ApiHooks 3.1: 9xGlobal.txt


 Because system libraries (KERNEL32, USER32, GDI32, ADVAPI32, ...) of Windows 9x
are located in shared area between 2 and 3 GB it is not possible to hook them
normally (VirtualProtect and WriteProcessMemory fail). 
 When you use HOOK_HARD flag (of course together with other flags) then system
libraries can be hooked. But because these modules lie in shared area the
changes are visible to every process. For example if you changed export
of system library then all newly created processes will have modified import
- it will point to your new api routines. Also GetProcAddress will return
addresses of your new api routines.
 What does it mean?
0) Hooks_DLL must not import from module which is not shared. 
1) Hooks_DLL should be located in shared memory. 
   Such a DLL can be created as follows:
    a) All writeable sections must have SHARED flag (0x010000000) set.
    b) Image base should be between  0x80000000 and 0xC0000000 (you can set it
       for example equal to KERNEL32's image base).
2) Hooks are global.
   You can't use handles and other process specific "values" because you
   don't have to be in "your" process actually.
   To make hooks pseudolocal follow this:
    a) In DllMain save current process ID (GetCurrentProcessId)
    b) And then compare this saved ID with current process ID inside hook
       procedure.
3) Unhooking is required.
   When unhooking fails, the process with hooks must not exit.
   Otherwise APIs after Hooks_DLL freeing will point to undefined space.

See Examples\ASM\VxDCall