Hook LoadLibrary/GetProcAddress variants in 'libraryloader' API sets

This commit is contained in:
baldurk
2017-05-01 16:02:21 +01:00
parent 478f22559c
commit ddc555fd31
+17
View File
@@ -728,6 +728,23 @@ void Win32_IAT_BeginHooks()
s_HookData->DllHooks["kernel32.dll"].FunctionHooks.push_back(
FunctionHook("GetProcAddress", NULL, &Hooked_GetProcAddress));
for(const char *apiset :
{"api-ms-win-core-libraryloader-l1-1-0.dll", "api-ms-win-core-libraryloader-l1-1-1.dll",
"api-ms-win-core-libraryloader-l1-1-2.dll", "api-ms-win-core-libraryloader-l1-2-0.dll",
"api-ms-win-core-libraryloader-l1-2-1.dll"})
{
s_HookData->DllHooks[apiset].FunctionHooks.push_back(
FunctionHook("LoadLibraryA", NULL, &Hooked_LoadLibraryA));
s_HookData->DllHooks[apiset].FunctionHooks.push_back(
FunctionHook("LoadLibraryW", NULL, &Hooked_LoadLibraryW));
s_HookData->DllHooks[apiset].FunctionHooks.push_back(
FunctionHook("LoadLibraryExA", NULL, &Hooked_LoadLibraryExA));
s_HookData->DllHooks[apiset].FunctionHooks.push_back(
FunctionHook("LoadLibraryExW", NULL, &Hooked_LoadLibraryExW));
s_HookData->DllHooks[apiset].FunctionHooks.push_back(
FunctionHook("GetProcAddress", NULL, &Hooked_GetProcAddress));
}
GetModuleHandleEx(
GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
(LPCTSTR)&s_HookData, &s_HookData->ownmodule);