How were window hooks implemented in 16-bit Windows?

re: How were window hooks implemented in 16-bit Windows?

Nawak — Wed, 09 Aug 2006 18:26:14 GMT

This is really clever!
But it also 'looks' fragile as it relies on user functions doing the right thing in order for the whole mechanic to work!
Since I am quite a nice guy (no, really ;) ), I am waiting for your tomorrow's post to see what evil deeds people managed to do with that!

re: How were window hooks implemented in 16-bit Windows?

Csaboka — Wed, 09 Aug 2006 18:49:22 GMT

> But it also 'looks' fragile as it relies on user functions doing the right thing in order for the whole mechanic to work!

Well, if you look at it that way, the whole 16-bit Windows world was fragile since it relied on user programs playing nicely. Back in the 16-bit days, it would have been too expensive to protect against misbehaving user programs. If you wanted to bring the whole system down, all you needed to do is not yielding to the OS.

This solution is ideal if you want to be memory efficient and you can assume user programs playing nicely together with you.

re: How were window hooks implemented in 16-bit Windows?

Caliban Darklock — Wed, 09 Aug 2006 18:50:04 GMT

How perceptive of you, Nawak. ;)

I was rather frustrated by programming under 16-bit Windows, not because of Windows itself, but purely because other developers had chosen to implement strange custom solutions to problems that had established "correct" answers. It was reasonably common that someone would reverse-engineer the contents of a handle - which was deliberately undocumented and unsupported, because it could change at any time - and access it directly.

In the HHOOK case, for example, someone might try to duplicate the above logic himself rather than use the standard Windows calls. If he happened to get something wrong, probably because he didn't really understand the process, the system would behave oddly and nobody would know why. I suspect that may form the basis of Raymond's next post.

re: How were window hooks implemented in 16-bit Windows?

Tom — Thu, 10 Aug 2006 00:37:30 GMT

I love opaque data structures. It's a relief not knowing how a class or data structure is implemented because otherwise you are tempted to program through the interface instead of to the interface (e.g. guess the implementation by the members of the class so you can 'optimize' how you call its methods).

I would have to say that if you are using a debugger to find undocumented members of structs/classes and relying on them being there: a) you're doing something wrong; and b) you get what you deserve.

I understand that Microsoft makes lots of thunks for broken software (see http://blogs.msdn.com/oldnewthing/archive/2006/01/09/510781.aspx for more information), and I can understand why. But it sure would be nice to say "to heck with them" when somebody pokes around internal undocumented structures and expects things to work that way forever.

In regards to hook dispatching, I can't imagine how expensive it is for more than one process to have a hook on a high-traffic message. How does Win32 make this work without a ton of context switches?

re: How were window hooks implemented in 16-bit Windows?

CN — Thu, 10 Aug 2006 15:40:00 GMT

Tom: The hook function must reside in a DLL. That DLL must/will be loaded in each target process. So, in addition to message processing, you add clutter the virtual address space and some loading time. (More so if the hook function is just one function in a heavy DLL that's then brought into every process.)

re: How were window hooks implemented in 16-bit Windows?

swapping — Thu, 10 Aug 2006 16:00:03 GMT

CN: 16-bit windows didn't have "virtual address space", it had segmenting at best. Only the (4k) pages that is used is loaded into ram, usually not very much.

One way people abused hooks in 16-bit Windows

The Old New Thing — Thu, 10 Aug 2006 17:00:16 GMT

Unhooking by hooking again.

re: How were window hooks implemented in 16-bit Windows?

Chris Becke — Thu, 10 Aug 2006 18:32:55 GMT

It seems an app that passed a copy of the HHOOK it originally got would defeat the unhooking mechanism. e.g.

DWORD CALLBACK MyHookProc(int nCode, WPARAM wParam, LPARAM lParam)
{
...
HHOOK hhkLocal = g_hhkPrev;
return DefHookProc(nCode, wParam, lParam, &hhkLocal);
}

Why do this? Who knows: Given the lack of a user parameter I can imagine a scenario where parts of the code use their own copies of an HHOOK.

re: How were window hooks implemented in 16-bit Windows?

ATZ Man — Fri, 11 Aug 2006 22:49:32 GMT

@swapping, @DN

Win16 enhanced mode had demand-paged virtual memory. In any mode, all running Win16 applications were in one memory space (accessed by the app through segment registers, it is true). The hook DLL would not have to be mapped into each target process, because the DLL was already jumpable into through a far call from any running application.