Author Topic: Windows Hooking works on 32bit apps but not on 64bit apps  (Read 252 times)

bluedevil

  • Member
  • **
  • Posts: 160
  • Binary Grinder
    • SCTZine
Windows Hooking works on 32bit apps but not on 64bit apps
« on: September 24, 2022, 07:15:07 AM »
Hello,
I have written icz tute24 in MASM64. Sources are attached.

It works on itself(which is 64 bit)
It works on 32bit apps
It doesn't work on 64bit apps

I have debugged my app and if I am not wrong the problem resides in DLL. The MouseProc function is not getting triggered if mouse is on a 64bit app?

Code: [Select]
MouseProc proc nCode:QWORD, wParam:WPARAM,lParam:LPARAM

    LOCAL   ms:MOUSEHOOKSTRUCT

    invoke CallNextHookEx, hHook, nCode, wParam, lParam
    mov rdx, lParam
   
    mov rax, [rdx]
    mov ms.pt.x, eax
    shr rax, 32
    mov ms.pt.y, eax
    invoke WindowFromPoint, ms.pt
   
    invoke PostMessage, hWnd, WM_MOUSEHOOK, rax, 0
   
    xor eax, eax
    ret
   
MouseProc endp

InstallHook proc hwnd:HWND
   
    push hwnd
    pop hWnd
    invoke SetWindowsHookEx, WH_MOUSE, addr MouseProc, hInstance, 0
    mov hHook, rax
   
    ret

InstallHook endp

UninstallHook proc
   
    invoke UnhookWindowsHookEx, hHook
   
    ret

UninstallHook endp

Of course I have look Mikl__ example. Unfortunately I cannot assemble Mikl__ example which was posted here. I couldn't find mymacros.asm @Mikl__ .
« Last Edit: September 26, 2022, 06:59:04 PM by bluedevil »
..Dreams make the future
But the past never lies..
BlueDeviL // SCT
My Code Site:
BlueDeviL Github

Mikl__

  • Member
  • *****
  • Posts: 1263
Re: Windows Hooking works on 32bit apps but not on 64bit apps
« Reply #1 on: September 24, 2022, 09:13:47 AM »
Hi bluedevil!
look here

zedd151

  • Member
  • *****
  • Posts: 1268
Re: Windows Hooking works on 32bit apps but not on 64bit apps
« Reply #2 on: September 24, 2022, 09:16:01 AM »
Hi bluedevil!
look here
Mikl_ check that link.




Edit =
A short time later...
Now that works Mikl_. Thx
... :biggrin:

Mikl__

  • Member
  • *****
  • Posts: 1263
Re: Windows Hooking works on 32bit apps but not on 64bit apps
« Reply #3 on: September 24, 2022, 09:19:57 AM »
Hi swordfish!
I have corrected the link. Thank you!

zedd151

  • Member
  • *****
  • Posts: 1268
Re: Windows Hooking works on 32bit apps but not on 64bit apps
« Reply #4 on: September 24, 2022, 09:21:15 AM »
Hi swordfish!
I have corrected the link. Thank you!
:thup:
... :biggrin:

learn64bit

  • Member
  • **
  • Posts: 75
Re: Windows Hooking works on 32bit apps but not on 64bit apps
« Reply #5 on: September 24, 2022, 10:12:03 AM »
bluedevil,

Try this one, Mikl__'s code is ok. I remember I just added one ";"

Mikl__

  • Member
  • *****
  • Posts: 1263
Re: Windows Hooking works on 32bit apps but not on 64bit apps
« Reply #6 on: September 24, 2022, 04:11:34 PM »
Hi bluedevi!

bluedevil

  • Member
  • **
  • Posts: 160
  • Binary Grinder
    • SCTZine
Re: Windows Hooking works on 32bit apps but not on 64bit apps
« Reply #7 on: September 24, 2022, 07:21:51 PM »
@Mikl__ thank you sharing Six_L's post. I have solved my problem with using MSLLHOOKSTRUCT instead of MOUSEHOOKSTRUCT. And using WH_MOUSE_LL instead of WH_MOUSE. I have attached the working sources.

@Mikl__ your executable which you shared in this reply is not working.

One more question, we use data? for uninitialized section but we also say linker /SECTION:.bbs,S to use uninitialized section as shared. Bu we don't use the word .bbs. So the linker is giving this warning?
Code: [Select]
LINK : warning LNK4039: section '.bbs' specified with /SECTION option does not exist
..Dreams make the future
But the past never lies..
BlueDeviL // SCT
My Code Site:
BlueDeviL Github

Mikl__

  • Member
  • *****
  • Posts: 1263
Re: Windows Hooking works on 32bit apps but not on 64bit apps
« Reply #8 on: September 24, 2022, 08:44:52 PM »
bluedevil,
can you write specifically WHAT does not work in my example? I don't distribute not worked software. I value my reputation.

bluedevil

  • Member
  • **
  • Posts: 160
  • Binary Grinder
    • SCTZine
Re: Windows Hooking works on 32bit apps but not on 64bit apps
« Reply #9 on: September 25, 2022, 12:02:00 AM »
bluedevil,
can you write specifically WHAT does not work in my example? I don't distribute not worked software. I value my reputation.

I am using a Windows 10 x64 ver 21H2(OS Build 19044.2075).  I have downloaded your reply and learnbit's reply. Both executable's do not show a window, and they immediately closes down!

I have debugged your tut_24b.exe and I got this error message:
Quote
7FFE79C82B26: The instruction at 0x7FFE79C82B26 referenced memory at 0x400000. The memory could not be read -> 0000000000400000 (exc.code c0000005, tid 6232)
..Dreams make the future
But the past never lies..
BlueDeviL // SCT
My Code Site:
BlueDeviL Github

zedd151

  • Member
  • *****
  • Posts: 1268
Re: Windows Hooking works on 32bit apps but not on 64bit apps
« Reply #10 on: September 25, 2022, 12:23:29 AM »

One more question, we use data? for uninitialized section but we also say linker /SECTION:.bbs,S to use uninitialized section as

maybe need ".bss,S" not ".bbs,S"  for the warning:
Code: [Select]
LINK : warning LNK4039: section '.bbs' specified with /SECTION option does not exist

Seems to be a typo.

As for the window not appearing, are the resources getting compiled? The dialog box is a resource.

Post the batch file you are using to assemble with. Could help solve your issues.

... :biggrin:

learn64bit

  • Member
  • **
  • Posts: 75
Re: [SOLVED]Windows Hooking works on 32bit apps but not on 64bit apps
« Reply #11 on: September 25, 2022, 12:36:14 AM »
bluedevil,

Oh, I only run it in Win7 64, and it works.
(I don't have a Windows 10 x64 ver 21H2(OS Build 19044.2075) machine yet...)

bluedevil

  • Member
  • **
  • Posts: 160
  • Binary Grinder
    • SCTZine
Re: Windows Hooking works on 32bit apps but not on 64bit apps
« Reply #12 on: September 25, 2022, 12:50:16 AM »

One more question, we use data? for uninitialized section but we also say linker /SECTION:.bbs,S to use uninitialized section as

maybe need ".bss,S" not ".bbs,S"  for the warning:
Code: [Select]
LINK : warning LNK4039: section '.bbs' specified with /SECTION option does not exist

Seems to be a typo.

As for the window not appearing, are the resources getting compiled? The dialog box is a resource.

Post the batch file you are using to assemble with. Could help solve your issues.



Exactly! It is a typo, I have fixed my batch file.
..Dreams make the future
But the past never lies..
BlueDeviL // SCT
My Code Site:
BlueDeviL Github

zedd151

  • Member
  • *****
  • Posts: 1268
Re: Windows Hooking works on 32bit apps but not on 64bit apps
« Reply #13 on: September 25, 2022, 12:54:55 AM »
Quote from: bluedevil
Exactly! It is a typo, I have fixed my batch file.
So, does it work now?
Glad I could give some limited help. I'm not currently set up to run 64 bit code.
... :biggrin:

bluedevil

  • Member
  • **
  • Posts: 160
  • Binary Grinder
    • SCTZine
Re: Windows Hooking works on 32bit apps but not on 64bit apps
« Reply #14 on: September 25, 2022, 01:56:28 AM »
Quote from: bluedevil
Exactly! It is a typo, I have fixed my batch file.
So, does it work now?
Glad I could give some limited help. I'm not currently set up to run 64 bit code.

Thank you! Yes it is working. I have now attached the sources with typo fixed batch!
..Dreams make the future
But the past never lies..
BlueDeviL // SCT
My Code Site:
BlueDeviL Github