用拷貝鉤子實現對檔案夾的監控

ICopyHook是一個用於建立拷貝鉤子處理常式COM介面，它決定一個檔案夾或者印表機對象是否可以被移動，拷貝，重新命名或刪除。Shell在執行這些操作之前，會調用ICopyHook介面的CopyCallback方法對它們進行驗證。CopyCallback返回一個int值指示Shell是否應該繼續執行這個操作。傳回值IDYES表示繼續，而傳回值IDNO和IDCANCEL則表示終止。

一個檔案夾對象可以安裝多個拷貝鉤子處理常式。如果出現這種情況，Shell會依次調用每個處理常式。只有當每個處理常式都返回IDYES時，Shell才真正執行使用者請求的操作。

拷貝鉤子處理常式的作用是在上述四種操作執行前對它們進行驗證，但是Shell並不會把操作的結果通知給拷貝鉤子處理常式。而windows提供的API函數FindFirstChangeNotification和FindNextChangeNotification卻可以實現這個功能。因此，只有把這種兩種方法結合起來，才能對一個檔案夾的狀態進行完全的監控。

拷貝鉤子處理常式實現並不困難，首先建立一個作為進程內組件的COM對象，它只需要暴露一個ICopyHook介面（當然還有IUnknown）。然後用regsrv32.exe註冊這個COM組件。最後一步是向Shell註冊你的這個拷貝鉤子處理常式，方法是在註冊表HKEY_CLASSES_ROOT/Directory/Shellex/CopyHookHandlers下建立一個名稱任意的sub key，在此sub key中建立一個類型為REG_SZ的項並將你的COM對象的CLSID作為它的預設值就可以了。

下面就是一個拷貝鉤子的實現程式

 

// CCopyHook.h 

//CCopyHook類實現了ICopyHook介面，CClassFactory實現了IClassFactory介面

#include <shlobj.h>

class CCopyHook: public ICopyHook

{

public:

            CCopyHook():m_refcnt(0)  {  }

            STDMETHODIMP QueryInterface(REFIID iid,void** ppvObject);

            STDMETHODIMP_(ULONG) AddRef();

            STDMETHODIMP_(ULONG) Release();

            STDMETHODIMP_(UINT) CopyCallback(HWND hwnd,UINT wFunc,UINT wFlags,

                                                     LPCTSTR pszSrcFile,DWORD dwSrcAttribs,

                                                     LPCTSTR pszDestFile,DWORD dwDestAttribs);

private:

            int m_refcnt;

};

class CClassFactory:public IClassFactory

{

public:

            CClassFactory():m_refcnt(0)  {   }

            STDMETHODIMP QueryInterface(REFIID iid,void** ppvObject);

            STDMETHODIMP_(ULONG) AddRef();

            STDMETHODIMP_(ULONG) Release();

            STDMETHODIMP CreateInstance(IUnknown * pUnkOuter,REFIID riid,void ** ppvObject);

            STDMETHODIMP LockServer(BOOL fLock);

private:

            int m_refcnt;

};

 

// CCopyHook.cpp

//CCopyHook對象和CClassFactory對象的實現檔案

#include <stdio.h>

#include "CCopyHook.h"

 

extern LONG nLocks;          //對象計數，用於DllCanUnloadNow

 

ULONG __stdcall CCopyHook::AddRef(){

            if(m_refcnt==0)

                        nLocks++;

            m_refcnt++;

            return m_refcnt;

}

ULONG __stdcall CCopyHook::Release(){

            int nNewCnt=--m_refcnt;

            if(nNewCnt<=0){

                        nLocks--;

                        delete this;

            }

            return nNewCnt;

}

HRESULT __stdcall CCopyHook::QueryInterface(REFIID iid,void** ppvObject){

            if(iid==IID_IUnknown)

                        *ppvObject=static_cast<IUnknown*>(this);

            else

                        if(iid==IID_IShellCopyHook)

                            *ppvObject=static_cast<ICopyHook*>(this);

            else

                         return E_NOINTERFACE;

            reinterpret_cast<IUnknown*>(*ppvObject)->AddRef();

            return S_OK;

}

//這就是CopyCallback方法，拷貝鉤子的所有功能由它實現。參數的具體值參看MSDN

UINT __stdcall CCopyHook::CopyCallback(HWND hwnd,UINT wFunc,UINT wFlags,

                                                     LPCTSTR pszSrcFile,DWORD dwSrcAttribs,

                                                     LPCTSTR pszDestFile,DWORD dwDestAttribs){

            char szMessage[MAX_PATH+14];

            sprintf(szMessage,"對%s進行的操作，是否繼續？",pszSrcFile);

            return MessageBox(NULL,szMessage,"確認",MB_YESNO|MB_ICONEXCLAMATION);

}

ULONG __stdcall CClassFactory::AddRef(){

            if(m_refcnt==0)

                        nLocks++;

            m_refcnt++;

            return m_refcnt;

}

ULONG __stdcall CClassFactory::Release(){

            int nNewCnt=--m_refcnt;

            if(nNewCnt<=0){

                        nLocks--;

                        delete this;

            }

            return nNewCnt;

}

HRESULT __stdcall CClassFactory::QueryInterface(REFIID iid,void** ppvObject){

            if(iid==IID_IUnknown)

                        *ppvObject=static_cast<IUnknown*>(this);

            else

                        if(iid==IID_IClassFactory)

                            *ppvObject=static_cast<IClassFactory*>(this);

            else

                         return E_NOINTERFACE;

            reinterpret_cast<IUnknown*>(*ppvObject)->AddRef();

            return S_OK;

}

HRESULT __stdcall CClassFactory::CreateInstance(IUnknown* pUnkownOuter,REFIID riid,void** ppvObj){

            if(pUnkownOuter!=NULL)

                        return CLASS_E_NOAGGREGATION;

            CCopyHook* pObj=new CCopyHook;

            pObj->AddRef();

            HRESULT hr=pObj->QueryInterface(riid,ppvObj);

    pObj->Release();

            return hr;

}

HRESULT __stdcall CClassFactory::LockServer(BOOL fLock){

            if(fLock)

                nLocks++;

            else

                        nLocks--;

            return S_OK;

}

// main.cpp

//主要實現了幾個COM對象標準的匯出函數。

#include <objbase.h>

#include <olectl.h>

#include "CCopyHook.h"

 

//這是要添加到註冊表中的項，注意如果你要使用這段代碼，應該用UUIDGEN.exe產生一

//個新的CLSID。

const char* szRegTable[][3]={

{"CLSID//{7e10a039-fe03-4f9c-b7e1-c5eeeaf53735}",0,"CopyHook"},

{"CLSID//{7e10a039-fe03-4f9c-b7e1-c5eeeaf53735}//InProcServer32",0,(const char*)-1},

{"CLSID//{7e10a039-fe03-4f9c-b7e1-c5eeeaf53735}//InProcServer32","ThreadingModel","Apartment"},

{"CLSID//{7e10a039-fe03-4f9c-b7e1-c5eeeaf53735}//ProgID",0,"webber84.CopyHook.1"},

{"webber84.CopyHook.1",0,"CopyHook"},

{"webber84.CopyHook.1//CLSID",0,"{7e10a039-fe03-4f9c-b7e1-c5eeeaf53735}"}};

HMODULE hInstance=NULL;

LONG nLocks=0;

BOOL APIENTRY DllMain( HANDLE hModule,

                       DWORD  ul_reason_for_call,

                       LPVOID lpReserved

                                                             ){

            if(ul_reason_for_call==DLL_PROCESS_ATTACH)

                        hInstance=(HMODULE)hModule;

    return TRUE;

}

STDAPI DllUnregisterServer(){

            HRESULT hr=S_OK;         LONG ret=0;

            int items=sizeof(szRegTable)/sizeof(szRegTable[0]);

            for(int i=items-1;i>=0;i--){

                        const char* szKeyName=szRegTable[i][0];

                        if( (i==items-1) || stricmp(szRegTable[i+1][0],szKeyName)!=0)

                             ret=RegDeleteKey(HKEY_CLASSES_ROOT,szKeyName);

        if(ret!=ERROR_SUCCESS)

                                    hr=SELFREG_E_CLASS;

            }

            return hr;

}

//可重用的DllRegisterServer函數，只要照上面的格式把登錄機碼放到一個數組中，就可以//用這段程式碼完成對任意組件的註冊。

STDAPI DllRegisterServer(void){

            HRESULT hr=S_OK;

            int items=sizeof(szRegTable)/sizeof(szRegTable[0]);

            char szDllPath[MAX_PATH];

            GetModuleFileName(hInstance,szDllPath,MAX_PATH);

            for(int i=0;i<items && SUCCEEDED(hr);i++){

                        const char* szKeyName=szRegTable[i][0];

                        const char* szValueName=szRegTable[i][1];

                        const char* szValue=szRegTable[i][2];

                        if(szValue==(const char*)-1)

                                    szValue=szDllPath;

                        HKEY hKey;

                        LONG ret=RegCreateKey(HKEY_CLASSES_ROOT,szKeyName,&hKey);

                        if(ret==ERROR_SUCCESS){

                                    RegSetValueEx(hKey,szValueName,0,REG_SZ,(const BYTE*)szValue,

strlen(szValue)+1);

                                    RegCloseKey(hKey);

                        }

                        if(ret!=ERROR_SUCCESS){

                                    hr=SELFREG_E_CLASS;

                                    DllUnregisterServer();

                        }

            }

            return hr;

}

STDAPI DllGetClassObject (REFCLSID rclsid, REFIID riid, void** ppvObj) {

    HRESULT hr = E_OUTOFMEMORY;

    *ppvObj = NULL;

    CClassFactory *pClassFactory = new CClassFactory;

    if (pClassFactory != NULL)

        hr = pClassFactory->QueryInterface(riid, ppvObj);

    return hr;

}

STDAPI DllCanUnloadNow(){

            return nLocks==0 ? S_OK : S_FALSE;

}