Describes a function to be hooked. More...

#include <detours.h>

Data Fields
PWCHAR	ModuleName
	NULL-terminated string of the kernel module in which the function is found. More...

PCHAR	FunctionName
	NULL-terminated string of the function name. More...

DWORD	MinVersion
	The minimum OS version for which this hook should be applied. More...

DWORD	MaxVersion
	The maximum OS version for which this hook should be applied. More...

PFUNC_DetourCallback	Callback
	Callback to be invoked when the detour issues a hypercall. May be NULL. More...

PFUNC_PreDetourCallback	PreCallback
	Callback to be invoked before the detour is written inside the guest. May be NULL. More...

PFUNC_PostDetourCallback	PostCallback
	Callback to be invoked after the detour has been set. May be NULL. More...

DETOUR_TAG	Tag
	Detour tag. More...

BOOLEAN	Exported
	True if this function is exported by the module that owns it. More...

BOOLEAN	NotCritical
	If True, this hook is not critical. More...

QWORD	DisableFlags
	Core activation and protection flags that will cause introcore to skip this hook. More...

QWORD	EnableFlags
	Core activation and protection flags that must be set in order to set and activate this hook. More...

WIN_UNEXPORTED_FUNCTION *	Patterns
	Array of code patterns used to find this function. More...

DETOUR_ARGS	Arguments
	Encoding of the arguments needed by introcore from the hooked function. More...

DWORD	HandlersCount
	The number of valid entries inside the Handlers array. More...

API_HOOK_HANDLER	Handlers [DETOUR_MAX_HANDLERS]
	Handlers that can be set for this function. More...

Detailed Description

Describes a function to be hooked.

This is used by IntDetSetHook and IntDetSetLixHook to know what to hook and how to find the hooked region.

Definition at line 329 of file detours.h.

Field Documentation

◆ Arguments

DETOUR_ARGS _API_HOOK_DESCRIPTOR::Arguments

Encoding of the arguments needed by introcore from the hooked function.

Definition at line 379 of file detours.h.

Referenced by IntDetGetArgument(), IntDetGetArguments(), IntDetPatchArgument(), IntWinApiUpdateHookDescriptor(), IntWinProcPatchSwapOut32(), and IntWinProcPatchSwapOut64().

◆ Callback

PFUNC_DetourCallback _API_HOOK_DESCRIPTOR::Callback

Callback to be invoked when the detour issues a hypercall. May be NULL.

Definition at line 347 of file detours.h.

◆ DisableFlags

QWORD _API_HOOK_DESCRIPTOR::DisableFlags

Core activation and protection flags that will cause introcore to skip this hook.

These are checked against the current options from gGuest. If options are changed and the new options contain any of these bits, the hook is disabled.

Definition at line 367 of file detours.h.

Referenced by IntWinApiUpdateHooks().

◆ EnableFlags

QWORD _API_HOOK_DESCRIPTOR::EnableFlags

Core activation and protection flags that must be set in order to set and activate this hook.

These are checked against the current options from gGuest. At least one must be set. If options are changed and the new options do not contain any of these bits, the hook is disabled. DETOUR_ENABLE_ALWAYS can be used to always enable this hook.

Definition at line 373 of file detours.h.

◆ Exported

BOOLEAN _API_HOOK_DESCRIPTOR::Exported

True if this function is exported by the module that owns it.

If False, the function address is found by using a code pattern.

Definition at line 358 of file detours.h.

◆ FunctionName

PCHAR _API_HOOK_DESCRIPTOR::FunctionName

NULL-terminated string of the function name.

This is used to match against function information inside a CAMI file. If Exported is True, the name is also used to find the function inside the kernel module that owns it.

Definition at line 337 of file detours.h.

◆ Handlers

API_HOOK_HANDLER _API_HOOK_DESCRIPTOR::Handlers[DETOUR_MAX_HANDLERS]

Handlers that can be set for this function.

The first entry in the array that matches the restrictions for this hook is used. Because of this, the order in which handlers should be set in this array is from the most to least restrictive. For example, if a function has to handlers: one available for Windows 9200 only, and another one available for all the other versions, the one for 9200 must be the first in the array.

Definition at line 388 of file detours.h.

Referenced by IntLixPatchSwapgs().

◆ HandlersCount

DWORD _API_HOOK_DESCRIPTOR::HandlersCount

The number of valid entries inside the Handlers array.

Definition at line 381 of file detours.h.

◆ MaxVersion

DWORD _API_HOOK_DESCRIPTOR::MaxVersion

The maximum OS version for which this hook should be applied.

DETOUR_MAX_VERSION_ANY can be used if there is no lower limit.

Definition at line 345 of file detours.h.

Referenced by IntWinApiHookAll(), and IntWinApiUpdateHookDescriptor().

◆ MinVersion

DWORD _API_HOOK_DESCRIPTOR::MinVersion

The minimum OS version for which this hook should be applied.

DETOUR_MIN_VERSION_ANY can be used if there is no lower limit.

Definition at line 341 of file detours.h.

Referenced by IntWinApiHookAll(), and IntWinApiUpdateHookDescriptor().

◆ ModuleName

PWCHAR _API_HOOK_DESCRIPTOR::ModuleName

NULL-terminated string of the kernel module in which the function is found.

Definition at line 332 of file detours.h.

◆ NotCritical

BOOLEAN _API_HOOK_DESCRIPTOR::NotCritical

If True, this hook is not critical.

Failure to set a critical hook is treated as a fatal initialization error and stops introcore.

Definition at line 362 of file detours.h.

◆ Patterns

WIN_UNEXPORTED_FUNCTION* _API_HOOK_DESCRIPTOR::Patterns

Array of code patterns used to find this function.

If Exported is True this field is ignored. If Exported is False this field must be valid.

Definition at line 377 of file detours.h.

Referenced by IntWinApiUpdateHookDescriptor().

◆ PostCallback

PFUNC_PostDetourCallback _API_HOOK_DESCRIPTOR::PostCallback

Callback to be invoked after the detour has been set. May be NULL.

Definition at line 351 of file detours.h.

◆ PreCallback

PFUNC_PreDetourCallback _API_HOOK_DESCRIPTOR::PreCallback

Callback to be invoked before the detour is written inside the guest. May be NULL.

Definition at line 349 of file detours.h.

◆ Tag

DETOUR_TAG _API_HOOK_DESCRIPTOR::Tag

Detour tag.

Definition at line 354 of file detours.h.

The documentation for this struct was generated from the following file:

introcore/include/detours.h

Data Fields