search

martona / mhook

A Windows API hooking library
Other
729 stars 326 forks source link

Calling original function from within hooked function calls hooked function once again #25

Open Bonjour123 opened 5 years ago

Bonjour123 commented 5 years ago

I'm having a problem:

HookedFunction(hdc){
    DebugWrite("HookedFunction"+HtoString(hdc));
    return OriginalFunction(hdc);
}

Is writting:

 HookedFunction FFFFFFFF9C214357
 HookedFunction FFFFFFFF9C214357

I've noticed the problem when I got errors from the fact the Function was deleting an object that had already been deleted (because of the first call). This means that OriginalFunction is calling the HookedFunction once and then the "real"-untouched-original function. Is it a bug or am I missing something ? This is not the first time I'm seing it, but last time I don't remember how the error disappeared. I checked, there is no other calls to HookedFunction in my code, I 've cleaned and rebuilt my solution to be sure. And APIMonitor detects only one call to Function. And when I remove the call to OriginalFunction, I have only one "HookedFunction FFFFFFFF9C214357" instead of two in the debug file.

Bonjour123 commented 5 years ago

This time, the function is EndDoc, but I don't remember if it was the same function which was affected last time.

Bonjour123 commented 5 years ago

image

The hook is actually working good, but the problem is a conditional recursive call of EndDoc inside EndDoc, which calls obviously HookedEndDoc. To sum up, hookedEndDoc calls OriginalEndDOc (first 5 bytes of EndDoc) which in turn calls EndDoc +5 (so avoid the jump to hookedEndDoc). Then go to that **** line and call MFP_EndDoc, which is equivalent to EndDoc. So again inside hookedEndDoc, originalEndoc, EndDoc+5 but then, this time, take another branch and don't go to that line (call to MFP_EndDoc). That's why I had 2 calls to hookedEndDoc but no more.

How should I deal with it ?