BOOL NTAPI LeNtUserDefSetText( HWND hWnd, PLARGE_UNICODE_STRING Text ) { BOOL Success; LARGE_UNICODE_STRING UnicodeText; PLeGlobalData GlobalData = LeGetGlobalData(); InitEmptyLargeString(&UnicodeText); LOOP_ONCE { if (Text == nullptr) break; if (GlobalData->GetWindowDataA(hWnd) == nullptr) break; if (LargeStringAnsiToUnicode(Text, &UnicodeText) == nullptr) break; Text = &UnicodeText; } Success = GlobalData->NtUserSetDefText(hWnd, Text); FreeLargeString(&UnicodeText); return Success; }
BOOL NTAPI DelayInitDllEntry(PVOID BaseAddress, ULONG Reason, PVOID Reserved) { BOOL Success; PLDR_MODULE Module = FindLdrModuleByHandle(BaseAddress); PIMAGE_NT_HEADERS NtHeaders; NtHeaders = PtrAdd((PIMAGE_NT_HEADERS)BaseAddress, ((PIMAGE_DOS_HEADER)BaseAddress)->e_lfanew); Module->EntryPoint = PtrAdd(BaseAddress, NtHeaders->OptionalHeader.AddressOfEntryPoint); Success = ((API_POINTER(DelayInitDllEntry))Module->EntryPoint)(BaseAddress, Reason, Reserved); if (Reason == DLL_PROCESS_ATTACH && !Success) return Success; switch (Reason) { case DLL_PROCESS_ATTACH: if (!Success) return Success; case DLL_PROCESS_DETACH: break; default: return Success; } LeGetGlobalData()->HookModule(BaseAddress, &Module->BaseDllName, Reason == DLL_PROCESS_ATTACH); return Success; }
LRESULT NTAPI WindowProcW(HWND Window, UINT Message, WPARAM wParam, LPARAM lParam) { WNDPROC PrevProc; FNUSERMESSAGECALL MessageCall; PLeGlobalData GlobalData = LeGetGlobalData(); PrevProc = (WNDPROC)GlobalData->GetWindowDataA(Window); if (Message < countof(MessageTable)) { MessageCall = gapfnMessageCall[MessageTable[Message].Function].UserCall; return MessageCall(PrevProc, Window, Message, wParam, lParam); } return CallUserMessageCallA(); }
VOID STDCALL SE_DllUnloaded( PLDR_DATA_TABLE_ENTRY DllUnLoading ) { LDR_DLL_NOTIFICATION_DATA NotificationData; NotificationData.Unloaded.BaseDllName = &DllUnLoading->BaseDllName; NotificationData.Unloaded.FullDllName = &DllUnLoading->FullDllName; NotificationData.Unloaded.Flags = 0; NotificationData.Unloaded.SizeOfImage = DllUnLoading->SizeOfImage; NotificationData.Unloaded.DllBase = DllUnLoading->DllBase; LeGetGlobalData()->DllNotification(LDR_DLL_NOTIFICATION_REASON_UNLOADED, &NotificationData); }