ntapiworks.h

Cracker终结者——提供最优秀的软件保护技术

// NtApiWorks.h - constants and structures for NtApiWorks

#ifndef _APIWORKS_
#define _APIWORKS_ 1

#include <ApiHooks.h>

//Protos--------------------------------------------

#ifdef __TURBOC__
  #ifdef __cplusplus
    #define __EXPORT extern "C" __declspec(dllexport)
  #else
    #define __EXPORT __declspec(dllexport)
  #endif
  #ifdef AW_STATIC_LINKING
    #ifdef __cplusplus
      #define __XTRN198 extern "C"
    #else
      #define __XTRN198 extern
    #endif

    __XTRN198 PVOID __stdcall _NtAllocEAHScoutA(LPCSTR  lpszDll, BOOL Reapply, PDWORD dwScoutSize);
    __XTRN198 PVOID __stdcall _NtAllocEAHScoutW(LPCWSTR lpszDll, BOOL Reapply, PDWORD dwScoutSize);

    __XTRN198 DWORD __stdcall _NtExecEAHScout(PVOID pScout);

    __XTRN198 BOOL  __stdcall _NtFreeEAHScout(PVOID pScout);

    __XTRN198 DWORD __stdcall _NtCallOrigFn(LPCSTR ModuleExport, LPCSTR ApiNameOrOrd, DWORD dwFlags, LPCVOID OrigFn, PAPI_UNHOOK ApiUnhook, DWORD nArgs, LPVOID pArgs);

    __XTRN198 BOOL  __stdcall _NtUnhookApis(PAPI_HOOK lpAHChain, LONG nAHooks);

    #define  NtAllocEAHScoutA     _NtAllocEAHScoutA
    #define  NtAllocEAHScoutW     _NtAllocEAHScoutW
    #define  NtExecEAHScout       _NtExecEAHScout
    #define  NtFreeEAHScout       _NtFreeEAHScout
    #define  NtUnhookApis         _NtUnhookApis
    #define  NtCallOrigFn         _NtCallOrigFn
 
    #ifdef UNICODE
      #define  NtAllocEAHScout NtAllocEAHScoutW
    #else
      #define  NtAllocEAHScout NtAllocEAHScoutA
    #endif //#ifdef UNICODE
    #pragma comment(lib,"SbNtApiWorks.lib")
  #else
    #define __NORMAL0Q 1
    #ifdef __cplusplus
      #define __XTRN198  extern "C" __declspec(dllimport)
    #else
      #define __XTRN198  __declspec(dllimport)
    #endif
    #pragma comment(lib,"bNtApiWorks.lib")
  #endif //#ifdef AW_STATIC_LINKING
#else
#define __NORMAL0Q 1
#ifdef _MSC_VER
  #ifdef __cplusplus
    #define __EXPORT extern "C" __declspec(dllexport)
  #else
    #define __EXPORT __declspec(dllexport)
  #endif
  #ifdef AW_STATIC_LINKING
    #ifdef __cplusplus
      #define __XTRN198 extern "C"
    #else
      #define __XTRN198 extern
    #endif
    #pragma comment(lib,"SNtApiWorks")
  #else
    #ifdef __cplusplus
      #define __XTRN198  extern "C" __declspec(dllimport)
    #else
      #define __XTRN198  __declspec(dllimport)
    #endif
    #pragma comment(lib,"NtApiWorks")
  #endif
#else
  #define __XTRN198
  #define __EXPORT
#endif //#ifdef _MSC_VER
#endif //#ifdef __TURBOC__

#ifdef __NORMAL0Q

 __XTRN198 PVOID __stdcall  NtAllocEAHScoutA(LPCSTR  lpszDll, BOOL Reapply, PDWORD dwScoutSize);
 __XTRN198 PVOID __stdcall  NtAllocEAHScoutW(LPCWSTR lpszDll, BOOL Reapply, PDWORD dwScoutSize);

 __XTRN198 DWORD __stdcall  NtExecEAHScout(PVOID pScout);

 __XTRN198 BOOL  __stdcall  NtFreeEAHScout(PVOID pScout);

 __XTRN198 DWORD __stdcall  NtCallOrigFn(LPCSTR ModuleExport, LPCSTR ApiNameOrOrd, DWORD dwFlags, LPCVOID OrigFn, PAPI_UNHOOK ApiUnhook, DWORD nArgs, LPVOID pArgs);

 __XTRN198 BOOL  __stdcall  NtUnhookApis(PAPI_HOOK lpAHChain, LONG nAHooks);

 #ifdef UNICODE
   #define  NtAllocEAHScout NtAllocEAHScoutW
 #else
   #define  NtAllocEAHScout NtAllocEAHScoutA
 #endif
#endif

 #define NTORIGFN(HookNo, nArgs, pArgs)\
        (NtCallOrigFn(ApiHookChain[(HookNo)].ModuleExport,\
                     ApiHookChain[(HookNo)].ApiNameOrOrd,\
                     ApiHookChain[(HookNo)].dwFlags,\
                     ApiHookChain[(HookNo)].ModuleImport,\
                     ApiHookChain[(HookNo)].UnhookAddresses,\
                     (nArgs), (pArgs)))

#endif