强大的窗口hook

阿杰 · 发表于 2009-3-5 22:27:39

'窗体中的代码
Option Explicit
Private Sub Form_Load()     Shell_Hook_Msg_ID = RegisterWindowMessage("SHELLHOOK")     RegisterShellHookWindow (Me.hWnd)    '' 调用未公开的函数进行注册     LogWinOldProc = SetWindowLong(Me.hWnd, GWL_WNDPROC, AddressOf WndProc) End Sub
Private Sub Form_Unload(Cancel As Integer)     DeregisterShellHookWindow Me.hWnd     SetWindowLong Me.hWnd, GWL_WNDPROC, LogWinOldProc End Sub
'模块中的代码
Option Explicit
Public Declare Function RegisterShellHookWindow Lib "user32" (ByVal hWnd As Long) As Long    ''use in NT5 Public Declare Function RegisterWindowMessage Lib "user32" Alias "RegisterWindowMessageA" (ByVal lpString As String) As Long Public Declare Function DeregisterShellHookWindow Lib "user32" (ByVal hWnd As Long) As Long Public Declare Function SetWindowLong Lib "user32" Alias "SetWindowLongA" (ByVal hWnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long Private Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal lpPrevWndFunc As Long, ByVal hWnd As Long, ByVal Msg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long Private Declare Function GetWindowText Lib "user32" Alias "GetWindowTextA" (ByVal hWnd As Long, ByVal lpString As String, ByVal cch As Long) As Long Private Declare Function GetWindowTextLength Lib "user32" Alias "GetWindowTextLengthW" (ByVal hWnd As Long) As Long
Private Const HSHELL_WINDOWCREATED = 1    '' 顶级窗体被创建 Private Const HSHELL_WINDOWDESTROYED = 2    '' 顶级窗体即将被关闭 Private Const HSHELL_ACTIVATESHELLWINDOW = 3    '' SHELL 的主窗体将被激活 Private Const HSHELL_WINDOWACTIVATED = 4    '' 顶级窗体被激活 Private Const HSHELL_GETMINRECT = 5    '' 顶级窗体被最大化或最小化（本例未用） Private Const HSHELL_REDRAW = 6    '' Windows 任务栏被刷新 Private Const HSHELL_TASKMAN = 7    '' 任务列表的内容被选中 Private Const HSHELL_LANGUAGE = 8    '' 中英文切换或输入法切换 Private Const HSHELL_SYSMENU = 9    ''显示系统菜单 Private Const HSHELL_ENDTASK = 10    ''顶级窗体被强制关闭 Private Const HSHELL_ACCESSIBILITYSTATE = 11 Private Const HSHELL_APPCOMMAND = 12    ''没有被程序处理的APPCOMMAND。见WM_APPCOMMAND Private Const HSHELL_WINDOWREPLACED = 13    ''wParam=被替换的顶级窗口的hWnd Private Const HSHELL_WINDOWREPLACING = 14    ''wParam=替换顶级窗口的窗口hWnd Private Const HSHELL_HIGHBIT = &H8000&    ''掩码 Private Const HSHELL_FLASH = (HSHELL_REDRAW Or HSHELL_HIGHBIT)    ''标题闪烁 Private Const HSHELL_RUDEAPPACTIVATED = (HSHELL_WINDOWACTIVATED Or HSHELL_HIGHBIT)    ''不知道干吗的
Public Const GWL_WNDPROC = -4 Private Const MAX_PATH = 260
Public Shell_Hook_Msg_ID As Long Public LogWinOldProc As Long
Public Function WndProc(ByVal hWnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long     Select Case wMsg     Case Shell_Hook_Msg_ID         Dim szTmp As String         Select Case wParam         Case HSHELL_WINDOWACTIVATED             szTmp = String(MAX_PATH, vbNullChar)             Call GetWindowText(lParam, szTmp, MAX_PATH)             Debug.Print "HSHELL_WINDOWACTIVATED:" & Left$(szTmp, GetWindowTextLength(lParam))         Case HSHELL_WINDOWCREATED             szTmp = String(MAX_PATH, vbNullChar)             Call GetWindowText(lParam, szTmp, MAX_PATH)             Debug.Print "HSHELL_WINDOWCREATED:" & Left$(szTmp, GetWindowTextLength(lParam))             '剩下的省略。。         End Select     End Select     WndProc = CallWindowProc(LogWinOldProc, hWnd, wMsg, wParam, lParam) End Function

阿杰 · 发表于 2009-3-5 22:30:05

RegisterShellHookWindow。强大的API，可以hook一切窗口的创建、销毁、焦点等等等等事件。
'MSDN 参数说明 'wParam lParam 'HSHELL_GETMINRECT A pointer to a SHELLHOOKINFO structure. 'HSHELL_WINDOWACTIVATEED The HWND handle of the activated window. 'HSHELL_RUDEAPPACTIVATEED The HWND handle of the activated window. 'HSHELL_WINDOWREPLACING The HWND handle of the window replacing the top-level window. 'HSHELL_WINDOWREPLACED The HWND handle of the window being replaced. 'HSHELL_WINDOWCreateD The HWND handle of the window being created. 'HSHELL_WINDOWDESTROYED The HWND handle of the top-level window being destroyed. 'HSHELL_ACTIVATESHELLWINDOW Not used. 'HSHELL_TASKMAN Can be ignored. 'HSHELL_REDRAW The HWND handle of the window that needs to be redrawn. 'HSHELL_FLASH The HWND handle of the window that needs to be flashed. 'HSHELL_ENDTASK The HWND handle of the window that should be forced to exit. 'HSHELL_APPCOMMAND The APPCOMMAND which has been unhandled by the application or other hooks. See WM_APPCOMMAND and use the message cracker GET_APPCOMMAND_LPARAM(lParam) to crack this parameter.