test_hook.py 文件源码

def test_self_iat_hook_success():
    """Test hook success in single(self) thread"""
    pythondll_mod = [m for m in windows.current_process.peb.modules if m.name.startswith("python") and m.name.endswith(".dll")][0]
    RegOpenKeyExA = [n for n in pythondll_mod.pe.imports['advapi32.dll'] if n.name == "RegOpenKeyExA"][0]

    hook_value = []

    @windows.hooks.RegOpenKeyExACallback
    def open_reg_hook(hKey, lpSubKey, ulOptions, samDesired, phkResult, real_function):
        hook_value.append((hKey, lpSubKey.value))
        phkResult[0] = 12345678
        return 0

    x = RegOpenKeyExA.set_hook(open_reg_hook)
    import _winreg
    open_args = (0x12345678, "MY_KEY_VALUE")
    k = _winreg.OpenKey(*open_args)
    assert k.handle == 12345678
    assert hook_value[0] == open_args
    # Remove the hook
    x.disable()