AppLog.docx

1、AppLogAppLog.c/*Module name: AppLog.cWritten by: Jonathan LockeNotices: Copyright (c) 1995 Jeffrey RichterPurpose: Shell hooks demonstration application*/#include Win95ADG.h /* See Appendix A for details */#include #include #pragma warning(disable: 4001) /* Single line comment */#include #include Sh

2、ellHk.h#include Resource.h/ Force a link with the import library for ShellHk.dll#pragma comment(lib, adgLIBBUILDTYPE adgLIBCPUTYPE ShellHk)/BOOL AppLog_OnInitDialog (HWND hwnd, HWND hwndFocus, LPARAM lParam) adgSETDLGICONS(hwnd, IDI_APPLOG, IDI_APPLOG); if (!ShellHook_Start(GetDlgItem(hwnd, IDC_APPL

3、OG) adgMB(_TEXT(Unable to start shell hook); EndDialog(hwnd, IDCANCEL); return(TRUE); / Accept default focus window. / void AppLog_OnSize (HWND hwnd, UINT state, int cx, int cy) / When the user resizes the main window, we must resize the listbox SetWindowPos(GetDlgItem(hwnd, IDC_APPLOG), NULL, 0, 0,

4、 cx, cy, SWP_NOZORDER); / void AppLog_OnCommand (HWND hwnd, int id, HWND hwndCtl, UINT codeNotify) switch (id) case IDCANCEL: / Allows dialog box to close / Unhook shell hook before exiting. if (!ShellHook_Stop() adgMB(_TEXT(Unable to stop shell hook); EndDialog(hwnd, id); break; / BOOL WINAPI AppLo

5、g_DlgProc (HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam) switch (uMsg) / Standard Windows messages adgHANDLE_DLGMSG(hwnd, WM_INITDIALOG, AppLog_OnInitDialog); adgHANDLE_DLGMSG(hwnd, WM_COMMAND, AppLog_OnCommand); adgHANDLE_DLGMSG(hwnd, WM_SIZE, AppLog_OnSize); return(FALSE); / We didnt process

6、 the message./int WINAPI WinMain (HINSTANCE hinstExe, HINSTANCE hinstPrev, LPSTR lpszCmdLine, int nCmdShow) adgWARNIFUNICODEUNDERWIN95(); adgVERIFY(-1 != DialogBox(hinstExe, MAKEINTRESOURCE(IDD_APPLOG), NULL, AppLog_DlgProc); return(0);ShellHk.c /*Module name: ShellHk.c Written by: Jonathan Locke No

7、tices: Copyright (c) 1995 Jeffrey Richter Purpose: Dll which sets a system shell hook. */ #include Win95ADG.h /* See Appendix A for details */ #include #include #pragma warning(disable: 4001) /* Single line comment */ #include #pragma warning(disable: 4001) /* Single line comment */ / We must define

8、 SHELLHKLIBAPI as dllexport before including ShellHk.h. / ShellHk.h will see that we have already defined SHELLHKLIBAPI and / will not (re)define it as dllimport. #define SHELLHKLIBAPI _declspec(dllexport) #include ShellHk.h / HINSTANCE g_hinstDll = NULL; / ShellHk.dlls instance handle / / Calling S

9、etWindowsHookEx with a thread id of zero will cause this DLL to be/ injected into other processes. Therefore, we must declare a shared data / section so that all mappings of our DLL (in all processes) share the same / set of global variables. /#pragma comment(lib, kernel32 ) #pragma data_seg(Shared)

10、 HHOOK g_hhook = NULL; / Hook handle for systemwide shell hook HWND g_hwndListBox = NULL; / Listbox in which to insert log strings #pragma data_seg() /#pragma comment(linker, -section:Shared,rws) / static LRESULT WINAPI ShellHook_HookProc (int nCode,WPARAM wParam, LPARAM lParam) TCHAR sz128, szPath1

11、28; DWORD dwProcessID; HWND hwnd = (HWND) wParam; DWORD dwThreadID = GetWindowThreadProcessId(hwnd, &dwProcessID); LRESULT lResult = CallNextHookEx(g_hhook, nCode, wParam, lParam); switch (nCode) case HSHELL_WINDOWCREATED: case HSHELL_WINDOWDESTROYED: / GetModuleFileName is being called in the conte

12、xt of the process in / which this Dll has been injected. if (!GetModuleFileName(NULL, szPath, adgARRAY_SIZE(szPath) _tcscpy(szPath, _TEXT(); wsprintf(sz, _TEXT(%c pid=0x%08x, tid=0x%08x, path=%s), (nCode = HSHELL_WINDOWCREATED ? _TEXT() : _TEXT(), dwProcessID, dwThreadID, szPath); ListBox_AddString(

13、g_hwndListBox, sz); break; return(lResult); / BOOL WINAPI ShellHook_Start (HWND hwndListBox) HHOOK hhook = NULL; / Return FALSE if hook has already been installed. if (g_hhook != NULL) return(FALSE); adgASSERT(IsWindow(hwndListBox); g_hwndListBox = hwndListBox; / Give up the remainder of our threads

14、 timeslice. / This gives us a better chance of getting all the way through the call / to SetWindowsHookEx and the variable assignment to g_hhook in one shot. / If we are preempted after the hook is set, but before the variable is / updated, it is possible for another thread to enter our hook filter

15、/ function before the hook handle is valid. Under Windows NT this is not / a problem. Under Windows 95, not having a valid hook handle will cause / CallNextHookEx to fail. If there is some reason that it is critical / that your application succeed in calling the next filter function in / the chain,

16、the only robust way to write this code is to use something / like the SWMRG (single-writer, multiple-reader guard) object developed / in Advanced Windows (Microsoft Press). Sleep(0); / Set our keyboard hook. hhook = SetWindowsHookEx(WH_SHELL, ShellHook_HookProc, g_hinstDll, 0); / Ensure that g_hhook

17、 is always valid (even if we are preempted whilst / in the middle of writing to it) by updating the variable atomically. InterlockedExchange(PLONG) &g_hhook, (LONG) hhook); return(g_hhook != NULL);/BOOL WINAPI ShellHook_Stop () BOOL fOK = TRUE; / Only uninstall the hook if it was successfully installed. if (g_hhook != NULL) fOK = UnhookWindowsHookEx(g_hhook); g_hhook = NULL; return(fOK);/BOOL WINAPI DllMain (HINSTANCE hinstDll, DWORD fdwReason, LPVOID lpvReserved) switch (fdwReason) case DLL_PROCESS_ATTACH: g_hinstDll = hinstDll; break; return(TRUE);