title: System wide Windows CBT hook not working properly
body: <p>I'm trying to hook a CBT hook on Windows OSes. I'm currently using Windows 7 x64.</p>
  
  <p>I've read many threads talking about this issue, but none has solved my problem. The application runs well; the hook is installed and I can see some notifications coming. </p>
  
  <p>Actually the problems arised is that the application is not notified about CBT hook of other processes running on the same machine.</p>
  
  <p>The application is written in C# (using Microsoft .NET). Here is a running sample:</p>
  
  <pre><code>using System;
  using System.Collections.Generic;
  using System.ComponentModel;
  using System.Diagnostics;
  using System.Text;
  using System.Threading;
  using System.Reflection;
  using System.Runtime.InteropServices;
  using System.Windows.Forms;
  
  namespace WindowsHook
  {
      class Program
      {
      [STAThread]
      static void Main(string[] args)
      {
          uint thid = (uint)AppDomain.GetCurrentThreadId();
          bool global = true;
  
          mHookDelegate = Marshal.GetFunctionPointerForDelegate(new HookProc(ManagedCallback));
  
          if (global == true) {
              mNativeWrapperInstance = LoadLibrary("Native_x64.dll");
              thid = 0;
          } else {
              using (Process curProcess = Process.GetCurrentProcess())
              using (ProcessModule curModule = curProcess.MainModule)
              {
                  mNativeWrapperInstance = GetModuleHandle(curModule.ModuleName);
              }
          }
  
          mNativeWrappedDelegate = AllocHookWrapper(mHookDelegate);
          mHookHandle = SetWindowsHookEx(/*WH_CBT*/5, mNativeWrappedDelegate, mNativeWrapperInstance, thid);
  
          if (mHookHandle == IntPtr.Zero)
              throw new Win32Exception(Marshal.GetLastWin32Error());
  
          Application.Run(new Form());
  
          if (FreeHookWrapper(mNativeWrappedDelegate) == false)
              throw new Win32Exception("FreeHookWrapper has failed");
          if (FreeLibrary(mNativeWrapperInstance) == false)
              throw new Win32Exception("FreeLibrary has failed");
  
          if (UnhookWindowsHookEx(mHookHandle) == false)
              throw new Win32Exception(Marshal.GetLastWin32Error());
      }
  
      static int ManagedCallback(int code, IntPtr wParam, IntPtr lParam)
      {
          Trace.TraceInformation("Code: {0}", code);
          if (code &gt;= 0) {
              return (0);
          } else {
              return (CallNextHookEx(mHookHandle, code, wParam, lParam));
          }
      }
  
      delegate int HookProc(int code, IntPtr wParam, IntPtr lParam);
  
      static IntPtr mHookHandle;
  
      static IntPtr mHookDelegate;
  
      static IntPtr mNativeWrapperInstance = IntPtr.Zero;
  
      static IntPtr mNativeWrappedDelegate = IntPtr.Zero;
  
      [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
      public static extern IntPtr GetModuleHandle(string lpModuleName);
  
      [DllImport("user32.dll", SetLastError = true)]
      private static extern IntPtr SetWindowsHookEx(int hook, IntPtr callback, IntPtr hMod, uint dwThreadId);
  
      [DllImport("user32.dll", SetLastError = true)]
      internal static extern bool UnhookWindowsHookEx(IntPtr hhk);
  
      [DllImport("user32.dll")]
      internal static extern int CallNextHookEx(IntPtr hhk, int nCode, IntPtr wParam, IntPtr lParam);
  
      [DllImport("kernel32.dll")]
      private static extern IntPtr LoadLibrary(string lpFileName);
  
      [DllImport("kernel32.dll", SetLastError = true)]
      private static extern bool FreeLibrary(IntPtr hModule);
  
      [DllImport("Native_x64.dll")]
      private static extern IntPtr AllocHookWrapper(IntPtr callback);
  
      [DllImport("Native_x64.dll")]
      private static extern bool FreeHookWrapper(IntPtr wrapper);
  
      [DllImport("Native_x64.dll")]
      private static extern int FreeHooksCount();
  }
  </code></pre>
  
  <p>}</p>
  
  <p>AllocHookWrapper and FreeHookWrapper are imported routines from a DLL (Native_x64.dll) compiler for x64 platform, located at the same directory of the application. AllocHookWrapper stores the function pointer (of the managed routine) and returns the DLL routine calling the function pointer).</p>
  
  <p>Here is the code of the DLL:</p>
  
  <pre><code>#include "stdafx.h"
  #include "iGecko.Native.h"
  
  #ifdef _MANAGED
  #pragma managed(push, off)
  #endif
  
  #define WIN32_LEAN_AND_MEAN
  #include &lt;windows.h&gt;
  
  #define WRAPPER_NAME(idx)   Wrapper ## idx
  
  #define WRAPPER_IMPLEMENTATION(idx)                                                 \
  LRESULT WINAPI WRAPPER_NAME(idx)(int code, WPARAM wparam, LPARAM lparam)        \
  {                                                                               \
      if (sHooksWrapped[idx] != NULL)                                             \
          return (sHooksWrapped[idx])(code, wparam, lparam);                      \
      else                                                                        \
          return (0);                                                             \
  }
  
  #define WRAPPER_COUNT       16
  
  HOOKPROC sHooksWrapped[WRAPPER_COUNT] = { NULL };
  
  WRAPPER_IMPLEMENTATION(0x00);
  WRAPPER_IMPLEMENTATION(0x01);
  WRAPPER_IMPLEMENTATION(0x02);
  WRAPPER_IMPLEMENTATION(0x03);
  WRAPPER_IMPLEMENTATION(0x04);
  WRAPPER_IMPLEMENTATION(0x05);
  WRAPPER_IMPLEMENTATION(0x06);
  WRAPPER_IMPLEMENTATION(0x07);
  WRAPPER_IMPLEMENTATION(0x08);
  WRAPPER_IMPLEMENTATION(0x09);
  WRAPPER_IMPLEMENTATION(0x0A);
  WRAPPER_IMPLEMENTATION(0x0B);
  WRAPPER_IMPLEMENTATION(0x0C);
  WRAPPER_IMPLEMENTATION(0x0D);
  WRAPPER_IMPLEMENTATION(0x0E);
  WRAPPER_IMPLEMENTATION(0x0F);
  
  const HOOKPROC sHookWrappers[] = {
      WRAPPER_NAME(0x00),
      WRAPPER_NAME(0x01),
      WRAPPER_NAME(0x02),
      WRAPPER_NAME(0x03),
      WRAPPER_NAME(0x04),
      WRAPPER_NAME(0x05),
      WRAPPER_NAME(0x06),
      WRAPPER_NAME(0x07),
      WRAPPER_NAME(0x08),
      WRAPPER_NAME(0x09),
      WRAPPER_NAME(0x0A),
      WRAPPER_NAME(0x0B),
      WRAPPER_NAME(0x0C),
      WRAPPER_NAME(0x0D),
      WRAPPER_NAME(0x0E),
      WRAPPER_NAME(0x0F)
  };
  
  BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
  {
      return (TRUE);
  }
  
  #ifdef _MANAGED
  #pragma managed(pop)
  #endif
  
  extern "C" IGECKONATIVE_API HOOKPROC WINAPI AllocHookWrapper(HOOKPROC wrapped)
  {
      for(int i = 0; i &lt; WRAPPER_COUNT; i++) {
          if (sHooksWrapped[i] == NULL) {
              sHooksWrapped[i] = wrapped;
              return sHookWrappers[i];
          }
      }
  
      return (NULL);
  }
  
  extern "C" IGECKONATIVE_API BOOL WINAPI FreeHookWrapper(HOOKPROC wrapper)
  {
      for(int i = 0; i &lt; WRAPPER_COUNT; i++) {
          if (sHookWrappers[i] == wrapper) {
              sHooksWrapped[i] = NULL;
              return TRUE;
          }
      }
  
      return (FALSE);
  }
  
  extern "C" IGECKONATIVE_API INT WINAPI FreeHooksCount()
  {
      int c = 0;
  
      for(int i = 0; i &lt; WRAPPER_COUNT; i++) {
          if (sHooksWrapped[i] == NULL)
              c++;
      }
  
      return (c);
  }
  </code></pre>
  
  <hr>
  
  <p>Actually I'm interested about window related events (creation, destruction) on a certain system, but I'm actually unable to being notified by the OS...</p>
  
  <p>What's going on? What have I missed?</p>
  
  <p>Note that I'm running with the Administratos group.</p>
  
  <hr>
  
  <p>I've found this interesting section in this <a href="http://support.microsoft.com/kb/319524/en-us" rel="nofollow noreferrer">page</a></p>
  
  <blockquote>
    <p><strong>Global hooks are not supported in the .NET Framework</strong>
    You cannot implement global hooks in Microsoft .NET Framework. To install a global hook, a hook must have a native DLL export to insert itself in another process that requires a valid, consistent function to call into. This behavior requires a DLL export. The .NET Framework does not support DLL exports. Managed code has no concept of a consistent value for a function pointer because these function pointers are proxies that are built dynamically.</p>
  </blockquote>
  
  <p>I thought to do the trick by implementing a native DLL containing the hook callback, which calls the managed callback. However, the managed callback is called only in the process which calls the SetWindowsHookEx routine and not called by other processes.</p>
  
  <p>What are the possible workarounds?</p>
  
  <p><em>Maybe allocating heap memory storing a process id (the managed one), and sending user messages describing the hooked functions?</em></p>
  
  <hr>
  
  <p>What I'm trying to achieve is a system wide monitor, which detect new processes executed, detect created windows position and size, as well closed windows, moved windows, minimized/maximized windows. Successively the monitor shall detect mouse and keyboard events (always system-wide) and also it has to "emulate" mouse and keyboard events.</p>
  
  <p>Every process in the same desktop has to be monitored, indepently by the archiveture (32 or 64 bit) and by the underlying framework (native or managed).</p>
  
  <p>The monitor shall force process windows position, size and movements, and shall be able to act as local user in order to allow remote user to act as a local user (something like VNC).</p>