|
try asking in the C# forum.
Do the chickens have large talons?
|
|
|
|
|
You need to intercept all the system services used to open files.
To do that you need a system hook, is more, you'll need a Kernel mode driver to install the hook.
Forget about C# and start learning WIN32 and Assembler.
What you try to do is really f***ing hard, I can tell you because I was working in a project similar to what you say.
Anton Basov articles would be really helpfull in your task, you can find them in the code project.
Hope this helps
|
|
|
|
|
Thanks a lot for your reply.. 
Luck is Opportunity with hardwork
|
|
|
|
|
hi
i coded a hook dll,but when i wanna add a file and write the result i dont know what happens.my file is wrong or somtimes it's empty
(but messagebos shows the right result !!!!!!!)
here is my code:
#include "a.h"
#include <stdio.h>
#include <stdlib.h>
#include <psapi.h>
#include <string.h>
#include <winreg.h>
#include <process.h>
#include <windef.h>
#include <windows.h>
#include <io.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
int x=0;
int stream;
FILE* fout;
static BOOL bHooked = FALSE;
static HHOOK CBT=0,CBT1=0;
static HINSTANCE hInst;
static int count;
char szModName[1024];
char szModName1[1024];
char nul[1024];
char win[1024];
void GetWinDir(void);
LRESULT CALLBACK CBTProc(int code, WPARAM wParam, LPARAM lParam);
//LRESULT CALLBACK CBTProc1(int code, WPARAM wParam, LPARAM lParam);
BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved)
{
switch (fdwReason)
{
case DLL_PROCESS_ATTACH:
hInst=hinstDLL;
count=0;
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
break;
default:
break;
}
return TRUE;
}
DLL_EXPORT void BagaHooku(void)
{
if(!bHooked)
{
CBT = SetWindowsHookEx(WH_CBT, (HOOKPROC)CBTProc, hInst, (DWORD)NULL);
/// CBT1 = SetWindowsHookEx(WH_CBT, (HOOKPROC)CBTProc1, hInst, (DWORD)NULL);
bHooked = TRUE;
}
}
DLL_EXPORT void ScoateHooku(void)
{
if(bHooked)
{
UnhookWindowsHookEx(CBT);
// UnhookWindowsHookEx(CBT1);
}
}
LRESULT CALLBACK CBTProc(int nCode,WPARAM wParam,LPARAM lParam)
{
if ((nCode==HCBT_ACTIVATE)||(nCode==HCBT_SYSCOMMAND)||(nCode==HCBT_QS)||(nCode==HCBT_CREATEWND))
//if (nCode==HCBT_DESTROYWND)
{
//MessageBox (NULL, TEXT ("send processes"), TEXT ("HelloMsg"), 0) ;
HANDLE hProc;
HMODULE hMods[1024];
DWORD n;
DWORD dwProcessId ;
DWORD lpExitCode;
DWORD dwSize,dwType,dwDisp;
HKEY Regentry;
char *host1;
char host[1024];
char rezerva[1024];
//MessageBox (NULL, TEXT ("send processes"), TEXT ("HelloMsg"), 0) ;
GetWindowThreadProcessId((HWND)wParam, &dwProcessId);
hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, (DWORD)dwProcessId);
if(EnumProcessModules(hProc, hMods, sizeof(hMods), &n))
{
if (n>0)
GetModuleFileNameEx(hProc, hMods[0], szModName, sizeof(szModName));
}
GetExitCodeProcess(hProc,&lpExitCode);
if(!(host1=strrchr(szModName,'\\')))
strcpy(host,szModName);
else
strcpy(host,host1+1);
RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\Gapula\\PEND", 0, KEY_QUERY_VALUE, &Regentry);
RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize);
if(RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize)!=ERROR_SUCCESS)
{
RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\Gapula\\OK", 0, KEY_QUERY_VALUE, &Regentry);
RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize);
if(RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize)!=ERROR_SUCCESS)
{
RegCloseKey(Regentry);
RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\Gapula\\RESTR", 0, KEY_QUERY_VALUE|KEY_ALL_ACCESS, &Regentry);
RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize);
if(RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize)!=ERROR_SUCCESS)
{
RegCreateKeyEx( HKEY_LOCAL_MACHINE, "SOFTWARE\\Gapula\\PEND", 0, "", REG_OPTION_NON_VOLATILE,KEY_WRITE, NULL, &Regentry, &dwDisp);
RegSetValueEx(Regentry, host, 0, REG_SZ,(unsigned char *)szModName, strlen(szModName)+1);
RegCloseKey(Regentry);
strcat(szModName," is trying to END, do you allow that ?\n Please recall that if you say yes this action will be happening every time this program starts\nThis goes for NO as well so be careful what you wish for");
//++++++++++++++++++++++++++++++++++++++++++++++
fout = fopen("out.txt", "a+");
fwrite(host, 1,strlen(host), fout);
// fwrite("\n",1,2,fout);
fclose(fout);
//++++++++++++++++++++++++++++++++++++++++++++++++++++
//this messagebox shows the right answer but the file above shows the wrong!!!!! whats problem?
MessageBox (NULL, host, TEXT ("HelloMsg"), 0) ;
if (MessageBox(NULL,szModName,"Gabby",MB_ICONQUESTION|MB_SYSTEMMODAL|MB_APPLMODAL|MB_TASKMODAL|MB_SETFOREGROUND|MB_TOPMOST|MB_YESNO)==IDNO)
{
RegCreateKeyEx( HKEY_LOCAL_MACHINE, "SOFTWARE\\Gapula\\RESTR", 0, "", REG_OPTION_NON_VOLATILE,KEY_WRITE, NULL, &Regentry, &dwDisp);
RegSetValueEx(Regentry, host, 0, REG_SZ,(unsigned char *)szModName, strlen(szModName)+1);
RegCloseKey(Regentry);
//MessageBox (NULL, TEXT ("send processes"), TEXT ("HelloMsg"), 0) ;
TerminateProcess(hProc, (UINT)lpExitCode);
}
else
{
RegCreateKeyEx( HKEY_LOCAL_MACHINE, "SOFTWARE\\Gapula\\OK", 0, "", REG_OPTION_NON_VOLATILE,KEY_WRITE, NULL, &Regentry, &dwDisp);
RegSetValueEx(Regentry, host, 0, REG_SZ,(unsigned char *)szModName, strlen(szModName)+1);
RegCloseKey(Regentry);
return 0;
}
}
else
//MessageBox (NULL, TEXT ("send processes"), TEXT ("HelloMsg"), 0) ;
TerminateProcess(hProc, (UINT)lpExitCode);
}
else
{
return 0;
}
}
else
{
RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\Gapula\\RESTR", 0, KEY_QUERY_VALUE|KEY_ALL_ACCESS, &Regentry);
RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize);
if(RegQueryValueEx(Regentry,host , NULL, &dwType, (unsigned char*)&rezerva, &dwSize)!=ERROR_SUCCESS)
return 0;
else
//MessageBox (NULL, TEXT ("send processes"), TEXT ("HelloMsg"), 0) ;
TerminateProcess(hProc, (UINT)lpExitCode);
}
}
return CallNextHookEx(CBT,nCode,wParam,lParam);
}
this part is wrong:
fout = fopen("out.txt", "a+");
fwrite(host, 1,strlen(host), fout);
// fwrite("\n",1,2,fout);
fclose(fout);
???????????????????????????????
-- modified at 13:51 Tuesday 18th July, 2006
|
|
|
|
|
You'd get a lot more help if you'd narrow this down to just a handful of lines. No one likes to wade through complete programs, or even several pages of code, to locate a problem. Try:
void main( void )
{
char host[1024], szModName[1024], *host1;
if (! (host1 = strrchr(szModName, '\\')))
strcpy(host, szModName);
else
strcpy(host, host1 + 1);
FILE *fout = fopen("out.txt", "a+");
fwrite(host, 1, strlen(host), fout);
fclose(fout);
}Now step through each of these until you locate the offending statement.
"Money talks. When my money starts to talk, I get a bill to shut it up." - Frank
"Judge not by the eye but by the heart." - Native American Proverb
|
|
|
|
|
|
are you sure you are looking at the correct out.txt file?
because this code looks fine: (isolated that is)
fout = fopen("out.txt", "a+");
fwrite(host, 1,strlen(host), fout);
fclose(fout);
Is this a Unicode project?
AliR.
Visual C++ MVP
|
|
|
|
|
salam
are file ijad mishe.ama mohtaviyatesh gheire marbote.hamihe esme barnameye hoohamo minevise!
dar hali ke man mohtavaiyate hosto ba message box ke nehson midam doroste ama vaghti to iflemikhad benevise eshtebah darm miad.
to rahi dari ke ijade proceesaro elam kone
man enumprocess gozahstam ta prosseaye jari ro nehson bede
bad kolehso to ye file mirizam.
hala mikham hamishe update bashe baraye hamin hook gozahstam ke age ye processe jadidi ijad shod ya kill shod eb man etela bede ta ono be on file ezafe konam.
be nazaret rahe digei ham hast ke proceesa ro monitor konam berizam to file?
|
|
|
|
|
Hi
I created a desk band like a wmp-minibar, but i have one problem
- how to programically resize the windows toolbar, i've noticed that
wmp-mini bar do that - has anyone some idea? - please help!!!
and sorry for my english, i'm from poland 
|
|
|
|
|
Hi again people
How can I get a list of the running apps, like the one is shown in Task Manager in the Applications tab?
Thanks in advance 
|
|
|
|
|
|
Thanks mate, I already know about enumprocess, but that will list all the running process, like svchost.exe, lsass and all that.
What I would really like is to see only the Apps running.
Is there any way to filter the process list to get only the Apps?
|
|
|
|
|
Does EnumWindows give you what you want?
AliR.
Visual C++ MVP
|
|
|
|
|
I think that EnumWindows is what I was looking for
I found also that task manager considers Application to any process with a visible window.
Thanks a lot Ali
|
|
|
|
|
Kharfax wrote: found also that task manager considers Application to any process with a visible window
try FindWindow and FindWindowEx combination too!
"Opinions are neither right nor wrong. I cannot change your opinion. I can, however, change what influences your opinion." - David Crow
cheers,
Alok Gupta
VC Forum Q&A :- I/ IV
Support CRY- Child Relief and You
|
|
|
|
|
See EnumProcesses
whitesky
|
|
|
|
|
The problem is solved, what you need to do is:
* Get all the top level windows via "EnumWindows"
* Filter the list using "IsWindowVisible"
That will leave you the list just like the one you see in the Applications tab in Task Manager.
Hope this will help someone in the future 
Thanks for the feedback people
|
|
|
|
|
I use vs2005, when i want to debug my mfc app with #include fstream i get a endless list of problems refering to the xdebug(32)file.
A few errors:
1>C:\Program Files (x86)\Microsoft Visual Studio 8\VC\include\xdebug(32) : warning C4229: anachronism used : modifiers on data are ignored
1>C:\Program Files (x86)\Microsoft Visual Studio 8\VC\include\xdebug(32) : error C2365: 'operator new' : redefinition; previous definition was 'function'
1>C:\Program Files (x86)\Microsoft Visual Studio 8\VC\include\xdebug(32) : error C2078: too many initializers
1>C:\Program Files (x86)\Microsoft Visual Studio 8\VC\include\xdebug(32) : error C2440: 'initializing' : cannot convert from 'int' to 'void *'
When i do a release however, everything works just fine...
any sugestions?
- Fred
-- modified at 12:26 Tuesday 18th July, 2006
|
|
|
|
|
The order of #include's may matter. Which do you include first? "stdafx.h" or <fstream> ?
Maxwell Chen
|
|
|
|
|
stdafx.h is before fstream
|
|
|
|
|
|
As the problem is only in debug mode, maybe there is something wrong with some preprocessor definition. If you have a #ifdef _DEBUG statement at the top of your file, post it here (completely) so we can have a look.
Cédric Moonen
Software developer
Charting control
|
|
|
|
|
ok, ive tried without the #ifdef _DEBUG
#include "stdafx.h"
#include "resource.h"
#include "Dialog1.h"
#include "Dialog2.h"
#include "assert.h"
#include <Windows.h>
#include "Dialog3.h"
#include <io.h>
#include <fcntl.h> /* Needed only for _O_RDWR definition */
#include <share.h>
#include <stdio.h>
#include "EmbeddedDialogDlg.h"
#include "QuickMissLoadWriteEdit.h"
#include <iostream>
#include "string.h"
#include <string>
#include <fstream>
using namespace std;
#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif
code comes here
|
|
|
|
|
Mmmh, I don't see really the problem here. Anyway, you are mixing deprecated header files with new ones. Remove all the include with a .h for the stadard library (stdio,io,string). I don't think this will solve the problem but check that first.
Cédric Moonen
Software developer
Charting control
|
|
|
|
|
ok, thanks anyway 
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
