Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

LowLevelHooksTimeout?

2,192 views
Skip to first unread message

Vincent Fatica

unread,
Mar 24, 2006, 10:02:22 PM3/24/06
to
... supposedly found in HKEY_CURRENT_USER\Control Panel\Desktop.

I have never seen it set on an XP system. What is it's default value? What
is the registry type of its value? Is it dynamic (as opposed to requiring a
logoff/logon after a change)? Is it documented anywhere (other than cursory
mention in the help for LL mouse and keyboard procs)? Thanks.

--
- Vince

Arkady Frenkel

unread,
Mar 26, 2006, 5:07:38 AM3/26/06
to
Jeffrey Richter wrote about it in
http://msdn.microsoft.com/msdnmag/issues/0700/Win32/
Arkady

"Vincent Fatica" <ab...@localhost.com> wrote in message
news:4424b2be$1...@news.vefatica.net...

Eman

unread,
Mar 26, 2006, 8:28:13 AM3/26/06
to
The second QA in that article let me to some question.

There are different implementations of

LONG InterlockedExchange( LONG volatile * Target, LONG Value );

in windows 98

mov ecx,[esp][04] ;ECX = pointer to Target
mov eax,[esp][08] ;EAX = Value
xchg eax,[ecx]
retn 8

and in windows xp

mov ecx,[esp][04] ;ECX = pointer to Target
mov edx,[esp][08] ;EDX = Value
mov eax,[ecx] ;EAX = Target
@1: lock
cmpxchg [ecx],edx
jne @1
retn 8

As far as XCHG reg,[mem] instruction has implicit LOCK prefix
this two pieces of code are fully functionally equivalent.
But why the second uses its nice loop instead of simple XCHG?
The only reason i can imagine is that XCHG reg,[mem]
not always has implicit LOCK (but i thought it's IA32 standard
requirement). Can someone clarify that?

Thanks in advance for any comment.

--

"Arkady Frenkel" <ark...@hotmailxdotx.com> wrote in message
news:OrEWc0LU...@TK2MSFTNGP11.phx.gbl...

Skywing

unread,
Mar 26, 2006, 9:07:51 AM3/26/06
to
Because Windows 98 only supports single processor systems.

"Eman" <e!m!a!n...@hotmail.com> wrote in message
news:Ox3lRmN...@TK2MSFTNGP10.phx.gbl...

Eman

unread,
Mar 26, 2006, 10:18:34 AM3/26/06
to
I know that..

Can i undestand your reply so that
XCHG reg,[mem] not always has implicit LOCK?

--

"Skywing" <skywing_...@valhallalegends.com> wrote in message
news:et54s6NU...@TK2MSFTNGP09.phx.gbl...

Don Burn

unread,
Mar 26, 2006, 10:25:45 AM3/26/06
to
No it does not have an inplicit lock, but in Windows 98 there is only one
processor, and what is being protected against is action by another
processor. Now, this does have the potential downside if you have a really
smart device that can look at memory, since the call will not work in this
case, but they are rare and there are ways such as ASM to get around this.


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

"Eman" <e!m!a!n...@hotmail.com> wrote in message

news:%23ZBtWiO...@TK2MSFTNGP09.phx.gbl...

Eman

unread,
Mar 26, 2006, 10:41:53 AM3/26/06
to
Thank you! That's what i wanted to make clear to myself.

--

"Don Burn" <bu...@stopspam.acm.org> wrote in message
news:eHlhgmOU...@TK2MSFTNGP14.phx.gbl...

Vincent Fatica

unread,
Mar 26, 2006, 2:44:33 PM3/26/06
to
I saw that. He says no more than is said in the keyboard and mouse
low-level hook_proc docs. His article answered none of my questions.

--
- Vince

Arkady Frenkel

unread,
Mar 27, 2006, 1:55:17 AM3/27/06
to
That pretty descriptive IMHO, if no registry value set , no Timeout and you
can sit in your the hook as long as you want or not want :).
When you start to debug your hook app you'll see what that mean , you will
hung inside and all chain will be blocked.
BTW Jeffrey wrote about that , find in the text sentence started from
"But this hook has a serious drawback:"...
So to overcome the problem you can set TO so OS can treat the chain
respectively
Arkady

"Vincent Fatica" <ab...@localhost.com> wrote in message

news:4426ef21$1...@news.vefatica.net...

Arkady Frenkel

unread,
Mar 27, 2006, 2:03:09 AM3/27/06
to
To summarize : default ( no key ) TO is INFINITIVE ( as Win32 define that )
and TO can change it to some less infinitive value :)
Arkady

"Arkady Frenkel" <ark...@hotmailxdotx.com> wrote in message

news:%23i5dvtW...@TK2MSFTNGP11.phx.gbl...

Vincent Fatica

unread,
Mar 27, 2006, 2:41:55 AM3/27/06
to
On Mon, 27 Mar 2006 09:03:09 +0200, "Arkady Frenkel"
<ark...@hotmailxdotx.com> wrote:

>To summarize : default ( no key ) TO is INFINITIVE ( as Win32 define that )
>and TO can change it to some less infinitive value :)
>Arkady

That is not in keeping with my experience. With a non-existent registry TO
value and an unqualified Sleep(10000) (10 seconds) in the low level keyboard
hook callback process, keystrokes seem to get through to apps in
considerably less than 1 second.
--
- Vince

Arkady Frenkel

unread,
Mar 27, 2006, 3:03:54 AM3/27/06
to
With Sleep you return control to the system , just set while loop and check
that
Arkady

"Vincent Fatica" <ab...@localhost.com> wrote in message

news:44279743$1...@news.vefatica.net...

Vincent Fatica

unread,
Mar 27, 2006, 10:38:27 AM3/27/06
to
On Mon, 27 Mar 2006 10:03:54 +0200, "Arkady Frenkel"
<ark...@hotmailxdotx.com> wrote:

>With Sleep you return control to the system , just set while loop and check
>that

OK, with no registry value, and with this hook:

HHOOK hKbHook = NULL;
LRESULT CALLBACK KbProc(int nCode, WPARAM wParam, LPARAM lParam ) {
for ( LONGLONG i=0; i<5000000000; i++ );
return CallNextHookEx(hKbHook, nCode, wParam, lParam);
}

set this way:

hKbHook = SetWindowsHookEx(WH_KEYBOARD_LL, KbProc, hThisDll, 0);

in and by a DLL manually loaded by a console application, the host app shows
keystrokes in about 6 seconds (that's how long the loop takes) but all other
apps, both GUI and CUI show keystrokes in (apparently) about 1/2 second
(obviously slowly, but much quicker than the time to do the loop).

So there appears to me to be some default timeout enforced for (at least)
all processes but the host one ... and possibly for the host process too
(which might be too busy looping to show the keystroke).

I am back to square one ... what's the default value of
LowLevelHooksTimeout; what's its registry type; is logoff/logon required for
changes to it to be effective?
--
- Vince

Arkady Frenkel

unread,
Mar 27, 2006, 11:00:47 AM3/27/06
to
No default value otherwise you'll be outof the loop before , set instead
your loop just while(true) ; and you'll be there forever.
As for key itself that defined as TO value in miliseconds , so set it as
DWORD and value of 5000 with stand for 5 sec e.g.
Arkady

"Vincent Fatica" <ab...@localhost.com> wrote in message

news:442806f3$1...@news.vefatica.net...

Vincent Fatica

unread,
Mar 27, 2006, 11:34:46 AM3/27/06
to
On Mon, 27 Mar 2006 18:00:47 +0200, "Arkady Frenkel"
<ark...@hotmailxdotx.com> wrote:

>No default value otherwise you'll be outof the loop before , set instead
>your loop just while(true) ; and you'll be there forever.
>As for key itself that defined as TO value in miliseconds , so set it as
>DWORD and value of 5000 with stand for 5 sec e.g.

Similar observation as before ... no registry value ... using

HHOOK hKbHook;


LRESULT CALLBACK KbProc(int nCode, WPARAM wParam, LPARAM lParam ) {

while (TRUE);


return CallNextHookEx(hKbHook, nCode, wParam, lParam);
}

hKbHook = SetWindowsHookEx(WH_KEYBOARD_LL, KbProc, hThisDll, 0);

Host app never shows keystrokes, other apps show keystrokes after about 1/2
second.
--
- Vince

Arkady Frenkel

unread,
Mar 28, 2006, 2:13:33 AM3/28/06
to
So set registry key to 5 sec and check if you'll be back in 5s
Arkady

"Vincent Fatica" <ab...@localhost.com> wrote in message

news:44281426$1...@news.vefatica.net...

Vincent Fatica

unread,
Mar 28, 2006, 10:21:24 AM3/28/06
to
On Tue, 28 Mar 2006 09:13:33 +0200, "Arkady Frenkel"
<ark...@hotmailxdotx.com> wrote:

>So set registry key to 5 sec and check if you'll be back in 5s
>Arkady

I adjusted the hookproc to handle only keydown:

LRESULT CALLBACK KbProc(int nCode, WPARAM wParam, LPARAM lParam ) {

if ( wParam == WM_KEYDOWN ) while (TRUE);


return CallNextHookEx(hKbHook, nCode, wParam, lParam);
}

The results were similar using REG_DWORD or REG_SZ (logoff/logon required).
I used 2000 and 4000 (decimal). In both cases, the app hosting the hook (a
CUI app) never got keystrokes (or was too busy to show them). Other apps
showed them in about **twice** the time I specified ... for a while that is
(a few minutes) ... then they reverted to showing keystrokes
instantaneously, as if Windows decided the hook was hung and bypassed it
completely; even then, the host app remained useless.

I'm tired of trying to figure this out by experimentation. All aspects of
LowLevelHooksTimeout should be documented.
--
- Vince

Arkady Frenkel

unread,
Mar 29, 2006, 1:11:45 AM3/29/06
to
Hi, Vincent!
Agree that all info have to be documented with more detail and you can
submit bug about it through sdk...@microsoft.com , but in general TO work
due to your description. BTW I didn't mention that debugging hooks you can
either through logs or I used direct output on the screen, like to show
string "text" in left/top corner of dispay :
HDC hdc = CreateDC( "DISPLAY" , NULL , NULL , NULL ) ;
TextOut( hdc , 0, 0 , "text" , 4 ) ;
DeleteDC( hdc ) ;
Arkady

"Vincent Fatica" <ab...@localhost.com> wrote in message

news:44295474$1...@news.vefatica.net...

0 new messages