回复 11# 131738
NO~有多种方法都可以实现在第三方程序上创建控件并截取其消息。
SetWindowLong就可以很好地完成此功能,_GUICtrlButton_Create($hWnd, ..., ...)($hWnd属于第三方进程)在远程界面上创建一个按钮之后,虽然按钮是显示在了$hWnd上面,但所属的进程仍旧是自己的程序。但这样做有一个缺点,自己的程序必须要常驻内存,因为 在循环截取消息的不是第三方$hWnd,而是自己的程序。
还有如thesnow兄所说的消息劫持。
以下这个不必常驻进程,将代码写入到第三方进程中后自己的程序退出就OK了,剩下的截取消息等工作将由目标进程自己完成。
测试代码:
a.au3GUICreate("Receive msg cross process", 400, 300)
GUISetState()
While GUIGetMsg() <> -3
WEnd
b.au3#include <Thread.au3>
$pCreateWindowExW = _RTGetProcAddress("User32.dll", "CreateWindowExW")
$pSendMessageW = _RTGetProcAddress("User32.dll", "SendMessageW")
$pGetStockObject = _RTGetProcAddress("Gdi32.dll", "GetStockObject")
$pGetModuleHandleW = _RTGetProcAddress("Kernel32.dll", "GetModuleHandleW")
$pMessageBoxW = _RTGetProcAddress("User32.dll", "MessageBoxW")
$pGetMessageW = _RTGetProcAddress("User32.dll", "GetMessageW")
$pDispatchMessageW = _RTGetProcAddress("User32.dll", "DispatchMessageW")
$hWnd = WinGetHandle("Receive msg cross process")
If (@error) Then Exit
$iPid = WinGetProcess($hWnd)
$hProcess = _RTOpenProcess($iPid)
$pCallAddr = _RTVirtualAllocEx($hProcess, 1028)
$bCode = "0x" & _
"6A00" & _
"B8" & _RTLongPtrToBytes($pGetModuleHandleW) & _
"FFD0" & _
"6A00" & _
"50" & _
"68" & _RTUlongToBytes(1024) & _
"68" & _RTLongPtrToBytes($hWnd) & _
"68" & _RTUlongToBytes(20) & _
"68" & _RTUlongToBytes(150) & _
"68" & _RTUlongToBytes(40) & _
"68" & _RTUlongToBytes(40) & _
"68" & _RTUlongToBytes(0x50014000) & _
"68" & _RTLongPtrToBytes($pCallAddr + 181) & _
"68" & _RTLongPtrToBytes($pCallAddr + 167) & _
"6A00" & _
"B8" & _RTLongPtrToBytes($pCreateWindowExW) & _
"FFD0" & _
"A3" & _RTLongPtrToBytes($pCallAddr + 1024) & _
"6A11" & _
"B8" & _RTLongPtrToBytes($pGetStockObject) & _
"FFD0" & _
"6A01" & _
"50" & _
"6A30" & _
"FF35" & _RTLongPtrToBytes($pCallAddr + 1024) & _
"B8" & _RTLongPtrToBytes($pSendMessageW) & _
"FFD0" & _
"6A00" & _
"6A00" & _
"FF35" & _RTLongPtrToBytes($pCallAddr + 1024) & _
"68" & _RTLongPtrToBytes($pCallAddr + 512) & _
"B8" & _RTLongPtrToBytes($pGetMessageW) & _
"FFD0" & _
"68" & _RTLongPtrToBytes($pCallAddr + 512) & _
"B8" & _RTLongPtrToBytes($pDispatchMessageW) & _
"FFD0" & _
"813D" & _RTLongPtrToBytes($pCallAddr + 516) & _RTUlongToBytes(0x202) & _
"75" & Hex(-46, 2) & _
"6A30" & _
"6A00" & _
"68" & _RTLongPtrToBytes($pCallAddr + 191) & _
"68" & _RTLongPtrToBytes($hWnd) & _
"B8" & _RTLongPtrToBytes($pMessageBoxW) & _
"FFD0" & _
"EB" & Hex(-69, 2) & _
_RTStringToBytesW("Button") & _
_RTStringToBytesW("Test") & _
_RTStringToBytesW("Bingo, catch you~!")
_RTWriteProcessMemory($hProcess, $pCallAddr, $bCode, BinaryLen($bCode), "binary")
_RTCloseHandle(_RTCreateRemoteThread($hProcess, $pCallAddr))
先运行a再运行b。需要用到的外部库文件:纯AU3拦截进程创建,并阻止或允许其运行 |