This repostiroty contains some tecniques for Windows API Hooking for research and educational purposes only!
The included techniques are:
- Detours Hook (x64/86)
- Trampoline Hook (x64/x86)
- Import Address Table (IAT) Hook (x64/x86)
- Export Address Table (EAT) Hook (x64/x86)
- Treampoline Hook needs a fix when copying the instruction from the original function into the new function address. The addresses in the instructions must be changed, otherwise the hook won't work.
- The TestApp is simply a while statement that contains a call into the MessageBoxA function. In TestApp86.exe, and in a rare case, the visual studio optimizer has stored the original API address in the ESI register which makes the IAT hook useless in that case. As a result, I compiled another version after turning off the optimizer (TestApp86OptOff.exe) to validate the hook results!
- EAT hook won't work for x64 bits because the relative addresses in EAT are 4 bytes for both x32 and x64 bits PE files. As a result, a jump instruction has been created in the same targeted module that is being hooked which will solve the issue.
BTC: bc1q2kqvggm552h0csyr0awa2zepdapxdqnacw0z5w
