hook ntdll

[SpenserCai]

if use this way get address can I hook it?

typedef DWORD(__stdcall *pNtTerminateProcess)(HANDLE, UINT);
pNtTerminateProcess fnNtTerminateProcess = (pNtTerminateProcess)GetProcAddress(GetModuleHandle(TEXT("ntdll.dll")), "NtTerminateProcess");

my code:

typedef NTSTATUS(WINAPI tNtTerminateProcess)
(
HANDLE ProcessHandle,
NTSTATUS ExitStatus
);
tNtTerminateProcess oNtTerminateProcessFunc;
NTSTATUS WINAPI hkNtTerminateProcess(HANDLE ProcessHandle,NTSTATUS ExitStatus)
{
printf("11111");
MessageBox(NULL, L"I'm alive!", L"Hello", 0);
return 0;
}
PLH::IatHook hook("ntdll.dll", "NtTerminateProcess", (uint64_t)&hkNtTerminateProcess, (uint64_t)&oNtTerminateProcessFunc, L"NtTerminateProcess");

[stevemk14ebr]

Please report bugs on the issue tracker and questions in the Gitter community chat linked in the projects readme. For an example of IatHook (and all other hook types) please refer to the UnitTests until i complete the documentation.

PolyHook_2_0/UnitTests/TestIatHook.cpp

Line 34 in 731008a

PLH::IatHook hook("kernel32.dll", "GetCurrentThreadId", (char*)&hkGetCurrentThreadId, (uint64_t*)&oGetCurrentThreadID, L"polyhook_2.exe");

Afaik this should work fine.