Unable to hook DestroyCaret function from user32 module about mhook HOT 4 CLOSED

Thanks for reporting. We are looking into this.

from mhook.

Hi, @rommar!

Could please anyone comment on this situation? Is this a known behavior?

First of all, it's a known situation, yes.
To hook some function mhook takes first 5 bytes of that function, save them to some memory location, and instead of them, write the jump to our hook (MyXXXFunction).
After our hook execution, (when you do return OriginalFuncPtr()) it jumps first to saved first 5 bytes of function, execute them, and then jumps back to original function code.
The problem with some call and jump instructions is they use address relative to the next statement, and we can't just move that instructions to another place without breaking the logic.

Originally mhook will just fail to hook functions with such instructions in the beggining.

Is there any drawback of such modification?

So the drawback of your modification is that you will call not original USER32.DestroyCaret after your hook, but something else instead. I would not recomend to do this.

I will investigate the case with DestroyCaret, most probably we will add the logic that fix relative addressing for calls.

from mhook.

@rommar The issue should be fixed now. Please check the latest master.

from mhook.

@SergiusTheBest @Grivus Wow, you are so fast! I confirm that it is working now for both x86 and x64 builds. Thank you!

from mhook.