tigros / hooktools Goto Github PK

Only works on win10 x64: The driver locates address of win32kfull.sys-->NtUserGetRawInputData-->HmValidateHandle
typedef PVOID (*HMVALIDATEHANDLE)(ULONGLONG Handle, char hType);
HMVALIDATEHANDLE HmValidateHandle = nullptr;
ULONGLONG CallAddr = Pattern(win32kfullbase, "B2 12 49 8B CC E8") + 6;
HmValidateHandle = (HMVALIDATEHANDLE)((CallAddr & 0xFFFFFFFF00000000) + (DWORD)CallAddr + *(PDWORD)CallAddr + 4);

Then get list of handles HHOOK from user32.dll-->gSharedInfo->aheList-->wUniq, object of tagHOOK is (tagHOOK*)HmValidateHandle((ULONGLONG)handleHHOOK, 5);

Hi tigros. I am AltF4 that originally posted this question on the PH forums - https://wj32.org/processhacker/forums/viewtopic.php?f=14&t=1321&sid=00a2f76b75e3e8c29270f9d6a5150ac9&start=20

What do you think it would take to update this for?
1703 | Redstone 2 | Creators Update
1709 | Redstone 3 | Fall Creators Update

Can I help by looking into some areas? Ill try to study the source when I get some time! Thanks!

hi, thank you for this nice project, do you have plans to port to x86 and wow?

I have tried some things:

	/* Get the pointer to the CLIENTINFO struct. &TEB.Win32ClientInfo */
#ifdef _M_IX86 
	d->pvWin32ClientInfo = (void *)((char *)d->pvTeb + 0x6cc);
#else
	//else
	d->pvWin32ClientInfo = (void *)((char *)d->pvTeb + 0x800);
#endif
	
	/* offsetof( struct CLIENTINFO, pDeskInfo ) */
	if( ( G->prog->dwOSMajorVersion == 5 ) && ( G->prog->dwOSMinorVersion == 0 ) ) // win2k
		offsetof_pDeskInfo = 20;
	else // XP+
#ifdef _M_IX86 
		offsetof_pDeskInfo = 24;
#else
		offsetof_pDeskInfo = 32;
#endif

but it is crashing, any idea how to solve the issue?