When NtSuspendThread is hooked, C# app is not installed

contains all delphi packages mentioned below
Post Reply
power888
Posts: 54
Joined: Sat May 23, 2009 8:55 am

When NtSuspendThread is hooked, C# app is not installed

Post by power888 »

Hi. All..

When I hooked NtSuspendThread and TerminateThread API,

C# Application is not installed or not executed..

Is there any solution to solve it ?

I had compiled madCodeHook 3.x and 2.x but same status is occurred.

(Hooked TerminateProcess, NtTerminateProcess, NtTerminateProcess, NtDebugActiveProcess is worked well)

Ah.. Is there sample code of Protect termination (in madCodeHook 3.x)?

(in madCodeHook 2.x, sample source is provided, But 3.x, sample source is not provided)
madshi
Site Admin
Posts: 10754
Joined: Sun Mar 21, 2004 5:25 pm

Re: When NtSuspendThread is hooked, C# app is not installed

Post by madshi »

Have you tried emptying your NtSuspendThread and TerminateThread callback functions? Try a simple "return NtSuspendThreadNext(...)" code so that your hook callback function does not change anything, but just forwards the API call to the original API. If you do that, does the problem go away?

Here's the 3.0 HookProcessTermination demo:

http://madshi.net/HookProcessTermination.zip

Please also make sure you're using the latest madCodeHook version:

http://madshi.net/madCollection.exe
power888
Posts: 54
Joined: Sat May 23, 2009 8:55 am

Re: When NtSuspendThread is hooked, C# app is not installed

Post by power888 »

Thanks. madshi..
I will test with blank NTSuspendThread...
power888
Posts: 54
Joined: Sat May 23, 2009 8:55 am

Re: When NtSuspendThread is hooked, C# app is not installed

Post by power888 »

Thanks. madshi..

solved issue...
Post Reply