New processes not being injected

Kino · Post by **Kino** » Thu Jan 19, 2006 6:09 am

When I inject the DLL (ALL_SESSIONS | SYSTEM_PROCESSES) all current process are injected and the hooks work well. But new processes that are started do not get automatically injected. Can you think of any reason for this?

I assume the new processes are not being injected because the hook works for the current processes, but not on any new processes.

Details below:
-----------------
Static lib build (commercial)
DLL to inject is in applications root directory
Calling InjectLibrary()/UninjectLibrary() from an NT service
WinXP Pro
Visual Studio .NET 2003
Windows Server 2003 SDK

Brian Young
KinoCode, Inc.
www.kinocode.com

Post by **iconic** » Thu Jan 19, 2006 6:58 am

I assume the new processes are not being injected because the hook works for the current processes, but not on any new processes.

Nope, the flags you specified ensure that newly created processes (processes created AFTER you inject also load your library) otherwise, what good is an injection system which only injects into current process, that would defeat the whole purpose of "SYSTEM WIDE" injection.

--Iconic

Post by **iconic** » Thu Jan 19, 2006 7:11 am

I missed this line (didn't read it until now)

Calling InjectLibrary()/UninjectLibrary() from an NT service

Maybe that has something to do with it, i wouldn't know because i've never used it in a service.

--Iconic

Post by **madshi** » Thu Jan 19, 2006 7:35 am

Can you please use the ProcessExplorer from sysinternals to check whether the hook dll is loaded or not loaded into newly created processes - just to be sure?

Also please reboot your PC and try the precompiled demos shipping with madCodeHook (without running any of your software after the reboot). Do these demos work or do they show the same problem?

Kino · Post by **Kino** » Fri Jan 20, 2006 3:59 am

This problem was completely my fault. I ended up deleting the InitializeMadCHook() call in a code merge. It created some interesting results though.

If program ran first that called the InitializeMadCHook(), such as one of the precompiled demos, then my hook worked properly even with the lack of this call in my code. But, if my program ran first, without the InitializeMadCHook() call, then the demo would also have the same problem hooking new processes.

Sorry to waste your time iconic and madshi and thank you very much for the quick help with my problem!

Post by **iconic** » Fri Jan 20, 2006 4:08 am

no problem, glad it is working for you.

cheers!

--Iconic

linden · Post by **linden** » Sat Jan 21, 2006 3:52 pm

I just wonder...

Post by **madshi** » Sat Jan 21, 2006 3:59 pm

linden wrote:I just wonder...

Hi linden,

I'm sorry, but while you're right, I don't want information about how to "disable" madCodeHook being published on my forum. Virus writers could misuse this information to work around security software which is based on madCodeHook.

linden · Post by **linden** » Sat Jan 21, 2006 4:12 pm

Oh! Sorry about that

Post by **madshi** » Sat Jan 21, 2006 4:18 pm

No problem...

ren · Post by **ren** » Sun Jan 22, 2006 3:33 pm

iconic wrote:the flags you specified ensure that newly created processes (processes created AFTER you inject also load your library)

Hmm... by the way, I am using:
(ALL_SESSIONS) and (not CURRENT_PROCESS)
to avoid wasting time with system processes (I only need to hook user applications). Sometimes, on some machines, the hooking doesn't seem to work at all

I was wondering if this may be the culprit...?

Post by **madshi** » Sun Jan 22, 2006 4:07 pm

ren wrote:I was wondering if this may be the culprit...?

I don't think so.

Post by **iconic** » Tue Jan 24, 2006 9:00 pm

@ren,
The ALL_SESSIONS flag does exactly what it says, if your hook code conforms to that of madshi's hooking rules then you shouldn't have any problems.

--Iconic

denisb · Post by **denisb** » Wed Jan 25, 2006 2:31 pm

HOLD THE PHONE!!!!

Madshi...are you saying that if someone manages to prevent InitializeMadCHook() from running then this kewl code hooking technique can be rendered useless?
then maybe we're gonna have to make sure InitializeMadCHook is ran as soon as possible...even in a system driver loaded at boot time...btw is this possible? to run MadCode Hook from a system driver?

i'm kinda planning on moving to driver development since i saw that in user realm there are many ways to bypass any security software...

so i was wondering if you, madshi, ever tried hooking let's say the ndis driver from a kernel mode driver...donnow if it makes lots of sense yet

Post by **madshi** » Wed Jan 25, 2006 2:38 pm

denisb wrote:HOLD THE PHONE!!!!

Madshi...are you saying that if someone manages to prevent InitializeMadCHook() from running then this kewl code hooking technique can be rendered useless?

Well, if someone manages to prevent HookAPI or InjectLibrary from running, then madCodeHook won't work correctly, either. No big surprise here.

denisb wrote:then maybe we're gonna have to make sure InitializeMadCHook is ran as soon as possible...even in a system driver loaded at boot time...

InitializeMadCHook is needed to be called for each hook dll which was compiled with MSVC++ and is using the static lib. InitializeMadCHook doesn't even exist when using Delphi and it's not as important when using the dynamic MSVC++ lib.

denisb wrote:btw is this possible? to run MadCode Hook from a system driver?

No. madCodeHook is strictly user land only - and it will stay that way.

madshi.net

New processes not being injected

New processes not being injected

Results