Hook mchInjDrv

linden · Post by **linden** » Sat Mar 19, 2005 5:57 pm

Hi,
There is a software runnning in my PC that's doing a system wide hooking using the madCodeHook library.
But I don't like it injecting hooks into every process, so I wrote a kernel mode driver to hook mchInjDrv (by monitoring its loading and patching the IAT). I hooked PsSetCreateProcessNotifyRoutine, PsLookupProcessByProcessId, ZwAllocateVirtualMemory, ZwOpenSection, and ObOpenObjectByPointer, and had them all return some unsuccessful status when called. I was able to preventing newly created process from being injected, but madCodeHook still succeeds in injecting hooks into all currently running processes.... Why??? Aren't you doing all the injection stuff in your driver?

Post by **madshi** » Tue Mar 22, 2005 8:01 am

The injection into currently running processes is done by using remote threads in user land. The driver is only used for injecting dlls into newly created processes.

Why don't you simply uninstall/delete that program, if you don't like it?