thanks for your help
I'v installed a global hook in a DLL(SetWindowsHookEx(WH_CBT, CBTProc,
g_hInstDLL, 0)),this is the callback function:
LRESULT CALLBACK CBTProc(int nCode, WPARAM wParam, LPARAM lParam)
{
FILE* stream;
TCHAR sFilename[MAX_PATH]={0};
int n_count;
int pos=-2;
LPCBT_CREATEWND p=(LPCBT_CREATEWND)lParam;
if(nCode==HCBT_CREATEWND)
{
DWORD m_PID;
HANDLE m_handle;
GetWindowThreadProcessId((HWND)wParam,&m_PID);
m_handle=OpenProcess(PROCESS_ALL_ACCESS, TRUE, m_PID);
n_count=GetModuleFileNameEx((HMODULE)m_handle,NULL,sFilename,MAX_PATH);
CloseHandle(m_handle);
pos = strcmp( &sFilename[n_count-12], "AcroRd32.exe" );
if(pos==0)
{
stream = fopen( "c:\\sys_fopen.txt", "at" );
fwrite(sFilename,sizeof(char),n_count,stream);
fclose( stream );
}
}
I ran "AcroRd32.exe" ,then I opened "c:\\sys_fopen.txt", I found the code
above has run 44 times!
I can't understand this,and would you help me to write this code? thanks
You should be able to catch the creation of splash window as well if
you install a process wide hook and handle WH_CBT. Did you try that? I
am assuming you are doing this outside the app (separate process) which
necessitates a system wide hook.
---
Ajay