Question: Setting "target" to an address

[DizzyThermal]

Hello!

target is either the address to hook or a ctypes function object for the function to hook.

How can I set the target value to a raw pointer address (i.e., 0x76845640)?

Does it have to be a special type, or is this okay?:

class GetAsyncKeyState(cyminhook.MinHook):
    signature = ctypes.WINFUNCTYPE(
        ctypes.c_short,
        ctypes.c_int,
        use_last_error=True,
    )

    target = 0x76845640

    def detour(self, vKey):
        print('GetAsyncKeyState :: OVERRIDE')
        return ctypes.c_short(1)

When I send a key to a C++ application's window via Python, GetAsyncKeyState is being called by the application. I want to set the target to the offset in the C++ application itself pointing to user32.dll + <offset to GetAsyncKeyState> - which I believe to be 0x76845640

Context: When I press 'u', the application discards my ControlSend / PostMessage calls - only SendInput works w/ focus. I believe this is because the application is checking GetAsyncKeyState of the 'u' key press. So I am trying this:

with GetAsyncKeyState() as hook:
    hook.enable()
    self.send_keys('u')
    hook.disable()

Should this work, or is there something I'm doing wrong here?

Thanks!

[segevfiner]

target can indeed just be a Python int pointer, when you pass a ctypes function object, it just casts it into the raw pointer. Note that minhook is built around inline assembly hooks, meaning it needs to be some code address, often the start of a function, if it's a function pointer (data) you are trying to hook, then you can just hook it to a ctypes function directly by getting the appropriate address and writing it yourself. Or just hook GetAsyncKeyState itself in user32.dll, assuming the program isn't doing anything weird, that should hook all calls to GetAsyncKeyState in the process. You can do that by just getting
the GetAsyncKeyState from ctypes and using that as the target.

Also note that this creates a hook in the current process only, to hook another process you will have to inject Python to it, or inject your own DLL with minhook yourself.

P.S. You can always use windbg to take a look at the resulting hook to see if it does what you think it should do.