RdpThief icon indicating copy to clipboard operation
RdpThief copied to clipboard

Issue hooking mstsc.exe on windows 10 1903

Open rajiv2790 opened this issue 4 years ago • 0 comments

I compiled the DLL (RdpThief.dll) and injected it into mstsc.exe process. It is able to hook ADVAPI32!CredIsMarshaledCredentialW but is unable to hook SSPICLI!SspiPrepareForCredRead and dpapi!cryptprotectmemory. I was able to verify this by attaching a debugger and looking at the assembly. Only the CredIsMarshaledCredentialW function has jump into the loaded dll. Any pointers on how do I debug this issue or have you encountered this before?

Are some DLLs immune to hooking?

rajiv2790 avatar Sep 16 '20 07:09 rajiv2790