title: Hook ZwCreateSection(), CreateProcess() and CreateProcessEx() using mhook to block certain application from launching
body: <p>I am trying to use mhook to create a global hook on CreateProcess(), CreateProcessEx() or ZwCreateSection() so that i can block certain application from launching. I followed the steps provided at <a href="https://www.apriorit.com/dev-blog/160-apihooks" rel="nofollow noreferrer">https://www.apriorit.com/dev-blog/160-apihooks</a>. But it doesn't seems to work. Is it even possible and if yes please provide any suggestion. 
  I tried the following code to log every process creation using CreateProcess().</p>
  
  <pre><code>#include "stdafx.h"
  #include&lt;fstream&gt;
  #include "mhook/mhook-lib/mhook.h"
  
  typedef BOOL (WINAPI *_CreateProcess)(
      _In_opt_    LPCTSTR               lpApplicationName,
      _Inout_opt_ LPTSTR                lpCommandLine,
      _In_opt_    LPSECURITY_ATTRIBUTES lpProcessAttributes,
      _In_opt_    LPSECURITY_ATTRIBUTES lpThreadAttributes,
      _In_        BOOL                  bInheritHandles,
      _In_        DWORD                 dwCreationFlags,
      _In_opt_    LPVOID                lpEnvironment,
      _In_opt_    LPCTSTR               lpCurrentDirectory,
      _In_        LPSTARTUPINFO         lpStartupInfo,
      _Out_       LPPROCESS_INFORMATION lpProcessInformation
  );
  
  _CreateProcess TrueCreateProcess = 
      (_CreateProcess)::GetProcAddress(::GetModuleHandle(L"kernel32"),"CreateProcess");
  
  BOOL WINAPI HookCreateProcess(
    _In_opt_    LPCTSTR               lpApplicationName,
    _Inout_opt_ LPTSTR                lpCommandLine,
    _In_opt_    LPSECURITY_ATTRIBUTES lpProcessAttributes,
    _In_opt_    LPSECURITY_ATTRIBUTES lpThreadAttributes,
    _In_        BOOL                  bInheritHandles,
    _In_        DWORD                 dwCreationFlags,
    _In_opt_    LPVOID                lpEnvironment,
    _In_opt_    LPCTSTR               lpCurrentDirectory,
    _In_        LPSTARTUPINFO         lpStartupInfo,
    _Out_       LPPROCESS_INFORMATION lpProcessInformation
  )
      {
      std::wofstream out;
      out.open("D:\\Log.txt",std::ios_base::app);
      if(out!=NULL)
      {
          out&lt;&lt;"Process Created\n";
      }
      return TrueCreateProcess(lpApplicationName,
          lpCommandLine,
          lpProcessAttributes,
          lpThreadAttributes,
          bInheritHandles,
          dwCreationFlags,
          lpEnvironment,
          lpCurrentDirectory,
          lpStartupInfo,
          lpProcessInformation);
      }
  
  BOOL WINAPI DllMain(
      __in HINSTANCE  hInstance,
      __in DWORD      Reason,
      __in LPVOID     Reserved
      )
  {        
      switch (Reason)
      {
      case DLL_PROCESS_ATTACH:
          Mhook_SetHook((PVOID*)&amp;TrueCreateProcess, HookCreateProcess);
          break;
  
      case DLL_PROCESS_DETACH:
          Mhook_Unhook((PVOID*)&amp;TrueCreateProcess);
          break;
      }
      return TRUE;
  }
  </code></pre>