void CALLBACK HandleWinEvent(HWINEVENTHOOK hook, DWORD event, HWND hwnd, 
	LONG idObject, LONG idChild, 
	DWORD dwEventThread, DWORD dwmsEventTime)
{
	char name[MAX_PATH];
	GetWindowTextA(hwnd,name,MAX_PATH);
	LONG mStyle = GetWindowLongA(hwnd,GWL_STYLE);
	LONG ExtStyle=GetWindowLongA(hwnd,GWL_EXSTYLE);
	if(mStyle==0x57c70000&&ExtStyle==0x140)
	{
		printf("find od 1 %08x %s\r\n",dwEventThread,name);
	}
	if (mStyle==0x56CF0000&&ExtStyle==0x140)
	{
		printf("Find od 2 %08x %s\r\n",dwEventThread,name);
	}
}
int _tmain(int argc, _TCHAR* argv[])
{
	CoInitialize(NULL);
	HWINEVENTHOOK hHook = SetWinEventHook( EVENT_MIN , EVENT_MAX , NULL, HandleWinEvent, 0, 0, WINEVENT_OUTOFCONTEXT | WINEVENT_SKIPOWNPROCESS);
	if (hHook)
	{
		printf("set hook ok\r\n");
	}
	else
	{
		printf("some hack in this os\r\n");
		exit(-1);
	}
	while(1)
	{
		MSG msg;
		GetMessage(&msg,NULL,0,0);
		TranslateMessage(&msg);
	}
	return 0;
}

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课