SetWindowsHookEx from NT Service

[kelt666]

Hello, I'm experiencing a trouble while setting a hook procedure form an NT Service. Hook procedure is intended to capture keyboard events (WH_KEYBOARD). Thread, that installs the hook, calls SwitchDesktop to switch to desktop, that receives user input. SetWindowsHookEx returns non-null hook handle, but the hook procedure is not ever called. Are there any prerequisites I'm missing?

[FarPointer]

Is it a SytemWideHook or ThreadSpecific Hook and were is the hook procedure present. Regards, FarPointer Blog:FARPOINTER

[James R Twine]

I would start by creating a little app and running it under the debugger.  Make sure you see your hook's DLL getting loaded into the running process.  If not, then the hook is not getting installed correctly.    If it is being loaded into the running process, then perhaps the way the events are being filtered is incorrect?    Also, what desktop are you in when the hook is installed?  Generally, hooks only work in the desktop that the hook is installed in.    Peace! -=- James

---

If you think it costs a lot to do it right, just wait until you find out how much it costs to do it wrong!
Avoid driving a vehicle taller than you and remember that Professional Driver on Closed Course does not mean your Dumb Ass on a Public Road!
DeleteFXPFiles & CheckFavorites (Please rate this post!)

[sudeesh]

u can specify the ALLOW_OTHER_ACCOUNT_HOOK and make the service interractive to input desktop hello

[James R Twine]

I am not familiar with the ALLOW_OTHER_ACCOUNT_HOOK in the context of hooks, and MSDN is not helping me here.  Where is this value documented?    Peace! -=- James

---

If you think it costs a lot to do it right, just wait until you find out how much it costs to do it wrong!
Avoid driving a vehicle taller than you and remember that Professional Driver on Closed Course does not mean your Dumb Ass on a Public Road!
DeleteFXPFiles & CheckFavorites (Please rate this post!)

[kelt666]

Thank you for your reply. I've eventually tested the hook in a small console application first. The DLL is getting loaded properly, the hook works ok. Concerning the service, I allow it to interact with desktop and use the following code to switch the desktop before setting hook:

HDESK hUserDesktop = ::OpenInputDesktop( DF_ALLOWOTHERACCOUNTHOOK, FALSE, GENERIC_ALL );

::SwitchDesktop( hUserDesktop );

HHOOK hHook = ::SetWindowsHookEx( WH_KEYBOARD, prHook, bfInst, 0 );

All of these function return successful results. I'm aware I'm missing some important stuff to do.

[kelt666]

This is a system-wide hook, the hook procedure resides in a DLL. This DLL is loaded by a service, then the hook is installed.

[James R Twine]

Are you sure the hook is really not getting executed?  You cannot set a breakpoint in the debugger with the service loaded and expect to see it fire from within the service, because the hook is getting loaded into the target processes, and it will fire under the context of those processes.    If you do something like using OutputDebugString(...) to write out a string to the debugger (do not use TRACE/TRACEx(...)).  Using the console application under the debugger, you should be able to see the output from that function if it is being fired.    Peace! -=- James

---

If you think it costs a lot to do it right, just wait until you find out how much it costs to do it wrong!
Avoid driving a vehicle taller than you and remember that Professional Driver on Closed Course does not mean your Dumb Ass on a Public Road!
DeleteFXPFiles & CheckFavorites (Please rate this post!)

[kelt666]

Thank you for your reply! I use ::OutputDebugStringA() to enable debug output and DbgView from sysinternals to capture this output. This pair works, as I receive debug output during serivce initialization. But still no output from hook.

[James R Twine]

Sorry - no other idea other than that the hook is just not getting across to the different desktop...    Peace! -=- James

---

If you think it costs a lot to do it right, just wait until you find out how much it costs to do it wrong!
Avoid driving a vehicle taller than you and remember that Professional Driver on Closed Course does not mean your Dumb Ass on a Public Road!
DeleteFXPFiles & CheckFavorites (Please rate this post!)

[sudeesh]

http://support.microsoft.com/kb/163892/EN-US/ hello

[kelt666]

I've got it at last! The problem was with security settings of some of synchronization objects. Being created withing a service, they had their owner set to SYSTEM and none of user code could ever open them (although, this code works if it is run from a test application under my account) Anyway, thank you for your ideas!

[James R Twine]

Yes, I now know that DF_ALLOWOTHERACCOUNTHOOK was the identifier you were trying to refer to.    Peace! -=- James

---

If you think it costs a lot to do it right, just wait until you find out how much it costs to do it wrong!
Avoid driving a vehicle taller than you and remember that Professional Driver on Closed Course does not mean your Dumb Ass on a Public Road!
DeleteFXPFiles & CheckFavorites (Please rate this post!)