Windows 10 SearchUI.exe

c++ / delphi package - dll injection and api hooking
ExPx
Posts: 34
Joined: Fri Oct 21, 2016 3:20 pm

Re: Windows 10 SearchUI.exe

Post by ExPx »

Thanks madshi for information. I added most of them in exclude list temporarily. I will also do a enumeration for suspended apps and kill them before uprate hook dll.
madshi
Site Admin
Posts: 10754
Joined: Sun Mar 21, 2004 5:25 pm

Re: Windows 10 SearchUI.exe

Post by madshi »

You could also use the latest build and *not* use the INJECT_METRO_APPS flag when calling InjectLibrary(). But of course that will include *all* Metro apps. That's probably not what you want?
ExPx
Posts: 34
Joined: Fri Oct 21, 2016 3:20 pm

Re: Windows 10 SearchUI.exe

Post by ExPx »

Disabling INJECT_METRO_APPS is not an option becuse of MS Edge hooking. I will try to terminate suspended metro apps while updating hook dll.
madshi
Site Admin
Posts: 10754
Joined: Sun Mar 21, 2004 5:25 pm

Re: Windows 10 SearchUI.exe

Post by madshi »

Well, you could do one injection for all processes except Metro processes, and a 2nd injection just for Edge?
iconic
Site Admin
Posts: 1065
Joined: Wed Jun 08, 2005 5:08 am

Re: Windows 10 SearchUI.exe

Post by iconic »

Might be worth looking into the IPackageDebugSettings COM interface and exposed Resume() method below:

https://docs.microsoft.com/en-us/window ... ngs-resume


--Iconic
madshi
Site Admin
Posts: 10754
Joined: Sun Mar 21, 2004 5:25 pm

Re: Windows 10 SearchUI.exe

Post by madshi »

Thank you, iconic - that looks really promising!! :crazy:
ExPx
Posts: 34
Joined: Fri Oct 21, 2016 3:20 pm

Re: Windows 10 SearchUI.exe

Post by ExPx »

Thanks iconic. I will try it.
iconic
Site Admin
Posts: 1065
Joined: Wed Jun 08, 2005 5:08 am

Re: Windows 10 SearchUI.exe

Post by iconic »

I haven't tried it myself so I've no idea if it will even work but as Madshi mentioned it does appear to look somewhat promising. Here's to hoping :wink:

--Iconic
raners
Posts: 5
Joined: Tue Feb 27, 2018 2:28 pm

Re: Windows 10 SearchUI.exe

Post by raners »

Can anyone expose to us if this method is working (to resume suspended processes)?
Post Reply