MessageBox changing memory in hooked function?

c++ / delphi package - dll injection and api hooking
Post Reply
mrbrdo
Posts: 26
Joined: Tue Nov 15, 2005 5:42 pm

MessageBox changing memory in hooked function?

Post by mrbrdo »

Hello madshi.

Since you made your lib commercial i cannot use your great codehook lib, but i had something where i needed hooking now, so i went to do it in C++ with Microsoft's Detours library.

I am wondering if your library has this problem also:
I hook CopyFileExW, and in the first line i call a MessageBox (A or W does not matter). After it completes, the lpExistingFileName is changed (???) to something like 'MSCTF.CheckThreadInptIdle.Event.MJE.MDALIJDK' or in general 'MSCTF.CheckThreadInptIdle.Event.'random'.'random. I tried then MessageBoxEx with same result, and i tried creating a delphi form imported from a delphi dll, but then the lpExistingFileName string became 'user32.dll'. Note i never pass anything relevant to MessageBox.. Example of a call i make: MessageBoxA(0, "X", "X", MB_OK); and the next line is the call to the next/original API, but the lpExistingFileName parameter is screwed up.
I solved it temporarily by first copying the lpExistingFileName (it's the first parameter btw) to a temp buffer and then passing that to the original/next API, and then it works. But this doesn't solve anything because for as much as i know other parameters may change in some other case, and this is also a performance hit.

Any ideas, i really hope you can shed some light on this!
Thanks!
Jan B.
Post Reply