反正代码不多，就直接贴出来算了，有不对的大家请多多指教
该程序是个Shell扩展，使用regsvr32注册，使用regsvr32 /u取消注册
ICopyHook就是监视目录复制的，IShellExecuteHook就是监视程序执行，在这个程序里面我把他们两个都实现了
/********************CopyHook.def********************/
LIBRARY "CopyHook.dll"
EXPORTS
DllGetClassObject PRIVATE
DllRegisterServer PRIVATE
DllUnregisterServer PRIVATE
DllCanUnloadNow PRIVATE
#include <Windows.h>
#include <Stdio.h>
#include <Tchar.h>
#include <Shlobj.h>
#include <InitGuid.h>
#include "ShellHook.h"
#include "ShellHookFactory.h"
HMODULE g_hinst;
ULONG g_lLockNumber;
ULONG g_lRefThisDll;
HRESULT ClsidToString(REFCLSID clsid, LPTSTR lpszClsid, int cchClsid)
{
HRESULT result;
LPWSTR lpszStr;
if((result = StringFromCLSID(clsid, &lpszStr)) == S_OK)
{
#ifdef UNICODE
lstrcpyn(lpszClsid, lpszStr, cchClsid);
#else
WideCharToMultiByte(CP_OEMCP, 0, lpszStr, -1, lpszClsid, cchClsid, 0, 0);
#endif
CoTaskMemFree(lpszStr);
}
return result;
}
HRESULT RegisterClsid(LPTSTR lpszClsid, LPTSTR lpszModule)
{
HKEY hKey;
HKEY hSubKey;
TCHAR szSubKey[1024];
TCHAR szModel[] = _T("Apartment");
LSTATUS status;
lstrcpy(szSubKey, _T("CLSID\\"));
lstrcat(szSubKey, lpszClsid);
status = RegCreateKey(HKEY_CLASSES_ROOT, szSubKey, &hKey);
if(status == ERROR_SUCCESS)
{
status = RegCreateKey(hKey, _T("InProcServer32"), &hSubKey);
if(status == ERROR_SUCCESS)
{
RegSetValue(hSubKey, NULL, REG_SZ, lpszModule, 0);
RegSetValueEx(hSubKey, _T("ThreadingModel"), 0, REG_SZ, (BYTE*)szModel, sizeof(szModel));
RegCloseKey(hSubKey);
}
RegCloseKey(hKey);
}
return HRESULT_FROM_WIN32(status);
}
HRESULT UnRegisterClsid(LPTSTR lpszClsid)
{
TCHAR szSubKey[1024];
LSTATUS status;
lstrcpy(szSubKey, _T("CLSID\\"));
lstrcat(szSubKey, lpszClsid);
lstrcat(szSubKey, _T("\\InProcServer32"));
status = RegDeleteKey(HKEY_CLASSES_ROOT, szSubKey);
lstrcpy(szSubKey, _T("CLSID\\"));
lstrcat(szSubKey, lpszClsid);
status = RegDeleteKey(HKEY_CLASSES_ROOT, szSubKey);
return HRESULT_FROM_WIN32(status);
}
STDAPI DllGetClassObject (const CLSID &rclsid, const IID &riid, void **ppv)
{
if (rclsid == CLSID_MyShellHook)
{
CMyShellHookFactory *pFactory = new CMyShellHookFactory;
if (pFactory == NULL)
return E_OUTOFMEMORY ;
return pFactory->QueryInterface(riid, ppv);
}
return CLASS_E_CLASSNOTAVAILABLE;
}
STDAPI DllCanUnloadNow (void)
{
if (g_lRefThisDll == 0 && g_lLockNumber == 0)
return S_OK;
else
return S_FALSE;
}
STDAPI DllRegisterServer ()
{
TCHAR szClsid[64];
TCHAR szModule[MAX_PATH];
HKEY hKey;
ClsidToString(CLSID_MyShellHook, szClsid, 64);
if(RegCreateKey(HKEY_CLASSES_ROOT, _T("Directory\\shellex\\CopyHookHandlers\\zCopyHook"), &hKey) == ERROR_SUCCESS)
{
RegSetValue(hKey, NULL, REG_SZ, szClsid, 0);
RegCloseKey(hKey);
}
if(RegOpenKey(HKEY_LOCAL_MACHINE, _T("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellExecuteHooks"), &hKey) == ERROR_SUCCESS)
{
RegSetValueEx(hKey, szClsid, 0, REG_SZ, NULL, 0);
RegCloseKey(hKey);
}
if(RegOpenKey(HKEY_LOCAL_MACHINE, _T("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"), &hKey) == ERROR_SUCCESS)
{
DWORD dwVal = 1;
RegSetValueEx(hKey, _T("EnableShellExecuteHooks"), 0, REG_DWORD, (LPBYTE)&dwVal, sizeof(DWORD));
RegCloseKey(hKey);
}
GetModuleFileName(g_hinst, szModule, MAX_PATH);
return RegisterClsid(szClsid, szModule);
}
STDAPI DllUnregisterServer ()
{
TCHAR szClsid[64];
HKEY hKey;
ClsidToString(CLSID_MyShellHook, szClsid, 64);
RegDeleteKey(HKEY_CLASSES_ROOT, _T("Directory\\shellex\\CopyHookHandlers\\zCopyHook"));
if(RegOpenKey(HKEY_LOCAL_MACHINE, _T("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellExecuteHooks"), &hKey) == ERROR_SUCCESS)
{
RegDeleteValue(hKey, szClsid);
RegCloseKey(hKey);
}
if(RegOpenKey(HKEY_LOCAL_MACHINE, _T("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"), &hKey) == ERROR_SUCCESS)
{
RegDeleteValue(hKey, _T("EnableShellExecuteHooks"));
RegCloseKey(hKey);
}
return UnRegisterClsid(szClsid);
}
BOOL WINAPI DllMain (HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
switch(fdwReason)
{
case DLL_PROCESS_ATTACH://加载dll;
{
g_hinst = hinstDLL;
}
break;
case DLL_PROCESS_DETACH://释放dll
{
}
break;
case DLL_THREAD_ATTACH://新建线程
{
}
break;
case DLL_THREAD_DETACH://线程退出
{
}
break;
}
return TRUE;
}
class CMyShellHookFactory : public IClassFactory
{
public:
CMyShellHookFactory();
~CMyShellHookFactory();
HRESULT STDMETHODCALLTYPE QueryInterface (REFIID iid, void **ppvObject);
ULONG STDMETHODCALLTYPE AddRef ();
ULONG STDMETHODCALLTYPE Release ();
HRESULT STDMETHODCALLTYPE CreateInstance (IUnknown *pUnkOuter, REFIID riid, void **ppvObject);
HRESULT STDMETHODCALLTYPE LockServer (BOOL fLock);
private:
ULONG m_lRefCount;
};
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
