easyhook

Easyhook 32 bit application

由 笑着哭i 提交于 2019-12-18 18:05:35
问题 I'm using EasyHook to intercept registry calls. In more detail, I use RegQueryValue to intercept the call that reads a key from registry and change its value with something else. The relevant code looks like: [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode, SetLastError = true)] delegate int DRegQueryValueExW( IntPtr hKey, string lpValueName, int lpReserved, ref Microsoft.Win32.RegistryValueKind lpType, StringBuilder lpData, ref int lpcbData); [DllImport(

Easyhook 32 bit application

由 雨燕双飞 提交于 2019-12-18 18:05:04
问题 I'm using EasyHook to intercept registry calls. In more detail, I use RegQueryValue to intercept the call that reads a key from registry and change its value with something else. The relevant code looks like: [UnmanagedFunctionPointer(CallingConvention.StdCall, CharSet = CharSet.Unicode, SetLastError = true)] delegate int DRegQueryValueExW( IntPtr hKey, string lpValueName, int lpReserved, ref Microsoft.Win32.RegistryValueKind lpType, StringBuilder lpData, ref int lpcbData); [DllImport(

EasyHook recv doesn't “hook” all packets

由 爱⌒轻易说出口 提交于 2019-12-09 06:52:56
问题 I managed to write a semiworking EasyHook example that hooks recv function. I wrote a form, added a WebBrowser component, and started the application. The problem is, I get the HTTP packets, but if there's a socket, it seems that recv stops "hooking". The problem is, with an external application, Spystudio, I can get them hooking recv. So, what am I missing? using System; using System.Collections.Generic; using System.Data; using System.Runtime.InteropServices; using System.Threading; using

Hook flash application

由 白昼怎懂夜的黑 提交于 2019-12-08 13:16:59
问题 if I load in my C# application a flash application A that opens a socket with a server B, is it possible to setup a local hook so that i can read the packets exchanged between A and the server B? I may obtain the flash application sources if needed, but I'm not the one who wrote them I'm new to C# ( to be honest, I'm still wondering what's the best language to write this kind of application for windows ) and to hooking, so any example would be really appreciated :) I'm working client side 回答1

Hooking NtCreateFile API from ntdll.dll with EasyHook (c#)

由 ⅰ亾dé卋堺 提交于 2019-12-08 05:40:06
问题 This is the first time I try to hook windows API. My goal is to monitor all files that a process is going to create/open/read/write. In order to be the most verbose possible, I decided to hook the ntdll.dll API such as NtCreateFile() and NtOpenFile(). So, in order to acheive this goal, I went on EasyHook, which seems easy and robust. I've essetially followed the FileMon example, changing what I really wanted: the Hooked function. When I try to read information about the file that is going to

EasyHook, .NET Remoting sharing interface between both client and server?

由 可紊 提交于 2019-12-03 14:07:08
问题 How can both the IPC client and IPC server call the shared remoting interface (the class inheriting MarshalByRefObject) to communicate, without having to put the interface class inside in the injecting application? For example, if I put the interface class in the injected library project that gets injected into my target process, my injecting application cannot reference that interface. Edit: I have answered the question below. 回答1: As of EasyHook Commit 66751 (tied to EasyHook 2.7 alpha), it

EasyHook recv doesn't “hook” all packets

由 梦想的初衷 提交于 2019-12-03 09:12:22
I managed to write a semiworking EasyHook example that hooks recv function. I wrote a form, added a WebBrowser component, and started the application. The problem is, I get the HTTP packets, but if there's a socket, it seems that recv stops "hooking". The problem is, with an external application, Spystudio, I can get them hooking recv. So, what am I missing? using System; using System.Collections.Generic; using System.Data; using System.Runtime.InteropServices; using System.Threading; using System.Text; using System.Windows.Forms; using System.Diagnostics; using System.IO; using System.Runtime

EasyHook, .NET Remoting sharing interface between both client and server?

由 廉价感情. 提交于 2019-12-03 04:01:12
How can both the IPC client and IPC server call the shared remoting interface (the class inheriting MarshalByRefObject) to communicate, without having to put the interface class inside in the injecting application? For example, if I put the interface class in the injected library project that gets injected into my target process, my injecting application cannot reference that interface. Edit: I have answered the question below. Jason As of EasyHook Commit 66751 (tied to EasyHook 2.7 alpha), it doesn't seem possible to get the instance of the remoting interface in both the client (that process

EasyHook Creating a remote file monitor

由 ▼魔方 西西 提交于 2019-11-27 16:55:45
In this tutorial we will create a remote file monitor using EasyHook. We will cover how to: 使用EasyHook创建一个全局文件监控程序，包括 Inject a managed assembly into an existing target process based on the process Id 将托管程序集(dll)注入到已存在的进程ID Inject a managed assembly into a newly created (and suspended) process using path to executable 将托管程序集(dll)注入到新创建（并且挂起）的进程（通过该进程运行的路径注入） Create local hooks within the remote process to monitor 3 file operations (CreateFile, ReadFile and WriteFile) 通过远程程序创建本地hook，完成CreateFile, ReadFile 和WriteFile3种操作 Report file accesses back to the main console application using .NET inter
订阅 easyhook