{"action":"created","issue":{"url":"https://api.github.com/repos/EasyHook/EasyHook/issues/40","labels_url":"https://api.github.com/repos/EasyHook/EasyHook/issues/40/labels{/name}","comments_url":"https://api.github.com/repos/EasyHook/EasyHook/issues/40/comments","events_url":"https://api.github.com/repos/EasyHook/EasyHook/issues/40/events","html_url":"https://github.com/EasyHook/EasyHook/issues/40","id":104280286,"number":40,"title":"Problem with LhBarrierBeginStackTrace AFTER the original function is called from a hook handler","user":{"login":"kaqkk","id":13981182,"avatar_url":"https://avatars.githubusercontent.com/u/13981182?v=3","gravatar_id":"","url":"https://api.github.com/users/kaqkk","html_url":"https://github.com/kaqkk","followers_url":"https://api.github.com/users/kaqkk/followers","following_url":"https://api.github.com/users/kaqkk/following{/other_user}","gists_url":"https://api.github.com/users/kaqkk/gists{/gist_id}","starred_url":"https://api.github.com/users/kaqkk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kaqkk/subscriptions","organizations_url":"https://api.github.com/users/kaqkk/orgs","repos_url":"https://api.github.com/users/kaqkk/repos","events_url":"https://api.github.com/users/kaqkk/events{/privacy}","received_events_url":"https://api.github.com/users/kaqkk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-09-01T14:34:34Z","updated_at":"2015-09-02T09:05:00Z","closed_at":null,"body":"Hi, I'm trying to log functions together with a callstack trace.\r\nMy hook handler:\r\n```C++\r\nLPVOID WINAPI HeapAllocHook(\r\n\t_In_ HANDLE hHeap,\r\n\t_In_ DWORD  dwFlags,\r\n\t_In_ SIZE_T dwBytes\r\n\t)\r\n{\r\n\tLPVOID result = HeapAlloc(hHeap, dwFlags, dwBytes);\r\n\tPVOID pCallStackBackup = NULL;\r\n\tLhBarrierBeginStackTrace(&pCallStackBackup);\r\n\r\n// Here I call my own logger function which captures stack trace and logs the 'result' and the dwBytes\r\n        Log(result,dwBytes);\r\n\t\t\r\n\tif (pCallStackBackup)\r\n\t\tLhBarrierEndStackTrace(pCallStackBackup);\r\n\treturn result;\r\n}\r\n```\r\nThe problem is that I get the \"The caller is not inside a hook handler.\" error when calling the LhBarrierBeginStackTrace function in the example above. It looks like that after calling the original HeapAlloc function the LhBarrierBeginStackTrace can't obtain the 'Runtime->Current' pointer as the LhBarrierIntro's DONT_INTERCEPT part will set it to NULL. So when it returns, these functions think that they are outside the hook handler, however it is not the case.\r\nThis makes it really awkward for me to capture call stack as I would need to first Save it early to somewhere, then call the original function, then pass the saved callstack to my logger function separately. There could be other scenarios too which can be problematic I guess.\r\n\r\nIs there a recommended workaround for this (so this behaviour is intentional), or is it a bug in easyhook?\r\n\r\nThanks in advance!\r\n"},"comment":{"url":"https://api.github.com/repos/EasyHook/EasyHook/issues/comments/136984689","html_url":"https://github.com/EasyHook/EasyHook/issues/40#issuecomment-136984689","issue_url":"https://api.github.com/repos/EasyHook/EasyHook/issues/40","id":136984689,"user":{"login":"spazzarama","id":933730,"avatar_url":"https://avatars.githubusercontent.com/u/933730?v=3","gravatar_id":"","url":"https://api.github.com/users/spazzarama","html_url":"https://github.com/spazzarama","followers_url":"https://api.github.com/users/spazzarama/followers","following_url":"https://api.github.com/users/spazzarama/following{/other_user}","gists_url":"https://api.github.com/users/spazzarama/gists{/gist_id}","starred_url":"https://api.github.com/users/spazzarama/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spazzarama/subscriptions","organizations_url":"https://api.github.com/users/spazzarama/orgs","repos_url":"https://api.github.com/users/spazzarama/repos","events_url":"https://api.github.com/users/spazzarama/events{/privacy}","received_events_url":"https://api.github.com/users/spazzarama/received_events","type":"User","site_admin":false},"created_at":"2015-09-02T09:05:00Z","updated_at":"2015-09-02T09:05:00Z","body":"Oh wait - you should not call the original function first. Once you call the original function you lose the context.\r\n\r\ni.e. move `LPVOID result = HeapAlloc(hHeap, dwFlags, dwBytes);` to below where you get the stack trace."}}