madshi.net

damn, I can't recall how many times I'm making such a stupid mistake Thanks god we have you )

Hi I'm hooking CreateCompatibleDC function into single .NET 32bit application. Problem is that, when I hook the function, the method that depends on that API crashes with NullReferenceException, even when I don't do anything specific, just call original API from callback. Here's the code: HBITMAP (W...

Looks like I found a solution, maybe someone will find it useful. The trick is to use 32 bit windows, not 64 bit. Also I tested only on Windows 7 (with Driver Signature Enforecement disabled of course) and it works. Looks like that's the ideal OS for madcodehook development

Thank you very much madshi, I will

ok madshi, thanks for trying :) I'll purchase the certs in that case, but which one? "P.S. as a last resort, I'll purchase the certificate, but https://www.globalsign.com/en/code-signing-certificate/ has 2 types, standard and Extended Validation certificates. Do you know if standard version (pr...

Yep, it worked, here's the screenshot. I run your demo with my driver + dlls.
I don't sign dlls, and never did actually. The dlls that came with your demo wasn't signed as well, already checked that.
I sign the drivers after configuring it, that is, after running madConfigDrv...

I get the following message: "only users with administrator privileges can run this demo". By looking at the code, it seems that your demo also managed to load the driver successfully but failed to inject the dll. if not InjectLibrary(CDriverName, 'HookPrintAPIs32.dll', ALL_SESSIONS, true,...

Forgot to mention that i managed to make madcodehook work without a valid cert signature once. But as i said, it was previous version, but >ver 3. So if u didn't modify/implemented cert validation routines, im sure it should work this time as well. Just trying to figure out the problem. If nothing h...

Haha, no problem madshi, it worked.
I thought Project1.exe was exclusion process...
never mind though.

So your demo is working, myne doesn't. Maybe you know some debugging tricks I don't? something like GetLastError for madcodehook

Thanks again

Yes madshi, I tried rebooting it. I also tried it with host OS (Win 10 x64 Home Edition) and it didn't work here as well. Just to be clear, is there any steps that I need to do before running the demo..? p.s. the screenshot was taken before I disabled win defender. :) p.s. is there any way to debug ...

Thanks madshi. No I'm not running any AV or other security software. I even disabled Windows Defender. The folder has full permission for Everyone and it's outside user's specific location. I also tried it with Windows 7 32 bit, but also didn't work. nothing was injected. Strange thing is that, in c...

Madshi, I'm not sure, maybe I'm doing something wrong, but the demo you provided didn't work. I unzipped it and run PrintMonitor64 or PrintMonitor32. Even though, I don't get any error message, no dll is being injected anywhere (not in 64 bit processes and not in 32 bit processes as well). Trying to...

Thanks madshi, I will try it soon. Although, i'm sure previous version worked without a problem, although i dont remember the exact version. I' not using a certificate because im in dev phase, i was planning to purchase it when im ready to release the product. Do you do know if self signed certifica...

Hi madshi

Yes sure, I did that. Also forgot to mention that 32 & 64 bit hook dlls are both in system32 and syswow64 folders

Thanks

Hi madshi I configured the injection drivers and windows to disable driver signature enforcement. The driver loads fine. IsInjectionDriverRunning returns true. InjectLibrary also works when injecting into a single process. However, as soon as I try to inject with CURRENT_SESSION/ALL_SESSIONS it fail...