PyHook icon indicating copy to clipboard operation
PyHook copied to clipboard

Error for explorer.exe process

Open Sp00p64 opened this issue 3 years ago • 7 comments

Program works for rdp etc but returns an error when hooking explorer process {'type': 'error', 'description': 'Error: expected a pointer', 'stack': 'Error: expected a pointer\n at value (frida/runtime/core.js:316)\n at <eval> (/script1.js:21)', 'fileName': 'frida/runtime/core.js', 'lineNumber': 316, 'columnNumber': 1} Tried debugging it for a bit but to no avail.

Sp00p64 avatar Aug 25 '21 19:08 Sp00p64

Hey! Can you give me your OS version and frida version? Additionally try to reset the desired process because of artifacts from the last hook that may appear.

IlanKalendarov avatar Aug 26 '21 04:08 IlanKalendarov

Thank you for the swift response ! The machine's OS is 64-bits Windows 10 Professionnal 10.0.19042 N/A build 19042 frida version is : 15.0.18 and the error seems to persist after process reboot and computer reboot.

Sp00p64 avatar Aug 26 '21 10:08 Sp00p64

This is weird, I couldn't reproduce your error in any way. Can you try to run as local admin and see if it will work that way ?

IlanKalendarov avatar Aug 29 '21 18:08 IlanKalendarov

Running as Local admin throws the same error unfortunately. I'll try running it on another machine of mine, I'll update you on the results

Sp00p64 avatar Aug 30 '21 13:08 Sp00p64

Hi sorry about the delay, I ran the program again on an updated machine and the error was gone ! But sadly after hooking the explorer process and entering a correct password in the UAC prompt no password was found. Could it be the fact that i'm running this on 64 bits machines ?

Sp00p64 avatar Sep 06 '21 17:09 Sp00p64

No, It should work. Did you run the latest version? Also hooking the UAC window works for when you open a program as a different user

IlanKalendarov avatar Sep 07 '21 06:09 IlanKalendarov

Yes I did run the latest version and it is very strange indeed,I'll provide a video and more details in the near future

Sp00p64 avatar Sep 11 '21 17:09 Sp00p64