{"action":"created","issue":{"url":"https://api.github.com/repos/EasyHook/EasyHook/issues/13","labels_url":"https://api.github.com/repos/EasyHook/EasyHook/issues/13/labels{/name}","comments_url":"https://api.github.com/repos/EasyHook/EasyHook/issues/13/comments","events_url":"https://api.github.com/repos/EasyHook/EasyHook/issues/13/events","html_url":"https://github.com/EasyHook/EasyHook/issues/13","id":101143903,"number":13,"title":"Access violation when hooking registry inside Winword process (64bit, Windows 8) - reentrant","user":{"login":"spazzarama","id":933730,"avatar_url":"https://avatars.githubusercontent.com/u/933730?v=3","gravatar_id":"","url":"https://api.github.com/users/spazzarama","html_url":"https://github.com/spazzarama","followers_url":"https://api.github.com/users/spazzarama/followers","following_url":"https://api.github.com/users/spazzarama/following{/other_user}","gists_url":"https://api.github.com/users/spazzarama/gists{/gist_id}","starred_url":"https://api.github.com/users/spazzarama/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spazzarama/subscriptions","organizations_url":"https://api.github.com/users/spazzarama/orgs","repos_url":"https://api.github.com/users/spazzarama/repos","events_url":"https://api.github.com/users/spazzarama/events{/privacy}","received_events_url":"https://api.github.com/users/spazzarama/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/EasyHook/EasyHook/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/EasyHook/EasyHook/milestones/1","html_url":"https://github.com/EasyHook/EasyHook/milestones/2.7%20Stable","labels_url":"https://api.github.com/repos/EasyHook/EasyHook/milestones/1/labels","id":1255063,"number":1,"title":"2.7 Stable","description":null,"creator":{"login":"spazzarama","id":933730,"avatar_url":"https://avatars.githubusercontent.com/u/933730?v=3","gravatar_id":"","url":"https://api.github.com/users/spazzarama","html_url":"https://github.com/spazzarama","followers_url":"https://api.github.com/users/spazzarama/followers","following_url":"https://api.github.com/users/spazzarama/following{/other_user}","gists_url":"https://api.github.com/users/spazzarama/gists{/gist_id}","starred_url":"https://api.github.com/users/spazzarama/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spazzarama/subscriptions","organizations_url":"https://api.github.com/users/spazzarama/orgs","repos_url":"https://api.github.com/users/spazzarama/repos","events_url":"https://api.github.com/users/spazzarama/events{/privacy}","received_events_url":"https://api.github.com/users/spazzarama/received_events","type":"User","site_admin":false},"open_issues":7,"closed_issues":8,"state":"open","created_at":"2015-08-14T12:01:36Z","updated_at":"2015-08-24T02:39:19Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2015-08-15T05:36:58Z","updated_at":"2015-08-24T04:42:38Z","closed_at":"2015-08-24T02:39:19Z","body":"*Moved from [CodePlex](https://easyhook.codeplex.com/workitem/25596)\r\nOriginally submitted by helmy*\r\n\r\nHi,\r\nI have to hook all windows registry functions in a VSTO addin that runs inside Microsoft Word. \r\nThis worked fine for years now with your great easyhook ...until we ported to .NET 4.0. \r\nUsing latest version 2.7 of easyhook did not solve the problem.\r\n32bit works fine, but running the hook in 64bit winword process crashes with an access violation.\r\nThe problem appears under Windows 8 (sometimes also under Windows 7). I am using the 64bit version of Office 2010 and 2013.\r\n\r\nI did a lot of debugging but could not find the problem. RIP addresses are not used, I checked that during debugging. \r\n\r\nI attached a VSTO addin sample where I only install a hook for RegOpenKeyW and RegOpenKeyA. There is a setup in the publish folder\r\nto install the addin in Word 2010 or 2013 (64bit).\r\n\r\nThe addin adds a new HOOKING tab on the ribbon. Create RegHook installs hook for RegOpenKeyW and RegOpenKeyA of kernelbase.dll.\r\n\r\nClicking on \"Create RegHook\" will crash winword process.\r\n\r\nAny help is appreciated!\r\nthanks\r\n\r\n**Comments**\r\n\r\n*helmy wrote Sep 4, 2014 at 5:45 PM*\r\nThere seems to be a problem with reentrances just under 64bit (W7 & W8.1). We are using the latest release 2.7.5292.0. \r\nIn our registry handler for e.g. RegOpenKeyEx we are calling HookRuntimeInfo.Callback at the very beginning. \r\nBefore the Callback is returned, RegOpenKeyEx is\r\n\r\n called from the system on the same thread and in LhBarrierIntro Runtime->Current is set to NULL. HookRuntimeInfo.Callback returns then STATUS_NOT_SUPPORTED. Although I am inside a hook handler. This is very strange because we never saw that exception before. It appeared when we switched to Framework 4.0, and only for 64bit. \r\n\r\nThere is a SelfProtection in LhBarrierIntro that cares about reentrance.\r\nWe solved the problem by putting the AquireSelfProtection() and ReleaseSelfProtection() \r\nto the interface of easyhook to be able to call it before our hook handlers are called. Since we are using that our problems are solved. \r\n\r\nCallstack of a thread looks as following: \r\n\r\nEasyHook64.dll!LhBarrierGetCallback() // throws status not supported although I am inside a hook handler\r\n```\r\n[managed to native trainsition]\r\nEasyHook64.dll!LhBarrierIntro() // at DONT_INTERCEPT: Info->Current = NULL\r\nadvapi32.dll!RegOpenKeyExWStub()// system calls RegOpenKey\r\nEasyHook.dll!EasyHook.NativeAPI.LhBarrierGetCallback()\r\nEasyHook.dll!EasyHook.HookRuntimeInfo.Handle.get()\r\nEasyHook.dll!EasyHook.HookRuntimeInfo.Callback.get()\r\nOurCustomWinApiHooks.dll!RegOpenKeyEx_Hooked() // this is my hook callback where I call HookRuntimeInfo.Callback \r\n```\r\n\r\nAttached the modified sample (with 2.7.5292.0). where the exception is easily reproducible with word 64bit. attachment: https://www.dropbox.com/s/8hkzj10f19f7ezq/WordPlugin2.zip?dl=0\r\n\r\nwould be great if you could take a look at it and maybe consider putting SelfProtection on the interface for such cases?\r\nthanks"},"comment":{"url":"https://api.github.com/repos/EasyHook/EasyHook/issues/comments/134032601","html_url":"https://github.com/EasyHook/EasyHook/issues/13#issuecomment-134032601","issue_url":"https://api.github.com/repos/EasyHook/EasyHook/issues/13","id":134032601,"user":{"login":"spazzarama","id":933730,"avatar_url":"https://avatars.githubusercontent.com/u/933730?v=3","gravatar_id":"","url":"https://api.github.com/users/spazzarama","html_url":"https://github.com/spazzarama","followers_url":"https://api.github.com/users/spazzarama/followers","following_url":"https://api.github.com/users/spazzarama/following{/other_user}","gists_url":"https://api.github.com/users/spazzarama/gists{/gist_id}","starred_url":"https://api.github.com/users/spazzarama/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spazzarama/subscriptions","organizations_url":"https://api.github.com/users/spazzarama/orgs","repos_url":"https://api.github.com/users/spazzarama/repos","events_url":"https://api.github.com/users/spazzarama/events{/privacy}","received_events_url":"https://api.github.com/users/spazzarama/received_events","type":"User","site_admin":false},"created_at":"2015-08-24T04:42:38Z","updated_at":"2015-08-24T04:42:38Z","body":"After some additional testing the only way I could reproduce the error was by setting a breakpoint on the following line and then use the inspector on `HookRuntimeInfo.Callback`:\r\n\r\n![image](https://cloud.githubusercontent.com/assets/933730/9432860/4aa1062e-4a6d-11e5-8f4b-024d8c254980.png)\r\n\r\nHowever if I set the breakpoint on the next line the callback is retrieved successfully (but inspecting again still results in the same error even though `hch` is set correctly - see below screenshots).\r\n\r\n![image](https://cloud.githubusercontent.com/assets/933730/9432885/7f3f2cc6-4a6d-11e5-8129-1367a7266843.png)\r\n![image](https://cloud.githubusercontent.com/assets/933730/9432906/eb091304-4a6d-11e5-8f8d-1412ea3c79d8.png)\r\n\r\nI believe something the debugger is doing is interfering (e.g. using a different thread), once the error has occurred subsequent calls work correctly within the debugger. "}}