{"id":22266618,"url":"https://github.com/fly-studio/winmm_hijack","last_synced_at":"2026-07-07T03:31:07.118Z","repository":{"id":258525634,"uuid":"863960756","full_name":"fly-studio/winmm_hijack","owner":"fly-studio","description":"Hijack winmm.dll, and Inject your dlls","archived":false,"fork":false,"pushed_at":"2024-10-18T10:37:17.000Z","size":151,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-10-19T12:11:50.047Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fly-studio.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-09-27T08:29:44.000Z","updated_at":"2024-10-18T10:37:20.000Z","dependencies_parsed_at":"2024-10-20T13:03:37.901Z","dependency_job_id":null,"html_url":"https://github.com/fly-studio/winmm_hijack","commit_stats":null,"previous_names":["fly-studio/winmm_hijack"],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fly-studio%2Fwinmm_hijack","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fly-studio%2Fwinmm_hijack/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fly-studio%2Fwinmm_hijack/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fly-studio%2Fwinmm_hijack/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fly-studio","download_url":"https://codeload.github.com/fly-studio/winmm_hijack/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245477515,"owners_count":20621833,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-03T10:19:25.761Z","updated_at":"2025-10-27T23:13:12.396Z","avatar_url":"https://github.com/fly-studio.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"# winmm.dll hijack \u0026 DLL Injection \u0026 Hook\n\n劫持`winmm.dll`，并注入指定的dll。\n\n待劫持目标exe的导入表`IAT（Import Address Table）`中必须有`winmm.dll`，才能劫持成功。\n\n\u003e 检测目标exe的位数和`IAT`，使用：[Detect it easy](https://github.com/horsicq/Detect-It-Easy)\n\n\n## Build\n\n编译项目Release，会生两个文件，分别为\n- winmm.x86.dll\n- winmm.x64.dll\n\n\n## Usage\n\n1. 假设目标exe是x86的，就修改`winmm.x86.dll`为`winmm.dll`，放入该程序的目录下\n2. 待注入的dll命名需要为`winmm.xxx.dll`，放入同目录。\n\n    支持多个dll，例如：\n\n    ```\n    winmm.core.dll\n    winmm.module.dll\n    ```\n3. 加载顺序是简单的字典顺序，比如`winmm.a.dll` 优先于 `winmm.b.dll`\n\n4. 是否加载成功，使用[DebugView](https://learn.microsoft.com/en-us/sysinternals/downloads/debugview)查看\n\n    输出如下，表示`winmm.core.dll`注入成功\n    ```\n    Injected dll: winmm.core.dll\n    ```\n\n## Development\n\n1. 可以使用[Baymax Patch Tools](https://www.chinapyg.com/thread-83083-1-1.html)、[AHeadLibEx](https://github.com/i1tao/AheadLibEx)生成的劫持的源码\n  \n    比如系统DLL：`winhttp.dll`、`version.dll`。\n\n\n2. 需要分别生成x86和x64的源码，\n    - 系统x64的dll位于：`C:\\Windows\\System32`\n    - 系统x86的dll位于`C:\\Windows\\SysWOW64`\n\n    - x86的只会生成一个.cpp\n    - x64的会生成.cpp、.asm，导出的函数的代码实际上位于.asm\n\n## 导出的方法\n\nwinmm.dll中导出了3个简单的hook方法：\n\n```cpp\nlong hook(PVOID* originalFunc, PVOID hookFunc);\nlong unhook(PVOID* originalFunc, PVOID hookFunc);\nlong hookTransaction(HANDLE threadHandle, void (*callback)(void));\n```\n\n除此之外，还导出了Detours的所有方法：\n\n```cpp\nLONG WINAPI DetourTransactionBegin(VOID);\nLONG WINAPI DetourTransactionCommit(VOID);\nLONG WINAPI DetourTransactionAbort(VOID);\nLONG WINAPI DetourUpdateThread(HANDLE hThread);\nLONG WINAPI DetourAttach(PVOID *ppPointer, PVOID pDetour);\nLONG WINAPI DetourAttachEx(PVOID *ppPointer, PVOID pDetour, PDETOUR_TRAMPOLINE *ppRealTrampoline, PVOID *ppRealTarget, PVOID *ppRealDetour);\nLONG WINAPI DetourDetach(PVOID *ppPointer, PVOID pDetour);\n\nBOOL WINAPI DetourCreateProcessWithDllExA(LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation, LPCSTR lpDllName, PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);\nBOOL WINAPI DetourCreateProcessWithDllExW(LPCWSTR lpApplicationName, LPWSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation, LPCSTR lpDllName, PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);\n\nBOOL WINAPI DetourCreateProcessWithDllsA(LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation, DWORD nDlls, LPCSTR *rlpDlls, PDETOUR_CREATE_PROCESS_ROUTINEA pfCreateProcessA);\nBOOL WINAPI DetourCreateProcessWithDllsW(LPCWSTR lpApplicationName, LPWSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCWSTR lpCurrentDirectory, LPSTARTUPINFOW lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation, DWORD nDlls, LPCSTR *rlpDlls, PDETOUR_CREATE_PROCESS_ROUTINEW pfCreateProcessW);\n\nBOOL WINAPI DetourRestoreAfterWith(VOID);\nBOOL WINAPI DetourFinishHelperProcess(HANDLE hProcess, DWORD dwProcessId, BOOL fFinishedProcess);\n\nPVOID WINAPI DetourBinaryOpen(HANDLE hFile);\nVOID WINAPI DetourBinaryClose(PVOID pBinary);\nBOOL WINAPI DetourBinaryWrite(HANDLE hFile, PVOID pBinary);\nBOOL WINAPI DetourBinaryResetImports(PVOID pBinary);\nBOOL WINAPI DetourBinaryEditImports(PVOID pBinary, PVOID pContext, PF_DETOUR_BINARY_BYWAY_CALLBACK pfByway, PF_DETOUR_BINARY_FILE_CALLBACK pfFile, PF_DETOUR_BINARY_SYMBOL_CALLBACK pfSymbol, PF_DETOUR_BINARY_COMMIT_CALLBACK pfCommit);\n\nPVOID WINAPI DetourAllocateRegionWithinJumpBounds(PVOID pbTarget, LONG cbAllocate);\nPVOID WINAPI DetourCopyInstruction(PVOID pDst, PVOID *ppDstPool, PVOID pSrc, PVOID *ppTarget, LONG *plExtra);\n\nBOOL WINAPI DetourSetCodeModule(HMODULE hModule, BOOL fLimitReferencesToModule);\nBOOL WINAPI DetourSetIgnoreTooSmall(BOOL fIgnore);\nBOOL WINAPI DetourSetRetainRegions(BOOL fRetain);\nBOOL WINAPI DetourSetSystemRegionLowerBound(PVOID pSystemRegionLowerBound);\nBOOL WINAPI DetourSetSystemRegionUpperBound(PVOID pSystemRegionUpperBound);\n\nPVOID WINAPI DetourGetEntryPoint(HMODULE hModule);\nULONG WINAPI DetourGetModuleSize(HMODULE hModule);\nHMODULE WINAPI DetourEnumerateModules(HMODULE hModuleLast);\nULONG WINAPI DetourGetSizeOfPayloads(HMODULE hModule);\n\n\nPVOID WINAPI DetourFindPayload(HMODULE hModule, REFGUID rguid, DWORD *pcbData);\nPVOID WINAPI DetourGetContainingModule(PVOID pvAddr);\n\nBOOL WINAPI DetourEnumerateImports(HMODULE hModule, PVOID pContext, PF_DETOUR_IMPORT_FILE_CALLBACK pfImportFile, PF_DETOUR_IMPORT_FUNC_CALLBACK pfImportFunc);\nBOOL WINAPI DetourEnumerateExports(HMODULE hModule, PVOID pContext, PF_DETOUR_ENUMERATE_EXPORT_CALLBACK pfExport);\n```\n\n## Example: Hook 系统函数\n\n比如需要hook `CreateFileW`，则在`winmm.xxx.dll`的`dllmain.cpp`中参考如下：\n\n\n```cpp\n#include \u003cWindows.h\u003e\n\n// 申明父级winmm.dll的函数\n#define BindDllMethod(funcPtr, dllHandle, funcName) (funcPtr = (decltype(funcPtr))GetProcAddress(dllHandle, funcName))\nlong (*hookTransaction)(HANDLE threadHandle, void (*callback)(void)) = nullptr;\nlong (*hook)(PVOID* originalFunc, PVOID hookFunc) = nullptr;\nlong (*unhook)(PVOID* originalFunc, PVOID hookFunc) = nullptr;\n\n\n// 原始 CreateFileW 函数的指针\nauto RealCreateFileW = CreateFileW;\n\n// 钩子函数\nstatic HANDLE WINAPI HookedCreateFileW(\n    LPCWSTR lpFileName,\n    DWORD dwDesiredAccess,\n    DWORD dwShareMode,\n    LPSECURITY_ATTRIBUTES lpSecurityAttributes,\n    DWORD dwCreationDisposition,\n    DWORD dwFlagsAndAttributes,\n    HANDLE hTemplateFile\n)\n{\n    // 做你想做的事情\n\n    // 调用原始的 CreateFileW 函数\n    HANDLE hFile = RealCreateFileW(\n        lpFileName,\n        dwDesiredAccess,\n        dwShareMode,\n        lpSecurityAttributes,\n        dwCreationDisposition,\n        dwFlagsAndAttributes,\n        hTemplateFile\n    );\n\n    // 做你想做的事情\n\n    return hFile;\n}\n\nBOOL APIENTRY DllMain( HMODULE hModule,\n                       DWORD  ul_reason_for_call,\n                       LPVOID lpReserved\n                     )\n{\n    switch (ul_reason_for_call)\n    {\n        case DLL_PROCESS_ATTACH: {\n            HMODULE hModule = GetModuleHandle(\"winmm.dll\");\n            if (nullptr == hModule) { // 当前dll不是被 winmm.dll 加载的，无法hook\n                return;\n            }\n            // 绑定\n            BindDllMethod(hookTransaction, hModule, \"hookTransaction\");\n            BindDllMethod(hook, hModule, \"hook\");\n            BindDllMethod(unhook, hModule, \"unhook\");\n\n            if (hookTransaction != nullptr) {\n                hookTransaction(NULL, [](){\n                    hook(\u0026(PVOID\u0026)RealCreateFileW, (PVOID)HookCreateFileW);\n                    // ...\n                });\n            }\n            \n        } break;\n        case DLL_PROCESS_DETACH: {\n            if (hookTransaction != nullptr) {\n                hookTransaction(NULL, [](){\n                    unhook(\u0026(PVOID\u0026)RealCreateFileW, (PVOID)HookCreateFileW);\n                    // ...\n                });\n            }\n        }\n        break;\n    }\n}\n\n#undef BindDllMethod // 避免影响其他模块\n\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffly-studio%2Fwinmm_hijack","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffly-studio%2Fwinmm_hijack","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffly-studio%2Fwinmm_hijack/lists"}