Bail out immediately if IAT entry is already hooked

* This avoids going into VirtualProtect changing the page access while code
  may potentially be executing these areas of memory (since the module is
  hooked, and may have returned to user code)
This commit is contained in:
baldurk
2014-08-09 01:44:45 +01:00
parent aa690d7183
commit 1b0eae755a
+4 -1
View File
@@ -50,6 +50,9 @@ struct FunctionHook
{
DWORD oldProtection = PAGE_EXECUTE;
if(*IATentry == hookptr)
return;
BOOL success = TRUE;
success = VirtualProtect(IATentry, sizeof(void*), PAGE_READWRITE, &oldProtection);
@@ -59,7 +62,7 @@ struct FunctionHook
return;
}
if(origptr && *origptr == NULL && *IATentry != hookptr) *origptr = *IATentry;
if(origptr && *origptr == NULL) *origptr = *IATentry;
*IATentry = hookptr;