Source insight is a plug-in series 4-Analysis of "Source insight"

The purpose of the plug-in is to inject code into other processes. Therefore, the injection must be completed by a target process. The so-called target process is usually part or whole of a software, therefore, you must have a deep understanding of the target program. Generally, plug-ins are developed for an application. The loading and running of these plug-ins depend on the environment provided by the host process. If an error occurs, the consequences are very serious. When some software runs, multiple processes are started, and each process completes its own tasks. Therefore, it is easier to determine which process should be "mounted, all functions are completed in one process, and the analysis is relatively simple.

To add a label bar for file switching to "Source insight", we need to conduct an in-depth study on the window system of "Source insight, because file switching is reflected in the "source insight" interface, that is, window switching. In addition, we also need to study the message flow between windows. Such a tool should first push "Spy ++ ". The "Spy ++" tool is part of viausl studio. Let's first use it to look at the window hierarchy of the "source insight" program. The first is the main frame window, that is, the window at the outermost (largest) layer of the interface, as shown in:

Figure 4.1 Main Window of source insight

The Class Name of the main window is "si_frame", which is a good sign. This indicates that the "source insight" program has a fixed main framework window class name, tabsiplus identifies "Source insight" based on the class name of the main framework window. In fact, to label a window system with multiple document interfaces, the most important thing is to find the host of the sub-Framework Window and the sub-Framework Window, that is, the parent window of the sub-Framework Window. Generally, this window is not a main frame window, but a subwindow of the main frame window. This subwindow is the same as the toolabr Or rebar window, except that it neither depends on the top nor the edges, it only occupies the entire customer zone of the main frame window. Now let's take a look at what is going on in the host window of the "source insight" sub-Framework Window. First, close all documents, that is, close all sub-framework windows, then, drag the "Spy ++" target star to search for the target star. Find and find the target star:

Figure 4.2 MDI client window

Have you noticed its class name? Yes, its window class name is "mdiclient". Programmers familiar with Windows know that this is the Windows standard multi-document window interface, which is very exciting. Remember this name, because our plug-in controls the file tag through the hook window. Next we will study the sub-frame window, open a sub-window, And do not maximize the number. Then we will take a look at it with the "Spy ++" target star:

Figure 4.3 subwindow of source insight

In the past, its class name was "si_sw", and it had many sub-windows, but it was important not to care about it, because "tabsiplus" only hooks the sub-Framework Window.

After finding these windows, you need to study the messages between these windows. Considering the behavior of switching the tag bar of the file, for example, you need to activate the corresponding sub-frame window when clicking a tag, for example, when a user switches a window in another way (such as using a shortcut key or window menu), the tab bar must be able to update the window accordingly, there is also the creation and destruction of Windows (the opposite operation is to open and close files), so the focus of a few messages is window creation, destruction, window activation, window deactivating, and so on, set the message filter as shown in:

Figure 4.4 message filtering settings

Then, activate this sub-framework window and you will see a wm_mdiactive message:

Figure 4.5 MDI Message Flow

The window handle can be obtained by parsing the message parameters, and then the relationship between the window handle and the tag is maintained by our plug-in. The internal details of tabsiplus will be described in the next article) update the corresponding tag. In the same way, hook wm_mdicreate and wm_mdidestroy can detect the creation and destruction of windows, and add or delete a tag accordingly. When a user activates a tag, the window can be acted upon by simulating the sending of the corresponding message, which is the focus of the tag plug-in.

Through the above research, we will summarize the qualified programs that can apply the tag window plug-in. First, the main window must have a fixed class name or window title format, it is not necessary to have a fixed class name. You can find the main window of the Host Program in other ways, but the format of the window title is very important, because the internal data structure of the host program cannot be obtained, the file name corresponding to the window can be obtained only by analyzing the window title. Secondly, the application should adopt a standard Windows Multi-document interface. Although theoretically all window systems with fixed customer window class names and sub-window class names can use tabsiplus technology, however, for standard Windows Multi-Document Interface programs, many standard window messages (such as mdichild_active and mdichild_destroy) can be used to facilitate function development. The sub-window used to display files must have a fixed class name. "Source insight" satisfies these conditions well, so "tabsiplus" appears.

So far, all external information about "tabsiplus" (including how to find "Source insight" and how to load the plug-in Dynamic Link Library) has been introduced, the next article in this series will go deep into the "tabsiplus" and explain in detail how the code injected into the host Program works. The next article (probably the last one) I will answer some questions of interest raised by readers during this article. If you are able to read the last article, you will be pleasantly surprised to wait for you and guess what it will be?

Source insignt file tag plug-in: tabsiplus:
Http://www.winmsg.com/download/tabsiplus.zip