Skip to content

GetWindowExW and LdrLoadDll not working #70

@callmeteus

Description

@callmeteus

I'm trying to normally hook GetWindowExW and LdrLoadDll, both of them doesn't work.
My experience with assembly is not the best, so I'm strugling to understand why it's in fact failing.

I know that my signatures are correct, I really think the problem is inside the DDetours library itself.

Here's a sample code for LdrLoadDll:

type
    NTSTATUS = Cardinal;
    PUNICODE_STRING = ^UNICODE_STRING;

    UNICODE_STRING = packed record
        Length: Word;
        MaximumLength: Word;
        Buffer: PWideChar;
    end;

implementation

var
    // LdrLoadDll
    LdrLoadDllHook: function(pDllPath: PWideChar; dwFlags: DWORD; pUniModuleName: PUNICODE_STRING; var pResultInstance: PPointer): NTSTATUS; stdcall = nil;

function OurLdrLoadDll(
    pDllPath: PWideChar;
    dwFlags: DWORD;
    pUniModuleName: PUNICODE_STRING;
    var pResultInstance: PPointer
): NTSTATUS; stdcall;
begin
    Result := NTSTATUS($C0000022);
end;

begin
    BeginHooks;
    @LdrLoadDllHook := InterceptCreate(GetProcAddress(GetModuleHandleW('ntdll.dll'), 'LdrLoadDll'), @OurLdrLoadDll);
    EndHooks;
end.

I'm getting the following exception when LdrLoadDll gets called:
http://prntscr.com/1wnlfdc

It seems like it's trying to compare some invalid memory (that is pointing to 0x0000001):
http://prntscr.com/1wnljhh

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions