Andreas Mohr wrote: >On Sat, Apr 13, 2002 at 09:53:57AM -0400, Joshua Thielen wrote: > >>>Can somebody give me a hint how is better to approach >>>implementation of >>>NFY_EXITTASK, NFY_STARTTASK events generation? >>> >>Does anyone know what ToolHelpHook does (KERNEL.341)? Could this be used by windows >to hook a toolhelp notification function into >>kernel.dll? >> >It installs notification handlers before important system events >(dll load, task exit, ...). >It returns the address of the previously installed notification handler, >thus allowing for chaining handlers. >It's basically a Win 3.1 replacement for RegisterPtrace(). >(same notification messages being used etc.) >The notification msgs are NFY_xxx in toolhelp.h, BTW. > >It's all described in "Undocumented Windows". > OK., it looks like toolhelp.dll should install a callback function into the kernel using ToolHelpHook. Whenever a kernel event occurs, this callback function would call each function in the NotifyRegister function list corresponding to the kernel event.
But this presents a problem: How would you install a 32-bit wine callback function using ToolHelpHook16? I guess we could have separate ToolHelpHook32 and ToolHelpHook16 functions. I don't think it would be possible to chain the 32-bit and 16-bit functions together like they are in windows/hook.c. The kernel code would have to call the 16-bit and 32-bit hooknotify functions separately. Any better ideas? As I'm no wine pro, I hope I'm not spouting off meaningless nonsense here. Josh
