如何在SYSTEM用户进程中侦听关机消息

[贪食蛇男]

在一个窗口程序中，只需要响应 WM_QUERYENDSESSION WM_ENDSESSION 消息即可侦听到关机。
MSDN说了：
Console applications can use the SetConsoleCtrlHandler function to receive shutdown notification.

Service applications can use the RegisterServiceCtrlHandlerEx function to receive shutdown notifications in a handler routine.

即是服务和控制台子系统都有方法侦测关机，但是一个不是服务的“SYSTEM用户下的进程”(如在服务中 CreateProcessW 直接创建的)我没有找到方法来侦听关机，我在这种进程中创建了窗口线程，但未收到 WM_QUERYENDSESSION 消息，同一时刻的普通SESSION下的进程用同样的方式可以侦听到。
求教如何在SYSTEM用户下进程中侦听关机。

[贪食蛇男]

引用 1 楼 zgl7903 的回复:

MSDN 的注释部分有说明 Console applications can use the SetConsoleCtrlHandler function to receive shutdown notification. Service applications can use the RegisterServiceCtrlHandlerEx function to receive shutdown notifications in a handler routine.

请仔细看题……RegisterServiceCtrlHandlerExW 必须在服务中，而我的问题是“普通”的进程，只是以SYSTEM身份运行，我已经试过 RegisterServiceCtrlHandlerEx 不传服务名会失败。

[zgl7903]

MSDN 的注释部分有说明 Console applications can use the SetConsoleCtrlHandler function to receive shutdown notification. Service applications can use the RegisterServiceCtrlHandlerEx function to receive shutdown notifications in a handler routine.

[贪食蛇男]

好了，我来公布是如何解决的吧，方法比较笨，用了轮询检查 GetSystemMetrics(SM_SHUTTINGDOWN); 放码：

#include <Windows.h>
#include <gdcommon/cpplug.h>

#define CLASS_NAME                      L"GdSessionMonWnd"

static HMODULE gs_hThisModule = NULL;
static DWORD gs_dwPlugType = PT_UNKNOWN;

BOOL WINAPI DllMain(HMODULE hThisModule, DWORD dwReason, LPVOID reserved)
{
    if (DLL_PROCESS_ATTACH == dwReason)
    {
        gs_hThisModule = hThisModule;
        DisableThreadLibraryCalls(hThisModule);
    }

    return TRUE;
}

static void _BroadcastSessionEnd()
{
    static DWORD s_dwLastNotify = 0;
    if (GetTickCount() - s_dwLastNotify > 10000)    // 10秒内可能出现多个，没必要广播多次
    {
        CPPLUGLOG_WARNW(L"向插件系统广播 PMC_SESSIONEND");
        CpPlugBroadcastNotify(PMC_SESSIONEND);
    }

    s_dwLastNotify = GetTickCount();
}

static LRESULT CALLBACK _WndProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
    if (uMsg == WM_QUERYENDSESSION)
    {
        _BroadcastSessionEnd();
    }

    return DefWindowProc(hwnd, uMsg, wParam, lParam);
}

static void WINAPI _MessageLoop()
{
    WNDCLASSEX wcex     = {sizeof(wcex)};
    wcex.lpszClassName  = CLASS_NAME;
    wcex.hInstance      = gs_hThisModule;
    wcex.lpfnWndProc    = _WndProc;
    wcex.style          = CS_HREDRAW | CS_VREDRAW;
    wcex.cbClsExtra     = 0;
    wcex.cbWndExtra     = 0;
    wcex.hIcon          = LoadIcon(NULL, MAKEINTRESOURCE(IDI_INFORMATION));
    wcex.hCursor        = LoadCursor(NULL, IDC_ARROW);
    wcex.hbrBackground  = (HBRUSH)GetStockObject(WHITE_BRUSH);

    if (RegisterClassExW(&wcex))
    {
        HWND hWindow = CreateWindowExW(
            0,
            CLASS_NAME,
            CLASS_NAME,
            WS_OVERLAPPEDWINDOW,
            0,
            0,
            0,
            0,
            NULL,
            NULL,
            gs_hThisModule,
            NULL
            );

        if (IsWindow(hWindow))
        {
            UpdateWindow(hWindow);

            MSG msg = {0};
            while (GetMessage(&msg, NULL, 0, 0))
            {
                TranslateMessage(&msg);
                DispatchMessage(&msg);
            }
        }
    }
}

static DWORD WINAPI _SessionMonThread(void* lpParam)
{
    if (PT_PROXY == gs_dwPlugType)
    {
        _MessageLoop();
    }
    else
    {
        for ( ; ;)
        {
            if (GetSystemMetrics(SM_SHUTTINGDOWN))
            {
                _BroadcastSessionEnd();
                break;
            }

            Sleep(SEC_TOMILLISEC(1));   // 快一点，可能有电脑关机特别迅速
        }
    }

    return 0;
}

BOOL WINAPI CpPlugStart(DWORD dwPlugType)
{
    gs_dwPlugType = dwPlugType;

    CPPLUGLOG_CLOSETHREAD(_SessionMonThread, NULL, L"SESSION监测线程");

    return TRUE;
}

// 32位服务插件
void WINAPI PR_b35bdb82() {}
// 32位代理插件
void WINAPI PR_5fe0a478() {}
// 64位服务插件
void WINAPI PR_26e6dcd5() {}
// 64位代理插件
void WINAPI PR_ca5da32f() {}