e-errors.txt

Cracker终结者——提供最优秀的软件保护技术

  ApiHooks (AH) error codes (common for all remote codes)
-----------------------------  

  () contains RCINFO.ProcFlags that can be set and help to identify error.


  ErrorAHException - AH function was called with invalid parameter(s).
                     * Exception during Scout preparation occured ().
                     * String passed to Mod/ApiWorks has more than MAX_PATH-1 characters ().
                     * More than LACMaxArgs parameters were passed to (h)LoadAndCall ().
                     * If you want, use this value for signaling failure/exception
                       during your Scout preparation.

  ErrorAHOpen      - can't open process represented by ProcessId or hProcess.
                     * ProcessId or hProcess are invalid (RC_PF_NOOPEN).
                     * Process is 16bit (Win9x) or terminating/terminated (RC_PF_16TERM).
                     * NT: Security: can't open for QR (RC_PF_NOOPEN).
                     * NT: Security: can't duplicate for SAME_ACCESS or open for MAXIMUM_ALLOWED ().

  ErrorAHPrepare   - error when preparing remote execution.
                     * NT: Security: Target was opened for some access but WOT access to
                       Target is not granted ().
                     * AH can't allocate memory in current process or in Target ().
                     * Target's memory can't be written to ().
                     * Remote thread can't be created in Target == 'System' NT process
                       (RC_PF_NATIVE).
                     * Remote thread can't be created in Target because it is terminating
                       ().

  ErrorAHTimeOut   - time has expired but thread hasn't returned yet.
                     Part of remote code could be executed.
                     * Typically, remote thread waits for critical section.
                     * Target is debugged (RC_PF_DEBUGGED).

  ErrorAHRemote    - remote thread raised an exception or was Target was terminated.
                     * Target doesn't contain KERNEL32.dll or the pointers to
                       required APIs are invalid in Target (RC_PF_NATIVE).
                     * Target was terminated during remote function execution.
                     * Remote thread was terminated by debugger.


  ApiWorks and ModWorks (AM) error codes (common for built-in remote codes - ApiWorks and ModWorks)
------------------------------------------  
are AH error codes +  

  ErrorAMModule    - lpszDll (Module or Hooks_DLL) can't be found/loaded into Target.
                     * lpszDll was specifed without PathTo and isn't in Target's search path.
                     * lpszDll doesn't exist.
                     * Target doesn't have Read & Execute access to lpszDll.
                     * lpszDll's DllMain faulted or returned FALSE on its process attach.

  ErrorAMApi       - API (in case of Apiworks: GetApiHookChain, ApiHookChain) isn't exported
                     by lpszDll.
                     * CallOrigFn can't find pointer to called function.



  ApiWorks (AW) error codes 
-----------------------------
are AM error codes +  

  ErrorAWSuccess   - (h)EstablishApiHooks or HookApi succeeded.
                     It doesn't tell if (all) hooks were applied -> check UnhookAddresses.CurNoAddr.