Begin_PM_App hook

i have used the code from generic.vxd (ddk) for
hooking Begin_PM_App. it never seems to hit the “int
3” in OnPMAppStart. what am i missing.
thanks
kudrt

ps : i want to get notified whenever a new application
is started.
////////////////////////////////////////////////
VxD_LOCKED_CODE_SEG

Begin_control_dispatch FLTDRV
Control_Dispatch Begin_PM_App, OnPMAppStart
End_control_dispatch FLTDRV

VxD_LOCKED_CODE_ENDS

VxD_PAGEABLE_CODE_SEG

BeginProc OnPMAppStart
int 3
ret
EndProc OnPMAppStart

VxD_PAGEABLE_CODE_ENDS
////////////////////////////////////////////////


Do You Yahoo!?
Make a great connection at Yahoo! Personals.
http://personals.yahoo.com


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

I’m unable to hook the Begin_PM_App which will notify
me as and when a protedted mode app starts, able to
get others like Create_VM and Thread_Init, the code is
given below. Hope someone can throw some light.
Thanks
kudrt

;======================================================================
;======================================================================

PAGE 58,132

TITLE GENERIC - Generic VxD

.386p

.XLIST
INCLUDE VMM.Inc
INCLUDE Debug.Inc
.LIST

Declare_Virtual_Device VXD, 1, 0, VXD_Control,
Undefined_Device_ID ,

VxD_IDATA_SEG
; Initialization data here - discarded after
Init_Complete
VxD_IDATA_ENDS

VxD_DATA_SEG
; Normal Data here
VxD_DATA_ENDS

VxD_LOCKED_DATA_SEG
; Pagelocked data here - try to keep this to a
minimum.
VxD_LOCKED_DATA_ENDS

;/////////////////////////////////////

VxD_ICODE_SEG

BeginProc VXD_Device_Init
int 3
clc ;no error -
load VxD
ret
EndProc VXD_Device_Init

VxD_ICODE_ENDS

;/////////////////////////////////////
VxD_CODE_SEG

BeginProc VXD_Create_VM
int 3
clc ;no error -
continue
ret
EndProc VXD_Create_VM

BeginProc VXD_Begin_PM_App
int 3
clc ;no error -
continue
ret
EndProc VXD_Begin_PM_App

BeginProc VXD_End_PM_App
int 3
clc
ret
EndProc VXD_End_PM_App

BeginProc VXD_New_Thread
int 3
ret
EndProc VXD_New_Thread

VxD_CODE_ENDS

;/////////////////////////////////////

VxD_LOCKED_CODE_SEG

BeginProc VXD_Control

Control_Dispatch Device_Init, VXD_Device_Init
Control_Dispatch Create_VM, VXD_Create_VM
Control_Dispatch Thread_Init, VXD_New_Thread
Control_Dispatch Begin_PM_App,
VXD_Begin_PM_App
Control_Dispatch End_PM_App, VXD_End_PM_App
clc
ret

EndProc VXD_Control

VxD_LOCKED_CODE_ENDS

;/////////////////////////////////////
VxD_REAL_INIT_SEG

BeginProc VxD_Real_Init_Proc

test bx, Duplicate_Device_ID ; check for already
loaded
jnz short duplicate ; jump if so

xor bx, bx ; no exclusion
table
xor si, si ; no instance
data table
xor edx, edx ; no reference
data

mov ax, Device_Load_Ok
ret

duplicate:
mov ax, Abort_Device_Load +
No_Fail_Message
ret

EndProc VxD_Real_Init_Proc

VxD_REAL_INIT_ENDS

;///////////////////////////////////// END

;======================================================================
;======================================================================


Do You Yahoo!?
Make a great connection at Yahoo! Personals.
http://personals.yahoo.com


You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com