Re: 16-bit apps starting and stopping notification

[Andreas Mohr]

On Sat, Apr 13, 2002 at 09:53:57AM -0400, Joshua Thielen wrote:
> > Can somebody give me a hint how is better to approach
> > implementation of 
> > NFY_EXITTASK, NFY_STARTTASK events generation?
>
> Does anyone know what ToolHelpHook does (KERNEL.341)? Could this be used by windows to hook a toolhelp notification function into
> kernel.dll?

It installs notification handlers before important system events
(dll load, task exit, ...).
It returns the address of the previously installed notification handler,
thus allowing for chaining handlers.
It's basically a Win 3.1 replacement for RegisterPtrace().
(same notification messages being used etc.)
The notification msgs are NFY_xxx in toolhelp.h, BTW.

It's all described in "Undocumented Windows".