Improving Deviare Hooking Performance with Custom Hooks

More Binary Instrumentation Alternatives

Deviare now has custom hooks to improve hooking performance. With custom hooks, two “OnFunctionCall” events are triggered: one in the SpyMgr process, and the other within the agent. The custom hook can send data, or custom parameters. to the SpyMgr process. The custom Deviare modules running in the agent have access to all process data, including file and registry handles. Since custom hooks access local process data, it is now possible to get the full key path of a registry HKEY value and transmit the resulting string as a custom parameter instead of doing a “DuplicateHandle” call in the SpyMgr process. You can also combine asynchronous hooking with custom hooks to keep the “OnFunctionCall” event in SpyMgr from blocking the flow of the application.

The Deviare Hooking Engine aims to simplify the “hooking experience” for people who are outside the Windows internals, x86/x64 Assembly, and reverse engineering fields, there is usually a penalty when you want to abstract something complex like API function hooking in a developer friendly COM component like Deviare. Our custom hooks are designed to meet different needs.

Another interesting advantage of using custom hooks is that you can mix different programming languages. For example, you can add a custom hook in C++ but notify the SpyMgr in C#, or vice versa.

The sample code below monitors and intercepts file mappings via the function MapViewOfFile on notepad.exe 32 and 64 bit. The custom hook analyzes the buffer in search of a specific string posing as malware. The read is cancelled if that string is found in the buffer. The sample code has two modes to illustrate the difference between only using SpyMgr, and relying on custom hooks: the displayed combo switches from one mode to the other. Custom hooks are also essential for video and audio processing. If you are interested in bootstrapping a project that requires audio hooking, do not hesitate to look at our Audio Recorder API. It will save you a lot of time and money. This code also hooks both 32 and 64 bit process from the same (“Any CPU”) assembly.

Code

The code is available on github.

Prerequisites

  1. Install the latest Deviare version
  2. Register 32 and 64 bit COM DLLs (although registration-free COM can be used in custom hooks too)
  3. Download the source code
  4. Copy Nektra.Deviare2.dll to the Lib directory inside the project
  5. Build the Debug configuration
  6. Run Notepad
  7. Run the hooking console

 

  • mena99260

    Our Deviare hooking technology would be a good choice when dealing with these user interface controls.
    expensive
    cookware

  • mena99260

    hello!! Very interesting discussion glad that I came across such informative post. Keep up the good work friend. Glad to be part of your net community. grigori diaita

  • mena99260

    Our Deviare hooking technology would be a good choice when dealing with these user interface controls.
    pharmacy
    technician schools in las vegas

  • mena99260

    Our Deviare hooking technology would be a good choice when dealing with these user interface controls.
    natural allergy remedy

  • mena99260

    Our Deviare hooking technology would be a good choice when dealing with these user interface controls.
    twitters

  • Ashar Arain

    Copy Nektra.Deviare2.dll to the Lib directory inside the project..
    best cannabis
    seed company

    • Ashar Arain

      parameter instead of doing a “DuplicateHandle” call in the SpyMgr process. You can also combin….
      heating and cooling contractor

    • imtiaz

      I could think of several real life issues that my reduce the effect of trade and the shifting of labor ..
      email managers

  • Imtiaz Ali

    .Deviare2.dll to the Lib directory inside the project..
    your input here

  • Imtiaz Ali

    we stated within your post. A fantastic piece of tips and also expressing.
    LinkedIn

  • Imtiaz Ali

    uplicateHandle” call in the SpyMgr process. You can also combin….
    cab service jaipur to
    delhi

  • Imtiaz Ali

    oncern you’d like us to dive into, tell us in a
    comment at the bottom of this post and we will try to address them in
    future posts…
    how to start
    a successful blog

  • Imtiaz Ali

    we stated within your post. A fantastic piece of tips and also expressing.
    rajasthan tour
    packages from jaipur

  • Imtiaz Ali

    bottom of this post and we will try to address them in
    future posts…..
    idaho falls home builders

  • Imtiaz Ali

    Want
    Higher Ranking In Google?? Nothing Is Better Than HIGH PR BLOG COMMENTING
    SERVICE. Google Love These Kinds Of Back Links Because Your Website Is
    Linking To Authority Site That Is Already Index In Search Engines. This
    Service Is A WIN For Both Your Site, And Sites Where We Will Place Your Link
    With Additional Unique Content.

    Backlinks

  • Black Men

    This code also hooks both 32 and 64 bit process from the same (“Any CPU”) assembly.air tightness testing

  • Ashar Arain

    Thank you very much! My friends and family members will be happy after hearing about this…
    free credit reports from all 3 bureaus

  • imtiaz

    Is there really only the way to upload via Dropbox itself
    and than attach it to my mail..
    taxi for delhi
    jaipur

  • imtiaz

    If you possibly can joke and enjoy your time on the date you happen to be more when compared with guaranteed.
    targeted email addresses

  • imtiaz

    Art & More fertigt Ihren Bilderrahmen oder Ihr Passepartout auch in Sondergrößen. Sonderformate bei Wechselrahmen..

    email marketing lists

  • https://twitter.com/SeoComenting SEO Commenting

    And he in fact ordered me dinner because I berita-idblogs found it for him… lol. So allow me to reword this. psd-loft.com

  • imtiaz

    They either bow out of the draconian
    structure or hang in there for the paycheck at a high price to their
    conscience. In the former, it’s only a matter of time before turning a
    blind eye to injustice becomes routine..

    top blogging
    sites

  • imtiaz

    We got on your own web site in addition to move through a number of submit. I enjoy your thing of establishing…

    opt in email marketing