开发者

Strange Hooking Problem : SendMessage unables to hooke the procedure while process launched normally , While it HOOKS properly in debugging mode

I am facing a strange problem regarding Hooking. I have a procedure which acts as a hooked procedure in C++/CLI, After SendMessage it unables to hook the procedure, while this is not the behavior while debugging the process in debug mode, when the hooked process is attached, successfully, all the statments of HookedProc will be observed as executed. I am unable to find the correct behavior.

This behavior is un desireable , as I have to deliver the process and use the process without using VS.

Code :

Object^ Injector::InvokeRemote(IntPtr hWnd, String^ assemblyFile, String^ typeName, String^            methodName, array<Object^>^ args)
{
    RequestMessage^ msg = gcnew RequestMessage();
    msg->AssemblyFile = assemblyFile;
    msg->TypeName = typeName;
    msg->MethodName = methodName;
    msg->Args = args;
    ::Serialize(msg);

    HINSTANCE hinstDLL = LoadLibrary((LPCTSTR) _T("InjectLib.dll"));
    DWORD threadID = GetWindowThreadProcessId((HWND)hWnd.ToPointer(), NULL);
    HOOKPROC procAddress = (HOOKPROC)GetProcAddress(hinstDLL, "MessageHookProc");
    HHOOK messageHookHandle = SetWindowsHookEx(WH_CALLWNDPROC, procAddress, hinstDLL, threadID);

    // This forces it to be loaded into the target adress space
    ::SendMessage((HWND)hWnd.ToPointer(), WM_INVOKEREMOTE, 0, 0);

     TCHAR开发者_高级运维 tValue[100];
     memset(tValue,0,100);
     DWORD ReturnValue = GetLastError();
     _stprintf(tValue,L"%d",ReturnValue);
     String^ strRetVal = gcnew String(tValue);

    ::UnhookWindowsHookEx(messageHookHandle);   

    Object^ retVal = Deserialize();
    return retVal;
}

and the followig one is the hook procedure

int __stdcall MessageHookProc(int nCode, WPARAM wParam, LPARAM lParam)
{   
    try
    {
        if (nCode == HC_ACTION)
        {
            try
            {
                if (pCW->message == WM_INVOKEREMOTE)
                {                                                           
                        String^ assemblyFile = "";
                        Assembly^ assembly = nullptr;
                        AppDomain^ currentDomain = AppDomain::CurrentDomain;
                        currentDomain->AssemblyResolve += gcnew ResolveEventHandler(HelperClass::ResolveRequestMessageAssembly);


                        RequestMessage^ msg = (RequestMessage^)Deserialize();
                        currentDomain->AssemblyResolve -= gcnew ResolveEventHandler(HelperClass::ResolveRequestMessageAssembly);                                                
                        assemblyFile = Path::Combine(Path::GetDirectoryName(Assembly::GetExecutingAssembly()->Location), msg->AssemblyFile);
                        assembly = Assembly::LoadFrom(assemblyFile);                    

                        Type^ type = assembly->GetType(msg->TypeName);              
                        Object^ retVal = type->InvokeMember(msg->MethodName, BindingFlags::Static | BindingFlags::Public | BindingFlags::InvokeMethod, nullptr, nullptr, msg->Args);
                        Serialize(retVal);                                          
                }
            }
            catch(Exception^ ex)
            {               
                 System::Windows::Forms::MessageBox::Show( ex->InnerException->ToString(), L"PAUSE", System::Windows::Forms::MessageBoxButtons::OK);
            }
        }       
    }
    catch(Object^ ex)
    {       
        IntPtr ptr = Marshal::StringToHGlobalUni(ex->ToString());
        LPCTSTR error = reinterpret_cast<LPCTSTR>(ptr.ToPointer());
        ::MessageBox(NULL, error, L"InvokeRemote Failed", MB_ICONERROR | MB_OK);
        Marshal::FreeHGlobal(ptr);
        Serialize(nullptr);
    }

    return CallNextHookEx(NULL, nCode, wParam, lParam);
}


To me this seems like a permissions/rights issue...

When debugging in VS there a so-called "Debug privilege" in play...

You can elevate your own process to contain this privilege though you need admin rights (UAC!) for that - some useful links:

http://msdn.microsoft.com/en-us/library/ff541528%28v=vs.85%29.aspx
http://msdn.microsoft.com/en-us/magazine/cc163823.aspx
http://www.codeproject.com/KB/system/accessctrl3.aspx
http://msdn.microsoft.com/en-us/library/system.security.accesscontrol.objectsecurity_methods.aspx

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜