its an example of what we are doing in our hook method, only using Get/SetThreadContext in the Critical Code Block, which must be executed as one block because if we have to change SetThreadContext the EIP must be correct.
its only an example, if u call begintest there should be a messagebox "1" if the code is executed in one block
what do u think? it seems to me that i get enough "time" to execute the hook code. maybe better than suspending threads (we have to test it on serveral PCs first)
nildo has a third solution maybe this is working how we want
for testing u can add remove
SetThreadPriority(GetCurrentThread, THREAD_PRIORITY_TIME_CRITICAL);
and see thats not working without it (because messagebox with "0" = not executed as one code)
Code: Select all
var tid, tid2: cardinal;
i,j: integer;
procedure start;
begin
while (true) do i := 0;
end;
procedure hook; // pseudo hook code
var lpContext: _CONTEXT;
k: integer;
begin
SetThreadPriority(GetCurrentThread, THREAD_PRIORITY_TIME_CRITICAL);
i := 1; // begin of block code which must be called without stop
lpContext.ContextFlags := CONTEXT_CONTROL;
for k := 1 to 10 do GetThreadContext(tid,lpContext); // for all threads
asm
xor eax, eax
@weiter:
inc eax
cmp eax, $1000000 // do the hook (overwrite code with jmp)
// i dont think it takes more instructions than this ;>
jne @weiter
end;
for k := 1 to 10 do SetThreadContext(tid,lpContext); // *maybe* for all threads
j := i; // end of block code which must be called without stop
SetThreadPriority(GetCurrentThread, THREAD_PRIORITY_NORMAL);
end;
procedure begintest;
begin
tid := CreateThread(nil,0,@start,nil,0,tid); // create the first thread
sleep(100); // let i := 0
tid2 := CreateThread(nil,0,@hook,nil,0,tid2); // create the or thread thread
Sleep(100); // let i :=
Messagebox(0,pchar(inttostr(j)),nil,0); // is second thread called in 1 block? (j = 1)?
end;
