PECompact 2
API Hook Plug-ins

Initialize

DWORD Initialize(HOOK_CHAIN_INFO *pHookChainInfo);

Initialize is called to provide the injected API hook code with the LoadLibraryA, GetProcAddress, and TranslateAPIAddressToHookAddress function addresses of the hook preceding hook plug-in in the chain. The LoadLibraryAHook, GetProcAddressWithHintHook, and TranslateAPIAddressToHookAddress must return the results of calls to these APIs unless the return needs to be modified in order to place an API hook. If an API hook is placed, if necessary it should transfer control to the original API address as returned by the GetProcAddress API provided to this function.

Initialize is invoked before reconstruction of the compressed module. InitializeEx is invoked after.

Since code is injected into compressed executables, it can not reference anything outside the bounds of the HOOK_DATA object or reference anything by static addresses, since those addresses will change. Therefore, it inherently can not have any references that require a base relocation.

pFunctions provides the address of LoadLibraryA followed by address of GetProcAddress.