1 #pragma once 2 3 #define HOOK_THREAD_REFERENCED (0x1) 4 #define HOOKID_TO_INDEX(HookId) (HookId - WH_MINHOOK) 5 #define HOOKID_TO_FLAG(HookId) (1 << ((HookId) + 1)) 6 #define ISITHOOKED(HookId) (((PTHREADINFO)PsGetCurrentThreadWin32Thread())->fsHooks & HOOKID_TO_FLAG(HookId)) 7 8 /* NOTE: The following definition is not a real hook but 9 a pseudo-id that will be used only for 10 injecting user api hook module to all processes. 11 It is used internally in win32k */ 12 #define WH_APIHOOK WH_MAX + 1 13 14 15 typedef struct tagEVENTHOOK 16 { 17 THROBJHEAD head; 18 LIST_ENTRY Chain; /* Event chain entry */ 19 UINT eventMin; 20 UINT eventMax; 21 DWORD idProcess; 22 DWORD idThread; 23 WINEVENTPROC Proc; /* Event function */ 24 ULONG Flags; /* Some internal flags */ 25 ULONG_PTR offPfn; 26 INT_PTR ihmod; 27 } EVENTHOOK, *PEVENTHOOK; 28 29 typedef struct tagEVENTTABLE 30 { 31 LIST_ENTRY Events; 32 UINT Counts; 33 } EVENTTABLE, *PEVENTTABLE; 34 35 typedef struct _NOTIFYEVENT 36 { 37 DWORD event; 38 LONG idObject; 39 LONG idChild; 40 DWORD flags; 41 } NOTIFYEVENT, *PNOTIFYEVENT; 42 43 LRESULT APIENTRY co_CallHook(INT HookId, INT Code, WPARAM wParam, LPARAM lParam); 44 LRESULT APIENTRY co_HOOK_CallHooks(INT HookId, INT Code, WPARAM wParam, LPARAM lParam); 45 LRESULT APIENTRY co_EVENT_CallEvents(DWORD, HWND, UINT_PTR, LONG_PTR); 46 PHOOK FASTCALL IntGetHookObject(HHOOK); 47 PHOOK FASTCALL IntGetNextHook(PHOOK Hook); 48 LRESULT APIENTRY UserCallNextHookEx( PHOOK pHook, int Code, WPARAM wParam, LPARAM lParam, BOOL Ansi); 49 BOOL FASTCALL IntUnhookWindowsHook(int,HOOKPROC); 50 BOOLEAN IntRemoveHook(PVOID Object); 51 BOOLEAN IntRemoveEvent(PVOID Object); 52 53 BOOL FASTCALL UserLoadApiHook(VOID); 54 BOOL IntLoadHookModule(int iHookID, HHOOK hHook, BOOL Unload); 55 BOOL FASTCALL UserUnregisterUserApiHook(VOID); 56 57 extern PPROCESSINFO ppiUahServer; 58 59 /* EOF */ 60