#include "stdafx.h"

#include "Hooks.h"

#include "MenuCommon/PrivateNamespace.h"

#include <TlHelp32.h>

struct HookTarget

{

LPCTSTR executableName;

HWND window;

DWORD threadId;

};

Hooks* windowHooks = NULL;

BOOL IsProcessExecutable(HWND hWnd, LPCTSTR expectedExecutableName,

BOOL* processResolved)

{

*processResolved = FALSE;

DWORD processId;

if (!GetWindowThreadProcessId(hWnd, &processId))

{

return FALSE;

}

HANDLE process = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION,

FALSE, processId);

if (!process)

{

return FALSE;

}

TCHAR imagePath[MAX_PATH];

DWORD imagePathLength = ARRAYSIZE(imagePath);

BOOL matched = FALSE;

if (QueryFullProcessImageName(process, 0, imagePath, &imagePathLength))

{

*processResolved = TRUE;

LPCTSTR executableName = _tcsrchr(imagePath, _T('\\'));

executableName = executableName ? executableName + 1 : imagePath;

matched = _tcsicmp(executableName, expectedExecutableName) == 0;

}

CloseHandle(process);

return matched;

}

BOOL IsApplicationWindow(HWND hWnd)

{

HWND rootWindow = GetAncestor(hWnd, GA_ROOT);

if (!rootWindow || !IsWindowVisible(rootWindow))

{

return FALSE;

}

if (!(GetWindowLongPtr(rootWindow, GWL_STYLE) & WS_SYSMENU))

{

return FALSE;

}

DWORD processId;

GetWindowThreadProcessId(hWnd, &processId);

DWORD rootProcessId;

GetWindowThreadProcessId(rootWindow, &rootProcessId);

return processId != GetCurrentProcessId()

&& rootProcessId != GetCurrentProcessId();

}

BOOL IsApplicationFrameWindow(HWND hWnd)

{

TCHAR className[64];

return GetClassName(GetAncestor(hWnd, GA_ROOT), className,

ARRAYSIZE(className))

&& _tcscmp(className, _T("ApplicationFrameWindow")) == 0;

}

BOOL CALLBACK InstallChildWindowHook(HWND hWnd, LPARAM lParam)

{

reinterpret_cast<Hooks*>(lParam)->InstallForWindow(hWnd);

return TRUE;

}

BOOL CALLBACK InstallTopLevelWindowHook(HWND hWnd, LPARAM lParam)

{

if (IsApplicationWindow(hWnd))

{

Hooks* hooks = reinterpret_cast<Hooks*>(lParam);

hooks->InstallForWindow(hWnd);

if (!IsApplicationFrameWindow(hWnd))

{

EnumChildWindows(hWnd, InstallChildWindowHook, lParam);

}

}

return TRUE;

}

VOID CALLBACK WindowShowWinEventProc(HWINEVENTHOOK hWinEventHook, DWORD event,

HWND hWnd, LONG idObject, LONG idChild, DWORD eventThread, DWORD eventTime)

{

UNREFERENCED_PARAMETER(hWinEventHook);

UNREFERENCED_PARAMETER(event);

UNREFERENCED_PARAMETER(eventThread);

UNREFERENCED_PARAMETER(eventTime);

if (!windowHooks || !hWnd)

{

return;

}

if (event == EVENT_SYSTEM_FOREGROUND

|| (idObject == OBJID_WINDOW && idChild == CHILDID_SELF))

{

windowHooks->QueueWindowEvent(hWnd);

}

}

struct ThreadHookMessage

{

DWORD threadId;

UINT message;

BOOL delivered;

};

BOOL CALLBACK SendHookMessage(HWND hWnd, LPARAM lParam)

{

ThreadHookMessage* hookMessage =

reinterpret_cast<ThreadHookMessage*>(lParam);

DWORD threadId = GetWindowThreadProcessId(hWnd, NULL);

if (threadId == hookMessage->threadId)

{

DWORD_PTR result;

if (SendMessageTimeout(hWnd, hookMessage->message, 0, 0,

SMTO_ABORTIFHUNG | SMTO_BLOCK, 200, &result))

{

hookMessage->delivered = TRUE;

}

}

return TRUE;

}

BOOL CALLBACK SendTopLevelHookMessage(HWND hWnd, LPARAM lParam)

{

SendHookMessage(hWnd, lParam);

EnumChildWindows(hWnd, SendHookMessage, lParam);

return TRUE;

}

VOID SendTrackedHookMessage(DWORD threadId, const HookThread& hook,

UINT message)

{

ThreadHookMessage hookMessage = { threadId, message, FALSE };

EnumThreadWindows(threadId, SendTopLevelHookMessage,

reinterpret_cast<LPARAM>(&hookMessage));

if (!hookMessage.delivered && IsWindow(hook.window)

&& GetWindowThreadProcessId(hook.window, NULL) == threadId)

{

SendHookMessage(hook.window, reinterpret_cast<LPARAM>(&hookMessage));

}

}

BOOL CALLBACK FindHookTarget(HWND hWnd, LPARAM lParam)

{

HookTarget* target = reinterpret_cast<HookTarget*>(lParam);

if (!IsWindowVisible(hWnd) || GetWindow(hWnd, GW_OWNER))

{

return TRUE;

}

DWORD processId;

DWORD threadId = GetWindowThreadProcessId(hWnd, &processId);

HANDLE hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, processId);

if (!hProcess)

{

return TRUE;

}

TCHAR imagePath[MAX_PATH];

DWORD imagePathLength = ARRAYSIZE(imagePath);

BOOL matched = FALSE;

if (QueryFullProcessImageName(hProcess, 0, imagePath, &imagePathLength))

{

LPCTSTR executableName = _tcsrchr(imagePath, _T('\\'));

executableName = executableName ? executableName + 1 : imagePath;

matched = _tcsicmp(executableName, target->executableName) == 0;

}

CloseHandle(hProcess);

if (!matched)

{

return TRUE;

}

if (target->window)

{

// Refuse ambiguous filenames instead of hooking an arbitrary process.

target->threadId = 0;

return FALSE;

}

target->window = hWnd;

target->threadId = threadId;

return TRUE;

}

BOOL FindRemoteModule(DWORD processId, LPCTSTR modulePath,

MODULEENTRY32* matchingModule)

{

HANDLE snapshot = CreateToolhelp32Snapshot(

TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, processId);

if (snapshot == INVALID_HANDLE_VALUE) return FALSE;

BOOL found = FALSE;

MODULEENTRY32 module = { 0 };

module.dwSize = sizeof(module);

if (Module32First(snapshot, &module))

{

do

{

if (_tcsicmp(module.szExePath, modulePath) == 0)

{

*matchingModule = module;

found = TRUE;

break;

}

} while (Module32Next(snapshot, &module));

}

CloseHandle(snapshot);

return found;

}

LPTHREAD_START_ROUTINE FindRemoteKernelProcedure(DWORD processId,

LPCSTR procedureName)

{

HMODULE localKernel = GetModuleHandle(_T("kernel32.dll"));

FARPROC localProcedure = localKernel

? GetProcAddress(localKernel, procedureName) : NULL;

HMODULE procedureModule = NULL;

TCHAR procedureModulePath[MAX_PATH];

MODULEENTRY32 remoteProcedureModule = { 0 };

if (!localProcedure

|| !GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS

| GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,

reinterpret_cast<LPCTSTR>(localProcedure), &procedureModule)

|| !GetModuleFileName(procedureModule, procedureModulePath,

ARRAYSIZE(procedureModulePath))

|| !FindRemoteModule(processId, procedureModulePath,

&remoteProcedureModule))

{

return NULL;

}

return reinterpret_cast<LPTHREAD_START_ROUTINE>(

reinterpret_cast<BYTE*>(remoteProcedureModule.hModule)

+ (reinterpret_cast<BYTE*>(localProcedure)

- reinterpret_cast<BYTE*>(procedureModule)));

}

BOOL InjectHookDll(DWORD processId, HMODULE hookModule,

MODULEENTRY32* remoteModule)

{

TCHAR modulePath[MAX_PATH];

if (!GetModuleFileName(hookModule, modulePath, ARRAYSIZE(modulePath)))

return FALSE;

HANDLE process = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION

| PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ,

FALSE, processId);

if (!process || GetProcessId(process) != processId)

{

if (process) CloseHandle(process);

SetLastError(ERROR_ACCESS_DENIED);

return FALSE;

}

SIZE_T modulePathBytes = (_tcslen(modulePath) + 1) * sizeof(TCHAR);

LPVOID remotePath = VirtualAllocEx(process, NULL, modulePathBytes,

MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

SIZE_T bytesWritten = 0;

BOOL pathWritten = remotePath && WriteProcessMemory(process, remotePath,

modulePath, modulePathBytes, &bytesWritten)

&& bytesWritten == modulePathBytes;

LPTHREAD_START_ROUTINE loadLibrary = FindRemoteKernelProcedure(processId,

"LoadLibraryW");

HANDLE injectionThread = pathWritten && loadLibrary

? CreateRemoteThread(process, NULL, 0, loadLibrary, remotePath, 0, NULL)

: NULL;

DWORD threadCreationError = injectionThread ? ERROR_SUCCESS : GetLastError();

DWORD injectionResult = 0;

BOOL threadCompleted = injectionThread

&& WaitForSingleObject(injectionThread, 5000) == WAIT_OBJECT_0

&& GetExitCodeThread(injectionThread, &injectionResult);

BOOL injected = threadCompleted && injectionResult

&& FindRemoteModule(processId, modulePath, remoteModule);

if (!injected)

{

if (!remotePath) SetLastError(ERROR_NOT_ENOUGH_MEMORY);

else if (!pathWritten) SetLastError(ERROR_WRITE_FAULT);

else if (!loadLibrary) SetLastError(ERROR_PROC_NOT_FOUND);

else if (!injectionThread) SetLastError(threadCreationError);

else if (!threadCompleted) SetLastError(WAIT_TIMEOUT);

else if (!injectionResult) SetLastError(ERROR_DLL_INIT_FAILED);

else SetLastError(ERROR_MOD_NOT_FOUND);

}

if (injectionThread) CloseHandle(injectionThread);

if (remotePath) VirtualFreeEx(process, remotePath, 0, MEM_RELEASE);

CloseHandle(process);

return injected;

}

VOID ReleaseInjectedHookDll(DWORD processId, HMODULE remoteModule)

{

HANDLE process = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION,

FALSE, processId);

LPTHREAD_START_ROUTINE freeLibrary = FindRemoteKernelProcedure(processId,

"FreeLibrary");

HANDLE releaseThread = process && freeLibrary

? CreateRemoteThread(process, NULL, 0, freeLibrary, remoteModule, 0, NULL)

: NULL;

if (releaseThread)

{

WaitForSingleObject(releaseThread, 5000);

CloseHandle(releaseThread);

}

if (process) CloseHandle(process);

}

struct FrameBootstrapParameters

{

HWND frameWindow;

DWORD ownerProcessId;

HWND coordinatorWindow;

};

BOOL RunRemoteFrameBootstrap(DWORD processId, HMODULE localModule,

HMODULE remoteModule, HWND frameWindow, HWND coordinatorWindow)

{

FARPROC localBootstrap = GetProcAddress(localModule,

"InstallFrameBootstrap");

if (!localBootstrap) return FALSE;

LPTHREAD_START_ROUTINE remoteBootstrap =

reinterpret_cast<LPTHREAD_START_ROUTINE>(

reinterpret_cast<BYTE*>(remoteModule)

+ (reinterpret_cast<BYTE*>(localBootstrap)

- reinterpret_cast<BYTE*>(localModule)));

HANDLE process = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION

| PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ,

FALSE, processId);

if (!process) return FALSE;

FrameBootstrapParameters parameters = {

GetAncestor(frameWindow, GA_ROOT), GetCurrentProcessId(),

coordinatorWindow };

LPVOID remoteParameters = VirtualAllocEx(process, NULL, sizeof(parameters),

MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

SIZE_T bytesWritten = 0;

BOOL parametersWritten = remoteParameters

&& WriteProcessMemory(process, remoteParameters, &parameters,

sizeof(parameters), &bytesWritten)

&& bytesWritten == sizeof(parameters);

HANDLE bootstrapThread = parametersWritten

? CreateRemoteThread(process, NULL, 0, remoteBootstrap,

remoteParameters, 0, NULL) : NULL;

DWORD exitCode = 0;

BOOL bootstrapped = bootstrapThread

&& WaitForSingleObject(bootstrapThread, 5000) == WAIT_OBJECT_0

&& GetExitCodeThread(bootstrapThread, &exitCode) && exitCode == TRUE;

if (bootstrapThread) CloseHandle(bootstrapThread);

if (remoteParameters) VirtualFreeEx(process, remoteParameters, 0, MEM_RELEASE);

CloseHandle(process);

return bootstrapped;

}

Hooks::Hooks(HWND notificationWindow)

{

hWinEventHook = NULL;

hForegroundWinEventHook = NULL;

hModDLL = NULL;

hPrivateNamespace = NULL;

this->notificationWindow = notificationWindow;

}

Hooks::~Hooks()

{

Uninstall();

}

BOOL Hooks::Install(LPCTSTR targetExecutable, HWND targetWindow)

{

if (!targetWindow && targetExecutable && *targetExecutable)

{

HookTarget target = { targetExecutable, NULL, 0 };

EnumWindows(FindHookTarget, reinterpret_cast<LPARAM>(&target));

if (!target.window || !target.threadId)

{

return FALSE;

}

targetWindow = target.window;

}

if (targetWindow && !IsApplicationWindow(targetWindow))

{

return FALSE;

}

// Load hook DLL

hModDLL = LoadLibrary(BUILD(MT_DLL_NAME));

if (!hModDLL)

{

return FALSE;

}

hPrivateNamespace = PrivateNamespace::Create(GetCurrentProcessId());

if (!hPrivateNamespace)

{

FreeLibrary(hModDLL);

hModDLL = NULL;

return FALSE;

}

if (targetWindow)

{

if (!InstallForWindow(targetWindow))

{

FreeLibrary(hModDLL);

hModDLL = NULL;

ClosePrivateNamespace(hPrivateNamespace,

PRIVATE_NAMESPACE_FLAG_DESTROY);

hPrivateNamespace = NULL;

return FALSE;

}

if (!IsApplicationFrameWindow(targetWindow))

{

EnumChildWindows(targetWindow, InstallChildWindowHook,

reinterpret_cast<LPARAM>(this));

}

}

else

{

windowHooks = this;

hWinEventHook = SetWinEventHook(EVENT_OBJECT_SHOW, EVENT_OBJECT_SHOW, NULL,

WindowShowWinEventProc, 0, 0,

WINEVENT_OUTOFCONTEXT | WINEVENT_SKIPOWNPROCESS);

hForegroundWinEventHook = SetWinEventHook(EVENT_SYSTEM_FOREGROUND,

EVENT_SYSTEM_FOREGROUND, NULL, WindowShowWinEventProc, 0, 0,

WINEVENT_OUTOFCONTEXT | WINEVENT_SKIPOWNPROCESS);

if (!hWinEventHook || !hForegroundWinEventHook)

{

windowHooks = NULL;

Uninstall();

return FALSE;

}

EnumWindows(InstallTopLevelWindowHook, reinterpret_cast<LPARAM>(this));

}

return TRUE;

}

VOID Hooks::QueueWindowEvent(HWND targetWindow)

{

HWND rootWindow = GetAncestor(targetWindow, GA_ROOT);

DWORD rootThreadId = rootWindow

? GetWindowThreadProcessId(rootWindow, NULL) : 0;

if (rootThreadId)

{

PostMessage(notificationWindow, MT_APP_MSG_WINDOW_EVENT,

reinterpret_cast<WPARAM>(rootWindow), rootThreadId);

}

}

VOID Hooks::HandleWindowEvent(HWND targetWindow, DWORD targetThreadId)

{

HWND rootWindow = GetAncestor(targetWindow, GA_ROOT);

if (rootWindow

&& GetWindowThreadProcessId(rootWindow, NULL) == targetThreadId)

{

InstallTopLevelWindowHook(rootWindow,

reinterpret_cast<LPARAM>(this));

}

}

static HHOOK InstallThreadHook(int hookType, HOOKPROC hookProcedure,

HMODULE hookModule, DWORD targetThreadId, DWORD targetProcessId)

{

if (!hookProcedure || !hookModule || !targetThreadId || !targetProcessId)

{

SetLastError(ERROR_INVALID_PARAMETER);

return NULL;

}

HANDLE targetThread = OpenThread(THREAD_QUERY_LIMITED_INFORMATION, FALSE,

targetThreadId);

if (!targetThread)

{

return NULL;

}

if (GetProcessIdOfThread(targetThread) != targetProcessId)

{

CloseHandle(targetThread);

SetLastError(ERROR_INVALID_PARAMETER);

return NULL;

}

HHOOK hook = SetWindowsHookEx(hookType, hookProcedure, hookModule,

targetThreadId);

CloseHandle(targetThread);

return hook;

}

BOOL Hooks::InstallForWindow(HWND targetWindow)

{

if (!targetWindow || !IsApplicationWindow(targetWindow)) return FALSE;

BOOL applicationFrameWindow = IsApplicationFrameWindow(targetWindow);

if (applicationFrameWindow)

{

targetWindow = GetAncestor(targetWindow, GA_ROOT);

if (!targetWindow) return FALSE;

}

DWORD targetProcessId;

DWORD targetThreadId = GetWindowThreadProcessId(targetWindow, &targetProcessId);

if (!targetThreadId) return FALSE;

std::map<DWORD, HookThread>::iterator existingHook = threadHooks.find(targetThreadId);

if (existingHook != threadHooks.end())

{

existingHook->second.window = targetWindow;

return TRUE;

}

if (applicationFrameWindow)

{

MODULEENTRY32 remoteModule = { 0 };

if (!InjectHookDll(targetProcessId, hModDLL, &remoteModule))

{

SetProp(notificationWindow, MT_FRAME_INJECTION_ERROR_PROP,

reinterpret_cast<HANDLE>(static_cast<ULONG_PTR>(GetLastError())));

return FALSE;

}

TCHAR eventObjectName[64];

TCHAR eventName[128];

TCHAR completeEventObjectName[64];

TCHAR completeEventName[128];

TCHAR releaseEventObjectName[64];

TCHAR releaseEventName[128];

_sntprintf_s(eventObjectName, ARRAYSIZE(eventObjectName), _TRUNCATE,

_T("AfhUnloadThread%u"), targetThreadId);

_sntprintf_s(completeEventObjectName,

ARRAYSIZE(completeEventObjectName), _TRUNCATE,

_T("AfhUnhookCompleteThread%u"), targetThreadId);

_sntprintf_s(releaseEventObjectName,

ARRAYSIZE(releaseEventObjectName), _TRUNCATE,

_T("AfhReleaseStartedThread%u"), targetThreadId);

SECURITY_ATTRIBUTES eventSecurity;

PSECURITY_DESCRIPTOR eventSecurityDescriptor = NULL;

BOOL namesCreated = PrivateNamespace::MakeObjectName(eventName,

ARRAYSIZE(eventName), GetCurrentProcessId(), eventObjectName)

&& PrivateNamespace::MakeObjectName(completeEventName,

ARRAYSIZE(completeEventName), GetCurrentProcessId(),

completeEventObjectName)

&& PrivateNamespace::MakeObjectName(releaseEventName,

ARRAYSIZE(releaseEventName), GetCurrentProcessId(),

releaseEventObjectName);

BOOL securityCreated = PrivateNamespace::CreateSharedEventSecurityAttributes(

&eventSecurity, &eventSecurityDescriptor);

HANDLE unloadEvent = namesCreated && securityCreated

? CreateEvent(&eventSecurity, TRUE, FALSE, eventName) : NULL;

HANDLE unhookCompleteEvent = namesCreated && securityCreated

? CreateEvent(&eventSecurity, TRUE, FALSE, completeEventName) : NULL;

HANDLE releaseStartedEvent = namesCreated && securityCreated

? CreateEvent(&eventSecurity, TRUE, FALSE, releaseEventName) : NULL;

if (eventSecurityDescriptor) LocalFree(eventSecurityDescriptor);

if (!unloadEvent || !unhookCompleteEvent || !releaseStartedEvent)

{

if (unloadEvent) CloseHandle(unloadEvent);

if (unhookCompleteEvent) CloseHandle(unhookCompleteEvent);

if (releaseStartedEvent) CloseHandle(releaseStartedEvent);

ReleaseInjectedHookDll(targetProcessId, remoteModule.hModule);

return FALSE;

}

BOOL bootstrapped = RunRemoteFrameBootstrap(targetProcessId, hModDLL,

remoteModule.hModule, targetWindow, notificationWindow);

PostThreadMessage(targetThreadId, WM_NULL, 0, 0);

DWORD_PTR barrierResult;

SendMessageTimeout(GetAncestor(targetWindow, GA_ROOT), WM_NULL, 0, 0,

SMTO_ABORTIFHUNG | SMTO_BLOCK, 1000, &barrierResult);

if (!bootstrapped)

{

SetEvent(unloadEvent);

SetEvent(unhookCompleteEvent);

CloseHandle(unloadEvent);

CloseHandle(unhookCompleteEvent);

CloseHandle(releaseStartedEvent);

ReleaseInjectedHookDll(targetProcessId, remoteModule.hModule);

return FALSE;

}

HookThread hook = { targetWindow, targetProcessId,

NULL, NULL, NULL, unloadEvent, unhookCompleteEvent,

releaseStartedEvent };

threadHooks.insert(std::make_pair(targetThreadId, hook));

return TRUE;

}

HHOOK callWndProcHook = InstallThreadHook(WH_CALLWNDPROC,

(HOOKPROC)GetProcAddress(hModDLL, MT_HOOK_PROC_CWP), hModDLL,

targetThreadId, targetProcessId);

if (!callWndProcHook) return FALSE;

HHOOK callWndRetHook = InstallThreadHook(WH_CALLWNDPROCRET,

(HOOKPROC)GetProcAddress(hModDLL, MT_HOOK_PROC_CWRP), hModDLL,

targetThreadId, targetProcessId);

if (!callWndRetHook)

{

UnhookWindowsHookEx(callWndProcHook);

return FALSE;

}

HHOOK getMessageHook = InstallThreadHook(WH_GETMESSAGE,

(HOOKPROC)GetProcAddress(hModDLL, MT_HOOK_PROC_GMP), hModDLL,

targetThreadId, targetProcessId);

if (!getMessageHook)

{

UnhookWindowsHookEx(callWndRetHook);

UnhookWindowsHookEx(callWndProcHook);

return FALSE;

}

TCHAR unloadObjectName[64];

TCHAR unloadName[128];

TCHAR completeObjectName[64];

TCHAR completeName[128];

TCHAR releaseObjectName[64];

TCHAR releaseName[128];

_sntprintf_s(unloadObjectName, ARRAYSIZE(unloadObjectName), _TRUNCATE,

_T("GenericUnloadProcess%u"), targetProcessId);

_sntprintf_s(completeObjectName, ARRAYSIZE(completeObjectName), _TRUNCATE,

_T("GenericUnhookCompleteProcess%u"), targetProcessId);

_sntprintf_s(releaseObjectName, ARRAYSIZE(releaseObjectName), _TRUNCATE,

_T("GenericReleaseStartedProcess%u"), targetProcessId);

SECURITY_ATTRIBUTES eventSecurity;

PSECURITY_DESCRIPTOR eventSecurityDescriptor = NULL;

BOOL namesCreated = PrivateNamespace::MakeObjectName(unloadName,

ARRAYSIZE(unloadName), GetCurrentProcessId(), unloadObjectName)

&& PrivateNamespace::MakeObjectName(completeName,

ARRAYSIZE(completeName), GetCurrentProcessId(), completeObjectName)

&& PrivateNamespace::MakeObjectName(releaseName,

ARRAYSIZE(releaseName), GetCurrentProcessId(), releaseObjectName);

BOOL securityCreated = PrivateNamespace::CreateSharedEventSecurityAttributes(

&eventSecurity, &eventSecurityDescriptor);

HANDLE unloadEvent = namesCreated && securityCreated

? CreateEvent(&eventSecurity, TRUE, FALSE, unloadName) : NULL;

HANDLE unhookCompleteEvent = namesCreated && securityCreated

? CreateEvent(&eventSecurity, TRUE, FALSE, completeName) : NULL;

HANDLE releaseStartedEvent = namesCreated && securityCreated

? CreateEvent(&eventSecurity, TRUE, FALSE, releaseName) : NULL;

if (eventSecurityDescriptor) LocalFree(eventSecurityDescriptor);

DWORD_PTR setupResult = 0;

BOOL watcherReady = FALSE;

if (unloadEvent && unhookCompleteEvent && releaseStartedEvent)

{

SendMessageTimeout(targetWindow, MT_HOOK_MSG_SET_GENERIC_WATCHER,

GetCurrentProcessId(), targetProcessId,

SMTO_ABORTIFHUNG | SMTO_BLOCK, 1000, &setupResult);

watcherReady = GetProp(targetWindow,

MT_GENERIC_WATCHER_READY_PROP) != NULL;

}

if (watcherReady)

{

RemoveProp(targetWindow, MT_GENERIC_WATCHER_READY_PROP);

}

if (!watcherReady)

{

BOOL watcherInstalled = GetProp(targetWindow,

MT_GENERIC_WATCHER_READY_PROP) != NULL;

if (watcherInstalled)

{

RemoveProp(targetWindow, MT_GENERIC_WATCHER_READY_PROP);

}

if (unloadEvent) SetEvent(unloadEvent);

UnhookWindowsHookEx(getMessageHook);

UnhookWindowsHookEx(callWndRetHook);

UnhookWindowsHookEx(callWndProcHook);

if (unhookCompleteEvent) SetEvent(unhookCompleteEvent);

if (watcherInstalled && releaseStartedEvent)

{

WaitForSingleObject(releaseStartedEvent, 5000);

}

if (unloadEvent) CloseHandle(unloadEvent);

if (unhookCompleteEvent) CloseHandle(unhookCompleteEvent);

if (releaseStartedEvent) CloseHandle(releaseStartedEvent);

return FALSE;

}

HookThread hook = { targetWindow, targetProcessId,

callWndProcHook, callWndRetHook, getMessageHook, unloadEvent,

unhookCompleteEvent, releaseStartedEvent };

threadHooks.insert(std::make_pair(targetThreadId, hook));

return TRUE;

}

BOOL Hooks::UninstallForThread(DWORD threadId)

{

std::map<DWORD, HookThread>::iterator hook = threadHooks.find(threadId);

if (hook == threadHooks.end())

{

return FALSE;

}

BOOL unhooked = TRUE;

if (hook->second.unloadEvent)

{

SetEvent(hook->second.unloadEvent);

}

if (hook->second.callWndProc)

{

unhooked = UnhookWindowsHookEx(hook->second.callWndProc) && unhooked;

hook->second.callWndProc = NULL;

}

if (hook->second.callWndRetProc)

{

unhooked = UnhookWindowsHookEx(hook->second.callWndRetProc) && unhooked;

hook->second.callWndRetProc = NULL;

}

if (hook->second.getMessage)

{

unhooked = UnhookWindowsHookEx(hook->second.getMessage) && unhooked;

hook->second.getMessage = NULL;

}

HANDLE thread = OpenThread(THREAD_QUERY_LIMITED_INFORMATION, FALSE, threadId);

if (thread && GetProcessIdOfThread(thread) == hook->second.processId)

{

PostThreadMessage(threadId, WM_NULL, 0, 0);

}

if (thread) CloseHandle(thread);

if (hook->second.unhookCompleteEvent)

{

SetEvent(hook->second.unhookCompleteEvent);

CloseHandle(hook->second.unhookCompleteEvent);

hook->second.unhookCompleteEvent = NULL;

}

if (hook->second.releaseStartedEvent)

{

if (WaitForSingleObject(hook->second.releaseStartedEvent, 5000)

== WAIT_OBJECT_0)

{

SetProp(notificationWindow, MT_FRAME_RELEASE_ACK_PROP,

reinterpret_cast<HANDLE>(TRUE));

}

CloseHandle(hook->second.releaseStartedEvent);

hook->second.releaseStartedEvent = NULL;

}

if (hook->second.unloadEvent)

{

CloseHandle(hook->second.unloadEvent);

hook->second.unloadEvent = NULL;

}

threadHooks.erase(hook);

return unhooked;

}

VOID Hooks::UninstallThreadHooks()

{

for (std::map<DWORD, HookThread>::iterator hook = threadHooks.begin();

hook != threadHooks.end(); hook++)

{

if (hook->second.unloadEvent)

{

SetEvent(hook->second.unloadEvent);

}

}

for (std::map<DWORD, HookThread>::iterator hook = threadHooks.begin();

hook != threadHooks.end(); hook++)

{

if (hook->second.callWndProc)

{

UnhookWindowsHookEx(hook->second.callWndProc);

hook->second.callWndProc = NULL;

}

if (hook->second.callWndRetProc)

{

UnhookWindowsHookEx(hook->second.callWndRetProc);

hook->second.callWndRetProc = NULL;

}

if (hook->second.getMessage)

{

UnhookWindowsHookEx(hook->second.getMessage);

hook->second.getMessage = NULL;

}

}

for (std::map<DWORD, HookThread>::iterator hook = threadHooks.begin();

hook != threadHooks.end(); hook++)

{

HANDLE thread = OpenThread(THREAD_QUERY_LIMITED_INFORMATION,

FALSE, hook->first);

if (thread && GetProcessIdOfThread(thread) == hook->second.processId)

{

PostThreadMessage(hook->first, WM_NULL, 0, 0);

DWORD_PTR result;

SendMessageTimeout(hook->second.window, WM_NULL, 0, 0,

SMTO_ABORTIFHUNG | SMTO_BLOCK, 1000, &result);

}

if (thread) CloseHandle(thread);

}

for (std::map<DWORD, HookThread>::iterator hook = threadHooks.begin();

hook != threadHooks.end(); hook++)

{

if (hook->second.unhookCompleteEvent)

{

SetEvent(hook->second.unhookCompleteEvent);

CloseHandle(hook->second.unhookCompleteEvent);

hook->second.unhookCompleteEvent = NULL;

}

}

for (std::map<DWORD, HookThread>::iterator hook = threadHooks.begin();

hook != threadHooks.end(); hook++)

{

if (hook->second.releaseStartedEvent)

{

if (WaitForSingleObject(hook->second.releaseStartedEvent, 5000)

== WAIT_OBJECT_0)

{

SetProp(notificationWindow, MT_FRAME_RELEASE_ACK_PROP,

reinterpret_cast<HANDLE>(TRUE));

}

CloseHandle(hook->second.releaseStartedEvent);

hook->second.releaseStartedEvent = NULL;

}

if (hook->second.unloadEvent)

{

CloseHandle(hook->second.unloadEvent);

hook->second.unloadEvent = NULL;

}

}

}

VOID WakeHookThreads(const std::map<DWORD, HookThread>& threadHooks)

{

for (std::map<DWORD, HookThread>::const_iterator hook = threadHooks.begin();

hook != threadHooks.end(); hook++)

{

HANDLE thread = OpenThread(THREAD_QUERY_LIMITED_INFORMATION,

FALSE, hook->first);

if (thread && GetProcessIdOfThread(thread) == hook->second.processId)

{

PostThreadMessage(hook->first, WM_NULL, 0, 0);

}

if (thread) CloseHandle(thread);

}

}

BOOL Hooks::Uninstall()

{

BOOL bRetn = TRUE;

BOOL hooksInstalled = !threadHooks.empty();

if (hWinEventHook)

{

UnhookWinEvent(hWinEventHook);

hWinEventHook = NULL;

}

if (hForegroundWinEventHook)

{

UnhookWinEvent(hForegroundWinEventHook);

hForegroundWinEventHook = NULL;

}

if (windowHooks == this)

{

windowHooks = NULL;

}

// Give each hooked UI thread a bounded opportunity to remove its menus.

if (hooksInstalled)

{

for (std::map<DWORD, HookThread>::const_iterator hook =

threadHooks.begin(); hook != threadHooks.end(); hook++)

{

SendTrackedHookMessage(hook->first, hook->second, WM_CANCELMODE);

SendTrackedHookMessage(hook->first, hook->second,

MT_HOOK_MSG_QUIT);

}

}

UninstallThreadHooks();

if (hModDLL)

{

FreeLibrary(hModDLL);

hModDLL = NULL;

}

WakeHookThreads(threadHooks);

if (hooksInstalled)

{

for (std::map<DWORD, HookThread>::const_iterator hook =

threadHooks.begin(); hook != threadHooks.end(); hook++)

{

SendTrackedHookMessage(hook->first, hook->second,

MT_HOOK_MSG_RELEASE);

}

}

threadHooks.clear();

if (hPrivateNamespace)

{

ClosePrivateNamespace(hPrivateNamespace,

PRIVATE_NAMESPACE_FLAG_DESTROY);

hPrivateNamespace = NULL;

}

return bRetn;

}