Member Avatar for denis1401

What is the best way to do system wide user mode (NOT KERNEL MODE) api hook on Windows NT?

  • 3 Contributors
  • 4 Replies
  • 80 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by MosaicFuneral

Recommended Answers

All 4 Replies

Member Avatar for denis1401

thanks, but I'm not interested in these hooks (like keyboard hooks, mouse event hooks, etc.)
I need to intercept/hook every call to a certain win32 api function on the system
How do I do that (without modifing the dll files on disk)?

Member Avatar for Ancient Dragon

you can use the WH_CALLWNDPROC hook if the process you want has a window. Other than that, I don't know if its even possible to do what you want.

Member Avatar for MosaicFuneral

One way might be: open every process, find if they import that particular function, if they do find where they call it and idk you solve the rest.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.