@pheber what thread ACL do you have setup? I don't see any reason why your scenario wouldn't be supported by EasyHook.
We have an inclusive ACL for the current thread (SetInclusiveACL(new[] {0})) as API Monitor tells me the nested call is happening on the same thread. Is there anything else that might be wrong with my configuration or could API Monitor be wrong?
WriteProcessMemory(hProc, RemoteInjectCode, GetInjectionPtr(), ...)
. The location is "RemoteInjectCode", so find that location within the target process and open the disassembler and add a break point. That code will be executed by a later call to NtCreateThreadEx.
[UnmanagedFunctionPointer(CallingConvention.ThisCall, SetLastError = true, CharSet = CharSet.Unicode)]
[return: MarshalAs(UnmanagedType.Bool)]
delegate bool SmflAudio2_SoundBuffer_loadFromFile(IntPtr self, IntPtr filename);
on the c++ side the code looks like;
sf::SoundBuffer buffer;
buffer.loadFromFile("sound.wav");
// start and inject into a new process
EasyHook.RemoteHooking.CreateAndInject(
targetExe, // executable to run
targetArg, // command line arguments for target
0, // additional process creation flags to pass to CreateProcess
EasyHook.InjectionOptions.DoNotRequireStrongName, // allow injectionLibrary to be unsigned
injectionRegLibrary, // 32-bit library to inject (if target is 32-bit)
injectionRegLibrary, // 64-bit library to inject (if target is 64-bit)
out targetPID, // retrieve the newly created process ID
regChannelName // the parameters to pass into injected library
// ...
);