Because of HOOKED function

Question

Hello.

I have a problem during developing.

When calling OpenProcess function , it returns FALSE.

It is becase target program hooked some function such as Ntopenprocess.

If I unhook it, the program detect it and exit...

So I read some document about it and they said that i must develop driver to solve the problem.

I have no experience of driver and no time to study,,,

If someone knows the method that can solve my trouble in user mode, help me!

Thanks :->

Answer 1

Check if LoadLibrary and GetProcAddress are not hooked and allow you to determine and call the real OpenProcess function.

Answer 2

Thanks for reply.

And i don't know exactly what you said.

Please correct its meaning. :->

Answer 3

Hello,

I'm very interested in hearing more about your issue, did you solve your problem?

If so, would you mind sharing the solution with us, it will be very great and helpful for other members of community who stuck in similar case.

Have a nice day!

Regrads,

---

Elegentin Xie [MSFT]
MSDN Community Support | Feedback to us