General Question Hooking a vessel's methods

[Face]

That's true. Can you think of any way to hook VESSEL2 functions for both pure VESSEL2 and pure VESSEL3, but also hook the exclusive VESSEL3 functions for pure VESSEL3?

Yes. But to make it robust, you'd need to parse the import tables of the class-holding DLL in order to get the signatures, so you can distinguish VESSEL2/3 virtual functions from custom virtual functions.

 

[escapetomsfate]

Face, I think I've found a bug in your hooking library. I'm posting it here so anyone else who uses your code knows about it too.

VesselHook::hookVtable has the line:

HANDLE hSelf = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ::GetCurrentProcessId());

This uses the flag PROCESS_ALL_ACCESS, which is the wrong size for XP/NT. From MSDN:

Windows Server 2003 and Windows XP: The size of the PROCESS_ALL_ACCESS flag increased on Windows Server 2008 and Windows Vista. If an application compiled for Windows Server 2008 and Windows Vista is run on Windows Server 2003 or Windows XP, the PROCESS_ALL_ACCESS flag is too large and the function specifying this flag fails with ERROR_ACCESS_DENIED.

This means classes won't get hooked on XP/NT. It's a simple fix, just use only the two access flags that you need for VirtualQueryEx and VirtualProtectEx:

OpenProcess(PROCESS_VM_OPERATION | PROCESS_QUERY_INFORMATION, FALSE, ::GetCurrentProcessId());

I checked the OMP source and found the same bug. If any XP users have been having trouble, this might explain it.

 

[Face]

Face, I think I've found a bug in your hooking library. I'm posting it here so anyone else who uses your code knows about it too.

VesselHook::hookVtable has the line:

HANDLE hSelf = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ::GetCurrentProcessId());

This uses the flag PROCESS_ALL_ACCESS, which is the wrong size for XP/NT. From MSDN:



This means classes won't get hooked on XP/NT. It's a simple fix, just use only the two access flags that you need for VirtualQueryEx and VirtualProtectEx:

OpenProcess(PROCESS_VM_OPERATION | PROCESS_QUERY_INFORMATION, FALSE, ::GetCurrentProcessId());

I checked the OMP source and found the same bug. If any XP users have been having trouble, this might explain it.

Thanks for the info! I've fixed that already in the OMP code of the ORL online branch: http://omp.ddns.net/hg/omp/rev/04961888cffe

I guess I never updated the hooking class ZIP, though. Sorry for that!


Face