Tutorial 24: Windows Hooks
WELL Learn About Windows Hooks in this Tutorial. Windows Hooks Are Very Powerful. With Them, You Can Poke Inside Other Processes and Sometimes ALTER THEIR Behaviors.
Download the Example
Here.
Theory:.. Windows hooks can be considered one of the most powerful features of Windows With them, you can trap events that will occur, either in your own process or in other processes By "hooking", you tell Windows about a function, filter Function Also Called Hook Procedure, That Will Be Called Everytime An Event You're Interested In Occurs. There Are Two Types of Them: Local and Remote Hooks.
Local Hooks Trap Events That Will Occur in Your Own Process. Remote Hooks Trap Events That Will Occur In Other Process (ES). There Are Two Types of Remote Hooks
thread-specific traps events that will occur in a specific thread in other process. In short, you want to observe events in a specific thread in a specific process. system-wide traps all events destined for all threads in all processes in the system. When you install hooks, remember that they affect system performance. System-wide hooks are the most notorious. Since ALL related events will be routed through your filter function, your system may slow down noticeably. So if you use a system-wide hook, you should use it judiciously and unhook it as soon as you do not need it. Also, you have a higher chance of crashing the other processes since you can meddle with other processes and if something is wrong in your filter function, it can pull The Other Processes Down To Oblivion with It. Remember: Power Comes with response.
You have to understand how a hook works before you can use it efficiently. When you create a hook, Windows creates a data structure in memory, containing information about the hook, and adds it to a linked list of existing hooks. New hook is added in front of old hooks. When an event occurs, if you install a local hook, the filter function in your process is called so it's rather straightforward. But if it's a remote hook, the system must inject the code for the hook procedure into the Address Space (S) of the Other Process (ES). And the System Can do That Only The Function Resides in A DLL. Thus, if You Want To Use A Remote Hook, Your Hook Procedure Must Reside In A DLL. There IS two exceptions to this rule: journal record and journal playback hooks The hook procedures for those two hooks must reside in the thread that installs the hooks The reason why it must be so is that:.. both hooks deal with the low-level interception of Hardware INPUTS. The Input Events Must Be Recorded / Playbacked in the order they appeared If the code of those two hooks is in a DLL, the input events may scatter among several threads and it is impossible to know the order of them So the solution:.. The hook procedure of those two hooks Must Be in a Single Thread Only IE Thread That Installs The Hooks.There Are 14 Types of Hooks:
WH_CALLWNDPROC called when SendMessage is called WH_CALLWNDPROCRET called when SendMessage returns WH_GETMESSAGE called when GetMessage or PeekMessage is called WH_KEYBOARD called when GetMessage or PeekMessage retrieves WM_KEYUP or WM_KEYDOWN from the message queue WH_MOUSE called when GetMessage or PeekMessage retrieves a mouse message from the message queue WH_HARDWARE called when GetMessage or PeekMessage retrieves some hardware message that is not related to keyboard or mouse. WH_MSGFILTER called when a dialog box, menu or scrollbar is about to process a message. This hook is local. It's specifically for those objects which have their own internal message loops . WH_SYSMSGFILTER same as WH_MSGFILTER but system-wide WH_JOURNALRECORD called when Windows retrieves message from the hardware input queue WH_JOURNALPLAYBACK called when an event is requested from the system's hardware input queue. WH_SHELL called when something interesting about the shell occurs such as when the task bar needs to redraw its button. WH_CBT used specifically for computer-based training (CBT). WH_FOREGROUNDIDLE used internally by Windows. Little use for general applications WH_DEBUG used to debug the hooking procedure Now that we know some theory, we can move on to How To Install / Uninstall The Hooks.to Install A Hook, You Call Setwindowshookex Which Has The Following Syntax:
SetWindowsHookex Proto HookType: DWORD, PHOOKPROC: DWORD, HINSTANCE: DWORD, ThreadId: DWORD
HookType is one of the values listed above, eg, WH_MOUSE, WH_KEYBOARD pHookProc is the address of the hook procedure that will be called to process the messages for the specified hook. If the hook is a remote one, it must reside in a DLL. If not, it must be in your process. hInstance is the instance handle of the DLL in which the hook procedure resides. If the hook is a local one, this value must be NULL ThreadID is the ID of the thread you want to install the hook to spy on. This parameter is the one that determines whether a hook is local or remote. If this parameter is NULL, Windows will interpret the hook as a system-wide remote hook that affects all threads in the system. If you specify the thread ID of a thread in your own process, this hook is a local one If you specify the thread ID from other process, the hook is a thread-specific remote one There are two exceptions to this rule:.. WH_JOURNALRECORD and WH_JOURNALPLAYBACK are always Local System-Wide Hooks That Are Not Requi red to be in a DLL. And WH_SYSMSGFILTER is always a system-wide remote hook. Actually it is identical to WH_MSGFILTER hook with ThreadID == 0. If the call is successful, it returns the hook handle in eax. If not, NULL is Returned. You must save the hook handle for unhanging latter.you can uninstall a hook by calling
UnHookWindowshookex Which Accepts Only One Parameter, The Handle of The Hook You Want To Uninstall. If The Call Serceeds, It Returns A Non-Zero Value in Eax. OtherWise, IT Returns Null.
Now That You Know How To Install / Uninstall Hooks, We Can Examine The Hook Procedure.
The hook procedure will be called.
. WH_MOUSE hook, when a mouse event occurs, your hook procedure will be called Regardless of the type of hook you installed, the hook procedure always has the following prototype: HookProc proto nCode: DWORD, wParam: DWORD, lParam: DWORD
Ncode Specifies The Hook Code. WParam and LParam Contain Additional Information About The Event
HookProc is actually a placeholder for the function name. You can name it anything you like so long as it has the above prototype. The interpretation of nCode, wParam and lParam is dependent on the type of hook you install. So as the return value from The hook procedure. for example:
WH_CallWndProc
Ncode Can Be Only HC_Action Which Means There Is A Message Sent To A Window WParam Contains The Message Being Sent, IF It's Not Zero LParam Points To A CWPStruct Structure Return Value: Not Used, Return Zero
WH_MOUSE
nCode can be HC_ACTION or HC_NOREMOVE wParam contains the mouse message lParam points to a MOUSEHOOKSTRUCT structure return value:. zero if the message should be processed 1 if the message should be discarded.
The Bottom Line is: You Must Consult Your Win32 API Reference For Details About The Meanings of The Parameters and Return Value of The Hook You Want To Install.
Now there is a little catch about the hook procedure. Remember that the hooks are chained in a linked list with the most recently installed hook at the head of the list. When an event occurs, Windows will call only the first hook in the chain. It's your hook procedure's responsibility to call the next hook in the chain. you can choose not to call the next hook but you'd better know what you're doing. Most of the time, it's a good practice to call the next procedure so Other Hooks Can Have A Shot At the next hook by callingcallnexthookex Which Has The Following Prototype:
CallNexthookex Proto HHOOK: DWORD, NCODE: DWORD, WPARAM: DWORD, LPARAM: DWORD
hHook is your own hook handle. The function uses this handle to traverse the linked list and search for the hook procedure it should call next. nCode, wParam and lParam you can just pass those three values you receive from Windows to CallNextHookEx.
An important note about remote hooks: the hook procedure must reside in a DLL which will be mapped into other processes When Windows maps the DLL into other processes, it will not map the data section (s) into the other processes In short,.. all processes share a single copy of code but they will have their own private copy of the DLL's data section! This can be a big surprise to the unwary. you may think that when you store a value into a variable in the data section of a DLL, that value will be shared among all processes that load the DLL into their process address space. It's simply not true. In normal situation, this behavior is desirable since it provides the illusion that each process has its own copy of the DLL. But . not when Windows hook is concerned We want the DLL to be identical in all processes, including the data The solution:. you must mark the data section as shared you can do this by specifying the section (s) attribute in the linker switch. Masm, You NEED TO USE THI s Switch: / Section:
The name of the initialized data section is .data and the uninitialized data is .bss. For example if you want to assemble a DLL which contains a hook procedure and you want the uninitialized data section to be shared amoung processes, you must use the following Line:
Link /SECTION :.Bss, S / DLL / SUBSYSTEM: Windows ..........
S Attribute Marks The Section as Shared.
EXAMPLE: THE ARE TWO MODULES: ONE Is The Main Program Which Will Do The Gui Part and The Other Is The Dll That Will Install / Uninstall The Hook.
; -------------------------------------------- this is the Source Code of the main program ------------------------------------- .386 .Model flat, stdcall option casemap: none include /masm32/include/windows.inc include /masm32/include/user32.inc include /masm32/include/kernel32.inc include mousehook.inc includelib mousehook.lib includelib /masm32/lib/user32.lib includelib / MASM32 / LIB / KERNEL32.LIBWSPRINTFA PROTO C: DWORD,: DWORD,: VARARG WSPRINTF TEXTEQU
.const IDD_MAINDLG EQU 101 IDC_CLASSNAME EQU 1000 IDC_Handle EQU 1001 IDC_WndProc EQU 1002 IDC_HOOK EQU 1004 IDC_EXIT EQU 1005 WM_Mousehook EQU WM_USER 6
DLGFunc Proto: DWORD,: DWORD,: DWORD,: DWORD
.DATA HOOKFLAG DD FALSE HOOKTEXT DB "& HOOK", 0 UnHooktext DB "& Unhook", 0 Template DB "% lx", 0
.DATA? HINSTANCE DD? HHOOK DD? CODE Start: Invoke GetModuleHandle, Null Mov Hinstance, Eax Invoke Dialogboxparam, Hinstance, IDD_MAINDLG, NULL, AddR Dlgfunc, Null Invoke EXIXITPROCESS, NULL
DLGFunc Proc HDLG: DWORD, UMSG: DWORD, WPARAM: DWORD, LPARAM: DWORD LOCAL HLIB: DWORD LOCAL BUFFER [128]: BYTE LOCAL BUFFER1 [128]: BYTE LOCAL RECT: Rect .IF UMSG == WM_Close .IF hookflag == TRUE invoke UninstallHook .endif invoke EndDialog, hDlg, NULL .elseif uMsg == WM_INITDIALOG invoke GetWindowRect, hDlg, addr rect invoke SetWindowPos, hDlg, HWND_TOPMOST, rect.left, rect.top, rect.right, rect.bottom, SWP_SHOWWINDOW .elseif uMsg == WM_MOUSEHOOK invoke GetDlgItemText, hDlg, IDC_HANDLE, addr buffer1,128 invoke wsprintf, addr buffer, addr template, wParam invoke lstrcmpi, addr buffer, addr buffer1 .if eax! = 0 invoke SetDlgItemText, hDlg, IDC_HANDLE, addr buffer .endif invoke GetDlgItemText, hDlg, IDC_CLASSNAME, addr buffer1,128 invoke GetClassName, wParam, addr buffer, 128 invoke lstrcmpi, addr buffer, addr buffer1 .if eax! = 0 invoke SetDlgItemText, hDlg, IDC_ CLASSNAME, addr buffer .endif invoke GetDlgItemText, hDlg, IDC_WNDPROC, addr buffer1,128 invoke GetClassLong, wParam, GCL_WNDPROC invoke wsprintf, addr buffer, addr template, eax invoke lstrcmpi, addr buffer, addr buffer1 .if eax! = 0 invoke SetDlgItemText, hDlg, IDC_WNDPROC, addr buffer .endif .elseif uMsg == WM_COMMAND .if lParam! = 0 mov eax, wParam mov edx, eax shr edx, 16 .if dx == BN_CLICKED .if ax == IDC_EXIT invoke SendMessage, hDlg, WM_CLOSE , 0, 0 .else .IF hookflag ==
FALSE invoke InstallHook, hDlg .if eax! = NULL mov HookFlag, TRUE invoke SetDlgItemText, hDlg, IDC_HOOK, addr UnhookText .endif .else invoke UninstallHook invoke SetDlgItemText, hDlg, IDC_HOOK, addr HookText mov HookFlag, FALSE invoke SetDlgItemText, hDlg, IDC_CLASSNAME, NULL invoke SetDlgItemText, hDlg, IDC_HANDLE, NULL invoke SetDlgItemText, hDlg, IDC_WNDPROC, NULL .endif .endif .endif .endif .else mov eax, FALSE ret .endif mov eax, TRUE ret DlgFunc endpend start
; ------------------------------------------------- ---- this is the source code of the dll ------------------------------------------------------------------------------------------------------------------------------------------------------ .386 .model flat, stdcall option casemap: none include /masm32/include/windows.inc include /masm32/include/kernel32.inc includelib /masm32/lib/kernel32.lib include /masm32/include/user32.inc includelib / masm32 /LIB/USER32.LIB
.const WM_MouseHook Equ WM_USER 6
.DATA HINSTANCE DD 0
.DATA? HHOOK DD? HWND DD?
.code dllenTry Proc Hinst: Hinstance, Reason: DWORD, Reserved1: Dword .if realved1: dword .if realved1: dword .if realved1: dword .if realved1: dword .if realved1: dll_process_attach push hinst pop hinstance .ndif Mov EAX, TRUE RET DLLENTRY ENDP
MouseProc proc nCode: DWORD, wParam: DWORD, lParam: DWORD invoke CallNextHookEx, hHook, nCode, wParam, lParam mov edx, lParam assume edx: PTR MOUSEHOOKSTRUCT invoke WindowFromPoint, [edx] .pt.x, [edx] .pt.y invoke PostMessage, hWnd, WM_MOUSEHOOK, eax, 0 assume edx: nothing xor eax, eax ret MouseProc endpInstallHook proc hwnd: DWORD push hwnd pop hWnd invoke SetWindowsHookEx, WH_MOUSE, addr MouseProc, hInstance, NULL mov hHook, eax ret InstallHook endp
Uninstallhook Proc Invoke UnHookWindowshookex, HHOOK RET Uninstallhook Endp
End dllenTry
; -------------------------------------------- this is the the Makefile of the DLL ----------------------------------------------
Name = mousehook $ (name) .dll: $ (name) .Obj link /section: #bss, s / dll /def: $(Name ).def / subsystem: windows / libpath: C: / Masm / LIB $ Name) .Obj $ (name) .Obj: $ (name) .asm ML / C / COFF / CP $ (Name) .asm
Analysis: The example will display a dialog box with three edit controls that will be filled with the class name, window handle and the address of the window procedure associated with the window under the mouse cursor There are two buttons, Hook and Exit When.. you press the Hook button, the program hooks the mouse input and the text on the button changes to Unhook. When you move the mouse cursor over a window, the info about that window will be displayed in the main window of the example. When you Press Unhook Button, The Program Removes The Mouse Hook.
The main program uses a dialog box as its main window. It defines a custom message, WM_MOUSEHOOK which will be used between the main program and the hook DLL. When the main program receives this message, wParam contains the handle of the window that the mouse cursor is on. of course, this is an arbitrary arrangement. I decide to send the handle in wParam for the sake of simplicity. You can choose your own method of communication between the main program and the hook DLL..if HookFlag == FALSE Invoke Installhook, HDLG .IF Eax! = Null Mov Hookflag, True Invoke Setdlgitemtext, HDLG, IDC_HOOK, ADDR UNHOOKTEXT .Endif
The program maintains a flag, HookFlag, to monitor the state of the hook. It's FALSE if the hook is not installed and TRUE if the hook is installed. When the user presses Hook button, the program checks if the hook is already installed. If it is not, it call InstallHook function in the hook DLL to install it. Note that we pass the handle of the main dialog as the parameter of the function so the hook DLL can send the WM_MOUSEHOOK messages to the right window ie our own. When the program is loaded, the hook DLL is loaded too. Actually, DLLs are loaded immediately after the program is in memory. The DLL entrypoint function is called before the first instruction in the main program is execute even. So when the main program executes the DLL (s) is / are initialized. We Put The Following Code In The DLL Entrypoint Function of The Hook DLL:
.if real_process_attach push hinst pop hinstance .endif
The code just saves the instance handle of the hook DLL itself to a global variable named hInstance for use within the InstallHook function. Since the DLL entrypoint function is called before other functions in the DLL are called, hInstance is always valid. We put hInstance in .data section so that this value is kept on per-process basis. Since when the mouse cursor hovers over a window, the hook DLL is mapped into the process. Imagine that there is already a DLL that occupies the intended load address of the hook DLL, the hook DLL would be remapped to another address. The value of hInstance will be updated to those of the new load address. When the user presses Unhook button and then Hook button, SetWindowsHookEx will be called again. However, this time, it will use the new load address as the instance handle which will be wrong because in the example process, the hook DLL's load address has not been changed. The hook will be a local one where you can hook only the mouse events that o ccur in your own window Hardly desirable.InstallHook proc hwnd:. DWORD push hwnd pop hWnd invoke SetWindowsHookEx, WH_MOUSE, addr MouseProc, hInstance, NULL mov hHook, eax ret InstallHook endp
The InstallHook function itself is very simple. It saves the window handle passed as its parameter to a global variable named hWnd for future use. It then calls SetWindowsHookEx to install a mouse hook. The return value of SetWindowsHookEx is stored in a global variable named hHook For use with unhookwindowshookex. After setWindowshookex is Called, The Mouse Hook is Functional. WHENEVER A MOUSE Event Occurs In The System, MouseProc (Your Hook Procedure) is Called.
MouseProc proc nCode: DWORD, wParam: DWORD, lParam: DWORD invoke CallNextHookEx, hHook, nCode, wParam, lParam mov edx, lParam assume edx: PTR MOUSEHOOKSTRUCT invoke WindowFromPoint, [edx] .pt.x, [edx] .pt.y invoke PostMessage, hWnd, WM_MOUSEHOOK, eax, 0 assume edx: nothing xor eax, eax ret MouseProc endpThe first thing it does is to call CallNextHookEx to give the other hooks the chance to process the mouse event After that, it calls WindowFromPoint function to. retrieve the handle of the window at the specified screen coordinate. Note that we use the POINT structure in the MOUSEHOOKSTRUCT structure pointed to by lParam as the current mouse coordinate. After that we send the window handle to the main program via PostMessage with WM_MOUSEHOOK message. One thing you should remember is that:.. you should not use SendMessage inside the hook procedure, it can cause message deadlock PostMessage is recommended The MOUSEHOOKSTRUCT structure is defined below:
MousehookStruct Struct DWord Pt Point <> hwnd dword? WhittestCode DWORD? DWEXTRAINFO DWORD? MousehookTRUCT Ends
pt is the current screen coordinate of the mouse cursor hwnd is the handle of the window that will receive the mouse message. It's usually the window under the mouse cursor but not always. If a window calls SetCapture, the mouse input will be redirected to that window instead. Because of this reason, I do not use the hwnd member of this structure but choose to call WindowFromPoint instead. wHitTestCode specifies the hit-test value. The hit-test value gives more information about the current mouse cursor position. It specifies on what part of window the mouse cursor is. For complete list, check your win32 api reference under WM_NCHITTEST message. dwExtraInfo contains the extra information associated with the message. Normally this value is set by calling mouse_event and retrieved by calling GetMessageExtraInfo. When the Main Window Receives WM_Mousehook Message, IT Uses The Window Handle in WParam To Retrieve The Information About The Window.
.elseif uMsg == WM_MOUSEHOOK invoke GetDlgItemText, hDlg, IDC_HANDLE, addr buffer1,128 invoke wsprintf, addr buffer, addr template, wParam invoke lstrcmpi, addr buffer, addr buffer1 .if eax! = 0 invoke SetDlgItemText, hDlg, IDC_HANDLE, addr buffer .endif invoke GetDlgItemText, hDlg, IDC_CLASSNAME, addr buffer1,128 invoke GetClassName, wParam, addr buffer, 128 invoke lstrcmpi, addr buffer, addr buffer1 .if eax! = 0 invoke SetDlgItemText, hDlg, IDC_CLASSNAME, addr buffer .endif invoke GetDlgItemText, hDlg, IDC_WNDPROC, addr buffer1,128 invoke GetClassLong, wParam, GCL_WNDPROC invoke wsprintf, addr buffer, addr template, eax invoke lstrcmpi, addr buffer, addr buffer1 .if eax! = 0 invoke SetDlgItemText, hDlg, IDC_WNDPROC, addr buffer .endifTo avoid Flickers, We check the text already in the edit controls and the text we will put ion. in they a ipient. re, we skip them. We retrieve the class name by calling GetClassName, the address of the window procedure by calling GetClassLong with GCL_WNDPROC and then format them into strings and put them into the appropriate edit controls.
invoke UninstallHook invoke SetDlgItemText, hDlg, IDC_HOOK, addr HookText mov HookFlag, FALSE invoke SetDlgItemText, hDlg, IDC_CLASSNAME, NULL invoke SetDlgItemText, hDlg, IDC_HANDLE, NULL invoke SetDlgItemText, hDlg, IDC_WNDPROC, NULL
When the user presses Unhook button, the program calls UninstallHook function in the hook DLL. UninstallHook just calls UnhookWindowsHookEx. After that, it changes the text of the button back to "Hook", HookFlag to FALSE and clears the content of the edit controls. Note The Linker Switch in the makefile.link /section :bss, s / dll /def: #(Name ).def / subsystem: windows
IT Specifies .Bss Section As a Shared Section To Make All Processes Share The Same Uninitialized Data Section of The Hook DLL. WITHOUT THIS SWITCH, YOUR HOOK DLL WILL NOT FUNCTION CORRECTLY.
