• Stars
    star
    196
  • Rank 197,542 (Top 4 %)
  • Language
    C#
  • License
    BSD 3-Clause "New...
  • Created over 3 years ago
  • Updated over 2 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

A C# port of the MinHook API hooking library

MinHook.NET

Introduction

MinHook.NET is a pure managed C# port of the brilliant MinHook library by Tsuda Kageyu (https://github.com/TsudaKageyu/minhook). The library has the capability of inline hooking native API calls, utilising .NET delegates for both the detoured and original function that is commonly called with the detour.

The project has attempted to keep within the simplistic spirit of the original MinHook library.

Quick Start

Simple example demonstrating the hooking of the MessageBoxW Windows API

    [DllImport("user32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
    public static extern int MessageBoxW(IntPtr hWnd, String text, String caption, uint type);

    //We need to declare a delegate that matches the prototype of the hooked function
    [UnmanagedFunctionPointer(CallingConvention.StdCall,CharSet=CharSet.Unicode)]
    delegate int MessageBoxWDelegate(IntPtr hWnd, string text, string caption, uint type);

    //A variable to store the original function so that we can call
    //within our detoured MessageBoxW handler
    MessageBoxWDelegate MessageBoxW_orig;

    //Our actual detour handler function
    int MessageBoxW_Detour(IntPtr hWnd, string text, string caption, uint type) {
        return MessageBoxW_orig(hWnd, "HOOKED: " + text, caption, type);
    }

    void ChangeMessageBoxMessage() {

		using (HookEngine engine = new HookEngine()) {

			MessageBoxW_orig = engine.CreateHook("user32.dll", "MessageBoxW", new MessageBoxWDelegate(MessageBoxW_Detour));
			engine.EnableHooks();

			//Call the PInvoke import to test our hook is in place
			MessageBoxW(IntPtr.Zero, "Text", "Caption", 0);
		}
    }

TOOO

  • Figure out how to calculate imm length with ModRM based instructions
  • When enabling hooks, enumerate threads and update thread context if any are running at the hook instructions that are being patched
  • Implement unit tests

Thanks

More Repositories

1

SweetPotato

Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019
C#
1,515
star
2

SharpBlock

A method of bypassing EDR's active projection DLL's by preventing entry point exection
C#
1,079
star
3

BeaconEye

Hunts out CobaltStrike beacons and logs operator command output
C#
852
star
4

ThreadlessInject

Threadless Process Injection using remote function hooking.
C#
692
star
5

BOF.NET

A .NET Runtime for Cobalt Strike's Beacon Object Files
C
639
star
6

lsarelayx

NTLM relaying for Windows made easy
C++
521
star
7

Volumiser

C#
324
star
8

MirrorDump

Another LSASS dumping tool that uses a dynamically compiled LSA plugin to grab an lsass handle and API hooking for capturing the dump in memory
C#
257
star
9

okta-terrify

Okta Verify and Okta FastPass Abuse Tool
C#
249
star
10

goreflect

Reflective DLL loading of your favorite Golang program
C
162
star
11

SylantStrike

Simple EDR implementation to demonstrate bypass
C
149
star
12

gssapi-abuse

A tool for enumerating potential hosts that are open to GSSAPI abuse within Active Directory networks
Python
131
star
13

PIVert

C#
99
star
14

dnMerge

A lightweight .NET assembly dependency merger that uses dnLib and 7zip's LZMA SDK for compressing dependant assemblies.
C#
98
star
15

PinSwipe

Smart Card PIN swiping DLL
C
71
star
16

gookies

A Chrome cookie dumping utility
Go
47
star
17

PwnyForm

C#
41
star
18

ProvisionAppx

C#
35
star
19

bittrex4j

Java library for accessing the Bittrex Web API's and Web Sockets
Java
32
star
20

PoC

Exploit PoC for CVE's and non CVE's alike
Python
23
star
21

Jboss-Wilfly-Hashes-to-Hashcat

Converts JBoss/Wildfly management users properties file to hashcat format compatible with mode 20
Python
12
star
22

VulnHub

VulnHub Walkthroughs
Python
4
star
23

MediaPortal-AsteriskCid

C#
1
star