Click here to Skip to main content
15,886,860 members
Articles / Programming Languages / ASM

Powerful x86/x64 Mini Hook-Engine

Rate me:
Please Sign up or sign in to vote.
4.92/5 (40 votes)
10 Apr 2008CPOL8 min read 194.7K   6.4K   196  
A powerful x86/x64 Hook-Engine
// NtHookEngine_Test.cpp : Defines the entry point for the application.
//

#include "stdafx.h"
#include "NtHookEngine_Test.h"

BOOL (__cdecl *HookFunction)(ULONG_PTR OriginalFunction, ULONG_PTR NewFunction);
VOID (__cdecl *UnhookFunction)(ULONG_PTR Function);
ULONG_PTR (__cdecl *GetOriginalFunction)(ULONG_PTR Hook);

int WINAPI MyMessageBoxW(HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption,
						 UINT uType, WORD wLanguageId, DWORD dwMilliseconds);

int APIENTRY _tWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
					   LPTSTR lpCmdLine, int nCmdShow)
{
	//
	// Retrive hook functions
	// 

	HMODULE hHookEngineDll = LoadLibrary(_T("NtHookEngine.dll"));

	HookFunction = (BOOL (__cdecl *)(ULONG_PTR, ULONG_PTR))
		GetProcAddress(hHookEngineDll, "HookFunction");

	UnhookFunction = (VOID (__cdecl *)(ULONG_PTR))
		GetProcAddress(hHookEngineDll, "UnhookFunction");

	GetOriginalFunction = (ULONG_PTR (__cdecl *)(ULONG_PTR))
		GetProcAddress(hHookEngineDll, "GetOriginalFunction");

	if (HookFunction == NULL || UnhookFunction == NULL || 
		GetOriginalFunction == NULL)
		return 0;

	//
	// Hook MessageBoxTimeoutW
	//

	HookFunction((ULONG_PTR) GetProcAddress(LoadLibrary(_T("User32.dll")),
		"MessageBoxTimeoutW"), 
		(ULONG_PTR) &MyMessageBoxW);

	MessageBox(0, _T("Hi, this is a message box!"), _T("This is the title."), 
		MB_ICONINFORMATION);

	//
	// Unhook MessageBoxTimeoutW
	//

	UnhookFunction((ULONG_PTR) GetProcAddress(LoadLibrary(_T("User32.dll")), 
		"MessageBoxTimeoutW"));

	MessageBox(0, _T("Hi, this is a message box!"), _T("This is the title."), 
		MB_ICONINFORMATION);

	return 0;
}

int WINAPI MyMessageBoxW(HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uType,
						 WORD wLanguageId, DWORD dwMilliseconds)
{
	int (WINAPI *pMessageBoxW)(HWND hWnd, LPCWSTR lpText, 
		LPCWSTR lpCaption, UINT uType, WORD wLanguageId, 
		DWORD dwMilliseconds);

	pMessageBoxW = (int (WINAPI *)(HWND, LPCWSTR, LPCWSTR, UINT, WORD, DWORD))
		GetOriginalFunction((ULONG_PTR) MyMessageBoxW);

	return pMessageBoxW(hWnd, lpText, L"Hooked MessageBox",
		uType, wLanguageId, dwMilliseconds);
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Software Developer
Germany Germany
The languages I know best are: C, C++, C#, Assembly (x86, x64, ARM), MSIL, Python, Lua. The environments I frequently use are: Qt, Win32, MFC, .NET, WDK. I'm a developer and a reverse engineer and I like playing around with internals.

You can find most of my work at http://ntcore.com.

Comments and Discussions