This document explains how to verify if a process has correctly loaded Dynamic Libraries (DLLs) needed for Citrix API Hooking to work.

---

Instructions

Many XenApp and XenDesktop features are provided via hooking system. 

As first step we need to verify if the main Hooking DLL is loaded. Depending if the process is 32 bit or 64bit we will be looking either for mfaphook.dll or mfaphook64.dll. 

In order to verify the DLL is loaded, we need to make use of a third party tool. In this case we will be using Process Explorer from Microsoft's Sysinternals Suite.

Here is an example for mfaphook64.dll and winlogon.exe process:

1. Download Process Explorer and unzip the content on your VDA or XenApp server where the target process is running
2. Run procexp.exe as a user with administrative privileges
3. From the menu, select View -> Show Lower Pane to enable the lower pane
   
   
4. From the menu, select View -> Lower Pane View -> DLLs
   
   
5. In the upper panel, select the target process (i.e. winlogon.exe) by clicking on its name
6. The lower panel will refresh and display the DLLs loaded by the process
7. Now we can see that mfaphook64.dll is loaded by the process
   
   

The same procedure can be repeated for child hooks (those that drives XenApp and XenDesktop features) such as scardhook64.dll (Smart Card virtual channel hooking):

External Resources:

• Sysinternals Suite - Process Explorer