SetWindowsHookEx for injection

On viernes, 28 de enero de 2011 0 comentarios

There are a number of disadvantages:

(1) SetWindowsHookEx only affects applications of the *current* session.
(2) SetWindowsHookEx doesn't inject into system processes, IIRC.
(3) SetWindowsHookEx doesn't inject unless a process uses user32.dll, I think.
(4) Uninjection is much more stable when using madCodeHook's DLL injection functionality, because madCodeHook makes sure that all APIs are unhooked *before* the DLL is unloaded. Which means that the unhooking is done outside of DllMain. When uninjecting with SetWindowsHookEx, the API hooks are uninstalled in DllMain, which makes uninjection quite a bit more unstable.
(5) I think you need some privileges to execute SetWindowsHookEx, too. Not admin rights, but some rights. I would guess that SetWindowsHookEx doesn't affect all processes if you run it from say a guest account in Windows 7. And you can't start SetWindowsHookEx from a service. With madCodeHook you can install a service and then every user can inject DLLs through the service, if you program it this way.

by madshi

0 comentarios:

Publicar un comentario