利用未公开函数实现Shell操作监视<br>作者 : TechnoFantasy<br><br> 在Windows下有一个未公开函数SHChangeNotifyRegister可以吧你的窗口添加到系统<br>的系统消息监视链中,该函数在Delphi中的定义如下:<br>Function SHChangeNotifyRegister(hWnd,uFlags,dwEventID,uMSG,cItems:LongWord;<br> lpps
IDLSTRUCT):integer;stdcall;external 'Shell32.dll' index 2;<br>其中参数hWnd定义了监视系统操作的窗口得句柄,参数uFlags dwEventID定义监视操<br>作参数,参数uMsg定义操作消息,参数cItems定义附加参数,参数lpps指定一个<br>PIDLSTRUCT结构,该结构指定监视的目录。<br><br> 当函数调用成功之后,函数会返回一个监视操作句柄,同时系统就会将hWnd指定的<br>窗口加入到操作监视链中,当有文件操作发生时,系统会向hWnd发送uMsg指定的消息,<br>我们只要在程序中加入该消息的处理函数就可以实现对系统操作的监视了。<br>如果要退出程序监视,就要调用另外一个未公开得函数SHChangeNotifyDeregister来<br>取消程序监视。<br><br> 下面是使用Delphi编写的具体程序实现范例,首先建立一个新的工程文件,然后在<br>Form1中加入一个Button控件和一个Memo控件,<br><br>程序的代码如下:<br><br>unit Unit1;<br><br>interface<br><br>uses<br><br> Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,<br><br> StdCtrls,shlobj,Activex;<br><br>const<br><br> SHCNE_RENAMEITEM = $1;<br><br> SHCNE_CREATE = $2;<br><br> SHCNE_DELETE = $4;<br><br> SHCNE_MKDIR = $8;<br><br> SHCNE_RMDIR = $10;<br><br> SHCNE_MEDIAINSERTED = $20;<br><br> SHCNE_MEDIAREMOVED = $40;<br><br> SHCNE_DRIVEREMOVED = $80;<br><br> SHCNE_DRIVEADD = $100;<br><br> SHCNE_NETSHARE = $200;<br><br> SHCNE_NETUNSHARE = $400;<br><br> SHCNE_ATTRIBUTES = $800;<br><br> SHCNE_UPDATEDIR = $1000;<br><br> SHCNE_UPDATEITEM = $2000;<br><br> SHCNE_SERVERDISCONNECT = $4000;<br><br> SHCNE_UPDATEIMAGE = $8000;<br><br> SHCNE_DRIVEADDGUI = $10000;<br><br> SHCNE_RENAMEFOLDER = $20000;<br><br> SHCNE_FREESPACE = $40000;<br><br> SHCNE_ASSOCCHANGED = $8000000;<br><br> SHCNE_DISKEVENTS = $2381F;<br><br> SHCNE_GLOBALEVENTS = $C0581E0;<br><br> SHCNE_ALLEVENTS = $7FFFFFFF;<br><br> SHCNE_INTERRUPT = $80000000;<br><br> <br><br> SHCNF_IDLIST = 0; // LPITEMIDLIST<br><br> SHCNF_PATHA = $1; // path name<br><br> SHCNF_PRINTERA = $2; // printer friendly name<br><br> SHCNF_DWORD = $3; // DWORD<br><br> SHCNF_PATHW = $5; // path name<br><br> SHCNF_PRINTERW = $6; // printer friendly name<br><br> SHCNF_TYPE = $FF;<br><br> <br><br> SHCNF_FLUSH = $1000;<br><br> <br><br> SHCNF_FLUSHNOWAIT = $2000;<br><br> SHCNF_PATH = SHCNF_PATHW;<br><br> SHCNF_PRINTER = SHCNF_PRINTERW;<br><br> <br><br> WM_SHNOTIFY = $401;<br><br> NOERROR = 0;<br><br> <br><br>type<br><br> TForm1 = class(TForm)<br><br> Button1: TButton;<br><br> Memo1: TMemo;<br><br> procedure FormClose(Sender: TObject; var Action: TCloseAction);<br><br> procedure Button1Click(Sender: TObject);<br><br> procedure FormCreate(Sender: TObject);<br><br> private<br><br> { Private declarations }<br><br> procedure WMShellReg(var Message:TMessage);message WM_SHNOTIFY;<br><br> public<br><br> { Public declarations }<br><br> end;<br><br> <br><br>type PSHNOTIFYSTRUCT=^SHNOTIFYSTRUCT;<br><br> SHNOTIFYSTRUCT = record<br><br> dwItem1 : PItemIDList;<br><br> dwItem2 : PItemIDList;<br><br> end;<br><br> <br><br>Type PSHFileInfoByte=^SHFileInfoByte;<br><br> _SHFileInfoByte = record<br><br> hIcon :Integer;<br><br> iIcon :Integer;<br><br> dwAttributes : Integer;<br><br> szDisplayName : array [0..259] of char;<br><br> szTypeName : array [0..79] of char;<br><br> end;<br><br> SHFileInfoByte=_SHFileInfoByte;<br><br>Type PIDLSTRUCT = ^IDLSTRUCT;<br><br> _IDLSTRUCT = record<br><br> pidl : PItemIDList;<br><br> bWatchSubFolders : Integer;<br><br> end;<br><br> IDLSTRUCT =_IDLSTRUCT;<br><br> <br><br>function SHNotify_Register(hWnd : Integer) : Bool;<br><br>function SHNotify_UnRegister:Bool;<br><br>function SHEventName(strPath1,strPath2:string;lParam:Integer):string;<br><br> <br><br>Function SHChangeNotifyDeregister(hNotify:integer):integer;stdcall;<br><br> external 'Shell32.dll' index 4;<br><br>Function SHChangeNotifyRegister(hWnd,uFlags,dwEventID,uMSG,cItems:LongWord;<br><br> lpps
IDLSTRUCT):integer;stdcall;external 'Shell32.dll' index 2;<br><br>Function SHGetFileInfoPidl(pidl : PItemIDList;<br><br> dwFileAttributes : Integer;<br><br> psfib : PSHFILEINFOBYTE;<br><br> cbFileInfo : Integer;<br><br> uFlags : Integer):Integer;stdcall;<br><br> external 'Shell32.dll' name 'SHGetFileInfoA';<br><br> <br><br>var<br><br> Form1: TForm1;<br><br> m_hSHNotify:Integer;<br><br> m_pidlDesktop : PItemIDList;<br><br> <br><br>implementation<br><br> <br><br>{$R *.DFM}<br><br> <br><br>function SHEventName(strPath1,strPath2:string;lParam:Integer):string;<br><br>var<br><br> sEvent:String;<br><br>begin<br><br> case lParam of file://根据参数设置提示消息<br><br> SHCNE_RENAMEITEM: sEvent := '重命名文件'+strPath1+'为'+strpath2;<br><br> SHCNE_CREATE: sEvent := '建立文件 文件名:'+strPath1;<br><br> SHCNE_DELETE: sEvent := '删除文件 文件名:'+strPath1;<br><br> SHCNE_MKDIR: sEvent := '新建目录 目录名:'+strPath1;<br><br> SHCNE_RMDIR: sEvent := '删除目录 目录名:'+strPath1;<br><br> SHCNE_MEDIAINSERTED: sEvent := strPath1+'中插入可移动存储介质';<br><br> SHCNE_MEDIAREMOVED: sEvent := strPath1+'中移去可移动存储介质'+strPath1+' '+strpath2;<br><br> SHCNE_DRIVEREMOVED: sEvent := '移去驱动器'+strPath1;<br><br> SHCNE_DRIVEADD: sEvent := '添加驱动器'+strPath1;<br><br> SHCNE_NETSHARE: sEvent := '改变目录'+strPath1+'的共享属性';<br><br> <br><br> SHCNE_ATTRIBUTES: sEvent := '改变文件目录属性 文件名'+strPath1;<br><br> SHCNE_UPDATEDIR: sEvent := '更新目录'+strPath1;<br><br> SHCNE_UPDATEITEM: sEvent := '更新文件 文件名:'+strPath1;<br><br> SHCNE_SERVERDISCONNECT: sEvent := '断开与服务器的连接'+strPath1+' '+strpath2;<br><br> SHCNE_UPDATEIMAGE: sEvent := 'SHCNE_UPDATEIMAGE';<br><br> SHCNE_DRIVEADDGUI: sEvent := 'SHCNE_DRIVEADDGUI';<br><br> SHCNE_RENAMEFOLDER: sEvent := '重命名文件夹'+strPath1+'为'+strpath2;<br><br> SHCNE_FREESPACE: sEvent := '磁盘空间大小改变';<br><br> SHCNE_ASSOCCHANGED: sEvent := '改变文件关联';<br><br> else<br><br> sEvent:='未知操作'+IntToStr(lParam);<br><br> end;<br><br> Result:=sEvent;<br><br>end;<br><br> <br><br>function SHNotify_Register(hWnd : Integer) : Bool;<br><br>var<br><br> ps
IDLSTRUCT;<br><br>begin<br><br> {$R-}<br><br> Result:=False;<br><br> If m_hSHNotify = 0 then begin<br><br> file://获取桌面文件夹的Pidl<br><br> if SHGetSpecialFolderLocation(0, CSIDL_DESKTOP,<br><br> m_pidlDesktop)<> NOERROR then<br><br> Form1.close;<br><br> if Boolean(m_pidlDesktop) then begin<br><br> ps.bWatchSubFolders := 1;<br><br> ps.pidl := m_pidlDesktop;<br><br> <br><br> // 利用SHChangeNotifyRegister函数注册系统消息处理<br><br> m_hSHNotify := SHChangeNotifyRegister(hWnd, (SHCNF_TYPE Or SHCNF_IDLIST),<br><br> (SHCNE_ALLEVENTS Or SHCNE_INTERRUPT),<br><br> WM_SHNOTIFY, 1, ps);<br><br> Result := Boolean(m_hSHNotify);<br><br> end<br><br> Else<br><br> // 如果出现错误就使用 CoTaskMemFree函数来释放句柄<br><br> CoTaskMemFree(m_pidlDesktop);<br><br> End;<br><br> {$R+}<br><br>end;<br><br> <br><br>function SHNotify_UnRegister:Bool;<br><br>begin<br><br> Result:=False;<br><br> If Boolean(m_hSHNotify) Then<br><br> file://取消系统消息监视,同时释放桌面的Pidl<br><br> If Boolean(SHChangeNotifyDeregister(m_hSHNotify)) Then begin<br><br> {$R-}<br><br> m_hSHNotify := 0;<br><br> CoTaskMemFree(m_pidlDesktop);<br><br> Result := True;<br><br> {$R-}<br><br> End;<br><br>end;<br><br>procedure TForm1.WMShellReg(var Message:TMessage); file://系统消息处理函数<br><br>var<br><br> strPath1,strPath2:String;<br><br> charPath:array[0..259]of char;<br><br> pidlItem
SHNOTIFYSTRUCT;<br><br>begin<br><br> pidlItem:=PSHNOTIFYSTRUCT(Message.wParam);<br><br> file://获得系统消息相关得路径<br><br> SHGetPathFromIDList(pidlItem.dwItem1,charPath);<br><br> strPath1:=charPath;<br><br> SHGetPathFromIDList(pidlItem.dwItem2,charPath);<br><br> strPath2:=charPath;<br><br> Memo1.Lines.Add(SHEvEntName(strPath1,strPath2,Message.lParam)+chr(13)+chr(10));<br><br>end;<br><br>procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction);<br><br>begin<br><br> file://在程序退出的同时删除监视<br><br> if Boolean(m_pidlDesktop) then<br><br> SHNotify_Unregister;<br><br>end;<br><br>procedure TForm1.Button1Click(Sender: TObject); file://Button1的Click消息<br><br>begin<br><br> m_hSHNotify:=0;<br><br> if SHNotify_Register(Form1.Handle) then begin file://注册Shell监视<br><br> ShowMessage('Shell监视程序成功注册');<br><br> Button1.Enabled := False;<br><br> end<br><br> else<br><br> ShowMessage('Shell监视程序注册失败');<br><br>end;<br><br> <br><br>procedure TForm1.FormCreate(Sender: TObject);<br><br>begin<br><br> Button1.Caption := '打开监视';<br><br>end;<br><br>end.<br><br> <br><br> 运行程序,点击“打开监视”按钮,如果出现一个显示“Shell监视程序成功注册”的对话框,说明Form1已经加入到系统操作监视链中了,你可以试着在资源管理器中建立、删除文件夹,移动文件等操作,你可以发现这些操作都被纪录下来并显示在文本框中。<br><br> 在上面的程序中多次使用到了一个PItemIDList的结构,这个数据结构指定Windows下得一个“项目”,在Windows下资源实现统一管理一个“项目”可以是一个文件或者一个文件夹,也可以是一个打印机等资源。另外一些API函数也涉及到了Shell(Windows外壳)操作,各位读者可以参考相应的参考资料。<br><br> <br><br> <br>