Skip to content

Instantly share code, notes, and snippets.

@jershmagersh

jershmagersh/hooks.cpp

Created December 1, 2015 04:46
Show Gist options
  • Save jershmagersh/4d11044e0642c8a2ce90 to your computer and use it in GitHub Desktop.
Save jershmagersh/4d11044e0642c8a2ce90 to your computer and use it in GitHub Desktop.
Download ZIP
PackerAttacker Hooks
Raw
hooks.cpp
/* place hooks and track PE section */
HOOK_GET_ORIG(this, "ntdll.dll", NtProtectVirtualMemory);
HOOK_GET_ORIG(this, "ntdll.dll", NtWriteVirtualMemory);
HOOK_GET_ORIG(this, "ntdll.dll", NtCreateThread);
HOOK_GET_ORIG(this, "ntdll.dll", NtMapViewOfSection);
HOOK_GET_ORIG(this, "ntdll.dll", NtResumeThread);
HOOK_GET_ORIG(this, "ntdll.dll", NtDelayExecution);
HOOK_GET_ORIG(this, "ntdll.dll", NtAllocateVirtualMemory);
HOOK_GET_ORIG(this, "Kernel32.dll", CreateProcessInternalW);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment