Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p><a href="http://msdn.microsoft.com/en-us/library/ms644990%28v=vs.85%29.aspx" rel="nofollow">SetWindowsHookEx</a> is your easiest solution.</p> <p>If you don't mind upsetting the anti-virus software, you can also inject a DLL into each process that will then hook CreateProcess (to inject the DLL into further processes) and CreateWindowEx (for your purposes).</p> <p>EDIT: I just read your question completely. Yes, you'll want to just hook CreateProcessW and inject your hook into future processes.</p> <p>EDIT #2: I was actually working on something like this yesterday, so some code which does what you want.</p> <pre><code>#include &lt;windows.h&gt; // call GetModuleFileNameto get the full path of the module before installing the hook static LPWSTR lpszDllName; HMODULE LoadModuleEx(__in HANDLE hProcess, __in_z LPCTSTR lpcszDll) { DWORD cdwSize; LPVOID lpvAllocation; HANDLE hThread; HMODULE hRet; cdwSize = lstrlen(lpcszDll) + 1; cdwSize *= sizeof(TCHAR); lpvAllocation = VirtualAllocEx(hProcess, NULL, cdwSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); if (lpvAllocation != NULL) { if (WriteProcessMemory(hProcess, lpvAllocation, lpcszDll, cdwSize, NULL)) { hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)LoadLibrary, lpvAllocation, 0, NULL); if (hThread != NULL) { GetExitCodeThread(hThread, (LPDWORD)&amp;hRet); CloseHandle(hThread); } } VirtualFreeEx(hProcess, lpvAllocation, cdwSize, MEM_DECOMMIT); } return hRet; } // hook future process creation - install this hook on top of CreateProcessW // I'd suggest using Microsoft Detours [http://research.microsoft.com/en-us/projects/detours/] BOOL WINAPI CreateProcessWHook(__in_opt LPCWSTR lpApplicationName, __inout_opt LPWSTR lpCommandLine, __in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes, __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes, __in BOOL bInheritHandles, __in DWORD dwCreationFlags, __in_opt LPVOID lpEnvironment, __in_opt LPCWSTR lpCurrentDirectory, __in LPSTARTUPINFO lpStartupInfo, __out LPPROCESS_INFORMATION lpProcessInformation) { // create the process suspended if (dwCreationFlags &amp; CREATE_SUSPENDED != CREATE_SUSPENDED) dwCreationFlags |= CREATE_SUSPENDED; // call original CreateProcessW BOOL bRet = _CreateProcessW(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation); if (bRet) { // inject DLL LoadModuleEx(lpProcessInformation-&gt;hProcess, lpszDllName); // resume thread ResumeThread(lpProcessInformation-&gt;hThread); } return bRet; } </code></pre>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload