Window goes invisible when i activate my Hook

Posted on 2009-04-22
Last Modified: 2013-11-20
I have created a global hook which calls another dll to perform certain actions. The different kind of hooks i am using are  WH_CALLWNDPROC, WH_CBT,                   WH_GETMESSAGE,  WH_KEYBOARD, WH_MOUSE,  WH_MSGFILTER,               WH_SYSMSGFILTER, WH_DEBUG.

On calling a hook procedure through setwindowhookex a function (FARPROC) CallWndProcFunc() is invoked..
LRESULT CALLBACK CallWndProcFunc (int nCode, WPARAM wParam, LPARAM lParam )
   HDC               hDC;
   PCWPSTRUCT  pParamStruct;

   return CallNextHookEx(hhookHooks[CALLWNDPROCINDEX], nCode, wParam, lParam);

The issue i face is that the calling of this function turns all menu bars invisible. It is like a ghost image and clicking on it still takes me to the actual form. This is also experienced in all menu options within start -> program for windows.

What could be restricting display of these menu's in my program as it is just a skeleton function.

Any help will be greatly appreciated.
Question by:rupvis
    LVL 86

    Expert Comment

    Any chance that something gets messed up in

       return CallNextHookEx(hhookHooks[CALLWNDPROCINDEX], nCode, wParam, lParam);

    , i.e. the indices were assigned incorrectly?
    LVL 2

    Author Comment

    (hhookHooks[CALLWNDPROCINDEX] is setup from the return type of setwindowhookex.
    Even if i plainly enter values without having an array used i still see window going transparent. Has anyone used a standard WH_CALLWNDPROC hook. If yes i would like to know the calling procedure.
    LVL 49

    Expert Comment

    There is a very complete example here:
        Using Hooks
    But I have to say that it appears to be functionally equivallent to your stub... So I don't have a solution for you.  Just a couple of thoughts:
    Perhaps some other hook proc is misbehaving (but only when your hook is installed).  I know of no way to detect active hooks, but if you could turn off the other hooks, you might learn something.  For instance, what if you don't call the hook chain (for testing purpose)?
    Diagnotic aid:  Log the call info to a text file, show the data going into your proc and after calling the hook chain.
    Question:  When does the oddness happen?  Is it immediately upon calling SetWindowsHookEx , or is it upon some action, such as a mouse move or a keystroke?
    Question (just to be sure):  Doe this haappen when the ONLY hook you install is for WH_CALLWNDPROC (it's apparent that you are installing multiple hooks, and I want to rule out the possibility that one of the your other hooks is having a strange interaction.)
    LVL 2

    Author Comment

    Thanks you danrollins. When debugging i have realised that i get the issue only when WH_CALLWNDPROC is called. I can be sure of this since i deactivate all other hooks and just run WH_CALLWNDPROC  to still get the problem. One thing i noticed is my virus scan i.e Mcafee to have a conflict. Mcafee task manager is a process named mctray.exe in the process list. If i kill mctray all runs fine again. So now i tried putting the hook dll name as well as the calling exe iinto the exclusion list for mcafee. Yet no luck.
    LVL 49

    Accepted Solution

    I doubt if McAffe's exclusion list logic is smart enough to identify window hooking modules (I think it's more about virus scanning rather than realtime checking).  
    But I think I have a glimmer of why this might be happeneing.  The "fade-in effect" might be one of those oddball messages that get handled without going through normal queuing logic.  There is a discussion here:
    It is possble that McAfee is trying to monitor those messages and in so-doing, corrupts the window-hooking chain -- or something like that.  
    As a possible way to verify this theory:  Go to the Display Control Panel, Appearance tab, click [Effects] and uncheck the "Use the following effects for menus and tooltips..." option.  And then test your app while McAfee is running.
    LVL 2

    Author Comment

    This is brilliant.. will test and let you know..

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    Join & Write a Comment

    If your system is showing symptoms of browser hijacks or 'google search redirects' check out my other article ( first and run the tool TDSSKiller ( to get rid of the infection. Once done, and if the …
    Sometimes people don't understand why download speed shows differently for Windows than Linux.Specially, this article covers and shows the solution for throughput difference for Windows than a Linux machine. For this, I arranged a test scenario.I…
    This video will show you how to get GIT to work in Eclipse.   It will walk you through how to install the EGit plugin in eclipse and how to checkout an existing repository.
    In this sixth video of the Xpdf series, we discuss and demonstrate the PDFtoPNG utility, which converts a multi-page PDF file to separate color, grayscale, or monochrome PNG files, creating one PNG file for each page in the PDF. It does this via a c…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now