// test.cpp : Defines the entry point for the console application.
//
#include "stdafx.h"
#include <windows.h>
#include <WinNT.h>
//#define _WIN64
#define TYPE_HOOK 5
BOOL Unhooked = FALSE;
using namespace std;
typedef struct _HANDLEENTRY {
PVOID pHead;
PVOID pOwner;
BYTE bType;
BYTE bFlags;
WORD wUniq;
} HANDLEENTRY, *PHANDLEENTRY;
typedef struct _SERVERINFO {
WORD wRIPFlags;
WORD wSRVIFlags;
WORD wRIPPID;
WORD wRIPError;
ULONG cHandleEntries;
} SERVERINFO, *PSERVERINFO;
typedef struct _SHAREDINFO {
PSERVERINFO psi;
PHANDLEENTRY aheList;
ULONG HeEntrySize;
ULONG_PTR pDispInfo;
ULONG_PTR ulSharedDelta;
ULONG_PTR awmControl;
ULONG_PTR DefWindowMsgs;
ULONG_PTR DefWindowSpecMsgs;
} SHAREDINFO, *PSHAREDINFO;
typedef struct _HOOK_
{
HANDLE Handle;
ULONG LockObj;
PVOID ThreadInfo;
PVOID Desktop1;
PVOID Self;
PVOID NextHook;
LONG HookType;
PVOID FunctionAddress;
ULONG Flags;
ULONG ModuleHandle;
PVOID Hooked;
PVOID Desktop2;
ULONG bitField;
} HOOK_;
SHAREDINFO* GetgSharedInfo() {
SHAREDINFO* gSharedInfo = NULL;
HMODULE huser32 = NULL;
huser32 = LoadLibrary(L"user32.dll");
if (huser32 == NULL)
{
printf("LoadLibrary faild\n");
return 0;
}
gSharedInfo = (SHAREDINFO*)GetProcAddress(huser32, "gSharedInfo");
if (gSharedInfo != NULL)
{
return gSharedInfo;
}
return NULL;
}
void EnumHandles3264(SHAREDINFO *pSharedInfo)
{
struct _TEB* pTeb = NtCurrentTeb();
#ifdef _WIN64
ULONGLONG offset = *(ULONGLONG*)(((BYTE*)pTeb) + 0x800 + 0x28);
#else
ULONG offset = *(ULONG*)(((BYTE*)pTeb) + 0x6CC + 0x1C);
#endif
ULONG cHandleEntries = *((ULONG *)((ULONG)pSharedInfo->psi + 8));
HANDLEENTRY *Handle = (HANDLEENTRY*)pSharedInfo->aheList;
for (ULONG i = 0; i < cHandleEntries; ++i)
{
HANDLEENTRY* pHandle = Handle++;
HOOK_* HookInfo = (HOOK_*)((UINT_PTR)pHandle->pHead - offset);
if (pHandle->bType != TYPE_HOOK) continue;
if (HookInfo)
{
Unhooked = UnhookWindowsHookEx((HHOOK)HookInfo->Handle);
//printf("Found hook at %p", HookInfo);
//printf("Handle: %08llX %s %2d %d\n\n", HookInfo->Handle, (Unhooked) ? ("Unhook OK!") : ("Unhook Fail"), HookInfo->HookType, HookInfo->Flags);
}
}
}
//////// In main() funtion: ////////
EnumHandles3264(GetgSharedInfo());
