• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 301
  • Last Modified:

Getting Programname.

Hey, I use a hook to log the keyboard. This function send the keys to my app. Is there anyway that it also sends the application name, the program where the key is pressed.

This is the function.

function KeyHookFunc(Code, VirtualKey, KeyStroke: Integer): LRESULT; stdcall;
var
  KeyState1: TKeyBoardState;
  AryChar: array[0..1] of Char;
  Count: Integer;
begin
  Result := 0;
  if Code = HC_NOREMOVE then Exit;
  Result := CallNextHookEx(hKeyHook, Code, VirtualKey, KeyStroke);
  if Code < 0 then
    Exit;
  if Code = HC_ACTION then
  begin
    if ((KeyStroke and (1 shl 30)) <> 0) then
        hMemFile  := OpenFileMapping(FILE_MAP_WRITE, False, 'Global7v9k');
        PHookRec1 := MapViewOfFile(hMemFile, FILE_MAP_WRITE, 0, 0, 0);
        if PHookRec1 <> nil then
        begin
          hApp  := PHookRec1.AppHnd;
        end;
    if ((KeyStroke and (1 shl 30)) <> 0) then
    begin
      GetKeyboardState(KeyState1);
      Count := ToAscii(VirtualKey, KeyStroke, KeyState1, AryChar, 0);
      if Count = 1 then
      begin
        PostMessage(hApp, WM_USER + 1678, Ord(AryChar[0]), 0);
      end;
    end;
  end;
end;

Thanks.
0
JuicyJJ
Asked:
JuicyJJ
  • 4
  • 3
1 Solution
 
GloomyFriarCommented:
DWORD GetModuleFileName(
  HMODULE hModule,    // handle to module
  LPTSTR lpFilename,  // path buffer
  DWORD nSize         // size of buffer
);
0
 
GloomyFriarCommented:
Or try something like that:

var hSnapshoot: THandle;
    pe32: TProcessEntry32;
    the32: THREADENTRY32;
    dw_pid: DWORD;

    dw_pid := GetCurrentProcessId;
    pe32.dwSize := SizeOf(TProcessEntry32);
    if (Process32First(hSnapshoot, pe32)) then
    repeat
      if dw_pid = pe32.th32ProcessID then begin
        ShowMessage('Process filename: ' + PChar(pe32.szExeFile));
        break;
      end;
    until not Process32Next(hSnapshoot, pe32);

    CloseHandle (hSnapshoot);
0
 
DaFoxCommented:
Hi,

you could either get the title of the application placed in the caption bar or get the filename of the application.

1. window title
GetWindowText({...})

2. filename
var
  ModuleHandle : THandle;
  FileName : PChar;
begin
  FileName := StrAlloc(255);
  ModuleHandle := GetClassLong(WindowHandle, GCL_HMODULE);
  GetModuleFileName(ModuleHandle, FileName, 255);
  // FileName should contain the executable or dll name and path
  StrDispose(FileName);
end;

Markus
0
[Webinar] Kill tickets & tabs using PowerShell

Are you tired of cycling through the same browser tabs everyday to close the same repetitive tickets? In this webinar JumpCloud will show how you can leverage RESTful APIs to build your own PowerShell modules to kill tickets & tabs using the PowerShell command Invoke-RestMethod.

 
JuicyJJAuthor Commented:
Hey thanks.
I guess GetModuleFileName is something as GetClassName, but I don't know what params to use, what the handle is.

With that other code you posted, in what unit are tprocessentry32 and threadentry32 located.

Thanks.
0
 
GloomyFriarCommented:
>With that other code you posted, in what unit are tprocessentry32 and threadentry32 located.
TlHelp32
0
 
DaFoxCommented:
Hi,

>> but I don't know what params to use, what the handle is.

Try GetActiveWindow().

Markus
0
 
GloomyFriarCommented:
:(
0
 
DaFoxCommented:
PS: My solution above gets the application filename, because there's no way to get the application name of any windows program a user may run on his machine.
This snippet below tries to get the application name (!) stored in the version info of the exe. Please not that this is not 100% accurate, e.g. the "product name" of notepad is "operating system windows xxx"... So, it may not fit your needs, just wanted to add this...

Here's the code:

procedure TForm1.Button1Click(Sender: TObject);
var
  aFileName: array [0..MAX_PATH] of Char;
  pdwHandle: DWORD;
  nInfoSize: DWORD;
  pFileInfo: Pointer;
  pVarFInfo: PChar;
  nVarFInfo: DWORD;
  nVarTrans: DWORD;
  aVarFPath: array [0..MAX_PATH] of Char;
begin
  if not OpenDialog1.Execute then exit;
  StrCopy(aFileName, PChar(OpenDialog1.FileName));
  // in your hook proc you should use this next line
  // GetModuleFileName(GetActiveWindow, aFileName, MAX_PATH);
  pdwHandle := 0;
  nInfoSize := GetFileVersionInfoSize(aFileName, pdwHandle);
  if nInfoSize <> 0 then pFileInfo := GetMemory(nInfoSize) else pFileInfo := nil;
  if Assigned(pFileInfo) then
  try
    if GetFileVersionInfo(aFileName, pdwHandle, nInfoSize, pFileInfo) then
    begin
      pVarFInfo := nil;
      nVarFInfo := 0;
      if VerQueryValue(pFileInfo, '\VarFileInfo\Translation', Pointer(pVarFInfo), nVarFInfo) then
      begin
        nVarTrans := HiWord(PDWORD(pVarFInfo)^) or (Word(PDWORD(pVarFInfo)^) shl 16);
        wvsprintf(aVarFPath, '\StringFileInfo\%8.8x\', PChar(@nVarTrans));
        // (CompanyName, FileDescription, FileVersion, InternalName,
        //  LegalCopyright, OriginalFilename ProductName, ProductVersion)
        lstrcat(aVarFPath, 'ProductName');
        pVarFInfo := nil;
        nVarFInfo := 0;
        if VerQueryValue(pFileInfo, aVarFPath, Pointer(pVarFInfo), nVarFInfo) then
        begin
          Label2.Caption := 'Dateiversion (var): ' + TCaption(pVarFInfo);
        end;
      end;
    end;
  finally
    FreeMemory(pFileInfo);
  end;
end;

Regards,
Markus
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now