Hooking / DLL injection

I have some applications at work that I bought.

They put information in the title bar, which we grab.  This is on XP.  There are two ways to do this.  One involves polling to see if the title bar of the app we monitor has changed.  Another involves hooking - we run a program before the apps start grab the changes to the title bar.  What is dll injection?  Is it hooking.  To essentially become part of another app we don't have code to, do we have to have a program running?

I appreciate very much the time it takes to reply.

gsgi
LVL 13
gsgiAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

DanRollinsCommented:
"DLL Injection" is the act of writing and running a global Windows Hook.  Your hook DLL will be loaded into the address space of every program.  You can then use some tricks to access the data of that program.  But it is not for the faint-of-heart, and difficult to do for even seasoned C++ programmers.  
You can start your reading here:
   Hooks
   http://msdn.microsoft.com/en-us/library/ms632589(VS.85).aspx
0
evilrixSenior Software Engineer (Avast)Commented:
You might find this useful...

"Three Ways to Inject Your Code into Another Process"
http://www.codeproject.com/KB/threads/winspy.aspx
0
itsmeandnobodyelseCommented:
If the information is in the titlebar, enumerating the top level windows and grabbing the text from them surely is senseful doing.

Installing a hook is another game. You need all admin priviliges on a system and would need to care for not opening doors to malicious programs when doing so. Moreover, spying out data from users other than yourself without the users know that they were spied out is at least questionable and may be forbidden by national laws.
0
HTML5 and CSS3 Fundamentals

Build a website from the ground up by first learning the fundamentals of HTML5 and CSS3, the two popular programming languages used to present content online. HTML deals with fonts, colors, graphics, and hyperlinks, while CSS describes how HTML elements are to be displayed.

jkrCommented:
Well yu won't need admin privileges for a Windows hook that runs in your current session (global to that session or not), see http://msdn.microsoft.com/en-us/library/ms997537.aspx ("Win32 Hooks"). Tis also injects a DLL into all running (GUI) applicationsYou'd basically check for 'WM_SETTEXT' being sent to the handle of the window that you're monitoring. The scoop would be to
LRESULT CALLBACK HookProc  (       int             nCode,  // hook code
                                WPARAM  wParam, // removal flag 
                                LPARAM  lParam  // address of structure with message 
                            )
{
    PMSG        pmsg    =       ( PMSG) lParam;
 
    if  (       0       >       nCode   ||      PM_NOREMOVE     ==      wParam) 
        {
            return      (       CallNextHookEx  (       g_hhk,
                                            nCode,
                                            wParam,
                                            lParam
                                        )
                    );
        }
 
    if  (WM_STTEXT == pmsg->message && hWndToCheck == pwmg->hwnd)
        {
            /* this one is for us, so grab the new window title here */
        }
 
    return      (       CallNextHookEx  (       g_hhk,
                                    nCode,
                                    wParam,
                                    lParam
                                )
            );
}

Open in new window

0
itsmeandnobodyelseCommented:
>>>> Well yu won't need admin privileges for a Windows hook that runs in your current session
Is there no way to keep a trojan from installing a session hook?
0
jkrCommented:
No, what happens in your session with your session's priveleges is OK (from an OS point of view).
0
itsmeandnobodyelseCommented:
>>>> from an OS point of view
Windows is an OS?   ;-)

It is always striking to experience how many open doors a windows system has. Do you know a reason why this security hole wasn't fixed?

0
gsgiAuthor Commented:
Here is the code my programmer has come up with and I appreciate any feedback, constructive critique etc.  BTW I am still not clear on when you would choose the hook over either of the createremotethread techinques mentioned.  i really appreciate your time and assistance and thought.  As stated above my goal is for each of my user sessions on a terminal server, to capture the text in the title bar of the apps that the user is using.

The code attached seems to be working.  It needs to be changed now from a dos to a background processes and tested more.  Also I am curious if there is an advantage to either createremotethread technique as presented in the link provided above by evilrix.

http://files.getdropbox.com/u/1461313/Development/HookingVersion.zip

thanks, gsgi
0
gsgiAuthor Commented:
Whoops the link above was the build, here is the code:
http://files.getdropbox.com/u/1288178/TitleHook.zip

Thanks,
gsgi
0
jkrCommented:
>>I am still not clear on when you would choose the hook over either of the
>>createremotethread techinques

Because it is way easier, more documented and more stable. Windows hooks are services provided by the system, whereas creating a remote thread leaves everything to you. And even worse, you still have to patch entry points in the remote process to get notified about a title change without having to poll.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
gsgiAuthor Commented:
Thanks.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Development

From novice to tech pro — start learning today.