#ifndef INTERRUPTHOOK_H #define INTERRUPTHOOK_H #include //assuming the standard interrupt hook routine is used this stackindex will be valid #ifdef AMD64 typedef enum {si_eax=0, si_ebx=1, si_ecx=2, si_edx=3, si_esi=4, si_edi=5, si_ebp=6, si_stack_esp=7, si_r8=8, si_r9=9, si_r10=10, si_r11=11, si_r12=12, si_r13=13, si_r14=14, si_r15=15, si_es=16, si_ds=17, si_stack_ss=18, si_errorcode=19+(4096/8), si_eip=20+(4096/8), si_cs=21+(4096/8), si_eflags=22+(4096/8), si_esp=23+(4096/8), si_ss=24+(4096/8)} stackindex; #else typedef enum {si_gs=-12, si_fs=-11, si_es=-10, si_ds=-9, si_edi=-8, si_esi=-7, si_stack_ebp=-6, si_stack_esp=-5, si_ebx=-4, si_edx=-3, si_ecx=-2, si_eax=-1, si_ebp=0, si_errorcode=1, si_eip=2, si_cs=3, si_eflags=4, si_esp=5, si_ss=6} stackindex; #endif #pragma pack(1) //allignment of 1 byte typedef struct tagINT_VECTOR { WORD wLowOffset; WORD wSelector; BYTE bUnused; BYTE bAccessFlags; /* unsigned gatetype : 3; //101=Task, 110=interrupt, 111=trap unsigned gatesize : 1; //1=32bit, 0=16bit unsigned zero : 1; unsigned DPL : 2; unsigned P : 1; */ WORD wHighOffset; #ifdef AMD64 DWORD TopOffset; DWORD Reserved; #endif } INT_VECTOR, *PINT_VECTOR; #pragma pack() #pragma pack(2) //allignemnt of 2 byte typedef struct tagIDT { WORD wLimit; PINT_VECTOR vector; } IDT, *PIDT; #pragma pack() #ifdef AMD64 typedef #pragma pack(1) //allignemnt of 1 byte struct { UINT64 eip; WORD cs; } JUMPBACK, *PJUMPBACK; #pragma pack() #else typedef #pragma pack(1) //allignemnt of 1 byte struct { DWORD eip; WORD cs; } JUMPBACK, *PJUMPBACK; #pragma pack() #endif int inthook_HookInterrupt(unsigned char intnr, int newCS, ULONG_PTR newEIP, PJUMPBACK jumpback); int inthook_UnhookInterrupt(unsigned char intnr); int inthook_isHooked(unsigned char intnr); int inthook_isDBVMHook(unsigned char intnr); ULONG_PTR inthook_getOriginalEIP(unsigned char intnr); WORD inthook_getOriginalCS(unsigned char intnr); #endif