walter

Walter是一个简单的hook库。

Walter支持32位和64位。

查看如何hook的示例示例

示例hook

wgl_swap_buffers

mod bindings {
    windows::include_bindings!();
}

use std::ffi::c_void;
use walter::{
    TrampolineHook64,
};
use bindings::Windows::Win32::{
    System::{
        SystemServices::DLL_PROCESS_ATTACH,
        LibraryLoader::{
            GetProcAddress,
            GetModuleHandleA,
        },
    },
    Foundation::{
        BOOL,
        HANDLE,
        HINSTANCE,
    },
};
use once_cell::sync::Lazy;
use std::sync::Mutex;

static HOOK: Lazy<Mutex<Option<TrampolineHook64>>> = Lazy::new(|| {
    Mutex::new(None)
});

pub extern "stdcall" fn wgl_swap_buffers(hdc: HANDLE) -> BOOL {
    let gateway = HOOK
        .lock()
        .unwrap()
        .as_ref()
        .unwrap()
        .gateway();

    let gateway_call: extern "stdcall" fn (hdc: HANDLE) -> BOOL;
    gateway_call = unsafe { std::mem::transmute(gateway) };
    gateway_call(hdc);

    BOOL::from(true)
}

#[no_mangle]
pub extern "stdcall" fn DllMain(_module: HINSTANCE, reason: u32, _reserved: *mut c_void) -> BOOL {
    match reason {
        DLL_PROCESS_ATTACH => {
            let module = unsafe { GetModuleHandleA("opengl32.dll") };
            let src_wgl_swap_buffers = unsafe {
                GetProcAddress(module, "wglSwapBuffers")
            }.unwrap();

            let hook = TrampolineHook64::hook(
                src_wgl_swap_buffers as *mut c_void,
                wgl_swap_buffers as *mut c_void,
                20
            ).unwrap();

            *HOOK.lock().unwrap() = Some(hook);
        }
        _ => {}
    }

    BOOL::from(true)
}