Welcome Guest Search | Active Topics | Sign In | Register

eowp.exe calls SetWinEventHook event Options
bnymellon
Posted: Wednesday, March 2, 2022 9:57:36 AM
Rank: Advanced Member
Groups: Member

Joined: 3/10/2020
Posts: 59
We are using EO webbrowser in a WPF based desktop application.
We are experiencing slowness issue within our application for a short span of time and we are working with Microsoft to troubleshoot the same. On analyzing we found the slowness is with UIA/Accessibility COM objects getting created (on receiving WM_GETOBJECTS message) and perform eager cleanup intermitently. Every time CLR performs eager cleanup of UIA/Accessibility COM objects, it slows down the application.

We continued our analysis to detect the souce application which posts WM_GETOBJECTS message.
On looking at the kernel dump we found eowp.exe calls SetWinEventHook (callstack below) which (as per Microsoft) tells Windows OS that eowp.exe is looking for the range of "events" so that it can do something with them. We are checking if these "events" would be the ones which WPF application would see as UIA/Accessibility which would spin up AutomationPeers (UIA/Accessibility COM objects).

To confirm the same, can you please provide us more insight on how eowp calls "SetWinEventHook" and the purpose of having such hooks.


1: kd> x win32kbase!gpWinEventHooks
fffff3ab`21373e18 win32kbase!gpWinEventHooks = 0xfffff3d0`429f4bc0

1: kd> dx -r1 ((win32kbase!tagEVENTHOOK *)0xfffff3d0429f4bc0)
((win32kbase!tagEVENTHOOK *)0xfffff3d0429f4bc0) : 0xfffff3d0429f4bc0 [Type: tagEVENTHOOK *]
[+0x000] head [Type: _THROBJHEAD]
[+0x018] pehNext : 0xfffff3d0429f4920 [Type: tagEVENTHOOK *]
[+0x020] eventMin : 0x80000004 [Type: unsigned int]
[+0x024] eventMax : 0x80000005 [Type: unsigned int]
[+0x028 ( 0: 0)] fDestroyed : 0x0 [Type: unsigned int]
[+0x028 ( 1: 1)] fIgnoreOwnThread : 0x0 [Type: unsigned int]
[+0x028 ( 2: 2)] fIgnoreOwnProcess : 0x0 [Type: unsigned int]
[+0x028 ( 3: 3)] fSync : 0x1 [Type: unsigned int]
[+0x028 ( 4: 4)] fSkipWowCrossContext : 0x0 [Type: unsigned int]
[+0x030] hEventProcess : 0x2484 [Type: void *]
[+0x038] idEventThread : 0xbcc [Type: unsigned long]
[+0x040] offPfn : 0x2c760 [Type: unsigned __int64]
[+0x048] ihmod : 2 [Type: int]
[+0x050] pwszModulePath : 0x0 [Type: wchar_t *]
[+0x058] dpiContext : 0x6010 [Type: unsigned long]
eo_support
Posted: Wednesday, March 2, 2022 4:45:20 PM
Rank: Administration
Groups: Administration

Joined: 5/27/2007
Posts: 24,217
Hi,

eowp.exe is used to run the Chromium browser engine. We looked into Chromium browser engine's source code and see that it does call SetWinEventHook at various location, and this one does seem to be related to accessiblity:

https://source.chromium.org/chromium/chromium/src/+/main:ui/accessibility/platform/inspect/ax_event_recorder_win.cc?q=SetWinEventHook&ss=chromium

We were not able to construct a scenario where it would be called in order to verify it. Do you know when SetWinEventHook is called?

Thanks!
bnymellon
Posted: Friday, March 4, 2022 2:45:40 PM
Rank: Advanced Member
Groups: Member

Joined: 3/10/2020
Posts: 59
We are hoping that you would let know a scenario in which the API is invoked from eowp.exe.
Our understanding is that this is invoked for the first time we create EO Webbrowser instance.
Can you please provide us a way (property or something) that would stop eowp.exe from calling "SetWinEventHook" as this has adverse effect on wpf applications.
eo_support
Posted: Friday, March 4, 2022 2:54:54 PM
Rank: Administration
Groups: Administration

Joined: 5/27/2007
Posts: 24,217
We did not find any instance where SetWinEventHook is called at all in our test einvironment. :( We only see it in the source code.


You cannot post new topics in this forum.
You cannot reply to topics in this forum.
You cannot delete your posts in this forum.
You cannot edit your posts in this forum.
You cannot create polls in this forum.
You cannot vote in polls in this forum.