Odd behaviour with demo?

c++ / delphi package - dll injection and api hooking
Post Reply
Rayomand
Posts: 5
Joined: Mon Oct 03, 2005 6:00 pm

Odd behaviour with demo?

Post by Rayomand »

I am using VC++.
I built a debug version of the HookFindNext demo dll.
I wrote a test driving application that does the following:
...
InjectLibrary(CURRENT_SESSION, "HookFindNextFile.dll");
...
call FindNextFile(...)
...

I but breakpoints in both FindNextFileACallback and FindNextFileWCallback in the demo dll.

I expected that either one or the other breakpoint would be hit.

What actually happens is that the call to FindNextFile from the test app causes the breakpoint in FindNextFindFileACallback to be hit. As soon as FindNextFindACallback calls FindNextFileANext, this causes FindNextFileWCallback to be invoked.

I must be doing (or not doing) something very elementary here. Please advise.
dcsoft
Posts: 380
Joined: Sat Dec 11, 2004 2:11 am
Location: San Francisco Bay Area, CA USA
Contact:

Post by dcsoft »

I believe on 2K/XP, this is normal. The 'A' functions just turn around and call the 'W' functions, since everyhing is implemented in UNICODE in 2K/XP. Your 2 hooks are being called as expected.

-- David
madshi
Site Admin
Posts: 10766
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

Yep, David is right, this is normal behaviour.

- In the NT family a lot of "A" APIs internally call the "W" APIs.
- In the 9x family a lot of "W" APIs internally call the "A" APIs.
Post Reply