McYoloSwagHam/win3wm

DLL injection to detect windows is unnecessary

anaisbetts opened this issue · 3 comments

anaisbetts commented

A better way to intercept when top-level windows get created or destroyed is via https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-registershellhookwindow and registering HSHELL_WINDOWCREATED and friends, this is way more efficient than Detours'ing every app.

McYoloSwagHam commented

Thanks for the advice, someone else recommened using SetWinEventHook. I'm torn between them, I'm not sure which one is better.
SetWinEventHook with EVENT_OBJECT_CREATE/EVENT_OBJECT_DESTROY
or RegisterShellHookWindow.
Any opinions?

anaisbetts commented

RegisterShellHookWindow probably does a whole bunch of things that are Very Relevant to your app so I'd try that first, then if you don't have the information you need go to SetWinEventHook