#include "stdafx.h"
#include "mhook/mhook-lib/mhook.h"

//////////////////////////////////////////////////////////////////////////
// Defines and typedefs

#define STATUS_SUCCESS  ((NTSTATUS)0x00000000L)

typedef struct _MY_SYSTEM_PROCESS_INFORMATION
{
    ULONG                   NextEntryOffset;
    ULONG                   NumberOfThreads;
    LARGE_INTEGER           Reserved[3];
    LARGE_INTEGER           CreateTime;
    LARGE_INTEGER           UserTime;
    LARGE_INTEGER           KernelTime;
    UNICODE_STRING          ImageName;
    ULONG                   BasePriority;
    HANDLE                  ProcessId;
    HANDLE                  InheritedFromProcessId;
} MY_SYSTEM_PROCESS_INFORMATION, *PMY_SYSTEM_PROCESS_INFORMATION;

typedef NTSTATUS(NTAPI *_NtDebugActiveProcess)(__in HANDLE ProcessHandle, __in HANDLE DebugObjectHandle);
//////////////////////////////////////////////////////////////////////////
// Original function

_NtDebugActiveProcess OrignalNtDebugActiveProcess = (_NtDebugActiveProcess)GetProcAddress(GetModuleHandle(L"ntdll"), "NtDebugActiveProcess");

//////////////////////////////////////////////////////////////////////////
// Hooked function

NTSTATUS NTAPI HookNtDebugActiveProcess(
	__in HANDLE ProcessHandle,
	__in HANDLE DebugObjectHandle
	)
{
	MessageBoxA(NULL, "CorrM", "CorM", MB_OK);
	return false;
}

//////////////////////////////////////////////////////////////////////////
// Entry point

BOOL WINAPI DllMain(
    __in HINSTANCE  hInstance,
    __in DWORD      Reason,
    __in LPVOID     Reserved
    )
{
    switch (Reason)
    {
    case DLL_PROCESS_ATTACH:
		Mhook_SetHook((PVOID*)&OrignalNtDebugActiveProcess, HookNtDebugActiveProcess);
        break;

    case DLL_PROCESS_DETACH:
		Mhook_Unhook((PVOID*)&OrignalNtDebugActiveProcess);
        break;
    }

    return TRUE;
}