BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved ) { if( fdwReason == DLL_PROCESS_ATTACH ) { if( MH_Initialize() != MH_OK ) { return FALSE; } if( MH_CreateHook(&CreateProcessA, &HookedCreateProcessA, reinterpret_cast<void**>(&OrigCreateProcessA)) != MH_OK ) { return FALSE; } if( MH_EnableHook(&CreateProcessA) != MH_OK ) { return FALSE; } if( MH_CreateHook(&CreateProcessW, &HookedCreateProcessW, reinterpret_cast<void**>(&OrigCreateProcessW)) != MH_OK ) { return FALSE; } if( MH_EnableHook(&CreateProcessW) != MH_OK ) { return FALSE; } if( MH_CreateHook(&ResumeThread, &HookedResumeThread, reinterpret_cast<void**>(&OrigResumeThread)) != MH_OK ) { return FALSE; } if( MH_EnableHook(&ResumeThread) != MH_OK ) { return FALSE; } if( MH_CreateHook(&LoadLibraryW, &HookedLoadLibraryW, reinterpret_cast<void**>(&OrigLoadLibraryW)) != MH_OK ) { return FALSE; } if( MH_EnableHook(&LoadLibraryW) != MH_OK ) { return FALSE; } HookD3D9(::GetModuleHandleW(L"d3d9.dll")); std::wstring moduleFilename = GetModulePath(hinstDLL); WstrToUtf8(moduleFilename, &g_moduleFilenameUtf8); } return TRUE; }
void mainFunction() { MODULEINFO moduleInfo; bool bSuccess; MH_STATUS status; Log::Init(); GetModuleInformation(GetCurrentProcess(), GetModuleHandle(NULL), &moduleInfo, sizeof(MODULEINFO)); Log::Write(Log::Type::Debug, "Base address is at: %I64X", moduleInfo.lpBaseOfDll); funcToHookOn = Pattern::Scan(moduleInfo, "48 89 5C 24 ? 57 48 83 EC 20 44 0F B7 05 ? ? ? ? 33 D2"); Log::Write(Log::Type::Debug, "The code is found at: %I64X", funcToHookOn); status = MH_Initialize(); Log::Write(Log::Type::Debug, "MinHook intialization was: ", status != MH_STATUS::MH_OK ? "Not successful" : "Successful"); status = MH_CreateHook((void*)funcToHookOn, hkRETURN_NUMBER_OF_RUNNING_SCRIPT, (void**)&oRETURN_NUMBER_OF_RUNNING_SCRIPT); Log::Write(Log::Type::Debug, "MinHook hook creation was: ", status != MH_STATUS::MH_OK ? "Not successful" : "Successful"); status = MH_EnableHook((void*)funcToHookOn); Log::Write(Log::Type::Debug, "MinHook enable was: ", status != MH_STATUS::MH_OK ? "Not successful" : "Successful"); }
BOOL APIENTRY DllMain(HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { #if defined(_WIN64) const char* pBitDepth = "64"; #else const char* pBitDepth = "32"; #endif switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: GetModuleFileName((HMODULE)hModule, revModuleName, MAX_PATH); swprintf(ovrModuleName, MAX_PATH, L"LibOVRRT%hs_%d.dll", pBitDepth, OVR_MAJOR_VERSION); MH_Initialize(); MH_CreateHook(LoadLibraryW, HookLoadLibrary, (PVOID*)&TrueLoadLibrary); MH_CreateHook(OpenEventW, HookOpenEvent, (PVOID*)&TrueOpenEvent); MH_CreateHookApi(L"dxgi.dll", "CreateDXGIFactory", HookDXGIFactory, (PVOID*)&DXGIFactory); MH_EnableHook(MH_ALL_HOOKS); break; case DLL_PROCESS_DETACH: MH_Uninitialize(); break; default: break; } return TRUE; }
DllImpl::DllImpl(const std::wstring& installationDir) { auto dllPath(installationDir + L"temple.dll"); // Does it even exist? if (!PathFileExists(dllPath.c_str())) { auto msg(fmt::format("Temple.dll does not exist: {}", ucs2_to_utf8(dllPath))); throw TempleException(msg); } SetCurrentDirectory(installationDir.c_str()); // Try to load it mDllHandle = LoadLibrary(dllPath.c_str()); if (!mDllHandle) { throw TempleException("Unable to load temple.dll from {}: {}", ucs2_to_utf8(dllPath), GetLastWin32Error()); } // calculate the offset from the default 0x10000000 base address auto baseAddr = reinterpret_cast<uint32_t>(mDllHandle); mDeltaFromVanilla = baseAddr - defaultBaseAddr; logger->info("The temple.dll base address delta is: {}", mDeltaFromVanilla); auto status = MH_Initialize(); if (status != MH_OK) { FreeLibrary(mDllHandle); auto msg(fmt::format("Unable to initialize MinHook: {}", MH_StatusToString(status))); throw TempleException(msg); } }
BOOL APIENTRY DllMain(HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { #if defined(_WIN64) const char* pBitDepth = "64"; #else const char* pBitDepth = "32"; #endif switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: ReviveModule = (HMODULE)hModule; swprintf(ovrModuleName, MAX_PATH, L"LibOVRRT%hs_%d.dll", pBitDepth, OVR_MAJOR_VERSION); swprintf(revModuleName, MAX_PATH, L"LibRevive%hs_%d.dll", pBitDepth, OVR_MAJOR_VERSION); swprintf(ovrPlatformName, MAX_PATH, L"LibOVRPlatform%hs_%d", pBitDepth, OVR_MAJOR_VERSION); TrueIsError = (_IsError)DetourIATptr("ovr_Message_IsError", ovr_Message_IsError, GetModuleHandle(NULL)); DetourIATptr("ovr_IsEntitled", ovr_IsEntitled, GetModuleHandle(NULL)); MH_Initialize(); MH_CreateHook(LoadLibraryW, HookLoadLibrary, (PVOID*)&TrueLoadLibrary); MH_CreateHook(OpenEventW, HookOpenEvent, (PVOID*)&TrueOpenEvent); MH_EnableHook(LoadLibraryW); MH_EnableHook(OpenEventW); break; case DLL_PROCESS_DETACH: MH_RemoveHook(LoadLibraryW); MH_RemoveHook(OpenEventW); MH_Uninitialize(); break; default: break; } return TRUE; }
BOOL APIENTRY DllMain(HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { #if defined(_WIN64) const char* pBitDepth = "64"; #else const char* pBitDepth = "32"; #endif switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: ReviveModule = (HMODULE)hModule; swprintf(ovrModuleName, MAX_PATH, L"LibOVRRT%hs_%d.dll", pBitDepth, OVR_MAJOR_VERSION); MH_Initialize(); MH_CreateHook(LoadLibraryW, HookLoadLibrary, (PVOID*)&TrueLoadLibrary); MH_CreateHook(OpenEventW, HookOpenEvent, (PVOID*)&TrueOpenEvent); MH_CreateHook(GetProcAddress, HookGetProcAddress, (PVOID*)&TrueGetProcAddress); MH_EnableHook(LoadLibraryW); MH_EnableHook(OpenEventW); break; case DLL_PROCESS_DETACH: MH_RemoveHook(LoadLibraryW); MH_RemoveHook(OpenEventW); MH_RemoveHook(GetProcAddress); MH_Uninitialize(); break; default: break; } return TRUE; }
BOOL APIENTRY DllMain(HINSTANCE instDLL, DWORD reason, LPVOID /* reserved */) { // called when the DLL is being loaded into the // virtual address space of the current process (where to be injected) if (reason == DLL_PROCESS_ATTACH) { instanceDLL = instDLL; // disables thread notifications (DLL_THREAD_ATTACH, DLL_THREAD_DETACH) DisableThreadLibraryCalls(instDLL); MH_Initialize(); // creates a thread to execute within the // virtual address space of the calling process (WoW) CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)&MainThreadControl, NULL, 0, NULL); } // the DLL is being unloaded else if (reason == DLL_PROCESS_DETACH) { // close the dump file if (fileDump) fclose(fileDump); MH_Uninitialize(); } return TRUE; }
BOOL APIENTRY DllMain(HANDLE hModule, DWORD fdwReason, LPVOID lpReserved) { switch (fdwReason) { case DLL_PROCESS_ATTACH: { MH_Initialize(); if (GetModuleHandle("dinput8.dll") == NULL) LoadLibrary("dinput8.dll"); MH_CreateHook(GetProcAddress(GetModuleHandle("dinput8.dll"), "DirectInput8Create"), &DirectInput8Create_Hook, reinterpret_cast<void**>(&DirectInput8Create_fn)); MH_EnableHook(MH_ALL_HOOKS); } break; case DLL_PROCESS_DETACH: ExitInstance(); MH_Uninitialize(); break; } return TRUE; }
// main logic int init() { // initialize hook engine if (MH_Initialize() != MH_OK) { return -1; } // create kernel32!CreateFileW hook (unicode) if (MH_CreateHookApiEx(L"kernel32", "CreateFileW", &DetourCreateFileW, &OriginalCreateFileW) != MH_OK) { return -2; } // create kernel32!CreateFileA hook (ANSI) if (MH_CreateHookApiEx(L"kernel32", "CreateFileA", &DetourCreateFileA, &OriginalCreateFileA) != MH_OK) { return -3; } // enable all hooks if (MH_EnableHook(MH_ALL_HOOKS) != MH_OK) { return -5; } // block this thread infinitely to keep hooks active return WaitForSingleObject(INVALID_HANDLE_VALUE, INFINITE); }
BOOL Initialize() { if (MH_Initialize() != MH_OK) return FALSE; // Get the path to the games's AppData folder TCHAR szPath[MAX_PATH]; if (SUCCEEDED(SHGetFolderPath(NULL, CSIDL_LOCAL_APPDATA, NULL, 0, szPath))) { // Get the path to the textures folder std::wstring appData(szPath); appData = appData.substr(0, appData.rfind(L"AC")); appData += L"LocalState\\games\\com.mojang\\assets\\"; MINECRAFT_LOCAL_PATH = appData; } else return FALSE; // Attach a hook on CreateProcessW and return the status of the hook BOOL hook = TRUE; hook &= attach(L"KernelBase.dll", "CreateFileW", (LPVOID*)&HfnCreateFileW, (LPVOID*)&pfnCreateFileW); return hook; }
bool Utility::InstallHook(void *target, void *function, void *original_function) { if (MH_CreateHook(target, function, reinterpret_cast<void**>(original_function)) == MH_ERROR_NOT_INITIALIZED) { MH_Initialize(); MH_CreateHook(target, function, reinterpret_cast<void**>(original_function)); } return MH_EnableHook(target) == MH_OK; }
// ================================================================================= // Init // ================================================================================= void Memory::Init() { // Init MinHook if (MH_Initialize() != MH_OK) { printf("[Memory::Init] MH_Initialize failed!\n"); return; } }
// EnsureMinHookInitialized ensures that the MinHook // library is initialized. If MinHook is already // initialized, calling this function is a no-op. static void EnsureMinHookInitialized() { // Ensure MH_Initialize is only called once. if (InterlockedCompareExchange(&minhook_init_once, 1, 0) == 0) { MH_STATUS status = MH_Initialize(); if (status != MH_OK && status != MH_ERROR_ALREADY_INITIALIZED) { fods("HardHook: Failed to initialize minhook; MH_Initialize returned %s", MH_StatusToString(status)); } } }
//------------------------------------------------------------------------------------------------- extern "C" BOOL WINAPI DllEntryPoint(HINSTANCE hInstDll, DWORD fdwReason, LPVOID) { if (fdwReason == DLL_PROCESS_ATTACH) { DWORD dwTemp = GetModuleFileNameW(nullptr, g_wBuf, MAX_PATH+1); if (dwTemp >= 6 && dwTemp < MAX_PATH) { wchar_t *pDelim = g_wBuf+dwTemp; do { if (*--pDelim == L'\\') break; } while (pDelim > g_wBuf); if (pDelim >= g_wBuf+4 && pDelim <= g_wBuf+MAX_PATH-g_dwPathMargin) { #ifdef _WIN64 if (MH_Initialize() == MH_OK && FCreateHook(RegCreateKeyExW, RegCreateKeyExWStub) && MH_EnableHook(reinterpret_cast<LPVOID>(RegCreateKeyExW)) == MH_OK && DisableThreadLibraryCalls(hInstDll)) { *pDelim = L'\0'; return TRUE; } #else constexpr const DWORD dwPatchSize = 1+sizeof(size_t); BYTE *const pAddress = reinterpret_cast<BYTE*>(RegCreateKeyExW); DWORD dwOldProtect; if (VirtualProtect(pAddress, dwPatchSize, PAGE_EXECUTE_READWRITE, &dwOldProtect)) { const size_t szOffset = reinterpret_cast<size_t>(RegCreateKeyExWStub) - (reinterpret_cast<size_t>(pAddress) + dwPatchSize); const BYTE *const pByte = static_cast<const BYTE*>(static_cast<const void*>(&szOffset)); pAddress[0] = 0xE9; //jump near pAddress[1] = pByte[0]; pAddress[2] = pByte[1]; pAddress[3] = pByte[2]; pAddress[4] = pByte[3]; if (VirtualProtect(pAddress, dwPatchSize, dwOldProtect, &dwTemp) && DisableThreadLibraryCalls(hInstDll)) { *pDelim = L'\0'; return TRUE; } } #endif } } } #ifdef _WIN64 else if (fdwReason == DLL_PROCESS_DETACH) MH_Uninitialize(); #endif return FALSE; }
vr::EVRInitError ServerDriver::Init(vr::IVRDriverContext *pDriverContext) { LOG(TRACE) << "CServerDriver::Init()"; // Initialize Hooking InterfaceHooks::setServerDriver(this); auto mhError = MH_Initialize(); if (mhError == MH_OK) { _driverContextHooks = InterfaceHooks::hookInterface(pDriverContext, "IVRDriverContext"); } else { LOG(ERROR) << "Error while initialising minHook: " << MH_StatusToString(mhError); } LOG(DEBUG) << "Initialize driver context."; VR_INIT_SERVER_DRIVER_CONTEXT(pDriverContext); // Read installation directory vr::ETrackedPropertyError tpeError; installDir = vr::VRProperties()->GetStringProperty(pDriverContext->GetDriverHandle(), vr::Prop_InstallPath_String, &tpeError); if (tpeError == vr::TrackedProp_Success) { LOG(INFO) << "Install Dir:" << installDir; } else { LOG(INFO) << "Could not get Install Dir: " << vr::VRPropertiesRaw()->GetPropErrorNameFromEnum(tpeError); } // Read vrsettings char buffer[vr::k_unMaxPropertyStringSize]; vr::EVRSettingsError peError; vr::VRSettings()->GetString(vrsettings_SectionName, vrsettings_overrideHmdManufacturer_string, buffer, vr::k_unMaxPropertyStringSize, &peError); if (peError == vr::VRSettingsError_None) { _propertiesOverrideHmdManufacturer = buffer; LOG(INFO) << vrsettings_SectionName << "::" << vrsettings_overrideHmdManufacturer_string << " = " << _propertiesOverrideHmdManufacturer; } vr::VRSettings()->GetString(vrsettings_SectionName, vrsettings_overrideHmdModel_string, buffer, vr::k_unMaxPropertyStringSize, &peError); if (peError == vr::VRSettingsError_None) { _propertiesOverrideHmdModel = buffer; LOG(INFO) << vrsettings_SectionName << "::" << vrsettings_overrideHmdModel_string << " = " << _propertiesOverrideHmdModel; } vr::VRSettings()->GetString(vrsettings_SectionName, vrsettings_overrideHmdTrackingSystem_string, buffer, vr::k_unMaxPropertyStringSize, &peError); if (peError == vr::VRSettingsError_None) { _propertiesOverrideHmdTrackingSystem = buffer; LOG(INFO) << vrsettings_SectionName << "::" << vrsettings_overrideHmdTrackingSystem_string << " = " << _propertiesOverrideHmdTrackingSystem; } auto boolVal = vr::VRSettings()->GetBool(vrsettings_SectionName, vrsettings_genericTrackerFakeController_bool, &peError); if (peError == vr::VRSettingsError_None) { _propertiesOverrideGenericTrackerFakeController = boolVal; LOG(INFO) << vrsettings_SectionName << "::" << vrsettings_genericTrackerFakeController_bool << " = " << boolVal; } // Start IPC thread shmCommunicator.init(this); return vr::VRInitError_None; }
int init() { BOOST_LOG_TRIVIAL(info) << "Initializing hook engine..."; if (MH_Initialize() != MH_OK) { BOOST_LOG_TRIVIAL(fatal) << "Couldn't initialize hook engine"; return -1; } BOOST_LOG_TRIVIAL(info) << "Hook engine initialized"; HookDefWindowProc(); return WaitForSingleObject(INVALID_HANDLE_VALUE, INFINITE); }
void HookSSL() { if (MH_Initialize() != MH_OK) printf("Init failed!\n"); else printf("Init succeded!\n"); if (MH_CreateHookApiEx(L"secur32.dll", "DecryptMessage", DetouredDecrypt, (LPVOID*)&orgDecrypt, true) != MH_OK) printf("Decrypthook failed!\n"); else printf("Decrypthook succeded!\n"); if (MH_CreateHookApiEx(L"secur32.dll", "EncryptMessage", DetouredEncrypt, (LPVOID*)&orgEncrypt, true) != MH_OK) printf("Encrypthook failed!\n"); else printf("Encrypthook succeded!\n"); MH_ApplyQueued(); }
void AtlDepHook::Install(void) { if (MH_Initialize() != MH_OK) { return; } for(int i = 0; i < s_FunctionsCount; ++i) { FunctionInfo& info = s_Functions[i]; if (info.bSucceeded) { continue; } HMODULE hModule = ::LoadLibraryA(info.szFunctionModule); if (!hModule) { DWORD dwErrorCode = ::GetLastError(); TRACE("[coba] Cannot LoadLibraryA(%s)! GetLastError: %d",info.szFunctionModule, dwErrorCode); continue; } info.pTargetFunction = GetProcAddress(hModule, info.szFunctionName); if (info.pTargetFunction == NULL) { TRACE("[coba] Cannot GetProcAddress of %s", info.szFunctionName); continue; } if (MH_CreateHook(info.pTargetFunction, info.pHookFunction, info.ppOriginalFunction) != MH_OK) { TRACE("[coba] MH_CreateHook failed! Module: %s Function: %s", info.szFunctionModule, info.szFunctionName); continue; } // Enable the hook if (MH_EnableHook(info.pTargetFunction) != MH_OK) { TRACE("[coba] MH_EnableHook failed! Module: %s Function: %s", info.szFunctionModule, info.szFunctionName); continue; } info.bSucceeded = TRUE; } }
void HookSetCursor() { if (MH_Initialize() == MH_OK) { if (MH_CreateHook(&SetCursorPos, &hkSetCursor, (void**)&origSetCursor) == MH_OK) { if (MH_EnableHook(&SetCursorPos) == MH_OK) { std::cout << "Hook Success \n"; }else{ std::cout << "Failed to Enable hook \n"; } }else{ std::cout << "Failed to Hook \n"; } }else{ std::cout << "Failed to initialize hook \n"; } }
//------------------------------------------------------------------------- MH_STATUS WINAPI MH_InitializeEx(MH_INITIALIZE* pInit) { MH_STATUS status = MH_Initialize(); if ((status == MH_OK) && pInit && (pInit->cbSize >= sizeof(MH_INITIALIZE))) { // CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD) has large overhead // In some cases, caller application may provide thread list itself // Caller is responsible to pass valid pointers or NULLs ThreadListCreate = pInit->ThreadListCreate; ThreadListFirst = pInit->ThreadListFirst; ThreadListNext = pInit->ThreadListNext; ThreadListClose = pInit->ThreadListClose; // Minhook working modes g_Flags = pInit->Flags; } return status; }
void Start() { MH_Initialize(); hFile = CreateFile ( "Dump.dll", GENERIC_WRITE, 0, NULL, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, NULL ); auto NtWow64WriteVirtualMemory64 = GetProcAddress(LoadLibrary("ntdll.dll"), "NtWow64WriteVirtualMemory64"); MH_CreateHook(NtWow64WriteVirtualMemory64, &NtWow64WriteVirtualMemory64_h, reinterpret_cast<LPVOID*>(&oNtWow64WriteVirtualMemory64)); MH_EnableHook(NtWow64WriteVirtualMemory64); }
IPYTHONEMBED_STATUS ipython_embed_start(PyObject* cmdline) { commandline_args = cmdline; if (MH_Initialize() != MH_OK) { return IPYTHONEMBED_MINHOOK_INIT_FAILED; } void* qt_eventloop = (void*)eventloop_address(); if (MH_CreateHook(qt_eventloop, &DetourQEventDispatcherWin32, (LPVOID*)&pQEventDispatcherWin32) != MH_OK) { return IPYTHONEMBED_CREATE_HOOK_FAILED; } if (MH_EnableHook(qt_eventloop) != MH_OK) { return IPYTHONEMBED_ENABLE_HOOK_FAILED; } return IPYTHONEMBED_OK; }
int main() { // Initialize MinHook. if (MH_Initialize() != MH_OK) { return 1; } // Create a hook for MessageBoxW, in disabled state. if (MH_CreateHook(&MessageBoxW, &DetourMessageBoxW, reinterpret_cast<void**>(&fpMessageBoxW)) != MH_OK) { return 1; } // Enable the hook for MessageBoxW. if (MH_EnableHook(&MessageBoxW) != MH_OK) { return 1; } // Expected to tell "Hooked!". MessageBoxW(NULL, L"Not hooked...", L"MinHook Sample", MB_OK); // Disable the hook for MessageBoxW. if (MH_DisableHook(&MessageBoxW) != MH_OK) { return 1; } // Expected to tell "Not hooked...". MessageBoxW(NULL, L"Not hooked...", L"MinHook Sample", MB_OK); // Uninitialize MinHook. if (MH_Uninitialize() != MH_OK) { return 1; } return 0; }
EXTERNC BOOL WINAPI DllMain(HINSTANCE hModule, DWORD dwReason, LPVOID pv) { if (dwReason == DLL_PROCESS_ATTACH) { hInstance = hModule; // 保持系统dll原有功能 LoadSysDll(hModule); // 初始化HOOK库成功以后安装加载器 MH_STATUS status = MH_Initialize(); if (status == MH_OK) { InstallLoader(); } else { DebugLog(L"MH_Initialize failed:%d", status); } } return TRUE; }
MainContext::MainContext() { LogFile("OneTweakNG.log"); if(config.GetAutoFix()) EnableAutoFix(); MH_Initialize(); MH_CreateHook(D3D9DLL::Get().Direct3DCreate9, HookDirect3DCreate9, reinterpret_cast<void**>(&TrueDirect3DCreate9)); MH_EnableHook(D3D9DLL::Get().Direct3DCreate9); MH_CreateHook(CreateWindowExA, HookCreateWindowExA, reinterpret_cast<void**>(&TrueCreateWindowExA)); MH_EnableHook(CreateWindowExA); MH_CreateHook(CreateWindowExW, HookCreateWindowExW, reinterpret_cast<void**>(&TrueCreateWindowExW)); MH_EnableHook(CreateWindowExW); MH_CreateHook(SetWindowLongA, HookSetWindowLongA, reinterpret_cast<void**>(&TrueSetWindowLongA)); MH_EnableHook(SetWindowLongA); MH_CreateHook(SetWindowLongW, HookSetWindowLongW, reinterpret_cast<void**>(&TrueSetWindowLongW)); MH_EnableHook(SetWindowLongW); }
static void AdjustLimits() { g_drawableStore = hook::get_address<char*>(hook::get_pattern("74 16 8B 17 48 8D 0D ? ? ? ? 41 B8 02 00 00 00", 7)); g_dwdStore = hook::get_address<char*>(hook::get_pattern("EB 7B 48 8D 54 24 40 48 8D 0D", 10)); MH_Initialize(); MH_CreateHook(hook::get_pattern("41 8B 18 44 0F B7 81 80 00 00 00", -5), GetIndexByKeyStub, (void**)&g_origGetIndexByKey); MH_CreateHook(hook::get_pattern("48 89 7C 24 10 44 0F B7 49 10", -5)/*(void*)0x1414F9E68*/, StoreInsert, (void**)&g_origStoreInsert); MH_CreateHook((void*)hook::get_pattern("44 0F B7 41 10 44 8B DA 33 D2")/*0x1414F4A34*/, StoreRemove, (void**)&g_origStoreRemove); MH_CreateHook((void*)hook::get_pattern("48 63 DA 48 8B F9 8B C3", -20)/*0x1414F9790*/, StoreInit, (void**)&g_origStoreInit); MH_CreateHook((void*)hook::get_pattern("BE FF FF 00 00 C6 41 60 00", -16)/*0x141588FE4*/, ArchetypeSetDrawable, (void**)&g_origSetDrawable); MH_CreateHook((void*)hook::get_pattern("41 8B F8 48 8B D9 75 12", -16)/*0x141588FE4*/, ArchetypeSetDrawableDict, nullptr); MH_CreateHook((void*)hook::get_pattern("F6 41 50 01 4C 8B D1 75 03")/*0x141586390*/, ArchetypeGetDrawable, (void**)&g_origGetDrawable); MH_CreateHook((void*)hook::get_pattern("0F B6 51 60 41 83 C9 FF")/*0x14158615C*/, ArchetypeGetDrawableF18, (void**)&g_origGetDrawableF18); MH_EnableHook(MH_ALL_HOOKS); static struct : jitasm::Frontend { static int GetArchetype(char* archetype) { if (*(uint8_t*)(archetype + 96) != 2 && *(uint8_t*)(archetype + 96) != 3) { return *(uint16_t*)(archetype + 98); } uint16_t archetypeIdx = *(uint16_t*)(archetype + 102); return g_drawableIndices[archetypeIdx]; } virtual void InternalMain() override { push(rcx); push(r8); push(r9); sub(rsp, 0x20); mov(rcx, rdx); mov(rax, (uintptr_t)GetArchetype); call(rax); add(rsp, 0x20); pop(r9); pop(r8); pop(rcx); add(ecx, eax); ret(); } } getArchetypeStub; { auto location = hook::get_pattern("0F B7 42 62 03 C8"); hook::nop(location/*0x141586371*/, 6); hook::call(location, getArchetypeStub.GetCode()); } // in setting of drawable dict index static struct : jitasm::Frontend { static int GetArchetype(char* archetype) { uint16_t archetypeIdx = *(uint16_t*)(archetype + 102); return g_drawableIndices[archetypeIdx]; } virtual void InternalMain() override { push(rcx); push(r8); push(r9); sub(rsp, 0x20); mov(rcx, r10); mov(rax, (uintptr_t)GetArchetype); call(rax); add(rsp, 0x20); pop(r9); pop(r8); pop(rcx); mov(r8d, eax); ret(); } } getArchetypeStub2; { auto location = hook::get_pattern("E9 84 00 00 00 45 0F B7 42 62", 5); hook::nop(location, 5); hook::call(location, getArchetypeStub2.GetCode()); } }
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) { switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: if (initialized) { break; } initialized = true; //MessageBoxW(NULL, L"Hooking", L"DPIMangler", MB_OK); // Initialize MinHook. if (MH_Initialize() != MH_OK) { MessageBoxW(NULL, L"Initialization error", L"DPIMangler", MB_OK); return 1; } // Create a hook for the DPI awareness functions, in disabled state. if (MH_CreateHook(&SetProcessDPIAware, &NukeSetProcessDPIAware, reinterpret_cast<void**>(&fpSetProcessDPIAware)) != MH_OK || MH_CreateHook(&SetProcessDpiAwareness, &NukeSetProcessDpiAwareness, reinterpret_cast<void**>(&fpSetProcessDpiAwareness)) != MH_OK) { MessageBoxW(NULL, L"Error creating hook", L"DPIMangler", MB_OK); return 1; } // Enable the hook for the DPI awareness functions. if (MH_EnableHook(&SetProcessDPIAware) != MH_OK || MH_EnableHook(&SetProcessDpiAwareness) != MH_OK) { MessageBoxW(NULL, L"Error enabling hook", L"DPIMangler", MB_OK); return 1; } //MessageBoxW(NULL, L"Hooked...", L"DPIManger", MB_OK); break; case DLL_PROCESS_DETACH: // Disable the hook for the DPI awareness functions. if (MH_DisableHook(&SetProcessDPIAware) != MH_OK || MH_DisableHook(&SetProcessDpiAwareness) != MH_OK) { MessageBoxW(NULL, L"Error disabling hook", L"DPIMangler", MB_OK); return 1; } // Uninitialize MinHook. if (MH_Uninitialize() != MH_OK) { MessageBoxW(NULL, L"Error uninitializing minhook", L"DPIMangler", MB_OK); return 1; } break; } return TRUE; }
InputHook::InputHook() : m_hookmask(HOOK_COM), m_fakepidvid(MAKELONG(0x045E, 0x028E)), m_timeout(0), m_timeout_thread(INVALID_HANDLE_VALUE) { IniFile ini; std::string inipath("x360ce.ini"); if (!ini.Load(inipath)) CheckCommonDirectory(&inipath, "x360ce"); if (!ini.Load(inipath)) return; bool read_from_database = ReadGameDatabase(); if (!read_from_database) { if (!ini.Get("InputHook", "HookMask", &m_hookmask, HOOK_COM)) { bool check = false; ini.Get("InputHook", "HookLL", &check); if (check) m_hookmask |= HOOK_LL; ini.Get("InputHook", "HookCOM", &check); if (check) m_hookmask |= HOOK_COM; ini.Get("InputHook", "HookDI", &check); if (check) m_hookmask |= HOOK_DI; ini.Get("InputHook", "HookPIDVID", &check); if (check) m_hookmask |= HOOK_PIDVID; ini.Get("InputHook", "HookSA", &check); if (check) m_hookmask |= HOOK_SA; ini.Get("InputHook", "HookNAME", &check); if (check) m_hookmask |= HOOK_NAME; ini.Get("InputHook", "HookSTOP", &check); if (check) m_hookmask |= HOOK_STOP; ini.Get("InputHook", "HookWT", &check); if (check) m_hookmask |= HOOK_WT; } if (GetState(HOOK_PIDVID)) { u32 vid; u32 pid; ini.Get<u32>("InputHook", "FakeVID", &vid, 0x045E); ini.Get<u32>("InputHook", "FakePID", &pid, 0x028E); if (vid != 0x045E || pid != 0x28E) m_fakepidvid = MAKELONG(vid, pid); } } if (m_hookmask) { PrintLog("InputHook starting..."); // Initalize InputHook Devices for (u32 i = 0; i < XUSER_MAX_COUNT; ++i) { std::string section; std::string key = StringFormat("PAD%u", i + 1); if (!ini.Get("Mappings", key, §ion)) continue; u32 index = 0; if (!ini.Get(section, "UserIndex", &index)) index = i; std::string buffer; GUID productid = GUID_NULL; GUID instanceid = GUID_NULL; if (ini.Get(section, "ProductGUID", &buffer)) StringToGUID(&productid, buffer); if (ini.Get(section, "InstanceGUID", &buffer)) StringToGUID(&instanceid, buffer); if (!IsEqualGUID(productid, GUID_NULL) && !IsEqualGUID(instanceid, GUID_NULL)) { m_devices.push_back(InputHookDevice(index, productid, instanceid)); } } } if (!m_devices.empty()) { if (!read_from_database) ini.Get<u32>("InputHook", "Timeout", &m_timeout, 45); std::string maskname; if (MaskToName(&maskname, m_hookmask)) PrintLog("HookMask 0x%08X: %s", m_hookmask, maskname.c_str()); MH_Initialize(); if (GetState(HOOK_LL)) HookLL(); if (GetState(HOOK_COM)) HookCOM(); if (GetState(HOOK_DI)) HookDI(); if (GetState(HOOK_SA)) HookSA(); if (GetState(HOOK_WT)) HookWT(); MH_EnableHook(MH_ALL_HOOKS); } }
} if (g_objectIds.size() < 16) { if (!g_requestedIds) { net::Buffer outBuffer; outBuffer.Write<uint16_t>(32); g_netLibrary->SendReliableCommand("msgRequestObjectIds", (const char*)outBuffer.GetData().data(), outBuffer.GetCurOffset()); g_requestedIds = true; } } }); OnKillNetworkDone.Connect([]() { g_objectIds.clear(); g_usedObjectIds.clear(); g_requestedIds = false; }); MH_Initialize(); MH_CreateHook(hook::get_pattern("FF 89 C4 3E 00 00 33 D2", -12), AssignObjectId, (void**)&g_origAssignObjectId); MH_CreateHook(hook::get_pattern("44 8B 91 C4 3E 00 00", -0x14), ReturnObjectId, (void**)&g_origReturnObjectId); MH_CreateHook(hook::get_pattern("48 83 EC 20 8B B1 C4 3E 00 00", -0xB), HasSpaceForObjectId, (void**)&g_origHasSpaceForObjectId); MH_EnableHook(MH_ALL_HOOKS); });
LOGICAL DllMain( __in HINSTANCE Instance, __in ULONG Reason, __reserved PVOID Reserved ) { switch (Reason) { case DLL_PROCESS_ATTACH: { PPH_PLUGIN_INFORMATION info; PluginInstance = PhRegisterPlugin(L"TT.MalHide", Instance, &info); if (!PluginInstance) return FALSE; info->DisplayName = L"MalHide"; info->Author = L"TETYYS"; info->Description = L"Changes window properties to prevent malware killing ProcessHacker, however you will not able to see user running PH."; info->HasOptions = FALSE; info->Url = L"http://wj32.org/processhacker/forums/viewtopic.php?f=18&t=1301&p=5731"; PhRegisterCallback( PhGetPluginCallback(PluginInstance, PluginCallbackUnload), UnloadCallback, NULL, &PluginUnloadCallbackRegistration ); RANGE range; RangesSize = 27; Ranges = malloc(sizeof(RANGE) * RangesSize); Ranges[0] = (RANGE) { .From = 0x0021, .To = 0x007E }; Ranges[1] = (RANGE) { .From = 0x00A1, .To = 0x024F }; Ranges[2] = (RANGE) { .From = 0x1F00, .To = 0x2049 }; Ranges[3] = (RANGE) { .From = 0x2070, .To = 0x2094 }; Ranges[4] = (RANGE) { .From = 0x20A0, .To = 0x20B5 }; Ranges[5] = (RANGE) { .From = 0x20B8, .To = 0x20B9 }; Ranges[6] = (RANGE) { .From = 0x20D0, .To = 0x20E1 }; Ranges[7] = (RANGE) { .From = 0x2100, .To = 0x2138 }; Ranges[8] = (RANGE) { .From = 0x214D, .To = 0x214E }; Ranges[9] = (RANGE) { .From = 0x2153, .To = 0x2182 }; Ranges[10] = (RANGE) { .From = 0x2184, .To = 0x2184 }; Ranges[11] = (RANGE) { .From = 0x2190, .To = 0x21EA }; Ranges[12] = (RANGE) { .From = 0x2200, .To = 0x22F1 }; Ranges[14] = (RANGE) { .From = 0x23BE, .To = 0x23CC }; Ranges[15] = (RANGE) { .From = 0x23CE, .To = 0x23CE }; Ranges[16] = (RANGE) { .From = 0x23DA, .To = 0x23DB }; Ranges[18] = (RANGE) { .From = 0x2460, .To = 0x24FE }; Ranges[19] = (RANGE) { .From = 0x2500, .To = 0x2595 }; Ranges[20] = (RANGE) { .From = 0x25A0, .To = 0x25EF }; Ranges[22] = (RANGE) { .From = 0x3000, .To = 0x303F }; Ranges[23] = (RANGE) { .From = 0xFE30, .To = 0xFE4F }; Ranges[24] = (RANGE) { .From = 0xFE50, .To = 0xFE6B }; Ranges[25] = (RANGE) { .From = 0xFF01, .To = 0xFF65 }; Ranges[26] = (RANGE) { .From = 0xFFE0, .To = 0xFFEE }; srand((UINT)time(NULL)); ClassName = RandomString(); if (MH_Initialize() != MH_OK) return 1; if (MH_CreateHook(&CreateWindowExW, &H_CreateWindowExW, (LPVOID*)(&O_CreateWindow)) != MH_OK || MH_EnableHook(&CreateWindowExW) != MH_OK) return 1; if (MH_CreateHook(&RegisterClassExW, &H_RegisterClassExW, (LPVOID*)(&O_RegisterClass)) != MH_OK || MH_EnableHook(&RegisterClassExW) != MH_OK) return 1; if (MH_CreateHook(&FindWindowExW, &H_FindWindowExW, (LPVOID*)(&O_FindWindow)) != MH_OK || MH_EnableHook(&FindWindowExW) != MH_OK) return 1; } break; } return TRUE; } VOID NTAPI UnloadCallback( __in_opt PVOID Parameter, __in_opt PVOID Context ) { MH_Uninitialize(); } HWND WINAPI H_FindWindowExW( _In_opt_ HWND hWndParent, _In_opt_ HWND hWndChildAfter, _In_opt_ LPCWSTR lpszClass, _In_opt_ LPCWSTR lpszWindow ) { if (lpszClass && wcscmp(lpszClass, ORIGINAL_CLASS_NAME) == 0) { lpszClass = ClassName; MH_DisableHook(&FindWindowExW); } return O_FindWindow(hWndParent, hWndChildAfter, lpszClass, lpszWindow); } ATOM WINAPI H_RegisterClassExW( _In_ /* CONST */ WNDCLASSEXW *lpwcx ) { if (wcscmp(lpwcx->lpszClassName, ORIGINAL_CLASS_NAME) == 0) { lpwcx->lpszClassName = ClassName; MH_DisableHook(&RegisterClassExW); } return O_RegisterClass(lpwcx); } HWND WINAPI H_CreateWindowExW( _In_ DWORD dwExStyle, _In_opt_ LPCTSTR lpClassName, _In_opt_ LPCTSTR lpWindowName, _In_ DWORD dwStyle, _In_ int x, _In_ int y, _In_ int nWidth, _In_ int nHeight, _In_opt_ HWND hWndParent, _In_opt_ HMENU hMenu, _In_opt_ HINSTANCE hInstance, _In_opt_ LPVOID lpParam ) { BOOL found = FALSE; if (wcscmp(lpClassName, ORIGINAL_CLASS_NAME) == 0) { found = TRUE; lpClassName = ClassName; lpWindowName = RandomString(); } HWND ret = O_CreateWindow(dwExStyle, lpClassName, lpWindowName, dwStyle, x, y, nWidth, nHeight, hWndParent, hMenu, hInstance, lpParam); if (found) { MainWindowHandle = ret; MH_DisableHook(&CreateWindowExW); } return ret; } WCHAR* RandomString() { ULONG range = rand() % RangesSize; ULONG len; do { len = rand() % 100; } while (len == 0); WCHAR* ustr = calloc(sizeof(WCHAR), len + 1); for (ULONG i = 0; i < len; i++) { ustr[i] = (rand() % (Ranges[range].To - Ranges[range].From + 1)) + Ranges[range].From; range = rand() % RangesSize; } ustr[len] = L'\0'; return ustr; }