Hooking GetModuleFileNameW and GetWindowTextW

May 30, 2009 at 6:25 PM

Hi,

i am trying to hook those 2 functions and someow i have problems.

For GetModuleFileNameW(...) i used this (copied from www.pinvoke.net):


 

[UnmanagedFunctionPointer(CallingConvention.StdCall,
            CharSet = CharSet.Unicode,
            SetLastError = true)]
        delegate uint DGetModuleFileNameW([In] IntPtr hModule, [Out] StringBuilder lpFilename, [In] [MarshalAs(UnmanagedType.U4)] int nSize);

        [DllImport("kernel32.dll", SetLastError = true)]
        [PreserveSig]
        static extern uint GetModuleFileNameW([In] IntPtr hModule, [Out] StringBuilder lpFilename, [In] [MarshalAs(UnmanagedType.U4)] int nSize);

        static uint GetModuleFileNameW_Hooked([In] IntPtr hModule, [Out] StringBuilder lpFilename, [In] [MarshalAs(UnmanagedType.U4)] int nSize)
        {
            Main This = (Main)HookRuntimeInfo.Callback;
            try
            {
                lock (This.Queue)
                {
                    This.Queue.Push("[" + RemoteHooking.GetCurrentProcessId() + ":" +
                        RemoteHooking.GetCurrentThreadId() + "]: \"" + "GetModuleFileNameW" + "\"");
                }
            }
            catch
            {
            }

           
            uint res = GetModuleFileNameW(hModule, lpFilename, nSize);
            return res;
        } 


Its not working. What i am doing wrong ?

Also, how would one change the result of original GetModuleFileName() and return some different string ?

 

thx in advance

Atic

May 31, 2009 at 10:47 AM

Never mind, i solved the problem with the "Marshal"-class (Copy method).