Hooking / DLL injection

If the information is in the titlebar, enumerating the top level windows and grabbing the text from them surely is senseful doing.

Installing a hook is another game. You need all admin priviliges on a system and would need to care for not opening doors to malicious programs when doing so. Moreover, spying out data from users other than yourself without the users know that they were spied out is at least questionable and may be forbidden by national laws.

Well yu won't need admin privileges for a Windows hook that runs in your current session (global to that session or not), see http://msdn.microsoft.com/en-us/library/ms997537.aspx ("Win32 Hooks"). Tis also injects a DLL into all running (GUI) applicationsYou'd basically check for 'WM_SETTEXT' being sent to the handle of the window that you're monitoring. The scoop would be to

LRESULT CALLBACK HookProc  (       int             nCode,  // hook code
                                WPARAM  wParam, // removal flag 
                                LPARAM  lParam  // address of structure with message 
                            )
{
    PMSG        pmsg    =       ( PMSG) lParam;
 
    if  (       0       >       nCode   ||      PM_NOREMOVE     ==      wParam) 
        {
            return      (       CallNextHookEx  (       g_hhk,
                                            nCode,
                                            wParam,
                                            lParam
                                        )
                    );
        }
 
    if  (WM_STTEXT == pmsg->message && hWndToCheck == pwmg->hwnd)
        {
            /* this one is for us, so grab the new window title here */
        }
 
    return      (       CallNextHookEx  (       g_hhk,
                                    nCode,
                                    wParam,
                                    lParam
                                )
            );
}

Select allOpen in new window

>>>> Well yu won't need admin privileges for a Windows hook that runs in your current session
Is there no way to keep a trojan from installing a session hook?

No, what happens in your session with your session's priveleges is OK (from an OS point of view).

>>>> from an OS point of view
Windows is an OS?   ;-)

It is always striking to experience how many open doors a windows system has. Do you know a reason why this security hole wasn't fixed?

Here is the code my programmer has come up with and I appreciate any feedback, constructive critique etc.  BTW I am still not clear on when you would choose the hook over either of the createremotethread techinques mentioned.  i really appreciate your time and assistance and thought.  As stated above my goal is for each of my user sessions on a terminal server, to capture the text in the title bar of the apps that the user is using.

The code attached seems to be working.  It needs to be changed now from a dos to a background processes and tested more.  Also I am curious if there is an advantage to either createremotethread technique as presented in the link provided above by evilrix.

http://files.getdropbox.com/u/1461313/Development/HookingVersion.zip

thanks, gsgi

Whoops the link above was the build, here is the code:
http://files.getdropbox.com/u/1288178/TitleHook.zip

Thanks,
gsgi

Thanks.