The principle and realization of the technique of mouse screen word-taking

"Mouse screen word" technology is widely used in the electronic dictionary, such as the four-way and Kingsoft and other software, this technology seems simple, in fact, the implementation of the Windows system is very complex, in general there are two ways to achieve:

The first: The use of interception of some GDI API calls to implement, such as Textout,textouta.

Second: Copy each Device context (DC) and track all actions that modify the context (DC).

The second method is more powerful, but not compatible, and the first method uses the Intercept WINDOWSAPI call, the technology is far more powerful than you can imagine, it is no exaggeration to say that, using WINDOWSAPI interception technology, you could transform the entire operating system, In fact, many of the plug-in Windows Chinese platform is so implemented! This technique is also the subject of this article.

The WINDOWSAPI call, in particular, can be divided into two ways:

The first method can be intercepted by directly overwriting the WINAPI image in memory, embedding the assembly code, and then jumping to the specified address when it is invoked. The second method overwrites the IAT (Import Address table entry form). REDIRECT WINAPI function calls to implement the interception of WINAPI.

The implementation of the first method is cumbersome and more difficult under Win95 and 98, because while Microsoft says the Win16 API is reserved for compatibility only, programmers should call 32-bit APIs as much as possible, which is actually not the case at all! Most of the 32-bit APIs inside the win 9x have been transformed to call the 16-bit API with the same name, which means we need to embed 16-bit assembler code in the blocked function!

We are going to introduce the second interception method, which runs under Win95, 98 and NT, and is more stable and has better compatibility. Because of the need for management of Windows virtual memory, breaking the process boundary wall, injecting code into the application's process space, PE (portable executable) file format, and IAT (Input Address table) and other low-level knowledge, So let's start with a brief introduction of the knowledge involved, and finally give the key code for the Intercept section.