HookAPI not working at all

c++ / delphi package - dll injection and api hooking

Re: HookAPI not working at all

Postby madshi » Fri Apr 04, 2014 9:12 pm

So the process still terminates even if you load my test dll?

Try the same by calling TerminateProcess yourself from your own code. Blocking your own call works, right? If so, maybe calling TerminateProcess is only one thing of many which iTunes does. Maybe it tries other things, too, like TerminateThread, PostQuitMessage, ExitProcess, ExitThread, (or all the native versions of those APIs like NtTerminateThread etc), whatever...
madshi
Site Admin
 
Posts: 9880
Joined: Sun Mar 21, 2004 5:25 pm

Re: HookAPI not working at all

Postby Jaque » Fri Apr 04, 2014 9:56 pm

Ok, I'm giving up on this. Despite the hook method getting invoked, my NtTerminateProcess breakpoint never gets hit, and yet the process terminates somehow.

Thanks for your help, but I don't think your hooking package will help me on this particular project.
Jaque
 
Posts: 18
Joined: Sat May 24, 2008 12:56 pm

Re: HookAPI not working at all

Postby Jaque » Fri Apr 04, 2014 10:04 pm

madshi wrote:So the process still terminates even if you load my test dll?

Try the same by calling TerminateProcess yourself from your own code. Blocking your own call works, right? If so, maybe calling TerminateProcess is only one thing of many which iTunes does. Maybe it tries other things, too, like TerminateThread, PostQuitMessage, ExitProcess, ExitThread, (or all the native versions of those APIs like NtTerminateThread etc), whatever...


Yes, it terminates still with your dll. I tried the same thing from my own code and it works (doesn't terminate). I've analyzed the strings in the DLL, and it doesn't dynamically load any of those APIs, and the only ones in the imports list are TerminateProcess and PostQuitMessage. I can try setting a breakpoint on PostQuitMessage and see if that gets hit...
Jaque
 
Posts: 18
Joined: Sat May 24, 2008 12:56 pm

Re: HookAPI not working at all

Postby Jaque » Fri Apr 04, 2014 10:13 pm

Not hitting my PostQuitMessage breakpoint, but I'll try hooking it anyway
Jaque
 
Posts: 18
Joined: Sat May 24, 2008 12:56 pm

Re: HookAPI not working at all

Postby Jaque » Fri Apr 04, 2014 10:30 pm

PostQuitMessage hook not getting called.

Yea, I'm going to cut my losses at this point and go to plan B. Hooking just isn't going to work apparently.
Jaque
 
Posts: 18
Joined: Sat May 24, 2008 12:56 pm

Re: HookAPI not working at all

Postby madshi » Sat Apr 05, 2014 7:21 am

Hooking only works if you know what you need to hook. I suppose there's probably something going on which you don't know about and thus haven't properly hooked.
madshi
Site Admin
 
Posts: 9880
Joined: Sun Mar 21, 2004 5:25 pm

Re: HookAPI not working at all

Postby Jaque » Sat Apr 05, 2014 11:24 am

madshi wrote:Hooking only works if you know what you need to hook. I suppose there's probably something going on which you don't know about and thus haven't properly hooked.


Agreed. I definitely don't understand what it's doing, and that's the root problem.

Thanks again for all your assistance.
Jaque
 
Posts: 18
Joined: Sat May 24, 2008 12:56 pm

Previous

Return to madCodeHook

Who is online

Users browsing this forum: No registered users and 4 guests