Windows C++ / Hook Injection

Author Unprotect
Platform Windows
Language C++
Technique Hook Injection

Description:

In this code, the HookFunction is injected as a hook using the SetWindowsHookEx function. This function will be called whenever a low-level mouse event occurs, allowing the malware to monitor and manipulate user actions. The CallNextHookEx function is used to call the next hook in the chain, allowing the normal flow of execution to continue.

Code

#include <windows.h>

// The function to be injected as a hook
LRESULT CALLBACK HookFunction(int code, WPARAM wParam, LPARAM lParam) {
  // Perform malicious actions here
  
  // Return the result of the next hook in the chain
  return CallNextHookEx(NULL, code, wParam, lParam);
}

int main() {
  // Install the hook
  HHOOK hHook = SetWindowsHookEx(WH_MOUSE_LL, HookFunction, NULL, 0);
  
  // Run the message loop to receive events
  MSG msg;
  while (GetMessage(&msg, NULL, 0, 0)) {
    TranslateMessage(&msg);
    DispatchMessage(&msg);
  }
  
  // Uninstall the hook
  UnhookWindowsHookEx(hHook);
  
  return 0;
}

Created

December 6, 2022

Last Revised

April 22, 2024