Delphi depth exploration outside Shell execution Action Recorder

Documenting the shell activity has many benefits, such as the need to monitor user behavior, backtracking before the system crashes. The key tool to implement this function is quite simple, it is COM interface ishellexecutehook. After writing a COM object that implements this interface, and then registering in the system, you can easily control and affect the operation of the Windows shell. Both Windows 98 and Windows 2000 support Ishellexecutehook shell extensions, while the Active Desktop extensions must be installed on Windows 95 and Windows NT 4.0 (that is, IE 4.01 must be installed).

A COM object that implements the Ishellexecutehook interface can intercept all calls to the ShellExecute and ShellExecuteEx functions. The ShellExecute and ShellExecuteEx functions are primarily used to execute applications, which can receive a filename and automatically obtain an executable file name associated with the file name. In addition, they also support system security authentication. If the user's executable permissions are set on NT, the ShellExecute and ShellExecuteEx functions will be checked before the new process is created (CreateProcess and winexec functions do not). The process of a function call is as follows:

(1) Get the executable file name that will be run.

(2) Check the user execution rights according to the program name.

(3) Activate all registered Ishellexecutehook extensions.

(4) When all extensions and permissions are agreed to execute, create a new process and return.

The Windows shell calls the ShellExecute and ShellExecuteEx functions in large numbers to perform almost all of the resource manager's operations, such as double-clicking the directory, browsing the contents of the folder, printing the editing document, viewing the file properties, selecting the context-related menu for the document, and so on. In addition, the Start Menu Run dialog box and DOS Start.exe also use the ShellExecuteEx function to execute the program. Simply put, all shell operations for almost any user can be extended to intercept, including calls to ShellExecute and Shellexecteex by other applications.

Writing the Shell Activity recorder