{"action":"created","issue":{"url":"https://api.github.com/repos/tklengyel/drakvuf/issues/99","repository_url":"https://api.github.com/repos/tklengyel/drakvuf","labels_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/99/labels{/name}","comments_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/99/comments","events_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/99/events","html_url":"https://github.com/tklengyel/drakvuf/pull/99","id":140133425,"number":99,"title":"Added routines for helping with win32ksys hooking","user":{"login":"aoshiken","id":5227552,"avatar_url":"https://avatars.githubusercontent.com/u/5227552?v=3","gravatar_id":"","url":"https://api.github.com/users/aoshiken","html_url":"https://github.com/aoshiken","followers_url":"https://api.github.com/users/aoshiken/followers","following_url":"https://api.github.com/users/aoshiken/following{/other_user}","gists_url":"https://api.github.com/users/aoshiken/gists{/gist_id}","starred_url":"https://api.github.com/users/aoshiken/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aoshiken/subscriptions","organizations_url":"https://api.github.com/users/aoshiken/orgs","repos_url":"https://api.github.com/users/aoshiken/repos","events_url":"https://api.github.com/users/aoshiken/events{/privacy}","received_events_url":"https://api.github.com/users/aoshiken/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2016-03-11T09:21:46Z","updated_at":"2016-04-19T16:01:12Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/tklengyel/drakvuf/pulls/99","html_url":"https://github.com/tklengyel/drakvuf/pull/99","diff_url":"https://github.com/tklengyel/drakvuf/pull/99.diff","patch_url":"https://github.com/tklengyel/drakvuf/pull/99.patch"},"body":"Win32ksys is a especial case because is treated as a DLL, trap is made using the CSRSS pid.\r\n\r\nRoutines added:\r\n\r\n- drakvuf_get_kern_module_base_addr(). Return the kernel module base address\r\n- drakvuf_add_trap_dll(). Add trap using provided pid and base address.\r\n\r\nSkeleton usage example:\r\n```\r\ndrakvuf_get_kern_module_base_addr( drakvuf, \"win32k.sys\", win32k_base_addr );\r\n\r\ntrap->name   = \"NtUserSetWindowsHookEx\" ;\r\ntrap->module = \"win32k.sys\";\r\n\r\ndrakvuf_get_function_rva( win32ksys_rekall_profile, trap_name, &trap->u2.rva );\r\n\r\ndrakvuf_add_trap_dll( drakvuf, trap, win32k_base_addr, csrss_pid );\r\n```\r\n\r\nRegards,\r\n\r\nAlfredo"},"comment":{"url":"https://api.github.com/repos/tklengyel/drakvuf/issues/comments/211994550","html_url":"https://github.com/tklengyel/drakvuf/pull/99#issuecomment-211994550","issue_url":"https://api.github.com/repos/tklengyel/drakvuf/issues/99","id":211994550,"user":{"login":"aoshiken","id":5227552,"avatar_url":"https://avatars.githubusercontent.com/u/5227552?v=3","gravatar_id":"","url":"https://api.github.com/users/aoshiken","html_url":"https://github.com/aoshiken","followers_url":"https://api.github.com/users/aoshiken/followers","following_url":"https://api.github.com/users/aoshiken/following{/other_user}","gists_url":"https://api.github.com/users/aoshiken/gists{/gist_id}","starred_url":"https://api.github.com/users/aoshiken/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aoshiken/subscriptions","organizations_url":"https://api.github.com/users/aoshiken/orgs","repos_url":"https://api.github.com/users/aoshiken/repos","events_url":"https://api.github.com/users/aoshiken/events{/privacy}","received_events_url":"https://api.github.com/users/aoshiken/received_events","type":"User","site_admin":false},"created_at":"2016-04-19T16:01:12Z","updated_at":"2016-04-19T16:01:12Z","body":"Agreed"}}