Failed to inject dwm.exe in windows 8. #1

rel1ve opened this Issue Apr 8, 2012 · 2 comments


None yet
3 participants

rel1ve commented Apr 8, 2012

Hi siwu,

I hope you could see this post.

DWM has some changes during past 4 years. One are privilege requirement to access dwm.exe, and it is easy to fix.
But dwm restarts immidiately when inject interop.dwmaxxlib.dll into it, and the injection failed.

I guess there is some anti-injected protection in dwm.exe, and issue is what should we do?


there are no problems with DLL injection into dwm.exe under Windows 8. You just need to have admin privileges, then it works.

Main problems are that DWM under Windows 8 is totally rewritten. It uses Direct3D 11 instead of 10.1, but method ID3D11DeviceContext::Draw seems to be called for overlay windows only (e.g. menu, tooltip etc.). Also drawing seems to be completely done via Direct2D which I have not managed to hook yet.

But yes, there is some antihook protection, but it seems to be in Windows 7 too. When hooking device::Draw method, the function pointer is restored to original one after a while. This can be bypassed by background thread which periodically hook Draw method again and again. But it's a more workaround than real solution.


steeve commented Jan 13, 2013

Did you guys try dwmaxx2?

steeve closed this Jan 13, 2013

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment