How to hook a method from ANY thread within a process using unmanaged EasyHook?

Question

I've been having some issues getting my method hooks to work. I can get the hook to work if "I" call the method that's being hooked. But when it occurs naturally during the processes operation, it doesn't get hooked. My problem is probably stemming from the fact that I'm actually setting these hooks in my own thread that I've spawned. And apparently the LhSetInclusiveACL() method needs to know the thread that you want to hook. Well, here are my issues...

I don't really care which threads apply the hook, i want them all to be hooked. For example, lets say I want the CreateICW() method from the "gdi32.dll" library hooked for the entire process "iexplorer.exe". Not just from thread ID number 48291 or whatever. Knowing which threads are going to be calling the routines you are interested in hooking requires intimate knowledge of internal workings of the process you are hooking. I'm speculating that is generally not feasible and certainly not feasible for me. Thus its kind of impossible for me to know a priori which thread IDs need to be hooked.

The following code was taken from the "UnmanageHook" example:

extern "C" int main(int argc, wchar_t* argv[])
{
    //...
    //...
    //...

    /*
        The following shows how to install and remove local hooks...
    */
    FORCE(LhInstallHook(
            GetProcAddress(hUser32, "MessageBeep"),
            MessageBeepHook,
            (PVOID)0x12345678,
            hHook));

    // won't invoke the hook handler because hooks are inactive after installation
    MessageBeep(123);

    // activate the hook for the current thread
    // This is where I believe my problem is.  ACLEntries is 
    // supposed to have a list of thread IDs that should pay
    // attention to the MessageBeep() hook.  Entries that are
    // "0" get translated to be the "current" threadID.  I want
    // ALL threads and I don't want to have to try to figure out
    // which threads will be spawned in the future for the given
    // process.  The second parameter is InThreadCount. I'm
    // kind of shocked that you can't just pass in 0 or -1 or
    // something for this parameter and just have it hook all
    // threads in that given process.
    FORCE(LhSetInclusiveACL(ACLEntries, 1, hHook));

    // will be redirected into the handler...
    MessageBeep(123);


    //...
    //...
    //...
}

I've added some comments to the LhSetInclusiveACL() method call explaining the situation. Also LhSetExclusiveACL() and the "global" versions for these methods don't seem to help either.

For reference here is the documentation for LhSetExclusiveACL:

/***********************************************************************
Sets an exclusive hook local ACL based on the given thread ID list.
Global and local ACLs are always intersected. For example if the 
global ACL allows a set “G” of threads to be intercepted, and the 
local ACL allows a set “L” of threads to be intercepted, then the 
set “G  L” will be intercepted. The “exclusive” and “inclusive” 
ACL types don’t have any impact on the computation of the final 
set. Those are just helpers for you to construct a set of threads.

EASYHOOK_NT_EXPORT LhSetExclusiveACL(
   ULONG* InThreadIdList,
   ULONG InThreadCount,
   TRACED_HOOK_HANDLE InHandle);

Parameters:

   InThreadIdList
      An array of thread IDs. If you specific zero for an 
      entry in this array, it will be automatically replaced
      with the calling thread ID.

   InThreadCount
      The count of entries listed in the thread ID list. This
      value must not exceed MAX_ACE_COUNT!

   InHandle
      The hook handle whose local ACL is going to be set. 

Return values:

   STATUS_INVALID_PARAMETER_2
       The limit of MAX_ACE_COUNT ACL is violated by the given buffer.
***********************************************************************/

Am I using this wrong? I imagine that this is how the majority of implementations would use this library, so why is this not working for me?

Answer 1

You want to use LhSetExclusiveACL instead. This means that any calls across any threads get hooked, except for ones you specify in the ACL.