Detect Wow64 User-Mode Hooks

//http://waleedassar.blogspot.com - (@waleedassar)
//Code to detect Wow64 user-mode hooks.
#include "stdafx.h"
#include "windows.h"


int main(int argc, char* argv[])
{
    unsigned short cs_=0;
    unsigned char* WOW32Reserved=0;
    unsigned long PEB64=0;
    __asm
    {
        pushad
        mov eax, dword ptr fs:[0xC0]
        mov WOW32Reserved,eax
        mov eax,dword ptr fs:[0x30]
        add eax,0x1000
        mov PEB64,eax
        mov cs_,cs
        popad
    }
    if(!WOW32Reserved) return 1;  //not 64-bit system
    if(  (*WOW32Reserved==0xEA)&&( *(unsigned short*)(WOW32Reserved+5)!=cs_ )  )
    {
        unsigned long CpupReturnFromSimulatedCode=*(unsigned long*)(WOW32Reserved+1);
        MEMORY_BASIC_INFORMATION MBI={0};
        VirtualQuery((void*)CpupReturnFromSimulatedCode,&MBI,sizeof(MBI));
        if(MBI.Type==MEM_IMAGE)
        {
            unsigned long ldrData=*(unsigned long*)(PEB64+0x18);
            unsigned long pInLoadOrder=(ldrData+0x10);
            unsigned long runner=*(unsigned long*)pInLoadOrder;
            while(runner!=pInLoadOrder)
            {
                unsigned long IB=*(unsigned long*)(runner+0x30);
                unsigned long szImage=*(unsigned long*)(runner+0x40);
                wchar_t* BaseName=*(wchar_t**)(runner+0x60);
                if(lstrcmpiW(BaseName,L"wow64cpu.dll")==0)
                {
                    if( (CpupReturnFromSimulatedCode>=IB)&&(CpupReturnFromSimulatedCode<(IB+szImage)) ) return 1;  //the wow64 process is not hooked
                    else break;
                }
                runner=*(unsigned long*)runner;
            }
        }
    }
    MessageBox(0,"Hooked Wow64 process","waliedassar",0);
    return 0;  //hooked
}