public int OnWriteFile(INktHookInfo hookInfo, int chainIndex, INktHookCallInfoPlugin callInfo)
{
System.Diagnostics.Trace.WriteLine("MyFilePlugin::OnWriteFile called [Hook: " + hookInfo.FunctionName + " @ 0x" + hookInfo.Address.ToString("X") + " / Chain:" + chainIndex.ToString() + "]");
try
{
if (callInfo.IsPreCall != false)
{
IntPtr fileHandle = callInfo.Params().GetAt(0).SizeTVal;
string s;
lock (handleMap)
{
if (handleMap.TryGetValue(fileHandle, out s) != false)
{
callInfo.AddString("WriteFile", s);
}
}
}
}
catch (System.Exception ex)
{
System.Diagnostics.Trace.WriteLine(ex.ToString());
}
return(0);
}
//called when a hooked function is called
public int OnFunctionCall(INktHookInfo hookInfo, int chainIndex, INktHookCallInfoPlugin callInfo)
{
System.Diagnostics.Trace.WriteLine("MyRegistryPlugin::OnFunctionCall called [Hook: " + hookInfo.FunctionName + " @ 0x" + hookInfo.Address.ToString("X") + " / Chain:" + chainIndex.ToString() + "]");
INktParamsEnum pms;
callInfo.AddString("sample name", "HKEY extractor sample");
pms = callInfo.Params();
for (int i = 0; i < pms.Count; i++)
{
INktParam p = pms.GetAt(i);
if (p.IsPointer)
p = p.Evaluate();
if (p != null && p.TypeName == "HKEY")
{
callInfo.AddSizeT("param#" + i.ToString(), p.SizeTVal);
}
}
return 0;
}
//called when a hooked function is called
public int OnFunctionCall(INktHookInfo hookInfo, int chainIndex, INktHookCallInfoPlugin callInfo)
{
System.Diagnostics.Trace.WriteLine("MyRegistryPlugin::OnFunctionCall called [Hook: " + hookInfo.FunctionName + " @ 0x" + hookInfo.Address.ToString("X") + " / Chain:" + chainIndex.ToString() + "]");
INktParamsEnum pms;
callInfo.AddString("sample name", "HKEY extractor sample");
pms = callInfo.Params();
for (int i = 0; i < pms.Count; i++)
{
INktParam p = pms.GetAt(i);
if (p.IsPointer)
{
p = p.Evaluate();
}
if (p != null && p.TypeName == "HKEY")
{
callInfo.AddSizeT("param#" + i.ToString(), p.SizeTVal);
}
}
return(0);
}
public int OnWriteFile(INktHookInfo hookInfo, int chainIndex, INktHookCallInfoPlugin callInfo)
{
System.Diagnostics.Trace.WriteLine("MyFilePlugin::OnWriteFile called [Hook: " + hookInfo.FunctionName + " @ 0x" + hookInfo.Address.ToString("X") + " / Chain:" + chainIndex.ToString() + "]");
try
{
if (callInfo.IsPreCall != false)
{
IntPtr fileHandle = callInfo.Params().GetAt(0).SizeTVal;
string s;
lock (handleMap)
{
if (handleMap.TryGetValue(fileHandle, out s) != false)
{
callInfo.AddString("WriteFile", s);
}
}
}
}
catch (System.Exception ex)
{
System.Diagnostics.Trace.WriteLine(ex.ToString());
}
return 0;
}
