apihooks.nh

Cracker终结者——提供最优秀的软件保护技术

%IFNDEF _APIHOOKS_
%DEFINE _APIHOOKS_ 1

;ApiHook.inc - constants and structures for Hook libraries

; For NASM

;standard-----------------------------------------------------------------------
   HOOK_EXPORT       EQU    000000001B
   HOOK_BY_NAME      EQU    000000010B
   HOOK_BY_ADDRESS   EQU    000000100B
   HOOK_HARD         EQU    000001000B
   HOOK_LOAD_IMPORT  EQU    000010000B
   HOOK_SPECIAL      EQU    000100000B
   HOOK_NOT_NT       EQU    001000000B
   HOOK_NOT_9X       EQU    010000000B
   HOOK_OVERWRITE    EQU    100000000B
   HOOK_RAW          EQU   1000000000B
   HOOK_ALL_SAFE     EQU  10000000000B
   HOOK_LOAD_EXPORT  EQU 100000000000B

   HOOKS_END         EQU     (-1)
   HOOKS_DYNAMIC     EQU     (-2)

   ALL_MODULES       EQU     (-1)
   MAIN_MODULE       EQU     0

   WHOLE_AH_CHAIN    EQU     (-1)

   STRUC      ADDR_CONTENTS
    ReturnWhere     RESD 1
    ReturnWhat      RESD 1
   ENDSTRUC

   STRUC         API_UNHOOK
    MaxNoAddr       RESD 1
    CurNoAddr       RESD 1
    WhereWhat       RESD 1
   ENDSTRUC

   STRUC           API_HOOK
    ModuleExport    RESD 1
    ApiNameOrOrd    RESD 1
    dwFlags         RESD 1
    ModuleImport    RESD 1
    UnhookAddresses RESD 1
    HookAddress     RESD 1
   ENDSTRUC

   ErrorAHMin        EQU (0xE1C2F3B1)
   ErrorAGException  EQU (ErrorAHMin+0)
   ErrorAHOpen       EQU (ErrorAHMin+1)
   ErrorAHPrepare    EQU (ErrorAHMin+2)
   ErrorAHTimeOut    EQU (ErrorAHMin+3)
   ErrorAHRemote     EQU (ErrorAHMin+4)
   ErrorAHMax        EQU (ErrorAHMin+4)

   ErrorAMMin        EQU ErrorAHMin
   ErrorAMModule     EQU (ErrorAHMax+1)
   ErrorAMApi        EQU (ErrorAHMax+2)
   ErrorAMMax        EQU (ErrorAHMax+2)

   ErrorAWSuccess    EQU (0xE1C2F3B0)
  
;   RCFlags:
    RC_FL_OWNTIMEOUT EQU 1
    RC_FL_TERMINATE  EQU 2
    RC_FL_OWNFREE    EQU 4
    RC_FL_UNHIDE9X   EQU 8
    RC_FL_DEFSD      EQU 16

;   ProcFlags:
    RC_PF_DEBUGGED   EQU 1
    RC_PF_16TERM     EQU 2
    RC_PF_NOOPEN     EQU 4
    RC_PF_NATIVE     EQU 8
    RC_PF_NOTINITED  EQU 16

    RCBlockStart      EQU 0xAC
    RCThreadBodyAlias EQU 0xE1C2F3AF

    LAC_PASCAL       EQU 0x80000000
    LAC_FASTCALL     EQU 0x40000000
    LAC_COMCALL      EQU 0x20000000
    LAC_DELPHI       EQU 0x10000000

    LACThreadBodyAlias EQU 0xE1C2F3AF 
    LACSTKPointer      EQU 0xE1C2E700 
    LACMEMPointer      EQU 0xE1C2DA00
    LACMEMOffset       EQU 0x3DC
    LACMEMSize         EQU 0xC24
    LACMaxArgs         EQU 0x309


   STRUC     RCINFO
    RCFlags          RESD 1
    ProcFlags        RESD 1
    RtlAllocMem      RESD 1
    RtlFreeMem       RESD 1
    hProcess         RESD 1
    ProcessId        RESD 1
    hThread          RESD 1
    ThreadId         RESD 1
    ThreadBody       RESD 1
    ThreadStack      RESD 1
   ENDSTRUC


%DEFINE   EndHooks    DD HOOKS_END

%ENDIF