Tricky QQ screenshot

Yesterday saw a friend of their own to achieve a similar function of the QQ screenshot, so the QQ screenshot of the DLL turned out, a simple test, and found some unusual small function may be useful to everyone. Here using RTX (Tencent's other software products) with the Camerawnd.dll, and QQ is very similar.

The first step: with VC with the depends. EXE to see the DLL's exported function, with the following three

CameraSubArea，CameraWndArea，CameraScreen

From the literal point of view, the first is to intercept the child range, the second is to intercept the window range, the third is a screenshot of the function parameters are not known, write a test program, the function temporarily think no return value without parameter code as follows:

typedef void (*FUN)();
　　HMODULE hInst = LoadLibrary(_T("CameraWnd.dll"));
　　if (hInst != NULL)
　　{
　　　　FUN pFunc = (FUN)GetProcAddress(hInst, "CameraSubArea");
　　　　if (pFunc != NULL)
　　　　{
　　　　　　pFunc();
　　　　}
　　}

Results test through, the same code into GetProcAddress (hmodule, "Camerawndarea") can also be set up, and the window screenshot mode, it is estimated that no one has seen, ^_^ when replaced by GetProcAddress (Hmodule, " Camerascreen ") can run and the function returns with an exception that indicates that the function has parameters or that we are calling the wrong way.

The second step: VC debugging mode, tracking Camerasubarea method can be seen:10001200 push 40800000h
10001205 push 1
10001207 push 1
10001209 call 100010E0

The trace Camerawndarea method can see:

10001210 push 40800000h
10001215 push 0
10001217 push 2
10001219 call 100010E0

The trace Camerascreen method can see:

100010E0 push ebp
100010E1 mov ebp,esp
100010E3 push 0FFh
100010E5 push 10007973h

It seems that the first two functions are called by the third method, except that the input parameters are different,< camerascreen should have 3 parameters, temporarily considered to be int,int,int then the first and second function should call the third function using the following method.

void CameraSubArea()
{
　　CameraScreen(1, 1, 0x40800000);
}
void CameraWndArea()
{
　　CameraScreen(2, 0, 0x40800000);
}

Then I try to modify each parameter, in addition to the last parameter does not know the effect, the first should be control mode, the second parameter control whether the magnifying glass is a bool type the third parameter changes affect the content displayed in the magnifying glass, and is estimated to be a magnifying glass parameter. Interested you can try or use the accompanying source code test run results directly.

Another: Camerascreen should have return value, if no return value caller how to know the user screenshot is canceled or intercepted, do not check the clipboard yourself. Before someone has a screenshot feature can not use the problem, it is possible that some other program opened the Clipboard did not close, causing the program to open the Clipboard failed, this time the system screenshot key should also not be used.

This article supporting source code