mstsc control is fail

c++ / delphi package - dll injection and api hooking
yoosh
Posts: 16
Joined: Mon Aug 20, 2012 11:55 am

mstsc control is fail

Post by yoosh »

Hi. madshi...

I have a question..

After install my hooking dll in client PC(A-PC) , and then try remote control to (A-PC) from another PC (using mstsc)
But, cant control that A-PC... (can't see remote PC)
(And in A-PC, hooking is worked well, and any hook API is not relation)

I had tested with 3.1.3 and 3.1.4....

(But 3.1.2 version worked well)
madshi
Site Admin
Posts: 10764
Joined: Sun Mar 21, 2004 5:25 pm

Re: mstsc control is fail

Post by madshi »

That sounds weird. I'm not sure why 3.1.2 would behave differently there compared to newer builds.

Can you reproduce the problem with the following demo? Just to make sure it's a general madCodeHook problem and not specific to your hook dll:

http://madshi.net/PrintMonitor.zip
yoosh
Posts: 16
Joined: Mon Aug 20, 2012 11:55 am

Re: mstsc control is fail

Post by yoosh »

hmm.... I had tested..

With your printerMonitorhook, same status was happened..

Test environment : WIn 7 (UAC activated, UAC deactivated)

Test method :
1. in Client PC(A-PC), execute printerMonitorHook..
then, when I printed some documents, printed result is displayed in ListView (I think that it's worked correctly)

2. But when I try remote control to A-PC from another PC using mstsc,
- mstsc can't display moniror screen.. (after input userid/password to mstsc window, there is no any response)
- If I exclude Winlogon.exe and LogonUi.exe processes, then, mstsc display A-PC logon window, but after that I cant control anything.
- If I exclude WinLogon.exe, LogonUI.exe and TsTheme.exe processes,
I can enter mstsc windows(A-PC), but can't execute any application..
(for example, click [Start] Button, and input [calc.exe] in command line.. but if I presses enter-key, there is no response)
(for example, If I click [control panel] in taskbar, there is no response)
madshi
Site Admin
Posts: 10764
Joined: Sun Mar 21, 2004 5:25 pm

Re: mstsc control is fail

Post by madshi »

Ok, I'll check if I can reproduce that here and then come back to you. Might take a couple of days, though...
yoosh
Posts: 16
Joined: Mon Aug 20, 2012 11:55 am

Re: mstsc control is fail

Post by yoosh »

Thnaks a lot..
I will wait,,
yoosh
Posts: 16
Joined: Mon Aug 20, 2012 11:55 am

Re: mstsc control is fail

Post by yoosh »

Hi. madshi?

In your PC, Is same statsus reproduced?

I had tested it in Win7-32Bit
madshi
Site Admin
Posts: 10764
Joined: Sun Mar 21, 2004 5:25 pm

Re: mstsc control is fail

Post by madshi »

I'm sorry for the long delay. I'll be looking into this in the next 2-3 days.
madshi
Site Admin
Posts: 10764
Joined: Sun Mar 21, 2004 5:25 pm

Re: mstsc control is fail

Post by madshi »

Finally got around testing this. I've used a clean win7 x86 virtual machine. I've started PrintMonitor in the VM. Then I started mstsc on my development PC and tried to connect to the virtual machine. I've tried 2 different things:

(1) I've tried to connect with the same user account which was already logged on in the VM, and which had started PrintMonitor. This worked just fine. mstsc practically took over the same session, PrintMonitor was still started, no problems at all. I could still start other applications etc. The VM screen showed the logon screen with two different users. One user was not logged on at all. The other one (which mstsc was using) was reported as "logged on". I've then closed mstsc without logging off, and then I could log on in the VM again and take back the same session.

(2) With PrintMonitor being started as user "A" in the VM, I've then tried to start mstsc with user "B". mstsc warned that another user was active, I confirmed that I still wanted to continue. Then the VM showed a warning box which I also had to confirm. After that the VM went back to the logon screen and mstsc succeeded showing user "B". The VM logon screen reported both users to be logged on, where user "B" was reported to be a remote session. I was still able to create new processes with mstsc as user "B". No problems at all. Then I logged off user "B"/mstsc and I could afterwards logon as user "A" again in the VM to take control of the old "A" session again.

So basically, I was not able to reproduce any problems at all. Tests were done with this PrintMonitor files:

http://madshi.net/PrintMonitor.zip

Could you please double check? Please make sure that your test PC is a clean installation. If you can't reproduce the problem on a clean installation, but if you *can* reproduce it with one specific PC, then we'd need to find out why that one PC behaves differently...
yoosh
Posts: 16
Joined: Mon Aug 20, 2012 11:55 am

Re: mstsc control is fail

Post by yoosh »

I see.. then I will test again with your method
yoosh
Posts: 16
Joined: Mon Aug 20, 2012 11:55 am

Re: mstsc control is fail

Post by yoosh »

Hi... I tested it with clear PC...

I think that I find reason...

scenario.
1. wih only execute PrinterHook, there is no issues about mstsc.

2. And I had prepared another hook, and execute it only (not execute PrinterHook simultaneous)
==> there is no issues about mstsc

3. But when I execute PrinterHook and another Hook, then MSTSC issues occurred
* so, for conviction, would you send me another Hook sample? then I will execute it with PrinterHook, and check status of mstsc..
yoosh
Posts: 16
Joined: Mon Aug 20, 2012 11:55 am

Re: mstsc control is fail

Post by yoosh »

With your samples, it's worked well...

so, I will compare mine and yours that which is different...

Thanks
madshi
Site Admin
Posts: 10764
Joined: Sun Mar 21, 2004 5:25 pm

Re: mstsc control is fail

Post by madshi »

Good to hear. Please keep me posted - thanks!
yoosh
Posts: 16
Joined: Mon Aug 20, 2012 11:55 am

Re: mstsc control is fail

Post by yoosh »

Hi. madshi...

I had found problem about mstsc..

With Hooking module that compiled by 3.1.4 or 3.1.2 madCHook, It's worked well..

But in some PC, Assume that there is 2 Hooking application.
and one hook module is compiled with 3.1.2 version, and other hook module is compiled with 3.1.4.
and If both hook module is launched, Hooking is worked well.
But When try connect this PC from another PC using mstsc, It's always fail (mstsc is fail)


Test scenario.
1. used your PrinterHook (I think that It's compiled with 3.1.4)
2. compiled your HookProcessCreation (I had compiled it with 3.1.2)
3. each hook module is worked well.
4. launch both PrinterHook and HookProcessCreation.
5. Now Try connect this PC from another PC using mstsc. (It's failed)
(I think that 3.1.3 and 3.1.2 have same status)

hmm...
If only my hook module is executed, then I think that there is no problem.
But If another company's hook module is installed (that is compiled with old version), and If my Hook is compiled with new version,
Then there is Problem..

So, How can I do for get information that another madCHook module is executed?
Or would you plan that have version compatibility?
yoosh
Posts: 16
Joined: Mon Aug 20, 2012 11:55 am

Re: mstsc control is fail

Post by yoosh »

upload dll and exe that compiled with 3.1.2 verison
Last edited by yoosh on Mon Jul 15, 2013 10:27 pm, edited 1 time in total.
Post Reply