dllhook/README.md

dllhook
===
dllhook is a tool for hooking Windows x86 applications. This tools injects embedded Python interpreter (Python DLL)
to the application and executes your script. And also this provides a convenient hooking library to use in your script.  
This tool uses `mayhem python_injector` as injector.  
See https://github.com/zeroSteiner/mayhem/blob/master/tools/python_injector.py  
When you clone this repository, you must also clone submodule `mayhem`.  
This tool is tested on Python 3.6-3.9.

Installation
===
Make sure you use 32-bit version of Python.  
This package requires `capstone`. To install `capstone`, in _Visual Studio Developer Command Prompt_:
```shell
python -mpip install capstone
```

To install dllhook:
```shell
python -mpip install dllhook
```

Usage
===
* Write your python script to inject.
```python
import ctypes
import dllhook

# @dllhook.hook_dll('Kernel32.dll', 0x00014510) also works
@dllhook.hook_dll('Kernel32.dll', b'CreateProcessW')
def see_process(arg1):
    if arg1 != 0:
        print("<hooked> ", ctypes.wstring_at(arg1))
```
* Save it as a file. (e.g. `C:\Users\example\Desktop\see_process.py`)

* Execute module `dllhook` with the target program and your script as the arguments.
```shell
python -mdllhook "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" C:\Users\example\Desktop\see_process.py
```
Console output:
```text
[+] Opened a handle to pid: 24308
[*] Found Python library at: C:\Users\example\AppData\Local\Programs\Python\Python36-32\python36.dll
[*] Injecting Python into the process...
[+] Loaded C:\Users\example\AppData\Local\Programs\Python\Python36-32\python36.dll with handle 0x69ee0000
[*] Resolved addresses:
  - Py_InitializeEx:    0x6a061cc0
  - PyRun_SimpleString: 0x6a07b1c0
[*] Initialized Python in the host process
[*] Waiting for client to connect on \\.\pipe\mayhem
[*] Client connected on named pipe
target: 0x75ae4510
invoke: 0x6c401df0
callbacker: 0x6620fdc
<hooked> C:/Program Files (x86)/Adobe/Acrobat Reader DC/Reader/ARH.exe
<hooked> C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
```
Author
===
[cosine0](https://github.com/cosine0) @github