API hooking revealed

Ivo Ivanov

Rate me:

4.94/5 (322 votes)

2 Dec 2002CPOL38 min read

2.8M

64.1K

1.3K

The article demonstrates how to build a user mode Win32 API spying system

hooksys_code.zip
- Code
  - Common
  - HookSrv
    - ApplicationScope.cpp
    - ApplicationScope.h
    - HookSrv.cpp
    - HookSrv.dsp
    - HookSrv.h
    - HookSrv.rc
    - LimitSingleInstance.cpp
    - LimitSingleInstance.h
    - MainFrm.cpp
    - MainFrm.h
    - res
      - HookSrv.ico
      - HookSrv.rc2
      - trayicon.ico
    - Resource.h
    - StdAfx.cpp
    - StdAfx.h
    - TrayIcon.cpp
    - TrayIcon.h
  - HookSystem.dsw
  - HookTool
    - ApiHook.cpp
    - ApiHook.h
    - HookTool.cpp
    - HookTool.def
    - HookTool.dsp
    - Injector.cpp
    - Injector.h
    - Interlocked.h
    - ModuleScope.cpp
    - ModuleScope.h
    - NtDriverController.cpp
    - NtDriverController.h
    - NtInjectorThread.cpp
    - NtInjectorThread.h
    - NtProcessMonitor.cpp
    - NtProcessMonitor.h
  - NTProcDrv
    - NTProcDrv.c
    - NTProcDrv.dsp
  - TestApp
    - TestApp.cpp
    - TestApp.dsp
hooksys_demo.zip
- Output
  - HookSrv.exe
  - HookTool.dll
  - HookTool.ini
  - NTProcDrv.sys
  - TestApp.exe

//{{NO_DEPENDENCIES}}
// Microsoft Developer Studio generated include file.
// Used by HookSrv.rc
//
#define IDD_ABOUTBOX                    100
#define IDR_MAINFRAME                   128
#define IDR_HOOKSRTYPE                  129
#define IDI_TRAYICON                    132
#define IDR_TRAYICON                    134

// Next default values for new objects
// 
#ifdef APSTUDIO_INVOKED
#ifndef APSTUDIO_READONLY_SYMBOLS
#define _APS_3D_CONTROLS                     1
#define _APS_NEXT_RESOURCE_VALUE        135
#define _APS_NEXT_COMMAND_VALUE         32772
#define _APS_NEXT_CONTROL_VALUE         1000
#define _APS_NEXT_SYMED_VALUE           101
#endif
#endif

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Written By

Ivo Ivanov

United States

I specialize in OS Internals and Reverse Engineering.
Before joining my current employer I used to run a security blog for malware analysis: http://vinsula.com/security-blog

API hooking revealed

License

Comments and Discussions