Description: Here you can find source codes. Note: to compile NtProcDrv you need NTDDK to be installed on your computer.
To run compiled sample, place tunew20.dll in any folder that is specified in PATH variable (windows/system32 for example). Then run HookDemo.exe. After it is has been started all process creation routines will be intercepted. Press "Enter" key and hook will be uninstalled. Note: you should have an administrator rights for properly running application.
To verify if it works fine try to start any application after HookDemo has been run. You should see message box "Before starting process." on process startup and "Before ending." right before process will be ended.
To Search:
File list (Check if you may need any files):
dllhookapi
..........\dllhookapi
..........\..........\dllhookapi.cpp
..........\..........\dllhookapi.def
..........\..........\dllhookapi.sln
..........\..........\dllhookapi.vcproj
..........\..........\Release
..........\..........\.......\tunew20.dll
..........\..........\stdafx.cpp
..........\..........\stdafx.h
..........\HookDemo
..........\........\HookDemo.cpp
..........\........\HookDemo.sln
..........\........\HookDemo.vcproj
..........\........\Monitoring.cpp
..........\........\Monitoring.h
..........\........\Release
..........\........\.......\HookDemo.exe
..........\........\stdafx.cpp
..........\........\stdafx.h
..........\NTProcDrv
..........\.........\DrvUtils.c
..........\.........\DrvUtils.h
..........\.........\NTProcDrv.c
..........\.........\NTProcDrv.dsp
..........\.........\NTProcDrv.dsw
..........\.........\NTProcDrv.h
..........\.........\NTProcDrv.vcproj
..........\.........\Release
..........\.........\.......\NTProcDrv.sys
..........\.........\Undocumented.h
..........\readme.txt
Download