［Help］钩子函数钩不到shutdown, logoff, restart事件

Question

Winlogon Notification 这个好用
http://www.05112.com/Article/article2/hacktools/200611/9172.html
http://msdn2.microsoft.com/en-us/library/aa380545.aspxhttp://blog.csdn.net/iiprogram/archive/2007/10/10/1818126.aspx

Answer 1

谢谢你提供的链接，看了一下。
不是说：Windows NT and Windows Me/98/95:  Winlogon notification packages are not supported.通用的办法，有没有？

Answer 2

WM_WTSSESSION_CHANGE // 这个与上面的差不多，但要好像XP以后WM_USERCHANGED 这个可以得到LOGON 或LOGOFF，关机就不知道了

Answer 3

钩API
ExitWindow, ExitWindowEx, InitiateSystemShutdown, InitiateSystemShutdownEx

Answer 4

DentistryDoctor, 怎么操作？SetWindowsHookEx没有用过。函数原型：
HHOOK SetWindowsHookEx(
  int idHook,        // hook type
  HOOKPROC lpfn,     // hook procedure
  HINSTANCE hMod,    // handle to application instance
  DWORD dwThreadId   // thread identifier
);第三个参数hMod指向ExitWindow,   ExitWindowEx,   InitiateSystemShutdown,   InitiateSystemShutdownEx的实例吗？

Answer 5

第一个参数是钩子的类型；第二个参数是钩子函数的地址；第三个参数是包含钩子函数的模块句柄；第四个参数指定监视的线程。
如何钩住API ExitWindow,ExitWindowEx,InitiateSystemShutdown,InitiateSystemShutdownEx?? 

Answer 6

http://blog.joycode.com/zee/archive/2004/12/02/40284.aspx

Answer 7

检测shutdown,logoff,restart事件的目的是： 因为usb port一直不掉电，而应用程序跟usb设备通讯，希望在PC shutdown,logoff,restart时由应用程序发一个ioctl给usb设备，使得通讯重新初始化。

Answer 8

shunruo, 这两个消息能在MFC程序内处理么？WM_ENDSESSION
WM_QUERYENDSESSION
想重载消息处理函数，怎么找不到该函数？ （像PreTranslateMessage(MSG *pMsg)消息处理就可以重载实现。）

Answer 9

hMoniter=SetWindowsHookEx(WM_QUERYENDSESSION,(HOOKPROC)monitorProc,hIns,0);
并未能检测到shutdown,logoff,restart事件...点解 ??

Answer 10

用一个键盘钩子函数来改，编译时Link出错...Linking...
.\kbdHook.def : warning LNK4022: cannot find unique match for symbol "WindowProc"
.\kbdHook.def : warning LNK4002: "long __stdcall WindowProc(struct HWND__ *,unsigned int,unsigned int,long)" (?WindowProc@@YGJPAUHWND__@@IIJ@Z) defined in .\Debug\kbdHook.obj
.\kbdHook.def : warning LNK4002: "public: virtual long __thiscall CControlBar::WindowProc(unsigned int,unsigned int,long)" (?WindowProc@CControlBar@@UAEJIIJ@Z) defined in C:\WINDDK\2600.1106\LIB\WXP\I386\mfc42d.lib
.\kbdHook.def : warning LNK4002: "protected: virtual long __thiscall CReBar::WindowProc(unsigned int,unsigned int,long)" (?WindowProc@CReBar@@MAEJIIJ@Z) defined in C:\WINDDK\2600.1106\LIB\WXP\I386\mfc42d.lib
.\kbdHook.def : warning LNK4002: "protected: virtual long __thiscall CWnd::WindowProc(unsigned int,unsigned int,long)" (?WindowProc@CWnd@@MAEJIIJ@Z) defined in C:\WINDDK\2600.1106\LIB\WXP\I386\mfc42d.lib
.\kbdHook.def : warning LNK4002: "public: virtual long __thiscall COleControl::WindowProc(unsigned int,unsigned int,long)" (?WindowProc@COleControl@@UAEJIIJ@Z) defined in C:\WINDDK\2600.1106\LIB\WXP\I386\mfco42d.lib
.\kbdHook.def : warning LNK4002: "protected: virtual long __thiscall COlePropertyPage::WindowProc(unsigned int,unsigned int,long)" (?WindowProc@COlePropertyPage@@MAEJIIJ@Z) defined in C:\WINDDK\2600.1106\LIB\WXP\I386\mfco42d.lib
.\kbdHook.def : warning LNK4002: "public: virtual long __thiscall CParkingWnd::WindowProc(unsigned int,unsigned int,long)" (?WindowProc@CParkingWnd@@UAEJIIJ@Z) defined in C:\WINDDK\2600.1106\LIB\WXP\I386\mfco42d.lib
.\kbdHook.def : warning LNK4002: "protected: virtual long __thiscall CReflectorWnd::WindowProc(unsigned int,unsigned int,long)" (?WindowProc@CReflectorWnd@@MAEJIIJ@Z) defined in C:\WINDDK\2600.1106\LIB\WXP\I386\mfco42d.lib
LINK : fatal error LNK1152: cannot resolve one or more undecorated symbols
LINK : fatal error LNK1141: failure during build of exports file
Error executing link.exe.kbdHook.dll - 2 error(s), 9 warning(s)