Click here to Skip to main content

Article

APIHijack - A Library for easy DLL function hooking.

Wade Brainerd

Rate me:

4.79/5 (30 votes)

15 Sep 2000CPOL

802K

10.5K

173

156

This library allows you to replace functions in other DLLs with functions from your own DLL.

Download source files and demo project - 102 Kb

Introduction

Based on DelayLoadProfileDLL.CPP, by Matt Pietrek for MSJ February 2000. This code is intended to be included in a DLL inserted through a global Windows Hook (CBT hook for example). It will replace functions from other DLLs (e.g. DDRAW.DLL) with functions from your DLL.

Functions are hooked by passing a parameter structure to the HookAPICalls() function as follows:

SDLLHook D3DHook = 
{
    "DDRAW.DLL",
    false, NULL,    // Default hook disabled, NULL function pointer.
    {
        { "DirectDrawCreate", MyDirectDrawCreate },
        { NULL, NULL }
    }
};

BOOL APIENTRY DllMain( HINSTANCE hModule, DWORD fdwReason, LPVOID lpReserved)
{
    if ( fdwReason == DLL_PROCESS_ATTACH )  // When initializing....
    {
        hDLL = hModule;

        // We don't need thread notifications for what we're doing.  Thus, 
        // get rid of them, thereby eliminating some of the overhead of 
        // this DLL
        DisableThreadLibraryCalls( hModule );

        // Only hook the APIs if this is the right process.
        GetModuleFileName( GetModuleHandle( NULL ), Work, sizeof(Work) );
        PathStripPath( Work );

        if ( stricmp( Work, "myhooktarget.exe" ) == 0 )
            HookAPICalls( &D3DHook );
    }

    return TRUE;
}

Now all that remains is to get your DLL loaded into the target process.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Written By

Wade Brainerd

United States

This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.

Comments and Discussions

Hooking intra-dll calls

Member 117407493-Jun-15 21:38

Member 11740749

3-Jun-15 21:38

Hello,

I am trying to hook intra-dll calls, by using delay loaded dll's. But it
does not work.

The question is if APIHijack would allow this.

The original code is like this:

-----------MyLib.dll, MyLib.lib -----------
__declspec(dllexport) int f1(int a) { ... }
__declspec(dllexport) int f2(int a) { if /* A */ (f1(a)) return 1; else return 0; }
-----------MyLib.dll, MyLib.lib -----------

-----------MyMockLib.dll, MyMockLib.lib -----------
__declspec(dllexport) int f1(int a) ...
__declspec(dllexport) int f2(int a) ...
-----------MyMockLib.dll, MyMockLib.lib -----------

Application links to MyMockLib.lib and MyLib.lib

I can intercept the call to MyLib::f2, but the call at [A]
from MyLib::f2 to MyLib::f1 goes directly to MyLib::f1
(and not to MyMockLib::f1 as I want).

I also wonder how the call at [A] is dispatched. Using the runtime linker, or
using a direct call. And if it is possible to control this behavior.

Regards,

Even

Non-Debug applications can be hooked too ?

Ryouku12-Jul-09 18:17

12-Jul-09 18:17

i've made a dll with this lib to hook all the LoadLibrary function
it's working but. if i compile my test application in release
it's load my dll but i can't know if the functions are hooked or not
and my hook for LoadLibrary isn't called
someone can help me ?

ps: i've modified the source to compile it as a stand-alone dll, so
when the .exe load it's with LoadLibraryA my dll will set all hooks
to log the library loads

Problem when trying to hook text functions

Roey C31-Mar-08 9:25

31-Mar-08 9:25

Hi everyone Smile | :)

Smile | :)

I'm trying to use this library to retrieve text from all kind of windows.
but for some reason i only get only parts of the text.

for example: in notepad i only get the texts in the menu, but not what the user has written.

does anyone knows why?

i hooked these functions:
ExtTextOutW
ExtTextOutA
TextOutW
TextOutA
DrawTextA
DrawTextW
PolyTextOutA
PolyTextOutW

thanks in advance Smile | :)

Smile | :)

Roey

Don't believe to what you hear on the news...

It does not work for me.

Achilleas Margaritis27-Nov-07 23:09

Achilleas Margaritis

27-Nov-07 23:09

I want to hook the functions HeapAlloc and HeapFree to see if there is a memory problem with my application, but it does not work for me. It worked a few years back, but it seems that Microsoft has released a patch which no longer allows apihijack to work.

Re: It does not work for me.

MXT320-Jan-12 7:42

20-Jan-12 7:42

Not true, I am using this on Vista, completely up to date, and it works great. I load my dll in applications by using CreateRemoteThread(). Because Vista and Windows 7 have a ressembling architecture, I assume it wil still work on windows 7. However, the sample didn't worked for some reason.

not imported by name?!

Parallan3-Nov-07 23:27

3-Nov-07 23:27

I want to hook the network functions, but they are not really hooked; "bool RedirectIAT( SDLLHook* DLLHook, PIMAGE_IMPORT_DESCRIPTOR pImportDesc, PVOID pBaseLoadAddr )" is called, but it doesn't hook the dll-functions.
by debugging I found out, that

if(!IMAGE_SNAP_BY_ORDINAL(pINT->u1.Ordinal))  // import by name

is not called, so the function is not imported by name. The "else" case doesn't really do anything, because UseDefault is disabled.

else
{
	// If the default function is enabled, store the ordinal for the user.
	if ( DLLHook->UseDefault )
		pStubs->pszNameOrOrdinal = pINT->u1.Ordinal;
}

SDLLHook WS2Hook = 
{
	"ws2_32.dll", false, NULL,
	{
		{ "accept", NEW_accept},
		{ "bind", NEW_bind},
		{ "connect", NEW_connect},
		{ "listen", NEW_listen},
		{ "recv", NEW_recv},
		{ "recvfrom", NEW_recvfrom},
		{ "send", NEW_send},
		{ "sendto", NEW_sendto},
		{ "WSAAccept", NEW_WSAAccept},
		{ "WSAConnect", NEW_WSAConnect},
		{ "WSARecv", NEW_WSARecv},
		{ "WSARecvFrom", NEW_WSARecvFrom},
		{ "WSARecvDisconnect", NEW_WSARecvDisconnect},
		{ "WSASend", NEW_WSASend},
		{ "WSASendTo", NEW_WSASendTo},
		{ "WSASendDisconnect", NEW_WSASendDisconnect},
		{ NULL, NULL }
	}
};

How to hook user defined DLL ?

mahesh kumar s3-Jul-07 1:46

3-Jul-07 1:46

I have a requirement to monitor functions called inside a userdefined DLL.

I coded a win32 DLL and exported a function ("TestFunction") and called LoadLibrary from Dlg based MFC sample
to load the dll dynamically.
I then gave this DLL name as input to Hook structure ,wrote the function pointer and prototype stuff overrides as in the sample in the Hook sample and built the test DLL.
I launched the launchtest app and hooked the dll. But when I execute the MFC sample, i dont see any trace of the function called in the win32 DLL i coded. Why is it so ?

Why only predefined Microsoft DLLs are able to hook and not User Defined ? How else must i link my MFC app to my user defined DLL to get the function hooked..

I place the userdefined win32 DLL in C:\windows\system32 folder.
Plz help me..

-Mahesh

monitoring dll function calls

mahesh kumar s28-Jun-07 4:04

28-Jun-07 4:04

I need to write an application which will basically monitor function calls in a win32 dll and print the
functions called to debug output. Iam novice to hooking.
Using this article, How can i do it ? can any one give me sample code ?

Thanks in advance..

-Mahesh

this trick doesn't work with all programs, nor?

6r15u30-Jan-07 2:10

30-Jan-07 2:10

If a program loads an activeX the activeX is not hooked, nor?
and if an program doesn't have an OriginalFirstThunk the function also fails?
So how can I hook functions system wide, so that I get every call of CreateFileA and CreateFileW?
Regards and thanks for your answers
Tobias

either you live or you are consequent

APIHijack is outmoded?

player.24-Jul-06 22:51

24-Jul-06 22:51

TestLauncher.exe and TestDLL.dll
can not hook api DirectDrawCreateEx in bend.exe

why?
APIHijack is outmoded?

Test at WinXP Pro SP2

Compile with Visual Studio 2003

P Gibson7-Jul-06 1:30

7-Jul-06 1:30

Hi anyone got this to compile cleanly using Visual Studio 2003 ? I'm getting some errors and would appreciate some help.

I've also found a more upto date version of this application on CodeGuru but that also gives errors when using VS 2003.

The API's I'm trying to hook are PrintDlgExA and PrintDlgExW so I require a more upto date environment than VC++ 6.0 and it's header/library files.

Hooking LoadLibraryA

Red XIII28-Jun-06 0:58

28-Jun-06 0:58

Does anyone know how to hook LoadLibraryA. I have tried several times, but it just doesn't work. My hook procedure is not called. The funny thing is that this only applies to KERNEL32.dll functions. I can easily hook any USER32.dll function with my hook procedure being called.
Any ideas?

VB.Net and APIHijack

Vitoto12-Jan-06 5:36

12-Jan-06 5:36

Hi man, is posible use you Dll in .Net Programs ?

triplebit21-Nov-05 1:07

21-Nov-05 1:07

I can't figure out how to verify the demo operation. When I start the directx demo and then the launcher program, I get a positive message - as if the hook is activated but I see no change in the demo.

Can someone help please?

Triplebit

sfc998219-Aug-23 3:13

19-Aug-23 3:13

I know it's late. You need to open launcher before bend.exe, and then if you open bend.exe, it will give you a sound of beep. Smile | :)

Smile | :)

triplebit21-Nov-05 1:06

21-Nov-05 1:06

I can't figure out how to verify the demo operation. When I start the directx demo and then the launcher program, I get a positive message - as if the hook is activated but I see no change in the demo.

Can someone help please?

Menker

Purely excelent...

Nick Z.3-Nov-05 14:21

3-Nov-05 14:21

Works like a charm, more than 5 years after the article was published...
Now that has to say something about the quality of this article.

Thank you!

Nick Z.

Re: Purely excelent...

Nguyen Duc Minh19-Nov-05 20:01

Nguyen Duc Minh

19-Nov-05 20:01

Right, I think so. But I don't know when we hooking some proccess of Window system (sample Spooler in Printing system). Do we infringe Window's privacy ?

minhcom

how to hook copy,cat,past operations

Al_Shakhly1-Nov-05 22:15

1-Nov-05 22:15

thanks too much for this artical, its very helpfull .
plz.. can u tell me how can i hook the windows copy,cat,past operation.
thank u for any think Rose | [Rose]

Rose | [Rose]

Retreiving variable

Member 178030014-Aug-05 4:04

14-Aug-05 4:04

is it possiblee to retreive a value of a variable in a process that you hijacked?

1: i hijack a process
2: find a variable by name or type
3: return the variable onfo to the hijack dll
4: free hijack

can that be done??

cheers Big Grin | :-D

Big Grin | :-D

Hooking dynamicly loaded DLLs functions

seybold23-May-05 22:33

23-May-05 22:33

Hi,
is there a way to hijack functions of a dll loaded at runtime by the application
via LoadLibrary?

Kalle

Re: Hooking dynamicly loaded DLLs functions

dchris_med14-Feb-06 3:16

14-Feb-06 3:16

Yeah...hook LoadLibrary Smile | :)

Smile | :)

Looking like a atlternative of DsSubCls.dll

ThatsAlok3-Dec-04 19:10

3-Dec-04 19:10

Yeah Right, Any comment about that???

-----------------------------
"I Think this Will Help"
-----------------------------
Alok Gupta
visit me at http://www.thisisalok.tk

Hooked function address is replaced by Original one

samren23-Sep-04 20:07

23-Sep-04 20:07

I m hooking Direct3dCreate8() of d3d8.dll. In some cases it is hooked succefully while in other after hooking, hooked function address is somehow replaced with original function address.

<br />
// Replace the IAT function pointer if we have a hook.<br />
        if ( HookFn )<br />
        {<br />
            // Cheez-o hack to see if what we're importing is code or data.<br />
            // If it's code, we shouldn't be able to write to it<br />
            if ( IsBadWritePtr( (PVOID)pIteratingIAT->u1.Function, 1 ) )<br />
            {<br />
                pIteratingIAT->u1.Function = (PDWORD)HookFn;<br />
            }<br />
            else if ( osvi.dwPlatformId == VER_PLATFORM_WIN32_WINDOWS )<br />
            {<br />
                // Special hack for Win9X, which builds stubs for imported<br />
                // functions in system DLLs (Loaded above 2GB).  These stubs are<br />
                // writeable, so we have to explicitly check for this case<br />
                if ( pIteratingIAT->u1.Function > (PDWORD)0x80000000 )<br />
                    pIteratingIAT->u1.Function = (PDWORD)HookFn;<br />
            }<br />
        }<br />

Here

pIteratingIAT->u1.Function = (PDWORD)HookFn;<br />

is succesfully assigned without any exception. but at the end when i recheck the address by
GetProcAddress( GetModuleHandle("d3d8.dll"), "Direct3dCreate8" );

it gives original Function address. Does any body knows abt it?

Re: Hooked function address is replaced by Original one

Member 108017311-Oct-04 2:32

11-Oct-04 2:32

this is because the hooking library is only hooking the IAT and not the dll's EAT.

in plain english this means imported function calls are hooked, but those calls using GetProcAddress are not.

a more complete solution is to modify the loaded dll's Export Address Table function pointer as well.

General News Suggestion Question Bug Answer Joke Praise Rant Admin

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

Go to top