Closed bbsuuo closed 1 year ago
Process ID: 31184 │ INFO│ 02:19:51.684 │ 19:bootstrap.cpp ┃ Enter Process : '31184' Process ID: 31184 │ INFO│ 02:19:51.684 │ 20:bootstrap.cpp ┃ ModuleDirectory : 'S:\测试用\f-1' Process ID: 31184 │ INFO│ 02:19:51.684 │ 70:hook.cpp ┃ Hooking LoadLibrary and LoadLibraryEx Functions Process ID: 31184 │ INFO│ 02:19:51.684 │ 79:hook.cpp ┃ Hooking LoadLibraryW SUCCESS Process ID: 31184 │ INFO│ 02:19:51.684 │ 90:hook.cpp ┃ Hooking LoadLibraryExW SUCCESS Process ID: 31184 │ INFO│ 02:19:51.684 │ 100:hook.cpp ┃ Hooking LoadLibraryA SUCCESS Process ID: 31184 │ INFO│ 02:19:51.685 │ 111:hook.cpp ┃ Hooking LoadLibraryExA SUCCESS Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\Game.exe' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'G:\反编译\apiMonitor\apimonitor-drv-x86.sys' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\nw_elf.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\WINMM.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\Windows\System32\winmm.DLL' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\RPGMakerMVHookTS.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll' Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll' Process ID: 16076 │ INFO│ 02:20:00.457 │ 19:bootstrap.cpp ┃ Enter Process : '16076' Process ID: 16076 │ INFO│ 02:20:00.457 │ 20:bootstrap.cpp ┃ ModuleDirectory : 'S:\测试用\f-1' Process ID: 16076 │ INFO│ 02:20:00.457 │ 70:hook.cpp ┃ Hooking LoadLibrary and LoadLibraryEx Functions Process ID: 16076 │ INFO│ 02:20:00.458 │ 79:hook.cpp ┃ Hooking LoadLibraryW SUCCESS Process ID: 16076 │ INFO│ 02:20:00.458 │ 90:hook.cpp ┃ Hooking LoadLibraryExW SUCCESS Process ID: 16076 │ INFO│ 02:20:00.458 │ 100:hook.cpp ┃ Hooking LoadLibraryA SUCCESS Process ID: 16076 │ INFO│ 02:20:00.458 │ 111:hook.cpp ┃ Hooking LoadLibraryExA SUCCESS Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\Game.exe' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'G:\反编译\apiMonitor\apimonitor-drv-x86.sys' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\nw_elf.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\WINMM.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\Windows\System32\winmm.DLL' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\RPGMakerMVHookTS.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll' Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll' Process ID: 31812 │ INFO│ 02:20:03.036 │ 19:bootstrap.cpp ┃ Enter Process : '31812' Process ID: 31812 │ INFO│ 02:20:03.036 │ 20:bootstrap.cpp ┃ ModuleDirectory : 'S:\测试用\f-1' Process ID: 31812 │ INFO│ 02:20:03.036 │ 70:hook.cpp ┃ Hooking LoadLibrary and LoadLibraryEx Functions Process ID: 31812 │ INFO│ 02:20:03.036 │ 79:hook.cpp ┃ Hooking LoadLibraryW SUCCESS Process ID: 31812 │ INFO│ 02:20:03.036 │ 90:hook.cpp ┃ Hooking LoadLibraryExW SUCCESS Process ID: 31812 │ INFO│ 02:20:03.037 │ 100:hook.cpp ┃ Hooking LoadLibraryA SUCCESS Process ID: 31812 │ INFO│ 02:20:03.037 │ 111:hook.cpp ┃ Hooking LoadLibraryExA SUCCESS Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\Game.exe' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'G:\反编译\apiMonitor\apimonitor-drv-x86.sys' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\nw_elf.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\WINMM.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\Windows\System32\winmm.DLL' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\RPGMakerMVHookTS.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll' Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll' Process ID: 12164 │ INFO│ 02:20:03.104 │ 19:bootstrap.cpp ┃ Enter Process : '12164' Process ID: 12164 │ INFO│ 02:20:03.104 │ 20:bootstrap.cpp ┃ ModuleDirectory : 'S:\测试用\f-1' Process ID: 12164 │ INFO│ 02:20:03.104 │ 70:hook.cpp ┃ Hooking LoadLibrary and LoadLibraryEx Functions Process ID: 12164 │ INFO│ 02:20:03.104 │ 79:hook.cpp ┃ Hooking LoadLibraryW SUCCESS Process ID: 12164 │ INFO│ 02:20:03.104 │ 90:hook.cpp ┃ Hooking LoadLibraryExW SUCCESS Process ID: 12164 │ INFO│ 02:20:03.105 │ 100:hook.cpp ┃ Hooking LoadLibraryA SUCCESS Process ID: 12164 │ INFO│ 02:20:03.105 │ 111:hook.cpp ┃ Hooking LoadLibraryExA SUCCESS Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\Game.exe' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'G:\反编译\apiMonitor\apimonitor-drv-x86.sys' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\nw_elf.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\WINMM.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\Windows\System32\winmm.DLL' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\RPGMakerMVHookTS.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll' Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll' Process ID: 28892 │ INFO│ 02:20:48.078 │ 19:bootstrap.cpp ┃ Enter Process : '28892' Process ID: 28892 │ INFO│ 02:20:48.078 │ 20:bootstrap.cpp ┃ ModuleDirectory : 'S:\测试用\f-1' Process ID: 28892 │ INFO│ 02:20:48.078 │ 70:hook.cpp ┃ Hooking LoadLibrary and LoadLibraryEx Functions Process ID: 28892 │ INFO│ 02:20:48.078 │ 79:hook.cpp ┃ Hooking LoadLibraryW SUCCESS Process ID: 28892 │ INFO│ 02:20:48.078 │ 90:hook.cpp ┃ Hooking LoadLibraryExW SUCCESS Process ID: 28892 │ INFO│ 02:20:48.078 │ 100:hook.cpp ┃ Hooking LoadLibraryA SUCCESS Process ID: 28892 │ INFO│ 02:20:48.078 │ 111:hook.cpp ┃ Hooking LoadLibraryExA SUCCESS Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\Game.exe' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'G:\反编译\apiMonitor\apimonitor-drv-x86.sys' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\nw_elf.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\WINMM.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\Windows\System32\winmm.DLL' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\RPGMakerMVHookTS.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll' Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll'
sorry, I may have uploaded the wrong log file. This one corresponds to API Monitor. The previous one was generated separately for adding a test call
The x86Detour destructor unhooks functions
lift them to global scope and store them inside a shared or unique ptr
I understand now, I apologize for acting like a fool
You're fine, many people make this mistake!
You're fine, many people make this mistake!
Thank you very much for your guidance. I am surprised to receive a response so quickly. I have given you some rewards, and I hope you are happy
I appreciate that, but please do not feel that is necessary
I use koaloader to hijack DLLs, and then I try to hook a series of functions such as LoadLibrary
This is my code:
include "hook.h"
include "logger.h"
include "polyhook2/Detour/x86Detour.hpp"
include "polyLogger.h"
include "utill.h"
namespace ts::hook { using namespace ts;
//{ // LOG_INFO("nw.dll has been loaded."); //} return hModule; }
//{ // LOG_INFO(L"nw.dll has been loaded."); //} return hModule; }
// PLH::Log::registerLogger(logger);
}
And this is my log: Process ID: 25364 │ INFO│ 03:04:01.259 │ 19:bootstrap.cpp ┃ Enter Process : '25364' Process ID: 25364 │ INFO│ 03:04:01.259 │ 20:bootstrap.cpp ┃ ModuleDirectory : 'S:\测试用\f-2' Process ID: 25364 │ INFO│ 03:04:01.259 │ 70:hook.cpp ┃ Hooking LoadLibrary and LoadLibraryEx Functions Process ID: 25364 │ INFO│ 03:04:01.259 │ 79:hook.cpp ┃ Hooking LoadLibraryW SUCCESS Process ID: 25364 │ INFO│ 03:04:01.259 │ 90:hook.cpp ┃ Hooking LoadLibraryExW SUCCESS Process ID: 25364 │ INFO│ 03:04:01.260 │ 100:hook.cpp ┃ Hooking LoadLibraryA SUCCESS Process ID: 25364 │ INFO│ 03:04:01.260 │ 111:hook.cpp ┃ Hooking LoadLibraryExA SUCCESS Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\Game.exe' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\nw_elf.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\WINMM.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\Windows\System32\winmm.DLL' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\RPGMakerMVHookTS.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll' Process ID: 25364 │ INFO│ 03:04:01.260 │ 138:hook.cpp ┃ Testing hook with nw.dll Process ID: 25364 │ INFO│ 03:04:01.260 │ 26:hook.cpp ┃ HookLoadLibraryA 'nw.dll' Process ID: 25364 │ INFO│ 03:04:01.268 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 25364 │ INFO│ 03:04:01.268 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 25364 │ INFO│ 03:04:01.268 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 25364 │ INFO│ 03:04:01.268 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp ┃ HookLoadLibraryEXW'kernel32' Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-string-l1-1-0' Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-localization-l1-2-1' Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-datetime-l1-1-1' Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-localization-obsolete-l1-2-0' Process ID: 25364 │ INFO│ 03:04:01.272 │ 141:hook.cpp ┃ nw.dll loaded successfully Process ID: 26876 │ INFO│ 03:04:01.323 │ 19:bootstrap.cpp ┃ Enter Process : '26876' Process ID: 26876 │ INFO│ 03:04:01.323 │ 20:bootstrap.cpp ┃ ModuleDirectory : 'S:\测试用\f-2' Process ID: 26876 │ INFO│ 03:04:01.323 │ 70:hook.cpp ┃ Hooking LoadLibrary and LoadLibraryEx Functions Process ID: 26876 │ INFO│ 03:04:01.323 │ 79:hook.cpp ┃ Hooking LoadLibraryW SUCCESS Process ID: 26876 │ INFO│ 03:04:01.323 │ 90:hook.cpp ┃ Hooking LoadLibraryExW SUCCESS Process ID: 26876 │ INFO│ 03:04:01.323 │ 100:hook.cpp ┃ Hooking LoadLibraryA SUCCESS Process ID: 26876 │ INFO│ 03:04:01.323 │ 111:hook.cpp ┃ Hooking LoadLibraryExA SUCCESS Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\Game.exe' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\nw_elf.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\WINMM.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\Windows\System32\winmm.DLL' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\RPGMakerMVHookTS.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll' Process ID: 26876 │ INFO│ 03:04:01.323 │ 138:hook.cpp ┃ Testing hook with nw.dll Process ID: 26876 │ INFO│ 03:04:01.323 │ 26:hook.cpp ┃ HookLoadLibraryA 'nw.dll' Process ID: 26876 │ INFO│ 03:04:01.332 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 26876 │ INFO│ 03:04:01.332 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 26876 │ INFO│ 03:04:01.332 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 26876 │ INFO│ 03:04:01.332 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp ┃ HookLoadLibraryEXW'kernel32' Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-string-l1-1-0' Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-localization-l1-2-1' Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-datetime-l1-1-1' Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-localization-obsolete-l1-2-0' Process ID: 26876 │ INFO│ 03:04:01.336 │ 141:hook.cpp ┃ nw.dll loaded successfully Process ID: 28984 │ INFO│ 03:04:01.359 │ 19:bootstrap.cpp ┃ Enter Process : '28984' Process ID: 28984 │ INFO│ 03:04:01.359 │ 20:bootstrap.cpp ┃ ModuleDirectory : 'S:\测试用\f-2' Process ID: 28984 │ INFO│ 03:04:01.359 │ 70:hook.cpp ┃ Hooking LoadLibrary and LoadLibraryEx Functions Process ID: 28984 │ INFO│ 03:04:01.359 │ 79:hook.cpp ┃ Hooking LoadLibraryW SUCCESS Process ID: 28984 │ INFO│ 03:04:01.359 │ 90:hook.cpp ┃ Hooking LoadLibraryExW SUCCESS Process ID: 28984 │ INFO│ 03:04:01.359 │ 100:hook.cpp ┃ Hooking LoadLibraryA SUCCESS Process ID: 28984 │ INFO│ 03:04:01.359 │ 111:hook.cpp ┃ Hooking LoadLibraryExA SUCCESS Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\Game.exe' Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll' Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL' Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll' Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll' Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll' Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\nw_elf.dll' Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll' Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll' Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL' Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll' Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll' Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\WINMM.dll' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'C:\Windows\System32\winmm.DLL' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\RPGMakerMVHookTS.dll' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll' Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll' Process ID: 28984 │ INFO│ 03:04:01.360 │ 138:hook.cpp ┃ Testing hook with nw.dll Process ID: 28984 │ INFO│ 03:04:01.360 │ 26:hook.cpp ┃ HookLoadLibraryA 'nw.dll' Process ID: 28984 │ INFO│ 03:04:01.368 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 28984 │ INFO│ 03:04:01.368 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 28984 │ INFO│ 03:04:01.368 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 28984 │ INFO│ 03:04:01.368 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp ┃ HookLoadLibraryEXW'kernel32' Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-string-l1-1-0' Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-localization-l1-2-1' Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-datetime-l1-1-1' Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-localization-obsolete-l1-2-0' Process ID: 28984 │ INFO│ 03:04:01.372 │ 141:hook.cpp ┃ nw.dll loaded successfully Process ID: 31808 │ INFO│ 03:04:01.486 │ 19:bootstrap.cpp ┃ Enter Process : '31808' Process ID: 31808 │ INFO│ 03:04:01.486 │ 20:bootstrap.cpp ┃ ModuleDirectory : 'S:\测试用\f-2' Process ID: 31808 │ INFO│ 03:04:01.486 │ 70:hook.cpp ┃ Hooking LoadLibrary and LoadLibraryEx Functions Process ID: 31808 │ INFO│ 03:04:01.486 │ 79:hook.cpp ┃ Hooking LoadLibraryW SUCCESS Process ID: 31808 │ INFO│ 03:04:01.486 │ 90:hook.cpp ┃ Hooking LoadLibraryExW SUCCESS Process ID: 31808 │ INFO│ 03:04:01.487 │ 100:hook.cpp ┃ Hooking LoadLibraryA SUCCESS Process ID: 31808 │ INFO│ 03:04:01.487 │ 111:hook.cpp ┃ Hooking LoadLibraryExA SUCCESS Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\Game.exe' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\nw_elf.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\WINMM.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\Windows\System32\winmm.DLL' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\RPGMakerMVHookTS.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll' Process ID: 31808 │ INFO│ 03:04:01.487 │ 138:hook.cpp ┃ Testing hook with nw.dll Process ID: 31808 │ INFO│ 03:04:01.487 │ 26:hook.cpp ┃ HookLoadLibraryA 'nw.dll' Process ID: 31808 │ INFO│ 03:04:01.496 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 31808 │ INFO│ 03:04:01.496 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 31808 │ INFO│ 03:04:01.496 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 31808 │ INFO│ 03:04:01.496 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp ┃ HookLoadLibraryEXW'kernel32' Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-string-l1-1-0' Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-localization-l1-2-1' Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-datetime-l1-1-1' Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-localization-obsolete-l1-2-0' Process ID: 31808 │ INFO│ 03:04:01.501 │ 141:hook.cpp ┃ nw.dll loaded successfully Process ID: 27752 │ INFO│ 03:04:01.537 │ 19:bootstrap.cpp ┃ Enter Process : '27752' Process ID: 27752 │ INFO│ 03:04:01.537 │ 20:bootstrap.cpp ┃ ModuleDirectory : 'S:\测试用\f-2' Process ID: 27752 │ INFO│ 03:04:01.537 │ 70:hook.cpp ┃ Hooking LoadLibrary and LoadLibraryEx Functions Process ID: 27752 │ INFO│ 03:04:01.537 │ 79:hook.cpp ┃ Hooking LoadLibraryW SUCCESS Process ID: 27752 │ INFO│ 03:04:01.537 │ 90:hook.cpp ┃ Hooking LoadLibraryExW SUCCESS Process ID: 27752 │ INFO│ 03:04:01.537 │ 100:hook.cpp ┃ Hooking LoadLibraryA SUCCESS Process ID: 27752 │ INFO│ 03:04:01.537 │ 111:hook.cpp ┃ Hooking LoadLibraryExA SUCCESS Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\Game.exe' Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll' Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL' Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll' Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll' Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\nw_elf.dll' Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll' Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\WINMM.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\Windows\System32\winmm.DLL' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-2\RPGMakerMVHookTS.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll' Process ID: 27752 │ INFO│ 03:04:01.538 │ 138:hook.cpp ┃ Testing hook with nw.dll Process ID: 27752 │ INFO│ 03:04:01.538 │ 26:hook.cpp ┃ HookLoadLibraryA 'nw.dll' Process ID: 27752 │ INFO│ 03:04:01.547 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 27752 │ INFO│ 03:04:01.547 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 27752 │ INFO│ 03:04:01.547 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 27752 │ INFO│ 03:04:01.547 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0' Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1' Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp ┃ HookLoadLibraryEXW'kernel32' Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-string-l1-1-0' Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-localization-l1-2-1' Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-datetime-l1-1-1' Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp ┃ HookLoadLibraryEXW'api-ms-win-core-localization-obsolete-l1-2-0' Process ID: 27752 │ INFO│ 03:04:01.552 │ 141:hook.cpp ┃ nw.dll loaded successfully
Then I tried to hook these functions in API Monitor, and the result was (Just PID 31184):
Time of Day Thread Module API Return Value Error Duration
1 2:19:43.424 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000067 2 2:19:46.129 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000091 3 2:19:46.619 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000083 4 2:19:46.915 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000085 5 2:19:47.125 AM 1 nw_elf.dll LoadLibraryExW ( "kernel32", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x763e0000 0.0000083 6 2:19:47.322 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-string-l1-1-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000094 7 2:19:47.500 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-localization-l1-2-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000075 8 2:19:47.676 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-datetime-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000082 9 2:19:47.868 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-localization-obsolete-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000080 10 2:19:48.826 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000080 11 2:19:49.060 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000078 12 2:19:49.850 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000081 13 2:19:50.053 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000079 14 2:19:50.265 AM 1 WINMM.dll LoadLibraryExW ( "kernel32", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x763e0000 0.0000109 15 2:19:50.480 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-string-l1-1-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000074 16 2:19:50.697 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-localization-l1-2-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000081 17 2:19:50.910 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-datetime-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000072 18 2:19:51.105 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-localization-obsolete-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000080 19 2:19:51.309 AM 1 WINMM.dll LoadLibraryW ( "RPGMakerMVHookTS.dll" ) 0x7c4d0000 0.0039236 20 2:19:51.310 AM 1 VCRUNTIME140.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000122 21 2:19:51.488 AM 1 VCRUNTIME140.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000082 22 2:19:51.685 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000107 23 2:19:51.685 AM 4 WINMM.dll LoadLibraryExW ( "api-ms-win-appmodel-runtime-l1-1-2", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x74e50000 0.0000165 24 2:19:51.943 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000111 25 2:19:52.098 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000110 26 2:19:59.416 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000030 27 2:19:59.416 AM 1 Game.exe LoadLibraryExW ( "kernel32", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x763e0000 0.0000021 28 2:19:59.416 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-string-l1-1-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000013 29 2:19:59.416 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-localization-l1-2-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000013 30 2:19:59.416 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-datetime-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000010 31 2:19:59.416 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-localization-obsolete-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000008 32 2:19:59.441 AM 1 Game.exe LoadLibraryExW ( "S:\测试用\f-1\nw.dll", NULL, LOAD_WITH_ALTERED_SEARCH_PATH ) 0x0fd70000 0.0159886 33 2:19:59.451 AM 1 ffmpeg.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000032 34 2:19:59.451 AM 1 ffmpeg.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000021 35 2:19:59.451 AM 1 ffmpeg.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000019 36 2:19:59.451 AM 1 ffmpeg.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000017 37 2:19:59.456 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000058 38 2:19:59.457 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000043 39 2:19:59.457 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000044 40 2:19:59.457 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000043 41 2:19:59.457 AM 1 nw.dll LoadLibraryExW ( "kernel32", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x763e0000 0.0000052 42 2:19:59.457 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-string-l1-1-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000042 43 2:19:59.457 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-localization-l1-2-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000048 44 2:19:59.458 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-datetime-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000043 45 2:19:59.458 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-localization-obsolete-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000040 46 2:19:59.460 AM 1 nw_elf.dll LoadLibraryExA ( "ADVAPI32.dll", NULL, 0 ) 0x766e0000 0.0000179 47 2:20:00.428 AM 1 nw_elf.dll LoadLibraryW ( "kernel32.dll" ) 0x763e0000 0.0000073 48 2:20:00.428 AM 1 nw_elf.dll LoadLibraryW ( "kernel32.dll" ) 0x763e0000 0.0000030 49 2:20:00.428 AM 1 nw_elf.dll LoadLibraryW ( "kernel32.dll" ) 0x763e0000 0.0000019 50 2:20:00.474 AM 1 nw_elf.dll LoadLibraryW ( "kernel32.dll" ) 0x763e0000 0.0000131 51 2:20:00.482 AM 1 nw.dll LoadLibraryW ( "Kernel32.dll" ) 0x763e0000 0.0000062 52 2:20:00.483 AM 1 nw.dll LoadLibraryExA ( "WS2_32.dll", NULL, 0 ) 0x76600000 0.0000185 53 2:20:02.959 AM 1 nw.dll LoadLibraryExA ( "IPHLPAPI.DLL", NULL, 0 ) 0x74760000 0.0000128 54 2:20:02.998 AM 1 nw.dll LoadLibraryW ( "shcore.dll" ) 0x762a0000 0.0000086 55 2:20:02.998 AM 1 nw.dll LoadLibraryW ( "shcore.dll" ) 0x762a0000 0.0000028 56 2:20:02.998 AM 1 nw.dll LoadLibraryExA ( "SETUPAPI.dll", NULL, 0 ) 0x76900000 0.0008777 57 2:20:03.000 AM 1 nw.dll LoadLibraryExA ( "CFGMGR32.dll", NULL, 0 ) 0x75950000 0.0000061 58 2:20:03.001 AM 14 nw.dll LoadLibraryW ( "combase.dll" ) 0x756d0000 0.0000059 59 2:20:03.001 AM 16 nw.dll LoadLibraryExW ( "C:\WINDOWS\system32\netapi32.dll", NULL, LOAD_WITH_ALTERED_SEARCH_PATH ) 0x73040000 0.0000071 60 2:20:03.001 AM 18 nw.dll LoadLibraryExW ( "C:\WINDOWS\system32\wlanapi.dll", NULL, LOAD_WITH_ALTERED_SEARCH_PATH ) 0x79330000 0.0021257 61 2:20:03.002 AM 22 nw.dll LoadLibraryExA ( "WINHTTP.dll", NULL, 0 ) 0x73060000 0.0000065 62 2:20:03.002 AM 16 nw.dll LoadLibraryExW ( "MDMRegistration.dll", NULL, LOAD_LIBRARY_SEARCH_DEFAULT_DIRS | LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR ) NULL 87 = 参数错误。 0.0016190 63 2:20:03.004 AM 16 nw.dll LoadLibraryW ( "MDMRegistration.dll" ) 0x6b290000 0.0017297 64 2:20:03.004 AM 1 nw.dll LoadLibraryExW ( "C:\WINDOWS\system32\audioses.dll", NULL, LOAD_WITH_ALTERED_SEARCH_PATH ) 0x6c100000 0.0037564 65 2:20:03.042 AM 1 nw.dll LoadLibraryExW ( "kernel32.dll", NULL, LOAD_LIBRARY_SEARCH_DEFAULT_DIRS | LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR ) 0x763e0000 0.0000243 66 2:20:03.057 AM 1 nw.dll LoadLibraryW ( "combase.dll" ) 0x756d0000 0.0000138 67 2:20:03.249 AM 1 nw.dll LoadLibraryExA ( "dwmapi.dll", NULL, 0 ) 0x6dd10000 0.0000281 68 2:20:03.256 AM 1 nw.dll LoadLibraryW ( "uxtheme.dll" ) 0x74dd0000 0.0000052 69 2:20:03.290 AM 1 nw.dll LoadLibraryExA ( "atlthunk.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x6e320000 0.0005325 70 2:20:03.301 AM 1 nw.dll LoadLibraryExA ( "IMM32.dll", NULL, 0 ) 0x76f70000 0.0000211 71 2:20:03.660 AM 32 nw.dll LoadLibraryExW ( "C:\WINDOWS\system32\avrt.dll", NULL, LOAD_WITH_ALTERED_SEARCH_PATH ) 0x58a60000 0.0000105 72 2:20:03.805 AM 45 nw.dll LoadLibraryExW ( "xinput1_4.dll", NULL, LOAD_LIBRARY_SEARCH_DEFAULT_DIRS | LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR ) NULL 87 = 参数错误。 0.0000460 73 2:20:03.805 AM 45 nw.dll LoadLibraryW ( "xinput1_4.dll" ) 0x51550000 0.0008882 74 2:20:03.806 AM 45 nw.dll LoadLibraryExW ( "hid.dll", NULL, LOAD_LIBRARY_SEARCH_DEFAULT_DIRS | LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR ) 0x6e970000 0.0000123 75 2:22:50.034 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-appmodel-runtime-l1-1-2", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x74e50000 0.0000100
In the log, we can see that after I hooked it, calling LoadLibrary immediately generated output in the log, but afterwards there was no output from the hooked function. did I do something wrong, or is there a misunderstanding about the hooked function?