https://github.com/sum-catnip/kptnhook

windows kernelmode driver to inject dll into each and every process and perform systemwide function hooking
https://github.com/sum-catnip/kptnhook

Last synced: 13 days ago
JSON representation

windows kernelmode driver to inject dll into each and every process and perform systemwide function hooking

• Host: GitHub
• URL: https://github.com/sum-catnip/kptnhook
• Owner: sum-catnip
• License: mit
• Created: 2022-08-09T18:47:10.000Z (almost 2 years ago)
• Default Branch: master
• Last Pushed: 2022-08-28T20:12:59.000Z (almost 2 years ago)
• Last Synced: 2024-04-22T10:12:55.967Z (2 months ago)
• Language: C++
• Size: 35.2 KB
• Stars: 50
• Watchers: 4
• Forks: 13
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Lists

• awesome-game-security - windows kernelmode driver to inject dll into each and every process and perform systemwide function hooking

README

        
# kptnhook

## TL;DL

Kptnhooks aim is to assist in global api hooking for security research and reverse engineering.

I'm using a kernel driver to ensure each and every process is accessible, from the first processes started by windows before even the login screen. Certain security mitigations have to be disabled from the kernel side for this to work, as some windows processes have special protections against hooking and injection.

## Status

This is still highly WIP. The kerneldriver is correctly injecting into 32 and 64bit processes without crashing any of them but the dll is not doing anything yet. Here is my TODO list:

- [ ] injected dll should provide hooks and allow sideloading of user-provided dlls

- [ ] disable PPL to allow loading of user-provided dlls

- [ ] provide prebuild binaries

- [ ] provide install/uninstall scripts that disable driver signature enforcement and trust the test certificate

- [ ] instructions / guide and whitepaper