXT = HeapAlloc( |
| 281 | GetProcessHeap(), |
| 282 | HEAP_ZERO_MEMORY, |
| 283 | core::mem::size_of::<CONTEXT>(), |
| 284 | ) as *mut CONTEXT; |
| 285 | |
| 286 | // Initialize ntdll.dll base and end addresses for syscall tracing |
| 287 | initialize_dll_info(&mut NTDLL_INFO); |
| 288 | } |
| 289 | } |
| 290 | |
| 291 | /// Cleans up the exception hooks by removing the previously added handlers. |
| 292 | /// |
no test coverage detected