GitHunt
LI

liulilittle/NetHook

it is a can make .net / clr applications can be the underlying hook winapi, and modify api execution flow.

NetHook

it is a can make .net / clr applications can be the underlying hook winapi, and modify api execution flow. you can use it to accomplish want in RING3 layer any hook a winapi.in the open source code, contains a code demo.

in the nethook use the code asm code.

  1. x86 // E9 00 00 00 00
    jmp rva

  2. x64 // 48 B8 00 00 00 00 00 00 00 00 FF E0
    mov rax, va
    jmp rax

but of course, there are many ways, and not just above two, for example, in x64, you also can do.
mov rax, va // 48H B8H XX XX XX XX XX XX XX XX 50H C3H
push rax
ret

Languages

C#100.0%

Contributors

GNU General Public License v3.0
Created May 19, 2016
Updated April 17, 2025