CaptainHook - GitLite

KO | EN

gitlite — search

#javascript #python #hacktoberfest #react #typescript #llm #android #rust #macos #java #awesome #cli #awesome-list #ios

CaptainHook

(★ 105)

CaptainHook is perfect x86/x64 hook environment

파일 탐색기

최종 버전 다운로드 (.zip)

- - arm.h
  - arm64.h
  - capstone.h
  - mips.h
  - platform.h
  - ppc.h
  - sparc.h
  - systemz.h
  - x86.h
  - xcore.h
- capstone
- CaptainHook.cpp
- CaptainHook.h
- CaptainHook.vcxproj
- CaptainHook.vcxproj.filters
- CaptainHook_for_include.h
- Utils.h
- VectoredHandler.cpp
- VectoredHandler.h
.gitattributes
.gitignore
.gitmodules
CaptainHook.h
CaptainHook.sln
LICENSE
README.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/shmuelyr/CaptainHook

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd CaptainHook

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. .NET

보통 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
.NET SDK dotnet 명령어를 쓰기 위한 SDK입니다.

dotnet restore

프로젝트에 필요한 패키지를 내려받습니다.

dotnet run

프로젝트를 빌드하고 바로 실행합니다.

✅ dotnet run 실행 후 터미널에 나타나는 안내 메시지나 주소를 확인하세요.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# CaptainHook (version 2.1 beta)

**this one isnt release, plz download from [here](https://github.com/shmuelyr/CaptainHook/releases)**

CaptainHook is a hook framework for x86/x64 arch, it's based on [capstone](https://github.com/aquynh/capstone) disassembler engine.
CaptainHook is easy to use, and very friendly.
The hook engine is much like MS Detours, so why to choose it?
* it supports x64 (Detours x64 is commerical - $10,000~).
* CaptainHook will know where to locate your hook in real time, the engine analyzes the code, and finds if small API redirection (Wow64 hook on kernelbase for example or some minimal JMP table redirection[particularly common in packed/protected code]) was occurred, and locate your hook in safe area.
* in the next release, CaptainHook will contain an engine for jmp/conditional jmp repair - if your hook corrupts sensitive code.

## whats new?
* Disable/Eneble hook at runtime, without remove them.
* some fix in the design of the code and the class.

code example:
```c++

#include "CaptainHook.h"
#pragma comment(lib, "CaptainHook.lib")

void (__fastcall *CH_OriginalFunction_1)(...) = OriginalFunction_1;
void (__stdcall  *CH_OriginalFunction_2)(...) = OriginalFunction_2;
void (__fastcall *CH_OriginalFunction_3)(...) = OriginalFunction_3;
void (__fastcall *CH_OriginalFunction_4)(...) = OriginalFunction_4;

int main() {

unsigned int uiHookId1, uiHookId2;
    CaptainHook *pChook = new CaptainHook();
    if (!pChook) return 0;
    
	pChook->AddInlineHook(&(void *&)CH_OriginalFunction_1, HookedOriginalFunction_1);
	pChook->AddPageGuardHook(&(void *&)CH_OriginalFunction_2, HookedOriginalFunction_2);
    
	pChook->AddInlineHook(&(void *&)CH_OriginalFunction_3, HookedOriginalFunction_3, &uiHookId1);
	pChook->AddPageGuardHook(&(void *&)CH_OriginalFunction_4, HookedOriginalFunction_4, &uiHookId2);
	/*
	:
	*/
	pChook->DisableHook(uiHookId1);
	/*
	:
	*/
	pChook->EnableHook(uiHookId1);
	/*
	:
	*/
	pChook->~CaptainHook(); // this function clean all the hook(s).
    return 0;
}
```
CaptainHook.h for include is just [this](https://github.com/shmuelyr/CaptainHook/blob/master/CaptainHook/CaptainHook_for_include.h) file

### how to build?
```shell
> git clone --recursive https://github.com/shmuelyr/CaptainHook.git
> cd CaptainHook
> "C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\Tools\vsvars32.bat"
> msbuild.exe
```

### in the next version:
* IAT hooking, for dll function.
* hooking with hardware breakpoint.

### Full example:
```c++

#include <Windows.h>
#include "CaptainHook.h"

#pragma comment(lib, "CaptainHook.lib")

int(__stdcall *CH_OriginalMessageBoxA)
	(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType) = MessageBoxA;
int __stdcall MyMessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType) {

return CH_OriginalMessageBoxA(hWnd, "HOOK", "HOOK", uType);
}

int WinMain(HINSTANCE hIns, HINSTANCE hPrev, LPSTR lpCmdLine, int cCmdShow) {
	
	unsigned int uiHookId;
	CaptainHook *pChook = new CaptainHook();
	pChook->AddPageGuardHook(&(void *&)CH_OriginalMessageBoxA, MyMessageBoxA, &uiHookId);
	MessageBoxA(NULL, "test", "test", MB_OK);
	pChook->DisableHook(uiHookId);
	MessageBoxA(NULL, "test", "test", MB_OK);
	pChook->EnableHook(uiHookId);
	MessageBoxA(NULL, "test", "test", MB_OK);
	return 0;
}
```

Happy Hooking!