0

I try to inject a dll to a process through SetWinEventHook.

SetWinEventHook(EVENT_OBJECT_TEXTSELECTIONCHANGED, EVENT_OBJECT_TEXTSELECTIONCHANGED, NULL , HandleWinEvent, iexploreId , 0, WINEVENT_OUTOFCONTEXT))

The hooked function is called, but I don't see that the dll is loaded to the hooked process. Doesn't SetWinEventHook implement loading the dll to the hooked process?

Thanks!

1337
  • 317
  • 1
  • 9

2 Answers2

0

You are using WINEVENT_OUTOFCONTEXT parameter, which means: The callback function is not mapped into the address space of the process that generates the event.

More details Here: Out-of-Context Hook Functions http://msdn.microsoft.com/en-us/library/windows/desktop/dd373611%28v=vs.85%29.aspx

Out-of-context hook functions are located in the client's address space, whether it is in the code body or in a DLL.

Out-of-context hook functions are not mapped into the server's address space.

When an event is triggered, the parameters for the hook function are marshaled across process boundaries.

Alex F
  • 42,307
  • 41
  • 144
  • 212
0

Inject your DLL in target process using whatever method you feel suitable, and then use WINEVENT_INCONTEXT as last parameter in SetWinEventHook function.

Pratik
  • 125
  • 11