There are 3 different types of hooks:

1. Hook Before Entering the function (type 'B')
2. Hook After the function returns (type 'A')
3. Hook when executing reaches this address (type '*')

To intercept functions exported from a DLL the syntax is:

          name_of_dll:function_name:number_of_parametes:python_module.hook_handler_name:hook_type

for example, to hook 'CreateFileA' (which has 7 parameters) before it is executed with a handler called 'CreateFileA_handler' implemented in the file mymodule.py:

          kernel32.dll:CreateFileA:7:mymodule.CreateFileA_handler:B

As explained above, it is possible to hook any 'executable' address of a process (which is basically the same as setting a breakpoint on an address):

          field_not_used:address_to_hook_in_hex:field_not_used:python_module.hook_handler_name:hook_type

So, for example, to hook execution at 0x401000 handled by the hook handler called 'anybp' implemented in the mymodule.py file:

          dummy.dll:0x401000:0:mymodule.anybp:*

Next is a sample of how a configuration file look like:

# B = hook before entering function
# A = hook AFTER function returns
# * = hook when an address is executed
kernel32.dll:CreateFileA:7:mymodule.CreateFileA_handler:B
dummy.dll:0x401000:0:mymodule.anybp:*

The configuration file can be loaded from OllyDbg by going to the 'plugins->uhooker' menu, and selecting 'Load Cfg File'. See the screenshot below.

A file dialog will be displayed from which a .cfg file (in fact any name can be used) can be loaded.

          def hook_name(hookcall):

The hookcall parameter is an object passed by the server to the hook handler that contains useful information about the intercept function and process. For example:

A hook handler can also read and write memory of the intercepted process, allocate memory, etc. All these functions are available from the Proxy.py module, so all hook handler also import and create and instance of the 'Proxy' object.

Next is a sample hook handler:

def CreateFileA_handler(hookcall):
	myproxy = hookcall.proxy
	print "bughandler running..."
	print "esp = %X" % hookcall.regs['esp']
	print "retaddr = %X" % hookcall.retaddr
	print "arg0 = %X" % hookcall.params[0]
	buffer = myproxy.readasciiz( hookcall.params[0] )
	print buffer
	hookcall.sendack()
	return

This handler:

Use cases

Intercepting network traffic

This can be easily done using the uhooker; for example, by hooking send(),sendto(), recvfrom(), recv(), etc.

One thing that I normally do and that people without much technical knowledge finds very amusing and I myself find very handy for certain ocassions, is that for every packet the application is about to send, my hook handler saves the packet to a file, runs an hex editor and loads the file with the packet, using the hex editor I can change the packet, observe it, add more bytes, etc, then I save the modified packet, and that is the packet that will be sent over the wire.

The following .cfg files and scripts will allow you to do what I have just described for TCP packets and UDP packets: