|Date:||August 10, 2006 / year-entry #269|
|Summary:||We saw last time how windows hooks were implemented in 16-bit Windows. Even though the HHOOK was an opaque data type that should have been treated like a handle, many programs "knew enough to be dangerous" and took advantage of the fact that the HHOOK was just a pointer to the previous hook procedure. The...|
We saw last time
how windows hooks were implemented in 16-bit Windows.
Even though the
The most common way of abusing this knowledge was
by unhooking from the windows hook chain the wrong way.
Instead of calling the
HHOOK g_hhkPrev; // install the hook g_hhkPrev = SetWindowsHook(WH_KEYBOARD, MyHookProc); ... // crazy! uninstall the hook by setting the previous hook "back" SetWindowsHook(WH_KEYBOARD, g_hhkPrev);
This code worked in spite of itself; it's as if two wrongs made a "sort of right". If nobody else messed with the hook chain in between the time the hook was installed and it was subsequently "uninstalled", then reinstalling the hook at the head of the chain did restore the chain variables in the same way they would have been restored if they had uninstalled the hook correctly.
But if somebody else installed their own
I still have no idea why they used this strange technique instead of doing the right thing, which is just swapping out one line of code for another:
Windows 3.1 introduced the
<-- Back to Old New Thing Archive Index