Leaked source code of windows server 2003
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

331 lines
9.8 KiB

  1. /*++
  2. Copyright (c) 2000 Microsoft Corporation
  3. Module Name:
  4. EncompassMonitor.cpp
  5. Abstract:
  6. Filters messages from the apps CBT WindowsHook.
  7. Notes:
  8. This is a general purpose shim.
  9. History:
  10. 01/30/2001 a-larrsh Created
  11. 02/18/2002 robkenny Properly check the return value from GetTempPathA
  12. --*/
  13. #include "precomp.h"
  14. IMPLEMENT_SHIM_BEGIN(EncompassMonitor)
  15. #include "ShimHookMacro.h"
  16. APIHOOK_ENUM_BEGIN
  17. APIHOOK_ENUM_ENTRY(SetWindowsHookExA)
  18. APIHOOK_ENUM_END
  19. // Local Hook Information
  20. HHOOK g_hCBTHook = NULL;
  21. HOOKPROC g_OriginalEncompassMonitorCBTProc = NULL;
  22. // Shared Data Infomation
  23. #define SHARED_SECTION_NAME "EncompassMonitor_SharedMemoryData"
  24. typedef struct
  25. {
  26. char szModuleFileName[MAX_PATH];
  27. HANDLE hModule;
  28. HOOKPROC pfnHookProc;
  29. } SHARED_HOOK_INFO, *PSHARED_HOOK_INFO;
  30. HANDLE g_hSharedMapping = NULL;
  31. PSHARED_HOOK_INFO g_pSharedHookInfo = NULL;
  32. // Creates Shared memory. Only called by the originial SHIM
  33. void CreateSharedMemory(HMODULE hModule, HOOKPROC pfnHookProc)
  34. {
  35. HANDLE hSharedFile;
  36. char szTempPath[MAX_PATH];
  37. char szTempFileName[MAX_PATH];
  38. // create the memory mapped file necessary to communicate between the original Instanace of SHIM
  39. // and the following instances of SHIMS
  40. DWORD dwTemp = GetTempPathA(sizeof(szTempPath), szTempPath);
  41. if (dwTemp == 0 ||
  42. dwTemp > sizeof(szTempPath))
  43. {
  44. DPFN( eDbgLevelError, "GetTempPath failed\n");
  45. goto errCreateSharedSection;
  46. }
  47. if (GetTempFileNameA(szTempPath, "mem", NULL, szTempFileName) == 0)
  48. {
  49. DPFN( eDbgLevelError, "GetTempFileName failed\n");
  50. goto errCreateSharedSection;
  51. }
  52. hSharedFile = CreateFileA( szTempFileName,
  53. GENERIC_READ | GENERIC_WRITE,
  54. FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
  55. NULL,
  56. CREATE_ALWAYS,
  57. FILE_ATTRIBUTE_TEMPORARY | FILE_FLAG_DELETE_ON_CLOSE,
  58. NULL);
  59. if (hSharedFile == NULL)
  60. {
  61. DPFN( eDbgLevelError, "CreateFile failed to create '%s'\n", szTempFileName);
  62. goto errCreateSharedSection;
  63. }
  64. // Increase size of file (create the mapping)
  65. g_hSharedMapping = CreateFileMappingA( hSharedFile,
  66. NULL,
  67. PAGE_READWRITE,
  68. NULL,
  69. sizeof(SHARED_HOOK_INFO),
  70. SHARED_SECTION_NAME);
  71. if (g_hSharedMapping == NULL)
  72. {
  73. DPFN( eDbgLevelError, "CreateFileMapping failed\n");
  74. goto errCreateSharedSection;
  75. }
  76. g_pSharedHookInfo = (PSHARED_HOOK_INFO)MapViewOfFile(g_hSharedMapping,
  77. FILE_MAP_ALL_ACCESS,
  78. 0,
  79. 0,
  80. sizeof(SHARED_HOOK_INFO));
  81. if (g_pSharedHookInfo == NULL)
  82. {
  83. DWORD dwErr = GetLastError();
  84. DPFN( eDbgLevelError, "MapViewOfFile failed [%d]", (int)dwErr);
  85. goto errCreateSharedSection;
  86. }
  87. CloseHandle(hSharedFile);
  88. g_pSharedHookInfo->hModule = hModule;
  89. g_pSharedHookInfo->pfnHookProc = pfnHookProc;
  90. if (0 == GetModuleFileNameA(hModule, g_pSharedHookInfo->szModuleFileName, MAX_PATH))
  91. {
  92. DPFN( eDbgLevelError, "GetModuleFileNameA failed\n");
  93. goto errCreateSharedSection;
  94. }
  95. if (!FlushViewOfFile(g_pSharedHookInfo, sizeof(SHARED_HOOK_INFO)))
  96. {
  97. DPFN( eDbgLevelError, "FlushViewOfFile failed\n");
  98. goto errCreateSharedSection;
  99. }
  100. DPFN( eDbgLevelInfo, "WRITE::Shared Section Successful");
  101. DPFN( eDbgLevelInfo, "WRITE::g_pSharedHookInfo->hModule=%x", g_pSharedHookInfo->hModule);
  102. DPFN( eDbgLevelInfo, "WRITE::g_pSharedHookInfo->pfnHookProc=%x", g_pSharedHookInfo->pfnHookProc);
  103. DPFN( eDbgLevelInfo, "WRITE::g_pSharedHookInfo->szModuleFileName=%s", g_pSharedHookInfo->szModuleFileName);
  104. return;
  105. errCreateSharedSection:
  106. DPFN( eDbgLevelError, "WRITE::Shared Section FAILED");
  107. return;
  108. }
  109. // Gets Shared Memory - Only called by injected versions of hook function
  110. void GetSharedMemory()
  111. {
  112. HANDLE hSharedFileMapping = NULL;
  113. hSharedFileMapping = OpenFileMappingA( FILE_MAP_ALL_ACCESS,
  114. FALSE,
  115. SHARED_SECTION_NAME);
  116. if (hSharedFileMapping != NULL)
  117. {
  118. PSHARED_HOOK_INFO pSharedHookInfo = (PSHARED_HOOK_INFO)MapViewOfFile( hSharedFileMapping,
  119. FILE_MAP_ALL_ACCESS,
  120. 0,
  121. 0,
  122. 0);
  123. if (pSharedHookInfo)
  124. {
  125. DPFN( eDbgLevelInfo, "READ::pSharedHookInfo->hModule=%x", pSharedHookInfo->hModule);
  126. DPFN( eDbgLevelInfo, "READ::pSharedHookInfo->pfnHookProc=%x", pSharedHookInfo->pfnHookProc);
  127. DPFN( eDbgLevelInfo, "READ::pSharedHookInfo->szModuleFileName=%s", pSharedHookInfo->szModuleFileName);
  128. // Load DLL with original CBT Proc in it.
  129. HANDLE hMod = LoadLibraryA(pSharedHookInfo->szModuleFileName);
  130. if (!hMod)
  131. {
  132. DPFN( eDbgLevelError, "LoadLibrary(\"%s\") - FAILED", pSharedHookInfo->szModuleFileName);
  133. }
  134. g_OriginalEncompassMonitorCBTProc = (HOOKPROC)((DWORD)hMod + ((DWORD)pSharedHookInfo->pfnHookProc) - (DWORD)pSharedHookInfo->hModule);
  135. DPFN( eDbgLevelInfo, "READ::Shared Section Successful - Original Hook at %x", g_OriginalEncompassMonitorCBTProc);
  136. CloseHandle(hSharedFileMapping);
  137. UnmapViewOfFile(pSharedHookInfo);
  138. }
  139. else
  140. {
  141. DPFN( eDbgLevelError, "MapViewOfFile() Failed");
  142. }
  143. }
  144. else
  145. {
  146. DPFN( eDbgLevelError, "READ::Shared Section Failed");
  147. }
  148. }
  149. // Replacement CBT Hook function
  150. LRESULT CALLBACK Filtered_EncompassMonitorCBTProc(
  151. int nCode, // hook code
  152. WPARAM wParam, // depends on hook code
  153. LPARAM lParam // depends on hook code
  154. )
  155. {
  156. LRESULT lResult = 0; // Allow operation to continue
  157. bool bFilterMessage = false;
  158. if (g_OriginalEncompassMonitorCBTProc == NULL)
  159. {
  160. GetSharedMemory();
  161. }
  162. if (nCode == HCBT_CREATEWND)
  163. {
  164. CBT_CREATEWNDA *pccw = (CBT_CREATEWNDA*)lParam;
  165. if ( (IS_INTRESOURCE(pccw->lpcs->lpszClass)) )
  166. {
  167. char szBuf[256];
  168. GetClassNameA((HWND)wParam, szBuf, 255);
  169. bFilterMessage=true;
  170. DPFN( eDbgLevelInfo, "[%x] - Filtered_EncompassMonitorCBTProc::HCBT_CREATEWND %s [ATOM CLASS FILTERED]", g_OriginalEncompassMonitorCBTProc, szBuf);
  171. }
  172. else
  173. {
  174. DPFN( eDbgLevelInfo, "[%x] - Filtered_EncompassMonitorCBTProc::HCBT_CREATEWND %s ", g_OriginalEncompassMonitorCBTProc, pccw->lpcs->lpszClass);
  175. }
  176. }
  177. if ( g_OriginalEncompassMonitorCBTProc )
  178. {
  179. if (bFilterMessage)
  180. {
  181. lResult = CallNextHookEx(g_hCBTHook, nCode, wParam, lParam);
  182. }
  183. else
  184. {
  185. lResult = g_OriginalEncompassMonitorCBTProc(nCode, wParam, lParam);
  186. }
  187. }
  188. else
  189. {
  190. DPFN( eDbgLevelError, "Filtered_EncompassMonitorCBTProc:: ** BAD g_OriginalEncompassMonitorCBTProc2 **");
  191. lResult = CallNextHookEx(g_hCBTHook, nCode, wParam, lParam);
  192. }
  193. return lResult;
  194. }
  195. // SHIMMED API
  196. HHOOK APIHOOK(SetWindowsHookExA)(
  197. int idHook, // hook type
  198. HOOKPROC lpfn, // hook procedure
  199. HINSTANCE hMod, // handle to application instance
  200. DWORD dwThreadId // thread identifier
  201. )
  202. {
  203. static int nNumCBThooks = 0;
  204. HHOOK hHook;
  205. if (idHook == WH_CBT)
  206. {
  207. nNumCBThooks++;
  208. switch(nNumCBThooks)
  209. {
  210. case 1:
  211. hHook = ORIGINAL_API(SetWindowsHookExA)(idHook, lpfn, hMod, dwThreadId);
  212. DPFN( eDbgLevelInfo, "%x=SetWindowsHookEx(%d, %x, %x, %x) - Ignoring First Hook Call", hHook, idHook, lpfn, hMod, dwThreadId);
  213. break;
  214. case 2:
  215. g_OriginalEncompassMonitorCBTProc = lpfn;
  216. g_hCBTHook = hHook = ORIGINAL_API(SetWindowsHookExA)(idHook, Filtered_EncompassMonitorCBTProc, g_hinstDll, dwThreadId);
  217. DPFN( eDbgLevelInfo, "%x=SetWindowsHookEx(%d, %x, %x, %x) - Replacing Hook with Filtered_EncompassMonitorCBTProc", hHook, idHook, lpfn, hMod, dwThreadId);
  218. CreateSharedMemory(hMod, lpfn);
  219. break;
  220. default:
  221. hHook = ORIGINAL_API(SetWindowsHookExA)(idHook, lpfn, hMod, dwThreadId);
  222. DPFN( eDbgLevelError, "SetWindowsHookEx -- More then 2 WH_CBT hooks [%d]", nNumCBThooks);
  223. break;
  224. }
  225. }
  226. else
  227. {
  228. hHook = ORIGINAL_API(SetWindowsHookExA)(idHook, lpfn, hMod, dwThreadId);
  229. }
  230. return hHook;
  231. }
  232. BOOL
  233. NOTIFY_FUNCTION(DWORD fdwReason)
  234. {
  235. if (fdwReason == DLL_PROCESS_DETACH)
  236. {
  237. if (g_hSharedMapping)
  238. {
  239. CloseHandle(g_hSharedMapping);
  240. g_hSharedMapping = NULL;
  241. }
  242. if (g_pSharedHookInfo)
  243. {
  244. UnmapViewOfFile(g_pSharedHookInfo);
  245. g_pSharedHookInfo = NULL;
  246. }
  247. }
  248. return TRUE;
  249. }
  250. /*++
  251. Register hooked functions
  252. --*/
  253. HOOK_BEGIN
  254. CALL_NOTIFY_FUNCTION
  255. APIHOOK_ENTRY(USER32.DLL, SetWindowsHookExA)
  256. HOOK_END
  257. IMPLEMENT_SHIM_END