Click here to Skip to main content
15,914,409 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
QuestionHow to call VB.NET DLL from VC++.NET Pin
Member 87328310-May-04 12:55
Member 87328310-May-04 12:55 
Generalworking with streams Pin
ra_sasi10-May-04 12:44
ra_sasi10-May-04 12:44 
GeneralRe: working with streams Pin
Paul Ranson10-May-04 13:01
Paul Ranson10-May-04 13:01 
GeneralRe: working with streams Pin
ra_sasi11-May-04 6:40
ra_sasi11-May-04 6:40 
GeneralNOT a Site Search? Search text within tables and display results. Pin
thefreebay10-May-04 12:41
thefreebay10-May-04 12:41 
GeneralRe: NOT a Site Search? Search text within tables and display results. Pin
Anthony_Yio10-May-04 16:17
Anthony_Yio10-May-04 16:17 
Questionprint screen hook? Pin
Miguel Lopes10-May-04 11:38
Miguel Lopes10-May-04 11:38 
AnswerRe: print screen hook? Pin
Toby Opferman10-May-04 16:29
Toby Opferman10-May-04 16:29 
The first thing you do is figure out where and when the printscreen key is processed. For example, the shell does a lot of processing, so if you open a paint program and kill the shell (explorer) then hit printscreen, does it still work?

Yes it does.

So, it would seem that it may happen in the kernel. There are two ends you could attempt to start watching for PRINT SCREEN. The starting end, where the keys are sent from or the other end, where the bitmap ends up.

The bitmap ends up in the clipboard. So, my guess would be WIN32K.SYS in the kernel may have something to do with it.

So, you get out your kernel debugger and you load up Microsoft's symbols and you start to look for anything you think may occur at that time. For example, print screen functions in the kernel, key strokes or clipboard functions.

We want to find out who puts the image in the clipboard, usermode or kernel mode and see where you want to hook.

So, I did this for you. I searched WIN32K.SYS for symbols. Found nothing on print screen. So, as I said, we know that paint programs get the bitmap from the clipboard. So, what I did was searched for *clip*board* symbols and set some breakpoints on ones related to setting data.

kd> bl
0 e a00b0cc8 0001 (0001) win32k!InternalSetClipboardData
1 e a00b0c35 0001 (0001) win32k!NtUserSetClipboardData
2 e a0046c43 0001 (0001) win32k!NtUserOpenClipboard

Then, I pressed "Print Screen" and I get a break point!

kd> kb
ChildEBP RetAddr Args to Child
fb676b30 a00b0e72 fcdb8bf8 00000002 18050144 win32k!InternalSetClipboardData
fb676b54 a01038ea 00000002 18050144 00000000 win32k!_SetClipboardData+0x2f
fb676bac a00c3a34 0185000f 00000201 e1ccf948 win32k!xxxSnapWindow+0x212
fb676c8c a00152e2 00000100 fb676d10 00000000 win32k!xxxScanSysQueue+0x1056
fb676ce0 a001612e fb676d10 000021ff 00000000 win32k!xxxInternalGetMessage+0x280
fb676d4c 80461691 0103fd70 00000000 00000000 win32k!NtUserGetMessage+0x43
fb676d4c 77e1414f 0103fd70 00000000 00000000 nt!KiSystemService+0xc4
0103fd1c 766d16d3 0103fd70 00000000 00000000 USER32!NtUserGetMessage+0xb
0103fd90 766d15bd 00020070 00000000 766d2610 stobject!SysTrayMain+0x124
0103ffb4 77e92ca8 00000000 00ccfaa0 77fb80db stobject!CSysTray::SysTrayThreadProc+0x45
0103ffec 00000000 766d1578 00000000 00000000 KERNEL32!BaseThreadStart+0x52
kd> !process -1 0
PROCESS fcc88020 SessionId: 0 Cid: 0324 Peb: 7ffdf000 ParentCid: 0318
DirBase: 0684b000 ObjectTable: fcc7db68 TableSize: 200.
Image: explorer.exe


I found something odd, explorer sets the internal data. So, I killed explorer to see how it was working without it.

I found this.

kd> kb
ChildEBP RetAddr Args to Child
f766fb30 a00b0e72 fcdb8bf8 00000002 0a0501e1 win32k!InternalSetClipboardData
f766fb54 a01038ea 00000002 0a0501e1 00000000 win32k!_SetClipboardData+0x2f
f766fbac a00c3a34 0185000f 00000001 e1cb0a48 win32k!xxxSnapWindow+0x212
f766fc8c a00152e2 00000100 f766fd10 00000000 win32k!xxxScanSysQueue+0x1056
f766fce0 a001612e f766fd10 000021ff 00000000 win32k!xxxInternalGetMessage+0x280
f766fd4c 80461691 00cfff88 00000000 00000000 win32k!NtUserGetMessage+0x43
f766fd4c 77e1414f 00cfff88 00000000 00000000 nt!KiSystemService+0xc4
00cfff44 5ffb3036 00cfff88 00000000 00000000 USER32!NtUserGetMessage+0xb
00cffff4 00000000 0040fdf0 00fc5a4d 00000001 winsrv!ConsoleInputThread+0x15c
kd> !process -1 0
PROCESS fcdc45a0 SessionId: 0 Cid: 00a8 Peb: 7ffdf000 ParentCid: 008c
DirBase: 03798000 ObjectTable: fcdc4508 TableSize: 249.
Image: csrss.exe


CSRSS (Which you will have some trouble hooking!) sets it.
Taking a closer look you can actually see that the process doesn't matter. It's simply scheduled anywhere in the kernel off of any kernel call in win32k.sys.

A little more work tells us the thread is woken up and calls win32k!xxxScanSysQueue which eventually figures out to call xxxSnapWindow which does all the work.

This is all in the kernel. I don't have time to figure out more detail, but I think this is what you're looking for. What you could do is see if you can register for clipboard data events and get a notification when data arrives in the clipboard or possibly a snapshot window message if there is one.

This is a starting point for you at least.



GeneralRe: print screen hook? Pin
Toby Opferman10-May-04 18:26
Toby Opferman10-May-04 18:26 
GeneralRe: print screen hook? Pin
Miguel Lopes10-May-04 23:42
Miguel Lopes10-May-04 23:42 
GeneralRe: print screen hook? Pin
Toby Opferman11-May-04 2:42
Toby Opferman11-May-04 2:42 
GeneralRe: print screen hook? Pin
Miguel Lopes11-May-04 3:05
Miguel Lopes11-May-04 3:05 
GeneralRe: print screen hook? Pin
Toby Opferman11-May-04 6:00
Toby Opferman11-May-04 6:00 
GeneralRe: print screen hook? Pin
Miguel Lopes12-May-04 2:58
Miguel Lopes12-May-04 2:58 
GeneralC2065 Compiler error. Pin
bin892210-May-04 11:30
bin892210-May-04 11:30 
GeneralRe: C2065 Compiler error. Pin
Christian Graus10-May-04 12:09
protectorChristian Graus10-May-04 12:09 
GeneralRe: C2065 Compiler error. Pin
bin892210-May-04 12:27
bin892210-May-04 12:27 
GeneralRe: C2065 Compiler error. Pin
Christian Graus10-May-04 12:32
protectorChristian Graus10-May-04 12:32 
GeneralRe: C2065 Compiler error. Pin
Ionut L.10-May-04 20:32
Ionut L.10-May-04 20:32 
GeneralRe: C2065 Compiler error. Pin
Robert A. T. Káldy10-May-04 22:46
Robert A. T. Káldy10-May-04 22:46 
GeneralError when closing application Pin
Krugger40410-May-04 11:04
Krugger40410-May-04 11:04 
GeneralRe: Error when closing application Pin
Blake Miller10-May-04 11:26
Blake Miller10-May-04 11:26 
GeneralRe: Error when closing application Pin
Mil1010-May-04 19:47
suss Mil1010-May-04 19:47 
GeneralRe: Error when closing application Pin
10-May-04 19:46
suss10-May-04 19:46 
GeneralControll Access Pin
Grahamfff10-May-04 9:32
Grahamfff10-May-04 9:32 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.