System-Wide Windows Hooks

By Moishe Halibard

February 14, 2005

(System-Wide Windows Hooks :  Page 1 of 1 )

Windows allows many types of programmatic "hooks" to be set in order to intercept and modify information being sent to or from applications running on the system. The classes of information that can be hooked include Windows messages, keyboard and mouse events. Each hook set provides a callback function that the operating system will call whenever the requested event occurs.

Hooks can be installed for specific threads, either in the current or remote processes, or system-wide, which is essentially installing it for every thread in the system. There are important caveats to the types of remote processes whose threads can be hooked—these include those running in a different desktop, different window station, those in console applications (even if they have windows), and those running in high-protection or core system processes. Caveats aside, setting a system-wide hook often results in a deluge of information bombarding the hook callback functions in multiple threads in multiple process spaces, and therefore, to avoid affecting system performance, hook callback implementations should be thin and lightweight.

This article examines the correct usage of certain system-wide hooks on WinNT and Win9x platforms, looking at their APIs, idiosyncrasies, and side effects. Throughout the article, references to WinNT refer to the entire NT family—from NT 4 through Win2000, Win2003 and XP. The Win9x information is slowly becoming obsolete, as nearly all new Windows installations choose XP. However, a huge number of home users still are running Win9x, and any mainstream application intended for home users will need to take into account the large differences between the platforms regarding system-wide hooks.

Setting Hooks

Calling SetWindowsHookEx sets system-wide hooks, and a callback function with a generic footprint needs to be provided. For a full example of setting a system-wide hook, see HookListing1 at the end of this article. The function takes as parameters the type of hook being set, a pointer to the callback function of the hook, the instance handle of the dll containing the callback function, and a thread identifier.

 Page 1 of 1