Search code examples
winapidllregistrycode-injectioncreateprocess

AppCertDLLs do not work in GUI apps, why?


I was trying to automatically inject a dll to every process (including GUI) whenever it is started by a user . My DLL hooks DoDragDrop method of winapi and communicates with server to decide allow or disallow the drag & drop process. I use easyhook (particularly this tutorial) for hooking part. I created a gist for my code : Gist

In this url it says: Doesn’t work reliably against GUI applications. Stick to console apps. No wonder it didn't work in microsoft edge, and chrome. I also tried code parts in these urls: first second Finally , I already certificated my dll.

Is there any other way apart from appcertdlls? Thank you in advance.

Edit: I can't use appinitdlls, some users might have secure boot enabled.

Edit2: Seems like dlls in some tutorials is under system32 (this, and this) , and I moved mine under system32 too, but it did not work.


Solution

  • PsSetLoadImageNotifyRoutine can be used, though it is a solution in kernel mode.