github.com/stavinski/winhook (go): Hooking library for windows, can be used to divert calls made to functions in executables/DLLs at runtime  To use you must know the address to hook and also the signature of the function.  A C function should then be declared with the matching sigature, for example:  extern HANDLE goPayloadFunc(DWORD, HANDLE);  HANDLE HookSetClipboard(DWORD uFormat, HANDLE hMem)  The goPayloadFunc should be an exported Go func:  //export goPayloadFunc  The trampoline should be a declared C pointer that also matches the signature of the hooked function:  typedef HANDLE SETCLIPBOARDDATA(DWORD, HANDLE);  SETCLIPBOARDDATA *trampoline = NULL;  When the call to InstallHook is made the returned uintptr should then be casted back to the trampoline variable:  trampolineFunc, err := winhook.InstallHook64(hookAddr, uintptr(C.HookSetClipboard), 5) // handle err  C.trampoline = (*C.SETCLIPBOARDDATA)(unsafe.Pointer(trampolineFunc))
Keywords: cybersecurity|forensics-investigations|forensics-tools|go|golang|hacking|hooking|hooks-library|infosec|malware-development|windows|x64