0

I am trying to use a CBT hook to receive HCBT_MOVESIZE notifications. It works fine for all applications when I run my program from a folder on my desktop. When I install the application to the "Program Files" or "Program Files (x86" folder I only receive notifications for my own application. The .exe file is signed and works perfectly in Windows XP. I am only receiving these errors in Vista x86/x64. Can anyone offer any suggestions on how to troubleshoot this? Thanks!

Joel Coehoorn
  • 399,467
  • 113
  • 570
  • 794
Jon Tackabury
  • 47,710
  • 52
  • 130
  • 168

1 Answers1

3

Might be a UIPI issue:

User Interface Privilege Isolation (UIPI) implements restrictions in the windows subsystem that prevents lower-privilege applications from sending window messages or installing hooks in higher-privilege processes.

from Microsoft's Windows Integrity Mechanism Design

jdigital
  • 11,926
  • 4
  • 34
  • 51
  • The strange thing is that it works fine until I copy the files to the "Program Files" folder. I haven't been able to find any docs that say that folder is more restrictive. – Jon Tackabury Jun 01 '09 at 23:11
  • Search the article for "Program Files" and you'll see that there is at least one rule that might explain the difference between Desktop and Program Files. – jdigital Jun 02 '09 at 00:47
  • According to that article, the only way it should work is when it is in the "Program Files" folder, but I'm seeing the opposite behaviour. :( – Jon Tackabury Jun 02 '09 at 14:37
  • Have you tried implementing the UIAccess security attribute as described in the article? – jdigital Jun 02 '09 at 17:31
  • I have. I have a manifest file embedded in the application and the DLLs. I have it set to "asInvoker" and "UIAccess=true". – Jon Tackabury Jun 02 '09 at 20:16
  • Have you checked the return value of SetWindowsHookEx? – jdigital Jun 03 '09 at 01:27
  • If SetWindowsHookEx is not returning an error, run Process Explorer (http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx) to see if you DLL is getting loaded into other processes. – jdigital Jun 03 '09 at 01:36