CallingUnmanagedModule returns a ProcessModule but UnmanagedStackTrace returns empty array

Apr 2, 2010 at 10:44 PM
Edited Apr 2, 2010 at 10:49 PM

I have written a sample application in C# to hook the InternetConnect call of WININET.dll.

1> In the hook handler when i do a HookRuntimeInfo.CallingUnmanagedModule.ModuleName i get the name of urlmon.dll. However when i do a HookRuntimeInfo.UnmanagedStackTrace, the array obtained is empty. How is this possible when HookRuntimeInfo.CallingUnmanagedModule is able to find an unmanaged module on the stack? Am i doing something wrong ?

This.Queue.Push(HookRuntimeInfo.CallingUnmanagedModule.ModuleName);

Module []modules = HookRuntimeInfo.ManagedStackTrace;
ProcessModule[] procModules = HookRuntimeInfo.UnmanagedStackTrace;

 for (int i = 0; i < modules.Length; i++)
 This.Queue.Push(modules[i].Name);

 for (int i = 0; i < procModules.Length; i++)
This.Queue.Push(procModules[i].ModuleName);

2> Calling HookRuntimeInfo.ManagedStackTrace returns Easyhook.dll and the name of my injected DLL. Is this call supposed to return  the injected Dll and easyhook.dll in the stack trace ?