CSXGuard / BaseHook отлов DeathMsg

#include <windows.h>
#include <stdio.h>

typedef int (*pfnUserMsgHook)(const char* pszName, int iSize, void* pbuf);
typedef pfnUserMsgHook (*pfnHookUserMsg_t)(char* szMsgName, pfnUserMsgHook pfn);

pfnHookUserMsg_t g_pHookUserMsg = nullptr;
pfnUserMsgHook g_pOrigDeathMsg = nullptr;
unsigned char* g_pMsgBuffer = nullptr;

void BEGIN_READ(void* buf, int size)
{
    g_pMsgBuffer = (unsigned char*)buf;
}

int READ_BYTE()
{
    return *g_pMsgBuffer++;
}

char* READ_STRING()
{
    char* str = (char*)g_pMsgBuffer;
    g_pMsgBuffer += strlen(str) + 1;
    return str;
}

int __cdecl DeathMsg_Handler(const char* pszName, int iSize, void* pbuf)
{
    BEGIN_READ(pbuf, iSize);
    
    int killer = READ_BYTE();
    int victim = READ_BYTE();
    int headshot = READ_BYTE();
    char* weapon = READ_STRING();
    
    char logMsg[256];
    sprintf_s(logMsg, sizeof(logMsg),
              "DeathMsg: Killer=%d, Victim=%d, Headshot=%d, Weapon=%s\n",
              killer, victim, headshot, weapon);
    
    OutputDebugStringA(logMsg);
    
    FILE* log = nullptr;
    fopen_s(&log, "deathmsg.log", "a");
    if(log)
    {
        fprintf(log, "%s", logMsg);
        fclose(log);
    }
    
    return g_pOrigDeathMsg(pszName, iSize, pbuf);
}

DWORD WINAPI InitHook(LPVOID lpParam)
{
    Sleep(3000);
    
    HMODULE hEngine = GetModuleHandleA("hw.dll");
    if(!hEngine)
    {
        OutputDebugStringA("ERROR: hw.dll not found\n");
        return 0;
    }
    
    g_pHookUserMsg = (pfnHookUserMsg_t)GetProcAddress(hEngine, "HookUserMsg");
    if(!g_pHookUserMsg)
    {
        OutputDebugStringA("ERROR: HookUserMsg not found\n");
        return 0;
    }
    
    g_pOrigDeathMsg = g_pHookUserMsg("DeathMsg", DeathMsg_Handler);
    
    if(g_pOrigDeathMsg)
        OutputDebugStringA("DeathMsg hook installed successfully\n");
    else
        OutputDebugStringA("ERROR: Failed to hook DeathMsg\n");
    
    return 1;
}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved)
{
    if(dwReason == DLL_PROCESS_ATTACH)
    {
        DisableThreadLibraryCalls(hModule);
        CreateThread(NULL, 0, InitHook, NULL, 0, NULL);
    }
    
    return TRUE;
}