Can somebody give me a hint how is better to approach implementation of NFY_EXITTASK, NFY_STARTTASK events generation?
Does anyone know what ToolHelpHook does (KERNEL.341)? Could this be used by windows to hook a toolhelp notification function into kernel.dll?
How important do you think is to implement this functionality, since it is for 16-bit apps only?
I still use a 16-bit app for school that uses these functions and that doesn't work in wine. I'm not sure if the app does't work because it needs these notifications or if there is another reason. I attempted to implement this a couple of months ago, but it was an ugly hack since I was calling a toolhelp helper function from kernel.dll (or maybe it was ntdll) in order to send the notification.
Regards,
Josh Thielen
On Sat, Apr 13, 2002 at 09:53:57AM -0400, Joshua Thielen wrote:
Can somebody give me a hint how is better to approach implementation of NFY_EXITTASK, NFY_STARTTASK events generation?
Does anyone know what ToolHelpHook does (KERNEL.341)? Could this be used by windows to hook a toolhelp notification function into kernel.dll?
It installs notification handlers before important system events (dll load, task exit, ...). It returns the address of the previously installed notification handler, thus allowing for chaining handlers. It's basically a Win 3.1 replacement for RegisterPtrace(). (same notification messages being used etc.) The notification msgs are NFY_xxx in toolhelp.h, BTW.
It's all described in "Undocumented Windows".
Andreas Mohr wrote:
On Sat, Apr 13, 2002 at 09:53:57AM -0400, Joshua Thielen wrote:
Can somebody give me a hint how is better to approach implementation of NFY_EXITTASK, NFY_STARTTASK events generation?
Does anyone know what ToolHelpHook does (KERNEL.341)? Could this be used by windows to hook a toolhelp notification function into kernel.dll?
It installs notification handlers before important system events (dll load, task exit, ...). It returns the address of the previously installed notification handler, thus allowing for chaining handlers. It's basically a Win 3.1 replacement for RegisterPtrace(). (same notification messages being used etc.) The notification msgs are NFY_xxx in toolhelp.h, BTW.
It's all described in "Undocumented Windows".
OK., it looks like toolhelp.dll should install a callback function into the kernel using ToolHelpHook. Whenever a kernel event occurs, this callback function would call each function in the NotifyRegister function list corresponding to the kernel event.
But this presents a problem: How would you install a 32-bit wine callback function using ToolHelpHook16? I guess we could have separate ToolHelpHook32 and ToolHelpHook16 functions. I don't think it would be possible to chain the 32-bit and 16-bit functions together like they are in windows/hook.c. The kernel code would have to call the 16-bit and 32-bit hooknotify functions separately.
Any better ideas? As I'm no wine pro, I hope I'm not spouting off meaningless nonsense here.
Josh
-
Andreas Mohr -
Joshua Thielen