1
0
Bifurcation 0
Demo for IAT hooking and interception of Win32 API calls
 
 
Aller au fichier
Bob Carroll baf677e3f1 initial commit 2020-06-01 19:59:14 -07:00
gdihook initial commit 2020-06-01 19:59:14 -07:00
.gitignore initial commit 2020-06-01 19:59:14 -07:00
readme.md initial commit 2020-06-01 19:59:14 -07:00
tripwire.c initial commit 2020-06-01 19:59:14 -07:00
tripwire.sln initial commit 2020-06-01 19:59:14 -07:00
tripwire.vcxproj initial commit 2020-06-01 19:59:14 -07:00

readme.md

Tripwire

Tripwire is a demo project for IAT hooking and interception of Win32 API calls.

  1. Start MS Publisher in a suspended state.
  2. Inject our custom GDIHOOK.DLL into the Publisher process.
  3. Inject a Publisher DLL we need to patch.
  4. Read the export address table for GDIHOOK.DLL and find the address of our replacement function.
  5. Read the import address table for Publisher's DLL looking for a specific Win32 API function.
  6. Write the address of our replacement function to the import thunk in Publisher's DLL.
  7. Resume the Publisher thread.
  8. Open a named pipe and wait.
  9. When Publisher calls the Win32 API function we want to intercept, our replacement function sends a signal over a named pipe to tripwire.
  10. Tripwire receives the signal from our DLL. If the intercepted function is never called the Tripwire waits indefinitely.