We help IT Professionals succeed at work.

Hooking alt+tab

A. Cristian Csiki
on
1,244 Views
Last Modified: 2010-08-05
Hi experts!
The following code was posted before by an expert here in EE. It's about disabling system hotkeys. The point is, that I don't want to disable it, just to monitor it, to detect when Alt+tab is pressed, and save into a log, date + time + a messege that alt+tab pressed.

Problem: Alt+tab is detected, but the time is 00:00:00 always and it's saved twice in log. Help me debug this bug plz.
Thanks a lot.

Original code:

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls;
  const
  WH_KEYBOARD_LL = 13;
  LLKHF_EXTENDED = $01;
  LLKHF_INJECTED = $10;
  LLKHF_ALTDOWN  = $20;
  LLKHF_UP       = $80;
type
  TForm1 = class(TForm)
    BlockBtn: TButton;
    ReleaseBtn: TButton;
    procedure BlockBtnClick(Sender: TObject);
    procedure ReleaseBtnClick(Sender: TObject);
    procedure FormClose(Sender: TObject; var Action: TCloseAction);
       procedure LockKeyboard; stdcall;
    procedure UnlockKeyboard; stdcall;
  private
    { Private declarations }
  public
    { Public declarations }
  end;
    TKBDLLHOOKSTRUCT = packed record
   vkCode:      DWORD;
   scanCode:    DWORD;
   flags:       DWORD;
   time:        DWORD;
   dwExtraInfo: DWORD;
 end;
 PKBDLLHOOKSTRUCT = ^TKBDLLHOOKSTRUCT;
var
  Form1: TForm1;
   hKbdProc: HHOOK;
implementation

{$R *.dfm}
  function KeyBoardProc(iCode: Integer; wParam, lParam: LongInt): LongInt; stdcall;
var
  KeyData: TKBDLLHOOKSTRUCT;
  bIgnore: Boolean;
begin
  bIgnore := False;
  if iCode = HC_ACTION then
  begin
    KeyData := PKBDLLHOOKSTRUCT(lParam)^;
    with KeyData do
    begin
      // Block Control-Escape
//      if (vkCode = VK_ESCAPE) and ((GetAsyncKeyState(VK_CONTROL) and $8000) <> 0) then
//        bIgnore := True;
      // Block Control-Tab
//      if (vkCode = VK_TAB) and ((GetAsyncKeyState(VK_CONTROL) and $8000) <> 0) then
//        bIgnore := True;
      // Block Alt-Tab
      if (vkCode = VK_TAB) and ((flags and LLKHF_ALTDOWN) <> 0) then
       showmessage('alt+tab');
      // Block Alt-Escape
//      if (vkCode = VK_ESCAPE) and ((flags and LLKHF_ALTDOWN) <> 0) then
//        bIgnore := True;
     // Block Left/Right Windows key
//      if KeyData.vkCode in [VK_LWIN, VK_RWIN] then
//        bIgnore := True;
      // Block Control-F4
//      if (vkCode = VK_F4) and ((GetAsyncKeyState(VK_CONTROL) and $8000) <> 0) then
//        bIgnore := True;
      // Block Alt-F4
//      if (vkCode = VK_F4) and ((flags and LLKHF_ALTDOWN) <> 0) then
//        bIgnore := True;
    end;
  end;
  if bIgnore then
    Result := 1
  else
    Result := CallNextHookEx(hKbdProc, iCode, wParam, lParam);
end;

procedure TForm1.LockKeyboard;
begin
  hKbdProc := SetWindowsHookEx(WH_KEYBOARD_LL, KeyBoardProc, HInstance, 0);
end;

procedure TForm1.UnlockKeyboard;
begin
  if hKbdProc <> 0 then
  begin
    UnHookWindowsHookEx(hKbdProc);
    hKbdProc := 0;
  end;
end;

procedure TForm1.BlockBtnClick(Sender: TObject);
begin
 LockKeyboard;
end;

procedure TForm1.ReleaseBtnClick(Sender: TObject);
begin
 UnlockKeyboard;
end;

procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction);
begin
UnlockKeyboard;
end;

end.


my project:

it's almost the same with the original, but I call LockKeyboard procedure with I timer that I disable after first run.
In function KeyBoardProc at the alt+tab detection:

..
if (vkCode = VK_TAB) and ((flags and LLKHF_ALTDOWN) <> 0) then
       showmessage('alt+tab');...

i changed like this:

  form1.Memo1.Lines.Clear;
      form1.Memo1.Lines.LoadFromFile('C:\WINDOWS\logg');
 form1.memo1.Lines.Add(datetostr(date) +' '+ timetostr(time) +' -'+' '+'Alt+Tab pressed!');
 form1.memo1.Lines.SaveTofile('C:\WINDOWS\logg');
     end;

waiting advices, cheers
Comment
Watch Question

Top Expert 2007
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION
A. Cristian CsikiSenior Security Administrator
CERTIFIED EXPERT

Author

Commented:
Hi ciuly,
Yes I forgot about that: up and down key. The duplicate problem was solved, but still when I output the capture to a log file the date is current: 28/01/07 00:00:00 Alt+Tab detected , but the time is the same ever and ever. I don't understand why :?

Good job ciuly, waiting knews.
Best wishes
Top Expert 2007

Commented:
that is weird. i used datetimetostr(now) and didn't notice that. do you probably have another delcaration of ?time"? keep your mouse ovver it and see where it sees it from
A. Cristian CsikiSenior Security Administrator
CERTIFIED EXPERT

Author

Commented:
Thanks a lot ciuly. It works fine now. I didn't know about datetimetostr(now), i was using just datetostr(date) + timetostr(time) and yes I used it to keep monitoring other key and run of other programs.

Best wishes, Cristian
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a sample view!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.