全局setWindowShookex如何设法将DLL注入所有线程？
我在主机应用程序中创建了2个钩子。第一是wh_mouse专门为任务栏的线程设置。 2nd是全局wh_keyboard_ll钩子（dwthreadid设置为0）。
正如您在Process Explorer中看到的那样，“本地”挂钩实际上将我的DLL注入了特定的Explorer.exe线程。但是，没有迹象表明我的第二个全球挂钩被注入了其他任何过程，但它仍然可以很好地工作...此外，即使设置了钩子，它也适用于我开始的所有新过程！ setWindowShookex如何管理？
我读到它仅适用于加载user32.dll的进程。我的怀疑是，在全球挂钩的情况下，Windows以某种方式将我的自定义DLL代码注入user32.dll“钩链”。然后，当启动加载user32.dll的新进程时，它会自动加载我的钩子？这是正确的还是在起作用的其他机制？
I created 2 hooks in my host application. 1st is WH_MOUSE set specifically for Taskbar's thread. 2nd is global WH_KEYBOARD_LL hook (dwThreadId is set to 0).
As you can see in Process Explorer, the "local" hook actually injected my dll into specific explorer.exe thread. However, there is no indication that my 2nd global hook got injected into any other processes, yet it still works perfectly... Moreover, it also works for all the new processes I start, even after the hook was set! How SetWindowsHookEx manages that?
I read that it only applies to processes that load user32.dll. My weak suspicion is that in a case of global hook, Windows somehow injects my custom dll code into user32.dll "hook-chain". And then, when new process that loads user32.dll is started, it automatically loads my hook with it? Is this correct or is there some other mechanism at work?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
_ll（低级）挂钩在任何地方都没有注入，win32k（窗口管理器的内核部分）直接调用钩回调函数。这就是为什么该线程需要消息循环的原因。低级挂钩始终是“全球”。MSDN说：
您应该将钩子视为具有3种模式的钩子：
最后两个可能需要Windows注入.dll。
_LL(low-level) hooks are not injected anywhere, win32k (the kernel part of the window manager) calls the hook callback function directly. This is why that thread needs a message loop. Low-level hooks are always "global".MSDN says:
You should think of hooks as having 3 modes:
The last two might require Windows to inject the .dll.