井泉

LRESULT CALLBACK fnHookWindowProc(HWND hwnd,UINT msg,WPARAM wparam, LPARAM lparam);

int __declspec(dllexport) WINAPI fnAttachWinProc(HWND ni_hAttatchWin,PVOID ,PVOID,PVOID);

int __declspec(dllexport) WINAPI fnDetachWinMsgProc(HWND ni_hDetachWin);

WNDPROC tpOldWindowProc;

FILE *m_pDebugOutputFile;

//將一個(gè)窗體消息處理掛接到net精簡(jiǎn)版MessageWindow對(duì)象上的代碼
typedef struct
{
　WNDPROC OldWinProc;//保留窗體原始消息處理過(guò)程的函數(shù)指針
　HWND WindowHandle;//保存net精簡(jiǎn)版中對(duì)應(yīng)的窗口掛接的MessageWindow對(duì)象的句柄
} DEFUDT_AttachWinInfo; //end struct

CMap<HWND,HWND,DEFUDT_AttachWinInfo,DEFUDT_AttachWinInfo> m_aAttachWinInfoMap;

//對(duì)指定的窗口進(jìn)程進(jìn)行掛接
int __declspec(dllexport) WINAPI fnAttachWinProc(HWND ni_hAttatchWin,
PVOID ni_0,
PVOID ni_1,
PVOID ni_2 )
{
　DEFUDT_AttachWinInfo tudtAttachWinInfo;
　m_pDebugOutputFile = fopen("\\Storage Card\\WinProcInfo.txt", "w");
　WNDPROC tpOldWindowProc=(WNDPROC)::SetWindowLong(ni_hAttatchWin, GWL_WNDPROC,(LONG) fnHookWindowProc );
　fprintf(m_pDebugOutputFile,"Attatch successfully! OldWindowProc: %08X\n",tpOldWindowProc);
　tudtAttachWinInfo.OldWinProc=tpOldWindowProc ;
　tudtAttachWinInfo.WindowHandle=ni_hAttatchWin;
　m_aAttachWinInfoMap.SetAt(ni_hAttatchWin,tudtAttachWinInfo);
　fclose(m_pDebugOutputFile);
　return 77;// (int)tpOldWindowProc ;
}//end function

int __declspec(dllexport) WINAPI fnDetachWinMsgProc(HWND ni_hDetachWin)
{
　DEFUDT_AttachWinInfo tudtAttachWinInfo;
　WNDPROC tpOldWindowProc;

　//取得在ncf中消息接收窗口對(duì)應(yīng)的原始消息處理函數(shù)的函數(shù)指針
　m_aAttachWinInfoMap.Lookup(ni_hDetachWin,tudtAttachWinInfo) ;

　//將窗體的消息處理函數(shù)設(shè)為默認(rèn)的處理過(guò)程
　tpOldWindowProc =(WNDPROC) SetWindowLong(ni_hDetachWin,GWL_WNDPROC , (LONG)tudtAttachWinInfo.OldWinProc);

　//將掛接信息消息處理映謝類(lèi)中刪除
　m_aAttachWinInfoMap.RemoveKey(ni_hDetachWin);

　return (int)tpOldWindowProc ;

}//end function

LRESULT CALLBACK fnHookWindowProc(HWND hwnd,UINT msg,WPARAM wparam, LPARAM lparam)
{
　DEFUDT_AttachWinInfo tudtAttachWinInfo;
　m_aAttachWinInfoMap.Lookup(hwnd,tudtAttachWinInfo) ;
　m_pDebugOutputFile = fopen("\\Storage Card\\WinProcInfo.txt", "a");
　if (m_pDebugOutputFile!=NULL)
　{
　　fprintf(m_pDebugOutputFile,"HWND: %08X Msg: %08X Wparam %08X Lparam %08X \n",
hwnd,msg,wparam,lparam);

　}//EHD IF

　fclose(m_pDebugOutputFile);
　//tudtAttachWin=maatt
　LRESULT tobjResult= ::CallWindowProc(tudtAttachWinInfo.OldWinProc ,hwnd,msg,wparam,lparam);
　return tobjResult;
}//end function

int m_hTargetWindow;//要掛接的目標(biāo)窗體句柄
IntPtr m_hTargetProcess;//目標(biāo)窗體所屬的進(jìn)程
IntPtr m_hModule; //掛接DLL的句柄

private void Form1_Load(object sender, EventArgs e)
{
　IntPtr tpTemp = IntPtr.Zero, tpTempa = IntPtr.Zero;
　uint tuntApiRet;

　m_hTargetWindow = (int)clsCECoreAPI.FindWindow("Explore", null );//資源管理器 0x0013e800;

　//掛接指定的進(jìn)程窗體消息
　IntPtr thCurrentProcess = clsCECoreAPI.GetCurrentProcess();
　m_hTargetProcess=IntPtr.Zero ;// (IntPtr) (unchecked((int)0xedd84e4a));
　tuntApiRet= clsCECoreAPI.GetWindowThreadProcessId(new IntPtr(unchecked((int) m_hTargetWindow)),
ref m_hTargetProcess);

　string tstrArgument;
　tstrArgument = "\\Program Files\\processinject\\HookWindowsProcMFCDLL.dll";// HookWindowsProcMFCDLL.dll";
　IntPtr tpArg0;

　int tintOriginalKMode = clsCECoreAPI.SetKMode(1);
　int tintOriginalProcPermission = (int)clsCECoreAPI.SetProcPermissions(0xffffffff);

　IntPtr tpFuncProc = clsCECoreAPI.GetProcAddress(clsCECoreAPI.GetModuleHandle("coredll.dll"), "LoadLibraryW");

　CallBackInfo tudtCALLBACKINFO;

　tpArg0 = clsCECoreAPI.MapPtrToProcess(tstrArgument, thCurrentProcess);

　tudtCALLBACKINFO.hProc = m_hTargetProcess;// Proc;
　tudtCALLBACKINFO.pfn = clsCECoreAPI.MapPtrToProcess(tpFuncProc, m_hTargetProcess);
　tudtCALLBACKINFO.pvArg0 = tpArg0;
　m_hModule =new IntPtr(unchecked(
(int) clsCECoreAPI.PerformCallBack4(ref tudtCALLBACKINFO,IntPtr.Zero,IntPtr.Zero,IntPtr.Zero )));
　//clsCECoreAPI.Sleep(1000);

　IntPtr thModule = clsCECoreAPI.LoadLibrary("HookWindowsProcMFCDLL.dll");
　tpFuncProc = clsCECoreAPI.GetProcAddress(thModule, "fnAttachWinProc");

　tpArg0 = (IntPtr) m_hTargetWindow;// clsCECoreAPI.MapPtrToProcess(ref thTargetWindow, thCurrentProcess);

　tudtCALLBACKINFO.hProc = m_hTargetProcess;
　tudtCALLBACKINFO.pfn = clsCECoreAPI.MapPtrToProcess(tpFuncProc, m_hTargetProcess);
　tudtCALLBACKINFO.pvArg0 = tpArg0 ;
　tuntApiRet = clsCECoreAPI.PerformCallBack4(ref tudtCALLBACKINFO,IntPtr.Zero,IntPtr.Zero,IntPtr.Zero );
　//clsCECoreAPI.Sleep(5000);
}

[DllImport("HookWindowsProcMFCDLL.dll")]
public static extern int fnAttachWinProc(IntPtr ni_hAttatchWin);

[DllImport("HookWindowsProcMFCDLL.dll")]
public static extern int fnDetachWinMsgProc(IntPtr ni_hDetachWin);