Home/ Questions/Q 6199517
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-24T04:12:12+00:00

I am facing a strange problem regarding Hooking. I have a procedure which acts

  • 0

I am facing a strange problem regarding Hooking. I have a procedure which acts as a hooked procedure in C++/CLI, After SendMessage it unables to hook the procedure, while this is not the behavior while debugging the process in debug mode, when the hooked process is attached, successfully, all the statments of HookedProc will be observed as executed.
I am unable to find the correct behavior.

This behavior is un desireable , as I have to deliver the process and use the process without using VS.

Code :

Object^ Injector::InvokeRemote(IntPtr hWnd, String^ assemblyFile, String^ typeName, String^            methodName, array<Object^>^ args)
{
    RequestMessage^ msg = gcnew RequestMessage();
    msg->AssemblyFile = assemblyFile;
    msg->TypeName = typeName;
    msg->MethodName = methodName;
    msg->Args = args;
    ::Serialize(msg);

    HINSTANCE hinstDLL = LoadLibrary((LPCTSTR) _T("InjectLib.dll"));
    DWORD threadID = GetWindowThreadProcessId((HWND)hWnd.ToPointer(), NULL);
    HOOKPROC procAddress = (HOOKPROC)GetProcAddress(hinstDLL, "MessageHookProc");
    HHOOK messageHookHandle = SetWindowsHookEx(WH_CALLWNDPROC, procAddress, hinstDLL, threadID);

    // This forces it to be loaded into the target adress space
    ::SendMessage((HWND)hWnd.ToPointer(), WM_INVOKEREMOTE, 0, 0);

     TCHAR tValue[100];
     memset(tValue,0,100);
     DWORD ReturnValue = GetLastError();
     _stprintf(tValue,L"%d",ReturnValue);
     String^ strRetVal = gcnew String(tValue);

    ::UnhookWindowsHookEx(messageHookHandle);   

    Object^ retVal = Deserialize();
    return retVal;
}

and the followig one is the hook procedure

int __stdcall MessageHookProc(int nCode, WPARAM wParam, LPARAM lParam)
{   
    try
    {
        if (nCode == HC_ACTION)
        {
            try
            {
                if (pCW->message == WM_INVOKEREMOTE)
                {                                                           
                        String^ assemblyFile = "";
                        Assembly^ assembly = nullptr;
                        AppDomain^ currentDomain = AppDomain::CurrentDomain;
                        currentDomain->AssemblyResolve += gcnew ResolveEventHandler(HelperClass::ResolveRequestMessageAssembly);


                        RequestMessage^ msg = (RequestMessage^)Deserialize();
                        currentDomain->AssemblyResolve -= gcnew ResolveEventHandler(HelperClass::ResolveRequestMessageAssembly);                                                
                        assemblyFile = Path::Combine(Path::GetDirectoryName(Assembly::GetExecutingAssembly()->Location), msg->AssemblyFile);
                        assembly = Assembly::LoadFrom(assemblyFile);                    

                        Type^ type = assembly->GetType(msg->TypeName);              
                        Object^ retVal = type->InvokeMember(msg->MethodName, BindingFlags::Static | BindingFlags::Public | BindingFlags::InvokeMethod, nullptr, nullptr, msg->Args);
                        Serialize(retVal);                                          
                }
            }
            catch(Exception^ ex)
            {               
                 System::Windows::Forms::MessageBox::Show( ex->InnerException->ToString(), L"PAUSE", System::Windows::Forms::MessageBoxButtons::OK);
            }
        }       
    }
    catch(Object^ ex)
    {       
        IntPtr ptr = Marshal::StringToHGlobalUni(ex->ToString());
        LPCTSTR error = reinterpret_cast<LPCTSTR>(ptr.ToPointer());
        ::MessageBox(NULL, error, L"InvokeRemote Failed", MB_ICONERROR | MB_OK);
        Marshal::FreeHGlobal(ptr);
        Serialize(nullptr);
    }

    return CallNextHookEx(NULL, nCode, wParam, lParam);
}
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    To me this seems like a permissions/rights issue…

    When debugging in VS there a so-called “Debug privilege” in play…

    You can elevate your own process to contain this privilege though you need admin rights (UAC!) for that – some useful links:

    http://msdn.microsoft.com/en-us/library/ff541528%28v=vs.85%29.aspx
    http://msdn.microsoft.com/en-us/magazine/cc163823.aspx
    http://www.codeproject.com/KB/system/accessctrl3.aspx
    http://msdn.microsoft.com/en-us/library/system.security.accesscontrol.objectsecurity_methods.aspx

    • 0