Question

I’m still trying to fully understand hooking and how easyhook works.
I’ve now written a simple example: a form that contains a webbrowser element, and i’m trying to hook recv calls made from that. When compiling, the program returns this error:

A first chance exception of type 'System.NotSupportedException' occurred in EasyHook.dll
System.NotSupportedException: STATUS_NOT_SUPPORTED:  (Code: 0)
   at EasyHook.NativeAPI.Force(Int32 InErrorCode)
   at EasyHook.RemoteHooking.InjectEx(Int32 InHostPID, Int32 InTargetPID, Int32 InWakeUpTID, Int32 InNativeOptions, String InLibraryPath_x86, String InLibraryPath_x64, Boolean InCanBypassWOW64, Boolean InCanCreateService, Object[] InPassThruArgs)
   at EasyHook.RemoteHooking.Inject(Int32 InTargetPID, InjectionOptions InOptions, String InLibraryPath_x86, String InLibraryPath_x64, Object[] InPassThruArgs)
   at Hook_Test.Form1.Run() in I:\Documents and Settings\Meme\Desktop\SimpleHook\Hook Test\Hook Test\Form1.cs:line 46

at line 46, I’ve this code:

            RemoteHooking.Inject(
                Process.GetCurrentProcess().Id,
                InjectionOptions.Default,
                "TestInject.dll",
                "TestInject.dll",
                ChannelName);

I can’t really see where the problem is, can somebody help me out?

Answer 1

In the documentation for the Inject method of the RemoteHooking class it says:

Even if it would technically be possible to inject a library for debugging purposes into the current process, it will throw an
exception. This is because it heavily depends on your injected library
whether the current process will be damaged. Any kind of communication
may lead into deadlocks if you hook the wrong APIs. Just use the
capability of Visual Studio to debug more than one process
simultaneously which will allow you to debug your library as if it
would be injected into the current process without running into any
side-effects.

It seems that this is by design. You may need to split your project into two apps, or else use shell or threading to launch instances (at least) of things outside of the current process.