Why doesn't my system wide hook capture all processes ?

The usual reason for system-wide hooks not operating systemically is that an essential piece of data (usually, but not always retricted to, the HHOOK) is not stored in a shared section, so each loaded instance of the DLL has a different value for the variable, and only one (in the address space of the initial loader app) has the right value and behaves as expected.

So, to create a shared section :

1. Use a pragma in your DLL code to specify the shared variables :

#pragma data_seg(".SHRDATA")
HWND hWndMain = 0;
HHOOK hKeybdHook = NULL ;
BOOL bSomeFlagOrOther = FALSE;
#pragma data_seg()

Note that shared variables *MUST* be initialised.

2. Create a DEF file with the following in it :

SECTIONS
.SHRDATA READ WRITE SHARED

Where the section name matches that in your pragma above. If having a
DEF file offends you, you can specify the section in a linker command
parameter (see the docs for the linker).

Author : Bob Moore