Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Hook processes

Tags:

windows

hook

Does anyone know tools like SpyStudio to hook processes? The features I would like to have are:

  • log function calls on other processes
  • GUI
  • scriptable
  • opensource

I already looked at some tools like:

  • SpyStudio
  • Detours
  • DynInst

but none really fully satisfies me.

like image 234
Jazz Avatar asked Nov 18 '08 16:11

Jazz


People also ask

What is a hook in operating system?

In programming, a hook is a place and usually an interface provided in packaged code that allows a programmer to insert customized programming. For example, a programmer might want to provide code that analyzed how often a particular logic path was taken within a program.

What is a hook in API?

API hooking is a technique by which we can instrument and modify the behavior and flow of API calls. API hooking can be done using various methods on Windows. Techniques include memory break point and . DEP and JMP instruction insertion.

What are application hooks?

Application hooks are objects that can be applied like procedures. Each application hook has two parts: a procedure that specifies what to do when the application hook is applied, and an arbitrary object, called extra. Often the procedure uses the extra object to determine what to do.

How does a hook injection work?

Hook injection describes a way to load malware that takes advantage of Windows hooks, which are used to intercept messages destined for applications. Malware authors can use hook injection to accomplish two things: To be sure that malicious code will run whenever a particular message is intercepted.


1 Answers

WinAPIOverride32

The primary usage of WinAPIOverride32 is monitoring/logging function calls of other process. It also has plug-in framework, so you could write your own hook handler. And it is open source (GPL).

like image 189
kcwu Avatar answered Sep 22 '22 12:09

kcwu