Global/Thread Keyboard Hooks

This is a discussion on Global/Thread Keyboard Hooks within the Windows Programming forums, part of the Platform Specific Boards category; I've heard two different things and I just want to clarify. When specifying a global keyboard hook, I know that ...

  1. #1
    and the hat of Marriage Rodaxoleaux's Avatar
    Join Date
    Sep 2011
    Location
    ntdll.dll
    Posts
    178

    Global/Thread Keyboard Hooks

    I've heard two different things and I just want to clarify.

    When specifying a global keyboard hook, I know that it must be in a DLL, but which hook id should be implemented for each type of hook

    Is it

    WH_KEYBOARD - Thread
    WH_KEYBOARD_LL - Global ?

    Or the other way around or what else should I know. MSDN specifies which one is low level (obvious: LL) and that should mean global input correct? Why is it required that a .dll be used anyway for a global keyboard hook?
    How to ask smart questions

    Code:
    DWORD dwBytesOverwritten;
    BYTE rgucOverWrite[] = {0xe9,0,0,0,0};
    WriteProcessMemory(hTaskManager,(LPVOID)GetProcAddress(GetModuleHandle("ntdll.dll"),"NtQuerySystemInformation"),rgucOverWrite,5,&dwBytesWritten);

  2. #2
    Captain Crash brewbuck's Avatar
    Join Date
    Mar 2007
    Location
    Portland, OR
    Posts
    7,239
    Quote Originally Posted by Rodaxoleaux View Post
    Why is it required that a .dll be used anyway for a global keyboard hook?
    How else could you possibly inject your code into OTHER processes? It's a global hook.
    Code:
    //try
    //{
    	if (a) do { f( b); } while(1);
    	else   do { f(!b); } while(1);
    //}

  3. #3
    Registered User Codeplug's Avatar
    Join Date
    Mar 2003
    Posts
    4,670
    There are some global hooks that do not need to be in a DLL. For example, WH_KEYBOARD_LL is global-only and does not require a DLL since it uses a message loop to "deliver" the callback.

    For hooks that global or local, the last parameter to SetWindowsHookEx() determines if it is global or local.

    SetWindowsHookEx function

    gg

  4. #4
    and the hat of Marriage Rodaxoleaux's Avatar
    Join Date
    Sep 2011
    Location
    ntdll.dll
    Posts
    178
    Quote Originally Posted by brewbuck View Post
    How else could you possibly inject your code into OTHER processes? It's a global hook.
    Oh yeah... duh... *facepalm*


    @CodePlug:


    dwThreadId [in]
    Type: DWORD
    The identifier of the thread with which the hook procedure is to be associated. If this parameter is zero, the hook procedure is associated with all existing threads running in the same desktop as the calling thread.

    You did not lie.
    How to ask smart questions

    Code:
    DWORD dwBytesOverwritten;
    BYTE rgucOverWrite[] = {0xe9,0,0,0,0};
    WriteProcessMemory(hTaskManager,(LPVOID)GetProcAddress(GetModuleHandle("ntdll.dll"),"NtQuerySystemInformation"),rgucOverWrite,5,&dwBytesWritten);

  5. #5
    and the hat of Marriage Rodaxoleaux's Avatar
    Join Date
    Sep 2011
    Location
    ntdll.dll
    Posts
    178
    Okay I read a bit more and WH_KEYBOARD_LL switches context to the running program in order to process the hook event. How fun |3
    How to ask smart questions

    Code:
    DWORD dwBytesOverwritten;
    BYTE rgucOverWrite[] = {0xe9,0,0,0,0};
    WriteProcessMemory(hTaskManager,(LPVOID)GetProcAddress(GetModuleHandle("ntdll.dll"),"NtQuerySystemInformation"),rgucOverWrite,5,&dwBytesWritten);

  6. #6
    'Allo, 'Allo, Allo
    Join Date
    Apr 2008
    Posts
    611
    For example, WH_KEYBOARD_LL is global-only and does not require a DLL since it uses a message loop to "deliver" the callback.
    What MSDN doesn't tell you (or at least didn't, it seems someone's recently added a community content bit), is that the normal WH_KEYBOARD/WH_MOUSE hooks also send messages if the event occurs in an app you can't inject into (events in 64-bit apps for 32-bit hooks, and equally vice versa). If you don't have a message pump, the app sending the event freezes waiting you to retrieve the message.

    EDIT: Oh, and as soon as I post it I see MSDN has added a bit at the bottom of the remarks about it. That'll show me. Well, it doesn't tell you how they can be called on the installing thread so I'm claiming that this post isn't totally useless.
    Last edited by adeyblue; 03-28-2012 at 05:35 PM.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. C keyboard hooks for linux
    By codecaine_21 in forum C Programming
    Replies: 6
    Last Post: 11-10-2010, 08:25 PM
  2. Global hooks problem
    By chottachatri in forum C++ Programming
    Replies: 3
    Last Post: 07-13-2009, 09:01 AM
  3. global keyboard hooks
    By Fender Bender in forum Windows Programming
    Replies: 6
    Last Post: 12-29-2005, 04:36 PM
  4. Do I need to use Keyboard Hooks to solve my problem?
    By BenPage in forum C++ Programming
    Replies: 3
    Last Post: 07-16-2005, 10:10 AM
  5. Detecting Keyboard Hooks
    By KinoCode in forum Windows Programming
    Replies: 2
    Last Post: 01-17-2003, 10:24 AM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21