AppInit_dll from codeproject.com does not work on Windows 7 x64

wfskmoney
wfskmoney used Ask the Experts™
on
Hi,

I am experimenting with AppInit_dll. I tried API hooking using this code sample: http://www.codeproject.com/Articles/49319/Easy-way-to-set-up-global-API-hooks

It is supposed to hide calc.exe from Task Manager. However it does not seem to work on Windows 7 64 bit.

I edited registry accordingly:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\AppInitHook.dll"
"LoadAppInit_DLLs"=dword:00000001
"RequireSignedAppInit_DLLs"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\AppInitHook.dll"
"LoadAppInit_DLLs"=dword:00000001
"RequireSignedAppInit_DLLs"=dword:00000000

It's still not loading...


thanks
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2012
Commented:
Hmmm, the probem is that a 32bit DLL can ony be loaded into the address space of a 32bit process, there are no translation thunks in either direction. On 64bit Windows, you shoud use 64bit DLLs for the injection to work (and their 32bit counterparts for thr WOW64 subsystem).

Author

Commented:
I see. So the hooking .dll has to be compiled fo 64bit for attaching to 64bit processes?
jkr
Top Expert 2012

Commented:
Yup, that's pretty much the gist.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial