Click here to Skip to main content
15,895,799 members
Articles / Desktop Programming / MFC

API hooking revealed

Rate me:
Please Sign up or sign in to vote.
4.94/5 (322 votes)
2 Dec 2002CPOL38 min read 2.8M   64.1K   1.3K  
The article demonstrates how to build a user mode Win32 API spying system
#include <windows.h>

HWND     g_hWnd;
HMODULE  hHookLib = NULL;


LRESULT CALLBACK WndProc(HWND, UINT, WPARAM, LPARAM);

int APIENTRY WinMain(
	HINSTANCE hInstance, 
	HINSTANCE hPrevInstance,
    LPSTR     lpszCmdLine, 
	int       nCmdShow
	)
{
    HWND     hwnd;
    MSG      msg ;
    WNDCLASS wndclass ;

	if(!hPrevInstance) 
	{
		wndclass.style         = CS_HREDRAW | CS_VREDRAW ;
		wndclass.lpfnWndProc   = WndProc ;
		wndclass.cbClsExtra    = 0 ;
		wndclass.cbWndExtra    = 0 ;
		wndclass.hInstance     = hInstance ;
		wndclass.hIcon         = LoadIcon(NULL, IDI_APPLICATION) ;
		wndclass.hCursor       = LoadCursor(NULL, IDC_ARROW) ;
		wndclass.hbrBackground =(HBRUSH) GetStockObject(WHITE_BRUSH) ;
		wndclass.lpszMenuName  = NULL;
		wndclass.lpszClassName = "DemoClass" ;
		RegisterClass(&wndclass) ;
	}

	hwnd = ::CreateWindow(
		"DemoClass",			// LPCTSTR lpClassName
		"Test Application",		// LPCTSTR lpWindowName
   		WS_OVERLAPPEDWINDOW,	// DWORD dwStyle
		CW_USEDEFAULT,			// int x
		0,						// int y 
		CW_USEDEFAULT,			// int nWidth
		0,						// int nHeight
		NULL,					// HWND hWndParent
		NULL,					// HMENU hMenu
		hInstance,				// HANDLE hInstance
		NULL                    // PVOID lpParam 
		);				
	g_hWnd = hwnd;
	
	::ShowWindow(hwnd, nCmdShow) ;
	::UpdateWindow(hwnd) ;

	while(::GetMessage(&msg, NULL, 0, 0))
	{
		::TranslateMessage(&msg) ;
		::DispatchMessage(&msg) ;
	}
	
	return msg.wParam ;
}

LRESULT CALLBACK WndProc(
	HWND   hwnd, 
	UINT   message, 
	WPARAM wParam, 
	LPARAM lParam
	)
{
	static char    pszLine0[80] = "Hello from TestApp!";
	static wchar_t pszLine1[80] = L"Hello from TestApp!";
    HDC hDC;                               
    PAINTSTRUCT ps;
	
	switch(message)
    {
    case WM_PAINT:
        hDC = ::BeginPaint(hwnd, &ps);
		::TextOutA(hDC, 0, 0, pszLine0, lstrlen(pszLine0));
		::TextOutW(hDC, 0, 20, pszLine1, wcslen(pszLine1));
        ::EndPaint(hwnd, &ps);
		return 0;
    case WM_DESTROY :
        ::PostQuitMessage(0) ;
		return 0;
    default:
        break;
    }
    return DefWindowProc(hwnd, message, wParam, lParam) ;
}

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
United States United States
I specialize in OS Internals and Reverse Engineering.
Before joining my current employer I used to run a security blog for malware analysis: http://vinsula.com/security-blog

Comments and Discussions