title: Windows API hooking python to msvbvm60.dll (rtcMsgBox)
body: <p>I want to intercept the API calls of a process to know when a process call to the API rtcMsgBox of the msvbvm60 dll.
  I have tried it with this code but it seems not to work:</p>
  
  <pre><code>from winappdbg import Debug, EventHandler
  import sys
  import os
  
  class MyEventHandler( EventHandler ):
  
      # Add the APIs you want to hook
      apiHooks = {
  
          'msvbvm60.dll' : [( 'rtcMsgBox'  ,   7  ),],'kernel32.dll' : [( 'CreateFileW'  ,   7  ),],
          }
  
      # The pre_ functions are called upon entering the API
  
      def pre_CreateFileW(self, event, ra, lpFileName, dwDesiredAccess,
               dwShareMode, lpSecurityAttributes, dwCreationDisposition,
                                  dwFlagsAndAttributes, hTemplateFile):
  
          fname = event.get_process().peek_string(lpFileName, fUnicode=True)
          print "CreateFileW: %s" % (fname)
  
      # The post_ functions are called upon exiting the API
  
      def post_CreateFileW(self, event, retval):
          if retval:
              print 'Suceeded (handle value: %x)' % (retval)
          else:
              print 'Failed!'
  
  if __name__ == "__main__":
  
      if len(sys.argv) &lt; 2 or not os.path.isfile(sys.argv[1]):
          print sys.argv[1]
          print "\nUsage: %s &lt;File to monitor&gt; [arg1, arg2, ...]\n" % sys.argv[0]
          sys.exit()
  
      # Instance a Debug object, passing it the MyEventHandler instance
      debug = Debug( MyEventHandler() )
  
      try:
          # Start a new process for debugging
          p = debug.execv(sys.argv[1:], bFollow=True)
  
          # Wait for the debugged process to finish
          debug.loop()
  
      # Stop the debugger
      finally:
          debug.stop()
  </code></pre>
  
  <p>It works with the CreateFileW API of Kernel32.dll but not with the rtcMsgBox of msvbvm60.dll. Why? What I am doing wrong?</p>
  
  <p>EDIT: By the way I don't know why the code I paste is divided in two pieces of code. The webapp don't parse it correctly but it is just all the same piece of code.
  Thanks</p>