Click here to Skip to main content
15,891,721 members
Articles / Desktop Programming / MFC

API hooking revealed

Rate me:
Please Sign up or sign in to vote.
4.94/5 (322 votes)
2 Dec 2002CPOL38 min read 2.8M   64.1K   1.3K  
The article demonstrates how to build a user mode Win32 API spying system
//---------------------------------------------------------------------------
//
// NtDriverController.h
//
// SUBSYSTEM: 
//				API Hooking system
// MODULE:    
//				Provides simple interface for managing device driver 
//              administration
//
// DESCRIPTION:
//
// AUTHOR:		Ivo Ivanov (ivopi@hotmail.com)
//                                                                         
//---------------------------------------------------------------------------

#if !defined(_NTDRIVERCONTROLLER_H_)
#define _NTDRIVERCONTROLLER_H_

#if _MSC_VER > 1000
#pragma once
#endif // _MSC_VER > 1000

#include <windows.h>

//---------------------------------------------------------------------------
//
// class CNtDriverController
//
//---------------------------------------------------------------------------
class CNtDriverController  
{
public:
	CNtDriverController();
	virtual ~CNtDriverController();
private:
	//
	// Obtain manager handle
	//
	BOOL Open();
	//
	// Close handle obtained from Open()
	//
	void Close();
	//
	//
	//
	BOOL WaitForState(
		DWORD           dwDesiredState, 
		SERVICE_STATUS* pss
		);
	//
	// Add the driver to the system and start it up
	//
	BOOL InstallAndStart();
	//
	// Stop the driver and remove it from the system
	//
	void StopAndRemove();
private:
	SC_HANDLE m_hSCM;
	SC_HANDLE m_hDriver;
	BOOL      m_bDriverStarted;
	BOOL      m_bErrorOnStart;
	char      m_szName[MAX_PATH];
	char      m_szInfo[MAX_PATH];
	char      m_szFullFileName[MAX_PATH];
};

#endif // !defined(_NTDRIVERCONTROLLER_H_)
//----------------------------End of the file -------------------------------

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
United States United States
I specialize in OS Internals and Reverse Engineering.
Before joining my current employer I used to run a security blog for malware analysis: http://vinsula.com/security-blog

Comments and Discussions