Windows Hooking for Mac guys (from a Mac guy who had to learn it)
Windows hooks work on the basis of a function getting called with an event
of some type, taking some sort of action, then passing the event to the next
hook. Some allow modifying or deleting the event, others only let you see it
as it goes by.
There are several different types of hooks. They differ in which events they
receive and when, what data is available, and what can be done with the
event. CBT Hooks (Computer Based Training) tend to be the most useful in
most cases, since they cover a wide range of events.
Any application can install a hook local to itself. The process is fairly
similar to the Mac trap patching except that it patches an event instead of
an API. This type of hook ONLY sees events inside an application'e process
space.
A global hook affects ALL processes on the machine that are started AFTER
the hook is installed. These have to be located in a DLL: once the hook
function (exported from the DLL) is installed, the DLL will automatically
load into every new process and be applied there. A global hook can be
installed or removed by any application. The closest Mac equivalent is the
jGNE Filter technique from the good old days.
I recently used hooks to implement a popup blocker for IE: a small app was
launched, loaded the DLL and applied the hook; every instance of IE
thereafter was affected. The hook caught (among other things) window
creation events and decided whether the window was a popup that needed to be
deleted before appearing (harder than it sounds!) or a legitimate window.
The DLL's init code is called every time it links to a new process, so I
could check for IE and disable the hook for other applications. There is
also a way to share memory between different processes using the hook DLL,
so they can talk to each other.
Buggy hooking can destroy the stability of the entire system, and there is
an obvious impact on system performance if too many are installed or too
much processing is done.
Search MSDN.microsoft.com for more information. Incidentally, hooks aren't
directly supported under .NET for the same reason OS X doesn't have trap
patching.
Post by Uli KustererPost by JohnThanks all of you for your valuable input. Your responses have given me
enough information on where to start my study.
Your help is highly appreciated.
John,
it would be nice if you could post your results here. That way, someone
searching for the answer to this question (e.g. via Google groups) won't
have to ask the same question again.
I'd personally be pretty interested in learning how these Windows
"hooking" APIs correspond to the existing Mac mechanisms.
Cheers,
-- Uli
http://www.zathras.de