Validtec Software, Inc.
http://www.validtec.com
API Hook SDK is a Software Development Kit for hooking Windows 32bit API functions,it will call your own function instead of Windows call some API. API Hook SDK also can hookthe functions in 3rd Appliction's DLL.
Table of contents
Features
File List
Usage
HookFunc project
HookSetup.dll
Compile and run
1. Your own functions have the same form as the API
functions you need to hook, it is easy to use.
2. Hooks process in real time, that means it will install hook just when the
process has created.
3. Takes very little system resource and nearly no CPU time consumed.
HookDemo.exe:
Call HookSetup.dll to Setup API Hook
HookSetup.dll: Setup API Hook DLL
APIHookxp.dll: Win32 API Hook DLL for WINNT/2000/XP
APIHook9x.dll: Win32 API Hook DLL for WIN9X/WINME
HookFunc.dll: Your own DLL include functions that will be called when hook
occurred
APIHook Directory: Source code of Win32 API Hook DLL
ADFilter Directory: Source code of Internet
Advertising Filter example
DESCrypt Directory: Source code of DES Cryptological Library
FileDelphi Directory: Source code of File access hook
function Delphi example
FileHook Directory: Source code of File access hook
function example
HookDemo Directory: Source code of HookDemo program
HookSetup Directory: Source code of API Hook setup
DLL
MsgHook Directory: Source code of system message hook
function example
NetCrypt Directory: Source code of network
transmission crypto function example
ProcHide Directory: Source code of hide process from taskmanager function example
RegHook Directory: Source code of registry hook
function example
SocketDelphi Directory: Source code of socket hook
function Delphi example
SocketHook Directory: Source code of socket hook
function example
Developer only need write the function related with the functions you want to hook, compiled HookFunc.dll, and call install and uninstall function at HookSetup.dll, it will implement the hook.
HookFunc project contain something as below:
1) HookFunc.h, there is only CAPIINFO structure definite in
this file:
#ifndef _HookFunc_h_
#define _HookFunc_h_
typedef struct
{
char *module_name;
char *func_name;
char *c_func_name;
}CAPIINFO;
module_name is the name of a DLL or other
module file name that will be hooked, for example : kernel32.dll
func_name is the function name and
parameters of user’s DLL that will be hooked, like C style format ,for
examples:
connect(SOCKET, struct sockaddr
*, INT)
c_func_name is your own function that called
as the related function hooked, for examples:
cConnect(SOCKET s, struct sockaddr *name, int namelen).
2) Define
CAPIINFO c_api_info[] and fill it, must be NULL in the end, It is the hook
function information, for examples:
CAPIINFO
c_api_info[] = {
{"WSOCK32.DLL", "socket(INT, INT, INT)", "cSocket"},
{"WSOCK32.DLL", "connect(SOCKET, struct
sockaddr *, INT)", "cConnect"},
{"WSOCK32.DLL", "recv(INT, char *,
INT, INT)", "cRecv"},
{"WSOCK32.DLL", "send(INT, char *, INT, INT)", "cSend"},
{"ADVAPI32.DLL", "RegOpenKeyA(HKEY,
LPCSTR, PHKEY)", "cRegOpenKeyA"},
{NULL,NULL,NULL} }; //must contain this
3) Must be define function GetCAPIINFO:
CAPIINFO *GetCAPIINFO()
{ return &c_api_info[0]; }
4) Coding with
user function, for example:
DWORD _cdecl cFuncName(type1 param1, type2, param2, …)
The function
must be defined with WINAPI (in
int WINAPI cConnect(SOCKET s,
struct sockaddr *name, int namelen)
{
struct sockaddr_in *paddr =(struct sockaddr_in *)name;
char *ip =inet_ntoa(paddr->sin_addr);
int port =ntohs(paddr->sin_port);
int ret =connect(s, name, namelen);
int err=WSAGetLastError();
WriteLog("connect: ip=%s,
port=%d, ret=%d\n", ip, port, ret); // check
filter
WSASetLastError(err);
return ret; }
in the
example, we recovery error code, because when we handle with our own procedure,
the error code will change, and the original process could be do next according
to the error code.even cConnect
not call original connect, we must use WSASetLastError
or SetLastError to set error code when cConnect return. Other functions should do as the same.
By the way, in
win9x, it is best to call the original API functions in HookFunc
for HookFunc will call the original dll module, otherwise before call HookFunc,
first use LoadLibrary() to load original dll file in apihook application,
hook could be failed if not do like this sometimes.
5) HookFunc.def contains GetCAPIINFO and users functions exports, for example:
LIBRARY HookFunc
EXPORTS
GetCAPIINFO
@1
cRegOpenKeyA
@2
cRegOpenKeyW
@3
cRegQueryValueA
@4
cRegQueryValueW
@5
cRegQueryValueExA
@6
cRegQueryValueExW
@7
HookSetup.dll contain these functions (refer to HookSetup.h):
Build the APIHook,HookSetup and HookFunc projects, put APIHookxp.dll (or APIHook9x.dll),HookSetup.dll,HookFunc.dll and your application which use the hook functions (e.g. Hookdemo.exe) to the same directory,then run your application, that's done.
Validtec Software, Inc.
http://www.validtec.com
January 28, 2004