These are chat archives for EasyHook/EasyHook

4th
Jan 2016
Felix Matenaar
@pleed
Jan 04 2016 17:28
LhAllocateMemory allocates memory with RWX, is "W" actually needed after the hooking structure has been set up or would it be possible with the current memory layout to revoke W after writing the data into the hook info struct?
Justin Stenning
@spazzarama
Jan 04 2016 23:11
Hi ViRb3 - sorry been busy
Justin Stenning
@spazzarama
Jan 04 2016 23:32
@pleed might be possible but with some changes. The memory location pointed to by the IsExecutedPtr member of the LOCAL_HOOK_INFO structures does get modified within the ASM trampoline code and I'm pretty sure this is within the same block of memory as the rest of the hook info struct.