8

DetourGetEntryPoint

Brian Gianforcaro edited this page 2020-08-22 00:25:06 -07:00

Table of Contents

• DetourGetEntryPoint
• Definition
• Parameters
• Return value
• Error codes
• Remarks
• Related Samples

DetourGetEntryPoint

Return the entry point for a module.

Definition

PVOID DetourGetEntryPoint(
    _In_opt_ HMODULE hModule
);

Parameters

hModule

The handle of the module to which the entry point is desired. If this parameter is NULL, DetourGetEntryPoint returns the entry point of the module used to create the calling process (.EXE).

Return value

Returns the entry point for the module, if found; otherwise, returns NULL.

Error codes

The function sets one of the following error codes, as appropriate. The error code may be retrieved after the function has returned by calling GetLastError.

NO_ERROR

The specified module has no entry point.

ERROR_BAD_EXE_FORMAT

The MZ header of specified module is invalid.

ERROR_EXE_MARKED_INVALID

The NT COFF header of the specified module is invalid.

ERROR_INVALID_EXE_SIGNATURE

The NT COFF header of the specified module has an invalid signature.

ERROR_EXE_MARKED_INVALID

The PE header of specified module is invalid, parsing resulted in an error.

Remarks

DetourGetEntryPoint returns the entry point for a module. For a .EXE file, the entry point is the start of the code for the runtime startup runtimes. For a .DLL file, the entry point is the start of the code for the DllMain function.

The Slept sample shows how to capture program execution after DLL initialization by detouring the entry point of a program.

Related Samples

Disas, Dumpe, FindFunc, Tracebld, Slept.

Overview

• Home
• Frequently Asked Questions
• Using Detours
• Interception of Binary Functions
• Payloads and DLL Import Editing
• Detouring 32-bit and 64-bit Processes
• Samples

API Reference

• Detouring Target Functions
• Finding Target Functions
• Accessing Loaded Binaries and Payloads
• Modifying Binaries
• Inserting DLLs and Payloads Into New Processes