Setwindowshookex 64 bit

Jul 14, kamranyd. Jaafar Tribak Apr 3, Excel Questions. Replies 4 Views Apr 12, audeser. Question 64 bit MouseWheel hook for pointer xy on a User Form, key press and wheel rotation. Tony Cheshire Jun 2, Excel Questions. Replies 0 Views Jun 2, Tony Cheshire.

Spork Schivago Jun 10, Excel Questions 2. Replies 19 Views 6K. Jun 17, Jaafar Tribak. Question Excel crashing during VBA procedures.

Magestick May 1, Excel Questions. Replies 4 Views 2K. May 2, NdNoviceHlp. Understanding data is crucial, and the easiest place to start is with Microsoft Excel. We've detected that you are using an adblocker.

We have a great community of people providing Excel help here, but the hosting costs are enormous. You can help keep this site running by allowing ads on MrExcel. In the middle of the picture we can see the victim. Usually, we want to change the IAT import table of the process, so whenever the process calls some function, it will end up calling some other function: our malicious function.

The first thing that we need is malicious DLL file, which we must code ourselves. To be able to use that function, we first need another program program. The program. This means that we need to code our DLL is such a way it exports at least one function.

After that, the program. The SetWindowsHookEx function will install the hook routine into the hook chain of the victim. After that, the exported function we passed to the SetWindowsHookEx is also called to handle the triggered event—in our case a key press. This effectively enables us to do whatever we want in the hooked address space of the program. The SetWindowsHookEx installs a hook routine into the hook chain, which is then invoked whenever certain events are triggered.

Otherwise the function returns NULL. All of the above constants are written in the winuser. After that, we can change the dllmain. We can see that we have a pretty simple DLL.

Upon that, one of the four messages is written to the C:temp. If we would like to program a keylogger, we could simply done so in the DLL code where we would have to hook certain functions in the IAT import table. There are plenty of possibilities we can explore, because once the DLL is loaded, our code is being called. This is also the reason that we can do pretty much anything related to this process.

We can instruct it to connect back to us and form a reverse session, we can send each pressed keystroke inside this application to the server over HTTP protocol, etc.

The next thing that we need to do is create the program. We can see the code below:. The code of the program is again pretty simple. For the DLL to be found we must change the path from the C:driversdllinject. At this point, we can use the dumpbin tool to check whether that function is actually exported. The output from that command can be seen below:. All rights reserved. After that, the program calls the most important function, the SetWindowsHookEx. The parameters passed to that function determine what the function will actually do.

The dll parameter is just a handle to our DLL. Reposting here for visibility- the problem is that the 64 bit process is waiting for your 32 bit hook application to respond to the hook callback, which it can only do if it is pumping messages.

Ask a question. Quick access. Search related threads. Remove From My Forums. Answered by:. Archived Forums. Visual C. Sign in to vote. Dears, This is a problem about global hook on 64bit OS, I need your help. Much appreciation for your help!!!

Best wishes, ShenHui. Friday, December 10, AM. Hi Shenhui,. Sorry for taking so long to answer. First, in KeyboardProc , add these lines at the top:. Thursday, December 16, PM.