example.hooks

# Example API Hooks for Emulator Mode
# Usage: ehook example.hooks
#        ehookaddr kernel32!CreateFileA 0x<address>

# CreateFileA - log the filename and return INVALID_HANDLE_VALUE
hook kernel32!CreateFileA:
    log "CreateFileA({rcx:str})"
    rax = INVALID_HANDLE_VALUE
    skip

# CreateFileW - log the address (wide strings need special handling)
hook kernel32!CreateFileW:
    log "CreateFileW({rcx:wstr})"
    rax = INVALID_HANDLE_VALUE
    skip

# VirtualAlloc - allocate memory in the emulator
# rcx = lpAddress (hint), rdx = dwSize, r8 = flAllocationType, r9 = flProtect
hook kernel32!VirtualAlloc:
    log "VirtualAlloc(0x{rcx:x}, {rdx:d} bytes, 0x{r8:x}, 0x{r9:x})"
    rax = alloc(rdx)
    skip

# VirtualFree - free memory
hook kernel32!VirtualFree:
    log "VirtualFree(0x{rcx:x})"
    free(rcx)
    rax = 1
    skip

# HeapAlloc - allocate from heap
# rcx = hHeap, rdx = dwFlags, r8 = dwBytes
hook kernel32!HeapAlloc:
    log "HeapAlloc(heap=0x{rcx:x}, flags=0x{rdx:x}, size={r8:d})"
    rax = alloc(r8)
    skip

# HeapFree - free from heap
hook kernel32!HeapFree:
    log "HeapFree(heap=0x{rcx:x}, ptr=0x{r8:x})"
    free(r8)
    rax = 1
    skip

# GetProcAddress - log and return NULL (function not found)
hook kernel32!GetProcAddress:
    log "GetProcAddress(0x{rcx:x}, {rdx:str})"
    rax = NULL
    skip

# LoadLibraryA - log and return NULL (library not found)
hook kernel32!LoadLibraryA:
    log "LoadLibraryA({rcx:str})"
    rax = NULL
    skip

# MessageBoxA - log message and return OK (1)
hook user32!MessageBoxA:
    log "MessageBoxA(hwnd=0x{rcx:x}, text={rdx:str}, caption={r8:str})"
    rax = 1
    skip

# ExitProcess - stop the emulator
hook kernel32!ExitProcess:
    log "ExitProcess({rcx:d})"
    stop