A clipboard viewer (evil usermode code 
gets notified when another
clipboard viewer leaves the chain and it even knows wether it’s on the top. It
relies on rules which all clipboard viewers have to follow nonetheless.
A window hook (also evil usermode code) registers and unregisters its hook
with the system. Nevertheless a keyboard hook can suppress certain key
presses. The system relies on some co-operative model.
A driver can (in principle) hook whatever and whereever it wants. That’s so
in any OS, since drivers belong to what MS calls the TCB (Trusted Computing
Base). Anyway, since it does not need notify “the system” of its changes and
since it (read: all drivers except a leaving one) gets not notified about a
leaving driver, all are working independently. A co-operative model as
described above must fail!
But what do you think. MS did not document many of the APIs we are hooking.
So why should they care or even create a facility to get a co-operative model
working?! They will not … it’s a restricted area:
- touch it - WITH ALL CONSEQUENCES … the dark side if you want
- or leave it and forget about the solution you just had in mind.
Oliver