{"id":30183,"date":"2006-08-09T10:00:18","date_gmt":"2006-08-09T10:00:18","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2006\/08\/09\/how-were-window-hooks-implemented-in-16-bit-windows\/"},"modified":"2006-08-09T10:00:18","modified_gmt":"2006-08-09T10:00:18","slug":"how-were-window-hooks-implemented-in-16-bit-windows","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20060809-18\/?p=30183","title":{"rendered":"How were window hooks implemented in 16-bit Windows?"},"content":{"rendered":"

\nThe mechanism for keeping track of window hooks was very\ndifferent in 16-bit Windows.\nThe functions involved were SetWindowsHook<\/code>,\nUnhookWindowsHook<\/code>\nand DefHookProc<\/code>.\nThe first two functions still exist today, but the third one has\nbeen replaced with a macro:\n<\/p>\n

\n\/\/ 16-bit prototype\nDWORD WINAPI DefHookProc(int nCode, WPARAM wParam,\n                         LPARAM lParam, HHOOK FAR *phk);\n\/\/ 32-bit macro\n#define DefHookProc(nCode, wParam, lParam, phhk)\\\n        CallNextHookEx(*phhk, nCode, wParam, lParam)\n<\/pre>\n
\nDisclaimer: All code below is “reconstructed from memory”.\nThe spirit of the code is intact, but the precise details\nmay be off.\n<\/p>\n
\nTo install a windows hook in 16-bit Windows, you started by\ncalling SetWindowsHook<\/code>:\n<\/p>\n
\nHHOOK g_hhkPrev;\ng_hhkPrev = SetWindowsHook(WH_WHATEVER, MyHookProc);\n<\/pre>\n
\nThe return value from SetWindowsHook<\/code> must be saved\nin a global variable, which we gave the somewhat provocative\nname g_hhkPrev<\/code>.\nThe hook procedure itself went something like this:\n<\/p>\n
\n\/\/ In Win16, hook procedures returned a DWORD, not an LRESULT.\nDWORD CALLBACK MyHookProc(int nCode, WPARAM wParam, LPARAM lParam)\n{\n  if (nCode >= 0) { ... }\n  return DefHookProc(nCode, wParam, lParam, &g_hhkPrev);\n}\n<\/pre>\n
\nAnd then when you were finished, you removed the hook by\ncalling UnhookWindowsHook<\/code>:\n<\/p>\n
\nUnhookWindowsHook(WH_WHATEVER, MyhookProc);\ng_hhkPrev = NULL;\n<\/pre>\n
\nInternally, the chain of hook functions was managed as\na linked list, but instead of using some internal data structure\nto keep track of the hooks, the linked list was managed\ninside the HHOOK variables themselves<\/strong>.\n<\/p>\n
\nThe internal implementation of SetWindowsHook<\/code>\nwas simply this:\n<\/p>\n
\n\/\/ This array is initialized with a bunch\n\/\/ of \"do nothing\" hook procedures.\nHOOKPROC g_rgHook[NUMHOOKS];\nHHOOK WINAPI SetWindowsHook(int nType, HOOKPROC pfnHookProc)\n{\n HHOOK hhkPrev = (HHOOK)g_rgHook[nType];\n g_rgHook[nType] = pfnHookProc;\n return hhkPrev;\n}\n<\/pre>\n
\nInstalling a hook merely set your hook procedure as the head of\nthe hook chain, and it returned the previous head.\nInvoking a hook was a simple matter of calling the hook at the\nhead of the chain:\n<\/p>\n
\nDWORD CallHook(int nType, int nCode, WPARAM wParam, LPARAM lParam)\n{\n return g_rgHook[nType](nCode, wParam, lParam);\n}\n<\/pre>\n
\nEach hook procedure did its work and then sent the call\ndown the hook chain by calling DefHookProc<\/code>,\npassing the HHOOK<\/code> by address<\/strong>.\n<\/p>\n
\nDWORD WINAPI DefHookProc(int nCode, WPARAM wParam,\n                         LPARAM lParam, HHOOK FAR *phk)\n{\n HOOKPROC pfnNext = (HOOKPROC)*phk;\n if (nCode >=0) {\n  return pfnNext(nCode, wParam, lParam);\n }\n ... more to come ...\n}\n<\/pre>\n
\nAs you can see, it’s all blindingly simple:\nInvoking a hook calls the first hook procedure,\nwhich then calls DefHookProc<\/code>, which\nknows that a HHOOK<\/code>\nis just a HOOKPROC<\/code>, and it forwards the call down\nthe chain by merely calling the next hook procedure directly.\n<\/p>\n
\nThe real magic happens when somebody wants to unhook.\nRecall that the rule for hook procedures is that a negative\nhook code should be passed straight to DefHookProc<\/code>\n(or in modern times, CallNextHookEx<\/code>).\nThis convention allows the hook system to use negative codes\nto manage its own internal bookkeeping.\nIn this case, we’re using -1<\/code> as the\n“unhook this hook procedure” code.\n<\/p>\n
\nBOOL WINAPI UnhookWindowsHook(int nType, HOOKPROC pfnHookProc)\n{\n return DefHookProc(-1, 0, (LPARAM)pfnHookProc,\n                    (HHOOK FAR*)&g_rgHook[nType]);\n}\n<\/pre>\n
And then the real magic begins:\n<\/p>\n
\nDWORD WINAPI DefHookProc(int nCode, WPARAM wParam,\n                         LPARAM lParam, HHOOK FAR *phk)\n{\n HOOKPROC pfnNext = (HOOKPROC)*phk;\n if (nCode >=0) {\n  return pfnNext(nCode, wParam, lParam);\n }\n switch (nCode) {\n case -1: \/\/ trying to unhook a node\n  if (pfnNext == (HOOKPROC)lParam) { \/\/ found it\n   *phk = (HHOOK)pfnNext(-2, 0, 0);\n   return TRUE;\n  }\n  \/\/ else keep looking\n  return pfnNext(nCode, wParam, lParam);\n case -2: \/\/ report the next hook procedure\n   return (DWORD)*phk;\n }\n return 0;\n}\n<\/pre>\n
\nAnd there you have it, the entire window hook system in\ntwo dozen lines of code.\nYou have to give 16-bit Windows credit for being small.\n<\/p>\n
\nLet’s walk through hook installation, dispatch, and removal to see\nhow this all works.\nSuppose there is one WH_KEYBOARD<\/code> hook in the system.\nOur variables are therefore set up like this:\n<\/p>\n
\n\/\/ In USER\ng_rgHook[WH_KEYBOARD] = Hook1;\n\/\/ In HOOK1.DLL\nHHOOK g_hhkPrev1 = DoNothingHookProc;\nDWORD CALLBACK Hook1(int nCode, WPARAM wParam, LPARAM lParam)\n{\n if (nCode >= 0) { ... work ... }\n return DefHookProc(nCode, wParam, lParam, &g_hhkPrev1);\n}\n<\/pre>\n
\nNow suppose you want to install a new hook, Hook2<\/code>.<\/p>\n
\n\/\/ In HOOK2.DLL\nHHOOK g_hhkPrev2;\ng_hhkPrev = SetWindowsHook(WH_KEYBOARD, Hook2);\n<\/pre>\n
\nThe SetWindowsHook<\/code> function just puts your function\nin as the new “head” hook function and returns the old one.\n<\/p>\n
\n\/\/ In USER\ng_rgHook[WH_KEYBOARD] = Hook2;\n\/\/ In HOOK2.DLL\nHHOOK g_hhkPrev2 = Hook1;\nDWORD CALLBACK Hook2(int nCode, WPARAM wParam, LPARAM lParam)\n{\n if (nCode >= 0) { ... work ... }\n return DefHookProc(nCode, wParam, lParam, &g_hhkPrev2);\n}\n\/\/ In HOOK1.DLL\nHHOOK g_hhkPrev1 = DoNothingHookProc;\nDWORD CALLBACK Hook1(int nCode, WPARAM wParam, LPARAM lParam)\n{\n if (nCode >= 0) { ... work ... }\n return DefHookProc(nCode, wParam, lParam, &g_hhkPrev1);\n}\n<\/pre>\n
\nNow suppose the window manager decides it’s time to fire the\nWH_KEYBOARD<\/code> hook.\nIt starts with CallHook<\/code> which calls\ng_rgHook[WH_KEYBOARD]<\/code> that takes us to\nHook2<\/code>.\nThat hook function does its work, then calls\nDefHookProc(..., &g_hhkPrev2)<\/code>,\nwhich dispatches the hook to g_hhkPrev2 == Hook1<\/code>.\nSimilarly, the hook travels through Hook1<\/code>,\nthen\nDefHookProc(..., &g_hhkPrev1)<\/code>,\nwhere it finally reaches the DoNothingHookProc<\/code>\nwhich does nothing and ends the hook chain.\n<\/p>\n
\nNow suppose that HOOK1.DLL<\/code> decides to uninstall its\nhook. It therefore calls\nUnhookWindowsHook(WH_KEYBOARD, Hook1)<\/code>.\nThis starts off the hook chain with the internal hook code -1<\/code>\nand &g_rgHook[WH_KEYBOARD]<\/code> as the first hook pointer.\nThis activates the case -1<\/code> in DefHookProc<\/code> code\npath, which dereferences its phk<\/code> parameter and obtains\ng_rgHook[WH_KEYBOARD] == Hook2<\/code>.\nSince this is not equal to Hook1<\/code>, the call forwards down\nthe chain to Hook2<\/code>.\n<\/p>\n
\nLike a good hook function, Hook2<\/code> reacts to the negative\nhook code by handing the call directly to\nDefHookProc(-1, ..., &g_hhkPrev2)<\/code>.\nThis time, *phk == g_hhkPrev2 == Hook1<\/code>,\nso the test succeeds and we dispatch the hook down the chain\nwith a new internal code of -2<\/code>, which means,\n“Tell me what the next hook procedure is”.\n<\/p>\n
\nThis dispatch calls Hook1<\/code> which (since the notification\ncode is negative) immediately passes the call to\nDefHookProc(-2, ..., &g_hhkPrev1)<\/code>.\nThis now triggers the case -2<\/code> code path, which\njust returns *phk == g_hhkPrev1 == DoNothingHookProc<\/code>.\nThis value is returned to the DefHookProc(-1, ...)<\/code>\nwhich stores the result into *phk == g_hhkPrev2<\/code>;\nthe result is that you have g_hhkPrev2 = DoNothingHookProc<\/code>.\nFinally, DefHookProc<\/code> returns TRUE<\/code>\nto indicate that the hook was successfully uninstalled.\nThis value is then returned out from all the nested function calls\nto the original caller of UnhookWindowsHook<\/code>.\n<\/p>\n
\nObserve that at the end of this unhook exercise, we get the desired\nresult:\n<\/p>\n
\n\/\/ In USER\ng_rgHook[WH_KEYBOARD] = Hook2; \/\/ unchanged\n\/\/ In HOOK2.DLL\ng_hhkPrev2 = DoNothingHookProc; \/\/ updated!\nDWORD CALLBACK Hook2(int nCode, WPARAM wParam, LPARAM lParam)\n{\n if (nCode >= 0) { ... work ... }\n return DefHookProc(nCode, wParam, lParam, &g_hhkPrev2);\n}\n<\/pre>\n
\nAnd Hook1<\/code> is out of the hook chain, as we desired.\n<\/p>\n
\nThis really isn’t all that complicated.\nAll we did was delete a node from a linked list.\nIt’s just that this particular linked list cannot be traversed\nby just dereferencing pointers.\nInstead, we have to issue a function call and ask the\nrecursive function to perform the work on the “next” node for us.\nThat’s what the negative nCode<\/code> values are for.\n<\/p>\n
\nEvery time I work through this exercise,\nI am impressed by how compactly 16-bit Windows was written.\nIn just two dozen lines of code, we managed a linked list of\nfunction calls, including a dispatching system as well as\narbitrary deletion from the middle\nof the linked list, and all without any memory allocation.\n<\/p>\n
\n(And because I know people are going to try to change the topic:\nRemember, I’m talking about 16-bit Windows, not 32-bit window hooks.)\n<\/p>\n
\nNext time, we’ll look at one way people abused this simple system.<\/p>\n","protected":false},"excerpt":{"rendered":"
The mechanism for keeping track of window hooks was very different in 16-bit Windows. The functions involved were SetWindowsHook, UnhookWindowsHook and DefHookProc. The first two functions still exist today, but the third one has been replaced with a macro: \/\/ 16-bit prototype DWORD WINAPI DefHookProc(int nCode, WPARAM wParam, LPARAM lParam, HHOOK FAR *phk); \/\/ 32-bit […]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[2],"class_list":["post-30183","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-history"],"acf":[],"blog_post_summary":"
The mechanism for keeping track of window hooks was very different in 16-bit Windows. The functions involved were SetWindowsHook, UnhookWindowsHook and DefHookProc. The first two functions still exist today, but the third one has been replaced with a macro: \/\/ 16-bit prototype DWORD WINAPI DefHookProc(int nCode, WPARAM wParam, LPARAM lParam, HHOOK FAR *phk); \/\/ 32-bit […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/30183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=30183"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/30183\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=30183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=30183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=30183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}