This topic is now archived and is closed to further replies.


What is Hook chain order?

Recommended Posts

I saw your post at win32.programmer.kernel and that there hasn''t been a response to it yet. Perhaps that will change as the work week is just beggining. It''s also not quite 5 am in Redmond.

My guess is that the hook chain is a linked list, perhaps a double linked list. CriticalSections use that kind of list.

You might get more response asking the question from another angle. Such as: "How to I prevent my application from being hooked?"

It might require walking the virtual address space of your process, at least that would be a way to tell whether a foreign libary has been loaded into your process. That would be an indication of a global hook at work - but not confirmation. Setting your own global hook and then refusing to call the next hook in the chain might do it too - but that would also likely foul up the users system and fouling the users system wouldn''t win you any friends.

Share this post

Link to post
Share on other sites