Shoutbox

To answer your first question (and your email), my guess is that you cannot subclass TrackPopupMenuEx() when Plus! is loaded because of the way you're searching for the function location in the import table.

Using PIMAGE_THUNK_DATA.u1.Function, works fine as long as you're the only one who tries to subclass a function. As Messenger Plus! replaces the function pointer for its own, your search returns nothing and your subclass fails. To prevent that from happening, I suggest that you simply search for the function based on its name and not its address in memory.

Getting the name of an imported function is simple. Messenger Plus! does it this way:

code:

---

PIMAGE_THUNK_DATA pThunk
  = (PIMAGE_THUNK_DATA)( (PBYTE) hmodCaller + pImportDesc->FirstThunk );

//... iterate every function

PIMAGE_IMPORT_BY_NAME pImportName
  = (PIMAGE_IMPORT_BY_NAME)((PBYTE)hmodCaller + pThunkName->u1.AddressOfData);

if(!(IMAGE_SNAP_BY_ORDINAL(pThunkName->u1.Ordinal)) && pImportName->Name)
{
   /** Add code to make sure this is a pointer to a string **/

   /** Compare pImportName->Name to the known name of the function. If there's a match, proceed with the subclass like you do by searching with a pointer, however, make sure you chain the subclass properly by getting the current function address from the table and not the original function pointer. **/
}

---

Hope it helps
Patchou