Search found 21 matches

by djsale
Tue May 12, 2009 5:27 pm
Forum: madCodeHook
Topic: CreateProcessXXX hooking in Windows 7
Replies: 23
Views: 32260

I also noticed the same behaviour as the original poster: The CreateProcessW hook is always fired if an app is maximized from the new taskbar (regardless if its already running or not). Everything else is running fine now.
by djsale
Tue May 12, 2009 9:54 am
Forum: madCodeHook
Topic: CreateProcessXXX hooking in Windows 7
Replies: 23
Views: 32260

Mike,

i've done some debugging and the hook code (and also the process launch) is now caught correctly ;) Seems the error is somewhere else in my code. I'll have to do a little bit more research. Thanks for your great help so far!
by djsale
Sun May 10, 2009 9:18 pm
Forum: madCodeHook
Topic: CreateProcessXXX hooking in Windows 7
Replies: 23
Views: 32260

mikec, it's not a stability issue. If I run the app it seems that CreateProcessA/W is not caught by the hook. I'm at the beginning of testing routines on Windows 7 and this was the first thing I mentioned...Other hooks (e.g. hooking terminate and even winsock hookings are working fine). I have to do...
by djsale
Sun May 10, 2009 5:23 pm
Forum: madCodeHook
Topic: CreateProcessXXX hooking in Windows 7
Replies: 23
Views: 32260

Hi guys, i'm facing the same problem. Hooking on Vista works fine, but on Windows 7 it fails :( code snippet: HookAPI('kernel32.dll', 'CreateProcessA', @CreateProcessACallback, @CreateProcessANext); HookAPI('kernel32.dll', 'CreateProcessW', @CreateProcessWCallback, @CreateProcessWNext); function Cre...
by djsale
Wed Feb 13, 2008 6:25 am
Forum: madCodeHook
Topic: (Recommended) maximum of IPC queues ?
Replies: 2
Views: 2664

(Recommended) maximum of IPC queues ?

Hi madshi, I'm using IPCs queues for interprocess communication with my service. Works fine so far. There's only one question: Is there a recommended maximum of IPC queues? (e.g. 5,10,100)? What are side effects if I'm using e.g. 15 different IPC queues for different tasks? Thanks and keep on this r...
by djsale
Tue Jun 19, 2007 6:36 pm
Forum: madCollection
Topic: InjectLibrary question
Replies: 4
Views: 8829

InjectLibrary question

Hi folks, hi Madshi, I use this code to inject my dll in one (already running) exe file: GetWindowThreadProcessID(FindWindow('WindowTitleXY',nil),ProcessID); ProcessHandle:=OpenProcess(PROCESS_ALL_ACCESS,false,ProcessID); if injectLibrary(ProcessHandle,'mylib.dll') then ... The question: Does inject...
by djsale
Thu Jun 14, 2007 6:53 am
Forum: madCodeHook
Topic: TerminateProcess under Vista
Replies: 12
Views: 11899

[quote="LeVuHoang"]I tested with the Demo HookProcessTermination under Vista. It always display 0. I'm facing the same problem. It seems to happen only on Vista if you want to terminate an EXE which is a Child (started by ShellExecute) of another exe. Just try to start the relevant Exe alo...
by djsale
Fri May 25, 2007 9:29 am
Forum: madKernel
Topic: NewProcess and UAC
Replies: 2
Views: 10979

Solved

solved by myself using CreateProcess(Ex). Nevertheless, what exactly does NewProcess do? (I can't hook that with hooks on CreateProcess)?
by djsale
Thu May 24, 2007 9:34 pm
Forum: madKernel
Topic: NewProcess and UAC
Replies: 2
Views: 10979

NewProcess and UAC

Hello, i tried to launch a process in Vista with NewProcess(myproc.exe). Everything works fine, except one thing: If myproc.exe requires an elevated run, means UAC is coming up and I press Cancel i am in an endless/recursive loop. The UAC dialog is coming up again and again. What's wrong? thanks a l...
by djsale
Tue May 15, 2007 8:46 pm
Forum: madKernel
Topic: IProcess.IsSuspend
Replies: 4
Views: 12466

Thanks a lot, i'll give this a try.
by djsale
Tue May 15, 2007 9:13 am
Forum: madKernel
Topic: IProcess.IsSuspend
Replies: 4
Views: 12466

Re: IProcess.IsSuspend

Thanks a lot for this great and explicitely explanation. The best way ever would be to disallow suspending via hooking (like disabling process terminate). But I don't have any idea how to do that at all...
Any hint would be highly appreciated!
by djsale
Mon May 14, 2007 8:24 am
Forum: madKernel
Topic: IProcess.IsSuspend
Replies: 4
Views: 12466

IProcess.IsSuspend

Hi madshi,

is there a way to detect if an appliction is suspended (sth. like process('app.exe').IsSuspend)?
Is it dangerous to use process('app.exe').RESUME in a timer to make sure another app doesn't suspend my one?

thanks in advance!
by djsale
Sun Mar 04, 2007 7:30 pm
Forum: madCodeHook
Topic: Vista: MS genuine check fails if hook is installed
Replies: 8
Views: 7564

http://support.microsoft.com/default.as ... 1699/en-us

I found this link where a gameGuard program is mentioned. I think this kind of tools also uses mainly hooking functions...?
by djsale
Sun Mar 04, 2007 7:03 pm
Forum: madCodeHook
Topic: Vista: MS genuine check fails if hook is installed
Replies: 8
Views: 7564

That's sounds like a funny problem! I've not been able to check this problem yet, but I hope to do that today or tomorrow... The behaviour happened now also on some of my customers PC. I'm not really sure if it is madCodeHook related or if it depends on some registry keys... Do you have any news yet?
by djsale
Wed Feb 14, 2007 2:14 pm
Forum: madCodeHook
Topic: IPC vs. WM_COPYDATA
Replies: 11
Views: 12572

Madshi YOU made my day. Real Guru. Thanks a lot. It seems setting handleMessages to false does fix it. Thanks again :D PS: Do you think this will also solve the problems on XP or should I still use COPYDATA there (never touch a running... you know...)