c++ - UnhookWindowsHookEx()崩溃

我为计算器制作了钩子(Hook)，想获取计算器收到的消息。为此，我设置了自己的窗口过程，但是在解钩过程中，如果我使用SetWindowLong(..)来恢复旧的窗口过程，则程序会崩溃。

DLL代码:

#define EXPORT_API extern "C" __declspec(dllexport)

EXPORT_API void InstallHook();
EXPORT_API void UninstallHook();

#pragma data_seg("Shared")
HHOOK   g_hHook  = NULL;
WNDPROC g_OldWndProc = NULL;
#pragma data_seg()
#pragma comment(linker, "/section:Shared,rws")

HWND GetTargetWindowHwnd()
{
return ::FindWindowA(0, "Calculator");
}

// my new wnd procedure to catch messages
LRESULT CALLBACK NewWndProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
    LRESULT lResult = 0;
    switch(uMsg)
    {
    case WM_CLOSE:
        {
            MessageBoxA(0, "Here we are!", "", 0);
        }
        break;
    default:
        lResult = CallWindowProc(g_OldWndProc, hwnd, uMsg, wParam, lParam);
        break;
    }
    lResult = CallWindowProc(g_OldWndProc, hwnd, uMsg, wParam, lParam);
    return lResult;
}
// hook procedure
LRESULT CALLBACK GetMsgProc(int nCode, WPARAM wParam, LPARAM lParam)
{
    MSG *pMsg = (MSG *)lParam;
    HWND hWnd = GetTargetWindowHwnd();
    bool flagIn = false;

    if( hWnd == pMsg->hwnd )
    {// if messege was sent to my target window
        if(g_OldWndProc == NULL)
        {
            // save the adress of old wnd procedure to recover it later
            g_OldWndProc = (WNDPROC)GetWindowLong(hWnd, GWL_WNDPROC);
            // set my wnd procedure
            SetWindowLong(hWnd, GWL_WNDPROC, (LONG)NewWndProc);
        }
    }
    return CallNextHookEx(g_hHook, nCode, wParam, lParam);
}

EXPORT_API void InstallHook()
{
    try
    {
        g_hHook = SetWindowsHookEx(WH_GETMESSAGE, (HOOKPROC)GetMsgProc, g_hInstance, 0);
    }
    catch(...)
    {
        MessageBoxA(0, "Hook error", "Error", 0);
    }
}

EXPORT_API void UninstallHook()
{
    if(g_OldWndProc)
    {
        // recovering old wnd proc
        HWND hWnd = GetTargetWindowHwnd();
        SetWindowLong(hWnd, GWL_WNDPROC, (LONG)g_OldWndProc);
        g_OldWndProc = NULL;
    }
    if (g_hHook)
    {
        UnhookWindowsHookEx(g_hHook);
        g_hHook = NULL;
    }
}

BOOL APIENTRY DllMain( HMODULE hModule,
    DWORD  ul_reason_for_call,
    LPVOID lpReserved
    )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        g_hInstance  = (HINSTANCE) hModule;
        break;
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

EXE代码:

void CHookTestDlg::OnBnClickedBtnInstall()
{
    InstallHook();
}

void CHookTestDlg::OnBnClickedBtnUninstall()
{
    UninstallHook();
}

如果我不使用我的wnd过程，它将正常工作。如果我使用SetWindowLong(..)恢复旧的窗口过程，则程序在摘机过程中会崩溃。怎么了？

最佳答案

问题在于您是在目标进程(计算)中在目标窗口上设置窗口proc，在这种情况下，它是成功的。但是，当您调用UninstallHook时，该代码将在您自己的exe进程中运行。在这种情况下，SetWindowLong将失败。

(将钩子(Hook)值放入共享内存中将无济于事； SetWindowLong仍将拒绝更改跨进程边界的窗口proc-有关详细信息，请参见MSDN。)

为了使其正常工作，您需要与DLL的挂钩实例通信，并要求它从该目标进程中重置wndproc，一旦完成，则将其脱钩。

(atzz关于脱钩的建议也是有效的。通常最好避免钩住不属于您的窗口。)

关于c++ - UnhookWindowsHookEx()崩溃，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/5297936/