|
Hi man, is posible use you Dll in .Net Programs ?
|
|
|
|
|
I can't figure out how to verify the demo operation. When I start the directx demo and then the launcher program, I get a positive message - as if the hook is activated but I see no change in the demo.
Can someone help please?
Triplebit
|
|
|
|
|
I know it's late. You need to open launcher before bend.exe, and then if you open bend.exe, it will give you a sound of beep. ![Smile | :)](https://codeproject.freetls.fastly.net/script/Forums/Images/smiley_smile.gif)
|
|
|
|
|
I can't figure out how to verify the demo operation. When I start the directx demo and then the launcher program, I get a positive message - as if the hook is activated but I see no change in the demo.
Can someone help please?
Menker
|
|
|
|
|
Works like a charm, more than 5 years after the article was published...
Now that has to say something about the quality of this article.
Thank you!
Nick Z.
|
|
|
|
|
Right, I think so. But I don't know when we hooking some proccess of Window system (sample Spooler in Printing system). Do we infringe Window's privacy ?
minhcom
|
|
|
|
|
thanks too much for this artical, its very helpfull .
plz.. can u tell me how can i hook the windows copy,cat,past operation.
thank u for any think![Rose | [Rose]](https://www.codeproject.com/script/Forums/Images/rose.gif)
|
|
|
|
|
is it possiblee to retreive a value of a variable in a process that you hijacked?
1: i hijack a process
2: find a variable by name or type
3: return the variable onfo to the hijack dll
4: free hijack
can that be done??
cheers ![Big Grin | :-D](https://www.codeproject.com/script/Forums/Images/smiley_biggrin.gif)
|
|
|
|
|
Hi,
is there a way to hijack functions of a dll loaded at runtime by the application
via LoadLibrary?
Kalle
|
|
|
|
|
Yeah...hook LoadLibrary ![Smile | :)](https://www.codeproject.com/script/Forums/Images/smiley_smile.gif)
|
|
|
|
|
Yeah Right, Any comment about that???
-----------------------------
"I Think this Will Help"
-----------------------------
Alok Gupta
visit me at http://www.thisisalok.tk
|
|
|
|
|
I m hooking Direct3dCreate8() of d3d8.dll. In some cases it is hooked succefully while in other after hooking, hooked function address is somehow replaced with original function address.
<br />
if ( HookFn )<br />
{<br />
if ( IsBadWritePtr( (PVOID)pIteratingIAT->u1.Function, 1 ) )<br />
{<br />
pIteratingIAT->u1.Function = (PDWORD)HookFn;<br />
}<br />
else if ( osvi.dwPlatformId == VER_PLATFORM_WIN32_WINDOWS )<br />
{<br />
if ( pIteratingIAT->u1.Function > (PDWORD)0x80000000 )<br />
pIteratingIAT->u1.Function = (PDWORD)HookFn;<br />
}<br />
}<br />
Here
pIteratingIAT->u1.Function = (PDWORD)HookFn;<br /> is succesfully assigned without any exception. but at the end when i recheck the address by
GetProcAddress( GetModuleHandle("d3d8.dll"), "Direct3dCreate8" );
it gives original Function address. Does any body knows abt it?
|
|
|
|
|
this is because the hooking library is only hooking the IAT and not the dll's EAT.
in plain english this means imported function calls are hooked, but those calls using GetProcAddress are not.
a more complete solution is to modify the loaded dll's Export Address Table function pointer as well.
|
|
|
|
|
Or just hook GetProcAddress as well...
|
|
|
|
|
I want to call a function that is in the exe that does the Hook Installation, when certain functions of the windows registry are called. I don't have problems to do that, except that the callback function can't be called from the dll (Access violation writing location 0x00000000). How could I make that work? In case that I can't do it that way, how can I do that??? Thank you.
|
|
|
|
|
I cannont hijack the function
int WSAAPI connect(...)
can you tell me or send me the source code of the dll modified to hook this funciton
thank you
here is what I wrote:
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <shlwapi.h>
#include <ddraw.h>#include "testdll.h"
#include "..\apihijack.h"
#include <winsock2.h>
// Text buffer for sprintf
char Work[256];
HINSTANCE hDLL;
// Function pointer types.
typedef int (WSAAPI *connect_Type)
(
SOCKET s,
const struct sockaddr FAR * name,
int namelen
);
// Function prototypes.
int WSAAPI Myconnect(
SOCKET s,
const struct sockaddr FAR * name,
int namelen
);
// Hook structure.
enum
{
D3DFN_connect=0
};
SDLLHook D3DHook =
{
"Ws2_32.DLL",
false, NULL, // Default hook disabled, NULL function pointer.
{
{ "connect", Myconnect },
{ NULL, NULL }
}
};
// Hook function.
int WSAAPI Myconnect
(
SOCKET s,
const struct sockaddr FAR * name,
int namelen
)
{
MessageBeep( MB_ICONINFORMATION );
MessageBox(NULL,"safdggsd","",MB_OK|MB_APPLMODAL);
connect_Type OldFn =
(connect_Type)D3DHook.Functions[D3DFN_connect].OrigFn;
return OldFn( s, name, namelen );
}
// CBT Hook-style injection.
BOOL APIENTRY DllMain( HINSTANCE hModule, DWORD fdwReason, LPVOID lpReserved )
{
if ( fdwReason == DLL_PROCESS_ATTACH ) // When initializing....
{
hDLL = hModule;
// We don't need thread notifications for what we're doing. Thus, get
// rid of them, thereby eliminating some of the overhead of this DLL
DisableThreadLibraryCalls( hModule );
// Only hook the APIs if this is the Everquest proess.
HookAPICalls( &D3DHook );
}
return TRUE;
}
// This segment must be defined as SHARED in the .DEF
#pragma data_seg (".HookSection")
// Shared instance for all processes.
HHOOK hHook = NULL;
#pragma data_seg ()
TESTDLL_API LRESULT CALLBACK HookProc(int nCode, WPARAM wParam, LPARAM lParam)
{
return CallNextHookEx( hHook, nCode, wParam, lParam);
}
TESTDLL_API void InstallHook()
{
OutputDebugString( "TESTDLL hook installed.\n" );
hHook = SetWindowsHookEx( WH_CBT, HookProc, hDLL, 0 );
}
TESTDLL_API void RemoveHook()
{
OutputDebugString( "TESTDLL hook removed.\n" );
UnhookWindowsHookEx( hHook );
}
gabby
|
|
|
|
|
Assuming you are using the most common technique of IAT hooking here - since I haven't read this article. You might need to call VirtualProtectEx before your code attempts to write the memory in the target (meaning the remote process/or wherever the IAT(s) you are hooking are)..
Basically what is most likely happening is that in the case which you are attempting the memory protection flags are set to disallow write access (eg: page-gaurd is set, etc.). You should use the VirtualProtect(Ex) immediately
before you perform the write.
Hopefully, that will solve your problem.
Regards,
deejay
|
|
|
|
|
APIHijack is public domain or other license ?
I modified APIHijack to compile gcc.
I will release this source code.
Is there problem ?
Please advice.![Confused | :confused:](https://codeproject.global.ssl.fastly.net/script/Forums/Images/smiley_confused.gif)
|
|
|
|
|
this article is under the "The Code Project Open License (CPOL)".
i think it let's you do with the code basically whatever you want...
read the contract to be sure.
Roey
Don't believe to what you hear on the news...
|
|
|
|
|
Hi all,
There are many programs that use delay loading, like WM player,Msn messenger. Is there anyway to hook functions in DELAY Import Address Table? I have been stuck this problem for many weeks.
Any ideas will be appreciate. ![Smile | :)](https://codeproject.global.ssl.fastly.net/script/Forums/Images/smiley_smile.gif)
|
|
|
|
|
Hook the loadlibrary- recognize your desired dll is being loaded , replay the desired func on the loaded dll export table with your own.
|
|
|
|
|
Why not just hook LoadLibraryA and LoadLibraryW, and respin another instance of the hook class, or am I not catching the implication of what you are trying to do?...
The aforementioned technique should enable you to successfully monitor methods in probably 99.99% of all cases - except of course in the very rare case where the caller has either rolled-their-own dll-loader or is loading by issuing calls to NtDll.dll directly...
Regards,
deejay
|
|
|
|
|
i want to hook call for com methods. any idea in this regard?
thanx in advance
imran
|
|
|
|
|
Try our tool, it's support monitor all apis and com interface.
---------------------------
Auto Debug for Windows
http://www.autodebug.com/
|
|
|
|
|
Dear,
I am in a problem while working with Keyboardhook. I want to change the characters of a message which is found after hooking. I dont know where is the option of hookproc()to post a changed message? The PostMessage() function contains parameters, but is there any parameter by which I can send message to the system after changing the hooked message? For example, pressing 'a' on keyboard I want to see 'b' or other character in display. How can it be possible? Pls help me.
Rupom
|
|
|
|