Article View: borland.public.cppbuilder.nativeapi
Article #7642Re: global system hook
From: Remy Lebeau (TeamB)
Date: Wed, 29 Dec 2004 23:32
Date: Wed, 29 Dec 2004 23:32
50 lines
3154 bytes
3154 bytes
"nicolasr" <nicolasrNOSPAMATSIGNgmx.net> wrote in message
news:41d33187@newsgroups.borland.com...
> 1) My dll currently has the most imaginative
> file name 'hook.dll'. Will I get into trouble when
> other programs are using the same dll name for
> their global hook? Or is a unique directory path
> sufficient?
That depends on 1) where you are placing your DLL, 2) how you are loading
your DLL (using absolute or relative paths), and 3) how the other programs
are loading their DLLs.
> 2) Is there a chance that an antivirus program would
> consider installing a global keyboard hook as keyboard
> sniffing and complaining?
Possibly.
> 3) After some tests I needed to change and rebuild
> my hook dll. However, BCB doesn't link it because of
> [Linker Fatal Error] Fatal: Could not open D:\...\Hook.dll (program
> still running?) Using a process explorer I found that two processes
> still have the dll mapped, iexplorer.exe and dexplorer.exe
> How can this be after my test program deinstalled the hook?
You can uninstall the hook, but you cannot tell the other processes that
have the DLL injected into them to release their references to the DLL. You
can only do that with your own process. MSDN says as much:
Using Hooks
http://msdn.microsoft.com/library/en-us/winui/winui/windowsuserinterface/windowing/hooks/usinghooks.asp
Installing and Releasing Hook Procedures
You can release a global hook procedure by using UnhookWindowsHookEx,
but this function does not free the DLL containing the hook procedure. This
is because global hook procedures are called in the process context of every
application in the desktop, causing an implicit call to the LoadLibrary
function for all of those processes. Because a call to the FreeLibrary
function cannot be made for another process, there is then no way to free
the DLL. The system eventually frees the DLL after all processes explicitly
linked to the DLL have either terminated or called FreeLibrary and all
processes that called the hook procedure have resumed processing outside the
DLL.
Gambit
Technical Details
Message-ID:
<41d33e45@newsgroups.borland.com>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news.maxwell.syr.edu!newsfeed.icl.net!newsfeed.fjserv.net!newsfeed.freenet.de!216.196.110.149.MISMATCH!border2.nntp.ams.giganews.com!border1.nntp.ams.giganews.com!nntp.giganews.com!pe2.news.blueyonder.co.uk!blueyonder!news-peer-test!btnet!newsfeed.bt.es!caladan.landsraad.net!newsgroups.borland.com!not-for-mailReferences:
<41d33187@newsgroups.borland.com>Show Full Headers
Complete Article Headers
X-Google-Thread: 10cc67,8f50842da09c0f93 X-Google-Attributes: gid10cc67,public X-Google-Language: ENGLISH,ASCII-7-bit From: "Remy Lebeau \(TeamB\)" <no.spam@no.spam.com> Newsgroups: borland.public.cppbuilder.nativeapi References: <41d33187@newsgroups.borland.com> Subject: Re: global system hook Date: Wed, 29 Dec 2004 15:32:37 -0800 Lines: 52 X-Priority: 3 X-MSMail-Priority: Normal X-Newsreader: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 NNTP-Posting-Host: 68.69.17.41 Message-ID: <41d33e45@newsgroups.borland.com> X-Trace: newsgroups.borland.com 1104363077 68.69.17.41 (29 Dec 2004 15:31:17 -0800) Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news.maxwell.syr.edu!newsfeed.icl.net!newsfeed.fjserv.net!newsfeed.freenet.de!216.196.110.149.MISMATCH!border2.nntp.ams.giganews.com!border1.nntp.ams.giganews.com!nntp.giganews.com!pe2.news.blueyonder.co.uk!blueyonder!news-peer-test!btnet!newsfeed.bt.es!caladan.landsraad.net!newsgroups.borland.com!not-for-mail