Why doesn't my system wide hook capture all processes ?

The usual reason for system-wide hooks not operating systemically is that an essential piece of data (usually, but not always restricted to, the HHOOK) is not stored in a shared section, so each loaded instance of the DLL has a different value for the variable, and only one (in the address space of the initial loader app) has the right value and behaves as expected. So, to create a shared section:

1. Use a pragma in your DLL code to specify the shared variables :

#pragma data_seg(".SHRDATA")
HWND hWndMain = 0;
HHOOK hKeybdHook = NULL ;
BOOL bSomeFlagOrOther = FALSE;
#pragma data_seg()

Note that shared variables must be initialised, otherwise sharing won't work.

2. Create a DEF file with the following in it :


Where the section name matches that in your pragma above. If having a DEF file offends you, you can specify the section in a linker command parameter (see the docs for the linker).