Click or drag to resize

HookRuntimeInfo Class

This class is intended to be used within hook handlers, to access associated runtime information.
Inheritance Hierarchy
SystemObject
  EasyHookHookRuntimeInfo

Namespace:  EasyHook
Assembly:  EasyHook (in EasyHook.dll) Version: 2.7.6270.0 (2.7.6270.0)
Syntax
public class HookRuntimeInfo

The HookRuntimeInfo type exposes the following members.

Constructors
  NameDescription
Public methodHookRuntimeInfo
Initializes a new instance of the HookRuntimeInfo class
Top
Properties
  NameDescription
Public propertyStatic memberAddressOfReturnAddress
A stack address pointing to ReturnAddress. Executes in max. one micro secound.
Public propertyStatic memberCallback
The user callback initially passed to either Create(IntPtr, Delegate, Object) or CreateUnmanaged(IntPtr, IntPtr, IntPtr). Executes in max. one micro secound.
Public propertyStatic memberCallingManagedModule
Determines the first managed module on the current call stack. This is always the module that invoked the hook. Executes in max. 40 micro secounds.
Public propertyStatic memberCallingUnmanagedModule
Determines the first unmanaged module on the current call stack. This is always the module that invoked the hook. Executes in max. 15 micro secounds.
Public propertyStatic memberHandle
The hook handle initially returned by either Create(IntPtr, Delegate, Object) or CreateUnmanaged(IntPtr, IntPtr, IntPtr). Executes in max. one micro secound.
Public propertyStatic memberIsHandlerContext
Is the current thread within a valid hook handler? This is only the case if your handler was called through the hooked entry point... Executes in max. one micro secound.
Public propertyStatic memberManagedStackTrace
Creates a call stack trace of the managed code path that finally lead to your hook. To detect whether the desired module is within the call stack you will have to walk through the whole list! Executes in max. 80 micro secounds.
Public propertyStatic memberReturnAddress
Returns the address where execution is continued, after you hook has been completed. This is always the instruction behind the hook invokation. Executes in max. one micro secound.
Public propertyStatic memberUnmanagedStackTrace
Creates a call stack trace of the unmanaged code path that finally lead to your hook. To detect whether the desired module is within the call stack you will have to walk through the whole list! Executes in max. 20 micro secounds.
Top
Methods
  NameDescription
Public methodEquals
Determines whether the specified Object is equal to the current Object.
(Inherited from Object.)
Protected methodFinalize
Allows an object to try to free resources and perform other cleanup operations before it is reclaimed by garbage collection.
(Inherited from Object.)
Public methodGetHashCode
Serves as a hash function for a particular type.
(Inherited from Object.)
Public methodGetType
Gets the Type of the current instance.
(Inherited from Object.)
Protected methodMemberwiseClone
Creates a shallow copy of the current Object.
(Inherited from Object.)
Public methodStatic memberPointerToModule
Retrives the unmanaged module that contains the given pointer. If no module can be found, null is returned. This method will automatically update the unmanaged module list from time to time. Executes in less than one micro secound.
Public methodToString
Returns a string that represents the current object.
(Inherited from Object.)
Public methodStatic memberUpdateUnmanagedModuleList
Allows you to explicitly update the unmanaged module list which is required for CallingUnmanagedModule, UnmanagedStackTrace and PointerToModule(IntPtr). Normally this is not necessary, but if you hook a process that frequently loads/unloads modules, you may call this method in a LoadLibrary hook to always operate on the latest module list.
Top
Remarks
Other hooking libraries on the market require that you keep track of such information yourself, what can be a burden.
See Also