//===============================================================================================// // This is a stub for the actuall functionality of the DLL. //===============================================================================================// #include "ReflectiveLoader.h" #include "NtApiHooks.h" // Note: REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR and REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN are // defined in the project properties (Properties->C++->Preprocessor) so as we can specify our own // DllMain and use the LoadRemoteLibraryR() API to inject this DLL. // You can use this value as a pseudo hinstDLL value (defined and set via ReflectiveLoader.c) extern HINSTANCE hAppInstance; // Store the parameter passed to ReflectiveLoader extern LPVOID g_lpReflectiveParameter; //===============================================================================================// BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved) { BOOL bReturnValue = TRUE; switch (dwReason) { case DLL_QUERY_HMODULE: if (lpReserved != NULL) *(HMODULE*)lpReserved = hAppInstance; break; case DLL_PROCESS_ATTACH: hAppInstance = hinstDLL; DisableThreadLibraryCalls(hinstDLL); // Install NT API hooks with the parameter passed from the injector InstallNtApiHooks(g_lpReflectiveParameter); break; case DLL_PROCESS_DETACH: // Remove hooks on detach RemoveNtApiHooks(); break; case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: break; } return bReturnValue; }