Hook on StartPage (GDI Print API)

c++ / delphi package - dll injection and api hooking
Post Reply
thiago.glaser
Posts: 4
Joined: Thu Apr 01, 2010 12:43 pm

Hook on StartPage (GDI Print API)

Post by thiago.glaser »

When I do hook on the StartPage APi Function (GDI32.dll) usually works fine.

Only when i'm using Notepad.exe (both Windows XP and Windows 7/64), the hook routine is triggered twice, even though the check in ApiMonitor that the api is called only once.

Anyone have any idea about it?

Thank you.
ApiMonitor.PNG
ApiMonitor.PNG (69.92 KiB) Viewed 6977 times
Log.png
Log.png (24.21 KiB) Viewed 6977 times
madshi
Site Admin
Posts: 10754
Joined: Sun Mar 21, 2004 5:25 pm

Re: Hook on StartPage (GDI Print API)

Post by madshi »

I can't imagine that the hook callback is fired twice accidently. My best guess is that either the API was really called twice (but why does it not show in ApiMonitor? don't know), or maybe you called HookAPI twice with the same callback routine? But why then does it only occur with Notepad? Don't really know, I'm just guessing...
thiago.glaser
Posts: 4
Joined: Thu Apr 01, 2010 12:43 pm

Re: Hook on StartPage (GDI Print API)

Post by thiago.glaser »

Hello Madshi,

I did a small test project, which can show what I'm saying.

In this project, by injecting into Notepad, or any other process, it will log every passage in the StartPage.
Projeto Teste.rar
(26.73 KiB) Downloaded 508 times
madshi
Site Admin
Posts: 10754
Joined: Sun Mar 21, 2004 5:25 pm

Re: Hook on StartPage (GDI Print API)

Post by madshi »

Does it happen with both 32bit and 64bit Notepad? Also in XP 32bit OS?
thiago.glaser
Posts: 4
Joined: Thu Apr 01, 2010 12:43 pm

Re: Hook on StartPage (GDI Print API)

Post by thiago.glaser »

Yes, tested on Windows 7 64 and Windows XP 32.
Post Reply