madshi.net

Thank you for the answer

Hi madshi I know you already replied to this question, but it was 9 monthes ago and a lot of things happened since then. Apple M1 ARM processor becomes more and more popular. Windows 11 ARM version was released. Our product (and many others) faces the need to be compatible with ARM. We've being usin...

Hi For a long time we've being using madCodeHook in our product - and it works great. Now we are trying to pack our application into a package for Microsoft Store using Desktop Bridge. It means our package (appx) will be installed from Microsoft Store and will have some limitations, described here: ...

You say we can cross-sign our DLL (not driver, but user-mode DLL) ? Does it work in a similar way to driver cross-signature or there is another workflow?

Few days ago Google release Chrome Canary (v.70) where it implemented some protection from dll injection. They had announce about this feature some time ago - https://blog.chromium.org/2017/11/reducing-chrome-crashes-caused-by-third.html and now finally it is enabled in Chrome Canary and looks like ...

Thank you very much for the explanation.

Yes! You are right! I tried PrintMonitor sample and if driver was started before Edge - HookPrintAPIs64.dll is loaded into MicrosoftEdgeCp.exe!
Do you have ideas why does it work this way?

Have update: it is still possible to inject dlls to other Metro applications, but not to Edge. When trying to inject dll madCodeHook succesfully creates remote thread in MicrosoftEdgeCp.exe, call LoadLibraryEx, then dll is being loaded (I see CreateFile and ReadFile calls in ProcMon), and then every...

Ok, answers above are very good and useful, we really need ALL APPLICATION PACKAGES flag - and it was enough to inject dll into Edge (by madCodeHook or by other tools). It worked fine - we even released our product with injecting to Edge feature enabled and got no any real problem reports from our u...