iconic wrote:Does Real_RtlCopyMemory have WINAPI? Both callback and real hook definitions need the same calling convention, otherwise you crash
--Iconic
typedef void (WINAPI *_RtlCopyMemory)(PVOID Destination, PVOID Source, SIZE_T Length);
void (WINAPI *Real_RtlCopyMemory)(PVOID Destination, PVOID Source, SIZE_T Length);
void WINAPI Detour_RtlCopyMemory(PVOID Destination, PVOID Source, SIZE_T Length)
{
Real_RtlCopyMemory(Destination, Source, Length);
if (Length == 5 && lstrcmpA((char *)Source, "Hello") == 0)
{
printf("Calling RtlCopyMemory(0x%p, 0x%p, 0x%x) <-----\n", Destination, Source, Length);
}
else
{
printf("Calling RtlCopyMemory(0x%p, 0x%p, 0x%x)\n", Destination, Source, Length);
}
}
int _tmain(int argc, _TCHAR* argv[])
{
InitializeMadCHook();
char a1[MAX_PATH] = {0};
char a2[MAX_PATH] = {0};
_RtlCopyMemory pRtlCopyMemory = (_RtlCopyMemory)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "RtlCopyMemory");
lstrcpyA(a1, "Hello");
HookAPI("ntdll.dll", "RtlCopyMemory", Detour_RtlCopyMemory, (PVOID*)&Real_RtlCopyMemory);
pRtlCopyMemory(&a2, &a1, 5);
getchar();
return 0;
}
VOID WINAPI Detour_RtlCopyMemory(PVOID pDestination, const PVOID pSource, SIZE_T iSize)
{
return Real_RtlCopyMemory(pDestination, pSource, iSize);
}
Users browsing this forum: Google [Bot] and 11 guests