From 738f2f72cedf66f99a7543dfd51c337c0b83eee4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E1=9E=90=E0=B2=98=E0=AA=85=E0=B4=9E=EF=AD=84=20=E1=B9=9B?=
=?UTF-8?q?=E0=BD=A5=E0=AA=9A?= <42241901+arsium@users.noreply.github.com>
Date: Sun, 28 Nov 2021 01:03:13 +0100
Subject: [PATCH] First
* added kernel32 routines
---
HookLib.cs | 44 +++++++++++++++
HookLib.csproj | 50 ++++++++++++++++++
NativeAPI.cs | 22 ++++++++
Properties/AssemblyInfo.cs | 36 +++++++++++++
...gnTimeResolveAssemblyReferencesInput.cache | Bin 0 -> 6646 bytes
.../HookLib.csproj.AssemblyReference.cache | Bin 0 -> 6 bytes
.../HookLib.csproj.CoreCompileInputs.cache | 1 +
.../HookLib.csproj.FileListAbsolute.txt | 6 +++
obj/Release/HookLib.dll | Bin 0 -> 6144 bytes
obj/Release/HookLib.pdb | Bin 0 -> 24064 bytes
10 files changed, 159 insertions(+)
create mode 100644 HookLib.cs
create mode 100644 HookLib.csproj
create mode 100644 NativeAPI.cs
create mode 100644 Properties/AssemblyInfo.cs
create mode 100644 obj/Release/DesignTimeResolveAssemblyReferencesInput.cache
create mode 100644 obj/Release/HookLib.csproj.AssemblyReference.cache
create mode 100644 obj/Release/HookLib.csproj.CoreCompileInputs.cache
create mode 100644 obj/Release/HookLib.csproj.FileListAbsolute.txt
create mode 100644 obj/Release/HookLib.dll
create mode 100644 obj/Release/HookLib.pdb
diff --git a/HookLib.cs b/HookLib.cs
new file mode 100644
index 0000000..4834e70
--- /dev/null
+++ b/HookLib.cs
@@ -0,0 +1,44 @@
+using System;
+
+namespace HookLib
+{
+ public class HookLib
+ {
+ private string LibToHook { get; set; }
+ private string FunctionToHook { get; set; }
+ public byte[] NewBytes { get; set; }
+ private uint SizeOfNewBytes { get; set; }
+ public bool IsHooked { get; set; }
+ public byte[] OldBytes { get; set; }
+ private IntPtr ProcessToHook { get; set; }
+
+ public HookLib(IntPtr ProcessToPatch, string LibName, string FunctionName, byte[] BytesToHook, uint SizeOfBytesToHook)
+ {
+ OldBytes = new byte[SizeOfBytesToHook]; //first we need a buffer to restore old function bytes to unhook it
+ ProcessToHook = ProcessToPatch;
+ LibToHook = LibName;//the lib ex kernel32 or ntdll
+ FunctionToHook = FunctionName;//name of the function you want to hook
+ NewBytes = BytesToHook;//bytes you want to use as replacement of our function address
+ SizeOfNewBytes = SizeOfBytesToHook;//the size of hooked bytes
+ }
+
+ public bool HookedFunction()
+ {
+ IntPtr AddressOfLib = NativeAPI.GetModuleHandle(LibToHook);//getting lib address in our program
+ IntPtr FunctionAddress = NativeAPI.GetProcAddress(AddressOfLib, FunctionToHook);//getting function address in our program
+ NativeAPI.ReadProcessMemory(ProcessToHook, FunctionAddress, OldBytes, SizeOfNewBytes, 0);//read the original bytes from our function address and store them if you want to restore
+ return IsHooked = NativeAPI.WriteProcessMemory(ProcessToHook, FunctionAddress, NewBytes, SizeOfNewBytes, 0);// here we hooked the function : the address of our function is replace by our code (asm or opcode !)
+ }
+
+ public bool UnHookedFunction()
+ {
+ IntPtr AddressOfLib = NativeAPI.GetModuleHandle(LibToHook);//getting lib address in our program
+ IntPtr FunctionAddress = NativeAPI.GetProcAddress(AddressOfLib, FunctionToHook);//getting function address in our program
+ if (NativeAPI.WriteProcessMemory(ProcessToHook, FunctionAddress, OldBytes, SizeOfNewBytes, 0))//here we unhook the function by setting the original bytes from our buffer
+ IsHooked = false;
+ else
+ IsHooked = true;
+ return IsHooked;
+ }
+ }
+}
diff --git a/HookLib.csproj b/HookLib.csproj
new file mode 100644
index 0000000..f382eaa
--- /dev/null
+++ b/HookLib.csproj
@@ -0,0 +1,50 @@
+
+
+
+
+ Debug
+ AnyCPU
+ {89130CAD-DC21-46A6-930F-8898E61F3E0E}
+ Library
+ Properties
+ HookLib
+ HookLib
+ v4.5
+ 512
+ true
+
+
+ true
+ full
+ false
+ bin\Debug\
+ DEBUG;TRACE
+ prompt
+ 4
+
+
+ pdbonly
+ true
+ bin\Release\
+ TRACE
+ prompt
+ 4
+ true
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/NativeAPI.cs b/NativeAPI.cs
new file mode 100644
index 0000000..4945bd4
--- /dev/null
+++ b/NativeAPI.cs
@@ -0,0 +1,22 @@
+using System;
+using System.Runtime.InteropServices;
+
+namespace HookLib
+{
+ internal class NativeAPI
+ {
+ private const String KERNEL32 = "kernel32.dll";
+
+ [DllImport(KERNEL32, SetLastError = true)]
+ internal static extern IntPtr GetModuleHandle(string lib);
+
+ [DllImport(KERNEL32, SetLastError = true)]
+ internal static extern IntPtr GetProcAddress(IntPtr Module, string Function);
+
+ [DllImport(KERNEL32, SetLastError = true)]
+ internal static extern bool WriteProcessMemory(IntPtr ProcessHandle, IntPtr Address, byte[] CodeToInject, uint Size, int NumberOfBytes);
+
+ [DllImport(KERNEL32, SetLastError = true)]
+ internal static extern bool ReadProcessMemory(IntPtr ProcHandle, IntPtr BaseAddress, byte[] Buffer, uint size, int NumOfBytes);
+ }
+}
diff --git a/Properties/AssemblyInfo.cs b/Properties/AssemblyInfo.cs
new file mode 100644
index 0000000..8be830d
--- /dev/null
+++ b/Properties/AssemblyInfo.cs
@@ -0,0 +1,36 @@
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+// Les informations générales relatives à un assembly dépendent de
+// l'ensemble d'attributs suivant. Changez les valeurs de ces attributs pour modifier les informations
+// associées à un assembly.
+[assembly: AssemblyTitle("HookLib")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyConfiguration("")]
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyProduct("HookLib")]
+[assembly: AssemblyCopyright("Copyright © 2021")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyCulture("")]
+
+// L'affectation de la valeur false à ComVisible rend les types invisibles dans cet assembly
+// aux composants COM. Si vous devez accéder à un type dans cet assembly à partir de
+// COM, affectez la valeur true à l'attribut ComVisible sur ce type.
+[assembly: ComVisible(false)]
+
+// Le GUID suivant est pour l'ID de la typelib si ce projet est exposé à COM
+[assembly: Guid("89130cad-dc21-46a6-930f-8898e61f3e0e")]
+
+// Les informations de version pour un assembly se composent des quatre valeurs suivantes :
+//
+// Version principale
+// Version secondaire
+// Numéro de build
+// Révision
+//
+// Vous pouvez spécifier toutes les valeurs ou indiquer les numéros de build et de révision par défaut
+// en utilisant '*', comme indiqué ci-dessous :
+// [assembly: AssemblyVersion("1.0.*")]
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
diff --git a/obj/Release/DesignTimeResolveAssemblyReferencesInput.cache b/obj/Release/DesignTimeResolveAssemblyReferencesInput.cache
new file mode 100644
index 0000000000000000000000000000000000000000..06b280195d3e7d674d4dd30491bf0fae7337f6ad
GIT binary patch
literal 6646
zcmeHMQBNC35VpZwFoYD-ln`iAr;XYqbxwAH0Fih|Y#dMtLbgRKVT-Kq#%9Cat-HGi
zxQO4b7AI%>k4nHu#rjcfmB?0>$w#(OMjVk-gmSwVci2?OXg(KyMEo_*00d6
zh$HaU>)FM|a$}{D%h}6Ww#dc^a`iJvZ+-6Agtz5skfQaQWUUrRv&7_<*YdS`h=U(8
z#}OxBzflU@y3^h`)!>m=Y6^Sjh1cNCB6nccVxG-yrlHr9v}&Q@J5EtD7fysc>NQnZ
z9oz1I(pD6Xjq`m>$_kTB(BZJMUss@a(1?1DRrYMZx@|+s*1{x-46gf0Z&_O*oYjNVi$x##&$pqbwkw7{SOWr|&U*jZ_Bqm5q
zqL?u5qKp|+DBhlxy3FZy8Hw}>lTZ!GZq?k`sDvCcbG&3OXL0&M-ixba{+8wdiI@5Z@t0BRYs3(B`Jro$N~^7K;w+ch?D4=Sj3v
zBA9LN{Xtj>Iwyxu_uY2ot{OW~{7)D^IPMg*u;rgbc&=W3zaPH5
zQz`GWb%rSNe$b0Q;8&Ub+W2_#dpz}eSBh976*r9^P?RG$-cv+D1B9n|lPF?YGEQ_f
z;HVc}i4#A)qD>KDr7K0GmAo~6L@{@kzqU?#Zv2F;GiRIJ(^MIwlGzq+opa+E>gUfY
z*B1fX=f-nv9|RA6fp(_OO6-KFAQcJEjh|8V@{82C&b^Qtr-<&{yjXgzVy$B;fWO%g=>@l0fI!GE&u=k
literal 0
HcmV?d00001
diff --git a/obj/Release/HookLib.csproj.AssemblyReference.cache b/obj/Release/HookLib.csproj.AssemblyReference.cache
new file mode 100644
index 0000000000000000000000000000000000000000..204fdef644eaa2e6de09b015f5f4588ab58aa14d
GIT binary patch
literal 6
LcmZQ$WB>vH051Rt
literal 0
HcmV?d00001
diff --git a/obj/Release/HookLib.csproj.CoreCompileInputs.cache b/obj/Release/HookLib.csproj.CoreCompileInputs.cache
new file mode 100644
index 0000000..4e4934a
--- /dev/null
+++ b/obj/Release/HookLib.csproj.CoreCompileInputs.cache
@@ -0,0 +1 @@
+976ca941126dfbcd99394a0fc6031ee54a4edf42
diff --git a/obj/Release/HookLib.csproj.FileListAbsolute.txt b/obj/Release/HookLib.csproj.FileListAbsolute.txt
new file mode 100644
index 0000000..2aaf5fe
--- /dev/null
+++ b/obj/Release/HookLib.csproj.FileListAbsolute.txt
@@ -0,0 +1,6 @@
+F:\Personal\HookFunction\HookLib\bin\Release\HookLib.dll
+F:\Personal\HookFunction\HookLib\bin\Release\HookLib.pdb
+F:\Personal\HookFunction\HookLib\obj\Release\HookLib.csproj.AssemblyReference.cache
+F:\Personal\HookFunction\HookLib\obj\Release\HookLib.csproj.CoreCompileInputs.cache
+F:\Personal\HookFunction\HookLib\obj\Release\HookLib.dll
+F:\Personal\HookFunction\HookLib\obj\Release\HookLib.pdb
diff --git a/obj/Release/HookLib.dll b/obj/Release/HookLib.dll
new file mode 100644
index 0000000000000000000000000000000000000000..7988b7b65e1f5e3915bc9465ed93f911ba4465c4
GIT binary patch
literal 6144
zcmeHLTWlOx8UE+8<6E-1r*12^<2ZqBQZMTZRnmsm_t=eNJF(-mG$NVZJzh^dyR)5{
zP2;qU9JLgpsA>f~v{H*g)dm#=j&G9y|D4b6fglnA{HaRFG*WP4
zs40YJq&5H=)zoS<5H+y^V;Y-Nn}DBCt15&FgHW{*^tPr{BbvJH8!`zRfq#VYq5MlH
zw>GGo+0BkR^*SchR0HJOZwhBDDt$>^8!GxSjTDjG_EIj#m94BqPibLm(B0~4-JlDMrH8Vy8P5O>I?b3QlWs+Qkj^TtjA?43Z&Mn(?*i~fdI#7>zXR@|zW}=!?_lg_`Cj@v
zCXZ0qVvFgEO}V_23u?Bp<;z(O@P*c^4U}e
z+5oDk4WR3RDrytxMxcti8uTilin<1L5_neYQMS>Iih`Z;NqR|_?Je{^w>#)vwEBWv
z|Ju?51{o
z!I2SPibbCMT4r}FzH{!#kv=OohYNYg7EYda!^4y-`>a$ARZ6+Qc1zdNPk3%l`2Mxj
z<4(SBJ`ny&$7AAwYiK6zlVW`4ntD0nuvN-Cg7%0YOi9E?!9-lBB1~?~Dhi5c!c4zg
zEZdIo_K1@3tU%;@13aO!l>kmFb`3WmvXw%?$~t1v0-dLA-(Di?^?gyyI`dO@P-|Kh
zdsbc)EpKko%ar9|v4-&ODjsla6>*;-1UM}`AK72*6)XGQ(u`fGAoi=O2ZW#V?DA4&
zIBD*2KseS3ru>z@k;Z%_7pzqDyXAS$F3et4RV-Vj`Ncj5Dy6_K3OOdm$=Z$`)M(|>
z({anG2$IW9zJ$qnKM=)q)H5B;9ov+uyKKS=a`!Dl;>}qjWBC
zz1V)hwhATJ5A2*Di{c!Nlmg+o^DZ}Q6xtvsd1bIGHW~@>i
zpW*ov$gJ>UPIigU9(SoSQnU1IvVNIpj|gPadh>Y?_X71@lQ;`VrccJ5pli
zfUxpWlJ|+C>&??4&kn>=5#NPB+w#;4!&~mz`-R5$T5o^jCl8TsDoVX(l9B+iZk=S4
z5>&lTZC159rMdpX$-~pvcV9l!JV$~&Dghll%sTPt%7b!9HIkaql2DBX)lgNV8SdbN
zS`yM{O9E_zblCtxMQxT$bAy>snv=SM
zZ@y@note%KqFWT&x^q`YS0-oW+w-~3j`r@`tlQdmb!BGSckbM^Q{2`u(IAws@w6<@8&f
z|B{rP!hY0^_}<$nU&?FBGL{ZZ4ovp0dEy^U#Z&uUANWI|>C`LT(%;bShbM6Rxh2av
zEE5qQA!d-3!*2H2VccT^J1mx^%lRxl9(`oWF~2TpQ&KBS{4pA8j`X|UfaC15>{9qN
z6@rg;)bGkRxLF?hN}nG~K12rO*AKq`i58Z2k|%^Ha}~L?lm8vu(}TT?cjmaP(z-!T
z<9+l9a1h@_llTT6r!nv&z@hM87kW+q>%YTyFFArNVS87|@H<#|{2~FG0k)bZ3m3=`
z-mD#5A|tp;X2@lut=wx0S_@JidW!Ob1u+G%vLP>A#nUj`WH9gW*NyK#
z=JDq-TZ`=?6a0@<534xx0eJ8!$8nUG#5s%+T)e-J
zBEl>>XO{GvMn4Zd7w6T1OEgoh^8cz;7)NF%VA~SnaB8Ai>Oa1K<$B6*-BI)@a1S}t
zGR<>@1)7C7;@K~ine-wKq=~CMgNjQK-(NCMi+;it$-{3Eem%@A&Kgk<$2uO3Ay-7k
z8s|uIGSf1)+MF!L9Oh;M{arjrD#&M0Gt=e$h`KqKOYN6ubY(u}y7eMzpXZQ8g!7p3
bf9r>^Kf1*X|1*5`&W~=0A4m58%fNpCp@+yk
literal 0
HcmV?d00001
diff --git a/obj/Release/HookLib.pdb b/obj/Release/HookLib.pdb
new file mode 100644
index 0000000000000000000000000000000000000000..ad2421a7d54c4b057077d908c6366f17e8aca0ca
GIT binary patch
literal 24064
zcmeHOdvH`&89y5!5GarEDpIO}21+2=Y#xw+D1?Magg|&XV;e>`$z8H0*=4fJbDX-)
zP|7G(oN=aFQ4tZ*cC-rPq!lPmJ8jeP54AJ3Gp#dNI}UWFyrh+>6#V_ppx^=YID*Zt8>0o#9A05Y4MDuAVzLuYO%^UWM1^8$EJr%{qaQC4>i2
zF{q1qghCa$zk|U7KRNxe=gbW^+@lt##2mhUkM`Z|_Kh1?o7OCTW%wJp``3xntACdD
z)0da6_`$h<{WW+0VwE5Dqdkx02Hwa$IY)@ABkE3${d2+IuG|SrpZM1HF^@m>?BqP{
z0}uad?bD@|AKuvYYSoXkp0-Y%DmeDvl~>>FK3wsOv*+s1|9&vI%E8!&OpX8WJ(J!N
zHK$)1S=RM@$D>O=9#Z+zlUELIn4e#D`FHgThKwDIwi^t6%GCIud@*$FH|K_hzEEFy
z=v4PN_q5;Nb);q3UuqY3pY1wYdZckM*lIBLVbtp-9gK!*|<_Pc{A%-~pV^|7|OA1>Ch3NHzWw-SNL`$1Bqf%hdYMUH@l#WbTZ-
zOpU+0{=YNhm1!-R8viR3XMOSQ>WW>L%bwctw|A%g`_k?s&mTPhpO+(>n+u;Ab)h`d
z?RMp5#sb$bT))8ko%i`uyRfmr>WqX#{`SV@;c#2+)=+aa7!JwI%3za;z0DCJ0t*|r
z80J=
z?euq8+ryo0g{
z?$^@&3DWztOG9TEMvexpNTX?AT__OlSIf4{nN~Ps|1pSEdo1L9>yj?2XsPR{;<3|JrL
z;((uqWZT#s8Z*Ly#it|LlqIK8q$hTv*4w2qPQ5sJ&gP|R(Wi)iK4ZSYq$-l-e?
z%ARcS)SUuv`dzN)xl{iz;6H8f)W6EwzH}!R1t@d&dyB?8b;DrUGYyuyldz`U&!y0d
zHe}PE+5KJ@+-0o}*bP~|_oI>v?U{@F{?Y+9aC6&F;q|kdGuxkyLdXuom-g)XeBcZ>e
zfu-NG`->G>x5yzqdIW?i6CO
z7?Rrp-YyV%P5nrbpSxk*&PdeikYiCQh7Rps{QfJ)zWiq0iJ3WBe|YBjCd#cBHKG(T
z-|Kw7d9_2cQHOI353mwpy^7>7c(V^7CEKG$-aI+7U02YiR^W&+d^1Fz^dG?33rhp4
zYH8_&Ii+52f7%Nn7*9dFIOqCGJdg}^Dw4lYmi-Y@vaK6JNv&0OJczbV0hTz!YuXE&
zWW2qXp(kIqj_vZ;bB%4}JC*^@TPz=|6T{2rkGy7HCG!?w)na&+PfRTr_?VMd`M=b1
z$?L@|F>;l!OD#7Cyfefsn^*a^)N;xDu$XJ}DqogbF8oCTuku@|<&w8h_-wh#N2Qhv
zUlPm1D44!g_hMi2&J+bUukt~u?togYq${<-!NWX5*_$(_Visa>-jH
zN+d7exk1fqd_d$C601afKjIwm
zbun6$g9<^@L32U*ARl&pBc=Z3;8i}rWBU-g6tj+a0CHeoF%2_JIzAUIU#0T?26+;{z=RwS#tpj)G2u
z-T_?!je~=k4XOb(f_8xRgPsGu209B8@TU_&g`kxn`u*LYI~91>KQ*WL(m1qtAKJ49
zijfq{kY@a(&hOOudbEw@9vx#$WjF<9}$r
zPjr0F$k+9CI{vw?SI>bEztrWH*86vzFVOgnIxf=n^E4i8vc289{<}K%a6}||`CH1DF*Sh4s#ge#_>yxT)
zDVyAlUWD-Rx5H4eM5f2dnP3;o1pK*tf9E5nucVJ#4&pj!6NtWx{&+WNKj;AHDCjuo
zH0V#Dw?OZKE`sPoMqu#hNAf_0ph{2;r~%XnY6V3>G0;BH|07HlGvykH1Mf-N;7t|<
zjym6b9|Ih?!7Py&E_&meLW5Ct8UrUiL+kmPt;eho%}Sf^AEi(6XeO%yRGr2&b8V>n(R;R@#0|B{4B+yi?=kL{-Ye5-neE5Xac^ywg+tVi_Rs2Y8$
zUgO|r??m7;zCEYJ1NQ-6Fzws9VnTF0T6qTfGbk)%IV*MGp7K*Neg3pA!q-A7MOjRl
zyeb_l8iuLV328T#HovqY-X2~Zi_(g!+EQOdwW&9V
zt_e49?XW`8$ehyBva<5Brj{aq<-7$&6QMkRuJK(x%pp?;;C)Qbt$IuL#iC3Vocx5ou#!n7J@%s8|e{-uPibME*
zA|i?-oz2CqmcPa7Y-$fTx2b|au-%Fj2X5lq5Gkjhu!IjkZU%T;UuoQoqAl@9EBT`f
zx=>sfzs0qZQG8WS<^5`B%eKPRviQ`XPcyURkT=868hDf}#ri>zQ
zEl^<|=v9c|*53O~rk%tk?L60z+2IYK;(7cbWd2N3fe%y${o`8Sz5i2-a=JkG{?9RAVkwV(91MLY
z^)ZUg7_(CXijqfs4?)t{>Q=jKt5y-@C+|EvE2
z9qi}-^k11e|L1w~91zd{XMuP}PylkC|38HM3=r=M_}v*VIHrTro&V>fj(6S