InjectLibrary failed

c++ / delphi package - dll injection and api hooking
Post Reply
manutai
Posts: 85
Joined: Sun Aug 03, 2008 1:40 am

InjectLibrary failed

Post by manutai »

If the exclusion list of the inject library is provided by file path then the function fails and it succeeded if the only the names of executable are provided.

eg:
----> if exclusion list is
C:\Windows\SysWOW64\svchost.exe|C:\Windows\system32\svchost.exe|C:\Windows\system32\winlogon.exe
the function fails

----> if exclusion list is
svchost.exe|winlogon.exe
the function succeeded

Is there something wrong with the file path provided in the exclusion list???
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Re: InjectLibrary failed

Post by madshi »

Hmmmm... Please show me the exact code you're using that fails. Also show me how you test whether it fails or not.
manutai
Posts: 85
Joined: Sun Aug 03, 2008 1:40 am

Re: InjectLibrary failed

Post by manutai »

This is the code we use... I have remove the unnecessary details.

bRet = InjectLibrary(MADSHI_DRV_NAME,
gstrLibPath,
ALL_SESSIONS,
TRUE,
NULL,
_T("C:\\Windows\\SysWOW64\\svchost.exe|C:\\Windows\\system32\\svchost.exe|C:\\Windows\\system32\\winlogon.exe"),
NULL,
lInjectTimeOut);


The API fails

And GetLastError() is return 31.

The same exclusion list is passed for both 32 bit library as well as 64 bit library.

Now if we pass this like svchost.exe|winlogon.exe... It works fine...


The code is executing from a service.
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Re: InjectLibrary failed

Post by madshi »

That's quite weird. Could you try spelling out the ansi/wide stuff, just to be safe there's no conflict of any kind there? So e.g. "InjectLibraryW(..., L"C:\\Windows...", ...)". I think it probably won't make a difference because if there were a problem the compiler should complain. But that's the only thing coming to my mind right now. I'd try this myself, but I'm in the middle of preparations for my vacation next week. So I won't have time to look into this until the week after the next week... :?
manutai
Posts: 85
Joined: Sun Aug 03, 2008 1:40 am

Re: InjectLibrary failed

Post by manutai »

Done..

Drivers are new and Service was compiled with older library..

:-(
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Re: InjectLibrary failed

Post by madshi »

I've just tried to reproduce this problem, but it works just fine for me, using the latest madCodeHook (beta) build and the HookProcessCreation demo:

http://madshi.net/madCollectionBeta.exe (installer 2.7.9.9)
http://madshi.net/HookProcessCreation.zip

Could you please double check whether you can reproduce the problem with the HookProcessCreation demo if you use the latest madCodeHook build?
Post Reply