A re-release of updated code originally written some 20 years ago.
Keep in mind that in some cases both a 32 and 64 bit version of a DLL are required.
Projects will compile in Delphi XE2 and up. XE2 was chosen since it will compile for both 32 and 64 bit with a small binary footprint.
A manifest file is supplied for Delphi Berlin which includes 'uiAccess'. Newer IDEs have this option built in. Debugging is best done with a manifest that does not include 'uiAccess'. 'LinkManifests.cmd' will generate symbolic links to the supplied manifest.
As of Windows 10.1903.18362.295 a Sandbox VM allowed debug testing without code signing.
Best to change the DLL name, change the Mapfile Filename and follow these steps:
- uiAccess="true"
- Code MUST be digitally signed
- Your application MUST reside in a trusted location (e.g.; Program Files)
Without this hooking a 'uiAccess' app will fail and possibly lock your App.
Recording and playback of a Journal hook. The code can reside inside an EXE or DLL and works for both 32/64 bit without an additional version. However the way I read this is that its best to use a DLL since non native bitness apps will end up loaded your code via a thunking mechanism.
Hooks all messages posted via PostMessage, best is to refine what you need to watch and let the rest flow through. The current demo simply posts a message back to the original App when a System Menu is clicked.
Hooks all GetMessage or PeekMessage functions when there is a keyboard message (WM_KEYUP or WM_KEYDOWN) to be processed. The current demo simply posts a message back to the original App when ALT+Numkey_1 is used.
Injects the DLL into a process using its PID, where a DDetours call essentially redirects an API.
This method could use a Hook process specific to a single process to lessen the load on the system.
Easiest Way to Test:
- Run two instances (same bitness)
- Copy the PID from the first to the second instances
- Attach to the first from the second instances
- Try to terminate the first instance
Requires: Delphi Detours Library
- SetWindowsHookEx for WH_JOURNALRECORD fails under Vista/Windows 7
- How do I disable driver signature enforcement Win 10
- Windows, Drivers and Digital Signatures
- Driver Signing changes in Windows 10, version 1607
- API Hooking using AppInit_DLLs
- Disable driver signature enforcement permanently in Windows 10
- Easy shell hooking example
- Using accessibility to monitor windows as they come and go