{"id":30173,"date":"2006-08-10T10:00:06","date_gmt":"2006-08-10T10:00:06","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2006\/08\/10\/one-way-people-abused-hooks-in-16-bit-windows\/"},"modified":"2006-08-10T10:00:06","modified_gmt":"2006-08-10T10:00:06","slug":"one-way-people-abused-hooks-in-16-bit-windows","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20060810-06\/?p=30173","title":{"rendered":"One way people abused hooks in 16-bit Windows"},"content":{"rendered":"

\nWe saw last time\n\nhow windows hooks were implemented in 16-bit Windows<\/a>.\nEven though the HHOOK<\/code> was an opaque data type that\nshould have been treated like a handle,\nmany programs “knew enough to be dangerous”\nand took advantage of the fact that the HHOOK<\/code>\nwas just a pointer to the previous hook procedure.\n<\/p>\n

\nThe most common way of abusing this knowledge was\nby unhooking from the windows hook chain the wrong way.\nInstead of calling the UnhookWindowsHook<\/code> function\nto unhook a windows hook, they called SetWindowsHook<\/code> again!\nSpecifically, they removed their hook by simply reinstalling the\nprevious hook at the head of the chain:\n<\/p>\n

\nHHOOK g_hhkPrev;\n\/\/ install the hook\ng_hhkPrev = SetWindowsHook(WH_KEYBOARD, MyHookProc);\n...\n\/\/ crazy! uninstall the hook by setting the previous hook \"back\"\nSetWindowsHook(WH_KEYBOARD, g_hhkPrev);\n<\/pre>\n
\nThis code worked in spite of itself;\nit’s as if two wrongs made a “sort of right”.\nIf nobody else messed with the hook chain in between the time\nthe hook was installed and it was subsequently “uninstalled”,\nthen reinstalling the hook at the head of the chain\ndid restore the chain variables in the same way they would have\nbeen restored if they had uninstalled the hook correctly.\n<\/p>\n
\nBut if somebody else installed their own WH_KEYBOARD<\/code>\nhook in the meantime, then setting the previous hook “back”\nwould have the effect of not only “uninstalling” the MyHookProc<\/code>\nbut also all other hooks that were installed in the meantime<\/strong>.\n(This is exactly the same problem you have\n\nif you aren’t careful in how you remove subclassed window procedures<\/a>.)\n<\/p>\n
\nI still have no idea why they used this strange technique instead of\ndoing the right thing, which is just swapping out one line of code\nfor another:\n<\/p>\n
\nUnhookWindowsHook(WH_KEYBOARD, MyHookProc);\n<\/pre>\n
\nWindows 3.1 introduced the\nSetWindowsHookEx<\/code>\/CallNextHookEx<\/code> model,\nwhich doesn’t use the external linked list technique but rather manages\nthe hook chain internally.\nThis protected the hook chain from programs that corrupted it by\nmismanaging the external hook chain,\nbut it meant that\nwhen these crazy programs tried to unhook by hooking,\nthey ended up corrupting the internal<\/strong> hook chain.\nSpecial code had to be written to detect these crazy people and\nturn their bad call into the correct one so that the hook chain\nwouldn’t get corrupted.<\/p>\n","protected":false},"excerpt":{"rendered":"
We saw last time how windows hooks were implemented in 16-bit Windows. Even though the HHOOK was an opaque data type that should have been treated like a handle, many programs “knew enough to be dangerous” and took advantage of the fact that the HHOOK was just a pointer to the previous hook procedure. The […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[2],"class_list":["post-30173","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-history"],"acf":[],"blog_post_summary":"
We saw last time how windows hooks were implemented in 16-bit Windows. Even though the HHOOK was an opaque data type that should have been treated like a handle, many programs “knew enough to be dangerous” and took advantage of the fact that the HHOOK was just a pointer to the previous hook procedure. The […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/30173","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=30173"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/30173\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=30173"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=30173"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=30173"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}