hook.cpp

Go to the documentation of this file.

#include "hook.hpp"
#include "detours\detours.h"
 
#pragma region Hooked Functions
 
pNtWriteVirtualMemory pOriginal_NtWriteVirtualMemory = NULL;
pNtModifyBootEntry pOriginal_NtModifyBootEntry = NULL;
pNtMapViewOfSectionEx pOriginal_NtMapViewOfSectionEx = NULL;
 
NTSTATUS NTAPI Hooked_NtWriteVirtualMemory(
    HANDLE ProcessHandle, 
    PVOID BaseAddress, 
    PVOID Buffer, 
    SIZE_T NumberOfBytesToWrite, 
    PSIZE_T NumberOfBytesWritten
)
{
    NTSTATUS status = pOriginal_NtWriteVirtualMemory(ProcessHandle, BaseAddress, Buffer, NumberOfBytesToWrite, NumberOfBytesWritten);
 
    return status;
}
 
NTSTATUS Hooked_NtModifyBootEntry(PBOOT_ENTRY BootEntry) {
    NTSTATUS status = pOriginal_NtModifyBootEntry(BootEntry);
    return status;
}
 
NTSTATUS Hooked_NtMapViewOfSectionEx(_In_ HANDLE SectionHandle,
    _In_ HANDLE ProcessHandle,
    _Inout_ _At_(*BaseAddress, _Readable_bytes_(*ViewSize) _Writable_bytes_(*ViewSize) _Post_readable_byte_size_(*ViewSize)) PVOID* BaseAddress,
    _Inout_opt_ PLARGE_INTEGER SectionOffset,
    _Inout_ PSIZE_T ViewSize,
    _In_ ULONG AllocationType,
    _In_ ULONG PageProtection,
    _Inout_updates_opt_(ExtendedParameterCount) PMEM_EXTENDED_PARAMETER ExtendedParameters,
    _In_ ULONG ExtendedParameterCount) 
{
    NTSTATUS status = pOriginal_NtMapViewOfSectionEx(SectionHandle,ProcessHandle,BaseAddress, 
    SectionOffset, ViewSize, AllocationType,PageProtection,ExtendedParameters,
    ExtendedParameterCount);
 
    return status;
}
 
#pragma endregion
 
VOID PlaceHooks() {
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
 
    pOriginal_NtWriteVirtualMemory = (pNtWriteVirtualMemory)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtWriteVirtualMemory");
    if (pOriginal_NtWriteVirtualMemory)
    {
        DetourAttach((PVOID*)&pOriginal_NtWriteVirtualMemory, (PVOID)Hooked_NtWriteVirtualMemory);
    }
 
    pOriginal_NtModifyBootEntry = (pNtModifyBootEntry)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtModifyBootEntry");
    if (pOriginal_NtModifyBootEntry) {
        DetourAttach((PVOID*)&pOriginal_NtModifyBootEntry, (PVOID)Hooked_NtModifyBootEntry);
    }
 
    pOriginal_NtMapViewOfSectionEx = (pNtMapViewOfSectionEx)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtMapViewOfSectionEx");
    if (pOriginal_NtMapViewOfSectionEx) {
        DetourAttach((PVOID*)&pOriginal_NtMapViewOfSectionEx, (PVOID)Hooked_NtMapViewOfSectionEx);
    }
 
    DetourTransactionCommit();
    return;
}
 
VOID UnHook() {
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
 
    if (pOriginal_NtWriteVirtualMemory) {
        DetourDetach((PVOID*)&pOriginal_NtWriteVirtualMemory, (PVOID)Hooked_NtWriteVirtualMemory);
    }
 
    if (pOriginal_NtModifyBootEntry) {
        DetourDetach((PVOID*)&pOriginal_NtModifyBootEntry, (PVOID)Hooked_NtModifyBootEntry);
    }
 
    if (pOriginal_NtMapViewOfSectionEx) {
        DetourDetach((PVOID*)&pOriginal_NtMapViewOfSectionEx, (PVOID)Hooked_NtMapViewOfSectionEx);
    }
 
    DetourTransactionCommit();
    return;
}