Monitoring API calls - system wide (Global hook)

[Ramanathan (ramanathanv)]

Google Gemini mentioned that detours can be used for monitoring API calls by injecting it into specific process as well as having a global hook on all process. (see: https://g.co/gemini/share/fcc818374057)
But in all the samples in the GitHub repository, I only see examples of monitoring API calls through injecting it into specific process.

Can detour monitor Windows API calls by having a global hook on all processes?

[Charles Milette (sylveon)]

You can achieve this by injecting into all processes.

[PARTHASARATHI KUNDU (parthasarathi204)]

I am interested for sendMessage, postMessage () fro all the windows in the system.
like
DetourAttach(&(PVOID&)TrueSendMessageW, HookedSendMessageW);
DetourAttach(&(PVOID&)TruePostMessageW, HookedPostMessageW);
DetourAttach(&(PVOID&)TrueSendMessageW, HookedSendMessageA);
DetourAttach(&(PVOID&)TruePostMessageW, HookedPostMessageA);
DetourAttach(&(PVOID&)TrueSendNotifyMessageW, HookedSendNotifyMessageW);

But I don't see trace of detoured messages .  Is that possible ?

[Charles Milette (sylveon)]

You will have to DLL inject in all processes you wanna trace.