Skip to content

Latest commit

 

History

History
15 lines (12 loc) · 553 Bytes

README.md

File metadata and controls

15 lines (12 loc) · 553 Bytes

NetHook

it is a can make .net / clr applications can be the underlying hook winapi, and modify api execution flow. you can use it to accomplish want in RING3 layer any hook a winapi.in the open source code, contains a code demo.

in the nethook use the code asm code.

  1. x86 // E9 00 00 00 00 jmp rva

  2. x64 // 48 B8 00 00 00 00 00 00 00 00 FF E0 mov rax, va jmp rax

but of course, there are many ways, and not just above two, for example, in x64, you also can do. mov rax, va // 48H B8H XX XX XX XX XX XX XX XX 50H C3H push rax ret