SetWindowsHook or SetWindowsHookEx causes all other processes to crash

Previous Top Next

The Win32 API functions SetWindowsHook and SetWindowsHookEx allow you to load a DLL into the process space of all other programs on the local system. The DLL which is loaded into the process space of other applications can receive Windows messages and relay them to main program using Shared memory or pipes. Some developers use this to "spy" on other application, for example to detect when the user is Idle for Instant Messaging software such Yahoo and MSN. Other applications such VNC (Virtual Network Computing) may use this to hook into other application and capture drawing commands.

Typically when a DLL is loaded by Thinstall, Thinstall will modify the DLL in memory to allow it to access the virtual operating system which Thinstall provides. If the DLL is to be loaded into other processes, these modification will cause the DLL to crash when running in the process space of another program. In effect, all other programs will crash. It is important to make sure Thinstall does not load or modify your DLL if the DLL is to be used with SetWindowsHook.

How to prevent Thinstall from loading your DLL:

Ensure the virtual path of the DLL is in the system search path
The Virtual Path for your DLL should be %InstallPath% \mydll.dll

By placing the DLL at the Virtual Path of %InstallPath%, you tell Thinstall to extract it to the path where the system can find when you application tries to load the DLL.

Extract your DLL to the hard drive on startup or install
From the DLL file Right-click menu select:
Extraction / Caching -> Extract on start
You must ensure your DLL is actually on the hard drive before it can be loaded by Windows, otherwise Thinstall will load it for you.

Tell Thinstall to let Windows try to load the DLL first
From the DLL file Right-click menu select:
Module Search Path -> Load only if system search fails


How to prevent Thinstall from modifying your DLL
Even when Windows loads your DLL instead of Thinstall, Thinstall will still modify it in memory to allow it to access the virtual operating system. This modification will cause other processes to crash if they are forced share the DLL. To tell Thinstall not to modify the DLL, use the following option:

Menu -> Link -> Program Security -> External DLL Loading

Add the name of your DLL to the second list:
"Thinstall never loads DLLs matching this pattern"

for example, add the text mydll.dll