Contains functions hook DLL is through the SetWindowsHookEx function of loading:

 
G_hHookLlKbd=SetWindowsHookEx (WH_KEYBOARD_LL DssLlKbdProc, g_hModule, 0). 
G_hHookCassWnd=SetWindowsHookEx (WH_CBT DssCBTProc, g_hModule, 0). 
G_MouseHook=SetWindowsHookEx (WH_MOUSE MouseProc, g_hModule, 0). 

In the DLL's dllmain function of the system function hook:

 
LhInstallHook (CreateFileMappingA MyCreateFileMappingA, NULL, & amp; G_HookHandle [i++]); 
LhInstallHook (CreateFileMappingW MyCreateFileMappingW, NULL, & amp; G_HookHandle [i++]); 

MyCreateFileMappingW function implementation:

 
HANDLE WINAPI MyCreateFileMappingW (
__in HANDLE hFile, 
__in_opt LPSECURITY_ATTRIBUTES lpAttributes, 
__in DWORD flProtect, 
__in DWORD dwMaximumSizeHigh, 
__in DWORD dwMaximumSizeLow, 
__in_opt LPCWSTR lpName 
) 
{
If (NULL==g_pfnCreateFileMappingW) return FALSE. 

MyOutputDebugMsgW (" % s, % d, L lpName=% s ", __WFILE__ and __LINE__, lpName); 

HANDLE HANDLE=NULL; 
If (StrStrIW (lpName, L "shared_memory_content_wps_starup_object")) 
{
Wstring STR=L "wps_starup_object_"; 
STR +=DssCreateGuidw (); 
MyOutputDebugMsgW (L % s, % d, STR="% s", __WFILE__ and __LINE__, STR); 

Handle=g_pfnCreateFileMappingW (hFile, lpAttributes flProtect, dwMaximumSizeHigh, dwMaximumSizeLow, STR., c_str ()); 
} 
The else 
{
Handle=g_pfnCreateFileMappingW (hFile, lpAttributes flProtect, dwMaximumSizeHigh, dwMaximumSizeLow, lpName); 
} 

Return the handle. 
} 

The goal is to make the WPS process creation, don't build "\ Sessions 2 \ BaseNamedObjects \ \ shared_memory_content_wps_starup_object_ {DEB796DA - F98E - 48 a4 - AE1E - 71411184820 e}" the memory mapping file, but have not found in MyCreateFileMappingW function to create the object, the following figure,


So, how this object is created, Process Explorer the section is not inside the mapping file mean?