原文: C# 屏蔽Ctrl Alt Del 快捷键方法+屏蔽所有输入
Win32.cs
1/* 2 * 3 * FileCreate By Bluefire 4 * Used To Import WindowsApi 5 * 6 */ 7 8using System; 9using System.Collections.Generic; 10using System.Text; 11using System.Runtime.InteropServices; 12 13namespace Bluefire.LockKeyBoard 14{ 15 internal static class Win32 16 { 17 public const string ATOM_FLAG = "HookSysKey"; 18 public const string SHELL_FALG = "Winlogon"; 19 public const short SHELL_CODE_DWORDLEN = 318;//注入代码所占的双字数 20 public const short SHELL_CODE_LENGTH = (SHELL_CODE_DWORDLEN * 4);// '字节数 21 public const short SHELL_FUNCOFFSET = 0x8;// '注入代码线程函数偏移量 22 public const UInt32 STANDARD_RIGHTS_REQUIRED = 0x000F0000; 23 public const UInt32 STANDARD_RIGHTS_READ = 0x00020000; 24 public const UInt32 TOKEN_ASSIGN_PRIMARY = 0x0001; 25 public const UInt32 TOKEN_DUPLICATE = 0x0002; 26 public const UInt32 TOKEN_IMPERSONATE = 0x0004; 27 public const UInt32 TOKEN_QUERY = 0x0008; 28 public const UInt32 TOKEN_QUERY_SOURCE = 0x0010; 29 public const UInt32 TOKEN_ADJUST_PRIVILEGES = 0x0020; 30 public const UInt32 TOKEN_ADJUST_GROUPS = 0x0040; 31 public const UInt32 TOKEN_ADJUST_DEFAULT = 0x0080; 32 public const UInt32 TOKEN_ADJUST_SESSIONID = 0x0100; 33 public const UInt32 TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY); 34 public const UInt32 TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | 35 TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | 36 TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT | 37 TOKEN_ADJUST_SESSIONID); 38 public const UInt32 SE_PRIVILEGE_ENABLED = 0x00000002; 39 public const string SE_DEBUG_NAME = "SeDebugPrivilege"; 40 public const int TH32CS_SNAPPROCESS = 2; 41 [DllImport("kernel32.dll")] 42 public static extern IntPtr OpenProcess(ProcessAccessFlags dwDesiredAccess, 43 [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, 44 int dwProcessId); 45 [DllImport("kernel32.dll", SetLastError = true)] 46 public static extern bool ReadProcessMemory( 47 IntPtr hProcess, 48 IntPtr lpBaseAddress, 49 [Out] byte[] lpBuffer, 50 int dwSize, 51 out int lpNumberOfBytesRead 52 ); 53 [DllImport("kernel32.dll", SetLastError = true)] 54 public static extern bool WriteProcessMemory(IntPtr hProcess, 55 IntPtr lpBaseAddress, uint[] lpBuffer, uint nSize, 56 out int lpNumberOfBytesWritten); 57 58 [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Auto)] 59 public static extern ushort GlobalAddAtom(string lpString); 60 [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] 61 public static extern ushort GlobalDeleteAtom(ushort nAtom); 62 [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Auto, EntryPoint = "GlobalFindAtomW")] 63 public static extern ushort GlobalFindAtom(string lpString); 64 65 66 67 [DllImport("kernel32.dll", SetLastError = true)] 68 public static extern IntPtr CreateToolhelp32Snapshot(SnapshotFlags dwFlags, uint th32ProcessID); 69 [DllImport("kernel32.dll")] 70 public static extern bool Process32First(IntPtr hSnapshot, ref PROCESSENTRY32 lppe); 71 [DllImport("kernel32.dll")] 72 public static extern bool Process32Next(IntPtr hSnapshot, ref PROCESSENTRY32 lppe); 73 74 [DllImport("kernel32.dll", CharSet = CharSet.Auto)] 75 public static extern int lstrcmpi(string lpString1, string lpString2); 76 77 [DllImport("kernel32.dll", SetLastError = true)] 78 [return: MarshalAs(UnmanagedType.Bool)] 79 public static extern bool CloseHandle(IntPtr hObject); 80 81 [DllImport("kernel32.dll")] 82 public static extern IntPtr GetCurrentProcess(); 83 84 [DllImport("advapi32.dll", SetLastError = true)] 85 [return: MarshalAs(UnmanagedType.Bool)] 86 public static extern bool OpenProcessToken(IntPtr ProcessHandle, 87 UInt32 DesiredAccess, out IntPtr TokenHandle); 88 89 [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)] 90 [return: MarshalAs(UnmanagedType.Bool)] 91 public static extern bool LookupPrivilegeValue(string lpSystemName, string lpName, 92 out LUID lpLuid); 93 94 // Use this signature if you want the previous state information returned 95 [DllImport("advapi32.dll", SetLastError = true)] 96 [return: MarshalAs(UnmanagedType.Bool)] 97 public static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, 98 [MarshalAs(UnmanagedType.Bool)]bool DisableAllPrivileges, 99 ref TOKEN_PRIVILEGES NewState, 100 UInt32 BufferLengthInBytes, 101 ref TOKEN_PRIVILEGES PreviousState, 102 out UInt32 ReturnLengthInBytes); 103 [DllImport("kernel32.dll", CharSet = CharSet.Auto)] 104 public static extern IntPtr GetModuleHandle(string lpModuleName); 105 106 [DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)] 107 public static extern UIntPtr GetProcAddress(IntPtr hModule, string procName); 108 109 [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] 110 public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, 111 uint dwSize, AllocationType flAllocationType, MemoryProtection flProtect); 112 113 [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] 114 public static extern bool VirtualFreeEx(IntPtr hProcess, IntPtr lpAddress, 115 int dwSize, FreeType dwFreeType); 116 117 [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] 118 public static unsafe extern bool VirtualFreeEx( 119 IntPtr hProcess, byte* pAddress, 120 int size, FreeType freeType); 121 [DllImport("kernel32.dll")] 122 public static extern IntPtr CreateRemoteThread(IntPtr hProcess, 123 IntPtr lpThreadAttributes, uint dwStackSize, int 124 lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, out IntPtr lpThreadId); 125 [DllImport("kernel32.dll", SetLastError = true)] 126 public static extern UInt32 WaitForSingleObject(IntPtr hHandle, Int32 dwMilliseconds); 127 [DllImport("kernel32.dll")] 128 public static extern bool GetExitCodeThread(IntPtr hThread, out int lpExitCode); 129 130 [DllImport("user32.dll", SetLastError = true)] 131 public static extern IntPtr SetWindowsHookEx(HookType hookType, HookProc lpfn, IntPtr hMod, uint dwThreadId); 132 133 [DllImport("user32.dll", SetLastError = true)] 134 [return: MarshalAs(UnmanagedType.Bool)] 135 public static extern bool UnhookWindowsHookEx(IntPtr hhk); 136 137 138 [DllImport("user32.dll")] 139 public static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode, WM wParam, [In]KBDLLHOOKSTRUCT lParam); 140 141 [DllImport("user32.dll")] 142 public static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode, int wParam, int lParam); 143 144 [DllImport("Kernel32.dll", EntryPoint = "RtlMoveMemory", SetLastError = false)] 145 public static extern void MoveMemory(object dest, IntPtr src, int size); 146 147 [DllImport("user32.dll")] 148 public static extern bool BlockInput(bool fBlockIt); 149 150 } 151 internal delegate int HookProc(int code, IntPtr wParam, IntPtr lParam); 152 internal delegate int ThreadProc(IntPtr param); 153 internal enum HookType : int 154 { 155 WH_JOURNALRECORD = 0, 156 WH_JOURNALPLAYBACK = 1, 157 WH_KEYBOARD = 2, 158 WH_GETMESSAGE = 3, 159 WH_CALLWNDPROC = 4, 160 WH_CBT = 5, 161 WH_SYSMSGFILTER = 6, 162 WH_MOUSE = 7, 163 WH_HARDWARE = 8, 164 WH_DEBUG = 9, 165 WH_SHELL = 10, 166 WH_FOREGROUNDIDLE = 11, 167 WH_CALLWNDPROCRET = 12, 168 WH_KEYBOARD_LL = 13, 169 WH_MOUSE_LL = 14 170 } 171 [StructLayout(LayoutKind.Sequential)] 172 internal class KBDLLHOOKSTRUCT 173 { 174 public uint vkCode; 175 public uint scanCode; 176 public KBDLLHOOKSTRUCTFlags flags; 177 public uint time; 178 public UIntPtr dwExtraInfo; 179 } 180 181 [Flags()] 182 internal enum KBDLLHOOKSTRUCTFlags : uint 183 { 184 LLKHF_EXTENDED = 0x01, 185 LLKHF_INJECTED = 0x10, 186 LLKHF_ALTDOWN = 0x20, 187 LLKHF_UP = 0x80, 188 } 189 190 [StructLayout(LayoutKind.Sequential)] 191 internal struct PROCESSENTRY32 192 { 193 public uint dwSize; 194 public uint cntUsage; 195 public uint th32ProcessID; 196 public IntPtr th32DefaultHeapID; 197 public uint th32ModuleID; 198 public uint cntThreads; 199 public uint th32ParentProcessID; 200 public int pcPriClassBase; 201 public uint dwFlags; 202 [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)] 203 public string szExeFile; 204 }; 205 206 [Flags] 207 internal enum FreeType 208 { 209 Decommit = 0x4000, 210 Release = 0x8000, 211 } 212 213 [Flags] 214 internal enum SnapshotFlags : uint 215 { 216 HeapList = 0x00000001, 217 Process = 0x00000002, 218 Thread = 0x00000004, 219 Module = 0x00000008, 220 Module32 = 0x00000010, 221 Inherit = 0x80000000, 222 All = 0x0000001F 223 } 224 225 [Flags] 226 internal enum AllocationType 227 { 228 Commit = 0x1000, 229 Reserve = 0x2000, 230 Decommit = 0x4000, 231 Release = 0x8000, 232 Reset = 0x80000, 233 Physical = 0x400000, 234 TopDown = 0x100000, 235 WriteWatch = 0x200000, 236 LargePages = 0x20000000 237 } 238 239 [Flags] 240 internal enum MemoryProtection 241 { 242 Execute = 0x10, 243 ExecuteRead = 0x20, 244 ExecuteReadWrite = 0x40, 245 ExecuteWriteCopy = 0x80, 246 NoAccess = 0x01,x02, 247 ReadWrite = 0x04, 248 WriteCopy = 0x08, 249 GuardModifierflag = 0x100, 250 NoCacheModifierflag = 0x200, 251 WriteCombineModifierflag = 0x400 252 } 253 254 [Flags] 255 internal enum ProcessAccessFlags : uint 256 { 257 All = 0x001F0FFF, 258 Terminate = 0x00000001, 259 CreateThread = 0x00000002, 260 VMOperation = 0x00000008, 261 VMRead = 0x00000010, 262 VMWrite = 0x00000020, 263 DupHandle = 0x00000040, 264 SetInformation = 0x00000200, 265 QueryInformation = 0x00000400, 266 Synchronize = 0x00100000 267 } 268 269 [StructLayout(LayoutKind.Sequential)] 270 internal struct LUID 271 { 272 public long lowpart; 273 public long highpart; 274 } 275 276 [StructLayout(LayoutKind.Sequential)] 277 internal struct LUID_AND_ATTRIBUTES 278 { 279 public LUID pLuid; 280 public long Attributes; 281 } 282 283 [StructLayout(LayoutKind.Sequential)] 284 internal struct TOKEN_PRIVILEGES 285 { 286 public long PrivilegeCount; 287 public LUID_AND_ATTRIBUTES Privileges; 288 } 289 [StructLayout(LayoutKind.Sequential)] 290 internal struct PROCESSENTRY32W 291 { 292 public long dwSize; 293 public long cntUsage; 294 public long h32ProcessID; 295 public long th32DefaultHeapID; 296 public long h32ModuleID; 297 public long cntThreads; 298 public long th32ParentProcessID; 299 public long pcPriClassBase; 300 public long dwFlags; 301 public int[] szExeFile; 302 } 303 /// <summary> 304 /// Windows Messages 305 /// Defined in winuser.h from Windows SDK v6.1 306 /// Documentation pulled from MSDN. 307 /// </summary> 308 internal enum WM : uint 309 { 310 /// <summary> 311 /// The WM_NULL message performs no operation. An application sends the WM_NULL message if it wants to post a message that the recipient window will ignore. 312 /// </summary> 313 NULL = 0x0000, 314 /// <summary> 315 /// The WM_CREATE message is sent when an application requests that a window be created by calling the CreateWindowEx or CreateWindow function. (The message is sent before the function returns.) The window procedure of the new window receives this message after the window is created, but before the window becomes visible. 316 /// </summary> 317 CREATE = 0x0001, 318 /// <summary> 319 /// The WM_DESTROY message is sent when a window is being destroyed. It is sent to the window procedure of the window being destroyed after the window is removed from the screen. 320 /// This message is sent first to the window being destroyed and then to the child windows (if any) as they are destroyed. During the processing of the message, it can be assumed that all child windows still exist. 321 /// /// </summary> 322 DESTROY = 0x0002, 323 /// <summary> 324 /// The WM_MOVE message is sent after a window has been moved. 325 /// </summary> 326 MOVE = 0x0003, 327 /// <summary> 328 /// The WM_SIZE message is sent to a window after its size has changed. 329 /// </summary> 330 SIZE = 0x0005, 331 /// <summary> 332 /// The WM_ACTIVATE message is sent to both the window being activated and the window being deactivated. If the windows use the same input queue, the message is sent synchronously, first to the window procedure of the top-level window being deactivated, then to the window procedure of the top-level window being activated. If the windows use different input queues, the message is sent asynchronously, so the window is activated immediately. 333 /// </summary> 334 ACTIVATE = 0x0006, 335 /// <summary> 336 /// The WM_SETFOCUS message is sent to a window after it has gained the keyboard focus. 337 /// </summary> 338 SETFOCUS = 0x0007, 339 /// <summary> 340 /// The WM_KILLFOCUS message is sent to a window immediately before it loses the keyboard focus. 341 /// </summary> 342 KILLFOCUS = 0x0008, 343 /// <summary> 344 /// The WM_ENABLE message is sent when an application changes the enabled state of a window. It is sent to the window whose enabled state is changing. This message is sent before the EnableWindow function returns, but after the enabled state (WS_DISABLED style bit) of the window has changed. 345 /// </summary> 346 ENABLE = 0x000A, 347 /// <summary> 348 /// An application sends the WM_SETREDRAW message to a window to allow changes in that window to be redrawn or to prevent changes in that window from being redrawn. 349 /// </summary> 350 SETREDRAW = 0x000B, 351 /// <summary> 352 /// An application sends a WM_SETTEXT message to set the text of a window. 353 /// </summary> 354 SETTEXT = 0x000C, 355 /// <summary> 356 /// An application sends a WM_GETTEXT message to copy the text that corresponds to a window into a buffer provided by the caller. 357 /// </summary> 358 GETTEXT = 0x000D, 359 /// <summary> 360 /// An application sends a WM_GETTEXTLENGTH message to determine the length, in characters, of the text associated with a window. 361 /// </summary> 362 GETTEXTLENGTH = 0x000E, 363 /// <summary> 364 /// The WM_PAINT message is sent when the system or another application makes a request to paint a portion of an application's window. The message is sent when the UpdateWindow or RedrawWindow function is called, or by the DispatchMessage function when the application obtains a WM_PAINT message by using the GetMessage or PeekMessage function. 365 /// </summary> 366 PAINT = 0x000F, 367 /// <summary> 368 /// The WM_CLOSE message is sent as a signal that a window or an application should terminate. 369 /// </summary> 370 CLOSE = 0x0010, 371 /// <summary> 372 /// The WM_QUERYENDSESSION message is sent when the user chooses to end the session or when an application calls one of the system shutdown functions. If any application returns zero, the session is not ended. The system stops sending WM_QUERYENDSESSION messages as soon as one application returns zero. 373 /// After processing this message, the system sends the WM_ENDSESSION message with the wParam parameter set to the results of the WM_QUERYENDSESSION message. 374 /// </summary> 375 QUERYENDSESSION = 0x0011, 376 /// <summary> 377 /// The WM_QUERYOPEN message is sent to an icon when the user requests that the window be restored to its previous size and position. 378 /// </summary> 379 QUERYOPEN = 0x0013, 380 /// <summary> 381 /// The WM_ENDSESSION message is sent to an application after the system processes the results of the WM_QUERYENDSESSION message. The WM_ENDSESSION message informs the application whether the session is ending. 382 /// </summary> 383 ENDSESSION = 0x0016, 384 /// <summary> 385 /// The WM_QUIT message indicates a request to terminate an application and is generated when the application calls the PostQuitMessage function. It causes the GetMessage function to return zero. 386 /// </summary> 387 QUIT = 0x0012, 388 /// <summary> 389 /// The WM_ERASEBKGND message is sent when the window background must be erased (for example, when a window is resized). The message is sent to prepare an invalidated portion of a window for painting. 390 /// </summary> 391 ERASEBKGND = 0x0014, 392 /// <summary> 393 /// This message is sent to all top-level windows when a change is made to a system color setting. 394 /// </summary> 395 SYSCOLORCHANGE = 0x0015, 396 /// <summary> 397 /// The WM_SHOWWINDOW message is sent to a window when the window is about to be hidden or shown. 398 /// </summary> 399 SHOWWINDOW = 0x0018, 400 /// <summary> 401 /// An application sends the WM_WININICHANGE message to all top-level windows after making a change to the WIN.INI file. The SystemParametersInfo function sends this message after an application uses the function to change a setting in WIN.INI. 402 /// Note The WM_WININICHANGE message is provided only for compatibility with earlier versions of the system. Applications should use the WM_SETTINGCHANGE message. 403 /// </summary> 404 WININICHANGE = 0x001A, 405 /// <summary> 406 /// An application sends the WM_WININICHANGE message to all top-level windows after making a change to the WIN.INI file. The SystemParametersInfo function sends this message after an application uses the function to change a setting in WIN.INI. 407 /// Note The WM_WININICHANGE message is provided only for compatibility with earlier versions of the system. Applications should use the WM_SETTINGCHANGE message. 408 /// </summary> 409 SETTINGCHANGE = WM.WININICHANGE, 410 /// <summary> 411 /// The WM_DEVMODECHANGE message is sent to all top-level windows whenever the user changes device-mode settings. 412 /// </summary> 413 DEVMODECHANGE = 0x001B, 414 /// <summary> 415 /// The WM_ACTIVATEAPP message is sent when a window belonging to a different application than the active window is about to be activated. The message is sent to the application whose window is being activated and to the application whose window is being deactivated. 416 /// </summary> 417 ACTIVATEAPP = 0x001C, 418 /// <summary> 419 /// An application sends the WM_FONTCHANGE message to all top-level windows in the system after changing the pool of font resources. 420 /// </summary> 421 FONTCHANGE = 0x001D, 422 /// <summary> 423 /// A message that is sent whenever there is a change in the system time. 424 /// </summary> 425 TIMECHANGE = 0x001E, 426 /// <summary> 427 /// The WM_CANCELMODE message is sent to cancel certain modes, such as mouse capture. For example, the system sends this message to the active window when a dialog box or message box is displayed. Certain functions also send this message explicitly to the specified window regardless of whether it is the active window. For example, the EnableWindow function sends this message when disabling the specified window. 428 /// </summary> 429 CANCELMODE = 0x001F, 430 /// <summary> 431 /// The WM_SETCURSOR message is sent to a window if the mouse causes the cursor to move within a window and mouse input is not captured. 432 /// </summary> 433 SETCURSOR = 0x0020, 434 /// <summary> 435 /// The WM_MOUSEACTIVATE message is sent when the cursor is in an inactive window and the user presses a mouse button. The parent window receives this message only if the child window passes it to the DefWindowProc function. 436 /// </summary> 437 MOUSEACTIVATE = 0x0021, 438 /// <summary> 439 /// The WM_CHILDACTIVATE message is sent to a child window when the user clicks the window's title bar or when the window is activated, moved, or sized. 440 /// </summary> 441 CHILDACTIVATE = 0x0022, 442 /// <summary> 443 /// The WM_QUEUESYNC message is sent by a computer-based training (CBT) application to separate user-input messages from other messages sent through the WH_JOURNALPLAYBACK Hook procedure. 444 /// </summary> 445 QUEUESYNC = 0x0023, 446 /// <summary> 447 /// The WM_GETMINMAXINFO message is sent to a window when the size or position of the window is about to change. An application can use this message to override the window's default maximized size and position, or its default minimum or maximum tracking size. 448 /// </summary> 449 GETMINMAXINFO = 0x0024, 450 /// <summary> 451 /// Windows NT 3.51 and earlier: The WM_PAINTICON message is sent to a minimized window when the icon is to be painted. This message is not sent by newer versions of Microsoft Windows, except in unusual circumstances explained in the Remarks. 452 /// </summary> 453 PAINTICON = 0x0026, 454 /// <summary> 455 /// Windows NT 3.51 and earlier: The WM_ICONERASEBKGND message is sent to a minimized window when the background of the icon must be filled before painting the icon. A window receives this message only if a class icon is defined for the window; otherwise, WM_ERASEBKGND is sent. This message is not sent by newer versions of Windows. 456 /// </summary> 457 ICONERASEBKGND = 0x0027, 458 /// <summary> 459 /// The WM_NEXTDLGCTL message is sent to a dialog box procedure to set the keyboard focus to a different control in the dialog box. 460 /// </summary> 461 NEXTDLGCTL = 0x0028, 462 /// <summary> 463 /// The WM_SPOOLERSTATUS message is sent from Print Manager whenever a job is added to or removed from the Print Manager queue. 464 /// </summary> 465 SPOOLERSTATUS = 0x002A, 466 /// <summary> 467 /// The WM_DRAWITEM message is sent to the parent window of an owner-drawn button, combo box, list box, or menu when a visual aspect of the button, combo box, list box, or menu has changed. 468 /// </summary> 469 DRAWITEM = 0x002B, 470 /// <summary> 471 /// The WM_MEASUREITEM message is sent to the owner window of a combo box, list box, list view control, or menu item when the control or menu is created. 472 /// </summary> 473 MEASUREITEM = 0x002C, 474 /// <summary> 475 /// Sent to the owner of a list box or combo box when the list box or combo box is destroyed or when items are removed by the LB_DELETESTRING, LB_RESETCONTENT, CB_DELETESTRING, or CB_RESETCONTENT message. The system sends a WM_DELETEITEM message for each deleted item. The system sends the WM_DELETEITEM message for any deleted list box or combo box item with nonzero item data. 476 /// </summary> 477 DELETEITEM = 0x002D, 478 /// <summary> 479 /// Sent by a list box with the LBS_WANTKEYBOARDINPUT style to its owner in response to a WM_KEYDOWN message. 480 /// </summary> 481 VKEYTOITEM = 0x002E, 482 /// <summary> 483 /// Sent by a list box with the LBS_WANTKEYBOARDINPUT style to its owner in response to a WM_CHAR message. 484 /// </summary> 485 CHARTOITEM = 0x002F, 486 /// <summary> 487 /// An application sends a WM_SETFONT message to specify the font that a control is to use when drawing text. 488 /// </summary> 489 SETFONT = 0x0030, 490 /// <summary> 491 /// An application sends a WM_GETFONT message to a control to retrieve the font with which the control is currently drawing its text. 492 /// </summary> 493 GETFONT = 0x0031, 494 /// <summary> 495 /// An application sends a WM_SETHOTKEY message to a window to associate a hot key with the window. When the user presses the hot key, the system activates the window. 496 /// </summary> 497 SETHOTKEY = 0x0032, 498 /// <summary> 499 /// An application sends a WM_GETHOTKEY message to determine the hot key associated with a window. 500 /// </summary> 501 GETHOTKEY = 0x0033, 502 /// <summary> 503 /// The WM_QUERYDRAGICON message is sent to a minimized (iconic) window. The window is about to be dragged by the user but does not have an icon defined for its class. An application can return a handle to an icon or cursor. The system displays this cursor or icon while the user drags the icon. 504 /// </summary> 505 QUERYDRAGICON = 0x0037, 506 /// <summary> 507 /// The system sends the WM_COMPAREITEM message to determine the relative position of a new item in the sorted list of an owner-drawn combo box or list box. Whenever the application adds a new item, the system sends this message to the owner of a combo box or list box created with the CBS_SORT or LBS_SORT style. 508 /// </summary> 509 COMPAREITEM = 0x0039, 510 /// <summary> 511 /// Active Accessibility sends the WM_GETOBJECT message to obtain information about an accessible object contained in a server application. 512 /// Applications never send this message directly. It is sent only by Active Accessibility in response to calls to AccessibleObjectFromPoint, AccessibleObjectFromEvent, or AccessibleObjectFromWindow. However, server applications handle this message. 513 /// </summary> 514 GETOBJECT = 0x003D, 515 /// <summary> 516 /// The WM_COMPACTING message is sent to all top-level windows when the system detects more than 12.5 percent of system time over a 30- to 60-second interval is being spent compacting memory. This indicates that system memory is low. 517 /// </summary> 518 COMPACTING = 0x0041, 519 /// <summary> 520 /// WM_COMMNOTIFY is Obsolete for Win32-Based Applications 521 /// </summary> 522 [Obsolete] 523 COMMNOTIFY = 0x0044, 524 /// <summary> 525 /// The WM_WINDOWPOSCHANGING message is sent to a window whose size, position, or place in the Z order is about to change as a result of a call to the SetWindowPos function or another window-management function. 526 /// </summary> 527 WINDOWPOSCHANGING = 0x0046, 528 /// <summary> 529 /// The WM_WINDOWPOSCHANGED message is sent to a window whose size, position, or place in the Z order has changed as a result of a call to the SetWindowPos function or another window-management function. 530 /// </summary> 531 WINDOWPOSCHANGED = 0x0047, 532 /// <summary> 533 /// Notifies applications that the system, typically a battery-powered personal computer, is about to enter a suspended mode. 534 /// Use: POWERBROADCAST 535 /// </summary> 536 [Obsolete] 537 POWER = 0x0048, 538 /// <summary> 539 /// An application sends the WM_COPYDATA message to pass data to another application. 540 /// </summary> 541 COPYDATA = 0x004A, 542 /// <summary> 543 /// The WM_CANCELJOURNAL message is posted to an application when a user cancels the application's journaling activities. The message is posted with a NULL window handle. 544 /// </summary> 545 CANCELJOURNAL = 0x004B, 546 /// <summary> 547 /// Sent by a common control to its parent window when an event has occurred or the control requires some information. 548 /// </summary> 549 NOTIFY = 0x004E, 550 /// <summary> 551 /// The WM_INPUTLANGCHANGEREQUEST message is posted to the window with the focus when the user chooses a new input language, either with the hotkey (specified in the Keyboard control panel application) or from the indicator on the system taskbar. An application can accept the change by passing the message to the DefWindowProc function or reject the change (and prevent it from taking place) by returning immediately. 552 /// </summary> 553 INPUTLANGCHANGEREQUEST = 0x0050, 554 /// <summary> 555 /// The WM_INPUTLANGCHANGE message is sent to the topmost affected window after an application's input language has been changed. You should make any application-specific settings and pass the message to the DefWindowProc function, which passes the message to all first-level child windows. These child windows can pass the message to DefWindowProc to have it pass the message to their child windows, and so on. 556 /// </summary> 557 INPUTLANGCHANGE = 0x0051, 558 /// <summary> 559 /// Sent to an application that has initiated a training card with Microsoft Windows Help. The message informs the application when the user clicks an authorable button. An application initiates a training card by specifying the HELP_TCARD command in a call to the WinHelp function. 560 /// </summary> 561 TCARD = 0x0052, 562 /// <summary> 563 /// Indicates that the user pressed the F1 key. If a menu is active when F1 is pressed, WM_HELP is sent to the window associated with the menu; otherwise, WM_HELP is sent to the window that has the keyboard focus. If no window has the keyboard focus, WM_HELP is sent to the currently active window. 564 /// </summary> 565 HELP = 0x0053, 566 /// <summary> 567 /// The WM_USERCHANGED message is sent to all windows after the user has logged on or off. When the user logs on or off, the system updates the user-specific settings. The system sends this message immediately after updating the settings. 568 /// </summary> 569 USERCHANGED = 0x0054, 570 /// <summary> 571 /// Determines if a window accepts ANSI or Unicode structures in the WM_NOTIFY notification message. WM_NOTIFYFORMAT messages are sent from a common control to its parent window and from the parent window to the common control. 572 /// </summary> 573 NOTIFYFORMAT = 0x0055, 574 /// <summary> 575 /// The WM_CONTEXTMENU message notifies a window that the user clicked the right mouse button (right-clicked) in the window. 576 /// </summary> 577 CONTEXTMENU = 0x007B, 578 /// <summary> 579 /// The WM_STYLECHANGING message is sent to a window when the SetWindowLong function is about to change one or more of the window's styles. 580 /// </summary> 581 STYLECHANGING = 0x007C, 582 /// <summary> 583 /// The WM_STYLECHANGED message is sent to a window after the SetWindowLong function has changed one or more of the window's styles 584 /// </summary> 585 STYLECHANGED = 0x007D, 586 /// <summary> 587 /// The WM_DISPLAYCHANGE message is sent to all windows when the display resolution has changed. 588 /// </summary> 589 DISPLAYCHANGE = 0x007E, 590 /// <summary> 591 /// The WM_GETICON message is sent to a window to retrieve a handle to the large or small icon associated with a window. The system displays the large icon in the ALT+TAB dialog, and the small icon in the window caption. 592 /// </summary> 593 GETICON = 0x007F, 594 /// <summary> 595 /// An application sends the WM_SETICON message to associate a new large or small icon with a window. The system displays the large icon in the ALT+TAB dialog box, and the small icon in the window caption. 596 /// </summary> 597 SETICON = 0x0080, 598 /// <summary> 599 /// The WM_NCCREATE message is sent prior to the WM_CREATE message when a window is first created. 600 /// </summary> 601 NCCREATE = 0x0081, 602 /// <summary> 603 /// The WM_NCDESTROY message informs a window that its nonclient area is being destroyed. The DestroyWindow function sends the WM_NCDESTROY message to the window following the WM_DESTROY message. WM_DESTROY is used to free the allocated memory object associated with the window. 604 /// The WM_NCDESTROY message is sent after the child windows have been destroyed. In contrast, WM_DESTROY is sent before the child windows are destroyed. 605 /// </summary> 606 NCDESTROY = 0x0082, 607 /// <summary> 608 /// The WM_NCCALCSIZE message is sent when the size and position of a window's client area must be calculated. By processing this message, an application can control the content of the window's client area when the size or position of the window changes. 609 /// </summary> 610 NCCALCSIZE = 0x0083, 611 /// <summary> 612 /// The WM_NCHITTEST message is sent to a window when the cursor moves, or when a mouse button is pressed or released. If the mouse is not captured, the message is sent to the window beneath the cursor. Otherwise, the message is sent to the window that has captured the mouse. 613 /// </summary> 614 NCHITTEST = 0x0084, 615 /// <summary> 616 /// The WM_NCPAINT message is sent to a window when its frame must be painted. 617 /// </summary> 618 NCPAINT = 0x0085, 619 /// <summary> 620 /// The WM_NCACTIVATE message is sent to a window when its nonclient area needs to be changed to indicate an active or inactive state. 621 /// </summary> 622 NCACTIVATE = 0x0086, 623 /// <summary> 624 /// The WM_GETDLGCODE message is sent to the window procedure associated with a control. By default, the system handles all keyboard input to the control; the system interprets certain types of keyboard input as dialog box navigation keys. To override this default behavior, the control can respond to the WM_GETDLGCODE message to indicate the types of input it wants to process itself. 625 /// </summary> 626 GETDLGCODE = 0x0087, 627 /// <summary> 628 /// The WM_SYNCPAINT message is used to synchronize painting while avoiding linking independent GUI threads. 629 /// </summary> 630 SYNCPAINT = 0x0088, 631 /// <summary> 632 /// The WM_NCMOUSEMOVE message is posted to a window when the cursor is moved within the nonclient area of the window. This message is posted to the window that contains the cursor. If a window has captured the mouse, this message is not posted. 633 /// </summary> 634 NCMOUSEMOVE = 0x00A0, 635 /// <summary> 636 /// The WM_NCLBUTTONDOWN message is posted when the user presses the left mouse button while the cursor is within the nonclient area of a window. This message is posted to the window that contains the cursor. If a window has captured the mouse, this message is not posted. 637 /// </summary> 638 NCLBUTTONDOWN = 0x00A1, 639 /// <summary> 640 /// The WM_NCLBUTTONUP message is posted when the user releases the left mouse button while the cursor is within the nonclient area of a window. This message is posted to the window that contains the cursor. If a window has captured the mouse, this message is not posted. 641 /// </summary> 642 NCLBUTTONUP = 0x00A2, 643 /// <summary> 644 /// The WM_NCLBUTTONDBLCLK message is posted when the user double-clicks the left mouse button while the cursor is within the nonclient area of a window. This message is posted to the window that contains the cursor. If a window has captured the mouse, this message is not posted. 645 /// </summary> 646 NCLBUTTONDBLCLK = 0x00A3, 647 /// <summary> 648 /// The WM_NCRBUTTONDOWN message is posted when the user presses the right mouse button while the cursor is within the nonclient area of a window. This message is posted to the window that contains the cursor. If a window has captured the mouse, this message is not posted. 649 /// </summary> 650 NCRBUTTONDOWN = 0x00A4, 651 /// <summary> 652 /// The WM_NCRBUTTONUP message is posted when the user releases the right mouse button while the cursor is within the nonclient area of a window. This message is posted to the window that contains the cursor. If a window has captured the mouse, this message is not posted. 653 /// </summary> 654 NCRBUTTONUP = 0x00A5, 655 /// <summary> 656 /// The WM_NCRBUTTONDBLCLK message is posted when the user double-clicks the right mouse button while the cursor is within the nonclient area of a window. This message is posted to the window that contains the cursor. If a window has captured the mouse, this message is not posted. 657 /// </summary> 658 NCRBUTTONDBLCLK = 0x00A6, 659 /// <summary> 660 /// The WM_NCMBUTTONDOWN message is posted when the user presses the middle mouse button while the cursor is within the nonclient area of a window. This message is posted to the window that contains the cursor. If a window has captured the mouse, this message is not posted. 661 /// </summary> 662 NCMBUTTONDOWN = 0x00A7, 663 /// <summary> 664 /// The WM_NCMBUTTONUP message is posted when the user releases the middle mouse button while the cursor is within the nonclient area of a window. This message is posted to the window that contains the cursor. If a window has captured the mouse, this message is not posted. 665 /// </summary> 666 NCMBUTTONUP = 0x00A8, 667 /// <summary> 668 /// The WM_NCMBUTTONDBLCLK message is posted when the user double-clicks the middle mouse button while the cursor is within the nonclient area of a window. This message is posted to the window that contains the cursor. If a window has captured the mouse, this message is not posted. 669 /// </summary> 670 NCMBUTTONDBLCLK = 0x00A9, 671 /// <summary> 672 /// The WM_NCXBUTTONDOWN message is posted when the user presses the first or second X button while the cursor is in the nonclient area of a window. This message is posted to the window that contains the cursor. If a window has captured the mouse, this message is not posted. 673 /// </summary> 674 NCXBUTTONDOWN = 0x00AB, 675 /// <summary> 676 /// The WM_NCXBUTTONUP message is posted when the user releases the first or second X button while the cursor is in the nonclient area of a window. This message is posted to the window that contains the cursor. If a window has captured the mouse, this message is not posted. 677 /// </summary> 678 NCXBUTTONUP = 0x00AC, 679 /// <summary> 680 /// The WM_NCXBUTTONDBLCLK message is posted when the user double-clicks the first or second X button while the cursor is in the nonclient area of a window. This message is posted to the window that contains the cursor. If a window has captured the mouse, this message is not posted. 681 /// </summary> 682 NCXBUTTONDBLCLK = 0x00AD, 683 /// <summary> 684 /// The WM_INPUT_DEVICE_CHANGE message is sent to the window that registered to receive raw input. A window receives this message through its WindowProc function. 685 /// </summary> 686 INPUT_DEVICE_CHANGE = 0x00FE, 687 /// <summary> 688 /// The WM_INPUT message is sent to the window that is getting raw input. 689 /// </summary> 690 INPUT = 0x00FF, 691 /// <summary> 692 /// This message filters for keyboard messages. 693 /// </summary> 694 KEYFIRST = 0x0100, 695 /// <summary> 696 /// The WM_KEYDOWN message is posted to the window with the keyboard focus when a nonsystem key is pressed. A nonsystem key is a key that is pressed when the ALT key is not pressed. 697 /// </summary> 698 KEYDOWN = 0x0100, 699 /// <summary> 700 /// The WM_KEYUP message is posted to the window with the keyboard focus when a nonsystem key is released. A nonsystem key is a key that is pressed when the ALT key is not pressed, or a keyboard key that is pressed when a window has the keyboard focus. 701 /// </summary> 702 KEYUP = 0x0101, 703 /// <summary> 704 /// The WM_CHAR message is posted to the window with the keyboard focus when a WM_KEYDOWN message is translated by the TranslateMessage function. The WM_CHAR message contains the character code of the key that was pressed. 705 /// </summary> 706 CHAR = 0x0102, 707 /// <summary> 708 /// The WM_DEADCHAR message is posted to the window with the keyboard focus when a WM_KEYUP message is translated by the TranslateMessage function. WM_DEADCHAR specifies a character code generated by a dead key. A dead key is a key that generates a character, such as the umlaut (double-dot), that is combined with another character to form a composite character. For example, the umlaut-O character (Ö) is generated by typing the dead key for the umlaut character, and then typing the O key. 709 /// </summary> 710 DEADCHAR = 0x0103, 711 /// <summary> 712 /// The WM_SYSKEYDOWN message is posted to the window with the keyboard focus when the user presses the F10 key (which activates the menu bar) or holds down the ALT key and then presses another key. It also occurs when no window currently has the keyboard focus; in this case, the WM_SYSKEYDOWN message is sent to the active window. The window that receives the message can distinguish between these two contexts by checking the context code in the lParam parameter. 713 /// </summary> 714 SYSKEYDOWN = 0x0104, 715 /// <summary> 716 /// The WM_SYSKEYUP message is posted to the window with the keyboard focus when the user releases a key that was pressed while the ALT key was held down. It also occurs when no window currently has the keyboard focus; in this case, the WM_SYSKEYUP message is sent to the active window. The window that receives the message can distinguish between these two contexts by checking the context code in the lParam parameter. 717 /// </summary> 718 SYSKEYUP = 0x0105, 719 /// <summary> 720 /// The WM_SYSCHAR message is posted to the window with the keyboard focus when a WM_SYSKEYDOWN message is translated by the TranslateMessage function. It specifies the character code of a system character key — that is, a character key that is pressed while the ALT key is down. 721 /// </summary> 722 SYSCHAR = 0x0106, 723 /// <summary> 724 /// The WM_SYSDEADCHAR message is sent to the window with the keyboard focus when a WM_SYSKEYDOWN message is translated by the TranslateMessage function. WM_SYSDEADCHAR specifies the character code of a system dead key — that is, a dead key that is pressed while holding down the ALT key. 725 /// </summary> 726 SYSDEADCHAR = 0x0107, 727 /// <summary> 728 /// The WM_UNICHAR message is posted to the window with the keyboard focus when a WM_KEYDOWN message is translated by the TranslateMessage function. The WM_UNICHAR message contains the character code of the key that was pressed. 729 /// The WM_UNICHAR message is equivalent to WM_CHAR, but it uses Unicode Transformation Format (UTF)-32, whereas WM_CHAR uses UTF-16. It is designed to send or post Unicode characters to ANSI windows and it can can handle Unicode Supplementary Plane characters. 730 /// </summary> 731 UNICHAR = 0x0109, 732 /// <summary> 733 /// This message filters for keyboard messages. 734 /// </summary> 735 KEYLAST = 0x0109, 736 /// <summary> 737 /// Sent immediately before the IME generates the composition string as a result of a keystroke. A window receives this message through its WindowProc function. 738 /// </summary> 739 IME_STARTCOMPOSITION = 0x010D, 740 /// <summary> 741 /// Sent to an application when the IME ends composition. A window receives this message through its WindowProc function. 742 /// </summary> 743 IME_ENDCOMPOSITION = 0x010E, 744 /// <summary> 745 /// Sent to an application when the IME changes composition status as a result of a keystroke. A window receives this message through its WindowProc function. 746 /// </summary> 747 IME_COMPOSITION = 0x010F, 748 IME_KEYLAST = 0x010F, 749 /// <summary> 750 /// The WM_INITDIALOG message is sent to the dialog box procedure immediately before a dialog box is displayed. Dialog box procedures typically use this message to initialize controls and carry out any other initialization tasks that affect the appearance of the dialog box. 751 /// </summary> 752 INITDIALOG = 0x0110, 753 /// <summary> 754 /// The WM_COMMAND message is sent when the user selects a command item from a menu, when a control sends a notification message to its parent window, or when an accelerator keystroke is translated. 755 /// </summary> 756 COMMAND = 0x0111, 757 /// <summary> 758 /// A window receives this message when the user chooses a command from the Window menu, clicks the maximize button, minimize button, restore button, close button, or moves the form. You can stop the form from moving by filtering this out. 759 /// </summary> 760 SYSCOMMAND = 0x0112, 761 /// <summary> 762 /// The WM_TIMER message is posted to the installing thread's message queue when a timer expires. The message is posted by the GetMessage or PeekMessage function. 763 /// </summary> 764 TIMER = 0x0113, 765 /// <summary> 766 /// The WM_HSCROLL message is sent to a window when a scroll event occurs in the window's standard horizontal scroll bar. This message is also sent to the owner of a horizontal scroll bar control when a scroll event occurs in the control. 767 /// </summary> 768 HSCROLL = 0x0114, 769 /// <summary> 770 /// The WM_VSCROLL message is sent to a window when a scroll event occurs in the window's standard vertical scroll bar. This message is also sent to the owner of a vertical scroll bar control when a scroll event occurs in the control. 771 /// </summary> 772 VSCROLL = 0x0115, 773 /// <summary> 774 /// The WM_INITMENU message is sent when a menu is about to become active. It occurs when the user clicks an item on the menu bar or presses a menu key. This allows the application to modify the menu before it is displayed. 775 /// </summary> 776 INITMENU = 0x0116, 777 /// <summary> 778 /// The WM_INITMENUPOPUP message is sent when a drop-down menu or submenu is about to become active. This allows an application to modify the menu before it is displayed, without changing the entire menu. 779 /// </summary> 780 INITMENUPOPUP = 0x0117, 781 /// <summary> 782 /// The WM_MENUSELECT message is sent to a menu's owner window when the user selects a menu item. 783 /// </summary> 784 MENUSELECT = 0x011F, 785 /// <summary> 786 /// The WM_MENUCHAR message is sent when a menu is active and the user presses a key that does not correspond to any mnemonic or accelerator key. This message is sent to the window that owns the menu. 787 /// </summary> 788 MENUCHAR = 0x0120, 789 /// <summary> 790 /// The WM_ENTERIDLE message is sent to the owner window of a modal dialog box or menu that is entering an idle state. A modal dialog box or menu enters an idle state when no messages are waiting in its queue after it has processed one or more previous messages. 791 /// </summary> 792 ENTERIDLE = 0x0121, 793 /// <summary> 794 /// The WM_MENURBUTTONUP message is sent when the user releases the right mouse button while the cursor is on a menu item. 795 /// </summary> 796 MENURBUTTONUP = 0x0122, 797 /// <summary> 798 /// The WM_MENUDRAG message is sent to the owner of a drag-and-drop menu when the user drags a menu item. 799 /// </summary> 800 MENUDRAG = 0x0123, 801 /// <summary> 802 /// The WM_MENUGETOBJECT message is sent to the owner of a drag-and-drop menu when the mouse cursor enters a menu item or moves from the center of the item to the top or bottom of the item. 803 /// </summary> 804 MENUGETOBJECT = 0x0124, 805 /// <summary> 806 /// The WM_UNINITMENUPOPUP message is sent when a drop-down menu or submenu has been destroyed. 807 /// </summary> 808 UNINITMENUPOPUP = 0x0125, 809 /// <summary> 810 /// The WM_MENUCOMMAND message is sent when the user makes a selection from a menu. 811 /// </summary> 812 MENUCOMMAND = 0x0126, 813 /// <summary> 814 /// An application sends the WM_CHANGEUISTATE message to indicate that the user interface (UI) state should be changed. 815 /// </summary> 816 CHANGEUISTATE = 0x0127, 817 /// <summary> 818 /// An application sends the WM_UPDATEUISTATE message to change the user interface (UI) state for the specified window and all its child windows. 819 /// </summary> 820 UPDATEUISTATE = 0x0128, 821 /// <summary> 822 /// An application sends the WM_QUERYUISTATE message to retrieve the user interface (UI) state for a window. 823 /// </summary> 824 QUERYUISTATE = 0x0129, 825 /// <summary> 826 /// The WM_CTLCOLORMSGBOX message is sent to the owner window of a message box before Windows draws the message box. By responding to this message, the owner window can set the text and background colors of the message box by using the given display device context handle. 827 /// </summary> 828 CTLCOLORMSGBOX = 0x0132, 829 /// <summary> 830 /// An edit control that is not read-only or disabled sends the WM_CTLCOLOREDIT message to its parent window when the control is about to be drawn. By responding to this message, the parent window can use the specified device context handle to set the text and background colors of the edit control. 831 /// </summary> 832 CTLCOLOREDIT = 0x0133, 833 /// <summary> 834 /// Sent to the parent window of a list box before the system draws the list box. By responding to this message, the parent window can set the text and background colors of the list box by using the specified display device context handle. 835 /// </summary> 836 CTLCOLORLISTBOX = 0x0134, 837 /// <summary> 838 /// The WM_CTLCOLORBTN message is sent to the parent window of a button before drawing the button. The parent window can change the button's text and background colors. However, only owner-drawn buttons respond to the parent window processing this message. 839 /// </summary> 840 CTLCOLORBTN = 0x0135, 841 /// <summary> 842 /// The WM_CTLCOLORDLG message is sent to a dialog box before the system draws the dialog box. By responding to this message, the dialog box can set its text and background colors using the specified display device context handle. 843 /// </summary> 844 CTLCOLORDLG = 0x0136, 845 /// <summary> 846 /// The WM_CTLCOLORSCROLLBAR message is sent to the parent window of a scroll bar control when the control is about to be drawn. By responding to this message, the parent window can use the display context handle to set the background color of the scroll bar control. 847 /// </summary> 848 CTLCOLORSCROLLBAR = 0x0137, 849 /// <summary> 850 /// A static control, or an edit control that is read-only or disabled, sends the WM_CTLCOLORSTATIC message to its parent window when the control is about to be drawn. By responding to this message, the parent window can use the specified device context handle to set the text and background colors of the static control. 851 /// </summary> 852 CTLCOLORSTATIC = 0x0138, 853 /// <summary> 854 /// Use WM_MOUSEFIRST to specify the first mouse message. Use the PeekMessage() Function. 855 /// </summary> 856 MOUSEFIRST = 0x0200, 857 /// <summary> 858 /// The WM_MOUSEMOVE message is posted to a window when the cursor moves. If the mouse is not captured, the message is posted to the window that contains the cursor. Otherwise, the message is posted to the window that has captured the mouse. 859 /// </summary> 860 MOUSEMOVE = 0x0200, 861 /// <summary> 862 /// The WM_LBUTTONDOWN message is posted when the user presses the left mouse button while the cursor is in the client area of a window. If the mouse is not captured, the message is posted to the window beneath the cursor. Otherwise, the message is posted to the window that has captured the mouse. 863 /// </summary> 864 LBUTTONDOWN = 0x0201, 865 /// <summary> 866 /// The WM_LBUTTONUP message is posted when the user releases the left mouse button while the cursor is in the client area of a window. If the mouse is not captured, the message is posted to the window beneath the cursor. Otherwise, the message is posted to the window that has captured the mouse. 867 /// </summary> 868 LBUTTONUP = 0x0202, 869 /// <summary> 870 /// The WM_LBUTTONDBLCLK message is posted when the user double-clicks the left mouse button while the cursor is in the client area of a window. If the mouse is not captured, the message is posted to the window beneath the cursor. Otherwise, the message is posted to the window that has captured the mouse. 871 /// </summary> 872 LBUTTONDBLCLK = 0x0203, 873 /// <summary> 874 /// The WM_RBUTTONDOWN message is posted when the user presses the right mouse button while the cursor is in the client area of a window. If the mouse is not captured, the message is posted to the window beneath the cursor. Otherwise, the message is posted to the window that has captured the mouse. 875 /// </summary> 876 RBUTTONDOWN = 0x0204, 877 /// <summary> 878 /// The WM_RBUTTONUP message is posted when the user releases the right mouse button while the cursor is in the client area of a window. If the mouse is not captured, the message is posted to the window beneath the cursor. Otherwise, the message is posted to the window that has captured the mouse. 879 /// </summary> 880 RBUTTONUP = 0x0205, 881 /// <summary> 882 /// The WM_RBUTTONDBLCLK message is posted when the user double-clicks the right mouse button while the cursor is in the client area of a window. If the mouse is not captured, the message is posted to the window beneath the cursor. Otherwise, the message is posted to the window that has captured the mouse. 883 /// </summary> 884 RBUTTONDBLCLK = 0x0206, 885 /// <summary> 886 /// The WM_MBUTTONDOWN message is posted when the user presses the middle mouse button while the cursor is in the client area of a window. If the mouse is not captured, the message is posted to the window beneath the cursor. Otherwise, the message is posted to the window that has captured the mouse. 887 /// </summary> 888 MBUTTONDOWN = 0x0207, 889 /// <summary> 890 /// The WM_MBUTTONUP message is posted when the user releases the middle mouse button while the cursor is in the client area of a window. If the mouse is not captured, the message is posted to the window beneath the cursor. Otherwise, the message is posted to the window that has captured the mouse. 891 /// </summary> 892 MBUTTONUP = 0x0208, 893 /// <summary> 894 /// The WM_MBUTTONDBLCLK message is posted when the user double-clicks the middle mouse button while the cursor is in the client area of a window. If the mouse is not captured, the message is posted to the window beneath the cursor. Otherwise, the message is posted to the window that has captured the mouse. 895 /// </summary> 896 MBUTTONDBLCLK = 0x0209, 897 /// <summary> 898 /// The WM_MOUSEWHEEL message is sent to the focus window when the mouse wheel is rotated. The DefWindowProc function propagates the message to the window's parent. There should be no internal forwarding of the message, since DefWindowProc propagates it up the parent chain until it finds a window that processes it. 899 /// </summary> 900 MOUSEWHEEL = 0x020A, 901 /// <summary> 902 /// The WM_XBUTTONDOWN message is posted when the user presses the first or second X button while the cursor is in the client area of a window. If the mouse is not captured, the message is posted to the window beneath the cursor. Otherwise, the message is posted to the window that has captured the mouse. 903 /// </summary> 904 XBUTTONDOWN = 0x020B, 905 /// <summary> 906 /// The WM_XBUTTONUP message is posted when the user releases the first or second X button while the cursor is in the client area of a window. If the mouse is not captured, the message is posted to the window beneath the cursor. Otherwise, the message is posted to the window that has captured the mouse. 907 /// </summary> 908 XBUTTONUP = 0x020C, 909 /// <summary> 910 /// The WM_XBUTTONDBLCLK message is posted when the user double-clicks the first or second X button while the cursor is in the client area of a window. If the mouse is not captured, the message is posted to the window beneath the cursor. Otherwise, the message is posted to the window that has captured the mouse. 911 /// </summary> 912 XBUTTONDBLCLK = 0x020D, 913 /// <summary> 914 /// The WM_MOUSEHWHEEL message is sent to the focus window when the mouse's horizontal scroll wheel is tilted or rotated. The DefWindowProc function propagates the message to the window's parent. There should be no internal forwarding of the message, since DefWindowProc propagates it up the parent chain until it finds a window that processes it. 915 /// </summary> 916 MOUSEHWHEEL = 0x020E, 917 /// <summary> 918 /// Use WM_MOUSELAST to specify the last mouse message. Used with PeekMessage() Function. 919 /// </summary> 920 MOUSELAST = 0x020E, 921 /// <summary> 922 /// The WM_PARENTNOTIFY message is sent to the parent of a child window when the child window is created or destroyed, or when the user clicks a mouse button while the cursor is over the child window. When the child window is being created, the system sends WM_PARENTNOTIFY just before the CreateWindow or CreateWindowEx function that creates the window returns. When the child window is being destroyed, the system sends the message before any processing to destroy the window takes place. 923 /// </summary> 924 PARENTNOTIFY = 0x0210, 925 /// <summary> 926 /// The WM_ENTERMENULOOP message informs an application's main window procedure that a menu modal loop has been entered. 927 /// </summary> 928 ENTERMENULOOP = 0x0211, 929 /// <summary> 930 /// The WM_EXITMENULOOP message informs an application's main window procedure that a menu modal loop has been exited. 931 /// </summary> 932 EXITMENULOOP = 0x0212, 933 /// <summary> 934 /// The WM_NEXTMENU message is sent to an application when the right or left arrow key is used to switch between the menu bar and the system menu. 935 /// </summary> 936 NEXTMENU = 0x0213, 937 /// <summary> 938 /// The WM_SIZING message is sent to a window that the user is resizing. By processing this message, an application can monitor the size and position of the drag rectangle and, if needed, change its size or position. 939 /// </summary> 940 SIZING = 0x0214, 941 /// <summary> 942 /// The WM_CAPTURECHANGED message is sent to the window that is losing the mouse capture. 943 /// </summary> 944 CAPTURECHANGED = 0x0215, 945 /// <summary> 946 /// The WM_MOVING message is sent to a window that the user is moving. By processing this message, an application can monitor the position of the drag rectangle and, if needed, change its position. 947 /// </summary> 948 MOVING = 0x0216, 949 /// <summary> 950 /// Notifies applications that a power-management event has occurred. 951 /// </summary> 952 POWERBROADCAST = 0x0218, 953 /// <summary> 954 /// Notifies an application of a change to the hardware configuration of a device or the computer. 955 /// </summary> 956 DEVICECHANGE = 0x0219, 957 /// <summary> 958 /// An application sends the WM_MDICREATE message to a multiple-document interface (MDI) client window to create an MDI child window. 959 /// </summary> 960 MDICREATE = 0x0220, 961 /// <summary> 962 /// An application sends the WM_MDIDESTROY message to a multiple-document interface (MDI) client window to close an MDI child window. 963 /// </summary> 964 MDIDESTROY = 0x0221, 965 /// <summary> 966 /// An application sends the WM_MDIACTIVATE message to a multiple-document interface (MDI) client window to instruct the client window to activate a different MDI child window. 967 /// </summary> 968 MDIACTIVATE = 0x0222, 969 /// <summary> 970 /// An application sends the WM_MDIRESTORE message to a multiple-document interface (MDI) client window to restore an MDI child window from maximized or minimized size. 971 /// </summary> 972 MDIRESTORE = 0x0223, 973 /// <summary> 974 /// An application sends the WM_MDINEXT message to a multiple-document interface (MDI) client window to activate the next or previous child window. 975 /// </summary> 976 MDINEXT = 0x0224, 977 /// <summary> 978 /// An application sends the WM_MDIMAXIMIZE message to a multiple-document interface (MDI) client window to maximize an MDI child window. The system resizes the child window to make its client area fill the client window. The system places the child window's window menu icon in the rightmost position of the frame window's menu bar, and places the child window's restore icon in the leftmost position. The system also appends the title bar text of the child window to that of the frame window. 979 /// </summary> 980 MDIMAXIMIZE = 0x0225, 981 /// <summary> 982 /// An application sends the WM_MDITILE message to a multiple-document interface (MDI) client window to arrange all of its MDI child windows in a tile format. 983 /// </summary> 984 MDITILE = 0x0226, 985 /// <summary> 986 /// An application sends the WM_MDICASCADE message to a multiple-document interface (MDI) client window to arrange all its child windows in a cascade format. 987 /// </summary> 988 MDICASCADE = 0x0227, 989 /// <summary> 990 /// An application sends the WM_MDIICONARRANGE message to a multiple-document interface (MDI) client window to arrange all minimized MDI child windows. It does not affect child windows that are not minimized. 991 /// </summary> 992 MDIICONARRANGE = 0x0228, 993 /// <summary> 994 /// An application sends the WM_MDIGETACTIVE message to a multiple-document interface (MDI) client window to retrieve the handle to the active MDI child window. 995 /// </summary> 996 MDIGETACTIVE = 0x0229, 997 /// <summary> 998 /// An application sends the WM_MDISETMENU message to a multiple-document interface (MDI) client window to replace the entire menu of an MDI frame window, to replace the window menu of the frame window, or both. 999 /// </summary> 1000 MDISETMENU = 0x0230, 1001 /// <summary> 1002 /// The WM_ENTERSIZEMOVE message is sent one time to a window after it enters the moving or sizing modal loop. The window enters the moving or sizing modal loop when the user clicks the window's title bar or sizing border, or when the window passes the WM_SYSCOMMAND message to the DefWindowProc function and the wParam parameter of the message specifies the SC_MOVE or SC_SIZE value. The operation is complete when DefWindowProc returns. 1003 /// The system sends the WM_ENTERSIZEMOVE message regardless of whether the dragging of full windows is enabled. 1004 /// </summary> 1005 ENTERSIZEMOVE = 0x0231, 1006 /// <summary> 1007 /// The WM_EXITSIZEMOVE message is sent one time to a window, after it has exited the moving or sizing modal loop. The window enters the moving or sizing modal loop when the user clicks the window's title bar or sizing border, or when the window passes the WM_SYSCOMMAND message to the DefWindowProc function and the wParam parameter of the message specifies the SC_MOVE or SC_SIZE value. The operation is complete when DefWindowProc returns. 1008 /// </summary> 1009 EXITSIZEMOVE = 0x0232, 1010 /// <summary> 1011 /// Sent when the user drops a file on the window of an application that has registered itself as a recipient of dropped files. 1012 /// </summary> 1013 DROPFILES = 0x0233, 1014 /// <summary> 1015 /// An application sends the WM_MDIREFRESHMENU message to a multiple-document interface (MDI) client window to refresh the window menu of the MDI frame window. 1016 /// </summary> 1017 MDIREFRESHMENU = 0x0234, 1018 /// <summary> 1019 /// Sent to an application when a window is activated. A window receives this message through its WindowProc function. 1020 /// </summary> 1021 IME_SETCONTEXT = 0x0281, 1022 /// <summary> 1023 /// Sent to an application to notify it of changes to the IME window. A window receives this message through its WindowProc function. 1024 /// </summary> 1025 IME_NOTIFY = 0x0282, 1026 /// <summary> 1027 /// Sent by an application to direct the IME window to carry out the requested command. The application uses this message to control the IME window that it has created. To send this message, the application calls the SendMessage function with the following parameters. 1028 /// </summary> 1029 IME_CONTROL = 0x0283, 1030 /// <summary> 1031 /// Sent to an application when the IME window finds no space to extend the area for the composition window. A window receives this message through its WindowProc function. 1032 /// </summary> 1033 IME_COMPOSITIONFULL = 0x0284, 1034 /// <summary> 1035 /// Sent to an application when the operating system is about to change the current IME. A window receives this message through its WindowProc function. 1036 /// </summary> 1037 IME_SELECT = 0x0285, 1038 /// <summary> 1039 /// Sent to an application when the IME gets a character of the conversion result. A window receives this message through its WindowProc function. 1040 /// </summary> 1041 IME_CHAR = 0x0286, 1042 /// <summary> 1043 /// Sent to an application to provide commands and request information. A window receives this message through its WindowProc function. 1044 /// </summary> 1045 IME_REQUEST = 0x0288, 1046 /// <summary> 1047 /// Sent to an application by the IME to notify the application of a key press and to keep message order. A window receives this message through its WindowProc function. 1048 /// </summary> 1049 IME_KEYDOWN = 0x0290, 1050 /// <summary> 1051 /// Sent to an application by the IME to notify the application of a key release and to keep message order. A window receives this message through its WindowProc function. 1052 /// </summary> 1053 IME_KEYUP = 0x0291, 1054 /// <summary> 1055 /// The WM_MOUSEHOVER message is posted to a window when the cursor hovers over the client area of the window for the period of time specified in a prior call to TrackMouseEvent. 1056 /// </summary> 1057 MOUSEHOVER = 0x02A1, 1058 /// <summary> 1059 /// The WM_MOUSELEAVE message is posted to a window when the cursor leaves the client area of the window specified in a prior call to TrackMouseEvent. 1060 /// </summary> 1061 MOUSELEAVE = 0x02A3, 1062 /// <summary> 1063 /// The WM_NCMOUSEHOVER message is posted to a window when the cursor hovers over the nonclient area of the window for the period of time specified in a prior call to TrackMouseEvent. 1064 /// </summary> 1065 NCMOUSEHOVER = 0x02A0, 1066 /// <summary> 1067 /// The WM_NCMOUSELEAVE message is posted to a window when the cursor leaves the nonclient area of the window specified in a prior call to TrackMouseEvent. 1068 /// </summary> 1069 NCMOUSELEAVE = 0x02A2, 1070 /// <summary> 1071 /// The WM_WTSSESSION_CHANGE message notifies applications of changes in session state. 1072 /// </summary> 1073 WTSSESSION_CHANGE = 0x02B1, 1074 TABLET_FIRST = 0x02c0, 1075 TABLET_LAST = 0x02df, 1076 /// <summary> 1077 /// An application sends a WM_CUT message to an edit control or combo box to delete (cut) the current selection, if any, in the edit control and copy the deleted text to the clipboard in CF_TEXT format. 1078 /// </summary> 1079 CUT = 0x0300, 1080 /// <summary> 1081 /// An application sends the WM_COPY message to an edit control or combo box to copy the current selection to the clipboard in CF_TEXT format. 1082 /// </summary> 1083 COPY = 0x0301, 1084 /// <summary> 1085 /// An application sends a WM_PASTE message to an edit control or combo box to copy the current content of the clipboard to the edit control at the current caret position. Data is inserted only if the clipboard contains data in CF_TEXT format. 1086 /// </summary> 1087 PASTE = 0x0302, 1088 /// <summary> 1089 /// An application sends a WM_CLEAR message to an edit control or combo box to delete (clear) the current selection, if any, from the edit control. 1090 /// </summary> 1091 CLEAR = 0x0303, 1092 /// <summary> 1093 /// An application sends a WM_UNDO message to an edit control to undo the last operation. When this message is sent to an edit control, the previously deleted text is restored or the previously added text is deleted. 1094 /// </summary> 1095 UNDO = 0x0304, 1096 /// <summary> 1097 /// The WM_RENDERFORMAT message is sent to the clipboard owner if it has delayed rendering a specific clipboard format and if an application has requested data in that format. The clipboard owner must render data in the specified format and place it on the clipboard by calling the SetClipboardData function. 1098 /// </summary> 1099 RENDERFORMAT = 0x0305, 1100 /// <summary> 1101 /// The WM_RENDERALLFORMATS message is sent to the clipboard owner before it is destroyed, if the clipboard owner has delayed rendering one or more clipboard formats. For the content of the clipboard to remain available to other applications, the clipboard owner must render data in all the formats it is capable of generating, and place the data on the clipboard by calling the SetClipboardData function. 1102 /// </summary> 1103 RENDERALLFORMATS = 0x0306, 1104 /// <summary> 1105 /// The WM_DESTROYCLIPBOARD message is sent to the clipboard owner when a call to the EmptyClipboard function empties the clipboard. 1106 /// </summary> 1107 DESTROYCLIPBOARD = 0x0307, 1108 /// <summary> 1109 /// The WM_DRAWCLIPBOARD message is sent to the first window in the clipboard viewer chain when the content of the clipboard changes. This enables a clipboard viewer window to display the new content of the clipboard. 1110 /// </summary> 1111 DRAWCLIPBOARD = 0x0308, 1112 /// <summary> 1113 /// The WM_PAINTCLIPBOARD message is sent to the clipboard owner by a clipboard viewer window when the clipboard contains data in the CF_OWNERDISPLAY format and the clipboard viewer's client area needs repainting. 1114 /// </summary> 1115 PAINTCLIPBOARD = 0x0309, 1116 /// <summary> 1117 /// The WM_VSCROLLCLIPBOARD message is sent to the clipboard owner by a clipboard viewer window when the clipboard contains data in the CF_OWNERDISPLAY format and an event occurs in the clipboard viewer's vertical scroll bar. The owner should scroll the clipboard image and update the scroll bar values. 1118 /// </summary> 1119 VSCROLLCLIPBOARD = 0x030A, 1120 /// <summary> 1121 /// The WM_SIZECLIPBOARD message is sent to the clipboard owner by a clipboard viewer window when the clipboard contains data in the CF_OWNERDISPLAY format and the clipboard viewer's client area has changed size. 1122 /// </summary> 1123 SIZECLIPBOARD = 0x030B, 1124 /// <summary> 1125 /// The WM_ASKCBFORMATNAME message is sent to the clipboard owner by a clipboard viewer window to request the name of a CF_OWNERDISPLAY clipboard format. 1126 /// </summary> 1127 ASKCBFORMATNAME = 0x030C, 1128 /// <summary> 1129 /// The WM_CHANGECBCHAIN message is sent to the first window in the clipboard viewer chain when a window is being removed from the chain. 1130 /// </summary> 1131 CHANGECBCHAIN = 0x030D, 1132 /// <summary> 1133 /// The WM_HSCROLLCLIPBOARD message is sent to the clipboard owner by a clipboard viewer window. This occurs when the clipboard contains data in the CF_OWNERDISPLAY format and an event occurs in the clipboard viewer's horizontal scroll bar. The owner should scroll the clipboard image and update the scroll bar values. 1134 /// </summary> 1135 HSCROLLCLIPBOARD = 0x030E, 1136 /// <summary> 1137 /// This message informs a window that it is about to receive the keyboard focus, giving the window the opportunity to realize its logical palette when it receives the focus. 1138 /// </summary> 1139 QUERYNEWPALETTE = 0x030F, 1140 /// <summary> 1141 /// The WM_PALETTEISCHANGING message informs applications that an application is going to realize its logical palette. 1142 /// </summary> 1143 PALETTEISCHANGING = 0x0310, 1144 /// <summary> 1145 /// This message is sent by the OS to all top-level and overlapped windows after the window with the keyboard focus realizes its logical palette. 1146 /// This message enables windows that do not have the keyboard focus to realize their logical palettes and update their client areas. 1147 /// </summary> 1148 PALETTECHANGED = 0x0311, 1149 /// <summary> 1150 /// The WM_HOTKEY message is posted when the user presses a hot key registered by the RegisterHotKey function. The message is placed at the top of the message queue associated with the thread that registered the hot key. 1151 /// </summary> 1152 HOTKEY = 0x0312, 1153 /// <summary> 1154 /// The WM_PRINT message is sent to a window to request that it draw itself in the specified device context, most commonly in a printer device context. 1155 /// </summary> 1156 PRINT = 0x0317, 1157 /// <summary> 1158 /// The WM_PRINTCLIENT message is sent to a window to request that it draw its client area in the specified device context, most commonly in a printer device context. 1159 /// </summary> 1160 PRINTCLIENT = 0x0318, 1161 /// <summary> 1162 /// The WM_APPCOMMAND message notifies a window that the user generated an application command event, for example, by clicking an application command button using the mouse or typing an application command key on the keyboard. 1163 /// </summary> 1164 APPCOMMAND = 0x0319, 1165 /// <summary> 1166 /// The WM_THEMECHANGED message is broadcast to every window following a theme change event. Examples of theme change events are the activation of a theme, the deactivation of a theme, or a transition from one theme to another. 1167 /// </summary> 1168 THEMECHANGED = 0x031A, 1169 /// <summary> 1170 /// Sent when the contents of the clipboard have changed. 1171 /// </summary> 1172 CLIPBOARDUPDATE = 0x031D, 1173 /// <summary> 1174 /// The system will send a window the WM_DWMCOMPOSITIONCHANGED message to indicate that the availability of desktop composition has changed. 1175 /// </summary> 1176 DWMCOMPOSITIONCHANGED = 0x031E, 1177 /// <summary> 1178 /// WM_DWMNCRENDERINGCHANGED is called when the non-client area rendering status of a window has changed. Only windows that have set the flag DWM_BLURBEHIND.fTransitionOnMaximized to true will get this message. 1179 /// </summary> 1180 DWMNCRENDERINGCHANGED = 0x031F, 1181 /// <summary> 1182 /// Sent to all top-level windows when the colorization color has changed. 1183 /// </summary> 1184 DWMCOLORIZATIONCOLORCHANGED = 0x0320, 1185 /// <summary> 1186 /// WM_DWMWINDOWMAXIMIZEDCHANGE will let you know when a DWM composed window is maximized. You also have to register for this message as well. You'd have other windowd go opaque when this message is sent. 1187 /// </summary> 1188 DWMWINDOWMAXIMIZEDCHANGE = 0x0321, 1189 /// <summary> 1190 /// Sent to request extended title bar information. A window receives this message through its WindowProc function. 1191 /// </summary> 1192 GETTITLEBARINFOEX = 0x033F, 1193 HANDHELDFIRST = 0x0358, 1194 HANDHELDLAST = 0x035F, 1195 AFXFIRST = 0x0360, 1196 AFXLAST = 0x037F, 1197 PENWINFIRST = 0x0380, 1198 PENWINLAST = 0x038F, 1199 /// <summary> 1200 /// The WM_APP constant is used by applications to help define private messages, usually of the form WM_APP+X, where X is an integer value. 1201 /// </summary> 1202 APP = 0x8000, 1203 /// <summary> 1204 /// The WM_USER constant is used by applications to help define private messages for use by private window classes, usually of the form WM_USER+X, where X is an integer value. 1205 /// </summary> 1206 USER = 0x0400, 1207 1208 /// <summary> 1209 /// An application sends the WM_CPL_LAUNCH message to Windows Control Panel to request that a Control Panel application be started. 1210 /// </summary> 1211 CPL_LAUNCH = USER + 0x1000, 1212 /// <summary> 1213 /// The WM_CPL_LAUNCHED message is sent when a Control Panel application, started by the WM_CPL_LAUNCH message, has closed. The WM_CPL_LAUNCHED message is sent to the window identified by the wParam parameter of the WM_CPL_LAUNCH message that started the application. 1214 /// </summary> 1215 CPL_LAUNCHED = USER + 0x1001, 1216 /// <summary> 1217 /// WM_SYSTIMER is a well-known yet still undocumented message. Windows uses WM_SYSTIMER for internal actions like scrolling. 1218 /// </summary> 1219 SYSTIMER = 0x118 1220 } 1221 1222}
LockInput.cs
1using System; 2using System.Collections.Generic; 3using System.Text; 4using System.Runtime.InteropServices; 5using System.Diagnostics; 6using System.Reflection; 7 8namespace Bluefire.LockKeyBoard 9{ 10 public class LockInput 11 { 12 public IntPtr m_lHookID = IntPtr.Zero; 13 private uint[] mlShellCode = new uint[Win32.SHELL_CODE_DWORDLEN - 1]; 14 public void Lock(Boolean isLock) 15 { 16 int lResualt; 17 ushort iAtom; 18 19 iAtom = Win32.GlobalFindAtom(Win32.SHELL_FALG); 20 if (iAtom == 0) 21 { 22 lResualt = InsertAsmCode(); 23 } 24 25 26 27 iAtom = Win32.GlobalFindAtom(Win32.ATOM_FLAG); 28 if (isLock) 29 { 30 m_lHookID = Win32.SetWindowsHookEx(HookType.WH_KEYBOARD_LL, new HookProc(LowLevelKeyboardProc), Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0); 31 32 if (iAtom == 0) 33 { 34 iAtom = Win32.GlobalAddAtom(Win32.ATOM_FLAG); 35 } 36 } 37 else 38 { 39 Win32.UnhookWindowsHookEx(m_lHookID); 40 if (iAtom != 0) 41 { 42 Win32.GlobalDeleteAtom(iAtom); 43 } 44 } 45 Win32.BlockInput(isLock); 46 } 47 48 private Boolean GetKeyboardState() 49 { 50 Boolean GetKeyboardState = Win32.GlobalFindAtom(Win32.ATOM_FLAG) != 0; 51 return GetKeyboardState; 52 } 53 54 private int LowLevelKeyboardProc(int nCode, IntPtr wParam, IntPtr lParam) 55 { 56 KBDLLHOOKSTRUCT KBEvent = new KBDLLHOOKSTRUCT(); 57 if (nCode == 0) 58 { 59 Marshal.StructureToPtr(KBEvent, lParam, true); 60 return 1; 61 } 62 else 63 { 64 return Win32.CallNextHookEx(m_lHookID, nCode, wParam.ToInt32(), lParam.ToInt32()).ToInt32(); 65 } 66 } 67 68 private int InsertAsmCode() 69 { 70 const string WinLogon = "Winlogon.exe"; 71 IntPtr hProcess; 72 int hPId; 73 bool lResult; 74 TOKEN_PRIVILEGES pToken; 75 IntPtr hToken; 76 IntPtr hRemoteThread, hRemoteThreadID, lRemoteAddr; 77 hPId = GetProcessIdFromName(WinLogon); 78 if (hPId == 0) 79 { 80 return Marshal.GetLastWin32Error(); 81 } 82 lResult = Win32.OpenProcessToken(Win32.GetCurrentProcess(), Win32.TOKEN_ADJUST_PRIVILEGES | Win32.TOKEN_QUERY, out hToken); 83 LUID id; 84 lResult = Win32.LookupPrivilegeValue("", Win32.SE_DEBUG_NAME, out id); 85 pToken.Privileges.pLuid = id; 86 pToken.PrivilegeCount = 1; 87 pToken.Privileges.Attributes = Win32.SE_PRIVILEGE_ENABLED; 88 TOKEN_PRIVILEGES tp = new TOKEN_PRIVILEGES(); 89 uint rect = 0; 90 lResult = Win32.AdjustTokenPrivileges(hToken, false, ref pToken, (uint)Marshal.SizeOf(pToken), ref tp, out rect); 91 hProcess = Win32.OpenProcess(ProcessAccessFlags.All, false, hPId); 92 if (hProcess != IntPtr.Zero) 93 { 94 InitShellCode(); 95 } 96 else 97 { 98 return Marshal.GetLastWin32Error(); 99 } 100 lRemoteAddr = Win32.VirtualAllocEx(hProcess, IntPtr.Zero, (uint)Win32.SHELL_CODE_LENGTH, AllocationType.Commit, MemoryProtection.ExecuteReadWrite); 101 int ret = 0; 102 if (lRemoteAddr != IntPtr.Zero) 103 { 104 int outret; 105 bool rects = Win32.WriteProcessMemory(hProcess, lRemoteAddr, mlShellCode, (uint)Win32.SHELL_CODE_LENGTH, out outret); 106 } 107 else 108 { 109 ret = Marshal.GetLastWin32Error(); 110 return ret; 111 } 112 113 hRemoteThread = Win32.CreateRemoteThread(hProcess, IntPtr.Zero, 0, lRemoteAddr.ToInt32() + Win32.SHELL_FUNCOFFSET, IntPtr.Zero, 0, out hRemoteThreadID); 114 if (hRemoteThread == IntPtr.Zero) 115 { 116 ret = Marshal.GetLastWin32Error(); 117 return ret; 118 } 119 120 Win32.WaitForSingleObject(hRemoteThreadID, -1); 121 Win32.GetExitCodeThread(hRemoteThreadID, out ret); 122 Win32.CloseHandle(hRemoteThread); 123 Win32.VirtualFreeEx(hRemoteThread, lRemoteAddr, Win32.SHELL_CODE_LENGTH, FreeType.Decommit); 124 return ret; 125 } 126 127 private int GetProcessIdFromName(string name) 128 { 129 Process[] ps = Process.GetProcesses(); 130 foreach (Process item in ps) 131 { 132 if (item.ProcessName.ToLower().Replace(".exe", "") == name.ToLower().Replace(".exe", "")) 133 { 134 return item.Id; 135 } 136 } 137 return -1; 138 } 139 140 private void InitShellCode() 141 { 142 const string kernel32 = "kernel32.dll"; 143 IntPtr hDll; 144 145 hDll = Win32.GetModuleHandle(kernel32); 146 mlShellCode[0] = Win32.GetProcAddress(hDll, "GetModuleHandleW").ToUInt32(); 147 mlShellCode[1] = Win32.GetProcAddress(hDll, "GetProcAddress").ToUInt32(); 148 mlShellCode[2] = 0xE853; 149 mlShellCode[3] = 0x815B0000; 150 mlShellCode[4] = 0x40100EEB; 151 mlShellCode[5] = 0x238E800; 152 mlShellCode[6] = 0xC00B0000; 153 mlShellCode[7] = 0x838D5075; 154 mlShellCode[8] = 0x4010B0; 155 mlShellCode[9] = 0xD093FF50; 156 mlShellCode[10] = 0xF004013; 157 mlShellCode[11] = 0xC00BC0B7; 158 mlShellCode[12] = 0x683A75; 159 mlShellCode[13] = 0x6A020000; 160 mlShellCode[14] = 0x8D006A00; 161 mlShellCode[15] = 0x4010B083; 162 mlShellCode[16] = 0x93FF5000; 163 mlShellCode[17] = 0x401090; 164 mlShellCode[18] = 0x1874C00B; 165 mlShellCode[19] = 0x10C2938D; 166 mlShellCode[20] = 0x6A0040; 167 mlShellCode[21] = 0x93FF5052; 168 mlShellCode[22] = 0x401094; 169 mlShellCode[23] = 0x474C00B; 170 mlShellCode[24] = 0xAEB0AEB; 171 mlShellCode[25] = 0x108C93FF; 172 mlShellCode[26] = 0x2EB0040; 173 mlShellCode[27] = 0xC25BC033; 174 mlShellCode[28] = 0xFF8B0004; 175 mlShellCode[38] = 0x410053; 176 mlShellCode[39] = 0x200053; 177 mlShellCode[40] = 0x690077; 178 mlShellCode[41] = 0x64006E; 179 mlShellCode[42] = 0x77006F; 180 mlShellCode[43] = 0xFF8B0000; 181 mlShellCode[44] = 0x690057; 182 mlShellCode[45] = 0x6C006E; 183 mlShellCode[46] = 0x67006F; 184 mlShellCode[47] = 0x6E006F; 185 mlShellCode[48] = 0x8B550000; 186 mlShellCode[49] = 0xF0C481EC; 187 mlShellCode[50] = 0x53FFFFFD; 188 mlShellCode[51] = 0xE8; 189 mlShellCode[52] = 0xEB815B00; 190 mlShellCode[53] = 0x4010D1; 191 mlShellCode[54] = 0x10468; 192 mlShellCode[55] = 0xF8858D00; 193 mlShellCode[56] = 0x50FFFFFD; 194 mlShellCode[57] = 0xFF0875FF; 195 mlShellCode[58] = 0x40108093; 196 mlShellCode[59] = 0xF8858D00; 197 mlShellCode[60] = 0x50FFFFFD; 198 mlShellCode[61] = 0x1098838D; 199 mlShellCode[62] = 0xFF500040; 200 mlShellCode[63] = 0x40107C93; 201 mlShellCode[64] = 0x75C00B00; 202 mlShellCode[65] = 0x68406A69; 203 mlShellCode[66] = 0x1000; 204 mlShellCode[67] = 0x7668; 205 mlShellCode[68] = 0xFF006A00; 206 mlShellCode[69] = 0x40107493; 207 mlShellCode[70] = 0x74C00B00; 208 mlShellCode[71] = 0x85896054; 209 mlShellCode[72] = 0xFFFFFDF0; 210 mlShellCode[73] = 0x75FFFC6A; 211 mlShellCode[74] = 0x8493FF08; 212 mlShellCode[75] = 0x8D004010; 213 mlShellCode[76] = 0x4013C893; 214 mlShellCode[77] = 0xFC028900; 215 mlShellCode[78] = 0xFDF0BD8B; 216 mlShellCode[79] = 0x76B9FFFF; 217 mlShellCode[80] = 0x8D000000; 218 mlShellCode[81] = 0x401374B3; 219 mlShellCode[82] = 0x8DA4F300; 220 mlShellCode[83] = 0x4010B083; 221 mlShellCode[84] = 0x93FF5000; 222 mlShellCode[85] = 0x401078; 223 mlShellCode[86] = 0xFDF0B5FF; 224 mlShellCode[87] = 0xFC6AFFFF; 225 mlShellCode[88] = 0xFF0875FF; 226 mlShellCode[89] = 0x40108893; 227 mlShellCode[90] = 0xC0336100; 228 mlShellCode[91] = 0xC03303EB; 229 mlShellCode[92] = 0xC2C95B40; 230 mlShellCode[93] = 0x6B0008; 231 mlShellCode[94] = 0x720065; 232 mlShellCode[95] = 0x65006E; 233 mlShellCode[96] = 0x33006C; 234 mlShellCode[97] = 0x2E0032; 235 mlShellCode[98] = 0x6C0064; 236 mlShellCode[99] = 0x6C; 237 mlShellCode[100] = 0x730075; 238 mlShellCode[101] = 0x720065; 239 mlShellCode[102] = 0x320033; 240 mlShellCode[103] = 0x64002E; 241 mlShellCode[104] = 0x6C006C; 242 mlShellCode[105] = 0x69560000; 243 mlShellCode[106] = 0x61757472; 244 mlShellCode[107] = 0x6572466C; 245 mlShellCode[108] = 0x6C470065; 246 mlShellCode[109] = 0x6C61626F; 247 mlShellCode[110] = 0x646E6946; 248 mlShellCode[111] = 0x6D6F7441; 249 mlShellCode[112] = 0x6C470057; 250 mlShellCode[113] = 0x6C61626F; 251 mlShellCode[114] = 0x41646441; 252 mlShellCode[115] = 0x576D6F74; 253 mlShellCode[116] = 0x74736C00; 254 mlShellCode[117] = 0x706D6372; 255 mlShellCode[118] = 0x4F005769; 256 mlShellCode[119] = 0x446E6570; 257 mlShellCode[120] = 0x746B7365; 258 mlShellCode[121] = 0x57706F; 259 mlShellCode[122] = 0x6D756E45; 260 mlShellCode[123] = 0x6B736544; 261 mlShellCode[124] = 0x57706F74; 262 mlShellCode[125] = 0x6F646E69; 263 mlShellCode[126] = 0x47007377; 264 mlShellCode[127] = 0x69577465; 265 mlShellCode[128] = 0x776F646E; 266 mlShellCode[129] = 0x74786554; 267 mlShellCode[130] = 0x65470057; 268 mlShellCode[131] = 0x6E695774; 269 mlShellCode[132] = 0x4C776F64; 270 mlShellCode[133] = 0x57676E6F; 271 mlShellCode[134] = 0x74655300; 272 mlShellCode[135] = 0x646E6957; 273 mlShellCode[136] = 0x6F4C776F; 274 mlShellCode[137] = 0x57676E; 275 mlShellCode[138] = 0x6C6C6143; 276 mlShellCode[139] = 0x646E6957; 277 mlShellCode[140] = 0x7250776F; 278 mlShellCode[141] = 0x57636F; 279 mlShellCode[142] = 0x4C746547; 280 mlShellCode[143] = 0x45747361; 281 mlShellCode[144] = 0x726F7272; 282 mlShellCode[145] = 0x72695600; 283 mlShellCode[146] = 0x6C617574; 284 mlShellCode[147] = 0x6F6C6C41; 285 mlShellCode[148] = 0x8B550063; 286 mlShellCode[149] = 0xFCC483EC; 287 mlShellCode[150] = 0x48C03360; 288 mlShellCode[151] = 0x8DFC4589; 289 mlShellCode[152] = 0x40117683; 290 mlShellCode[153] = 0x93FF5000; 291 mlShellCode[154] = 0x401000; 292 mlShellCode[155] = 0x840FC00B; 293 mlShellCode[156] = 0xFA; 294 mlShellCode[157] = 0x838DF88B; 295 mlShellCode[158] = 0x401190; 296 mlShellCode[159] = 0x93FF50; 297 mlShellCode[160] = 0xB004010; 298 mlShellCode[161] = 0xE3840FC0; 299 mlShellCode[162] = 0x8B000000; 300 mlShellCode[163] = 0x45838DF0; 301 mlShellCode[164] = 0x50004012; 302 mlShellCode[165] = 0x493FF57; 303 mlShellCode[166] = 0x89004010; 304 mlShellCode[167] = 0x40107483; 305 mlShellCode[168] = 0x38838D00; 306 mlShellCode[169] = 0x50004012; 307 mlShellCode[170] = 0x493FF57; 308 mlShellCode[171] = 0x89004010; 309 mlShellCode[172] = 0x40108C83; 310 mlShellCode[173] = 0xC2838D00; 311 mlShellCode[174] = 0x50004011; 312 mlShellCode[175] = 0x493FF57; 313 mlShellCode[176] = 0x89004010; 314 mlShellCode[177] = 0x40107883; 315 mlShellCode[178] = 0xB2838D00; 316 mlShellCode[179] = 0x50004011; 317 mlShellCode[180] = 0x493FF57; 318 mlShellCode[181] = 0x89004010; 319 mlShellCode[182] = 0x4013D083; 320 mlShellCode[183] = 0xD1838D00; 321 mlShellCode[184] = 0x50004011; 322 mlShellCode[185] = 0x493FF57; 323 mlShellCode[186] = 0x89004010; 324 mlShellCode[187] = 0x40107C83; 325 mlShellCode[188] = 0xDB838D00; 326 mlShellCode[189] = 0x50004011; 327 mlShellCode[190] = 0x493FF56; 328 mlShellCode[191] = 0x89004010; 329 mlShellCode[192] = 0x40109083; 330 mlShellCode[193] = 0xE8838D00; 331 mlShellCode[194] = 0x50004011; 332 mlShellCode[195] = 0x493FF56; 333 mlShellCode[196] = 0x89004010; 334 mlShellCode[197] = 0x40109483; 335 mlShellCode[198] = 0xFB838D00; 336 mlShellCode[199] = 0x50004011; 337 mlShellCode[200] = 0x493FF56; 338 mlShellCode[201] = 0x89004010; 339 mlShellCode[202] = 0x40108083; 340 mlShellCode[203] = 0xA838D00; 341 mlShellCode[204] = 0x50004012; 342 mlShellCode[205] = 0x493FF56; 343 mlShellCode[206] = 0x89004010; 344 mlShellCode[207] = 0x40108483; 345 mlShellCode[208] = 0x19838D00; 346 mlShellCode[209] = 0x50004012; 347 mlShellCode[210] = 0x493FF56; 348 mlShellCode[211] = 0x89004010; 349 mlShellCode[212] = 0x40108883; 350 mlShellCode[213] = 0x28838D00; 351 mlShellCode[214] = 0x50004012; 352 mlShellCode[215] = 0x493FF56; 353 mlShellCode[216] = 0x89004010; 354 mlShellCode[217] = 0x4013CC83; 355 mlShellCode[218] = 0x89C03300; 356 mlShellCode[219] = 0x8B61FC45; 357 mlShellCode[220] = 0xC3C9FC45; 358 mlShellCode[221] = 0x53EC8B55; 359 mlShellCode[222] = 0xE8; 360 mlShellCode[223] = 0xEB815B00; 361 mlShellCode[224] = 0x40137D; 362 mlShellCode[225] = 0x120C7D81; 363 mlShellCode[226] = 0x75000003; 364 mlShellCode[227] = 0xD4838D1C; 365 mlShellCode[228] = 0x50004013; 366 mlShellCode[229] = 0x13D093FF; 367 mlShellCode[230] = 0xB70F0040; 368 mlShellCode[231] = 0x74C00BC0; 369 mlShellCode[232] = 0x40C03308; 370 mlShellCode[233] = 0x10C2C95B; 371 mlShellCode[234] = 0x1475FF00; 372 mlShellCode[235] = 0xFF1075FF; 373 mlShellCode[236] = 0x75FF0C75; 374 mlShellCode[237] = 0xC8B3FF08; 375 mlShellCode[238] = 0xFF004013; 376 mlShellCode[239] = 0x4013CC93; 377 mlShellCode[240] = 0xC2C95B00; 378 mlShellCode[241] = 0xFF8B0010; 379 mlShellCode[245] = 0x6F0048; 380 mlShellCode[246] = 0x6B006F; 381 mlShellCode[247] = 0x790053; 382 mlShellCode[248] = 0x4B0073; 383 mlShellCode[249] = 0x790065; 384 mlShellCode[250] = 0x8B550000; 385 mlShellCode[251] = 0xD8C481EC; 386 mlShellCode[252] = 0xE8FFFFFD; 387 mlShellCode[253] = 0x226; 388 mlShellCode[254] = 0x8DE84589; 389 mlShellCode[255] = 0x6A50EC45; 390 mlShellCode[256] = 0xE875FF28; 391 mlShellCode[257] = 0x24BE8; 392 mlShellCode[258] = 0xFC00B00; 393 mlShellCode[259] = 0x11584; 394 mlShellCode[260] = 0xF4458D00; 395 mlShellCode[261] = 0x20606850; 396 mlShellCode[262] = 0x6A0040; 397 mlShellCode[263] = 0x22DE8; 398 mlShellCode[264] = 0x74C00B00; 399 mlShellCode[265] = 0xF045C722; 400 mlShellCode[266] = 0x1; 401 mlShellCode[267] = 0x2FC45C7; 402 mlShellCode[268] = 0x6A000000; 403 mlShellCode[269] = 0x6A006A00; 404 mlShellCode[270] = 0xF0458D00; 405 mlShellCode[271] = 0xFF006A50; 406 mlShellCode[272] = 0x1E8EC75; 407 mlShellCode[273] = 0xFF000002; 408 mlShellCode[274] = 0x6A0875; 409 mlShellCode[275] = 0x1F0FFF68; 410 mlShellCode[276] = 0x1CEE800; 411 mlShellCode[277] = 0x45890000; 412 mlShellCode[278] = 0x68046AE8; 413 mlShellCode[279] = 0x1000; 414 mlShellCode[280] = 0x4F268; 415 mlShellCode[281] = 0xFF006A00; 416 mlShellCode[282] = 0xC1E8E875; 417 mlShellCode[283] = 0x89000001; 418 mlShellCode[284] = 0x6AE445; 419 mlShellCode[285] = 0x4F268; 420 mlShellCode[286] = 0x10006800; 421 mlShellCode[287] = 0x75FF0040; 422 mlShellCode[288] = 0xE875FFE4; 423 mlShellCode[289] = 0x1B9E8; 424 mlShellCode[290] = 0x30186800; 425 mlShellCode[291] = 0x86A0040; 426 mlShellCode[292] = 0x40300068; 427 mlShellCode[293] = 0xE475FF00; 428 mlShellCode[294] = 0xE8E875FF; 429 mlShellCode[295] = 0x1A2; 430 mlShellCode[296] = 0x81E4558B; 431 mlShellCode[297] = 0x8C2; 432 mlShellCode[298] = 0x6A006A00; 433 mlShellCode[299] = 0x52006A00; 434 mlShellCode[300] = 0x6A006A; 435 mlShellCode[301] = 0xE8E875FF; 436 mlShellCode[302] = 0x156; 437 mlShellCode[303] = 0x144E850; 438 mlShellCode[304] = 0x18680000; 439 mlShellCode[305] = 0x6A004030; 440 mlShellCode[306] = 0x30006808; 441 mlShellCode[307] = 0x75FF0040; 442 mlShellCode[308] = 0xE875FFE4; 443 mlShellCode[309] = 0x151E8; 444 mlShellCode[310] = 0x58D00; 445 mlShellCode[311] = 0x8B004030; 446 mlShellCode[312] = 0x4408B10; 447 mlShellCode[313] = 0xCB685250; 448 mlShellCode[314] = 0x8D004020; 449 mlShellCode[315] = 0xFFFDD885; 450 mlShellCode[316] = 0x909050FF; 451 } 452 } 453}
经过仔细对Windows按下Ctrl Alt Del 的消息跟踪，发现实际处理这个消息函数的是WinLogon.exe 也就是我们在登录系统的时候看到的欢迎画面，这个实际上也是一个正常的Windows桌面，既然这样，我们可以通过代码注入+Windows Hook来获取实际WinLogon.exe的键盘消息，只要勾住键盘消息，不让消息真正的传递到WinLogon.exe中，就能够彻底取消掉系统的快捷键。
程序中，通过InsertAsmCode把MASM32的代码注入到WinLogon中，通过Windows Hook勾去消息。