Comments (7)
Hi Syahmi,
Are you trying to hook a function used by Deviare when it is hooking? Or the call is done by another thread after resuming them but before the Hook method return?
Regards,
Mauro.
from deviare-inproc.
Hi Mauro,
I think the call is done by another thread after resuming them but before the Hook method return if I understand you correctly.
I will show pesudo code example to illustrate the problem better.
void* lpCalculateRealtimeOrig = nullptr;
int CalculateRealtime()
{
return 1;
}
int MyCalculateRealtime()
{
return lpCalculateRealtimeOrig();
}
DWORD WINAPI Thread2(LPVOID)
{
for (;;) {
CalculateRealtime();
}
}
int main()
{
CNktHookLib hook;
CreateThread(Thread2);
// The hooking by default pauses all other threads leaving only current thread running
hook.Hook(&idCalcRt, (LPVOID*)&lpCalculateRealtimeOrig, CalculateRealtime, MyCalculateRealtime);
// Once the hooking is done, it resumes all other threads...
// However, the calls above isn't returned yet. So the lpCalculateRealtimeOrig is/might still null while the thread 2 already run.
}
Above illustrate the problem better, what should be done for safe hooking is the lplpCallOriginal is set right before hooking on this line: https://github.com/nektra/Deviare-InProc/blob/master/Src/Lib/NktHookLib.cpp#L662 instead of passing the value and assign it later after hooking is done and threads resumed here: https://github.com/nektra/Deviare-InProc/blob/master/Src/Lib/NktHookLib.cpp#L152
Regards,
from deviare-inproc.
Hi Syahmi,
Thanks for the hint. I will apply the change on next working day.
Regards.
from deviare-inproc.
Hi Syahmi,
After checking the code, you can call the Hook
method that uses the HOOK_INFO
parameter. The fields are filled before actual hooking occurs. In the other Hook
method, fields are copied from a temporary HOOK_INFO
variable to destination.
Regards,
Mauro.
from deviare-inproc.
Hi Mauro,
I think I will propose a fix for this problem. Stay tune.
Sorry, I had an unexpected errand. So I'll try to fix when there is time.
There are several ways of fixing this:
-
Move all real hooking function to this signature
DWORD CNktHookLib::RemoteHook(__out SIZE_T *lpnHookId, __out LPVOID *lplpCallOriginal, __in DWORD dwPid, __in LPVOID lpProcToHook, __in LPVOID lpNewProcAddr, __in DWORD dwFlags)
In this case, we'll get access tolplpCallOriginal
directly so we can assign it before the hooking begin or thread resumed. While the otherRemoteHook()
with theHOOK_INFO
array is passed to this function as address for example&aHookInfo[nHookIdx].lpCallOriginal
to thelplpCallOriginal
. This should give consistent result for all 4 hook functions call. So it is just flipping the function signature with some minor modification on the code. This is what I want to do in my proposal. -
This might requires more changes, by resuming thread after
lplpCallOriginal
assignment. So instead it resume the thread onRemoteHook
it resume onHook
or 3 others that call this veryRemoteHook
. This might introduce more headache than actually to solve this problem. -
Introduce
lplpCallOriginal
toHOOK_API
structure. Since it is an API change, this is my least preferred.
from deviare-inproc.
Hi Syahmi,
I uploaded a fix (among other for low IL processes). Please try it.
Regards.
from deviare-inproc.
Hi Mauro,
Sorry I couldn't get back to you earlier. The commit should fix the problem. Thanks.
from deviare-inproc.
Related Issues (20)
- [Suggestion] CreateProcessWithBuffer HOT 5
- _CrtIsValidHeapPointer(block) HOT 7
- hook .NET methods Property error
- how hook DateTime.Now
- BuildNtSysCalls fail
- build.bat issue HOT 1
- How to hook .NET methods in remote process? HOT 5
- Cannot open include file: 'source\libudis86\decode.h': No such file or directory HOT 2
- In-Proc does not fix relative jumps in trampoline functions HOT 5
- Question about Deviare-InProc HOT 2
- Is there anyway to createprocess from a dotnet exe and suspend it at its main method? HOT 2
- TEST instruction using RIP is not updated in trampoline HOT 7
- How to hook CoCreateInstance ?
- Possible to hook methods of another .net executable? HOT 3
- Possible bug in CNktHookLib::EnableHook?
- Unable to generate lib file HOT 1
- STATUS_STACK_BUFFER_OVERRUN was raised
- Doesn't build? HOT 3
- Cannot build NtkHookLib from vs2010 solution HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from deviare-inproc.