@pheber what thread ACL do you have setup? I don't see any reason why your scenario wouldn't be supported by EasyHook.
We have an inclusive ACL for the current thread (SetInclusiveACL(new[] {0})) as API Monitor tells me the nested call is happening on the same thread. Is there anything else that might be wrong with my configuration or could API Monitor be wrong?
in the end I decided to use this https://stackoverflow.com/questions/13354882/easyhook-net-remoting-sharing-interface-between-both-client-and-server
which let me keep a common instance for 2 sides communication and also pass a different interface from each client so that the communication is done different if its from a console, web service or wpf app.
@Raagh I'm looking at that stackoverflow question+answer and I don't see how that differs from just specifying the channelName and allowed client SIDs while passing in the ipcInterface instance.
@Firedragonweb I'm testing the far jump changes for #247 at the moment. Although the changes work in this scenario, I'm not convinced yet that this is a "safe" default behaviour. I'm having a think about enabling a "allow all jumps" flag that allows you to deliberately ignore these conditions under known circumstances.
@TinkerWorX unknown error in assembler code, usually refers to something not working with the code that is injected into the target process. This is a real pain to step through with the debugger, basically you have the target debugged and the host. The starting point is in the host at thread.c line 1292
WriteProcessMemory(hProc, RemoteInjectCode, GetInjectionPtr(), ...). The location is "RemoteInjectCode", so find that location within the target process and open the disassembler and add a break point. That code will be executed by a later call to NtCreateThreadEx.
The remote thread probably is failing to be created...
The ASM that is injected is returned by GetInjectionPtr() - returning either Injection_ASM_x64, or Injection_ASM_x86
@TinkerWorX take a look at this ASM code in HookSpecific_x64/x86.asm, if it is getting as far as running this code then one of the calls in here is probably failing (in the target process - so you will have to have the disassembler window open, and pointing to the correct address from RemoteInjectCode with a break point) .
Just ask questions here if you need to. End of day for me so goodnight
@spazzarama I want to use olydb64 to analyze the problem. But hooked method will be canceled. Actually I was a web developer.
I am very fresher guy in the C# area.
You should be busy on some your own problems.
Can you please tell me how to anlayze the problem ? like debug or other tricky methods.
I am very fresher guy in the C# area.
You should be busy on some your own problems.
Can you please tell me how to anlayze the problem ? like debug or other tricky methods.
not sure if that is your actual problem but it's what I had to do to get mine working. It looks like:
[UnmanagedFunctionPointer(CallingConvention.ThisCall, SetLastError = true, CharSet = CharSet.Unicode)]
[return: MarshalAs(UnmanagedType.Bool)]
delegate bool SmflAudio2_SoundBuffer_loadFromFile(IntPtr self, IntPtr filename);on the c++ side the code looks like;
sf::SoundBuffer buffer;
buffer.loadFromFile("sound.wav");
How does one convert a project which uses Easyhook (v2.7.6684) to (v2.7.6789)?
@99bobster99
\packages\EasyHook.2.7.6789\tools\install.ps1 is not digitally signed. The script will not execute on the system. For more information, see about_Execution_Policies at
http://go.microsoft.com/fwlink/?LinkID=135170.
At line:1 char:3
http://go.microsoft.com/fwlink/?LinkID=135170.
At line:1 char:3
- & 'D:\test100\Source (Zhook 2.7.6684 - WinFS v180906)\Win-FS-Reg-Redirect\packag ...
~~~~~~~~~~~~~~~~- CategoryInfo : SecurityError: (:) [], PSSecurityException
- FullyQualifiedErrorId : UnauthorizedAccess
There was an error while injecting into target:
System.ApplicationException: STATUS_INTERNAL_ERROR: Unknown error in injected C++ completion routine. (Code: 15)
at EasyHook.RemoteHooking.CreateAndInject(String InEXEPath, String InCommandLine, Int32 InProcessCreationFlags, InjectionOptions InOptions, String InLibraryPath_x86, String InLibraryPath_x64, Int32& OutProcessId, Object[] InPassThruArgs)
at test1.Program.Main(String[] args) in D:\projects\test1\Program.cs:line 57
System.ApplicationException: STATUS_INTERNAL_ERROR: Unknown error in injected C++ completion routine. (Code: 15)
at EasyHook.RemoteHooking.CreateAndInject(String InEXEPath, String InCommandLine, Int32 InProcessCreationFlags, InjectionOptions InOptions, String InLibraryPath_x86, String InLibraryPath_x64, Int32& OutProcessId, Object[] InPassThruArgs)
at test1.Program.Main(String[] args) in D:\projects\test1\Program.cs:line 57
// start and inject into a new process
EasyHook.RemoteHooking.CreateAndInject(
targetExe, // executable to run
targetArg, // command line arguments for target
0, // additional process creation flags to pass to CreateProcess
EasyHook.InjectionOptions.DoNotRequireStrongName, // allow injectionLibrary to be unsigned
injectionRegLibrary, // 32-bit library to inject (if target is 32-bit)
injectionRegLibrary, // 64-bit library to inject (if target is 64-bit)
out targetPID, // retrieve the newly created process ID
regChannelName // the parameters to pass into injected library
// ...
);