1

The main program calls the function SetHook in the wi.dll to install global WH_CBT hook.

bool WI_API SetHook()
{
    if (!g_hHook)
    {
        g_hHook = SetWindowsHookEx(WH_CBT, (HOOKPROC) CBTProc, g_hInstDll, 0);
    }

    return g_hHook != NULL;
}

I presume after installing global hook, wi.dll should be loaded into each process' address space. However wi.dll is loaded in to some processes only. For example, if I start Skype, MS Word I can see that wi.dll is loaded into these processes as well (using Process Explorer), however if I run Firefox, uTorrent, Adobe Reader then wi.dll is not loaded into these processes.

I'm using W7 64-bit, main program and wi.dll is 32-bit, all programs mentioned here is 32-bit programs as well.

Any ideas why that happens?

Thanks in advance.

Joel Coehoorn
  • 399,467
  • 113
  • 570
  • 794
drumsta
  • 1,336
  • 2
  • 16
  • 27

2 Answers2

1

From MSDN:

SetWindowsHookEx can be used to inject a DLL into another process. A 32-bit DLL cannot be injected into a 64-bit process, and a 64-bit DLL cannot be injected into a 32-bit process. If an application requires the use of hooks in other processes, it is required that a 32-bit application call SetWindowsHookEx to inject a 32-bit DLL into 32-bit processes, and a 64-bit application call SetWindowsHookEx to inject a 64-bit DLL into 64-bit processes. The 32-bit and 64-bit DLLs must have different names.

So, you should create 32-bit app to call SetWindowsHookEx from a 32-bit dll, then redirect the messages to your main app, and have your main app in x64 call SetWindowsHookEx from a 64-bit dll to receive messages from x64 processes as well.

Super Basic
  • 31
  • 4
0

The hook chain mechanism is not bulletproof and relies on everyone involved following the rules. If an application installs its own per-thread WH_CBT hook and does not call CallNextHookEx in its hook procedure, earlier hooks won't get called. See the MSDN docs for CallNextHookEx.

Dewb
  • 382
  • 1
  • 8