首页
社区
课程
招聘
[原创]NtUserGetThreadState的用法收集
发表于: 2010-1-22 15:25 8323

[原创]NtUserGetThreadState的用法收集

2010-1-22 15:25
8323
NtUserGetThreadState是个变参函数,第一个参数是标志
标志 = 0 就是GetFocus
       = 1 就是GetActiveWindow
        = 8 就是GetMessageA

[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课

收藏
免费 0
支持
分享
最新回复 (5)
雪    币: 38
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
谢谢 学习了
2010-1-22 23:06
0
雪    币: 284
活跃值: (16)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
这可是个好函数,mark...
2010-1-23 09:43
0
雪    币: 636
活跃值: (174)
能力值: ( LV9,RANK:260 )
在线值:
发帖
回帖
粉丝
4
貌似标志 = 6 是 GetCursor
2010-1-25 08:55
0
雪    币: 29
活跃值: (11)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
5
学习中
长见识了
2010-1-25 08:58
0
雪    币: 636
活跃值: (174)
能力值: ( LV9,RANK:260 )
在线值:
发帖
回帖
粉丝
6
翻了下2k的代码。这家伙作用真多:
ULONG_PTR NtUserGetThreadState(
    IN USERTHREADSTATECLASS ThreadState)
{
    PTHREADINFO ptiCurrent = PtiCurrentShared();

    BEGINRECV_SHARED(ULONG_PTR, 0);

    switch (ThreadState) {
    case UserThreadStateFocusWindow:
        retval = (ULONG_PTR)HW(ptiCurrent->pq->spwndFocus);
        break;
    case UserThreadStateActiveWindow:
        retval = (ULONG_PTR)HW(ptiCurrent->pq->spwndActive);
        break;
    case UserThreadStateCaptureWindow:
        retval = (ULONG_PTR)HW(ptiCurrent->pq->spwndCapture);
        break;
    case UserThreadStateDefaultImeWindow:
        retval = (ULONG_PTR)HW(ptiCurrent->spwndDefaultIme);
        break;
    case UserThreadStateDefaultInputContext:
        retval = (ULONG_PTR)PtoH(ptiCurrent->spDefaultImc);
        break;
    case UserThreadStateImeCompatFlags:
        UserAssert(ptiCurrent->ppi != NULL);
        retval = (DWORD)(ptiCurrent->ppi->dwImeCompatFlags);
        break;
    case UserThreadStatePreviousKeyboardLayout:
        retval = (ULONG_PTR)(ptiCurrent->hklPrev);
        break;
    case UserThreadStateIsWinlogonThread:
        // Client IMM checks if the process is Login;
        // to prevent switching dictionaries, etc.
        // LATER: gpidLogin per WinStation ?
        retval = (DWORD)(GetCurrentProcessId() == gpidLogon);
        break;
    case UserThreadStateIsConImeThread:
        UserAssert(ptiCurrent->rpdesk != NULL);
        retval = (DWORD)(PtiFromThreadId(ptiCurrent->rpdesk->dwConsoleIMEThreadId) == ptiCurrent);
        break;
    case UserThreadStateInputState:
        retval = (DWORD)_GetInputState();
        break;
    case UserThreadStateCursor:
        retval = (ULONG_PTR)PtoH(ptiCurrent->pq->spcurCurrent);
        break;
    case UserThreadStateChangeBits:
        retval = ptiCurrent->pcti->fsChangeBits;
        break;
    case UserThreadStatePeekMessage:
        /*
         * Update the last read time so that hung app painting won't occur.
         */
        SET_TIME_LAST_READ(ptiCurrent);
        retval = (DWORD)FALSE;
        break;
    case UserThreadStateExtraInfo:
        retval = ptiCurrent->pq->ExtraInfo;
        break;

    case UserThreadStateInSendMessage:
        if (ptiCurrent->psmsCurrent != NULL) {
            if (ptiCurrent->psmsCurrent->ptiSender != NULL) {
                retval = ISMEX_SEND;
            } else if (ptiCurrent->psmsCurrent->flags & (SMF_CB_REQUEST | SMF_CB_REPLY)) {
                retval = ISMEX_CALLBACK;
            } else {
                retval = ISMEX_NOTIFY;
            }

            if (ptiCurrent->psmsCurrent->flags & SMF_REPLY) {
                retval |= ISMEX_REPLIED;
            }
        } else {
            retval = ISMEX_NOSEND;
        }
        break;

    case UserThreadStateMessageTime:
        retval = ptiCurrent->timeLast;
        break;
    case UserThreadStateIsForeground:
        retval = (ptiCurrent->pq == gpqForeground);
        break;
    case UserThreadConnect:
        retval = TRUE;
        break;
    default:
        RIPMSG1(RIP_WARNING, "NtUserGetThreadState invalid ThreadState:%#x", ThreadState);
        MSGERROR(0);
    }

    ENDRECV_SHARED();
}
2010-1-25 10:28
0
游客
登录 | 注册 方可回帖
返回
//