Skip to content

Instantly share code, notes, and snippets.

@jocopa3
Last active March 4, 2016 19:51
Show Gist options
  • Save jocopa3/256f5378b40a729b03fe to your computer and use it in GitHub Desktop.
Save jocopa3/256f5378b40a729b03fe to your computer and use it in GitHub Desktop.
Added extra check
#include <Windows.h>
#include <iostream>
#include "MinHook.h"
// Hooks a function at a given address given the hook function and trampoline function
BOOL setHook(LPVOID* origAddress, LPVOID* hookFunction, LPVOID* trampFunction)
{
if (MH_CreateHook(origAddress, hookFunction, reinterpret_cast<LPVOID*>(trampFunction)) != MH_OK)
{
return FALSE;
}
if (MH_EnableHook(origAddress) != MH_OK)
{
return FALSE;
}
return TRUE;
}
// Attaches a hook on a function given the name of the owning module and the name of the function
BOOL attach(LPWSTR wstrModule, LPCSTR strFunction, LPVOID* hook, LPVOID* original)
{
HMODULE hModule = GetModuleHandle(wstrModule);
if (hModule == NULL)
{
return FALSE;
}
FARPROC hFunction = GetProcAddress(hModule, strFunction);
if (hFunction == NULL)
{
return FALSE;
}
return setHook((LPVOID*)hFunction, hook, original);
}
// Store whether the process was suspended or not
BOOL Suspended = FALSE;
// Basic hook setup for CreateProcessW
typedef BOOL(WINAPI *PfnCreateProcessW)(LPCWSTR lpApplicationName, LPWSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation);
PfnCreateProcessW pfnCreateProcessW = NULL;
BOOL WINAPI HfnCreateProcessW(LPCWSTR lpApplicationName, LPWSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation)
{
// Flag the process to be suspended on creation
dwCreationFlags |= CREATE_SUSPENDED;
Suspended = (dwCreationFlags & CREATE_SUSPENDED) == CREATE_SUSPENDED;
printf("CreateProcessW: %ws\n", lpApplicationName);
return pfnCreateProcessW(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation);
}
int main(int argc, char* argv[])
{
MH_Initialize();
// Attach a hook on CreateProcessW
BOOL hook = TRUE;
hook &= attach(L"kernelbase.dll", "CreateProcessW", (LPVOID*)&HfnCreateProcessW, (LPVOID*)&pfnCreateProcessW);
if (!hook)
{
std::cout << "Could not attach the hook" << std::endl;
return FALSE;
}
PROCESS_INFORMATION ProcessInfo;
STARTUPINFO StartupInfo;
ZeroMemory(&StartupInfo, sizeof(StartupInfo));
StartupInfo.cb = sizeof StartupInfo;
// CreateProcess example to show the hook worked
if (CreateProcess(L"C:\\Windows\\Notepad.exe", NULL,NULL, NULL, FALSE, 0, NULL, NULL, &StartupInfo, &ProcessInfo))
{
std::cout << "The process was created\n";
std::cout << "PID: (" << ProcessInfo.dwProcessId << ")\n";
std::cout << "Suspended: " << (Suspended ? "True" : "False") << std::endl;
CloseHandle(ProcessInfo.hThread);
CloseHandle(ProcessInfo.hProcess);
}
else
{
std::cout << "Failed to create the process" << std::endl;
}
system("PAUSE");
MH_Uninitialize();
return TRUE;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment