EasyHook errors

[brian6932]

❯ $_=Get-ItemProperty 'HKLM:/SOFTWARE/Microsoft/Windows NT/CurrentVersion';$_.CurrentMajorVersionNumber.ToString()+'.'+$_.CurrentMinorVersionNumber.ToString()+'.'+$_.CurrentBuild+'.'+$_.UBR
10.0.19044.5131

❯ dotnet build -p:Configuration=Release -m:$env:NUMBER_OF_PROCESSORS
  Determining projects to restore...
  Restored ...\NetworkAdapterSelector\NetworkAdapterSelector.ShellExtension\NetworkAdapterSelector.ShellExtension.csproj (in 214 ms).
  Restored ...\NetworkAdapterSelector\NetworkAdapterSelector.Hook\NetworkAdapterSelector.Hook.csproj (in 214 ms).
  1 of 3 projects are up-to-date for restore.
  NetworkAdapterSelector.TestApp -> ...\NetworkAdapterSelector\NetworkAdapterSelector.TestApp\bin\Release\net462\NetworkAdapterSelector.TestApp.exe
  NetworkAdapterSelector.ShellExtension -> ...\NetworkAdapterSelector\Release\net462\NetworkAdapterSelector.ShellExtension.dll
  NetworkAdapterSelector.Hook -> ...\NetworkAdapterSelector\Release\net472\NetworkAdapterSelector.Hook.exe

Build succeeded.
    0 Warning(s)
    0 Error(s)

Time Elapsed 00:00:01.29

❯ Set-Location Release/net472

❯ .\NetworkAdapterSelector.Hook.exe -n (Get-NetAdapter redacted).DeviceID -e (where.exe redacted.exe)
Creating process ...
Trying to create the process as suspended.
Trying to create the process as suspended.
Trying to create the process as suspended.
Trying to create the process as suspended.
System.DllNotFoundException: Unable to load DLL 'EasyHook64.dll': The specified module could not be found. (Exception from HRESULT: 0x8007007E)
   at EasyHook.NativeAPI_x64.RtlCreateSuspendedProcess(String InEXEPath, String InCommandLine, Int32 InProcessCreationFlags, Int32& OutProcessId, Int32& OutThreadId)
   at EasyHook.NativeAPI.RtlCreateSuspendedProcess(String InEXEPath, String InCommandLine, Int32 InProcessCreationFlags, Int32& OutProcessId, Int32& OutThreadId)
   at EasyHook.RemoteHooking.CreateAndInject(String InEXEPath, String InCommandLine, Int32 InProcessCreationFlags, InjectionOptions InOptions, String InLibraryPath_x86, String InLibraryPath_x64, Int32& OutProcessId, Object[] InPassThruArgs)
   at NetworkAdapterSelector.Hook.Program.CreateAndInjectProcess(String networkId, String filePath, String arguments) in ...\NetworkAdapterSelector\NetworkAdapterSelector.Hook\Program.cs:line 74
   at NetworkAdapterSelector.Hook.Program.Main() in ...\NetworkAdapterSelector\NetworkAdapterSelector.Hook\Program.cs:line 196
Failed to start process. Fallback to delayed injection.
Trying to inject process #21312.
Trying to inject process #21312.
Trying to inject process #21312.
Trying to inject process #21312.
System.DllNotFoundException: Unable to load DLL 'EasyHook64.dll': The specified module could not be found. (Exception from HRESULT: 0x8007007E)
   at EasyHook.NativeAPI_x64.RhInjectLibrary(Int32 InTargetPID, Int32 InWakeUpTID, Int32 InInjectionOptions, String InLibraryPath_x86, String InLibraryPath_x64, IntPtr InPassThruBuffer, Int32 InPassThruSize)
   at EasyHook.RemoteHooking.InjectEx(Int32 InHostPID, Int32 InTargetPID, Int32 InWakeUpTID, Int32 InNativeOptions, String InLibraryPath_x86, String InLibraryPath_x64, Boolean InCanBypassWOW64, Boolean InCanCreateService, Boolean InRequireStrongName, Object[] InPassThruArgs)
   at NetworkAdapterSelector.Hook.Program.InjectProcess(String networkId, Int32 processId) in ...\NetworkAdapterSelector\NetworkAdapterSelector.Hook\Program.cs:line 145
   at NetworkAdapterSelector.Hook.Program.Main() in ...\NetworkAdapterSelector\NetworkAdapterSelector.Hook\Program.cs:line 222
FATAL

❯ Get-ChildItem

        Directory: ...\NetworkAdapterSelector\Release\net472


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a---        2018-08-14   1:36 PM         185856   CommandLine.dll
-a---        2018-08-03   4:59 AM          52224   EasyHook.dll
-a---        2024-11-28   7:10 AM          59904 󰣆  NetworkAdapterSelector.Hook.exe
-a---        2024-11-28   7:10 AM            176   NetworkAdapterSelector.Hook.exe.config
-a---        2024-11-28   7:10 AM          16184   NetworkAdapterSelector.Hook.pdb
-a---        2020-02-19   5:05 AM          20856   System.Buffers.dll
-a---        2022-05-07  11:31 PM         142240   System.Memory.dll
-a---        2018-05-15   9:29 AM         115856   System.Numerics.Vectors.dll
-a---        2016-04-26   5:19 PM          28424   System.Reflection.TypeExtensions.dll
-a---        2022-10-18  12:37 PM          61568   System.Resources.Extensions.dll
-a---        2020-02-19   5:05 AM          16768   System.Runtime.CompilerServices.Unsafe.dll

❯ Rename-Item .\EasyHook.dll EasyHook64.dll

❯ .\NetworkAdapterSelector.Hook.exe -n (Get-NetAdapter redacted).DeviceID -e (where.exe redacted.exe)
Creating process ...
System.IO.FileNotFoundException: Could not load file or assembly 'EasyHook, Version=2.7.6789.0, Culture=neutral, PublicKeyToken=4b580fca19d0b0c5' or one of its dependencies. The system cannot find the file specified.
File name: 'EasyHook, Version=2.7.6789.0, Culture=neutral, PublicKeyToken=4b580fca19d0b0c5'
   at NetworkAdapterSelector.Hook.Program.CreateAndInjectProcess(String networkId, String filePath, String arguments)
   at NetworkAdapterSelector.Hook.Program.Main() in ...\NetworkAdapterSelector\NetworkAdapterSelector.Hook\Program.cs:line 196

WRN: Assembly binding logging is turned OFF.
To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1.
Note: There is some performance penalty associated with assembly bind failure logging.
To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog].

Failed to start process. Fallback to delayed injection.
System.IO.FileNotFoundException: Could not load file or assembly 'EasyHook, Version=2.7.6789.0, Culture=neutral, PublicKeyToken=4b580fca19d0b0c5' or one of its dependencies. The system cannot find the file specified.
File name: 'EasyHook, Version=2.7.6789.0, Culture=neutral, PublicKeyToken=4b580fca19d0b0c5'
   at NetworkAdapterSelector.Hook.Program.InjectProcess(String networkId, Int32 processId)
   at NetworkAdapterSelector.Hook.Program.Main() in ...\NetworkAdapterSelector\NetworkAdapterSelector.Hook\Program.cs:line 222

WRN: Assembly binding logging is turned OFF.
To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1.
Note: There is some performance penalty associated with assembly bind failure logging.
To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog].

FATAL

The precompiled bin from the installer seems to error as well.

❯ Get-ChildItem

        Directory: ...\nas


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a---        2024-11-28   7:54 AM        2276469 󰣆  Network Adapter Selector.exe
-a---        2024-11-28   7:55 AM        1517056 󰏖  Network Adapter Selector.msi

❯ lessmsi x '.\Network Adapter Selector.msi'
Extracting '...\nas\Network Adapter Selector.msi' to '...\nas\Network Adapter Selector'.
1/13    LICENSE
2/13    EasyHook32.dll
3/13    EasyHook32Svc.exe
4/13    EasyHook64.dll
5/13    EasyHook64Svc.exe
6/13    EasyLoad32.dll
7/13    EasyLoad64.dll
8/13    NetworkAdapterSelector.Hook.exe
9/13    CommandLine.dll
10/13   EasyHook.dll
11/13   srm.exe
12/13   SharpShell.dll
13/13   NetworkAdapterSelector.ShellExtension.dll

❯ Set-Location 'SourceDir/program files/Network Adapter Selector'

❯ .\NetworkAdapterSelector.Hook.exe -n (Get-NetAdapter redacted).DeviceID -e (where.exe redacted.exe)
System.ApplicationException: STATUS_INTERNAL_ERROR: C++ completion routine has returned success but didn't raise the remote event. (Code: 0)
   at EasyHook.NativeAPI.Force(Int32 InErrorCode)
   at EasyHook.RemoteHooking.InjectEx(Int32 InHostPID, Int32 InTargetPID, Int32 InWakeUpTID, Int32 InNativeOptions, String InLibraryPath_x86, String InLibraryPath_x64, Boolean InCanBypassWOW64, Boolean InCanCreateService, Boolean InRequireStrongName, Object[] InPassThruArgs)
   at NetworkAdapterSelector.Hook.Program.Main()