Class ApiHook

x.__init__(...) initializes x; see x.__class__.__doc__ for signature

Parameters:

• eventHandler (EventHandler) - Event handler instance.
• procName (str) - Procedure name. The pre and post callbacks will be deduced from it.

  For example, if the procedure is "LoadLibraryEx" the callback routines will be "pre_LoadLibraryEx" and "post_LoadLibraryEx".

  The signature for the callbacks can be something like this:

     def pre_LoadLibraryEx(event, *params):
         ra   = params[0]        # return address
         argv = params[1:]       # function parameters
  
         # (...)
  
     def post_LoadLibraryEx(event, return_value):
  
         # (...)
  

  But if you passed the right number of arguments, you can also use a signature like this:

     def pre_LoadLibraryEx(event, ra, lpFilename, hFile, dwFlags):
         szFilename = event.get_process().peek_string(lpFilename)
  
         # (...)
  

• paramCount (int) - (Optional) Number of parameters for the callback. Parameters are read from the stack and assumed to be DWORDs. The first parameter of the pre callback is always the return address.

Overrides: object.__init__

Installs the API hook on a given process and module.

Parameters:

• debug (Debug) - Debug object.
• pid (int) - Process ID.
• modName (str) - Module name.

Overrides: Hook.hook

Removes the API hook from the given process and module.

Parameters:

• debug (Debug) - Debug object.
• pid (int) - Process ID.
• modName (str) - Module name.

Overrides: Hook.unhook