def __init__(self): super(NoTopMostPlugin, self).__init__() self.hModule_user32 = kernel32.LoadLibraryA("user32.dll") self.detours.append(api.Detour( getProcAddress("user32.dll::CreateWindowExA"), True, lambda d: self.hook_CreateWindowEx('a', d) )) self.detours.append(api.Detour( getProcAddress("user32.dll::CreateWindowExW"), True, lambda d: self.hook_CreateWindowEx('w', d) )) self.detours.append(api.Detour( getProcAddress("user32.dll::SetWindowPos"), True, self.hook_SetWindowPos ))
def plugin_init(self): o_d_s_addr = getProcAddress("kernel32.dll::OutputDebugStringA") # We can't detour it - it'd be recursive. # I can't just run the line below yet - I need to add VirtualProtect() calls to pydetour.memory pydetour.memory[o_d_s_addr] = "C20400".decode("hex") # RETN 4
def plugin_init(self): self.detours.append(Detour( getProcAddress("kernel32.dll::IsDebuggerPresent"), False, returnFalse ))