procName (str) - Procedure name. The pre and post callbacks will be deduced from
it.
For example, if the procedure is "LoadLibraryEx" the
callback routines will be "pre_LoadLibraryEx" and
"post_LoadLibraryEx".
The signature for the callbacks can be something like
this:
def pre_LoadLibraryEx(event, *params):
ra = params[0] # return address
argv = params[1:] # function parameters
# (...)
def post_LoadLibraryEx(event, return_value):
# (...)
But if you passed the right number of arguments, you can also
use a signature like this:
def pre_LoadLibraryEx(event, ra, lpFilename, hFile, dwFlags):
szFilename = event.get_process().peek_string(lpFilename)
# (...)
Note that the second example assumes all parameters are
DWORDs. This may not always be so, especially in 64 bits
Windows.
