钩链机制不是防弹的，依赖于遵循规则的每个人。如果应用程序安装自己的每线程 WH_CBT 钩子，并且在其钩子过程中不调用 CallNextHookEx ，早期的钩子赢了不要叫请参阅MSDN文档以获取 CallNextHookEx 。

The main program calls the function SetHook in the wi.dll to install global WH_CBT hook.

bool WI_API SetHook()
{
    if (!g_hHook)
    {
        g_hHook = SetWindowsHookEx(WH_CBT, (HOOKPROC) CBTProc, g_hInstDll, 0);
    }

    return g_hHook != NULL;
}

I presume after installing global hook, wi.dll should be loaded into each process' address space. However wi.dll is loaded in to some processes only. For example, if I start Skype, MS Word I can see that wi.dll is loaded into these processes as well (using Process Explorer), however if I run Firefox, uTorrent, Adobe Reader then wi.dll is not loaded into these processes.

I'm using W7 64-bit, main program and wi.dll is 32-bit, all programs mentioned here is 32-bit programs as well.

Any ideas why that happens?

Thanks in advance.

The hook chain mechanism is not bulletproof and relies on everyone involved following the rules. If an application installs its own per-thread WH_CBT hook and does not call CallNextHookEx in its hook procedure, earlier hooks won't get called. See the MSDN docs for CallNextHookEx.