ApiHooks 3.1: AHexe.txt

 ApiHooks.exe calls ApiHooks functions with 20 sec. limit. It this
interval expires, "Time out!" message box is displayed.
 ApiHooks.exe returns error codes (see HDK\DOC\APIs.txt) which
you can check via GetProcessExitCode or in batch file via
ERRORLEVEL variable (in NT).

ApiHooks.exe command line:

ApiHooks <-><n|o|l|m|u>[q|r] [PathTo\]<Module> [PathTo\]<TargetName|TargetPID|ALL> [Target's command line] [Redirections]

   Environment variables in [PathTo\]<Module> and  [PathTo\]<Target>
   allowed.

   Target can be specified by:
   a) Name (csrss.exe, \??\winnt\system32\winlogon.exe, calc)
    For -n, -l switches can be specifed without extension.
    For -o, -m, -u switches must be specifed with extension.
   b) PID - process identifier (must have 0d/0x prefix: 0d708, 0x98,
            0D4294870253, 0Xfffd3e47,..)
   c) ALL - all processes are Targets

   Redirections: >, < (in NT also |)


   The following applies to -o -m and -u switches:
   NT system information limit: Target name without PathTo can have
   max. 15 characters. Targets with names longer than 15 characters
   will be found only if you specify them without PathTo and if you
   truncate their names to 15 characters. See this limit by watching
   process names in Task Manager.
   Example: Full name of existing Target is LooongTarget.exe
    apihooks -n Hooks  LooongTarget.exe   will succeed
    apihooks -o Hooks  LooongTarget.exe   will not find Target
    apihooks -l Module LooongTarget.exe   will succeed
    apihooks -m PathTo\Module LooongTarget.ex    will succeed
    apihooks -u Module PathTo\LooongTarget.ex   will not find Target
    apihooks -m PathTo\Module PathTo\LooongTarget.exe  will not find Target

  -n .. create new Target, load Module into it (1x) and establish
   API hooks. If Module is specified without PathTo, current directory
   will be added to Module.

  -o .. open existing Target, load Module into it (1x) and establish
   API hooks. If Module is specified without PathTo, current directory
   will be added to Module.

  -l .. create new Target and load module into it (1x)
   Module must be in ApiHooks search path.

  -m .. open existing Target and load module into it (1x)
   Module must be in Target's search path if it is not, you
   have to specify it with PathTo.

  -u .. open existing process and unload Module from it (1x).

   q .. display message box only if there was an error.

   r .. no message box at all.

  apihooks.exe -m  module.dll %systemroot%\explorer.exe
  (loads module.dll into existing %systemroot%\explorer.exe process;
   module.dll must be in %systemroot%\explorer.exe's search path;
   msgbox is displayed)

  apihooks.exe -lq  cmdext cmd /C cmd /C cmd /C app
  (creates process "cmd /C cmd /C cmd /C app" and loads cmdext into it;
   module.dll must be in the current directory or in search path;
   msgbox is displayed only if there was an error)

  apihooks.exe -ur  "addon. 4" 0XaC
  (unloads "addon. 4" from process represented by identifier 172;
   msgbox is never displayed)

  apihooks.exe -m e:\temp\mod.dll ALL
  (loads e:\temp\mod.dll into all processes;
   msgbox is displayed)

  apihooks.exe -l e:\temp\mod.dll th32list >list
  (creates th32list.exe process, loads e:\temp\mod.dll into it; and
   redirects its output to list
   msgbox is displayed)