using System;
using SystemIO;
using SystemReflection;
using SystemRuntimeInteropServices;
using SystemWindowsForms;
namespace WATPMS
{
/**//// <summary>
/// Description: Hook Helper类可以屏蔽一些热键并屏蔽任务管理器
/// Author: ZhangRongHua
/// Create DateTime: :
/// UpdateHistory:
/// </summary>
public class HookHelper
{
Delegates#region Delegates
public delegate int HookProc(int nCode Int wParam IntPtr lParam);
#endregion
变量声明#region 变量声明
private HookProc KeyboardHookProcedure;
private FileStream MyFs; // 用流来屏蔽ctrl alt delete
private const byte LLKHF_ALTDOWN = x;
private const byte VK_CAPITAL = x;
private const byte VK_ESCAPE = xB;
private const byte VK_F = x;
private const byte VK_LCONTROL = xA;
private const byte VK_NUMLOCK = x;
private const byte VK_RCONTROL = xA;
private const byte VK_SHIFT = x;
private const byte VK_TAB = x;
public const int WH_KEYBOARD = ;
private const int WH_KEYBOARD_LL = ;
private const int WH_MOUSE = ;
private const int WH_MOUSE_LL = ;
private const int WM_KEYDOWN = x;
private const int WM_KEYUP = x;
private const int WM_LBUTTONDBLCLK = x;
private const int WM_LBUTTONDOWN = x;
private const int WM_LBUTTONUP = x;
private const int WM_MBUTTONDBLCLK = x;
private const int WM_MBUTTONDOWN = x;
private const int WM_MBUTTONUP = x;
private const int WM_MOUSEMOVE = x;
private const int WM_MOUSEWHEEL = xA;
private const int WM_RBUTTONDBLCLK = x;
private const int WM_RBUTTONDOWN = x;
private const int WM_RBUTTONUP = x;
private const int WM_SYSKEYDOWN = x;
private const int WM_SYSKEYUP = x;
private static int hKeyboardHook = ;
#endregion
函数转换#region 函数转换
[DllImport(userdll CharSet = CharSetAuto CallingConvention = CallingConventionStdCall)]
public static extern int SetWindowsHookEx(int idHook HookProc lpfn IntPtr hInstance int threadId);
// 卸载钩子
[DllImport(userdll CharSet = CharSetAuto CallingConvention = CallingConventionStdCall)]
public static extern bool UnhookWindowsHookEx(int idHook);
// 继续下一个钩子
[DllImport(userdll CharSet = CharSetAuto CallingConvention = CallingConventionStdCall)]
public static extern int CallNextHookEx(int idHook int nCode Int wParam IntPtr lParam);
// 取得当前线程编号
[DllImport(kerneldll)]
private static extern int GetCurrentThreadId();
[DllImport(userdll CharSet = CharSetAuto CallingConvention = CallingConventionStdCall)]
private static extern short GetKeyState(int vKey);
#endregion
方法#region 方法
/**//// <summary>
/// 钩子回调函数在这里屏蔽热键
/// <remark>
/// Author:ZhangRongHua
/// Create DateTime: :
/// Update History:
/// </remark>
/// </summary>
/// <param name=nCode>The n code</param>
/// <param name=wParam>The w param</param>
/// <param name=lParam>The l param</param>
/// <returns></returns>
private int KeyboardHookProc(int nCode Int wParam IntPtr lParam)
{
KeyMSG m = (KeyMSG) MarshalPtrToStructure(lParam typeof (KeyMSG));
if (((Keys) mvkCode == KeysLWin) || ((Keys) mvkCode == KeysRWin) ||
((mvkCode == VK_TAB) && ((mflags & LLKHF_ALTDOWN) != )) ||
((mvkCode == VK_ESCAPE) && ((mflags & LLKHF_ALTDOWN) != )) ||
((mvkCode == VK_F) && ((mflags & LLKHF_ALTDOWN) != )) ||
(mvkCode == VK_ESCAPE) && ((GetKeyState(VK_LCONTROL) & x) != ) ||
(mvkCode == VK_ESCAPE) && ((GetKeyState(VK_RCONTROL) & x) != )
)
{
return ;
}
return CallNextHookEx(hKeyboardHook nCode wParam lParam);
}
/**//// <summary>
/// 启动Hook并用流屏蔽任务管理器
/// <remark>
/// Author:ZhangRongHua
/// Create DateTime: :
/// Update History:
/// </remark>
/// </summary>
public void HookStart()
{
if (hKeyboardHook == )
{
// 创建HookProc实例
KeyboardHookProcedure = new HookProc(KeyboardHookProc);
hKeyboardHook = SetWindowsHookEx(WH_KEYBOARD
KeyboardHookProcedure
MarshalGetHINSTANCE(AssemblyGetExecutingAssembly()GetModules()[])
);
// 如果设置钩子失败
if (hKeyboardHook == )
{
HookStop();
//throw new Exception(SetWindowsHookEx failedeeeeeeee);
}
//用二进制流的方法打开任务管理器而且不关闭流这样任务管理器就打开不了
MyFs = new FileStream(EnvironmentExpandEnvironmentVariables(%windir%\\system\\taskmgrexe)
FileModeOpen);
byte[] MyByte = new byte[(int) MyFsLength];
MyFsWrite(MyByte (int) MyFsLength);
}
}
/**//// <summary>
/// 卸载hook并关闭流取消屏蔽任务管理器
/// <remark>
/// Author:ZhangRongHua
/// Create DateTime: :
/// Update History:
/// </remark>
/// </summary>
public void HookStop()
{
bool retKeyboard = true;
if (hKeyboardHook != )
{
retKeyboard = UnhookWindowsHookEx(hKeyboardHook);
hKeyboardHook = ;
}
if (null != MyFs)
{
MyFsClose();
}
if (!(retKeyboard))
{
throw new Exception(UnhookWindowsHookEx failedsssss);
}
}
#endregion
Nested type: KeyMSG#region Nested type: KeyMSG
public struct KeyMSG
{
public int dwExtraInfo;
public int flags;
public int scanCode;
public int time;
public int vkCode;
}
#endregion
}
}
//PS也可以通过将[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
//下的DisableTaskmgr项的值设为来屏蔽任务管理器
