AppLogWord文档下载推荐.docx

AppLogWord文档下载推荐.docx

《AppLogWord文档下载推荐.docx》由会员分享，可在线阅读，更多相关《AppLogWord文档下载推荐.docx（8页珍藏版）》请在冰豆网上搜索。

windowsx.h>

#pragmawarning（disable:

4001）/*Singlelinecomment*/

tchar.h>

ShellHk.h"

Resource.h"

/////////////////////////////////////////////////////////////////

//ForcealinkwiththeimportlibraryforShellHk.dll

#pragmacomment（lib,adgLIBBUILDTYPEadgLIBCPUTYPE"

\\"

"

ShellHk"

）

BOOLAppLog_OnInitDialog（HWNDhwnd,HWNDhwndFocus,LPARAMlParam）{

adgSETDLGICONS（hwnd,IDI_APPLOG,IDI_APPLOG）;

if（!

ShellHook_Start（GetDlgItem（hwnd,IDC_APPLOG）））{

adgMB（__TEXT（"

Unabletostartshellhook"

））;

EndDialog（hwnd,IDCANCEL）;

}

return（TRUE）;

//Acceptdefaultfocuswindow.

}

/////////////////////////////////////////////////////////////////

voidAppLog_OnSize（HWNDhwnd,UINTstate,intcx,intcy）{

//Whentheuserresizesthemainwindow,wemustresizethelistbox

SetWindowPos（GetDlgItem（hwnd,IDC_APPLOG）,NULL,0,0,cx,cy,SWP_NOZORDER）;

////////////////////////////////////////////////////////////////

voidAppLog_OnCommand（HWNDhwnd,intid,HWNDhwndCtl,UINTcodeNotify）{

switch（id）{

caseIDCANCEL:

//Allowsdialogboxtoclose

//Unhookshellhookbeforeexiting.

if（!

ShellHook_Stop（））

adgMB（__TEXT（"

Unabletostopshellhook"

EndDialog（hwnd,id）;

break;

BOOLWINAPIAppLog_DlgProc（HWNDhwnd,UINTuMsg,WPARAMwParam,LPARAMlParam）{

switch（uMsg）{

//StandardWindowsmessages

adgHANDLE_DLGMSG（hwnd,WM_INITDIALOG,AppLog_OnInitDialog）;

adgHANDLE_DLGMSG（hwnd,WM_COMMAND,AppLog_OnCommand）;

adgHANDLE_DLGMSG（hwnd,WM_SIZE,AppLog_OnSize）;

}

return（FALSE）;

//Wedidn'

tprocessthemessage.

}

intWINAPIWinMain（HINSTANCEhinstExe,HINSTANCEhinstPrev,LPSTRlpszCmdLine,intnCmdShow）{

adgWARNIFUNICODEUNDERWIN95（）;

adgVERIFY（-1!

=DialogBox（hinstExe,MAKEINTRESOURCE（IDD_APPLOG）,

NULL,AppLog_DlgProc））;

return（0）;

ShellHk.c

ShellHk.c

JonathanLocke

Copyright（c）1995JeffreyRichter

Dllwhichsetsasystemshellhook.

****************************************************************/

/*SeeAppendixAfordetails*/

4001）/*Singlelinecomment*/

//WemustdefineSHELLHKLIBAPIas'

dllexport'

beforeincludingShellHk.h.

//ShellHk.hwillseethatwehavealreadydefinedSHELLHKLIBAPIand

//willnot（re）defineitas'

dllimport'

.

#defineSHELLHKLIBAPI__declspec（dllexport）

HINSTANCEg_hinstDll=NULL;

//ShellHk.dll'

sinstancehandle

//CallingSetWindowsHookExwithathreadidofzerowillcausethisDLLtobe

//injectedintootherprocesses.Therefore,wemustdeclareashareddata

//sectionsothatallmappingsofourDLL（inallprocesses）sharethesame

//setofglobalvariables.

//#pragmacomment（lib,"

kernel32"

）

#pragmadata_seg（"

Shared"

）

HHOOKg_hhook=NULL;

//Hookhandleforsystemwideshellhook

HWNDg_hwndListBox=NULL;

//Listboxinwhichtoinsertlogstrings

#pragmadata_seg（）

//#pragmacomment（linker,"

-section:

Shared,rws"

staticLRESULTWINAPIShellHook_HookProc（intnCode,WPARAMwParam,LPARAMlParam）{

TCHARsz[128],szPath[128];

DWORDdwProcessID;

HWNDhwnd=（HWND）wParam;

DWORDdwThreadID=GetWindowThreadProcessId（hwnd,&

dwProcessID）;

LRESULTlResult=CallNextHookEx（g_hhook,nCode,wParam,lParam）;

switch（nCode）{

caseHSHELL_WINDOWCREATED:

caseHSHELL_WINDOWDESTROYED:

//GetModuleFileNameisbeingcalledinthecontextoftheprocessin

//whichthisDllhasbeeninjected.

if（!

GetModuleFileName（NULL,szPath,adgARRAY_SIZE（szPath）））

_tcscpy（szPath,__TEXT（"

<

unknown>

"

wsprintf（sz,__TEXT（"

%cpid=0x%08x,tid=0x%08x,path=%s"

）,

（nCode==HSHELL_WINDOWCREATED?

__TEXT（'

>

'

）:

））,

dwProcessID,dwThreadID,szPath）;

ListBox_AddString（g_hwndListBox,sz）;

break;

return（lResult）;

BOOLWINAPIShellHook_Start（HWNDhwndListBox）{

HHOOKhhook=NULL;

//ReturnFALSEifhookhasalreadybeeninstalled.

if（g_hhook!

=NULL）

adgASSERT（IsWindow（hwndListBox））;

g_hwndListBox=hwndListBox;

//Giveuptheremainderofourthread'

stimeslice.

//Thisgivesusabetterchanceofgettingallthewaythroughthecall

//toSetWindowsHookExandthevariableassignmenttog_hhookinoneshot.

//Ifwearepreemptedafterthehookisset,butbeforethevariableis

//updated,itispossibleforanotherthreadtoenterourhookfilter

//functionbeforethehookhandleisvalid.UnderWindowsNTthisisnot

//aproblem.UnderWindows95,nothavingavalidhookhandlewillcause

//CallNextHookExtofail.Ifthereissomereasonthatitiscritical

//thatyourapplicationsucceedincallingthenextfilterfunctionin

//thechain,theonlyrobustwaytowritethiscodeistousesomething

//liketheSWMRG（single-writer,multiple-readerguard）objectdeveloped

//inAdvancedWindows（MicrosoftPress）.

Sleep（0）;

//Setourkeyboardhook.

hhook=SetWindowsHookEx（WH_SHELL,ShellHook_HookProc,g_hinstDll,0）;

//Ensurethatg_hhookisalwaysvalid（evenifwearepreemptedwhilst

//inthemiddleofwritingtoit）byupdatingthevariableatomically.

InterlockedExchange（（PLONG）&

g_hhook,（LONG）hhook）;

return（g_hhook!

=NULL）;

BOOLWINAPIShellHook_Stop（）{

BOOLfOK=TRUE;

//Onlyuninstallthehookifitwassuccessfullyinstalled.

=NULL）{

fOK=UnhookWindowsHookEx（g_hhook）;

g_hhook=NULL;

return（fOK）;

BOOLWINAPIDllMain（HINSTANCEhinstDll,DWORDfdwReason,LPVOIDlpvReserved）{

switch（fdwReason）{

caseDLL_PROCESS_ATTACH:

g_hinstDll=hinstDll;