How to find the injected hook dll?

Question

I'm implementing a .NET application.

It sets a global hook WH_KEYBOARD_LL with P/Invoke to SetWindowsHookEx.

The hook callback procedure resides in an isolated dll hook.dll.

When I start another .NET appliction Victim.exe, the key strike is successfully hooked.

As I know, this hook.dll should invade into other process space with any key strike.

But I did NOT find it in Victim.exe processes' loaded modules or current app domain referenced assemblies.

Is there any way to indicate if the hook.dll is injected? Or is it completely wrong?

Answer 1

Low level keyboard hooks are not injected into all processes. The keyboard hook is executed in the context of the thread and process that installed it.

Check out the Remarks section of the LowLevelKeyboardProc documentation.