获取explorer.exe以从启动加载我的扩展 [英] Get explorer.exe to load my extension from startup
问题描述
防止 XY问题的背景:(因为可能存在更简单的解决方案)
Context to prevent an XY Problem: (Because there very well might be a simplier solution)
我的目标是跟踪用户拖动文件(以及使用剪贴板剪切和复制内容)时explorer.exe的文件移动.我尝试使用Windows Shell扩展来解决此问题，但是我实现的接口似乎从未触发过.我遵循了此 CodeProject的指南，效果很好.但是，当我实施 IFileOperation 界面，在这些用户操作期间，explorer.exe都没有调用过我的函数(我应该在教程中添加到*.rgs文件中的另一个位置吗?IFileOperation接口的某些特定注册位置)像txtfile用于上下文菜单?).
My goal is to track explorer.exe's file movement when the user drags files around (as well as uses clipboard cut and copy stuff). I tried to solve this with a Windows Shell Extension, however the interfaces that I implemented never seemed to do trigger. I followed this guide from CodeProject which worked beautifully. However, when I implemented the IFileOperation interface, none of my functions were ever called by explorer.exe during these user operations (is there another place I'm supposed to add to the *.rgs file from the tutorial? Some specific registration location for the IFileOperation interface like txtfile was for the context menu?).
作为回应，已编写了一个使用mhook和第三方DLL注入程序强制explorer.exe加载我的DLL.通过过滤NtReadFile，NtWriteFile和NtSetInformationFile调用，我可以区分移动操作和复制操作.效果很好！
In response, have written a DLL file that hooks ntdll.dll function calls using mhook and this other CodeProject tutorial, which all takes place within DLLMain. Instead of using the AppInit registry entry as in the tutorial, I used a third party DLL injection program to force explorer.exe to load my DLL. By filtering NtReadFile, NtWriteFile, and NtSetInformationFile calls, I can differentiate between move and copy operations. It worked pretty well!
问题:
虽然代码注入很hacky，所以我回过头将DLLMain与第一个指南合并，以便将我的挂钩代码驻留在shell扩展中.当explorer.exe加载shell扩展时，我的挂钩代码也将执行.好吧，explorer.exe很聪明，并且仅在需要时加载DLL.为了使我的挂钩代码开始工作，我需要右键单击一个文本文件以调用原始指南的shell扩展代码，此后DLL似乎一直保持加载状态.
Code injection is hacky though, so I went back and merged my DLLMain with the first guide so that my hooking code resides within a shell extension. When explorer.exe loads the shell extension, my hooking code gets executed as well. Well, explorer.exe is smart and only loads DLLs as it needs them. In order for my hooking code to start working, I need to right click a text file in order to invoke the original guide's shell extension code, at which point the DLL seems to stay loaded from then on.
问题:
是否有可以伪实现的shell扩展接口，以便使explorer.exe在启动时加载我的shell扩展，而从不卸载它?对于我在做什么有更优雅的解决方案吗?
Is there a shell extension interface that I can pseudo implement in order to get explorer.exe to load my shell extension on startup, and never unload it? Is there a more elegant solution to what I'm doing?
There is a similar post concerning a BHO, which loads with both explorer.exe and iexplorer.exe at start up. I had thought it was just an IE thing when I read that, but I was wrong. There is an additional key (NoExplorer) you can write to prevent explorer.exe from loading it, but is there a similar command to prevent IE from loading it? All of my searches keep bringing up NoExplorer.
通过一些经验实验， ICopyHook 接口与它所获得的持久性Shell扩展一样近.未调用IFileOperation的原因是因为explorer.exe没有调用它，而是来自其他程序，这些程序请求Shell在该接口下执行特定操作.无论如何，我已经实现了一个相当空的ICopyHook shell扩展，尽管它是非常不确定的，但它似乎在启动后不久就加载到了explorer.exe中.如果有人有更好的解决方案，请分享.
Through a little bit of empirical experimentation, the ICopyHook interface is as close to a persistent shell extension as it gets. The reason IFileOperation wasn't being called was because explorer.exe does not call it, but rather it comes from other programs requesting the shell to do a specific operation under that interface. In any case, I've implemented a rather empty ICopyHook shell extension and it seems to load into explorer.exe shortly after startup, although it is very nondeterministic. If anyone has a better solution, please do share.
推荐答案
There is an additional key (NoExplorer) you can write to prevent explorer.exe from loading it, but is there a similar command to prevent IE from loading it?
当Internet Explorer加载外壳扩展程序时，
仅在DllMain DLL_PROCESS_ATTACH 中返回 FALSE .
Simply return FALSE in DllMain DLL_PROCESS_ATTACH when your shell extension is loaded by Internet Explorer.
这篇关于获取explorer.exe以从启动加载我的扩展的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
