DetourGetEntryPoint

DetourGetEntryPoint

Return the entry point for a module.

Definition

PVOID DetourGetEntryPoint(
    _In_opt_ HMODULE hModule
);

Parameters

hModule : The handle of the module to which the entry point is desired. If this parameter is NULL, DetourGetEntryPoint returns the entry point of the module used to create the calling process (.EXE).

Return value

Returns the entry point for the module, if found; otherwise, returns NULL.

Error codes

The function sets one of the following error codes, as appropriate. The error code may be retrieved after the function has returned by calling GetLastError.

NO_ERROR : The specified module has no entry point.

ERROR_BAD_EXE_FORMAT : The MZ header of specified module is invalid.

ERROR_EXE_MARKED_INVALID : The NT COFF header of the specified module is invalid.

ERROR_INVALID_EXE_SIGNATURE : The NT COFF header of the specified module has an invalid signature.

ERROR_EXE_MARKED_INVALID : The PE header of specified module is invalid, parsing resulted in an error.

Remarks

DetourGetEntryPoint returns the entry point for a module. For a .EXE file, the entry point is the start of the code for the runtime startup runtimes. For a .DLL file, the entry point is the start of the code for the DllMain function.

The Slept sample shows how to capture program execution after DLL initialization by detouring the entry point of a program.

Related Samples

Disas, Dumpe, FindFunc, Tracebld, Slept.