You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
32 lines
1.0 KiB
32 lines
1.0 KiB
#include "callback.h"
|
|
|
|
namespace callback
|
|
{
|
|
void on_image_load(
|
|
PUNICODE_STRING image_path,
|
|
HANDLE pid,
|
|
PIMAGE_INFO image_info
|
|
)
|
|
{
|
|
if (!pid)
|
|
{
|
|
DBG_PRINT("base address: 0x%p", image_info->ImageBase);
|
|
DBG_PRINT("driver loaded from: %ws", image_path->Buffer);
|
|
DBG_PRINT(" - driver timestamp: 0x%p", driver_util::get_file_header(image_info->ImageBase)->TimeDateStamp);
|
|
|
|
//
|
|
// driver gets deleted after loading
|
|
//
|
|
driver_util::copy_driver(image_path);
|
|
if (driver_util::get_file_header(image_info->ImageBase)->TimeDateStamp == UNFAIR_TIMESTAMP)
|
|
{
|
|
DBG_PRINT("unfair driver loaded...");
|
|
detour get_proc_hook(
|
|
(void*)(((char*)image_info->ImageBase) + UNFAIR_GETPROC_ADDR_OFFSET),
|
|
&hooks::get_addr_hook
|
|
);
|
|
DBG_PRINT("hooked get proc address....");
|
|
}
|
|
}
|
|
}
|
|
} |