API hooking

Hi. What I'm trying to achieve here is an API hook in a single application. The application is writing several logfiles which is clogging up my harddrive, so I thought I'd reroute WriteFile to a function that does nothing.

I was thinking of injecting a DLL and then patch the API-call. However, I'm not sure which technique I should use to reroute an API. I've tried the Microsoft Detour library but I would rather do it myself, thus I can actually learn something on the way.

What is the easiest way, inside a process, to reroute one or several API's?

Look up hooking on CodeProject. There are several tutorials there.

Thank you. I've looked through a few examples and my eye has fallen on to IAT Patching, a quite interesting technique.

I've been writing some code but I have not gotten it to actually work. This is my code so far:

dll.c

Code:

---

int WINAPI My_MessageBox(HWND, LPCTSTR, LPCTSTR, UINT);

int * addr = (int *)MessageBoxW;
int * myaddr = (int *)My_MessageBox;
PDWORD pAddr = NULL;

unsigned __stdcall ThreadProc(void *param)
{
        // Hook API
        HMODULE hMod = GetModuleHandle(NULL);
        PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hMod;
        PIMAGE_NT_HEADERS pNTHeaders = (PIMAGE_NT_HEADERS)((BYTE *)hMod + pDosHeader->e_lfanew);
        PIMAGE_OPTIONAL_HEADER pOptHeader = (PIMAGE_OPTIONAL_HEADER)&(pNTHeaders->OptionalHeader);
       
        PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((BYTE *)hMod + pOptHeader->DataDirectory[1].VirtualAddress);
       
        while(pImportDescriptor->FirstThunk)
        {
              char * dllname = (char *)((BYTE *)hMod + pImportDescriptor->Name);
             
              PIMAGE_THUNK_DATA pThunkData = (PIMAGE_THUNK_DATA)((BYTE *)hMod + pImportDescriptor->OriginalFirstThunk);
             
              int no = 1;
              while(pThunkData->u1.Function)
              {
                    char *funname = (char *)((BYTE *)hMod + (DWORD)pThunkData->u1.AddressOfData + 2);
                    PDWORD lpAddr = (DWORD *)((BYTE *)hMod + (DWORD)pImportDescriptor->FirstThunk) + (no-1);
                   
                    if((*lpAddr) == (DWORD)addr)
                    {
                                  DWORD dwOld;
                                  MEMORY_BASIC_INFORMATION mbi;
                                  VirtualQuery(lpAddr, &mbi, sizeof(mbi));
                                  VirtualProtect(lpAddr, sizeof(DWORD), PAGE_READWRITE, &dwOld);
                                  WriteProcessMemory(GetCurrentProcess(), lpAddr, &myaddr, sizeof(DWORD), NULL);
                                  pAddr = lpAddr;
                                  break;
                    }
                    no++;
                    pThunkData++;
              }
              pImportDescriptor++;
        }
       
        return 0;
}

BOOL APIENTRY DllMain (HINSTANCE hInst    /* Library instance handle. */ ,
                      DWORD reason        /* Reason this function is being called. */ ,
                      LPVOID reserved    /* Not used. */ )
{
                      //PDWORD OrigWriteFile;
                      //PDWORD MyWriteFile;
    switch (reason)
    {
      case DLL_PROCESS_ATTACH:
          _beginthreadex(NULL, 0, ThreadProc, NULL, NULL, NULL);
          MessageBox(NULL, "Testing", "Test", MB_OK);
        break;

      case DLL_PROCESS_DETACH:
        break;

      case DLL_THREAD_ATTACH:
        break;

      case DLL_THREAD_DETACH:
        break;
    }

    /* Returns TRUE on success, FALSE on failure */
    return TRUE;
}

int WINAPI My_MessageBox(HWND hWnd, LPCTSTR lpText, LPCTSTR lpCation, UINT uType)
{
    MessageBox(NULL, "Detoured Messagebox call", "Test", MB_OK);
}

---

test.c

Code:

---

#include <windows.h>

int main()
{
    Sleep(10000);
    MessageBox(NULL, "Hey", "Test", MB_OK);
    Sleep(5000);
    MessageBox(NULL, "Hey", "test2", MB_OK);
    return 0;
}

---

The DLL is injected in to test.exe's memory space and the hook is being runned. Though The MessageBox-calls simply call the original API.

Have I misunderstood the technique? What would be the problem? SE_DEBUG_PRIVILEGES?

Thank you