RE: "Win32::API::Callback::IATPatch" name for DLL/SO hooker for Win32::API
[email protected] (bulk 88)
| Newsgroups | perl.libwin32,perl.modules |
|---|---|
| Message-ID | <[email protected]> |
---------------------------------------- > From: [email protected] > To: [email protected]; [email protected]; [email protected]; [email protected]; [email protected] > Subject: RE: "Win32::API::Callback::IATPatch" name for DLL/SO hooker for Win32::API > Date: Mon, 15 Oct 2012 13:33:55 -0700 > > On Sun, 14 Oct 2012, bulk 88 wrote: >> >> I haven't heard from you since my last post a month ago. > > Sorry, I didn't have time to look at this in details. My gut > feeling is that API hooking should be in a separate module, not > not jammed into Win32::API. But this is not a fully informed > opinion, so if e.g. implementation sharing makes this more > convenient, then that may be a good reason to do so. > The post you replied to was mostly intended to Cosimo, not you. But lets go on. ::IATPatch is a class that is implemented in Callback.dll. Its full name is Win32::API::IATPatch and it is OO. It has no Perl code. Currently ::IATPatch peeks inside a ::Callback non publically. Also many provisions or future changes (I have no plans to implement them ATM) would require ::IATPatch or (future) sister classes to use private API of other parts of Win32::API. ::IATPatch has proposed method, in a src comment, to create a Win32::API automatically from a Win32::API::Callback. Also if a Win32::API::HMODULE class is ever created for proper refcounting of DLLs, ::IATPatch *may* need to use it, and it probably will be 100% internal to Win32::API with no public exposure. If something like MS Detours or a FOSS clone of it is ever added to Win32::API, it would need ::Callback's private API just as ::IATPatch does now. ::IATPatch is really small. It has no Perl code, 1 C func 0x2a3, 2 1 line method XSUBs 0x33+0xA2, 1 DESTROY XSUB 0xCD, 1 constructor XSUB 0x248, and 1 other xsub 0x173, for a total of 0x7a0, 1952 bytes of 32 bit machine code, string literals and everything else excluded. Callback.dll is 10KB. ::IATPatch is not large enough to need a separate DLL. Are you concerned about any security issues with adding API hooking to the Win32::API distribution?