GDI Hooking

acid · Feb 2, 2004, 22:38

Any sample code or article for systemwide GDI hooking ? It seems to me the techniques are kept in secret since all Remote Controlling softwares are using them in commercial purposes

BlackMoon · Feb 3, 2004, 07:09

mojesh utochnit?
u menia koechto est napisanoe

acid · Feb 3, 2004, 07:16

I have an application executable, which is not developed by myself, simply - I don't have the source code of that application. It has some GDI text output which I need to capture with my application whenever text output funtion is called.

BlackMoon · Feb 3, 2004, 07:31

At home I have sources of keyboard hook by myself
I will post them today evening or tomorrow morning
if it can help you in VC 6.0 or 7.0
with GDI shold be tha same

acid · Feb 3, 2004, 08:21

Thanks, but I can have many sources with keyboard hooking myself

it's not same at all. Win32 API provides keyboard hooking mechanism.

Thanks anyway.

greka · Feb 7, 2004, 13:02

is windows messaging used during console input/output ?

What about tracing system-wide all WM_SETTEXT/WM_GETTEXT messages?

The most suitable decision I see in a system-wide hook set on every "CreateFont()"+"WM_SETTEXT" pair.

I.e. somehow (?) traced CreateFont API, then upon appearance - started to trace EVERY WM_SETTEXT sent by specified application untill "DeleteObject" called.

h-m..?

Agregat · Feb 8, 2004, 08:50

Касательно консольного ввода/вывода - то ReadConsole позволяет отслеживать keyboard, mouse events.

acid · Feb 8, 2004, 09:12

Quote:

Originally Posted by greka

is windows messaging used during console input/output ?

What about tracing system-wide all WM_SETTEXT/WM_GETTEXT messages?

The most suitable decision I see in a system-wide hook set on every "CreateFont()"+"WM_SETTEXT" pair.

I.e. somehow (?) traced CreateFont API, then upon appearance - started to trace EVERY WM_SETTEXT sent by specified application untill "DeleteObject" called.

h-m..?

What console input/output has to do with my question ?

As well as I am concerned WS_SET/GETTEXT are not GDI functions.

Can you tell me in details how to set system-wide hook on CreateFont? If yes the problem is solved !

GDI text output is performed using *TextOut functions. I want to capture exactly that one.

Thank you.

armeng · Feb 9, 2004, 14:26

Quote:

Originally Posted by acid

What console input/output has to do with my question ?
GDI text output is performed using *TextOut functions. I want to capture exactly that one.

Меняешь ExtTextOut, ExtTextOutA, ExtTextOutW функции в gdi32.dll на свои.
Как реализовать это? Ищи в интернете "DLL Injection API Hooking".

armeng · Feb 9, 2004, 14:29

Но учти что эти ф-и будут вызываться при каждой WM_PAINT.

Agregat · Feb 9, 2004, 14:32

Джеффри Рихтер, если что

acid · Feb 9, 2004, 15:41

Quote:

Originally Posted by armeng

Меняешь ExtTextOut, ExtTextOutA, ExtTextOutW функции в gdi32.dll на свои.
Как реализовать это? Ищи в интернете "DLL Injection API Hooking".

Это уже поближе к делу! Гоогле мне в руки и вперед.

П.С.
Неужели заразы типа Remote Control applcations тоже меняют gdi32.dll... больше не буду такие гадости ставить(PCAnywhere, Remote Admin...)

Спасибо.

armeng · Feb 10, 2004, 06:59

Quote:

Originally Posted by acid

Неужели заразы типа Remote Control applcations тоже меняют gdi32.dll...

Почти они все (которые я знаю RemoteAdmin, VNC...) передают разницы screenshot-ов, а вот родной Window Terminal Server делает настоящий перехват всей API + Messages. Отсюда вывод (может ошибаюсь), что скорей всего механизм перехвата ф-й API реализована где то в недрах Windows-a и спрятана так глубоко, что качественый Remote Control осуществляет только Terminal Server.

Кстати не объязательно на диске менять gdi32.dll. Можно его менять в ОЗУ (CreateRemoteThread?, OpenProcess, ReadProcessMemory ....). Рихтера тоже смотри, там есть хорошие примеры.

sukhodolin · Jul 22, 2005, 21:02

Quote:

Originally Posted by armeng

а вот родной Window Terminal Server делает настоящий перехват всей API + Messages.

Мы (DemoForge) тоже это умеем, что именно интересует?

Feb 2, 2004, 22:38	#1
acid Administrator Join Date: Sep 2001 Location: South Korea, Gumi Posts: 7,194 Blog Entries: 15 Rep Power: 10 Reputation: 313	GDI Hooking Any sample code or article for systemwide GDI hooking ? It seems to me the techniques are kept in secret since all Remote Controlling softwares are using them in commercial purposes __________________ Chat with acid

Feb 3, 2004, 07:09	#2
BlackMoon Дошкольник Join Date: May 2002 Location: The Dark Side of The Moon Posts: 102 Rep Power: 7 Reputation: 10	mojesh utochnit? u menia koechto est napisanoe __________________ BM

Feb 3, 2004, 07:16	#3
acid Administrator Join Date: Sep 2001 Location: South Korea, Gumi Posts: 7,194 Blog Entries: 15 Rep Power: 10 Reputation: 313	I have an application executable, which is not developed by myself, simply - I don't have the source code of that application. It has some GDI text output which I need to capture with my application whenever text output funtion is called. __________________ Chat with acid

Feb 3, 2004, 07:31	#4
BlackMoon Дошкольник Join Date: May 2002 Location: The Dark Side of The Moon Posts: 102 Rep Power: 7 Reputation: 10	At home I have sources of keyboard hook by myself I will post them today evening or tomorrow morning if it can help you in VC 6.0 or 7.0 with GDI shold be tha same __________________ BM

Feb 3, 2004, 08:21	#5
acid Administrator Join Date: Sep 2001 Location: South Korea, Gumi Posts: 7,194 Blog Entries: 15 Rep Power: 10 Reputation: 313	Thanks, but I can have many sources with keyboard hooking myself it's not same at all. Win32 API provides keyboard hooking mechanism. Thanks anyway. __________________ Chat with acid

Feb 7, 2004, 13:02	#6
greka Administrator Join Date: Sep 2001 Location: @work Posts: 5,347 Rep Power: 10 Reputation: 23	is windows messaging used during console input/output ? What about tracing system-wide all WM_SETTEXT/WM_GETTEXT messages? The most suitable decision I see in a system-wide hook set on every "CreateFont()"+"WM_SETTEXT" pair. I.e. somehow (?) traced CreateFont API, then upon appearance - started to trace EVERY WM_SETTEXT sent by specified application untill "DeleteObject" called. h-m..? __________________ И повешенные могут качаться в неположенную сторону. /С.Е.Лец/

Feb 8, 2004, 08:50	#7
Agregat Грустно... Join Date: Aug 2002 Location: Там, где всегда идут дожди Posts: 21,616 Rep Power: 11 Reputation: 202	Касательно консольного ввода/вывода - то ReadConsole позволяет отслеживать keyboard, mouse events. __________________ http://аvitya.livejournal.com Хотели, как лучше, а получилось даже хуже... Лозунг шахматиста: На каждый шах - ответим матом!

Feb 9, 2004, 14:29	#10
armeng Дошкольник Join Date: Mar 2003 Location: 2A Posts: 102 Rep Power: 6 Reputation: 10	Но учти что эти ф-и будут вызываться при каждой WM_PAINT.

Feb 9, 2004, 14:32	#11
Agregat Грустно... Join Date: Aug 2002 Location: Там, где всегда идут дожди Posts: 21,616 Rep Power: 11 Reputation: 202	Джеффри Рихтер, если что __________________ http://аvitya.livejournal.com Хотели, как лучше, а получилось даже хуже... Лозунг шахматиста: На каждый шах - ответим матом!

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode