Menu

9xheap Hook

2023-01-28
2023-02-04
  • BEEN_Nath_58

    BEEN_Nath_58 - 2023-01-28

    Thread for the 9xheap hook

     
  • BEEN_Nath_58

    BEEN_Nath_58 - 2023-01-28

    The 9xheap hook works fine in Win10 21H2 as I tested on a VM. My 2nd machine having both Windows 7 and Windows 10 22H2 can't use the tweak.

    On Windows 10 22H2, it complains saying it can't find the file where the file is clearly present!

    On Windows 7 the application refuses to launch with the tweak.

    Please look into it.

     
    • gho

      gho - 2023-01-29

      The 9xheap.dll currently provided with DxWnd has dependencies with a given VisualC runtime. I think that the cause of the error is the lack of these modules. Maybe Dippy Dipper could help building a version with no dependencies. Now it's too late for me, tomorrow I could try to follow Dippy Dipper's directions, but I'm not sure I have a VC++ compiler able to build the 9xheap project. Well, tomorrow I'll see what happens...

       

      Last edit: gho 2023-01-29
  • dippy dipper

    dippy dipper - 2023-01-30

    VC++2015 dependencies? I don't have any modern compilers installed at the moment. Also I have never used the 9xheap dll either. But If you have some modern VC compiler then it could be as simple as changing the project to compile as MT instead of MD.

    https://learn.microsoft.com/en-us/cpp/build/reference/md-mt-ld-use-run-time-library?view=msvc-170

    /MT Causes the application to use the multithread, static version of the run-time library. Defines _MT and causes the compiler to place the library name LIBCMT.lib into the .obj file so that the linker will use LIBCMT.lib to resolve external symbols.

     

    Last edit: dippy dipper 2023-01-30
  • BEEN_Nath_58

    BEEN_Nath_58 - 2023-01-30

    could well be vc++ issues. I noticed it still works on Win10 22H2 unlike Win11 22H2. I will try on both Win7 and Win10 with the Vc2015

     
  • gho

    gho - 2023-01-30

    In my files I have a tentative static version of 9xheap (not built by me). This one has no dependencies, maybe it works better?

     
  • BEEN_Nath_58

    BEEN_Nath_58 - 2023-01-30

    Okay this one is working on windows 10 22h2.

    It still doesn't work on win7. I get an error SuspendThread error=5 now (atleast on my vm)

     
    • gho

      gho - 2023-01-30

      Try running DxWnd and the target with Administrator's capabilities...

       
      • BEEN_Nath_58

        BEEN_Nath_58 - 2023-01-30

        Nope, doesn't work.

        It prints only one line:

        [00000:000] __COMPAT_LAYER="(null)"
        
         
  • gho

    gho - 2023-01-30

    Uhmm... I wrote to Batteryshark, it would be great if he could help ...

     
    • BEEN_Nath_58

      BEEN_Nath_58 - 2023-01-31

      Probably the reason it didn't work because his patching method is incompatible someway with Windows 7, i.e. you need to port the same thing for XP+ compatibility

       
    • batteryshark

      batteryshark - 2023-01-31

      Ill dig into my patch tomorrow and see if i can spot the issue. I'm away at the moment eith no access to my desktop for another two days, but I might be able to point out why.

       
  • batteryshark

    batteryshark - 2023-01-31

    its probably shim.c https://github.com/batteryshark/9xheap_public/blob/main/shim.c
    I'm making inline hooks for those functions and the win7 functions may have different sizes, prologues, or names. Since this code was written, Ive been more apt to use polyhook2 instead for cross compatibility.

     
    • BEEN_Nath_58

      BEEN_Nath_58 - 2023-01-31

      Hi @batteryshark, thanks for the response. Probably the hook can get fixed.

      I also sent an Issue in the github thread. The shim isn't working fine on Windows 11 22H2 anymore, it crashes here and there and causes exceptions all across the place. Do you have any idea or a remedy on what should be done?

       
  • gho

    gho - 2023-01-31

    @batteryshark :
    If you manage to get a built version of polyhook2 for x86 could you hand me a copy of the dll? I'm using my own hooking methods, mostly patching the vtable but in some gases using MinHook and I am satisfied with that, but I'm curious to see if polyhook2 could fix some problems.
    Well, I know I could build it myself, but I'm sort of a lazy boy (and busy too) ;)

     

    Last edit: gho 2023-01-31
    • dippy dipper

      dippy dipper - 2023-01-31

      Ummm... Slightly confused here. polyhook2 is another generic method of hooking programs as per here:
      https://github.com/stevemk14ebr/PolyHook_2_0

      What does it have to do with heap emulation? On the other hand I guess polyhook2 might potentially have its benefits as advertised here:
      https://www.codeproject.com/articles/1100579/polyhook-the-cplusplus-x-x-hooking-library

      Minhook is pretty good but i relies on pre crafted trampoline routines, sometimes fails to hook, and the source code is again bloated.

      Not that I've run into games having issues with the Dxwnd hooks. Inject DLL has done it's job well on the games I have tested that had trouble with the standard hook...

       
      • gho

        gho - 2023-01-31

        Some explanations (Batteryshark will forgive me if I'm not exact).
        The 9xheap.dll is an independent project that works independently from DxWnd. It has its own way to hook the heap system calls to be patched. It is built in such a way that when you reference the dll it automatically hooks all the heap calls and makes them compatible with Win95. But the presence of two separate hooking schemas makes it plausible that this could be the problem about Window compatibility. At least, this was Batteryshark's guess.
        Then, it wouldn't be possible to use the DxWnd default IAT patching mode because the heap calls are also hidden in system libraries whose IAT is not scanned, while a prologue redirection is much more intrusive.

         
  • BEEN_Nath_58

    BEEN_Nath_58 - 2023-01-31

    On the other hand I guess polyhook2 might potentially have its benefits as advertised here:

    Does it benefit for NFSSE?

    it wouldn't be possible to use the DxWnd default IAT patching mode

    Polyhook2 is generated using VC++17. I wonder if it will need extra libraries to utilise it (better if can be avioded).

    Also can Polyhook2 replace the old Minhook (think about Win7 hooking issues, as in Godfather)

     

    Last edit: BEEN_Nath_58 2023-01-31
    • BEEN_Nath_58

      BEEN_Nath_58 - 2023-02-01

      PowerVR SGL wrapper is very developed now and could come any day. DSOAL is there, there is D3DRM and D3DX unimplemented by DxWnd.

      Can Minhook hook them all, can IAT patching hook? Probably if theh aren't efficienct enouhh PolyHook2 can be an option

       
      • gho

        gho - 2023-02-04

        The matter of hooking is complex, it can't be reduced to a simple more powerful library. The current hookers are ok, but it's always better to have more arrows in your quiver, so I'll try PolyHook as soon as I'll have some time.
        But I got no news from Batteryshark. I hope the adaptation was not more complex than expected ...

         

Log in to post a comment.

MongoDB Logo MongoDB