ApiHooks 3.1: APIs.txt

 ApiHooks.dll (ApiHooks.lib, iApiHooks.lib, bApiHooks.lib and lApiHooks.lib) and
 static libraries (SApiHooks.lib, SiApiHooks.lib and SbApiHooks.lib) export APIs
 you can call from your programs:
  a) Functions with ANSI/UNICODE form:
     EstablishApiHooks,  IsModuleLoaded,  UnloadModule,  LoadAndCall,
    hEstablishApiHooks, hIsModuleLoaded, hUnloadModule, hLoadAndCall,
     HookApi.
  b) Remaining functions: RemoteExecute, hRemoteExecute, GetLastStatus.

  The only difference between "Function" and "hFunction" is that 
  "Function" has Target process specified by ProcessId (DWORD) while
  "hFunction" has Target process specified by hProcess (HANDLE).  
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
 DWORD  EstablishApiHooks(LPCTSTR lpszDll, DWORD ProcessId, LONG dwMilliseconds);
 DWORD hEstablishApiHooks(LPCTSTR lpszDll, HANDLE hProcess, LONG dwMilliseconds);

  These functions try to load lpszDll into ProcessId/hProcess in dwMilliseconds
  and establish API hooks according to ApiHookChain exported by lpszDll via
   a) function "GetApiHookChain"
        PAPI_HOOK GetApiHookChain(void) { return ApiHookChain;}
   b) pointer to array of API_HOOK structures "ApiHookChain".
   c) pointer to array of API_HOOK structures is ordinal 1.

 Parameters:
  lpszDll         - points to name of Hooks_DLL.
  ProcessId       - identifier of Target process.
  hProcess        - handle to Target process.
  dwMilliseconds  - time limit for completion (INFINITE for no time limit).
                  - ignored if ProcessId/hProcess == current process.

 Return code:
  ErrorSuccess    - hooks were successfully applied.
  ErrorExeception - function was called with bad parameter(s) probably.
  ErrorOpenProcess- can't open process represented by ProcessId or hProcess.
  ErrorMemory     - can't allocate/commit/lock memory.
  ErrorRemoteExec - Target doesn't contain KERNEL32.dll; Hooks_DLL is alredy
                    present in Target; ApiHookChain in Hooks_DLL is invalid or
                    not present; Hooks_DLL DllMain faulted or returned FALSE;
                    Target has no suitable threads: Target threads can't be
                    opened/suspended or their contexts can't be read.
  ErrorTimeOut    - time has expired but thread hasn't made its job yet.
                  - see AH_LAST_STATUS structure comment.

- hProcess in Win9x can grant any access to Target, in WinNT it must grant
  at least PROCESS_QUERY_INFORMATION access.
- dwMilliseconds should be > 10000.
- lpszDll can be specified with/without path, ".dll" extension is assumed if
  it is not given.
- lpszDll can be pointer to dynamic ApiHookChain. It must begin with API_HOOK
  structure containing ModuleExport == HOOKS_DYNAMIC (this 1st structure can
  contain pointer to NULL terminated list of HMODULEs to exclude from hooking in
  UnhookAddresses structure member).
  Pointers in chain must be valid in Target, so dynamic hooks make sense when
  applying hooks to current process.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
 DWORD  IsModuleLoaded(LPCTSTR lpszDll, DWORD ProcessId, LONG dwMilliseconds);
 DWORD hIsModuleLoaded(LPCTSTR lpszDll, HANDLE hProcess, LONG dwMilliseconds);

  These functions try to get HMODULE of lpszDll in ProcessId/hProcess in dwMilliseconds.

 Parameters:
  lpszDll         - points to name of Module to perform GetModuleHandle.
  other parameters are identical with EAH parameters.

 Return code:
  ErrorExeception, ErrorOpenProcess, ErrorMemory,  ErrorRemoteExec,  ErrorTimeOut
  or
  output from GetModuleHandle(lpszDll):
   NULL           - module isn't present in Target.
   HMODULE        - module is present in Target.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
 DWORD  UnloadModule(LPCTSTR lpszDll, DWORD ProcessId, LONG dwMilliseconds, DWORD HowManyTimes);
 DWORD hUnloadModule(LPCTSTR lpszDll, HANDLE hProcess, LONG dwMilliseconds, DWORD HowManyTimes);

  These functions try to unload lpszDll from ProcessId/hProcess in dwMilliseconds HowManyTimesx.

 Parameters:
  HowManyTimes    - how many times to call FreeLibrary.
  other parameters are identical with IML parameters.

 Return code:
  ErrorExeception, ErrorOpenProcess, ErrorMemory,  ErrorRemoteExec,  ErrorTimeOut
  or
  output from GetModuleHandle(lpszDll):
   NULL           - module isn't present in Target (was unloaded).
   HMODULE        - module is still present in Target (can't unload or lpszDll reference
                    count is > 0 - increase HowManyTimes).

 - in NT statically (at process startup) loaded modules and modules with RefCount > 65534
   can't be unloaded.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
 DWORD  LoadAndCall(LPCTSTR lpszDll, DWORD ProcessId, LONG dwMilliseconds, DWORD HowManyTimes, LPCTSTR ApiNameOrOrd);
 DWORD hLoadAndCall(LPCTSTR lpszDll, HANDLE hProcess, LONG dwMilliseconds, DWORD HowManyTimes, LPCTSTR ApiNameOrOrd);

  These functions try to load lpszDll into ProcessId/hProcess in dwMilliseconds HowManyTimesx
  and optionally call ApiNameOrOrd.

 Parameters:
  HowManyTimes  - how many times to call LoadLibrary.
                - if > 65534 lpszDll becomes unloadable in NT.
  ApiNameOrOrd  - pointer to the name of API or ordinal number of API exported by lpszDll.
                - NULL for no call.
                API should return code != AH Error codes.
                API function must have format: DWORD Function(void);
  other parameters are identical with ULM parameters.

 Return code:
  if   all was succesful and API was    called  - value returned from API.
       all was succesful and API wasn't called  - HMODULE of lpszDll.
       all was succesful but lpszDll is not present (can't be loaded) - NULL.
  else standard AH Error codes.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
 DWORD HookApi(LPCTSTR ModuleExport, LPCTSTR ApiNameOrOrd, DWORD dwFlags, LPCTSTR ModuleImport, PAPI_UNHOOK ApiUnhook, LPVOID HookAddress, HANDLE ExcludeModules[]);

  Prepares 1 dynamic hook and calls EstablishApiHooks with current process
  = hooks ModuleExport.ApiNameOrOrd in the current process.

  Parameters have the same meaning as members of API_HOOK structure. ExcludeModules is
  the same as UnhookAddresses in API_HOOK {HOOKS_DYNAMIC} structure -> NULL terminated
  list of HMODULEs to exclude from hooking. UnhookAddresses and ExcludeModules parameters
  are optional; set them to NULL if they aren't used.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
 DWORD  RemoteExecute(DWORD ProcessId, LONG dwMilliseconds, LPVOID lpBlock, DWORD BlockSize, LPVOID lpCodeEnd);
 DWORD hRemoteExecute(HANDLE hProcess, LONG dwMilliseconds, LPVOID lpBlock, DWORD BlockSize, LPVOID lpCodeEnd);

  These low-level functions try to execute given code in ProcessId/hProcess in dwMilliseconds.

    lpBlock    - pointer to a block of code and data; this block will be copied to
                 the ProcessId/hProcess and executed there.
    BlockSize  - the size of the block.
    lpCodeEnd  - marks the code end zone of the block. There must be 3 dwords reserved.

    Code must begin on block's begin. Block can be in read-only memory and is not changed.
    RemoteCode must preserve EAX at entry and return it in ECX, must be surrounded by SEH
    and must preserve EBX, ESI, EDI, EBP registers. Code must return code != AH Error codes
    in EAX. See Examples\ASM\Infilter\Refilter.asm for details.

  Return code:
   If all was successful - value returned by Code.
   else AH Error codes.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
 PAH_LAST_STATUS GetLastStatus(void);
  This function is important if previous AH function returned ErrorTimeOut.
  Returns address of AH_LAST_STATUS structure. This address is constant, points to
  writeable memory (= you can zero the structure after call to GetLastStatus).
  See description of AH_LAST_STATUS structure.