HookDetector/common.h at main · SAERXCIT/HookDetector · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
#pragma once

#include <Windows.h>
#include <stdio.h>
#include <winternl.h>

typedef struct _MODULE_INFO {
	LPWSTR wszModuleName;
	PVOID pModuleAddress;
} MODULE_INFO, * PMODULE_INFO;

typedef struct _MODULE_LIST {
	WORD wCount;
	MODULE_INFO pModuleList[ANYSIZE_ARRAY];
} MODULE_LIST, * PMODULE_LIST;

typedef struct _HOOK_INFO {
	DWORD dwDifferenceRVA;
	DWORD dwBestCandidateRVA;
	LPSTR szBestCandidateName;
} HOOK_INFO, * PHOOK_INFO;

typedef struct _HOOK_LIST {
	WORD wCount;
	HOOK_INFO pHookList[ANYSIZE_ARRAY];
} HOOK_LIST, * PHOOK_LIST;


BOOL GetLoadedModuleList(
	PMODULE_LIST* ppsctModuleList
);
BOOL GetModuleSectionHeader(
	PBYTE pModuleAddress,
	LPCSTR szSectionName,
	PIMAGE_SECTION_HEADER* ppImgSectionHdr
);
BOOL FindFunctionsFromRVAs(
	PBYTE pModuleAddress,
	BOOL bIsManuallyMapped,
	PHOOK_LIST psctHookList
);
DWORD RvaToRaw(
	PBYTE pMappedModule,
	DWORD dwRva
);

BOOL MapFromKnownDLLs(
	LPWSTR wszModuleName,
	PBYTE* ppModuleData,
	PHANDLE phFileToClose
);
BOOL MapFromFileSystem(
	LPWSTR wszModuleName,
	PBYTE* ppModuleData,
	PHANDLE phFileToClose,
	PHANDLE phFileMappingToClose
);
BOOL MapTargetModule(
	LPWSTR wszModuleName,
	PBYTE* ppMappedAddress,
	PBOOL pbIsManuallyMapped,
	PHANDLE phFileToClose,
	PHANDLE phFileMappingToClose
);

BOOL ProcessModuleComparison(
	PBYTE pLoadedModuleAddress,
	PBYTE pMappedModuleAddress,
	BOOL bIsManuallyMapped,
	PHOOK_LIST* ppsctHookList
);
BOOL CompareBytes(
	PBYTE pLoadedBase,
	PBYTE pLoadedText,
	PBYTE pMappedText,
	DWORD dwTextSize,
	PHOOK_LIST* ppsctHookList
);

VOID StuffIAT(
	void
);


typedef NTSTATUS(NTAPI* fnNtOpenSection)(
	_Out_ PHANDLE SectionHandle,
	_In_ ACCESS_MASK DesiredAccess,
	_In_ POBJECT_ATTRIBUTES ObjectAttributes
);