Hooking IE(6) InternetCloseHandle by EasyHook in C# RRS feed

  • 问题

  • I am gona making a program to Hook IE request info. However, I found a way that is Hooking InternetCloseHandle method .
    My Hook base program (EasyHook FileMon) is work fine, and I changed the Hooking method to my wish as follow.

                CharSet = CharSet.Ansi,
                SetLastError = true)]
            delegate bool DInternetCloseHandle_Hooked(
                IntPtr hInternet);
            // just use a P-Invoke implementation to get native API access from C# (this step is not necessary for C++.NET)
                CharSet = CharSet.Ansi)]
            static extern bool InternetCloseHandle(
                IntPtr hInternet);
            // this is where we are intercepting all IE InternetCloseHandle!
            static bool InternetCloseHandle_Hooked(IntPtr hInternet)
                //intercepting global object
                Main This = (Main)HookRuntimeInfo.Callback;
                bool ret = false;
                ret = InternetCloseHandle(hInternet);
                if (!ret)
                    //mark error code
                    This.Queue.Push("[" + RemoteHooking.GetCurrentProcessId() + ":" +
                                        RemoteHooking.GetCurrentThreadId() + "]: \"code:" + Marshal.GetLastWin32Error().ToString() + "\"");
                return ret;

    I have confirm this method in IE (IE6) can be intercepting ( My mean is I can add my code in InternetCloseHandle_Hooked ).
    there something strange :
    1.when I visit a simple webpage (for example test.php , the page only echo a short string ), It's worked!
    2.when I visit a complicated webpage (which contain a large of pic and other linking) , IE was blocked, and look like stoping download anyting. afther a moment the IE was get no responed !

    In theory , this pure hooking code equal none hooking , cause I haven't do anything, just transfer.

    By searching information about it , It take me almost 2 day .and no solution was found. So , Could anyone who can help me ! thank you !

    write by peter

    2011年9月15日 17:20