So in this, we will be taking a look at the function set with the successor to the events and execute
our shared code whenever that event occurs.
So hooking means it's kind of like monitoring or reiterating the actual code to the our our desired
function.
So this thing is used to monitor the functions and we can also redirect the actual code to the, our
malicious function.
So we can set the Windows Hook using this function.
And there are certain types of hooks available.
There are mouse events and keyboard events, etc. So we'll be using the keyboard to monitor the keyboard
events and whenever there is a keyboard event will be executing a function that normally well, you
can execute the reversal.
For now, we'll be just popping the message box.
So first we need to.
The second parameter is the function address, and third parameter is the handle.
And the last one is the thread data.
In the thread we need to specify which thread we need to monitor.
If you give zero, are the new threads going to execute our function whenever there is an event?
So that's first created here that simply pops up the message box.
So here, let me create.
A function called pop up.
So I'm using the.
C-sharp forms.
So standard windows we have this message box show so we can just say testing.
One, two, three.
So whenever in my main court I do the pop up.
I should get the message box.
And we can see the message box.
Now, this is generated in the format we need to be in the format of digital.
So for that, we need to manage add the NuGet package.
I have already insert this one that is the export.
So this converts a function into a data export function.
So we can import that data and use that function.
All we need to say is the export of the name pop up.
So we need to change the app to class library so this will generate the solution.
And we can see message box there so we can go and test this one.
Let's execute the function pop up and here we can see the message box.
So let's copy this one.
Copy the path and let's go.
And so I have already written the signature for this.
So it's nothing fancy integer and two endpoints and again you want that data.
So, uh.
So this is the part.
So let's, uh.
So I am using the road library to load the data into the memory.
And we are going to find the address of the function pop up so we can use get proc address.
So the first one is the other hand and second one is the function name that is pop up.
And we regret the function at this.
If your hand did not is cause to.
Zero.
And if you got any function address, then you can say.
If function or does not is equal to 1.0.
Then the function is rewarded in our process.
So let's actually run this one.
I have created it here so we can just say Marshal should get delegate for a function pointer and the
pointer is the function address, the type of delegate.
So the delegate name is also pop up.
So.
So we can see that dynamic in work.
Now, at this point, we should be we should be getting the message box if everything goes well.
And here you can see the message box has been popped.
So that means the function address.
We can print out the function address as well.
And we can see the function address.
So now we have successfully.
Pre-order that digital and found that function address.
Now we need to call this set Windows XY.
And the first parameter is the integer, the type of the hook we want to monitor.
So that is the keyboard one.
So I can pass two.
And second one is the function address.
And the third one is the other hand in Russian is trade daddy.
So if I pass zero, then the newly created threats will execute this function.
To unhook this, we can use unhook windows hooks.
And meanwhile, what we need to do is, since these are the key word events, our keyboard won't give
the input to this program.
So we can do read it or three so we can say 6 seconds.
So after cooking for the keyword events, we are sleeping for 6 seconds.
So in these 6 seconds, if there is any keyboard press, then our function gets executed.
So let's start this one and now I'm going to press.
So here you can see I have pressed the keyboard and here we can see the message box have been popped
and whenever the program has been exited, this memory was destroyed.
And so this.
We don't.
Those passes also exited.
Now let's.
So.
So in these 15 seconds, I'm going to open Notepad already.
So now I can type normal?
Yes.
Now let's start hooking.
And whenever there is a key press, even in the notepad now, this process will try to load the function
from this data, and it's going to execute.
So I am pressing.
And now we can see our main process has been exited, but still you can see these are not disturbed
because these are loaded by this process.
So that some of these, uh, video hooking, uh, events using set windows for clicks, you can also
create the data and you can also generate that using em as a venom and you can point the functionalities.