-
Notifications
You must be signed in to change notification settings - Fork 62
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Unable to hook DestroyCaret function from user32 module #4
Comments
Thanks for reporting. We are looking into this. |
Hi, @rommar!
First of all, it's a known situation, yes. Originally mhook will just fail to hook functions with such instructions in the beggining.
So the drawback of your modification is that you will call not original USER32.DestroyCaret after your hook, but something else instead. I would not recomend to do this. I will investigate the case with DestroyCaret, most probably we will add the logic that fix relative addressing for calls. |
Add ability to hook functions with call in first 5 bytes (#4)
@rommar The issue should be fixed now. Please check the latest master. |
@SergiusTheBest @Grivus Wow, you are so fast! I confirm that it is working now for both x86 and x64 builds. Thank you! |
I want to hook CreateCaret and DestroyCaret functions from user32.dll. Hooking CreateCaret works ok, but DestroyCaret - no.
In main function I have:
I studied a bit how mhook works under the hood and I see that the first call to DisassembleAndSkip in Mhook_SetHookEx returns instruction length of 5 bytes for CreateCaret, but 2 bytes for DestroyCaret. ollydbg shows that CreateCaret starts with
MOV EAX,1032
(5 bytes long) while DestroyCaret isFirst instruction for DestroyCaret is PUSH which takes 2 bytes. So DisassembleAndSkip returns 2 bytes and we go to else block where a check for IsJumpPresentInFirstFiveBytes takes place. IsJumpPresentInFirstFiveBytes returns false because it checks only for conditional jumps (ITYPE_BRANCHCC). So trampoline is not created.
Could please anyone comment on this situation? Is this a known behavior?
In IsJumpPresentInFirstFiveBytes I tried to add a check for ITYPE_CALL and return true for that and after that I see that my hook is working (gets called). Is there any drawback of such modification?
OS is Windows 7. Application type is x86.
The text was updated successfully, but these errors were encountered: