# WindowsHookTools

**Repository Path**: DLarpx/windows-hook-tools

## Basic Information

- **Project Name**: WindowsHookTools
- **Description**: 一款基于 .NET 10 的 WPF 桌面应用，用于在 Ring3（用户态）下检测系统中可疑的截屏 API 调用和进程枚举行为。兼容 Windows 11 25H2 + HVCI（内存完整性），无需驱动程序。
- **Primary Language**: Unknown
- **License**: MIT
- **Default Branch**: master
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2026-06-17
- **Last Updated**: 2026-07-28

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# HookMonitor

[中文](README.md) | [English](README.en.md)

Docs: [User Guide (zh)](docs/用户使用说明.md) · [Developer Guide (zh)](docs/开发说明.md)

A .NET WPF desktop tool that detects suspicious screen-capture and process-enumeration behavior in user mode. Works with Windows 11 memory integrity (HVCI) and does not require a kernel driver.

## What it does

- Flags suspicious capture / process-enumeration activity  
- Surfaces suspect processes with a threat level  
- Defaults to ETW + handle scanning; optional IAT hook injection  

## How it works (brief)

1. Start the GUI as Administrator.  
2. Start monitoring; the app scores relevant system signals.  
3. Review the list, then stop monitoring when done.

## Quick start

```bash
dotnet restore
dotnet build --configuration Release
dotnet run --project src/HookMonitor.GUI --configuration Release
```

See the Chinese [developer guide](docs/开发说明.md) for environment, native DLL, and configuration details.

## Project

| Item | Notes |
|------|--------|
| Product | HookMonitor (repo: WindowsHookTools) |
| Layout | `src/` · `docs/` · `scripts/` |
| License | MIT — see [LICENSE](LICENSE) |

## License

MIT License