Skip to content

Information for any type of hooks

Daniil edited this page Oct 13, 2022 · 5 revisions

All types of hooks can be configured using kthook_option enum.

Options can be combined using operator|

For example:

kCreateContextIntegral | kCreateContextEF | kFreezeThreads

There are several options available:

  1. kNone - default behaviour
  2. kCreateContextIntegral - kthook will capture Integral CPU registers.
  3. kCreateContextFP - kthook will capture FPU CPU state(x87 stack and SSE registers).
  4. kCreateContextEF - kthook will capture EFLAGS CPU state.
  5. kCreateContextAll - same as kCreateContextIntegral | kCreateContextFP | kCreateContextEF
  6. kFreezeThreads - kthook will suspend all threads before installing the hook

for kthook_simple and kthook_signal it can be passed as second template argument; for kthook_naked - as first argument.

Clone this wiki locally