Solved

Hook CreateProcess

Posted on 2006-06-24
15
2,902 Views
Last Modified: 2008-01-09
Hi
I want to hook every created process and manage them.
Example before a process creates it give me its name and it should wait for my reply, access or deny...
Sorry for my bad english :( I hope I describe it...
0
Comment
Question by:dgn_
  • 9
  • 4
15 Comments
 
LVL 28

Expert Comment

by:ciuly
ID: 16976682
well , I think what you are looking for is maghis madhook components :)
http://www.madshi.net/madCodeHookDescription.htm
you will also have some examples there, and you can find a lot of examples on the net.

0
 

Author Comment

by:dgn_
ID: 16978522
I cannot use madCodeHook :(
can you give me working examples like i said in question ?
0
 
LVL 28

Expert Comment

by:ciuly
ID: 16981425
I'll have to ask this so that I don't waste time doing stuff you don't need:
you can't use madcodehook because you don't know how, or because there are some restrictions? if there are some restrictions, what are they?
0
 

Author Comment

by:dgn_
ID: 16982433
I can't use madcodehook because I don't know how
0
 
LVL 28

Expert Comment

by:ciuly
ID: 16983853
ok then. I'll dig you up a small demo from somewhere in a few minute. until then, if you haven't already done so, install the madshi components
0
 
LVL 28

Expert Comment

by:ciuly
ID: 16983979
so, you download the demos from madhis site (http://madshi.net/MCHDemos.zip)
in  system wide\HookProcessTermination you have an example of what you want to do: not createprocess, but terminateprocess. you should be able to easily adopt that to createprocess.

let me know if you can do that, if not, I'll find some time later on today to do it
0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 

Author Comment

by:dgn_
ID: 16990379
Very thanks for your interest but i cannot adopt it :(
0
 
LVL 28

Expert Comment

by:ciuly
ID: 16997334
ok. I will make the necessary changes for you sometime tomorrow.

btw, you are aware that createprocess is not the only function that can be used to lunch an application, right? I remember a discussion on this issue here on EE. I did a small search but couldn't find the discussion but found somthing you might look into until tomorrow when I get a chance to make the project:

http://www.experts-exchange.com/Programming/Programming_Languages/Delphi/Q_10338608.html?query=hook+createprocess&topics=85
0
 
LVL 28

Expert Comment

by:ciuly
ID: 17138129
sorry for the outage. I got some issues on my head and were not able to modify my dev environemnt for a while.
I just installed madshi components and will get back to you with a demo in the next 24 hours.

sorry for this delay
0
 
LVL 28

Expert Comment

by:ciuly
ID: 17146542
I did the hook for createprocess api function but for some reaason injecting the hook did not work. so I looked over madhi's site and found a simle example that hooks winexec:
file://localhost/C:/Program%20Files/madCollection/madBasic/help/data/ProcessApi.htm
as you notice this is from the local installation folder ;)
also, it will only work for that process.

I am working to see why the injection fails and post the projects as soon as I fix the issue.(I will go over it tomorrow)
0
 

Author Comment

by:dgn_
ID: 17151976
Thanks ciuly. I wait no prob :)
thanks
0
 
LVL 28

Expert Comment

by:ciuly
ID: 17200900
a small update. I found the issue. pretty stupid from my part, but that's what happens when someone doesn't use madcodehook too often.
the issue was that madchook.dll must be present before injecting the dll.

now that I fixed that, I am getting a lot of craches in the injecting processes. I am guessing that is might be eitehr because the ipcqueue used, or because this injects in all system processes and some system processes don't like createprocess being hooked.

I'll do some more testing next week (I am flying home this weekend :) and won't have a pc handy for the next 48-56 hours)

cheers
0
 
LVL 28

Accepted Solution

by:
ciuly earned 125 total points
ID: 17269387
for some reason I still get a few errors when injecting. maybe it's my system to blame.
try out this demo just as it is (you should get no message dialogs or whatever, just some logging in hooking.log
demo here: http://www.ciuly.com/delphi/CreateProcessHook.zip

the way to use:
- compile all 4 projects
- copy madCHook.dll from madhsi installation to the manager directory (OR, place the path to it on the PATH variable)
- copy CreateProcessHook.dll in the manager directory
- run manager.exe
- click on install and wait to finish. if you get some error messages from different applications, make them go away and let me knwo: in this case it's something with the hooking and I'll have to investigate further (maybe call in madshi to take a look :) )
- run test.exe. an empty form will appear (the one of bogus.exe) at this point you can check the logs and see that indeed the hook was called and some messages were logged.

at this stage, if no error appeared from other applications, you can safely work with manager.exe and now check the ask checkbox (you did not close the exe yet ;) ) now close the empty form and run test.exe again. you should be promted with a dialog if you want to run the exe or not and onyl after you chose yes you should see the empty form appear :)

I sure do hope there are issues on my machine as previous projects done just like this worked fine and now they also generate these errors. but in case it's not my system, I'll need to really do everything from ground 0: I must be doing something wrong then :)
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Filemaker 14 vs Delphi Embarcadero 7 161
APK file name 7 64
Delphi selector screen 2 58
find a node in VST 2 47
Introduction The parallel port is a very commonly known port, it was widely used to connect a printer to the PC, if you look at the back of your computer, for those who don't have newer computers, there will be a port with 25 pins and a small print…
In my programming career I have only very rarely run into situations where operator overloading would be of any use in my work.  Normally those situations involved math with either overly large numbers (hundreds of thousands of digits or accuracy re…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now