Click here to Skip to main content

Submit your article

Hooking

hooking

Great Reads

PolyHook 2: C++17 x86/x64 Hooking Library

by stevemk14ebr

PolyHook v2 - the C++17 x86/x64 library supporting multiple methods of hooking

How to Hook 64-Bit Code from WOW64 32-Bit Mode

by Apriorit Inc

Being able to switch between 32-bit and 64-bit modes in Windows is a useful skill. Learn about the heaven’s gate technique and the tools and methods needed for hooking 64-bit processes from the 32-bit WOW64 mode.

Mhook Enhancements: 10x Speed Improvement and Other Fixes

by Apriorit Inc, Artur Bulakaiev

Learn how was increased mhook’s performance, enhanced its capabilities and eliminated certain bugs.

x64 API Hooker + Disassembler

by Member 13737597

This article shows you how to implement trampolines on x64, introduces the idea of sync and async hooks, and dynamically added runtime filters and loggers.

Latest Articles

How to Hook 64-Bit Code from WOW64 32-Bit Mode

by Apriorit Inc

Being able to switch between 32-bit and 64-bit modes in Windows is a useful skill. Learn about the heaven’s gate technique and the tools and methods needed for hooking 64-bit processes from the 32-bit WOW64 mode.

Hooking Linux Kernel Functions, Part 2: How to Hook Functions with Ftrace

by Apriorit Inc, Sergey Stepanchuk

Learn how you can use ftrace to hook critical function calls in the Linux kernel

Hooking Linux Kernel Functions, Part 3: What Are the Main Pros and Cons of Ftrace?

by Apriorit Inc

In this article, we focus on the main ftrace pros and cons and describe some unexpected surprises we’ve faced when hooking Linux kernel functions with this utility.

Hooking Linux Kernel Functions, Part 1: Looking for the Perfect Solution

by Apriorit Inc

Two theoretical ways to protect a Linux kernel module from hooks.

All Articles

Hooking

Losing keyboard hook after connection to access

16 Mar 2023 by 11_

I'm having an issue whereby I've setup a keyboard hook in my application that works perfectly from both within my app and when any other app is in the foreground. I have a need to connect to an external MS Access database, but on doing so I...

28 Feb 2014 by _Ravikant Tiwari_

This program will demonstrate the process of injecting code into already running processes. Here we have choosen to inject into Explorer

Detection of User-Mode Hooks

6 Nov 2012 by Abhineet Ayan Verma

I am trying to write some codes for detecting the user-mode hooks. Would you please guide me through the steps and ways to detect hooks. Till now I have tried enumerating all the running processes and enumerating the modules for each of the process. I read somewhere to compare the in-memory...

how to hook windows api

2 Feb 2013 by Abhishek Pant

hi,This may help you a little-EasyHook - The reinvention of Windows API Hooking[^]

Handling wh_shell's window destroy message

7 Jan 2013 by analogx

i have written application for WH_SHELL and WH_CBT hooking,the problem with this application is that i'm able to hook window created messages but for window destroy messages my application just crashes,if i comment the window destroy code the application works fine,i have google it and found no...

Handling wh_shell's window destroy message

10 Jan 2013 by analogx

HEY finally found a work around,instead of hooking HSHELL_WINDOWDESTROY message i just use the handle returned from HSHELL_WINDOWCREATED to get the process id using which i could get the handle to process,i stored the process id,handle to process in a singly link list and then wrote a checking...

Hook a process and get files it`s created\deleted\renamed

9 Oct 2016 by Aner Izraeli

I have created a c# program which gets new loaded processstartWatch.EventArrived += new ventArrivedEventHandler(startWatch_EventArrived);and doing stuff when eventHandler fire.afterwards im using:foreach (var runningProcess in Process.GetProcessesByName(ShortProcessName))to get...

Unable to hook registry functions using MS-detours (32bit)

27 Nov 2016 by Aner Izraeli

im using ms-detours to hook functions. im successfully injecting my dll to a process. im successfully catching functions of createfile\deletefile and event see them at "debugView".im unable to catch all registry functions.tried:REGSETVALUEX OrigRegSetValueEx = NULL;REGOPENKEYEXA...

Mhook Enhancements: 10x Speed Improvement and Other Fixes

4 Oct 2018 by Apriorit Inc, Artur Bulakaiev

Learn how was increased mhook’s performance, enhanced its capabilities and eliminated certain bugs.

Hooking Linux Kernel Functions, Part 1: Looking for the Perfect Solution

9 Jan 2019 by Apriorit Inc

Two theoretical ways to protect a Linux kernel module from hooks.

Hooking Linux Kernel Functions, Part 3: What Are the Main Pros and Cons of Ftrace?

17 Jan 2019 by Apriorit Inc

In this article, we focus on the main ftrace pros and cons and describe some unexpected surprises we’ve faced when hooking Linux kernel functions with this utility.

Hooking Linux Kernel Functions, Part 2: How to Hook Functions with Ftrace

22 Jan 2019 by Apriorit Inc, Sergey Stepanchuk

Learn how you can use ftrace to hook critical function calls in the Linux kernel

How to Hook 64-Bit Code from WOW64 32-Bit Mode

23 Mar 2020 by Apriorit Inc

Being able to switch between 32-bit and 64-bit modes in Windows is a useful skill. Learn about the heaven’s gate technique and the tools and methods needed for hooking 64-bit processes from the 32-bit WOW64 mode.

Virtual Table hook under linux

4 Nov 2012 by armagedescu

DWORD on x86 is a 32 bit unsigned integer. Is easy to find definition. Put cursor on DWORD in VisualStudio and press F12.

Unable to hook registry functions using MS-detours (32bit)

27 Nov 2016 by Arthur V. Ratz

I've just reviewed your code and this all seems to me a kind of strange. I'd recommend you to read this article API Hooking with MS Detours

In which process this hook code is actually called?

2 Dec 2021 by Avtem

I wrote a DLL with hook of type WH_GETMESSAGE. What I want to do is store an std::vector inside that DLL and being able to manipulate it from my app. But the problem is that when my app calls DLL function createMyObjects() vector's size...

Hookmanager ... How to run as a windows service

4 Mar 2019 by B4S

Regarding the very helpful article ... Processing Global Mouse and Keyboard Hooks in C# (Processing Global Mouse and Keyboard Hooks in C#[^]) ... I need to run the HookManager in a windows service, but the events will not firing ... any ideas? What I have tried: It runs perfect in a...

Log all keys pressed by user in all applications

4 Nov 2012 by Barakat S.

Here is a simple keylogger I wrote a while ago:#include #define LOG_PATH "log.txt"HANDLE hFile;HHOOK hHook;LRESULT CALLBACK MessageProc(int nCode, WPARAM wParam, LPARAM lParam);INT WINAPI WinMain(HINSTANCE hInstance, HINSTANCE HHGG, LPSTR lpCmdLine, int...

Driver hooking ZwQueryDirectoryFile causes Blue Screen

5 Nov 2012 by Barakat S.

You should start learning how to debug your driver and do driver crashes analysis. A good place to start with: http://www.dedoimedo.com/computers/windows-bsod.html[^]. You will find many articles, technics and tools there on the Internet regarding this topic.

Looking for a 32/64 bit WM_MOVING global hook source C++ sample.

20 May 2014 by bling

This article has some useful information on creating a DLL that loads into each applications's address space. The article is a bit dated in that the advice on creating a shared section of memory doesn't work with Windows Vista and later.Hooks and DLLs[^]The key is - I think - the...

Where can I get Desaware.shcomponent.dll ?

25 Mar 2014 by CHill60

From Desaware.http://www.desaware.com/purchase/index.aspx[^]

Difference between the keyboard hooks(WH_KEYBOARD and WH_KEYBOARD_LL)

7 Apr 2020 by Coder969

I want to understand which hook is used for what purpose. What I have tried: I have googled and only difference I understood is WH_KEYBOAD will inject the dll into the processes but for the WH_KEYBOAD_LL windows will make a direct call to call back function without injecting the dll. So...

Modifying an out parameter of a hooked function

5 Aug 2014 by Cristi A

I want to hook EnumProcesses() and, as a first exercise, remove some process IDs from the array it populates.This is an out parameter so I had to let the function to execute, and then to do my dirty thing.Basic idea, using a DLL that can be injected into a process:- hook...

C# - Hooking to a specific application

6 Dec 2013 by Dave Kreskowiak

No, there is no way to get messages directed at a specific application. Your hook code sits between the keyboard driver and the control with the input focus. Notice that there is no destination information in the data that is passed to your hook code. You have no idea where it's going and no...

Has someone the library Desaware.shcomponent.dll ? If you have it, please, let me know

24 Mar 2014 by Dave Kreskowiak

Considering that's a product you have to pay for to get the library, nobody is going to hand over their copy of it.

which HOOK is called when a directory or a file (say hook.txt ) is opened ?

27 Aug 2014 by Dave Kreskowiak

None. No such "hook" exists.Opening a file in an application is not some mystical thing. It happens all the time, system wide, not just when you double-click something.

Question regarding global hooks

13 Nov 2017 by Dave Kreskowiak

All it means is that any messages your hookProc code gets passed into it should be passed to the next hook in the chain using CallNextHookEx. You can find an example of that here[^] in globalKeyboardHook.cs. Usually, you don't modify the values you get passed into your hookProc, but there's...

How to use minhook? What's the purpose of the precompiled DLL's?

7 Feb 2018 by Dave Kreskowiak

Post your question in the bottom of the article MinHook - The Minimalistic x86/x64 API Hooking Library[^]. Articles are supported by the people that wrote them, not by the community at large.

Win32/64 bit API hooking for kernel mode

19 Sep 2022 by Dave Kreskowiak

It sounds like what you're looking for is "Detours"[^]

Createprocessw hook is not working properly

8 Feb 2023 by Dave Kreskowiak

Your code, running as your account, cannot intercept calls being made by another account, or an elevated account. This is for security reasons. Think about it. Would you want some schmuck user intercepting code running as administrator and...

Get coordinates of Mouse Click

6 Sep 2015 by dave_bulac

Hello guys.I am working in windows Form and need a code , which gives me on Form coordinates of Mouse Click. Click must be made outside of the Form , for example in Browser. To detect coordinates on Form is easily but I can't say the same when Click is made outside the Form. I have searched and...

Log all keys pressed by user in all applications

4 Nov 2012 by debdipta_ghosh

I want to log all keys pressed by user in all applications.... (Catch message WM_CHAR)....Is hooking WM_CHAR is that solution?? Any link of documentation???can any one help me?

Windows print/spooler hook method...

2 Feb 2013 by debdipta_ghosh

Hi, I want to hook all info related to printer and what was printed, i.e I actually want to hook Spooler?Any idea what to be sent to "SetwindowHookEx"?Thanks

how to hook windows api

2 Feb 2013 by debdipta_ghosh

I want to Hook "StartDocPrinter" api (http://msdn.microsoft.com/en-us/library/windows/desktop/dd145115(v=vs.85).aspx[^])Any idea or article how to hook a api?thanks

Virtual Table hook under linux

2 Nov 2012 by DJ Fire-Black

Hi !I have a little function which is used to hook virtual functions under Windows x86.I have to port it or linux x86, I know I have to use mprotect but this is abstract for me, I've searched all the night on google, here and on other site but ... wtf ... no answer at all ?? Linux doesn't...

How to set a window hook in other application?Using C#

3 Aug 2013 by DragonetLi

I want to do this:set a window hook in an application such as cal.exe、IE,and if I press any key,my application can show me what key I pressed by message.show();Using C# please!I try to find the solution,but no one can help me ,please show me the code,thanks!My English maybe very bad,so don't care

Hookmanager ... How to run as a windows service

4 Mar 2019 by F-ES Sitecore

You won't get this working as services have their own separate desktop\user session from the logged in user so your service code can't access anything on the interactive desktop such as mouse and keyboard events. It works fine from your application as your application is running as your...

Capture browser click event,form fields events in Windows application

17 Feb 2014 by gautam05

I am working on a Windows application developed in C#. The Windows application is required to capture the user inputs from Internet Explorer. For example, when user clicks on “Submit” button in the browser, the Windows application should be able to capture that event and also capture the text...

How Do I Extract An Api Sequence Of Each Process At Runtime (With Dynamic Analysis)?

18 May 2014 by hassan_sayfi69

I want to follow the behavior of each process (trace each process)at runtime just like antivirus. SSDT hooking is not applicable because hook 4000 API is nearly impossible. can anybody help me?

How do I add a new system call to SSDT

25 Sep 2014 by hassan_sayfi69

Hello to all you hackersOn windows, can I add a new system call to the SSDT, like zwOpenfile2, for special purposes. If it can or you know how it's possible, give me some help. Thank you for your help.

How can I get Thread Id from its handle in NtCreateThreadEx(&ThreadHandle,...)?

18 Jul 2015 by hassan_sayfi69

HiHow can I get Thread Id from its handle in NtCreateThread(&ThreadHandle) system call or NtCreateThreadEx(&ThreadHandle, ...)?I try to load thread's information by calling NtQueryInformationThread but this system call fails with ambiguous error code. Now I need a solution to get an ID of...

[C#] Need draw a text string to a process game window

10 Jul 2013 by havilove

Im trying to make a plugin for Age of Empires (AOE). I want to display a message on screen of game when im playing I think must use SetWindowsHookEx and draws overlay in response to WM_PAINT messages. But im not strong with Hook. Im searching for a simple code snippet which can help me draw a...

hookapi to make printer to image

23 Dec 2014 by hiroyukki

I encountered the same problem when I writing printer content monitor.I hooked StartDocW EndDoc StartPage EndPage and hook many GDI APIS (DrawTextExA, FillRect ...)when StartDocW occured.I tee gdi actions to emf file to get the printer content. It works ok usually, but as same as your...

Detection of User-Mode Hooks

7 Nov 2012 by JackDingler

There are no quick answers for this one.I could post google links for you, but I'd bet that, you've been there, done that.I'd start with getting a good understanding of how user hooks work.

windows ll_keyboard_hook and ll_mouse_hook trying to disable input.

3 Dec 2012 by jamescaunt

Hi, im trying to disable user input using global system hooks. heres some of my code. my understanding is mouse input should be disabled as it is not passed down after PlaybackMouseHook is called. However when i run this code, i can still move the mouse. It looks as if the hook works for a bit...

Hooking Into Another Application In C#

13 Aug 2013 by Jean A Brandelero

Just searched a little and found this:A Flexible Plugin System[^]Edit:you can simple use this to get a value from the main exe:int x = (int)System.Reflection.Assembly.GetEntryAssembly().GetType("SharedVarsClass").GetField("SharedVar").GetValue(null);

Catch and disable Sleep and Win L buttons

24 Oct 2012 by Jochen Arndt

You may disable the Windows key (or use a keyboard without this key). This should prevent the excution of the logoff and other commands. See the KB article How to disable the keyboard Windows key[^]. Additional keys - like a sleep key on your keyboard - can be added to the registry value. The...

Error 5 (access denied) for when calling getpointerframeinfo

27 Mar 2018 by KarstenK

Access denied is often the cause when the call needs elevated right. Try to run the code with administrator rights. The same error is typical when the pointer is from another thread.

how to use Windows keyboard_hook

22 Aug 2014 by keyur chauhan

I want to prepare a keyboard hook just to know how hooking works , I am using visual studio 2012 for this purpose.so can anyone tell me what files I will need to create and link with ?Thanks in advance for your help , I appreciate it.

which HOOK is called when a directory or a file (say hook.txt ) is opened ?

27 Aug 2014 by keyur chauhan

someone please tell me the answer ?

Hook a process and get files it`s created\deleted\renamed

9 Oct 2016 by Kornfeld Eliyahu Peter

I do not think you can tell why a process opened a file, but can tell the files the process currently holds open...First of all you have to dig into old WIN32 APINtQuerySystemInformation[^]This function is not much documented and the help page will not contain the SystemHandleInformation...

Monitoring both sides of chats

20 Feb 2013 by Kucera Jan

Hi,I would recomend using a sniffer. If you want to use existing application you can use Ethercap or Wireshark or TCPDUMP.If you, though, want to implement your own sniffer, you shall study LIBPCAP libreary.Best RegardsJ. K.

Driver hooking ZwQueryDirectoryFile causes Blue Screen

5 Nov 2012 by lilyNaz

Hi,I wrote a driver which hooks ZwQueryDirectoryFile and hides a file, "o.txt", but when I access "o.txt" directly using its name (which of course I know), for instance, when I try to delete it in command Prompt using >del o.txt ,the system crashes and I see the blue screen. What should...

How to prevent Dll injection by using SSDT Hooking?

5 Jan 2013 by lilyNaz

I need to stop processes which are trying to inject DLL. I know that CreateRemoteThread and SetWindowsHookEx are used by malwares to do so. What Functions in kernel mode, in my driver, do I have too hook,SSDT Hooking, in order to prevent these processes from injecting dlls?Is there any other...

hookapi to make printer to image

4 Sep 2014 by liutaoxwl

i want to get a image when user print from other applications.then i hook some api.first i hooked createdcw and in my hook funciton, i create a memory dc(by CreateCompatibleDC(NULL) ) and return. but the target application show a error.then, i in my createdcw i create both printer...

How to protect browser from API Hooking?

24 Feb 2013 by marwen109

According to this article, i'm looking for an idea to protect browser from this attack, it's called en.wikipedia.org/wiki/Form_grabbing , the malware hook the API call of the browser when he send the request and before its encrypted with(HTTPS/SSL)..I don't know if just sandboxing the browser...

about a question of the article:"Windows Live Messenger Plug-in Development Bible"

10 Sep 2013 by Member 10261671

I read this article.But I didn't understood it how the code run.The code don't main function.The code can createdll file,no exe file.So it how can do.I really understand.Please help me.Thank you very much!

C# - Hooking to a specific application

6 Dec 2013 by Member 10436245

The following code hooks successfully of all open windows and applications on my desktop:IntPtr hInstance = LoadLibrary("User32.dll");callbackDelegate = new HOOKPROC(HookCallback);hhook = SetWindowsHookEx(WH_KEYBOARD_LL, callbackDelegate, hInstance, 0);However, I would like to hook to...

Capturing button, checkbox clicks from another application

17 Apr 2014 by Member 10503105

Tried to ask this several times, but still didn't get an answer. At least after several weeks my question are became more... understandable I guess...So far I am trying to create an aplication which will do second things: I run aplication. While it is working, when I am clicking on button or...

Looking for a 32/64 bit WM_MOVING global hook source C++ sample.

20 May 2014 by Member 10562606

Hello, I'm looking for a source sample to detect any window move (thus, a global hook) in x86/x64 windows systems.I've searched a bit but all I found about global hooks end in keyboard/mouse samples.I've checked the MinHook project which comes with different type of keyboard samples...

Difference between the keyboard hooks(WH_KEYBOARD and WH_KEYBOARD_LL)

7 Apr 2020 by Member 10779791

how i can trace application name or browser url where typing something?? Example if i a\m typing on word then it will return word if it will a exe file then exe file name?? Any suggestion Thankls in Advance

Easy Hook Tutorial - output drawed text

13 Dec 2014 by Member 11308457

If anyone could show me a simple easy hook tutorial it would be much appreciated:the program hooks chrome.exe or calc.exe and outputs every drawed text. (in case of calc.exe: MC MR MS M+ M- Ce C 7 8 9 etc. )thank you

How to get handle of children inside a PTIODEVICE using java in windows

8 Aug 2015 by Member 11895995

Hi,I am attempting to peek into a casino game window to see what is happening inside the thread of the PTIODEVICE by using something along the lines of a windows hook.After googling about "Class: PTIODEVICE" i've discovered that there is a hierarchy below the top level Class...

How to get handle of children inside a PTIODEVICE using java in windows

8 Aug 2015 by Member 11895995

ok I figured out that I just needed to enumerate the child windows to find the handle of the INTERNET EXPLORER_SERVER

Hooking messageboxa using a DLL

21 May 2016 by Member 12537558

I've recently created a "hello world" c++ program:#include int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd){ MessageBoxA(NULL, "Hello World!", "", MB_OK); return 0;}What I need to do now is create a dll that...

How to use minhook? What's the purpose of the precompiled DLL's?

7 Feb 2018 by Member 13536260

so I went here And downloaded the realeses from the github repo, But I don't understand something here, How do i use this, Do i only have to call the MinHook.h ? and use some functions from it? if yes then what is the purpose of precompiled dll in this link:...

x64 API Hooker + Disassembler

8 Nov 2018 by Member 13737597

This article shows you how to implement trampolines on x64, introduces the idea of sync and async hooks, and dynamically added runtime filters and loggers.

How to apply a simple detours hook?

23 Oct 2019 by Member 14631177

I'm attempting to make Detours hooking on CreateFile() by calling notepad.exe. Starting withdll /d:HookProject.dll "C:\Windows\System32\notepad.exe" in command prompt, I don't see any traceable dll hook application, but only DLLMain() call from ntdll.dll module (my tracing tool is API...

Why can't I print my watermark in chrome and edge?

2 Dec 2020 by Member 14872681

Hello. I'm a developer who needs help. First of all, I hope you understand that the sentence structure can be strange as I ask questions using a translator machine. I am currently working on a program that requires watermarking on any...

Win32/64 bit API hooking for kernel mode

19 Sep 2022 by Member 15635207

Hello Folks, It is possible to hook 32 and 64 bit Windows API's from kernel mode? Any references will be helpful. If there any such kernel drivers , commercial or non-commercial, please do share - viks What I have tried: Tried google, and...

Unable to hook registry functions using MS-detours (32bit)

21 Jun 2020 by Member 3017361

I hit the same problem: took a day of debugging what to hook. If you want to hook the registry access -- you need to snag the versions in kernelbase.dll not advapi32.dll or kernel32.dll. Otherwise some things will hook, but others, like...

Monitoring both sides of chats

20 Feb 2013 by Michael Haephrati

How can a parental control monitor both sides of chats? That should be done not by using keyboard hooks (which will monitor only one side of the conversation), but instead, by identifying the window and the control (listbox, editbox, etc.) used for communication, and capturing it textually. Is...

Monitoring both sides of chats

15 Oct 2012 by Michael Haephrati

Skype for example encrypts it. Also, I am interested in discussing the question: is it possible to identify the UI element used by common chat application and capture the text inside it.

32bit Flash thunk hook code OK. but 64bit code occur 'Access Violation'.

2 Aug 2015 by migurazi

I write vc++ code with flash.I want to hooking flash because mouse right button operation and flash's transparent.In my code, use flash32*.ocx or flash64*.ocx (Active-X) reference code :1. 플래시콘 컨트롤 (FlashconAxWindow) | 마을 :: 컨텐츠 상세보기 (korean. sorry^^)2. Another new thunk...

How can i capture the file selected message in Windows Explorer?

17 Nov 2012 by ohsorry

How can i capture the file selected message in Windows Explorer?on desktop or in windows explorer if a file or a folder's (or something else with a icon ) status is selected,then show a messagebox and print it's full name?if multiple selected print all of them?suppose I have the...

Log all keys pressed by user in all applications

4 Nov 2012 by pasztorpisti

Besides global hooks its a good practice to use a driver, but there are so many points where you can put your filter in. More these: http://www.securelist.com/en/analysis/204792178/Keyloggers_Implementing_keyloggers_in_Windows_Part_Two[^]Alternatively:...

Catch and disable Sleep and Win L buttons

24 Oct 2012 by PJ Arends

I have set up a low level keyboard hook to filter out any unwanted keys that would allow a user (in this case my two year old daughter) from switching to another app or otherwise being able to leave the current app. The only problems so far are the sleep (VK_SLEEP) and Win + 'L' (Log Off) keys....

Catch and disable Sleep and Win L buttons

29 May 2013 by PJ Arends

I solved the Sleep button issue. See my tip: How to disable the Sleep button while your code is running[^]Not sure why this solution was deleted but I have resubmitted it.

Monitoring both sides of chats

15 Oct 2012 by PrafullaVedante

Why dont you try packet sniffing. Protocol used by most of the chat clients are known, you can decode it to get the message. There are readymade softwares are available, e.g. ArcMentor (I was working on this at my previous organization ;) )

C# simple sending joystick input to program

13 May 2023 by prohetguy

hello, so I was trying to make a program in C# where u send a joystick input to program, what I mean by that is there is no google search on it and I want to know if there is a way to hook a Dll into a program with controller index, as I how many...

Installing Keyboard hooks to specific process

18 Jan 2014 by Raul Iloc

The last parameter should be: AppDomain.GetCurrentThreadId()

Virtual Table hook under linux

2 Nov 2012 by Richard MacCutchan

Try this sample[^]. I do not think that DWORD is defined in any of the Linux C/C++ headers, but you can add it yourself quite easily.

Difference between the keyboard hooks(WH_KEYBOARD and WH_KEYBOARD_LL)

16 Sep 2019 by Richard MacCutchan

It is all described at Hooks Overview - Windows applications | Microsoft Docs[^].

How to do local hook to notepad in C++?

28 Aug 2021 by Rick York

I don't have an answer for you but there many articles on the topic of hooks at this site. Hopefully one of them will be of use to you. Are are links to a few of them : API hooking revealed[^] Mouse and KeyBoard Hooking utility with VC++[^]...

In which process this hook code is actually called?

2 Dec 2021 by Rick York

Hook procedures are called in the context of the process that generates the message. Here is what the docs (Hooks Overview - Win32 apps | Microsoft Docs[^]) say on the topic : Quote: A global hook monitors messages for all threads in the same...

C# simple sending joystick input to program

12 May 2023 by Rick York

I would start by looking at the articles on this site about joysticks : Search for Joysticks at CodeProject[^] That will show you how the interfaces work. Once you understand that then you should be able to implement your own interface. That...

How to apply a simple detours hook?

23 Oct 2019 by RickZeeland

Maybe this CodeProject article will clear things up: API Hooking with MS Detours[^] Also see: MinHook - The Minimalistic x86/x64 API Hooking Library[^]

Getting 2 pointerup messages for 1 pointerdown message in chrome or firefox

25 Oct 2017 by Roger1990

Hi All, I am capturing the count of PointerDown and PointerUp touch events, using global hook 'WH_GETMESSAGE'. For every PointerDown touch, I am supposed to get one PointerUp touch. But in case of touch events inside google chrome or firefox, I am getting 2 pointerUp events for 1 pointerDown...

Question regarding global hooks

13 Nov 2017 by Roger1990

I found this extract in the 'remarks' section of the documentation for SetWindowsHookEx function ("https://msdn.microsoft.com/en-us/library/windows/desktop/ms644990(v=vs.85).aspx"): "To hook all applications on the desktop of a 64-bit Windows installation, install a 32-bit global hook and a...

Error 5 (access denied) for when calling getpointerframeinfo

27 Mar 2018 by Roger1990

I am trying to call the GetPointerFrameInfo function to get the pointer count but the function seems to fail with Error 5 (Access Denied). Any idea why that is happening and how I can resolve it? I am trying to call the same inside the hook procedure GetMsgProc as mentioned in the 'What have...

Log all keys pressed by user in all applications

4 Nov 2012 by Sergey Alexandrovich Kryukov

The solution is using a global Windows Hook; using "global" is an important key. Please see:http://msdn.microsoft.com/en-us/library/windows/desktop/ms632589%28v=vs.85%29.aspx[^].Make sure you don't do evil!—SA

How to protect browser from API Hooking?

24 Feb 2013 by Sergey Alexandrovich Kryukov

The sandboxing is not a solution. You can consider a sandbox as a separate system isolated from your host system. If something bad happens to the sandbox, it won't infect the host system or damage it otherwise. In other words, a sandbox is a method to try something risky or questionable without...

Need example with hooks for catching a window's messages

10 May 2013 by Sergey Alexandrovich Kryukov

In case you don't know yet: this is related to this Windows API function: http://msdn.microsoft.com/en-us/library/windows/desktop/ms644990%28v=vs.85%29.aspx[^].See also: http://msdn.microsoft.com/en-us/library/windows/desktop/ms644959%28v=vs.85%29.aspx[^].As to the samples, now when you...

Global keyboard hook works only in thread level

6 Jun 2013 by Sergey Alexandrovich Kryukov

Please see my comments to the question and think about it.For first step, please try the following: instead of "printing some messages", do the following: send Beep to the speaker (first, make sure it works in a "normal" application), something like:#include...

How to set a window hook in other application?Using C#

3 Aug 2013 by Sergey Alexandrovich Kryukov

Please see my recent answer: How to set a window hook in other application?[^].—SA

Hooking Into Another Application In C#

13 Aug 2013 by Sergey Alexandrovich Kryukov

First, you can use the Microsoft MEF framework:http://en.wikipedia.org/wiki/Managed_Extensibility_Framework[^],http://mef.codeplex.com/[^],http://msdn.microsoft.com/en-us/library/dd460648%28VS.100%29.aspx[^].You can do it yourself, especially if you need it as simple as you really...

Capturing button, checkbox clicks from another application

17 Apr 2014 by Sergey Alexandrovich Kryukov

Bad idea. In general case, this is impossible. The processes are designed to be isolated, to minimize possible intervention from other processes, eliminate clashes in memory (each process is executed in a separate memory space, which is based on hardware isolation of memory).In some cases,...

how to use Windows keyboard_hook

22 Aug 2014 by Sergey Alexandrovich Kryukov

Please see my comment to the question.Everything is clearly explained here:http://msdn.microsoft.com/en-us/library/windows/desktop/ms644959%28v=vs.85%29.aspx[^],http://msdn.microsoft.com/en-us/library/windows/desktop/ms644990%28v=vs.85%29.aspx[^].There are two types of "keyboard...

Easy Hook Tutorial - output drawed text

13 Dec 2014 by Sergey Alexandrovich Kryukov

There cannot be an "easy tutorial" because of one very obvious reason: Window hooks are not easy to work with, notoriously hard to debug, and so on. Chances are, the easiest tutorials would be the worst, in terms of getting to the results you want. And I don't recommend doing the works you...

How can I get Thread Id from its handle in NtCreateThreadEx(&ThreadHandle,...)?

20 Jul 2015 by Sergey Alexandrovich Kryukov

In Windows, this is how: https://msdn.microsoft.com/en-us/library/windows/desktop/ms683233%28v=vs.85%29.aspx[^].Note that the handles are only valid inside a single process (it can be inherited as is by child processes); and the same arithmetic value can be something different or meaningful...