Having trouble with microsoft detours

Question

I'm trying to do some basic hooking with microsoft detours and I can't get it to work. I've used essentially the code that was posted in this thread:

How can I hook Windows functions in C/C++?

but no dice. I updated the send/receive functions in the DLL code to simply log the data to a file, and I tried having the main program hook into the "internet checkers" program, but a log file never gets created, so it appears that the dll wasn't injected.

I'm running Windows 7 64-bit, Visual Studio 10.0, Detours 3.0 (my environment appears to be set up correctly, no issues building or anything). I created a DLL project, pasted in the DLL code from the link above, with send/recv updated as such:

FILE * pSendLogFile;
fopen_s(&pSendLogFile, "C:\\SendLog.txt", "a+");
fprintf(pSendLogFile, "%s\n", buf);
fclose(pSendLogFile);

and compiled. Then created another project, pasted in the main code from the link above, set it to look for the chkrzm.exe program (checkers), and hardcoded the DLL path to:

fullPath = "C:\\Users\\PM\\Documents\\Programs\\C Code\\Test\\DLLTester2\\Debug\\DLLTester2.dll";

and ran it, but no dice. Any idea why I can't get this to work?

The sample code you are using is missing all error checking. You'll have no way to diagnose failure. You'll need to fix that, always check function return values, use GetLastError() to get an error code when the function failed. — Hans Passant, Dec 24 '11 at 15:01
Hey thanks for the heads up. I peppered the main code with calls to GetLastError () and it looks like when I call CreateRemoteThread (), it is exiting with an error code of 5 - "access is denied". I tried running visual studio as admin but that didn't help; looked into some more and coincidentally found an old post by you on some other forum regarding the same issue: — Paavan M, Dec 25 '11 at 05:21
"It is a highly privileged operation, as privileged as it gets. Use the Technet forums to chase the security problem. Meanwhile, are you trying to inject 32-bit code into a 64-bit process? No can do." How do I know if the process is 32/64 bit, and if the dll I'm injecting is 32/64 bit? I assumed that some programs, eg. textpad, which install themselves under the program x86 folder are 32-bit...is that true? Thanks for any further assistance. — Paavan M, Dec 25 '11 at 05:24

score 2 · Accepted Answer · edited May 23 '17 at 11:52

FYI got this solved. To see which processes are 32-bit, just ctrl-alt-delete and go to the task manager; 32-bit processes are listed with *32 next to them. Also got my hook working; here is the code. I abandoned the CreateRemoteThread approach and just used a system-wide hook. I stitched the code together from:

How to hook external process with SetWindowsHookEx and WH_KEYBOARD http://www.codingthewheel.com/archives/how-i-built-a-working-online-poker-bot-4 http://www.codingthewheel.com/archives/how-i-built-a-working-online-poker-bot-7

This program simply reverses text in 32-bit processes (as shown in the last link above). Eg. open up textpad and hover over menus; their text should get reversed.

The dll:

#include <windows.h>
#include <detours.h>
#include <stdio.h>
#include <iostream>
using namespace std;


// Initial stuff
#ifdef _MANAGED
#pragma managed(push, off)
#endif

#pragma comment( lib, "Ws2_32.lib" )
#pragma comment( lib, "detours.lib" )

#pragma data_seg("Shared")
HHOOK   g_hHook  = NULL;
#pragma data_seg()


// Globals
HINSTANCE  g_hInstance = NULL;


// ExtTextOut - original
BOOL (WINAPI * Real_ExtTextOut)(HDC hdc, int X, int Y, UINT options, const RECT* lprc, LPCTSTR text, UINT cbCount, const INT* lpSpacingValues) = ExtTextOut;

// ExtTextOut - overridden
BOOL WINAPI Mine_ExtTextOut(HDC hdc, int X, int Y, UINT options, const RECT* lprc, LPCTSTR text, UINT cbCount, const INT* lpSpacingValues)
{
    if (!text)
        return TRUE;

    // Make a copy of the supplied string..safely
    LPWSTR szTemp = (LPWSTR)LocalAlloc(0, (cbCount+1) * 2);
    memcpy(szTemp, text, cbCount*2); // can't use strcpy here
    szTemp[cbCount] = L'\0'; // append terminating null

    // Reverse it..
    wcsrev(szTemp);

    // Pass it on to windows...
    BOOL rv = Real_ExtTextOut(hdc, X, Y, options, lprc, szTemp, cbCount, lpSpacingValues);

    // Cleanup
    LocalFree(szTemp);

    return TRUE;
}


// DLLMain
BOOL APIENTRY DllMain( HANDLE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved  )
{
    switch (ul_reason_for_call)
    {
        case DLL_PROCESS_ATTACH:
            g_hInstance  = (HINSTANCE) hModule;

            DetourTransactionBegin(); 
            DetourUpdateThread(GetCurrentThread());
            DetourAttach(&(PVOID&)Real_ExtTextOut, Mine_ExtTextOut); // <- magic
            DetourTransactionCommit();
            break;

        case DLL_PROCESS_DETACH:
            DetourTransactionBegin(); 
            DetourUpdateThread(GetCurrentThread());
            DetourDetach(&(PVOID&)Real_ExtTextOut, Mine_ExtTextOut);
            DetourTransactionCommit();
            break;
    }

    return TRUE;
}


// CBT Hook - dll is hooked into all processes (only 32 bit processes on my machine)
LRESULT CALLBACK CBTProc(int nCode, WPARAM wParam, LPARAM lParam)
{
    if (nCode < 0)
        return CallNextHookEx(g_hHook, nCode, wParam, lParam);

    // Return 0 to allow window creation/destruction/activation to proceed as normal.
    return 0;
}


// Install hook
extern "C" __declspec(dllexport) bool install()
{
    g_hHook = SetWindowsHookEx(WH_CBT, (HOOKPROC) CBTProc, g_hInstance, 0);

    return g_hHook != NULL;
}


// Uninstall hook
extern "C" __declspec(dllexport) void uninstall()
{
    if (g_hHook)
    {
        UnhookWindowsHookEx(g_hHook);
        g_hHook = NULL;
    }
}

The main program:

#include <Windows.h>
#include <stdio.h>
#include <tchar.h>
#include <iostream>
using namespace std;


// Main
int _tmain(int argc, _TCHAR* argv[])
{
    // Load dll
    HINSTANCE hinst = LoadLibrary(_T("C:\\Users\\PM\\Documents\\Programs\\C Code\\Test\\DLLTesterFinal\\Debug\\DLLTesterFinal.dll")); 

    if (hinst)
    {
        // Get functions
        typedef bool (*Install)();
        typedef void (*Uninstall)();
        Install install = (Install) GetProcAddress(hinst, "install");
        Uninstall uninstall = (Uninstall) GetProcAddress(hinst, "uninstall");
        cout << "GetLastError1: " << GetLastError () << endl << endl;

        // Install hook
        bool hookInstalledSuccessfully = install ();
        cout << "GetLastError2: " << GetLastError () << endl;
        cout << "Hook installed successfully? " << hookInstalledSuccessfully << endl << endl;

        // At this point, go to a 32-bit process (eg. textpad, chrome) and hover over menus; their text should get reversed
        cout << "Text should now be reversed in 32-bit processes" << endl;
        system ("Pause");

        // Uninstall hook
        uninstall();
        cout << endl << "GetLastError3: " << GetLastError () << endl;
        cout << "Done" << endl;
        system ("Pause");
    }

    return 0;
}

However upon trying to detour ExtTextOut in a java application, the java app crashes; need to investigate that.

score 1 · Answer 2 · edited May 31 '12 at 10:35

1

I'm running Windows 7 64-bit, Visual Studio 10.0

You have to run the MS DETOUR INJECT as administrator user on WIN7. To validate the working detour code use the samples for detour 3.0 use make target test.

cmd>$Path/Detours Express 3.0>nmake test

edited May 31 '12 at 10:35

Darshana

2,462
6
28
54

answered May 30 '12 at 18:00

DrInternet

11
1

Having trouble with microsoft detours

2 Answers2

Linked