0

i'm hooking GetQueuedCompletionStatus function with code below:

// hook code
typedef BOOL (__stdcall * MyGetQueuedCompletionStatus)(
  _In_  HANDLE       CompletionPort,
  _Out_ LPDWORD      lpNumberOfBytes,
  _Out_ PULONG_PTR   lpCompletionKey,
  _Out_ LPOVERLAPPED *lpOverlapped,
  _In_  DWORD        dwMilliseconds
);

static BOOL __stdcall OwnGetQueuedCompletionStatus(
    __in  HANDLE CompletionPort,
    __out LPDWORD lpNumberOfBytesTransferred,
    __out PULONG_PTR lpCompletionKey,
    __out LPOVERLAPPED *lpOverlapped,
    __in  DWORD dwMilliseconds
    );    

int hook()
{
    LPVOID fnOrigGetQueuedCompletionStatus = ::GetProcAddress(LoadLibrary("kernel32.dll"),  "GetQueuedCompletionStatus");
    DWORD dwOsErr = cHookMgr.Hook(&nHookId, (LPVOID*)&(Information::Instance().pTrampolineGetQueuedCompletionStatus), fnOrigGetQueuedCompletionStatus, OwnGetQueuedCompletionStatus);
}

static BOOL __stdcall OwnGetQueuedCompletionStatus(
    __in  HANDLE CompletionPort,
    __out LPDWORD lpNumberOfBytesTransferred,
    __out PULONG_PTR lpCompletionKey,
    __out LPOVERLAPPED *lpOverlapped,
    __in  DWORD dwMilliseconds
    )
{
    return Information::Instance().pTrampolineGetQueuedCompletionStatus(CompletionPort, lpNumberOfBytesTransferred, lpCompletionKey, lpOverlapped, dwMilliseconds);
}

As you can see, fake function does nothing but i always have crashes when hooking app use it:

Problem Event Name: BEX64
Application Name: MainServer.exe
Application Timestamp: 575f98b7
Fault Module Name: test64.dll_unloaded
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 585af544
Exception Offset: 00000000000025a0
Exception Code: c0000005 Exception Data: 0000000000000008

Other hooked functions work well. How can i fix that?

Kracken
  • 662
  • 1
  • 11
  • 27
  • 1
    and for what you wait ? impossible give answer based only on this info. you need debug process, and look where/why was exception exactly – RbMm Dec 21 '16 at 22:45
  • 2
    and notable - "test64.dll_unloaded" - dll where hook is unloaded ? – RbMm Dec 21 '16 at 22:49
  • The most likely reason why GetQueuedCompletionStatus in particular is giving you trouble is that it is a blocking function, i.e., there's a much greater chance that it is running at the time you install or remove the hook. The fact that the exception is identified as being in an unloaded DLL (as RbMm observed) makes me think the problem is that you're removing the hook and unloading the hook DLL, is that so? (Once a hook is installed, there's no safe way to unload the DLL containing the hook function. Just leave it loaded.) – Harry Johnston Dec 21 '16 at 23:02
  • @HarryJohnston @RbMm no i'm not unloading dll and i install hook when process is inactive(when start with `CREATE_SUSPENDED` flag). Also i don't unhook – Kracken Dec 21 '16 at 23:07
  • 2
    with provided info can not research bug. i be advice - create self simply exe. set hook, and than call `GetQueuedCompletionStatus` - trace this call in debugger step by step. faster of all this just show problem – RbMm Dec 21 '16 at 23:11
  • code which you show useless - it not say more than you somehow set hook. `cHookMgr.Hook`, `Information::Instance().pTrampolineGetQueuedCompletionStatus` - how this worked not visible. usefull info say asm dump of GetQueuedCompletionStatus code. and may be also problem because in `kernel32.dll` `GetQueuedCompletionStatus` - is single jump to `kernelbase.dll` - where real implementation. so without asm code of hooked function and trampoline - impossible say. but the best - trace in self process call to `GetQueuedCompletionStatus` under debugger – RbMm Dec 21 '16 at 23:21

0 Answers0