apihooks.bas

Cracker终结者——提供最优秀的软件保护技术

Attribute VB_Name = "ApiHooks"
Public Const HOOK_EXPORT       As Long = 1
Public Const HOOK_BY_NAME      As Long = 2
Public Const HOOK_BY_ADDRESS   As Long = 4
Public Const HOOK_HARD         As Long = 8
Public Const HOOK_LOAD_IMPORT  As Long = 16
Public Const HOOK_SPECIAL      As Long = 32
Public Const HOOK_NOT_NT       As Long = 64
Public Const HOOK_NOT_9X       As Long = 128
Public Const HOOK_OVERWRITE    As Long = 256
Public Const HOOK_RAW          As Long = 512
Public Const HOOK_ALL_SAFE     As Long = 1024
Public Const HOOK_LOAD_EXPORT  As Long = 2048
  
Public Const HOOKS_END         As Long = (-1)
Public Const HOOKS_DYNAMIC     As Long = (-2)
 
Public Const ALL_MODULES       As Long = (-1)
Public Const MAIN_MODULE       As Long = 0

Public Const WHOLE_AH_CHAIN    As Long = (-1)

Public Const ErrorAHMin        As Long = &HE1C2F3B1
Public Const ErrorAHException  As Long = (ErrorAHMin + 0)
Public Const ErrorAHOpen       As Long = (ErrorAHMin + 1)
Public Const ErrorAHPrepare    As Long = (ErrorAHMin + 2)
Public Const ErrorAHTimeOut    As Long = (ErrorAHMin + 3)
Public Const ErrorAHRemote     As Long = (ErrorAHMin + 4)
Public Const ErrorAHMax        As Long = (ErrorAHMin + 4)

Public Const ErrorAMMin        As Long = ErrorAHMin
Public Const ErrorAMModule     As Long = (ErrorAHMax+1)
Public Const ErrorAMApi        As Long = (ErrorAHMax+2)
Public Const ErrorAMMax        As Long = (ErrorAHMax+2)

Public Const ErrorAWSuccess    As Long = &HE1C2F3B0

Public Const RC_FL_OWNTIMEOUT  As Long = 1
Public Const RC_FL_TERMINATE   As Long = 2
Public Const RC_FL_OWNFREE     As Long = 4
Public Const RC_FL_UNHIDE9X    As Long = 8
Public Const RC_FL_DEFSD       As Long = 16

Public Const RC_PF_DEBUGGED    As Long = 1
Public Const RC_PF_16TERM      As Long = 2
Public Const RC_PF_NOOPEN      As Long = 4
Public Const RC_PF_NATIVE      As Long = 8
Public Const RC_PF_NOTINITED   As Long = 16

Public Const RCBlockStart      As Long = &HAC
Public Const RCThreadBodyAlias As Long = &HE1C2F3AF

Public Const LAC_PASCAL        As Long = &H80000000
Public Const LAC_FASTCALL      As Long = &H40000000
Public Const LAC_COMCALL       As Long = &H20000000
Public Const LAC_DELPHI        As Long = &H10000000

Public Const LACThreadBodyAlias As Long = &HE1C2F3AF
Public Const LACSTKPointer      As Long = &HE1C2E700
Public Const LACMEMPointer      As Long = &HE1C2DA00
Public Const LACMEMOffset       As Long = &H3DC
Public Const LACMEMSize         As Long = &HC24
Public Const LACMaxArgs         As Long = &H309

Public Type RCINFO
  RCFlags     As Long
  ProcFlags   As Long
  RtlAllocMem As Long
  RtlFreeMem  As Long
  hProcess    As Long
  ProcessId   As Long
  hThread     As Long
  ThreadId    As Long
  ThreadBody  As Long
  ThreadStack As Long
End Type

Public Type ADDRESS_CONTENTS
  ReturnWhere As Long
  ReturnWhat  As Long
End Type

Public Type API_UNHOOK
  MaxNoAddr   As Long
  CurNoAddr   As Long
  WhereWhat() As ADDRESS_CONTENTS
End Type

Public Const VB6_UNHOOK  As Long = &HC000000

Public Type API_HOOK
  ModuleExport As String
  ApiNameOrOrd As String
  dwFlags      As Long
  ModuleImport As String
  UnhookAddresses As Long
  HookAddress  As Long
End Type
  
Public Declare Function EstablishApiHooks Lib "ApiHooks.dll" _
    Alias "EstablishApiHooksA" _
   (pRCI As RCINFO, ByVal lpszDll As Any, ByVal lProcessID As Long, _
    ByVal dwMilliseconds As Long) As Long

Public Declare Function hEstablishApiHooks Lib "ApiHooks.dll" _
    Alias "hEstablishApiHooksA" _
   (pRCI As RCINFO, ByVal lpszDll As Any, ByVal hProcess As Long, _
    ByVal dwMilliseconds As Long) As Long

Public Declare Function IsModuleLoaded Lib "ApiHooks.dll" _
    Alias "IsModuleLoadedA" _
    (pRCI As RCINFO, ByVal lpszDll As String, ByVal lProcessID As Long, _
    ByVal dwMilliseconds As Long) As Long

Public Declare Function hIsModuleLoaded Lib "ApiHooks.dll" _
    Alias "hIsModuleLoadedA" _
    (pRCI As RCINFO, ByVal lpszDll As String, ByVal hProcess As Long, _
    ByVal dwMilliseconds As Long) As Long

Public Declare Function UnloadModule Lib "ApiHooks.dll" _
    Alias "UnloadModuleA" _
    (pRCI As RCINFO, ByVal lpszDll As String, ByVal lProcessID As Long, _
    ByVal dwMilliseconds As Long, ByVal HowManyTimes As Long) _
    As Long

Public Declare Function hUnloadModule Lib "ApiHooks.dll" _
    Alias "hUnloadModuleA" _
    (pRCI As RCINFO, ByVal lpszDll As String, ByVal hProcess As Long, _
    ByVal dwMilliseconds As Long, ByVal HowManyTimes As Long) _
    As Long

Public Declare Function LoadAndCall Lib "ApiHooks.dll" _
    Alias "LoadAndCallA" _
    (pRCI As RCINFO, ByVal lpszDll As String, ByVal lProcessID As Long, _
    ByVal dwMilliseconds As Long, ByVal HowManyTimes As Long, _
    ByVal ApiNameOrOrd As Any, ByVal nArgs As Long, pArgs As Any) As Long

Public Declare Function hLoadAndCall Lib "ApiHooks.dll" _
    Alias "hLoadAndCallA" _
    (pRCI As RCINFO, ByVal lpszDll As String, ByVal hProcess As Long, _
    ByVal dwMilliseconds As Long, ByVal HowManyTimes As Long, _
    ByVal ApiNameOrOrd As Any, ByVal nArgs As Long, pArgs As Any) As Long

Public Declare Function RemoteExecute Lib "ApiHooks.dll" _
 _
    (pRCI As RCINFO, ByVal lProcessID As Long, ByVal dwMilliseconds As Long, _
    ByVal lpBlock As Long, ByVal BlockSize As Long, _
    ByVal lpParameter As Long) As Long

Public Declare Function hRemoteExecute Lib "ApiHooks.dll" _
 _
    (pRCI As RCINFO, ByVal hProcess As Long, ByVal dwMilliseconds As Long, _
    ByVal lpBlock As Long, ByVal BlockSize As Long, _
    ByVal lpParameter As Long) As Long

Public Declare Function HookApi Lib "ApiHooks.dll" _
    Alias "HookApiA" ( _
    ByVal ModuleExport As Any, _
    ByVal ApiNameOrOrd As Any, _
    ByVal dwFlags As Long, _
    ByRef ImportModule As Any, _
    ByRef UnhookAddresses As Any, _
    ByVal HookAddress As Long, _
    ByRef ExcludeModules As Any _
    ) As Long

Public Declare Function iHookApi Lib "ApiHooks.dll" _
    Alias "HookApiA" ( _
    ByVal ModuleExport As Any, _
    ByVal ApiNameOrOrd As Any, _
    ByVal dwFlags As Long, _
    ByVal ImportModule As Any, _
    ByRef UnhookAddresses As Any, _
    ByVal HookAddress As Long, _
    ByRef ExcludeModules As Any _
    ) As Long

Public Declare Function CallOrigFn Lib "ApiHooks.dll" _
    ( _
    ByVal ModuleExport As Any, _
    ByVal ApiNameOrOrd As Any, _
    ByVal dwFlags As Long, _
    ByRef ImportModule As Any, _
    ByRef UnhookAddresses As Any, _
    ByVal nArgs As Long, _
    ByRef pArgs As Any _
    ) As Long

Public Declare Function GetDefaultRCInfo Lib "ApiHooks.dll" _
    () As Long

Public Declare Function GetProcFlags Lib "ApiHooks.dll" _
    (ByVal ProcessId As Long) As Long

Public Declare Function hGetProcFlags Lib "ApiHooks.dll" _
    (ByVal hProcess As Long) As Long

Public Declare Function UnhookApis Lib "ApiHooks.dll" _
    ( _
    ApiHookChain As API_HOOK, _
    ByVal nApiHooks As Long _
    ) As Long