Class Hook

Returns: a new object with type S, a subtype of T

Overrides: object.__new__

(inherited documentation)

x.__init__(...) initializes x; see help(type(x)) for signature

Parameters:

• preCB (function) - (Optional) Callback triggered on function entry.

  The signature for the callback should be something like this:

     def pre_LoadLibraryEx(event, ra, lpFilename, hFile, dwFlags):
  
         # return address
         ra = params[0]
  
         # function arguments start from here...
         szFilename = event.get_process().peek_string(lpFilename)
  
         # (...)
  

  Note that all pointer types are treated like void pointers, so your callback won't get the string or structure pointed to by it, but the remote memory address instead. This is so to prevent the ctypes library from being "too helpful" and trying to dereference the pointer. To get the actual data being pointed to, use one of the Process.read methods.

• postCB (function) - (Optional) Callback triggered on function exit.

  The signature for the callback should be something like this:

     def post_LoadLibraryEx(event, return_value):
  
         # (...)
  

• paramCount (int) - (Optional) Number of parameters for the preCB callback, not counting the return address. Parameters are read from the stack and assumed to be DWORDs in 32 bits and QWORDs in 64.

  This is a faster way to pull stack parameters in 32 bits, but in 64 bits (or with some odd APIs in 32 bits) it won't be useful, since not all arguments to the hooked function will be of the same size.

  For a more reliable and cross-platform way of hooking use the signature argument instead.

• signature (tuple) - (Optional) Tuple of ctypes data types that constitute the hooked function signature. When the function is called, this will be used to parse the arguments from the stack. Overrides the paramCount argument.
• arch (str) - (Optional) Target architecture. Defaults to the current architecture. See: win32.arch

Overrides: object.__init__

Handles the breakpoint event on entry of the function.

Parameters:

• event (ExceptionEvent) - Breakpoint hit event.

Raises:

• WindowsError - An error occured.

Returns the parameters found in the stack when the hooked function was last called by this thread.

Parameters:

• tid (int) - Thread global ID.

Returns: tuple( arg, arg, arg... )

Tuple of arguments.

Returns the parameters found in the stack each time the hooked function was called by this thread and hasn't returned yet.

Parameters:

• tid (int) - Thread global ID.

Returns: list of tuple( arg, arg, arg... )

List of argument tuples.

Installs the function hook at a given process and address.

Parameters:

• debug (Debug) - Debug object.
• pid (int) - Process ID.
• address (int) - Function address.

Removes the function hook at a given process and address.

Parameters:

• debug (Debug) - Debug object.
• pid (int) - Process ID.
• address (int) - Function address.