Improving Deviare Hooking Performance with Custom Hooks

More Binary Instrumentation Alternatives

Deviare now has custom hooks to improve hooking performance. With custom hooks, two “OnFunctionCall” events are triggered: one in the SpyMgr process, and the other within the agent. The custom hook can send data, or custom parameters. to the SpyMgr process. The custom Deviare modules running in the agent have access to all process data, including file and registry handles. Since custom hooks access local process data, it is now possible to get the full key path of a registry HKEY value and transmit the resulting string as a custom parameter instead of doing a “DuplicateHandle” call in the SpyMgr process. You can also combine asynchronous hooking with custom hooks to keep the “OnFunctionCall” event in SpyMgr from blocking the flow of the application.

The Deviare Hooking Engine aims to simplify the “hooking experience” for people who are outside the Windows internals, x86/x64 Assembly, and reverse engineering fields, there is usually a penalty when you want to abstract something complex like API function hooking in a developer friendly COM component like Deviare. Our custom hooks are designed to meet different needs.

Another interesting advantage of using custom hooks is that you can mix different programming languages. For example, you can add a custom hook in C++ but notify the SpyMgr in C#, or vice versa.

The sample code below monitors and intercepts file mappings via the function MapViewOfFile on notepad.exe 32 and 64 bit. The custom hook analyzes the buffer in search of a specific string posing as malware. The read is cancelled if that string is found in the buffer. The sample code has two modes to illustrate the difference between only using SpyMgr, and relying on custom hooks: the displayed combo switches from one mode to the other. Custom hooks are also essential for video and audio processing. If you are interested in bootstrapping a project that requires audio hooking, do not hesitate to look at our Audio Recorder API. It will save you a lot of time and money. This code also hooks both 32 and 64 bit process from the same (“Any CPU”) assembly.

Code

The code is available on github.

Prerequisites

  1. Install the latest Deviare version
  2. Register 32 and 64 bit COM DLLs (although registration-free COM can be used in custom hooks too)
  3. Download the source code
  4. Copy Nektra.Deviare2.dll to the Lib directory inside the project
  5. Build the Debug configuration
  6. Run Notepad
  7. Run the hooking console

 

  • mena99260

    Our Deviare hooking technology would be a good choice when dealing with these user interface controls.
    expensive
    cookware

  • mena99260

    hello!! Very interesting discussion glad that I came across such informative post. Keep up the good work friend. Glad to be part of your net community. grigori diaita

  • mena99260

    Our Deviare hooking technology would be a good choice when dealing with these user interface controls.
    pharmacy
    technician schools in las vegas

  • mena99260

    Our Deviare hooking technology would be a good choice when dealing with these user interface controls.
    natural allergy remedy

  • mena99260

    Our Deviare hooking technology would be a good choice when dealing with these user interface controls.
    twitters

  • Ashar Arain

    Copy Nektra.Deviare2.dll to the Lib directory inside the project..
    best cannabis
    seed company

    • Ashar Arain

      parameter instead of doing a “DuplicateHandle” call in the SpyMgr process. You can also combin….
      heating and cooling contractor

    • imtiaz

      I could think of several real life issues that my reduce the effect of trade and the shifting of labor ..
      email managers

  • Imtiaz Ali

    .Deviare2.dll to the Lib directory inside the project..
    your input here

  • Imtiaz Ali

    we stated within your post. A fantastic piece of tips and also expressing.
    LinkedIn

  • Imtiaz Ali

    uplicateHandle” call in the SpyMgr process. You can also combin….
    cab service jaipur to
    delhi

  • Imtiaz Ali

    oncern you’d like us to dive into, tell us in a
    comment at the bottom of this post and we will try to address them in
    future posts…
    how to start
    a successful blog

  • Imtiaz Ali

    we stated within your post. A fantastic piece of tips and also expressing.
    rajasthan tour
    packages from jaipur

  • Imtiaz Ali

    bottom of this post and we will try to address them in
    future posts…..
    idaho falls home builders

  • Imtiaz Ali

    Want
    Higher Ranking In Google?? Nothing Is Better Than HIGH PR BLOG COMMENTING
    SERVICE. Google Love These Kinds Of Back Links Because Your Website Is
    Linking To Authority Site That Is Already Index In Search Engines. This
    Service Is A WIN For Both Your Site, And Sites Where We Will Place Your Link
    With Additional Unique Content.

    Backlinks

  • Black Men

    This code also hooks both 32 and 64 bit process from the same (“Any CPU”) assembly.air tightness testing

  • Ashar Arain

    Thank you very much! My friends and family members will be happy after hearing about this…
    free credit reports from all 3 bureaus

  • imtiaz

    Is there really only the way to upload via Dropbox itself
    and than attach it to my mail..
    taxi for delhi
    jaipur

  • imtiaz

    If you possibly can joke and enjoy your time on the date you happen to be more when compared with guaranteed.
    targeted email addresses

  • imtiaz

    Art & More fertigt Ihren Bilderrahmen oder Ihr Passepartout auch in Sondergrößen. Sonderformate bei Wechselrahmen..

    email marketing lists

  • https://twitter.com/SeoComenting SEO Commenting

    And he in fact ordered me dinner because I berita-idblogs found it for him… lol. So allow me to reword this. psd-loft.com

  • imtiaz

    They either bow out of the draconian
    structure or hang in there for the paycheck at a high price to their
    conscience. In the former, it’s only a matter of time before turning a
    blind eye to injustice becomes routine..

    top blogging
    sites

  • imtiaz

    We got on your own web site in addition to move through a number of submit. I enjoy your thing of establishing…

    opt in email marketing

  • peterseo

    There are usually techniques in arranging a project from your bottom to
    help top, or through the end goal after which it the step-by-step back…

    email lists

  • https://twitter.com/SeoComenting John SEO

    If you are interested in the finest vets inside Shropshire you then need Playground Issa. This leading veterinary service can provide your pets every one of the health care they want…
    Grami
    Dermatology

  • https://twitter.com/SeoComenting John SEO

    I appreciate everything you have added to my knowledge base.Admiring the
    time and effort you put into your blog and detailed information you
    offer Thanks.
    salvia for sale

  • https://twitter.com/SeoComenting CanadiaN WeB HosT

    Thanks a ton for sharing your knowledge! It is great to see that some people still put in an effort into managing their websites.
    finding sobriety

  • https://www.facebook.com/ SEO Worker

    I like viewing web sites which comprehend the price of delivering the
    excellent useful resource free of charge. I truly adored reading your posting.
    targeted email list

  • imtiiz seo

    hooking techniques to extend the application functionalit

    cab
    service jaipur to delhi

  • robinseo

    Rahmenwerkstatt ermöglicht uns schnell und in höchster

    do follow blog comments

  • robinjack529

    We Are A
    Full-Service Provider Of High Quality Backlinks That Help Boost Traffic,
    Increase Rankings, And Build Authority. With Years Of Experience We Know
    Exactly What Type Of Manual Dofollow Blog Comments It Takes To Quickly
    Increase Your Online Visibility

    Link building service

  • AJ seo1

    It Takes To Quickly
    Increase Your Online Visibility

    living room ideas

  • loferboy

    You know your projects stand out of the herd. There is something special about them.

    wm shutters

  • AJ seo1

    Provider Of High Quality Backlinks That Help Boost Traffic,
    Increase Rankings, And Build Authority.
    vector logo

  • loferboy

    I really enjoyed reading this fascinating article. This surely is one of the best things that I’ve read this year.
    recommended reading

  • anasqureshi

    With Years Of Experience We Know Exactly What Type
    Of Manual Dofollow Blog Comments It Takes To Quickly Increase Your
    Online Visibility

    Ultrasound Technician
    Training

  • AJ seo1

    This surely is one of the best things that I’ve read this year.

    business insurance provider

  • loferboy

    I would like to thank you for the efforts you have made in writing this
    article. I am hoping the same best work from you in the future as well.
    best web design company

  • https://www.youtube.com/watch?v=T9plYcLAVjA Worker

    Your very own commitment to getting the message throughout came to be rather powerful and have consistently enabled employees just like me to arrive at their desired goals.
    unlocking code

  • maaz seo

    I really loved reading your blog. It was very well authored and easy to
    understand..
    taxi from delhi to jaipur

  • robinseo

    offensive or abusive will be edited or removed and we reserve the right to suspend the accounts of users posting such material.
    f4x reviews

  • https://www.facebook.com/ SEO Worker

    Good quality info. Lucky to me I came to your website not on purpose, but now I have bookmarked it.
    tmj pain remedies

  • maaz seo

    Lucky to me I came to your website not on purpose, but now I have bookmarked it.
    packers and movers pune to hyderabad

  • ayeshakhan

    Superb post shared here with the help of maps. this maps help me to understand this post easily. Keep it up…
    2015 web design

  • maaz seo

    the message throughout came to be rather powerful and have consistently
    enabled employees just like me to arrive at their desired goals.
    northern kentucky personal injury
    attorney

  • robinjack529

    There would have been tiny beef brisket bits everywhere. The rage, all
    of it, would have been warranted. And it wouldn’t have done a thing, of
    course. Whether or not this is what anyone could want, this is just what
    we get.
    Low
    OBL backlinks < 100

  • https://www.facebook.com/ SEO Worker

    I am really looking forward to skiing there. It is so very pretty and amazing there. Hopefully I can visit there one day.
    ebook creation software

  • robinjack529

    Increase Rankings, And Build Authority. With Years Of Experience We Know
    Exactly What Type Of Manual Dofollow Blog Comments It Takes To Quickly
    Increase Your Online Visibility

    Click This Link

  • ayeshakhan

    Amazing knowledge and I like to share this kind of information with my friends and hope they like it they why I do.
    will writing

  • johnjohn

    Whenever someone in the Financial division walks right into a room of individuals from the actual sales as well as marketing sections, the discussion dies lower and everybody waits for that killjoy in order to leave. http://www.connectfinance.net
    For those who have old debt that you’re paying back in a much decreased monthly rate the probabilities are how the debt may be sold onto to some debt selection agency. This really is good news for you personally and here is why! http://www.thefinancecompany.net
    It’s very important to possess personal financial discussions together with your spouse or even partner. Learning how to speak regarding money, inside a helpful as well as worthwhile method, can create the very best foundation with regard to both your own relationship along with your financial well-being. http://www.adviceaboutfinance.net

  • johnjohn

    Millions would like relief using the same kind of outdated techniques that only wind up costing energy and cash. The so-called alleviation just requires a different type of debt. You will find better methods. http://www.rainbow-finance.net
    Scientific works within the theories associated with finances as well as credit, based on the specification from the research item, are characterized to become many-sided as well as many-leveled. http://www.vipcarfinance.net
    Are you searching to teach your son or daughter about cash management? The sooner you start this method, the easier it will likely be for your son or daughter to create financial habits which will benefit her or him for an eternity, and avoid them through moving house after university in severe debt. http://www.teachingfinance.net

  • johnjohn

    It’s becoming progressively apparent which business, once we know this, is deep in the center of a spectacular transformation. http://www.businessfrontier.net
    Have a person ever considered a symphony orchestra in an effort to see what sort of large business might be structured? Suppose each portion of the orchestra is really a department inside your business, and also the musical overseer, or conductor, may be the CEO or even The Employer. http://www.businessorganisers.net
    Building an effective business requires using a firm basis. Mission, Eyesight and ideals, hard edged preparing, leadership improvement and utilizing a common group of tools with regard to resolving problems really are a good starting point. http://www.successionbusiness.net

  • johnjohn

    Credit greeting card companies are extremely competitive with regards to getting you complete their business charge card applications. Recently they’ve taken in order to offering bonuses to people prepared to open the credit account together. http://www.businesscreditcardapplications.net

  • ayeshakhan

    Try instead adding a dash of Churchill to your Hitchcock – his exhortation ‘Action this day!’ offers new leaders the best chance of getting off to a flying start..
    Strapless Bra

  • ayeshakhan

    This post is really magnificent. I really like this post. It is one of
    the best posts that I ve read in a long time. Thanks a lot for this
    really good post. I really appreciate it!
    Humane Society

  • loferboy

    Anda yang sedang mencari property hunian ataupun untuk dijadikan sarana
    berinvestasi. Harga tanah di Bandung cenderung meningkat, cocok bila
    dijadikan investasi untuk masa depan Anda.
    website here

  • roshan seo

    you feel stressed, and you don’t get enough sleep. It’s normal to feel
    scared, overwhelmed, or moody for a few days after giving birth….
    movers and packers pune

  • ayeshakhan

    The men still talk inanely but now even the most banal things they say are charged with an underlying tension. Such is the power of suspense..
    article source

  • roshan seo

    I decidedly getting a charge out of every tad bit of it and I have you bookmarked to look at new stuff you weblog post.
    gurgaon to jaipur cab

  • ayeshakhan

    People’s life time seems to be very strange thing and very oft you must choose one action at the same time, then you don’t have time to do some else thing….
    car loan rate calculator

  • anasqureshi

    very striking. You have beautifully presented your thought in this blog
    post. I found so many interesting things in this blog, excellent work…

    Olegario
    Vazquez Aldir

  • roshan seo

    I am pretty much pleased with your good work.You put really very helpful information.
    bike transport pune

    • https://www.fiverr.com/blackman111 BlackMen

      Thank you for putting this information into one post…..cccam server

  • loferboy

    This is genuinely an incredible read for me. I have bookmarked it and I am anticipating perusing new articles.
    pure garcinia cambogia reviews

  • ayeshakhan

    I’ve been searching for some decent stuff on the subject and haven’t had any luck up until this point, You just got a new biggest fan!….
    2 broke girls stream

  • loferboy

    I just found this blog and have high hopes for it to continue. Keep up
    the great work, its hard to find good ones. I have added to my
    favorites.
    gottaloseweight.com

  • ehti

    But he taught us something all the same. If his earliest years is
    fading, the dedication that earned him his final NBA act will be harder
    to forget.
    click here

  • ayeshakhan

    I am preparing a research paper and collecting information on this topic. Your post is one of the better that I have read. Thank you for putting this information into one post…..
    Movie Tube

  • roshan seo

    decent stuff on the subject and haven’t had any luck up until this point, You just got a new biggest fan!..

    gurgaon to jaipur cab

  • ayeshakhan

    A very awesome blog post. We are really grateful for your blog post. You will find a lot of approaches after visiting your post. I was exactly searching for. Thanks for such post and please keep it up. Great work..
    web marketing services

  • ehtisham

    I needed to much obliged in your time for this sublime read!! I
    decidedly getting a charge out of every tad bit of it and I have you
    bookmarked to look at new stuff you weblog post.
    grohe shower heads

  • http://rawshotstudios.com John SEO Worker

    Awesome plugin!! The only “bug” or “feature” its when I close the
    Dropbox explorer I haven’t find a way out to open it again, hope that
    you can workaround this in any future release. Great plugin folks!
    GTA 5

  • ayeshakhan

    I am preparing a research paper and collecting information on this topic. Your post is one of the better that I have read. Thank you for putting this information into one post…..
    Capture His Heart And Make Him Love You
    Forever

  • ayeshakhan

    A very awesome blog post. We are really grateful for your blog post. You
    will find a lot of approaches after visiting your post. I was exactly
    searching for. Thanks for such post and please keep it up. Great work…..
    http://www.rebelmouse.com

  • ayeshakhan

    A very awesome blog post. We are really grateful for your blog post. You will find a lot of approaches after visiting your post. I was exactly searching for. Thanks for such post and please keep it up. Great work..

    Magnetic Messaging Free Download

  • ayeshakhan

    I really loved reading your blog. It was very well authored and easy to understand. Unlike other blogs I have read which are really not that good.Thanks a lot!
    penguin method free download

  • ayeshakhan

    I am agree with you.If you need monster warlord hack tool to get unlimited hacking and best codes game at zero amount than go to the website on us..
    paleo grubs

  • ayeshakhan

    We are really grateful for your blog post. You will find a lot of approaches after visiting your post. Great work.
    Revolutionary Sex PDF

  • roshan seo

    be very strange thing and very oft you must choose one action at the same time, then you don’t have time
    Hook your ex system review

  • https://www.fiverr.com/blackman111 BlackMen

    API function hooking in a developer friendly COM component like Deviare. Our custom hooks are designed to meet different needs.m88