Description: how to replace the hhook returned by ntusersetwindowshookex with phook

Many people have asked ntusersetwindowshookex how to replace the hhook with phook.
It is mainly to find the Conversion Function address and call it directly.

Principle:
Find the function entry of ntuserunhookwindowshookex in win32k ssdt,
Directly obtain the address @ hmvalidatehandle @ 8

Usage:

# Define getobjectfromhandle (handle, object)
{
_ ASM push ECx
_ ASM push edX
_ ASM mov ECx, handle
_ ASM mov DL, 5
_ ASM call @ hmvalidatehandle @ 8
_ ASM mov object, eax
_ ASM pop edX
_ ASM pop ECx
}

/////
////// // Ntuserunhookwindowshookex code
/////
. Text: a0013b47; _ stdcall ntuserunhookwindowshookex (X)
. Text: a0013b47 _ ntuserunhookwindowshookex @ 4 proc near; Data xref:. Data: a016bd34o
. Text: a0013b47
. Text: a0013b47 arg_0 = dword ptr 8
. Text: a0013b47
. Text: a0013b47 56 push ESI
. Text: a0013b48 E8 3D D1 Fe FF call _ entercrit @ 0; entercrit ()
. Text: a0013b4d 8B 4C 24 08 mov ECx, [esp + arg_0]
. Text: a0013b51 B2 05 mov DL, 5
. Text: a0013b53 E8 48 96 ff call @ hmvalidatehandle @ 8; hmvalidatehandle (x, x)
. Text: a0013b58 85 C0 test eax, eax
. Text: a0013b5a 75 04 jnz short loc_a0013b60
. Text: a0013b5c 33 F6 xor esi, ESI
. Text: a0013b5e EB 08 JMP short loc_a0013b68
. Text: a0013b60; where where?
. Text: a0013b60
. Text: a0013b60 loc_a0013b60:; Code xref: ntuserunhookwindowshookex (x) + 13j
. Text: a0013b60 50 push eax
. Text: a0013b61 E8 2a C8 08 00 call _ zzzunhookwindowshookex @ 4; zzzunhookwindowshookex (X)
. Text: a0013b66 8B F0 mov ESI, eax
. Text: a0013b68
. Text: a0013b68 loc_a0013b68:; Code xref: ntuserunhookwindowshookex (x) + 17j
. Text: a0013b68 E8 E4 D0 Fe FF call _ leavecrit @ 0; leavecrit ()
. Text: a0013b6d 8B C6 mov eax, ESI
. Text: a0013b6f 5E pop ESI
. Text: a0013b70 C2 04 00 retn 4
. Text: a0013b70 _ ntuserunhookwindowshookex @ 4 endp