Windows 小记 3 -- 屏蔽系统热键的补充

系统热键屏蔽这块，我主要要补充 csrss.exe 注册的几个热键的屏蔽。目前查快捷键结构信息（在内核中）的工具有 OpenArk。通过查找热键，可以找到 Win+L，Ctrl+Alt+Del 等多个热键的id 码。
知道id 码之后就可以注入 ban 掉热键了。xp 和之前都是在 winlogon 进程注册的，vista 开始就是 csrss 进程注册的。

ban 的基本思路就是：1）获取注册热键的窗口句柄（一般这些窗口可以根据窗口类名特征或者窗口创建的时机，窗口层次锁定，或者你逆向hook 住一些创建时的 api 即可）；2）窗口子类化，在子类化过程中调用 UnregisterHotKey 卸载热键（此 id 根据驱动获取的结果得到，或者写死）。

不同系统可能id码还会不一样，取决于注册热键的程序是否经常更新，像 csrss 就不怎么变化，explorer 就总会变。

下面仅提供一个 xp 的（不适用于 vista，仅供参考思路用），代码来源：https://blog.csdn.net/zwfgdlc/article/details/6609591。在此也感谢一下原作者提供的分析思路，以及 OpenArk 开发者对内核中快捷键注册机制的研究。

#include <windows.h>
#include <process.h> 
#include <tchar.h>
#include <stdio.h>
#include <shlwapi.h>
#include <psapi.h>
 
#pragma comment(lib, "psapi.lib")
#pragma comment(lib, "shlwapi.lib")
 
TCHAR ModuleFile[MAX_PATH];
TCHAR szText[128] = {0};
WNDPROC OldWindowProc;
HWND hWinLogon;
HMODULE hDll;
 
 
LRESULT CALLBACK NewWindowProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
	if (message == WM_NULL)
	{
		::UnregisterHotKey(hWnd, 0); //Ctrl+Alt+delete
		::UnregisterHotKey(hWnd, 4); //Ctrl+Shift+Esc
		::UnregisterHotKey(hWnd, 5); //Win+L
		::UnregisterHotKey(hWnd, 6); //Win+U
		::SetWindowLongPtr(hWnd, GWL_WNDPROC, (LONG)OldWindowProc);
		return 1;
	}
	
	return CallWindowProc(OldWindowProc, hWnd, message, wParam, lParam);
}
 
BOOL WINAPI EnablePrivileges()
{
	HANDLE hToken; 
	TOKEN_PRIVILEGES tkp; 
 
	if (!OpenProcessToken(GetCurrentProcess(), 
		TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) 
		return( FALSE ); 
 
	LookupPrivilegeValue(NULL, SE_DEBUG_NAME, 
		&tkp.Privileges[0].Luid); 
 
	tkp.PrivilegeCount = 1; 
	tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
 
	AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, 
		(PTOKEN_PRIVILEGES)NULL, 0); 
 
	if (GetLastError() != ERROR_SUCCESS) 
		return FALSE; 
 
	return TRUE;
}
 
BOOL CALLBACK lpEnumWindowsProc(HWND hwnd, LPARAM lParam)
{
	if (IsWindow(hwnd))
	{
		::GetWindowText(hwnd, szText, _countof(szText));
 
		if (!_tcscmp(szText, TEXT("SAS window")))
		{
			hWinLogon = hwnd;
			OldWindowProc = (WNDPROC)::SetWindowLongPtr(hwnd, GWL_WNDPROC, (LONG)NewWindowProc);
			PostMessage(hwnd, WM_NULL, 0, 0);
			return FALSE;
		}
	}
 
	return TRUE;
}
 
UINT _stdcall FreeSelfProc(void *Arg)
{
	FreeLibraryAndExitThread(hDll, 0);
	return 1;
}
 
BOOL WINAPI DllMain(HINSTANCE hDllHandle, DWORD nReason, LPVOID Reserved)
{
	switch ( nReason )
	{
	case DLL_PROCESS_ATTACH:
		hDll = hDllHandle;
		GetModuleFileName(NULL, ModuleFile, _countof(ModuleFile));
		EnablePrivileges();
		
		if (StrStrI(ModuleFile, TEXT("winlogon.exe")))
		{
			HANDLE hThread;
			UINT ThreadId;
 
			HDESK hWinLogon = OpenDesktop(TEXT("Winlogon"), 0, FALSE, GENERIC_ALL);
			::EnumDesktopWindows(hWinLogon, lpEnumWindowsProc, NULL);
			CloseDesktop(hWinLogon);
 
			hThread = (HANDLE)_beginthreadex(NULL, NULL, &FreeSelfProc, 0, 0, &ThreadId);
			WaitForSingleObject(hThread, INFINITE);
			CloseHandle(hThread);			
		}
		else
		{
			DWORD dwProcessId = 0;
			HANDLE hProcess = 0;  
			DWORD ProcessList[512], cbNeeded, cProcess;
			TCHAR szFileName[256];
 
			EnumProcesses(ProcessList, sizeof(ProcessList), &cbNeeded);
			cProcess = cbNeeded/sizeof(DWORD);
 
			for (UINT i=0; i<cProcess; i++)
			{
				if (ProcessList[i] != 0)
				{
					hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessList[i]);
					if (hProcess)
					{
						GetModuleBaseName(hProcess, NULL, szFileName, _countof(szFileName));
						if (!_tcsicmp(szFileName, TEXT("winlogon.exe")))
						{
							dwProcessId = ProcessList[i];
							break;
						}
					}
				}
			}
 
			if (dwProcessId)
			{
				hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
			}
 
			if (!hProcess)
			{
				return 0;
			}
		
			LPVOID Param = VirtualAllocEx(hProcess, 0, 512, MEM_COMMIT, PAGE_READWRITE);
			if (!Param)
			{
				MessageBox(NULL, TEXT("申请内存失败"), TEXT("申请内存失败"), MB_ICONWARNING);
				return 0;
			}
 
			GetModuleFileName(hDllHandle, ModuleFile, _countof(ModuleFile));
 
			if (!WriteProcessMemory(hProcess, Param, (LPVOID)ModuleFile, 256, NULL))
			{
				MessageBox(NULL, TEXT("写入内存失败"), TEXT("写入内存失败"), MB_ICONWARNING);
				return 0;
			}
			
			HANDLE hThread = CreateRemoteThread(hProcess, 
					NULL, 
					NULL, 
					(LPTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("kernel32.dll")), "LoadLibraryW"),
					Param, 
					NULL, 
					NULL);
			if (hThread)
			{
				WaitForSingleObject(hThread, INFINITE);
			}
			else
			{
				TCHAR sztmp[1024];
				_stprintf_s(sztmp, _countof(sztmp), TEXT("创建远程线程失败, 错误代码:%d, dll=%s"), GetLastError(), ModuleFile);
				MessageBox(NULL, sztmp, TEXT("创建远程线程失败"), MB_ICONWARNING);
				return 0;				
			}
 
			VirtualFreeEx(hProcess, Param , 0, MEM_RELEASE);
			CloseHandle(hThread);
			CloseHandle(hProcess);
		}
		break;
	case DLL_THREAD_ATTACH:
		break;
	case DLL_THREAD_DETACH:
		break;
	case DLL_PROCESS_DETACH:
		::SetWindowLongPtr(hWinLogon, GWL_WNDPROC, (LONG)OldWindowProc);
		break;
	default:
		break;
	}
 
	return 1;
}
 
EXTERN_C __declspec(dllexport) int Hook(void)
{
	return 1;
}