{
win9X,NT,w2k 中的系統日志鉤子示例程序(Delphi 版)
-----------------------------------------------------
windows下的日志鉤子是一種很有用的HOOK類型，他不需要動態鏈接庫*.DLL，就能實現
系統級的事件監控,它只能監視兩種硬件的事件，即鼠標，鍵盤的操作，而不能監視其它
消息，被記錄的消息可以用日志回放鉤子將它還原，下面這個程序用Delphi設計，沒有
用delphi的控件，只用了win32 api，所以通用於Delphi的任何版本，當然你也可以用c
來實現,有看不懂的可以寫信給我，這是第一版，可能有BUG,大家發現了通知我一下，歡
迎大家和我一起來討論HOOK技術:
-----------------------------------------------------
First Created:njhhack 2001.6.14 (ver1.0)
電子信箱:[email protected]
主頁:hotsky.363.net
}
Program Journal;
//包含如下頭文件
uses windows,messages,sysutils;
{$r *.res} //使用資源文件
//定義一個新的結構類型
type
TWin = record
Msg:TMsg;
wClass:TWndClass;
hMain:integer;
lr:trect;
tem:TEVENTMSG;
end;
var
Win:TWin; //結構變量
HHJournalRecordProc:integer; //日志鉤子句柄
//將字符串str寫到文件c:key.txt中
procedure SaveInfo(str:string);stdcall;
var
f:textfile;
fname:string;
begin
fname:=c:key.txt;
assignfile(f,fname);
if fileexists(fname)=false then rewrite(f)
else append(f);
writeln(f,str);
closefile(f);
end;
//將信息寫到屏幕
procedure writestr;
var
hdc:integer;
str:string;
begin
hdc:=getdc(win.hmain);
RoundRect(hdc,10,10,240,140,12,8);
with win.tem do
begin
str:=format(窗口句柄=%x,[hwnd]);
textout(hdc,30,24*1,pchar(str),length(str));
str:=format(鼠標位置=(%d,%d),[paraml,paramh]);
textout(hdc,30,24*2,pchar(str),length(str));
str:=format(消息類型=%x,[message]);
textout(hdc,30,24*3,pchar(str),length(str));
str:=format(時間=%d,[time div 1000]);
textout(hdc,30,24*4,pchar(str),length(str));
end;
releasedc(win.hmain,hdc);
end;
//日志鉤子的回調函數
function JournalRecordProc(nCode:integer;wParam:WPARAM;lParam:LPARAM):LRESULT;stdcall;
begin
win.tem:=TEVENTMSG(PEVENTMSG(lParam)^);
if nCode>=0 then
begin
with win.tem do
begin
with win.lr do
begin
left:=10;
top:=10;
right:=240;
bottom:=140;
end;
InvalidateRect(win.hmain,@win.lr,false);
if message=wm_lbuttondown then
begin
SaveInfo(format(窗口句柄=%x,鼠標位置=(%d,%d),消息類型=WM_LBUTTONDOWN,時間=%d,[hwnd,paraml,paramh,time div 1000]));
end;
end;
end;
Result:=CallNextHookEx(HHJournalRecordProc,nCode,wParam,lParam); //調用下一個鉤子
end;
//鉤子設置和刪除函數
procedure SetHook(fSet:boolean);
begin
if fSet=true then
begin
if HHJournalRecordProc=0 then HHJournalRecordProc:=SetWindowsHookEx(WH_JOURNALRECORD,@JournalRecordProc,hinstance,0);
end else
begin
if HHJournalRecordProc<>0 then UnhookWindowsHookEx(HHJournalRecordProc);
end;
end;
//主程序的回調函數
function WindowProc(hWnd,Msg,wParam,lParam:longint):LRESULT; stdcall;
begin
Result:=DefWindowProc(hWnd,Msg,wParam,lParam);
case Msg of
wm_paint:writestr;
wm_destroy:begin SetHook(False);halt;end;
end;
end;
//主程序的執行函數
procedure run;stdcall;
begin
win.wClass.hInstance:= hInstance;
with win.wclass do
begin
hIcon:= LoadIcon(hInstance,MAINICON);
hCursor:= LoadCursor(0,IDC_ARROW);
hbrBackground:= COLOR_BTNFACE+1;
Style:= CS_PARENTDC;
lpfnWndProc:= @WindowProc;
lpszClassName:=JournalRecordHook;
end;
RegisterClass(win.wClass);
win.hmain:=CreateWindow(win.wClass.lpszClassName,系統日志鉤子演示程序,WS_VISIBLE or WS_OVERLAPPEDWINDOW,10,10,260,180,0,0,hInstance,nil);
SetHook(true);
while(GetMessage(win.Msg,win.hmain,0,0))do
begin
TranslateMessage(win.Msg);
DispatchMessage(win.Msg);
end;
end;
begin
run; //開始運行主程序
end.
