martona / mhook

A Windows API hooking library
Other
723 stars 324 forks source link

It's not work with Mhook_Unhook #2

Open RelicOfTesla opened 10 years ago

RelicOfTesla commented 10 years ago

Only hook one api, and call the Mhook_Unhook to restore it, It's bad to TrampolineGet return NULL.

RelicOfTesla commented 10 years ago

@poizan42 @martona This problem is only after merge e58a58ca31dbe14f202b9b26315bff9f7a32598c (Merge branch 'fix-remove-max-limit-patch' ) When I switch to efa4d7e7695a1fd934250b1acadf8a630f081b5f (remove @poizan42 change), IT'S OK. My OS is win7 x64,( but build in x86 mode) //////////////////

include <mhook-lib/mhook.h>

int (WINAPI* OldMessageBoxA)( in_opt HWND hWnd, __in_opt LPCSTR lpText, in_opt LPCSTR lpCaption, __in UINT uType) = MessageBoxA;

int WINAPI NewMessageBoxA( in_opt HWND hWnd, __in_opt LPCSTR lpText, in_opt LPCSTR lpCaption, __in UINT uType) { return 0; }

int _tmain(int argc, _TCHAR* argv[]) { Mhook_SetHook((void)&OldMessageBoxA, NewMessageBoxA); Mhook_Unhook((void)&OldMessageBoxA); MessageBoxA(0, 0, 0, 0);

return 0;

}

gmmybu commented 8 years ago

In function Mhook_SetHook, ppSystemFunction is assigned to pTrampoline->codeTrampoline. In Mhook_Unhook, ppSystemFunction is passed to TrampolineGet, by comparing with pCurrent->pHookFunction to get owned pTrampoline.

In my test, unhook always return FALSE because TrampolineGet always return NULL.

This bug can be fixed by modifying function TrampolineGet pCurrent->pHookFunction to pCurrent->codeTrampoline