Local WH_CBT hook causes GPF - but only on the first window..?

I have written a local WH_CBT hook and am using it to track window creation. It decodes the CBT_CREATEWND structure and raises an event. The sink for this event can then decide whether or not to allow the window creation to continue. However this will cause a GPF if I start the hook before any VB window is created...but not if I start it after the first form is shown. Any ideas?

The code I have is:

VB Code:

Private Type CREATESTRUCT
    lpCreateParams As Long
    hInstance As Long
    hMenu As Long
    hWndParent As Long
    Height As Integer
    Width As Integer
    Left As Integer
    Top As Integer
    Style As Long
    lpszName As Long
    lpszClass As Long
    ExStyle As Long
End Type
 
Private Declare Sub CopyMemoryCreateStruct Lib "kernel32" Alias "RtlMoveMemory" (Destination As CREATESTRUCT, ByVal Source As Long, ByVal Length As Long)
Private Declare Sub CopyMemoryFromCREATESTRUCT Lib "kernel32" Alias "RtlMoveMemory" (ByVal Destination As Long, Source As CREATESTRUCT, ByVal Length As Long)
 
Private Type CBT_CREATEWND
    csThis As Long '\\ Pointer to CREATESTRUCT
    hWndInsertAfter As Long
End Type
 
Private Declare Sub CopyMemoryCBT_CreateWnd Lib "kernel32" Alias "RtlMoveMemory" (Destination As CBT_CREATEWND, ByVal Source As Long, ByVal Length As Long)
 
Private Declare Sub CopyMemoryFromCBT_CreateWnd Lib "kernel32" Alias "RtlMoveMemory" (ByVal Destination As Long, Source As CBT_CREATEWND, ByVal Length As Long)
 
'....snippet from use....
Case HOOKPROC_CBT
    Code = Arguments(1)
    wParam = Arguments(2)
    lParam = Arguments(3)
    lResult = Arguments(4)
    '\\ Create a new window for these to use...
    Set wndThis = New ApiWindow
 
    '\\ Different events raised according to which message this is...
    Select Case True
 
    Case Code = HCBT_CREATEWND
        Dim CreateWndStruct As CBT_CREATEWND
        Dim csThis As CREATESTRUCT
        Dim sClassName As String, sName As String
        Call CopyMemoryCBT_CreateWnd(CreateWndStruct, lParam, Len(CreateWndStruct))
        If Err.LastDllError Then
            ReportError Err.LastDllError, CLSNAME & ":HCBT_CREATEWND", GetLastSystemError
        Else
            Call CopyMemoryCreateStruct(csThis, CreateWndStruct.csThis, Len(csThis))
            With csThis
                sClassName = StringFromPointer(.lpszClass, 32)
                sName = StringFromPointer(.lpszName, 32)
                RaiseEvent BeforeWindowCreate(sName, sClassName, .Height, .Width, .Left, .Top, .Style, .ExStyle, Cancel)
            End With
            If Not Cancel Then
                Call CopyMemoryFromCREATESTRUCT(CreateWndStruct.csThis, csThis, Len(csThis))
            Else
                Arguments(4) = 1 '\\ This value is the hookproc return
            End If
        End If

Thanks in advance,
Duncan

Extraordinary - it seems that a system/hidden window is created to handle events when the first RaiseEvent occurs and that this falls over if you have a CBT hook on it...I have coded around that so I think that's the last of the EventVB release H issues - I think I'll get a full release out this week...

Are you able to post the final working code. I am still new to CBTs and I would like to view your workig code to get a better understanding at what exactly works.

I have been experimenting with them, but I keep getting many GPFs = not good hah

If you can that would be great.
Thanks.

The source code is in EventVB.dll release I....