EasyHook does not work for other threads

1.1k views Asked by At

I'm currently trying to hook the "MessageBeep" function in user32.dll by using EasyHook. If im running [this example][1] everything seems to work fine. But if I replace the thread-ID in lines 52 and 60 with the thread-ID of my test application the hook does not apply for the ohter program.

Why is the SetExclusiveACL-Method not accepting any other thread-Ids? e.g.

hook.ThreadACL.SetExclusiveACL(new int[] { 8788 });

I'm using the following Code to retrieve the thread-ID of my test application and to verify if the hook works on the MessageBeep function:

Sub Main()
   While True
      Console.WriteLine(GetCurrentThreadId().ToString)
      MessageBeep(&H40)
      If Console.ReadKey().KeyChar = "c"c Then
          Console.Clear()
      End If
   End While
End Sub
1

There are 1 answers

0
Kim Hoang On BEST ANSWER

If you want to hook to a target process, you need to inject your DLL into target process, EasyHook already provide the way to do it. And inside that injected DLL, you can set the LocalHook for MessageBeep. Below is sample code to do the injection using RemoteHooking.Inject

//create channel to send text data and log
RemoteHooking.IpcCreateServer<LogChannel>(ref _logChannelName, WellKnownObjectMode.Singleton);

RemoteHooking.IpcCreateServer<TextDataChannel>(
     ref _textDataChannelName, WellKnownObjectMode.Singleton);

CommandChannel = new Common.IPC.CommandChannel();

string filePath = Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location) + "\\" + INJECT_DLL_NAME;
RemoteHooking.Inject(processID,InjectionOptions.DoNotRequireStrongName,
               filePath,
               filePath,
                _logChannelName, _textDataChannelName, CommandChannel.PipeName, _pendingMsgType);

Updated: you can refer to this link https://www.codeproject.com/Articles/27637/EasyHook-The-reinvention-of-Windows-API-hooking