 ApiHooks debugging support
----------------------------


 Windows 9X
----------------------------------------------------------------------------------
 AHexts.dll can be loaded into user debugger (windbg).
Commands:
!ahexts.load - load AHexts.dll  (or !load ahexts)
!ahexts.help - help
!ahexts.?    - help
!ahexts.ahh <address> - print API hooks at given <address>
!ahexts.ahm <address> - print API hooks in module loaded at <address>
!ahexts.unload - unload AHexts.dll

 Hooks can be loaded into debuggee externally:
a) before debugger is attached (recommended)
b) when debuggee isn't stopped (is running and not waiting)

Q: My program calls EAH functions to hook itself. When I debug it in Win9x it
   isn't hooked. Where is the problem?
A: This is, for example, case of AutoHook.exe which calls EAH after debugger is
   attached in order to apply dynamic hooks in its own process. It uses
   HOOK_BY_ADDRESS flag (= force EAH to find API to hook using GetProcAddress).
   Problem is GetProcAddress in debuggee returns everytime other address for
   given API:
     // hModule is > 2GB (system DLLs in shared memory)
     a=GetProcAddress(hModule,"givenAPI");
     b=GetProcAddress(hModule,"givenAPI");
     if(a!=b) printf("I'm debugged in Win9x/n");
   Solution: Temporarily change HOOK_BY_ADDRESS to HOOK_IMPORT (but it will not
   work with packed file). Every call to GetProcAddress with API residing in
   shared memory returns address of new built stub (takes 10 bytes). Try to debug
   program which contains:
     for(i=0; i<BIG_NUMBER; i++)
      if(!GetProcAddress(GetModuleHandle("KERNEL32"), "Sleep")) break;
   and you'll hear a pagefile soon.
----------------------------------------------------------------------------------
 AHexts.vxd can be loaded into kernel debuggers (WDEB386 family):
a) statically (in System.ini [386Enh] section specify: device=PathTo\AHexts.vxd)
b) dynamically (run AHexts.exe - it runs in Win9x only)
Commands:
.?              - help
.iahh <address> - print API hooks at given <address>
.iahm <address> - print API hooks in module loaded at <address>
----------------------------------------------------------------------------------


 Windows NT
----------------------------------------------------------------------------------
 AHexts.dll can be loaded into user debugger (ntsd, cdb, windbg).
Commands:
!ahexts.load - load AHexts.dll  (or !load ahexts)
!ahexts.help - help
!ahexts.?    - help
!ahexts.ahh <address> - print API hooks at given <address>
!ahexts.ahm <address> - print API hooks in module loaded at <address>
!ahexts.eah <ModuleWithHooks> - load <ModuleWithHooks> and establish API hooks
!ahexts.eaf  - free memory after .eah, .lom or .ulo thread termination
!ahexts.lom <Module>  - load <Module>
!ahexts.ulo <Module>  - unload <Module>
!ahexts.unload - unload AHexts.dll
 !eah, !lom and !ulo perform !eaf before they are executed.
  !lom module00
  !ulo module00
  !eah testhooks
  !eaf
 is equivalent to
  !lom module00 
  !eaf
  !ulo module00
  !eaf
  !eah testhooks
  !eaf

 See .log files for details.
----------------------------------------------------------------------------------
 Directory "sice" contains AHexts.dll which can be converted to NuMega SoftICE
extension (by kd2sys.exe, kd2sysxlat.exe). It supports !help, !?, !ahh and !ahm
only.
Tip: bpx loadlibrarya if ((esp.0)-4).0==e457ff53 do "g esp.0;pagein eax;!ahm eax;"

 Directory "kd" contains AHexts.dll for kernel debuggers (makes it sense?). It
supports !help, !?, !load, !unload, !ahh and !ahm.