Hooking RegisterClassEx and dll question

Kuniva

Ok, what I'm trying to do here is change the default WindowProc of a common control by hooking RegisterClassEx using a hooking library. I figured InitCommonControls() does nothing but register the common control classes using RegisterClass(). BUT.. I managed to hook the functions, but I noticed that when I start apps like IE and others, I usually get a few RegisterClassEx calls but for really anomalous classes. To make myself clear, its the progress bar I want to change ("msctls_progress32" or something). So I don't get why I'm not logging the RegisterClassEx() calls for those controls when IE starts. My logical explanation would be that the registering of these classes is somehow global for the system and that its only done once at startup or whenever an app first uses them, but that seems kinda weird, cause then why would an app need to call InitCommonControls() each time before it can use them? :/ Then I have a second issue which has more to do with Windows in general really. I was wondering: When an application is loaded, is a new copy of the dlls it uses always loaded in memory, or does Windows keep like a pool of loaded dll's and if its already loaded the app will just use that dll? Like kernel32.dll or user32.dll for example. Does each app get a fresh copy or do they all use a shared instance? My guess would be they all get their own copy, but then I would think applications would consume more memory than they appear to do. Thanks in advance for any clarifications. Kuniva --------------------------------------------

Ryan Binns

Kuniva wrote: My logical explanation would be that the registering of these classes is somehow global for the system and that its only done once at startup or whenever an app first uses them, but that seems kinda weird, cause then why would an app need to call InitCommonControls() each time before it can use them? Classes are registered per application instance, and are unregistered when the application closes. InitCommonControls() loads the comctl32.dll library, which in turn registers the classes using RegisterClassEx(). Most apps these days use InitCommonControlsEx() and only register the classes that they require. InitCommonControlsEx() can be called multiple times, so IE might only be registering the classes as it needs them. Also, have you checked to see whether it is using the standard progress control and not its own variety?

Ryan

"Punctuality is only a virtue for those who aren't smart enough to think of good excuses for being late" John Nichol "Point Of Impact"

Kuniva

Hmm ok.. First of all, I just checked and the progress control is the normal one registered through InitCommonControlsEx(). Now, I did some testing and came up with some stuff I really can't explain: First I made a test app that simply consists of a window and it does the following on startup:

INITCOMMONCONTROLSEX icc;

icc.dwSize = sizeof(INITCOMMONCONTROLSEX);
icc.dwICC = ICC\_PROGRESS\_CLASS;

InitCommonControlsEx(&icc);

Now my hooking app logs both InitCommonControlsEx() and RegisterClassEx(). When I run my test app, I get a log for InitCommonControlsEx() just as I should PLUS a call to RegisterClassEx() (for the progress control). Now the weird thing is, in my hooking app I also log the lpszClassName member of the WNDCLASSEX structure for the RegisterClassEx() function. For my test app I get "PROGRESS"... ???? :wtf: I mean.. wth is going on, isn't it supposed to be "msctls_progress32" or something? Now, another weird thing. As I've said I checked the class of the IE progress bar by using Spy++ and it's msctls_progress32. Now the thing is, when I have my hooking app running, then start IE, I DO log two RegisterClassEx() calls but NO InitCommonControlsEx() calls? The ones I do log are the following: RegisterClassExA() - CicMarshalWndClass RegisterClassExA() - IMMIF UI Now, am I right to conclude from this that the "Common progressbar" control IS NOT of class msctls_progress32 but just.. PROGRESS? However, that's impossible because I checked commctrl.h and there it's declared as follows:

//====== PROGRESS CONTROL =====================================================

#ifndef NOPROGRESS

#ifdef _WIN32

#define PROGRESS_CLASSA "msctls_progress32"
#define PROGRESS_CLASSW L"msctls_progress32"

#ifdef UNICODE
#define PROGRESS_CLASS PROGRESS_CLASSW
#else
#define PROGRESS_CLASS PROGRESS_CLASSA
#endif

#else
#define PROGRESS_CLASS "msctls_progress"
#endif

I am seriously confused about all this and any clarification would be wonderful. Thanks. Kuniva --------------------------------------------

Ryan Binns

Are you hooking both RegisterClassExA() AND RegisterClassExW()? And you might like to hook RegisterClass() as well, just to make sure...

Ryan

"Punctuality is only a virtue for those who aren't smart enough to think of good excuses for being late" John Nichol "Point Of Impact"