[Question] C++ Global Hooking APIs

[PoZHx]

How would i go about Globally Hooking API's?
Would i have to inject every process? or is there a better method?
I know how to do local hooks via DLL using MSDetours 1.5

Thanks

[g3nuin3]

Only one i know is SetWindowsHooks API's. Take a look a look at those, although they have one drawback, in which youd need to restart the pc before it takes affect.. You pretty much register your DLL into the system registry (forgot which one) and the OS will handle putting your dll into every running process in the system.

[PoZHx]

Quote Originally Posted by g3nuin3

Only one i know is SetWindowsHooks API's. Take a look a look at those, although they have one drawback, in which youd need to restart the pc before it takes affect.. You pretty much register your DLL into the system registry (forgot which one) and the OS will handle putting your dll into every running process in the system.

I'll search up on SetWindowsHook API's
I've used simple test for Keyboard and didn't require reboot while back

If i do need injecting every procss that will be no problem ..
I'll use CreateToolhelp32Snapshot to view every running process and inject them all
Thanks for reply

[Letters]

Inject a dll into every process is pretty messy, and you still have to keep your process running,
what exactly do you want to do?

For most things Mini Filters and drivers will do a cleaner job, and as for them, you got some great code pieces in CE + OSR registration is free, and those guys seriously rock.

--Edit: Okay you said your pretty buddy with detours, so advicing you to write a driver is maybe a bit ahead...

The main advantage on set window hook ex is that you define a DLL with a callback to be inserted into a hook chain.

Quote

The SetWindowsHookEx function installs an application-defined hook procedure into a hook chain. You would install a hook procedure to monitor the system for certain types of events. These events are associated either with a specific thread or with all threads in the same desktop as the calling thread.

Now, you could compile 2 ressource files into your main pogramm - an loader and a dll - copy those to into the system folder, for example, and then place an autostart record for your loader to make it load your dll into the hookchain at every boot. So you dont have to keep your programm running whilst you still can inject all programms beeing started / running.

References: HOOK - A HowTo for setting system wide hooks — CodeGuru.com
CodeProject: API hooking revealed. Free source code and programming help
CodeProject: Hooks and DLLs. Free source code and programming help
CodeProject: Writing a Macro Recorder/Player using Win32 Journal Hooks. Free source code and programming help

[PoZHx]

Couldn't really work out global hooking API's using SetWindowsHookEx but il keep searching

Quote Originally Posted by Letters

Inject a dll into every process is pretty messy, and you still have to keep your process running,
what exactly do you want to do?

For most things Mini Filters and drivers will do a cleaner job, and as for them, you got some great code pieces in CE + OSR registration is free, and those guys seriously rock.

Basically I'm starting off on making some simple security applications
Also unfortunately i've never coded a driver or nor how to make a driver so that idea is out of the window >.< lol

I'll check out OSR website see if i can find any useful info thanks

[Letters]

Quote Originally Posted by PoZHx

Couldn't really work out global hooking API's using SetWindowsHookEx but il keep searching



Basically I'm starting off on making some simple security applications
Also unfortunately i've never coded a driver or nor how to make a driver so that idea is out of the window >.< lol

I'll check out OSR website see if i can find any useful info thanks

i was finished editing my topic ( i tend to edit alot :P ) just after you answered, posted some reference for the case you still havent found what you were looking for

ah lol OO

this was supposed to be a pm >_>

[mitro]

Hi,

I´m new to the community... but maybe I have something interesting on that topic...
Dll Injection

hopefully it helps.

regards,
mitro

[iPromise]

Quote Originally Posted by g3nuin3

Only one i know is SetWindowsHooks API's. Take a look a look at those, although they have one drawback, in which youd need to restart the pc before it takes affect.. You pretty much register your DLL into the system registry (forgot which one) and the OS will handle putting your dll into every running process in the system.

WH_CBT hook.

[PhreakMe]

This is an interesting goal you have set for yourself. I'm sure as you know in the example of using GetKeyState you can see if a key was pressed in any application. Is this what you mean by global? Because, you could make a lengthy program that dumps the return status of all desired APIs quite easily.

Code:

cout<<GetKeyState; // returns the last key pressed
cout<<GetKeyState(0x41) // returns a 1 or 0 for success or failure of the A key being pressed

You could do this with virtually any API although much better to use mASM where you can simply do a TEST EAX,EAX on any API you CALL for it's return value.

In further example you dump say the parameters of LoadLibraryA in any loaded application (via window or proccess rotation) and dump the name of the .DLLs that each executable loads into itself. Does this make sense?

This all being said, you could always debug your own application and set breakpoints on each API yourself! Kekeke

[PoZHx]

Quote Originally Posted by PhreakMe

This is an interesting goal you have set for yourself. I'm sure as you know in the example of using GetKeyState you can see if a key was pressed in any application. Is this what you mean by global? Because, you could make a lengthy program that dumps the return status of all desired APIs quite easily.

Code:

cout<<GetKeyState; // returns the last key pressed
cout<<GetKeyState(0x41) // returns a 1 or 0 for success or failure of the A key being pressed

You could do this with virtually any API although much better to use mASM where you can simply do a TEST EAX,EAX on any API you CALL for it's return value.

In further example you dump say the parameters of LoadLibraryA in any loaded application (via window or proccess rotation) and dump the name of the .DLLs that each executable loads into itself. Does this make sense?

This all being said, you could always debug your own application and set breakpoints on each API yourself! Kekeke

I think you misunderstood my problem.
I wanted to inject my DLL into every process not capture key presses or set BP's but thanks for posting
I solved this issue already.

[PhreakMe]

I only used those two as examples =p what you just said is much easier to do then what i was talking about, glad you figured it out.