易语言枚举卸载消息钩子源码

易语言枚举卸载消息钩子源码系统结构:枚举消息钩子,置超级列表框整行红色,提升进程权限,GetSharedInfoAddress,系统是否支持,取指针_整数型,取指针_tagOUTPUTINFO,取进程路径,修正路径,取系统目录,十六到十,api_LookupPrivilegeValue,api_AdjustTokenPrivileges,api_GetCurrentProcess,api_OpenProcessToken,GetProcAddress,GetModuleHandle,TotagSymbolCode,TotagSHAREDINFO,TotagSERVERINFO,TotagHANDLEENTRY,GetVersionExA,OpenProcess,Api_GetProcessImageFileName,EnumProcessModules,GetModuleFileNameEx,CloseHandle,GetSystemDirectoryA,StrToIntEx,UnhookWindowsHookEx, ======窗口程序集1 || ||------_按钮1_被单击 || ||------__启动窗口_创建完毕 || ||------__启动窗口_将被销毁 || ||------枚举消息钩子 || ||------置超级列表框整行红色 || ||------_超级列表框1_右键单击表项 || ||------_卸载钩子_被选择 || || ======功能_程序集 || ||------提升进程权限 || ||------GetSharedInfoAddress || ||------系统是否支持 || ||------取指针_整数型 || ||------取指针_tagOUTPUTINFO || ||------取进程路径 || ||------修正路径 || ||------取系统目录 || ||------十六到十 || || ======调用的Dll || ||---[dll]------api_LookupPrivilegeValue || ||---[dll]------api_AdjustTokenPrivileges || ||---[dll]------api_GetCurrentProcess || ||---[dll]------api_OpenProcessToken || ||---[dll]------GetProcAddress || ||---[dll]------GetModuleHandle || ||---[dll]------TotagSymbolCode || ||---[dll]------TotagSHAREDINFO || ||---[dll]------TotagSERVERINFO || ||---[dll]------TotagHANDLEENTRY || ||---[dll]------GetVersionExA || ||---[dll]------OpenProcess || ||---[dll]------Api_GetProcessImageFileName || ||---[dll]------EnumProcessModules || ||---[dll]------GetModuleFileNameEx || ||---[dll]------CloseHandle || ||---[dll]------GetSystemDirectoryA || ||---[dll]------StrToIntEx || ||---[dll]------UnhookWindowsHookEx 调用的DLL命令: .DLL命令api_LookupPrivilegeValue,逻辑型,"advapi32.dll","LookupPrivilegeValueA" .参数lpSystemName,文本型 .参数lpName,文本型 .参数lpLuid,LuID,传址 .DLL命令api_AdjustTokenPrivileges,逻辑型,"advapi32.dll","AdjustTokenPrivileges" .参数TokenHandle,整数型 .参数DisableAllPrivileges,整数型 .参数NewState,TOKEN_PRIVILEGES,传址 .参数BufferLength,整数型 .参数PreviousState,TOKEN_PRIVILEGES,传址 .参数ReturnLength,整数型,传址 .DLL命令api_GetCurrentProcess,整数型,"kernel32.dll","GetCurrentProcess" .DLL命令api_OpenProcessToken,整数型,"advapi32.dll","OpenProcessToken" .参数ProcessHandle,整数型 .参数DesiredAccess,整数型 .参数TokenHandle,整数型,传址 .DLL命令GetProcAddress,整数型,"kernel32.dll","GetProcAddress" .参数hModule,整数型 .参数lpProcName,文本型 .DLL命令GetModuleHandle,整数型,,"GetModuleHandleA" .参数lpLibName,文本型 .DLL命令TotagSymbolCode,,"kernel32","RtlMoveMemory" .参数目的地址,tagSymbolCode,,any .参数源地址,整数型,,any .参数复制尺寸,整数型 .DLL命令TotagSHAREDINFO,,"kernel32","RtlMoveMemory" .参数目的地址,tagSHAREDINFO,,any .参数源地址,整数型,,any .参数复制尺寸,整数型 .DLL命令TotagSERVERINFO,,"kernel32","RtlMoveMemory" .参数目的地址,tagSERVERINFO,,any .参数源地址,整数型,,any .参数复制尺寸,整数型 .DLL命令TotagHANDLEENTRY,,"kernel32","RtlMoveMemory" .参数目的地址,tagHANDLEENTRY,,any .参数源地址,整数型,,any .参数复制尺寸,整数型 .DLL命令GetVersionExA,整数型,"kernel32","GetVersionExA",,在一个OSVERSIONINFO结构中载入与平台和操作系统有关的版本信息非零表示成功，零表示失败 .参数版本,版本信息_,,OSVERSIONINFO，用于装载版本信息的结构。在正式调用函数之前，必须先将这个结构的dwOSVersionInfoSize字段设为结构的大小（148）; .DLL命令OpenProcess,整数型,"kernel32.dll","OpenProcess",,将句柄返回给过程对象 .参数进程对象,整数型,,dwDesiredAccess .参数继承句柄,整数型,,bInheritHandle .参数进程标识符,整数型,,dwProcessId .DLL命令Api_GetProcessImageFileName,整数型,"psapi.dll","GetProcessImageFileNameA" .参数hProcess,整数型,,"" .参数lpImageFileName,文本型,传址,"" .参数nSize,整数型,,"" .DLL命令EnumProcessModules,整数型,"psapi.dll" .参数hProcess,整数型,,"" .参数lphModule,整数型,传址,"" .参数cb,整数型,,"" .参数lpcbNeeded,整数型,传址,"" .DLL命令GetModuleFileNameEx,整数型,"psapi.dll","GetModuleFileNameExA" .参数hProcess,整数型,,"" .参数hModule,整数型,,"" .参数lpFileName,文本型,传址,"" .参数nSize,整数型,,"" .DLL命令CloseHandle,整数型,"kernel32","CloseHandle",,关闭一个内核对象。其中包括文件、文件映射、进程、线程、安全和同步对象等。涉及文件处理时，这个函数通常与vb的close命令相似。应尽可能的使用close，因为它支持vb的差错控制。注意这个函数使用的文件句柄与vb的文件编号是完全不同的非零表示成功，零表示失败。会设置GetLastError .参数对象句柄,整数型,,欲关闭的一个对象的句柄; .DLL命令GetSystemDirectoryA,整数型,,"GetSystemDirectoryA" .参数lpbuffer,文本型 .参数nsize,整数型 .DLL命令StrToIntEx,整数型,"shlwapi.dll","StrToIntExA" .参数pszString,文本型 .参数dwFlags,整数型 .参数piRet,整数型,传址 .DLL命令UnhookWindowsHookEx,整数型,"user32.dll","UnhookWindowsHookEx",,UnhookWindowsHookEx .参数钩子句柄,整数型,,hHook