Posted on 2009-11-16 22:45
S.l.e!ep.￠% 閱讀(165)
評論(0) 編輯 收藏 引用 所屬分類:
RootKit
接著
About ShutDown of Windows（一）在網上看到很多掛接 ExitWindowsEx 的方法，主要還是 SetHook，于是復習下全局鉤子的東東
Create了一個 HookTest 的 Project
LRESULT?CALLBACK?MyKeyHook(int?code,?WPARAM?wParam,?LPARAM?lParam)
{
????return?1;
}??????
BOOL?CHookTestDlg::OnInitDialog()
{
????CDialog::OnInitDialog();
????//?Add?"About
"?menu?item?to?system?menu.
????//?IDM_ABOUTBOX?must?be?in?the?system?command?range.
????ASSERT((IDM_ABOUTBOX?&?0xFFF0)?==?IDM_ABOUTBOX);
????ASSERT(IDM_ABOUTBOX?<?0xF000);
????CMenu*?pSysMenu?=?GetSystemMenu(FALSE);
????if?(pSysMenu?!=?NULL)
????{
????????CString?strAboutMenu;
????????strAboutMenu.LoadString(IDS_ABOUTBOX);
????????if?(!strAboutMenu.IsEmpty())
????????{
????????????pSysMenu->AppendMenu(MF_SEPARATOR);
????????????pSysMenu->AppendMenu(MF_STRING,?IDM_ABOUTBOX,?strAboutMenu);
????????}
????}
????//?Set?the?icon?for?this?dialog.??The?framework?does?this?automatically
????//??when?the?application's?main?window?is?not?a?dialog
????SetIcon(m_hIcon,?TRUE);????????????//?Set?big?icon
????SetIcon(m_hIcon,?FALSE);????????//?Set?small?icon
????
????//?TODO:?Add?extra?initialization?here
#ifndef?WH_KEYBOARD_LL
????#define?WH_KEYBOARD_LL?????13
#endif
????SetWindowsHookEx(WH_KEYBOARD_LL,?MyKeyHook,?AfxGetApp()->m_hInstance,?0);
????
????return?TRUE;??//?return?TRUE??unless?you?set?the?focus?to?a?control
} 網上的資料說，需要把 SetWindowsHookEx? 的部份寫入一個DLL，否則不起作用
實際嘗試了一下，上述的代碼可以屏蔽鍵盤，但對于 Ctrl + Atl +Del 鍵是不起作用的