SetWindowsHookEx - Dll Injection skips first few calls

Question

I am trying to use SetWindowsHookEx to capture API calls in java.dll.

So, I created another dll and injected all the other processes using setwindowsHookEx

g_hHook = SetWindowsHookEx (WH_CALLWNDPROC, JLoadSetFunc, g_hHookDll, 0)

The problem is as follows:

When I try to capture calls from a process, I notice that my dll is bound to this process after several hooked calls have already been made.

So the problem is that my connection mechanism misses the first few calls of the connected API.

Please suggest or comment on this issue to guide me. I am terribly stuck with this.

Answer 1

I suggest the following:

• Register your hook using SetWindowsHookEx ()
• SendMessage () for a remote process using a special message that only your hook understands.
• Repeat this until your hook answers
• Call the code with which you want your hook to interact with

In short, wait for the installation to complete before attempting to use it.

Answer 2

@MSalters

A small correction: not in every process - it is loaded only for processes that import / use user32.dll, and not all use it (however, I agree that most processes really use it).

For more information, see Working with the AppInit_DLLs registry setting .

Answer 3

There is a terribly dirty hack to load a DLL into each process using the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs