[PATCH v2 3/3] win32u: Return ERROR_ACCESS_DENIED for WH_JOURNALRECORD and WH_JOURNALPLAYBACK on newer OS versions.

[Zhiyi Zhang]

From: Zhiyi Zhang

On > XP, settings WH_JOURNALRECORD or WH_JOURNALPLAYBACK hooks report ERROR_ACCESS_DENIED according
to tests, even with administrator rights. PCSE_TERM depends on this to not crash. MSDN also says
that journaling hooks APIs are unsupported starting in Windows 11.
---
 dlls/user32/tests/msg.c | 2 --
 dlls/win32u/hook.c      | 9 +++++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/dlls/user32/tests/msg.c b/dlls/user32/tests/msg.c
index 2db1e62930e..d924f889f72 100644
--- a/dlls/user32/tests/msg.c
+++ b/dlls/user32/tests/msg.c
@@ -12299,9 +12299,7 @@ static void test_set_hook(void)
         error = GetLastError();
         if (LOBYTE(LOWORD(GetVersion())) >= 6 && (i == WH_JOURNALRECORD || i == WH_JOURNALPLAYBACK))
         {
-            todo_wine
             ok(!hhook, "SetWinEventHook succeeded.\n");
-            todo_wine
             ok(error == ERROR_ACCESS_DENIED, "Got unexpected error %ld.\n", GetLastError());
         }
         else
diff --git a/dlls/win32u/hook.c b/dlls/win32u/hook.c
index 3cd6b1ee1a2..b16f76cba2a 100644
--- a/dlls/win32u/hook.c
+++ b/dlls/win32u/hook.c
@@ -105,6 +105,15 @@ HHOOK WINAPI NtUserSetWindowsHookEx( HINSTANCE inst, UNICODE_STRING *module, DWO
         }
     }

+    /* On > XP, settings WH_JOURNALRECORD or WH_JOURNALPLAYBACK hooks report ERROR_ACCESS_DENIED
+     * according to tests, even with administrator rights. PCSE_TERM depends on this to not crash.
+     * MSDN also says that journaling hooks APIs are unsupported starting in Windows 11 */
+    if (NtCurrentTeb()->Peb->OSMajorVersion >= 6 && (id == WH_JOURNALRECORD || id == WH_JOURNALPLAYBACK))
+    {
+        RtlSetLastWin32Error( ERROR_ACCESS_DENIED );
+        return 0;
+    }
+
     SERVER_START_REQ( set_hook )
     {
         req->id        = id;