求Hook 系统函数的例子!

Question

我查了以前的贴子，大部分都是Hook系统消息的例子，我想Hook一个系统函数。
如只要系统调用了StartDoc()函数，我的程序都能截取到此函数，然后调用我自已的过程。请给出一个实例。
我的email:[email protected]
谢!
我想肯定很多人都有此问题需要问的，请大家帮忙解答!

Answer 1

unit Unit1;
 
interface
 
uses
  Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,
  StdCtrls;
 
type
  TForm1 = class(TForm)
  Button1: TButton;
  Button2: TButton;
  Button3: TButton;
  Edit1: TEdit;
  Button4: TButton;
  procedure FormCreate(Sender: TObject);
  procedure Button1Click(Sender: TObject);
  procedure Button2Click(Sender: TObject);
  procedure Button3Click(Sender: TObject);
  private
  { Private declarations }
  public
  { Public declarations }
  end;
 
var
  Form1: TForm1;  EventArr:array[0..1000]of EVENTMSG;
  EventLog:Integer;
  PlayLog:Integer;
  hHook,hPlay:Integer;
  recOK:Integer;
  canPlay:Integer;
  bDelay:Bool;
implementation{$R *.DFM}
Function PlayProc(iCode:Integer;wParam:wParam;lParam:lParam):LRESULT;stdcall;
begin
  canPlay:=1;
  Result:=0;
 
  if iCode < 0 then //必须将消息传递到消息链的下一个接受单元
  Result := CallNextHookEx(hPlay,iCode,wParam,lParam)
  else if iCode = HC_SYSMODALON then
  canPlay:=0
  else if iCode = HC_SYSMODALOFF then
  canPlay:=1
  else if ((canPlay =1 )and(iCode=HC_GETNEXT)) then begin
  if bDelay then begin
  bDelay:=False;
  Result:=50;
  end;
  pEventMSG(lParam)^:=EventArr[PlayLog];
  end
  else if ((canPlay = 1)and(iCode = HC_SKIP))then begin
  bDelay := True;
  PlayLog:=PlayLog+1;
  end;
  if PlayLog>=EventLog then begin
  UNHookWindowsHookEx(hPlay);
  end;
end;function HookProc(iCode:Integer;wParam:wParam;lParam:lParam):LRESULT;stdcall;
begin
  recOK:=1;
  Result:=0;
 
  if iCode < 0 then
  Result := CallNextHookEx(hHook,iCode,wParam,lParam)
  else if iCode = HC_SYSMODALON then
  recOK:=0
  else if iCode = HC_SYSMODALOFF then
  recOK:=1
  else if ((recOK>0) and (iCode = HC_ACTION)) then begin
  EventArr[EventLog]:=pEventMSG(lParam)^;
  EventLog:=EventLog+1;  if EventLog>=1000 then begin
  UnHookWindowsHookEx(hHook);
  end;
  end;
end;
 
procedure TForm1.FormCreate(Sender: TObject);
begin
  Button1.Caption:='纪录';
  Button2.Caption:='停止';
  Button3.Caption:='回放';
  Button4.Caption:='范例';
  Button2.Enabled:=False;
  Button3.Enabled:=False;
end;
 
procedure TForm1.Button1Click(Sender: TObject);
begin
  EventLog:=0;
  //建立键盘鼠标操作消息纪录链
  hHook:=SetwindowsHookEx(WH_JOURNALRECORD,HookProc,HInstance,0);
  Button2.Enabled:=True;
  Button1.Enabled:=False;
end;
 
procedure TForm1.Button2Click(Sender: TObject);
begin
  UnHookWindowsHookEx(hHook);
  hHook:=0;
 
  Button1.Enabled:=True;
  Button2.Enabled:=False;
  Button3.Enabled:=True;
end;
 
procedure TForm1.Button3Click(Sender: TObject);
begin
  PlayLog:=0;
  //建立键盘鼠标操作消息纪录回放链
  hPlay:=SetwindowsHookEx(WH_JOURNALPLAYBACK,PlayProc,
  HInstance,0);
 
  Button3.Enabled:=False;
end;
 
end.

Answer 2

unit Unit1;
 
interface
 
uses
  Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,
  StdCtrls;
 
type
  TForm1 = class(TForm)
  Button1: TButton;
  Button2: TButton;
  Button3: TButton;
  Edit1: TEdit;
  Button4: TButton;
  procedure FormCreate(Sender: TObject);
  procedure Button1Click(Sender: TObject);
  procedure Button2Click(Sender: TObject);
  procedure Button3Click(Sender: TObject);
  private
  { Private declarations }
  public
  { Public declarations }
  end;
 
var
  Form1: TForm1;  EventArr:array[0..1000]of EVENTMSG;
  EventLog:Integer;
  PlayLog:Integer;
  hHook,hPlay:Integer;
  recOK:Integer;
  canPlay:Integer;
  bDelay:Bool;
implementation{$R *.DFM}
Function PlayProc(iCode:Integer;wParam:wParam;lParam:lParam):LRESULT;stdcall;
begin
  canPlay:=1;
  Result:=0;
 
  if iCode < 0 then //必须将消息传递到消息链的下一个接受单元
  Result := CallNextHookEx(hPlay,iCode,wParam,lParam)
  else if iCode = HC_SYSMODALON then
  canPlay:=0
  else if iCode = HC_SYSMODALOFF then
  canPlay:=1
  else if ((canPlay =1 )and(iCode=HC_GETNEXT)) then begin
  if bDelay then begin
  bDelay:=False;
  Result:=50;
  end;
  pEventMSG(lParam)^:=EventArr[PlayLog];
  end
  else if ((canPlay = 1)and(iCode = HC_SKIP))then begin
  bDelay := True;
  PlayLog:=PlayLog+1;
  end;
  if PlayLog>=EventLog then begin
  UNHookWindowsHookEx(hPlay);
  end;
end;function HookProc(iCode:Integer;wParam:wParam;lParam:lParam):LRESULT;stdcall;
begin
  recOK:=1;
  Result:=0;
 
  if iCode < 0 then
  Result := CallNextHookEx(hHook,iCode,wParam,lParam)
  else if iCode = HC_SYSMODALON then
  recOK:=0
  else if iCode = HC_SYSMODALOFF then
  recOK:=1
  else if ((recOK>0) and (iCode = HC_ACTION)) then begin
  EventArr[EventLog]:=pEventMSG(lParam)^;
  EventLog:=EventLog+1;  if EventLog>=1000 then begin
  UnHookWindowsHookEx(hHook);
  end;
  end;
end;
 
procedure TForm1.FormCreate(Sender: TObject);
begin
  Button1.Caption:='纪录';
  Button2.Caption:='停止';
  Button3.Caption:='回放';
  Button4.Caption:='范例';
  Button2.Enabled:=False;
  Button3.Enabled:=False;
end;
 
procedure TForm1.Button1Click(Sender: TObject);
begin
  EventLog:=0;
  //建立键盘鼠标操作消息纪录链
  hHook:=SetwindowsHookEx(WH_JOURNALRECORD,HookProc,HInstance,0);
  Button2.Enabled:=True;
  Button1.Enabled:=False;
end;
 
procedure TForm1.Button2Click(Sender: TObject);
begin
  UnHookWindowsHookEx(hHook);
  hHook:=0;
 
  Button1.Enabled:=True;
  Button2.Enabled:=False;
  Button3.Enabled:=True;
end;
 
procedure TForm1.Button3Click(Sender: TObject);
begin
  PlayLog:=0;
  //建立键盘鼠标操作消息纪录回放链
  hPlay:=SetwindowsHookEx(WH_JOURNALPLAYBACK,PlayProc,
  HInstance,0);
 
  Button3.Enabled:=False;
end;
 
end.

Answer 3

zjqyb(风清扬*任它溺水三千,我只取一瓢饮*)
系统Func的Hook与Mouse,Keyboard的Hook有不同。
year2000bug(独孤不败) 
感谢你的例程，但好象只能对自已的程序起作用，不能对系统所有的程序起到作用。不过还是结帐。