Windows Cmd 후크가 작동하지 않습니다.

Question

cmd.exe에서 CreateProcess를 연결하려고합니다. 나는 dll에 cmd 프로세스를 삽입 할 수 있지만 주입 후 dll 프로세스 분리 메시지 수신 및 createprocess 함수 호출을 후크하지 못합니다. 나는 easyhook을 사용하고 있습니다. 내 코드 :

#include <windows.h> 
#include <Shlwapi.h> 
#include <tchar.h> 
#include <stdio.h> 
#include <strsafe.h> 
#include <easyhook.h> 

BOOL WINAPI myCreateProcess(
_In_opt_ LPCTSTR    lpApplicationName, 
_Inout_opt_ LPTSTR    lpCommandLine, 
_In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes, 
_In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes, 
_In_  BOOL     bInheritHandles, 
_In_  DWORD     dwCreationFlags, 
_In_opt_ LPVOID    lpEnvironment, 
_In_opt_ LPCTSTR    lpCurrentDirectory, 
_In_  LPSTARTUPINFO   lpStartupInfo, 
_Out_  LPPROCESS_INFORMATION lpProcessInformation 
){ 
OutputDebugString(L"\n !!!!!! In CreateProcess HOOK\n !!!!!!!!"); 
return CreateProcessW(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCommandLine, lpStartupInfo, lpProcessInformation); 
} 
BOOL APIENTRY DllMain(HMODULE hModule, 
DWORD ul_reason_for_call, 
LPVOID lpReserved 
) 
{ 
BOOL bErrorFlag = FALSE; 
DWORD dwBytesToWrite = (DWORD)strlen(DataBuffer); 
DWORD dwBytesWritten = 0; 
switch (ul_reason_for_call) 
{ 
case DLL_PROCESS_ATTACH: 
{ 


    HOOK_TRACE_INFO hHook = { NULL }; // keep track of our hook 

    // Install the hook 

    NTSTATUS result = LhInstallHook(
     GetProcAddress(GetModuleHandle(TEXT("kernel32")), "CreateProcessW"), 
     myCreateProcess, 
     NULL, 
     &hHook); 
    if (FAILED(result)) 
    { 
     OutputDebugString(L"!!!!!!!!!!!FAIL!!!!!!!!"); 
     return 1; 
    } 

    ULONG ACLEntries[1] = { 0 }; 
    LhSetInclusiveACL(ACLEntries, 1, &hHook); 
    OutputDebugString(L"!!!!!!!!!!!!Injection Succeed!!!!!!!!!!!!"); 
    break; 
} 
case DLL_THREAD_ATTACH:{ 
    OutputDebugString(L"!!!!!!!!!!!!dll thread attach!!!!!!!!!!!!"); 
    break; 
} 
case DLL_THREAD_DETACH: 
{ 
     OutputDebugString(L"!!!!!!!!!!!!dll thread Detach!!!!!!!!!!!!"); 
    break; 
} 

case DLL_PROCESS_DETACH: 
{ 
      OutputDebugString(L"!!!!!!!!!!!!dll process Detach!!!!!!!!!!!!"); 
    break; 
} 
} 
} 

내가 "주입이 성공"메시지와 바로 "DLL 공정 분리"메시지 후를받을 수 있습니다. 아이디어가 있습니까?

Answer 1

시도 변경 :

LhSetInclusiveACL(ACLEntries, 1, &hHook); 

에 :

LhSetExclusiveACL(ACLEntries, 1, &hHook);