asked on

About Shell hook

Why my shell hook can only hook my process messages? I want to hook other process window create and destroy.

This is my code(DebugTrace function can out put the debug info.
function shellHookProc(iCode:Integer;wParam1:wParam;lParam1:lParam):LRESULT;stdcall;
begin
Result:=0;
debugtrace(inttostr(iCode));
if iCode<0 then Result := CallNextHookEx(hHook1,iCode,wParam1,lParam1);
end;

procedure SetshellHook(hnd:HWND);
begin
hHook1:=SetwindowsHookEx(WH_SHELL,TaskHookProc,hInstance,0);
if hHook1 <=0 then messagebox(0,'hookError','task',16);
end;

procedure RemoveshellHook;
begin
UnhookWindowsHookEx(hhook1);
end;

cookey

ASKER

I want a system shell hook, not only hook my process

robert_marquardt

Such a hook has to reside in a DLL.
Windows maps this DLL into all running applications.

The problem with such a DLL is that each mapped instance has its own data segment and therefore
all global variables are in fact local to the specific instance.
This affects the hHook variable which has to be shared by all instances.

The easiest way is to write the DLL in C with MS VC++ because it allows to easily set up
shared segments. I have written such a DLL myself and it works without problems.
If you want to write the DLL in Delphi then search for "Delphi WH_SHELL" on Google and
you should get enough links to satisfy you.

DeerBear

Hi,

As Robert pointed out, there's a problem with system-wide hooks.

The best option is to use a Memory Mapped File for communication
among several DLL instances or just a file, which in turn has several
disadvantages.

You should look deeply into the Delphi Help File for the PROCESS_ATTACH and
PROCESS_DETATCH options on DLL loading.

HTH,

Andrew

GloomyFriar

>The best option is to use a Memory Mapped File for communication

I don't agree whit this.
The best way is shared data segment, imho.

ASKER CERTIFIED SOLUTION

GloomyFriar

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

DeerBear

Hi,

Using MMFs, to my knowledge, basically means using shared memory and I
fail to see where a "data segment" can be considered different from "Memory".

Cheers,

Andrew

GloomyFriar

2 DeerBear,
Of caurse I understand what are you talking about.
But try to explain this to cookey ;-)))

And by the way
#pragma data_seg("myshare")

is rather different then somethig like the following
SECURITY_ATTRIBUTES sa;
memset(&sa, 0, sizeof(sa));
HANDLE h_file = CreateFile(FileName, GENERIC_WRITE|GENERIC_READ, FILE_SHARE_READ, &sa, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
DWORD FileSize = GetFileSize(h_file, NULL);
HANDLE map_file = CreateFileMapping(h_file, &sa, PAGE_READWRITE, 0, 0, NULL);
char* Data = (char*)MapViewOfFile(map_file, FILE_MAP_ALL_ACCESS, 0, 0, 0);
memmove(Data+Position, Data+Position+LenToClip, FileSize-Position);
UnmapViewOfFile(Data);
CloseHandle(map_file);
SetFilePointer(h_file, FileSize-LenToClip, NULL, FILE_BEGIN);
SetEndOfFile(h_file);
CloseHandle(h_file);

Or you can't agree?

DeerBear

Eheheheheheh yeah ok, sorry ^_^

Just think I had arrived to a point where I was imagining this "data segment" as a
sort of C++ meta-instruction <g>, ya know some of those black magic C++ tricks that
make you go nuts in debugging <g>.

Andrew

cookey

ASKER

I think I find out the way to solve this problem, that Delphi write system wild hook very hard, I already write it in VC++

Thanks every body give me very good advices, but it seems the scores can only give one person, so I give the scores to GloomyFriar because of the longest code :-)