Windows Python / Hook Injection

Author Unprotect
Platform Windows
Language Python
Technique Hook Injection

Description:

The HookFunction is injected as a hook using the SetWindowsHookEx function, and it still calls the CallNextHookEx function to continue the normal flow of execution. The main function installs the hook, runs the message loop to receive events, and then uninstalls the hook when finished.

Code

import ctypes
from ctypes.wintypes import HHOOK, LPARAM, LRESULT, WPARAM


# The function to be injected as a hook
def HookFunction(code: int, wParam: WPARAM, lParam: LPARAM) -> LRESULT:
    # Perform malicious actions here

    # Return the result of the next hook in the chain
    return ctypes.windll.user32.CallNextHookEx(None, code, wParam, lParam)


def main():
    # Install the hook
    hHook = ctypes.windll.user32.SetWindowsHookEx(
        ctypes.c_int(14), HookFunction, None, 0
    )

    # Run the message loop to receive events
    msg = ctypes.wintypes.MSG()
    while ctypes.windll.user32.GetMessageW(ctypes.byref(msg), None, 0, 0):
        ctypes.windll.user32.TranslateMessageW(msg)
        ctypes.windll.user32.DispatchMessageW(msg)

    # Uninstall the hook
    ctypes.windll.user32.UnhookWindowsHookEx(hHook)


if __name__ == "__main__":
    main()

Created

December 6, 2022

Last Revised

April 22, 2024