My development environment is Windows Vista x64. I have a virtual machine setup with Windows Vista x64 and another one setup for Windows Vista x86.
If I build the FileMon example for both x64 and Win32 (both Debug) and run them in their respective virtual machines the x64 FileMon works as expected while the Win32 FileMon tells me that it can't find the user defined managed entry point. If I remotely
debug the process from my primary Windows Vista x64 computer I can get some more details on it and it appears that it can't find the appropriate constructor for my IEntryPoint implementation.
One thing I did notice is that in the documentation you mention that IEntryPoint needs an Initialize function yet in the FileMon example you implement a Constructor in it's place. The constructor does work so I have assumed that this is just an error
in the documentation.
I have stepped through the code as much as I can but because the error is occuring in the remote process it's not as easy to debug over the network (no debugger is installed on the virtual machines, so I am using Visual Studio remote debugging features).
From the perspective of the FileMon process, it appears to be getting a failed return code from the injected thread.
The exact error (without debugging it) is:
System.ApplicationException Unknown error code (-1073741502): The user defined managed entry point failed in the target process. Make sure that EasyHook is registered in the GAC. Refer to the event logs for more information. (Code: 13)
The event logs are empty and FileMonInject is in the GAC. Since FileMon seems to work for everyone else the only thing I can think of is that it's either related to the fact that I'm compiling on x64 (even though I'm compiling for an x86 target) or it's
a problem with Vista x86 (not Vista x64).
I can do some more debugging if it would help, just tell me where to look.