CODEWITHSUNDEEP
c++winapihook
sokie
sokie

Reputation: 1986

Hook api call in a parent process

So the current situation is this: .exe has a direct dependency ( in the IAT ) of dll1
dll1 does LoadLibrary dll2.
I want to hook ( and override ) a winapi of the exe from dll2.
I tried hooking both IAT and using minhook . But the problem is that with both I actually hook the api of dll1, not the exe.
If i hook something like MessageBox, if i call it from dll1 it works, if i call it from the exe it doesn't ( it calls original MessageBox not my hooked one ).

Upvotes: 0

Views: 553

Answers (2)

Shmuel Fomberg
Shmuel Fomberg

Reputation: 546

I'm guessing that the compiler for your DLL is creating stub functions, (that forward to the real function) and the hooking tool is hooking the stub and not the real function.
So when the EXE is calling the function, it obviously doesn't use your stub, and call the real, unhooked function.

The simple solution: get a pointer to the real function using GetProcAddress, and hook it.

Upvotes: 0

PrashanthBC
PrashanthBC

Reputation: 275

Have you tried Microsoft detours or easy hook? I have tried both and they work well. Easyhook : https://easyhook.github.io/

Upvotes: 1

Related Questions