53 TRACE(
"co_IntClientLoadLibrary returned %d\n", bResult );
95 TRACE(
"IntHookModuleUnloaded: iHookID=%d\n", iHookID);
100 while(ListEntry != &pdesk->
PtiList)
108 ptiCurrent->
ppi != ppiCsr)
112 TRACE(
"IntHookModuleUnloaded: sending message to PID %p, ppi=%p\n",
PsGetProcessId(ptiCurrent->
ppi->peProcess), ptiCurrent->
ppi);
124 ListEntry = ListEntry->
Flink;
176 if(pwndCurrent ==
NULL)
180 ptiCurrent = pwndCurrent->
head.pti;
184 ptiCurrent->
ppi == ppiCsr)
256 pti = Hook->
head.pti;
309 ERR(
"Error Hook Call SendMsg. %d Status: 0x%x\n", Hook->
HookId,
Status);
421 ERR(
"HOOK WH_DEBUG read from lParam ERROR!\n");
435 Size =
sizeof(MOUSEHOOKSTRUCTEX);
506 ERR(
"HOOK WH_DEBUG read from Debug.lParam ERROR!\n");
535 MOUSEHOOKSTRUCTEX
Mouse;
541 sizeof(MOUSEHOOKSTRUCTEX),
546 sizeof(MOUSEHOOKSTRUCTEX));
556 ERR(
"HOOK WH_MOUSE read from lParam ERROR!\n");
594 ERR(
"HOOK WH_MOUSE_LL read from lParam ERROR!\n");
629 ERR(
"HOOK WH_KEYBORD_LL read from lParam ERROR!\n");
666 ERR(
"HOOK WH_XMESSAGEX read from lParam ERROR!\n");
694 ERR(
"HOOK WH_GETMESSAGE write to lParam ERROR!\n");
702 TRACE(
"HOOK WH_CBT!\n");
709 TRACE(
"HOOK HCBT_CREATEWND\n");
761 ERR(
"HOOK HCBT_CREATEWND write ERROR!\n");
764 if (!BadChk && Hook->
Proc)
775 TRACE(
"HOOK HCBT_MOVESIZE\n");
797 ERR(
"HOOK HCBT_MOVESIZE read from lParam ERROR!\n");
812 TRACE(
"HOOK HCBT_ACTIVATE\n");
833 ERR(
"HOOK HCBT_ACTIVATE read from lParam ERROR!\n");
881 ERR(
"HOOK WH_JOURNAL read from lParam ERROR!\n");
909 ERR(
"HOOK WH_JOURNAL write to lParam ERROR!\n");
930 ERR(
"Unsupported HOOK Id -> %d\n",Hook->
HookId);
972 for (pElem = pLastHead->
Flink; pElem != pLastHead; pElem = pElem->
Flink)
982 for (pElem = pLastHead->
Flink; pElem != pLastHead; pElem = pElem->
Flink)
998 int HookId = Hook->
HookId;
1014 if (pElem != pLastHead)
1061 bOtherProcess = (ptiHook->
ppi != pti->
ppi);
1108 PHOOK Hook, SaveHook;
1128 TRACE(
"No PDO %d\n", HookId);
1139 TRACE(
"Hook Thread dead %d\n", HookId);
1145 TRACE(
"Local Hooker %d\n", HookId);
1151 TRACE(
"Global Hooker %d\n", HookId);
1167 ERR(
"No Local Hook Found!\n");
1230 HHOOK *pHookHandles;
1242 for(
i = 0; pHookHandles[
i]; ++
i)
1247 ERR(
"Invalid hook!\n");
1252 ptiHook = Hook->
head.pti;
1256 TRACE(
"Next Hook %p, %p\n", ptiHook->
rpdesk, pdo);
1261 if (ptiHook != pti )
1271 TRACE(
"\nGlobal Hook posting to another Thread! %d\n",HookId );
1274 else if (ptiHook->
ppi == pti->
ppi)
1276 TRACE(
"\nGlobal Hook calling to another Thread! %d\n",HookId );
1294 TRACE(
"Global going Local Hook calling to Thread! %d\n",HookId );
1312 TRACE(
"Ret: Global HookId %d Result 0x%x\n", HookId,
Result);
1336 pElement = pLastHead->
Flink;
1337 while (pElement != pLastHead)
1344 if (Hook->
Proc == pfnFilterProc)
1346 if (Hook->
head.pti == pti)
1377 PHOOK HookObj, NextObj;
1382 TRACE(
"Enter NtUserCallNextHookEx\n");
1389 if (!HookObj)
RETURN( 0);
1414 TRACE(
"Leave NtUserCallNextHookEx, ret=%i\n",_ret_);
1456 TRACE(
"Enter NtUserSetWindowsHookEx\n");
1481 TRACE(
"Local hook installing Global HookId: %d\n",HookId);
1489 ERR(
"Invalid thread id 0x%x\n", ThreadId);
1496 ERR(
"Local hook wrong desktop HookId: %d\n",HookId);
1501 if (ptiHook->
ppi != pti->
ppi)
1513 ERR(
"Local hook needs hMod HookId: %d\n",HookId);
1547 ERR(
"Global hook needs hMod HookId: %d\n",HookId);
1577 Hook->
Proc = HookProc;
1591 if ( ptiHook->
ppi == pti->
ppi)
1600 ERR(
"Problem writing to Local ClientInfo!\n");
1616 ERR(
"Problem writing to Remote ClientInfo!\n");
1673 FIXME(
"NtUserSetWindowsHookEx Setting process hMod instance addressing.\n");
1680 TRACE(
"Installing: HookId %d Global %s\n", HookId, !ThreadId ?
"TRUE" :
"FALSE");
1686 TRACE(
"Leave NtUserSetWindowsHookEx, ret=%p\n", _ret_);
1698 TRACE(
"Enter NtUserUnhookWindowsHookEx\n");
1703 ERR(
"Invalid handle passed to NtUserUnhookWindowsHookEx\n");
1717 TRACE(
"Leave NtUserUnhookWindowsHookEx, ret=%i\n",_ret_);
static __inline NTSTATUS ProbeAndCaptureUnicodeString(OUT PUNICODE_STRING Dest, IN KPROCESSOR_MODE CurrentMode, IN const UNICODE_STRING *UnsafeSrc)
#define ERROR_INVALID_PARAMETER
BOOLEAN IntRemoveHook(PVOID Object)
#define HCBT_CLICKSKIPPED
BOOL FASTCALL UserRegisterUserApiHook(PUNICODE_STRING pstrDllName, PUNICODE_STRING pstrFuncName)
#define HOOKID_TO_FLAG(HookId)
#define ERROR_INVALID_HOOK_HANDLE
BOOL FASTCALL UserDeleteObject(HANDLE h, HANDLE_TYPE type)
struct png_info_def **typedef void(__cdecl typeof(png_destroy_read_struct))(struct png_struct_def **
BOOL APIENTRY NtUserUnregisterUserApiHook(VOID)
UNICODE_STRING strUahInitFunc
PHOOK FASTCALL IntGetNextHook(PHOOK Hook)
VOID NTAPI Unload(PDRIVER_OBJECT DriverObject)
FORCEINLINE VOID InsertHeadList(_Inout_ PLIST_ENTRY ListHead, _Inout_ __drv_aliasesMem PLIST_ENTRY Entry)
PVOID NTAPI PsGetProcessWin32Process(PEPROCESS Process)
TW_UINT32 TW_UINT16 TW_UINT16 MSG
struct tagKBDLLHOOKSTRUCT KBDLLHOOKSTRUCT
PVOID NTAPI PsGetCurrentThreadWin32Thread(VOID)
BOOL IntHookModuleUnloaded(PDESKTOP pdesk, int iHookID, HHOOK hHook)
UNICODE_STRING strUahModule
static __inline VOID UserRefObjectCo(PVOID obj, PUSER_REFERENCE_ENTRY UserReferenceEntry)
#define ERROR_NOT_ENOUGH_MEMORY
IN PVOID IN PVOID IN USHORT IN USHORT Size
struct _HOOKPACK * PHOOKPACK
CBT_CREATEWNDA CBT_CREATEWND
#define W32PF_APIHOOKLOADED
BOOL FASTCALL UserDereferenceObject(PVOID Object)
ACPI_BUFFER *RetBuffer ACPI_BUFFER *RetBuffer char ACPI_WALK_RESOURCE_CALLBACK void *Context ACPI_BUFFER *RetBuffer UINT16 ACPI_RESOURCE **ResourcePtr ACPI_GENERIC_ADDRESS *Reg UINT32 *ReturnValue UINT8 UINT8 *Slp_TypB ACPI_PHYSICAL_ADDRESS PhysicalAddress64 UINT32 UINT32 *TimeElapsed UINT32 ACPI_STATUS const char UINT32 ACPI_STATUS const char UINT32 const char const char * ModuleName
_Must_inspect_result_ FORCEINLINE BOOLEAN IsListEmpty(_In_ const LIST_ENTRY *ListHead)
struct _THREADINFO * ptiHooked
LRESULT APIENTRY NtUserCallNextHookEx(int Code, WPARAM wParam, LPARAM lParam, BOOL Ansi)
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
BOOL APIENTRY NtUserRegisterUserApiHook(PUNICODE_STRING m_dllname1, PUNICODE_STRING m_funname1, DWORD dwUnknown3, DWORD dwUnknown4)
LRESULT(CALLBACK * HOOKPROC)(int, WPARAM, LPARAM)
PVOID FASTCALL UserCreateObject(PUSER_HANDLE_TABLE ht, PDESKTOP pDesktop, PTHREADINFO pti, HANDLE *h, HANDLE_TYPE type, ULONG size)
struct _THREADINFO * GetW32ThreadInfo(VOID)
struct tagMSLLHOOKSTRUCT MSLLHOOKSTRUCT
struct tagCBT_CREATEWNDW * LPCBT_CREATEWNDW
PTHREADINFO FASTCALL IntTID2PTI(HANDLE id)
#define WH_FOREGROUNDIDLE
FORCEINLINE BOOLEAN RemoveEntryList(_In_ PLIST_ENTRY Entry)
BOOL FASTCALL co_MsqSendMessageAsync(PTHREADINFO ptiReceiver, HWND hwnd, UINT Msg, WPARAM wParam, LPARAM lParam, SENDASYNCPROC CompletionCallback, ULONG_PTR CompletionCallbackContext, BOOL HasPackedLParam, INT HookMessage)
struct tagMOUSEHOOKSTRUCT MOUSEHOOKSTRUCT
struct _HOOKPACK HOOKPACK
NTSYSAPI ULONG WINAPI RtlNtStatusToDosError(NTSTATUS)
BOOL FASTCALL UserLoadApiHook(VOID)
VOID NTAPI KeStackAttachProcess(IN PKPROCESS Process, OUT PRKAPC_STATE ApcState)
#define ERROR_ACCESS_DENIED
static __inline VOID UserDerefObjectCo(PVOID obj)
#define PsGetCurrentProcess
#define EXCEPTION_EXECUTE_HANDLER
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
BOOL IntLoadHookModule(int iHookID, HHOOK hHook, BOOL Unload)
static VOID FASTCALL IntFreeHook(PHOOK Hook)
NTSTATUS FASTCALL IntValidateWindowStationHandle(HWINSTA WindowStation, KPROCESSOR_MODE AccessMode, ACCESS_MASK DesiredAccess, PWINSTATION_OBJECT *Object, POBJECT_HANDLE_INFORMATION pObjectHandleInfo)
HHOOK APIENTRY NtUserSetWindowsHookAW(int idHook, HOOKPROC lpfn, BOOL Ansi)
#define WH_CALLWNDPROCRET
BOOL FASTCALL UserObjectInDestroy(HANDLE h)
PWND FASTCALL UserGetWindowObject(HWND hWnd)
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
#define HOOKID_TO_INDEX(HookId)
#define IntReferenceThreadInfo(pti)
VOID FASTCALL UserEnterExclusive(VOID)
#define UserHMGetHandle(obj)
LRESULT APIENTRY co_IntCallHookProc(INT HookId, INT Code, WPARAM wParam, LPARAM lParam, HOOKPROC Proc, INT Mod, ULONG_PTR offPfn, BOOLEAN Ansi, PUNICODE_STRING ModuleName)
struct _LIST_ENTRY * Flink
static __inline VOID ReleaseCapturedUnicodeString(IN PUNICODE_STRING CapturedString, IN KPROCESSOR_MODE CurrentMode)
LRESULT APIENTRY co_CallHook(INT HookId, INT Code, WPARAM wParam, LPARAM lParam)
#define ERROR_INVALID_FILTER_PROC
_Out_ PCLIENT_ID ClientId
BOOL APIENTRY NtUserUnhookWindowsHookEx(HHOOK Hook)
UNICODE_STRING ModuleName
Implementation of the Explorer desktop window.
#define NT_SUCCESS(StatCode)
static LRESULT APIENTRY co_UserCallNextHookEx(PHOOK Hook, int Code, WPARAM wParam, LPARAM lParam, BOOL Ansi)
#define UlongToHandle(ul)
static HHOOK *FASTCALL IntGetGlobalHookHandles(PDESKTOP pdo, int HookId)
#define ISITHOOKED(HookId)
HHOOK APIENTRY NtUserSetWindowsHookEx(HINSTANCE Mod, PUNICODE_STRING UnsafeModuleName, DWORD ThreadId, int HookId, HOOKPROC HookProc, BOOL Ansi)
#define ObDereferenceObject
#define DECLARE_RETURN(type)
static LRESULT APIENTRY co_HOOK_CallHookNext(PHOOK Hook, INT Code, WPARAM wParam, LPARAM lParam)
#define WH_JOURNALPLAYBACK
BOOLEAN NTAPI PsIsSystemProcess(IN PEPROCESS Process)
struct _CLIENTINFO * pClientInfo
#define ExAllocatePoolWithTag(hernya, size, tag)
LRESULT APIENTRY co_HOOK_CallHooks(INT HookId, INT Code, WPARAM wParam, LPARAM lParam)
DBG_DEFAULT_CHANNEL(UserHook)
BOOL NTAPI co_IntClientLoadLibrary(PUNICODE_STRING pstrLibName, PUNICODE_STRING pstrInitFunc, BOOL Unload, BOOL ApiHook)
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
LIST_ENTRY aphkStart[NB_HOOKS]
FIXME!
_Must_inspect_result_ _In_ WDFCMRESLIST List
_In_ UCHAR _In_ UCHAR _In_ ULONG Code
PPROCESSINFO ppiUahServer
HWND *FASTCALL IntWinListChildren(PWND Window)
struct tagHOOK * sphkCurrent
VOID FASTCALL SetLastNtError(NTSTATUS Status)
static LRESULT FASTCALL co_IntCallLowLevelHook(PHOOK Hook, INT Code, WPARAM wParam, LPARAM lParam)
_Must_inspect_result_ _In_ WDFCOLLECTION _In_ WDFOBJECT Object
PHOOK FASTCALL IntGetHookObject(HHOOK hHook)
VOID FASTCALL UserLeave(VOID)
HWND FASTCALL IntGetDesktopWindow(VOID)
FORCEINLINE struct _TEB * NtCurrentTeb(VOID)
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
PVOID UserGetObject(PUSER_HANDLE_TABLE ht, HANDLE handle, HANDLE_TYPE type)
VOID NTAPI KeUnstackDetachProcess(IN PRKAPC_STATE ApcState)
_Out_ PKAPC_STATE ApcState
#define _Analysis_assume_
PVOID NTAPI PsGetCurrentProcessWin32Process(VOID)
BOOL FASTCALL UserIsEnteredExclusive(VOID)
#define ERROR_HOOK_TYPE_NOT_ALLOWED
BOOL FASTCALL IntUnhookWindowsHook(int HookId, HOOKPROC pfnFilterProc)
#define ERROR_HOOK_NEEDS_HMOD
#define ERROR_GLOBAL_ONLY_HOOK
static LRESULT FASTCALL co_IntCallDebugHook(PHOOK Hook, int Code, WPARAM wParam, LPARAM lParam, BOOL Ansi)
#define ObReferenceObject
struct tagEVENTMSG EVENTMSG
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
struct tagCBTACTIVATESTRUCT CBTACTIVATESTRUCT
#define RtlCopyMemory(Destination, Source, Length)
NTSTATUS FASTCALL co_MsqSendMessage(PTHREADINFO ptirec, HWND Wnd, UINT Msg, WPARAM wParam, LPARAM lParam, UINT uTimeout, BOOL Block, INT HookMessage, ULONG_PTR *uResult)
#define _SEH2_EXCEPT(...)
PDESKTOP FASTCALL IntGetActiveDesktop(VOID)
HANDLE NTAPI PsGetProcessId(PEPROCESS Process)
#define ExFreePoolWithTag(_P, _T)
struct _DESKTOPINFO * pDeskInfo
PUSER_HANDLE_TABLE gHandleTable
LIST_ENTRY aphkStart[NB_HOOKS]
#define IntDereferenceThreadInfo(pti)
ENGAPI VOID APIENTRY EngSetLastError(_In_ ULONG iError)
BOOL FASTCALL UserUnregisterUserApiHook(VOID)
#define ERROR_INVALID_HOOK_FILTER
VOID FASTCALL UserReferenceObject(PVOID obj)