Good afternoon
Try to hook the FindNextFileW to hide a filke from Explorer.
Hook sucessfully .
Try to build the Callback but not enough luck for it
There is someone to give me some help to find the way ?
Thanks for the time
Public Function NowFindnextfile_call(ByVal hFindFile As Long, pFindFileData As WIN32_FIND_DATA) As Long
If (pFindFileData.cFileName) = "TEST.EXE" Then
NowFindnextfile_call = -1
End If
End Function
in my screenshot hook the W and A also
http://img168.imageshack.us/img168/2921/screen0wa.jpg
p.s Someone point me how to solve this
thanks guys
Good afternoon las talopes... spanish please
mmm es griego asi que dudo que pueda hablar en español
Que le pregunte a "Zorba" :D
Cita de: Dessa en 4 Marzo 2009, 00:26 AM
Que le pregunte a "Zorba" :D
jaja buenisimo...
can you post the code?
anyway, that function is called from anywhere?
check that with OutputDebugString!
bye
Thanks for the replys
This is the code from my module
Option Explicit
Private Declare Function FindFirstFile Lib "kernel32" Alias "FindFirstFileA" _
(ByVal lpFileName As String, lpFindFileData As WIN32_FIND_DATA) As Long
Private Declare Function FindNextFile Lib "kernel32" Alias "FindNextFileW" (ByVal hFindFile As Long, lpFindFileData As WIN32_FIND_DATA) As Long
'Private Declare Function FindNextFile Lib "kernel32" Alias "FindNextFileW" (ByVal hFindFile As Long, lpFindFileData As WIN32_FIND_DATA) As Long
' The FindClose Win32 API function, which closes the search handle created by the FindFirstFile function
Private Declare Function FindClose Lib "kernel32" (ByVal hFindFile As Long) As Long
' The INVALID_HANDLE_VALUE is return value, which indicates that the FindFirstFile function failed
Private Const INVALID_HANDLE_VALUE As Long = -1
' File name is limited to MAX_PATH characters
Private Const MAX_PATH As Integer = 260
' The FILETIME structure is a 64-bit value representing date and time of file
Private Type FILETIME
dwLowDateTime As Long
dwHighDateTime As Long
End Type
' The WIN32_FIND_DATA structure that we need to receive the FindFirstFile and the FindNextFile functions output
Private Type WIN32_FIND_DATA
dwFileAttributes As Long
ftCreationTime As FILETIME
ftLastAccessTime As FILETIME
ftLastWriteTime As FILETIME
nFileSizeHigh As Long
nFileSizeLow As Long
dwReserved0 As Long
dwReserved1 As Long
cFileName As String * MAX_PATH
cAlternateFileName As String * 14
End Type
' The SYSTEMTIME structure represents a date and time
Private Type SYSTEMTIME
wYear As Integer
wMonth As Integer
wDayOfWeek As Integer
wDay As Integer
wHour As Integer
wMinute As Integer
wSecond As Integer
wMilliseconds As Integer
End Type
Private Const sbuff As String = "TEST.EXE"
Public Function Findnextfile_call(ByVal hFindFile As Long, pFindFileData As WIN32_FIND_DATA) As Long
Dim wfd As WIN32_FIND_DATA
If (wfd.cFileName) = "TEST.EXE" Then
Findnextfile_call = -1
end if
End Function
and call my hook like this
Set Hookapis = New clsHookInfo
Process = OpenProcess(PROCESS_ALL_ACCESS, 0, GetCurrentProcessId)
Hookapis.HookApi "kernel32", "FindNextFileA", GetFunAddr(AddressOf Findnextfile_call), Process
check 2 things: in Finnextfile_call make a OutputDebugString with wfd.dwFileAttributes.
if it works, then the pointer of WIN32_FIND_DATA isn't working good with the strings. so you must need copy 4 bytes to know the real pointer of the string.
bye
Good evening
make the same yesterday night
this night is so long
when inject the dll
the hook load and call the callback .
my callback is empty
nothis inside
Public Function Findnextfile_call(ByVal hFindFile As Long, pFindFileData As WIN32_FIND_DATA) As Long
OutputDebugString "Debug string -Iam in callback"
End function
please u can be more specific
thanks for the reply
Hi again
yesterday play again with this project
remove all data from my callback again and rewritte again like this
CODE:
Public Function HookFindFirstfile(ByVal hFindFile As Long, ByRef ipFindFileData As WIN32_FIND_DATA) As Long
OutputDebugString "load callback First file" & "...." & ipFindFileData.dwFileAttributes & "......" & "checdk this attributes ascoll"
End Function
CODE
compile sucessfuly and inject in explorer
my report from debugger is :
http://img246.imageshack.us/img246/56/debug.jpg
Think my problem still in WIN32_FIND_DATA
thanks for the time