禁止 拦击 关机 重启 注销 事件
文章转自王牌软件
站长推荐:NSetup一键部署软件
一键式完成美化安装包制作，自动增量升级，数据统计，数字签名。应对各种复杂场景，脚本模块化拆分，常规复杂的脚本代码，图形化设置。无需专业的研发经验，轻松完成项目部署。(www.nsetup.cn)
只回答业务咨询
站长推荐:NSetup一键部署软件
一键式完成美化安装包制作，自动增量升级，数据统计，数字签名。应对各种复杂场景，脚本模块化拆分，常规复杂的脚本代码，图形化设置。无需专业的研发经验，轻松完成项目部署。(www.nsetup.cn)
前段时间 有个项目需要此功能，貌似国内没人放出完整的例子
新建 DLL 动态库 工程名 InterceptShutdown
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
//新建 InterceptShutdown.h #if !defined __INTERCEPTSHUTDOWN__H #define __INTERCEPTSHUTDOWN__H #define INJECT_EX_EXPORTS #ifdef INJECT_EX_EXPORTS #define HOOKDLL_API __declspec(dllexport) #else #define HOOKDLL_API __declspec(dllimport) #endif #include <mapidefs.h> typedef struct _APIHOOK32_ENTRY { LPCTSTR pszAPIName; //API名字 LPCTSTR pszCallerModuleName; //被调用的模块名 PROC pfnOriginApiAddress; //原始的函数地址 PROC pfnDummyFuncAddress; //新的函数地址 HMODULE hModCallerModule; //调用的模块句柄 }APIHOOK32_ENTRY, *PAPIHOOK32_ENTRY; PROC lpAdder; APIHOOK32_ENTRY pe; HOOKDLL_API int InstallHook(); HOOKDLL_API int UninstallHook(); #endif // !defined(INJECT_EX__H) |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 |
//新建 InterceptShutdown.cpp #include "InterceptShutdown.h" #include <windows.h> #include <imagehlp.h> #include <tlhelp32.h> //odbc32.lib odbccp32.lib ImageHlp.lib #pragma comment(lib, "odbc32.lib") #pragma comment(lib, "odbccp32.lib") #pragma comment(lib, "ImageHlp.lib") //------------------------------------------------------------- // shared data // Notice: seen by both: the instance of "HookInjEx.dll" mapped // into "explorer.exe" as well as by the instance // of "HookInjEx.dll" mapped into our "HookInjEx.exe" #pragma data_seg("mydata") HHOOK glhHook=NULL;//安装的勾子句柄 //HINSTANCE glhInstance=NULL; //DLL实例句柄 #pragma data_seg() #pragma comment(linker,"/SECTION:mydata,RWS") //------------------------------------------------------------- // global variables (unshared!) // HINSTANCE glhInstance=NULL; //DLL实例句柄 LRESULT HookProc(int code, // hook code WPARAM wParam, // removal option LPARAM lParam // message ) { return CallNextHookEx(glhHook,code,wParam,lParam); } BOOL WINAPI _SetApiHookUp(PAPIHOOK32_ENTRY phk) { PIMAGE_THUNK_DATA pThunk; ULONG size; //获取指向PE文件中的Import中IMAGE_DIRECTORY_DESCRIPTOR数组的指针 PIMAGE_IMPORT_DESCRIPTOR pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(phk->hModCallerModule, TRUE, IMAGE_DIRECTORY_ENTRY_IMPORT,&size); if (pImportDesc == NULL) return FALSE; //查找记录,察看导入表中是否存指定的DLL for (;pImportDesc->Name;pImportDesc++) { LPSTR pszDllName = (LPSTR)((PBYTE)phk->hModCallerModule+pImportDesc->Name); if (lstrcmpiA(pszDllName,phk->pszCallerModuleName) == 0) break; } if (pImportDesc->Name ==NULL) return FALSE; //寻找我们想要的函数 pThunk = (PIMAGE_THUNK_DATA) ((PBYTE)phk->hModCallerModule+pImportDesc->FirstThunk);//IAT // pThunk = (PIMAGE_THUNK_DATA) ((PBYTE)phk->hModCallerModule+pImportDesc->OriginalFirstThunk); for (;pThunk->u1.Function;pThunk++) { //ppfn记录了与IAT表项相应的函数的地址 PROC *ppfn= (PROC *)&pThunk->u1.Function; if (*ppfn == phk->pfnOriginApiAddress) { //如果地址相同，也就是找到了我们想要的函数，进行改写，将其指向我们所定义的函数 WriteProcessMemory(GetCurrentProcess(),ppfn,&(phk->pfnDummyFuncAddress),sizeof(phk->pfnDummyFuncAddress),NULL); return TRUE; } } return FALSE; } //***************************************************************************************/ // SetWindowsAPIHook 挂接WindowsAPI函数 当phk->hModCallerModule == NULL // // 会在整个系统内挂接函数 // // 仿照SetWindowsHookEx 建立 // //***************************************************************************************// BOOL WINAPI SetWindowsAPIHook(PAPIHOOK32_ENTRY phk) { MEMORY_BASIC_INFORMATION mInfo; HMODULE hModHookDLL; HANDLE hSnapshot; BOOL bOk; MODULEENTRY32 me = {sizeof(MODULEENTRY32)}; if (phk->pszAPIName == NULL || phk->pszCallerModuleName == NULL || phk->pfnOriginApiAddress == NULL) return FALSE; if (phk->hModCallerModule == NULL) { VirtualQuery(_SetApiHookUp,&mInfo,sizeof(mInfo)); hModHookDLL=(HMODULE)mInfo.AllocationBase; hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,0); bOk = Module32First(hSnapshot,&me); while (bOk) { if (me.hModule != hModHookDLL) { phk->hModCallerModule = me.hModule; _SetApiHookUp(phk); } bOk = Module32Next(hSnapshot,&me); } phk->hModCallerModule = NULL; return TRUE; } else return _SetApiHookUp(phk); return FALSE; } BOOL WINAPI UnhookWindowsAPIHooks(PAPIHOOK32_ENTRY lpHk) { PROC temp; temp = lpHk->pfnOriginApiAddress; lpHk->pfnOriginApiAddress = lpHk->pfnDummyFuncAddress; lpHk->pfnDummyFuncAddress = temp; return SetWindowsAPIHook(lpHk); } BOOL WINAPI MyExitWindowsEx( UINT uFlags, // shutdown operation DWORD dwReserved // reserved ) { //MessageBox(NULL,"不能重起！！！","提示",MB_OKCANCEL); return FALSE; } int InstallHook() { glhHook = SetWindowsHookEx( WH_GETMESSAGE,(HOOKPROC)HookProc,glhInstance, 0); if( glhHook==NULL ) return 0; return 1; } int UninstallHook() { if(!UnhookWindowsAPIHooks(&pe) || !UnhookWindowsHookEx(glhHook)) return 0; return 1; } //------------------------------------------------------------- // DllMain // BOOL APIENTRY DllMain( HINSTANCE hModule, DWORD ul_reason_for_call, LPVOID lpReserved ) { if (ul_reason_for_call == DLL_PROCESS_ATTACH) { glhInstance=hModule; // MessageBox(NULL,"不能重起！！！","提示",MB_OKCANCEL); // showup(); pe.pszAPIName ="ExitWindowsEx"; //API名字 pe.pszCallerModuleName="user32.dll"; //被调用的模块名 pe.pfnOriginApiAddress=(PROC)ExitWindowsEx; //原始的函数地址 pe.pfnDummyFuncAddress=(PROC)MyExitWindowsEx; //新的函数地址 pe.hModCallerModule =NULL; lpAdder=(PROC)ExitWindowsEx; SetWindowsAPIHook(&pe); } return(TRUE); } |
|
1 2 3 4 5 6 7 |
//新建 InterceptShutdown.def LIBRARY "InterceptShutdown" DESCRIPTION 'Intercept shutdown restart' EXPORTS InstallHook UninstallHook |
学习日记，兼职软件设计，软件修改，毕业设计。
本文出自 学习日记，转载时请注明出处及相应链接。
本文永久链接: https://www.softwareace.cn/?p=120
