EasyHook

https://easyhook.github.io
Admin
EasyHook is a Windows API hooking framework that enables injecting managed .NET assemblies and...
Tokens:59,296
Snippets:512
Trust Score:9.7
Update:1 month ago
Show doc for...
Tokens:
Raw
### InstallReference(Guid, String, String)

Source: https://easyhook.github.io/api/html/M_System_GACManagedAccess_InstallReference__ctor.htm

Initializes a new instance of the InstallReference class with the specified GUID scheme, identifier, and reference data.

```APIDOC
## InstallReference Constructor

### Description
Initializes a new instance of the InstallReference class. This constructor is used to define how an assembly is referenced within the GAC.

### Signature
`public InstallReference(Guid guid, string id, string data)`

### Parameters
- **guid** (System.Guid) - The reference scheme GUID. Supported values include FUSION_REFCOUNT_MSI_GUID, FUSION_REFCOUNT_UNINSTALL_SUBKEY_GUID, FUSION_REFCOUNT_FILEPATH_GUID, and FUSION_REFCOUNT_OPAQUE_STRING_GUID.
- **id** (System.String) - A unique string that identifies the application that installed the assembly.
- **data** (System.String) - A string containing reference-specific data understood by the entity adding the reference.
```

--------------------------------

### Implement and Install a Native Hook

Source: https://easyhook.github.io/tutorials/nativehook.html

Demonstrates defining a hook function, installing it with LhInstallHook, and managing thread-specific access via ACLs.

```cpp
#include <string>
#include <iostream>
#include <Windows.h>
#include <easyhook.h>

using namespace std;

BOOL WINAPI myBeepHook(DWORD dwFreq, DWORD dwDuration);

BOOL WINAPI myBeepHook(DWORD dwFreq, DWORD dwDuration)
{
    cout << "\n****All your beeps belong to us!\n\n";
    return Beep(dwFreq + 800, dwDuration);
}

int _tmain(int argc, _TCHAR* argv[])
{
    HOOK_TRACE_INFO hHook = { NULL }; // keep track of our hook
    cout << "\n";
    cout << GetProcAddress(GetModuleHandle(TEXT("kernel32")), "Beep");
    
    // Install the hook
    NTSTATUS result = LhInstallHook(
        GetProcAddress(GetModuleHandle(TEXT("kernel32")), "Beep"), 
        myBeepHook, 
        NULL, 
        &hHook);
    if (FAILED(result))
    {
        wstring s(RtlGetLastErrorString());
        wcout << "Failed to install hook: ";
        wcout << s;
        cout << "\n\nPress any key to exit.";
        cin.get();
        return -1;
    }
    
    cout << "Beep after hook installed but not enabled.\n";
    Beep(500, 500);

    cout << "Activating hook for current thread only.\n";
    // If the threadId in the ACL is set to 0, 
    // then internally EasyHook uses GetCurrentThreadId()
    ULONG ACLEntries[1] = { 0 };
    LhSetInclusiveACL(ACLEntries, 1, &hHook);

    cout << "Beep after hook enabled.\n";
    Beep(500, 500);

    cout << "Uninstall hook\n";
    LhUninstallHook(&hHook);

    cout << "Beep after hook uninstalled\n";
    Beep(500, 500);

    cout << "\n\nRestore ALL entry points of pending removals issued by LhUninstallHook()\n";
    LhWaitForPendingRemovals();

    cout << "Press any key to exit.";
    cin.get();

    return 0;
}
```

--------------------------------

### Install Hook with LhInstallHook

Source: https://easyhook.github.io/tutorials/remotefilemonitor.html

Installs a hook on the NtCreateFile function using EasyHook's LhInstallHook.

```cpp
NTSTATUS NtCreateFile_result = LhInstallHook(GetProcAddress(GetModuleHandle(TEXT("ntdll.dll")), "NtCreateFile"), NtCreateFile_Hook, NULL, &NtCreateFile_hHook);
```

--------------------------------

### Register

Source: https://easyhook.github.io/api/html/Methods_T_EasyHook_Config.htm

Installs EasyHook and user .NET assemblies into the GAC.

```APIDOC
## Register

### Description
REQUIRES ADMIN PRIVILEGES. Installs EasyHook and all given user NET assemblies into the GAC and ensures that all references are cleaned up if the installing application is shutdown.
```

--------------------------------

### ExecuteAsService Usage Example

Source: https://easyhook.github.io/api/html/M_EasyHook_RemoteHooking_ExecuteAsService__1.htm

Example demonstrating how to use ExecuteAsService to perform administrative tasks like process enumeration.

```C#
private static void OnProcessUpdate(Object InCallback)
{
    ProcessTimer.Change(Timeout.Infinite, Timeout.Infinite);

    try
    {
        ProcessInfo[] Array = (ProcessInfo[])RemoteHooking.ExecuteAsService<Form1>("EnumProcesses");
        SortedDictionary<String, ProcessInfo> Result = new SortedDictionary<string, ProcessInfo>();

        // sort by name...
        lock (ProcessList)
        {
            ActivePIDList.Clear();

            for (int i = 0; i < Array.Length; i++)
            {
                Result.Add(System.IO.Path.GetFileName(Array[i].FileName) + "____" + i, Array[i]);

                ActivePIDList.Add(Array[i].Id);
            }

            Result.Values.CopyTo(Array, 0);

            ProcessList.Clear();

            ProcessList.AddRange(Array);
        }
    }
    catch (AccessViolationException)
    {
        MessageBox.Show("This is an administrative task!", "Permission denied...", MessageBoxButtons.OK);

        Process.GetCurrentProcess().Kill();
    }
    finally
    {
        ProcessTimer.Change(5000, 5000);
    }
}

[Serializable]
public class ProcessInfo
{
    public String FileName;
    public Int32 Id;
    public Boolean Is64Bit;
    public String User;
}

public static ProcessInfo[] EnumProcesses()
{
    List<ProcessInfo> Result = new List<ProcessInfo>();
    Process[] ProcList = Process.GetProcesses();

    for (int i = 0; i < ProcList.Length; i++)
    {
        Process Proc = ProcList[i];

        try
        {
            ProcessInfo Info = new ProcessInfo();

            Info.FileName = Proc.MainModule.FileName;
            Info.Id = Proc.Id;
            Info.Is64Bit = RemoteHooking.IsX64Process(Proc.Id);
            Info.User = RemoteHooking.GetProcessIdentity(Proc.Id).Name;

            Result.Add(Info);
        }
        catch
        {
        }
    }

    return Result.ToArray();
}
```

--------------------------------

### NativeAPI.RtlInstallService Method

Source: https://easyhook.github.io/api/html/M_EasyHook_NativeAPI_RtlInstallService.htm

Installs a service using the specified service name, executable path, and channel name.

```APIDOC
## NativeAPI.RtlInstallService

### Description
Installs a service with the provided service name, executable path, and channel name.

### Signature
`public static void RtlInstallService(string InServiceName, string InExePath, string InChannelName)`

### Parameters
- **InServiceName** (String) - The name of the service to install.
- **InExePath** (String) - The file path to the executable for the service.
- **InChannelName** (String) - The name of the channel associated with the service.
```

--------------------------------

### RemoteHooking.WakeUpProcess Method

Source: https://easyhook.github.io/api/html/M_EasyHook_RemoteHooking_WakeUpProcess.htm

Starts the current process after it has been injected. This should be called in the library Run() method after all hooks are installed.

```APIDOC
## WakeUpProcess

### Description
Starts the current process after it has been injected via CreateAndInject. This method should be invoked within the library's Run() method once all necessary hooks have been installed.

### Signature
`public static void WakeUpProcess()`

### Namespace
EasyHook

### Assembly
EasyHook.dll (v2.7.6684.0)
```

--------------------------------

### Install and uninstall hooks

Source: https://easyhook.github.io/tutorials/nativehook.html

Manage the lifecycle of a hook using LhInstallHook, ACL configuration, and LhUninstallHook.

```cpp
HOOK_TRACE_INFO hHook = { NULL }; // keep track of our hook
NTSTATUS result = LhInstallHook(
    GetProcAddress(GetModuleHandle(TEXT("kernel32")), "Beep"), 
    myBeepHook, 
    NULL, 
    &hHook);
if (FAILED(result))
{
    // Hook could not be installed, see RtlGetLastErrorString() for details
    return;
}
// If the threadId in the ACL is set to 0, 
// then internally EasyHook uses GetCurrentThreadId()
ULONG ACLEntries[1] = { 0 };

// Enable the hook for the provided threadIds
LhSetInclusiveACL(ACLEntries, 1, &hHook);

...

// Remove the hook handler
LhUninstallHook(&hHook);

// This will restore all functions that have any 
// uninstalled hooks back to their original state.
LhWaitForPendingRemovals();
```

--------------------------------

### Initialize and Query COMClassInfo

Source: https://easyhook.github.io/api/html/T_EasyHook_COMClassInfo.htm

Demonstrates initializing COMClassInfo using types or GUIDs and querying function pointers.

```C#
// 1. Use imported Class and Interface Types
COMClassInfo cci1 = new COMClassInfo(typeof(CLSID_DirectInputDevice8), typeof(IID_IDirectInputDevice8W), "GetCapabilities");
// 2. Use Guid from class and interface types
COMClassInfo cci2 = new COMClassInfo(typeof(CLSID_DirectInputDevice8).GUID, typeof(IID_IDirectInputDevice8W).GUID, 3);
// 3. Use class and interface Guids directly (no need to have class and interface types defined)
COMClassInfo cci3 = new COMClassInfo(new Guid("25E609E5-B259-11CF-BFC7-444553540000"), new Guid("54D41081-DC15-4833-A41B-748F73A38179"), 3);

// Will output False if dinput8.dll is not already loaded
Console.WriteLine(cci1.IsModuleLoaded());
cci1.Query();
cci2.Query();
cci3.Query();
// Will output True as dinput8.dll will be loaded by .Query() if not already
Console.WriteLine(cci1.IsModuleLoaded());

// Output the function pointers we queried
Console.WriteLine(cci1.FunctionPointers[0]);
Console.WriteLine(cci2.FunctionPointers[0]);
Console.WriteLine(cci3.FunctionPointers[0]);

...

[ComVisible(true)]
[Guid("25E609E5-B259-11CF-BFC7-444553540000")]
public class CLSID_DirectInputDevice8
{
}

[ComVisible(true)]
[InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
[Guid("54D41081-DC15-4833-A41B-748F73A38179")]
public interface IID_IDirectInputDevice8W
{
    /*** IDirectInputDevice8W methods ***/
    int GetCapabilities(IntPtr deviceCaps); // fourth method due to IUnknown methods QueryInterface, AddRef and Release
    // other methods...
}
```

--------------------------------

### Config.Register Method

Source: https://easyhook.github.io/api/html/M_EasyHook_Config_Register.htm

Installs EasyHook and user assemblies into the GAC. Requires administrative privileges. Assemblies must have a strong name.

```APIDOC
## Config.Register

### Description
Installs EasyHook and all given user .NET assemblies into the GAC and ensures that all references are cleaned up if the installing application is shutdown. This method requires administrative privileges and ensures transactional GAC registration.

### Signature
`public static void Register(string InDescription, params string[] InUserAssemblies)`

### Parameters
- **InDescription** (String) - A description under which the installed files should be referenced.
- **InUserAssemblies** (String[]) - A list of user assemblies as relative or absolute paths.

### Exceptions
- **FileNotFoundException** - At least one of the files specified could not be found.
- **BadImageFormatException** - Unable to load at least one of the given files for reflection.
- **ArgumentException** - At least one of the given files does not have a strong name.
```

--------------------------------

### RhInstallDriver Method

Source: https://easyhook.github.io/api/html/M_EasyHook_NativeAPI_RhInstallDriver.htm

Installs the EasyHook driver using the specified path and name.

```APIDOC
## RhInstallDriver

### Description
Installs the EasyHook driver into the system.

### Signature
`public static void RhInstallDriver(string InDriverPath, string InDriverName)`

### Parameters
- **InDriverPath** (String) - The file system path to the driver file.
- **InDriverName** (String) - The name to assign to the installed driver.
```

--------------------------------

### InstallReferenceGuid.IsValidGuidScheme(Guid)

Source: https://easyhook.github.io/api/html/M_System_GACManagedAccess_InstallReferenceGuid_IsValidGuidScheme.htm

Validates if the provided Guid is one of the valid reference guids (UninstallSubkeyGuid, FilePathGuid, OpaqueGuid, or Empty).

```APIDOC
## Method: IsValidGuidScheme

### Description
Ensures that the provided Guid is one of the valid reference guids defined in InstallReferenceGuid (excluding MsiGuid and OsInstallGuid).

### Signature
`public static bool IsValidGuidScheme(Guid guid)`

### Parameters
- **guid** (System.Guid) - The Guid to validate.

### Return Value
- **Boolean** - Returns true if the Guid is UninstallSubkeyGuid, FilePathGuid, OpaqueGuid, or Empty.
```

--------------------------------

### LhInstallHook Method

Source: https://easyhook.github.io/api/html/M_EasyHook_NativeAPI_LhInstallHook.htm

Installs a hook at the specified entry point using the provided hook procedure and callback.

```APIDOC
## LhInstallHook

### Description
Installs a hook at a specified entry point. This method allows developers to redirect execution to a custom hook procedure.

### Signature
`public static void LhInstallHook(IntPtr InEntryPoint, IntPtr InHookProc, IntPtr InCallback, IntPtr OutHandle)`

### Parameters
- **InEntryPoint** (IntPtr) - The address of the function to be hooked.
- **InHookProc** (IntPtr) - The address of the hook procedure.
- **InCallback** (IntPtr) - The address of the callback function.
- **OutHandle** (IntPtr) - A pointer to a handle that will receive the hook handle.
```

--------------------------------

### LocalHook.Create Method

Source: https://easyhook.github.io/api/html/M_EasyHook_LocalHook_Create.htm

Installs a managed hook. After this you'll have to activate it by setting a proper ThreadACL.

```APIDOC
## LocalHook.Create

### Description
Installs a managed hook. After this you'll have to activate it by setting a proper ThreadACL.

### Signature
`public static LocalHook Create(IntPtr InTargetProc, Delegate InNewProc, Object InCallback)`

### Parameters
- **InTargetProc** (IntPtr) - A target entry point that should be hooked.
- **InNewProc** (Delegate) - A handler with the same signature as the original entry point that will be invoked for every call.
- **InCallback** (Object) - An uninterpreted callback that will later be available through Callback.

### Return Value
- **LocalHook** - A handle to the newly created hook.

### Exceptions
- **OutOfMemoryException** - Not enough memory available to complete the operation.
- **ArgumentException** - The given function pointer does not map to executable memory or null was passed as a delegate.
- **NotSupportedException** - The given entry point contains machine code that can not be hooked.
- **InsufficientMemoryException** - The maximum amount of hooks (1024) has been installed.
```

--------------------------------

### RtlInstallService Method Signatures

Source: https://easyhook.github.io/api/html/M_EasyHook_NativeAPI_RtlInstallService.htm

Method signatures for installing a service across different .NET languages.

```C#
public static void RtlInstallService(
	string InServiceName,
	string InExePath,
	string InChannelName
)
```

```VB
Public Shared Sub RtlInstallService ( 
	InServiceName As String,
	InExePath As String,
	InChannelName As String
)
```

```C++
public:
static void RtlInstallService(
	String^ InServiceName, 
	String^ InExePath, 
	String^ InChannelName
)
```

```F#
static member RtlInstallService : 
        InServiceName : string * 
        InExePath : string * 
        InChannelName : string -> unit 
```

--------------------------------

### InstallReference.Identifier Property

Source: https://easyhook.github.io/api/html/P_System_GACManagedAccess_InstallReference_Identifier.htm

A unique string that identifies the application that installed the assembly.

```APIDOC
## Property: Identifier

### Description
A unique string that identifies the application that installed the assembly.

### Signature
`public string Identifier { get; }`

### Property Value
- **Type**: String
```

--------------------------------

### RhInstallSupportDriver Method

Source: https://easyhook.github.io/api/html/M_EasyHook_NativeAPI_RhInstallSupportDriver.htm

Installs the EasyHook support driver required for library functionality.

```APIDOC
## RhInstallSupportDriver

### Description
Installs the EasyHook support driver. This method is part of the NativeAPI class and is used to ensure the driver environment is correctly set up for hooking.

### Signature
`public static void RhInstallSupportDriver()`

### Namespace
EasyHook

### Assembly
EasyHook.dll
```

--------------------------------

### InstallDriver Method Signatures

Source: https://easyhook.github.io/api/html/M_EasyHook_RemoteHooking_InstallDriver.htm

Method signatures for installing a driver across different .NET languages.

```C#
public static void InstallDriver(
	string InDriverPath,
	string InDriverName
)
```

```VB
Public Shared Sub InstallDriver ( 
	InDriverPath As String, 
	InDriverName As String
)
```

```C++
public:
static void InstallDriver(
	String^ InDriverPath, 
	String^ InDriverName
)
```

```F#
static member InstallDriver : 
        InDriverPath : string * 
        InDriverName : string -> unit 
```

--------------------------------

### RemoteHooking.InstallSupportDriver()

Source: https://easyhook.github.io/api/html/M_EasyHook_RemoteHooking_InstallSupportDriver.htm

Installs the EasyHook support driver. This must be called before using InstallDriver to install a kernel mode hooking component.

```APIDOC
## RemoteHooking.InstallSupportDriver()

### Description
Installs the EasyHook support driver. After this step you may use InstallDriver(String, String) to install your kernel mode hooking component.

### Signature
`public static void InstallSupportDriver()`

### Namespace
EasyHook

### Assembly
EasyHook.dll (v2.7.6684.0)
```

--------------------------------

### InstallReference.Description Property

Source: https://easyhook.github.io/api/html/P_System_GACManagedAccess_InstallReference_Description.htm

Gets a string that is only understood by the entity that adds the reference. The GAC only stores this string.

```APIDOC
## InstallReference.Description Property

### Description
A string that is only understood by the entity that adds the reference. The GAC only stores this string.

### Property Signature
`public string Description { get; }`

### Property Value
- **Type**: String
```

--------------------------------

### InstallSupportDriver Method Signatures

Source: https://easyhook.github.io/api/html/M_EasyHook_RemoteHooking_InstallSupportDriver.htm

Method signatures for installing the EasyHook support driver across supported .NET languages.

```csharp
public static void InstallSupportDriver()
```

```vb
Public Shared Sub InstallSupportDriver
```

```cpp
public:
static void InstallSupportDriver()
```

```fsharp
static member InstallSupportDriver : unit -> unit 
```

--------------------------------

### COMClassInfo(Guid, Guid, Int32[])

Source: https://easyhook.github.io/api/html/M_EasyHook_COMClassInfo__ctor.htm

Creates a new COMClassInfo instance using the COM class and interface Guids. The function indexes to retrieve the addresses for as defined by the order of the methods in the COM interface.

```APIDOC
## COMClassInfo(Guid, Guid, Int32[])

### Description
Creates a new COMClassInfo instance using the COM class and interface Guids. The function indexes to retrieve the addresses for as defined by the order of the methods in the COM interface.

### Parameters
- **clsid** (System.Guid) - The class id (CLSID) of the COM object
- **iid** (System.Guid) - The interface id (IID) of the COM interface. This interface MUST inherit from IUnknown.
- **vTableIndexes** (System.Int32[]) - One or more method indexes to retrieve the address for. Index 0 == QueryInterface, 1 == AddRef, 2 == Release, 3 == first method and so on, i.e. the order that the methods appear in the interface's C++ header file.
```

--------------------------------

### COMClassInfo Constructor (Guid)

Source: https://easyhook.github.io/api/html/T_EasyHook_COMClassInfo.htm

Creates a new COMClassInfo instance using the COM class and interface Guids. The function indexes to retrieve the addresses are defined by the order of the methods in the COM interface.

```APIDOC
## COMClassInfo(Guid, Guid, Int32[])

### Description
Initializes a new instance of the COMClassInfo class using class and interface GUIDs.

### Parameters
- **classGuid** (Guid) - The GUID of the COM class.
- **interfaceGuid** (Guid) - The GUID of the COM interface.
- **indexes** (Int32[]) - An array of method indexes to retrieve addresses for.
```

--------------------------------

### InstallAssembly Method Signatures

Source: https://easyhook.github.io/api/html/M_System_GACManagedAccess_AssemblyCache_InstallAssembly.htm

Method signatures for installing an assembly into the GAC across multiple .NET languages.

```C#
public static void InstallAssembly(
	string assemblyPath,
	InstallReference reference,
	AssemblyCommitFlags flags
)
```

```VB
Public Shared Sub InstallAssembly ( 
	assemblyPath As String,
	reference As InstallReference,
	flags As AssemblyCommitFlags
)
```

```C++
public:
static void InstallAssembly(
	String^ assemblyPath, 
	InstallReference^ reference, 
	AssemblyCommitFlags flags
)
```

```F#
static member InstallAssembly : 
        assemblyPath : string * 
        reference : InstallReference * 
        flags : AssemblyCommitFlags -> unit 
```

--------------------------------

### WakeUpProcess Method

Source: https://easyhook.github.io/api/html/Methods_T_EasyHook_RemoteHooking.htm

Resumes a process that was started in a suspended state via CreateAndInject.

```APIDOC
## WakeUpProcess

### Description
If the library was injected with CreateAndInject, this will finally start the current process. You should call this method in the library Run() method after all hooks have been installed.
```

--------------------------------

### Config.HelperLibraryLocation Property

Source: https://easyhook.github.io/api/html/P_EasyHook_Config_HelperLibraryLocation.htm

Gets or sets the path where helper files are stored.

```APIDOC
## Property: EasyHook.Config.HelperLibraryLocation

### Description
Gets or sets the path where helper files, such as EasyHook32.dll and EasyHook64.dll, are stored. This property defaults to the location of the assembly containing the Config type.

### Signature
`public static string HelperLibraryLocation { get; set; }`

### Property Value
- **Type**: String

### Namespace
EasyHook
```

--------------------------------

### GetNextReference Method Signatures

Source: https://easyhook.github.io/api/html/M_System_GACManagedAccess_AssemblyCacheInstallReferenceEnum_GetNextReference.htm

Method signatures for retrieving the next installation reference across supported .NET languages.

```C#
public InstallReference GetNextReference()
```

```VB
Public Function GetNextReference As InstallReference
```

```C++
public:
InstallReference^ GetNextReference()
```

```F#
member GetNextReference : unit -> InstallReference 
```

--------------------------------

### InstallAssemblies Method Signatures

Source: https://easyhook.github.io/api/html/M_System_GACManagedAccess_AssemblyCache_InstallAssemblies.htm

Method signatures for installing assemblies into the GAC across multiple .NET languages.

```C#
public static void InstallAssemblies(
	string[] assemblyPaths,
	InstallReference reference,
	AssemblyCommitFlags flags
)
```

```VB
Public Shared Sub InstallAssemblies ( 
	assemblyPaths As String(),
	reference As InstallReference,
	flags As AssemblyCommitFlags
)
```

```C++
public:
static void InstallAssemblies(
	array<String^>^ assemblyPaths, 
	InstallReference^ reference, 
	AssemblyCommitFlags flags
)
```

```F#
static member InstallAssemblies : 
        assemblyPaths : string[] * 
        reference : InstallReference * 
        flags : AssemblyCommitFlags -> unit 
```

--------------------------------

### CreateAndInject Method

Source: https://easyhook.github.io/api/html/Methods_T_EasyHook_RemoteHooking.htm

Creates a new process and starts it in a suspended state, allowing for library injection before the target process executes its own code.

```APIDOC
## CreateAndInject

### Description
Creates a new process which is started suspended until you call WakeUpProcess() from within your injected library Run() method. This allows you to hook the target BEFORE any of its usual code is executed.
```

--------------------------------

### AssemblyCache.InstallAssemblies(string[], InstallReference, AssemblyCommitFlags)

Source: https://easyhook.github.io/api/html/M_System_GACManagedAccess_AssemblyCache_InstallAssemblies.htm

Installs the provided assemblies to the GAC using the specified reference and commit flags.

```APIDOC
## AssemblyCache.InstallAssemblies

### Description
Installs the provided assemblies to the Global Assembly Cache (GAC).

### Signature
`public static void InstallAssemblies(string[] assemblyPaths, InstallReference reference, AssemblyCommitFlags flags)`

### Parameters
- **assemblyPaths** (System.String[]) - The array of file paths to the assemblies to be installed.
- **reference** (System.GACManagedAccess.InstallReference) - The installation reference for the assemblies.
- **flags** (System.GACManagedAccess.AssemblyCommitFlags) - The commit flags to control the installation process.
```

--------------------------------

### Implement Native Injection Entry Point and Hook

Source: https://easyhook.github.io/tutorials/nativeremotehook.html

Defines the DLL entry point required by EasyHook and installs a hook on the Beep function while excluding the injector thread.

```cpp
#include <easyhook.h>
#include <string>
#include <iostream>
#include <Windows.h>

DWORD gFreqOffset = 0;
BOOL WINAPI myBeepHook(DWORD dwFreq, DWORD dwDuration)
{
	std::cout << "\n    BeepHook: ****All your beeps belong to us!\n\n";
	return Beep(dwFreq + gFreqOffset, dwDuration);
}

// EasyHook will be looking for this export to support DLL injection. If not found then 
// DLL injection will fail.
extern "C" void __declspec(dllexport) __stdcall NativeInjectionEntryPoint(REMOTE_ENTRY_INFO* inRemoteInfo);

void __stdcall NativeInjectionEntryPoint(REMOTE_ENTRY_INFO* inRemoteInfo)
{
	std::cout << "\n\nNativeInjectionEntryPointt(REMOTE_ENTRY_INFO* inRemoteInfo)\n\n" <<
		"IIIII           jjj               tt                dd !!! \n" 
		" III  nn nnn          eee    cccc tt      eee       dd !!! \n" 
		" III  nnn  nn   jjj ee   e cc     tttt  ee   e  dddddd !!! \n" 
		" III  nn   nn   jjj eeeee  cc     tt    eeeee  dd   dd     \n" 
		"IIIII nn   nn   jjj  eeeee  ccccc  tttt  eeeee  dddddd !!! \n" 
		"              jjjj                                         \n\n";

	std::cout << "Injected by process Id: " << inRemoteInfo->HostPID << "\n";
	std::cout << "Passed in data size: " << inRemoteInfo->UserDataSize << "\n";
	if (inRemoteInfo->UserDataSize == sizeof(DWORD))
	{
		gFreqOffset = *reinterpret_cast<DWORD *>(inRemoteInfo->UserData);
		std::cout << "Adjusting Beep frequency by: " << gFreqOffset << "\n";
	}

	// Perform hooking
	HOOK_TRACE_INFO hHook = { NULL }; // keep track of our hook

	std::cout << "\n";
	std::cout << "Win32 Beep found at address: " << GetProcAddress(GetModuleHandle(TEXT("kernel32")), "Beep") << "\n";

	// Install the hook
	NTSTATUS result = LhInstallHook(
		GetProcAddress(GetModuleHandle(TEXT("kernel32")), "Beep"),
		myBeepHook,
		NULL,
		&hHook);
	if (FAILED(result))
	{
		std::wstring s(RtlGetLastErrorString());
		std::wcout << "Failed to install hook: ";
		std::wcout << s;
	}
	else 
	{
		std::cout << "Hook 'myBeepHook installed successfully.";
	}

	// If the threadId in the ACL is set to 0,
	// then internally EasyHook uses GetCurrentThreadId()
	ULONG ACLEntries[1] = { 0 };

	// Disable the hook for the provided threadIds, enable for all others
	LhSetExclusiveACL(ACLEntries, 1, &hHook);

	return;
}
```

--------------------------------

### AssemblyCacheInstallReferenceEnum.GetNextReference()

Source: https://easyhook.github.io/api/html/M_System_GACManagedAccess_AssemblyCacheInstallReferenceEnum_GetNextReference.htm

Retrieves the next reference from the assembly cache install reference enumeration.

```APIDOC
## GetNextReference()

### Description
Retrieves the next reference from the AssemblyCacheInstallReferenceEnum.

### Syntax
`public InstallReference GetNextReference()`

### Return Value
- **Type**: InstallReference
- **Description**: The next reference in the enumeration.
```

--------------------------------

### NativeAPI.GacInstallAssemblies(string[] InAssemblyPaths, string InDescription, string InUniqueID)

Source: https://easyhook.github.io/api/html/M_EasyHook_NativeAPI_GacInstallAssemblies.htm

Installs a set of assemblies into the Global Assembly Cache.

```APIDOC
## NativeAPI.GacInstallAssemblies

### Description
Installs the specified assemblies into the Global Assembly Cache (GAC).

### Signature
`public static void GacInstallAssemblies(string[] InAssemblyPaths, string InDescription, string InUniqueID)`

### Parameters
- **InAssemblyPaths** (String[]) - The array of file paths to the assemblies to be installed.
- **InDescription** (String) - A description associated with the installation.
- **InUniqueID** (String) - A unique identifier for the installation process.
```

--------------------------------

### InstallReference Class

Source: https://easyhook.github.io/api/html/T_System_GACManagedAccess_InstallReference.htm

The InstallReference class represents a reference made when an application installs an assembly in the GAC.

```APIDOC
## InstallReference Class

### Description
The InstallReference class represents a reference that is made when an application has installed an assembly in the GAC.

### Properties
- **Description** (string) - A string that is only understood by the entity that adds the reference. The GAC only stores this string.
- **GuidScheme** (Guid) - The entity that adds the reference.
- **Identifier** (string) - A unique string that identifies the application that installed the assembly.
```

--------------------------------

### AssemblyCache.InstallAssembly(String, InstallReference, AssemblyCommitFlags)

Source: https://easyhook.github.io/api/html/M_System_GACManagedAccess_AssemblyCache_InstallAssembly.htm

Installs a specified assembly into the Global Assembly Cache (GAC) using the provided path, reference, and commit flags.

```APIDOC
## InstallAssembly

### Description
Installs an assembly into the Global Assembly Cache (GAC).

### Signature
`public static void InstallAssembly(string assemblyPath, InstallReference reference, AssemblyCommitFlags flags)`

### Parameters
- **assemblyPath** (String) - The file system path to the assembly to be installed.
- **reference** (InstallReference) - The reference information for the assembly installation.
- **flags** (AssemblyCommitFlags) - The flags that define how the assembly is committed to the GAC.
```

--------------------------------

### RhInstallDriver Method Signatures

Source: https://easyhook.github.io/api/html/M_EasyHook_NativeAPI_RhInstallDriver.htm

Method signatures for installing the EasyHook driver across supported .NET languages.

```C#
public static void RhInstallDriver(
	string InDriverPath,
	string InDriverName
)
```

```VB
Public Shared Sub RhInstallDriver ( 
	InDriverPath As String,
	InDriverName As String
)
```

```C++
public:
static void RhInstallDriver(
	String^ InDriverPath, 
	String^ InDriverName
)
```

```F#
static member RhInstallDriver : 
        InDriverPath : string * 
        InDriverName : string -> unit 
```

--------------------------------

### LocalHook.Create Method Signatures

Source: https://easyhook.github.io/api/html/M_EasyHook_LocalHook_Create.htm

Method signatures for installing a managed hook across different .NET languages.

```C#
public static LocalHook Create(
	IntPtr InTargetProc,
	Delegate InNewProc,
	Object InCallback
)
```

```VB
Public Shared Function Create ( 
	InTargetProc As IntPtr,
	InNewProc As Delegate,
	InCallback As Object
) As LocalHook
```

```C++
public:
static LocalHook^ Create(
	IntPtr InTargetProc, 
	Delegate^ InNewProc, 
	Object^ InCallback
)
```

```F#
static member Create : 
        InTargetProc : IntPtr * 
        InNewProc : Delegate * 
        InCallback : Object -> LocalHook 
```

--------------------------------

### Implement InjectionEntryPoint class

Source: https://easyhook.github.io/tutorials/remotefilemonitor.html

Defines the entry point for the injected payload, including IPC connection setup via the constructor.

```csharp
/// <summary>
/// EasyHook will look for a class implementing <see cref="EasyHook.IEntryPoint"/> during injection. This
/// becomes the entry point within the target process after injection is complete.
/// </summary>
public class InjectionEntryPoint: EasyHook.IEntryPoint
{
    /// <summary>
    /// Reference to the server interface within FileMonitor
    /// </summary>
    ServerInterface _server = null;

    /// <summary>
    /// Message queue of all files accessed
    /// </summary>
    Queue<string> _messageQueue = new Queue<string>();

    /// <summary>
    /// EasyHook requires a constructor that matches <paramref name="context"/> and any additional parameters as provided
    /// in the original call to <see cref="EasyHook.RemoteHooking.Inject(int, EasyHook.InjectionOptions, string, string, object[])"/>.
    /// 
    /// Multiple constructors can exist on the same <see cref="EasyHook.IEntryPoint"/>, providing that each one has a corresponding Run method (e.g. <see cref="Run(EasyHook.RemoteHooking.IContext, string)"/>).
    /// </summary>
    /// <param name="context">The RemoteHooking context</param>
    /// <param name="channelName">The name of the IPC channel</param>
    public InjectionEntryPoint(
        EasyHook.RemoteHooking.IContext context,
        string channelName)
    {
        // Connect to server object using provided channel name
        _server = EasyHook.RemoteHooking.IpcConnectClient<ServerInterface>(channelName);
```

--------------------------------

### Visual Studio Memory Leak Report

Source: https://easyhook.github.io/tutorials/remotefilemonitor.html

Example output from Visual Studio's memory leak detection tool.

```text
Detected memory leaks!
Dumping objects ->
{82} normal block at 0x0341C9D0, 16384 bytes long.
 Data: <                > 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00   
{75} normal block at 0x039F22E8, 16384 bytes long.
 Data: <                > 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00   
{70} normal block at 0x03916C60, 16384 bytes long.
 Data: <                > 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00   
{69} normal block at 0x038DE0B8, 16384 bytes long.
 Data: <                > 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00   
{68} normal block at 0x038CA048, 16384 bytes long.
 Data: <                > 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00   
{64} normal block at 0x034650E0, 16384 bytes long.
 Data: <                > 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00   
{62} normal block at 0x034462C0, 16384 bytes long.
 Data: <                > 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00   
{57} normal block at 0x00349FF0, 16384 bytes long.
 Data: <                > 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00   
{55} normal block at 0x00359BB8, 4096 bytes long.
 Data: <           w    > 00 00 00 00 FD 02 00 00 B4 00 1A 77 00 00 00 00   
Object dump complete.
```

--------------------------------

### GacInstallAssemblies Method Signatures

Source: https://easyhook.github.io/api/html/M_EasyHook_NativeAPI_GacInstallAssemblies.htm

Method signatures for installing assemblies into the GAC across different .NET languages.

```C#
public static void GacInstallAssemblies(
	string[] InAssemblyPaths,
	string InDescription,
	string InUniqueID
)
```

```VB
Public Shared Sub GacInstallAssemblies ( 
	InAssemblyPaths As String(),
	InDescription As String,
	InUniqueID As String
)
```

```C++
public:
static void GacInstallAssemblies(
	array<String^>^ InAssemblyPaths, 
	String^ InDescription, 
	String^ InUniqueID
)
```

```F#
static member GacInstallAssemblies : 
        InAssemblyPaths : string[] * 
        InDescription : string * 
        InUniqueID : string -> unit 
```

--------------------------------

### CreateUnmanaged Method Signatures

Source: https://easyhook.github.io/api/html/M_EasyHook_LocalHook_CreateUnmanaged.htm

Method signatures for installing an unmanaged hook across different .NET languages.

```C#
public static LocalHook CreateUnmanaged(
	IntPtr InTargetProc,
	IntPtr InNewProc,
	IntPtr InCallback
)
```

```VB
Public Shared Function CreateUnmanaged ( 
	InTargetProc As IntPtr,
	InNewProc As IntPtr,
	InCallback As IntPtr
) As LocalHook
```

```C++
public:
static LocalHook^ CreateUnmanaged(
	IntPtr InTargetProc, 
	IntPtr InNewProc, 
	IntPtr InCallback
)
```

```F#
static member CreateUnmanaged : 
        InTargetProc : IntPtr * 
        InNewProc : IntPtr * 
        InCallback : IntPtr -> LocalHook 
```

--------------------------------

### InstallReferenceGuid.MsiGuid Field

Source: https://easyhook.github.io/api/html/F_System_GACManagedAccess_InstallReferenceGuid_MsiGuid.htm

The MsiGuid field is a static readonly Guid used to identify assembly references installed by the Windows Installer. This scheme is reserved for use by the Windows Installer itself.

```APIDOC
## Field: MsiGuid

### Description
Represents the FUSION_REFCOUNT_MSI_GUID. This GUID indicates that the assembly is referenced by an application installed via Windows Installer. The szIdentifier field is set to 'MSI' and szNonCannonicalData is set to 'Windows Installer'. This scheme must only be used by Windows Installer itself and cannot be used for manual installation into the GAC.

### Namespace
System.GACManagedAccess

### Assembly
EasyHook.dll (Version 2.7.6684.0)

### Field Value
Type: System.Guid

### Syntax
C#: public static readonly Guid MsiGuid
VB: Public Shared ReadOnly MsiGuid As Guid
C++: public: static initonly Guid MsiGuid
F#: static val MsiGuid: Guid
```

--------------------------------

### LocalHook.CreateUnmanaged Method

Source: https://easyhook.github.io/api/html/M_EasyHook_LocalHook_CreateUnmanaged.htm

Installs an unmanaged hook. After this you'll have to activate it by setting a proper ThreadACL. HookRuntimeInfo is not supported for unmanaged hooks.

```APIDOC
## LocalHook.CreateUnmanaged

### Description
Installs an unmanaged hook. After this you'll have to activate it by setting a proper ThreadACL. HookRuntimeInfo is not supported for unmanaged hooks.

### Signature
`public static LocalHook CreateUnmanaged(IntPtr InTargetProc, IntPtr InNewProc, IntPtr InCallback)`

### Parameters
- **InTargetProc** (System.IntPtr) - A target entry point that should be hooked.
- **InNewProc** (System.IntPtr) - A handler with the same signature as the original entry point that will be invoked for every call that has passed the Thread Deadlock Barrier and various integrity checks.
- **InCallback** (System.IntPtr) - An uninterpreted callback that will later be available through LhBarrierGetCallback().

### Return Value
- **LocalHook** - A handle to the newly created hook.

### Exceptions
- **OutOfMemoryException** - Not enough memory available to complete the operation.
- **ArgumentException** - The given function pointer does not map to executable memory or null was passed as a delegate.
- **NotSupportedException** - The given entry point contains machine code that cannot be hooked.
- **InsufficientMemoryException** - The maximum amount of hooks (1024) has been installed.
```

--------------------------------

### RemoteHooking.InstallDriver Method

Source: https://easyhook.github.io/api/html/M_EasyHook_RemoteHooking_InstallDriver.htm

Loads the given driver into the kernel and immediately marks it for deletion. The installed driver will be registered with the service control manager under the specified name.

```APIDOC
## RemoteHooking.InstallDriver Method

### Description
Loads the given driver into the kernel and immediately marks it for deletion. The installed driver will be registered with the service control manager under the InDriverName you specify.

### Signature
`public static void InstallDriver(string InDriverPath, string InDriverName)`

### Parameters
- **InDriverPath** (System.String) - The file path to the driver to be loaded.
- **InDriverName** (System.String) - The name under which the driver will be registered with the service control manager.

### Remarks
It is recommended to use IsX64System to determine which driver to load, as the OS kernel architecture may differ from the process architecture.
```

--------------------------------

### Initialize InstallReferenceGuid

Source: https://easyhook.github.io/api/html/M_System_GACManagedAccess_InstallReferenceGuid__ctor.htm

Constructs a new instance of the InstallReferenceGuid class across supported languages.

```C#
public InstallReferenceGuid()
```

```VB
Public Sub New
```

```C++
public:
InstallReferenceGuid()
```

```F#
new : unit -> InstallReferenceGuid
```

--------------------------------

### RemoteHooking.CreateAndInject(String, String, Int32, InjectionOptions, String, String, Int32, Object[])

Source: https://easyhook.github.io/api/html/Overload_EasyHook_RemoteHooking_CreateAndInject.htm

Creates a new process started in a suspended state with specific injection options, allowing for library injection before the target process executes its code.

```APIDOC
## RemoteHooking.CreateAndInject(String, String, Int32, InjectionOptions, String, String, Int32, Object[])

### Description
Creates a new process which is started suspended until you call WakeUpProcess() from within your injected library Run() method. This allows you to hook the target BEFORE any of its usual code is executed, utilizing specified InjectionOptions.
```

--------------------------------

### Implement FileMonitor Console Application

Source: https://easyhook.github.io/tutorials/remotefilemonitor.html

This snippet demonstrates setting up an IPC server and performing process injection using EasyHook. It handles both attaching to an existing process and spawning a new one.

```csharp
class Program
{
    static void Main(string[] args)
    {
        Int32 targetPID = 0;
        string targetExe = null;

        // Will contain the name of the IPC server channel
        string channelName = null;

        // Process command line arguments or print instructions and retrieve argument value
        ProcessArgs(args, out targetPID, out targetExe);

        if (targetPID <= 0 && string.IsNullOrEmpty(targetExe))
            return;

        // Create the IPC server using the FileMonitorIPC.ServiceInterface class as a singleton
        EasyHook.RemoteHooking.IpcCreateServer<FileMonitorHook.ServerInterface>(ref channelName, System.Runtime.Remoting.WellKnownObjectMode.Singleton);

        // Get the full path to the assembly we want to inject into the target process
        string injectionLibrary = Path.Combine(Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location), "FileMonitorHook.dll");

        try
        {
            // Injecting into existing process by Id
            if (targetPID > 0)
            {
                Console.WriteLine("Attempting to inject into process {0}", targetPID);

                // inject into existing process
                EasyHook.RemoteHooking.Inject(
                    targetPID,          // ID of process to inject into
                    injectionLibrary,   // 32-bit library to inject (if target is 32-bit)
                    injectionLibrary,   // 64-bit library to inject (if target is 64-bit)
                    channelName         // the parameters to pass into injected library
                                        // ...
                );
            }
            // Create a new process and then inject into it
            else if (!string.IsNullOrEmpty(targetExe))
            {
                Console.WriteLine("Attempting to create and inject into {0}", targetExe);
                // start and inject into a new process
                EasyHook.RemoteHooking.CreateAndInject(
                    targetExe,          // executable to run
                    "",                 // command line arguments for target
                    0,                  // additional process creation flags to pass to CreateProcess
                    EasyHook.InjectionOptions.DoNotRequireStrongName, // allow injectionLibrary to be unsigned
                    injectionLibrary,   // 32-bit library to inject (if target is 32-bit)
                    injectionLibrary,   // 64-bit library to inject (if target is 64-bit)
                    out targetPID,      // retrieve the newly created process ID
                    channelName         // the parameters to pass into injected library
                                        // ...
                );
            }
        }
        catch (Exception e)
        {
            Console.ForegroundColor = ConsoleColor.Red;
            Console.WriteLine("There was an error while injecting into target:");
            Console.ResetColor();
            Console.WriteLine(e.ToString());
        }

        Console.ForegroundColor = ConsoleColor.DarkGreen;
        Console.WriteLine("<Press any key to exit>");
        Console.ResetColor();
        Console.ReadKey();
    }

    static void ProcessArgs(string[] args, out int targetPID, out string targetExe)
    {
        targetPID = 0;
        targetExe = null;

        // Load any parameters
        while ((args.Length != 1) || !Int32.TryParse(args[0], out targetPID) || !File.Exists(args[0]))
        {
            if (targetPID > 0)
            {
                break;
            }
            if (args.Length != 1 || !File.Exists(args[0]))
            {
                Console.WriteLine("Usage: FileMonitor ProcessID");
                Console.WriteLine("   or: FileMonitor PathToExecutable");
                Console.WriteLine("");
                Console.WriteLine("e.g. : FileMonitor 1234");
                Console.WriteLine("          to monitor an existing process with PID 1234");
                Console.WriteLine(@"  or : FileMonitor ""C:\Windows\Notepad.exe""");
                Console.WriteLine("          create new notepad.exe process using RemoteHooking.CreateAndInject");
                Console.WriteLine();
                Console.WriteLine("Enter a process Id or path to executable");
                Console.Write("> ");

                args = new string[] { Console.ReadLine() };

                if (String.IsNullOrEmpty(args[0])) return;
            }
            else
            {
                targetExe = args[0];
                break;
            }
        }
    }
}
```

--------------------------------

### IsValidGuidScheme Method

Source: https://easyhook.github.io/api/html/Methods_T_System_GACManagedAccess_InstallReferenceGuid.htm

Ensures that the provided Guid is one of the valid reference guids defined in InstallReferenceGuid (excluding MsiGuid and OsInstallGuid).

```APIDOC
## IsValidGuidScheme

### Description
Ensures that the provided Guid is one of the valid reference guids defined in InstallReferenceGuid (excluding MsiGuid and OsInstallGuid).
```

--------------------------------

### RemoteHooking.CreateAndInject(String, String, Int32, String, String, Int32, Object[])

Source: https://easyhook.github.io/api/html/M_EasyHook_RemoteHooking_CreateAndInject_1.htm

Creates a new process which is started suspended until WakeUpProcess() is called from within the injected library's Run() method.

```APIDOC
## RemoteHooking.CreateAndInject

### Description
Creates a new process which is started suspended until you call WakeUpProcess() from within your injected library Run() method. This allows you to hook the target BEFORE any of its usual code is executed.

### Method Signature
`public static void CreateAndInject(string InEXEPath, string InCommandLine, int InProcessCreationFlags, string InLibraryPath_x86, string InLibraryPath_x64, out int OutProcessId, params Object[] InPassThruArgs)`

### Parameters
- **InEXEPath** (String) - A relative or absolute path to the desired executable.
- **InCommandLine** (String) - Optional command line parameters for process creation.
- **InProcessCreationFlags** (Int32) - Additional flags for process creation (e.g., DETACHED_PROCESS, CREATE_NEW_CONSOLE).
- **InLibraryPath_x86** (String) - A partially qualified assembly name or file path of the 32-bit version of your library.
- **InLibraryPath_x64** (String) - A partially qualified assembly name or file path of the 64-bit version of your library.
- **OutProcessId** (Int32) - The process ID of the newly created process.
- **InPassThruArgs** (Object[]) - A serializable list of parameters being passed to your library entry points Run() and constructor.

### Exceptions
- **ArgumentException** - The given EXE path could not be found.
```
Tokens:
Raw