Пример #1
0
        public override void InstallHook()
        {
            sendHook = LocalHook.Create(
                LocalHook.GetProcAddress("Ws2_32.dll", "send"),
                new Dsend(send_Hooked),
                this.Injector);
            sendHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });

            sendtoHook = LocalHook.Create(
                LocalHook.GetProcAddress("Ws2_32.dll", "sendto"),
                new Dsendto(sendto_Hooked),
                this.Injector);
            sendtoHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });

            recvHook = LocalHook.Create(
                LocalHook.GetProcAddress("Ws2_32.dll", "recv"),
                new Drecv(recv_Hooked),
                this.Injector);
            recvHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });
            recvFunc = LocalHook.GetProcDelegate <Drecv>("Ws2_32.dll", "recv");

            recvfromHook = LocalHook.Create(
                LocalHook.GetProcAddress("Ws2_32.dll", "recvfrom"),
                new Drecvfrom(recvfrom_Hooked),
                this.Injector);
            recvfromHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });
            recvfromFunc = LocalHook.GetProcDelegate <Drecvfrom>("Ws2_32.dll", "recvfrom");
        }
Пример #2
0
        public static TDelegate GetProcDelegate <TDelegate>(string hookedModule, string function)
        {
            TDelegate result = default(TDelegate);

            TryNames <TDelegate>(function, (name) => result = LocalHook.GetProcDelegate <TDelegate>(hookedModule, name));

            return(result);
        }
Пример #3
0
        public static LocalHook SetupHook <TDelegate>(string function, string hookedModule, Func <TDelegate, TDelegate> hookProcedure, object callback = null)
        {
            LocalHook hook = null;

            TryNames <TDelegate>(function, (name) => hook = LocalHook.Create(
                                     LocalHook.GetProcAddress(hookedModule, name),
                                     hookProcedure(LocalHook.GetProcDelegate <TDelegate>(hookedModule, name)) as Delegate,
                                     callback)
                                 );

            hook.ThreadACL.SetExclusiveACL(new[] { 0 });

            return(hook);
        }
Пример #4
0
        TOriginalDelegate InterceptUser32Method <TOriginalDelegate>(string methodName, TOriginalDelegate callback)
        {
            _interface.DebugWriteLine("Intercepting " + methodName + ".");

            const string library = "user32.dll";

            var originalDelegate = LocalHook.GetProcDelegate <TOriginalDelegate>(
                library,
                methodName);

            var hook = LocalHook.Create(
                LocalHook.GetProcAddress(library, methodName),
                (Delegate)(object)callback,
                null);

            hook.ThreadACL.SetExclusiveACL(new int[] { });

            return(originalDelegate);
        }
Пример #5
0
        public override void InstallHook()
        {
            CreateFileHook = LocalHook.Create(
                LocalHook.GetProcAddress("kernel32.dll", "CreateFileW"),
                new DCreateFile(CreateFile_Hooked),
                this.Injector);
            ReadFileHook = LocalHook.Create(
                LocalHook.GetProcAddress("kernel32.dll", "ReadFile"),
                new DReadFile(ReadFile_Hooked),
                this.Injector);

            WriteFileHook = LocalHook.Create(
                LocalHook.GetProcAddress("kernel32.dll", "WriteFile"),
                new DWriteFile(WriteFile_Hooked),
                this.Injector);

            CreateFileHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });
            WriteFileHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });
            ReadFileHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });

            ReadFileFunc = LocalHook.GetProcDelegate <DReadFile>("kernel32.dll", "ReadFile");
        }