Double hook issue

c++ / delphi package - dll injection and api hooking
Post Reply
rr97
Posts: 2
Joined: Wed Sep 07, 2022 7:08 am

Double hook issue

Post by rr97 »

Hey madshi.

We have been trying to hook both "GetKeyState" and "GetAsyncKeyState" via the "HookApi" function and we are experiencing some weird behavior.
The hook order is : 1.GetKeyState, 2.GetAsyncKeyState , The first hook is placed fine but the second one (GetAsync..) is placed only to be immediately removed because of the "double hook" detection in the following code:

Image

(I have confirmed that this is the case by simply debugging it and stepping into it)
The machine is Win 10 X64 bit.

Both of this API's reside in the same module. (Which is USER32.dll)
If we only hook one of them then it works fine, but the combination of both leads to the undesired behavior (The second API is hooked only to be unhooked)

Any suggestions? are we missing something?

Thanks & good day.
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Re: Double hook issue

Post by madshi »

Can you please show me your "HookAPI()" call code? Are you using the same "NextHook" function variable for both API hooks? That's usually when the "double hook" error comes up. You need to use a separate "NextHook" variable for each and every API hook.
rr97
Posts: 2
Joined: Wed Sep 07, 2022 7:08 am

Re: Double hook issue

Post by rr97 »

Hey thanks for the fast reply, seems like that was the issue.
Fixed and working.

Highly appreciated.
iconic
Site Admin
Posts: 1065
Joined: Wed Jun 08, 2005 5:08 am

Re: Double hook issue

Post by iconic »

Glad your issue is resolved by Madshi's suggestion, for future reference, see below please =]
6. Each API hook needs its own callback function and its own "NextHook" variable. Don't try to save code by using callback functions and/or NextHook variables twice.
Hooking rules can be located here: http://help.madshi.net/HookingRules.htm

--Iconic
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Re: Double hook issue

Post by madshi »

Good point. The "hooking rules" are always worth a read... :D
Post Reply