@@ -670,15 +670,13 @@ BOOL Mhook_SetHook(PVOID *ppSystemFunction, PVOID pHookFunction) {
670
670
pTrampoline = TrampolineAlloc ((PBYTE)pSystemFunction, patchdata.nLimitUp , patchdata.nLimitDown );
671
671
if (pTrampoline) {
672
672
ODPRINTF ((L" mhooks: Mhook_SetHook: allocated structure at %p" , pTrampoline));
673
- // open ourselves so we can VirtualProtectEx
674
- HANDLE hProc = GetCurrentProcess ();
675
673
DWORD dwOldProtectSystemFunction = 0 ;
676
674
DWORD dwOldProtectTrampolineFunction = 0 ;
677
675
// set the system function to PAGE_EXECUTE_READWRITE
678
- if (VirtualProtectEx (hProc, pSystemFunction, dwInstructionLength, PAGE_EXECUTE_READWRITE, &dwOldProtectSystemFunction)) {
676
+ if (VirtualProtect ( pSystemFunction, dwInstructionLength, PAGE_EXECUTE_READWRITE, &dwOldProtectSystemFunction)) {
679
677
ODPRINTF ((L" mhooks: Mhook_SetHook: readwrite set on system function" ));
680
678
// mark our trampoline buffer to PAGE_EXECUTE_READWRITE
681
- if (VirtualProtectEx (hProc, pTrampoline, sizeof (MHOOKS_TRAMPOLINE), PAGE_EXECUTE_READWRITE, &dwOldProtectTrampolineFunction)) {
679
+ if (VirtualProtect ( pTrampoline, sizeof (MHOOKS_TRAMPOLINE), PAGE_EXECUTE_READWRITE, &dwOldProtectTrampolineFunction)) {
682
680
ODPRINTF ((L" mhooks: Mhook_SetHook: readwrite set on trampoline structure" ));
683
681
684
682
// create our trampoline function
@@ -710,7 +708,7 @@ BOOL Mhook_SetHook(PVOID *ppSystemFunction, PVOID pHookFunction) {
710
708
pbCode = pTrampoline->codeJumpToHookFunction ;
711
709
pbCode = EmitJump (pbCode, (PBYTE)pHookFunction);
712
710
ODPRINTF ((L" mhooks: Mhook_SetHook: created reverse trampoline" ));
713
- FlushInstructionCache (hProc , pTrampoline->codeJumpToHookFunction ,
711
+ FlushInstructionCache (GetCurrentProcess () , pTrampoline->codeJumpToHookFunction ,
714
712
pbCode - pTrampoline->codeJumpToHookFunction );
715
713
716
714
// update the API itself
@@ -729,16 +727,16 @@ BOOL Mhook_SetHook(PVOID *ppSystemFunction, PVOID pHookFunction) {
729
727
pTrampoline->pHookFunction = (PBYTE)pHookFunction;
730
728
731
729
// flush instruction cache and restore original protection
732
- FlushInstructionCache (hProc , pTrampoline->codeTrampoline , dwInstructionLength);
733
- VirtualProtectEx (hProc, pTrampoline, sizeof (MHOOKS_TRAMPOLINE), dwOldProtectTrampolineFunction, &dwOldProtectTrampolineFunction);
730
+ FlushInstructionCache (GetCurrentProcess () , pTrampoline->codeTrampoline , dwInstructionLength);
731
+ VirtualProtect ( pTrampoline, sizeof (MHOOKS_TRAMPOLINE), dwOldProtectTrampolineFunction, &dwOldProtectTrampolineFunction);
734
732
} else {
735
- ODPRINTF ((L" mhooks: Mhook_SetHook: failed VirtualProtectEx 2: %d" , gle ()));
733
+ ODPRINTF ((L" mhooks: Mhook_SetHook: failed VirtualProtect 2: %d" , gle ()));
736
734
}
737
735
// flush instruction cache and restore original protection
738
- FlushInstructionCache (hProc , pSystemFunction, dwInstructionLength);
739
- VirtualProtectEx (hProc, pSystemFunction, dwInstructionLength, dwOldProtectSystemFunction, &dwOldProtectSystemFunction);
736
+ FlushInstructionCache (GetCurrentProcess () , pSystemFunction, dwInstructionLength);
737
+ VirtualProtect ( pSystemFunction, dwInstructionLength, dwOldProtectSystemFunction, &dwOldProtectSystemFunction);
740
738
} else {
741
- ODPRINTF ((L" mhooks: Mhook_SetHook: failed VirtualProtectEx 1: %d" , gle ()));
739
+ ODPRINTF ((L" mhooks: Mhook_SetHook: failed VirtualProtect 1: %d" , gle ()));
742
740
}
743
741
if (pTrampoline->pSystemFunction ) {
744
742
// this is what the application will use as the entry point
@@ -771,19 +769,17 @@ BOOL Mhook_Unhook(PVOID *ppHookedFunction) {
771
769
// make sure nobody's executing code where we're about to overwrite a few bytes
772
770
SuspendOtherThreads (pTrampoline->pSystemFunction , pTrampoline->cbOverwrittenCode );
773
771
ODPRINTF ((L" mhooks: Mhook_Unhook: found struct at %p" , pTrampoline));
774
- // open ourselves so we can VirtualProtectEx
775
- HANDLE hProc = GetCurrentProcess ();
776
772
DWORD dwOldProtectSystemFunction = 0 ;
777
773
// make memory writable
778
- if (VirtualProtectEx (hProc, pTrampoline->pSystemFunction , pTrampoline->cbOverwrittenCode , PAGE_EXECUTE_READWRITE, &dwOldProtectSystemFunction)) {
774
+ if (VirtualProtect ( pTrampoline->pSystemFunction , pTrampoline->cbOverwrittenCode , PAGE_EXECUTE_READWRITE, &dwOldProtectSystemFunction)) {
779
775
ODPRINTF ((L" mhooks: Mhook_Unhook: readwrite set on system function" ));
780
776
PBYTE pbCode = (PBYTE)pTrampoline->pSystemFunction ;
781
777
for (DWORD i = 0 ; i<pTrampoline->cbOverwrittenCode ; i++) {
782
778
pbCode[i] = pTrampoline->codeUntouched [i];
783
779
}
784
780
// flush instruction cache and make memory unwritable
785
- FlushInstructionCache (hProc , pTrampoline->pSystemFunction , pTrampoline->cbOverwrittenCode );
786
- VirtualProtectEx (hProc, pTrampoline->pSystemFunction , pTrampoline->cbOverwrittenCode , dwOldProtectSystemFunction, &dwOldProtectSystemFunction);
781
+ FlushInstructionCache (GetCurrentProcess () , pTrampoline->pSystemFunction , pTrampoline->cbOverwrittenCode );
782
+ VirtualProtect ( pTrampoline->pSystemFunction , pTrampoline->cbOverwrittenCode , dwOldProtectSystemFunction, &dwOldProtectSystemFunction);
787
783
// return the original function pointer
788
784
*ppHookedFunction = pTrampoline->pSystemFunction ;
789
785
bRet = TRUE ;
@@ -792,7 +788,7 @@ BOOL Mhook_Unhook(PVOID *ppHookedFunction) {
792
788
TrampolineFree (pTrampoline, FALSE );
793
789
ODPRINTF ((L" mhooks: Mhook_Unhook: unhook successful" ));
794
790
} else {
795
- ODPRINTF ((L" mhooks: Mhook_Unhook: failed VirtualProtectEx 1: %d" , gle ()));
791
+ ODPRINTF ((L" mhooks: Mhook_Unhook: failed VirtualProtect 1: %d" , gle ()));
796
792
}
797
793
// make the other guys runnable
798
794
ResumeOtherThreads ();
0 commit comments