Hook works at startup, but stop working soon

[tsudakageyu]

Hook works at startup, but stop working soon

[m417z]

Use a low-level assembly debugger, such as OllyDbg (32-bit) or x64dbg:

1. Break on MH_EnableHook.
2. Go to CloseHandle, and notice that the first command is not a jump.
3. Step over the MH_EnableHook call.
4. Go to CloseHandle again, and notice that the first command was overwritten with a jump.
5. Right click on the jump command, and set a hardware breakpoint on write.
6. Resume your process. If the hook will be removed, the breakpoint will be triggered, and you can see in the stack trace where it comes from.

[altexy]

@RaMMicHaeL thanks!