1

I am attempting to install a WH_JOURNALRECORD with SetWindowsHookEx:

#include <iostream>
#include <Windows.h>

LRESULT CALLBACK WndProc(int nCode, WPARAM wParam, LPARAM lParam)
{
   std::cout << "Hook called" << std::endl;
   return CallNextHookEx(NULL, nCode, wParam, lParam);
}

int main()
{
   HHOOK hook = SetWindowsHookEx(WH_JOURNALRECORD, WndProc, 0, 0);
   if (hook != NULL)
   {
     std::cout << "Hooked WH_JOURNALRECORD" << std::endl;
   }
   else
   {
     DWORD dw = GetLastError();
     std::cout << "Failed to install hook:" << "(Error: " << dw << ")" << std::endl;
   }

   MSG msg;
   while (GetMessage(&msg, NULL, 0, 0) > 0)
   {
     TranslateMessage(&msg);
     DispatchMessage(&msg);
   }
}

My application is signed with a certificate and ran under C:\Program Files as Administrator, as is required for JournalRecord hooks (/uiAccess=true). The application launches and the hook is installed successfully, however I never receive any output from my WndProc function. I can move my cursor, however I cannot click or type anything until I press ctrl+alt+del or another key combo that forces Windows to uninstall the JournalRecord hook.

According to the documentation, this type of hook is a global hook and can run within the same application context (ie, no DLL is required as is the case for other types of hooks). Despite being a console application, I have added a message loop so I don't believe that is the issue.

If anyone knows what I am doing wrong, or how I can solve this issue, any help is appreciated.

user2692560
  • 71
  • 2
  • 9
  • 1
    A DLL is required for this hook. Mysterious that it did not fail. – Hans Passant Nov 18 '20 at 23:00
  • I recall trying it with a DLL as well with the same results. I will try it again with a DLL and post my code here if I run into issue. However the MSDN docs state: "A JournalRecordProc hook procedure does not need to live in a dynamic-link library. A JournalRecordProc hook procedure can live in the application itself." https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/ms644983(v=vs.85) – user2692560 Nov 18 '20 at 23:04
  • Related, possible dup: [Hook procedure for Journal Record Hook never being called](https://stackoverflow.com/questions/58034786/) – Remy Lebeau Nov 18 '20 at 23:37
  • Hi, most of the time the code works fine for me, but occasionally I can reproduce this issue. And I will confirm it with Internal engineer, and response here if there is any update.Thanks for your understanding. – Zeus Nov 19 '20 at 03:27
  • @ZhuSong-MSFT I have also posted the issue on MSDN Q&A forums. Another engineer has been looking at the issue as well. Some progress has been made but there are still issues: https://learn.microsoft.com/en-us/answers/questions/167703/wh-journalrecord-hook-blocks-mouse-clicks-keystrok.html. The hook will work upon system restart, however once I begin launching applications the input locks up again. Even killing the applications doesnt help, until I restart again. – user2692560 Nov 19 '20 at 20:25
  • Yes, the hooking system will work after I restart the computer. But once I lock it in some way, it can only be restored by restarting it again. At present, I am not sure of the cause of this situation, and I will confirm with the internal engineer. – Zeus Nov 20 '20 at 02:58

1 Answers1

1

After many hours of troubleshooting, I noticed that the hook installs and runs as expected if I create a new user account on Windows and run it from there.

I dumped all running processes and services on my new test account, as well as on my main account, and examined those that were only present on my main account.

I located a service (Alienware Command Center) that runs as part of software that allows me to customize my mouse and keyboard. When the service and corresponding processes(s) are killed, Journal hooks work as expected.

Something inside of that service is for whatever reason interfering with the hook.

user2692560
  • 71
  • 2
  • 9