0

I'm trying to use EasyHook in C# to properly hook into a method from a COM object (unmanaged).

I was able to determine the address of the method of the COM object and I can properly trigger my hook function. I did it this way, being the rest of the code pretty much similar to the one in the tutorial:

SendHook = LocalHook.Create(0x12345678, new DMyFunc(MyFunc_Hooked), this);

However, once inside my hook, all parameters are scrambled (they do not equal those that I'm originally passing).

Also, I'm not able to return anything (please note that I also tried hooking another function that returns a short and the value doesn't properly return).

When I open eXescope, this is one of the function signatures:

function MyFunc(out ParamA:^BSTR; out ParamB:^bool): ^TypeA;

And this function has the following signature when I use the COM object normally in C#:

TypeA MyFunc(ref string ParamA, ref bool ParamB);

Any ideas? Thanks in advance!

Żubrówka
  • 730
  • 1
  • 10
  • 24
  • 2
    Are you accounting for the first parameter to the call being a pointer to the COM object? See here for an example of what a COM call looks like: http://www.codeproject.com/Articles/13601/COM-in-plain-C – Dark Falcon Feb 20 '13 at 17:34
  • I didn't know that but definitely I'll take that input into account, thanks!!!!! – Żubrówka Feb 20 '13 at 18:00

1 Answers1

1

I managed to solve the problem in 5 minutes after reading the article provided by Dark Falcon. I totally recommend reading it! Therefore, all credit for the answer goes to him!

Żubrówka
  • 730
  • 1
  • 10
  • 24
  • Hello Sadly it is by far not that easy as this article explains. This is a beginner article letting all the complicated stuff beside. And COM is VERY!! complicated. I noticed that setting a hook on COM interfaces brings you directly into hell. I found out that my hook has finally been set on a wrapper object in the Remote Procedure Call Runtime! (Rpcrt4.dll) instead of the functions I wanted to hook. Resulting in hooks never beeing called or even crashes! – Elmue Feb 02 '14 at 18:19