怎样拦截关机（包括注销、重起）？

[weigang2002]

我在PreTranslateMessage中拦截WM_QUERYENDSESSION为什么没有反应？

[kingzai]

you should hook "ExitWindowsEx" API.

[weigang2002]

怎样hook ExitWindowsEx,
它是在系统的那个dll中呢?

[kingzai]

http://expert.csdn.net/Expert/topic/1553/1553525.xml?temp=.2279322

[weigang2002]

我已经捕捉到ExitWindowsEx了，但我直接在新函数中return true时，为什么非法操作？

[kingzai]

you should return previous function address.

[weigang2002]

我想不让它继续执行关机ExitWindowsEx，就是不让系统关机怎么办呢？
该return什么？

[kingzai]

you can try use the API call on Windows NT, this is what I find on the
Platform SDK

Platform SDK:

AbortSystemShutdown
The AbortSystemShutdown function stops a system shutdown started by using
the InitiateSystemShutdown function.

BOOL AbortSystemShutdown(
LPTSTR lpMachineName // pointer to name of computer to stop
// shutting down
);

Parameters
lpMachineName
Pointer to the null-terminated string that specifies the network name of the
computer where the shutdown is to be stopped. If lpMachineName is NULL or
points to an empty string, the function stops the shutdown on the local
computer.
Return Values
If the function succeeds, the return value is nonzero.

If the function fails, the return value is zero. To get extended error
information, callGetLastError.

Remarks
The InitiateSystemShutdown function displays a dialog box that notifies the
user that the system is shutting down. During the InitiateSystemShutdown
time-out period, the AbortSystemShutdown function can prevent the system
from shutting down.

To stop the local computer from shutting down, the calling process must have
the SE_SHUTDOWN_NAME privilege. To stop a remote computer from shutting
down, the calling process must have the SE_REMOTE_SHUTDOWN_NAME privilege on
the remote computer. By default, users can enable the SE_SHUTDOWN_NAME
privilege on the computer they are logged onto, and administrators can
enable the SE_REMOTE_SHUTDOWN_NAME privilege on remote computers.

Common reasons for failure include an invalid computer name, an inaccessible
computer, or insufficient privilege.

QuickInfo
Windows NT: Requires version 3.1 or later.
Windows: Unsupported.
Windows CE: Unsupported.
Header: Declared in winreg.h.
Import Library: Use advapi32.lib.
Unicode: Implemented as Unicode and ANSI versions on Windows NT.

[winphoenix]

upupup

[zhshly007]

向系统放一个钩子，用钩子拦截关机消息。。。。

[weigang2002]

还是不会
那位大侠能给个拦截ExitWindowsEx的代码，一定给100分！
up
up
up
up
up