Hooking works for Windows 10 users, but not for Windows 7

[shavitush]

Code:

bool redirect(bool enable, void **function, void *redirection)
{
	if(DetourTransactionBegin() != NO_ERROR)
	{
		return false;
	}

	if(DetourUpdateThread(GetCurrentThread()) != NO_ERROR)
	{
		return false;
	}

	if((enable? DetourAttach:DetourDetach)(function, redirection) != NO_ERROR)
	{
		return false;
	}

	if(DetourTransactionCommit() == NO_ERROR)
	{
		return true;
	}

	DetourTransactionAbort();

	return false;
}

typedef int(__stdcall *IsCorrectItem_t)(int);
IsCorrectItem_t g_real_IsCorrectItem = reinterpret_cast<IsCorrectItem_t>(0x005D4A2B);

int __stdcall hooked_IsCorrectItem(int nItemID)
{
	return 0;
}

// inside my function
detours::redirect(true, reinterpret_cast<void **>(&g_real_IsCashItem), hooked_IsCorrectItem);

This seems to be perfectly fine on Windows 10, but on Windows 7 it simply doesn't work. I installed the static Detours library through vcpkg.

[sharkitgood]

IsCorrectItem_t g_real_IsCorrectItem = reinterpret_cast<IsCorrectItem_t>(0x005D4A2B);

Are you sure it's an identical executable on both platforms? If not, 0x5D4A2B isn't likely to point anywhere useful; you'd want to either specify the explicit address for each expected binary version, or provide a way to seek the correct address. Note this'll also be the case if the binaries you're detouring are updated at any point in future, if that might be something you want to keep track of.

[shavitush]

@sharkitgood It definitely is; considering I am the one supplying the binary to the user running Windows 7.

My procedure is this:

1. Start the process with CreateProcessA (started suspended).
2. Call LoadLibraryA inside it by creating a remote thread. The library that is being loaded contains the code I have attached.
3. Resume the thread retrieved by CreateProcessA.

The address shouldn't ever change. It is an extremely old executable, 12 years old, that does not make use of ASLR.

I have asked a Windows 7 user to attach x32dbg to the process and what's going on. My library also changes memory at certain locations - it calls VirtualProtect to change page protection, then writes to the pointer. That also works on the Windows 7 system. However, the detours just don't work.

[sylveon]

Have you checked the return value?

[shavitush]

@appleman1232 any suggestions?

[wineggdrop]

@appleman1232 any suggestions?

try madcodehook,but it's not free

[dtarditi]

There has been no further commentary on this question. Closing.