6 DetourEnumerateImports

Brian Gianforcaro редактировал(а) эту страницу 2020-08-22 00:25:06 -07:00

Содержание

• DetourEnumerateImports
• Definition
• Parameters
• Return value
• Error codes
• Remarks
• Related Samples

DetourEnumerateImports

Enumerate imports from a module.

Definition

BOOL DetourEnumerateImports(
    _In_opt_ HMODULE hModule,
    _In_opt_ PVOID pContext,
    _In_opt_ PF_DETOUR_IMPORT_FILE_CALLBACK pfImportFile,
    _In_opt_ PF_DETOUR_IMPORT_FUNC_CALLBACK pfImportFunc
);

Parameters

hModule

The handle to the module whose imports are to be enumerated.

pContext

Program specific context that will be passed to pfImportFile and pfImportFunc.

pfImportFile

Callback function to be called once per file imported by module.

pfImportFunc

Callback function to be called once per function imported by module.

Return value

TRUE if module imports are enumerated; otherwise FALSE.

Error codes

The function sets one of the following error codes, as appropriate. The error code may be retrieved after the function has returned by calling GetLastError.

ERROR_BAD_EXE_FORMAT

The MZ header of specified module is invalid.

ERROR_EXE_MARKED_INVALID

The NT COFF header of the specified module is invalid.

ERROR_INVALID_EXE_SIGNATURE

The NT COFF header of the specified module has an invalid signature.

Remarks

If you need a pointer into the Import Address Table ("IAT"), you should use the DetourEnumerateImportsEx.

Related Samples

Tracebld.

Overview

• Home
• Frequently Asked Questions
• Using Detours
• Interception of Binary Functions
• Payloads and DLL Import Editing
• Detouring 32-bit and 64-bit Processes
• Samples

API Reference

• Detouring Target Functions
• Finding Target Functions
• Accessing Loaded Binaries and Payloads
• Modifying Binaries
• Inserting DLLs and Payloads Into New Processes