I want to get information about functions in global hook chain in windows. in fact i need to get the list of them and get their corresponding application if it's possible. As far as I know there is no windows API for doing this so I think i have to find them by going through the hook chain link list. but i don`t know the data structure of this link list and its begin address. does anyone know how windows manages its global hook chain?
+1
A:
One approach I've seen is shown in this blog post. It was referenced by this code (beware of slow server). Crazy stuff of course, no idea how well this will port between different Windows versions.
Hans Passant
2010-09-19 15:48:20
Thanks for your help. I've seen the blog and it gave me an overview but i think the code may be more useful. Now i`m trying to read assembly code and build it under win7.
Roozbeh
2010-09-21 18:07:34
A:
Instead of trying to walk an internal Windows structure, you know that all Window hooks must have a loaded module associated with them that has been injected into the target process; if you're trying to ensure that your own application isn't being hooked, enumerate the loaded module list and look for modules that shouldn't be there.
Paul Betts
2010-09-20 05:45:30