0

i am trying to hook wndproc in an game, to do that i am injecting a dll into their memory, my problem is i don't wanna do a Global Hook to the wndproc, i want to get a pointer to his procedure to do thing more cleans and stealth. (I am still learning so i am right now a noob into assembly, if you want you can recommend me a good tutorial to learn assembly etc).

PS: Sorry for my english.

This is what i mean for Global Hook:

//Global/Universal Hook example.
#include <windows.h>

static bool bSetup = false;
WNDPROC oWndProc;

LRESULT WndProc(const HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam)
{
    //Process messages
    
    return CallWindowProc(WindowProc, hWnd, msg, wParam, lParam);
}

void lpMain()//Our dll start here, we do our thing in this function.
{
    if (!bSetup)
    {
        WindowProc = (WNDPROC)SetWindowLongPtr(HWND, GWLP_WNDPROC, (LRESULT)WndProc);//our Global Hooked Procedure.
    }
}

BOOL APIENTRY DllMain( HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        CreateThread(nullptr, 0, (LPTHREAD_START_ROUTINE)lpMain, nullptr, 0, 0);//The trhead that call our function and maintain it alive.
        break;
    }
    return TRUE;
}

Instead of doing it by this way i want to hook it directly by the address/pointer of the target process also i want to avoid the CallWindowProc API call if it possible, i have been searching for the pointer with IDA Pro, x32dbg and Cheat engine but i haven't found it. How i can found a pointer to this? Thank you guys.

I am injecting a dll to the process to trying to do this.

Goal-Objective: The goal is hook the game procedure to use it instead of creating a global hook, also trying to avoid moost WinApi calls to be stealthy, cause anticheats can hook some API Functions and checks if they have been called or edited.

Example of what i am trying to do (Detour hooking):

//This is that i want to do.
#include <windows.h>
#include "detour.h"//Microsoft detours header for hooking.
#pragma comment(lib, "detours.lib");//Microsoft detours library.

static bool bSetup = false;
HWND GameHwnd = (HWND)((uintptr_t)GetModuleHandle(nullptr) + 0xA93158);

typedef LRESULT(__stdcall* wndProc) (HWND, UINT, WPARAM, lParam);//our prototype.
wndProc oWindowProc = nullptr;//our function return.

//offsets, pointers, addresses...
uintptr_t ADDRESS_WNDPROC = (uintptr_t)GetModuleHandle(nullptr) + 0x283C3A;

LRESULT HookedWndProc(const HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam)
{
    //Process messages
    
    return CallWindowProc(oWindowProc, hWnd, msg, wParam, lParam);
}

void lpMain()//Our dll start here, we do our thing in this function.
{
    if (!bSetup)//Hook Procedure and other stuff.
    {
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        
        DetourAttach(&(LPVOID&)ADDRESS_WNDPROC, &HookedWndProc);
        
        DetourTransactionCommit();
        
        oWindowProc = (WNDPROC)ADDRESS_WNDPROC;
        
        or
        
        //oWindowProc = (WNDPROC)SetWindowLongPtr(GameHwnd, GWLP_WNDPROC, (LRESULT)HookedWndProc);//our Global Hooked Procedure.
        
        bSetup = true;
    }
    
    //do our things.
}

BOOL APIENTRY DllMain( HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        CreateThread(nullptr, 0, (LPTHREAD_START_ROUTINE)lpMain, nullptr, 0, 0);//The trhead that call our function and maintain it alive.
        break;
    }
    return TRUE;
}
8
  • Hi and welcome to RE.SE. Could you please tell us the motivation, i.e. what your actual goal is. Sure, you're giving us a description of a particular path and asking for help, but it would be better if you gave us the context that comes with knowing the actual goal. In general SetWindowHookEx lets you do plenty and it also causes your DLL to be loaded into the target process (provided bitness matches and so on). The example you show won't work across process boundaries. – 0xC0000022L Jun 23 '20 at 7:34
  • The goal is hook the game procedure to use it instead of creating a global hook, also trying to avoid moslty WinApi calls to be stealthy, cause anticherats can hook some API Functions and checks if they have been called or edited., Also i am manual mapping so i don't need to inject it with SetWindowsHooks. – Mov Eax Jun 23 '20 at 14:26
  • Not sure if I understand you correctly. Do you want to obtain address of CallWindowProc? – morsisko Jun 23 '20 at 14:48
  • @morsisko I don't think so. I think the goal is to obtain the wndproc pointer for a given window and basically replace it ... but whether that'll have the desired effect depends on a whole lot of ifs ... – 0xC0000022L Jun 23 '20 at 15:02
  • @MovEax in your own wndproc you'd simply call the address of the original wndproc you obtained, minus those cases where you want to intercept specific messages or so ... no need to call CallWindowProc ... you can expect that the wndproc you replaced is doing that already for you. Oh well, you may want to do it for those messages you intercept and for which you want default handling ... but seems unlikely from your description. – 0xC0000022L Jun 23 '20 at 15:04
0

The window procedure is usually set up per window class via the call to RegisterClassW or similar. While it can be changed later by SetWindowLongPtr, in practice this is done quite rarely (AFAIK) so most likely the standard class procedure will be used. So:

  1. Check calls to RegisterClassW/RegisterClassA and extract lpfnWndProc from the class struct
  2. Hook the procedure and do what you need.
1
  • That makes sense, ill try that thank you. – Mov Eax Jun 24 '20 at 16:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.