WinRT API hooking

c++ / delphi package - dll injection and api hooking
Post Reply
mileng
Posts: 2
Joined: Wed Apr 25, 2012 8:45 pm

WinRT API hooking

Post by mileng »

Hi Madshi,

Is it possible the next (or other future) version of madCodeHook to support WinRT API?
That is about Metro style apps in Windows 8.
madshi
Site Admin
Posts: 10764
Joined: Sun Mar 21, 2004 5:25 pm

Re: WinRT API hooking

Post by madshi »

The WinRT builds on the win32 API. So e.g. if WinRT tries to execute a new process, and if you have hooked the process creation APIs, your hooks should already work right now.

If you want to hook WinRT APIs directly instead of the underlying win32 layer, that is probably possible, too. You just need to get the address of a WinRT method, and then use madCodeHook's "HookCode()" instead of "HookAPI()". The same method that already works for e.g. Direct3D hooking right now should still work for WinRT, I believe. For your information, here's a Direct3D hooking demo:

http://madshi.net/HookDirect3D.zip
mileng
Posts: 2
Joined: Wed Apr 25, 2012 8:45 pm

Re: WinRT API hooking

Post by mileng »

Let me give an example...

The WinRT way to open a socket connection is documented here: http://msdn.microsoft.com/en-us/library ... 01507.aspx
It's the method ConnectAsync of WinRT class StreamSocket. It comes from Windows.Networking.dll, but the dll doesn't export any function similar to the above.
Will it be possible madCodeHook to hook that kind of API?
madshi
Site Admin
Posts: 10764
Joined: Sun Mar 21, 2004 5:25 pm

Re: WinRT API hooking

Post by madshi »

The StreamSocket seems to be an interface instance, similar to what you have with e.g. IDirect3D9. So you should be able to hook it the same way. But again, the network access done by StreamSocket is likely to end up in WinSock. Oh well, maybe WinSock is internally based on an even lower level API, then it's possible that StreamSocket bypasses WinSock and goes to the lower level API. But in any case, from what I've read so far, these WinRT APIs in the end are based on the win32 API. So hooking the win32 API should also give you access to what WinRT does. At least that's my understanding. But as explained above, you should also be able to hook the WinRT methods directly. Similar to how you can already do it with IDirect3D9 and similar interfaces.
Post Reply