|
Hello,
I am trying to hook intra-dll calls, by using delay loaded dll's. But it
does not work.
The question is if APIHijack would allow this.
The original code is like this:
-----------MyLib.dll, MyLib.lib -----------
__declspec(dllexport) int f1(int a) { ... }
__declspec(dllexport) int f2(int a) { if /* A */ (f1(a)) return 1; else return 0; }
-----------MyLib.dll, MyLib.lib -----------
-----------MyMockLib.dll, MyMockLib.lib -----------
__declspec(dllexport) int f1(int a) ...
__declspec(dllexport) int f2(int a) ...
-----------MyMockLib.dll, MyMockLib.lib -----------
Application links to MyMockLib.lib and MyLib.lib
I can intercept the call to MyLib::f2, but the call at [A]
from MyLib::f2 to MyLib::f1 goes directly to MyLib::f1
(and not to MyMockLib::f1 as I want).
I also wonder how the call at [A] is dispatched. Using the runtime linker, or
using a direct call. And if it is possible to control this behavior.
Regards,
Even
|
|
|
|
|
i've made a dll with this lib to hook all the LoadLibrary function
it's working but. if i compile my test application in release
it's load my dll but i can't know if the functions are hooked or not
and my hook for LoadLibrary isn't called
someone can help me ?
ps: i've modified the source to compile it as a stand-alone dll, so
when the .exe load it's with LoadLibraryA my dll will set all hooks
to log the library loads
|
|
|
|
|
Hi everyone
I'm trying to use this library to retrieve text from all kind of windows.
but for some reason i only get only parts of the text.
for example: in notepad i only get the texts in the menu, but not what the user has written.
does anyone knows why?
i hooked these functions:
ExtTextOutW
ExtTextOutA
TextOutW
TextOutA
DrawTextA
DrawTextW
PolyTextOutA
PolyTextOutW
thanks in advance
Roey
Don't believe to what you hear on the news...
|
|
|
|
|
I want to hook the functions HeapAlloc and HeapFree to see if there is a memory problem with my application, but it does not work for me. It worked a few years back, but it seems that Microsoft has released a patch which no longer allows apihijack to work.
|
|
|
|
|
Not true, I am using this on Vista, completely up to date, and it works great. I load my dll in applications by using CreateRemoteThread(). Because Vista and Windows 7 have a ressembling architecture, I assume it wil still work on windows 7. However, the sample didn't worked for some reason.
|
|
|
|
|
I want to hook the network functions, but they are not really hooked; "bool RedirectIAT( SDLLHook* DLLHook, PIMAGE_IMPORT_DESCRIPTOR pImportDesc, PVOID pBaseLoadAddr )" is called, but it doesn't hook the dll-functions.
by debugging I found out, that
if(!IMAGE_SNAP_BY_ORDINAL(pINT->u1.Ordinal))
is not called, so the function is not imported by name. The "else" case doesn't really do anything, because UseDefault is disabled.
else
{
if ( DLLHook->UseDefault )
pStubs->pszNameOrOrdinal = pINT->u1.Ordinal;
}
SDLLHook WS2Hook =
{
"ws2_32.dll", false, NULL,
{
{ "accept", NEW_accept},
{ "bind", NEW_bind},
{ "connect", NEW_connect},
{ "listen", NEW_listen},
{ "recv", NEW_recv},
{ "recvfrom", NEW_recvfrom},
{ "send", NEW_send},
{ "sendto", NEW_sendto},
{ "WSAAccept", NEW_WSAAccept},
{ "WSAConnect", NEW_WSAConnect},
{ "WSARecv", NEW_WSARecv},
{ "WSARecvFrom", NEW_WSARecvFrom},
{ "WSARecvDisconnect", NEW_WSARecvDisconnect},
{ "WSASend", NEW_WSASend},
{ "WSASendTo", NEW_WSASendTo},
{ "WSASendDisconnect", NEW_WSASendDisconnect},
{ NULL, NULL }
}
};
|
|
|
|
|
I have a requirement to monitor functions called inside a userdefined DLL.
I coded a win32 DLL and exported a function ("TestFunction") and called LoadLibrary from Dlg based MFC sample
to load the dll dynamically.
I then gave this DLL name as input to Hook structure ,wrote the function pointer and prototype stuff overrides as in the sample in the Hook sample and built the test DLL.
I launched the launchtest app and hooked the dll. But when I execute the MFC sample, i dont see any trace of the function called in the win32 DLL i coded. Why is it so ?
Why only predefined Microsoft DLLs are able to hook and not User Defined ? How else must i link my MFC app to my user defined DLL to get the function hooked..
I place the userdefined win32 DLL in C:\windows\system32 folder.
Plz help me..
-Mahesh
|
|
|
|
|
I need to write an application which will basically monitor function calls in a win32 dll and print the
functions called to debug output. Iam novice to hooking.
Using this article, How can i do it ? can any one give me sample code ?
Thanks in advance..
-Mahesh
|
|
|
|
|
If a program loads an activeX the activeX is not hooked, nor?
and if an program doesn't have an OriginalFirstThunk the function also fails?
So how can I hook functions system wide, so that I get every call of CreateFileA and CreateFileW?
Regards and thanks for your answers
Tobias
either you live or you are consequent
|
|
|
|
|
TestLauncher.exe and TestDLL.dll
can not hook api DirectDrawCreateEx in bend.exe
why?
APIHijack is outmoded?
Test at WinXP Pro SP2
|
|
|
|
|
Hi anyone got this to compile cleanly using Visual Studio 2003 ? I'm getting some errors and would appreciate some help.
I've also found a more upto date version of this application on CodeGuru but that also gives errors when using VS 2003.
The API's I'm trying to hook are PrintDlgExA and PrintDlgExW so I require a more upto date environment than VC++ 6.0 and it's header/library files.
|
|
|
|
|
Does anyone know how to hook LoadLibraryA. I have tried several times, but it just doesn't work. My hook procedure is not called. The funny thing is that this only applies to KERNEL32.dll functions. I can easily hook any USER32.dll function with my hook procedure being called.
Any ideas?
|
|
|
|
|
Hi man, is posible use you Dll in .Net Programs ?
|
|
|
|
|
I can't figure out how to verify the demo operation. When I start the directx demo and then the launcher program, I get a positive message - as if the hook is activated but I see no change in the demo.
Can someone help please?
Triplebit
|
|
|
|
|
I know it's late. You need to open launcher before bend.exe, and then if you open bend.exe, it will give you a sound of beep.
|
|
|
|
|
I can't figure out how to verify the demo operation. When I start the directx demo and then the launcher program, I get a positive message - as if the hook is activated but I see no change in the demo.
Can someone help please?
Menker
|
|
|
|
|
Works like a charm, more than 5 years after the article was published...
Now that has to say something about the quality of this article.
Thank you!
Nick Z.
|
|
|
|
|
Right, I think so. But I don't know when we hooking some proccess of Window system (sample Spooler in Printing system). Do we infringe Window's privacy ?
minhcom
|
|
|
|
|
thanks too much for this artical, its very helpfull .
plz.. can u tell me how can i hook the windows copy,cat,past operation.
thank u for any think
|
|
|
|
|
is it possiblee to retreive a value of a variable in a process that you hijacked?
1: i hijack a process
2: find a variable by name or type
3: return the variable onfo to the hijack dll
4: free hijack
can that be done??
cheers
|
|
|
|
|
Hi,
is there a way to hijack functions of a dll loaded at runtime by the application
via LoadLibrary?
Kalle
|
|
|
|
|
Yeah...hook LoadLibrary
|
|
|
|
|
Yeah Right, Any comment about that???
-----------------------------
"I Think this Will Help"
-----------------------------
Alok Gupta
visit me at http://www.thisisalok.tk
|
|
|
|
|
I m hooking Direct3dCreate8() of d3d8.dll. In some cases it is hooked succefully while in other after hooking, hooked function address is somehow replaced with original function address.
<br />
if ( HookFn )<br />
{<br />
if ( IsBadWritePtr( (PVOID)pIteratingIAT->u1.Function, 1 ) )<br />
{<br />
pIteratingIAT->u1.Function = (PDWORD)HookFn;<br />
}<br />
else if ( osvi.dwPlatformId == VER_PLATFORM_WIN32_WINDOWS )<br />
{<br />
if ( pIteratingIAT->u1.Function > (PDWORD)0x80000000 )<br />
pIteratingIAT->u1.Function = (PDWORD)HookFn;<br />
}<br />
}<br />
Here
pIteratingIAT->u1.Function = (PDWORD)HookFn;<br /> is succesfully assigned without any exception. but at the end when i recheck the address by
GetProcAddress( GetModuleHandle("d3d8.dll"), "Direct3dCreate8" );
it gives original Function address. Does any body knows abt it?
|
|
|
|
|
this is because the hooking library is only hooking the IAT and not the dll's EAT.
in plain english this means imported function calls are hooked, but those calls using GetProcAddress are not.
a more complete solution is to modify the loaded dll's Export Address Table function pointer as well.
|
|
|
|