10

Win32 API allows creating hook into system processes such as mouse hook (WH_MOUSE_LL), a hook is created with SetWindowsHookExA/W functions.

The scenario is, a programme has installed a hook into Windows system with a local function; the programme does have a hook uninstall at the end, but, there's a case when the programme crashes and hook uninstall function is not called.

Does Windows know about dead hooks? and remove them automatically?

Hooks do pass around messages in a sequence: hook1 --> callnexthook --> hook2 --> callnexthook...

When the hook2 is dead, would it spoil the system?

Dee
  • 7,455
  • 6
  • 36
  • 70
  • 3
    _"...Before terminating, an application must call the UnhookWindowsHookEx function to free system resources associated with the hook...."_ https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowshookexa Means that even if Windows currently does remove dead hooks you can't rely on that behaviour. – Richard Critten Apr 29 '22 at 15:35
  • [Related/Duplicate](https://stackoverflow.com/q/4478829/10871073)? – Adrian Mole Apr 29 '22 at 15:37
  • 3
    @RichardCritten that's a great find but it doesn't tell you what the consequences are when you can't do that. I suppose it's like undefined behavior, you can't know and hope you never find out. – Mark Ransom Apr 29 '22 at 15:38
  • 1
    hook related to thread. and information about this saved in thread object (in general sense). when thread terminated - if hook still exist on thread - it removed – RbMm Apr 29 '22 at 15:47
  • 2
    Does Windows know about dead hooks? yes (hook is dead after thread, which set it terminared, or if we direct call UnhookWindowsHookEx ) and remove them automatically? - yes, of course. otherwise this is bug in system design and resourse leak – RbMm Apr 29 '22 at 16:12
  • 2
    in details calls on thread exit - `UserThreadCallout(PsW32ThreadCalloutExit) -> xxxDestroyThreadInfo() -> FreeThreadsWindowHooks() -> UnlinkHook + FreeHook`. [also](https://stackoverflow.com/a/38125642/6401656) – RbMm Apr 29 '22 at 16:18

0 Answers0