🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: borland.public.cppbuilder.nativeapi
Article #7642

Re: global system hook

#7642
From: Remy Lebeau (TeamB)
Date: Wed, 29 Dec 2004 23:32
50 lines
3154 bytes
"nicolasr" <nicolasrNOSPAMATSIGNgmx.net> wrote in message
news:41d33187@newsgroups.borland.com...

> 1) My dll currently has the most imaginative
> file name 'hook.dll'. Will I get into trouble when
> other programs are using the same dll name for
> their global hook? Or is a unique directory path
> sufficient?

That depends on 1) where you are placing your DLL, 2) how you are loading
your DLL (using absolute or relative paths), and 3) how the other programs
are loading their DLLs.

> 2) Is there a chance that an antivirus program would
> consider installing a global keyboard hook as keyboard
> sniffing and complaining?

Possibly.

> 3) After some tests I needed to change and rebuild
> my hook dll. However, BCB doesn't link it because of
> [Linker Fatal Error] Fatal: Could not open D:\...\Hook.dll (program
> still running?) Using a process explorer I found that two processes
> still have the dll mapped, iexplorer.exe and dexplorer.exe
> How can this be after my test program deinstalled the hook?

You can uninstall the hook, but you cannot tell the other processes that
have the DLL injected into them to release their references to the DLL.  You
can only do that with your own process.  MSDN says as much:

    Using Hooks

http://msdn.microsoft.com/library/en-us/winui/winui/windowsuserinterface/windowing/hooks/usinghooks.asp

    Installing and Releasing Hook Procedures

    You can release a global hook procedure by using UnhookWindowsHookEx,
but this function does not free the DLL containing the hook procedure. This
is because global hook procedures are called in the process context of every
application in the desktop, causing an implicit call to the LoadLibrary
function for all of those processes. Because a call to the FreeLibrary
function cannot be made for another process, there is then no way to free
the DLL. The system eventually frees the DLL after all processes explicitly
linked to the DLL have either terminated or called FreeLibrary and all
processes that called the hook procedure have resumed processing outside the
DLL.


Gambit
Technical Details
Message-ID: <41d33e45@newsgroups.borland.com>
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news.maxwell.syr.edu!newsfeed.icl.net!newsfeed.fjserv.net!newsfeed.freenet.de!216.196.110.149.MISMATCH!border2.nntp.ams.giganews.com!border1.nntp.ams.giganews.com!nntp.giganews.com!pe2.news.blueyonder.co.uk!blueyonder!news-peer-test!btnet!newsfeed.bt.es!caladan.landsraad.net!newsgroups.borland.com!not-for-mail
References: <41d33187@newsgroups.borland.com>

Show Full Headers
Complete Article Headers
X-Google-Thread: 10cc67,8f50842da09c0f93
X-Google-Attributes: gid10cc67,public
X-Google-Language: ENGLISH,ASCII-7-bit
From: "Remy Lebeau \(TeamB\)" <no.spam@no.spam.com>
Newsgroups: borland.public.cppbuilder.nativeapi
References: <41d33187@newsgroups.borland.com>
Subject: Re: global system hook
Date: Wed, 29 Dec 2004 15:32:37 -0800
Lines: 52
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2800.1409
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
NNTP-Posting-Host: 68.69.17.41
Message-ID: <41d33e45@newsgroups.borland.com>
X-Trace: newsgroups.borland.com 1104363077 68.69.17.41 (29 Dec 2004 15:31:17 -0800)
Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news.maxwell.syr.edu!newsfeed.icl.net!newsfeed.fjserv.net!newsfeed.freenet.de!216.196.110.149.MISMATCH!border2.nntp.ams.giganews.com!border1.nntp.ams.giganews.com!nntp.giganews.com!pe2.news.blueyonder.co.uk!blueyonder!news-peer-test!btnet!newsfeed.bt.es!caladan.landsraad.net!newsgroups.borland.com!not-for-mail