- 01
- 02
- 03
- 04
- 05
- 06
- 07
- 08
- 09
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
- 59
- 60
- 61
- 62
// HooksList.h
#define PPCAT_NX(A, B) A ## B
#define PPCAT(A, B) PPCAT_NX(A, B)
#ifdef HOOKS_DEFS
using namespace NtStructs;
#define API_HOOK_DEF(module_name, hook_name, return_type, enabled, ...) \
typedef return_type(WINAPI *PPCAT(hook_name, _ptr))(__VA_ARGS__); \
return_type WINAPI PPCAT(hook_name, _hook)(__VA_ARGS__); \
extern PPCAT(hook_name, _ptr) PPCAT(hook_name, _orig);
#elif defined(HOOKS_LIST)
#define API_HOOK_DEF(module_name, hook_name, return_type, enabled, ...) \
{module_name, #hook_name, (LPVOID)PPCAT(hook_name, _hook), (LPVOID*)&PPCAT(hook_name, _orig), enabled},
#elif defined(HOOKS_TYPES_DEF)
using namespace NtStructs;
#define API_HOOK_DEF(module_name, hook_name, return_type, enabled, ...) \
typedef return_type(WINAPI *PPCAT(hook_name, _ptr))(__VA_ARGS__); \
return_type WINAPI PPCAT(hook_name, _hook)(__VA_ARGS__);
#elif defined(ORIGINAL_FUNCTIONS_TABLE_DEF)
#define API_HOOK_DEF(module_name, hook_name, return_type, enabled, ...) \
PPCAT(hook_name, _ptr) hook_name;
#elif defined(ORIGINAL_FUNCTIONS_TABLE_FILL)
#define API_HOOK_DEF(module_name, hook_name, return_type, enabled, ...) \
(ORIGINAL_FUNCTIONS_TABLE_NAME).hook_name = PPCAT(hook_name, _orig);
#else
#define API_HOOK_DEF(...)
#endif
// NtCreateFile
API_HOOK_DEF(L"ntdll", NtCreateFile, NTSTATUS, true,
PHANDLE FileHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PIO_STATUS_BLOCK IoStatusBlock,
PLARGE_INTEGER AllocationSize,
ULONG FileAttributes,
ULONG ShareAccess,
ULONG CreateDisposition,
ULONG CreateOptions,
PVOID EaBuffer,
ULONG EaLength)
// NtDeleteFile
API_HOOK_DEF(L"ntdll", NtDeleteFile, NTSTATUS, true,
POBJECT_ATTRIBUTES ObjectAttributes)
// И так далее
// В .cpp:
static HookEntry hookEntries[] = {
#define HOOKS_LIST
#include "HooksList.h"
#undef HOOKS_LIST
};
// ...
static OriginalFunctions originalFuncsTable;
#define ORIGINAL_FUNCTIONS_TABLE_FILL 1
#define ORIGINAL_FUNCTIONS_TABLE_NAME originalFuncsTable
#include "HooksList.h"
#undef ORIGINAL_FUNCTIONS_TABLE_NAME
#undef ORIGINAL_FUNCTIONS_TABLE_FILL