首页
社区
课程
招聘
[转帖]Ultimate Hooking Engine by deroko/ARTeam
发表于: 2007-6-23 18:02 3925

[转帖]Ultimate Hooking Engine by deroko/ARTeam

2007-6-23 18:02
3925
Ultimate Hooking Engine is project started for my own needs, to be honest, I got tired of rewriting inline hooks everytime I need to hook something.

This engine is very simple to use and is designed to be used by everyone that need to hook something, all that is required to hook certain target is carfully crafted hooking dll with certain exports, actually exports are used to locate API that you want to hook, there are 3 export types that you dll may have:

1. prefixed HOOK
2. prefixed Detoured
3. hookmain (optional)

1. Whenever you want to hook some API you will put this kind of export:

HOOK_kernel32_GetModuleHandleA
HOOK_user32_MessageBoxA

Also note that inline hook will point to this procedure so this procedure will have all code you need for hooking.

2. To be able to call original API from your hook you should export also this variable (in C/C++ it will be function pointer):

Detoured_GetModuleHandleA
Detoured_MessageBoxA

Here is one example from C/C++ code:

extern "C" __declspec(dllexport) HMODULE (__stdcall *Detoured_GetModuleHandleA)(LPCTSTR modulename) = NULL;

extern "C" HMODULE __declspec(dllexport) __stdcall HOOK_kernel32_GetModuleHandleA(LPCTSTR modulename){
return Detoured_GetModuleHandleA(modulename);
}

Note also that this is optional, if you don't need to call orignal proc, then you don't need this export.

Note that when working with MSVC2005 it will always screw export name for procedurs while function pointers are properly exported, so add this line to your .def file:

HOOK_kernel32_GetModuleHandleA = _HOOK_kernel32_GetModuleHandleA@4
Detoured_GetModuleHandleA

3. hookmain

hookmain is export which has this prototype:

void __stdcall hookmain();

This procedure will be called before program jumps to entrypoint of target, here you may add some extra code, it isn't very useful and all initialization you may perfrom in DllEntry, but I leave this here just in case that you want to start your own tracer before code jmps to entrypoint. At least that's why I'm using it.

Examples for MSVC, Borldan C and tasm you may find in examples folder

[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)

上传的附件:
收藏
免费 0
支持
分享
最新回复 (2)
雪    币: 233
活跃值: (10)
能力值: ( LV6,RANK:90 )
在线值:
发帖
回帖
粉丝
2
good, thanks~
2007-6-25 08:30
0
雪    币: 560
活跃值: (359)
能力值: ( LV13,RANK:1370 )
在线值:
发帖
回帖
粉丝
3
2007-6-25 08:45
0
游客
登录 | 注册 方可回帖
返回
//