search

IlanKalendarov / PyHook

PyHook is an offensive API hooking tool written in python designed to catch various credentials within the API call.
BSD 3-Clause "New" or "Revised" License
180 stars 17 forks source link

Error for explorer.exe process #1

Open Sp00p64 opened 3 years ago

Sp00p64 commented 3 years ago

Program works for rdp etc but returns an error when hooking explorer process {'type': 'error', 'description': 'Error: expected a pointer', 'stack': 'Error: expected a pointer\n at value (frida/runtime/core.js:316)\n at <eval> (/script1.js:21)', 'fileName': 'frida/runtime/core.js', 'lineNumber': 316, 'columnNumber': 1} Tried debugging it for a bit but to no avail.

IlanKalendarov commented 3 years ago

Hey! Can you give me your OS version and frida version? Additionally try to reset the desired process because of artifacts from the last hook that may appear.

Sp00p64 commented 3 years ago

Thank you for the swift response ! The machine's OS is 64-bits Windows 10 Professionnal 10.0.19042 N/A build 19042 frida version is : 15.0.18 and the error seems to persist after process reboot and computer reboot.

IlanKalendarov commented 3 years ago

This is weird, I couldn't reproduce your error in any way. Can you try to run as local admin and see if it will work that way ?

Sp00p64 commented 3 years ago

Running as Local admin throws the same error unfortunately. I'll try running it on another machine of mine, I'll update you on the results

Sp00p64 commented 3 years ago

Hi sorry about the delay, I ran the program again on an updated machine and the error was gone ! But sadly after hooking the explorer process and entering a correct password in the UAC prompt no password was found. Could it be the fact that i'm running this on 64 bits machines ?

IlanKalendarov commented 3 years ago

No, It should work. Did you run the latest version? Also hooking the UAC window works for when you open a program as a different user

Sp00p64 commented 3 years ago

Yes I did run the latest version and it is very strange indeed,I'll provide a video and more details in the near future