🚀 go-pugleaf

Remy Lebeau (TeamB) wrote:
> The DLL is loaded separately into every running process.  The hMod passed 
> into DllEntryPoint() should be different for each DLL instance, as each DLL 
> instance is mapped into a different address space.
> 
> But you have your DLL code set up to allow any DLL instance to release the 
> unhook, not the first instance exclusively.  That would suggest your hook 
> data's reference count is somehow falling to 0, causing one of the DLL 
> instances to call UnhookWindowsHookEx() even though other apps are still 
> running.

How have I missed the OutputDebugString() all this time -- it is much 
easier than using MessageBox().  I'm not going to keep beating a horse 
that won't work, but here is the edited logfile from DebugView for your 
viewing pleasure.  It does a much better job of showing what's happening 
than I've been able to do so far.  I started 3 instances (1, 2, 3) of 
the app (THWin32.exe) and then closed them closed them in the order 3, 
1, 2.  The PID is in brackets, the DLLInstance is the parameter passed 
to DllEntryPoint() and the RefCount is what I've been maintaining in the 
shared memory.

=====> start app 1
00 [516] Reason = Attach hook	
01 [516] DLLInstance = 14811136	
02 [516] Ref Count = 0	
03 [516] C:\...\THWin32.exe	

04 [516] Reason = DLL_ATTACH	
05 [516] DLLInstance = 14811136	
06 [516] Ref Count = 1	
07 [516] C:\...\THWin32.exe	

08 [1652] Reason = DLL_ATTACH	
09 [1652] DLLInstance = 15204352	
10 [1652] Ref Count = 2	
11 [1652] C:\WINNT\Explorer.EXE	

====> start app 2
12 [2496] Reason = DLL_ATTACH	
13 [2496] DLLInstance = 14811136	
14 [2496] Ref Count = 3	
15 [2496] C:\...\THWin32.exe	

=====> start app 3
16 [3884] Reason = DLL_ATTACH	
17 [3884] DLLInstance = 14811136	
18 [3884] Ref Count = 4	
19 [3884] C:\...\THWin32.exe	

=====> close app 3
20 [3884] Reason = DLL_DETACH	
21 [3884] DLLInstance = 14811136	
22 [3884] Ref Count = 3	
23 [3884] C:\...\THWin32.exe	

=====> close app 1
24 [516] Reason = DLL_DETACH	
25 [516] DLLInstance = 14811136	
26 [516] Ref Count = 2	
27 [516] C:\...\THWin32.exe	

28 [1652] Reason = DLL_DETACH	
29 [1652] DLLInstance = 15204352	
30 [1652] Ref Count = 1	
31 [1652] C:\WINNT\Explorer.EXE
=====> hook stops working at this point	
=====> close app 2
32 [2496] Reason = DLL_DETACH	
33 [2496] DLLInstance = 14811136	
34 [2496] Ref Count = 0	
35 [2496] C:\..\THWin32.exe	

36 [2496] Reason = Detach hook	
37 [2496] DLLInstance = 14811136	
38 [2496] Ref Count = 0	
39 [2496] C:\..\THWin32.exe

> You can use window messages or other IPC to communicate with hook.exe.  Each 
> instance could register/unregister itself with hook.exe so it knows how many 
> apps are running.

I think your suggestion to use messages for IPC between the app(s) and 
hook.exe is a better idea than my using an event and shared memory to 
keep a reference count of the number of apps running.  This means that 
hook.exe needs to be able to monitor messages.  Does this also mean 
hook.exe needs to have a window (that's never shown), or is there a way 
for a program to monitor messages with a message loop and process 
relevant messages in the loop rather than using DispatchMessage() to 
send the message to a window procedure?  The HWnd member of the message 
would have to be something other than a valid window handle, so would 
the message ever reach message queue for hook.exe?

Thanks -- Steve