#ifndef _APISPY_INTERCEPT_HPP_ #define _APISPY_INTERCEPT_HPP_ #include #include #include #include #include #include class Intercept : public PureVector { public: Intercept(void); ~Intercept(); WORD performIntercept(PureVector &pureImports,DWORD baseAddress); private: void loadImportDescriptors(PureVector &pureImports); void loadImportModuleNames(void); void moduleEntryPoints(void); void resolveImportNames(PureVector &pureImport); WORD importEntryPoint(PureImport &pureImport); DWORD baseAddress(void)const; WORD isWIN95Thunk(DWORD baseAddress); DWORD mBaseAddress; Block mImportModuleNames; }; inline Intercept::Intercept(void) { } inline Intercept::~Intercept() { } inline DWORD Intercept::baseAddress(void)const { return mBaseAddress; } inline WORD Intercept::isWIN95Thunk(DWORD baseAddress) { if(*((BYTE*)baseAddress)==0x68&&*(((BYTE*)baseAddress)+5)==0xE9)return TRUE; return FALSE; } #endif