Skip to content

Instantly share code, notes, and snippets.

@Meigs2
Created June 16, 2021 20:50
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Meigs2/4dc57aaf2462b59f1545671050840b4c to your computer and use it in GitHub Desktop.
Save Meigs2/4dc57aaf2462b59f1545671050840b4c to your computer and use it in GitHub Desktop.
Easyhook not working
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
namespace TestLauncherApp
{
class Program
{
[StructLayout(LayoutKind.Sequential)]
internal struct STARTUPINFO
{
uint cb;
IntPtr lpReserved;
IntPtr lpDesktop;
IntPtr lpTitle;
uint dwX;
uint dwY;
uint dwXSize;
uint dwYSize;
uint dwXCountChars;
uint dwYCountChars;
uint dwFillAttributes;
uint dwFlags;
ushort wShowWindow;
ushort cbReserved;
IntPtr lpReserved2;
IntPtr hStdInput;
IntPtr hStdOutput;
IntPtr hStdErr;
}
[StructLayout(LayoutKind.Sequential)]
internal struct PROCESS_INFORMATION
{
public IntPtr hProcess;
public IntPtr hThread;
public int dwProcessId;
public int dwThreadId;
}
[DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)]
private static extern bool CreateProcess(IntPtr lpApplicationName, string lpCommandLine, IntPtr lpProcAttribs, IntPtr lpThreadAttribs, bool bInheritHandles, uint dwCreateFlags, IntPtr lpEnvironment, IntPtr lpCurrentDir, [In] ref STARTUPINFO lpStartinfo, out PROCESS_INFORMATION lpProcInformation);
[UnmanagedFunctionPointer(CallingConvention.StdCall, SetLastError = true)]
delegate bool CreateProcess_Delegate(IntPtr lpApplicationName, string lpCommandLine, IntPtr lpProcAttribs, IntPtr lpThreadAttribs, bool bInheritHandles, uint dwCreateFlags, IntPtr lpEnvironment, IntPtr lpCurrentDir, [In] ref STARTUPINFO lpStartinfo, out PROCESS_INFORMATION lpProcInformation);
bool CreateProcess_Hook(IntPtr lpApplicationName, string lpCommandLine, IntPtr lpProcAttribs, IntPtr lpThreadAttribs, bool bInheritHandles, uint dwCreateFlags, IntPtr lpEnvironment, IntPtr lpCurrentDir, [In] ref STARTUPINFO lpStartinfo, out PROCESS_INFORMATION lpProcInformation)
{
bool result = false;
result = CreateProcess(lpApplicationName, lpCommandLine, lpProcAttribs, lpThreadAttribs, bInheritHandles,
dwCreateFlags, lpEnvironment, lpCurrentDir, ref lpStartinfo, out lpProcInformation);
try
{
// Add message to send to FileMonitor
Console.WriteLine("IT WOKRED!!!!!!");
}
catch
{
// swallow exceptions so that any issues caused by this code do not crash target process
}
return result;
}
static void Main(string[] args)
{
var p = new Program();
p.SetupHook();
var lpStartupInfo = new STARTUPINFO();
var lpProcessInformation = new PROCESS_INFORMATION();
uint flags = 0x00000000;// | DetachedProcess | CreateNoWindow;
CreateProcess((IntPtr)0, @"notepad.exe", (IntPtr)0, (IntPtr)0,
false, flags, (IntPtr)0, (IntPtr)0, ref lpStartupInfo, out lpProcessInformation);
Console.WriteLine(Marshal.GetLastWin32Error());
}
private void SetupHook()
{
var createProcessHook = EasyHook.LocalHook.Create(
EasyHook.LocalHook.GetProcAddress("kernel32.dll", "CreateProcessA"),
new CreateProcess_Delegate(CreateProcess_Hook),
this);
createProcessHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });
Console.WriteLine("Hook Installed");
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment