Does x86Detour seem not to work for external DLL calls?

Question

Does x86Detour seem not to work for external DLL calls?

bbsuuo opened this issue a year ago · 6 comments

I use koaloader to hijack DLLs, and then I try to hook a series of functions such as LoadLibrary

This is my code:

#include "hook.h"
#include "logger.h"
#include "polyhook2/Detour/x86Detour.hpp"
#include "polyLogger.h"
#include "utill.h"

namespace ts::hook
{
using namespace ts;

// The type of LoadLibraryA, LoadLibraryW, LoadLibraryExA and LoadLibraryExW functions
typedef HMODULE(WINAPI* LoadLibraryAType)(LPCSTR lpFileName);
typedef HMODULE(WINAPI* LoadLibraryWType)(LPCWSTR lpFileName);
typedef HMODULE(WINAPI* LoadLibraryExAType)(LPCSTR lpFileName, HANDLE hFile, DWORD dwFlags);
typedef HMODULE(WINAPI* LoadLibraryExWType)(LPCWSTR lpFileName, HANDLE hFile, DWORD dwFlags);

// The trampoline functions that will be used to call the original LoadLibraryA, LoadLibraryW, LoadLibraryExA and LoadLibraryExW
uint64_t TrampolineLoadLibraryA;
uint64_t TrampolineLoadLibraryW;
uint64_t TrampolineLoadLibraryExA;
uint64_t TrampolineLoadLibraryExW;

// The hook functions
HMODULE WINAPI HookLoadLibraryA(LPCSTR lpFileName)
{
	LOG_INFO(R"(HookLoadLibraryA '{}')", std::string(lpFileName));
	// Call the original LoadLibraryA function
	HMODULE hModule = PLH::FnCast(TrampolineLoadLibraryA, &LoadLibraryA)(lpFileName);
	//if (strcmp(lpFileName, "nw.dll") == 0)

//{
// LOG_INFO("nw.dll has been loaded.");
//}
return hModule;
}

HMODULE WINAPI HookLoadLibraryW(LPCWSTR lpFileName)
{
	LOG_INFO(R"(HookLoadLibraryW'{}')", ts::utill::to_string(std::wstring(lpFileName)));
	// Call the original LoadLibraryW function
	HMODULE hModule = PLH::FnCast(TrampolineLoadLibraryW, &LoadLibraryW)(lpFileName);
	//if (wcscmp(lpFileName, L"nw.dll") == 0)

//{
// LOG_INFO(L"nw.dll has been loaded.");
//}
return hModule;
}

HMODULE WINAPI HookLoadLibraryExA(LPCSTR lpFileName, HANDLE hFile, DWORD dwFlags)
{
	LOG_INFO(R"(HookLoadLibraryEXA '{}')", std::string(lpFileName));
	// Call the original LoadLibraryExA function
	HMODULE hModule = PLH::FnCast(TrampolineLoadLibraryExA, &LoadLibraryExA)(lpFileName, hFile, dwFlags);
	return hModule;
}

HMODULE WINAPI HookLoadLibraryExW(LPCWSTR lpFileName, HANDLE hFile, DWORD dwFlags)
{
	LOG_INFO(R"(HookLoadLibraryEXW'{}')", ts::utill::to_string(std::wstring(lpFileName)));
	// Call the original LoadLibraryExW function
	HMODULE hModule = PLH::FnCast(TrampolineLoadLibraryExW, &LoadLibraryExW)(lpFileName, hFile, dwFlags);
	return hModule;
}

void hookEnviroument()
{
	//std::shared_ptr<PolyLogger> logger = std::make_shared<PolyLogger>();

// PLH::Log::registerLogger(logger);

	// Create a detour for LoadLibraryW
	LOG_INFO("Hooking LoadLibrary and LoadLibraryEx Functions");
	PLH::x86Detour detourW = PLH::x86Detour((uint64_t)&LoadLibraryW, (uint64_t)HookLoadLibraryW, &TrampolineLoadLibraryW);
	PLH::x86Detour detourExW = PLH::x86Detour((uint64_t)&LoadLibraryExW, (uint64_t)HookLoadLibraryExW, &TrampolineLoadLibraryExW);
	PLH::x86Detour detourA = PLH::x86Detour((uint64_t)&LoadLibraryA, (uint64_t)HookLoadLibraryA, &TrampolineLoadLibraryA);
	PLH::x86Detour detourExA = PLH::x86Detour((uint64_t)&LoadLibraryExA, (uint64_t)HookLoadLibraryExA, &TrampolineLoadLibraryExA);

	// Enable the detour
	if (detourW.hook())
	{
		LOG_INFO("Hooking LoadLibraryW SUCCESS");
	}
	else 
	{
		LOG_INFO("Hooking LoadLibraryW Failure.");
		return;
	}

	// Enable the detour
	if (detourExW.hook())
	{
		LOG_INFO("Hooking LoadLibraryExW SUCCESS");
	}
	else
	{
		LOG_INFO("Hooking LoadLibraryExW Failure.");
		return;
	}
	// Enable the detour
	if (detourA.hook())
	{
		LOG_INFO("Hooking LoadLibraryA SUCCESS");
	}
	else
	{
		LOG_INFO("Hooking LoadLibraryA Failure.");
		return;
	}

	// Enable the detour
	if (detourExA.hook())
	{
		LOG_INFO("Hooking LoadLibraryExA SUCCESS");
	}
	else
	{
		LOG_INFO("Hooking LoadLibraryExA Failure.");
		return;
	}

	// 我们检查当前环境中已经加载的程序集
	HANDLE hProcess = GetCurrentProcess();
	HMODULE hMods[1024];
	DWORD cbNeeded;
	if (EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded))
	{
		for (unsigned int i = 0; i < (cbNeeded / sizeof(HMODULE)); i++)
		{
			TCHAR szModName[MAX_PATH];

			if (GetModuleFileNameEx(hProcess, hMods[i], szModName, sizeof(szModName) / sizeof(TCHAR)))
			{
				LOG_INFO(R"(Current Load Module : '{}')", ts::utill::tchar_to_string(szModName));
			}
		}
	}

	CloseHandle(hProcess);

	LOG_INFO("Testing hook with nw.dll");
	HMODULE hModule = LoadLibraryA("nw.dll");
	if (hModule != NULL) {
		LOG_INFO("nw.dll loaded successfully");
		FreeLibrary(hModule);
	}
	else {
		LOG_INFO("Failed to load nw.dll");
	}

}

}

And this is my log：
Process ID: 25364 │ INFO│ 03:04:01.259 │ 19:bootstrap.cpp Process ID: 25364 │ INFO│ 03:04:01.259 │ 20:bootstrap.cpp Process ID: 25364 │ INFO│ 03:04:01.259 │ 70:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.259 │ 79:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.259 │ 90:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 100:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 111:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 131:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 138:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.260 │ 26:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.268 │ 58:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.268 │ 58:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.268 │ 58:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.268 │ 58:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.272 │ 58:hook.cpp Process ID: 25364 │ INFO│ 03:04:01.272 │ 141:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 19:bootstrap.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 20:bootstrap.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 70:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 79:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 90:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 100:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 111:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 131:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 138:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.323 │ 26:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.332 │ 58:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.332 │ 58:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.332 │ 58:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.332 │ 58:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.336 │ 58:hook.cpp Process ID: 26876 │ INFO│ 03:04:01.336 │ 141:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 19:bootstrap.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 20:bootstrap.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 70:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 79:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 90:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 100:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 111:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.359 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 131:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 138:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.360 │ 26:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.368 │ 58:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.368 │ 58:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.368 │ 58:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.368 │ 58:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.371 │ 58:hook.cpp Process ID: 28984 │ INFO│ 03:04:01.372 │ 141:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.486 │ 19:bootstrap.cpp Process ID: 31808 │ INFO│ 03:04:01.486 │ 20:bootstrap.cpp Process ID: 31808 │ INFO│ 03:04:01.486 │ 70:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.486 │ 79:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.486 │ 90:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 100:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 111:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 131:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 138:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.487 │ 26:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.496 │ 58:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.496 │ 58:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.496 │ 58:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.496 │ 58:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.501 │ 58:hook.cpp Process ID: 31808 │ INFO│ 03:04:01.501 │ 141:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.537 │ 19:bootstrap.cpp Process ID: 27752 │ INFO│ 03:04:01.537 │ 20:bootstrap.cpp Process ID: 27752 │ INFO│ 03:04:01.537 │ 70:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.537 │ 79:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.537 │ 90:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.537 │ 100:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.537 │ 111:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.537 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 131:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 138:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.538 │ 26:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.547 │ 58:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.547 │ 58:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.547 │ 58:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.547 │ 58:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.552 │ 58:hook.cpp Process ID: 27752 │ INFO│ 03:04:01.552 │ 141:hook.cpp ┃ Enter Process : '25364'
┃ ModuleDirectory : 'S:\测试用\f-2'
┃ Hooking LoadLibrary and LoadLibraryEx Functions
┃ Hooking LoadLibraryW SUCCESS
┃ Hooking LoadLibraryExW SUCCESS
┃ Hooking LoadLibraryA SUCCESS
┃ Hooking LoadLibraryExA SUCCESS
┃ Current Load Module : 'S:\测试用\f-2\Game.exe'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll'
┃ Current Load Module : 'S:\测试用\f-2\nw_elf.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll'
┃ Current Load Module : 'S:\测试用\f-2\WINMM.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll'
┃ Current Load Module : 'C:\Windows\System32\winmm.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL'
┃ Current Load Module : 'S:\测试用\f-2\RPGMakerMVHookTS.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll'
┃ Testing hook with nw.dll
┃ HookLoadLibraryA 'nw.dll'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'kernel32'
┃ HookLoadLibraryEXW'api-ms-win-core-string-l1-1-0'
┃ HookLoadLibraryEXW'api-ms-win-core-localization-l1-2-1'
┃ HookLoadLibraryEXW'api-ms-win-core-datetime-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-localization-obsolete-l1-2-0'
┃ nw.dll loaded successfully
┃ Enter Process : '26876'
┃ ModuleDirectory : 'S:\测试用\f-2'
┃ Hooking LoadLibrary and LoadLibraryEx Functions
┃ Hooking LoadLibraryW SUCCESS
┃ Hooking LoadLibraryExW SUCCESS
┃ Hooking LoadLibraryA SUCCESS
┃ Hooking LoadLibraryExA SUCCESS
┃ Current Load Module : 'S:\测试用\f-2\Game.exe'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll'
┃ Current Load Module : 'S:\测试用\f-2\nw_elf.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll'
┃ Current Load Module : 'S:\测试用\f-2\WINMM.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll'
┃ Current Load Module : 'C:\Windows\System32\winmm.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL'
┃ Current Load Module : 'S:\测试用\f-2\RPGMakerMVHookTS.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll'
┃ Testing hook with nw.dll
┃ HookLoadLibraryA 'nw.dll'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'kernel32'
┃ HookLoadLibraryEXW'api-ms-win-core-string-l1-1-0'
┃ HookLoadLibraryEXW'api-ms-win-core-localization-l1-2-1'
┃ HookLoadLibraryEXW'api-ms-win-core-datetime-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-localization-obsolete-l1-2-0'
┃ nw.dll loaded successfully
┃ Enter Process : '28984'
┃ ModuleDirectory : 'S:\测试用\f-2'
┃ Hooking LoadLibrary and LoadLibraryEx Functions
┃ Hooking LoadLibraryW SUCCESS
┃ Hooking LoadLibraryExW SUCCESS
┃ Hooking LoadLibraryA SUCCESS
┃ Hooking LoadLibraryExA SUCCESS
┃ Current Load Module : 'S:\测试用\f-2\Game.exe'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll'
┃ Current Load Module : 'S:\测试用\f-2\nw_elf.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll'
┃ Current Load Module : 'S:\测试用\f-2\WINMM.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll'
┃ Current Load Module : 'C:\Windows\System32\winmm.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL'
┃ Current Load Module : 'S:\测试用\f-2\RPGMakerMVHookTS.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll'
┃ Testing hook with nw.dll
┃ HookLoadLibraryA 'nw.dll'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'kernel32'
┃ HookLoadLibraryEXW'api-ms-win-core-string-l1-1-0'
┃ HookLoadLibraryEXW'api-ms-win-core-localization-l1-2-1'
┃ HookLoadLibraryEXW'api-ms-win-core-datetime-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-localization-obsolete-l1-2-0'
┃ nw.dll loaded successfully
┃ Enter Process : '31808'
┃ ModuleDirectory : 'S:\测试用\f-2'
┃ Hooking LoadLibrary and LoadLibraryEx Functions
┃ Hooking LoadLibraryW SUCCESS
┃ Hooking LoadLibraryExW SUCCESS
┃ Hooking LoadLibraryA SUCCESS
┃ Hooking LoadLibraryExA SUCCESS
┃ Current Load Module : 'S:\测试用\f-2\Game.exe'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll'
┃ Current Load Module : 'S:\测试用\f-2\nw_elf.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll'
┃ Current Load Module : 'S:\测试用\f-2\WINMM.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll'
┃ Current Load Module : 'C:\Windows\System32\winmm.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL'
┃ Current Load Module : 'S:\测试用\f-2\RPGMakerMVHookTS.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll'
┃ Testing hook with nw.dll
┃ HookLoadLibraryA 'nw.dll'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'kernel32'
┃ HookLoadLibraryEXW'api-ms-win-core-string-l1-1-0'
┃ HookLoadLibraryEXW'api-ms-win-core-localization-l1-2-1'
┃ HookLoadLibraryEXW'api-ms-win-core-datetime-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-localization-obsolete-l1-2-0'
┃ nw.dll loaded successfully
┃ Enter Process : '27752'
┃ ModuleDirectory : 'S:\测试用\f-2'
┃ Hooking LoadLibrary and LoadLibraryEx Functions
┃ Hooking LoadLibraryW SUCCESS
┃ Hooking LoadLibraryExW SUCCESS
┃ Hooking LoadLibraryA SUCCESS
┃ Hooking LoadLibraryExA SUCCESS
┃ Current Load Module : 'S:\测试用\f-2\Game.exe'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll'
┃ Current Load Module : 'S:\测试用\f-2\nw_elf.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll'
┃ Current Load Module : 'S:\测试用\f-2\WINMM.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll'
┃ Current Load Module : 'C:\Windows\System32\winmm.DLL'
┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll'
┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL'
┃ Current Load Module : 'S:\测试用\f-2\RPGMakerMVHookTS.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll'
┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll'
┃ Testing hook with nw.dll
┃ HookLoadLibraryA 'nw.dll'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-synch-l1-2-0'
┃ HookLoadLibraryEXW'api-ms-win-core-fibers-l1-1-1'
┃ HookLoadLibraryEXW'kernel32'
┃ HookLoadLibraryEXW'api-ms-win-core-string-l1-1-0'
┃ HookLoadLibraryEXW'api-ms-win-core-localization-l1-2-1'
┃ HookLoadLibraryEXW'api-ms-win-core-datetime-l1-1-1'
┃ HookLoadLibraryEXW'api-ms-win-core-localization-obsolete-l1-2-0'
┃ nw.dll loaded successfully

Then I tried to hook these functions in API Monitor, and the result was (Just PID 31184):

Time of Day Thread Module API Return Value Error Duration

1 2:19:43.424 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000067
2 2:19:46.129 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000091
3 2:19:46.619 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000083
4 2:19:46.915 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000085
5 2:19:47.125 AM 1 nw_elf.dll LoadLibraryExW ( "kernel32", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x763e0000 0.0000083
6 2:19:47.322 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-string-l1-1-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000094
7 2:19:47.500 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-localization-l1-2-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000075
8 2:19:47.676 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-datetime-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000082
9 2:19:47.868 AM 1 nw_elf.dll LoadLibraryExW ( "api-ms-win-core-localization-obsolete-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000080
10 2:19:48.826 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000080
11 2:19:49.060 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000078
12 2:19:49.850 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000081
13 2:19:50.053 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000079
14 2:19:50.265 AM 1 WINMM.dll LoadLibraryExW ( "kernel32", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x763e0000 0.0000109
15 2:19:50.480 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-string-l1-1-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000074
16 2:19:50.697 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-localization-l1-2-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000081
17 2:19:50.910 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-datetime-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000072
18 2:19:51.105 AM 1 WINMM.dll LoadLibraryExW ( "api-ms-win-core-localization-obsolete-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000080
19 2:19:51.309 AM 1 WINMM.dll LoadLibraryW ( "RPGMakerMVHookTS.dll" ) 0x7c4d0000 0.0039236
20 2:19:51.310 AM 1 VCRUNTIME140.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000122
21 2:19:51.488 AM 1 VCRUNTIME140.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000082
22 2:19:51.685 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000107
23 2:19:51.685 AM 4 WINMM.dll LoadLibraryExW ( "api-ms-win-appmodel-runtime-l1-1-2", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x74e50000 0.0000165
24 2:19:51.943 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000111
25 2:19:52.098 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000110
26 2:19:59.416 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000030
27 2:19:59.416 AM 1 Game.exe LoadLibraryExW ( "kernel32", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x763e0000 0.0000021
28 2:19:59.416 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-string-l1-1-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000013
29 2:19:59.416 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-localization-l1-2-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000013
30 2:19:59.416 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-datetime-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000010
31 2:19:59.416 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-core-localization-obsolete-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000008
32 2:19:59.441 AM 1 Game.exe LoadLibraryExW ( "S:\测试用\f-1\nw.dll", NULL, LOAD_WITH_ALTERED_SEARCH_PATH ) 0x0fd70000 0.0159886
33 2:19:59.451 AM 1 ffmpeg.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000032
34 2:19:59.451 AM 1 ffmpeg.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000021
35 2:19:59.451 AM 1 ffmpeg.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000019
36 2:19:59.451 AM 1 ffmpeg.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000017
37 2:19:59.456 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000058
38 2:19:59.457 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000043
39 2:19:59.457 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-synch-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000044
40 2:19:59.457 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-fibers-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000043
41 2:19:59.457 AM 1 nw.dll LoadLibraryExW ( "kernel32", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x763e0000 0.0000052
42 2:19:59.457 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-string-l1-1-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000042
43 2:19:59.457 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-localization-l1-2-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000048
44 2:19:59.458 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-datetime-l1-1-1", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000043
45 2:19:59.458 AM 1 nw.dll LoadLibraryExW ( "api-ms-win-core-localization-obsolete-l1-2-0", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x75ae0000 0.0000040
46 2:19:59.460 AM 1 nw_elf.dll LoadLibraryExA ( "ADVAPI32.dll", NULL, 0 ) 0x766e0000 0.0000179
47 2:20:00.428 AM 1 nw_elf.dll LoadLibraryW ( "kernel32.dll" ) 0x763e0000 0.0000073
48 2:20:00.428 AM 1 nw_elf.dll LoadLibraryW ( "kernel32.dll" ) 0x763e0000 0.0000030
49 2:20:00.428 AM 1 nw_elf.dll LoadLibraryW ( "kernel32.dll" ) 0x763e0000 0.0000019
50 2:20:00.474 AM 1 nw_elf.dll LoadLibraryW ( "kernel32.dll" ) 0x763e0000 0.0000131
51 2:20:00.482 AM 1 nw.dll LoadLibraryW ( "Kernel32.dll" ) 0x763e0000 0.0000062
52 2:20:00.483 AM 1 nw.dll LoadLibraryExA ( "WS2_32.dll", NULL, 0 ) 0x76600000 0.0000185
53 2:20:02.959 AM 1 nw.dll LoadLibraryExA ( "IPHLPAPI.DLL", NULL, 0 ) 0x74760000 0.0000128
54 2:20:02.998 AM 1 nw.dll LoadLibraryW ( "shcore.dll" ) 0x762a0000 0.0000086
55 2:20:02.998 AM 1 nw.dll LoadLibraryW ( "shcore.dll" ) 0x762a0000 0.0000028
56 2:20:02.998 AM 1 nw.dll LoadLibraryExA ( "SETUPAPI.dll", NULL, 0 ) 0x76900000 0.0008777
57 2:20:03.000 AM 1 nw.dll LoadLibraryExA ( "CFGMGR32.dll", NULL, 0 ) 0x75950000 0.0000061
58 2:20:03.001 AM 14 nw.dll LoadLibraryW ( "combase.dll" ) 0x756d0000 0.0000059
59 2:20:03.001 AM 16 nw.dll LoadLibraryExW ( "C:\WINDOWS\system32\netapi32.dll", NULL, LOAD_WITH_ALTERED_SEARCH_PATH ) 0x73040000 0.0000071
60 2:20:03.001 AM 18 nw.dll LoadLibraryExW ( "C:\WINDOWS\system32\wlanapi.dll", NULL, LOAD_WITH_ALTERED_SEARCH_PATH ) 0x79330000 0.0021257
61 2:20:03.002 AM 22 nw.dll LoadLibraryExA ( "WINHTTP.dll", NULL, 0 ) 0x73060000 0.0000065
62 2:20:03.002 AM 16 nw.dll LoadLibraryExW ( "MDMRegistration.dll", NULL, LOAD_LIBRARY_SEARCH_DEFAULT_DIRS | LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR ) NULL 87 = 参数错误。 0.0016190
63 2:20:03.004 AM 16 nw.dll LoadLibraryW ( "MDMRegistration.dll" ) 0x6b290000 0.0017297
64 2:20:03.004 AM 1 nw.dll LoadLibraryExW ( "C:\WINDOWS\system32\audioses.dll", NULL, LOAD_WITH_ALTERED_SEARCH_PATH ) 0x6c100000 0.0037564
65 2:20:03.042 AM 1 nw.dll LoadLibraryExW ( "kernel32.dll", NULL, LOAD_LIBRARY_SEARCH_DEFAULT_DIRS | LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR ) 0x763e0000 0.0000243
66 2:20:03.057 AM 1 nw.dll LoadLibraryW ( "combase.dll" ) 0x756d0000 0.0000138
67 2:20:03.249 AM 1 nw.dll LoadLibraryExA ( "dwmapi.dll", NULL, 0 ) 0x6dd10000 0.0000281
68 2:20:03.256 AM 1 nw.dll LoadLibraryW ( "uxtheme.dll" ) 0x74dd0000 0.0000052
69 2:20:03.290 AM 1 nw.dll LoadLibraryExA ( "atlthunk.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x6e320000 0.0005325
70 2:20:03.301 AM 1 nw.dll LoadLibraryExA ( "IMM32.dll", NULL, 0 ) 0x76f70000 0.0000211
71 2:20:03.660 AM 32 nw.dll LoadLibraryExW ( "C:\WINDOWS\system32\avrt.dll", NULL, LOAD_WITH_ALTERED_SEARCH_PATH ) 0x58a60000 0.0000105
72 2:20:03.805 AM 45 nw.dll LoadLibraryExW ( "xinput1_4.dll", NULL, LOAD_LIBRARY_SEARCH_DEFAULT_DIRS | LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR ) NULL 87 = 参数错误。 0.0000460
73 2:20:03.805 AM 45 nw.dll LoadLibraryW ( "xinput1_4.dll" ) 0x51550000 0.0008882
74 2:20:03.806 AM 45 nw.dll LoadLibraryExW ( "hid.dll", NULL, LOAD_LIBRARY_SEARCH_DEFAULT_DIRS | LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR ) 0x6e970000 0.0000123
75 2:22:50.034 AM 1 Game.exe LoadLibraryExW ( "api-ms-win-appmodel-runtime-l1-1-2", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 ) 0x74e50000 0.0000100

In the log, we can see that after I hooked it, calling LoadLibrary immediately generated output in the log, but afterwards there was no output from the hooked function. did I do something wrong, or is there a misunderstanding about the hooked function?

Answer 1 · 2023-06-30T19:14:32.000Z

Process ID: 31184 │ INFO│ 02:19:51.684 │ 19:bootstrap.cpp ┃ Enter Process : '31184'
Process ID: 31184 │ INFO│ 02:19:51.684 │ 20:bootstrap.cpp ┃ ModuleDirectory : 'S:\测试用\f-1'
Process ID: 31184 │ INFO│ 02:19:51.684 │ 70:hook.cpp ┃ Hooking LoadLibrary and LoadLibraryEx Functions
Process ID: 31184 │ INFO│ 02:19:51.684 │ 79:hook.cpp ┃ Hooking LoadLibraryW SUCCESS
Process ID: 31184 │ INFO│ 02:19:51.684 │ 90:hook.cpp ┃ Hooking LoadLibraryExW SUCCESS
Process ID: 31184 │ INFO│ 02:19:51.684 │ 100:hook.cpp ┃ Hooking LoadLibraryA SUCCESS
Process ID: 31184 │ INFO│ 02:19:51.685 │ 111:hook.cpp ┃ Hooking LoadLibraryExA SUCCESS
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\Game.exe'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'G:\反编译\apiMonitor\apimonitor-drv-x86.sys'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\nw_elf.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\WINMM.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\Windows\System32\winmm.DLL'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\RPGMakerMVHookTS.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll'
Process ID: 31184 │ INFO│ 02:19:51.685 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll'
Process ID: 16076 │ INFO│ 02:20:00.457 │ 19:bootstrap.cpp ┃ Enter Process : '16076'
Process ID: 16076 │ INFO│ 02:20:00.457 │ 20:bootstrap.cpp ┃ ModuleDirectory : 'S:\测试用\f-1'
Process ID: 16076 │ INFO│ 02:20:00.457 │ 70:hook.cpp ┃ Hooking LoadLibrary and LoadLibraryEx Functions
Process ID: 16076 │ INFO│ 02:20:00.458 │ 79:hook.cpp ┃ Hooking LoadLibraryW SUCCESS
Process ID: 16076 │ INFO│ 02:20:00.458 │ 90:hook.cpp ┃ Hooking LoadLibraryExW SUCCESS
Process ID: 16076 │ INFO│ 02:20:00.458 │ 100:hook.cpp ┃ Hooking LoadLibraryA SUCCESS
Process ID: 16076 │ INFO│ 02:20:00.458 │ 111:hook.cpp ┃ Hooking LoadLibraryExA SUCCESS
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\Game.exe'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'G:\反编译\apiMonitor\apimonitor-drv-x86.sys'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\nw_elf.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\WINMM.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\Windows\System32\winmm.DLL'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\RPGMakerMVHookTS.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll'
Process ID: 16076 │ INFO│ 02:20:00.458 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll'
Process ID: 31812 │ INFO│ 02:20:03.036 │ 19:bootstrap.cpp ┃ Enter Process : '31812'
Process ID: 31812 │ INFO│ 02:20:03.036 │ 20:bootstrap.cpp ┃ ModuleDirectory : 'S:\测试用\f-1'
Process ID: 31812 │ INFO│ 02:20:03.036 │ 70:hook.cpp ┃ Hooking LoadLibrary and LoadLibraryEx Functions
Process ID: 31812 │ INFO│ 02:20:03.036 │ 79:hook.cpp ┃ Hooking LoadLibraryW SUCCESS
Process ID: 31812 │ INFO│ 02:20:03.036 │ 90:hook.cpp ┃ Hooking LoadLibraryExW SUCCESS
Process ID: 31812 │ INFO│ 02:20:03.037 │ 100:hook.cpp ┃ Hooking LoadLibraryA SUCCESS
Process ID: 31812 │ INFO│ 02:20:03.037 │ 111:hook.cpp ┃ Hooking LoadLibraryExA SUCCESS
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\Game.exe'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'G:\反编译\apiMonitor\apimonitor-drv-x86.sys'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\nw_elf.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\WINMM.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\Windows\System32\winmm.DLL'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\RPGMakerMVHookTS.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll'
Process ID: 31812 │ INFO│ 02:20:03.037 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll'
Process ID: 12164 │ INFO│ 02:20:03.104 │ 19:bootstrap.cpp ┃ Enter Process : '12164'
Process ID: 12164 │ INFO│ 02:20:03.104 │ 20:bootstrap.cpp ┃ ModuleDirectory : 'S:\测试用\f-1'
Process ID: 12164 │ INFO│ 02:20:03.104 │ 70:hook.cpp ┃ Hooking LoadLibrary and LoadLibraryEx Functions
Process ID: 12164 │ INFO│ 02:20:03.104 │ 79:hook.cpp ┃ Hooking LoadLibraryW SUCCESS
Process ID: 12164 │ INFO│ 02:20:03.104 │ 90:hook.cpp ┃ Hooking LoadLibraryExW SUCCESS
Process ID: 12164 │ INFO│ 02:20:03.105 │ 100:hook.cpp ┃ Hooking LoadLibraryA SUCCESS
Process ID: 12164 │ INFO│ 02:20:03.105 │ 111:hook.cpp ┃ Hooking LoadLibraryExA SUCCESS
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\Game.exe'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'G:\反编译\apiMonitor\apimonitor-drv-x86.sys'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\nw_elf.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\WINMM.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\Windows\System32\winmm.DLL'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\RPGMakerMVHookTS.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll'
Process ID: 12164 │ INFO│ 02:20:03.105 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll'
Process ID: 28892 │ INFO│ 02:20:48.078 │ 19:bootstrap.cpp ┃ Enter Process : '28892'
Process ID: 28892 │ INFO│ 02:20:48.078 │ 20:bootstrap.cpp ┃ ModuleDirectory : 'S:\测试用\f-1'
Process ID: 28892 │ INFO│ 02:20:48.078 │ 70:hook.cpp ┃ Hooking LoadLibrary and LoadLibraryEx Functions
Process ID: 28892 │ INFO│ 02:20:48.078 │ 79:hook.cpp ┃ Hooking LoadLibraryW SUCCESS
Process ID: 28892 │ INFO│ 02:20:48.078 │ 90:hook.cpp ┃ Hooking LoadLibraryExW SUCCESS
Process ID: 28892 │ INFO│ 02:20:48.078 │ 100:hook.cpp ┃ Hooking LoadLibraryA SUCCESS
Process ID: 28892 │ INFO│ 02:20:48.078 │ 111:hook.cpp ┃ Hooking LoadLibraryExA SUCCESS
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\Game.exe'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\ntdll.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNEL32.DLL'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\KERNELBASE.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'G:\反编译\apiMonitor\apimonitor-drv-x86.sys'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHLWAPI.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcrt.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ADVAPI32.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\sechost.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\RPCRT4.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\PSAPI.DLL'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\SHELL32.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\nw_elf.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\msvcp_win.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\ucrtbase.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\USER32.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\win32u.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\GDI32.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\gdi32full.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\WINMM.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VERSION.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\WINHTTP.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\WS2_32.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\Windows\System32\winmm.DLL'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\CRYPT32.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\System32\IMM32.DLL'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'S:\测试用\f-1\RPGMakerMVHookTS.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\MSVCP140.dll'
Process ID: 28892 │ INFO│ 02:20:48.079 │ 131:hook.cpp ┃ Current Load Module : 'C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll'

sorry, I may have uploaded the wrong log file. This one corresponds to API Monitor. The previous one was generated separately for adding a test call

Answer 2 · 2023-06-30T19:14:36.000Z

The x86Detour destructor unhooks functions

lift them to global scope and store them inside a shared or unique ptr

Answer 3 · 2023-06-30T19:16:13.000Z

I understand now, I apologize for acting like a fool

Answer 4 · 2023-06-30T19:17:05.000Z

You're fine, many people make this mistake!

Answer 5 · 2023-06-30T19:28:29.000Z

You're fine, many people make this mistake!

Thank you very much for your guidance. I am surprised to receive a response so quickly. I have given you some rewards, and I hope you are happy

Answer 6 · 2023-07-01T02:21:27.000Z

I appreciate that, but please do not feel that is necessary