儿子成长,父亲知识库

如果想命令行方式来清除IE缓冲，可以使用借助RunDll32.exe 来运行Internet选项的对应功能。

比如：

Temporary Internet Files  （Internet临时文件）

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8

Cookies

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2

History (历史记录)

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1

Form Data （表单数据）

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 16

Passwords (密码）

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 32

Delete All  （全部删除）

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255

Delete All - "Also delete files and settings stored by add-ons"

RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 4351

想通过编程方式清除IE缓存， 调用Win32 API函数 ShellExecute 或者 CreateProcess 来执行以上的命令行就可以了。

例子：

ShellExecute(NULL, _T("open"), _T("rundll32.exe"),  _T("InetCpl.cpl,ClearMyTracksByProcess 4351"), NULL, SW_SHOWNORMAL);

一、以下就是WINUSB系统的框架：

从上图可以看出：

WINUSB可以针对于一个设备作为一个驱动，可以看左边的这种设计。

也可以由usbccgp作为父驱动，再由每个Interface生成一个winusb的子驱动。可以看右边的设计。

两种都是通过Winusb来进行通讯的。但在实际使用过程中，两者还是有些不一样的地方。因为每个USB Device都不是完针对于USB的specification来做的。这就是我们决定用上图左边的这种设计。驱动少做。让在User mode处理更多的事情。这样来兼容大都USB设备。

二、pnpmon的工作原理

Pnpmon.sys是一个内核的驱动程序。驱动在加载时，Pnpmon.sys就得到Hub的Driver_Object.把原驱动的Hub的Dispatch的入口地址修改了。用我们的代码来代替。当OS PNP有设备接入（Plug in）时，系统的PDO就一级一级向由驱动来创建供他的设备来运用。

由于pnpmon在hook 的地方为USB HUB的Device stack.PNP返回给系统的BusQueryDeviceID，BusQueryHardwareIDs，BusQueryCompatibleIDs时，我们修改IO_STACK中的内容就可以替换PID与VID了。

三、我们修改两个PID、VID的方法是不会影响的

我们在替换PID与VID时，pnpmon的是知道真正设备的驱动PID，VID，这样就可以根据以前驱动的设备来确认虚拟的PID与VID。目前(prolific的驱动用 Vid_80EE&Pid_FD01)、其它的用(Vid_80EE&Pid_FD02)，对于OS来，就能识别成不同的设备，所以就可以安装不能的驱动。

不同的硬件，不同的驱动，并且都是由microsoft签名过或是mircrosoft写的Driver，当然没有问题。

/// code start ////////////////////////////////////////////////////

void CTestDlg::testCallWMI()

{

      int error_code;

      HANDLE h = INVALID_HANDLE_VALUE;

      BYTE guid[]={0x6f, 0x0a, 0x7c, 0x82, 0xb0, 0xfe, 0xd0, 0x11, 0xbd, 0x26, 0x00, 0xaa, 0x00, 0xb7, 0xb3, 0x2a,};

      wchar_t hubname[]=L"USB\\ROOT_HUB\\4&139B5C82&0";

      wchar_t diid[MAX_PATH];

      HMODULE hWmiDll=LoadLibrary("WMI.DLL");

      if (hWmiDll!=NULL)

      {

            int (__stdcall *lpWmiSetSingleInstanceW)(HANDLE,wchar_t*,int,int,LPBYTE)=NULL;;

            lpWmiSetSingleInstanceW=(int (__stdcall *)(HANDLE,wchar_t*,int,int,LPBYTE))GetProcAddress(hWmiDll,"WmiSetSingleInstanceW");

            int (__stdcall *lpWmiQuerySingleInstanceW)(HANDLE,wchar_t*,int*,LPBYTE)=NULL;;

            lpWmiQuerySingleInstanceW=(int (__stdcall *)(HANDLE,wchar_t*,int*,LPBYTE))GetProcAddress(hWmiDll,"WmiQuerySingleInstanceW");

            void (__stdcall *lpWmiCloseBlock)(HANDLE)=NULL;;

            lpWmiCloseBlock=(void(__stdcall*)(HANDLE))GetProcAddress(hWmiDll,"WmiCloseBlock");

            int (__stdcall *lpWmiOpenBlock)(BYTE*, int, HANDLE*)=NULL;;

            lpWmiOpenBlock=(int(__stdcall*)(BYTE*, int, HANDLE*))GetProcAddress(hWmiDll,"WmiOpenBlock");

            void (__stdcall *lpWmiDevInstToInstanceNameW)(wchar_t*,int,wchar_t*,int)=NULL;

            lpWmiDevInstToInstanceNameW=(void(__stdcall*)(wchar_t*,int,wchar_t*,int))GetProcAddress(hWmiDll,"WmiDevInstToInstanceNameW");

            if (lpWmiOpenBlock && lpWmiCloseBlock && lpWmiDevInstToInstanceNameW && lpWmiQuerySingleInstanceW && lpWmiSetSingleInstanceW)

            {

                  int l=wcslen(hubname);

                  lpWmiDevInstToInstanceNameW(diid,l+8,hubname,0);

                  error_code=lpWmiOpenBlock(guid,0,&h);

                  if (error_code==ERROR_SUCCESS)

                  {

                        int size=0;

                        error_code=lpWmiQuerySingleInstanceW(h,diid,&size,NULL);

                        BYTE* p = new BYTE[size];

                        error_code=lpWmiQuerySingleInstanceW(h,diid,&size,p);

                        BYTE enable=0;

                        error_code=lpWmiSetSingleInstanceW(h,diid,0,1,&enable);

                        error_code=lpWmiQuerySingleInstanceW(h,diid,&size,p);

                        lpWmiCloseBlock(h);

                  }

            }

      }

}

;以下就是TransferCable的inf文件的例子，我将在例子中说明

;---------------------------------------------------------------;
;
; TransferCable.inf
; .inf file for the Windows Easy Transfer Cable.
;
; Copyright (c) Microsoft Corp. 2005
;
;---------------------------------------------------------------;

; ================= Version section =====================

[Version]
Signature="$Windows NT$"
CatalogFile.NT=tfrdrv.cat
Class=Transfer Cable
ClassGUID={BC103702-DD72-406f-9B28-95C868337B59}

;1这个ClassGUID要记住
provider=%MSFT%
DriverVer=12/05/2006,6.0.5707.0

; ================= Class section =====================

[ClassInstall32]
Addreg=CableClassReg    

[CableClassReg]
HKR,,,0,%ClassName%
HKR,,Icon,,-23

; ================= Manufacturer section =====================

[Manufacturer]
%MfgName%=Microsoft,NTx86.5.1,NTamd64.5.2

; ================= Models section =====================

;============Other OS Versions============

[Microsoft]
;
; Don't install on other OS versions
;

;============WinXP - x86============

[Microsoft.NTx86.5.1]
%GenericCableDesc%=TRANSFERCABLE_WINXP_X86,         USB\MS_COMP_TFRCABL     ; Generic Microsoft OS Descriptor
%BelkinCableDesc%=TRANSFERCABLE_WINXP_X86,          USB\VID_050D&PID_258A   ; belkin cable
%BelkinCableDesc%=TRANSFERCABLE_WINXP_X86,          USB\VID_050D&PID_258B   ; belkin cable
%BelkinCableDesc%=TRANSFERCABLE_WINXP_X86,          USB\VID_050D&PID_258C   ; belkin cable
%BelkinCableDesc%=TRANSFERCABLE_WINXP_X86,          USB\VID_050D&PID_258D   ; belkin cable
%ProlificDesc%=TRANSFERCABLE_WINXP_X86,             USB\VID_067B&PID_25A1   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_X86,             USB\VID_067B&PID_25B1   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_X86,             USB\VID_067B&PID_25C1   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_X86,             USB\VID_067B&PID_25D1   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_X86,             USB\VID_067B&PID_25E1   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_X86,             USB\VID_067B&PID_25F1   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_X86,             USB\VID_067B&PID_25A2   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_X86,             USB\VID_067B&PID_25B2   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_X86,             USB\VID_067B&PID_25C2   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_X86,             USB\VID_067B&PID_25D2   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_X86,             USB\VID_067B&PID_25E2   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_X86,             USB\VID_067B&PID_25F2   ; prolific reserved
%BAFODesc%=TRANSFERCABLE_WINXP_X86,                 USB\VID_0576&PID_1254   ; BAFO customers
%BAFODesc%=TRANSFERCABLE_WINXP_X86,                 USB\VID_0576&PID_2795   ; BAFO customers
%BAFODesc%=TRANSFERCABLE_WINXP_X86,                 USB\VID_0576&PID_9828   ; BAFO customers

;============WinXP - amd64============

[Microsoft.NTamd64.5.2]
%GenericCableDesc%=TRANSFERCABLE_WINXP_AMD64,       USB\MS_COMP_TFRCABL     ; Generic Microsoft OS Descriptor
%BelkinCableDesc%=TRANSFERCABLE_WINXP_AMD64,        USB\VID_050D&PID_258A   ; belkin cable
%BelkinCableDesc%=TRANSFERCABLE_WINXP_AMD64,        USB\VID_050D&PID_258B   ; belkin cable
%BelkinCableDesc%=TRANSFERCABLE_WINXP_AMD64,        USB\VID_050D&PID_258C   ; belkin cable
%BelkinCableDesc%=TRANSFERCABLE_WINXP_AMD64,        USB\VID_050D&PID_258D   ; belkin cable
%ProlificDesc%=TRANSFERCABLE_WINXP_AMD64,           USB\VID_067B&PID_25A1   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_AMD64,           USB\VID_067B&PID_25B1   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_AMD64,           USB\VID_067B&PID_25C1   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_AMD64,           USB\VID_067B&PID_25D1   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_AMD64,           USB\VID_067B&PID_25E1   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_AMD64,           USB\VID_067B&PID_25F1   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_AMD64,           USB\VID_067B&PID_25A2   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_AMD64,           USB\VID_067B&PID_25B2   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_AMD64,           USB\VID_067B&PID_25C2   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_AMD64,           USB\VID_067B&PID_25D2   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_AMD64,           USB\VID_067B&PID_25E2   ; prolific reserved
%ProlificDesc%=TRANSFERCABLE_WINXP_AMD64,           USB\VID_067B&PID_25F2   ; prolific reserved
%BAFODesc%=TRANSFERCABLE_WINXP_AMD64,               USB\VID_0576&PID_1254   ; BAFO customers
%BAFODesc%=TRANSFERCABLE_WINXP_AMD64,               USB\VID_0576&PID_2795   ; BAFO customers
%BAFODesc%=TRANSFERCABLE_WINXP_AMD64,               USB\VID_0576&PID_9828   ; BAFO customers

;============ OS-Platform specific install sections =====================

;============WinXP - x86============

[TRANSFERCABLE_WINXP_X86.NT]
CopyFiles=TRANSFER_CABLE.CopyFiles
AddReg=TRANSFER_CABLE.AddReg

[TRANSFERCABLE_WINXP_X86.NT.HW]
AddReg=TRANSFER_CABLE.HW.AddReg

[TRANSFERCABLE_WINXP_X86.NT.Services]
Addservice = winusb, 0x00000002, TRANSFER_CABLE.AddService

[TRANSFERCABLE_WINXP_X86.NT.CoInstallers]
AddReg=TRANSFER_CABLE_CoInstaller_AddReg
CopyFiles= TRANSFER_CABLE_CoInstaller_CopyFiles

[TRANSFERCABLE_WINXP_X86.NT.Wdf]
KmdfService = TRANSFERCABLE_WINXP_X86, TRANSFERCABLE_WINXP_X86_wdfsect

[TRANSFERCABLE_WINXP_X86_wdfsect]
KmdfLibraryVersion = 1.5

;============WinXP - amd64============

[TRANSFERCABLE_WINXP_AMD64.NT]
CopyFiles=TRANSFER_CABLE.CopyFiles
AddReg=TRANSFER_CABLE.AddReg

[TRANSFERCABLE_WINXP_AMD64.NT.HW]
AddReg=TRANSFER_CABLE.HW.AddReg

[TRANSFERCABLE_WINXP_AMD64.NT.Services]
Addservice = winusb, 0x00000002, TRANSFER_CABLE.AddService

[TRANSFERCABLE_WINXP_AMD64.NT.CoInstallers]
AddReg=TRANSFER_CABLE_CoInstaller_AddReg
CopyFiles= TRANSFER_CABLE_CoInstaller_CopyFiles

[TRANSFERCABLE_WINXP_AMD64.NT.Wdf]
KmdfService = TRANSFERCABLE_WINXP_AMD64, TRANSFERCABLE_WINXP_AMD64_wdfsect

[TRANSFERCABLE_WINXP_AMD64_wdfsect]
KmdfLibraryVersion = 1.5

; ======== Generic installation sections =====================

[TRANSFER_CABLE.AddReg]
HKR,,DevLoader,,*ntkern
HKR,,NTMPDriver,,winusb.sys

;这个增加的Path为HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{BC103702-DD72-406F-9B28-95C868337B59}\0000

;这儿就是ClassGUID，而不是增加到下面

[TRANSFER_CABLE.HW.AddReg]
HKR,,DeviceInterfaceGUID,,"{1EB7CB03-60A9-4d28-934F-4ABEEEBD0019}"
HKR,,Label,,%EasyTransferCableName%
HKR,,DeviceHandlers,,"MagicUSBDeviceHandler"
HKR,,Icons,0x00010000,"%windir%\System32\MigAutoplay.exe,0"

;增加到HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\Vid_067b&Pid_25a1\5&35b6bbea&0&4\Device Parameters

;interface symbolink 就要用这个GUID查询

[TRANSFER_CABLE.CopyFiles]

[TRANSFER_CABLE_CoInstaller_CopyFiles]
WinusbCoInstaller.dll
WdfCoInstaller01005.dll

[TRANSFER_CABLE.AddService]
DisplayName    = %WINUSB_SvcDesc%
ServiceType    = 1                  ; SERVICE_KERNEL_DRIVER
StartType      = 3
ErrorControl   = 1                  ; SERVICE_ERROR_NORMAL
ServiceBinary  = %12%\WinUSB.SYS
LoadOrderGroup = Base

[TRANSFER_CABLE_CoInstaller_AddReg]
HKR,,CoInstallers32,0x00010000, "WinusbCoInstaller.dll,CoDeviceInstall", "WdfCoInstaller01005.dll,WdfCoInstaller"

; ================= Source Disks =====================

[SourceDisksNames]
1 = %CD_Description%
[SourceDisksFiles]
WinusbCoInstaller.dll = 1
WdfCoinstaller01005.dll = 1
[SourceDisksFiles.amd64]
WinusbCoInstaller.dll = 1
WdfCoinstaller01005.dll = 1

; ================= Destination Dirs =====================

[DestinationDirs]
DefaultDestDir   = 11

; ================= Strings =====================

[Strings]
EasyTransferCableName   = "Easy Transfer Cable"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "WinUSB Service"
ClassName               = "Transfer Cable Devices"
CD_Description          = "Windows Easy Transfer Cable CD-ROM"
GenericCableDesc        = "USB Easy Transfer Cable"
PrototypeCableDescLink  = "USB Easy Transfer Cable Prototype (Link Mode)"
PrototypeCableDescNet   = "USB Easy Transfer Cable Prototype (Network Mode)"
BelkinCableDesc         = "Belkin USB Easy Transfer Cable"
ProlificDesc            = "USB Easy Transfer Cable"
BAFODesc                = "USB Easy Transfer Cable"

; ar-SA
[Strings.0401]
EasyTransferCableName   = "كبل أداة النقل"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "خدمة WinUSB"
ClassName               = "أجهزة كبلات النقل"
CD_Description          = "محرك الأقراص المضغوطة لكبل 'أداة النقل لـ Windows'"
GenericCableDesc        = "كبل USB Easy Transfer"
PrototypeCableDescLink  = "بروتوكول كبل USB Easy Transfer (وضع الارتباط)"
PrototypeCableDescNet   = "بروتوكول كبل USB Easy Transfer (وضع الشبكة)"
BelkinCableDesc         = "كبل Belkin USB Easy Transfer"
ProlificDesc            = "كبل USB Easy Transfer"
BAFODesc                = "كبل USB Easy Transfer"

; cs-CZ
[Strings.0405]
EasyTransferCableName   = "Easy Transfer Cable"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "Služba WinUSB"
ClassName               = "Kabelová zařízení pro přenos"
CD_Description          = "Kabel a disk CD-ROM nástroje Migrace profilu uživatele"
GenericCableDesc        = "Kabel USB nástroje Migrace profilu uživatele"
PrototypeCableDescLink  = "Prototyp kabelu USB nástroje Migrace profilu uživatele (režim linky)"
PrototypeCableDescNet   = "Prototyp kabelu USB nástroje Migrace profilu uživatele (režim sítě)"
BelkinCableDesc         = "Kabel Belkin USB nástroje Migrace profilu uživatele"
ProlificDesc            = "Kabel USB nástroje Migrace profilu uživatele"
BAFODesc                = "Kabel USB nástroje Migrace profilu uživatele"

; da-DK
[Strings.0406]
EasyTransferCableName   = "Easy Transfer Cable"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "WinUSB-tjeneste"
ClassName               = "Overførselskabelenheder"
CD_Description          = "Windows Overførsel Kabel cd-rom"
GenericCableDesc        = "USB-kabel til Windows Overførsel"
PrototypeCableDescLink  = "Overførsel med USB-kabelprototype (Linktilstand)"
PrototypeCableDescNet   = "Overførsel med USB-kabelprototype (Netværkstilstand)"
BelkinCableDesc         = "Overførsel med Belkin USB-kabel"
ProlificDesc            = "USB-kabel til Windows Overførsel"
BAFODesc                = "USB-kabel til Windows Overførsel"

; de-DE
[Strings.0407]
EasyTransferCableName   = "EasyTransfer-Kabel"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "WinUSB-Dienst"
ClassName               = "Transferkabelgeräte"
CD_Description          = "Windows-EasyTransfer-Kabel-CD-ROM"
GenericCableDesc        = "USB-EasyTransfer-Kabel"
PrototypeCableDescLink  = "Prototyp für USB-EasyTransfer-Kabel (Verbindungsmodus)"
PrototypeCableDescNet   = "Prototyp für USB-EasyTransfer-Kabel (Netzwerkmodus)"
BelkinCableDesc         = "Belkin USB-EasyTransfer-Kabel"
ProlificDesc            = "USB-EasyTransfer-Kabel"
BAFODesc                = "USB-EasyTransfer-Kabel"

; el-GR
[Strings.0408]
EasyTransferCableName   = "Καλώδιο εύκολης μεταφοράς"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "Υπηρεσία WinUSB"
ClassName               = "Συσκευές καλωδίων μεταφοράς"
CD_Description          = "CD-ROM καλωδίου εύκολης μεταφοράς των Windows"
GenericCableDesc        = "USB καλώδιο εύκολης μεταφοράς"
PrototypeCableDescLink  = "Πρωτότυπο USB καλωδίου εύκολης μεταφοράς (Λειτουργία σύνδεσης)"
PrototypeCableDescNet   = "Πρωτότυπο USB καλωδίου εύκολης μεταφοράς (Λειτουργία δικτύου)"
BelkinCableDesc         = "USB καλώδιο εύκολης μεταφοράς της Belkin"
ProlificDesc            = "USB καλώδιο εύκολης μεταφοράς"
BAFODesc                = "USB καλώδιο εύκολης μεταφοράς"

; en-US
[Strings.0409]
EasyTransferCableName   = "Easy Transfer Cable"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "WinUSB Service"
ClassName               = "Transfer Cable Devices"
CD_Description          = "Windows Easy Transfer Cable CD-ROM"
GenericCableDesc        = "USB Easy Transfer Cable"
PrototypeCableDescLink  = "USB Easy Transfer Cable Prototype (Link Mode)"
PrototypeCableDescNet   = "USB Easy Transfer Cable Prototype (Network Mode)"
BelkinCableDesc         = "Belkin USB Easy Transfer Cable"
ProlificDesc            = "USB Easy Transfer Cable"
BAFODesc                = "USB Easy Transfer Cable"

; es-ES
[Strings.0C0A]
EasyTransferCableName   = "Cable de Easy Transfer"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "Servicio WinUSB"
ClassName               = "Dispositivos de cable para transferir"
CD_Description          = "CD-ROM de cable de Windows Easy Transfer"
GenericCableDesc        = "Cable USB de Easy Transfer"
PrototypeCableDescLink  = "Prototipo de cable USB de Easy Transfer (modo de vínculo)"
PrototypeCableDescNet   = "Prototipo de cable USB de Easy Transfer (modo de red)"
BelkinCableDesc         = "Cable USB de Easy Transfer de Belkin"
ProlificDesc            = "Cable USB de Easy Transfer"
BAFODesc                = "Cable USB de Easy Transfer"

; fi-FI
[Strings.040B]
EasyTransferCableName   = "Easy Transfer Cable"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "WinUSB-palvelu"
ClassName               = "Siirtokaapelilaitteet"
CD_Description          = "Windowsin asetusten siirtämisen kaapelin CD-levy"
GenericCableDesc        = "Asetusten siirtämisen USB-kaapeli"
PrototypeCableDescLink  = "Asetustsen siirtämisen USB-kaapelin prototyyppi (linkkitila)"
PrototypeCableDescNet   = "Asetusten siirtämisen USB-kaapelin prototyyppi (verkkotila)"
BelkinCableDesc         = "Belkinin asetusten siirtämisen USB-kaapeli"
ProlificDesc            = "Asetusten siirtämisen USB-kaapeli"
BAFODesc                = "Asetusten siirtämisen USB-kaapeli"

; fr-FR
[Strings.040C]
EasyTransferCableName   = "Câble de transfert de fichiers et paramètres"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "Service WinUSB"
ClassName               = "Périphériques pour le câble de transfert de fichiers et paramètres"
CD_Description          = "CD-ROM du câble de transfert de fichiers et paramètres Windows"
GenericCableDesc        = "Câble de transfert de fichiers et paramètres USB"
PrototypeCableDescLink  = "Prototype de câble de transfert de fichiers et paramètres USB (Mode liaison)"
PrototypeCableDescNet   = "Prototype de câble de transfert de fichiers et paramètres USB (Mode réseau)"
BelkinCableDesc         = "Câble de transfert de fichiers et paramètres USB Belkin"
ProlificDesc            = "Câble de transfert de fichiers et paramètres USB"
BAFODesc                = "Câble de transfert de fichiers et paramètres USB"

; he-IL
[Strings.040D]
EasyTransferCableName   = "כבל העברה קלה"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "שירות WinUSB"
ClassName               = "התקני כבל העברה"
CD_Description          = "תקליטור של כבל העברה קלה ב- Windows"
GenericCableDesc        = "כבל העברה קלה מסוג USB"
PrototypeCableDescLink  = "אב טיפוס של כבל העברה קלה מסוג USB (מצב קישור)"
PrototypeCableDescNet   = "אב טיפוס של כבל העברה קלה מסוג USB (מצב רשת)"
BelkinCableDesc         = "כבל העברה קלה מסוג Belkin USB"
ProlificDesc            = "כבל העברה קלה מסוג USB"
BAFODesc                = "כבל העברה קלה מסוג USB"

; it-IT
[Strings.0410]
EasyTransferCableName   = "Cavo per Trasferimento dati Windows"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "Servizio WinUSB"
ClassName               = "Dispositivi con cavo utilizzati per il trasferimento"
CD_Description          = "CD-ROM cavo per Trasferimento dati Windows"
GenericCableDesc        = "Cavo USB per Trasferimento dati Windows"
PrototypeCableDescLink  = "Prototipo cavo USB per Trasferimento dati Windows (modalità collegamento)"
PrototypeCableDescNet   = "Prototipo cavo USB per Trasferimento dati Windows (modalità rete)"
BelkinCableDesc         = "Cavo Belkin USB per Trasferimento dati Windows"
ProlificDesc            = "Cavo USB per Trasferimento dati Windows"
BAFODesc                = "Cavo USB per Trasferimento dati Windows"

; ja-JP
[Strings.0411]
; localizable
EasyTransferCableName   = "簡易転送ケーブル"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "WinUSB サービス"
ClassName               = "転送ケーブル デバイス"
CD_Description          = "Windows 簡易転送ケーブル CD-ROM"

GenericCableDesc        = "USB 簡易転送ケーブル"
BelkinCableDesc         = "Belkin USB 簡易転送ケーブル"
ProlificDesc            = "USB 簡易転送ケーブル"
BAFODesc                = "USB 簡易転送ケーブル"

; ko-KR
[Strings.0412]
EasyTransferCableName   = "사용자 환경 전송 케이블"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "WinUSB 서비스"
ClassName               = "전송 케이블 장치"
CD_Description          = "Windows 사용자 환경 전송 케이블 CD-ROM"
GenericCableDesc        = "USB 사용자 환경 전송 케이블"
PrototypeCableDescLink  = "USB 사용자 환경 전송 케이블 프로토타입(링크 모드)"
PrototypeCableDescNet   = "USB 사용자 환경 전송 케이블 프로토타입(네트워크 모드)"
BelkinCableDesc         = "Belkin USB 사용자 환경 전송 케이블"
ProlificDesc            = "USB 사용자 환경 전송 케이블"
BAFODesc                = "USB 사용자 환경 전송 케이블"

; nl-NL
[Strings.0413]
EasyTransferCableName   = "Easy Transfer-kabel"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "WinUSB-service"
ClassName               = "Transferkabelapparaten"
CD_Description          = "Cd-rom voor Windows Easy Transfer-kabel"
GenericCableDesc        = "USB Easy Transfer-kabel"
PrototypeCableDescLink  = "Prototype van USB Easy Transfer-kabel (Verbindingsmodus)"
PrototypeCableDescNet   = "Prototype van USB Easy Transfer-kabel (Netwerkmodus)"
BelkinCableDesc         = "Belkin USB Easy Transfer-kabel"
ProlificDesc            = "USB Easy Transfer-kabel"
BAFODesc                = "USB Easy Transfer-kabel"

; zh-CN
[Strings.0804]
EasyTransferCableName   = "轻松传送电缆"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "WinUSB 服务"
ClassName               = "传输电缆设备"
CD_Description          = "Windows 轻松传送电缆 CD-ROM"
GenericCableDesc        = "USB 轻松传送电缆"
PrototypeCableDescLink  = "USB 轻松传送电缆原型(链接模式)"
PrototypeCableDescNet   = "USB 轻松传送电缆原型(网络模式)"
BelkinCableDesc         = "Belkin USB 轻松传送电缆"
ProlificDesc            = "USB 轻松传送电缆"
BAFODesc                = "USB 轻松传送电缆"

; zh-TW
[Strings.0404]
EasyTransferCableName   = "輕鬆傳輸纜線"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "WinUSB 服務"
ClassName               = "轉送纜線裝置"
CD_Description          = "Windows 輕鬆傳輸纜線 CD-ROM"
GenericCableDesc        = "USB 輕鬆傳輸纜線"
PrototypeCableDescLink  = "USB 輕鬆傳輸纜線原型 (連結模式)"
PrototypeCableDescNet   = "USB 輕鬆傳輸纜線原型 (網路模式)"
BelkinCableDesc         = "Belkin USB 輕鬆傳輸纜線"
ProlificDesc            = "USB 輕鬆傳輸纜線"
BAFODesc                = "USB 輕鬆傳輸纜線"

; pt-BR
[Strings.0416]
EasyTransferCableName   = "Cabo da Transferência Fácil"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "Serviço WinUSB"
ClassName               = "Dispositivos de Cabo de Transferência"
CD_Description          = "CD-ROM do Cabo da Transferência Fácil do Windows"
GenericCableDesc        = "Cabo de Transferência Fácil USB"
BelkinCableDesc         = "Cabo de Transferência Fácil Belkin USB"
ProlificDesc            = "Cabo de Transferência Fácil USB"
BAFODesc                = "Cabo de Transferência Fácil USB"

; ru-RU
[Strings.0419]
EasyTransferCableName   = "Кабель средства переноса"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "Служба WinUSB"
ClassName               = "Устройства для кабеля средства переноса"
CD_Description          = "CD-ROM кабеля средства переноса Windows"
GenericCableDesc        = "USB-кабель средства переноса"
BelkinCableDesc         = "Belkin USB-кабель средства переноса"
ProlificDesc            = "USB-кабель средства переноса"
BAFODesc                = "USB-кабель средства переноса"

; nb-NO
[Strings.0414]
EasyTransferCableName   = "Kabel for Enkel overføring"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "WinUSB Service"
ClassName               = "Overføringskabelenheter"
CD_Description          = "CD-ROM for Kabel for Windows Enkel overføring"
GenericCableDesc        = "USB-kabel for Enkel overføring"
BelkinCableDesc         = "Belkin USB-kabel for Enkel overføring"
ProlificDesc            = "USB-kabel for Enkel overføring"
BAFODesc                = "USB-kabel for Enkel overføring"

; sv-SE
[Strings.041D]
EasyTransferCableName   = "Filöverföringskabel"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "WinUSB Service"
ClassName               = "Överföringskablar"
CD_Description          = "CD-ROM för Windows Filöverföringskabel"
GenericCableDesc        = "USB-filöverföringskabel"
BelkinCableDesc         = "Belkin USB-filöverföringskabel"
ProlificDesc            = "USB-filöverföringskabel"
BAFODesc                = "USB-filöverföringskabel"

; pl-PL
[Strings.0415]
EasyTransferCableName   = "Kabel łatwego transferu"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "Usługa WinUSB"
ClassName               = "Urządzenia transferu kablowego"
CD_Description          = "Dysk CD-ROM kabla łatwego transferu w systemie Windows"
GenericCableDesc        = "Kabel łatwego transferu USB"
BelkinCableDesc         = "Kabel łatwego transferu USB Belkin"
ProlificDesc            = "Kabel łatwego transferu USB"
BAFODesc                = "Kabel łatwego transferu USB"

; pt-PT
[Strings.0816]
EasyTransferCableName   = "Cabo de Transferência Fácil"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "Serviço WinUSB"
ClassName               = "Dispositivos de Cabo para Transferência"
CD_Description          = "CD-ROM do Cabo de Transferência Fácil do Windows"
GenericCableDesc        = "Cabo de Transferência Fácil USB"
BelkinCableDesc         = "Cabo de Transferência Fácil USB Belkin"
ProlificDesc            = "Cabo de Transferência Fácil USB"
BAFODesc                = "Cabo de Transferência Fácil USB"

; tr-TR
[Strings.041F]
EasyTransferCableName   = "Kolay Aktarım Kablosu"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "WinUSB Hizmeti"
ClassName               = "Aktarım Kablosu Aygıtları"
CD_Description          = "Windows Kolay Aktarım Kablosu CD-ROM'u"
GenericCableDesc        = "USB Kolay Aktarım Kablosu"
BelkinCableDesc         = "Belkin USB Kolay Aktarım Tablosu"
ProlificDesc            = "USB Kolay Aktarım Kablosu"
BAFODesc                = "USB Kolay Aktarım Kablosu"

; hu-HU
[Strings.040E]
EasyTransferCableName   = "Áttelepítő kábel"
MSFT                    = "Microsoft"
MfgName                 = "Microsoft"
WINUSB_SvcDesc          = "WinUSB szolgáltatás"
ClassName               = "Átviteli kábeleszközök"
CD_Description          = "Windows áttelepítő kábel CD-ROM"
GenericCableDesc        = "USB áttelepítő kábel"
BelkinCableDesc         = "Belkin USB áttelepítő kábel"
ProlificDesc            = "USB áttelepítő kábel"
BAFODesc                = "USB áttelepítő kábel"

#define IO_METHOD_FROM_CTL_CODE(ctlCode) (ctlCode&0x00000003)

static VOID
GetUserBuffers(
    IN PIRP Irp,
    IN ULONG IoControlCode,
    OUT PVOID* BufferIn,
    OUT PVOID* BufferOut)
{
    ASSERT(Irp);
    ASSERT(BufferIn);
    ASSERT(BufferOut);

    switch (IO_METHOD_FROM_CTL_CODE(IoControlCode))
    {
        case METHOD_BUFFERED:
            *BufferIn = *BufferOut = Irp->AssociatedIrp.SystemBuffer;
            break;
        case METHOD_IN_DIRECT:
        case METHOD_OUT_DIRECT:
            *BufferIn = Irp->AssociatedIrp.SystemBuffer;
            *BufferOut = MmGetSystemAddressForMdl(Irp->MdlAddress);
            break;
        case METHOD_NEITHER:
            *BufferIn = IoGetCurrentIrpStackLocation(Irp)->Parameters.DeviceIoControl.Type3InputBuffer;
            *BufferOut = Irp->UserBuffer;
            break;
        default:
            /* Should never happen */
            *BufferIn = NULL;
            *BufferOut = NULL;
            break;
    }
}

// APIHook.h: interface for the CAPIHook class.
//
//////////////////////////////////////////////////////////////////////

#if !defined(AFX_APIHOOK_H__C666B57C_5812_4793_9CE5_AB0648974B81__INCLUDED_)
#define AFX_APIHOOK_H__C666B57C_5812_4793_9CE5_AB0648974B81__INCLUDED_

#if _MSC_VER > 1000
#pragma once
#endif // _MSC_VER > 1000

class CAPIHook 
{
public:
   // Hook a function in all modules
   CAPIHook(PSTR pszCalleeModName, PSTR pszFuncName, PROC pfnHook,
      BOOL fExcludeAPIHookMod);

   // Unhook a function from all modules
   ~CAPIHook();

   // Returns the original address of the hooked function
   operator PROC() { return(m_pfnOrig); }

public:
    void ReplaceAPIAddress();
   // Calls the real GetProcAddress
   static FARPROC WINAPI GetProcAddressRaw(HMODULE hmod, PCSTR pszProcName);

private:
   static PVOID sm_pvMaxAppAddr; // Maximum private memory address
   static CAPIHook* sm_pHead;    // Address of first object
   CAPIHook* m_pNext;            // Address of next  object

   PCSTR m_pszCalleeModName;     // Module containing the function (ANSI)
   PCSTR m_pszFuncName;          // Function name in callee (ANSI)
   PROC  m_pfnOrig;              // Original function address in callee
   PROC  m_pfnHook;              // Hook function address
   BOOL  m_fExcludeAPIHookMod;   // Hook module w/CAPIHook implementation?

private:
   // Replaces a symbol's address in a module's import section
   static void WINAPI ReplaceIATEntryInAllMods(PCSTR pszCalleeModName,
      PROC pfnOrig, PROC pfnHook, BOOL fExcludeAPIHookMod);

   // Replaces a symbol's address in all module's import sections
   static void WINAPI ReplaceIATEntryInOneMod(PCSTR pszCalleeModName,
      PROC pfnOrig, PROC pfnHook, HMODULE hmodCaller);

private:
   // Used when a DLL is newly loaded after hooking a function
   static void    WINAPI FixupNewlyLoadedModule(HMODULE hmod, DWORD dwFlags);

   // Used to trap when DLLs are newly loaded
   static HMODULE WINAPI LoadLibraryA(PCSTR  pszModulePath);
   static HMODULE WINAPI LoadLibraryW(PCWSTR pszModulePath);
   static HMODULE WINAPI LoadLibraryExA(PCSTR  pszModulePath,
      HANDLE hFile, DWORD dwFlags);
   static HMODULE WINAPI LoadLibraryExW(PCWSTR pszModulePath,
      HANDLE hFile, DWORD dwFlags);

   // Returns address of replacement function if hooked function is requested
   static FARPROC WINAPI GetProcAddress(HMODULE hmod, PCSTR pszProcName);

private:
   // Instantiates hooks on these functions
    /*
   static CAPIHook sm_LoadLibraryA;
   static CAPIHook sm_LoadLibraryW;
   static CAPIHook sm_LoadLibraryExA;
   static CAPIHook sm_LoadLibraryExW;
   static CAPIHook sm_GetProcAddress;
   */
};

#endif // !defined(AFX_APIHOOK_H__C666B57C_5812_4793_9CE5_AB0648974B81__INCLUDED_)

// APIHook.cpp: implementation of the CAPIHook class.
//
//////////////////////////////////////////////////////////////////////

#include "stdafx.h"
#include "dllRecAnyCall.h"
#include "APIHook.h"

#include "Toolhelp.h"
#include <ImageHlp.h>
#pragma comment(lib, "ImageHlp")

#ifdef _DEBUG
#undef THIS_FILE
static char THIS_FILE[]=__FILE__;
#define new DEBUG_NEW
#endif

CString hwGetModuleBaseName();
///////////////////////////////////////////////////////////////////////////////

// When an application runs on Windows 98 under a debugger, the debugger
// makes the module's import section point to a stub that calls the desired
// function. To account for this, the code in this module must do some crazy
// stuff. These variables are needed to help with the crazy stuff.

// The highest private memory address (used for Windows 98 only)
PVOID CAPIHook::sm_pvMaxAppAddr = NULL;
const BYTE cPushOpCode = 0x68;   // The PUSH opcode on x86 platforms

///////////////////////////////////////////////////////////////////////////////

// The head of the linked-list of CAPIHook objects
CAPIHook* CAPIHook::sm_pHead = NULL;

///////////////////////////////////////////////////////////////////////////////

CAPIHook::CAPIHook (
        PSTR pszCalleeModName,
        PSTR pszFuncName,
        PROC pfnHook,
        BOOL fExcludeAPIHookMod
    )
{
    HwDbgLog ( L_VERBOSE, "CAPIHook() : [%s] - %s - %s",hwGetModuleBaseName(), pszCalleeModName, pszFuncName );
    if (sm_pvMaxAppAddr == NULL)
    {
        // Functions with address above lpMaximumApplicationAddress require
        // special processing (Windows 98 only)
        SYSTEM_INFO si;
        GetSystemInfo(&si);
        sm_pvMaxAppAddr = si.lpMaximumApplicationAddress;
    }
    m_pNext  = sm_pHead;    // The next node was at the head
    sm_pHead = this;        // This node is now at the head
    // Save information about this hooked function
    m_pszCalleeModName   = pszCalleeModName;
    m_pszFuncName        = pszFuncName;
    m_pfnHook            = pfnHook;
    m_fExcludeAPIHookMod = fExcludeAPIHookMod;
    m_pfnOrig            = GetProcAddressRaw(
        GetModuleHandleA(pszCalleeModName), m_pszFuncName);
    chASSERT(m_pfnOrig != NULL);  // Function doesn't exist
    if (m_pfnOrig > sm_pvMaxAppAddr)
    {
        // The address is in a shared DLL; the address needs fixing up
        PBYTE pb = (PBYTE) m_pfnOrig;
        if (pb[0] == cPushOpCode)
        {
            // Skip over the PUSH op code and grab the real address
            PVOID pv = * (PVOID*) &pb[1];
            m_pfnOrig = (PROC) pv;
        }
    }

    ReplaceAPIAddress ();
}

//
// Hook this function in all currently loaded modules
//
void CAPIHook::ReplaceAPIAddress()
{
    ReplaceIATEntryInAllMods(m_pszCalleeModName, m_pfnOrig, m_pfnHook,
        m_fExcludeAPIHookMod);
}

///////////////////////////////////////////////////////////////////////////////

CAPIHook::~CAPIHook()
{
    HwDbgLog ( L_VERBOSE, "~CAPIHook() : [%s] - %s - %s",hwGetModuleBaseName(), m_pszCalleeModName, m_pszFuncName );
    // Unhook this function from all modules
    ReplaceIATEntryInAllMods(m_pszCalleeModName, m_pfnHook, m_pfnOrig,
        m_fExcludeAPIHookMod);
    // Remove this object from the linked list
    CAPIHook* p = sm_pHead;
    if (p == this) {     // Removing the head node
        sm_pHead = p->m_pNext;
    } else {
        BOOL fFound = FALSE;
        // Walk list from head and fix pointers
        for (; !fFound && (p->m_pNext != NULL); p = p->m_pNext) {
            if (p->m_pNext == this) {
                // Make the node that points to us point to the our next node
                p->m_pNext = p->m_pNext->m_pNext;
                break;
            }
        }
        chASSERT(fFound);
    }
}

///////////////////////////////////////////////////////////////////////////////

// NOTE: This function must NOT be inlined
FARPROC CAPIHook::GetProcAddressRaw(HMODULE hmod, PCSTR pszProcName)
{
    return(::GetProcAddress(hmod, pszProcName));
}

///////////////////////////////////////////////////////////////////////////////

// Returns the HMODULE that contains the specified memory address
static HMODULE ModuleFromAddress(PVOID pv)
{
    MEMORY_BASIC_INFORMATION mbi;
    return((VirtualQuery(pv, &mbi, sizeof(mbi)) != 0)
        ? (HMODULE) mbi.AllocationBase : NULL);
}

///////////////////////////////////////////////////////////////////////////////

void CAPIHook::ReplaceIATEntryInAllMods (
        PCSTR pszCalleeModName,
        PROC pfnCurrent,
        PROC pfnNew,
        BOOL fExcludeAPIHookMod
    )
{
    HMODULE hmodThisMod = fExcludeAPIHookMod
        ? ModuleFromAddress(ReplaceIATEntryInAllMods) : NULL;
    // Get the list of modules in this process
    CToolhelp th(TH32CS_SNAPMODULE, GetCurrentProcessId());
    MODULEENTRY32 me = { sizeof(me) };
    for (BOOL fOk = th.ModuleFirst(&me); fOk; fOk = th.ModuleNext(&me))
    {
        // NOTE: We don't hook functions in our own module
        if (me.hModule != hmodThisMod)
        {
            // Hook this function in this module
            ReplaceIATEntryInOneMod (
                pszCalleeModName, pfnCurrent, pfnNew, me.hModule);
        }
    }
}

///////////////////////////////////////////////////////////////////////////////

void CAPIHook::ReplaceIATEntryInOneMod(PCSTR pszCalleeModName,
                                       PROC pfnCurrent, PROC pfnNew, HMODULE hmodCaller) {
    // Get the address of the module's import section
    ULONG ulSize;
    PIMAGE_IMPORT_DESCRIPTOR pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)
        ImageDirectoryEntryToData(hmodCaller, TRUE,
        IMAGE_DIRECTORY_ENTRY_IMPORT, &ulSize);
    if (pImportDesc == NULL)
        return;  // This module has no import section
    // Find the import descriptor containing references to callee's functions
    for (; pImportDesc->Name; pImportDesc++) {
        PSTR pszModName = (PSTR) ((PBYTE) hmodCaller + pImportDesc->Name);
        if (lstrcmpiA(pszModName, pszCalleeModName) == 0)
            break;   // Found
    }
    if (pImportDesc->Name == 0)
        return;  // This module doesn't import any functions from this callee
    // Get caller's import address table (IAT) for the callee's functions
    PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)
        ((PBYTE) hmodCaller + pImportDesc->FirstThunk);
    // Replace current function address with new function address
    for (; pThunk->u1.Function; pThunk++) {
        // Get the address of the function address
        PROC* ppfn = (PROC*) &pThunk->u1.Function;
        // Is this the function we're looking for?
        BOOL fFound = (*ppfn == pfnCurrent);
        if (!fFound && (*ppfn > sm_pvMaxAppAddr)) {
            // If this is not the function and the address is in a shared DLL,
            // then maybe we're running under a debugger on Windows 98. In this
            // case, this address points to an instruction that may have the
            // correct address.
            PBYTE pbInFunc = (PBYTE) *ppfn;
            if (pbInFunc[0] == cPushOpCode) {
                // We see the PUSH instruction, the real function address follows
                ppfn = (PROC*) &pbInFunc[1];
                // Is this the function we're looking for?
                fFound = (*ppfn == pfnCurrent);
            }
        }
        if (fFound) {
            // The addresses match, change the import section address
            WriteProcessMemory(GetCurrentProcess(), ppfn, &pfnNew,
                sizeof(pfnNew), NULL);
            return;  // We did it, get out
        }
    }
    // If we get to here, the function is not in the caller's import section
}

///////////////////////////////////////////////////////////////////////////////

// Hook LoadLibrary functions and GetProcAddress so that hooked functions
// are handled correctly if these functions are called.
/*
CAPIHook CAPIHook::sm_LoadLibraryA  ("Kernel32.dll", "LoadLibraryA",  
                                     (PROC) CAPIHook::LoadLibraryA, TRUE);

CAPIHook CAPIHook::sm_LoadLibraryW  ("Kernel32.dll", "LoadLibraryW",  
                                     (PROC) CAPIHook::LoadLibraryW, TRUE);

CAPIHook CAPIHook::sm_LoadLibraryExA("Kernel32.dll", "LoadLibraryExA",
                                     (PROC) CAPIHook::LoadLibraryExA, TRUE);

CAPIHook CAPIHook::sm_LoadLibraryExW("Kernel32.dll", "LoadLibraryExW",
                                     (PROC) CAPIHook::LoadLibraryExW, TRUE);

CAPIHook CAPIHook::sm_GetProcAddress("Kernel32.dll", "GetProcAddress",
                                     (PROC) CAPIHook::GetProcAddress, TRUE);
*/

///////////////////////////////////////////////////////////////////////////////

void CAPIHook::FixupNewlyLoadedModule(HMODULE hmod, DWORD dwFlags) {
    // If a new module is loaded, hook the hooked functions
    if ((hmod != NULL) && ((dwFlags & LOAD_LIBRARY_AS_DATAFILE) == 0)) {
        for (CAPIHook* p = sm_pHead; p != NULL; p = p->m_pNext) {
            ReplaceIATEntryInOneMod(p->m_pszCalleeModName,
                p->m_pfnOrig, p->m_pfnHook, hmod);
        }
    }
}

///////////////////////////////////////////////////////////////////////////////

HMODULE WINAPI CAPIHook::LoadLibraryA(PCSTR pszModulePath) {
    HMODULE hmod = ::LoadLibraryA(pszModulePath);
    FixupNewlyLoadedModule(hmod, 0);
    return(hmod);
}

///////////////////////////////////////////////////////////////////////////////

HMODULE WINAPI CAPIHook::LoadLibraryW(PCWSTR pszModulePath) {
    HMODULE hmod = ::LoadLibraryW(pszModulePath);
    FixupNewlyLoadedModule(hmod, 0);
    return(hmod);
}

///////////////////////////////////////////////////////////////////////////////

HMODULE WINAPI CAPIHook::LoadLibraryExA(PCSTR pszModulePath,
                                        HANDLE hFile, DWORD dwFlags) {
    HMODULE hmod = ::LoadLibraryExA(pszModulePath, hFile, dwFlags);
    FixupNewlyLoadedModule(hmod, dwFlags);
    return(hmod);
}

///////////////////////////////////////////////////////////////////////////////

HMODULE WINAPI CAPIHook::LoadLibraryExW(PCWSTR pszModulePath,
                                        HANDLE hFile, DWORD dwFlags)
{
    HMODULE hmod = ::LoadLibraryExW(pszModulePath, hFile, dwFlags);
    FixupNewlyLoadedModule(hmod, dwFlags);
    return(hmod);
}

///////////////////////////////////////////////////////////////////////////////

FARPROC WINAPI CAPIHook::GetProcAddress(HMODULE hmod, PCSTR pszProcName) {
    // Get the true address of the function
    FARPROC pfn = GetProcAddressRaw(hmod, pszProcName);
    // Is it one of the functions that we want hooked?
    CAPIHook* p = sm_pHead;
    for (; (pfn != NULL) && (p != NULL); p = p->m_pNext) {
        if (pfn == p->m_pfnOrig) {
            // The address to return matches an address we want to hook
            // Return the hook function address instead
            pfn = p->m_pfnHook;
            break;
        }
    }
    return(pfn);
}

//////////////////////////////// End of File //////////////////////////////////

/******************************************************************************
Module:  Toolhelp.h
Notices: Copyright (c) 2000 Jeffrey Richter
******************************************************************************/

#pragma once

///////////////////////////////////////////////////////////////////////////////

#include "CmnHdr.h"     /* See Appendix A. */
#include <tlhelp32.h>
#include <tchar.h>

///////////////////////////////////////////////////////////////////////////////

class CToolhelp {
private:
   HANDLE m_hSnapshot;

public:
   CToolhelp(DWORD dwFlags = 0, DWORD dwProcessID = 0);
   ~CToolhelp();

   BOOL CreateSnapshot(DWORD dwFlags, DWORD dwProcessID = 0);
   BOOL ProcessFirst(PPROCESSENTRY32 ppe) const;
   BOOL ProcessNext(PPROCESSENTRY32 ppe) const;
   BOOL ProcessFind(DWORD dwProcessId, PPROCESSENTRY32 ppe) const;

   BOOL ModuleFirst(PMODULEENTRY32 pme) const;
   BOOL ModuleNext(PMODULEENTRY32 pme) const;
   BOOL ModuleFind(PVOID pvBaseAddr, PMODULEENTRY32 pme) const;
   BOOL ModuleFind(PTSTR pszModName, PMODULEENTRY32 pme) const;
   BOOL ThreadFirst(PTHREADENTRY32 pte) const;
   BOOL ThreadNext(PTHREADENTRY32 pte) const;
   BOOL HeapListFirst(PHEAPLIST32 phl) const;
   BOOL HeapListNext(PHEAPLIST32 phl) const;
   int  HowManyHeaps() const;

   // Note: The heap block functions do not reference a snapshot and
   // just walk the process's heap from the beginning each time. Infinite
   // loops can occur if the target process changes its heap while the
   // functions below are enumerating the blocks in the heap.
   BOOL HeapFirst(PHEAPENTRY32 phe, DWORD dwProcessID,
      UINT_PTR dwHeapID) const;
   BOOL HeapNext(PHEAPENTRY32 phe) const;
   int  HowManyBlocksInHeap(DWORD dwProcessID, DWORD dwHeapId) const;
   BOOL IsAHeap(HANDLE hProcess, PVOID pvBlock, PDWORD pdwFlags) const;

public:
   static BOOL EnableDebugPrivilege(BOOL fEnable = TRUE);
   static BOOL ReadProcessMemory(DWORD dwProcessID, LPCVOID pvBaseAddress,
      PVOID pvBuffer, DWORD cbRead, PDWORD pdwNumberOfBytesRead = NULL);
};

///////////////////////////////////////////////////////////////////////////////

inline CToolhelp::CToolhelp(DWORD dwFlags, DWORD dwProcessID) {

   m_hSnapshot = INVALID_HANDLE_VALUE;
   CreateSnapshot(dwFlags, dwProcessID);
}

///////////////////////////////////////////////////////////////////////////////

inline CToolhelp::~CToolhelp() {

   if (m_hSnapshot != INVALID_HANDLE_VALUE)
      CloseHandle(m_hSnapshot);
}

///////////////////////////////////////////////////////////////////////////////

inline CToolhelp::CreateSnapshot(DWORD dwFlags, DWORD dwProcessID) {

   if (m_hSnapshot != INVALID_HANDLE_VALUE)
      CloseHandle(m_hSnapshot);

   if (dwFlags == 0) {
      m_hSnapshot = INVALID_HANDLE_VALUE;
   } else {
      m_hSnapshot = CreateToolhelp32Snapshot(dwFlags, dwProcessID);
   }
   return(m_hSnapshot != INVALID_HANDLE_VALUE);
}

///////////////////////////////////////////////////////////////////////////////

inline BOOL CToolhelp::EnableDebugPrivilege(BOOL fEnable) {

   // Enabling the debug privilege allows the application to see
   // information about service applications
   BOOL fOk = FALSE;    // Assume function fails
   HANDLE hToken;

   // Try to open this process's access token
   if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES,
      &hToken)) {

      // Attempt to modify the "Debug" privilege
      TOKEN_PRIVILEGES tp;
      tp.PrivilegeCount = 1;
      LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);
      tp.Privileges[0].Attributes = fEnable ? SE_PRIVILEGE_ENABLED : 0;
      AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);
      fOk = (GetLastError() == ERROR_SUCCESS);
      CloseHandle(hToken);
   }
   return(fOk);
}

///////////////////////////////////////////////////////////////////////////////

inline BOOL CToolhelp::ReadProcessMemory(DWORD dwProcessID,
   LPCVOID pvBaseAddress, PVOID pvBuffer, DWORD cbRead,
   PDWORD pdwNumberOfBytesRead) {

   return(Toolhelp32ReadProcessMemory(dwProcessID, pvBaseAddress, pvBuffer,
      cbRead, pdwNumberOfBytesRead));
}

///////////////////////////////////////////////////////////////////////////////

inline BOOL CToolhelp::ProcessFirst(PPROCESSENTRY32 ppe) const {

   BOOL fOk = Process32First(m_hSnapshot, ppe);
   if (fOk && (ppe->th32ProcessID == 0))
      fOk = ProcessNext(ppe); // Remove the "[System Process]" (PID = 0)
   return(fOk);
}

inline BOOL CToolhelp::ProcessNext(PPROCESSENTRY32 ppe) const {

   BOOL fOk = Process32Next(m_hSnapshot, ppe);
   if (fOk && (ppe->th32ProcessID == 0))
      fOk = ProcessNext(ppe); // Remove the "[System Process]" (PID = 0)
   return(fOk);
}

inline BOOL CToolhelp::ProcessFind(DWORD dwProcessId, PPROCESSENTRY32 ppe)
   const {

   BOOL fFound = FALSE;
   for (BOOL fOk = ProcessFirst(ppe); fOk; fOk = ProcessNext(ppe)) {
      fFound = (ppe->th32ProcessID == dwProcessId);
      if (fFound) break;
   }
   return(fFound);
}

///////////////////////////////////////////////////////////////////////////////

inline BOOL CToolhelp::ModuleFirst(PMODULEENTRY32 pme) const {

   return(Module32First(m_hSnapshot, pme));
}

inline BOOL CToolhelp::ModuleNext(PMODULEENTRY32 pme) const {

   return(Module32Next(m_hSnapshot, pme));
}

inline BOOL CToolhelp::ModuleFind(PVOID pvBaseAddr, PMODULEENTRY32 pme) const {

   BOOL fFound = FALSE;
   for (BOOL fOk = ModuleFirst(pme); fOk; fOk = ModuleNext(pme)) {
      fFound = (pme->modBaseAddr == pvBaseAddr);
      if (fFound) break;
   }
   return(fFound);
}

inline BOOL CToolhelp::ModuleFind(PTSTR pszModName, PMODULEENTRY32 pme) const {
   BOOL fFound = FALSE;
   for (BOOL fOk = ModuleFirst(pme); fOk; fOk = ModuleNext(pme)) {
      fFound = (lstrcmpi(pme->szModule,  pszModName) == 0) ||
               (lstrcmpi(pme->szExePath, pszModName) == 0);
      if (fFound) break;
   }
   return(fFound);
}

///////////////////////////////////////////////////////////////////////////////

inline BOOL CToolhelp::ThreadFirst(PTHREADENTRY32 pte) const {

   return(Thread32First(m_hSnapshot, pte));
}

inline BOOL CToolhelp::ThreadNext(PTHREADENTRY32 pte) const {

   return(Thread32Next(m_hSnapshot, pte));
}

///////////////////////////////////////////////////////////////////////////////

inline int CToolhelp::HowManyHeaps() const {

   int nHowManyHeaps = 0;
   HEAPLIST32 hl = { sizeof(hl) };
   for (BOOL fOk = HeapListFirst(&hl); fOk; fOk = HeapListNext(&hl))
      nHowManyHeaps++;
   return(nHowManyHeaps);
}

inline int CToolhelp::HowManyBlocksInHeap(DWORD dwProcessID,
   DWORD dwHeapID) const {

   int nHowManyBlocksInHeap = 0;
   HEAPENTRY32 he = { sizeof(he) };
   BOOL fOk = HeapFirst(&he, dwProcessID, dwHeapID);
   for (; fOk; fOk = HeapNext(&he))
      nHowManyBlocksInHeap++;
   return(nHowManyBlocksInHeap);
}

inline BOOL CToolhelp::HeapListFirst(PHEAPLIST32 phl) const {

   return(Heap32ListFirst(m_hSnapshot, phl));
}

inline BOOL CToolhelp::HeapListNext(PHEAPLIST32 phl) const {

   return(Heap32ListNext(m_hSnapshot, phl));
}

inline BOOL CToolhelp::HeapFirst(PHEAPENTRY32 phe, DWORD dwProcessID,
   UINT_PTR dwHeapID) const {

   return(Heap32First(phe, dwProcessID, dwHeapID));
}

inline BOOL CToolhelp::HeapNext(PHEAPENTRY32 phe) const {

   return(Heap32Next(phe));
}

inline BOOL CToolhelp::IsAHeap(HANDLE hProcess, PVOID pvBlock,
   PDWORD pdwFlags) const {

   HEAPLIST32 hl = { sizeof(hl) };
   for (BOOL fOkHL = HeapListFirst(&hl); fOkHL; fOkHL = HeapListNext(&hl)) {
      HEAPENTRY32 he = { sizeof(he) };
      BOOL fOkHE = HeapFirst(&he, hl.th32ProcessID, hl.th32HeapID);
      for (; fOkHE; fOkHE = HeapNext(&he)) {
         MEMORY_BASIC_INFORMATION mbi;
         VirtualQueryEx(hProcess, (PVOID) he.dwAddress, &mbi, sizeof(mbi));
         if (chINRANGE(mbi.AllocationBase, pvBlock,
            (PBYTE) mbi.AllocationBase + mbi.RegionSize)) {

            *pdwFlags = hl.dwFlags;
            return(TRUE);
         }
      }
   }
   return(FALSE);
}

//////////////////////////////// End of File //////////////////////////////////

http://support.microsoft.com/kb/314743/zh-cn