Click here to Skip to main content
15,899,679 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
QuestionTesting a dll Pin
jon-8022-Jul-06 2:35
professionaljon-8022-Jul-06 2:35 
QuestionRe: Testing a dll Pin
Eytukan22-Jul-06 4:56
Eytukan22-Jul-06 4:56 
AnswerRe: Testing a dll Pin
Eytukan22-Jul-06 5:01
Eytukan22-Jul-06 5:01 
GeneralRe: Testing a dll Pin
Hamid_RT22-Jul-06 7:15
Hamid_RT22-Jul-06 7:15 
QuestionMFC application crash when using activex control Pin
eranre22-Jul-06 1:07
eranre22-Jul-06 1:07 
AnswerRe: MFC application crash when using activex control Pin
A_Fa22-Jul-06 1:27
A_Fa22-Jul-06 1:27 
AnswerRe: MFC application crash when using activex control Pin
Hamid_RT22-Jul-06 7:14
Hamid_RT22-Jul-06 7:14 
QuestionCreateFile API Hook [modified] Pin
capricious_00122-Jul-06 0:15
capricious_00122-Jul-06 0:15 
Hey guys,

I'm having some issues with an import function hook. Basically when I inject my DLL into the address space of a certain process, and a hook is performed on CreateFile, the process ends up crashing.

I am using Daniel Cavalcanti's DLL injection and API Hooking source found on:
http://www.planet-source-code.com/vb...=7528&lngWId=3

I think many are familiar with this. The DLL injector works fine. Its properly attached to the process. However, when the program runs, it hooks onto CreateFile, and as you can see in the source below, it writes to a file the value of lpFileName then returns the handle of CreateFile. The filename is written to the text file and is correct, however I get an unhandled exception error after it is returned.

You can also see that in Daniel Cavalcanti's API hooking source, he has a parameter for the HookImportedFunction where you have to supply the ordinal of the function. I didnt know what the ordinal of CreateFileA is so I removed that.

I know these may be some stupid questions, but I've googled for hours to find some answers or a solution to my problem.

1) Is CreateFileA an import or export function of the Kernel32.dll Module? If its exported then I may have to change the code around a bit.

2) What is it that I could be doing wrong thats causing my program to crash?

3) What would be the ordinal of CreateFileA in Kernel32.dll?

I included the source of my DLL for your perusal and hopefully someone can help me out because I have no idea how to fix this.

Thanks in advance,

Robbie

<br />
#include <windows.h><br />
#include <Dbghelp.h><br />
#include <fstream><br />
<br />
HANDLE hCreateFile(LPCTSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE);<br />
HANDLE htstCreateFile(LPCTSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE);<br />
<br />
PVOID HookImportedFunction(const char *Dll, const char *FuncName, void *Function);<br />
DWORD HookGeneralFunction(const char *Dll, const char *FuncName, void *Function, unsigned char *backup);<br />
void NumOut(char *format, ...);<br />
<br />
DWORD createFileAddr=0;<br />
BYTE backup[6];<br />
ofstream fout("C:\\dll.txt");<br />
<br />
BOOL APIENTRY DllMain( HMODULE hModule, DWORD  fwReason, LPVOID lpReserved)<br />
{<br />
	<br />
<br />
	switch (fwReason)<br />
	{<br />
		case DLL_PROCESS_ATTACH:<br />
			{	<br />
				DisableThreadLibraryCalls(hModule); //keeps it from being re-called<br />
				fout << "In DLL process Attach" << endl;<br />
				//HookImportedFunction("Kernel32.dll", "CreateFileA", hCreateFile);<br />
				createFileAddr = HookGeneralFunction("Kernel32.dll", "CreateFileA", hCreateFile, backup);<br />
				return true;<br />
<br />
			}<br />
			break;<br />
		case DLL_THREAD_ATTACH:<br />
			fout << "In DLL thread Attach" << endl;<br />
			break;<br />
		case DLL_THREAD_DETACH:<br />
			fout << "In DLL thread detach" << endl;<br />
			fout.close();<br />
			break;<br />
		case DLL_PROCESS_DETACH:<br />
			{<br />
				fout << "In DLL Process Detach" << endl;<br />
<br />
				if(createFileAddr)<br />
					WriteProcessMemory(GetCurrentProcess(), (void*)createFileAddr, backup, 6, 0);<br />
<br />
				fout.close();<br />
				return true;<br />
<br />
			}<br />
			break;<br />
	}<br />
	return false;<br />
}<br />
<br />
HANDLE hCreateFile(LPCTSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)<br />
{<br />
<br />
	fout << "Function call to CreateFileA and lpFilename is " << lpFileName << endl;<br />
	<br />
	HANDLE fHandle = CreateFile(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);<br />
<br />
	fout << "The File handle is " << fHandle << endl;<br />
<br />
	return fHandle;<br />
}<br />
<br />
<br />
<br />
HANDLE htstCreateFile(LPCTSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)<br />
{<br />
	<br />
	//restore the bytes at MessageBox<br />
	WriteProcessMemory(GetCurrentProcess(), (void*)createFileAddr, backup, 6, 0);<br />
	<br />
	//use the true msgbox<br />
	//MessageBox(0, "Incoming Text", "HOOKED hihi!", 0);<br />
	HANDLE ret = CreateFile(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);<br />
<br />
	//restore the hook<br />
	createFileAddr = HookGeneralFunction("kernel32.dll", "CreateFileA", htstCreateFile, backup);<br />
	return ret;<br />
}<br />
<br />
<br />




-- modified at 6:15 Saturday 22nd July, 2006
AnswerRe: CreateFile API Hook Pin
Stephen Hewitt22-Jul-06 0:30
Stephen Hewitt22-Jul-06 0:30 
QuestionReading from a text file (2 q's) Pin
jon-8021-Jul-06 23:34
professionaljon-8021-Jul-06 23:34 
AnswerRe: Reading from a text file (2 q's) Pin
Garth J Lancaster22-Jul-06 0:36
professionalGarth J Lancaster22-Jul-06 0:36 
GeneralRe: Reading from a text file (2 q's) Pin
ovidiucucu22-Jul-06 1:36
ovidiucucu22-Jul-06 1:36 
GeneralRe: Reading from a text file (2 q's) Pin
Garth J Lancaster22-Jul-06 2:08
professionalGarth J Lancaster22-Jul-06 2:08 
GeneralRe: Reading from a text file (2 q's) Pin
ovidiucucu22-Jul-06 3:35
ovidiucucu22-Jul-06 3:35 
AnswerRe: Reading from a text file (2 q's) Pin
ovidiucucu22-Jul-06 1:33
ovidiucucu22-Jul-06 1:33 
GeneralThanks for the solution Pin
jon-8022-Jul-06 2:07
professionaljon-8022-Jul-06 2:07 
QuestionConvert C++ strings to C-style string (char*) in VC++ 6.0 Pin
Dhananjayak0221-Jul-06 23:31
Dhananjayak0221-Jul-06 23:31 
AnswerRe: Convert C++ strings to C-style string (char*) in VC++ 6.0 Pin
Stephen Hewitt22-Jul-06 0:35
Stephen Hewitt22-Jul-06 0:35 
AnswerRe: Convert C++ strings to C-style string (char*) in VC++ 6.0 Pin
Naveen22-Jul-06 0:38
Naveen22-Jul-06 0:38 
AnswerRe: Convert C++ strings to C-style string (char*) in VC++ 6.0 Pin
Eytukan22-Jul-06 5:11
Eytukan22-Jul-06 5:11 
GeneralRe: Convert C++ strings to C-style string (char*) in VC++ 6.0 Pin
Dhananjayak0222-Jul-06 8:43
Dhananjayak0222-Jul-06 8:43 
AnswerRe: Convert C++ strings to C-style string (char*) in VC++ 6.0 Pin
ThatsAlok23-Jul-06 21:19
ThatsAlok23-Jul-06 21:19 
Questionchange image resolution Pin
QuickDeveloper21-Jul-06 22:33
QuickDeveloper21-Jul-06 22:33 
AnswerRe: change image resolution Pin
Naveen21-Jul-06 23:13
Naveen21-Jul-06 23:13 
AnswerRe: change image resolution Pin
Hamid_RT21-Jul-06 23:36
Hamid_RT21-Jul-06 23:36 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.