hooking clipboard apis

c++ / delphi package - dll injection and api hooking
tallas
Posts: 14
Joined: Wed May 27, 2015 6:43 am

hooking clipboard apis

Post by tallas »

I am trying to hook the clipboard APIs for example SetClipboardData; it is not working!!
HANDLE WINAPI MyClass::SetClipboardDataACallback(
_In_ UINT uFormat, _In_opt_ HANDLE hMem)
{
OUTPUTDBGMSGAX("MyClass:SetClipboardDataACallback");
}
HANDLE WINAPI MyClass::SetClipboardDataWCallback(
_In_ UINT uFormat, _In_opt_ HANDLE hMem)
{
OUTPUTDBGMSGAX("SetClipboardDataWCallback");
}
HANDLE (WINAPI *SetClipboardDataAOrig)( _In_ UINT uFormat, _In_opt_ HANDLE hMem);

if (!HookAPI("User32.dll", "SetClipboardDataA", SetClipboardDataACallback, (PVOID*)&SetClipboardDataAOrig)
|| !HookAPI("User32.dll", "SetClipboardDataW", SetClipboardDataWCallback, (PVOID*)&SetClipboardDataWOrig,)
)
{
OUTPUTDBGMSGX2(_T("sseApplicationFilter:StartApplicationFilter->SetClipboardDataACallback Hooking failed. Error = %d"), GetLastError());
}
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Re: hooking clipboard apis

Post by madshi »

What do you say to your customers if they tell you: "I've tried your product, but it's not working"?

Some more details would be helpful. What does "is not working" mean exactly? Does your computer explode? Or does the PC reboot? Do you get a bluescreen? Does HookAPI return FALSE/0? Or something else?

FWIW, both the hook callback function and the "Orig" function variable must have exactly the same calling convention and parameter list as the API you're hooking. In your case you're hooking a simple function, but your hook callback function is a method (part of a class). That is not compatible. A method has an addition hidden "This" parameter which means it's a different parameter list compared to the original API.
tallas
Posts: 14
Joined: Wed May 27, 2015 6:43 am

Re: hooking clipboard apis

Post by tallas »

HookAPI doesn't return any error; This dll gets injected into selected processes. whenever clipboard copy paste is done by those processes, I am expecting callback function to be called and that is not happening. I am also hooking createprocess and terminate process with callback functions being the members of the same class, and they are being called upon - I see the issue of "this" pointer being there as far as matching API - I am wondering why it is being an issue in those cases!
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Re: hooking clipboard apis

Post by madshi »

Try calling SetClipboardDataA/W yourself. Does that get hooked?
tallas
Posts: 14
Joined: Wed May 27, 2015 6:43 am

Re: hooking clipboard apis

Post by tallas »

I tried calling SetClipboardData, immediately after the dll_attach, I can verify that the clipboard contents at that point is what I put in using SetClipboardData call; Even this one doesn't result in SetClipboardDataCallBack( SetClipboardDataHook) being called!!!
By the way I also tried making SetClipboardDataCallBack non member of any class, rather a global function inside a cpp file, still no success.
tallas
Posts: 14
Joined: Wed May 27, 2015 6:43 am

Re: hooking clipboard apis

Post by tallas »

Do you support/recommend hooking NtUserSetClipboardData and NtUserGetClipboardData calls? If so please provide details.
tallas
Posts: 14
Joined: Wed May 27, 2015 6:43 am

Re: hooking clipboard apis

Post by tallas »

I am attempting to hook the following clipboard APIs; HookAPI returns success but none of callbacks get called. As I said, I made all the callbacks to non members of any class.
Do you a small program to demonstrate the successful hooking of these?
OpenClipboard
GetClipboardData
SetClipboardData
OleSetClipboard
OleGetClipboard
CloseClipboard
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Re: hooking clipboard apis

Post by madshi »

I don't have a demo for those APIs. Can you make a small test project which demonstrates that hooking these APIs doesn't work? Then I'll have a look at it. Which OS are we talking about? And which development system are you using exactly?
tallas
Posts: 14
Joined: Wed May 27, 2015 6:43 am

Re: hooking clipboard apis

Post by tallas »

This is windows 8.1 and development environment is Visual Studio 2013, SDK etc.
Can you think of any other things I should look into to make it work?
tallas
Posts: 14
Joined: Wed May 27, 2015 6:43 am

Re: hooking clipboard apis

Post by tallas »

c++ and Win32 ofcourse.
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Re: hooking clipboard apis

Post by madshi »

I'm not sure what it could be if HookAPI() returns success!

Can you make a small test project which demonstrates that hooking these APIs doesn't work? Then I'll have a look at it.
tallas
Posts: 14
Joined: Wed May 27, 2015 6:43 am

Re: hooking clipboard apis

Post by tallas »

It is hard for me to put together a demo. The only thing to look is if I am calling the HookAPI correctly and passing in all the parameters correctly.
And what is the significance of HookAPI returning success?
Do you know of clipboard APIs being hooked successfully before?
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Re: hooking clipboard apis

Post by madshi »

Just noticed: There is no SetClipboardDataA and SetClipboardDataW. There is only SetClipboardData.

I don't know if anybody has hooked clipboard APIs before. I would think so. Nobody has reported any specific failure to hook any API yet. So there's no reason why clipboard APIs should not be hookable, if everything else can be hooked.
tallas
Posts: 14
Joined: Wed May 27, 2015 6:43 am

Re: hooking clipboard apis

Post by tallas »

If I hook SetClipboardData, and inject that dll into a process and then in the same process if I call SetClipboradData, Is it reasonable to expect that hook be called as a result?
That was the test I did yesterday and it didn't result in hook being called. My question is, is it a correct test?
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Re: hooking clipboard apis

Post by madshi »

Yes, that sounds like a reasonable test. An even simpler test would be to hook the API and call the API in the same process, by simply doing all the stuff in one EXE project.

Have you seen my note that there is no A/W for SetClipboardData?
Post Reply