Skip to content

Instantly share code, notes, and snippets.

@vallahor
Created January 12, 2024 18:56
Show Gist options
  • Save vallahor/a434001d9758740537cb621a4a033113 to your computer and use it in GitHub Desktop.
Save vallahor/a434001d9758740537cb621a4a033113 to your computer and use it in GitHub Desktop.
Hook Windows API (MessageBox) using Odin Lang
package hook
import "core:fmt"
import "core:intrinsics"
import "core:mem"
import "core:os"
import "core:runtime"
import "core:strings"
import win32 "core:sys/windows"
message_box_hook :: proc "stdcall" (
hwnd: rawptr, text: cstring, caption: cstring, type: u32
) -> i32 {
aeho := intrinsics.constant_utf16_cstring("HOOKED")
context = runtime.default_context()
defer fmt.println("running after message box")
fmt.println("running at hook")
return win32.MessageBoxW(nil, aeho, win32.utf8_to_wstring(string(caption)), type)
}
call_hook :: proc (hook_at: uintptr, new_func: uintptr) {
// jmp_inst := [12]u8{0x48, 0xB9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x51, 0xC3}
jmp_inst := [?]u8{0x49, 0xBA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0xAA, 0x41, 0xFF, 0xE2};
mem.copy(&jmp_inst[2], transmute(rawptr)new_func, size_of(new_func))
old_protection: u32
win32.VirtualProtectEx(
win32.GetCurrentProcess(), transmute(rawptr)hook_at, size_of(jmp_inst),
win32.PAGE_READWRITE, &old_protection)
bytes_written: uint
win32.WriteProcessMemory(
win32.GetCurrentProcess(), transmute(rawptr)hook_at, transmute(rawptr)&jmp_inst,
size_of(jmp_inst), &bytes_written)
win32.VirtualProtectEx(
win32.GetCurrentProcess(), transmute(rawptr)hook_at, size_of(jmp_inst),
old_protection, &old_protection)
}
main :: proc() {
aeho := cstring("AEHO")
win32.MessageBoxA(nil, aeho, aeho, win32.MB_OK)
library := win32.LoadLibraryW(win32.utf8_to_wstring("user32.dll"))
message_box_address := win32.GetProcAddress(library, "MessageBoxA")
message_box_hook_address := message_box_hook
call_hook(uintptr(message_box_address), uintptr(&message_box_hook_address))
win32.MessageBoxA(nil, aeho, aeho, win32.MB_OK)
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment