Fooling Around

Today’s update for DirectShow Filter Graph Spy introduces 64-bit version (mind the beta state) and a mini-API for an external module to be involved into graph building process.

Filter Graph Spy is offering three new interfaces that provide extensibility of the spy:

• IFilterGraphAddRemoveHook
• IFilterGraphConnectHook
• IFilterGraphStateControlHook

The interfaces are contained in the type library and can be imported using #import directive. An implementation of one or more of these interfaces will receive hook style calls corresponding to respective Filter Graph Manager calls, system wide including in context of other applications.

A COM object may be registered as a hook object with Spy and NoThreadSpy COM classes under predefined registry keys:

Spy will instantiate the registered hook objects and forward them the calls it receive, before passing them to system Filter Graph Manager object. A hook object has an option to override default processing, including, for example, inserting its own filter in between. For example, IFilterGraph::Reconnect call is implemented the following way:

STDMETHOD(Reconnect)(IPin* pPin) throw()
{
    _Z4(atlTraceCOM, 4, _T("...\n"));
    HOOK_PROLOG(CFilterGraphConnectHookHost)
        OnReconnect(pT, pPin, &bDefault);
    HOOK_EPILOG()
    return m_pInnerFilterGraph2->Reconnect(pPin);
}

Before passing the call to original Reconnect method, spy is iterating through associated hooks, passing them IFilterGraphConnectHook::OnReconnect call. Setting bDefault parameter to FALSE will prevent spy from passing the call to original method.

Included BdaHooks project shows a sample implementation of the hooking COM classes (note .rgs registration).

Filter Graph Spy is compatible with all current Windows operating systems, 32-bit and 64-bit (x64), in particular including:

• Windows 7
• Windows Server 2008
• Windows Vista
• Windows Server 2003
• Windows XP
• Windows 2000

NOTE: DirectShow Filter Graph Spy is NOT suitable for production environment, it is NOT licensed to be redistributed to be a part of production state software item.

Partial Visual C++ .NET 2008 source code is available from SVN, release binary included (Win32, x64); installation instructions are in another post.

Regsvr32 tool is the one to register DLL hosted COM servers with the system, this is what many have learned without even knowing anything about COM.

On 64-bit operating systems DLLs are 32-bit and 64-bit images, and an important thing about them is that there is no way to mix them in a single process. That is, 32-bit DLLs are for 32-bit processes, running inside WOW64 subsystem, 64-bit DLLs are for native processes.

So how comes that running regsvr32 from command line we can register both 32-bit and 64-bit DLLs. Does the system automatically identify image type of the DLL? Yes, the screenshot below illustrates registration of 64-bit DLL from command line “regsvr32 FilterGraphSpy.dll“.

Command line interpreter starts a 32-bit version of regsvr32 tool, which is located in SysWOW64 directory. It detects that provided image is 64-bit and spawns a 64-bit twin from system32 directory, forwarding the registration task to it. The latter loads 64-bit DLL, being native 64-bit process itself, and does the thing.

As simple as that.