Windows Global Hooks

Recently useful to global hook, actually can refer to Windows core programming, Global hook is also a way of DLL injection.

First, it must be a DLL, you can export an interface, where the global hook is set, the type is wh_getmessage (so that all processes will be hook), so successful, the system will inject this DLL into all processes with GETMESSAGE, The next LoadLibrary is implicitly invoked for each process.

Then every time you getmessage, you can go back to the redeployment callback function and you'll be able to do some of your own processing.

When the hook is not needed, the unhook can be passed so that the system implicitly calls FreeLibrary for the processes on those hooks and unloads the DLL.

We set the hook process for the P,hook DLL to D, then the experiment found that

Even if p does not call D's unhook before exiting, or p is strongly killed or hung, the system will still find that it will still help call freelibrary for those hooks, which will go into the Proc_detach of D.

However, there are some surprises, and occasionally some processes do not unload D, such as Chrome, Svncache, or other processes that take some time to unload (but the 64-bit system seems to be okay?). )。

Static hhook _myhook = null; lresult callback myhookproc (                               _In_  int nCode,                               _In_  WPARAM wParam,                               _In_  LPARAM lParam                               ) {    return callnexthookex (Null, ncode, wparam,  lparam);// hhook&nBsp;parameter is optional and ignored}bool hookstart () {    if   (_myhook)         return true;    _ Myhook = setwindowshookex (        WH_GETMESSAGE,          (HOOKPROC) &MyHookProc,         Getmaindll (),         0);    if  (NULL ==  _myhook)     {        assert (false & &  "[hookstart]hook false!");         return false;    }     return true;} Bool hookend () {    if  (Null == _myhook)          return true;    if (False == unhookwindowshookex (_myhook))     {         assert (false &&  "[hookend]unhook false!");         return false;    }     _myhook = null;    return true;}

This article is from the "V" blog, be sure to keep this source http://4651077.blog.51cto.com/4641077/1613836

Windows Global Hooks