Process Creation Hook in Win8 X64

c++ / delphi package - dll injection and api hooking
Post Reply
madshi
Site Admin
Posts: 10859
Joined: Sun Mar 21, 2004 5:25 pm

Re: Process Creation Hook in Win8 X64

Post by madshi »

There are several process creation APIs. CreateProcessWithLogonW and CreateProcessAsUserA/W come to my mind right now, but I'm not sure if that's the one which is used for right click -> run as admin. I also don't know if these end up in CreateProcessInternalW. Maybe not. I think user elevation *may* also involve the process being started from some system process, so your hook dll might have to be injected in the system processes, too, but I'm not really sure about that. You could try hooking NtCreateProcess(Ex), but I think doing that won't give you the exe file name.

It might make sense to add a secondary "new process" detection by making use of the automated dll injection. If you inject your hook dll system wide, you can call in DllMain "GetModuleFileName(0)". That will give you the name of each new process. So if you missed a new process in your CreateProcessInternalW hooks, by checking the current process in your hook dll's DllMain you'd have a 2nd layer of new process detection.
Post Reply