HookAPI not working at all

c++ / delphi package - dll injection and api hooking
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Re: HookAPI not working at all

Post by madshi »

So the process still terminates even if you load my test dll?

Try the same by calling TerminateProcess yourself from your own code. Blocking your own call works, right? If so, maybe calling TerminateProcess is only one thing of many which iTunes does. Maybe it tries other things, too, like TerminateThread, PostQuitMessage, ExitProcess, ExitThread, (or all the native versions of those APIs like NtTerminateThread etc), whatever...
Jaque
Posts: 18
Joined: Sat May 24, 2008 12:56 pm

Re: HookAPI not working at all

Post by Jaque »

Ok, I'm giving up on this. Despite the hook method getting invoked, my NtTerminateProcess breakpoint never gets hit, and yet the process terminates somehow.

Thanks for your help, but I don't think your hooking package will help me on this particular project.
Jaque
Posts: 18
Joined: Sat May 24, 2008 12:56 pm

Re: HookAPI not working at all

Post by Jaque »

madshi wrote:So the process still terminates even if you load my test dll?

Try the same by calling TerminateProcess yourself from your own code. Blocking your own call works, right? If so, maybe calling TerminateProcess is only one thing of many which iTunes does. Maybe it tries other things, too, like TerminateThread, PostQuitMessage, ExitProcess, ExitThread, (or all the native versions of those APIs like NtTerminateThread etc), whatever...
Yes, it terminates still with your dll. I tried the same thing from my own code and it works (doesn't terminate). I've analyzed the strings in the DLL, and it doesn't dynamically load any of those APIs, and the only ones in the imports list are TerminateProcess and PostQuitMessage. I can try setting a breakpoint on PostQuitMessage and see if that gets hit...
Jaque
Posts: 18
Joined: Sat May 24, 2008 12:56 pm

Re: HookAPI not working at all

Post by Jaque »

Not hitting my PostQuitMessage breakpoint, but I'll try hooking it anyway
Jaque
Posts: 18
Joined: Sat May 24, 2008 12:56 pm

Re: HookAPI not working at all

Post by Jaque »

PostQuitMessage hook not getting called.

Yea, I'm going to cut my losses at this point and go to plan B. Hooking just isn't going to work apparently.
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Re: HookAPI not working at all

Post by madshi »

Hooking only works if you know what you need to hook. I suppose there's probably something going on which you don't know about and thus haven't properly hooked.
Jaque
Posts: 18
Joined: Sat May 24, 2008 12:56 pm

Re: HookAPI not working at all

Post by Jaque »

madshi wrote:Hooking only works if you know what you need to hook. I suppose there's probably something going on which you don't know about and thus haven't properly hooked.
Agreed. I definitely don't understand what it's doing, and that's the root problem.

Thanks again for all your assistance.
Post Reply