阿杰 发表于 2009-3-5 22:27:39

强大的窗口hook

<p><font face="Verdana">'窗体中的代码</font></p>
<p><font face="Verdana">Option Explicit</font></p>
<p><font face="Verdana">Private Sub Form_Load()<br/>&nbsp;&nbsp;&nbsp; Shell_Hook_Msg_ID = RegisterWindowMessage("SHELLHOOK")<br/>&nbsp;&nbsp;&nbsp; RegisterShellHookWindow (Me.hWnd)&nbsp;&nbsp;&nbsp; '' 调用未公开的函数进行注册<br/>&nbsp;&nbsp;&nbsp; LogWinOldProc = SetWindowLong(Me.hWnd, GWL_WNDPROC, AddressOf WndProc)<br/>End Sub</font></p>
<p><font face="Verdana">Private Sub Form_Unload(Cancel As Integer)<br/>&nbsp;&nbsp;&nbsp; DeregisterShellHookWindow Me.hWnd<br/>&nbsp;&nbsp;&nbsp; SetWindowLong Me.hWnd, GWL_WNDPROC, LogWinOldProc<br/>End Sub</font></p>
<p>'模块中的代码</p>
<p><font face="Verdana">Option Explicit</font></p>
<p><font face="Verdana">Public Declare Function RegisterShellHookWindow Lib "user32" (ByVal hWnd As Long) As Long&nbsp;&nbsp;&nbsp; ''use in NT5<br/>Public Declare Function RegisterWindowMessage Lib "user32" Alias "RegisterWindowMessageA" (ByVal lpString As String) As Long<br/>Public Declare Function DeregisterShellHookWindow Lib "user32" (ByVal hWnd As Long) As Long<br/>Public Declare Function SetWindowLong Lib "user32" Alias "SetWindowLongA" (ByVal hWnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long<br/>Private Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal lpPrevWndFunc As Long, ByVal hWnd As Long, ByVal Msg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long<br/>Private Declare Function GetWindowText Lib "user32" Alias "GetWindowTextA" (ByVal hWnd As Long, ByVal lpString As String, ByVal cch As Long) As Long<br/>Private Declare Function GetWindowTextLength Lib "user32" Alias "GetWindowTextLengthW" (ByVal hWnd As Long) As Long</font></p>
<p><font face="Verdana">Private Const HSHELL_WINDOWCREATED = 1&nbsp;&nbsp;&nbsp; '' 顶级窗体被创建<br/>Private Const HSHELL_WINDOWDESTROYED = 2&nbsp;&nbsp;&nbsp; '' 顶级窗体即将被关闭<br/>Private Const HSHELL_ACTIVATESHELLWINDOW = 3&nbsp;&nbsp;&nbsp; '' SHELL 的主窗体将被激活<br/>Private Const HSHELL_WINDOWACTIVATED = 4&nbsp;&nbsp;&nbsp; '' 顶级窗体被激活<br/>Private Const HSHELL_GETMINRECT = 5&nbsp;&nbsp;&nbsp; '' 顶级窗体被最大化或最小化(本例未用)<br/>Private Const HSHELL_REDRAW = 6&nbsp;&nbsp;&nbsp; '' Windows 任务栏被刷新<br/>Private Const HSHELL_TASKMAN = 7&nbsp;&nbsp;&nbsp; '' 任务列表的内容被选中<br/>Private Const HSHELL_LANGUAGE = 8&nbsp;&nbsp;&nbsp; '' 中英文切换或输入法切换<br/>Private Const HSHELL_SYSMENU = 9&nbsp;&nbsp;&nbsp; ''显示系统菜单<br/>Private Const HSHELL_ENDTASK = 10&nbsp;&nbsp;&nbsp; ''顶级窗体被强制关闭<br/>Private Const HSHELL_ACCESSIBILITYSTATE = 11<br/>Private Const HSHELL_APPCOMMAND = 12&nbsp;&nbsp;&nbsp; ''没有被程序处理的APPCOMMAND。见WM_APPCOMMAND<br/>Private Const HSHELL_WINDOWREPLACED = 13&nbsp;&nbsp;&nbsp; ''wParam=被替换的顶级窗口的hWnd<br/>Private Const HSHELL_WINDOWREPLACING = 14&nbsp;&nbsp;&nbsp; ''wParam=替换顶级窗口的窗口hWnd<br/>Private Const HSHELL_HIGHBIT = &amp;H8000&amp;&nbsp;&nbsp;&nbsp; ''掩码<br/>Private Const HSHELL_FLASH = (HSHELL_REDRAW Or HSHELL_HIGHBIT)&nbsp;&nbsp;&nbsp; ''标题闪烁<br/>Private Const HSHELL_RUDEAPPACTIVATED = (HSHELL_WINDOWACTIVATED Or HSHELL_HIGHBIT)&nbsp;&nbsp;&nbsp; ''不知道干吗的</font></p>
<p><font face="Verdana">Public Const GWL_WNDPROC = -4<br/>Private Const MAX_PATH = 260</font></p>
<p><font face="Verdana">Public Shell_Hook_Msg_ID As Long<br/>Public LogWinOldProc As Long</font></p>
<p><font face="Verdana">Public Function WndProc(ByVal hWnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long<br/>&nbsp;&nbsp;&nbsp; Select Case wMsg<br/>&nbsp;&nbsp;&nbsp; Case Shell_Hook_Msg_ID<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Dim szTmp As String<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Select Case wParam<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Case HSHELL_WINDOWACTIVATED<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; szTmp = String(MAX_PATH, vbNullChar)<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Call GetWindowText(lParam, szTmp, MAX_PATH)<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Debug.Print "HSHELL_WINDOWACTIVATED:" &amp; Left$(szTmp, GetWindowTextLength(lParam))<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Case HSHELL_WINDOWCREATED<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; szTmp = String(MAX_PATH, vbNullChar)<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Call GetWindowText(lParam, szTmp, MAX_PATH)<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Debug.Print "HSHELL_WINDOWCREATED:" &amp; Left$(szTmp, GetWindowTextLength(lParam))<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; '剩下的省略。。<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; End Select<br/>&nbsp;&nbsp;&nbsp; End Select<br/>&nbsp;&nbsp;&nbsp; WndProc = CallWindowProc(LogWinOldProc, hWnd, wMsg, wParam, lParam)<br/>End Function</font></p>

阿杰 发表于 2009-3-5 22:30:05

<p>RegisterShellHookWindow。强大的API,可以hook一切窗口的创建、销毁、焦点等等等等事件。</p>
<p><font color="#008000">'<span style="COLOR: #008000">MSDN 参数说明</span></font><span style="COLOR: #008000"><br/>'</span><span style="COLOR: #008000">wParam&nbsp;lParam</span><span style="COLOR: #008000"><br/>'</span><span style="COLOR: #008000">HSHELL_GETMINRECT&nbsp;A&nbsp;pointer&nbsp;to&nbsp;a&nbsp;SHELLHOOKINFO&nbsp;structure.</span><span style="COLOR: #008000"><br/>'</span><span style="COLOR: #008000">HSHELL_WINDOWACTIVATEED&nbsp;The&nbsp;HWND&nbsp;handle&nbsp;of&nbsp;the&nbsp;activated&nbsp;window.</span><span style="COLOR: #008000"><br/>'</span><span style="COLOR: #008000">HSHELL_RUDEAPPACTIVATEED&nbsp;The&nbsp;HWND&nbsp;handle&nbsp;of&nbsp;the&nbsp;activated&nbsp;window.</span><span style="COLOR: #008000"><br/>'</span><span style="COLOR: #008000">HSHELL_WINDOWREPLACING&nbsp;The&nbsp;HWND&nbsp;handle&nbsp;of&nbsp;the&nbsp;window&nbsp;replacing&nbsp;the&nbsp;top-level&nbsp;window.</span><span style="COLOR: #008000"><br/>'</span><span style="COLOR: #008000">HSHELL_WINDOWREPLACED&nbsp;The&nbsp;HWND&nbsp;handle&nbsp;of&nbsp;the&nbsp;window&nbsp;being&nbsp;replaced.</span><span style="COLOR: #008000"><br/>'</span><span style="COLOR: #008000">HSHELL_WINDOWCreateD&nbsp;The&nbsp;HWND&nbsp;handle&nbsp;of&nbsp;the&nbsp;window&nbsp;being&nbsp;created.</span><span style="COLOR: #008000"><br/>'</span><span style="COLOR: #008000">HSHELL_WINDOWDESTROYED&nbsp;The&nbsp;HWND&nbsp;handle&nbsp;of&nbsp;the&nbsp;top-level&nbsp;window&nbsp;being&nbsp;destroyed.</span><span style="COLOR: #008000"><br/>'</span><span style="COLOR: #008000">HSHELL_ACTIVATESHELLWINDOW&nbsp;Not&nbsp;used.</span><span style="COLOR: #008000"><br/>'</span><span style="COLOR: #008000">HSHELL_TASKMAN&nbsp;Can&nbsp;be&nbsp;ignored.</span><span style="COLOR: #008000"><br/>'</span><span style="COLOR: #008000">HSHELL_REDRAW&nbsp;The&nbsp;HWND&nbsp;handle&nbsp;of&nbsp;the&nbsp;window&nbsp;that&nbsp;needs&nbsp;to&nbsp;be&nbsp;redrawn.</span><span style="COLOR: #008000"><br/>'</span><span style="COLOR: #008000">HSHELL_FLASH&nbsp;The&nbsp;HWND&nbsp;handle&nbsp;of&nbsp;the&nbsp;window&nbsp;that&nbsp;needs&nbsp;to&nbsp;be&nbsp;flashed.</span><span style="COLOR: #008000"><br/>'</span><span style="COLOR: #008000">HSHELL_ENDTASK&nbsp;The&nbsp;HWND&nbsp;handle&nbsp;of&nbsp;the&nbsp;window&nbsp;that&nbsp;should&nbsp;be&nbsp;forced&nbsp;to&nbsp;exit.</span><span style="COLOR: #008000"><br/>'</span><span style="COLOR: #008000">HSHELL_APPCOMMAND&nbsp;The&nbsp;APPCOMMAND&nbsp;which&nbsp;has&nbsp;been&nbsp;unhandled&nbsp;by&nbsp;the&nbsp;application&nbsp;or&nbsp;other&nbsp;hooks.&nbsp;See&nbsp;WM_APPCOMMAND&nbsp;and&nbsp;use&nbsp;the&nbsp;message&nbsp;cracker&nbsp;GET_APPCOMMAND_LPARAM(lParam)&nbsp;to&nbsp;crack&nbsp;this&nbsp;parameter.</span><span style="COLOR: #008000"><br/></span></p>

5988143 发表于 2009-3-16 10:57:40

謝謝分享~學習中

马大哈 发表于 2009-6-3 13:21:57

<p>暴风雨写过这样的一个例子:)</p>
<p>&nbsp;</p>
<p>的确很好很强大~~~~</p>

SilenceNet 发表于 2010-3-1 12:57:05

:victory: 留名。。。

6768656 发表于 2010-3-2 13:41:23

顶下:lol

sgp_003 发表于 2010-5-28 15:59:24

哪位大侠再多点说明,呵呵!

马大哈 发表于 2010-5-28 19:07:52

有什么问题?

乔丹二世 发表于 2010-7-4 18:05:57

这个暴强,顶一下!
页: [1]
查看完整版本: 强大的窗口hook