ntapiworks.txt

Cracker终结者——提供最优秀的软件保护技术

  NtApiWorks allows developer to establish API/code hooks
in NT native processes (processes which do not contain
KERNEL32.dll module, like smss.exe, os2ss.exe).
  NtApiWorks, in collaboration with AddProcessInitX, allows
developer to establish API/code hooks in process before
KERNEL32.dll initialization.
  NtApiWorks contains NtEAHScout that can be run remotelly
(NtHooks_DLL is not linked with NtApiWorks, only loader is)
or locally (NtHooks_DLL is linked with NtApiWorks statically
or dynamically).

  Exported functions:

NtCallOrigFn and NtUnhookApis are Nt equivalents to AH functions
CallOrigFn and NtUnhookApis.

PVOID NtAllocEAHScout(LPCTSTR lpszDll, BOOL Reapply, PDWORD dwScoutSize);
allocates and fixes NtEAHScout, fills in lpszDll (can be NtHooks_DLL
or ApiHookChain), enables hooks reapplication according to Reapply
and fills dwScoutSize (if non-NULL) with NtEAHScout size.
Returns pointer to new NtEAHScout, that can be executed using
NtExecEAHScout (locally) or using (h)RemoteExecute.
Return values: pScout or AH error codes.

BOOL NtFreeEAHScout(PVOID pScout);
frees memory previously allocated by NtAllocEAHScout.

DWORD NtExecEAHScout(PVOID pScout);
executes NtEAHScout in the context of current process (locally).