这是我的钩子过程,每当我试图读取存储在CBTHOOKCREATE->lpcs->lpszName中的名称时,它都会遇到垃圾值,例如:
79 77A064700 Created!~
0 00F915BC0 Created!~
68 000DF5BC0 Created!~
0 00F915BC0 Created!~
0 00F915BC0 Created!~
67 7630D8200 Created!~
77 000DEF340 Created!~
79 77A064700 Created!~ 这同样适用于lpszClass。关于取消引用lparam,有没有什么我应该做的,但还没有做的!?
这就是我们讨论的函数:
LRESULT CALLBACK HookProcedure(int nCode, WPARAM wparam, LPARAM lparam)
{
if (nCode < 0) return CallNextHookEx(hookID, nCode, wparam, lparam);
std::ofstream outfile;
CBT_CREATEWND *CBTHOOKCREATE;
RECT *CBTRECTPTR;
RECT CBTRECT;
wstring Message;
CBTHOOKCREATE = (CBT_CREATEWND*) lparam;
LPWSTR str = L" ";
outfile.open(("d:\\test.txt"), std::ios_base::app);
if (nCode >= 0) {
switch (nCode)
{
case HCBT_CREATEWND:
outfile << *(CBTHOOKCREATE->lpcs->lpszName) << " " << CBTHOOKCREATE->lpcs->lpszName << " Created!~ " << endl;
//cout << "Created!~" << endl;
break;
case HCBT_DESTROYWND:
outfile << "Destroied!~" << endl;
//cout << "Destroied!~" << endl;
break;
default:
//cout << "sth else" << endl;
break;
}
}
outfile.close();
return 0;
}发布于 2013-12-14 21:40:19
*strong text*尝试在wParam中使用带有窗口句柄的IsWindowUnicode。如果窗口是Unicode窗口,lpcs指向一个CREATESTRUCTW结构,lpszName指向一个宽字符串,您必须对其进行转换。
将以下代码添加到DLL CPP文件的顶部。
std::string wc2s( const wchar_t * pw ) {
int length = (int)wcslen( pw ) + 1;
int newlen = WideCharToMultiByte( CP_ACP, 0, pw, length, 0, 0, 0, 0 );
std::string r( newlen , '\0' );
WideCharToMultiByte( CP_ACP, 0, pw, length, &r[0], newlen, 0, 0 );
return r;
}对传递给CreateWindow的文本使用以下代码
case HCBT_CREATEWND: {
CBT_CREATEWND * pCBT_CW = (CBT_CREATEWND *)lParam;
std::string strCreatText;
if ( pCBT_CW->lpcs->lpszName != NULL ) {
if ( IsWindowUnicode( (HWND)wParam ) ) {
strCreatText = wc2s( pCBT_CW->lpcs->lpszName );
} else {
strCreatText = (char*)pCBT_CW->lpcs->lpszName;
}
}
outfile << strCreatText << " Created!~ " << endl;
break;
}PS:未测试
更新:根据IInspectable评论。非侵入式钩子必须遵循CallNextHookEx的一般规则:返回CallNextHookEx返回的内容。
LRESULT CALLBACK HookProcedure(int nCode, [...]
if ( nCode >= 0 ) {
[...]
}
return CallNextHookEx(NULL, nCode, wparam, lparam);
}https://stackoverflow.com/questions/20583493
复制相似问题