@joelvaneenwyk I may have time also in the next month or two to get a few things done. Will see how everything pans out.
awesome, thanks @spazzarama ! it is now up and running on my custom branch: https://ci.appveyor.com/project/joelvaneenwyk/easyhook
for x64, i looktup some walking peb codes but there are not so many sources..
Right now, I'm getting C0000005 ACCESS_VIOLATION crashes as soon as I hook GetSystemInfo on amdxc32.dll and attempt to run a DirectX game
Hi, I'm trying to inject into an application which I start with CreateProcessW in a suspended state. Now when I call RemoteHooking.Inject I get a Code: 5 in return (I guess C0000005?) When I start it in an unsuspended state the hook works, but I need to catch something that's called pretty much immediately in the main function
(I'm using C#)
@Qibbi are you using the easyhook's RemoteHooking.CreateAndInject ? If not, try that instead.
I also need to use CreateProcessW in my case as I need to set bInheritHandles to true, but as said, it doesn't matter as it's the same result regardless
I am attempting to hook a 32bit test process with a 32bit dll and injector, just like in the native c++ beep tutorial, but i am getting the error code -1073741582 with the error Unable to find the required native entry point in the given 32-bit library.
I have followed the tutorial exactly and clearly have the entry point defined in the dll:
extern "C" void __declspec(dllexport) __stdcall NativeInjectionEntryPoint(REMOTE_ENTRY_INFO * inRemoteInfo);
void __stdcall NativeInjectionEntryPoint(REMOTE_ENTRY_INFO *inRemoteInfo)
{
...etc
}
If i compile everything to 64 bit instead, and move the dll path to the 64bit library path argument in
RhInjectLibrary, it is capable of injecting into a 64bit process
I dont see the reason why it is unable to find the entry point in the 32bit version since i followed the tutorial exactly, and the exact same code works for 64bit
With EasyHook, can i hook keys on a specific keyboard?
I'm using C#
@Acidical are you using latest NuGet? The issue is probably related to what the export name ends up in 32-bit e.g. _NativeInjectionEntryPoint@4 . Check the export name using one of many dll export tools out there
@ronsig_gitlab have you attempted debugging and setting break points in the hook handler?
@Acidical to clarify, in 32-bit mode the native export is assumed to be _NativeInjectionEntryPoint@4 . I'm adding support for this to be changed in a .def EXPORTS section to NativeInjectionEntryPoint just in case.
I have checked the 32bit dlls export and it seems to be correct
And i am using a version i built myself from the github develop branch, ill try rebuilding with your new commit and see if it fixes the issue
Just read your commit and it does seem that would fix it, ill build it now
@ronsig_gitlab not sure sorry. My approach to dealing with needing to have reliable notification or IO is to write a file system filter driver. You could try hooking if you can get the address and know the calling convention, otherwise you could look at using something like API monitor to see if there is another API being used there somewhere that is suitable.
@Qibbi The only incompatibility that I have identified so far is no .NET remoting. My plan is to remove any inbuilt IPC (use MMF or names pipes if something is still required internally), and provide examples using other ipc solutions. Removing reliance on .net remoting actually won’t be that hard. I just have to find the time :)
why
anyone here?
sometimes there is down time so maybe in your region? https://www.githubstatus.com/
@spazzarama , FYI, i'm back to the grind and re-looking at formatting C#/C++ and this issue: EasyHook/EasyHook#275
impressive to see one 5 years old still getting updates