Prev: DOS (16-bit) disassembler.
Next: Reference becomes void on DLL unload
From: Vasu on 5 Apr 2010 09:42
Hi,

I have implemented a global keyboard hook in a 32 bit dll, using
SetWindowsHookEx(WH_KEYBOARD, lpFunction, hModule, 0) function. This
application is running without any issues on Windows XP. Recently I tested
this application on 64 bit Windows 7 operating system and I do get the
keyboard events as expected from all the Win32 applications. Surprisingly, I
am also getting the keyboard events from the 64 bit applications such as
Notepad & Wordpad. How is that possible? The document clearly says... "A
32-bit DLL cannot be injected into a 64-bit process".

BTW, I also have a global WH_SHELL hook in the same dll for which I get
events only from the 32 bit apps.

Am I missing somthing here? Any help will be appreciated.

From: Nobody on 5 Apr 2010 10:50
"Vasu" <Vasu(a)discussions.microsoft.com> wrote in message
news:4B9AC5A4-2AE0-4284-BC0F-A11628D63D66(a)microsoft.com...
> Hi,
>
> I have implemented a global keyboard hook in a 32 bit dll, using
> SetWindowsHookEx(WH_KEYBOARD, lpFunction, hModule, 0) function. This
> application is running without any issues on Windows XP. Recently I tested
> this application on 64 bit Windows 7 operating system and I do get the
> keyboard events as expected from all the Win32 applications. Surprisingly,
> I
> am also getting the keyboard events from the 64 bit applications such as
> Notepad & Wordpad. How is that possible? The document clearly says... "A
> 32-bit DLL cannot be injected into a 64-bit process".
>
> BTW, I also have a global WH_SHELL hook in the same dll for which I get
> events only from the 32 bit apps.

Some hooks are done as messages without loading the DLL in the target
process. If you want your 32 bit app to hook 64 bit apps, you can make a
64-Bit COM DLL and call it out of process. In this case, Windows would use
dllhost.exe to host the 64-Bit DLL, which would install the hook. I already
done that. A better solution is to make a 64-Bit version of your app. If
it's in C++, then not much changed in 64-Bit. int/long are still 32 bits,
but pointer size changed. In my case, the main app was a VB6 app, which is
32-Bit, and doesn't have a 64-Bit compiler.


From: Ivo Beltchev on 5 Apr 2010 10:57
Use Process Explorer to verify if your DLL is loaded in the process you
think it is. You can also check the process name/ID in your keyboard
hook (call GetModuleFileName(NULL) or GetCurrentProcessId) to verify it
really runs inside a 64-bit app.

I know that low-level keyboard hooks do run in the process that called
SetWindowsHookEx. Maybe normal keyboard hooks do too.

BTW, there are 32-bit versions of Notepad and Wordpad even on 64-bit
systems.

Vasu wrote:
> Hi,
>
> I have implemented a global keyboard hook in a 32 bit dll, using
> SetWindowsHookEx(WH_KEYBOARD, lpFunction, hModule, 0) function. This
> application is running without any issues on Windows XP. Recently I tested
> this application on 64 bit Windows 7 operating system and I do get the
> keyboard events as expected from all the Win32 applications. Surprisingly, I
> am also getting the keyboard events from the 64 bit applications such as
> Notepad & Wordpad. How is that possible? The document clearly says... "A
> 32-bit DLL cannot be injected into a 64-bit process".
>
> BTW, I also have a global WH_SHELL hook in the same dll for which I get
> events only from the 32 bit apps.
>
> Am I missing somthing here? Any help will be appreciated.
>
 | 
Pages: 1
Prev: DOS (16-bit) disassembler.
Next: Reference becomes void on DLL unload