Introduction
Ganxo is an opensource API hooking framework. In Catalan, Ganxo means hook and is pronounced like you pronounce: "Gun show". Ganxo uses Capstone disassembler for its disassembly requirements.
Features
- Ganxo is transactional. No hooking side effects take place until the transaction is committed
- Written in C and aims to be light and portable. Although for now only Windows is supported
- Ganxo has a rich api: simple data structures APIs, memory APIs, disassembly APIs
- Heavily documented source code which is ideal for learning how to build API hooking frameworks
Installation
-
Clone Ganxo from: http://github.com/PassingTheKnowledge/Ganxo
-
Clone the thirdparty dependencies:
git submodule update --init --recursive -
Open Ganxo.sln solution
-
Right click and change the general configuration of the capstone project and select a supported compiler
-
Change the preprocessor settings to only have x86 and diet Capstone:
CAPSTONE_USE_SYS_DYN_MEM;CAPSTONE_X86_ATT_DISABLE;CAPSTONE_DIET;CAPSTONE_X86_REDUCE;CAPSTONE_HAS_X86 -
When ready, righ-click on the solution and "Build all"
Refer to simple.cpp and test_hook project
Simple example
This is an exmaple program that hooks Sleep() and MessageBoxA()
Step 1 - Define the prototypes and the hook functions
#include <Ganxo.h>
typedef VOID(WINAPI *Sleep_proto)(DWORD);
typedef int (WINAPI *MessageBoxA_proto)(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType);
Sleep_proto orig_Sleep = Sleep;
VOID WINAPI My_Sleep(DWORD dwMilliSecs)
{
printf("MySleep() triggered! calling original sleep...");
orig_Sleep(dwMilliSecs);
printf("done!\n");
}
MessageBoxA_proto orig_MessageBoxA = MessageBoxA;
int WINAPI my_MessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType)
{
printf("MessageBoxA(hWnd=%08p, lpText='%s', lpCaption='%s', uType=%04X)\n",
hWnd, lpText, lpCaption, uType);
return IDOK;
}
Step 2 - Initialize Ganxo
int main()
{
gnx_err_t err = gnx_init();
if (err != GNX_ERR_OK)
{
printf("Failed to initialize!\n");
return -1;
}
// Create a new workspace instance
gnx_handle_t gnx;
if (gnx_open(&gnx) != GNX_ERR_OK)
{
printf("Failed to create workspace\n");
return -1;
}
Step 3 - Start a hooking transaction
gnx_handle_t transaction;
gnx_transaction_begin(gnx, &transaction);
Step 4 - Add the function to the transaction
// Hook
err = gnx_transaction_add_hook(
transaction,
(void **)&orig_Sleep,
My_Sleep);
err = gnx_transaction_add_hook(
transaction,
(void **)&orig_MessageBoxA,
my_MessageBoxA);
Step 5 - Commit the transaction
err = gnx_transaction_commit(transaction);
Step 6 - Functions are now hooked!
// Call hooked functions
printf("main(): calling Sleep()\n");
::Sleep(10);
MessageBoxA(0, "Hello", "Info", MB_OK);
Step 7 - When done, remove the hooks
Start a new transaction for the sake of removing the hooks, remove the hooks and commit the transaction:
// Unhook
gnx_transaction_begin(gnx, &transaction);
gnx_transaction_remove_hook(
transaction,
(void **)&orig_Sleep);
gnx_transaction_remove_hook(
transaction,
(void **)&orig_MessageBoxA);
gnx_transaction_commit(transaction);
gnx_close(gnx);
return 0;
}
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent