Introduction to API Hooking

To find interesting calls to Windows API from a process we can use API Monitor.

• http://www.rohitab.com/downloads

Detour

Detour is a Windows framework that offers dynamic application of interception code at runtime. With detour we can create a dll which will be injected on the process we want to hook. We can use that lib to do API Hooking.

• DetourTransactionBegin()
• DetourUpdateThread()
• DetourAttach()
• DetourDettach()

Once the hooked function is called, Detour will redirect the flow to our function. Usefull to log, modify or bypass some restrictions.

Code

Example of windows api hooking with Detour:

#include <stdio.h>
#include <windows.h>
#include "detours.h"
#pragma comment(lib, "user32.lib")

// pointer to original MessageBox
int (WINAPI * pOrigMessageBox)(HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption, UINT uType) = MessageBox;

BOOL Hookem(void);
BOOL UnHookem(void);

// Hooking function
int HookedMessageBox(HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption, UINT uType) {

    printf("HookedMessageBox() called!\n");
    pOrigMessageBox(hWnd, "TESTING WITH HOOKS", "RTNOTES", uType);
    return IDOK;
}

// Set hooks on MessageBox
BOOL Hookem(void) {

    LONG err;

    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourAttach(&(PVOID&)pOrigMessageBox, HookedMessageBox);
    err = DetourTransactionCommit();

    printf("MessageBox() hooked!\n", err);

    return TRUE;
}

// Revert all changes to original code
BOOL UnHookem(void) {

    LONG err;

    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourDetach(&(PVOID&)pOrigMessageBox, HookedMessageBox);
    err = DetourTransactionCommit();

    printf("Hook removed from MessageBox()\n", err);

    return TRUE;
}

BOOL WINAPI DllMain(HINSTANCE hinst, DWORD dwReason, LPVOID reserved) {

    switch (dwReason)  {
        case DLL_PROCESS_ATTACH:
            Hookem();
            break;
        case DLL_THREAD_ATTACH:
            break;
        case DLL_THREAD_DETACH:
            break;
        case DLL_PROCESS_DETACH:
            UnHookem();
            break;
    }
    return TRUE;
}