Skip to content
x86 WinAPI hook written in pure Go
Go
Branch: master
Clone or download
castaneai Merge pull request #1 from castaneai/develop
Add amd64 arch support (unstable)
Latest commit 30aed1e Sep 14, 2018
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.gitignore Hello, hinako. Apr 6, 2017
LICENSE Initial commit Apr 6, 2017
README.md change readme Apr 12, 2017
arch.go Fix x64 trampoline Sep 14, 2018
arch386.go WIP: Add x64 support Sep 14, 2018
arch386_test.go Refactor tests Sep 14, 2018
archamd64.go Fix x64 trampoline Sep 14, 2018
hinako.go Refactor tests Sep 14, 2018
hinako_test.go Refactor tests Sep 14, 2018
util.go WIP: Add x64 support Sep 14, 2018
vmem.go Refactor tests Sep 14, 2018
vmem_test.go Refactor tests Sep 14, 2018

README.md

hinako

Windows API hooking (x86) with golang based on trampoline function.

Requirements

  • Windows OS
  • Golang i386 (not amd64)

Getting Started

Hook MessageBoxW Sample

package main

import (
	"fmt"
	"github.com/castaneai/hinako"
	"syscall"
	"unsafe"
)

func main() {
	target := syscall.NewLazyDLL("user32.dll").NewProc("MessageBoxW")

	// Before hook
	// Call MessageBoxW
	target.Call(0, WSTRPtr("MessageBoxW"), WSTRPtr("MessageBoxW"), 0)

	// API Hooking by hinako
	arch := hinako.IA32Arch{}
	var originalMessageBoxW *syscall.Proc = nil
	hook, err := hinako.NewHookByName(&arch, "user32.dll", "MessageBoxW", func(hWnd syscall.Handle, lpText, lpCaption *uint16, uType uint) int {
		r, _, _ := originalMessageBoxW.Call(uintptr(hWnd), WSTRPtr("Hooked!"), WSTRPtr("Hooked!"), uintptr(uType))
		return int(r)
	})
	if err != nil {
		fmt.Printf("hook failed: %s", err.Error())
	}
	originalMessageBoxW = hook.OriginalProc
	defer hook.Close()

	// After hook
	// Call MessageBoxW
	target.Call(0, WSTRPtr("MessageBoxW"), WSTRPtr("MessageBoxW"), 0)
}

func WSTRPtr(str string) uintptr {
	ptr, _ := syscall.UTF16PtrFromString(str)
	return uintptr(unsafe.Pointer(ptr))
}

Test

$ go test

Author

castaneai

You can’t perform that action at this time.