hook.cpp File Reference

#include "hook.hpp"
#include "detours\detours.h"

Go to the source code of this file.

Functions
NTSTATUS NTAPI	Hooked_NtWriteVirtualMemory (HANDLE ProcessHandle, PVOID BaseAddress, PVOID Buffer, SIZE_T NumberOfBytesToWrite, PSIZE_T NumberOfBytesWritten)
	The Hooked_NtWriteVirtualMemory function is a function that hooks the NtWriteVirtualMemory function.
NTSTATUS	Hooked_NtModifyBootEntry (PBOOT_ENTRY BootEntry)
	The Hooked_NtModifyBootEntry function is a function that hooks the NtModifyBootEntry function.
NTSTATUS	Hooked_NtMapViewOfSectionEx (_In_ HANDLE SectionHandle, _In_ HANDLE ProcessHandle, _Inout_ _At_(*BaseAddress, _Readable_bytes_(*ViewSize) _Writable_bytes_(*ViewSize) _Post_readable_byte_size_(*ViewSize)) PVOID *BaseAddress, _Inout_opt_ PLARGE_INTEGER SectionOffset, _Inout_ PSIZE_T ViewSize, _In_ ULONG AllocationType, _In_ ULONG PageProtection, _Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters, _In_ ULONG ExtendedParameterCount)
	The Hooked_NtMapViewOfSectionEx function is a function that hooks the NtMapViewOfSectionEx function.
VOID	PlaceHooks ()
	The PlaceHooks function places the trampoline hooks on several NTDLL functions.
VOID	UnHook ()
	The UnHook function removes the trampoline hooks from the NTDLL functions.

Variables
pNtWriteVirtualMemory	pOriginal_NtWriteVirtualMemory = NULL
pNtModifyBootEntry	pOriginal_NtModifyBootEntry = NULL
pNtMapViewOfSectionEx	pOriginal_NtMapViewOfSectionEx = NULL

Function Documentation

Hooked_NtMapViewOfSectionEx()

NTSTATUS Hooked_NtMapViewOfSectionEx	(	_In_ HANDLE	SectionHandle,
		_In_ HANDLE	ProcessHandle,
		_Inout_ _At_(*, *ViewSize _Writable_bytes_ *ViewSize _Post_readable_byte_size_ *	ViewSize
	)

The Hooked_NtMapViewOfSectionEx function is a function that hooks the NtMapViewOfSectionEx function.

Parameters

SectionHandle	The handle to the section.
ProcessHandle	The handle to the process.
BaseAddress	The base address of the memory to map.
SectionOffset	The offset of the section.
ViewSize	The size of the view.
AllocationType	The allocation type.
PageProtection	The page protection.
ExtendedParameters	The extended parameters.
ExtendedParameterCount	The number of extended parameters.

Returns

The status of the function.

Definition at line 52 of file hook.cpp.

{
    NTSTATUS status = pOriginal_NtMapViewOfSectionEx(SectionHandle,ProcessHandle,BaseAddress, 
    SectionOffset, ViewSize, AllocationType,PageProtection,ExtendedParameters,
    ExtendedParameterCount);
 
    return status;
}

References pOriginal_NtMapViewOfSectionEx.

Referenced by PlaceHooks(), and UnHook().

Hooked_NtModifyBootEntry()

NTSTATUS Hooked_NtModifyBootEntry

(

PBOOT_ENTRY

BootEntry

)

The Hooked_NtModifyBootEntry function is a function that hooks the NtModifyBootEntry function.

Parameters

BootEntry

The boot entry to modify.

Returns

The status of the function.

Definition at line 35 of file hook.cpp.

                                                         {
    NTSTATUS status = pOriginal_NtModifyBootEntry(BootEntry);
    return status;
}

References pOriginal_NtModifyBootEntry.

Referenced by PlaceHooks(), and UnHook().

Hooked_NtWriteVirtualMemory()

NTSTATUS NTAPI Hooked_NtWriteVirtualMemory	(	HANDLE	ProcessHandle,
		PVOID	BaseAddress,
		PVOID	Buffer,
		SIZE_T	NumberOfBytesToWrite,
		PSIZE_T	NumberOfBytesWritten
	)

The Hooked_NtWriteVirtualMemory function is a function that hooks the NtWriteVirtualMemory function.

Parameters

ProcessHandle	The handle to the process.
BaseAddress	The base address of the memory to write to.
Buffer	The buffer to write to the memory.
NumberOfBytesToWrite	The number of bytes to write to the memory.
NumberOfBytesWritten	The number of bytes written to the memory.

Returns

The status of the function.

Definition at line 18 of file hook.cpp.

{
    NTSTATUS status = pOriginal_NtWriteVirtualMemory(ProcessHandle, BaseAddress, Buffer, NumberOfBytesToWrite, NumberOfBytesWritten);
 
    return status;
}

References pOriginal_NtWriteVirtualMemory.

Referenced by PlaceHooks(), and UnHook().

PlaceHooks()

VOID PlaceHooks

(

)

The PlaceHooks function places the trampoline hooks on several NTDLL functions.

The PlaceHooks function places the hooks on the NTDLL functions.

Definition at line 72 of file hook.cpp.

                  {
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
 
    pOriginal_NtWriteVirtualMemory = (pNtWriteVirtualMemory)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtWriteVirtualMemory");
    if (pOriginal_NtWriteVirtualMemory)
    {
        DetourAttach((PVOID*)&pOriginal_NtWriteVirtualMemory, (PVOID)Hooked_NtWriteVirtualMemory);
    }
 
    pOriginal_NtModifyBootEntry = (pNtModifyBootEntry)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtModifyBootEntry");
    if (pOriginal_NtModifyBootEntry) {
        DetourAttach((PVOID*)&pOriginal_NtModifyBootEntry, (PVOID)Hooked_NtModifyBootEntry);
    }
 
    pOriginal_NtMapViewOfSectionEx = (pNtMapViewOfSectionEx)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtMapViewOfSectionEx");
    if (pOriginal_NtMapViewOfSectionEx) {
        DetourAttach((PVOID*)&pOriginal_NtMapViewOfSectionEx, (PVOID)Hooked_NtMapViewOfSectionEx);
    }
 
    DetourTransactionCommit();
    return;
}

References Hooked_NtMapViewOfSectionEx(), Hooked_NtModifyBootEntry(), Hooked_NtWriteVirtualMemory(), pOriginal_NtMapViewOfSectionEx, pOriginal_NtModifyBootEntry, and pOriginal_NtWriteVirtualMemory.

Referenced by DllMain().

UnHook()

VOID UnHook

(

)

The UnHook function removes the trampoline hooks from the NTDLL functions.

The UnHook function removes the hooks from the NTDLL functions.

Definition at line 97 of file hook.cpp.

              {
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
 
    if (pOriginal_NtWriteVirtualMemory) {
        DetourDetach((PVOID*)&pOriginal_NtWriteVirtualMemory, (PVOID)Hooked_NtWriteVirtualMemory);
    }
 
    if (pOriginal_NtModifyBootEntry) {
        DetourDetach((PVOID*)&pOriginal_NtModifyBootEntry, (PVOID)Hooked_NtModifyBootEntry);
    }
 
    if (pOriginal_NtMapViewOfSectionEx) {
        DetourDetach((PVOID*)&pOriginal_NtMapViewOfSectionEx, (PVOID)Hooked_NtMapViewOfSectionEx);
    }
 
    DetourTransactionCommit();
    return;
}

References Hooked_NtMapViewOfSectionEx(), Hooked_NtModifyBootEntry(), Hooked_NtWriteVirtualMemory(), pOriginal_NtMapViewOfSectionEx, pOriginal_NtModifyBootEntry, and pOriginal_NtWriteVirtualMemory.

Referenced by DllMain().

Variable Documentation

pOriginal_NtMapViewOfSectionEx

pNtMapViewOfSectionEx pOriginal_NtMapViewOfSectionEx = NULL

Definition at line 8 of file hook.cpp.

Referenced by Hooked_NtMapViewOfSectionEx(), PlaceHooks(), and UnHook().

pOriginal_NtModifyBootEntry

pNtModifyBootEntry pOriginal_NtModifyBootEntry = NULL

Definition at line 7 of file hook.cpp.

Referenced by Hooked_NtModifyBootEntry(), PlaceHooks(), and UnHook().

pOriginal_NtWriteVirtualMemory

pNtWriteVirtualMemory pOriginal_NtWriteVirtualMemory = NULL

Definition at line 6 of file hook.cpp.

Referenced by Hooked_NtWriteVirtualMemory(), PlaceHooks(), and UnHook().