Hook CreateProcess

I want to hook every created process and manage them.
Example before a process creates it give me its name and it should wait for my reply, access or deny...
Sorry for my bad english :( I hope I describe it...
Who is Participating?
2266180Connect With a Mentor Commented:
for some reason I still get a few errors when injecting. maybe it's my system to blame.
try out this demo just as it is (you should get no message dialogs or whatever, just some logging in hooking.log
demo here: http://www.ciuly.com/delphi/CreateProcessHook.zip

the way to use:
- compile all 4 projects
- copy madCHook.dll from madhsi installation to the manager directory (OR, place the path to it on the PATH variable)
- copy CreateProcessHook.dll in the manager directory
- run manager.exe
- click on install and wait to finish. if you get some error messages from different applications, make them go away and let me knwo: in this case it's something with the hooking and I'll have to investigate further (maybe call in madshi to take a look :) )
- run test.exe. an empty form will appear (the one of bogus.exe) at this point you can check the logs and see that indeed the hook was called and some messages were logged.

at this stage, if no error appeared from other applications, you can safely work with manager.exe and now check the ask checkbox (you did not close the exe yet ;) ) now close the empty form and run test.exe again. you should be promted with a dialog if you want to run the exe or not and onyl after you chose yes you should see the empty form appear :)

I sure do hope there are issues on my machine as previous projects done just like this worked fine and now they also generate these errors. but in case it's not my system, I'll need to really do everything from ground 0: I must be doing something wrong then :)
well , I think what you are looking for is maghis madhook components :)
you will also have some examples there, and you can find a lot of examples on the net.

dgn_Author Commented:
I cannot use madCodeHook :(
can you give me working examples like i said in question ?
Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

I'll have to ask this so that I don't waste time doing stuff you don't need:
you can't use madcodehook because you don't know how, or because there are some restrictions? if there are some restrictions, what are they?
dgn_Author Commented:
I can't use madcodehook because I don't know how
ok then. I'll dig you up a small demo from somewhere in a few minute. until then, if you haven't already done so, install the madshi components
so, you download the demos from madhis site (http://madshi.net/MCHDemos.zip)
in  system wide\HookProcessTermination you have an example of what you want to do: not createprocess, but terminateprocess. you should be able to easily adopt that to createprocess.

let me know if you can do that, if not, I'll find some time later on today to do it
dgn_Author Commented:
Very thanks for your interest but i cannot adopt it :(
ok. I will make the necessary changes for you sometime tomorrow.

btw, you are aware that createprocess is not the only function that can be used to lunch an application, right? I remember a discussion on this issue here on EE. I did a small search but couldn't find the discussion but found somthing you might look into until tomorrow when I get a chance to make the project:

sorry for the outage. I got some issues on my head and were not able to modify my dev environemnt for a while.
I just installed madshi components and will get back to you with a demo in the next 24 hours.

sorry for this delay
I did the hook for createprocess api function but for some reaason injecting the hook did not work. so I looked over madhi's site and found a simle example that hooks winexec:
as you notice this is from the local installation folder ;)
also, it will only work for that process.

I am working to see why the injection fails and post the projects as soon as I fix the issue.(I will go over it tomorrow)
dgn_Author Commented:
Thanks ciuly. I wait no prob :)
a small update. I found the issue. pretty stupid from my part, but that's what happens when someone doesn't use madcodehook too often.
the issue was that madchook.dll must be present before injecting the dll.

now that I fixed that, I am getting a lot of craches in the injecting processes. I am guessing that is might be eitehr because the ipcqueue used, or because this injects in all system processes and some system processes don't like createprocess being hooked.

I'll do some more testing next week (I am flying home this weekend :) and won't have a pc handy for the next 48-56 hours)

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.