mirror of
https://github.com/ayoubfaouzi/al-khaser
synced 2026-06-06 15:14:33 +00:00
hfiref0x
62 lines
1.6 KiB
C++
62 lines
1.6 KiB
C++
#include "pch.h"
|
|
|
|
#include "SetWindowsHooksEx.h"
|
|
|
|
BOOL SetWindowsHooksEx_Injection()
|
|
{
|
|
TCHAR lpDllName[] = _T("InjectedDLL.dll");
|
|
TCHAR lpDllPath[MAX_PATH];
|
|
HOOKPROC myFunctionAddress;
|
|
HMODULE hOurDll;
|
|
DWORD dwProcessId, dwThreadId;
|
|
HHOOK hHook;
|
|
|
|
/* Get Process ID from Process name */
|
|
dwProcessId = GetProcessIdFromName(_T("notepad.exe"));
|
|
if (dwProcessId == NULL)
|
|
return FALSE;
|
|
_tprintf(_T("\t[+] Getting proc id: %u\n"), dwProcessId);
|
|
|
|
/* Get thread id from process id */
|
|
dwThreadId = GetMainThreadId(dwProcessId);
|
|
if (dwThreadId == NULL)
|
|
return FALSE;
|
|
_tprintf(_T("\t[+] Getting main thread id of proc id: %u\n"), dwThreadId);
|
|
|
|
/* Get the full path of the dll to be injected */
|
|
GetFullPathName(lpDllName, MAX_PATH, lpDllPath, NULL);
|
|
_tprintf(_T("\t[+] Full DLL Path: %s\n"), lpDllPath);
|
|
|
|
/* Obtain a handle to our injected dll */
|
|
hOurDll = LoadLibrary(lpDllPath);
|
|
if (hOurDll == NULL) {
|
|
print_last_error(_T("LoadLibrary"));
|
|
return FALSE;
|
|
}
|
|
|
|
/* Get 'MyProc' address */
|
|
_tprintf(_T("\t[+] Looking for 'MyProc' in our dll\n"));
|
|
myFunctionAddress = (HOOKPROC)GetProcAddress(hOurDll, "MyProc");
|
|
if (myFunctionAddress == NULL) {
|
|
print_last_error(_T("GetProcAddress"));
|
|
return FALSE;
|
|
}
|
|
_tprintf(_T("\t[+] Found at 0x%p\n"), myFunctionAddress);
|
|
|
|
/* Injection happens here */
|
|
hHook = SetWindowsHookEx(WH_KEYBOARD, myFunctionAddress, hOurDll, dwThreadId);
|
|
if (hHook == NULL) {
|
|
print_last_error(_T("SetWindowsHookEx"));
|
|
return FALSE;
|
|
}
|
|
|
|
/* Unhook */
|
|
_tprintf(_T("SetWindowsHookEx created successfully ...\n"));
|
|
|
|
/* When we want to remove the hook */
|
|
// UnhookWindowsHookEx(hHook);
|
|
|
|
return TRUE;
|
|
|
|
}
|