Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Reverse Engineering Team Blog

07.05.05

Hook now pray later

Posted in General Posts at 11:27 am by andreageddon

I was working on a small app to hook the keyboard, i used SetWindowsHookEx function to set a WH_KEYBOARD hook. My intent was to hook the “on screen keyboard” usage. So i write my dll with my nice hook procedure, but something goes wrong. Hook seems not to work properly! My dll was made as follows:

in DllMain, case DLL_PROCESS_ATTACH:
Pointer = Open_An_Existing_File_Mapping

in hook proc:
Pointer[i] = current char;

when “typing” a key on the osk, this dll is injected in the osk process, but guess? Is the dll mapped and DllMain executed? No smile The dll is mapped, but the hook function is executed BEFORE dllmain. As a result my pointer is null, and hookprocedure crashes. Well, not really, you don’t see the standard application crash dialog! The dll crashes silently and is unmapped, so the hook won’t work. To avoid this problem i had to put dll initialization in hook procedure smile
Maybe this is due to mgrier explanations (http://blogs.msdn.com/mgrier).
Bye!
AndreaGeddon

Leave a Comment