Andreas Mohr wrote:
On Sat, Apr 13, 2002 at 09:53:57AM -0400, Joshua Thielen wrote:
Can somebody give me a hint how is better to approach implementation of NFY_EXITTASK, NFY_STARTTASK events generation?
Does anyone know what ToolHelpHook does (KERNEL.341)? Could this be used by windows to hook a toolhelp notification function into kernel.dll?
It installs notification handlers before important system events (dll load, task exit, ...). It returns the address of the previously installed notification handler, thus allowing for chaining handlers. It's basically a Win 3.1 replacement for RegisterPtrace(). (same notification messages being used etc.) The notification msgs are NFY_xxx in toolhelp.h, BTW.
It's all described in "Undocumented Windows".
OK., it looks like toolhelp.dll should install a callback function into the kernel using ToolHelpHook. Whenever a kernel event occurs, this callback function would call each function in the NotifyRegister function list corresponding to the kernel event.
But this presents a problem: How would you install a 32-bit wine callback function using ToolHelpHook16? I guess we could have separate ToolHelpHook32 and ToolHelpHook16 functions. I don't think it would be possible to chain the 32-bit and 16-bit functions together like they are in windows/hook.c. The kernel code would have to call the 16-bit and 32-bit hooknotify functions separately.
Any better ideas? As I'm no wine pro, I hope I'm not spouting off meaningless nonsense here.
Josh