#include #include // Global accessor to security instance. Security::RuntimeSecurityPtr Protection = std::make_unique(); namespace Security { decltype(&MessageBoxA) oMessageBox; int __stdcall Hooked_MessageBox(HWND Window, char *Message, char *Caption, uint32_t Type) { // TODO: Replace this with a Syscall so we cannot get hooked. MEMORY_BASIC_INFORMATION Query; if(!VirtualQuery(_ReturnAddress(), &Query, sizeof MEMORY_BASIC_INFORMATION)) ExitProcess(0); HMODULE ReturnModule = (HMODULE)Query.AllocationBase; if (ReturnModule != GetModuleHandleA(0)) ExitProcess(0); return oMessageBox(Window, Message, Caption, Type); } bool RuntimeSecurity::Start() { if(MH_Initialize() != MH_OK) return false; MH_CreateHook(&MessageBoxA, Hooked_MessageBox, (void **)&oMessageBox); MH_EnableHook(&MessageBoxA); return true; } }