Hook from within a Windows Service: "Exception has been thrown by the target of an invocation"

Jun 19, 2012 at 10:58 AM

Hi there, has anyone found a solution to this issue. It is driving me banana's!

I am using the new version of Easyhook 2.7 Alpha 3 from within a Windows Service. I have set the dependancy path:

Config.DependencyPath = @"C:\Program Files\CompanyName\Program name\";

and registered in the GAC:

 

string[] arr = new string[2];               

arr[0] = @"C:\Program Files\CompanyName\Program name\Program name.exe";               

arr[1] = @"C:\Program Files\CompanyName\Program name\FileMonInject.dll";               

Config.DependencyPath = @"C:\Program Files\CompanyName\Program name\";               

Config.Register("Program name",arr);

 

Then when I try to hook:

RemoteHooking.Inject((int)procId,  

@"C:\Program Files\CompanyName\Program name\FileMonInject.dll", // 32-bit version (the same because AnyCPU)               

@"C:\Program Files\CompanyName\Program name\FileMonInject.dll", // 64-bit version (the same because AnyCPU)               

ChannelName// the optional parameter list...               

);

 

I get the error: "Exception has been thrown by the target of an invocation."

 

Any thoughts?

Coordinator
Jun 21, 2012 at 12:16 AM

Can you confirm that it works when not run from within a service?

Jun 21, 2012 at 6:07 PM

I can confirm that it does not run as a console application either. 

I get an exception in RemoteHook.InjectEx at the invocation of WaitForInjection:

case NativeAPI.STATUS_SUCCESS:
{
	// wait for injection completion
	HelperServiceInterface.WaitForInjection(InTargetPID); //Exception here
 } break;

If I use my dll with the FileMon or ProcessMonitor example code (ensuring that I reference the appropriate namespaces) then everything works ok. So, from this I can assume the injected dll is ok.

The problem appears to be with the console application or maybe with the way I am using/including the libraries. 

Both my project and the sample projects reference the correct version of Easyhook ( i.e. release-2.7\Build\netfx4-Debug\x64\EasyHook.dll ). They are both console applications using .Net v4.0, x86 build. And I have included all of the Easyhook dlls in the running directory. 

Any thoughts? 

Jason

p.s. As an aside this is a amazing project :-) . Very nice work. I have seen the examples work across WinXp, Vista, Windows 7 (32/64 bit).

Jun 21, 2012 at 7:11 PM

Okay, so my application fails with this exception now (stacktrace below): 

2012-06-21 20:04:56.0312|INFO|CoreInterface|Injecting - PID: 7344
2012-06-21 20:04:56.2656|ERROR|CoreInterface|Exception has been thrown by the target of an invocation.
2012-06-21 20:04:56.2656|ERROR|CoreInterface|   at EasyHook.HelperServiceInterface.WaitForInjection(Int32 InTargetPID) in C:\...\release-2.7\EasyHook\HelperServiceInterface.cs:line 126
   at EasyHook.RemoteHooking.InjectEx(Int32 InHostPID, Int32 InTargetPID, Int32 InWakeUpTID, Int32 InNativeOptions, String InLibraryPath_x86, String InLibraryPath_x64, Boolean InCanBypassWOW64, Boolean InCanCreateService, Boolean InRequireStrongName, Object[] InPassThruArgs) in C:\...\release-2.7\EasyHook\RemoteHook.cs:line 635
   at EasyHook.RemoteHooking.Inject(Int32 InTargetPID, String InLibraryPath_x86, String InLibraryPath_x64, Object[] InPassThruArgs) in C:\...\release-2.7\EasyHook\RemoteHook.cs:line 487
   at CoreInterface.HookProcess(UInt32 procId) in C:\...\CoreMonitor.cs:line 1366
2012-06-21 20:04:56.2812|ERROR|CoreInterface|No parameterless constructor defined for this object.

And this fails consistently. I am going to have to rebuild the solution from scratch to see at which point it falls over.

Coordinator
Jun 22, 2012 at 2:14 PM
Edited Jun 22, 2012 at 2:16 PM

I think the main clue here is:

No parameterless constructor defined for this object.

I agree - you should build up a simple assembly to inject and start from there. If you do get a nice simple proof, maybe post it here - it would be good I think to include something like this in the examples list. I believe it will be something to do with the way the Proc/FileMon projects work with the host application (re: sending back information via IPC) and your application not necessarily supporting it properly.

Jun 25, 2012 at 12:33 AM

Hi I thought that too so I rebuilt from the ground up again. A simple windows service that injects the dll into two applications: Notepad and Acrobat Reader. Initially, everything worked fine then I got an exception in an related piece of code. Suddenly all injections into Notepad fail with the following warning and error in the event log...

  [warning]: FAIL: Assembly.LoadFrom(c:\Easyhook\ProcessInject.dll) - System.BadImageFormatException: Could not load file or assembly 'file:///c:\Easyhook\ProcessInject.dll' or one of its dependencies. An attempt was made to load a program with an incorrect format.
File name: 'file:///c:\Easyhook\ProcessInject.dll'
   at System.Reflection.RuntimeAssembly._nLoad(AssemblyName fileName, String codeBase, Evidence assemblySecurity, RuntimeAssembly locationHint, StackCrawlMark& stackMark, IntPtr pPrivHostBinder, Boolean throwOnFileNotFound, Boolean forIntrospection, Boolean suppressSecurityChecks)
   at System.Reflection.RuntimeAssembly.InternalLoadAssemblyName(AssemblyName assemblyRef, Evidence assemblySecurity, RuntimeAssembly reqAssembly, StackCrawlMark& stackMark, IntPtr pPrivHostBinder, Boolean throwOnFileNotFound, Boolean forIntrospection, Boolean suppressSecurityChecks)
   at System.Reflection.RuntimeAssembly.InternalLoadAssemblyName(AssemblyName assemblyRef, Evidence assemblySecurity, RuntimeAssembly reqAssembly, StackCrawlMark& stackMark, Boolean throwOnFileNotFound, Boolean forIntrospection, Boolean suppressSecurityChecks)
   at System.Reflection.RuntimeAssembly.InternalLoadFrom(String assemblyFile, Evidence securityEvidence, Byte[] hashValue, AssemblyHashAlgorithm hashAlgorithm, Boolean forIntrospection, Boolean suppressSecurityChecks, StackCrawlMark& stackMark)
   at System.Reflection.Assembly.LoadFrom(String assemblyFile)
   at EasyHook.InjectionLoader.Main(String InParam)

and

[error]: Could not load assembly c:\Easyhook\ProcessInject.dll, ProcessInject, Version=1.0.0.1, Culture=neutral, PublicKeyToken=d34a061f079be347

When I inject the same dll from the same service into Acrobat Reader everything is fine. The event log reads:

[comment]: SUCCESS: Assembly.Load(ProcessInject, Version=1.0.0.1, Culture=neutral, PublicKeyToken=d34a061f079be347)

 

What I find weird is that nothing changes other than the process I am injecting into. I am running this on a 64-bit Windows 7 Home Edition system. I am using Easyhook 2.7 and the build configuration is: netfx-debug, x86.

Coordinator
Jun 25, 2012 at 3:15 AM

Ah, I think because you are using the x86 build it will not inject into 64-bit processes. Notepad is 64-bit on a 64-bit edition of Windows 7.

Try building your app against the x64 build.