🚀 go-pugleaf

Hi all, in the middle of writting an article for the BCB Journal on Dll 
injeciton and API hooking and ran into a very strange problem.  Was 
wondering if anyone had any explaination of this.  Basically in my example, 
i was hooking a native api called NtCreateProcessEx.  The prototype for this 
(taken from Windows NT / 2000 Native API reference by Gary Nebbett - 
www.amazon.com/Windows-2000-Native-API-Reference/dp/1578701996 and the 
Undocumented NT Internals undocumented.ntinternals.net/) state that it is 
defined thus:

NTSTATUS NTAPI
  NtCreateProcessEx(
  PHANDLE ProcessHandle,
  ACCESS_MASK DesiredAccess,
  POBJECT_ATTRIBUTES ObjectAttributes,
  HANDLE InheritFromProcessHandle,
  BOOLEAN InheritHandles,
  HANDLE SectionHandle,
  HANDLE DebugPort,
  HANDLE ExceptionPort,
  DWORD dwSaferFlags
);


However, if i define it this way, the system fails to launch new processes 
(when hooked) reporting that the parameter are incorrect.  I found an delphi 
example where the author had define the prototype using a Cardinal for the 
PHANDLE and DWORD's for both the HANDLES and BOOLEAN values.  This 
implimentation seems to work when i copy it.  Having looked at the winnt.h 
the definition for a HANDLE changes depending upon the STRICT directive but 
is either a void or PVOID.

Can anyone explain this i.e. why the supposidly correct data types fail but 
re-defining them works?  Also, is it possible to redefine a HANDLE or 
override the orginal definition.  I have lots of example code where the 
prototypes are already define and it would be handy to simply redefine a 
HANDLE at the begining.

Many thank in advance,


Mike Collins