m417z
commented
3 weeks ago Hi Valentin,
Thank you for the great feedback. I spent a lot of time and effort in Windhawk, I'm happy to see that it's appreciated!
I have to say that I'm also impressed by your projects, mainly Explorer Patcher but others too. I recommended it to some friends, many users, and mentioned it in several blog posts. Also, as you probably know, some bits of your work were ported to Windhawk mods.
Regarding your question:
writing a kernel mode driver. I mean, that's a possibility as well, idk, I am curious to hear your opinion on this but it is not my main question today.
The short answer, from my blog post: "I wanted Windhawk to be able to run even without administrator rights. And in general, I preferred to avoid installing a driver which is too intrusive to my taste and can affect the system's stability". Having to worry about the driver signature is yet another reason to avoid it. With all the downsides, I felt that it's not worth it.
since
services.execannot be injected (it being PPL WinTcb)
Normally not, but people find workarounds from time to time, and Microsoft fixes them, sometimes quickly, sometimes not so much. Recently, I stumbled upon a new method: https://github.com/Slowerzs/PPLSystem. It's not sustainable for the long term but can be helpful depending on your goal.
Do you think a mechanism for somehow notifying Windhawk to trigger its internal "scan for processes/inject new processes" thing would make sense (something simple, like a named event, for example?)
Yes, I think it's a great idea, allowing for more customization opportunities without much effort or downsides.
The nifty thing about Windhawk is that instead of releasing a new version for testing a small fix or feature, I can create a mod :) So here's a small mod that adds this functionality, and some simple C++ code that demonstrates the usage of the new event: https://gist.github.com/m417z/5811d5eda32fc33b86c5053f2b54b16c
Note that I also added a mechanism for waiting for the Windhawk module to initialize by waiting for the CreateProcessInternalW hook to be placed. It's not very elegant, but should be fairly reliable. If I end up adding this feature to Windhawk, it'd probably be a good idea to add an event with the PID in the name that will be signaled when initialization is done.
One downside of this implementation is that the named event won't be available in sandboxed UWP apps. Not sure if the feature is even relevant for them.
Another possibility I think would be to load
windhawk.dllin process and call theInjectInitexport, I think?
That's possible in theory, but it wouldn't be very convenient as InjectInit expects to receive some data that has to be prepared for it.
the path to
windhawk.dllis not that easily obtainable
The relative path to the up-to-date engine folder can be obtained from C:\Program Files\Windhawk\windhawk.ini. The reason it's not a fixed path is that upon an update or reinstall, some DLLs might be locked, e.g. because they're loaded in suspended processes. In this case, instead of asking for a reboot, a different folder is created.
valinet
namazso
Hi
First of all, I have to admit, yeah, I am a really big fan of this project. Good job, and hats off - from UI, mod deployment to coding and injection, everything is state of the art so to say - textbook example. Really glad to see this open sourced and so well maintained, congratulations.
Now, I have a small question: I have read the technicality behind this. Indeed, Windows does not have any proper hook/in time notification mechanism for when a new process is created, short of writing a kernel mode driver. I mean, that's a possibility as well, idk, I am curious to hear your opinion on this but it is not my main question today.
The main question is, so to say, how to help Windhawk more effectively inject these processes that it injects late? For example, since
services.execannot be injected (it being PPL WinTcb), usually Windhawk fails to inject in time for most services, which is not that great. Now, depending on what we want to inject, there could be workarounds. For one of my needs, I have written a proxy stub forwarder DLL that I place in the same folder, beside the target executable. Because of DLL load order, my custom proxy DLL is loaded, which forwards all exported functions of the original to the original DLL via a symlink in the same folder to the original DLL. Now, my question would be, how to "help" Windhawk properly with this DLL? Right now, what I do is simplySleep(1000)there, which gives enough time for Windhawk to pick up the new process, inject it and still have the process in a pristine state, since most threads haven't stated yet, while the loader still loads imported DLLs in the executable.But like,
Sleep(1000)is hacky. Do you think a mechanism for somehow notifying Windhawk to trigger its internal "scan for processes/inject new processes" thing would make sense (something simple, like a named event, for example?). Another possibility I think would be to loadwindhawk.dllin process and call theInjectInitexport, I think? Although yeah, the way it is right now, the path towindhawk.dllis not that easily obtainable, maybe add some registry path that specifies it? Otherwise,FindFirstFile& co for listing directories in Windhawk'sEnginefolder in reverse alphabetical order and picking the first entry? What's your recommmendation on this use case, any advice or direction for making such functionality official?Again, thank you for this great product.
@valinet