AppInit_DLLs Registry Value and Windows 95 (134655)

SUMMARY

Windows 95 does not support the loading of a DLL into a process's address space through the use of the AppInit_DLLs registry value. In Windows NT, for every process executed, Windows NT loads the DLLs listed in the AppInit_DLLs registry value into the process' address space. For similar functionality in Windows 95, you can implement a system-wide hook. This article shows by example how to do it.

MORE INFORMATION

To implement a system-wide hook, you must ensure that the hooked function (callback function) exists in a DLL. Then, when the this function is called, the operating system maps the hooked DLL into the target application's address space. The actual hooked function then operates as part of the target application's process.

There are essentially two steps involved in creating a system-wide hook:

Create a DLL with an exported function that is used as the hooking function. In the sample function that follows, the callback function is modeled after a callback function required to implement a WH_KEYBOARD system-wide hook:

      // Trap keyboard messages
      __declspec(dllexport) LRESULT CALLBACK HookFunction(
                       int code,
                       WPARAM wParam,
                       LPARAM lParam)
      {
         char szVCode[50];

         //display the virtual key code trapped
         sprintf(szVCode, "Virtual Key code: %lx", wParam);
         MessageBox(NULL, szVCode,"Key stroke", MB_OK);
                :
                :
      }

   The associated .def file for this DLL might resemble this:

      LIBRARY      HOOK

      EXPORTS
         HookFunction

Install the system-wide hook. To install the hook, the DLL must be loaded, the hook function's address retrieved, and SetWindowsHookEx called with the function's address. Here's an example:

      // add system-wide hook
      hHookDll = LoadLibrary("hook");
      hHookProc = (HOOKPROC) GetProcAddress(hHookDll, "HookFunction");

      // Install keyboard hook to trap all keyboard messages
      hSystemHook =  SetWindowsHookEx(WH_KEYBOARD,hHookProc,hHookDll,0);

Once the application has finished with the system-wide hook, be sure to undo the hooking process as follows:

      // Remove the hook and unload the DLL used for the hooking process
      UnhookWindowsHookEx(hSystemHook);
      FreeLibrary(hHookDll);