Исходник Beeflang Hook class (x64/x86)

[oldORM]

class Hook {
    private readonly void* mOriginal ~ delete _;
    private readonly void* mReplacement ~ delete _;
#if BF_64_BIT
    private uint8[] mReplacementBytes = new .(
                0x49, 0xBA,                                            //movabs r10
                0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA,        //[QWORD]   
                0x41, 0xFF, 0xE2                                       //jmp r10
            ) ~ delete _;
#else
    private uint8[] mReplacementBytes = new .(
                0xB8,                                                  //mov eax
                0xAA, 0xAA, 0xAA, 0xAA,                                //[DWORD]
                0xFF, 0xE0                                             //jmp eax
            ) ~ delete _;
#endif
    private uint8[] mOriginalBytes = new .[mReplacementBytes.Count] ~ delete _;

    [CLink, CallingConvention(.Stdcall)]
    private static extern bool VirtualProtect(void* lpAddress, uint32 dwSize, uint32 flNewProtect, out uint32 lpflOldProtect);

    public this(void* originalAddress, void* replacementAddress) {
        mOriginal = originalAddress;
        mReplacement = replacementAddress;

        Internal.MemCpy(mOriginalBytes.Ptr, mOriginal, mReplacementBytes.Count);

        uint32 oldProtect;
        VirtualProtect(mOriginal, (.)mReplacementBytes.Count, Windows.PAGE_READWRITE, out oldProtect);

#if BF_64_BIT
        *(void**)(mReplacementBytes.Ptr + 2) = mReplacement;
#else
        *(void**)(mReplacementBytes.Ptr + 1) = mReplacement;
#endif

        Internal.MemCpy(mOriginal, mReplacementBytes.Ptr, mReplacementBytes.Count);

        VirtualProtect(mOriginal, (.)mReplacementBytes.Count, oldProtect, out oldProtect);
    }

    public void Unhook()
    {
        uint32 oldProtect;
        VirtualProtect(mOriginal, (.)mOriginalBytes.Count, Windows.PAGE_READWRITE, out oldProtect);
        Internal.MemCpy(mOriginal, mOriginalBytes.Ptr, mOriginalBytes.Count);
        VirtualProtect(mOriginal, (.)mOriginalBytes.Count, oldProtect, out oldProtect);
    }
}

Пример использования:

    public static this() {
        AllocConsole();
        let handle = Windows.GetModuleHandleA("user32.dll");
        let address = Windows.GetProcAddress(handle, "MessageBoxA");
        Console.WriteLine(scope $"Address: {address:X}");
        function int(Windows.HWnd, char8*, char8*, int32) funcPtr = => HookMsgbox;
        function int(Windows.HWnd, char8*, char8*, int32) funcPtr2 = (.)address;
        var hook = scope Hook(address, (void*)funcPtr);
        funcPtr2(0, "", "", 0);
        Console.Read();
        hook.Unhook();
    }

    public static int HookMsgbox(Windows.HWnd handle, char8* desc, char8* title, int32 type) {
        return 0;
    }

 

[UNVI]

Я правильно понимаю, хук перехватывает вызовы WinApi функций?

 

[oldORM]

Я правильно понимаю, хук перехватывает вызовы WinApi функций?

Любых функций, адрес которых передадут