{"action":"opened","issue":{"url":"https://api.github.com/repos/EasyHook/EasyHook/issues/34","labels_url":"https://api.github.com/repos/EasyHook/EasyHook/issues/34/labels{/name}","comments_url":"https://api.github.com/repos/EasyHook/EasyHook/issues/34/comments","events_url":"https://api.github.com/repos/EasyHook/EasyHook/issues/34/events","html_url":"https://github.com/EasyHook/EasyHook/issues/34","id":102678807,"number":34,"title":"WinXP + GetWindowDC hook crash","user":{"login":"spazzarama","id":933730,"avatar_url":"https://avatars.githubusercontent.com/u/933730?v=3","gravatar_id":"","url":"https://api.github.com/users/spazzarama","html_url":"https://github.com/spazzarama","followers_url":"https://api.github.com/users/spazzarama/followers","following_url":"https://api.github.com/users/spazzarama/following{/other_user}","gists_url":"https://api.github.com/users/spazzarama/gists{/gist_id}","starred_url":"https://api.github.com/users/spazzarama/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spazzarama/subscriptions","organizations_url":"https://api.github.com/users/spazzarama/orgs","repos_url":"https://api.github.com/users/spazzarama/repos","events_url":"https://api.github.com/users/spazzarama/events{/privacy}","received_events_url":"https://api.github.com/users/spazzarama/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/EasyHook/EasyHook/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-08-24T00:54:33Z","updated_at":"2015-08-24T00:54:33Z","closed_at":null,"body":"*Moved from [CodePlex](https://easyhook.codeplex.com/workitem/18901)\r\nOriginally submitted by EaSy123*\r\n\r\nI have described problem and (probably) a solution to this. I hope it will be an easy fix. :)\r\n \r\nhttp://easyhook.codeplex.com/Thread/View.aspx?ThreadId=73300\r\n \r\nThanks.\r\n\r\n**Comments**\r\n\r\n*EaSy123 wrote Oct 20, 2010 at 4:51 AM*\r\n\r\nfor example: \"ResumeThread\" will be no longer hookable on 32b using this solution ... workaround is to hook NtResumeThread\r\n\r\n*Paramike wrote Feb 8, 2011 at 7:24 PM*\r\n\r\nThis error also occurs while hooking FindNextFileA on Windows Vista 32 bits. The same fix applies.\r\n\r\n**Suggested solution**\r\n\r\n*EaSy123 Oct 8, 2010 at 6:27 AM Edited Oct 8, 2010 at 6:32 AM*\r\n\r\nHello,\r\n\r\nsorry for reopening old post.\r\n\r\nI want add some info. There is a problem with `RtlProtectMemory`.\r\n\r\nThe solution to problem is:\r\n```c\r\n#ifdef X64_DRIVER\r\n    FORCE(EntrySize = LhRoundToNextInstruction(InEntryPoint, 16)); //originaly was 12\r\n#else\r\n    FORCE(EntrySize = LhRoundToNextInstruction(InEntryPoint, 8)); //originaly was 5\r\n#endif\r\n```\r\nvalue is then used by:\r\n```c\r\n//this code is used only in 32b, so in 64b 12 will probably work\r\nFORCE(RtlProtectMemory(Hook->TargetProc, Hook->EntrySize, PAGE_EXECUTE_READWRITE));\r\n```\r\nand data are written:\r\n```c\r\n#ifdef X64_DRIVER\r\n...\r\n    *((ULONGLONG*)(Hook->TargetProc + 0)) = AtomicCache_x64;\r\n    *((ULONGLONG*)(Hook->TargetProc + 8)) = AtomicCache;               //reason why 16 (not 12)\r\n#else\r\n...\r\n    *((ULONGLONG*)Hook->TargetProc) = AtomicCache;  //reason why 8 (not 5)\r\n#endif\r\n```\r\nYou may wonder, why it is problem.\r\n\r\nIt is not problem until `LhRoundToNextInstruction` is returning >= 8, and this is not happening on some wXP machines with GetWindowDC function --> crash or BSOD.\r\n\r\nFinally I hope, this modification wont cause more trouble. :))\r\n\r\n "}}