On Sat, Apr 13, 2002 at 09:53:57AM -0400, Joshua Thielen wrote: > > Can somebody give me a hint how is better to approach > > implementation of > > NFY_EXITTASK, NFY_STARTTASK events generation? > > Does anyone know what ToolHelpHook does (KERNEL.341)? Could this be used by windows >to hook a toolhelp notification function into > kernel.dll? It installs notification handlers before important system events (dll load, task exit, ...). It returns the address of the previously installed notification handler, thus allowing for chaining handlers. It's basically a Win 3.1 replacement for RegisterPtrace(). (same notification messages being used etc.) The notification msgs are NFY_xxx in toolhelp.h, BTW.
It's all described in "Undocumented Windows". -- Andreas Mohr Stauferstr. 6, D-71272 Renningen, Germany Tel. +49 7159 800604 http://home.arcor.de/andi.mohr/
