Skip to content

Instantly share code, notes, and snippets.

@luodaoyi
Created March 27, 2019 17:21
Show Gist options
  • Save luodaoyi/d6169259252a20d55260dc0488755400 to your computer and use it in GitHub Desktop.
Save luodaoyi/d6169259252a20d55260dc0488755400 to your computer and use it in GitHub Desktop.
LoadLibrary Hook
MinHook addr:
https://github.com/TsudaKageyu/minhook
```c
#include "MinHook.h"
typedef HMODULE (WINAPI *TYPE_LoadLibraryA)(LPCSTR);
TYPE_LoadLibraryA g_loadLibraryA_original = NULL;
HMODULE WINAPI LoadLibraryA_replacement(_In_ LPCTSTR lpFileName)
{
if(strcmp("OPENGL32",lpFileName) != 0)
{
CString loadName;
loadName.Format("*** LoadLibraryA: %s",lpFileName);
OutputDebugString(loadName);
}
return g_loadLibraryA_original(lpFileName);
}
typedef HMODULE (WINAPI *TYPE_LoadLibraryExA)(LPCSTR, HANDLE, DWORD);
TYPE_LoadLibraryExA g_loadLibraryExA_original =NULL;
HMODULE WINAPI LoadLibraryExA_replacement(_In_ LPCSTR lpLibFileName,_In_ HANDLE hFile, _In_ DWORD dwFlags)
{
CString loadName;
loadName.Format("*** LoadLibraryExA: %s ,hFile :0x08X,dwFlags: %x",lpLibFileName,hFile,dwFlags);
OutputDebugString(loadName);
return g_loadLibraryExA_original(lpLibFileName,hFile,dwFlags);
}
typedef HMODULE (WINAPI *TYPE_LoadLibraryW)(LPCWSTR);
TYPE_LoadLibraryW g_loadLibraryW_original = NULL;
HMODULE WINAPI LoadLibraryW_replacement(LPCWSTR lpLibFileName)
{
CString buffer(lpLibFileName);
buffer.Insert(0,"*** LoadLibraryW: ");
OutputDebugString(buffer);
return g_loadLibraryW_original(lpLibFileName);
}
typedef HMODULE (WINAPI *TYPE_LoadLibraryExW)(LPCWSTR, HANDLE, DWORD);
TYPE_LoadLibraryExW g_LoadLibraryExW_original = NULL;
HMODULE WINAPI LoadLibraryExW_replacement(_In_ LPCWSTR lpLibFileName,_In_ HANDLE hFile, _In_ DWORD dwFlags)
{
CString buffer(lpLibFileName);
buffer.Insert(0,"*** LoadLibraryExW:");
buffer.AppendFormat(" hFile :0x08X,dwFlags: %x",hFile,dwFlags);
OutputDebugString(buffer);
return g_LoadLibraryExW_original(lpLibFileName,hFile,dwFlags);
}
bool installLoadLibraryHook()
{
// Initialize MinHook.
if (MH_Initialize() != MH_OK)
{
OutputDebugString("Initialize MinHook False!");
return false;
}
if (MH_CreateHook(
&LoadLibraryA,
&LoadLibraryA_replacement,
(LPVOID*)(&g_loadLibraryA_original)
) != MH_OK)
{
OutputDebugString("MH_CreateHook loadLibraryA False!");
return false;
}
if (MH_EnableHook(&LoadLibraryA) != MH_OK)
{
OutputDebugString("MH_EnableHook loadLibraryA False!");
return false;
}
if(MH_CreateHook(
&LoadLibraryExA,
&LoadLibraryExA_replacement,
(LPVOID*)(&g_loadLibraryExA_original)
) !=MH_OK)
{
OutputDebugString("MH_CreateHook LoadLibraryExA False!");
return false;
}
if (MH_EnableHook(&LoadLibraryExA) != MH_OK)
{
OutputDebugString("MH_EnableHook LoadLibraryExA False!");
return false;
}
if (MH_CreateHook(
&LoadLibraryW,
&LoadLibraryW_replacement,
(LPVOID*)(&g_loadLibraryW_original)
) != MH_OK)
{
OutputDebugString("MH_CreateHook loadLibraryW False!");
return false;
}
if (MH_EnableHook(&LoadLibraryW) != MH_OK)
{
OutputDebugString("MH_EnableHook loadLibraryW False!");
return false;
}
if(MH_CreateHook(
&LoadLibraryExW,
&LoadLibraryExW_replacement,
(LPVOID*)(&g_LoadLibraryExW_original)
) !=MH_OK)
{
OutputDebugString("MH_CreateHook LoadLibraryExW False!");
return false;
}
if (MH_EnableHook(&LoadLibraryExW) != MH_OK)
{
OutputDebugString("MH_EnableHook LoadLibraryExW False!");
return false;
}
return true;
}
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment