Re: SetWindowsHooksEx

No, it isn't exported anyway; user32 and perhaps winsrv have the call stub
static linked but not exported.

In any case, win32k has some security checks built in; you must have
sufficient rights granted on the target desktop to perform the operation,
and there is an additional check to verify that you have the same logon
session id as the target application (unless the target application threads
desktop has the DF_ALLOWOTHERACCOUNTHOOK flag which is not set by default)
before the injection is permitted.

--
Ken Johnson (Skywing)
Windows SDK MVP

<euacela@xxxxxxxxx> wrote in message
news:1155116847.669674.12760@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
I am intereseted because I want to write a security aplication in
kernel mode and I beleive that microsoft is abusing of insecurity. This
function actually writes in a process memory usualy a dll and you know
where that could get you . . . . if it a malicious attack.
this function is exported by ntdll right ?


Eugene Gershnik wrote:
euacela@xxxxxxxxx wrote:
Hi,
I was wondering what lower function SetWindowsHooksEx calls.

NtUserSetWindowsHookEx system call. Google reveals that quite a few
people
seem to be interested in it.

Why do you care?


--
Eugene
http://www.gershnik.com



.

Relevant Pages

  • Re: Shutdown Utilities Do Not Work
    ... If you turn logon auditing on the target (control panel/local policies/Audit ... policy), you should see the network logon in the security eventlog. ... Local User Rights ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Global Security Group members disappear
    ... Event Category: Account Management ... Security Enabled Global Group Member Removed: ... Target Account Name: Students ... Caller User Name: SENIOR$ ...
    (microsoft.public.windows.server.active_directory)
  • Re: WU v5, Cant download updates
    ... I have been through all the security verifications, impersonation settings, ... Target version: 5.5.3790.2182 Required: 5.5.3790.2182 ... > the Authenticated Users to run Windows Update. ... >> I get error messages indicating that the download failed. ...
    (microsoft.public.windowsupdate)
  • [UNIX] Bluez Hcid popen() Explained
    ... Get your security news from a reliable source. ... In order for the vulnerability to become exploitable the target must have ... In ltrace when the attacking host attempts to pair with the target we can ... like "Incoming connection from ". ...
    (Securiteam)
  • Re: W2k3 AD migration to W2k3 AD - HELP HELP!!
    ... for the target either delegated permissions or admin permissions ... create an account in the target domain, make it a member of domain admins ... Translate security of the data/resources from source security ...
    (microsoft.public.windows.server.migration)
Loading