78 lines
2.1 KiB
C
78 lines
2.1 KiB
C
#ifndef INTERRUPTHOOK_H
|
|
#define INTERRUPTHOOK_H
|
|
|
|
#include <windef.h>
|
|
|
|
//assuming the standard interrupt hook routine is used this stackindex will be valid
|
|
#ifdef AMD64
|
|
typedef enum {si_eax=0, si_ebx=1, si_ecx=2, si_edx=3, si_esi=4, si_edi=5, si_ebp=6, si_stack_esp=7, si_r8=8, si_r9=9, si_r10=10, si_r11=11, si_r12=12, si_r13=13, si_r14=14, si_r15=15, si_es=16, si_ds=17, si_stack_ss=18, si_xmm=19, si_errorcode=19+(4096/8)+(512/8), si_eip=20+(4096/8) + (512 / 8), si_cs=21+(4096/8) + (512 / 8), si_eflags=22+(4096/8) + (512 / 8), si_esp=23+(4096/8) + (512 / 8), si_ss=24+(4096/8) + (512 / 8)} stackindex;
|
|
#else
|
|
typedef enum {si_gs=-12, si_fs=-11, si_es=-10, si_ds=-9, si_edi=-8, si_esi=-7, si_stack_ebp=-6, si_stack_esp=-5, si_ebx=-4, si_edx=-3, si_ecx=-2, si_eax=-1, si_ebp=0, si_errorcode=1, si_eip=2, si_cs=3, si_eflags=4, si_esp=5, si_ss=6} stackindex;
|
|
#endif
|
|
|
|
|
|
|
|
#pragma pack(1) //allignment of 1 byte
|
|
typedef struct tagINT_VECTOR
|
|
{
|
|
WORD wLowOffset;
|
|
WORD wSelector;
|
|
BYTE bUnused;
|
|
BYTE bAccessFlags;
|
|
|
|
/*
|
|
unsigned gatetype : 3; //101=Task, 110=interrupt, 111=trap
|
|
unsigned gatesize : 1; //1=32bit, 0=16bit
|
|
unsigned zero : 1;
|
|
unsigned DPL : 2;
|
|
unsigned P : 1;
|
|
*/
|
|
WORD wHighOffset;
|
|
#ifdef AMD64
|
|
DWORD TopOffset;
|
|
DWORD Reserved;
|
|
#endif
|
|
} INT_VECTOR, *PINT_VECTOR;
|
|
#pragma pack()
|
|
|
|
#pragma pack(2) //allignemnt of 2 byte
|
|
typedef struct tagIDT
|
|
{
|
|
WORD wLimit;
|
|
PINT_VECTOR vector;
|
|
} IDT, *PIDT;
|
|
#pragma pack()
|
|
|
|
|
|
#ifdef AMD64
|
|
typedef
|
|
#pragma pack(1) //allignemnt of 1 byte
|
|
struct
|
|
{
|
|
UINT64 eip;
|
|
WORD cs;
|
|
} JUMPBACK, *PJUMPBACK;
|
|
#pragma pack()
|
|
#else
|
|
typedef
|
|
#pragma pack(1) //allignemnt of 1 byte
|
|
struct
|
|
{
|
|
DWORD eip;
|
|
WORD cs;
|
|
} JUMPBACK, *PJUMPBACK;
|
|
#pragma pack()
|
|
#endif
|
|
|
|
|
|
int inthook_HookInterrupt(unsigned char intnr, int newCS, ULONG_PTR newEIP, PJUMPBACK jumpback);
|
|
int inthook_UnhookInterrupt(unsigned char intnr);
|
|
int inthook_isHooked(unsigned char intnr);
|
|
int inthook_isDBVMHook(unsigned char intnr);
|
|
ULONG_PTR inthook_getOriginalEIP(unsigned char intnr);
|
|
WORD inthook_getOriginalCS(unsigned char intnr);
|
|
|
|
|
|
|
|
|
|
#endif |