9xglobal.txt

window编程,非常的好

 Because system libraries (KERNEL32, USER32, GDI32, ADVAPI32, ...) of Windows 9x
are located in shared area between 2 and 3 GB it is not possible to hook them
normally (VirtualProtect and WriteProcessMemory fail). 
 When you use HOOK_HARD flag (of course together with other flags) then system
libraries can be hooked. But because these modules lay in shared area the
changes are visible for every process. For example if you changed export
of system library then all newly created processes will have modified import
- it will point to your new api routines. Also GetProcAddress will return
addresses of your new api routines.
 What does it mean?
1) Hooks.dll should be located in shared memory. 
   Such a dll can be created as follows:
    a) All writeable sections must have SHARED flag (0x010000000) set.
    b) Image base should be between  0x80000000 and 0xC0000000 (you can set it
       for example equal to KERNEL32's image base).
2) Hooks are global.
   You can't use handles and other process specific "values" because you
   don't have to be in "your" process actually.
   To make hooks pseudolocal follow this:
    a) In DllMain save current process ID (GetCurrentProcessId)
    b) And then compare this saved ID with current process ID inside hook
       procedure.
3) Unhooking is required.
   When unhooking fails, the process with hooks must not exit.
   Otherwise APIs after Hooks.dll freeing will point to undefined space.