APIHijack - A Library for Easy DLL Function Hooking.

WEBINAR: On-demand webcast

How to Boost Database Development Productivity on Linux, Docker, and Kubernetes with Microsoft SQL Server 2017 REGISTER >

Based on DelayLoadProfileDLL.CPP, by Matt Pietrek for MSJ February 2000. This code is intended to be included in a DLL inserted through a global Windows Hook (CBT hook for example). It will replace functions from other DLLs (e.g. DDRAW.DLL) with functions from your DLL.

Functions are hooked by passing a parameter structure to the HookAPICalls() function as follows:

// Hook structure.
SDLLHook D3DHook = 
{
 "DDRAW.DLL",
 false, NULL, // Default hook disabled, NULL function pointer.
 {
  { "DirectDrawCreate", MyDirectDrawCreate },
  { NULL, NULL }
 }
};

BOOL APIENTRY DllMain( HINSTANCE hModule, 
                       DWORD fdwReason, 
                       LPVOID lpReserved )
{
 // When initializing....
 if ( fdwReason == DLL_PROCESS_ATTACH )  
 {
  hDLL = hModule;

  // We don't need thread notifications for what we're doing.
  // Thus, get rid of them, thereby eliminating some of the 
  // overhead of this DLL
  DisableThreadLibraryCalls( hModule );

  // Only hook the APIs if this is the Everquest process.
  GetModuleFileName( GetModuleHandle( NULL ), 
                     Work, 
                     sizeof(Work) );
  PathStripPath( Work );

  if ( stricmp( Work, "myhooktarget.exe" ) == 0 )
   HookAPICalls( &D3DHook );
 }

 return TRUE;
}

Now all that remains is to get your DLL loaded into the target process. The MSDN has a few good articles on Windows hooks, which are the preferred way to get an arbitrary DLL loaded into a process:

http://msdn.microsoft.com/library/techart/msdn_hooks32.htm

Also, the article from which this code is based shows another way to do it, which involves loading the process to be hooked as a debug target:

http://msdn.microsoft.com/library/periodic/period00/hood0200.htm

Downloads

Download source code and demo project - 102 Kb


Comments

  • problem in hooking ntshrui.dll apis

    Posted by sameen_f on 07/01/2009 06:35am

    hi, i have tried this code it is working fine but when i tired to hook other apis then it showed no output...i need help in how to hook apis from ntshrui.dll....or is there any need for any kind of driver with the given source code...

    Reply
  • APIHijack for IDirect3D8::CreateDevice ????

    Posted by boonchait on 12/04/2004 03:08pm

    How can i set APIHijack for IDirect3D8::CreateDevice.

    Reply
  • can't highjack TextOut well from gdi32.dll

    Posted by Legacy on 02/12/2004 12:00am

    Originally posted by: Benjamin Gao

    when i highjack TextOut function in notepad.exe or wordpad.exe,nothing happened.
    not TextOut you wnat to TextOutA and TextOutW

    Reply
  • how can I hook Com ports in Win2000,WinXP?

    Posted by Legacy on 02/04/2004 12:00am

    Originally posted by: Gokay Gursoy

    Dear Sir/Madam
    How can I hook com ports (Com1/Com2) in Win2000/WinXP?
    I want to see data incoming and data outgoing from my com1
    and com2.I would be very pleased if you send me some delphi
    source about this.
    Best Regards
    Gokay Gursoy

    Reply
  • How do i Hook WM_CHAR in WinXP?

    Posted by Legacy on 01/30/2004 12:00am

    Originally posted by: uqtur

    Hello !
    I write a hook with VC 6.0 in Win2K and it worked .
    but in Win XP It dosn't worked functionally.
    my purpose is display some UNICODE characters in
    correctly with this HOOK.can any one help me?

    thank you .
    ////

    static LRESULT WINAPI MyApp ( int nCode, WPARAM wParam, LPARAM lParam)
    {
    ...

    pwszKLID=malloc(10);
    msg=(LPMSG)lParam;
    //
    switch (msg->message)
    {
    case WM_KEYDOWN:
    My6=msg->wParam;
    GetKeyboardState(st);
    break;
    case WM_CHAR:
    {
    if ((msg->wParam)==63) //can't display correctly ,replace with '?'
    {
    switch (My6)
    {
    case 71://g
    SendMessage(msg->hwnd,WM_CHAR,234,0);
    PostMessage(msg->hwnd,WM_KEYDOWN,8,0);
    break;
    case 73://i
    SendMessage(msg->hwnd,WM_CHAR,188,0);
    PostMessage(msg->hwnd,WM_KEYDOWN,8,0);
    break;
    ....
    }
    }
    break;
    }
    }
    //
    lResult = CallNextHookEx(g_hhook, nCode, wParam, lParam);
    return(lResult);
    }

    ////

    Reply
  • Error when compile

    Posted by Legacy on 01/28/2004 12:00am

    Originally posted by: BigWizard

    Deleting intermediate files and output files for project 'TestDLL - Win32 Debug'.
    --------------------Configuration: TestDLL - Win32 Debug--------------------
    Compiling...
    apihijack.cpp
    c:\temp\3\apihijack.cpp(158) : error C2440: '=' : cannot convert from 'unsigned long' to 'void *'
    Conversion from integral type to pointer type requires reinterpret_cast, C-style cast or function-style cast
    c:\temp\3\apihijack.cpp(196) : error C2440: '=' : cannot convert from 'unsigned long *' to 'unsigned long'
    This conversion requires a reinterpret_cast, a C-style cast or function-style cast
    c:\temp\3\apihijack.cpp(203) : error C2446: '>' : no conversion from 'unsigned long *' to 'unsigned long'
    This conversion requires a reinterpret_cast, a C-style cast or function-style cast
    c:\temp\3\apihijack.cpp(203) : error C2040: '>' : 'unsigned long' differs in levels of indirection from 'unsigned long *'
    c:\temp\3\apihijack.cpp(204) : error C2440: '=' : cannot convert from 'unsigned long *' to 'unsigned long'
    This conversion requires a reinterpret_cast, a C-style cast or function-style cast
    dllmain.cpp
    Error executing cl.exe.

    TestDLL.dll - 5 error(s), 0 warning(s)

    Reply
  • How do i hook a API that exported with ordinal rather than Name,certenly,I know it's protype!

    Posted by Legacy on 01/23/2004 12:00am

    Originally posted by: Hellow

    How do i hook a API that exported with ordinal rather than Name,certenly,I know it's protype!
    

    Reply
  • How to hook DLL outside windows \ system32

    Posted by Legacy on 08/30/2003 12:00am

    Originally posted by: Martijn

    I'm not succeeding in hooking a DLL which contains a path. 
    
    I need this because my DLL name conflicts with one that
    exists in windows\system32 directory. i've modified the
    struct like this:

    SDLLHook MYHook = {
    "C:\\123\\abc\\abc.dll",
    false, NULL,
    {
    { "NormalOut", MyNormalOut },
    { NULL, NULL }
    }
    };

    Is there anything else I need to do that I'm missing here?

    Reply
  • Problem with directx games

    Posted by Legacy on 06/11/2003 12:00am

    Originally posted by: twinsen

    It does not work for games. The hooking bit works in DllMain but the MyDirectDrawCreateEx never gets run even though I know a particular game uses DirectDrawCreateEx. The only way I know of detecting DirectDrawCreateEx in a game is using DX spy. However I really need more control (source code). Too bad this one doesn't work. Perhaps its because most games call loadlibrary dynamically like someone else said. It would be wonderful if someone could make another version that works with more situations. At "http://yodas.reverse-engineering.info/proggies.htm"; softsnoop has source code and does a few things with dynamic loading dlls. Once again it doesn't work with directx games, but perhaps it may help people.

    Reply
  • How to do dynamic LoadLibrary dlls (works for games)

    Posted by Legacy on 06/11/2003 12:00am

    Originally posted by: twinsen

    These are the ways to do this type of thing:
    
    * Replace the DLL
    Problem: DLLs can contain undocumented export entries
    * Replace the process' Import Address Table - The way you did it
    Problem: fails with dynamic LoadLibrary
    * Hook into the remote DLL code
    Problem: don't always know compiler of dll, assumptions may be wrong (stack frame setup code is different)

    I prefer the 3rd method when targeting specific calls since all games I have tested do dynamic LoadLibrary. There is a good tutoiral on how to do this (with source) at http://home.worldonline.dk/viksoe/wepmetering.htm for winsock. I modified theirs to work with the directX DirectDrawCreateEx and got it to work for your bend program and the vietcong demo (a game that can run in window mode and I found to be a good testing ground). The stack frame setup code was damn annoying but eventually I worked it out by guessing numbers :). Eventually I want to intercept most of the useful directx commands and try to do things like rip out textures from memory. If anyone can think of someone who has done stuff like that please tell me.

    Reply
  • Loading, Please Wait ...

Leave a Comment
  • Your email address will not be published. All fields are required.

Top White Papers and Webcasts

  • Microsoft Azure® is a leading choice for businesses looking to take advantage of the cloud. Azure is particularly appealing to businesses that have already invested in Microsoft on-premises and are now considering running these applications and other workloads in the cloud. To understand how to make this move to Azure, many businesses are turning to managed service providers (MSPs) with specific Azure expertise. Read this white paper to learn the eight key areas to focus on when considering an MSP for an …

  • The software-defined data center (SDDC) and new trends in cloud and virtualization bring increased agility, automation, and intelligent services and management to all areas of the data center. Businesses can now more easily manage the entire lifecycle of their applications and services via the SDDC. This Aberdeen analyst report examines how a strong foundation in both the cloud and internal data centers is empowering organizations to fully leverage their IT infrastructure and is also preparing them to be able …

Most Popular Programming Stories

More for Developers

RSS Feeds

Thanks for your registration, follow us on our social networks to keep up-to-date