注册 登录
编程论坛 汇编论坛

罗云彬win32汇编书里的日志记录钩子WH_JOURNALRECORD

S0RCERER 发布于 2023-11-13 23:38, 989 次点击
用了罗云彬书里的例子,生成的EXE运行之后没有任何反应
查了一下微软官方文档,里面说从 Windows 11 开始,日记挂钩 API WH_JOURNALRECORD不受支持,将在将来的版本中删除。但是win10的系统也无效了吗?
以下是源代码:
.386
.model flat,stdcall
option casemap:none

include windows.inc
include user32.inc
includelib user32.lib
include kernel32.inc
includelib kernel32.lib

ICO_MAIN equ 1000
DLG_MAIN equ 1000
IDC_TEXT equ 1001

.data?

hInstance dd ?
hWinMain dd ?
hHook dd ?
szAscii db 32 dup (?)

.code

HookProc proc _dwCode,_wParam,_lParam
    local @szKeyState[256]:byte

    invoke CallNextHookEx,hHook,_dwCode,_wParam,_lParam
    pushad
    .if _dwCode==HC_ACTION
        mov ebx,_lParam
        assume ebx:ptr EVENTMSG
        .if [ebx].message==WM_KEYDOWN
            invoke GetKeyboardState,addr @szKeyState
            invoke GetKeyState,VK_SHIFT
            mov @szKeyState+VK_SHIFT,al
            mov ecx,[ebx].paramH
            shr ecx,16
            invoke ToAscii,[ebx].paramL,ecx,addr @szKeyState,addr szAscii,0
            mov byte ptr szAscii [eax],0
            .if szAscii==0dh
            mov word ptr szAscii+1,0ah
            .endif
            invoke SendDlgItemMessage,hWinMain,IDC_TEXT,EM_REPLACESEL,0,addr szAscii
        .endif
    assume ebx:nothing
    .endif
    popad
    ret

HookProc endp

_ProcDlgMain proc uses ebx edi esi hWnd,wMsg,wParam,lParam

        mov eax,wMsg
        .if eax==WM_CLOSE
            invoke UnhookWindowsHookEx,hHook
            invoke EndDialog,hWnd,NULL
        .elseif eax==WM_INITDIALOG
            push hWnd
            pop hWinMain
            invoke SetWindowsHookEx,WH_JOURNALRECORD,addr HookProc,hInstance,NULL
                .if eax
                    mov hHook,eax
                .else
                    invoke EndDialog,hWnd,NULL
                .endif
        .else
            mov eax,FALSE
            ret
        .endif
        mov eax,TRUE
        ret

_ProcDlgMain endp

start:

    invoke GetModuleHandle,NULL
    mov hInstance,eax
    invoke DialogBoxParam,eax,DLG_MAIN,NULL,offset _ProcDlgMain,NULL
    invoke ExitProcess,NULL

end start
1 回复
#2
Valenciax2023-12-15 03:26
可以用windows的debugger追蹤一下,看看哪里出错,比如:WinDbg或者 ollydbg
1