Low level keyboard hooks are not injected into all processes. The keyboard hook is executed in the context of the thread and process that installed it.
Check out the Remarks section of the LowLevelKeyboardProc documentation.
Question
I'm implementing a .NET
application.
It sets a global hook WH_KEYBOARD_LL
with P/Invoke
to SetWindowsHookEx
.
The hook callback procedure resides in an isolated dll hook.dll
.
When I start another .NET
appliction Victim.exe
, the key strike is successfully hooked.
As I know, this hook.dll
should invade into other process space with any key strike.
But I did NOT find it in Victim.exe
processes' loaded modules or current app domain referenced assemblies.
Is there any way to indicate if the hook.dll
is injected? Or is it completely wrong?
Solution
Low level keyboard hooks are not injected into all processes. The keyboard hook is executed in the context of the thread and process that installed it.
Check out the Remarks section of the LowLevelKeyboardProc documentation.