HookImportFunctionByName v1.0

Introduction

The code is based on the code developed by John Robbins for his "BugSlayer" articles in the MSJ magazine. I have removed the dependencies on his other DLL functions, converted the code to MFC and addition of numerous ASSERTs.

History

• Initial Public Release.

API

HookImportFunctionsByName

HookImportFunctionsByName

BOOL HookImportFunctionsByName(HMODULE hModule, LPCSTR szImportMod, UINT uiCount, LPHOOKFUNCDESC paHookArray, PROC* paOrigFuncs, UINT* puiHooked);

Return Value:
TRUE if the specified API call(s) were hooked, therwise FALSE. To get extended error information, call ::GetLastError().

Parameters:

• hModule -- This is the instance handle of the process calling the function. Normally in MFC you can obtain this from the function AfxGetInstanceHandle().
• szImportMod -- This is the name of the module which contains the functions which you want to hook. e.g. for hooking file system calls, this would be KERNEL32.DLL.
• uiCount -- This is the size of the paHookArray parameter.
• paHookArray -- This is an array which specifies what functions to hook. The members of the HOOKFUNCDESC are "szFunc", which is the name of your function to hook, and "pProc", which is a function pointer to the function which you want to have called instead of normal unhooked case.
• paOrigFuncs -- Upon successful return this will contain the original unhooked function pointers. These would be useful if you want to pass the request onto the original function after your hook function has been called.
• puiHooked -- Upon return this will contain the number of functions which were hooked. This will be less than or equal to "uiCount".

Remarks:
If you are hooked standard Win32 API calls then make sure that your hook function is using the right calling convention namely STDCALL. This is one of the most common problems encountered when using the hooking function.

Planned Enhancements

• Provide a sample app. I started using this code for a number of private contracts which I have been working on. Some ideas for sample apps would be a serial port monitor, a file system monitor to do the same as the Filemon application on the System Internals Web site.
• If you have any other suggested improvements, please let me know so that I can incorporate them into the next release.

Contacting the Author

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here