Windows® via C/C++, Fifth Edition

Injecting a DLL Using Windows Hooks

You can inject a DLL into a process’ address space using hooks. To get hooks to work as they do in 16-bit Windows, Microsoft was forced to devise a mechanism that allows a DLL to be injected into the address space of another process.

Let’s look at an example. Process A (a utility similar to Microsoft Spy++) installs a WH_GETMESSAGE hook to see messages processed by windows in the system. The hook is installed by calling SetWindowsHookEx as follows:

HHOOK hHook = SetWindowsHookEx(WH_GETMESSAGE, GetMsgProc,
   hInstDll, 0);

The first parameter, WH_GETMESSAGE, indicates the type of hook to install. The second parameter, GetMsgProc, identifies the address (in your address space) of the function that the system should ...