Screen Event Recorder DLL/Application

• Download Event Recorder (source + binary) - 66 Kb

Introduction

This article presents a powerful DLL. I say powerful since it offers some advantages over standard library DLL. This DLL not only can be linked to your application; it can also be run as a stand-alone application.

Description

Almost every time a developer will develop a library, a separate application will be created to use it. But at times, the logic in the GUI is so simple, there is no need for it. By using the RunDll.exe utility provided with Windows (generally under System32 folder), a developer can automatically provide the required GUI inside of the DLL itself. This eliminates the need to write a separate application to use it. Such DLLs doesn't need to be programmed only with Win32 API, you can also use MFC/ATL/WTL library if you wish to do so.

RunDLL

MSDN: The Run DLL utility (Rundll32.exe) included in Windows enables you to call functions exported from a 32-bit DLL. These functions must have the following syntax:

void CALLBACK EntryPoint(
    HWND hwnd,        // handle to owner window
    HINSTANCE hinst,  // instance handle for the DLL
    LPTSTR lpCmdLine, // string the DLL will parse
    int nCmdShow      // show state
);

Windows NT/2000/XP: It is possible to create a Unicode version of the function. Rundll32 first tries to find a function named EntryPointW. If it cannot find this function, it tries EntryPointA, then EntryPoint. To create a DLL that supports ANSI on Windows 95/98/ME and Unicode otherwise, export two functions: EntryPointW and EntryPoint.

When our main function PlayFile is called, HWND hwnd points to the RunDLL window class. This window is normally hidden and the main thread inside of the RunDll.exe application is running its message loop. Thus, to terminate the running thread, you only need to call PostQuitMessage(). The DLL/Application is able to record/play user input events. It can be viewed as a full feature application capable to record mouse and keyboard activities. A file can be created (.evr) and played at later time. This can be useful to automate testing for your application.

How to Use

Stand-Alone

To use this DLL as stand-alone, you can create a shortcut with the following:

%windir%\System32\RunDll32.exe 
    C:\Program Files\EventRecorder\MacRcrd.dll,PlayFile

You can also use the exported registry settings file (.reg) which can used to register the event recorder file extension to your computer so that you can use explorer to execute a recorder file by using the context menu command.

REGEDIT4

[HKEY_CLASSES_ROOT\.evr]
@="EventFile"

[HKEY_CLASSES_ROOT\EventFile]
@="Event File"

[HKEY_CLASSES_ROOT\EventFile\DefaultIcon]
@="C:\\Progra~1\\EventRecorder\\MacRcrd.dll"

[HKEY_CLASSES_ROOT\EventFile\shell]
@=""

[HKEY_CLASSES_ROOT\EventFile\shell\Start Player]

[HKEY_CLASSES_ROOT\EventFile\shell\Start Player\command]
@="RunDll32.exe C:\\Progra~1\\EventRecorder\\MacRcrd.dll,PlayFile /file:%1"

[HKEY_CLASSES_ROOT\EventFile\shell\Play Events]

[HKEY_CLASSES_ROOT\EventFile\shell\Play Events\command]
@="RunDll32.exe 
    C:\\Progra~1\\EventRecorder\\MacRcrd.dll,PlayFile /play /file:%1"

Statically or dynamically linked to other application

Using this DLL as statically linked to your application is also possible. This is made easy on you by just including

#include "MacRcrdImport.h"

in your project. This Event recorder DLL (MacRcrd.dll) exposes the following interfaces:

HRESULT InstallCBT( LONG_PTR lEventObj, 
    LONG_PTR lEventObjInstance, DWORD fdwOptions );
HRESULT UninstallCBT();
HRESULT InstallRecorder( LONG_PTR lEventObj, 
    LONG_PTR lEventObjInstance, DWORD fdwOptions );
HRESULT UninstallRecorder();
HRESULT InstallPlayer( LONG_PTR lEventObj, 
    LONG_PTR lEventObjInstance, DWORD fdwOptions );
HRESULT UninstallPlayer();

The function InstallRecorder installs a journal record hook while the InstallPlayer installs a journal playback hook in the system. You can provide a CALLBACK function as the event object a window handle. I do not recommend to use the window handle for now, since the callback method provide much more functionalities. The callback must follow this prototype:

typedef LRESULT (CALLBACK* PFNCALLBACK)(int nCode, 
    WPARAM wParam, LPARAM lParam, LONG_PTR dwInstance);

I recommend you to take a look inside PlayFile.cpp for an example of how this can be used. Remember that WM_CANCELJOURNAL is posted to your MFC application but with RunDll32.exe, this message cannot be seen very easily. In order to see this message inside of your DLL, you will need to run your own message loop by using GetMessage or PeekMessage or you can also install a GetMsgProc hook procedure function.

Conclusion

I introduced in this article a DLL/Application, which is not very different to control panel application (same principle), but offer some advantages to regular DLL. In software design, DLL/Application can be very useful and may offer a very attractive solution to your design. This project demonstrates various techniques like:

• Using Journal recorder and playback (WH_JOURNALRECORD and WH_JOURNALPLAYBACK)
• Using ComCtl32 Version 6 in Control Panel or a DLL That is run by RunDll32.exe
• Exporting and renaming exported functions from source code
• Parsing command-line argument

Revision History

• v1.5.0.0 - Bug fixes, Added CPlayFileDlg ATL-class
• v1.0.0.0 - Initial release