Bail out immediately if IAT entry is already hooked

* This avoids going into VirtualProtect changing the page access while code
  may potentially be executing these areas of memory (since the module is
  hooked, and may have returned to user code)
This commit is contained in:
baldurk committed 2014-08-09 01:44:45 +01:00
1 parent aa690d7183
commit 1b0eae755a
1 file changed
+4 -1
+4 -1
View File
@@ -50,6 +50,9 @@ struct FunctionHook
{
DWORD oldProtection = PAGE_EXECUTE;
if(*IATentry == hookptr)
return;
BOOL success = TRUE;
success = VirtualProtect(IATentry, sizeof(void*), PAGE_READWRITE, &oldProtection);
@@ -59,7 +62,7 @@ struct FunctionHook
return;
}
if(origptr && *origptr == NULL && *IATentry != hookptr) *origptr = *IATentry;
if(origptr && *origptr == NULL) *origptr = *IATentry;
*IATentry = hookptr;