监视程序运行得钩子程序

老是觉得钩子很深奥，最近研究了一下，这是我得代码，可以监视哪些程序被运行以及被销毁。

这是钩子得头文件

#ifndef EXEHOOKAPI

#define EXEHOOKAPI __declspec(dllimport)

#endif

#define USER_MSG WM_USER+1

#define UC_APPSTART 0x80000001

#define UC_APPDESTROY 0x80000002

EXEHOOKAPI BOOL WINAPI SetHook(HWND hExe);

这是cpp文件

#include <windows.h>

#define EXEHOOKAPI __declspec(dllexport)

#include "ExeHook.h"

#pragma data_seg("shared")

HHOOK g_hProc =NULL;

HWND g_hForm = NULL;

#pragma data_seg()

#pragma comment(linker, "/section:shared,rws")

// DLL¾ä±ú

HINSTANCE g_hInstDLL = NULL;

//LRESULT CALLBACK HookedShellProc(int nCode, WPARAM wParam, LPARAM lParam);

LRESULT CALLBACK HookedShellProc(int nCode, WPARAM wParam, LPARAM lParam)

{

switch(nCode)

{

case HSHELL_WINDOWCREATED:

PostMessage(g_hForm,USER_MSG,UC_APPSTART,LPARAM(wParam));

break;

case HSHELL_WINDOWDESTROYED:

PostMessage(g_hForm,USER_MSG,UC_APPDESTROY,LPARAM(wParam));

break;

}

return CallNextHookEx(g_hProc, nCode, wParam, lParam);

}

BOOL WINAPI SetHook(HWND hwndExe)

{

BOOL bRet;

if(hwndExe)

{

g_hForm=hwndExe;

g_hProc=SetWindowsHookEx(WH_SHELL, (HOOKPROC) HookedShellProc, g_hInstDLL, 0);

bRet = (g_hProc!=NULL);

}

else

{

bRet=UnhookWindowsHookEx(g_hProc);

g_hProc=NULL;

g_hForm=NULL;

}

return bRet;

}

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)

{

if (fdwReason == DLL_PROCESS_ATTACH)

g_hInstDLL = hinstDLL;

return TRUE;

}