C# 屏幕截图 winlogon 以及用户桌面 [英] C# Screenshot winlogon as well as User Desktop

问题描述

我正在处理屏幕共享项目.但是我在捕获安全桌面时遇到了麻烦.我已经在这里问过相关问题，也得到了答案

请通过上面的链接

正如dymanoid所建议的那样.我正在使用 PsExec exe 捕获安全桌面/winlogon 桌面，如下所示

/x 和/s 开关在 SYSTEM 帐户下和 Winlogon 桌面上运行该进程.

<块引用>

PsExec/i/h/x/d/s "path_\screencapture.exe"

现在 screencapture exe 在 winlogon 桌面上以 SYSTEM 帐户运行，我可以在用户登录屏幕上看到 screencapture exe，但在用户桌面屏幕上看不到.

现在事情反过来了，我能够捕获用户登录屏幕，但不能捕获用户桌面.

用户桌面给我空/黑屏.

如果我从下面的命令中删除/x ，那么我就可以得到 userdesktop 不安全的桌面

<块引用>

PsExec/i/h/d/s "path_\screencapture.exe"

我的问题是有没有办法做到这一点

解决方案

我无法测试我的理论，因为我在工作.+ 我还没有评论的权利...所以，如果这不起作用，请耐心等待.

作为系统运行可能与它没有桌面"目录有关.所以请创建这些目录:

32 位:%windir%\System32\config\systemprofile\desktop64 位:%windir%\SYSWOW64\config\systemprofile\desktop

使用 SYSTEM 帐户重试:

<块引用>

PsExec -i -h -x -d -s "path_\screencapture.exe"

有时工作目录是只读"的，所以通过指定你可以让它工作

<块引用>

PsExec -i -h -x -d -s -w c:\temp "path_\screencapture.exe"

如果这不起作用，请尝试将其附加到会话，查询可用的用户会话以查看安全桌面是否正在运行自己的会话名称，我命令提示符输入:

<块引用>

查询会话

 SESSIONNAME 用户名 ID 状态类型设备服务 0 光盘>控制台 xxxx 2 活动rdp-tcp 65536 听

我在这里唯一可用的会话是 services = 0 和 mylogin = 2.

我建议尝试

<块引用>

PsExec -i 0 -h -x -d -s -w c:\temp "path_\screencapture.exe"

或

<块引用>

PsExec -i 2 -h -x -d -s -w c:\temp "path_\screencapture.exe"

并查看捕获是否有任何差异.

我以前从未使用过安全桌面，因此它可能是一个额外的层.在用户情况下， -i 对我来说一直很好.

祝你好运:)

我很幸运地对此进行了测试，这就是我所做的:

1. 下载了一个带gui的抓包工具，我试过7capture.com

2. 然后我像这样启动了 7capture.exe:

<块引用>

PsExec -i -s -x c:\7capture.exe

3. 现在我展示了以管理员身份运行"的安全桌面.当弹出窗口出现时，我按下了 ALT+TAB 并出现了 7capture :)

4. 按刷新"按钮查看项目列表.桌面"在我的电脑上被称为$$$Secure UAP 后台窗口".

5. 瞧，捕捉到并可见

现在查看屏幕截图安全桌面

我会更改桌面 HWND 调用:

Win32Stuff.GetDesktopWindow();

使用枚举函数并为您在安全桌面中找到的每个 HWND 拍照.

未经测试，但我相信您可以使用它:

[DllImport("user32.dll")]private static extern bool EnumWindows(EnumWindowsProc enumProc, IntPtr lParam);//委托过滤要包含的窗口公共委托 bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam);

尝试一下，看看您是否可以使其适用于所有场景.

Edit2:
由于这是 2 个不同的用户范围，因此您需要运行 Screencapture.exe 的两个副本.一种用于安全桌面，一种用于交互式会话:统一咨询委员会:

<块引用>

PsExec -i -h -x -d -s "path_\screencapture.exe"

没有 UAC:

<块引用>

PsExec -i -h -d "path_\screencapture.exe"

I am working with screen sharing project.But i was got into trouble to capture secure desktop. I have already ask related question here and got Answer too

Pls go through above link

as suggested by dymanoid. I am using PsExec exe to capture secured desktop/winlogon desktop as below

The /x and /s switches run the process under the SYSTEM account and on the Winlogon desktop.

PsExec /i /h /x /d /s "path_\screencapture.exe"

Now screencapture exe is running as SYSTEM account on winlogon desktop, i able to see screencapture exe on user login screen but not on user desktop screen.

Now the things reverse i able to capture user login screen but not user desktop.

User desktop gives me Empty/black screen.

If i remove /x from command as below then i able to get userdesktop not secured desktop

PsExec /i /h /d /s "path_\screencapture.exe"

My question is if there any way to do this

解决方案

I am unable to test my theory since I'm at work. + I do not have the rights to comment yet... So please bear with me, if this does not work.

Running as system could be related that it does not have a "desktop" directory. So please create a these directories:

32-bit: %windir%\System32\config\systemprofile\desktop
64-bit: %windir%\SYSWOW64\config\systemprofile\desktop

Try again with the SYSTEM account:

PsExec -i -h -x -d -s "path_\screencapture.exe"

Sometimes the working directory is "read only" so by specifying that you could get it to work

PsExec -i -h -x -d -s -w c:\temp "path_\screencapture.exe"

If that does not work, try to attach it to a session, query the user-sessions available to see if a secure desktop are running its own sessioname, i command-prompt enter this:

query sessions

 SESSIONNAME       USERNAME                 ID  STATE   TYPE        DEVICE
 services                                    0  Disc
>console           xxxx                      2  Active
 rdp-tcp                                 65536  Listen

My only session available here is services = 0 and mylogin = 2.

I would suggest to try

PsExec -i 0 -h -x -d -s -w c:\temp "path_\screencapture.exe"

or

PsExec -i 2 -h -x -d -s -w c:\temp "path_\screencapture.exe"

And see if there are any difference in the captures.

I have never worked with the secure desktop before, so it could be an extra layer. In a user situation the -i has always worked fine for me.

Good luck :)

Edit:
I have tested this out with luck, this is what I did:

1. Downloaded a capture tool with gui, I tried 7capture.com

2. Then I started 7capture.exe like this:

PsExec -i -s -x c:\7capture.exe

3. Now I showed the secure desktop with "run as admin" on something. When the popup comes, I pushed ALT+TAB and there was 7capture :)

4. Press the "Refresh" button to see a list of items. The "desktop" is called something like "$$$Secure UAP Background window" on my computer.

5. Voila, capture taken and visible

Now for the code on Screenshot secure desktop

I would change the desktop HWND call:

Win32Stuff.GetDesktopWindow();

To a Enum function and take a picture of every HWND you find in the secure desktop.

Untested, but I belive you can use this:

[DllImport("user32.dll")]
private static extern bool EnumWindows(EnumWindowsProc enumProc, IntPtr lParam);

// Delegate to filter which windows to include 
public delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam);

Give that a try and see if you can make it work for all scenarios.

Edit2:
Since these are 2 different user scopes, you need to run two copies of Screencapture.exe. One for secure desktop and one for the interactive session: UAC:

PsExec -i -h -x -d -s "path_\screencapture.exe"

Without UAC:

PsExec -i -h -d "path_\screencapture.exe"

这篇关于C# 屏幕截图 winlogon 以及用户桌面的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！