CreateFileW - Why my hook is restarted ?

c++ / delphi package - dll injection and api hooking
Post Reply
LeVuHoang
Posts: 131
Joined: Fri Oct 22, 2004 8:37 am

CreateFileW - Why my hook is restarted ?

Post by LeVuHoang »

hello all,
I tried to hook CreateFileW but when I clicked on button to start the hook. My PC was restarted.

Code: Select all

library HookFileAPIs;

{$IMAGEBASE $59800000}

uses
  madCodeHook,
  Windows,
  Dialogs,
  SysUtils,
  Registry;

type
  TFileRequest = record
    fName    : Array [0..MAX_PATH] of Char; // file name
    Process1 : Array [0..MAX_PATH] of Char; // query process
  end; { TFileRequest }

var
  StartupFolder   : String;

  CreateFileWNext : function (lpFileName: PWideChar; dwDesiredAccess, dwShareMode: DWORD; lpSecurityAttributes: PSecurityAttributes; dwCreationDisposition, dwFlagsAndAttributes: DWORD; hTemplateFile: THandle): THandle; stdcall;


function CreateFileWCallback(lpFileName: PWideChar; dwDesiredAccess, dwShareMode: DWORD; lpSecurityAttributes: PSecurityAttributes; dwCreationDisposition, dwFlagsAndAttributes: DWORD; hTemplateFile: THandle): THandle; stdcall;
begin
  Result :=CreateFileWNext(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
end; { CreateFileWCallback }

var
  Reg : TRegistry;
begin
  Reg :=TRegistry.Create;
  Reg.RootKey :=HKEY_CURRENT_USER;
  Reg.OpenKey('\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', True);
  StartupFolder :=LowerCase(Reg.ReadString('Startup'));
  Reg.CloseKey;
  Reg.Free;

  HookAPI('kernel32.dll', 'CreateFileW', @CreateFileWCallback, @CreateFileWNext);
end.
Thank you.
uall
Posts: 254
Joined: Sun Feb 20, 2005 1:24 pm

Post by uall »

do u use the library in a system wide hook?
madshi
Site Admin
Posts: 10766
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

Don't use "Dialogs" in a hook dll! That way you're linking the whole VCL into your hook dll. And that violates the hooking rules (see documentation).

Try to get along with as few units as possible. E.g. try to get along without Dialogs, SysUtils and Registry. "Windows.pas" is your friend (when writing hook dlls).
Post Reply