Welcome！[Sign In] ！[Sign Up]！
Front-page it | Collect it | [中国-简体中文]
FAQ Fav
Location:
Search - inline hook api

Search list

[Hook api] HookLibrary

Description: Hook Api Library 0.2 [Ring0&3] By Anskya Email:Anskya@Gmail.com ring3 inline hook For Api Thank: 前29A高手也一直都是我的偶像...z0mbie大牛...这里膜拜一下 使用的LDE32引擎是翻译他老人家的...C->Delphi... 说明: 1.利用堆栈跳转 没有使用传统的jmp xxxx 长跳转,使用容易理解的push xxxx+ret 仔细看代码容易理解...封装完好. 2.内存补丁结构: 补丁1:|push xxx--钩子处理过程|ret| 补丁2:|保存原始补丁地址|保存原始地址代码长度|原始地址的代码|push xxxxxx|ret| 更新说明: 0.2: 支持Ring0 Inline Hook 0.1: Ring3 Inline Hook
Platform: | Size: 6347 | Author: david | Hits:

[Hook api] HookLibrary

Description: Hook Api Library 0.2 [Ring0&3] By Anskya Email:Anskya@Gmail.com ring3 inline hook For Api Thank: 前29A高手也一直都是我的偶像...z0mbie大牛...这里膜拜一下 使用的LDE32引擎是翻译他老人家的...C->Delphi... 说明: 1.利用堆栈跳转 没有使用传统的jmp xxxx 长跳转,使用容易理解的push xxxx+ret 仔细看代码容易理解...封装完好. 2.内存补丁结构: 补丁1:|push xxx--钩子处理过程|ret| 补丁2:|保存原始补丁地址|保存原始地址代码长度|原始地址的代码|push xxxxxx|ret| 更新说明: 0.2: 支持Ring0 Inline Hook 0.1: Ring3 Inline Hook -Hook Api Library 0.2 [Ring0
Platform: | Size: 6144 | Author: david | Hits:

[OS program] CeApiSpy_07-18-2005

Description: Windows CE API hook application~
Platform: | Size: 111616 | Author: 萧董 | Hits:

[Hook api] ring3_inline_hook_demo

Description: tat hook api 在一个文件中对自身调用的api进行hook的一个例子。-tat hook api in a document of its own hook to call api
Platform: | Size: 7168 | Author: 王奎 | Hits:

[Hook api] interept

Description: API拦截-现在了对指定API的拦截。使用了进程注入和inline hook等方法-api interept
Platform: | Size: 737280 | Author: 周杰伦 | Hits:

[Driver Develop] Kehook

Description: 对于hook，从ring3有很多，ring3到ring0也有很多，根据api调用环节递进的顺序，在每一个环节都有hook的机会，可以有int 2e或者sysenter hook，ssdt hook，inline hook ，irp hook，object hook，idt hook-The hook, from ring3 there are many, ring3 to ring0 there are many, according to api call progressive sequence of links, each link in the opportunity to have a hook, you can have int 2e or sysenter hook, ssdt hook, inline hook, irp hook, object hook, idt hook, etc.
Platform: | Size: 1869824 | Author: 王小明 | Hits:

[Hook api] Hook_CreateFile

Description: inline hook 实例 hook CreateFile 前五个字节的例子-The example of inline hook CreateFile
Platform: | Size: 81920 | Author: 韩挚同 | Hits:

[Hook api] inline-hook

Description: 1． Hook之前的准备工作之一。 在这个软件中，总共hook了15个native api 函数。他们分别是： ZwOpenKey , ZwClose, ZwQueryValueKey, ZwDeleteKey, ZwSetValueKey, ZwCreateKey, ZwDeleteValueKey. ZwEnumerateValueKey,ZwRestoreKey, ZwReplaceKey, ZwTerminateProcess, ZwSetSecurityObject, ZwCreateThread, ZwTerminateThread, ZwQuerySystemInformation-1. Hook one of the preparatory work before. In this software, a total of 15 native api hook function. They are: ZwOpenKey, ZwClose, ZwQueryValueKey, ZwDeleteKey, ZwSetValueKey, ZwCreateKey, ZwDeleteValueKey. ZwEnumerateValueKey, ZwRestoreKey, ZwReplaceKey, ZwTerminateProcess, ZwSetSecurityObject, ZwCreateThread, ZwTerminateThread, ZwQuerySystemInformation
Platform: | Size: 7168 | Author: wu | Hits:

[Hook api] inlinehook_v1.1_by_solosky

Description: Inline HOOK API V1.1 thanks to 海风月影, xIkUg ,sucsor by solosky <solosky772@qq.com> created at 2011.06.29, updated at 2011.06.30 ---------------------------------- Inline HOOK API V1.1 2011.06.30 ---------------------------------- 1. 修复没有判断申请空间是否成功的BUG； 2. 修复释放内存的参数错误的BUG； ---------------------------------- Inline HOOK API V1.0 2011.06.29 ---------------------------------- 1. HOOK任何函数，仅需知道原型和调用方式即可（可以HOOK对象方法，但需要保存和恢复this指针） 2. UnHOOK已经HOOK的函数 感谢海风月影提供的反汇编长度引擎-Inline HOOK API V1.1 thanks to the sea love affair film, xIkUg, sucsor by solosky <solosky772@qq.com> created at 2011.06.29, updated at 2011.06.30---------------------------------- Inline HOOK API V1. 1 2011.06.30---------------------------------- 1 repair application space does not determine the success of BUG 2 fixed parameters of free memory error BUG ---------------------------------- Inline HOOK API V1. 0 2011.06.29---------------------------------- 1. HOOK any function, just know that the prototype and call way you can (you can HOOK object methods, but need to save and restore this pointer) 2. UnHOOK has a function to thank the sea HOOK film Temptress Moon provided the length of the engine disassembly! !
Platform: | Size: 5120 | Author: money | Hits:

[OS program] XueTr

Description: 1.进程、线程、进程模块、进程窗口、进程内存信息查看，热键信息查看，杀进程、杀线程、卸载模块等功能 　　2.内核驱动模块查看，支持内核驱动模块的内存拷贝 　　3.SSDT、Shadow SSDT、FSD、KBD、TCPIP、IDT信息查看，并能检测和恢复ssdt hook和inline hook 　　4.CreateProcess、CreateThread、LoadImage、CmpCallback、BugCheckCallback、Shutdown、Lego等Notify Routine信息查看，并支持对这些Notify Routine的删除 　　5.端口信息查看，目前不支持2000系统 　　6.查看消息钩子 　　7.内核模块的iat、eat、inline hook、patches检测和恢复 　　8.磁盘、卷、键盘、网络层等过滤驱动检测，并支持删除 　　9.注册表编辑 -1 process, thread, process modules, process window, process memory information viewing, hot information to view, kill the process, kill thread, unload the module and other functions 2 kernel driver module view, to support the kernel driver module memory copy 3.SSDT, Shadow SSDT, FSD, KBD, TCPIP, IDT information view, and can detect and recover ssdt hook and inline hook 4.CreateProcess, CreateThread, LoadImage, CmpCallback, BugCheckCallback, Shutdown, Lego, etc. Notify Routine Information check, and to support their Notify Routine Delete 5 port information view, the current system does not support 2000 6 view news hook 7 kernel module iat, eat, inline hook, patches detection and recovery 8 disk, volume, keyboard, network layer filter driver detect, and support for the deletion 9. Registry Editor
Platform: | Size: 3696640 | Author: 接收 | Hits:

[OS program] kssd-rootkit

Description: 看雪学院Rootkit学习，1.内核Hook:对于hook，从ring3有很多，ring3到ring0也有很多，根据api调用环节递进的顺序，在每一个环节都有hook的机会，可以有int 2e或者sysenter hook，ssdt hook，inline hook ，irp hook，object hook，idt hook-See snow Institute Rootkit learning, kernel Hook: hook from ring3 many, ring3 to ring0 also the api call progressive order, every link has the opportunity to hook int 2e or sysenter. hook, ssdt hook, inline hook, irp hook, object hook, idt hook, etc.
Platform: | Size: 1652736 | Author: stars | Hits:

[Hook api] 4PHOOK

Description: 支持对API进行InlineHook，以及对InlineHook的检测和恢复-Support for the API Inline Hook, as well as the detection and recovery of Inline Hook
Platform: | Size: 16384 | Author: Saul | Hits:

[Delphi VCL] delphi HOOK 技术

Description: delphi hook dll案例, 论坛里有关于HOOK API的贴子， 但其实现在方式显示得麻烦， 其实现在拦截API一般不用那种方式， 大都采用inline Hook API方式。其实也就是直接修改了要拦截的API源码的头部，让它无条件跳转到我们自己的处理过程。(There are HOOK API posts on the forum, but in fact, the way it is showing is troublesome. In fact, interception of API is usually not in that way. Most of them are inline Hook API. In fact, it is directly to modify the API source to intercept the head, let it unconditionally jump to our own processing process.)
Platform: | Size: 278528 | Author: lj123456_ | Hits:

CodeBus www.codebus.net