Click here to Skip to main content
12,406,687 members (59,139 online)
Click here to Skip to main content

Stats

1.9M views
57.6K downloads
1.2K bookmarked
Posted

API hooking revealed

, 2 Dec 2002 CPOL
The article demonstrates how to build a user mode Win32 API spying system
//---------------------------------------------------------------------------
//
// ApplicationScope.h
//
// SUBSYSTEM:   Hook system
//				
// MODULE:      Hook server
//
// DESCRIPTION: Implementation of the CApplicationScope class.
//              This class is designed to provide single interface for 
//              all hook related activities.
// 				
//             
// AUTHOR:		Ivo Ivanov (ivopi@hotmail.com)
// DATE:		2001 December v1.00
//
//---------------------------------------------------------------------------
#include "stdafx.h"
#include "HookSrv.h"
#include "ApplicationScope.h"

//---------------------------------------------------------------------------
//
// class CApplicationScope 
//
//---------------------------------------------------------------------------

//---------------------------------------------------------------------------
//
// Static memeber declarations
//
//---------------------------------------------------------------------------
CApplicationScope* CApplicationScope::sm_pInstance = NULL;

//---------------------------------------------------------------------------
//
// Constructor
//
//---------------------------------------------------------------------------
CApplicationScope::CApplicationScope():
	m_hmodHookTool(NULL),
	m_pfnInstallHook(NULL)
{

}

//---------------------------------------------------------------------------
//
// Destructor 
//
//---------------------------------------------------------------------------
CApplicationScope::~CApplicationScope()
{
	if (m_hmodHookTool)
		::FreeLibrary( m_hmodHookTool );
}

//---------------------------------------------------------------------------
//
// Copy constructor
//
//---------------------------------------------------------------------------
CApplicationScope::CApplicationScope(const CApplicationScope& rhs)
{

}

//---------------------------------------------------------------------------
//
// Assignment operator
//
//---------------------------------------------------------------------------
CApplicationScope& CApplicationScope::operator=(const CApplicationScope& rhs)
{
	if (this == &rhs) 
		return *this;

	return *this; // return reference to left-hand object
}


//---------------------------------------------------------------------------
// GetInstance
//
// Implements the "double-checking" locking pattern combined with 
// Scott Meyers single instance
// For more details see - 
// 1. "Modern C++ Design" by Andrei Alexandrescu - 6.9 Living in a 
//     Multithreaded World
// 2. "More Effective C++" by Scott Meyers - Item 26
//---------------------------------------------------------------------------
CApplicationScope& CApplicationScope::GetInstance()
{
	if (!sm_pInstance)
	{
		CLockMgr<CCSWrapper> guard(g_AppSingeltonLock, TRUE);
		if (!sm_pInstance)
		{
			static CApplicationScope instance;
			sm_pInstance = &instance;
		}
	} // if

	return *sm_pInstance;
}

//---------------------------------------------------------------------------
// InstallHook
//
// Delegates the call to the DLL InstallHook function
//---------------------------------------------------------------------------
void CApplicationScope::InstallHook(BOOL bActivate, HWND hwndServer)
{
	if (NULL == m_hmodHookTool)
	{
		m_hmodHookTool = ::LoadLibrary( "HookTool.Dll" );
		if (NULL != m_hmodHookTool)
			m_pfnInstallHook = (PFN_INSTALLHOOK)::GetProcAddress(
				m_hmodHookTool, 
				"InstallHook"
				);
	} // if
	if (m_pfnInstallHook)
		m_pfnInstallHook(bActivate, hwndServer);
}

//---------------------------------------------------------------------------
// OnDllLoaded
//
// Fired when a process loads hooktool dll
//---------------------------------------------------------------------------
void CApplicationScope::OnDllLoaded(DWORD dwProcessId)
{

}

//---------------------------------------------------------------------------
// OnDllUnLoaded
//
// Fired when a process unloads hooktool dll
//---------------------------------------------------------------------------
void CApplicationScope::OnDllUnLoaded(DWORD dwProcessId)
{

}

//----------------------------End of the file -------------------------------

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author

Ivo Ivanov
United States United States
I specialize in OS Internals and Reverse Engineering.
Before joining my current employer I used to run a security blog for malware analysis: http://vinsula.com/security-blog

You may also be interested in...

| Advertise | Privacy | Terms of Use | Mobile
Web02 | 2.8.160730.1 | Last Updated 3 Dec 2002
Article Copyright 2002 by Ivo Ivanov
Everything else Copyright © CodeProject, 1999-2016
Layout: fixed | fluid