#include <RTApiHook32.au3>
$hProcess = _RTOpenProcess("explorer.exe")
If ($hProcess < 1) Then
Exit MsgBox(0x40030, "Error", "Error opening process: " & @error)
EndIf
$pExitWindowsEx = _RTGetProcAddress("User32.dll", "ExitWindowsEx")
If ($pExitWindowsEx = 0) Then
Exit MsgBox(0x40030, "Error", "Error finding system function.")
EndIf
$hCallBack = DllCallBackRegister("_CallBack", "long", "handle;ptr")
$pCallBack = DllCallBackGetPtr($hCallBack)
$tExitWindowsEx = _RTApiHookEx($hProcess, $pExitWindowsEx, 2, $pCallBack)
If ($tExitWindowsEx = 0) Then
Exit MsgBox(0x40030, "Error", "Error hooking system function: " & @error)
EndIf
OnAutoItExitRegister("_Restore")
While 1
Sleep(100)
WEnd
Func _Restore()
_RTApiUnhook($hProcess, $pExitWindowsEx, DllStructGetData($tExitWindowsEx, "Entrypoint"))
_RTCloseHandle($hProcess)
EndFunc ;==>_Restore
Func _CallBack($hProcess, $pCallInfo)
Local $iFlags, $iReason
$iFlags = _RTApiHookReadParam($hProcess, $pCallInfo, 1)
$iReason = _RTApiHookReadParam($hProcess, $pCallInfo, 2)
MsgBox(48, $iFlags, $iReason)
Return $APIHOOK_Flags_Call_Abort
EndFunc ;==>_CallBack
挂钩ExitWindowsEx函数。顺便帮我测试一下,看这段代码能否运行于WIN7系统。 |