Exetools - C++ Hooking - Write Less Do More

Exetools (https://forum.exetools.com/index.php)

- Source Code (https://forum.exetools.com/forumdisplay.php?f=46)

- - C++ Hooking - Write Less Do More (https://forum.exetools.com/showthread.php?t=20738)

vic4key

11-07-2023 12:12

C++ Hooking - Write Less Do More

With this library, you can set up function hooking easily and write less code.
It supports both Inline hooking & IAT hooking on both 32-bit & 64-bit.

Eg. To hook/un-hook a function with the Inline Hooking technique, you only need to write codes as the following

Code:

#include "cpp-hooking/hooking.h"



// Define the hooking function

int WINAPI hkMessageBoxW(HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uType)

{

  lpText = L"INL Hooked";

  return INLHookingManager::instance().invoke&lt;int&gt;(MessageBoxW, hWnd, lpText, lpCaption, uType);

}



// Perform hooking

INLHookingManager::instance().hook(MessageBoxW, hkMessageBoxW);



// Perform un-hooking

INLHookingManager::instance().unhook(MessageBoxW);

Eg. To hook/un-hook a function with the IAT Hooking technique, you only need to write codes as the following

Code:

#include "cpp-hooking/hooking.h"



// Define the hooking entry

#define Entry_MessageBoxW { "cpp-hooking.exe"s, "user32.dll"s, "MessageBoxW"s }



// Define the hooking function

int WINAPI hkMessageBoxW(HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uType)

{

  lpText = L"IAT Hooked";

  return IATHookingManager::instance().invoke&lt;int&gt;(Entry_MessageBoxW, hWnd, lpText, lpCaption, uType);

}



// Perform hooking

IATHookingManager::instance().hook(Entry_MessageBoxW, hkMessageBoxW);



// Perform un-hooking

IATHookingManager::instance().unhook(Entry_MessageBoxW);

The repository @ https://github.com/vic4key/cpp-hooking.git

Follow me on GitHub @ https://github.com/vic4key

Regards,
Vic P.

wilson bibe

11-07-2023 14:26

Hello, is it possible for someone publish the compiled version of this tool? Thanks in advance

blue_devil

11-07-2023 14:32

Hello vic4key, you have an awesome repo. Once, I have created a thread for sharing our socials (not only twitter&instagram but github&gitlab or other similar accounts)
Socials

If you want you can share your socials on this thread.

Regards

blue_devil

11-07-2023 14:37

Quote:

Originally Posted by wilson bibe (Post 129063)

Hello, is it possible for someone publish the compiled version of this tool? Thanks in advance

But @wilson, this repo is only contains header files. You create a project and add this header files to you solution; and then start hooking-unhooking! You do not need a compiled version of it! Am I right @vic4key?

vic4key

11-07-2023 15:10

Quote:

Originally Posted by blue_devil (Post 129065)

Yes. You're right. But these header files required Vutils library as its hooking backend.
And install Vutils library is very easy and quick, just checkout/download and double-click to run 2 batch file .cmd inside `Vutils\tools` folder to complete.

Refer to https://github.com/vic4key/Vutils#installation

sendersu

11-07-2023 16:50

batch files have got some hardcoded pathes
in my case VS is installed into other path,
is it possible to deduce it from the env the real install pathes?

SET VU_VSDEV=%ProgramFiles(x86)%\Microsoft Visual Studio\%VU_VSVER%\%%L\Common7\Tools\VsDevCmd.bat

vic4key

11-07-2023 18:02

Can you gimme the path in your case?
Thanks for feedback. I will check and update the script to make it more common.

sendersu

11-07-2023 19:18

well, I mean it might be any
in my case it is D:\dev\vs2019 :)

chants

11-12-2023 09:17

Yes and VS2022 is no longer x86 with an x64 IDE. One reason I like CMake is not just it's portability but that it has all the strategies to detect all different compilers even on Windows to build with. Providing a CMakeLists.txt in projects is very convenient to make it easy for anyone to configure and build.

vic4key

11-14-2023 14:25

Quote:

Originally Posted by chants (Post 129179)

Actually, I'm not a fan of CMake. CMake is portability, but it needs too many steps to finish, and only build for a specified arch at once (cannot generate for both Win & x64, or maybe I don't know how to do that).

I targeted only using for Win32/x64/MinGW. So, I wrote a batch file to build all at once (x86, x64, MT/MTd, MD/MDd). And then, just one-click to finish. I believe it much easier and simpler than CMake.

BTW, I will update the batch file to fix the bug when I get free time.

chants

11-15-2023 02:38

Yes if you are targetting a specific set of architectures and compilers would not argue it is more efficient to use simpler build methods.

But if you want to write something with library quality usefulness then being independent of these things is important. Different configurations should require different builds if being totally generic.

You are likely locked into the Microsoft ecosystem. But at this day and age that is rather niche. Professional programmers can go cross architecture and cross platform and cross compiler quite readily.

Getting off topic though, for this project which is very Windows specific, of course CMake is overkill. But there are still several of C compilers on Windows, MSVC isn't the only possibility.

The main point is these batch file type issues are completely solved by modern build tools. Whereas making a project that can be shared and built without any issues isn't so easy with custom build processes.

sendersu

11-15-2023 03:43

so how to instruct cmake to use clang/gcc and not msvc?
in this specific case

chants

11-15-2023 04:18

I mean I suppose using Ninja is best in this case and something along the lines of:

Quote:

cmake -B build -S . -DCMAKE_CXX_COMPILER:FILEPATH="C:/Program Files/LLVM/bin/clang.exe" -DCMAKE_C_COMPILER:FILEPATH="C:/Program Files/LLVM/bin/clang.exe" -DCMAKE_LINKER:FILEPATH="C:/Program Files/LLVM/bin/lld-link.exe" -G"Ninja" -DCMAKE_EXPORT_COMPILE_COMMANDS=1

vic4key

11-15-2023 11:48

Quote:

cross architecture and cross platform and cross compiler quite readily.

@chants Absolutely, I got it. In this case, I will use CMake for sure.

Quote:

Getting off topic though, for this project which is very Windows specific, of course CMake is overkill. But there are still several of C compilers on Windows, MSVC isn't the only possibility.

@chants My library is only targeting to MSVC & MinGW compilerr. I did not test and check for other compilers. I mentioned at https://github.com/vic4key/Vutils#information

tianmuxia

01-06-2024 10:12

maybe minhook is more useful for unknow functions?

vic4key

03-25-2024 11:40

Quote:

Originally Posted by tianmuxia (Post 129830)

maybe minhook is more useful for unknow functions?

It works fine with unknown functions. Just use a unique constant instead of function pointer.

user1

03-26-2024 13:40

any example for C hooking CreateFileMapping, OpenFileMapping and MapViewOfFile ?

vic4key

03-26-2024 14:40

Quote:

Originally Posted by user1 (Post 130448)

any example for C hooking CreateFileMapping, OpenFileMapping and MapViewOfFile ?

For quick, Copilot can help you.

https://copilot.microsoft.com/sl/kUEeCAMEU6m (CreateFileMapping)
https://copilot.microsoft.com/sl/iGq8ESNUtWu (OpenFileMapping and MapViewOfFile)

Note: Not tested. But give a try and update a little bit if error.

user1

03-26-2024 17:30

thanks copilot, will do my way with vs2010 minhook compatible.

NON	04-02-2024 19:31

Quote:

Originally Posted by vic4key (Post 130449)

But for copilot we need paid or a credit card to be added? That is not so safe since the Microsoft can then identify us if they need.

vic4key

04-05-2024 10:03

No. It's fully free. No required anything that related to privacy.

NON	04-06-2024 23:54

Quote:

Originally Posted by vic4key (Post 130577)

No. It's fully free. No required anything that related to privacy.

Do you have a company or student subscription?

It is only free for verified students, teachers, and maintainers of popular open source projects.
Check here under Pricing: https://github.com/features/copilot

vic4key

04-08-2024 11:54

Ah no. I'm talking about Microsoft's Copilot. Not GitHub's Copilot. 😁

https://copilot.microsoft.com/

NON	04-11-2024 16:13

Quote:

Originally Posted by vic4key (Post 130596)

Ah no. I'm talking about Microsoft's Copilot. Not GitHub's Copilot. ��

https://copilot.microsoft.com/

Ok... Even the microsoft copilot requires login using microsoft account but at least that can be faked!
By faking, I mean creating a fake microsoft login account which does not have your real name in the email id, etc.

chants

04-13-2024 06:57

Quote:

Originally Posted by Gregory Morse (Post 130620)

Ok... Even the microsoft copilot requires login using microsoft account but at least that can be faked!

Perhaps. What cannot be faked is knowledge. Such as the fact that you can download code from github, train your own LLM and run inference on it to achieve a similar result. You see? You learn something new everyday. Granted training requires a high amount of computational and memory resources.

All times are GMT +8. The time now is 16:41.