Easyhook can not hook wininet.dll and ws2_32.dll

Nov 7, 2009 at 4:18 AM

no matter how i tried, will always get the following exception in easyhook when I tried to hook wininet.dll and ws2_32.dll

looks like it is impossible to hook these dlls which is network related


               DllNotFoundException(string.Format("The given library is not loaded into the current process"));

 

but when i try kernal32.dll, user32.dll, there is no such problem. Anyone know if this is by design?

 

Thanks

Roger

Nov 9, 2009 at 12:44 AM

It seems the dll is not loaded when you hook it.  Do you try to load the library first before hooking the API?

Nov 9, 2009 at 3:49 AM

Hi, foonson, can you be more specific on how to load it?

I just use the FileMonInject sample project and modify a little bit for the function in wininet.dll and ws2_32.dll

The same code works for the functions in Kernal32.dll

 

Thanks

Roger

Nov 9, 2009 at 6:01 AM

For unmanaged code, before your call of LhInstallHook, call LoadLibrary first.

 

LoadLibrary("c:\\windows\\system32\\wininet.dll");

LhInstallHook(pTrueAPI, pHookAPI, lpCallback, hHook);

lStatus = LhInstallHook(pTrueAPI, pHookAPI, lpCallback, hHook);

 

 

Nov 10, 2009 at 2:22 AM

Hi, foonson, I have no idea how to use LhInstallHook(). I referenced the sample in the EasyHook. When I did the attach to the InternetConnect function unmanaged dll -Wininet.dll,

 

CreateFileHook = LocalHook.Create(
                    LocalHook.GetProcAddress("Wininet.dll", "InternetConnect"),
                    new DCreateFile(CreateFile_Hooked),
                    this);

 

This complains that "The given library is not loaded into the current process" as I mentioned in my first post.

 

But if I attached to CreateFileW in kernel32.dll which is also a unmanaged function, it is running ok

 

CreateFileHook = LocalHook.Create(
                    LocalHook.GetProcAddress("kernel32.dll", "CreateFileW"),
                    new DCreateFile(CreateFile_Hooked),
                    this);

 

So I don't know if there is anything wrong since LocalHook.Create() actually calls LhInstallHook()

 

Thanks

Roger

Nov 10, 2009 at 5:20 AM

ok.  Then please call LoadLibrary to load wininet.dll before invoking LocalHook.Create().  The whole point is wininet.dll is not loaded at the moment of hooking so that you need to load it by youself.  Kernel32.dll is almost always loaded when you hook it.

I hooked many wininet APIs (but not by managed code) and EasyHook should work.

Nov 10, 2009 at 4:11 PM

cool, it is working now, the code

 

                IntPtr handle = NativeAPI.LoadLibrary("c:\\windows\\system32\\wininet.dll");

                CreateFileHook = LocalHook.Create(
    LocalHook.GetProcAddress("wininet.dll", "InternetConnectW"),
    new DInternetConnect(InternetConnect_Hooked),
    this);
                CreateFileHook.ThreadACL.SetExclusiveACL(new Int32[] { 0 });
                NativeAPI.FreeLibrary(handle);

 

Thanks foonson