I know how I can hook functions from the IAT table, but I have a problem with APIs which were imported by calling LoadLibrary/GetProcAddress functions. I want to know exactly how someone could hook those functions. I realize that I should hook the GetProcAddress function but how can I check the parameters that were passsed to that function?

For example, consider a program which is going to include MessageBoxW via LoadLibrary/GetProcAddress, how can I hook that MessageBoxW and then check the parameters that have been passed to it?

I have searched a lot in StackOverflow and Google, but I couldn't find a step-by-step tutorial about this. So, if you have such a tutorial or article, I would be really grateful to read them.

CodePudding user response：

In order to hook APIs that they are loaded into a binary dynamically with help of LoadLibrary/GetProcAddress, you should intercept return address of the GetProcAddress and name of the functions that passed to it (for example, consider a program try to load MessageBoxA in this way).

In the second step, you should save that original address of MessageBoxA API in a variable like OriginalMessageBoxA.

In the third and final step, you should return address of your modified API (HookedMessageBoxA) to the callee of the GetProcAddress so when the program try to call that address, program redirected to your function. Something like the following one:

VOID* HookedGetProcAddress(HMODULE hModule, LPCSTR lpProcName)
{
    if (std::string(lpProcName).compare("MessageBoxA") == 0)
    {
        OMessageBoxA = (PMessageBoxA)GetProcAddress(hModule, lpProcName);
        return HookedMessageBoxA;
    }
    else
    {
        return OGetProcAddress(hModule, lpProcName);
    }
}

In that moment, caller will go through your HookedMessageBoxA and you can check parameters that passed to MessageBoxA. As folks said, it is kinda same like normal IAT hook with a minor changes and tricks.