Click here to Skip to main content
11,578,707 members (61,113 online)
Click here to Skip to main content
Add your own
alternative version

API hooking revealed

, 2 Dec 2002 CPOL 1.8M 55.2K 1.2K
The article demonstrates how to build a user mode Win32 API spying system
// NtDriverController.h
//				API Hooking system
// MODULE:    
//				Provides simple interface for managing device driver 
//              administration
// AUTHOR:		Ivo Ivanov (


#if _MSC_VER > 1000
#pragma once
#endif // _MSC_VER > 1000

#include <windows.h>

// class CNtDriverController
class CNtDriverController  
	virtual ~CNtDriverController();
	// Obtain manager handle
	BOOL Open();
	// Close handle obtained from Open()
	void Close();
	BOOL WaitForState(
		DWORD           dwDesiredState, 
	// Add the driver to the system and start it up
	BOOL InstallAndStart();
	// Stop the driver and remove it from the system
	void StopAndRemove();
	SC_HANDLE m_hDriver;
	BOOL      m_bDriverStarted;
	BOOL      m_bErrorOnStart;
	char      m_szName[MAX_PATH];
	char      m_szInfo[MAX_PATH];
	char      m_szFullFileName[MAX_PATH];

#endif // !defined(_NTDRIVERCONTROLLER_H_)
//----------------------------End of the file -------------------------------

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

Ivo Ivanov
Chief Technology Officer Vinsula
Australia Australia
I specialise in Malware Analysis, Application Security, Windows Kernel, x86/x64, and Reverse Engineering.
My blog:

You may also be interested in...

| Advertise | Privacy | Terms of Use | Mobile
Web04 | 2.8.150603.1 | Last Updated 3 Dec 2002
Article Copyright 2002 by Ivo Ivanov
Everything else Copyright © CodeProject, 1999-2015
Layout: fixed | fluid