Question

Im trying to get a basic hook going using microsoft detours. My program is able to successfully run CreateProcessWithDllEx and inject a dll. However, I cannot seem to resume the actual hooked program. I am using notepad for testing and I can see notepad.exe running in my process list, but the notepad window never actually comes up.

my dll is as follows:

#undef UNICODE
#include <cstdio>
#include <windows.h>
#include <detours.h>
#pragma comment(lib, "detours.lib")

typedef void (WINAPI *pFunc)(void);
DWORD WINAPI MyFunc(void);

pFunc FuncToDetour = (pFunc)DetourFindFunction("Winmm.dll", "timeGetTime"); //Set it at address to detour in 
//the process

extern "C" __declspec( dllexport )VOID NullExport( VOID )
{
}

INT APIENTRY DllMain(HMODULE hDLL, DWORD Reason, LPVOID Reserved)
{
  switch(Reason)
  {
    case DLL_PROCESS_ATTACH:
    {
        DisableThreadLibraryCalls(hDLL);
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        //DetourAttach(&(PVOID&)FuncToDetour, MyFunc);
        //DetourTransactionCommit();
    }
    break;
    case DLL_PROCESS_DETACH:
          DetourTransactionBegin();
          DetourUpdateThread(GetCurrentThread());
          DetourDetach(&(PVOID&)FuncToDetour, MyFunc);
          DetourTransactionCommit();
    break;
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH: 
    break;
  }
  return TRUE;
}
DWORD WINAPI MyFunc()
{
   return 0;
}

And my injector is as follows:

#undef _UNICODE
#include "stdafx.h"
#include <cstdio>
#include <windows.h>
#include <detours.h>

int main()
{
   STARTUPINFO si;
   PROCESS_INFORMATION pi;
   ZeroMemory(&si, sizeof(STARTUPINFO));
   ZeroMemory(&pi, sizeof(PROCESS_INFORMATION));
   si.cb = sizeof(STARTUPINFO);

   WCHAR DirPath[MAX_PATH+1];
   wcscpy_s(DirPath, MAX_PATH, L"C:\\Documents and Settings\\Administrator\\My Documents\\Visual Studio 2010\\Projects\\hbotinjector\\Release");

   char DLLPath[MAX_PATH+1] = "C:\\Documents and Settings\\Administrator\\My Documents\\Visual Studio 2010\\Projects\\hbotinjector\\Release\\hbotdll.dll";

   WCHAR EXE[MAX_PATH+1]={0};
   wcscpy_s( EXE, MAX_PATH, L"C:\\Documents and Settings\\Administrator\\My Documents\\Visual Studio 2010\\Projects\\hbotinjector\\Release\\notepad.exe" ); 

   STARTUPINFO _StartupInfo;
   PROCESS_INFORMATION _Information;
   ZeroMemory( &_Information, sizeof( PROCESS_INFORMATION ) );  

   if(DetourCreateProcessWithDllEx( EXE, NULL, NULL, NULL, TRUE, 
CREATE_DEFAULT_ERROR_MODE | CREATE_SUSPENDED, NULL, DirPath, &_StartupInfo, &_Information,
     DLLPath, NULL ))
     {
          MessageBoxA(NULL,"INJECTED", NULL, NULL);
          ResumeThread(_Information.hThread);
          WaitForSingleObject(_Information.hProcess, INFINITE);
     }
     else
     {
          char error[100];
          sprintf(error, "%d", GetLastError());
          MessageBoxA(NULL, error, NULL, NULL);
     }

     return 0;
 }

And I build my dll with a .def file, insuring that there is the required function at ordinal 1 for detours to work properly:

LIBRARY HBOTDLL
EXPORTS

NullExport @1

Does anyone know what is causing the process from not running? As a side note, I’ve tried it with a blank dll as well where it just contains the required function at ordinal 1 and nothing else and it seems to have identical results.

Also, my injector runs forever as long as the notepad.exe process is showing in the process list. This is in response to WaitForSingleObject, which seems to indicate the process has been spawned correctly.

Answer 1

On the comment of Hans Passant, I went back and realized that I had declared pi and si as well as _Information and _StartupInfo. I wasn’t zeroing out the second group I had created, and that was the group I was using. So I changed the call to CreateProcessWithDllEx to use &pi and &si. Everything works fine now.