🔒 Locked

Windows Hook problem

Started by Burning_Ice May 13, 2003 at 11:23 AM 3 replies 550+ views

Original Post

May 13, 2003 at 11:23 AM

well i was playing around a bit with windows hooks and ran into a problem: i wanted to write a little prog that would run in the background and only allow certain programs to be run. (and no, i'm not trying to write a trojan or something, i just want a way to secure my pc from my sister, so she can only start the internet connection[so her pc can go online over the network] and not mess anything up when i'm not at home) anyway, i figured that a CBT Hook would do what i want, since it is called before a window gets created and can thus immediately stop the program. So far as installing the hook everything went fine and my CBTProc in the dll is called with code HCBT_CREATEWND whenever i start any programs. But my problem lies in finding out what program it is that is about to be started. According to the help files the way to access the info i want is to cast the LPARAM of the CBTProc callback to a CBT_CREATEWND*, which has a pointer to a LPCREATESTRUCT, which has a lpszClass member, which should be a pointer to the string with the class name. This works fine when i start notepad and some other small progs, but for some reason it crashes my computer whenever i open windows explorer (i'm on win98 btw) or the internet connection dialog. its always crashing in kernel32.dll or user32.dll, when i'm trying to access the lpszClass or lpszName string: casting and assigning the stringpointer works, but when i try a fprintf with the string or a strcmp then it crashes the computer and i have to reboot... its just looking like windows doesnt want to let me read the memory in which it keeps the class and name strings for windows explorer and other programs. so i would be really happy if someone knows whats going on and how i can get read-access to that simple string without crashing the computer.

[edited by - burning_ice on May 13, 2003 12:24:05 PM]

Dave Hunt

146

Dave Hunt

May 13, 2003 at 11:34 AM

You could try using the hInstance member to get the module file name (GetModuleFileName()). That would tell you what program was creating the window.

Nypyren

1,001

Nypyren

May 13, 2003 at 1:01 PM

[edited because I can't read]

Make sure your shared memory area isn't getting messed up somehow.

Is your injected DLL passing data back to your .exe to ask whether or not to kill a process?

[edited by - Nypyren on May 13, 2003 2:05:47 PM]

Burning_Ice

Author

Burning_Ice

May 13, 2003 at 1:08 PM

thanks for the idea, but again for some reason its only working with notepad.

but its getting weirder and weirder...
i have now reduced the whole callback to a messagebeep, an increment of a dll-static int and a file-append of the int.
now when i start notepad it beeps and for every time i start notepad it writes the counter(incremented each time) to file...but when i start explorer it only beeps! it just skips the whole file-write....no idea whats happening here

Edit: Nypyren: nope, right now i'm only trying to log program starts

[edited by - burning_ice on May 13, 2003 2:10:01 PM]

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.