+ All Categories
Home > Documents > Visual Basic - Subclassing and Hooking with VB & VB NET

Visual Basic - Subclassing and Hooking with VB & VB NET

Date post: 08-Dec-2016
Category:
Upload: dinhdat
View: 230 times
Download: 8 times
Share this document with a friend
687
Transcript
Page 1: Visual Basic - Subclassing and Hooking with VB & VB NET

Page 2: Visual Basic - Subclassing and Hooking with VB & VB NET

6XEFODVVLQJ�DQG�+RRNLQJ�ZLWK�9LVXDO�%DVLF��3UHIDFH����:KR�7KLV�%RRN�,V�)RU����+RZ�7KLV�%RRN�,V�6WUXFWXUHG����2EWDLQLQJ�WKH�6DPSOH�&RGH����&RQYHQWLRQV�8VHG�LQ�7KLV�%RRN����+RZ�WR�&RQWDFW�8V����$FNQRZOHGJPHQWV��,��,QWURGXFLQJ�6XEFODVVLQJ�DQG�+RRNLQJ�����,QWURGXFWLRQ��������6XEFODVVLQJ���������7KH�:LQGRZ�+RRNLQJ�0HFKDQLVP��������7RROV�WR�$LG�8V�LQ�2XU�(IIRUWV��������$�:RUG�RI�:DUQLQJ�����:LQGRZV�6\VWHP�6SHFLILF�,QIRUPDWLRQ��������,QVLGH�D�:LQGRZV�$SSOLFDWLRQ��������,QVLGH�WKH�:LQGRZV�0HVVDJLQJ�6\VWHP��������3HUIRUPDQFH�&RQVLGHUDWLRQV�����7KH�%DVLFV�RI�6XEFODVVLQJ�DQG�+RRNV��������:KDW�,V�6XEFODVVLQJ"��������:KDW�$UH�+RRNV"��,,��6XEFODVVLQJ�DQG�6XSHUFODVVLQJ�����6XEFODVVLQJ��������7KH�$GGUHVV2I�2SHUDWRU��������6RPH�6XEFODVVLQJ�7LSV��������,QVWDQFH�6XEFODVVLQJ��$Q�([DPSOH��������*OREDO�6XEFODVVLQJ��������6XPPDU\�RI�.H\�3RLQWV�LQ�6XEFODVVLQJ�����6XEFODVVLQJ�WKH�:LQGRZV�&RPPRQ�'LDORJ�%R[HV��������+RZ�&RPPRQ�'LDORJ�%R[6XEFODVVLQJ�:RUNV�

Page 3: Visual Basic - Subclassing and Hooking with VB & VB NET

�������8VLQJ�WKH�5HVRXUFH��������&UHDWLQJ�WKH�6XEFODVVLQJ�$SSOLFDWLRQ��������6XEFODVVLQJ�&RPPRQ�'LDORJ�%R[HV�2WKHU�7KDQ�2SHQ�DQG�6DYH�$V��������3UREOHPV�6XEFODVVLQJ�WKH�)LQG�DQG�5HSODFH�&RPPRQ�'LDORJV�����$FWLYH;�&RQWUROV�DQG�6XEFODVVLQJ��������6XEFODVVLQJ�D�7KLUG�3DUW\$FWLYH;�&RQWURO��������6XEFODVVLQJ�DQ�$FWLYH;�&RQWURO&UHDWHG�LQ�9%���������6XEFODVVLQJ�D�8VHU&RQWURO�IURP�:LWKLQ�D�9%�&UHDWHG�$FWLYH;�&RQWURO��������&UHDWLQJ�DQ�$FWLYH;�&RQWURO�7KDW�6XEFODVVHV�2WKHU�:LQGRZV�����6XSHUFODVVLQJ��������:KDW�,V�6XSHUFODVVLQJ"��������+RZ�WKH�6XSHUFODVVLQJ�([DPSOH�:RUNV��������3HHULQJ�LQWR�WKH�6XSHUFODVVLQJ�$SSOLFDWLRQ�ZLWK�6S\�������'HEXJJLQJ�7HFKQLTXHV�IRU�6XEFODVVLQJ��������:KHUH�WR�6WDUW��������0LFURVRIW�7RROV��������1X0HJDV�6PDUW&KHFN��,,,��+RRNLQJ�����:+B&$//:1'352&��������+RZ�:+B&$//:1'352&�:RUNV��������$�7KUHDG�6SHFLILF�([DPSOH��������&DYHDWV������:+B&$//:1'352&5(7���������+RZ�:+B&$//:1'352&5(7�:RUNV���������$�7KUHDG�6SHFLILF�([DPSOH���������&DYHDWV������:+B*(70(66$*(���������+RZ�:+B*(70(66$*(�:RUNV���������$�7KUHDG�6SHFLILF�([DPSOH���������&DYHDWV������:+B.(<%2$5'�DQG�:+B.(<%2$5'B//���������+RZ�.H\ERDUG�0HVVDJLQJ�2SHUDWHV�

Page 4: Visual Basic - Subclassing and Hooking with VB & VB NET

��������'HVFULSWLRQ�RI�+RRNV���������$�7KUHDG�6SHFLILF�([DPSOH���������$�6\VWHP�:LGH�([DPSOH���������$�/RZ�/HYHO�+RRN�([DPSOH���������&DYHDWV������:+B0286(�DQG�:+B0286(B//���������+RZ�0RXVH�0HVVDJLQJ�2SHUDWHV���������'HVFULSWLRQ�RI�+RRNV���������/RFDWLRQ�RI�7KLV�+RRN�LQ�WKH�6\VWHP���������$�6LQJOH�7KUHDG�([DPSOH���������$�6\VWHP�:LGH�+RRN�([DPSOH���������&DYHDWV������:+B)25(*5281','/(���������'HVFULSWLRQ���������/RFDWLRQ�RI�7KLV�+RRN�LQ�WKH�6\VWHP���������%DFNJURXQG�3URFHVVLQJ�([DPSOH���������&DYHDWV������:+B06*),/7(5���������'HVFULSWLRQ���������$�7KUHDG�6SHFLILF�([DPSOH���������&DYHDWV������:+B6<606*),/7(5���������'HVFULSWLRQ���������$�6\VWHP�:LGH�([DPSOH���������&DYHDWV������:+B6+(//���������'HVFULSWLRQ���������/RFDWLRQ�RI�7KLV�+RRN�LQ�WKH�6\VWHP���������$�7KUHDG�6SHFLILF�([DPSOH���������&DYHDWV������:+B&%7���������'HVFULSWLRQ���������$�7KUHDG�6SHFLILF�([DPSOH���������&DYHDWV�

Page 5: Visual Basic - Subclassing and Hooking with VB & VB NET

�����:+B-2851$/5(&25'���������'HVFULSWLRQ���������7KH�0DFUR�5HFRUGHU�([DPSOH���������&DYHDWV������:+B-2851$/3/$<%$&.���������'HVFULSWLRQ���������7KH�0DFUR�5HFRUGHU�3OD\EDFN�([DPSOH���������&DYHDWV������:+B'(%8*���������'HVFULSWLRQ���������$�7KUHDG�6SHFLILF�([DPSOH���������6RPH�:+B'(%8*�6FHQDULRV���������&DYHDWV��,9��7KH��1(7�3ODWIRUP������6XEFODVVLQJ��1(7�:LQ)RUPV���������:KDW�,V�D�:LQ)RUP"���������,QVWDQFH�6XEFODVVLQJ���������6XEFODVVLQJ�D�&RQWURO���������6XSHUFODVVLQJ���������6XSHUFODVVLQJ�D�&RQWURO���������,QWHUFHSWLQJ�.H\VWURNHV�LQ�D�:LQ)RUP���������%HKLQG�WKH�6FHQHV�ZLWK�6S\��������,PSOHPHQWLQJ�+RRNV�LQ�9%�1(7���������+RRNV�DQG�9%�1(7���������'HOHJDWHV���������,PSOHPHQWLQJ�WKH�:+B.(<%2$5'�+RRN���������,PSOHPHQWLQJ�WKH�:+B0286(�+RRN��9��$SSHQGL[HV��$��0HVVDJHV����$���:LQGRZ�0HVVDJHV����$���%XWWRQ�&RQWURO�6SHFLILF�0HVVDJHV����$���&RPER�%R[�6SHFLILF�0HVVDJHV�

Page 6: Visual Basic - Subclassing and Hooking with VB & VB NET

���$���(GLW�&RQWURO�6SHFLILF�0HVVDJHV����$���/LVWER[�6SHFLILF�0HVVDJHV����$���6FUROO�%DU�6SHFLILF�0HVVDJHV����$���0HVVDJHV�6SHFLILF�WR�WKH�&RPPRQ'LDORJ�%R[HV����$���0HVVDJHV�6SHFLILF�WR�WKH�)RQW�&RPPRQ�'LDORJ�%R[����$���0HVVDJHV�6SHFLILF�WR�WKH�3DJH�6HWXS�&RPPRQ�'LDORJ�%R[��%��$3,�)XQFWLRQV��&��6WUXFWXUHV�DQG�&RQVWDQWV����&���&RQVWDQWV��&RORSKRQ�

Page 7: Visual Basic - Subclassing and Hooking with VB & VB NET

3UHIDFH�,�FDPH�DERXW�WKH�LGHD�WR�ZULWH�WKLV�ERRN�ZKHQ�,�QRWLFHG�WKDW�WKHUH�ZDV�QR�RQH�SODFH�\RX�FRXOG�JR�WR�OHDUQ�DERXW�VXEFODVVLQJ�DQG�KRRNLQJ��2ULJLQDOO\��WKHVH�WZR�VXEMHFWV�ZHUH�JHDUHG�WRZDUG�PRUH�DGYDQFHG�&���GHYHORSHUV��9LVXDO�%DVLF��9%��GHYHORSHUV�ZHUH�QHYHU�DEOH�WR�XVH�HLWKHU�RI�WKHVH�WHFKQLTXHV�LQ�D�SXUH�9%�VROXWLRQ�XQWLO�WKH�DGYHQW�RI�9HUVLRQV���DQG����ZKHQ�WKH�ODQJXDJH�DOORZHG�GHYHORSHUV�WR�WDS�LQWR�VXEFODVVLQJ�DQG�KRRNLQJ�WHFKQLTXHV��8QIRUWXQDWHO\��WKHUH�UHPDLQHG�D�SUREOHP�RI�LQVXIILFLHQW�LQIRUPDWLRQ�WR�KHOS�WKH�9%�GHYHORSHU�XQGHUVWDQG�KRZ��ZKHQ��ZKHUH��DQG�ZK\�WR�XVH�WKHVH�WHFKQLTXHV���,Q�GRLQJ�VRPH�UHVHDUFK��,�FDPH�WR�WKH�UHDOL]DWLRQ�WKDW�IHZ�9%�GHYHORSHUV�KDG�D�VROLG�JUDVS�RI�WKHVH�WHFKQLTXHV��,Q�IDFW��WKHVH�WHFKQLTXHV�ZHUH�EHLQJ�XQGHUXVHG�DQG�HYHQ�PLVXVHG��'HYHORSHUV�ZHUH�FUHDWLQJ�LQFUHGLEO\�FRPSOH[�DQG�KDUG�WR�PDLQWDLQ�FRGH��FRGH�WKDW�FRXOG�EH�JUHDWO\�VLPSOLILHG�LI�WKH�SURJUDPPHU�KDG�RQO\�WDNHQ�DGYDQWDJH�RI�VXEFODVVLQJ��KRRNLQJ��RU�HYHQ�ERWK�WHFKQLTXHV�LQ�WDQGHP��7KLV�ERRN�LV�PHDQW�QRW�RQO\�WR�WHDFK�VXEFODVVLQJ�DQG�KRRNLQJ�WHFKQLTXHV��EXW�DOVR�WR�EH�D�VLQJOH�UHVRXUFH�IURP�ZKLFK�GHYHORSHUV�FDQ�JHW�LQIRUPDWLRQ�DQG�DQVZHUV�WR�WKHLU�TXHVWLRQV�DERXW�WKHVH�WHFKQLTXHV���

:KR�7KLV�%RRN�,V�)RU�

7KLV�ERRN�LV�IRU�WKH�9%�GHYHORSHU�ZKR�ZDQWV�D�EHWWHU�XQGHUVWDQGLQJ�RI�VXEFODVVLQJ�DQG�KRRNLQJ��DV�ZHOO�DV�NQRZOHGJH�RI�KRZ�WR�LQFRUSRUDWH�WKHVH�WHFKQLTXHV�LQWR�KLV�SURMHFWV��<RX�QHHG�QRW�EH�DQ�DGYDQFHG�9%�GHYHORSHU�WR�OHDUQ�KRZ�WR�HIIHFWLYHO\�XVH�VXEFODVVLQJ�DQG�KRRNLQJ��7KH�EHJLQQLQJ�RI�WKLV�ERRN�OD\V�D�VROLG�IRXQGDWLRQ�WKDW�ZLOO�EULQJ�WKH�EHJLQQLQJ�RU�LQWHUPHGLDWH�GHYHORSHU�XS�WR�VSHHG���,Q�XQGHUVWDQGLQJ�VXEFODVVLQJ�DQG�KRRNLQJ��\RX�PXVW�GHOYH�GHHS�LQWR�WKH�LQWHUQDOV�RI�WKH�:LQGRZV�RSHUDWLQJ�V\VWHP��7KLV�GHHSHU�XQGHUVWDQGLQJ�RI�:LQGRZV�HQDEOHV�\RX�QRW�RQO\�WR�JDLQ�DQ�XQGHUVWDQGLQJ�RI�VXEFODVVLQJ�DQG�KRRNLQJ��EXW�DOVR�WR�OHDUQ�PRUH�DERXW�WKH�PHVVDJLQJ�V\VWHP��ZKLFK�LV�WKH�KHDUW�RI�WKH�:LQGRZV�RSHUDWLQJ�V\VWHP��,Q�WKH�SURFHVV��\RXOO�EHFRPH�D�EHWWHU�SURJUDPPHU�ZKHWKHU�RU�QRW�\RX�FRPPRQO\�XVH�VXEFODVVLQJ�DQG�KRRNLQJ�LQ�\RXU�DSSOLFDWLRQV���<RX�ZLOO�QHHG�WR�XWLOL]H�PDQ\�RI�WKH�:LQ���DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IXQFWLRQV�WR�ZULWH�VXEFODVVLQJ�DQG�KRRNLQJ�DSSOLFDWLRQV��7KHUHIRUH��D�JRRG�NQRZOHGJH�RI�WKH�:LQ���$3,�IXQFWLRQV�DQG�KRZ�WKH\�DUH�XVHG�ZLWKLQ�9%�LV�QHFHVVDU\��<RX�FDQ�ILQG�GHILQLWLRQV�IRU�PRVW�RI�WKHVH�$3,�IXQFWLRQV��FRQVWDQWV��DQG�VWUXFWXUHV�XVLQJ�WKH�$3,�7H[W�9LHZHU��ZKLFK�VKLSV�ZLWK�9LVXDO�6WXGLR����+RZHYHU��VHYHUDO�$3,�IXQFWLRQV��FRQVWDQWV��DQG�VWUXFWXUH�GHILQLWLRQV�DUH�PLVVLQJ�IURP�WKLV�YLHZHU��<RX�FDQ�ILQG�WKLV�PLVVLQJ�LQIRUPDWLRQ�E\�VHDUFKLQJ�WKURXJK�ERWK�WKH�&���:LQGRZV�K�DQG�:LQ8VHU�K�KHDGHU�ILOHV��$GGLWLRQDOO\��,�KDYH�SURYLGHG�GHILQLWLRQV�IRU�WKH�

Page 8: Visual Basic - Subclassing and Hooking with VB & VB NET

YDULRXV�$3,�IXQFWLRQV��FRQVWDQWV��DQG�VWUXFWXUHV�XVHG�ZLWKLQ�WKLV�ERRN�LQ�$SSHQGL[�$��$SSHQGL[�$��DQG�$SSHQGL[�$���,�ZLOO�IRFXV�RQ�XVLQJ�WKH�9LVXDO�%DVLF�ODQJXDJH�LQ�WKLV�ERRN��$OO�WKH�VXEFODVVLQJ�FRGH�DQG�PRVW�RI�WKH�KRRNLQJ�FRGH�ZLOO�EH�ZULWWHQ�LQ�9%��7KH�OLPLWDWLRQV�RI�9%�FRPH�LQWR�SOD\�ZKHQ�GHYHORSHUV�WU\�WR�ZULWH�V\VWHP�ZLGH�KRRNV��6\VWHP�ZLGH�KRRNV�UHTXLUH�D�WUXH�:LQ���G\QDPLF�OLQN�OLEUDU\��'//��WR�EH�FUHDWHG��VRPHWKLQJ�WKDW�9%�GRHV�QRW�VXSSRUW��LW�HQDEOHV�\RX�WR�JHQHUDWH�RQO\�&20�'//V���9LVXDO�&���ZLOO�HQWHU�WKH�SLFWXUH�DW�WKLV�SRLQW��7KH�9LVXDO�&���FRGH�ZLOO�EH�NHSW�WR�D�PLQLPXP�VR�WKDW�\RX�FDQ�IRFXV�RQ�XVLQJ�9%�WR�LPSOHPHQW�KRRNV���7KH�FRGH�LQ�WKLV�ERRN�ZDV�ZULWWHQ�DQG�WHVWHG�XVLQJ�9LVXDO�%DVLF�9HUVLRQ���6HUYLFH�3DFN����9LVXDO�%DVLF�1(7�%HWD����DQG�9LVXDO�&���9HUVLRQ���6HUYLFH�3DFN����7KH�IROORZLQJ�RSHUDWLQJ�V\VWHPV�ZHUH�XVHG�ZKLOH�ZULWLQJ�WKLV�ERRN�DQG�LWV�H[DPSOHV��:LQGRZV�����:LQGRZV�17���6HUYLFH�3DFN����DQG�:LQGRZV������6HUYLFH�3DFN����7KHUH�DUH�VXEWOH�GLIIHUHQFHV�LQ�WKHVH�RSHUDWLQJ�V\VWHPV�WKDW�DIIHFW�KRZ�VXEFODVVLQJ�DQG�KRRNLQJ�RSHUDWH�RQ�HDFK�V\VWHP��7KHVH�GLIIHUHQFHV�DUH�QRWHG�LQ�WKLV�ERRN�ZKHUHYHU�WKH\�ZLOO�DIIHFW�WKH�GHYHORSHU��

+RZ�7KLV�%RRN�,V�6WUXFWXUHG�

7KLV�ERRN�LV�JURXSHG�LQWR�IRXU�GLVWLQFW�VHFWLRQV��7KH�ILUVW�LV�WKH�LQWURGXFWRU\�VHFWLRQ��ZKLFK�FRQWDLQV�LQIRUPDWLRQ�DERXW�WKH�:LQGRZV�RSHUDWLQJ�V\VWHP�DQG�WKH�EDVLFV�RI�VXEFODVVLQJ�DQG�KRRNLQJ��7KLV�VHFWLRQ�OD\V�WKH�IRXQGDWLRQ�WKDW�ZLOO�HQDEOH�\RX�WR�FRPSOHWHO\�JUDVS�WKH�UHVW�RI�WKH�PDWHULDO�LQ�WKLV�ERRN��7KLV�VHFWLRQ�FRQWDLQV�WKH�IROORZLQJ�FKDSWHUV���Chapter 1

7KLV�FKDSWHU�GHILQHV�VXEFODVVLQJ�DQG�KRRNLQJ�DQG�JLYHV�VHYHUDO�H[DPSOHV�RI�KRZ�HDFK�FDQ�EH�XVHG�HIIHFWLYHO\��,Q�DGGLWLRQ��WKH�WRROV�XVHG�LQ�WKLV�ERRN�DUH�H[SODLQHG��7KH�WRROV�LQFOXGH�WKH�IROORZLQJ���

• 6S\����ZKLFK�HQDEOHV�XV�WR�YLHZ�LQIRUPDWLRQ�DERXW�SURFHVVHV��ZLQGRZV��DQG�PHVVDJHV��7KLV�WRRO�FRPHV�DV�SDUW�RI�WKH�9LVXDO�6WXGLR�9HUVLRQ���GHYHORSPHQW�HQYLURQPHQW���

• 7KH�'EJZSURF�GOO�'//��ZKLFK�HQDEOHV�XV�WR�PRUH�HDVLO\�GHEXJ�VXEFODVVLQJ�FRGH�ZLWKLQ�SURMHFWV�ZULWWHQ�LQ�9HUVLRQV���RU���RI�9%��7KLV�WRRO�FDQ�EH�GRZQORDGHG�IURP�KWWS���PVGQ�PLFURVRIW�FRP�YEDVLF�GRZQORDGV�FRQWUROV�DVS���

• 0LFURVRIW�6\VWHP�,QIRUPDWLRQ��ZKLFK�HQDEOHV�XV�WR�VHH�WKH�LQVWDOOHG�KRRNV�LQ�D�:LQGRZV����V\VWHP��7KLV�WRRO�FDQ�EH�DFFHVVHG�IURP�WKH�+HOS� $ERXW�0LFURVRIW�9LVXDO�%DVLF����PHQX�LWHP�RQ�WKH�9LVXDO�%DVLF�PDLQ�PHQX�EDU��:KHQ�WKH�$ERXW�GLDORJ�ER[�DSSHDUV��FOLFN�WKH�6\VWHP�,QIR����EXWWRQ�WR�YLHZ�WKH�0LFURVRIW�6\VWHP�,QIRUPDWLRQ�WRRO���

• 6PDUW&KHFN��GHYHORSHG�E\�&RPSXZDUH�1XPHJD�/DEV��ZKLFK�HQDEOHV�XV�WR�ZDWFK�XQGHU�WKH�KRRG�DV�D�9%�SURMHFW�UXQV��$����GD\�WULDO�YHUVLRQ�RI�WKLV�

Page 9: Visual Basic - Subclassing and Hooking with VB & VB NET

VRIWZDUH�LV�DYDLODEOH�IURP�&RPSXZDUH�1XPHJD�/DEV�DW�KWWS���ZZZ�QXPHJD�FRP�HYDOXDWLRQV�GHIDXOW�DVS���

Chapter 2

7KLV�FKDSWHU�FRQWDLQV�LQIRUPDWLRQ�RQ�:LQGRZV�SURFHVVHV��WKUHDGV��ZLQGRZV��DQG�PHVVDJLQJ�V\VWHP��DV�ZHOO�DV�KRZ�WKH\�UHODWH�WR�VXEFODVVLQJ�DQG�KRRNLQJ���

Chapter 3

7KLV�FKDSWHU�VWDUWV�RXW�ZLWK�D�GLVFXVVLRQ�RI�KRZ�VXEFODVVLQJ�RSHUDWHV�DQG�WKH�GLIIHUHQW�W\SHV�RI�VXEFODVVLQJ�DW�\RXU�GLVSRVDO��DQG�LV�IROORZHG�E\�D�GLVFXVVLRQ�RI�KRZ�KRRNLQJ�RSHUDWHV��)LQDOO\��WKH�SURV�DQG�FRQV�RI�XVLQJ�VXEFODVVLQJ�DQG�KRRNV�DUH�ODLG�RXW�IRU�\RX���

7KH�VHFRQG�VHFWLRQ�FRYHUV�WKH�WHFKQLTXH�RI�VXEFODVVLQJ�DQG�LWV�YDULDWLRQV��7KH�SURFHVV�RI�VXEFODVVLQJ�9%�IRUPV�LV�GLVFXVVHG��DORQJ�ZLWK�VXEFODVVLQJ�FRQWUROV��FRPPRQ�GLDORJ�ER[HV��DQG�$FWLYH;�FRQWUROV�WKDW�\RX�FUHDWH��$GGLQJ�WR�WKLV��JOREDO�VXEFODVVLQJ�DQG�VXSHUFODVVLQJ�DUH�GLVFXVVHG�DW�OHQJWK��DORQJ�ZLWK�GHEXJJLQJ�\RXU�VXEFODVVLQJ�FRGH��7KLV�VHFWLRQ�FRQWDLQV�WKH�IROORZLQJ�FKDSWHUV���Chapter 4

$�GLVFXVVLRQ�RI�WKH�$GGUHVV2I�RSHUDWRU�LV�SUHVHQWHG�ILUVW��IROORZHG�E\�DQ�LQ�GHSWK�GLVFXVVLRQ�RI�WKH�YDULRXV�W\SHV�RI�VXEFODVVLQJ��DORQJ�ZLWK�H[DPSOHV�RI�HDFK�W\SH��7LSV�IRU�XVLQJ�VXEFODVVLQJ�DUH�SUHVHQWHG�WKURXJKRXW�WKLV�FKDSWHU���

Chapter 5

$�FUDVK�FRXUVH�RQ�XVLQJ�WKH�:LQGRZV�&RPPRQ�'LDORJ�$3,V�LV�SUHVHQWHG�ILUVW��1H[W��WKH�WHFKQLTXH�RI�VXEFODVVLQJ�WKH�2SHQ�DQG�6DYH�$V�FRPPRQ�GLDORJV�LV�GLVFXVVHG�DQG�H[DPSOHV�DUH�SURYLGHG��)LQDOO\��WKH�FKDSWHU�ILQLVKHV�ZLWK�D�GLVFXVVLRQ�RI�VXEFODVVLQJ�HDFK�RI�WKH�RWKHU�FRPPRQ�GLDORJV���

Chapter 6

7KLV�FKDSWHU�GLVFXVVHV�KRZ�WR�VXEFODVV�D�WKLUG�SDUW\�$FWLYH;�FRQWURO�DQG�DQ�$FWLYH;�FRQWURO�WKDW�ZH�FUHDWH�LQ�9%��1H[W�IROORZV�D�GLVFXVVLRQ�RI�VXEFODVVLQJ�D�8VHU&RQWURO�IURP�ZLWKLQ�DQ�$FWLYH;�FRQWURO�WKDW�LV�FUHDWHG�LQ�9%��7KLV�FKDSWHU�ILQLVKHV�E\�FUHDWLQJ�DQ�$FWLYH;�FRQWURO�WKDW�LV�XVHG�WR�VXEFODVV�D�9%�IRUP���

Chapter 7

7KH�WHFKQLTXH�RI�VXSHUFODVVLQJ�D�ZLQGRZ�LV�GLVFXVVHG�DQG�H[DPSOHV�DUH�SURYLGHG��DQG�WKH�GLIIHUHQFHV�DQG�VLPLODULWLHV�EHWZHHQ�VXSHUFODVVLQJ�DQG�RWKHU�W\SHV�RI�VXEFODVVLQJ�DUH�QRWHG���

Chapter 8

7KLV�FKDSWHU�SUHVHQWV�YDULRXV�WHFKQLTXHV�XVHG�WR�GHEXJ�\RXU�VXEFODVVLQJ�DSSOLFDWLRQ��$ORQJ�ZLWK�WKLV�GLVFXVVLRQ��VHYHUDO�RI�WKH�SUHYLRXVO\�PHQWLRQHG�WRROV�DUH�GLVFXVVHG�LQ�PRUH�GHWDLO���

7KH�WKLUG�VHFWLRQ�FRYHUV�WKH�WHFKQLTXH�RI�KRRNLQJ��)LIWHHQ�GLIIHUHQW�W\SHV�RI�KRRNV�DUH�GLVFXVVHG��HDFK�LQ�LWV�RZQ�FKDSWHU��H[FHSW�IRU�WKH�PRXVH�DQG�ORZ�OHYHO�NH\ERDUG�KRRNV��ZKLFK�DUH�JURXSHG�ZLWK�WKH�UHJXODU�PRXVH�DQG�NH\ERDUG�KRRNV��UHVSHFWLYHO\���7KLV�VHFWLRQ�FRQWDLQV�WKH�IROORZLQJ�FKDSWHUV���

Page 10: Visual Basic - Subclassing and Hooking with VB & VB NET

Chapter 9

7KH�:+B&$//:1'352&�KRRN�LV�SUHVHQWHG�LQ�WKLV�FKDSWHU��DORQJ�ZLWK�GHWDLOV�RI�LWV�RSHUDWLRQ��H[DPSOHV��DQG�WKLQJV�WR�ZDWFK�RXW�IRU�ZKHQ�XVLQJ�LW���

Chapter 10

7KH�:+B&$//:1'352&5(7�KRRN�LV�SUHVHQWHG�LQ�WKLV�FKDSWHU��DORQJ�ZLWK�GHWDLOV�RI�LWV�RSHUDWLRQ��H[DPSOHV��DQG�WKLQJV�WR�ZDWFK�RXW�IRU�ZKHQ�XVLQJ�LW���

Chapter 11

7KH�:+B*(70(66$*(�KRRN�LV�SUHVHQWHG�LQ�WKLV�FKDSWHU��DORQJ�ZLWK�GHWDLOV�RI�LWV�RSHUDWLRQ��H[DPSOHV��DQG�WKLQJV�WR�ZDWFK�RXW�IRU�ZKHQ�XVLQJ�LW���

Chapter 12

7KH�:+B.(<%2$5'�DQG�:+B.(<%2$5'B//�KRRNV�DUH�SUHVHQWHG�LQ�WKLV�FKDSWHU��DORQJ�ZLWK�GHWDLOV�RI�WKHLU�RSHUDWLRQ��H[DPSOHV��DQG�WKLQJV�WR�ZDWFK�RXW�IRU�ZKHQ�XVLQJ�WKHP���

Chapter 13

7KH�:+B0286(�DQG�:+B0286(B//�KRRNV�DUH�SUHVHQWHG�LQ�WKLV�FKDSWHU��DORQJ�ZLWK�GHWDLOV�RI�WKHLU�RSHUDWLRQ��H[DPSOHV��DQG�WKLQJV�WR�ZDWFK�RXW�IRU�ZKHQ�XVLQJ�WKHP���

Chapter 14

7KH�:+B)25(*5281','/(�KRRN�LV�SUHVHQWHG�LQ�WKLV�FKDSWHU��DORQJ�ZLWK�GHWDLOV�RI�LWV�RSHUDWLRQ��H[DPSOHV��DQG�WKLQJV�WR�ZDWFK�RXW�IRU�ZKHQ�XVLQJ�LW���

Chapter 15

7KH�:+B06*),/7(5�KRRN�LV�SUHVHQWHG�LQ�WKLV�FKDSWHU��DORQJ�ZLWK�GHWDLOV�RI�LWV�RSHUDWLRQ��H[DPSOHV��DQG�WKLQJV�WR�ZDWFK�RXW�IRU�ZKHQ�XVLQJ�LW���

Chapter 16

7KH�:+B6<606*),/7(5�KRRN�LV�SUHVHQWHG�LQ�WKLV�FKDSWHU��DORQJ�ZLWK�GHWDLOV�RI�LWV�RSHUDWLRQ��H[DPSOHV��DQG�WKLQJV�WR�ZDWFK�RXW�IRU�ZKHQ�XVLQJ�LW���

Chapter 17

7KH�:+B6+(//�KRRN�LV�SUHVHQWHG�LQ�WKLV�FKDSWHU��DORQJ�ZLWK�GHWDLOV�RI�LWV�RSHUDWLRQ��H[DPSOHV��DQG�WKLQJV�WR�ZDWFK�RXW�IRU�ZKHQ�XVLQJ�LW���

Chapter 18

7KH�:+B&%7�KRRN�LV�SUHVHQWHG�LQ�WKLV�FKDSWHU��DORQJ�ZLWK�GHWDLOV�RI�LWV�RSHUDWLRQ��H[DPSOHV��DQG�WKLQJV�WR�ZDWFK�RXW�IRU�ZKHQ�XVLQJ�LW���

Chapter 19

7KH�:+B-2851$/5(&25'�KRRN�LV�SUHVHQWHG�LQ�WKLV�FKDSWHU��DORQJ�ZLWK�GHWDLOV�RI�LWV�RSHUDWLRQ��H[DPSOHV��DQG�WKLQJV�WR�ZDWFK�RXW�IRU�ZKHQ�XVLQJ�LW���

Chapter 20

7KH�:+B-2851$/3/$<%$&.�KRRN�LV�SUHVHQWHG�LQ�WKLV�FKDSWHU��DORQJ�ZLWK�GHWDLOV�RI�LWV�RSHUDWLRQ��H[DPSOHV��DQG�WKLQJV�WR�ZDWFK�RXW�IRU�ZKHQ�XVLQJ�LW��$�GLVFXVVLRQ�RI�KRZ�WKLV�KRRN�LV�XVHG�LQ�WDQGHP�ZLWK�WKH�:+B-2851$/5(&25'�KRRN�DOVR�LV�SURYLGHG���

Chapter 21

7KH�:+B'(%8*�KRRN�LV�SUHVHQWHG�LQ�WKLV�FKDSWHU��DORQJ�ZLWK�GHWDLOV�RI�LWV�RSHUDWLRQ��H[DPSOHV��DQG�WKLQJV�WR�ZDWFK�RXW�IRU�ZKHQ�XVLQJ�LW��$OVR�GLVFXVVHG�DUH�ZD\V�WR�HQKDQFH�WKH�GHEXJJLQJ�RI�KRRNV�LQ�\RXU�DSSOLFDWLRQV���

Page 11: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�IRXUWK�DQG�ILQDO�VHFWLRQ�FRYHUV�WKH�WHFKQLTXHV�RI�VXEFODVVLQJ�DQG�KRRNLQJ�DV�WKH\�DSSO\�WR�WKH�QHZ�9%�1(7�ODQJXDJH��7KLV�VHFWLRQ�FRQWDLQV�WKH�IROORZLQJ�FKDSWHUV���Chapter 22

7KH�YDULRXV�WHFKQLTXHV�RI�VXEFODVVLQJ�XVLQJ�WKH�QHZ�9%�1(7�ODQJXDJH�DUH�SUHVHQWHG�LQ�WKLV�FKDSWHU��DORQJ�ZLWK�H[DPSOHV���

Chapter 23

7KLV�FKDSWHU�GLVFXVVHV�KRZ�WR�XVH�KRRNV�ZLWK�WKH�QHZ�9%�1(7�ODQJXDJH��([DPSOHV�XVLQJ�YDULRXV�KRRNV�DOVR�DUH�SURYLGHG��

2EWDLQLQJ�WKH�6DPSOH�&RGH�

7KH�H[DPSOH�9%�VRXUFH�FRGH�IURP�6XEFODVVLQJ�DQG�+RRNLQJ�ZLWK�9LVXDO�%DVLF�LV�IUHHO\�GRZQORDGDEOH�IURP�WKH�25HLOO\��$VVRFLDWHV�ZHE�VLWH�DW�YE�RUHLOO\�FRP��-XVW�IROORZ�WKH�OLQN�WR�WKH�ERRNV�WLWOH�SDJH�DQG�WKHQ�FOLFN�WKH�([DPSOHV�OLQN��7KH�GRZQORDGDEOH�FRGH�ZLOO�EH�XSGDWHG�WR�UHIOHFW�WKH�PRVW�UHFHQW�EHWD�RU�SURGXFWLRQ�UHOHDVH�RI�WKH�9%�1(7�SODWIRUP��

&RQYHQWLRQV�8VHG�LQ�7KLV�%RRN�

7KURXJKRXW�WKLV�ERRN��ZH�KDYH�XVHG�WKH�IROORZLQJ�W\SRJUDSKLF�FRQYHQWLRQV���Constant width

,QGLFDWHV�D�ODQJXDJH�FRQVWUXFW�VXFK�DV�D�ODQJXDJH�VWDWHPHQW��D�FRQVWDQW��RU�DQ�H[SUHVVLRQ��,QWHUIDFH�QDPHV�DSSHDU�LQ�FRQVWDQW�ZLGWK��/LQHV�RI�FRGH�DOVR�DSSHDU�LQ�FRQVWDQW�ZLGWK��DV�GR�IXQFWLRQ�DQG�PHWKRG�SURWRW\SHV���

&RQVWDQW�ZLGWK�EROG�,QGLFDWHV�XVHU�LQSXW�LQ�FRGH�VHFWLRQV��

Italic

5HSUHVHQWV�LQWULQVLF�DQG�DSSOLFDWLRQ�GHILQHG�IXQFWLRQV��WKH�QDPHV�RI�V\VWHP�HOHPHQWV�VXFK�DV�GLUHFWRULHV�DQG�ILOHV��DQG�,QWHUQHW�UHVRXUFHV�VXFK�DV�ZHE�GRFXPHQWV��1HZ�WHUPV�DOVR�DUH�LWDOLFL]HG�ZKHQ�WKH\�DUH�ILUVW�LQWURGXFHG���

&RQVWDQW�ZLGWK�LWDOLF

,QGLFDWHV�UHSODFHDEOH�SDUDPHWHU�QDPHV�LQ�SURWRW\SHV�RU�FRPPDQG�V\QWD[��DQG�LQGLFDWHV�YDULDEOH�DQG�SDUDPHWHU�QDPHV�LQ�ERG\�WH[W���

�7KLV�LFRQ�GHVLJQDWHV�D�QRWH��ZKLFK�LV�DQ�LPSRUWDQW�DVLGH�WR�WKH�QHDUE\�WH[W����

� 7KLV�LFRQ�GHVLJQDWHV�D�ZDUQLQJ�UHODWLQJ�WR�WKH�QHDUE\�WH[W���

Page 12: Visual Basic - Subclassing and Hooking with VB & VB NET

+RZ�WR�&RQWDFW�8V�

:H�KDYH�WHVWHG�DQG�YHULILHG�DOO�WKH�LQIRUPDWLRQ�LQ�WKLV�ERRN�WR�WKH�EHVW�RI�RXU�DELOLW\��EXW�\RX�PLJKW�ILQG�WKDW�IHDWXUHV�KDYH�FKDQJHG��RU�HYHQ�WKDW�ZH�KDYH�PDGH�PLVWDNHV����3OHDVH�OHW�XV�NQRZ�DERXW�DQ\�HUURUV�\RX�ILQG��DV�ZHOO�DV�\RXU�VXJJHVWLRQV�IRU�IXWXUH�HGLWLRQV��E\�ZULWLQJ�WR���O’Reilly & Associates, Inc. 101 Morris St. Sebastopol, CA 95472 (800) 998-9938 (in the U.S. or Canada) (707) 829-0515 (international/local) (707) 829-0104 (fax)

<RX�DOVR�FDQ�VHQG�PHVVDJHV�HOHFWURQLFDOO\��7R�EH�SXW�RQ�RXU�PDLOLQJ�OLVW�RU�WR�UHTXHVW�D�FDWDORJ��VHQG�HPDLO�WR���[email protected]

7R�DVN�WHFKQLFDO�TXHVWLRQV�RU�FRPPHQW�RQ�WKH�ERRN��VHQG�HPDLO�WR��[email protected]

)RU�WHFKQLFDO�LQIRUPDWLRQ�RQ�9LVXDO�%DVLF�SURJUDPPLQJ��WR�SDUWLFLSDWH�LQ�9LVXDO�%DVLF�GLVFXVVLRQ�IRUXPV��RU�WR�DFTXDLQW�\RXUVHOI�ZLWK�25HLOO\V�OLQH�RI�9LVXDO�%DVLF�ERRNV��\RX�FDQ�DFFHVV�WKH�25HLOO\�9LVXDO�%DVLF�ZHE�VLWH�DW���http://vb.oreilly.com

$FNQRZOHGJPHQWV�

,�ILUVW�ZDQW�WR�WKDQN�5RQ�3HWUXVKD��P\�HGLWRU��IRU�WDNLQJ�D�FKDQFH�RQ�DQ�XQSURYHQ�DXWKRU��7KLV�LV�WKH�ILUVW�ERRN�WKDW�,�KDYH�ZULWWHQ��DQG�LW�KDV�EHHQ�D�YHU\�IXOILOOLQJ�H[SHULHQFH��8QGHU�5RQV�FRQVWDQW�JXLGDQFH�DQG�GLUHFWLRQ��,�KDYH�JURZQ�FRQVLGHUDEO\�LQ�P\�VNLOO�DQG�XQGHUVWDQGLQJ�RI�WKH�LQWULFDFLHV�RI�ZULWLQJ���,�FDQQRW�WKDQN�P\�ZLIH�HQRXJK��VKH�KDV�EHHQ�WKHUH��HQDEOLQJ�PH�LQ�HYHU\�ZD\�SRVVLEOH�WR�FRPSOHWH�WKLV�SURMHFW��:LWKRXW�KHU��,�PLJKW�KDYH�GLVPLVVHG�WKH�LGHD�RI�ZULWLQJ�WKLV�ERRN�HDUO\�RQ��WKLQNLQJ�WKDW�LW�ZRXOG�EH�WRR�IDU�RXW�RI�P\�JUDVS��+HDULQJ�KHU�HQWKXVLDVP�ZKLOH�WHOOLQJ�RWKHUV�DERXW�WKH�ERRN�WKDW�,�ZDV�ZULWLQJ�DOZD\V�UHQHZHG�P\�GHWHUPLQDWLRQ�DQG�HQHUJ\�WR�ILQLVK�WKLV�ERRN���,�ZDQW�WR�WKDQN�0RP�DQG�'DG�IRU�WKHLU�VXSSRUW�DQG�WKH�PDQ\�ORQJ�GLVWDQFH�SKRQH�FDOOV�WKH\�PDGH�WR�PDNH�VXUH�WKDW�,�ZDV�VWLOO�RQ�VFKHGXOH���,�ZRXOG�OLNH�WR�WKDQN�:LOOLDP�-��6WHHOH��D�0LFURVRIW�FRQVXOWDQW��IRU�WDNLQJ�WLPH�RXW�RI�KLV�EXV\�VFKHGXOH�WR�GLVFXVV�VRPH�RI�WKH�TXHVWLRQV�DQG�WKHRULHV�WKDW�,�FDPH�XS�ZLWK�ZKLOH�LQ�WKH�SURFHVV�RI�ZULWLQJ�WKLV�ERRN���7KH�WHFKQLFDO�UHYLHZHUV��'DQLHO�&UHHURQ�DQG�-�3��+DPLOWRQ��GLG�D�ZRQGHUIXO�MRE�RI�UHYLHZLQJ�WKH�ERRNV�WHFKQLFDO�PDWHULDO��7KLV�ZDV�QR�HDV\�MRE��DQG�,�WKDQN�WKHP�IRU�WKHLU�YDOXDEOH�IHHGEDFN���

Page 13: Visual Basic - Subclassing and Hooking with VB & VB NET

)LQDOO\��,�ZRXOG�OLNH�WR�WKDQN�-HVVDP\Q�5HDG�IRU�GRLQJ�D�JUHDW�MRE�LQ�WUDQVIRUPLQJ�WKH�LOOXVWUDWLRQV�WKDW�,�FDPH�XS�ZLWK�LQWR�WKHLU�ILQDO�IRUP��

Page 14: Visual Basic - Subclassing and Hooking with VB & VB NET

3DUW�,��,QWURGXFLQJ�6XEFODVVLQJ�DQG�+RRNLQJ�7KLV�VHFWLRQ�ZLOO�OD\�WKH�EDVLV�IRU�GHYHORSLQJ�DSSOLFDWLRQV�WKDW�LQFRUSRUDWH�VXEFODVVLQJ�DQG�KRRNLQJ�E\�H[DPLQLQJ�WKH�:LQGRZV�IDPLO\�RI�RSHUDWLQJ�V\VWHPV�DV�PHVVDJLQJ�V\VWHPV��:HOO�DOVR�H[SORUH�ZKDW�VXEFODVVLQJ�DQG�KRRNLQJ�LQYROYHV��KRZ�WKH\�GLIIHU��DQG�ZK\�\RXG�ZDQW�WR�XVH�RQH�WHFKQLTXH�UDWKHU�WKDQ�DQRWKHU��)LQDOO\��ZHOO�ORRN�DW�VRPH�VRIWZDUH�WRROV�WKDW�\RX�FDQ�XVH�ERWK�WR�EHWWHU�XQGHUVWDQG�WKH�RSHUDWLRQ�RI�:LQGRZV��DV�ZHOO�DV�WR�JDWKHU�LQIRUPDWLRQ�DERXW�KRZ�\RXU�VXEFODVVHG�ZLQGRZV�RU�KRRNV�DUH�SHUIRUPLQJ���

Page 15: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU����,QWURGXFWLRQ�:LQGRZV�LV�D�PHVVDJH�EDVHG�V\VWHP��7KLV�PHDQV�WKDW�HYHU\�DFWLRQ�\RX�WDNH�ZKLOH�XVLQJ�WKH�V\VWHP�FUHDWHV�RQH�RU�PRUH�PHVVDJHV�WR�FDUU\�RXW�WKH�DFWLRQ��7KHVH�PHVVDJHV�DUH�SDVVHG�EHWZHHQ�REMHFWV�ZLWKLQ�WKH�V\VWHP��7KHVH�PHVVDJHV�DOVR�FDUU\�ZLWK�WKHP�LQIRUPDWLRQ�WKDW�JLYHV�WKH�UHFLSLHQW�PRUH�GHWDLO�RQ�KRZ�WR�LQWHUSUHW�DQG�DFW�XSRQ�WKH�PHVVDJH���&OLFNLQJ�D�EXWWRQ�FRQWURO�SURYLGHV�D�JRRG�PHVVDJLQJ�H[DPSOH��7KLV�SURGXFHV�QRW�RQO\�WKH�PHVVDJH�IRU�WKH�PRXVH�EXWWRQ�FOLFN��EXW�DOVR�D�ZLGH�DUUD\�RI�RWKHU�PHVVDJHV��7KHVH�LQFOXGH�PHVVDJHV�WR�UHSDLQW�WKH�EXWWRQ�LQ�LWV�GHSUHVVHG�VWDWH��QRWLILFDWLRQ�PHVVDJHV�WR�LQIRUP�RWKHU�REMHFWV�RI�WKH�EXWWRQV�FKDQJH�LQ�VWDWH��PHVVDJHV�WR�GHWHUPLQH�WKH�VWDWH�RI�WKH�PRXVH�FXUVRU��DV�ZHOO�DV�RWKHUV��(YHQ�D�VLPSOH�DFW�VXFK�DV�PRYLQJ�WKH�PRXVH�RU�SUHVVLQJ�D�NH\�RQ�WKH�NH\ERDUG�FDQ�SURGXFH�DQ�DVWRQLVKLQJ�QXPEHU�RI�PHVVDJHV���,Q�DGGLWLRQ�WR�FRPPXQLFDWLQJ�XVHU�DFWLRQV��:LQGRZV�DOVR�XVHV�PHVVDJHV�LQWHUQDOO\�WR�GR�KRXVHNHHSLQJ��0HVVDJHV�QHHG�WR�EH�VHQW�WR�XSGDWH�WKH�WLPH�DQG�GDWH��WR�QRWLI\�RWKHU�REMHFWV�RI�D�FKDQJH�LQ�VWDWH��DQG�HYHQ�WR�QRWLI\�DSSOLFDWLRQV�ZKHQ�V\VWHP�UHVRXUFHV�DUH�H[KDXVWHG���7KH�:LQGRZV�PHVVDJLQJ�V\VWHP�LV�WKH�KHDUW�RI�WKH�RSHUDWLQJ�V\VWHP��$V�D�UHVXOW��WKH�PHVVDJLQJ�V\VWHP�LV�YHU\�FRPSOH[���6XEFODVVLQJ�DQG�WKH�:LQGRZV�KRRNLQJ�PHFKDQLVP�RSHUDWH�RQ�PHVVDJHV�ZLWKLQ�WKH�PHVVDJLQJ�V\VWHP��7KLV�PDNHV�VXEFODVVLQJ�DQG�KRRNLQJ�WZR�YHU\�SRZHUIXO�WHFKQLTXHV��:LWK�WKHP��ZH�FDQ�PDQLSXODWH��PRGLI\��RU�HYHQ�GLVFDUG�PHVVDJHV�ERXQG�IRU�RWKHU�REMHFWV�ZLWKLQ�WKH�RSHUDWLQJ�V\VWHP�DQG��LQ�WKH�SURFHVV��FKDQJH�WKH�ZD\�LQ�ZKLFK�WKH�V\VWHP�EHKDYHV��$V�\RX�PLJKW�DOUHDG\�KDYH�JXHVVHG��D�WKRURXJK�XQGHUVWDQGLQJ�RI�WKH�PHVVDJLQJ�V\VWHP�LV�FULWLFDO�WR�PDVWHULQJ�WKH�WHFKQLTXHV�RI�VXEFODVVLQJ�DQG�KRRNLQJ���$ORQJ�ZLWK�WKLV�SRZHU�FRPHV�UHVSRQVLELOLW\��,W�LV�XS�WR�WKH�GHYHORSHU�WR�PDNH�VXUH�WKDW�KH�RU�VKH�LV�XVLQJ�WKHVH�WHFKQLTXHV�FRUUHFWO\��:LQGRZV�LV�YHU\�XQIRUJLYLQJ�LI�WKHVH�WHFKQLTXHV�DUH�XVHG�LQFRUUHFWO\���

����6XEFODVVLQJ��

6XEFODVVLQJ�WHFKQLTXHV�GHDO�ZLWK�LQWHUFHSWLQJ�PHVVDJHV�ERXQG�IRU�RQH�RU�PRUH�ZLQGRZV�RU�FRQWUROV��7KHVH�PHVVDJHV�DUH�LQWHUFHSWHG�EHIRUH�WKH\�FDQ�UHDFK�WKHLU�GHVWLQDWLRQ�ZLQGRZ��7KH�LQWHUFHSWHG�PHVVDJH�FDQ�EH�OHIW�LQ�LWV�RULJLQDO�VWDWH�RU�PRGLILHG��$IWHUZDUG��WKH�PHVVDJH�FDQ�EH�VHQW�WR�LWV�RULJLQDO�GHVWLQDWLRQ�RU�GLVFDUGHG���%\�LQWHUFHSWLQJ�PHVVDJHV�LQ�WKLV�PDQQHU��ZH�FDQ�KDYH�D�SRZHUIXO�LQIOXHQFH�RQ�KRZ�WKH�ZLQGRZ�RU�FRQWURO�ZLOO�UHDFW�WR�WKH�PHVVDJHV�LW�UHFHLYHV��&RQVLGHU��IRU�H[DPSOH��ULJKW�FOLFNLQJ�WKH�9LVXDO�%DVLF��9%��WH[W�ER[�FRQWURO��7KLV�DFWLRQ�FDXVHV�D�GHIDXOW�SRS�XS�PHQX�WR�EH�GLVSOD\HG�FRQWDLQLQJ�WKH�IROORZLQJ�PHQX�LWHPV��8QGR��&XW��&RS\��3DVWH��'HOHWH��DQG�6HOHFW�

Page 16: Visual Basic - Subclassing and Hooking with VB & VB NET

$OO��5HSODFLQJ�WKLV�PHQX�ZLWK�RQH�RI�RXU�RZQ�LV�D�IDLUO\�VLPSOH�WDVN�XVLQJ�VXEFODVVLQJ��6XEFODVVLQJ�KDV�PDQ\�RWKHU�XVHV�DV�ZHOO��VXFK�DV���

• 'HWHUPLQLQJ�ZKHQ�D�ZLQGRZ�LV�EHLQJ�DFWLYDWHG�RU�GHDFWLYDWHG�DQG�UHVSRQGLQJ�WR�WKLV�FKDQJH��

• 5HVSRQGLQJ�WR�QHZ�PHQX�LWHPV�WKDW�DUH�PDQXDOO\�DGGHG�WR�WKH�V\VWHP�PHQX�RI�D�ZLQGRZ��

• 'LVSOD\LQJ�GHVFULSWLRQV�RI�PHQX�LWHPV�DV�WKH�PRXVH�PRYHV�DFURVV�WKHP�• 'LVDOORZLQJ�D�XVHU�WR�PRYH�RU�UHVL]H�D�ZLQGRZ�• $OORZLQJ�D�XVHU�WR�PRYH�RU�UHVL]H�D�ZLQGRZ�ZLWKLQ�VSHFLILHG�ERXQGDULHV�• 'HWHUPLQLQJ�ZKHUH�WKH�PRXVH�FXUVRU�LV�DQG�UHVSRQGLQJ�DFFRUGLQJO\�• 0RGLI\LQJ�WKH�ORRN�RI�D�ZLQGRZ�RU�FRQWURO�• &KDQJLQJ�WKH�ZD\�D�FRPER�ER[�RSHUDWHV�• 'HWHUPLQLQJ�ZKHQ�WKH�GLVSOD\�UHVROXWLRQ�KDV�EHHQ�FKDQJHG�• 0RQLWRULQJ�WKH�V\VWHP�IRU�D�ORZ�V\VWHP�UHVRXUFH�FRQGLWLRQ�• 0RGLI\LQJ�RU�GLVDOORZLQJ�NH\VWURNHV�VHQW�WR�D�ZLQGRZ�RU�FRQWURO�• 0RGLI\LQJ�KRZ�D�ZLQGRZ�RU�FRQWURO�LV�SDLQWHG�RQ�WKH�VFUHHQ�

6XEFODVVLQJ�RSHQV�XS�D�ZHDOWK�RI�SRVVLELOLWLHV�WR�WKH�9%�GHYHORSHU����SRVVLELOLWLHV�WKDW�RUGLQDULO\�DUH�FRPSOHWHO\�XQDYDLODEOH��RU�DW�OHDVW�DUH�QRW�HDV\�WR�LPSOHPHQW���7KHUH�DUH�WKUHH�W\SHV�RI�VXEFODVVLQJ��DOO�RI�ZKLFK�,�ZLOO�GLVFXVV��7KH�ILUVW�LV�LQVWDQFH�VXEFODVVLQJ��ZKLFK�PDNHV�LW�SRVVLEOH�WR�LQWHUFHSW�PHVVDJHV�IRU�D�VLQJOH�LQVWDQFH�RI�D�ZLQGRZ�RU�FRQWURO��7KLV�W\SH�RI�VXEFODVVLQJ�LV�WKH�PRVW�FRPPRQO\�XVHG��,W�LV�XVHG�WR�FRQWURO��IRU�H[DPSOH��WKH�XVHUV�DELOLW\�WR�VL]H�D�VLQJOH�LQVWDQFH�RI�D�ZLQGRZ��7KH�VHFRQG�LV�JOREDO�VXEFODVVLQJ��ZKLFK�PDNHV�LW�SRVVLEOH�WR�LQWHUFHSW�PHVVDJHV�IRU�RQH�RU�PRUH�ZLQGRZV�RU�FRQWUROV�WKDW�DUH�DOO�FUHDWHG�IURP�WKH�VDPH�ZLQGRZ�FODVV��$OO�ZLQGRZV�GHULYH�IURP�VRPH�W\SH�RI�FODVV��WKHVH�FODVVHV�GHVFULEH�WKH�IXQGDPHQWDO�ORRN�DQG�EHKDYLRU�RI�ZLQGRZV�FUHDWHG�IURP�WKHP��7DNH��IRU�H[DPSOH��D�VWDQGDUG�EXWWRQ�FRQWURO��HDFK�LQVWDQFH�RI�WKLV�FRQWURO�GHULYHV�IURP�D�%87721�FODVV��8VLQJ�JOREDO�VXEFODVVLQJ��ZH�FDQ�FKDQJH�WKH�EHKDYLRU�RI�WKH�FODVV��7KLV�LQ�WXUQ�DOORZV�XV�WR�LQWHUFHSW�PHVVDJHV�IURP�DOO�ZLQGRZ�RU�FRQWURO�LQVWDQFHV�FUHDWHG�IURP�WKLV�FODVV��8VLQJ�JOREDO�VXEFODVVLQJ�ZH�FDQ�FRQWURO�WKH�XVHUV�DELOLW\�WR�VL]H�DQ\�ZLQGRZ�FUHDWHG�IURP�D�SDUWLFXODU�FODVV��7KH�WKLUG�W\SH�RI�VXEFODVVLQJ��VXSHUFODVVLQJ��LV�D�FORVH�UHODWLYH�RI�JOREDO�VXEFODVVLQJ��6XSHUFODVVLQJ�DOVR�KDV�WKH�DELOLW\�WR�LQWHUFHSW�PHVVDJHV�IRU�RQH�RU�PRUH�ZLQGRZV�RU�FRQWUROV��7KH�GLIIHUHQFH�LV�WKDW�D�EUDQG�QHZ�ZLQGRZ�FODVV�LV�FUHDWHG�WR�IDFLOLWDWH�WKLV�W\SH�RI�VXEFODVVLQJ��6LPLODU�WR�JOREDO�VXEFODVVLQJ��VXSHUFODVVLQJ�DOORZV�XVHUV�WR�VL]H�D�ZLQGRZ�WR�EH�FRQWUROOHG��

����7KH�:LQGRZ�+RRNLQJ�0HFKDQLVP�

Page 17: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�ZLQGRZ�KRRNLQJ�PHFKDQLVP��RU�KRRNV��DOVR�GHDOV�ZLWK�LQWHUFHSWLQJ�PHVVDJHV��EXW�DW�D�PXFK�EURDGHU�VFRSH�WKDQ�VXEFODVVLQJ��+RRNLQJ�DOORZV�XV�WR�LQWHUFHSW�PHVVDJHV�DW�YDULRXV�VHW�SRLQWV�ZLWKLQ�WKH�RSHUDWLQJ�V\VWHP��)RU�H[DPSOH��ZH�FDQ�LQWHUFHSW�D�PHVVDJH�EHIRUH�DQG�DIWHU�D�ZLQGRZ�KDV�SURFHVVHG�LW���7KHUH�DUH�VHYHUDO�GLIIHUHQW�NLQGV�RI�KRRNV��HDFK�ZLWK�WKHLU�RZQ�VSHFLDO�SXUSRVH�DQG�ORFDWLRQ�ZLWKLQ�WKH�RSHUDWLQJ�V\VWHP��7KH\�DUH���:+B&$//:1'352&

:+B&$//:1'352&5(7

:+B&%7

:+B'(%8*

:+B)25(*5281','/(

:+B*(70(66$*(

:+B-2851$/3/$<%$&.

:+B-2851$/5(&25'

:+B.(<%2$5'

:+B.(<%2$5'B//

:+B0286(

:+B0286(B//

:+B06*),/7(5

:+B6<606*),/7(5

:+B6+(//

+RRNV��XQOLNH�VXEFODVVLQJ��FDQ�KDYH�DQ�DSSOLFDWLRQ�VFRSH�RU�D�V\VWHP�ZLGH�VFRSH��%\�WKLV��,�PHDQ�D�VLQJOH�KRRN�FDQ�LQWHUFHSW�VSHFLILF�PHVVDJHV�ZLWKLQ�D�VLQJOH�DSSOLFDWLRQ��RU�LW�FDQ�EH�VHW�XS�WR�LQWHUFHSW�WKRVH�VDPH�PHVVDJHV�IRU�DOO�DSSOLFDWLRQV�UXQQLQJ�LQ�WKH�V\VWHP��+RRNV�JLYH�XV�FRQWURO�RYHU�WKH�V\VWHP��ZKLFK�FDQQRW�EH�DFKLHYHG�ZLWK�VXEFODVVLQJ��7KH�IROORZLQJ�DUH�MXVW�D�IHZ�RI�WKH�XVHV�IRU�KRRNV���

• 0RGLI\LQJ�PHVVDJHV�VHQW�WR�GLDORJ�ER[HV��VFUROO�EDUV��PHQXV��RU�PHVVDJH�ER[HV��• 6XEFODVVLQJ�D�ZLQGRZ�WKDW�UHVLGHV�LQ�D�VHSDUDWH�SURFHVV�• &UHDWLQJ�D�PDFUR�UHFRUGHU�WKDW�FDQ�SOD\�EDFN�WKH�UHFRUGHG�PDFUR�DV�ZHOO��• 'HYHORSLQJ�FRPSXWHU�EDVHG�WUDLQLQJ��&%7��DSSOLFDWLRQV�• &DSWXULQJ�DQG�PRGLI\LQJ�PRXVH�RU�NH\ERDUG�PHVVDJHV�DW�D�V\VWHP�OHYHO�• 3URYLGLQJ�D�KHOS�IXQFWLRQ�NH\�IRU�PHQX�LWHPV�DQG�PHVVDJH�ER[HV�• &UHDWLQJ�D�XWLOLW\�VLPLODU�WR�6S\���• &UHDWLQJ�DQ�DXWRPDWHG�WHVWLQJ�DSSOLFDWLRQ�• 'HWHUPLQLQJ�ZKHQ�DQ�DSSOLFDWLRQ�LV�LGOH�• 0RGLI\LQJ�PRXVH�EXWWRQV�DQG�NH\VWURNHV�IRU�D�SDUWLFXODU�DSSOLFDWLRQ��RU�IRU�DOO�

DSSOLFDWLRQV��• 0RGLI\LQJ�$/7�7$%�DQG�$/7�(6&�NH\�IXQFWLRQDOLW\�

Page 18: Visual Basic - Subclassing and Hooking with VB & VB NET

,�ZLOO�GLVFXVV�DOO�WKH�KRRNV�OLVWHG�KHUH��DV�ZHOO�DV�VKRZ�KRZ�WR�DSSO\�WKHP�WR�D�VLQJOH�DSSOLFDWLRQ�RU�WR�DOO�DSSOLFDWLRQV�UXQQLQJ�LQ�WKH�V\VWHP��LQ�&KDSWHU���WKURXJK�&KDSWHU������

����7RROV�WR�$LG�8V�LQ�2XU�(IIRUWV�

$ORQJ�ZLWK�XVLQJ�WKHVH�DGYDQFHG�WHFKQLTXHV��HIIHFWLYHO\�LPSOHPHQWLQJ�VXEFODVVLQJ�DQG�KRRNLQJ�LQ�RXU�GHYHORSPHQW�ZRUN�UHTXLUHV�WKDW�ZH�HPSOR\�GHEXJJLQJ�WRROV�EH\RQG�WKH�FDSDELOLWLHV�RI�WKH�9%�GHEXJJHU���:KLOH�GHYHORSLQJ�WKH�SURMHFWV�IRU�WKLV�ERRN��,�XVHG�VHYHUDO�VRIWZDUH�XWLOLWLHV�DV�ZHOO�DV�RWKHU�SURIHVVLRQDO�DSSOLFDWLRQV�WKDW�,�EXLOW��$OWKRXJK�\RX�FDQ�VXFFHVVIXOO\�EXLOG�DSSOLFDWLRQV�WKDW�VXEFODVV�YDULRXV�ZLQGRZV�RU�WKDW�KRRN�LQWR�FHUWDLQ�PHVVDJH�VWUHDPV�ZLWKRXW�WKHVH�XWLOLWLHV��,�GR�QRW�VXJJHVW�GRLQJ�VR��7KHVH�XWLOLWLHV�JLYH�\RX��WKH�GHYHORSHU��D�YDOXDEOH�LQVLJKW�LQWR�ZKDW�LV�KDSSHQLQJ�LQVLGH�WKH�V\VWHP�ZKLOH�UXQQLQJ�\RXU�SURMHFWV�LQ�WKH�9%�LQWHJUDWHG�GHYHORSPHQW�HQYLURQPHQW��,'(��DQG�HVSHFLDOO\�DW�UXQWLPH��<RX�ZLOO�EH�DEOH�WR�VHH�WKLQJV�RSHUDWH�LQ�D�ZD\�WKDW�LV�XQDYDLODEOH�WR�\RX�E\�MXVW�XVLQJ�WKH�9LVXDO�%DVLF�RU�9LVXDO�&���GHYHORSPHQW�HQYLURQPHQWV���,�ZRXOG�JR�DV�IDU�DV�VD\LQJ�WKDW�VRPH�RI�WKHVH�XWLOLWLHV�DUH�QHFHVVDU\�WR�XQGHUVWDQG�KRZ�VXEFODVVLQJ�DQG�KRRNV�ZRUN��2WKHUZLVH��\RX�ZLOO�RQO\�EH�EOLQGO\�SOXJJLQJ�FRGH�LQWR�DQ�DSSOLFDWLRQ��QRW�IXOO\�XQGHUVWDQGLQJ�ZK\�\RX�DUH�GRLQJ�LW�DQG�ZKDW�LV�KDSSHQLQJ�EHKLQG�WKH�VFHQHV��:KHQ�WKH�DSSOLFDWLRQ�ORFNV�XS��GHEXJJLQJ�LW�ZLOO�EH�IUXVWUDWLQJ�DQG�SRVVLEO\�IXWLOH��:KDW�,�DP�VWUHVVLQJ�KHUH�LV�WKDW�ZH��DV�SURJUDPPHUV��PXVW�DVSLUH�WR�KDYH�DQ�XQGHUVWDQGLQJ�RI�ZKDW�ZH�DUH�GRLQJ��:LWKRXW�WKLV�XQGHUVWDQGLQJ�ZH�FDQQRW�KRSH�WR�UHDFK�WKH�PRUH�DGYDQFHG�DUHDV�RI�RXU�GLVFLSOLQH��+DYLQJ�DQ�XQGHUVWDQGLQJ�RI�KRZ�VXEFODVVLQJ�DQG�KRRNV�ZRUN�DQG�LQWHUDFW�ZLWK�WKH�UHVW�RI�WKH�:LQGRZV�V\VWHP�ZLOO�DOORZ�\RX�WR�EXLOG�VXFFHVVIXO�DSSOLFDWLRQV���,�ZLOO�GHVFULEH�WKH�XWLOLWLHV�WKDW�,�XVH�LQ�WKH�IROORZLQJ�VHFWLRQV��$OWKRXJK�WKLV�ERRN�ZLOO�QRW�LQFOXGH�D�WXWRULDO�IRU�RSHUDWLQJ�WKHVH�XWLOLWLHV��WKHUH�LV�VRPH�YHU\�JRRG�GRFXPHQWDWLRQ�LQ�WKH�0LFURVRIW�'HYHORSHU�1HWZRUN�/LEUDU\��06'1��IRU�6S\���DQG�39LHZ��7KH�1X0HJD�WRROV�FRPH�ZLWK�WKHLU�RZQ�GRFXPHQWDWLRQ��1RWH�WKDW�VRPH�RI�WKHVH�WRROV�GLVSOD\�GLIIHUHQW�LQIRUPDWLRQ�GHSHQGLQJ�RQ�ZKLFK�RSHUDWLQJ�V\VWHP�\RX�DUH�XVLQJ��H�J���:LQGRZV��[��17��RU���������

������6S\���

7KH�6S\���XWLOLW\�LV�LQFOXGHG�LQ�WKH�:LQ���6RIWZDUH�'HYHORSPHQW�.LW��6'.��DV�ZHOO�DV�LQ�0LFURVRIW�9LVXDO�6WXGLR���,�KDYH�XVHG�WKLV�XWLOLW\�WKH�PRVW��H[FHSW�PD\EH�IRU�1X0HJDV�6PDUW&KHFN�XWLOLW\��6S\���LV�RQH�RI�WKH�PRVW�YDOXDEOH�WRROV�ZKHQ�LPSOHPHQWLQJ�VXEFODVVLQJ�DQG�VXSHUFODVVLQJ��6S\���FDQ�SURYLGH�\RX�ZLWK�DOO�WKH�LQIRUPDWLRQ�\RX�QHHG�WR�YHULI\�WKH�VWDWH�RI�WKH�DSSOLFDWLRQ�EHIRUH�DQG�

Page 19: Visual Basic - Subclassing and Hooking with VB & VB NET

DIWHU�D�VXEFODVVLQJ�RSHUDWLRQ��DV�ZHOO�DV�DOO�WKH�PHVVDJH�LQIRUPDWLRQ�EHLQJ�SDVVHG�WR�DQG�IURP�D�ZLQGRZ��6S\���LV�GHVFULEHG�DV�D�WRRO�IRU��VS\LQJ��RQ�GLIIHUHQW�SDUWV�RI�WKH�RSHUDWLQJ�V\VWHP��7KLV�PHDQV�\RX�FDQ�ZDWFK�DV�SURFHVVHV��WKUHDGV��DQG�ZLQGRZV�FRQWDLQHG�ZLWKLQ�WKH�WKUHDGV�DUH�FUHDWHG�DQG�GHVWUR\HG��$OVR��\RX�FDQ�JHW�YDOXDEOH�LQIRUPDWLRQ�RQ�WKHVH�REMHFWV��VRPH�RI�ZKLFK�LV�FRQWDLQHG�ZLWKLQ�WKH�VWUXFWXUHV�XVHG�WR�FUHDWH�WKHP��%XW�HYHQ�PRUH�XVHIXO�LV�WKH�DELOLW\�WR�ZDWFK�LQ�UHDO�WLPH�DV�PHVVDJHV�IORZ�WKURXJKRXW�WKH�V\VWHP��7KLV��LQ�P\�RSLQLRQ��LV�WKH�PRVW�SRZHUIXO�IHDWXUH�RI�WKLV�WRRO���6S\���LV�D�0XOWLSOH�'RFXPHQW�,QWHUIDFH��0',��DSSOLFDWLRQ��/HWV�VWDUW�XS�6S\���DQG�TXLFNO\�UXQ�WKURXJK�WKH�ZLQGRZV�DQG�PHQXV��MXVW�WR�EHFRPH�IDPLOLDU�ZLWK�JHWWLQJ�DURXQG�LQ�WKH�WRRO��(DFK�FKLOG�ZLQGRZ�ZLWKLQ�6S\���GLVSOD\V�LQIRUPDWLRQ�RQ�SURFHVVHV��WKUHDGV��WRS�OHYHO�ZLQGRZV��RU�PHVVDJHV��/HWV�VWDUW�ZLWK�WKH�3URFHVVHV�ZLQGRZ�DQG�ZRUN�RXU�ZD\�GRZQ���:KHQ�6S\���LV�VWDUWHG��LW�ZLOO�WDNH�D�VQDSVKRW�RI�WKH�V\VWHP�DW�WKDW�SRLQW�LQ�WLPH���7KLV�GRHV�QRW�DSSO\�WR�VS\LQJ�RQ�PHVVDJHV��PHVVDJHV�DUH�GLVSOD\HG�DV�VRRQ�DV�WKH\�DUULYH�DW�WKH�ZLQGRZ���$Q\�WLPH�DQ�DSSOLFDWLRQ�LV�VWDUWHG�RU�HQGHG��RU�LWV�VWDWH�FKDQJHV��\RX�VKRXOG�UHIUHVK�WKH�GLVSOD\�E\�SUHVVLQJ�WKH�)��NH\��7KLV�ZLOO�DOORZ�\RX�WR�YLHZ�WKH�PRVW�FXUUHQW�VWDWH�RI�WKH�V\VWHP���7KH�3URFHVVHV�ZLQGRZ��ZKLFK�LV�VKRZQ�LQ�)LJXUH������LV�RSHQHG�DXWRPDWLFDOO\�ZKHQ�6S\���LV�ODXQFKHG��DQG�GLVSOD\V�D�OLVW�RI�FXUUHQWO\�UXQQLQJ�SURFHVVHV�LQ�WKH�V\VWHP�LQ�D�WUHH�KLHUDUFK\��<RX�FDQ�GULOO�GRZQ�WKURXJK�WKH�SURFHVVHV��ZKLFK�DUH�GLVSOD\HG�ZLWK�D�WZR�JHDU�LFRQ��LQWR�WKH�WKUHDGV�ZLWKLQ�D�SURFHVV��GLVSOD\HG�ZLWK�D�VLQJOH�JHDU�LFRQ��,I�D�WKUHDG�FRQWDLQV�DQ\�WRS�OHYHO�ZLQGRZV��\RX�FDQ�GULOO�GRZQ�LQWR�WKHVH�ZLQGRZV�DV�ZHOO��7RS�OHYHO�ZLQGRZV�DUH�ZLQGRZV�WKDW�KDYH�WKH�GHVNWRS�ZLQGRZ�DV�WKHLU�RQO\�ZLQGRZ��7KH�WRS�OHYHO�ZLQGRZV�DUH�GLVSOD\HG�ZLWK�D�UHFWDQJXODU�ZLQGRZ�LFRQ��(DFK�LWHP�LQ�WKH�WUHH�FDQ�EH�GRXEOH�FOLFNHG�WR�GLVSOD\�D�GLDORJ�ER[�WKDW�GLVSOD\V�LWV�SURSHUWLHV��:LWKLQ�HDFK�SURSHUWLHV�GLDORJ�ER[��H[FHSW�IRU�WKH�3URFHVVHV�3URSHUWLHV�GLDORJ��WKHUH�DUH�K\SHUOLQNV�WR�IDFLOLWDWH�WKH�SURFHVV�RI�GULOOLQJ�XS�DQG�GRZQ�WKURXJK�SURFHVVHV��WKUHDGV��ZLQGRZV��DQG�PHVVDJHV��(DFK�LWHP�FDQ�EH�ULJKW�FOLFNHG�DV�ZHOO�WR�GLVSOD\�D�SRS�XS�PHQX�IRU�WKDW�LWHP��$�VHSDUDWH�SRS�XS�PHQX�LV�GLVSOD\HG�IRU�SURFHVVHV��WKUHDGV��ZLQGRZV��DQG�PHVVDJHV���

)LJXUH������8VLQJ�6S\���WR�YLHZ�WKH�SURFHVVHV�FXUUHQWO\�UXQQLQJ�

Page 20: Visual Basic - Subclassing and Hooking with VB & VB NET

,I�\RXU�SULPDU\�LQWHUHVW�LV�H[DPLQLQJ�WKH�UXQQLQJ�WKUHDGV�UDWKHU�WKDQ�WKH�SURFHVVHV��\RX�FDQ�RSHQ�WKH�7KUHDGV�ZLQGRZ�E\�VHOHFWLQJ�WKH�7KUHDGV�RSWLRQ�IURP�WKH�6S\�PHQX��7KH�7KUHDGV�ZLQGRZ��ZKLFK�LV�VKRZQ�LQ�)LJXUH������GLVSOD\V�D�OLVW�RI�FXUUHQWO\�UXQQLQJ�WKUHDGV�LQ�DOO�SURFHVVHV�LQ�WKH�V\VWHP��VRUWHG�E\�WKUHDG�,'��7KH�GLVSOD\�LV�VLPLODU�WR�WKH�3URFHVVHV�ZLQGRZ��H[FHSW�WKDW�WKH�3URFHVVHV�OHYHO�KDV�EHHQ�UHPRYHG�DQG�WKH�UXQQLQJ�WKUHDGV�DUH�QRZ�DW�WKH�WRS�RI�WKH�KLHUDUFK\��<RX�FDQ�GRXEOH�FOLFN�DQG�ULJKW�FOLFN�WKH�LWHPV�LQ�WKH�OLVW��MXVW�DV�LQ�WKH�3URFHVVHV�ZLQGRZ���

)LJXUH������8VLQJ�6S\���WR�YLHZ�WKH�UXQQLQJ�WKUHDGV�RI�DOO�UXQQLQJ�SURFHVVHV�

)LQDOO\��LI�\RXUH�LQWHUHVWHG�LQ�WKH�ZLQGRZV�KDQGOHG�E\�WKH�V\VWHP�DQG�LWV�DSSOLFDWLRQV��\RX�FDQ�XVH�WKH�:LQGRZV�ZLQGRZ��ZKLFK�DOVR�LV�RSHQHG�ZKHQ�6S\���VWDUWV��7KH�:LQGRZV�ZLQGRZ��ZKLFK�LV�VKRZQ�LQ�)LJXUH������RSHUDWHV�OLNH�WKH�3URFHVVHV�DQG�7KUHDGV�ZLQGRZV�DQG�GLVSOD\V�D�OLVW�RI�DOO�FXUUHQWO\�UXQQLQJ�WRS�OHYHO�ZLQGRZV�DQG�WKHLU�FKLOG�ZLQGRZV��:LWK�WKLV�LQIRUPDWLRQ��\RX�FDQ�VHH�KRZ�DQ�DSSOLFDWLRQV�GHVLJQHU�DUUDQJHG�WKH�XVHU�LQWHUIDFH��8,��IRU�HDFK�DSSOLFDWLRQ���

)LJXUH������8VLQJ�6S\���WR�YLHZ�DOO�UXQQLQJ�WRS�OHYHO�ZLQGRZV�DQG�WKHLU�FKLOG�ZLQGRZV�

Page 21: Visual Basic - Subclassing and Hooking with VB & VB NET

)LQDOO\��WKH�0HVVDJHV�ZLQGRZ��ZKLFK�LV�VKRZQ�LQ�)LJXUH������LV�WKH�ZLQGRZ�WKDW�ZH�ZLOO�EH�PRVW�LQWHUHVWHG�LQ�IRU�WKH�DSSOLFDWLRQV�WKDW�ZH�ZLOO�EH�EXLOGLQJ�WKURXJKRXW�WKLV�ERRN���

)LJXUH������8VLQJ�6S\���WR�YLHZ�WKH�PHVVDJHV�EHLQJ�VHQW�WKURXJKRXW�WKH�V\VWHP�

&OLFNLQJ�WKH�0HVVDJHV� 2SWLRQV����PHQX�LWHP�GLVSOD\V�WKH�0HVVDJH�2SWLRQV�GLDORJ�ER[��7KLV�GLDORJ�FRQWDLQV�WKH�IROORZLQJ�WKUHH�WDEV���The Windows tab

'HWHUPLQHV�ZKLFK�ZLQGRZV�ZLOO�EH�ZDWFKHG��'UDJJLQJ�WKH�)LQGHU�LFRQ�DQG�GURSSLQJ�LW�RQWR�D�ZLQGRZ�ZLOO�VHOHFW�WKDW�ZLQGRZV�PHVVDJHV�WR�EH�GLVSOD\HG�LQ�6S\����7KH�FKHFNER[HV�LQ�WKH�$GGLWLRQDO�:LQGRZV�IUDPH�DOORZ�\RX�WR�YLHZ�PHVVDJHV�IRU�DGGLWLRQDO�ZLQGRZV���

The Messages tab

%HFDXVH�ZDWFKLQJ�HYHU\�PHVVDJH�IRU�HYHU\�ZLQGRZ�LQ�WKH�V\VWHP�ZRXOG�SURGXFH�IDU�WRR�PXFK�LQIRUPDWLRQ�WR�GLJHVW��WKLV�WDE�DOORZV�\RX�WR�FKRRVH�ZKLFK�PHVVDJHV�WR�GLVSOD\��7KH�0HVVDJHV�WR�9LHZ�OLVW�ER[�GLVSOD\V�HYHU\�PHVVDJH�WKDW�FDQ�EH�ZDWFKHG��7KH�FKHFNER[HV�LQ�WKH�0HVVDJH�*URXSV�IUDPH��WR�WKH�ULJKW�RI�WKH�OLVW�ER[��FRUUHVSRQG�WR�VHSDUDWH�JURXSV�RI�UHODWHG�PHVVDJHV��0RVW�RI�WKH�FKHFNER[HV�DUH�VHOI�H[SODQDWRU\��IRU�H[DPSOH��PRXVH�PHVVDJHV�FRUUHODWH�ZLWK�WKH�0RXVH�FKHFNER[��7KH�1RQ�&OLHQW�FKHFNER[�UHODWHV�WR�PHVVDJHV�WKDW�XVXDOO\�KDYH�WKH�OHWWHUV�1&�LQ�WKHP��1&�VWDQGV�IRU�QRQ�FOLHQW��7KHVH�PHVVDJHV�GHVFULEH�DFWLRQV�RULJLQDWLQJ�IURP�WKH�QRQ�

Page 22: Visual Basic - Subclassing and Hooking with VB & VB NET

FOLHQW�DUHD�RI�D�ZLQGRZ��VXFK�DV�WKH�WLWOH�EDUV�DQG�RU�D�ERUGHU�WKDW�LV�EHLQJ�UHVL]HG��7KH�*HQHUDO�FKHFNER[�UHODWHV�WR�WKH�PHVVDJHV�FRPPRQO\�XVHG�LQ�D�ZLQGRZ��VXFK�DV�:0B&200$1'��:0B7,0(5��RU�:0B3$,17��7KH�5HJLVWHUHG�FKHFNER[�ZDWFKHV�IRU�PHVVDJHV�GHILQHG�E\�WKH�GHYHORSHU�XVLQJ�WKH�5HJLVWHU:LQGRZ0HVVDJH�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IXQFWLRQ��7KH�8QNQRZQ�FKHFNER[�ZDWFKHV�IRU�PHVVDJHV�WKDW�DUH�GHILQHG�WR�EH�LQ�WKH�UDQJH�RI�]HUR�WR�RQH�OHVV�WKDQ�WKH�:0B86(5�FRQVWDQW��+������7KHVH�DUH�PHVVDJH�LGHQWLILHUV�WKDW�DUH�UHVHUYHG�IRU�WKH�V\VWHP�WR�XVH��7KH�5HJLVWHUHG�FKHFNER[�ZDWFKHV�IRU�PHVVDJHV�WKDW�DUH�GHILQHG�WR�EH�HTXDO�WR�RU�JUHDWHU�WKDQ�WKH�:0B86(5�FRQVWDQW��7KHVH�DUH�DSSOLFDWLRQ�GHILQHG�PHVVDJHV��$IWHU�\RX�VHOHFW�DOO�WKH�PHVVDJHV�\RX�ZDQW�WR�ZDWFK��LW�LV�D�JRRG�LGHD�WR�FKHFN�WKH�6DYH�6HWWLQJV�DV�'HIDXOW�FKHFNER[��WKLV�ZD\��\RX�ZLOO�QRW�KDYH�WR�JR�EDFN�HYHU\�WLPH�DQG�UH�VHOHFW�WKH�DSSURSULDWH�PHVVDJHV���

The Output tab

7KLV�WDE�DOORZV�\RX�VRPH�FRQWURO�RYHU�WKH�PHVVDJH�LQIRUPDWLRQ�GLVSOD\HG�E\�6S\����)RU�WKLV�WDE��,�XVXDOO\�FKHFN�DOO�WKH�FKHFNER[HV�JURXSHG�LQ�WKH�6KRZ�LQ�0HVVDJH�/RJ�IUDPH��DQG�LQFUHDVH�WKH�YDOXH�LQ�WKH�/LQHV�0D[LPXP�WH[W�ER[�WR�DQ�DSSURSULDWH�YDOXH��VRPHZKHUH�DURXQG���������&KHFNLQJ�DOO�WKHVH�FKHFNER[HV�ZLOO�GLVSOD\�WKH�PD[LPXP�DPRXQW�RI�LQIRUPDWLRQ�DERXW�D�PHVVDJH��:H�ZLOO�QRW�QHHG�WKH�0HVVDJH�2ULJLQ�7LPH�DQG�0HVVDJH�0RXVH�3RVLWLRQ�FKHFNER[HV�XQWLO�ODWHU��ZKHQ�ZH�ORRN�LQWR�XVLQJ�MRXUQDOLQJ�KRRNV��&KHFNLQJ�WKH�6DYH�6HWWLQJV�DV�'HIDXOW�FKHFNER[�LV�D�JRRG�LGHD�KHUH�DV�ZHOO���

$IWHU�VHOHFWLQJ�ZKLFK�PHVVDJHV�WR�YLHZ�IRU�ZKLFK�ZLQGRZV��FOLFNLQJ�0HVVDJHV� 6WDUW�/RJJLQJ�ZLOO�DOORZ�6S\���WR�VWDUW�GLVSOD\LQJ�WKH�PHVVDJHV�WKDW�\RX�KDYH�VHOHFWHG�LQ�WKH�0HVVDJHV�ZLQGRZ��7KH�ILUVW�FROXPQ�RI�WKH�0HVVDJHV�ZLQGRZ�ZLOO�GLVSOD\�D�OLQH�QXPEHU�WR�GHQRWH�WKH�RUGHU�RI�WKH�PHVVDJHV��7KH�QH[W�FROXPQ�LV�WKH�ZLQGRZ�KDQGOH�WKDW�WKH�PHVVDJH�ZDV�GLUHFWHG�WR��7KH�WKLUG�FROXPQ�LV�IRU�PHVVDJH�FRGHV��$�PHVVDJH�FRGH�FRXOG�EH�GLVSOD\HG�DV�D�3��6��V��RU�5��$�PHVVDJH�FRGH�RI�3�PHDQV�WKDW�WKLV�PHVVDJH�ZDV�SRVWHG�WR�WKH�ZLQGRZV�PHVVDJH�TXHXH��DQG�WKDW�WKH�SRVWLQJ�DSSOLFDWLRQ�KDV�FRQWLQXHG�WR�H[HFXWH�FRGH�DQG�LW�LV�QRW�ZDLWLQJ�IRU�D�UHWXUQ�FRGH�WR�EH�VHQW�EDFN��$Q�6�PHDQV�WKDW�WKH�PHVVDJH�ZDV�VHQW�WR�WKLV�ZLQGRZ�XVLQJ�WKH�6HQG0HVVDJH�$3,�IXQFWLRQ�RU�RQH�RI�LWV�GHULYDWLYHV��VXFK�DV�6HQG0HVVDJH&DOOEDFN��6HQG0HVVDJH�ZLOO�ZDLW�IRU�D�UHWXUQ�YDOXH�WR�EH�SDVVHG�EDFN�WR�LW�EHIRUH�FRQWLQXLQJ�WR�H[HFXWH�FRGH�LQ�WKH�FDOOLQJ�DSSOLFDWLRQ��(YHU\�PHVVDJH�ZLWK�D�FRGH�RI�6�LV�IROORZHG�E\�WKDW�VDPH�PHVVDJH�ZLWK�D�FRGH�RI�5��$�PHVVDJH�FRGH�RI�5�PHDQV�WKDW�D�UHWXUQ�YDOXH�KDV�EHHQ�SDVVHG�EDFN�WR�WKH�FDOOHU��$�PHVVDJH�FRGH�RI�V�PHDQV�WKDW�WKH�UHWXUQ�YDOXH�FDQQRW�EH�DFFHVVHG�GXH�WR�D�VHFXULW\�UHVWULFWLRQ��7KH�QH[W�FROXPQ�LQ�WKH�0HVVDJHV�ZLQGRZ�GLVSOD\V�WKH�DFWXDO�PHVVDJH�QDPH��7KLV�QDPH�PLJKW�EH�SUHFHGHG�E\�RQH�RU�PRUH�SHULRGV��(DFK�SHULRG�LV�D�QHVWLQJ�OHYHO��7KLV�PHDQV�WKDW�D�PHVVDJH�FRXOG�EH�UHFHLYHG�E\�WKH�ZLQGRZ�SURFHGXUH�WKDW��LQ�WXUQ��PLJKW�ILUH�RII�VHYHUDO�RWKHU�PHVVDJHV��HDFK�RI�ZKLFK�FRXOG�EH�KDQGOHG�EHIRUH�WKH�RULJLQDO�PHVVDJH�FRPSOHWHV�SURFHVVLQJ��,I�\RX�ZDWFKHG�IRU�HYHU\�PHVVDJH�IRU�D�SDUWLFXODU�ZLQGRZ��\RX�ZRXOG�QRWLFH�WKDW�VRPH�PHVVDJHV�KDYLQJ�D�FRGH�RI�6��VHQW�PHVVDJHV��

Page 23: Visual Basic - Subclassing and Hooking with VB & VB NET

DUH�QRW�LPPHGLDWHO\�IROORZHG�E\�WKH�UHWXUQHG�PHVVDJH��,QVWHDG�VHYHUDO�RWKHU�QHVWHG�PHVVDJHV�PLJKW�EH�ILUHG�RII��HDFK�EHLQJ�SUHFHGHG�E\�RQH�RU�PRUH�SHULRGV��,W�ZRXOG�ORRN�VRPHWKLQJ�OLNH�WKLV�LQ�6S\�����������%���6��:0B1&$&7,9$7(�������%���6���:0B*(77(;7�������%���5���:0B*(77(;7�������%���5��:0B1&$&7,9$7(�9DOXHV�IROORZLQJ�WKH�PHVVDJH�ZLOO�GHVFULEH�LQ�GHWDLO�WKH�Z3DUDP�DQG�O3DUDP�SDUDPHWHUV��7KLV�GHVFULSWLRQ�GHSHQGV�RQ�WKH�W\SH�RI�PHVVDJH��%\�FKHFNLQJ�WKH�'HFRGHG�0HVVDJH�3DUDPHWHUV�DQG�'HFRGHG�5HWXUQ�9DOXHV�FKHFNER[HV�LQ�WKH�0HVVDJH�2SWLRQV�GLDORJ�ER[��\RX�ZLOO�EH�DEOH�WR�VHH�D�XVHIXO�GHVFULSWLRQ�RI�WKH�Z3DUDP��O3DUDP��DQG�UHWXUQ�YDOXHV�RI�HDFK�PHVVDJH���,I�\RX�GRXEOH�FOLFN�D�PHVVDJH��WKH�0HVVDJH�3URSHUWLHV�GLDORJ�ER[�DSSHDUV��7KLV�GLDORJ�EDVLFDOO\�GLVSOD\V�WKH�VDPH�LQIRUPDWLRQ�WKDW�LV�SUHVHQW�LQ�WKH�0HVVDJHV�FKLOG�ZLQGRZ��EXW�LW�DGGV�WZR�XVHIXO�IHDWXUHV��7KH�ILUVW�LV�WKH�:LQGRZ�+DQGOH�ILHOG�LQ�WKH�GLDORJ�ER[��ZKLFK�LV�D�K\SHUWH[W�OLQN�WR�WKH�ZLQGRZ�SURSHUWLHV��&OLFNLQJ�WKLV�ILHOG�ZLOO�WDNH�\RX�WR�WKH�:LQGRZ�3URSHUWLHV�GLDORJ�ER[�IRU�WKH�ZLQGRZ�ZLWK�WKDW�SDUWLFXODU�KDQGOH��7KH�VHFRQG�LV�WKDW��LI�D�PHVVDJH�FRQWDLQV�D�SRLQWHU�WR�D�VWULQJ�RU�D�VWUXFWXUH��WKH�0HVVDJH�3URSHUWLHV�GLDORJ�ER[�GLVSOD\V�WKH�DFWXDO�WH[W�LQ�WKH�FDVH�RI�D�VWULQJ�RU�WKH�PHPEHUV�DQG�WKHLU�YDOXHV�LQ�WKH�FDVH�RI�D�VWUXFWXUH���&OLFNLQJ�0HVVDJHV� 6WRS�/RJJLQJ�ZLOO�VWRS�6S\���IURP�GLVSOD\LQJ�PHVVDJHV���

��������8VLQJ�6S\���WR�H[DPLQH�D�9%�DSSOLFDWLRQ�

7KH�SDUHQW�RI�DOO�ZLQGRZV�LV�WKH�'HVNWRS�ZLQGRZ��WKLV�ZLQGRZ�ZLOO�DOZD\V�EH�DW�WKH�WRS�RI�WKH�KLHUDUFK\��%HORZ�WKDW�ZLQGRZ�DUH�DOO�WKH�SDUHQW�ZLQGRZV�ZLWKLQ�HDFK�UXQQLQJ�DSSOLFDWLRQ��7R�YLHZ�WKH�ZLQGRZ�LQIRUPDWLRQ�IRU�\RXU�9%�DSSOLFDWLRQ��VHDUFK�WKURXJK�WKH�OLVW�IRU�DQ\�SDUHQW�ZLQGRZV�FRQWDLQLQJ�WKH�WH[W�7KXQGHU57�)RUP'&��7KH�FDSWLRQ�RI�\RXU�ZLQGRZ�VKRXOG�EH�WR�WKH�OHIW�RI�7KXQGHU57�)RUP'&��H�J����&KDSWHU������6XEFODVVLQJ�([DPSOH��7KXQGHU57�)RUP'&���7KXQGHU57�)RUP'&�LV�WKH�QDPH�RI�WKH�FODVV�IURP�ZKLFK�WKLV�IRUP�ZDV�FUHDWHG��$Q\�IRUP�WKDW�\RXU�DSSOLFDWLRQ�FUHDWHV�ZLOO�EH�FUHDWHG�IURP�WKLV�FODVV�DQG�ZLOO�EH�FRQVLGHUHG�D�SDUHQW�ZLQGRZ��7KH�QH[W�OHYHO�EHORZ�WKH�SDUHQW�LV�WKH�FKLOG�ZLQGRZ��&KLOG�ZLQGRZV�DUH�XVXDOO\�FRQWUROV�FRQWDLQHG�ZLWKLQ�D�9%�IRUP��$Q\�9%�LQWULQVLF�FRQWURO�FODVV�ZLOO�EH�SUHSHQGHG�ZLWK�WKH�ZRUG�7KXQGHU57���+HQFH��D�FRPPDQG�EXWWRQ�ZRXOG�EH�FDOOHG�7KXQGHU57�&RPPDQG%XWWRQ�LQ�9HUVLRQ���RI�9%��&KLOG�ZLQGRZV�FDQ�EH�SDUHQWV�WR�RWKHU�FKLOG�ZLQGRZV��DV�KDSSHQV�ZKHQ�FRQWUROV��VXFK�DV�D�3LFWXUH%R[�FRQWURO��FRQWDLQ�FRQWUROV��(DFK�FRQWDLQHU�FRQWURO�LV�WKH�SDUHQW�WR�WKH�FKLOG�FRQWURO�V��WKDW�LW�FRQWDLQV���,I�\RX�UXQ�D�VLPSOH�9%�H[HFXWDEOH��(;(���\RX�ZLOO�QRWLFH�WKDW�VHYHUDO�GLIIHUHQW�KLGGHQ�ZLQGRZV�DUH�UXQQLQJ�ZLWKLQ�WKH�VDPH�SURFHVV�DV�\RXU�(;(��7KHVH�KLGGHQ�ZLQGRZV�DUH�9%%XEEOH57���2OH0DLQ7KUHDG:QG&ODVV��[����������9%0VR6WG&RPS0JU��7KXQGHU57�0DLQ��2OH'GH:QG&ODVV��[����������DQG�9%)RFXV57����

Page 24: Visual Basic - Subclassing and Hooking with VB & VB NET

(YHU\�9%�DSSOLFDWLRQ�KDV�D�KLGGHQ�WRS�OHYHO�ZLQGRZ�WR�ZKLFK�DOO�PHVVDJHV�DQG�HYHQWV�DUH�LQLWLDOO\�VHQW��7KLV�ZLQGRZ�LV�GHULYHG�IURP�WKH�FODVV�FDOOHG�7KXQGHU57�0DLQ��7KLV�ZLQGRZ�RZQV�DOO�RWKHU�9%�IRUPV�LQ�WKH�DSSOLFDWLRQ���2OH0DLQ7KUHDG:QG1DPH�LV�D�KLGGHQ�ZLQGRZ�GHULYHG�IURP�WKH�2OH0DLQ7KUHDG:QG&ODVV��[���������FODVV��,W�LV�FUHDWHG�E\�&20�WR�KDQGOH�PHVVDJH�PDUVKDOLQJ�EHWZHHQ�&20�FRPSRQHQWV���7KH�9%0VR6WG&RPS0JU�FODVV�LV�WKH�EDVLV�IRU�VHYHUDO�FRQWUROV�GHYHORSHG�IRU�0LFURVRIW�2IILFH��)RU�H[DPSOH��WKH�0LFURVRIW�2IILFH�GHYHORSPHQW�WHDP�FUHDWHG�WKH�GHIDXOW�WRROEDU�WKDW�DOO�ZLQGRZV�QRZ�XVH��7KH�OHWWHUV��0VR��FRQWDLQHG�LQ�9%0VR6WG&RPS0JU�VWDQG�IRU�0LFURVRIW�2IILFH��:KLOH�UXQQLQJ�DQ�DSSOLFDWLRQ�LQ�WKH�9%�,'(��WKLV�FODVV�ZLOO�GURS�WKH�9%�LQ�LWV�QDPH�DQG�EH�GLVSOD\HG�DV�0VR6WG&RPS0JU�LQVWHDG���7KH�ZLQGRZ�FUHDWHG�IURP�WKH�9%)RFXV57��FODVV�LV�DQ�LQYLVLEOH�SUR[\�IRUP�IRU�ZLQGRZOHVV�RU�OLJKWZHLJKW�FRQWUROV��7KLV�SUR[\�IRUP�LV�XVHG�WR�UHFHLYH�NH\ERDUG��PRXVH��DQG�V\VWHP�PHVVDJHV�IRU�WKHVH�FRQWUROV���$OO�9%�IRUP�DQG�FRQWURO�FODVVHV�DUH�VXSHUFODVVHV�RI�WKH�9%%XEEOH57��FODVV��ZKLFK�LV�DOVR�D�VXSHUFODVV�RI�WKH�7KXQGHU57�0DLQ�FODVV��7KH�9%%XEEOH57��FODVV�LV�UHVSRQVLEOH�IRU�IRUZDUGLQJ�PHVVDJHV�WR�WKH�DSSURSULDWH�ZLQGRZ���,I�\RX�EULQJ�XS�D�9%�DSSOLFDWLRQ��(;(��LQ�6S\����\RX�PLJKW�QRWLFH�WKDW�DOO�ZLQGRZV�EHJLQQLQJ�ZLWK�WKH�ZRUG�7KXQGHU57��KDYH�WKH�VDPH�ZLQGRZ�SURFHGXUH�DQG�FODVV�ZLQGRZ�SURFHGXUH��H[FHSW�IRU�7KXQGHU57�0DLQ��7R�VHH�WKLV��ORRN�DW�WKH�:LQGRZ�3URF�ILHOG�LQ�WKH�*HQHUDO�DQG�&ODVV�WDEV�RI�WKH�:LQGRZ�3URSHUWLHV�GLDORJ�ER[��7KH�UHDVRQ�DOO�ZLQGRZ�SURFHGXUHV�XVH�WKH�VDPH�IXQFWLRQ�SRLQWHU�LV�WKDW�DOO�FODVVHV�EHJLQQLQJ�ZLWK�WKH�ZRUG�7KXQGHU57���H[FHSW�IRU�7KXQGHU57�0DLQ��DUH�GHULYHG�IURP�WKH�VDPH�EDVH�FODVV��9%%XEEOH57���,Q�RWKHU�ZRUGV��7KXQGHU57�&RPPDQG%XWWRQ��7KXQGHU57�)RUP'&��HWF���DUH�DOO�VXSHUFODVVHV�RI�WKH�EDVH�FODVV��9%%XEEOH57���2WKHU�WKLUG�SDUW\�FRQWUROV�ZLOO�KDYH�GLIIHUHQW�ZLQGRZ�SURFHGXUHV�EHFDXVH�WKHVH�FRQWUROV�ZHUH�FUHDWHG�IURP�GLIIHUHQW�ZLQGRZ�FODVVHV���$QRWKHU�LQWHUHVWLQJ�WKLQJ�WR�QRWLFH�LV�WKH�FRQVWUXFWLRQ�RI�WKH�7KXQGHU57�&RPER%R[�FRQWURO��:KHQ�YLHZLQJ�D�FRQWURO�FUHDWHG�IURP�WKLV�FODVV��\RX�FDQ�GULOO�GRZQ�RQH�OHYHO�GHHSHU�WR�GLVFRYHU�D�VWDQGDUG�:LQGRZV�HGLW�FRQWURO���7KLV�LV�QRW�D�9%�FRQWURO�EHFDXVH�WKH�FODVV�QDPH�LV�QRW�SUHIL[HG�ZLWK�WKH�ZRUG�7KXQGHU���7KLV�VKRZV�WKDW�D�7KXQGHU57�&RPER%R[�FRQWURO�FRQVLVWV�RI�D�9%�GHILQHG�FRPER�ER[�DQG�D�VWDQGDUG�:LQGRZV�HGLW�FRQWURO��7KLV�LQIRUPDWLRQ�ZLOO�FRPH�LQ�KDQG\�LI�\RX�HYHU�QHHG�WR�VXEFODVV�D�9%�FRPER�ER[���,I�\RX�GRXEOH�FOLFN�D�ZLQGRZ�LQ�WKH�KLHUDUFK\��6S\���RSHQV�WKH�:LQGRZ�3URSHUWLHV�GLDORJ��ZKLFK�FRQWDLQV�LQIRUPDWLRQ�DERXW�WKDW�SDUWLFXODU�ZLQGRZ��7KHUH�DUH�ILYH�WDEV�LQ�WKLV�GLDORJ�ER[��*HQHUDO��6W\OHV��:LQGRZV��&ODVV��DQG�3URFHVV��7KH�*HQHUDO�WDE�KDV�VHYHUDO�LWHPV�RI�LQWHUHVW��7KH�:LQGRZ�&DSWLRQ�GLVSOD\V�WKH�FDSWLRQ�RI�D�IRUP�RU�EXWWRQ��6RPH�ZLQGRZV��VXFK�DV�WKH�WH[W�ER[�FRQWURO��GR�QRW�KDYH�FDSWLRQV��7KH�:LQGRZ�+DQGOH�LV�WKH�XQLTXH��V\VWHP�ZLGH�KDQGOH�RI�WKH�VHOHFWHG�ZLQGRZ��7KLV�YDOXH�LV�DOZD\V�SDVVHG�RQ�WR�WKH�ZLQGRZV�ZLQGRZ�SURFHGXUH�WR�LGHQWLI\�ZKLFK�ZLQGRZ�WKH�PHVVDJH�ZDV�GLUHFWHG�WR��:KHQ�ZDWFKLQJ�PHVVDJHV�ZLWK�6S\����LW�LV�VRPHWLPHV�KHOSIXO��HVSHFLDOO\�ZKHQ�GHEXJJLQJ��WR�PDWFK�XS�WKH�ZLQGRZ�KDQGOH�LQ�WKH�

Page 25: Visual Basic - Subclassing and Hooking with VB & VB NET

PHVVDJH�WR�DQ�DFWXDO�ZLQGRZ��7KLV�ZLOO�VKRZ�\RX�ZKLFK�ZLQGRZ�LV�UHFHLYLQJ�WKH�PHVVDJH��7KH�:LQGRZ�3URF�LV�DQRWKHU�YHU\�YDOXDEOH�ILHOG�RQ�WKLV�WDE��WKLV�LV�WKH�ILHOG�ZH�FKDQJH�WR�VXEFODVV�D�ZLQGRZ��'R�QRW�FRQIXVH�LW�ZLWK�WKH�FODVV�ZLQGRZ�SURFHGXUH��ZKLFK�LV�FRQWDLQHG�RQO\�ZLWKLQ�WKH�FODVV�DQG�QRW�WKH�ZLQGRZ�LQVWDQFH��%HIRUH�VXEFODVVLQJ�D�ZLQGRZ��FKHFN�RXW�WKH�YDOXH�RI�LWV�:LQGRZ�3URF��$IWHU�VXEFODVVLQJ�D�ZLQGRZ��UHFKHFN�WKLV�YDOXH��GRQW�IRUJHW�WR�KLW�)��WR�UHIUHVK�WKH�YLHZ���<RXOO�QRWLFH�WKDW�LW�KDV�FKDQJHG�DQG�LV�QRZ�SRLQWLQJ�WR�WKH�ZLQGRZ�SURFHGXUH�ZH�GHILQHG�LQ�RXU�FRGH��%$6��PRGXOH��$IWHU�UHPRYLQJ�WKH�VXEFODVV��FKHFN�WKLV�YDOXH�DJDLQ�DQG�QRWLFH�WKDW�LW�KDV�EHHQ�UHWXUQHG�WR�LWV�RULJLQDO�QXPEHU���7KH�6W\OHV�WDE�KDV�WZR�OLVW�ER[HV��RQH�FRQWDLQLQJ�:LQGRZ�6W\OHV�DQG�WKH�RWKHU�FRQWDLQLQJ�([WHQGHG�6W\OHV��7KHVH�VW\OHV�KDYH�DQ�LQGLUHFW�HIIHFW�RQ�WKH�PHVVDJHV�WKDW�D�ZLQGRZ�VHQGV�DQG�UHFHLYHV��IRU�GHWDLOV��VHH�WKH�GRFXPHQWDWLRQ�RQ�WKH�06'1�&'�520��7KH�:LQGRZV�WDE�FRQWDLQV�WKH�ZLQGRZ�KDQGOHV�WR�WKH�VHOHFWHG�ZLQGRZV�SDUHQW��WKH�ILUVW�FKLOG��DQG�DQ\�RZQHU�ZLQGRZV�RI�WKDW�SDUWLFXODU�ZLQGRZ��7KH�SDUHQW�ZLQGRZ�KDQGOH�LV�XVHIXO�WR�GHWHUPLQH�WR�ZKLFK�ZLQGRZ�D�QRWLILFDWLRQ�PHVVDJH�ZLOO�EH�VHQW��7KH�RZQHU�ZLQGRZ�RI�DQ\�9%�DSSOLFDWLRQ�LV�WKH�ZLQGRZ�FUHDWHG�IURP�WKH�7KXQGHU57�0DLQ�FODVV��7KH�KDQGOHV�OLVWHG�RQ�WKLV�WDE�DUH�K\SHUOLQNV�WR�WKH�ZLQGRZV�WKDW�WKH\�UHIHUHQFH��&OLFNLQJ�WKH�K\SHUOLQN�GLVSOD\V�WKH�SURSHUWLHV�RI�WKDW�ZLQGRZ�LQ�WKH�:LQGRZ�3URSHUWLHV�GLDORJ�ER[���7KH�&ODVV�WDE�LV�DOVR�YHU\�XVHIXO�IRU�GHWHUPLQLQJ�VXEFODVVLQJ�LQIRUPDWLRQ��7KH�&ODVV�1DPH�LV�WKH�QDPH�JLYHQ�WR�WKLV�FODVV�ZKHQ�LW�ZDV�UHJLVWHUHG�ZLWK�WKH�V\VWHP��7KH�&ODVV�$WRP�LV�WKH�XQLTXH����ELW�LQWHJHU�YDOXH�WKDW�LGHQWLILHV�WKLV�FODVV��LW�LV�UHWXUQHG�IURP�WKH�FDOO�WR�5HJLVWHU&ODVV([��(YHU\�FODVV�DOVR�KDV�VW\OHV�VLPLODU�WR�D�ZLQGRZ�VW\OH��7KH�&'B'%/&/.6��&6B+5('5$:��&6B95('5$:��DQG�&6B6$9(%,76�FODVV�VW\OHV�FDQ�KDYH�DQ�HIIHFW�RQ�WKH�PHVVDJHV�VHQW�DQG�UHFHLYHG�E\�D�ZLQGRZ��7KHUH�LV�RQH�PRUH�ELW�RI�FULWLFDO�LQIRUPDWLRQ�RQ�WKLV�WDE��WKH�:LQGRZ�3URF�ILHOG��ZKLFK�WUDQVODWHV�WR�WKH�ZLQGRZ�SURFHGXUH�RI�WKH�FODVV��QRW�WKH�ZLQGRZ��8VLQJ�WKLV�ILHOG��ZH�FDQ�GHWHUPLQH�ZKHQ�D�ZLQGRZ�KDV�EHHQ�VXEFODVVHG��$OO�ZH�KDYH�WR�GR�LV�VHH�ZKHWKHU�WKH�:LQGRZ�3URF�YDOXHV�RQ�WKH�*HQHUDO�DQG�&ODVV�WDEV�PDWFK��,I�WKH\�GR��WKH�ZLQGRZ�KDV�QRW�EHHQ�VXEFODVVHG��,I�WKH\�DUH�GLIIHUHQW��WKH�ZLQGRZ�LV�VXEFODVVHG��*OREDO�VXEFODVVLQJ�DQG�VXSHUFODVVLQJ�DUH�WZR�WHFKQLTXHV�WKDW�ZLOO�PRGLI\�WKH�FODVV�ZLQGRZ�SURFHGXUH�GLUHFWO\���7KLV�FRPSOHWHV�WKH�ZKLUOZLQG�WRXU�RI�6S\����,I�\RX�GR�QRWKLQJ�HOVH��IDPLOLDUL]H�\RXUVHOI�ZLWK�WKLV�XWLOLW\��(YHQ�LI�\RX�QHYHU�XVH�VXEFODVVLQJ�RU�KRRNV��\RX�FDQ�VWLOO�XVH�WKLV�XWLOLW\�WR�GHEXJ�DSSOLFDWLRQ�PHVVDJH�IORZ��DV�ZHOO�DV�ZDWFK�DQG�OHDUQ�KRZ�DQ�DSSOLFDWLRQ�LV�VHW�XS�DQG�RSHUDWHV�ZLWKLQ�WKH�V\VWHP���

������1X0HJD�6PDUW&KHFN�

6PDUW&KHFN��GHYHORSHG�E\�1X0HJD��KWWS���ZZZ�QXPHJD�FRP���LV�D�WRRO�GHVLJQHG�WR�KHOS�GHYHORSHUV�WUDFN�GRZQ�EXJV�DQG�FRUUHFW�WKHP��$V�DQ�DGGLWLRQDO�ERQXV��ZLWK�WKLV�WRRO�\RX�FDQ�WDNH�D�ORRN�XQGHU�WKH�KRRG�RI�D�FRPSLOHG�9%�DSSOLFDWLRQ�DQG�ZDWFK�KRZ�LW�ZRUNV��7R�WHOO�\RX�

Page 26: Visual Basic - Subclassing and Hooking with VB & VB NET

KRZ�WR�XVH�LW�ZRXOG�UHTXLUH�PRUH�WKDQ�MXVW�RQH�FKDSWHU��,�ZLOO�OHDYH�WKDW�VXEMHFW�WR�WKH�GRFXPHQWDWLRQ�SURYLGHG�ZLWK�WKH�WRRO���6PDUW&KHFN�UHDOO\�VKLQHV�ZKHQ�\RXU�DSSOLFDWLRQ�WKURZV�D�*HQHUDO�3URWHFWLRQ�)DXOW��*3)���,I�\RX�KDYH�HYHU�KDG�WKH�SOHDVXUH�RI�WUDFNLQJ�GRZQ�D�*3)�LQ�9%�ZLWKRXW�DQ\�WRROV��\RX�ZLOO�XQGHUVWDQG�ZKDW�,�PHDQ��%HFDXVH�9%�KLGHV�PDQ\�ORZHU�OHYHO�V\VWHP�RSHUDWLRQV�IURP�WKH�GHYHORSHU��LW�LV�GLIILFXOW�WR�GHWHUPLQH�ZK\�D�SLHFH�RI�FRGH�ZLOO�SURGXFH�D�*3)��DQG�LI�LW�KDSSHQV�DW�UDQGRP�LQWHUYDOV��LW�LV�QHDUO\�LPSRVVLEOH�WR�ILJXUH�RXW��6PDUW&KHFN�JRHV�RYHU�HDFK�H[HFXWLQJ�OLQH�RI�FRGH�ZLWK�D�ILQH�WRRWKHG�FRPE��7KDW�ZD\��LW�LV�SRVVLEOH�WR�VHH�D�SUREOHP�VXFK�DV�D�VWULQJ�UHWXUQHG�IURP�DQ�$3,�FDOO�WKDW�LV�RYHUZULWLQJ�LWV�ERXQGV�DQG�VHWWLQJ�XS�D�WLPH�ERPE�WKDW�ZLOO�HYHQWXDOO\�EORZ�XS�LQ�\RXU�IDFH��7U\�ILQGLQJ�WKDW�SUREOHP�\RXUVHOI�ZLWKRXW�DQ\�WRROV���6PDUW&KHFN�WUDFNV�DOO�VRUWV�RI�LWHPV�VXFK�DV�$3,�FDOOV��EDG�FDOOV�WR�LQWULQVLF�9%�IXQFWLRQV��YDOXH�FRHUFLRQ�SUREOHPV��PHVVDJHV��PHPRU\�OHDNV��KRRNV��DQG�PXFK�PRUH��:H�ZLOO�EH�SD\LQJ�FORVH�DWWHQWLRQ�WR�WKH�KRRNV��PHVVDJHV��DQG�$3,�FDOOV�WKDW�6PDUW&KHFN�ZLOO�EH�ZDWFKLQJ�WKURXJKRXW�WKH�ERRN���

������'EJZSURF�GOO�

7KLV�LV�D�G\QDPLF�OLQN�OLEUDU\��'//��WKDW�\RX�FDQ�JHW�IURP�WKH�0LFURVRIW�ZHE�VLWH�WKDW�KHOSV�ZLWK�WURXEOHVKRRWLQJ�9%�DSSOLFDWLRQV�WKDW�XVH�VXEFODVVLQJ��$V�ZH�VKDOO�VHH�ODWHU��GHEXJJLQJ�D�9%�DSSOLFDWLRQ�WKDW�XVHV�WKH�VXEFODVVLQJ�DQG�KRRNLQJ�WHFKQLTXHV�GHVFULEHG�LQ�WKLV�ERRN�LV�GLIILFXOW�EHFDXVH��KDYLQJ�FLUFXPYHQWHG�9%V�RZQ�SURWHFWLYH�PHFKDQLVPV��\RX�FDQQRW�JR�YHU\�IDU�ZLWK�WKH�GHEXJJLQJ�WRROV�9%�SURYLGHV��'EJZSURF�GOO�LV�D�WRRO�WKDW��ZKHQ�\RXU�DSSOLFDWLRQ�LV�UXQQLQJ�LQ�GHEXJ�PRGH��ZLOO�DOORZ�\RX�WR�WUDFH�WKURXJK�\RXU�DSSOLFDWLRQ�ZLWKRXW�FUDVKLQJ��<RX�FDQ�ILQG�WKLV�WRRO�RQ�WKH�0LFURVRIW�ZHE�VLWH�DW�KWWS���PVGQ�PLFURVRIW�FRP�YEDVLF�GRZQORDGV�FRQWUROV�DVS��,�ZLOO�WDON�DERXW�WKLV�WRRO�LQ�&KDSWHU�����

������0LFURVRIW�6\VWHP�,QIRUPDWLRQ�

7KLV�XWLOLW\�FDQ�EH�UXQ�XQGHU�:LQGRZV����E\�VHOHFWLQJ�6WDUW� 3URJUDPV� $FFHVVRULHV�6\VWHP�7RROV� 6\VWHP�,QIRUPDWLRQ��6DGO\��WKH�6\VWHP�,QIRUPDWLRQ�DSSOLFDWLRQ�SURYLGHG�ZLWK�:LQGRZV�17������GRHV�QRW�VKRZ�WKLV�LQIRUPDWLRQ���

)LJXUH������'LVSOD\LQJ�V\VWHP�KRRNV�LQ�0LFURVRIW�6\VWHP�,QIRUPDWLRQ�

Page 27: Visual Basic - Subclassing and Hooking with VB & VB NET

7KLV�WRRO�FDQ�GLVSOD\�DOO�WKH�V\VWHP�ZLGH�KRRNV�WKDW�DUH�FXUUHQWO\�LQVWDOOHG�LQ�WKH�V\VWHP��7R�GR�WKLV��H[SDQG�WKH�SDWK�6\VWHP�,QIRUPDWLRQ� 6RIWZDUH�(QYLURQPHQW� 6\VWHP�+RRNV��7KLV�ZLOO�JLYH�XV�LQVLJKW�LQWR�DSSOLFDWLRQV�WKDW�XVH�V\VWHP�ZLGH�KRRNV�WR�GR�WKHLU�ZRUN��,Q�WKH�$SSOLFDWLRQV�FROXPQ�LQ�)LJXUH������\RX�VHH�WKUHH�HQWULHV�IRU�63<;;�(;(��ZKLFK�LV�WKH�6S\���XWLOLW\�WKDW�ZH�GLVFXVVHG�SUHYLRXVO\��:H�FDQ�VHH�WKDW�LW�LQVWDOOV�WKUHH�V\VWHP�ZLGH�KRRNV��*HW0HVVDJH��:LQGRZ�3URFHGXUH��DQG�:LQGRZ�3URFHGXUH�5HVXOW��:H�ZLOO�GLVFXVV�V\VWHP�ZLGH�KRRNV��LQFOXGLQJ�WKHVH�WKUHH�W\SHV�RI�KRRNV��WKURXJKRXW�3DUW�,,,�RI�WKLV�ERRN��7KLV�XWLOLW\�DOVR�FDQ�EH�XVHG�WR�PDNH�VXUH�WKDW�RXU�DSSOLFDWLRQV�DUH�LQVWDOOLQJ�RXU�V\VWHP�ZLGH�KRRNV�FRUUHFWO\��8QIRUWXQDWHO\��WKLV�LV�DOO�WKH�LQIRUPDWLRQ�DERXW�KRRNV�WKDW�LW�FDQ�JLYH�XV��

����$�:RUG�RI�:DUQLQJ�

7KH�WHFKQLTXHV�SUHVHQWHG�LQ�WKLV�ERRN�PDNH�H[WHQVLYH�XVH�RI�WKH�:LQ���$3,�DQG�SRLQWHUV��$V�\RX�NQRZ��9%�GRHV�QRW�JLYH�XV�GLUHFW�DFFHVV�WR�SRLQWHUV��,QVWHDG�ZH�PXVW�XVH�$3,�IXQFWLRQV�WR�FRQYHUW�WKHVH�SRLQWHUV�LQWR�LQIRUPDWLRQ�WKDW�9%�FDQ�XVH���$V�ZLWK�XVLQJ�SRLQWHUV�LQ�&��ZH�PXVW�DOVR�WDNH�FDUH�ZKHQ�KDQGOLQJ�SRLQWHUV�LQ�9%��)DLOLQJ�WR�GR�VR�ZLOO�UHVXOW�LQ�\RXU�DSSOLFDWLRQ�EHKDYLQJ�XQSUHGLFWDEO\�RU�FUDVKLQJ���,QFRUUHFWO\�VHWWLQJ�XS�DQG�FDOOLQJ�:LQ���$3,�IXQFWLRQV�LV�DQRWKHU�VRXUFH�RI�SUREOHPV��7R�IXQFWLRQ�FRUUHFWO\��$3,�IXQFWLRQV�PXVW�QRW�RQO\�EH�GHFODUHG�FRUUHFWO\�LQ�9%��EXW�DOVR�KDYH�WKHLU�DUJXPHQWV�SDVVHG�LQ�SURSHUO\���,�ZLOO�QRW�EH�FRYHULQJ�LQ�DQ\�JUHDW�GHWDLO�KRZ�WR�VHW�XS�DQG�FDOO�:LQ���$3,�IXQFWLRQV�LQ�WKLV�ERRN��,W�LV�XS�WR�\RX�WR�PDNH�VXUH�WKH�$3,�IXQFWLRQV�WKDW�\RX�XVH�DUH�GHFODUHG�DQG�XVHG�SURSHUO\��)RU�PRUH�LQIRUPDWLRQ�RQ�WKH�WRSLF�RI�:LQ���$3,�IXQFWLRQV��\RX�FDQ�UHDG�6WHYHQ�5RPDQV�ERRN�HQWLWOHG�:LQ���$3,�3URJUDPPLQJ�:LWK�9LVXDO�%DVLF��SXEOLVKHG�E\�25HLOO\��$VVRFLDWHV���

Page 28: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU����:LQGRZV�6\VWHP�6SHFLILF�,QIRUPDWLRQ�%HIRUH�GHOYLQJ�LQWR�WKH�JXWV�RI�VXEFODVVLQJ�DQG�XVLQJ�KRRNV��ZH�PXVW�ILUVW�OHDUQ�KRZ�WKH�:LQGRZV�PHVVDJLQJ�V\VWHP�ZRUNV��7KLV�FKDSWHU�LV�QRW�JRLQJ�WR�WHDFK�\RX�DOO�WKH�GHWDLOV�RI�SURFHVVHV��WKUHDGV��RU�VRPH�RI�WKH�RWKHU�:LQGRZV�REMHFWV�HQFRXQWHUHG�ZKLOH�SURJUDPPLQJ�WKH�RSHUDWLQJ�V\VWHP��,QVWHDG��,�ZLOO�FRQFHQWUDWH�RQ�WKH�SDUWLFXODUV�RI�WKH�:LQGRZV�RSHUDWLQJ�V\VWHP�RQO\�LQVRIDU�DV�WKH\�DSSO\�WR�WKH�VXEMHFW�RI�WKLV�ERRN���8QGHUVWDQGLQJ�KRZ�WKH�:LQGRZV�PHVVDJLQJ�VXEV\VWHP�ZRUNV�LV�D�QHFHVVDU\�ILUVW�VWHS�WRZDUG�OHDUQLQJ�KRZ�WR�FRUUHFWO\�GHVLJQ�DQG�LPSOHPHQW�VXEFODVVLQJ�DQG�KRRNV�WKURXJK�9LVXDO�%DVLF��9%���,Q�IDFW��WKLV�KROGV�WUXH�IRU�XVLQJ�VXEFODVVLQJ�RU�KRRNV�LQ�DQ\�ODQJXDJH��EXW�LW�LV�PRUH�LPSRUWDQW�LQ�9%�EHFDXVH�9%�VKLHOGV�WKH�GHYHORSHU�IURP�JRLQJ�WRR�GHHSO\�LQWR�WKH�:LQGRZV�LQWHUQDOV��7KLV�LV�D�GRXEOH�HGJHG�VZRUG��2Q�RQH�KDQG��9%�PDNHV�LW�YHU\�VLPSOH�WR�FRQVWUXFW�DSSOLFDWLRQV�WKDW�PLJKW�WDNH�PXFK�PRUH�WLPH�DQG�HIIRUW�LQ�D�GLIIHUHQW�ODQJXDJH�VXFK�DV�&����2Q�WKH�RWKHU�KDQG��QRW�EHLQJ�DEOH�WR�HDVLO\�JHW�LQWLPDWH�ZLWK�WKH�ORZHU�OHYHOV�RI�WKH�:LQGRZV�RSHUDWLQJ�V\VWHP�PDNHV�WKH�WDVN�RI�GHEXJJLQJ�DQG�LPSOHPHQWLQJ�DGYDQFHG�IXQFWLRQDOLW\�LQWR�RXU�DSSOLFDWLRQV�PRUH�GLIILFXOW��.QRZOHGJH�RI�ZKDW�LV�KDSSHQLQJ�LQ�WKH�V\VWHP��ZKHUH�LW�LV�KDSSHQLQJ��DQG�ZK\�LW�LV�KDSSHQLQJ�LV�HVVHQWLDO�WR�FRQVWUXFWLQJ�DQG�GHEXJJLQJ�\RXU�DSSOLFDWLRQV���7LQNHULQJ�ZLWK�WKH�:LQGRZV�PHVVDJLQJ�V\VWHP�LV�QHLWKHU�VWUDLJKWIRUZDUG�QRU�HDV\��2QH�ZURQJ�OLQH�RI�FRGH��RQH�PLVSODFHG�SRLQWHU����HYHQ�H[LWLQJ�\RXU�DSSOLFDWLRQ�HDUO\����FRXOG�HDVLO\�EULQJ�GRZQ�WKH�HQWLUH�V\VWHP��&UHDWLQJ�LQYDOLG�SDJH�IDXOWV�DV�ZHOO�DV�IUHH]LQJ�DQ�DSSOLFDWLRQ�RU�\RXU�HQWLUH�V\VWHP�LV�HDV\�WR�GR�ZKHQ�DGGLQJ�VXEFODVVLQJ�DQG�RU�KRRNV�WR�DQ�DSSOLFDWLRQ��7KLV�LV�WKH�PDLQ�UHDVRQ�ZK\�VRPH�GHYHORSHUV�VK\�DZD\�IURP�XVLQJ�WKHVH�WRROV�DQG�VRPHWLPHV�HYHQ�GRZQSOD\�WKHLU�XVHIXOQHVV��$UPHG�ZLWK�WKH�LQIRUPDWLRQ�LQ�WKLV�ERRN��\RX�ZLOO�EH�DEOH�WR�FRQVLVWHQWO\�XVH�WKHVH�WRROV�WR�DGG�DGYDQFHG�IXQFWLRQDOLW\�WR�\RXU�DSSOLFDWLRQV�ZLWK�D�PLQLPXP�RI�SDLQ�DQG�FRQIXVLRQ���:LWK�WKDW�VDLG��WKLV�FKDSWHU�ZLOO�IRFXV�PDLQO\�RQ�H[SODLQLQJ�WKH�XQGHUO\LQJ�:LQGRZV�PHVVDJLQJ�V\VWHP��ZKDW�LV�LW��KRZ�LW�ZRUNV��DV�ZHOO�DV�ZKDW�PDNHV�XS�D�PHVVDJH�DQG�KRZ�WR�LQWHUSUHW�LW��7KLV�ZLOO�JLYH�\RX��WKH�GHYHORSHU��D�VROLG�IRXQGDWLRQ�RQ�ZKLFK�WR�EXLOG�WKURXJKRXW�WKH�UHVW�RI�WKH�FKDSWHUV���

����,QVLGH�D�:LQGRZV�$SSOLFDWLRQ�

7KLV�VHFWLRQ�IRFXVHV�RQ�WKH�DUHDV�WKDW�DUH�RI�JUHDWHVW�LQWHUHVW�WR�XV�LQ�XVLQJ�VXEFODVVLQJ�DQG�KRRNV�HIIHFWLYHO\��,I�\RX�DUH�LQWHUHVWHG�LQ�OHDUQLQJ�PRUH�DERXW�WKHVH�VXEMHFWV��SLFN�XS�D�FRS\�RI�:LQ���$3,�3URJUDPPLQJ�ZLWK�9LVXDO�%DVLF�E\�6WHYHQ�5RPDQ��+H�JLYHV�WKHVH�WRSLFV�D�YHU\�WKRURXJK�H[SODQDWLRQ���

Page 29: Visual Basic - Subclassing and Hooking with VB & VB NET

������:LQGRZ�5HODWLRQVKLSV�

$OO�ZLQGRZV�DUH�UHODWHG�LQ�VRPH�ZD\�WR�RQH�RU�PRUH�RWKHU�ZLQGRZV��7KH�PRVW�FRPPRQ�W\SH�RI�ZLQGRZ�UHODWLRQVKLS�LV�WKH�SDUHQW�FKLOG�UHODWLRQVKLS��2WKHU�W\SHV�RI�UHODWLRQVKLSV�LQFOXGH�RZQHU�RZQHG�DQG�WRS�OHYHO�ZLQGRZV��$OWKRXJK�LQIRUPDWLRQ�RQ�WKH�UHODWLRQVKLS�RI�RQH�ZLQGRZ�WR�DQRWKHU�LV�QRW�D�UHTXLUHPHQW�WR�XQGHUVWDQGLQJ�VXEFODVVLQJ�RU�KRRNV��LW�LV�YHU\�KHOSIXO��7KLV�LQIRUPDWLRQ�ZLOO�FRPH�LQWR�SOD\�PRUH�DV�,�GLVFXVV�VXEFODVVLQJ�WKH�FRPPRQ�GLDORJ�ER[HV�DQG�DV�,�JHW�LQWR�WKH�VSHFLILFV�RI�KRRNV��VXFK�DV�WKH�:+B6+(//�KRRN��)RU�H[DPSOH��WKH�:+B6+(//�KRRN�RQO\�SURYLGHV�LQIRUPDWLRQ�RQ�WRS�OHYHO��XQRZQHG�ZLQGRZV���&HQWUDO�WR�GHILQLQJ�WKH�UHODWLRQVKLS�DPRQJ�ZLQGRZV�LV�WKH�FRQFHSW�RI�=�RUGHU��:KHQ�ZLQGRZV�DUH�GUDZQ�RQ�WKH�VFUHHQ��RQO\�RQH�ZLQGRZ�FDQ�EH�DFWLYH�DW�DQ\�WLPH��7KLV�DFWLYH�ZLQGRZ�UHFHLYHV�XVHU�LQSXW�WKURXJK�WKH�PRXVH�DQG�NH\ERDUG��7KLV�ZLQGRZ�DOVR�RYHUODSV�DOO�RWKHU�GLVSOD\HG�ZLQGRZV�RQ�WKH�VFUHHQ��7KH�ZLQGRZV�EHORZ�WKH�DFWLYH�ZLQGRZ�DUH�VWDFNHG�RQH�RQ�WRS�RI�WKH�RWKHU��WKLV�LV�LOOXVWUDWHG�LQ�)LJXUH������<RX�FDQ�WKLQN�RI�WKLV�VWDFN�RI�ZLQGRZV�DV�EHLQJ�VLPLODU�WR�D�VWDFN�RI�SDSHU��7KH�SLHFH�RI�SDSHU�RQ�WKH�WRS�RI�WKH�VWDFN�LV�WKH�WRSPRVW�SLHFH�RI�SDSHU��7KH�QH[W�SLHFH�RI�SDSHU�LV�ORFDWHG�EHORZ�WKH�WRSPRVW�SLHFH��WKH�WKLUG�SLHFH�GRZQ�LV�ORFDWHG�EHORZ�WKH�VHFRQG�RQH��DQG�VR�RQ�DQG�VR�IRUWK���

)LJXUH������7KH�ZLQGRZ�=�RUGHU�

$�=�RUGHU�GHILQHV�ZKHUH�D�ZLQGRZ�LV�FXUUHQWO\�DW�LQ�WKH�VWDFN�RI�ZLQGRZV��0DNLQJ�D�ZLQGRZ�WKH�DFWLYH�ZLQGRZ�ZLOO�SODFH�LW�DW�WKH�WRS�RI�WKH�=�RUGHU��8VLQJ�WKH�=�RUGHU��ZH�FDQ�GHWHUPLQH�ZKLFK�ZLQGRZ�ZLOO�EH�JLYHQ�WKH�IRFXV�ZKHQ�WKH�FXUUHQW�ZLQGRZ�LV�PLQLPL]HG��7KH�ZLQGRZ�JLYHQ�WKH�IRFXV�ZLOO�EH�WKH�QH[W�ZLQGRZ�GRZQ��VWDUWLQJ�IURP�WKH�WRS�RI�WKH�=�RUGHU���7KH�=�RUGHU�DOVR�GHVFULEHV�WKH�RUGHULQJ�RI�FRQWUROV�ZLWKLQ�D�ZLQGRZ��,I�WZR�FRQWUROV�RYHUODS�DQG�WKH�ILUVW�LV�KLJKHU�RQ�WKH�=�RUGHU�WKDQ�WKH�VHFRQG��WKH�ILUVW�FRQWURO�LV�GUDZQ�RQ�WRS�RI�WKH�VHFRQG�FRQWURO���7KH�=�RUGHU�FDQ�EH�PDQLSXODWHG�WKURXJK�WKH�6HW:LQGRZ3RV�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IXQFWLRQ��7KLV�LV�WKH�9%�GHFODUDWLRQ�IRU�WKLV�IXQFWLRQ���3XEOLF�'HFODUH�)XQFWLRQ�6HW:LQGRZ3RV�/LE��XVHU����$OLDV��6HW:LQGRZ3RV��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�K:QG,QVHUW$IWHU�$V�/RQJ��B�� � %\9DO�[�$V�/RQJ��%\9DO�\�$V�/RQJ��%\9DO�F[�$V�/RQJ��B�� � %\9DO�F\�$V�/RQJ��%\9DO�Z)ODJV�$V�/RQJ��$V�/RQJ�'HILQLWLRQV�RI�WKLV�IXQFWLRQV�SDUDPHWHUV�DUH���

Page 30: Visual Basic - Subclassing and Hooking with VB & VB NET

KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�EHLQJ�PRGLILHG��K:QG,QVHUW$IWHU

7KH�KDQGOH�RI�WKH�ZLQGRZ�WKDW�FRPHV�EHIRUH�WKLV�ZLQGRZ�LQ�WKH�=�RUGHU��7KLV�DUJXPHQW�DOVR�FDQ�WDNH�WKH�IROORZLQJ�FRQVWDQWV���

HWND_BOTTOM (1)

3ODFHV�WKH�ZLQGRZ�DW�WKH�ERWWRP�RI�WKH�=�RUGHU��HWND_NOTOPMOST (-2)

)RU�WRSPRVW�ZLQGRZV��SODFHV�WKH�ZLQGRZ�DERYH�DOO�QRQWRSPRVW�ZLQGRZV��WKDW�LV��EHKLQG�DOO�WRSPRVW�ZLQGRZV���)RU�QRQWRSPRVW�ZLQGRZV��WKH�IODJ�KDV�QR�HIIHFW���

HWND_TOP (0)

3ODFHV�WKH�ZLQGRZ�DW�WKH�WRS�RI�WKH�=�RUGHU��HWND_TOPMOST (-1)

3ODFHV�WKH�ZLQGRZ�DERYH�DOO�QRQWRSPRVW�ZLQGRZV�DQG�PDLQWDLQV�WKH�ZLQGRZV�WRSPRVW�SRVLWLRQ��HYHQ�LI�LW�ORVHV�WKH�IRFXV��DQ�RSWLRQ�W\SLFDOO\�LQGLFDWHG�RQ�PHQXV�DV��DOZD\V�RQ�WRS�����

[

(TXLYDOHQW�WR�WKH�/HIW�SURSHUW\�LQ�9%��\

(TXLYDOHQW�WR�WKH�7RS�SURSHUW\�LQ�9%��F[

(TXLYDOHQW�WR�WKH�:LGWK�SURSHUW\�LQ�9%��F\

(TXLYDOHQW�WR�WKH�+HLJKW�SURSHUW\�LQ�9%��Z)ODJV

)ODJV�WKDW�VSHFLI\�WKH�VL]LQJ�DQG�SRVLWLRQLQJ�DWWULEXWHV��,I�PXOWLSOH�IODJV�DUH�SUHVHQW��WKH\�FDQ�EH�ORJLFDOO\�2UHG�WRJHWKHU��6RPH�RI�WKH�SRVVLEOH�IODJV�DUH���

SWP_DRAWFRAME (32)

'UDZV�D�IUDPH�DURXQG�WKH�ZLQGRZ���SWP_HIDEWINDOW (128)

+LGHV�WKH�ZLQGRZ���SWP_NOACTIVATE (16)

'RHV�QRW�DFWLYDWH�WKH�ZLQGRZ��2WKHUZLVH��6HW:LQGRZ3RV�E\�GHIDXOW�DFWLYDWHV�WKH�ZLQGRZ���

SWP_NOMOVE (2)

5HWDLQV�WKH�ZLQGRZV�FXUUHQW�SRVLWLRQ��L�H���LJQRUHV�WKH�[�DQG�\�SDUDPHWHUV����SWP_NOOWNERZORDER (512)

/HDYHV�WKH�RZQHU�ZLQGRZV�SRVLWLRQ�LQ�WKH�=�RUGHU�XQFKDQJHG���SWP_NOREPOSITION (512)

7KH�VDPH�DV�WKH�6:3B122:1(5=25'(5�IODJ���SWP_NOSIZE (1)

5HWDLQV�WKH�FXUUHQW�ZLQGRZ�VL]H��LJQRUHV�WKH�F[�DQG�F\�SDUDPHWHUV����SWP_NOZORDER (4)

5HWDLQV�WKH�FXUUHQW�=�RUGHU��LJQRUHV�WKH�K:QG,QVHUW$IWHU�SDUDPHWHU����

Page 31: Visual Basic - Subclassing and Hooking with VB & VB NET

SWP_SHOWWINDOW (64)

'LVSOD\V�WKH�ZLQGRZ���7KLV�IXQFWLRQ�LV�VXFFHVVIXO�ZKHQ�WKH�UHWXUQ�YDOXH�LV�QRQ]HUR��<RX�FDQ�VHW�D�ZLQGRZ�WR�EH�DOZD\V�RQ�WRS�LQ�9%�XVLQJ�WKH�6HW:LQGRZ3RV�IXQFWLRQ��DV�WKLV�FRGH�LOOXVWUDWHV���6HW7RS0RVW:LQGRZ� �6HW:LQGRZ3RV�)RUP��KZQG��+:1'B7230267��������������B�� � 6:3B12029(�25�6:3B126,=(��:KHQ�WKH�:LQGRZV�RSHUDWLQJ�V\VWHP�LV�VWDUWHG��D�GHVNWRS�ZLQGRZ�LV�FUHDWHG��7KLV�LV�D�VSHFLDO�ZLQGRZ�RQ�ZKLFK�DOO�RWKHU�ZLQGRZV�DUH�GUDZQ��7KLV�ZLQGRZ�LV�DOVR�DW�WKH�WRS�RI�WKH�ZLQGRZ�KLHUDUFK\��7KLV�ZLQGRZ�LV�WKH�SDUHQW�WR�DOO�RWKHU�WRS�OHYHO�ZLQGRZV�LQ�WKH�V\VWHP���$�SDUHQW�ZLQGRZ�FDQ�KDYH�RQH�RU�PRUH�ZLQGRZV�DV�LWV�FKLOGUHQ��7KHVH�FKLOG�ZLQGRZV�DUH�FRQWDLQHG�ZLWKLQ�WKHLU�SDUHQW�ZLQGRZ��WKDW�LV�WR�VD\��WKH�FKLOG�ZLQGRZV�DUH�GUDZQ�ZLWKLQ�WKH�FOLHQW�DUHD�RI�WKH�SDUHQW��$�FRPPRQ�H[DPSOH�RI�D�FKLOG�ZLQGRZ�LV�D�FRQWURO�WKDW�LV�SODFHG�RQ�D�IRUP��7KH�FRQWURO�LV�WKH�FKLOG�ZLQGRZ�DQG�WKH�IRUP�LV�LWV�SDUHQW���,W�LV�SRVVLEOH�IRU�D�FKLOG�ZLQGRZ�WR�KDYH�FKLOG�ZLQGRZV�RI�LWV�RZQ��$�9%�SLFWXUH�ER[�FRQWURO�FRXOG�KDYH�VHYHUDO�EXWWRQ�FRQWUROV�DV�LWV�FKLOG�ZLQGRZV��IRU�H[DPSOH��7KHVH�EXWWRQV�ZRXOG�EH�GUDZQ�ZLWKLQ�WKH�ERXQGV�RI�WKH�SLFWXUH�ER[��$Q\�EXWWRQ�RU�SDUW�RI�D�EXWWRQ�ORFDWHG�RXWVLGH�RI�WKH�SLFWXUH�ER[�ZRXOG�QRW�EH�GUDZQ��WKH�ERWWRP�ZRXOG�EH�FOLSSHG���7KH�EXWWRQ�FKLOG�FRQWUROV�ZRXOG�FRQVLGHU�WKH�SLFWXUH�ER[�FRQWURO�WKHLU�SDUHQW�ZLQGRZ��HYHQ�WKRXJK�WKH�SLFWXUH�ER[�FRQWURO�LV�LWVHOI�D�FKLOG�RI�D�IRUP��&KLOG�ZLQGRZV�KDYH�WKHVH�DWWULEXWHV���

• 7KH\�PXVW�KDYH�D�VLQJOH�SDUHQW�ZLQGRZ��• 7KH\�DUH�GUDZQ�UHODWLYH�WR�WKH�XSSHU�OHIW�SRLQW�LQ�WKH�SDUHQWV�FOLHQW�DUHD���• 7KH\�FDQQRW�KDYH�D�PHQX��• $Q\�SRUWLRQ�RI�WKH�FKLOG�ZLQGRZ�RXWVLGH�RI�WKH�SDUHQWV�FOLHQW�DUHD�LV�KLGGHQ�RU�

FOLSSHG���

3DUHQW�ZLQGRZV�KDYH�WKHVH�DWWULEXWHV���

• 7KH\�FDQ�KDYH�PDQ\�FKLOG�ZLQGRZV���• 7KH\�FDQ�KDYH�D�PHQX��• 7KH\�FDQ�EH�WRS�OHYHO�ZLQGRZV��• :KHQ�D�SDUHQW�ZLQGRZ�LV�VKRZQ��GHVWUR\HG��PRYHG��RU�KLGGHQ��WKH�VDPH�KDSSHQV�WR�

WKH�FKLOG�ZLQGRZ���

$�WRS�OHYHO�ZLQGRZ�LV�D�ZLQGRZ�WKDW�KDV�WKH�GHVNWRS�ZLQGRZ�DV�LWV�SDUHQW�ZLQGRZ��(YHU\�ZLQGRZ�KDV�D�KDQGOH�WR�LWV�SDUHQW�ZLQGRZ��7RS�OHYHO�ZLQGRZV�PXVW�KDYH�WKH�GHVNWRS�ZLQGRZ�KDQGOH�DV�WKHLU�SDUHQW�ZLQGRZ�KDQGOH��1RWH�WKDW�D�SDUHQW�ZLQGRZ�FDQ�EH�FRQVLGHUHG�D�WRS�OHYHO�ZLQGRZ��EXW�D�FKLOG�ZLQGRZ�FDQQRW��7RS�OHYHO�ZLQGRZV�KDYH�WKHVH�DWWULEXWHV���

• 2QO\�RQH�WRS�OHYHO�ZLQGRZ�FDQ�EH�DFWLYH�DW�DQ\�RQH�WLPH��• $Q�DSSOLFDWLRQ�FDQ�KDYH�PRUH�WKDQ�RQH�WRS�OHYHO�ZLQGRZ��

Page 32: Visual Basic - Subclassing and Hooking with VB & VB NET

• :KHQ�WKH�XVHU�PDQLSXODWHV�D�FKLOG�ZLQGRZ��SRVVLEO\�D�FRQWURO���WKH�WRS�OHYHO�ZLQGRZ�DVVRFLDWHG�ZLWK�WKH�FKLOG�ZLQGRZ��LWV�SDUHQW��LV�DFWLYDWHG���

7KH�ODVW�ZLQGRZ�UHODWLRQVKLS�,�ZLOO�GLVFXVV�LV�WKH�RZQHU�RZQHG�UHODWLRQVKLS��2QO\�WRS�OHYHO�ZLQGRZV�FDQ�EH�RZQHG�E\�RU�EH�RZQHUV�RI�RWKHU�WRS�OHYHO�ZLQGRZV��2ZQHG�ZLQGRZV�KDYH�WKHVH�DWWULEXWHV���

• 2ZQHG�ZLQGRZV�DUH�DOZD\V�KLJKHU�LQ�WKH�=�RUGHU�WKDQ�WKHLU�RZQHUV��• 2ZQHG�ZLQGRZV�DUH�KLGGHQ�ZKHQ�WKHLU�RZQHUV�DUH�KLGGHQ��• 2ZQHG�ZLQGRZV�DUH�QRW�KLGGHQ�ZKHQ�WKHLU�RZQHUV�DUH�PLQLPL]HG��• 2QO\�WRS�OHYHO�ZLQGRZV�FDQ�EH�RZQHU�ZLQGRZV���

������:KDW�$UH�$OO�7KHVH�+DQGOHV�)RU"�

$OO�REMHFWV�KDYH�D�KDQGOH��$�KDQGOH�LV�VLPSO\�D�ORQJ�GDWDW\SH�WKDW�FRQWDLQV�D�QXPEHU�LGHQWLI\LQJ�DQ�REMHFW��7R�XVH�DQ�REMHFW�LQ�WKH�:LQGRZV�RSHUDWLQJ�V\VWHP��\RX�ILUVW�QHHG�WR�JHW�LWV�KDQGOH���+DQGOHV�DUH�YLWDO�WR�XVLQJ�VXEFODVVLQJ�DQG�KRRNV��:KHQ�VXEFODVVLQJ�D�ZLQGRZ��WKH�KDQGOH�WR�WKDW�ZLQGRZ�PXVW�ILUVW�EH�REWDLQHG��7KH�K:QG�SURSHUW\�LQ�9%�PDNHV�WKLV�WDVN�D�WULYLDO�RQH��7KLV�KDQGOH�LV�WKHQ�VHQW�WR�D�:LQ���$3,�IXQFWLRQ�FDOOHG�6HW:LQGRZ/RQJ3WU�WR�LQLWLDWH�DV�ZHOO�DV�WR�UHPRYH�WKH�VXEFODVVLQJ��6HW:LQGRZ/RQJ3WU�LV�GHVFULEHG�LQ�PRUH�GHWDLO�LQ�&KDSWHU�����+DQGOHV�DUH�DOVR�YLWDO�WR�XVLQJ�KRRNV��$OO�KRRNV��ZKHQ�LQVWDOOHG��DUH�LGHQWLILHG�E\�D�KRRN�KDQGOH��2QH�RI�WKH�PRUH�LPSRUWDQW�XVHV�IRU�WKLV�KDQGOH�LV�WR�UHPRYH�WKH�KRRN����IDLOLQJ�WR�UHPRYH�D�KRRN�EHIRUH�WKH�DSSOLFDWLRQ�VWRSV�FUHDWHV�D�QDVW\�SUREOHP��$�VSHFLDO�W\SH�RI�KRRN�FDOOHG�D�V\VWHP�ZLGH�KRRN�XVHV�D�PRGXOH�KDQGOH�WR�LGHQWLI\�WKH�G\QDPLF�OLQN�OLEUDU\��'//��PRGXOH�WKDW�KDV�LQVWDOOHG�WKH�KRRN��6\VWHP�ZLGH�KRRNV�DQG�WKHLU�XVDJH�DUH�D�FRPSOH[�WRSLF��DQG�PRUH�GLVFXVVLRQ�LV�GHYRWHG�WR�LW�LQ�&KDSWHU�����,Q�9%��IRUPV�DQG�PDQ\�FRQWUROV�KDYH�DQ�K:QG�SURSHUW\�WKDW�FRQWDLQV�WKH�ZLQGRZ�KDQGOH��$OVR��VHYHUDO�GLIIHUHQW�$3,�IXQFWLRQV�FDQ�EH�FDOOHG�IURP�9%�WR�JHW�KDQGOHV�WR�YDULRXV�RWKHU�REMHFWV��)RU�RXU�SXUSRVHV��ZH�ZLOO�EH�XVLQJ�WKUHH�PDLQ�KDQGOHV��7KH\�DUH�WKH�ZLQGRZ�KDQGOH��K:QG���WKH�PRGXOH�KDQGOH��K0RGXOH�RU�K,QVWDQFH���DQG�WKH�KRRN�KDQGOH��K+RRN���7KH\�DUH�GHVFULEHG�QH[W���

��������K:QG�

7KH�V\VWHP�DVVLJQV�DQ�K:QG�WR�HDFK�ZLQGRZ�XSRQ�FUHDWLRQ��(YHU\�ZLQGRZ�LQ�WKH�V\VWHP�KDV�LWV�RZQ�XQLTXH�ZLQGRZ�KDQGOH��7KLV�KDQGOH�LV�XQLTXH�HYHQ�DFURVV�SURFHVVHV��$�PHVVDJH�XVHV�WKLV�ZLQGRZ�KDQGOH�WR�ILQG�LWV�ZD\�WR�WKH�GHVWLQDWLRQ�ZLQGRZ�WR�ZKLFK�WKH�PHVVDJH�ZDV�GLUHFWHG��7R�LOOXVWUDWH��ZKHQ�D�PRXVH�LV�FOLFNHG�RYHU�D�EXWWRQ��WKH�PRXVH�FOLFN�HYHQW�LV�FRQYHUWHG�LQWR�D�PHVVDJH��DQG�WKH�K:QG�RI�WKH�EXWWRQ�LV�LQFOXGHG�ZLWKLQ�WKH�PHVVDJH�

Page 33: Visual Basic - Subclassing and Hooking with VB & VB NET

VWUXFWXUH��7KLV�PHVVDJH�SDVVHV�WKURXJK�WKH�:LQGRZV�PHVVDJLQJ�V\VWHP�DQG�DUULYHV�DW�WKH�ZLQGRZ�WR�ZKLFK�WKH�HYHQW�ZDV�ILUVW�GLUHFWHG���$�ZLQGRZ�KDQGOH�FDQ�EH�UHWULHYHG�LQ�9%�E\�XVLQJ�WKH�IRUP�RU�FRQWUROV�K:QG�SURSHUW\��<RX�DOVR�FDQ�XVH�VHYHUDO�:LQGRZV�$3,�IXQFWLRQV�WR�REWDLQ�DQ�K:QG��7KH�)LQG:LQGRZ�$3,�IXQFWLRQ�LV�XVHG�WR�ILQG�D�WRS�OHYHO�ZLQGRZ�KDQGOH�JLYHQ�D�VSHFLILF�FODVV�QDPH�DQG�ZLQGRZ�QDPH��7KH�)LQG:LQGRZ�IXQFWLRQ�LV�GHFODUHG�LQ�9%�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�)LQG:LQGRZ�/LE��XVHU����$OLDV��)LQG:LQGRZ$��B�� � �%\9DO�OS&ODVV1DPH�$V�6WULQJ��%\9DO�OS:LQGRZ1DPH�$V�6WULQJ��$V�/RQJ�7KH�IXQFWLRQV�SDUDPHWHUV�DUH��OS&ODVV1DPH

$�VWULQJ�WKDW�FRQWDLQV�WKH�ZLQGRZ�FODVV�QDPH�RI�WKH�ZLQGRZ�EHLQJ�VHDUFKHG�IRU��OS:LQGRZ1DPH

$�VWULQJ�WKDW�FRQWDLQV�WKH�ZLQGRZ�QDPH�RI�WKH�ZLQGRZ�EHLQJ�VHDUFKHG�IRU��7KLV�IXQFWLRQ�UHWXUQV�WKH�K:QG�RI�WKH�ILUVW�WRS�OHYHO�ZLQGRZ�WKDW�PDWFKHV�WKH�FULWHULD��$�]HUR�LV�UHWXUQHG�LI�WKLV�IXQFWLRQ�ILQGV�QR�ZLQGRZV�PDWFKLQJ�WKH�VSHFLILHG�FULWHULD��,I�PRUH�WKDQ�RQH�ZLQGRZ�LV�IRXQG��WKH�ZLQGRZ�KLJKHVW�LQ�WKH�=�RUGHU�LV�UHWXUQHG���7R�REWDLQ�WKH�KDQGOH�WR�WKH�GHVNWRS�ZLQGRZ��WKH�*HW'HVNWRS:LQGRZ�$3,�IXQFWLRQ�LV�XVHG��7KLV�IXQFWLRQ�LV�GHFODUHG�LQ�9%�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�*HW'HVNWRS:LQGRZ�/LE��XVHU����B�� � $OLDV��*HW'HVNWRS:LQGRZ�������$V�/RQJ�7KLV�IXQFWLRQ�WDNHV�QR�DUJXPHQWV�DQG�UHWXUQV�WKH�GHVNWRS�ZLQGRZ�KDQGOH���$QRWKHU�XVHIXO�IXQFWLRQ�WR�REWDLQ�DQ�KZQG�LV�WKH�*HW:LQGRZ�$3,�IXQFWLRQ��7KLV�IXQFWLRQ�LV�GHFODUHG�LQ�9%�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�*HW:LQGRZ�/LE��XVHU����$OLDV��*HW:LQGRZ��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Z&PG�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��KZQG

7KH�KDQGOH�RI�D�ZLQGRZ�XVHG�DV�D�VWDUWLQJ�SRLQW���Z&PG

'HILQHV�WKH�UHODWLRQVKLS�EHWZHHQ�WKH�ZLQGRZ�SURYLGHG�E\�WKH�KZQG�DUJXPHQW�DQG�WKH�ZLQGRZ�KDQGOH�WR�EH�UHWXUQHG�E\�WKLV�IXQFWLRQ���

$�ZLQGRZ�KDQGOH�LV�UHWXUQHG�EDVHG�RQ�LWV�UHODWLRQVKLS�ZLWK�WKH�ZLQGRZ�SURYLGHG�LQ�WKH�KZQG�DUJXPHQW��7KH�UHODWLRQVKLS�LV�GHWHUPLQHG�E\�WKH�Z&PG�FRQVWDQW��LI�QR�ZLQGRZ�PHHWV�WKH�FULWHULD�GHILQHG�E\�Z&PG��WKH�IXQFWLRQ�UHWXUQV�HLWKHU�RU�KZQG��7KH�Z&PG�DUJXPHQW�FDQ�FRQWDLQ�DQ\�RI�WKH�IROORZLQJ�YDOXHV���GW_CHILD (5)

7KH�UHWXUQHG�ZLQGRZ�KDQGOH�LV�WKH�ILUVW�FKLOG�ZLQGRZ�IRXQG�LQ�WKH�=�RUGHU���GW_ENABLEDPOPUP (6)

Page 34: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�UHWXUQHG�ZLQGRZ�KDQGOH�LV�D�SRS�XS�ZLQGRZ�RZQHG�E\�WKH�ZLQGRZ�UHSUHVHQWHG�E\�WKH�KZQG�DUJXPHQW��)RU�:LQGRZV������RQO\���

GW_HWNDFIRST (0)

7KH�UHWXUQHG�ZLQGRZ�KDQGOH�LV�WKH�ILUVW�LQ�WKH�=�RUGHU�ZLWK�WKH�VDPH�ZLQGRZ�W\SH��WRSPRVW��WRS�OHYHO��RU�FKLOG��DV�WKH�ZLQGRZ�UHSUHVHQWHG�E\�WKH�KZQG�DUJXPHQW���

GW_HWNDLAST (1)

7KH�UHWXUQHG�ZLQGRZ�KDQGOH�LV�WKH�ODVW�LQ�WKH�=�RUGHU�ZLWK�WKH�VDPH�ZLQGRZ�W\SH��WRSPRVW��WRS�OHYHO��RU�FKLOG��DV�WKH�ZLQGRZ�UHSUHVHQWHG�E\�WKH�KZQG�DUJXPHQW���

GW_HWNDNEXT (2)

7KH�UHWXUQHG�ZLQGRZ�KDQGOH�LV�QH[W�LQ�WKH�=�RUGHU�ZLWK�WKH�VDPH�ZLQGRZ�W\SH��WRSPRVW��WRS�OHYHO��RU�FKLOG��DV�WKH�ZLQGRZ�UHSUHVHQWHG�E\�WKH�KZQG�DUJXPHQW���

GW_HWNDPREV (3)

7KH�UHWXUQHG�ZLQGRZ�KDQGOH�LV�SUHYLRXV�LQ�WKH�=�RUGHU�ZLWK�WKH�VDPH�ZLQGRZ�W\SH��WRSPRVW��WRS�OHYHO��RU�FKLOG��DV�WKH�ZLQGRZ�UHSUHVHQWHG�E\�WKH�KZQG�DUJXPHQW���

GW_OWNER (4)

7KH�UHWXUQHG�ZLQGRZ�KDQGOH�LV�WKH�RZQHU�RI�WKH�ZLQGRZ�UHSUHVHQWHG�E\�WKH�KZQG�DUJXPHQW���

%\�ILUVW�XVLQJ�WKH�*HW'HVNWRS:LQGRZ�RU�)LQG:LQGRZ�IXQFWLRQ��\RX�FDQ�REWDLQ�D�KDQGOH�WKDW�FDQ�EH�XVHG�E\�WKH�*HW:LQGRZ�IXQFWLRQ�WR�ILQG�D�UHODWHG�ZLQGRZ���

��������K,QVWDQFH�

$Q�K,QVWDQFH�LV�D�KDQGOH�WR�D�VSHFLILF�UXQQLQJ�LQVWDQFH�RI�\RXU�DSSOLFDWLRQ��(YHU\�DSSOLFDWLRQ�KDV�DQ�LQVWDQFH�KDQGOH��ZKLFK�LV�SURYLGHG�E\�WKH�V\VWHP��,I�DQ�DSSOLFDWLRQ�LV�UXQQLQJ�PRUH�WKDQ�RQFH�RQ�WKH�VDPH�V\VWHP��WKH�LQVWDQFH�KDQGOH�WR�HDFK�DSSOLFDWLRQ�ZLOO�EH�GLIIHUHQW�WR�GLVWLQJXLVK�RQH�LQVWDQFH�IURP�DOO�RWKHU�LQVWDQFHV��7KLV�KDQGOH�LV�SDVVHG�LQWR�WKH�ZLQGRZ�FODVV�VWUXFWXUH�GXULQJ�FUHDWLRQ�RI�D�ZLQGRZ�WR�WUDFN�ZKLFK�PRGXOH�FUHDWHG�DQG�UHJLVWHUHG�D�ZLQGRZ��$OVR��ZKHQ�D�'//�LV�OLQNHG�WR�WKH�DSSOLFDWLRQ�DW�UXQWLPH��LW�UHFHLYHV�DQ�LQVWDQFH�KDQGOH�IURP�WKH�V\VWHP���7R�REWDLQ�WKH�LQVWDQFH�KDQGOH�RI�D�9%�DSSOLFDWLRQ��XVH�WKH�$SS�K,QVWDQFH�SURSHUW\��<RX�DOVR�FDQ�XVH�WKH�*HW:LQGRZ/RQJ�$3,�IXQFWLRQ�WR�UHWULHYH�WKH�LQVWDQFH�KDQGOH�RI�DQ\�9%�RU�QRQ�9%�DSSOLFDWLRQ��$OO�WKDW�LV�QHHGHG�IRU�WKLV�IXQFWLRQ�LV�D�ZLQGRZ�KDQGOH�EHORQJLQJ�WR�WKH�DSSOLFDWLRQ�ZKRVH�LQVWDQFH�KDQGOH�\RX�QHHG��7KH�*HW:LQGRZ/RQJ�IXQFWLRQ�LV�GHFODUHG�LQ�9%�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�*HW:LQGRZ/RQJ�/LE��XVHU����B�� � $OLDV��*HW:LQGRZ/RQJ$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Q,QGH[�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��KZQG

$�ZLQGRZ�KDQGOH��Q,QGH[

Page 35: Visual Basic - Subclassing and Hooking with VB & VB NET

$�FRQVWDQW�WKDW�GHWHUPLQHV�WKH�W\SH�RI�YDOXH�WKDW�WKLV�IXQFWLRQ�ZLOO�UHWXUQ��7KH�*:/B+,167$1&(�FRQVWDQW��RU�����PXVW�EH�SURYLGHG�WR�WKH�Q,QGH[�SDUDPHWHU�WR�UHWXUQ�WKH�DSSOLFDWLRQV�LQVWDQFH�KDQGOH���

7KH�IROORZLQJ�FRGH�IUDJPHQW�XVHV�WKLV�IXQFWLRQ�WR�UHWXUQ�DQ�LQVWDQFH�KDQGOH�RI�DQ�DSSOLFDWLRQ�FRQWDLQLQJ�)RUP����&RQVW�*:/B+,167$1&(� ����K,QVWDQFH� �*HW:LQGRZ/RQJ�)RUP��KZQG��*:/B+,167$1&(���0XOWLSOH�LQVWDQFHV�RI�DQ�DSSOLFDWLRQ�RU�'//�XVH�WKH�VDPH�FRGH�VHJPHQW��DVVXPLQJ�WKH�EDVH�DGGUHVVHV�ZKHUH�WKH\�DUH�ORDGHG�LQWR�WKH�SURFHVV�DUH�WKH�VDPH���EXW�WKH\�XVH�GLIIHUHQW�GDWD�VHJPHQWV��7KH�K,QVWDQFH�KDQGOH�LV�XVHG�WR�LGHQWLI\�WKH�GDWD�VHJPHQWV�IRU�HDFK�PRGXOH��7KLV�PHDQV�WKDW�LW�LV�SRVVLEOH�IRU�HDFK�'//�WR�XVH�WKH�VDPH�FRGH�EXW�GLIIHUHQW�VHWV�RI�YDULDEOHV���7KH�K,QVWDQFH�KDQGOH�LV�QRW�JOREDO�LQ�VFRSH��DV�LV�WKH�FDVH�ZLWK�WKH�K:QG�KDQGOH��7KLV�KDQGOH�LV�YDOLG�RQO\�ZLWKLQ�D�VLQJOH�SURFHVV���,Q�:LQ����DQ�K,QVWDQFH�DQG�DQ�K0RGXOH�DUH�H[DFWO\�WKH�VDPH��$FFRUGLQJ�WR�0LFURVRIWV�GRFXPHQWDWLRQ��ERWK�WKH�K,QVWDQFH�DQG�WKH�K0RGXOH�SRLQW�WR�WKH�EDVH�DGGUHVV�DW�ZKLFK�WKH�H[HFXWDEOH��(;(��RU�WKH�'//�PRGXOH�LV�ORDGHG�ZLWKLQ�WKH�SURFHVV���2QH�ODVW�SRLQW�DERXW�KDQGOHV��1HYHU�VWRUH�WKH�KDQGOH�RI�DQ�REMHFW�LQ�D�JOREDO�YDULDEOH��7KLV�LV�EHFDXVH�LI�WKH�REMHFW�LV�GHVWUR\HG��WKH�KDQGOH�VWRUHG�LQ�WKH�JOREDO�YDULDEOH�ZLOO�SRLQW�WR�QRWKLQJ��7KLV�ZLOO�FDXVH�DQ�HUURU�ZKHQ�XVLQJ�WKH�LQYDOLG�KDQGOH�LQ�\RXU�FRGH��2WKHU�WKLQJV�FRXOG�KDSSHQ��VXFK�DV�WKH�FUHDWLRQ�RI�D�QHZ�REMHFW�WKDWV�DVVLJQHG�WKLV�KDQGOH��7KLV�LV�SRVVLEOH�EHFDXVH�:LQGRZV�UHXVHV�KDQGOH�,'V��:KHQ�XVLQJ�KDQGOHV�LQ�\RXU�FRGH��JHW�WKH�KDQGOH�DV�ODWH�DV�SRVVLEOH�DQG�WKHQ�XVH�LW��7KLV�ZLOO�JXDUDQWHH�WKDW�WKH�KDQGOH�LV�YDOLG�ZKHQ�\RX�XVH�LW���

��������K+RRN�

(YHU\�KRRN�WKDW�\RX�FUHDWH�QHHGV�D�KDQGOH�WKDW�LGHQWLILHV�LW��/LNH�WKH�K:QG�ZLQGRZ�KDQGOH��WKH�K+RRN�KDQGOH�YDOXH�LV�XQLTXH�WR�WKH�HQWLUH�V\VWHP��$V�WKH�QDPH�LPSOLHV��WKH�K+RRN�KDQGOH�ZLOO�EH�XVHG�RQO\�ZLWK�KRRNV��QRW�ZLWK�VXEFODVVLQJ���7R�JHW�D�KDQGOH�WR�D�KRRN��ZH�PXVW�XVH�WKH�6HW:LQGRZ+RRN([�$3,�IXQFWLRQ��WKH�:LQ���KRRN�LQVWDOODWLRQ�IXQFWLRQ��LQ�RWKHU�ZRUGV��ZH�UHWULHYH�WKH�KDQGOH�WR�D�KRRN�ZKHQ�WKDW�KRRN�LV�GHILQHG��7KH�6HW:LQGRZ+RRN([�IXQFWLRQ�LV�GHFODUHG�LQ�9%�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�6HW:LQGRZV+RRN([�/LE��XVHU����B�� � $OLDV��6HW:LQGRZV+RRN([$��B�� � �%\9DO�LG+RRN�$V�/RQJ��%\9DO�OSIQ�$V�/RQJ��B�� � %\9DO�KPRG�$V�/RQJ��%\9DO�GZ7KUHDG,G�$V�/RQJ��$V�/RQJ�,W�KDV�WKH�IROORZLQJ�SDUDPHWHUV��LG+RRN

7KLV�LV�WKH�LGHQWLILHU�RI�WKH�W\SH�RI�KRRN�WKDW�LV�EHLQJ�LQVWDOOHG��H�J���*HW0HVVDJH�KRRN��&%7�KRRN��'HEXJ�KRRN��HWF����

Page 36: Visual Basic - Subclassing and Hooking with VB & VB NET

OSIQ

$�SRLQWHU�WR�WKH�KRRN�FDOOEDFN�IXQFWLRQ���KPRG

7KH�KDQGOH�RI�WKH�'//�FRQWDLQLQJ�WKH�KRRN�FDOOEDFN�IXQFWLRQ��,I�WKLV�LV�18//��WKH�KRRN�FDOOEDFN�IXQFWLRQ�LV�QRW�FRQWDLQHG�ZLWKLQ�D�'//��,QVWHDG��LW�LV�FRQWDLQHG�LQ�WKH�DSSOLFDWLRQV��(;(V��FRGH���

GZ7KUHDG,G

7KH�,'�RI�WKH�DSSOLFDWLRQ�WKUHDG�WKDW�FRQWDLQV�WKH�KRRN�FDOOEDFN�IXQFWLRQ��,I�WKLV�LV�18//��WKH�KRRN�FDOOEDFN�IXQFWLRQ�LV�FRQWDLQHG�ZLWKLQ�D�'//��VHH�KPRG����

7KH�UHWXUQ�YDOXH�RI�WKLV�IXQFWLRQ�LV�WKH�KDQGOH�WR�WKH�QHZO\�FUHDWHG�KRRN��7KLV�KDQGOH�QHHGV�WR�EH�VWRUHG�VR�WKDW�LW�FDQ�ODWHU�EH�XVHG�WR�UHPRYH�WKH�KRRN��7KLV�LV�RQH�FDVH�ZKHUH�\RX�QHHG�WR�VWRUH�D�KDQGOH�IRU�ODWHU�XVH��<RX�FDQ�GR�WKLV�EHFDXVH�\RX�DUH�LQ�FRQWURO�RI�WKLV�KDQGOHV�FUHDWLRQ�DQG�GHVWUXFWLRQ��WKH�RWKHU�KDQGOHV�PHQWLRQHG�KHUH�DUH�FRQWUROOHG�E\�WKH�V\VWHP���

������3URFHVVHV�

8QGHUVWDQGLQJ�SURFHVVHV�LQVLGH�DQG�RXW�LV�QRW�D�UHTXLUHPHQW�IRU�EHLQJ�DEOH�WR�OHDUQ�DQG�XQGHUVWDQG�WKH�PDWHULDO�LQ�WKLV�ERRN��DOWKRXJK�D�VLPSOH�XQGHUVWDQGLQJ�LV�KHOSIXO��7KH�LQIRUPDWLRQ�SUHVHQWHG�KHUH�RQ�SURFHVVHV�LV�RQO\�D�KLJK�OHYHO�RYHUYLHZ���$OO�DSSOLFDWLRQV�UHTXLUH�D�SURFHVV�WR�UXQ�ZLWKLQ��$�SURFHVV�LV�D��*E�YLUWXDO�DGGUHVV�VSDFH�WKDW�FRQWDLQV�WKH�DSSOLFDWLRQ��DOO�LWV�PRGXOHV��WKH�DSSOLFDWLRQV�UHVRXUFHV��DQG�DW�OHDVW�RQH�WKUHDG�RI�H[HFXWLRQ��7KH�DSSOLFDWLRQV�PRGXOHV�LQFOXGH�VXFK�WKLQJV�DV�WKH�PDLQ�H[HFXWDEOH�� �(;(���'//V�� �'//���GULYHUV�� �'59���DQG�$FWLYH;�FRQWUROV�� �2&;���$SSOLFDWLRQ�UHVRXUFHV�LQFOXGH�EXW�DUH�QRW�OLPLWHG�WR�GLDORJV��IRQWV��ILOHV��KDQGOHV�WR�REMHFWV��DQG�ELWPDS�ILOHV��7KUHDGV�DUH�GHVFULEHG�LQ�WKH�QH[W�VHFWLRQ���3HUKDSV�WKH�PRVW�VWULNLQJ�IHDWXUH�RI�D�SURFHVV�LV�WKDW�HYHU\WKLQJ�HQFDSVXODWHG�ZLWKLQ�LW�LV�FRQVLGHUHG�SULYDWH�WR�WKH�UHVW�RI�WKH�UXQQLQJ�SURFHVVHV��7KLV�NHHSV�RQH�SURFHVV�IURP�LQYDGLQJ�RQH�RU�PRUH�RWKHU�SURFHVVHV�DQG�FDXVLQJ�WKHP�WR�FUDVK��7KHUH�DUH��KRZHYHU��PHWKRGV�LQ�:LQGRZV�WKDW�SURYLGH�WKH�DELOLW\�WR�SLHUFH�WKDW�YHLO�RI�VHFUHF\��0HWKRGV�VXFK�DV�ILOH�PDSSLQJ��LQMHFWLQJ�FRGH��'//V��LQWR�RWKHU�SURFHVVHV��DQG�RWKHU�LQWHUSURFHVV�FRPPXQLFDWLRQ��,3&��WHFKQLTXHV�DOORZ�SURFHVVHV�WR�FRPPXQLFDWH�DQG�LQWHUDFW�ZLWK�HDFK�RWKHU���

������7KUHDGV�

7KUHDGV�RSHUDWH�RQO\�ZLWKLQ�D�SURFHVV��(DFK�SURFHVV�KDV�RQH�PDLQ�WKUHDG�DQG�SRWHQWLDOO\�PDQ\�RWKHU�ZRUNHU�WKUHDGV�SHUIRUPLQJ�RWKHU�WDVNV�ZLWKLQ�WKH�SURFHVV��7KH�WKUHDGV�ZLWKLQ�D�SURFHVV�DFWXDOO\�H[HFXWH�FRGH��WKH�SURFHVV�LWVHOI�GRHV�QRW�H[HFXWH�FRGH��(YHU\�WKUHDG�DOVR�KDV�LWV�RZQ�PHVVDJH�TXHXH��$FWXDOO\��,�VKRXOG�FODULI\�WKLV�VWDWHPHQW��7KUHDGV�DUH�FUHDWHG�LQLWLDOO\�ZLWKRXW�D�PHVVDJH�TXHXH��WKLV�LV�GRQH�WR�VSHHG�XS�V\VWHP�SHUIRUPDQFH��$�PHVVDJH�TXHXH�LV�FUHDWHG�RQO\�ZKHQ�WKH�WKUHDG�LV�DERXW�WR�XVH�WKH�8VHU���RU�*',���PRGXOHV��DV�LV�

Page 37: Visual Basic - Subclassing and Hooking with VB & VB NET

GRQH�ZKHQ�D�QHZ�ZLQGRZ�LV�FUHDWHG��,PPHGLDWHO\�EHIRUH�WKH�ILUVW�ZLQGRZ�LV�FUHDWHG��D�PHVVDJH�TXHXH�LV�FUHDWHG�IRU�WKDW�WKUHDG���,I�PRUH�WKDQ�RQH�ZLQGRZ�LV�FUHDWHG�LQ�WKLV�WKUHDG��WKH�PHVVDJH�TXHXH�XVHV�WKH�K:QG�HOHPHQW�RI�WKH�PHVVDJH�VWUXFWXUH�WR�GHWHUPLQH�ZKLFK�ZLQGRZ�ZLOO�UHFHLYH�HDFK�SDUWLFXODU�PHVVDJH��)RU�PRUH�GHWDLO�RQ�:LQGRZV�PHVVDJHV��VHH��,QVLGH�WKH�:LQGRZV�0HVVDJLQJ�6\VWHP��ODWHU�LQ�WKLV�FKDSWHU��)RU�QRZ��LWV�LPSRUWDQW�WR�XQGHUVWDQG�WKDW�RQO\�WKUHDGV�FRQWDLQ�PHVVDJH�TXHXHV��SURFHVVHV�GR�QRW�KDYH�PHVVDJH�TXHXHV���

������7KH�,QWHUQDOV�RI�D�:LQGRZ�

:LQGRZ�KDV�D�EURDGHU�PHDQLQJ�WKDQ�WKH�FRQYHQWLRQDO�XVH�RI�WKH�WHUP��7R�WKH�RSHUDWLQJ�V\VWHP��D�ZLQGRZ�FDQ�EH�WKH�GHVNWRS�ZLQGRZ��DQ�DSSOLFDWLRQV�WRS�OHYHO�ZLQGRZ��DQ\�FKLOG�ZLQGRZV�RI�WKH�WRS�OHYHO�ZLQGRZ��GLDORJ�ER[HV��PHVVDJH�ER[HV��RU�FRQWUROV��7KH�PDLQ�VLPLODULW\�DPRQJ�WKHVH�ZLQGRZV�LV�WKDW�WKH\�DOO�KDYH�D�ZLQGRZ�SURFHGXUH�WKDW�FDQ�UHFHLYH�PHVVDJHV�IURP�LWV�RZQLQJ�WKUHDGV�PHVVDJH�TXHXH�DQG�DFW�RQ�WKHP��$OO�ZLQGRZV�FRQWDLQ�D�GHIDXOW�ZLQGRZ�SURFHGXUH�WKDW�LV�GHILQHG�LQ�WKH�ZLQGRZ�FODVV���8VLQJ�6S\����ZH�FDQ�SURYLGH�HYLGHQFH�WKDW�FRQWUROV�SODFHG�RQ�D�ZLQGRZ�DUH�LQ�IDFW�ZLQGRZV�WKHPVHOYHV��)LUVW��FUHDWH�D�VLPSOH�9%�DSSOLFDWLRQ�ZLWK�D�IHZ�FRQWUROV�RQ�LW��1H[W��FRPSLOH�DQG�UXQ�WKH�DSSOLFDWLRQ��6WDUW�6S\���DQG�SUHVV�WKH�&75/�:�NH\V�WR�GLVSOD\�WKH�OLVW�RI�FXUUHQWO\�UXQQLQJ�ZLQGRZV��7KH�WRS�OHYHO�RI�WKH�ZLQGRZ�WUHH�LQ�6S\���FRQWDLQV�WKH�'HVNWRS��ZKLFK�LV�D�ZLQGRZ��7KH�QH[W�OHYHO�GRZQ�FRQWDLQV�D�OLVW�RI�DOO�WRS�OHYHO�ZLQGRZV�LQ�WKH�V\VWHP��:H�FDQ�ILQG�RXU�9%�DSSOLFDWLRQV�PDLQ�ZLQGRZ�LQ�WKLV�OLVW�DQG�WKHQ�GULOO�GRZQ�WR�WKH�QH[W�OHYHO�WR�YLHZ�DOO�LWV�FKLOG�ZLQGRZV��7KHVH�FKLOG�ZLQGRZV�DUH�WKH�FRQWUROV�WKDW�ZH�SODFHG�RQ�WKH�9%�IRUP��%\�GRXEOH�FOLFNLQJ�RQH�RI�WKHVH�FRQWURO�ZLQGRZV��ZH�FDQ�YLHZ�LWV�3URSHUWLHV�GLDORJ�ER[��,Q�WKH�GLDORJ�ER[��ZH�QRWLFH�WKDW�HDFK�FRQWURO�KDV�LWV�RZQ�ZLQGRZ�SURFHGXUH��ZKLFK�ZH�FDQ�VHH�LQ�WKH�:LQGRZ�3URF�ILHOG�RQ�WKH�&ODVV�WDE�RI�WKH�GLDORJ�ER[��DV�VKRZQ�LQ�)LJXUH�������

)LJXUH������6S\���RXWSXW�IRU�D�WH[W�ER[�FRQWURO�LQ�D�9%�DSSOLFDWLRQ�

Page 38: Visual Basic - Subclassing and Hooking with VB & VB NET

��������7KH�ZLQGRZ�FODVV�

(YHU\�ZLQGRZ�LV�FUHDWHG�IURP�VRPHWKLQJ�FDOOHG�D�ZLQGRZ�FODVV��7KLV�LV�VRPHZKDW�VLPLODU�WR�WKH�W\SH�RI�FODVV�WKDW�ZH�XVH�LQ�9%�RU�&����EXW�LW�LV�QRW�WKH�VDPH��$�ZLQGRZ�FODVV�LV�QRWKLQJ�PRUH�WKDQ�D�VWUXFWXUH�RI�HOHPHQWV�GHVFULELQJ�WKH�EDVH�LQIRUPDWLRQ�WKDW�HYHU\�ZLQGRZ�QHHGV��7KLV�LQIRUPDWLRQ�FRQVLVWV�RI�WKLQJV�FRPPRQ�WR�DOO�ZLQGRZV��VXFK�DV�WKH�W\SH�RI�FXUVRU�WR�GLVSOD\��WKH�ZLQGRZV�LFRQ��HYHQ�WKH�ORRN�DQG�IHHO�RI�WKH�ZLQGRZ�LWVHOI��:KHQ�ZH�FUHDWH�D�ZLQGRZ�LQ�&�&����ZH�VWDUW�E\�ILOOLQJ�WKH�:1'&/$66(;�VWUXFWXUH�ZLWK�WKH�QHFHVVDU\�LQIRUPDWLRQ��7KH�:1'&/$66(;�VWUXFWXUH�LV�GHILQHG�LQ�9LVXDO�&���DV�IROORZV���W\SHGHI�VWUXFW�B:1'&/$66(;�^������8,17�������FE6L]H�������8,17�������VW\OH�������:1'352&����OSIQ:QG3URF�������LQW��������FE&OV([WUD�������LQW��������FE:QG([WUD�������+,167$1&(��K,QVWDQFH�������+,&21������K,FRQ�������+&85625����K&XUVRU�������+%586+�����KEU%DFNJURXQG�������/3&7675����OSV]0HQX1DPH�������/3&7675����OSV]&ODVV1DPH�������+,&21������K,FRQ6P���`�:1'&/$66(;�� 3:1'&/$66(;��7KLV�HTXLYDOHQW�VWUXFWXUH�LQ�9%�LV�DV�IROORZV��3XEOLF�7\SH�:1'&/$66(;�����FE6L]H�$V�/RQJ�����VW\OH�$V�/RQJ�����OSIQ:QG3URF�$V�/RQJ�����FE&OV([WUD�$V�/RQJ�����FE:QG([WUD�$V�/RQJ�����K,QVWDQFH�$V�/RQJ�����K,FRQ�$V�/RQJ�����K&XUVRU�$V�/RQJ�����KEU%DFNJURXQG�$V�/RQJ�����OSV]0HQX1DPH�$V�6WULQJ�����OSV]&ODVV1DPH�$V�6WULQJ�����K,FRQ6P�$V�/RQJ�(QG�7\SH�7KH�PHPEHUV�RI�WKH�:1'&/$66(;�VWUXFWXUH�DUH��FE6L]H

Page 39: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�VL]H�RI�WKLV�VWUXFWXUH��VW\OH

$�FRPELQDWLRQ�RI�FODVV�VW\OH�FRQVWDQWV�25HG�WRJHWKHU��7KHVH�VW\OHV�GHWHUPLQH�WKH�IXQGDPHQWDO�ORRN�DQG�RSHUDWLRQ�RI�D�ZLQGRZ�FUHDWHG�IURP�WKLV�FODVV��)RU�H[DPSOH��WKH�&6B12&/26(�FRQVWDQW�GLVDEOHV�WKH�&ORVH�RSWLRQ�RQ�WKH�FODVVV�ZLQGRZ�PHQX��ZKLOH�WKH�&6B+5('5$:�FRQVWDQW�IRUFHV�D�UHGUDZ�RI�WKH�ZLQGRZ�ZKHQHYHU�WKH�ZLGWK�RI�LWV�FOLHQW�DUHD�FKDQJHV���

OSIQ:QG3URF

7KH�IXQFWLRQ�SRLQWHU�WR�WKH�ZLQGRZ�SURFHGXUH�IRU�WKLV�FODVV��FE&OV([WUD

7KH�DPRXQW�RI�H[WUD�VSDFH�WR�DGG�WR�WKH�HQG�RI�WKH�FODVV�VWUXFWXUH��7KH�GHYHORSHU�XVHV�WKLV�WR�VWRUH�FODVV�UHODWHG�LQIRUPDWLRQ���

FE:QG([WUD

7KH�DPRXQW�RI�H[WUD�VSDFH�WR�DGG�WR�WKH�HQG�RI�WKH�ZLQGRZ�VWUXFWXUH��7KH�GHYHORSHU�XVHV�WKLV�WR�VWRUH�ZLQGRZ�UHODWHG�LQIRUPDWLRQ���

K,QVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�PRGXOH�WKDW�FRQWDLQV�WKH�ZLQGRZ�SURFHGXUH�IRU�WKLV�FODVV���K,FRQ

7KH�KDQGOH�WR�DQ�LFRQ�UHVRXUFH��K&XUVRU

7KH�KDQGOH�WR�D�FXUVRU�UHVRXUFH��KEU%DFNJURXQG

7KH�KDQGOH�WR�D�EUXVK�RU�D�FRORU�YDOXH�XVHG�WR�SDLQW�WKH�EDFNJURXQG�RI�WKH�ZLQGRZ�FUHDWHG�IURP�WKLV�FODVV���

OSV]0HQX1DPH

7KH�QXOO�WHUPLQDWHG�VWULQJ�WKDW�GHILQHV�WKH�PHQX�UHVRXUFH��OSVT&ODVV1DPH

7KH�QXOO�WHUPLQDWHG�VWULQJ�RU�FODVV�DWRP�GHILQLQJ�WKH�QDPH�RI�WKH�FODVV��7KLV�YDOXH�PXVW�EH�XQLTXH���

K,FRQ6P

7KH�KDQGOH�WR�WKH�VPDOO�LFRQ�UHVRXUFH��$IWHU�WKH�:1'&/$66(;�VWUXFWXUH�LV�GHILQHG��ZH�UHJLVWHU�WKLV�FODVV�E\�XVLQJ�WKH�5HJLVWHU&ODVV([�$3,�IXQFWLRQ��,WV�9%�GHFODUDWLRQ�LV���3XEOLF�'HFODUH�)XQFWLRQ�5HJLVWHU&ODVV([�/LE��XVHU����B�� � $OLDV��5HJLVWHU&ODVV([$��B�� � �SF:QG&ODVV([�$V�:1'&/$66(;��$V�,QWHJHU�7KH�VLQJOH�SDUDPHWHU�WR�5HJLVWHU&ODVV([�LV��SF:QG&ODVV([

$�SRLQWHU�WR�WKH�:1'&/$66(;�VWUXFWXUH��

Page 40: Visual Basic - Subclassing and Hooking with VB & VB NET

7KLV�IXQFWLRQ�UHWXUQV�D�FODVV�DWRP��ZKLFK�LV�D�XQLTXH�LGHQWLILHU�WR�WKH�QHZO\�UHJLVWHUHG�FODVV��$W�WKLV�SRLQW��ZH�FDQ�SURFHHG�WR�DFWXDOO\�FUHDWH�D�ZLQGRZ�RI�WKLV�FODVV�E\�FDOOLQJ�WKH�&UHDWH:LQGRZ([�$3,�IXQFWLRQ��WKH�9%�GHFODUDWLRQ�IRU�ZKLFK�LV���3XEOLF�'HFODUH�)XQFWLRQ�&UHDWH:LQGRZ([�/LE��XVHU����B�� � $OLDV��&UHDWH:LQGRZ([$��B�� � �%\9DO�GZ([6W\OH�$V�/RQJ��%\9DO�OS&ODVV1DPH�$V�6WULQJ��B�� � %\9DO�OS:LQGRZ1DPH�$V�6WULQJ��%\9DO�GZ6W\OH�$V�/RQJ��B�� � %\9DO�[�$V�/RQJ��%\9DO�\�$V�/RQJ��B�� � %\9DO�Q:LGWK�$V�/RQJ��%\9DO�Q+HLJKW�$V�/RQJ��B�� � %\9DO�K:QG3DUHQW�$V�/RQJ��%\9DO�K0HQX�$V�/RQJ��B�� � %\9DO�K,QVWDQFH�$V�/RQJ��OS3DUDP�$V�$Q\��$V�/RQJ�7KH�SDUDPHWHUV�RI�&UHDWH:LQGRZ([�DUH��GZ([6W\OH

$�FRPELQDWLRQ�RI�H[WHQGHG�ZLQGRZ�VW\OH�FRQVWDQWV�25HG�WRJHWKHU��7KH�FRQVWDQWV�LQFOXGH�:6B(;B$&&(37),/(6��ZKLFK�LQGLFDWHV�WKDW�WKH�ZLQGRZ�DFFHSWV�GUDJ�GURS�ILOHV��:6B(;B&217(;7+(/3��ZKLFK�LQFOXGHV�D�TXHVWLRQ�PDUN�WKDW�DSSHDUV�LQ�WKH�ZLQGRZV�WLWOH�EDU��:6B(;B'/*02'$/)5$0(��ZKLFK�FUHDWHV�D�ZLQGRZ�ZLWK�D�GRXEOH�ERUGHU��RU�:6B(;B0',&+,/'��ZKLFK�FUHDWHV�DQ�0XOWLSOH�'RFXPHQW�,QWHUIDFH��0',��FKLOG�ZLQGRZ���

OS&ODVV1DPH

7KH�FODVV�QDPH�RU�FODVV�DWRP�UHWXUQHG�E\�5HJLVWHU&ODVV([���OS:LQGRZ1DPH

,I�WKH�ZLQGRZ�KDV�D�WLWOH�EDU��WKLV�LV�WKH�ZLQGRZ�FDSWLRQ��,I�QR�WLWOH�EDU�H[LVWV��WKLV�LV�WKH�WH[W�IRU�WKH�FRQWURO��H�J���WKH�WH[W�VWULQJ�GLVSOD\HG�IRU�D�FKHFNER[����

GZ6W\OH

$�FRPELQDWLRQ�RI�ZLQGRZ�VW\OH�FRQVWDQWV�DQG�FRQWURO�VW\OH�FRQVWDQWV�25HG�WRJHWKHU��6RPH�VW\OH�FRQVWDQWV�LQFOXGH�:6B&$37,21��WR�FUHDWH�D�ZLQGRZ�ZLWK�D�WLWOH�EDU��:6B',6$%/('��WR�FUHDWH�D�ZLQGRZ�WKDW�LV�LQLWLDOO\�GLVDEOHG��:6B0$;,0,=(%2;��WR�LQFOXGH�D�PD[LPL]H�EXWWRQ�RQ�WKH�ZLQGRZ��RU�:6B6,=(%2;��WR�FUHDWH�D�ZLQGRZ�WKDW�KDV�D�VL]LQJ�ERUGHU��&RQWURO�FRQVWDQWV�LQFOXGH�%87721��&20%2%2;��(',7��/,67%2;��0',&/,(17��5,&+(',7B&/$66��6&52//%$5��DQG�67$7,&���

[

(TXLYDOHQW�WR�WKH�/HIW�SURSHUW\�RI�D�9%�ZLQGRZ��\

(TXLYDOHQW�WR�WKH�7RS�SURSHUW\�RI�D�9%�ZLQGRZ��Q:LGWK

(TXLYDOHQW�WR�WKH�:LGWK�SURSHUW\�RI�D�9%�ZLQGRZ��QKHLJKW

(TXLYDOHQW�WR�WKH�+HLJKW�SURSHUW\�RI�D�9%�ZLQGRZ��K:QG3DUHQW

Page 41: Visual Basic - Subclassing and Hooking with VB & VB NET

$�KDQGOH�WR�WKLV�ZLQGRZV�SDUHQW�RU�RZQHU�ZLQGRZ���K0HQX

$�KDQGOH�WR�WKH�GHIDXOW�ZLQGRZV�PHQX�UHVRXUFH��K,QVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�PRGXOH�WKDW�LV�DVVRFLDWHG�ZLWK�WKLV�ZLQGRZ��OS3DUDP

$�SRLQWHU�WR�XVHU�GHILQHG�GDWD��7KLV�SRLQWHU�LV�VWRUHG�WR�WKH�OS&UHDWH3DUDPV�PHPEHU�RI�WKH�&5($7(6758&7�VWUXFWXUH��D�VWUXFWXUH�JHQHUDWHG�E\�WKH�RSHUDWLQJ�V\VWHP�XVLQJ�WKH�SDUDPHWHUV�SDVVHG�WR�WKH�&UHDWH:LQGRZ([�IXQFWLRQ�DQG��LQ�WXUQ��SDVVHG�LQ�WKH�O3DUDP�SDUDPHWHU�RI�WKH�:0B&5($7(�PHVVDJH���

7KLV�IXQFWLRQ�UHWXUQV�D�KDQGOH�WR�WKH�ZLQGRZ��K:QG���ZKLFK�DOORZV�XV�WR�PDQLSXODWH�WKH�FUHDWHG�ZLQGRZ���9%�FRPSOHWHO\�KLGHV�DOO�WKH�PHFKDQLFV�RI�ZLQGRZ�FUHDWLRQ�IURP�WKH�GHYHORSHU��,W�LV�HDVLHU�WR�VHH�KRZ�FODVV�DQG�ZLQGRZ�FUHDWLRQ�ZRUNV�LQ�9LVXDO�&����7KHUHIRUH��WKH�FRGH�WKDW�IROORZV�ZLOO�EH�ZULWWHQ�LQ�9LVXDO�&�����:KHQ�ZULWLQJ�D�VLPSOH�:LQGRZV�DSSOLFDWLRQ�LQ�9LVXDO�&����\RX�ILUVW�FUHDWH�DQG�UHJLVWHU�D�QHZ�ZLQGRZ�FODVV��DV�VKRZQ�LQ�([DPSOH������7KLV�FODVV�ZLOO�EH�XVHG�WR�FUHDWH�WKH�PDLQ�ZLQGRZ�IRU�RXU�DSSOLFDWLRQ��:KHQ�WKH�FODVV�LV�FUHDWHG��D�IXQFWLRQ�SRLQWHU�WR�WKH�ZLQGRZ�SURFHGXUH�IRU�WKLV�QHZ�ZLQGRZ�QHHGV�WR�EH�SURYLGHG�LQ�WKH�OSIQ:QG3URF�PHPEHU��)RU�WKLV�H[DPSOH��WKH�ZLQGRZ�SURFHGXUH�IRU�WKLV�ZLQGRZ�ZLOO�EH�WKH�:QG3URF�IXQFWLRQ��)LQDOO\��WKH�FODVV�LV�UHJLVWHUHG�XVLQJ�5HJLVWHU&ODVV���

([DPSOH������&UHDWLQJ�DQG�5HJLVWHULQJ�D�:LQGRZ�&ODVV��

:LQ&ODVV�OSV]&ODVV1DPH� ��1HZ:LQGRZ&ODVV����:LQ&ODVV�OSIQ:QG3URF� �:QG3URF���:LQ&ODVV�VW\OH� �&6B2:1'&�_�&6B95('5$:�_�&6B+5('5$:���:LQ&ODVV�K,QVWDQFH� �K,QVWDQFH���:LQ&ODVV�K,FRQ� �/RDG,FRQ��18//��,',B$33/,&$7,21�����:LQ&ODVV�K&XUVRU� �/RDG&XUVRU��18//��,'&B$552:�����:LQ&ODVV�KEU%DFNJURXQG� ��+%586+���&2/25B:,1'2:�������:LQ&ODVV�OSV]0HQX1DPH� �18//���:LQ&ODVV�FE&OV([WUD� �����:LQ&ODVV�FE:QG([WUD� ������5HJLVWHU&ODVV([��:LQ&ODVV�����1H[W��D�ZLQGRZ�LV�FUHDWHG�IURP�WKLV�FODVV�DQG�GLVSOD\HG��DV�VKRZQ�LQ�([DPSOH������7KH�&UHDWH:LQGRZ�IXQFWLRQ�LV�XVHG�WR�FUHDWH�WKH�ZLQGRZ��%HFDXVH�WKLV�IXQFWLRQ�ZLOO�QRW�GLVSOD\�WKH�ZLQGRZ��ZH�KDYH�WR�XVH�WKH�6KRZ:LQGRZ�$3,�IXQFWLRQ�WR�WHOO�WKH�ZLQGRZ�WR�GLVSOD\�LWVHOI���

Page 42: Visual Basic - Subclassing and Hooking with VB & VB NET

([DPSOH������'LVSOD\LQJ�D�:LQGRZ�&UHDWHG�IURP�D�:LQGRZ�&ODVV��

K:QG� �&UHDWH:LQGRZ([��:6B(;B/755($',1*���� � � �1HZ:LQGRZ&ODVV����� � � �0DLQ�:LQGRZ����� � � :6B29(5/$33(':,1'2:���� � � ����� � � ����� � � &:B86('()$8/7���� � � &:B86('()$8/7���� � � K2ZQHU���� � � 18//���� � � K,QVWDQFH���� � � 18//������6KRZ:LQGRZ��K:QGB0DLQ��6:B6+2:�����6KRZ:LQGRZ�LV�GHILQHG�LQ�9%�DV�IROORZV��3XEOLF�'HFODUH�)XQFWLRQ�6KRZ:LQGRZ�/LE��XVHU����$OLDV��6KRZ:LQGRZ��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Q&PG6KRZ�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�WR�EH�VKRZQ��Q&PG6KRZ

$�FRQVWDQW�VSHFLI\LQJ�KRZ�WKH�ZLQGRZ�LV�GLVSOD\HG��&RQVWDQWV�LQFOXGH�6:B)25&(0,1,0,=(��IRU�:LQGRZV������RQO\���6:B+,'(��6:B0$;,0,=(��6:B0,1,0,=(��6:B5(6725(��6:B6+2:��DQG�6:B6+2:'()$8/7���

7KLV�IXQFWLRQ�UHWXUQV�D�]HUR�LI�WKLV�ZLQGRZ�ZDV�SUHYLRXVO\�KLGGHQ��$�QRQ�]HUR�YDOXH�LV�UHWXUQHG�RWKHUZLVH���<RX�PLJKW�EH�VD\LQJ�WR�\RXUVHOI���,YH�QHYHU�KDG�WR�GR�WKDW�LQ�9%���7KDWV�EHFDXVH�WR�FUHDWH�D�ZLQGRZ��9%�PXVW�JR�WKURXJK�WKH�SURFHVV�IRU�\RX��9%�GHYHORSHUV�DUH�VKLHOGHG�IURP�XVLQJ�D�ZLQGRZ�FODVV�WR�FUHDWH�QHZ�ZLQGRZV��<RX�FDQ�VWLOO�DFFHVV�WKH�FODVV�WKURXJK�9%�XVLQJ�$3,�IXQFWLRQV�VXFK�DV�*HW&ODVV/RQJ�RU�6HW&ODVV/RQJ��&KDSWHU���JRHV�LQWR�GHSWK�RQ�XVLQJ�WKHVH�DQG�RWKHU�$3,V�WR�FUHDWH�D�ZLQGRZ�FODVV�DQG��LQ�WXUQ��WR�FUHDWH�RQH�RU�PRUH�ZLQGRZV�IURP�WKDW�FODVV���,Q�WKH�:1'&/$66(;�VWUXFWXUH��WKH�ZLQGRZ�FODVV�HOHPHQW�WKDW�ZH�ZLOO�IRFXV�RQ�LV�OSIQ:QG3URF��7KLV�LV�D�SRLQWHU�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�WKDW�DOO�ZLQGRZV�PXVW�KDYH�WR�UHFHLYH�PHVVDJHV��7KH�GHIDXOW�ZLQGRZ�SURFHGXUH�GHILQHG�KHUH�LV�SLYRWDO�LQ�VXEFODVVLQJ�DV�ZHOO�DV�LQ�VXSHUFODVVLQJ��DQRWKHU�WHFKQLTXH�VLPLODU�WR�VXEFODVVLQJ��:H�ZLOO�GLVFXVV�ERWK�WRSLFV�DW�OHQJWK�LQ�3DUW�,,�RI�WKLV�ERRN���

Page 43: Visual Basic - Subclassing and Hooking with VB & VB NET

%HFDXVH�DOO�ZLQGRZV�DUH�FUHDWHG�IURP�FODVVHV��LW�VWDQGV�WR�UHDVRQ�WKDW�VRPH�V\VWHP�ZLGH�FODVVHV�GHVFULEH�ZLQGRZV�WKDW�DUH�LQWULQVLF�WR�WKH�:LQGRZV�RSHUDWLQJ�V\VWHP��7DEOH�����OLVWV�WKHVH�V\VWHP�ZLGH�FODVVHV���

7DEOH������6\VWHP�ZLGH�:LQGRZ�&ODVVHV��&ODVV�1DPH� 'HVFULSWLRQ�

%XWWRQ� 7KH�EXWWRQ�FODVV��&RPER%R[� 7KH�FRPER�ER[�FODVV��(GLW� 7KH�HGLW�FRQWURO�FODVV��/LVW%R[� 7KH�OLVW�ER[�FODVV��0',&OLHQW� 7KH�0',�FOLHQW�ZLQGRZ�FODVV��6FUROO%DU� 7KH�VFUROO�EDU�FODVV��6WDWLF� 7KH�VWDWLF�FRQWURO�FODVV��&RPER/%R[� 7KH�OLVW�ER[�FODVV�WKDW�LV�FRQWDLQHG�LQ�D�FRPER�ER[��''(0/(YHQW� 7KH�''(0/�HYHQWV�FODVV��:LQGRZV�17��������0HVVDJH� 7KH�PHVVDJH�RQO\�ZLQGRZ�FODVV��:LQGRZV��������������� 7KH�PHQX�FODVV��������� 7KH�GHVNWRS�ZLQGRZ�FODVV��������� 7KH�GLDORJ�ER[�FODVV��������� 7KH�WDVN�VZLWFK�ZLQGRZ�FODVV��������� 7KH�LFRQ�WLWOHV�FODVV��:LQGRZV�17��������7KHVH�FODVVHV�DUH�FUHDWHG�E\�WKH�RSHUDWLQJ�V\VWHP�DQG�FDQ�EH�XVHG�E\�HYHU\�UXQQLQJ�SURFHVV��7KHVH�FODVVHV�FDQQRW�EH�GHVWUR\HG�E\�DQ�DSSOLFDWLRQ��7KLV�W\SH�RI�FODVV�KDV�D�V\VWHP�ZLGH�RU�JOREDO�VFRSH����KHQFH�LWV�QDPH��V\VWHP�ZLGH�FODVV��7KLV�PHDQV�WKDW�DQ\�DSSOLFDWLRQ�RU�'//�FXUUHQWO\�UXQQLQJ�LQ�WKH�V\VWHP�FDQ�XVH�PRVW�RI�WKHVH�FODVVHV�WR�FUHDWH�QHZ�ZLQGRZV���(YHQ�WKRXJK�WKH�ODVW�HLJKW�LWHPV�LQ�7DEOH�����DUH�V\VWHP�ZLGH��WKH\�DUH�DYDLODEOH�RQO\�WR�WKH�V\VWHP��7KH�GHYHORSHU�FDQQRW�XVH�WKHVH�FODVVHV�WR�FUHDWH�ZLQGRZV����7KHUH�DUH�WZR�PRUH�W\SHV�RI�FODVVHV��HDFK�KDYLQJ�D�PRUH�OLPLWHG�VFRSH��7KH�ILUVW�W\SH�RI�FODVV�LV�WKH�DSSOLFDWLRQ�JOREDO�FODVV��7KLV�FODVV�LV�FUHDWHG�DQG�UHJLVWHUHG�E\�D�PRGXOH��'//�RU�(;(��ZLWKLQ�WKH�SURFHVV�E\�SODFLQJ�WKH�&6B*/2%$/&/$66�FRQVWDQW�LQ�WKH�VW\OH�HOHPHQW�RI�WKH�:1'&/$66(;�VWUXFWXUH��7KLV�W\SH�RI�FODVV�LV�UHJLVWHUHG�DQG�XVHG�RQO\�ZLWKLQ�D�VLQJOH�SURFHVV��$OO�PRGXOHV�ZLWKLQ�WKDW�SURFHVV�KDYH�WKH�DELOLW\�WR�FUHDWH�QHZ�ZLQGRZV�XVLQJ�WKLV�W\SH�RI�FODVV���7KH�VHFRQG�W\SH�RI�FODVV�LV�WKH�ORFDO�FODVV��7KH�ORFDO�FODVV�LV�FUHDWHG�DQG�UHJLVWHUHG�E\�D�VLQJOH�PRGXOH��(;(�RU�'//���7KLV�W\SH�RI�FODVV�LV�DYDLODEOH�RQO\�WR�WKH�PRGXOH�WKDW�UHJLVWHUHG�LW��([FOXGLQJ�WKH�&6B*/2%$/&/$66�FRQVWDQW�IURP�WKH�VW\OH�PHPEHU�RI�WKH�:1'&/$66(;�FODVV�VWUXFWXUH�DOORZV�\RX�WR�FUHDWH�WKLV�W\SH�RI�FODVV���

Page 44: Visual Basic - Subclassing and Hooking with VB & VB NET

:KHQ�\RX�DUH�XVLQJ�WKH�63<���SURJUDP�WR�ZDWFK�\RXU�9%�DSSOLFDWLRQV��\RX�ZLOO�QRWLFH�WKDW�9%�XVHV�FODVVHV�SUHSHQGHG�ZLWK�WKH�ZRUG��7KXQGHU���/RRNLQJ�DW�)LJXUH������\RX�FDQ�VHH�WKDW�WKHUH�DUH�VHYHUDO�7KXQGHU�FODVVHV���ThunderRT6FormDC

7KH�FODVV�IRU�DOO�9%�IRUPV���ThunderRT6CommandButton

7KH�FODVV�IRU�DOO�9%�EXWWRQV���ThunderTR6TextBox

7KH�FODVV�IRU�DOO�9%�WH[W�ER[HV���ThunderRT6Main

7KH�FODVV�IRU�WKH�IRUP�WKDW�RZQV�DOO�9%�WRS�OHYHO�ZLQGRZV��7KLV�ZLQGRZ�LV�DOZD\V�KLGGHQ���

'HSHQGLQJ�RQ�WKH�YHUVLRQ�RI�9%�\RX�DUH�XVLQJ��7KXQGHU57��RU�7KXQGHU57��FDQ�EH�SUHSHQGHG�WR�WKH�FODVV�QDPH��7KH�OHWWHUV�LQ�57��GHQRWH�WKH�ZRUG��UXQWLPH���DQG�WKH�QXPEHU�GHQRWHV�WKH�YHUVLRQ�RI�9%��7KH�QXPEHU�LV�QRW�DGGHG�IRU�YHUVLRQV�RI�9%�HDUOLHU�WKDQ����$OVR��ZKHQ�UXQQLQJ�LQ�WKH�,'(��WKHUH�LV�QR�57���MXVW�WKH�ZRUG�7KXQGHU��7KXQGHU�ZDV�WKH�FRGH�QDPH�IRU�9%�ZKHQ�LW�ZDV�ILUVW�EHLQJ�GHYHORSHG�DW�0LFURVRIW���

)LJXUH������9%��7KXQGHU��FODVVHV�

��������7KH�ZLQGRZ�SURFHGXUH�

$OO�ZLQGRZV�PXVW�KDYH�D�ZLQGRZ�SURFHGXUH�WR�SURFHVV�LQFRPLQJ�PHVVDJHV�IURP�WKHLU�WKUHDGV�PHVVDJH�TXHXH��$�ZLQGRZ�SURFHGXUH�LV�EDVLFDOO\�D�IXQFWLRQ�WKDW�UHFHLYHV�WKH�ZLQGRZV�PHVVDJH�SDVVHG�LQ�DV�D�/RQJ��DORQJ�ZLWK�DQ\�SDUDPHWHUV�DVVRFLDWHG�ZLWK�WKH�PHVVDJH�DV�DUJXPHQWV��7KH�ERG\�RI�WKLV�IXQFWLRQ�LV�VLPSO\�D�ODUJH�FDVH�VWDWHPHQW�WKDW�

Page 45: Visual Basic - Subclassing and Hooking with VB & VB NET

SURYLGHV�WKH�DSSURSULDWH�IXQFWLRQDOLW\�IRU�HDFK�PHVVDJH�WKDW�WKH�GHYHORSHU�LV�LQWHUHVWHG�LQ��$OO�ZLQGRZ�SURFHGXUHV�KDYH�WKH�IROORZLQJ�SURWRW\SH���/5(68/7�&$//%$&.�:LQGRZ3URF����+:1'�KZQG����������8,17�X0VJ����������:3$5$0�Z3DUDP������/3$5$0�O3DUDP�������7KH�ZLQGRZ�SURFHGXUH�KDV�WKH�IROORZLQJ�SDUDPHWHUV��KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�WR�ZKLFK�WKH�PHVVDJH�LV�GLUHFWHG��X0VJ

$�FRQVWDQW�WKDW�LGHQWLILHV�WKH�PHVVDJH�WKDW�LV�EHLQJ�VHQW�Z3DUDP

([WUD�LQIRUPDWLRQ�WKDW�WKH�PHVVDJH�FDQ�FRQWDLQ�O3DUDP

([WUD�LQIRUPDWLRQ�WKDW�WKH�PHVVDJH�FDQ�FRQWDLQ�7KH�Z3DUDP�DQG�O3DUDP�DUJXPHQWV�FRQWDLQ�LQIRUPDWLRQ�QHHGHG�WR�SURFHVV�D�PHVVDJH��7KH�LQIRUPDWLRQ�FRQWDLQHG�ZLWKLQ�WKHVH�WZR�DUJXPHQWV�GHSHQGV�RQ�WKH�PHVVDJH�EHLQJ�VHQW��7DNH��IRU�H[DPSOH��WKH�:0B'(6752<�PHVVDJH��ZKLFK�LV�VHQW�GXULQJ�WKH�GHVWUXFWLRQ�RI�D�ZLQGRZ��7KLV�PHVVDJH�GRHV�QRW�XVH�HLWKHU�WKH�O3DUDP�RU�WKH�Z3DUDP�DUJXPHQWV��2Q�WKH�RWKHU�KDQG��WKH�:0B6,=(�PHVVDJH��ZKLFK�LV�VHQW�DIWHU�D�ZLQGRZ�KDV�EHHQ�UHVL]HG��XVHV�ERWK�DUJXPHQWV��7KH�Z3DUDP�FRQWDLQV�D�FRQVWDQW�GHVFULELQJ�WKH�W\SH�RI�UHVL]LQJ�EHLQJ�GRQH��7KH�O3DUDP�FRQWDLQV�WKH�ZLGWK�DQG�KHLJKW�RI�WKH�ZLQGRZ�EHLQJ�UHVL]HG��2WKHU�PHVVDJHV�FDQ�XVH�RQO\�RQH�RI�WKH�DUJXPHQWV��,W�LV�LPSRUWDQW�WR�H[DPLQH�WKH�GHILQLWLRQ�DQG�VWUXFWXUH�RI�HDFK�PHVVDJH�VR�WKDW�\RX�XVH�LW�FRUUHFWO\���7KLV�EULQJV�XS�DQ�LPSRUWDQW�SRLQW��0DQ\�WLPHV�D�PHVVDJH�ZLOO�FRQWDLQ�D�SRLQWHU�WR�D�VWUXFWXUH�LQ�WKH�Z3DUDP�RU�O3DUDP�DUJXPHQWV��7KH�&RS\0HPRU\�$3,�IXQFWLRQ�LV�XVHG�WR�SODFH�WKH�VWUXFWXUH�SRLQWHG�WR�E\�HLWKHU�RI�WKHVH�DUJXPHQWV�LQWR�WKH�VDPH�VWUXFWXUH�GHFODUHG�LQ�9%��7KH�&RS\0HPRU\�SURFHGXUH�GHFODUDWLRQ�LQ�9%�LV�DV�IROORZV���3XEOLF�'HFODUH�6XE�&RS\0HPRU\�/LE��NHUQHO����$OLDV��5WO0RYH0HPRU\��B�� � �'HVWLQDWLRQ�$V�$Q\��6RXUFH�$V�$Q\��%\9DO�/HQJWK�$V�/RQJ��,WV�SDUDPHWHUV�DUH��'HVWLQDWLRQ

7KH�GHVWLQDWLRQ�DGGUHVV�WR�ZKLFK�WKH�LQIRUPDWLRQ�LV�WR�EH�FRSLHG�6RXUFH

7KH�VRXUFH�DGGUHVV�IURP�ZKLFK�WKH�LQIRUPDWLRQ�LV�WR�EH�FRSLHG�/HQJWK

7KH�OHQJWK�LQ�E\WHV�RI�WKH�LQIRUPDWLRQ�WR�EH�FRSLHG�

Page 46: Visual Basic - Subclassing and Hooking with VB & VB NET

([DPSOH�����LV�D�VKRUW�H[DPSOH�XVLQJ�&RS\0HPRU\�WR�JHW�D�VWUXFWXUH�UHWXUQHG�IURP�WKH�*HW&ODVV,QIR([�$3,�IXQFWLRQ��7KH�ILUVW�IRXU�OLQHV�GLPHQVLRQ�WKH�YDULDEOHV�WKDW�DUH�XVHG��7KH�:1'&/$66(;�VWUXFWXUH�ZLOO�EH�FRSLHG�IURP�PHPRU\�XVLQJ�WKH�SRLQWHU�VWRUHG�LQ�WKH�VWUXFW2ULJ%WWQ&ODVV�YDULDEOH�DQG�SODFHG�LQWR�WKH�VWUXFW&RS\%WWQ&ODVV�YDULDEOH��7KH�QH[W�OLQH�RI�FRGH�XVHV�*HW&ODVV,QIR([�WR�UHWULHYH�WKH�FODVV�VWUXFWXUH�IRU�WKH�V\VWHP�ZLGH�%87721�FODVV��7KH�VWUXFW2ULJ%WWQ&ODVV�YDULDEOH�QRZ�FRQWDLQV�D�SRLQWHU�WR�WKH�:1'&/$66(;�VWUXFWXUH��%HIRUH�ZH�FDQ�XVH�WKLV�VWUXFWXUH��ZH�KDYH�WR�XVH�WKH�&RS\0HPRU\�IXQFWLRQ�WR�FRS\�WKH�VWUXFWXUH�SRLQWHG�WR�E\�VWUXFW2ULJ%WWQ&ODVV�LQWR�WKH�VWUXFW&RS\%WWQ&ODVV�YDULDEOH��7KH�ODVW�OLQH�RI�FRGH�XVHV�WKH�VWUXFW&RS\%WWQ&ODVV�YDULDEOH�WR�UHWULHYH�WKH�OSIQZQGSURF�PHPEHU�GDWD�DQG�SODFH�LW�LQWR�D�VHSDUDWH�YDULDEOH���

([DPSOH������8VLQJ�WKH�&RS\0HPRU\�3URFHGXUH��

'LP�VWUXFW2ULJ%WWQ&ODVV�$V�:1'&/$66(;�'LP�VWUXFW&RS\%WWQ&ODVV�$V�:1'&/$66(;�'LP�PB2ULJ%WWQ:LQ3URF�DV�/RQJ�'LP�O5HW9DO�$V�/RQJ���*HW�RULJLQDO�:LQGRZV�EXWWRQ�FODVV�O5HW9DO� �*HW&ODVV,QIR([�$SS�K,QVWDQFH���%87721���VWUXFW2ULJ%WWQ&ODVV���*HW�D�FRS\�RI�LWV�HOHPHQWV�&RS\0HPRU\�VWUXFW&RS\%WWQ&ODVV��VWUXFW2ULJ%WWQ&ODVV��/HQ%�VWUXFW2ULJ%WWQ&ODVV�����������*HW�RULJLQDO�EXWWRQ�ZLQGRZ�SURFHGXUH�DQG�VDYH�LW�PB2ULJ%WWQ:LQ3URF� �VWUXFW&RS\%WWQ&ODVV�OSIQZQGSURF�&RS\0HPRU\�DOVR�FDQ�EH�XVHG�IRU�SRLQWHUV�WR�QXOO�WHUPLQDWHG�VWULQJV�WKDW�DUH�SDVVHG�EDFN�WR�9%�DSSOLFDWLRQV��8QGHUVWDQGLQJ�DQG�XVLQJ�&RS\0HPRU\�LV�D�UHTXLUHPHQW�IRU�PDQLSXODWLQJ�PHVVDJHV�WKDW�FRQWDLQ�SRLQWHUV�WR�VWUXFWXUHV�DV�ZHOO�DV�VWULQJV���7R�UHVXPH�RXU�GLVFXVVLRQ�RI�WKH�ZLQGRZ�SURFHGXUH��IRU�D�ZLQGRZ�SURFHGXUH�WR�EH�DEOH�WR�SURFHVV�PHVVDJHV��LW�PXVW�ILUVW�EH�IHG�WKH�PHVVDJHV��$�PHVVDJH�ORRS�LV�XVHG�IRU�WKLV�SXUSRVH��,Q�VKRUW��D�PHVVDJH�ORRS�UXQV�IRU�WKH�HQWLUH�OLIHWLPH�RI�WKH�WKUHDG�WR�ZKLFK�LW�LV�DWWDFKHG��,W�FRQWLQXDOO\�FKHFNV�WKH�WKUHDG�PHVVDJH�TXHXH�IRU�PHVVDJHV�DQG�WKHQ�SDVVHV�WKHP�RQ�WR�WKH�ZLQGRZ�SURFHGXUH��,�ZLOO�H[SODLQ�WKLV�LQ�PRUH�GHWDLO�ODWHU�LQ�WKLV�FKDSWHU��)RU�QRZ��([DPSOH�����VKRZV�WKH�9LVXDO�&���FRGH�XVHG�WR�FUHDWH�D�PHVVDJH�ORRS���

([DPSOH������$�0HVVDJH�/RRS��

ZKLOH��*HW0HVVDJH��PVJ��18//������������ ��*HW�PVJ�IURP�TXHXH�^��

Page 47: Visual Basic - Subclassing and Hooking with VB & VB NET

� 7UDQVODWH0HVVDJH��PVJ����� � ��1HFHVVDU\�IRU�NH\ERDUG�LQSXW�� 'LVSDWFK0HVVDJH��PVJ����� � ��6HQGV�PVJ�WR�ZLQGRZ�SURFHGXUH�`��,Q�D�9LVXDO�&���DSSOLFDWLRQ��D�ZLQGRZ�SURFHGXUH�ORRNV�VRPHWKLQJ�OLNH�([DPSOH������,Q�D�UHDO�ZRUOG�DSSOLFDWLRQ��WKH�VZLWFK�VWDWHPHQW��DQDORJRXV�WR�D�9%�6HOHFW�&DVH�VWDWHPHQW��ZRXOG�KDQGOH�PDQ\�PRUH�PHVVDJHV���

([DPSOH������$�:LQGRZ�3URFHGXUH��

/5(68/7�&$//%$&.�:QG3URF��+:1'�K:QG���� � � � 8,17�XPVJ���� � � � :3$5$0�Z3DUDP���� � � � /3$5$0�O3DUDP����^�� VZLWFK���XPVJ���� ��� � FDVH�:0B&200$1'��� � � ��'R�ZRUN�KHUH�� � � EUHDN���� � FDVH�:0B'(6752<���� � � 3RVW4XLW0HVVDJH��������� � � UHWXUQ������ � GHIDXOW���� `���� UHWXUQ��'HI:LQGRZ3URF��K:QG��XPVJ��Z3DUDP��O3DUDP������`��$V�\RX�FDQ�VHH��PRVW�RI�WKH�:QG3URF�ZLQGRZ�SURFHGXUH�LV�WDNHQ�XS�E\�D�VZLWFK�VWDWHPHQW��+XQGUHGV�RI�PHVVDJHV�FDQ�EH�SDVVHG�WR�D�ZLQGRZ�SURFHGXUH��,Q�D�UHDO�ZRUOG�DSSOLFDWLRQ�ZULWWHQ�LQ�&����D�ZLQGRZ�SURFHGXUH�FRXOG�EHFRPH�YHU\�ODUJH���$�YHU\�LPSRUWDQW�REVHUYDWLRQ�PXVW�EH�PDGH�DERXW�WKLV�ZLQGRZ�SURFHGXUH��1RWLFH�WKDW��E\�GHIDXOW��WKH�'HI:LQGRZ3URF�$3,�IXQFWLRQ�LV�FDOOHG�DW�WKH�YHU\�HQG�RI�WKLV�ZLQGRZ�SURFHGXUH��7KLV�IXQFWLRQ�LV�GHFODUHG�LQ�9%�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�'HI:LQGRZ3URF�/LE��XVHU����B�� � $OLDV��'HI:LQGRZ3URF$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Z0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�WR�ZKLFK�WKH�PHVVDJH�LV�GLUHFWHG��

Page 48: Visual Basic - Subclassing and Hooking with VB & VB NET

X0VJ

$�FRQVWDQW�WKDW�LGHQWLILHV�WKH�PHVVDJH�WKDW�LV�EHLQJ�VHQW��Z3DUDP

([WUD�LQIRUPDWLRQ�WKDW�WKH�PHVVDJH�FDQ�FRQWDLQ��7KLV�YDOXH�LV�GHWHUPLQHG�E\�WKH�PHVVDJH���

O3DUDP

([WUD�LQIRUPDWLRQ�WKDW�WKH�PHVVDJH�FDQ�FRQWDLQ��7KLV�YDOXH�LV�GHWHUPLQHG�E\�WKH�PHVVDJH���

7KH�UHWXUQ�YDOXH�DOVR�GHSHQGV�RQ�WKH�PHVVDJH��$V�\RX�PLJKW�QRWLFH��WKHVH�DUJXPHQWV�DUH�WKH�VDPH�LQ�QXPEHU�DQG�W\SH�DV�WKH�DUJXPHQWV�LQ�WKH�:QG3URF�ZLQGRZ�SURFHGXUH��7KHVH�DUJXPHQWV�DUH�VLPSO\�SDVVHG�WKURXJK�WR�WKLV�IXQFWLRQ��7KLV�IXQFWLRQ�FDOOV�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�ZKLFK�SURYLGHV�WKH�PLQLPXP�IXQFWLRQDOLW\�IRU�DOO�ZLQGRZV���:LQGRZ�SURFHGXUHV��IRU�QHDUO\�DOO�PHVVDJHV��PXVW�FDOO�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH��)DLOLQJ�WR�GR�VR�FDQ�PHDQ�WKDW�FHUWDLQ�PHVVDJHV�PLJKW�QRW�EH�KDQGOHG�FRUUHFWO\��7KH�SUHYLRXV�FRGH�H[DPSOH�IRU�WKH�:QG3URF�IXQFWLRQ�FDOOV�'HI:LQGRZ3URF�DIWHU�SURFHVVLQJ�WKH�:0B&200$1'�PHVVDJH��EXW�QRW�DIWHU�WKH�:0B'(6752<�PHVVDJH��7KH�:0B'(6752<�PHVVDJH�FDOOV�3RVW4XLW0HVVDJH��ZKLFK�VLPSO\�LQIRUPV�WKH�WKUHDG�WKDW�LW�LV�WLPH�WR�EH�GHVWUR\HG��$W�WKLV�SRLQW��DQ\�RI�WKLV�ZLQGRZV�FKLOG�ZLQGRZV�DUH�ILUVW�GHVWUR\HG��WKHQ�WKH�ZLQGRZ�LV�GHDFWLYDWHG��DQG�NH\ERDUG�DQG�PRXVH�LQSXW�DUH�QRW�DFFHSWHG��7KH�ZLQGRZ�DQG�DQ\�RWKHU�REMHFWV�LW�RZQV�DUH�ILQDOO\�UHPRYHG�IURP�PHPRU\���7KH�'HI:LQGRZ3URF�IXQFWLRQ�LV�QRW�FDOOHG�EHFDXVH��IRU�WKLV�PHVVDJH��LW�ZRXOG�QRW�EH�GHVLUDEOH�WR�DOORZ�RWKHU�DFWLRQV�WR�RFFXU�ZKLOH�WKLV�ZLQGRZ�LV�EHLQJ�GHVWUR\HG��'XULQJ�WKH�SURFHVV�RI�GHVWUR\LQJ�D�ZLQGRZ��WKH�K:QG�RI�WKDW�ZLQGRZ�DOVR�LV�GHVWUR\HG��7KH�'HI:LQGRZ3URF�PLJKW�FDXVH�RWKHU�PHVVDJHV�WR�EH�ILUHG�RII�WKDW�FDQ�VORZ�GRZQ�RU�LQWHUIHUH�ZLWK�WKH�GHVWUXFWLRQ�SURFHVV��3RWHQWLDOO\��PHVVDJHV�FRXOG�EH�ZDLWLQJ�LQ�WKH�PHVVDJH�TXHXH�WR�EH�SURFHVVHG�E\�WKH�ZLQGRZ�SURFHGXUH�UHODWLQJ�WR�WKLV�K:QG��,I�D�PHVVDJH�HQGV�XS�LQ�WKH�WKUHDGV�PHVVDJH�TXHXH�ZLWK�WKH�KDQGOH�WR�D�ZLQGRZ�WKDW�KDV�EHHQ�GHVWUR\HG��D�*HQHUDO�3URWHFWLRQ�)DXOW��*3)��FRXOG�RFFXU�ZKHQ�WKH�PHVVDJH�ORRS�WULHV�WR�SURFHVV�WKLV�PHVVDJH���2Q�WKH�RWKHU�KDQG��LI�FHUWDLQ�PHVVDJHV�DUH�QRW�SDVVHG�RQ�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH��WKH�DSSOLFDWLRQ�PLJKW�QRW�EHKDYH�FRUUHFWO\��,PDJLQH�WU\LQJ�WR�UHVL]H�RU�PRYH�D�ZLQGRZ�ZKHQ�WKH�UHVL]H�DQG�PRYH�PHVVDJHV�DUH�QRW�EHLQJ�SDVVHG�RQ�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�IRU�SURFHVVLQJ��,W�ZRXOG�VHHP�DV�LI�WKH�DSSOLFDWLRQ�ZDV�IUR]HQ��$V�\RX�FDQ�VHH��LW�LV�LPSHUDWLYH�WR�SDVV�WKH�PHVVDJHV�RQ�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH��XQOHVV�\RX�KDQGOH�DOO�WKH�ORZ�OHYHO�IXQFWLRQDOLW\�RI�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�LQ�WKH�ZLQGRZ�SURFHGXUH�\RX�GHYHORS��7KLV�LV�QRW�UHFRPPHQGHG���:KHQ�D�V\VWHP��PRXVH��RU�NH\ERDUG�HYHQW�VHQGV�D�PHVVDJH�WR�D�VSHFLILF�ZLQGRZ��LW�LV�KDQGOHG�E\�WKH�ZLQGRZ�SURFHGXUH�IRU�WKDW�ZLQGRZ��7KH�SURFHGXUH�FDQ�SHUIRUP�VRPH�DFWLRQ�EDVHG�RQ�WKH�PHVVDJH��RU�LI�WKH�PHVVDJHG�LV�QRW�KDQGOHG��LW�LV�SDVVHG�RQ�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�WKURXJK�WKH�'HI:LQGRZ3URF�$3,�IXQFWLRQ�IRU�GHIDXOW�SURFHVVLQJ���

Page 49: Visual Basic - Subclassing and Hooking with VB & VB NET

,W�LV�LQWHUHVWLQJ�WR�QRWH�WKDW�ZKHQ�PRUH�WKDQ�RQH�ZLQGRZ�LV�FUHDWHG�IURP�D�VLQJOH�FODVV��HDFK�ZLQGRZ�KDV�WKH�VDPH�ZLQGRZ�SURFHGXUH��7KLV�LV�EHFDXVH�WKH�FODVV�PHPEHU�OSIQ:QG3URF��ZKLFK�LV�LQKHULWHG�E\�HDFK�ZLQGRZ��LV�SRLQWLQJ�WR�WKH�VDPH�PHPRU\�ORFDWLRQ��1RZ�WKLV�SURFHGXUH�LV�ZKDW�PDNHV�RXU�ZLQGRZ�IXQFWLRQDO��8QIRUWXQDWHO\��WKLV�ZLQGRZ�SURFHGXUH�LV�QRW�DV�UHDGLO\�DYDLODEOH�WR�WKH�9%�GHYHORSHU�WR�EH�PRGLILHG�DV�LW�LV�WR�WKH�9LVXDO�&���GHYHORSHU��7R�RYHUULGH�RU�FKDQJH�WKH�GHIDXOW�EHKDYLRU�RI�D�ZLQGRZ��ZH�QHHG�WR�VXEFODVV�WKH�ZLQGRZ����RU��LQ�RWKHU�ZRUGV��WR�FKDQJH�WKH�OSIQ:QG3URF�PHPEHU�WR�SRLQW�WR�D�ZLQGRZ�SURFHGXUH�WKDW�ZH�FUHDWH���

��������&UHDWLQJ�D�VLPSOH�ZLQGRZ�DSSOLFDWLRQ�ZLWK�9LVXDO�&���

%HFDXVH�9%�WHQGV�WR�REVFXUH�PRVW�RI�WKH�GHWDLOV�RI�D�:LQGRZV�DSSOLFDWLRQV�RSHUDWLRQ��LW�LV�XVHIXO�WR�ORRN�DW�WKH�9LVXDO�&���FRGH�IRU�D�YHU\�VLPSOH�DSSOLFDWLRQ�WKDW�GLVSOD\V�D�SODLQ�ZLQGRZ��ZKLFK�LV�VKRZQ�LQ�([DPSOH������7KH�DSSOLFDWLRQ�FRQVLVWV�RI�RQO\�WZR�IXQFWLRQV��7KH�ILUVW��WKH�:LQ0DLQ�IXQFWLRQ��LV�WKH�HQWU\�SRLQW�WR�D�:LQGRZV�DSSOLFDWLRQ��7KLV�IXQFWLRQ�LV�FDOOHG�E\�WKH�V\VWHP��ZKLFK�SURYLGHV�YDOXHV�DV�DUJXPHQWV�RI�WKLV�IXQFWLRQ�DV�ZHOO��7KH�IXQFWLRQV�DUJXPHQWV�DUH���K,LQVWDQFH

7KH�LQVWDQFH�KDQGOH�IRU�WKH�FXUUHQW�LQVWDQFH�RI�WKH�DSSOLFDWLRQ��K3UHY,QVWDQFH

:LQ���DSSOLFDWLRQV�DOZD\V�VHW�WKLV�WR�18//��OSV]&PG/LQH

7KH�FRPPDQG�OLQH�SDUDPHWHUV�SDVVHG�LQ�WR�WKLV�DSSOLFDWLRQ��Q&PG6KRZ

'HWHUPLQHV�KRZ�WKLV�ZLQGRZ�LV�LQLWLDOO\�GLVSOD\HG�WR�WKH�XVHU��7KH�VHFRQG�IXQFWLRQ��:QG3URF��LV�WKH�DSSOLFDWLRQV�ZLQGRZ�SURFHGXUH���

([DPSOH������$�6LPSOH�:LQGRZV�$SSOLFDWLRQ�:ULWWHQ�LQ�&����

LQW�3$6&$/�:LQ0DLQ��+,167$1&(�K,QVWDQFH���� � � +,167$1&(�K3UHY,QVWDQFH���� � � /3675�OSV]&PG/LQH���� � � LQW�Q&PG6KRZ����^��� :1'&/$66�:LQ&ODVV���� 06*�PVJ���� +:1'�K:QG����� :LQ&ODVV�OSV]&ODVV1DPH� ��1HZ:LQGRZ&ODVV����� :LQ&ODVV�OSIQ:QG3URF� �:QG3URF���

Page 50: Visual Basic - Subclassing and Hooking with VB & VB NET

� :LQ&ODVV�VW\OH� �&6B2:1'&�_�&6B95('5$:�_�&6B+5('5$:���� :LQ&ODVV�K,QVWDQFH� �K,QVWDQFH���� :LQ&ODVV�K,FRQ� �/RDG,FRQ��18//��,',B$33/,&$7,21������ :LQ&ODVV�K&XUVRU� �/RDG&XUVRU��18//��,'&B$552:������ :LQ&ODVV�KEU%DFNJURXQG� ��+%586+���&2/25B:,1'2:�������� :LQ&ODVV�OSV]0HQX1DPH� �18//���� :LQ&ODVV�FE&OV([WUD� ������ :LQ&ODVV�FE:QG([WUD� ������� 5HJLVWHU&ODVV([��:LQ&ODVV���� � ��5HJLVWHU�WKLV�FODVV��� +:QG� �&UHDWH:LQGRZ([��:6B(;B/755($',1*���� � � �1HZ:LQGRZ&ODVV����� � � �0DLQ�:LQGRZ����� � � :6B29(5/$33(':,1'2:���� � � ����� � � ����� � � &:B86('()$8/7���� � � &:B86('()$8/7���� � � K2ZQHU���� � � 18//���� � � K,QVWDQFH���� � � 18//������� 6KRZ:LQGRZ��K:QG��6:B6+2:����� ��6KRZ�WKH�FUHDWHG�ZLQGRZ��� ZKLOH��*HW0HVVDJH��PVJ��18//�������������*HW�PVJ�IURP�TXHXH�� ^��� � 7UDQVODWH0HVVDJH��PVJ����� ��1HFHVVDU\�IRU�NH\ERDUG�LQSXW�� � 'LVSDWFK0HVVDJH��PVJ����� ��6HQGV�PVJ�WR�ZLQGRZ�SURFHGXUH�� `���� UHWXUQ�PVJ�Z3DUDP���`���/5(68/7�&$//%$&.�:QG3URF��+:1'�K:QG���� � � � 8,17�XPVJ���� � � � :3$5$0�Z3DUDP���� � � � /3$5$0�O3DUDP����^�

Page 51: Visual Basic - Subclassing and Hooking with VB & VB NET

� VZLWFK���XPVJ���� ��� � FDVH�:0B&200$1'��� � � ��'R�ZRUN�KHUH�� � � EUHDN���� � FDVH�:0B'(6752<���� � � 3RVW4XLW0HVVDJH��������� � � UHWXUQ������ � GHIDXOW���� `���� UHWXUQ��'HI:LQGRZ3URF��K:QG��XPVJ��Z3DUDP��O3DUDP�������`��

����,QVLGH�WKH�:LQGRZV�0HVVDJLQJ�6\VWHP�

7KH�PHVVDJLQJ�V\VWHP�LV�DW�WKH�FRUH�RI�WKH�:LQGRZV�RSHUDWLQJ�V\VWHP��:LWKRXW�PHVVDJHV��WKH�RSHUDWLQJ�V\VWHP�ZRXOG�EH�DERXW�DV�XVHIXO�DV�D�SLOH�RI�URFNV��6XEFODVVLQJ�DQG�KRRNV�RSHUDWH�RQ�WKH�PHVVDJLQJ�V\VWHP��WKLV�LV�ZK\�LW�LV�VR�LPSRUWDQW�WR�XQGHUVWDQG�PHVVDJLQJ�DV�LW�DSSOLHV�WR�WKH�:LQGRZV�RSHUDWLQJ�V\VWHP��,Q�WKLV�VHFWLRQ��,�ZLOO�GLVFXVV�HDFK�VHSDUDWH�PHFKDQLVP�ZLWKLQ�WKH�PHVVDJLQJ�V\VWHP�WR�JLYH�\RX�DQ�LGHD�RI�KRZ�WKHVH�SLHFHV�UHODWH�DQG�RSHUDWH�WRJHWKHU�WR�VHQG�PHVVDJHV�IURP�D�VRXUFH�WR�D�GHVWLQDWLRQ�ZLQGRZ��)LJXUH�����VKRZV�KRZ�WKH�PHVVDJLQJ�V\VWHP�ZRUNV���

)LJXUH������7KH�:LQGRZV�PHVVDJLQJ�V\VWHP�

Page 52: Visual Basic - Subclassing and Hooking with VB & VB NET

������7KH�5DZ�,QSXW�7KUHDG�

7KH�RSHUDWLQJ�V\VWHP�XSRQ�ERRWXS�FUHDWHV�RQH�WKUHDG�IRU�LWVHOI��FDOOHG�WKH�UDZ�LQSXW�WKUHDG��5,7���7KHUH�LV�RQO\�RQH�RI�WKLV�W\SH�RI�WKUHDG�LQ�WKH�V\VWHP��7KLV�WKUHDG�FRQWDLQV�D�V\VWHP�PHVVDJH�TXHXH�XVHG�WR�UHFHLYH�KDUGZDUH�HYHQWV�VXFK�DV�PRXVH�FOLFNV�DQG�NH\ERDUG�NH\SUHVVHV��,W�FDQ�FROOHFW�HYHQWV�IURP�WKHVH�KDUGZDUH�GHYLFHV�WKURXJK�GHYLFH�GULYHUV��$�GHYLFH�GULYHU�LV�EDVLFDOO\�D�W\SH�RI�'//�WKDW�DFWV�DV�WKH�WUDQVODWRU�EHWZHHQ�WKH�KDUGZDUH�GHYLFH�DQG�WKH�:LQGRZV�V\VWHP��7KLV�DOORZV�KDUGZDUH�GHYLFHV�WR�FRPPXQLFDWH�ZLWK�WKH�V\VWHP��$�GHYLFH�GULYHU�VLWV�DQG�ZDLWV�IRU�LQSXW�IURP�WKH�KDUGZDUH�GHYLFH�IRU�ZKLFK�LW�LV�DVVRFLDWHG��$IWHU�LW�JHWV�VRPH�W\SH�RI�LQSXW��LW�LQWHUUXSWV�WKH�V\VWHP�DQG�VHQGV�D�KDUGZDUH�HYHQW�WR�WKH�V\VWHP�PHVVDJH�TXHXH�RQ�WKH�5,7��7KH�5,7�WDNHV�WKH�KDUGZDUH�HYHQW�RII�RI�LWV�V\VWHP�PHVVDJH�TXHXH�DQG�FRQYHUWV�LW�WR�D�VWDQGDUG�:LQGRZV�PHVVDJH��7KH�5,7�SRVWV�WKH�PHVVDJH�WR�WKH�FRUUHFW�WKUHDGV��RU�WKUHDGV��PHVVDJH�TXHXH��7KH�ODVW�VWHS�LQ�WKH�SURFHVV�LV�IRU�WKH�WKUHDGV�PHVVDJH�TXHXH�WR�GHOLYHU�WKH�PHVVDJH�WR�WKH�FRUUHFW�ZLQGRZ�SURFHGXUH���/HWV�WDNH��IRU�H[DPSOH��D�PRXVH�EXWWRQ�FOLFN�WKDW�LV�JHQHUDWHG�E\�WKH�XVHU��7KH�PRXVH�GULYHU�JDWKHUV�LQIRUPDWLRQ�DERXW�WKH�PRXVH�DQG�SODFHV�LW�LQWR�D�06*�VWUXFWXUH��GHILQHG�DV�IROORZV���W\SHGHI�VWUXFW�WDJ06*�^�����+:1'���KZQG�������8,17���PHVVDJH�������:3$5$0�Z3DUDP�������/3$5$0�O3DUDP���

Page 53: Visual Basic - Subclassing and Hooking with VB & VB NET

����':25'��WLPH�������32,17��SW���`�06*�� 306*��7KH�06*�VWUXFWXUH�KDV�WKH�IROORZLQJ�HOHPHQWV��KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�WR�ZKLFK�WKH�PHVVDJH�LV�GLUHFWHG���PHVVDJH

7KH�PHVVDJH�WR�EH�SDVVHG�WR�WKLV�ZLQGRZ��$OO�ZLQGRZ�PHVVDJHV�DUH�FRQVWDQWV��ZKLFK�DUH�GHILQHG�LQ�WKH�:LQ���6RIWZDUH�'HYHORSPHQW�.LW��6'.��KHDGHU�ILOHV��7KH�KHDGHU�ILOHV�:,186(5�+�DQG�:,1$%/(�+�FRQWDLQ�PRVW�RI�WKHVH�FRQVWDQWV���

Z3DUDP and O3DUDP

0DQ\�PHVVDJHV�PDNH�XVH�RI�WKH�Z3DUDP�DQG�O3DUDP�HOHPHQWV�WR�SDVV�LQ�H[WUD�LQIRUPDWLRQ�WR�WKH�UHFHLYLQJ�ZLQGRZ�SURFHGXUH��7KLV�H[WUD�LQIRUPDWLRQ�GHSHQGV�RQ�WKH�PHVVDJH��)RU�H[DPSOH��LW�FRXOG�LQGLFDWH�ZKLFK�PRXVH�EXWWRQ�ZDV�SUHVVHG��RU�LI�WKH�&WUO�NH\�ZDV�SUHVVHG�LQ�FRPELQDWLRQ�ZLWK�WKH�FXUUHQWO\�SUHVVHG�NH\��6RPH�PHVVDJHV�QHHG�WR�SDVV�PXFK�PRUH�LQIRUPDWLRQ�WKDQ�LV�SRVVLEOH�ZLWK�WKH�Z3DUDP�DQG�O3DUDP�DUJXPHQWV��7R�JHW�DURXQG�WKLV�OLPLWDWLRQ��VRPH�PHVVDJHV�KDYH�VSHFLDO�VWUXFWXUHV�DVVRFLDWHG�ZLWK�WKHP��3RLQWHUV�WR�WKHVH�VWUXFWXUHV�DUH�SDVVHG�LQ�HLWKHU�WKH�O3DUDP�RU�Z3DUDP�HOHPHQWV���(DFK�PHVVDJH�KDV�LWV�RZQ�LGHQWLW\����WKDW�LV��WKH�ZD\�RQH�PHVVDJH�ILOOV�LQ�WKH�06*�VWUXFWXUH�LV�QRW�WKH�ZD\�HYHU\�PHVVDJH�ZLOO�ILOO�LW�LQ��0RVW�PHVVDJHV�KDYH�WKHLU�RZQ�LQIRUPDWLRQ�WKDW�PXVW�EH�SDVVHG�RQ�WR�WKH�UHFHLYLQJ�ZLQGRZ��7KHUHIRUH��EHFRPH�IDPLOLDU�ZLWK�WKH�PHVVDJH�WKDW�\RX�DUH�JRLQJ�WR�EH�WUDSSLQJ�EHIRUH�\RX�ZULWH�WKH�FRGH�RU�\RX�PLJKW�EH�LQ�IRU�D�VXUSULVH���

WLPH

5HSUHVHQWV�ZKHQ�WKH�PHVVDJH�ZDV�SRVWHG��WLPH�LV�HTXDO�WR�WKH�QXPEHU�RI�FORFN�WLFNV�VLQFH�WKH�FRPSXWHU�KDV�EHHQ�UXQQLQJ��6R��WR�ILQG�WKH�DPRXQW�RI�WLPH�WKDW�KDV�HODSVHG�EHWZHHQ�PHVVDJHV��MXVW�VXEWUDFW�WKH�SUHYLRXV�PHVVDJHV�WLPH�PHPEHU�IURP�WKH�FXUUHQW�PHVVDJHV�WLPH�PHPEHU��7KH�WLPH�PHPEHU�ZLOO�SOD\�DQ�LPSRUWDQW�UROH�ZKHQ�ZH�VWDUW�XVLQJ�MRXUQDO�KRRNV���

SW $�SRLQWHU�WR�D�32,17�VWUXFWXUH��7KH�SW�PHPEHU�SRLQWV�WR�D�VWUXFWXUH�FRQWDLQLQJ�WKH�PRXVH�FXUVRU�FRRUGLQDWHV�ZKHQ�WKLV�PHVVDJH�ZDV�JHQHUDWHG���

7R�FRQWLQXH�ZLWK�RXU�H[DPSOH��WKH�ZLQGRZ�KDQGOH�WR�WKH�ZLQGRZ�RQ�ZKLFK�WKH�PRXVH�ZDV�FOLFNHG�LV�SODFHG�LQ�WKH�KZQG�PHPEHU��7KH�DSSURSULDWH�PHVVDJH�LGHQWLILHU�LV�SODFHG�LQ�WKH�PHVVDJH�PHPEHU�RI�WKLV�VWUXFWXUH��,Q�WKLV�FDVH��LW�ZRXOG�EH�WKH�:0B/%87721'2:1�PHVVDJH��,QIRUPDWLRQ�DERXW�WKH�DUHD�RI�WKH�ZLQGRZ�WKDW�WKH�PRXVH�ZDV�RYHU�ZKHQ�WKH�FOLFN�ZDV�JHQHUDWHG�DQG�ZKLFK�PRXVH�EXWWRQ�ZDV�SUHVVHG�LV�SODFHG�LQ�WKH�Z3DUDP�DQG�O3DUDP�PHPEHUV��7KH�WLPH�PHPEHU�FRQWDLQV�WKH�WLPH�WKDW�WKLV�PHVVDJH�ZDV�VHQW��7KH�SW�PHPEHU�FRQWDLQV�WKH�PRXVH�FRRUGLQDWHV�DW�WKH�SRLQW�LQ�WLPH�ZKHQ�WKH�PRXVH�EXWWRQ�ZDV�FOLFNHG��7KLV�

Page 54: Visual Basic - Subclassing and Hooking with VB & VB NET

06*�GDWD�LWHP�LV�WKHQ�VHQW�WR�WKH�5,7�V\VWHP�PHVVDJH�TXHXH��:KHQ�WKH�5,7�GHWHFWV�WKLV�PHVVDJH�EHLQJ�VHQW�WR�LWV�V\VWHP�PHVVDJH�TXHXH��LW�ZDNHV�XS�DQG�SURFHVVHV�WKDW�PHVVDJH��7KH�5,7�WKHQ�EURDGFDVWV�WKLV�PHVVDJH�WR�DOO�:LQGRZV�PHVVDJH�TXHXHV��7KH�PHVVDJH�ORRS�IRU�HDFK�PHVVDJH�TXHXH�GHWHUPLQHV�LI�WKLV�PHVVDJH�QHHGV�WR�EH�SURFHVVHG�DQG��LI�VR��ZKLFK�ZLQGRZ�ZLOO�GR�WKH�SURFHVVLQJ��7KH�KZQG�PHPEHU�RI�WKH�06*�VWUXFWXUH�LV�XVHG�WR�GHWHUPLQH�ZKLFK�ZLQGRZ�SURFHGXUH�ZLOO�SURFHVV�WKLV�PHVVDJH���

������7KH�6\VWHP�0HVVDJH�4XHXH�

7KH�V\VWHP�PHVVDJH�TXHXH�LV�D�VLQJOH�TXHXH�WKDW�LV�SDUW�RI�WKH�UDZ�LQSXW�WKUHDG�WKDW�UHFHLYHV�PHVVDJHV�IURP�WKH�NH\ERDUG��PRXVH��DQG�RWKHU�KDUGZDUH�GHYLFHV�YLD�WKH�KDUGZDUHV�GHYLFH�GULYHU��,W�LV�VLPLODU�WR�D�WKUHDGV�PHVVDJH�TXHXH���

������7KUHDG�0HVVDJH�4XHXHV�

$�VLQJOH�PHVVDJH�TXHXH�LV�FRQWDLQHG�ZLWKLQ�HDFK�WKUHDG�RI�D�SURFHVV��7KLV�PHVVDJH�TXHXH�UHFHLYHV�PHVVDJHV�IURP�ZLWKLQ�WKH�WKUHDG��IURP�RWKHU�WKUHDGV��DQG�IURP�WKH�5,7��7KH�PHVVDJH�TXHXH�LV�EDVLFDOO\�D�GRXEO\�OLQNHG�OLVW��ZLWK�HDFK�QRGH�LQ�WKH�OLVW�FRQWDLQLQJ�D�VLQJOH�PHVVDJH��7KLV�LV�LOOXVWUDWHG�LQ�)LJXUH������$�GRXEO\�OLQNHG�OLVW�FRQVLVWV�RI�QRGHV�WKDW�FRQWDLQ�SRLQWHUV�WR�ERWK�WKH�SUHYLRXV�QRGH�LQ�WKH�OLVW�DV�ZHOO�DV�WKH�QH[W�QRGH�LQ�WKH�OLVW��8VLQJ�WKHVH�SRLQWHUV��LW�LV�SRVVLEOH�WR�WUDYHUVH�WKH�OLQNHG�OLVW�LQ�ERWK�D�IRUZDUG�DQG�EDFNZDUG�GLUHFWLRQ���

)LJXUH������7KH�:LQGRZV�PHVVDJH�TXHXH�DV�D�GRXEO\�OLQNHG�OLVW�

7KH�PHVVDJH�TXHXH�DOVR�DFWV�DV�D�)LUVW�,Q�)LUVW�2XW��),)2��TXHXH��7KHUHIRUH��PHVVDJHV�DUH�SXOOHG�IURP�WKH�TXHXH�LQ�WKH�VDPH�RUGHU�DV�WKH\�ZHUH�SXW�LQWR�WKH�TXHXH��0HFKDQLVPV�DUH�LQ�SODFH�ZKLFK�DOORZ�PHVVDJHV�WR�EH�VNLSSHG�RU�HYHQ�UHPRYHG�ZLWKRXW�EHLQJ�VHQW�WR�D�ZLQGRZ��7KHVH�PHFKDQLVPV�DUH�DFFHVVHG�WKURXJK�WKH�*HW0HVVDJH�$3,�IXQFWLRQ���

������0HVVDJH�/RRSV�

7KH�PHVVDJH�TXHXH�LWVHOI�RQO\�TXHXHV�XS�PHVVDJHV��LW�GRHV�QRW�VHQG�WKHP�DQ\ZKHUH��7KH�WKUHDG�QHHGV�D�ZD\�WR�JHW�WKHVH�PHVVDJHV�IURP�WKH�TXHXH�DQG�VHQG�WKHP�WR�WKH�FRUUHFW�

Page 55: Visual Basic - Subclassing and Hooking with VB & VB NET

ZLQGRZ��7KLV�LV�ZKHUH�WKH�PHVVDJH�ORRS����VRPHWLPHV�FDOOHG�WKH�PHVVDJH�SXPS����HQWHUV�WKH�SLFWXUH��7KH�PHVVDJH�ORRS�LV�ZKDW�HQDEOHV�WKH�PHVVDJHV�WR�EH�VHQW�IURP�D�WKUHDGV�PHVVDJH�TXHXH�WR�WKH�FRUUHFW�ZLQGRZ�SURFHGXUH�ZLWKLQ�WKDW�WKUHDG��$V�SUHYLRXVO\�PHQWLRQHG��D�W\SLFDO�PHVVDJH�ORRS�ORRNV�OLNH�WKLV�LQ�9LVXDO�&�����ZKLOH��*HW0HVVDJH��PVJ��18//������������^��� 7UDQVODWH0HVVDJH��PVJ������ 'LVSDWFK0HVVDJH��PVJ�����`�7KHVH�ORRSV�DUH�FRQVWDQWO\�SROOLQJ�WKH�PHVVDJH�TXHXH�IRU�PHVVDJHV�WKDW�UHODWH�WR�ZLQGRZV�ZLWKLQ�WKH�WKUHDG��$IWHU�D�PHVVDJH�LV�IRXQG��LW�LV�VHQW�WR�WKH�FRUUHFW�ZLQGRZ��7KH�PHVVDJH�ORRS�XVHV�WKH�K:QG�HOHPHQW�RI�WKH�PHVVDJH�VWUXFWXUH��WKH�PHVVDJH�VWUXFWXUH�LV�LQWURGXFHG�LQ�WKH�QH[W�VHFWLRQ��WR�LGHQWLI\�ZKLFK�ZLQGRZ�WR�VHQG�WKH�PHVVDJH�WR��$V�XVXDO��9%�KLGHV�WKLV�IXQFWLRQDOLW\�IURP�WKH�GHYHORSHU�DV�ZHOO���(YHQ�WKRXJK�RQO\�WKUHH�OLQHV�RI�FRGH�DUH�LQ�WKH�PHVVDJH�ORRS��D�ORW�JRHV�RQ�KHUH��)LUVW��WKH�ZKLOH�ORRS�ZLOO�UXQ�IRU�WKH�OLIH�RI�WKH�WKUHDG��7KLV�LV�EHFDXVH�*HW0HVVDJH�ZLOO�DOZD\V�UHWXUQ�D�QRQ�]HUR�YDOXH��ZKLFK�HYDOXDWHV�WR�WUXH�LQ�9LVXDO�&����H[FHSW�ZKHQ�LW�UHFHLYHV�D�:0B48,7�PHVVDJH��7KH�:0B48,7�PHVVDJH�UHWXUQV�D�]HUR�DQG�FDXVHV�WKH�ORRS�WR�EH�H[LWHG��$IWHU�WKH�ORRS�LV�H[LWHG��WKH�WKUHDG�WHUPLQDWHV���7KH�7UDQVODWH0HVVDJH�$3,�IXQFWLRQ�UHODWHV�RQO\�WR�PHVVDJHV�RULJLQDWLQJ�IURP�WKH�NH\ERDUG��7KLV�IXQFWLRQ�WUDQVODWHV�YLUWXDO�NH\�PHVVDJHV�LQWR�FKDUDFWHU�PHVVDJHV��ZKLFK�DUH�LQ�WXUQ�SRVWHG�EDFN�LQWR�WKH�VDPH�WKUHDGV�PHVVDJH�TXHXH��7KLV�PHDQV�WKDW�ZKHQ�D�NH\�LV�SUHVVHG��D�YLUWXDO�NH\�PHVVDJH�FRPELQDWLRQ�RI�:0B.(<'2:1�IROORZHG�E\�:0B.(<83�LV�VHQW�WR�WKH�PHVVDJH�TXHXH�DVVRFLDWHG�ZLWK�WKDW�ZLQGRZ�E\�WKH�5,7��7KHVH�PHVVDJHV�FRQWDLQ�WKH�YLUWXDO�NH\�FRGH�LGHQWLI\LQJ�WKH�SUHVVHG�NH\�RQ�WKH�NH\ERDUG��7UDQVODWH0HVVDJH�ZLOO�FUHDWH�D�:0B&+$5�PHVVDJH��7KLV�PHVVDJH�LV�WKHQ�SODFHG�EDFN�RQ�WKH�TXHXH�IURP�ZKLFK�WKH�:0B.(<'2:1�DQG�:0B.(<83�PHVVDJHV�RULJLQDWHG��7KLV�LQIRUPDWLRQ�ZLOO�EHFRPH�PRUH�XVHIXO�DV�ZH�VWDUW�KRRNLQJ�NH\ERDUG�PHVVDJHV���/DVWO\��WKH�'LVSDWFK0HVVDJH�$3,�IXQFWLRQ�LV�FDOOHG��7KH�'LVSDWFK0HVVDJH�IXQFWLRQ�GRHV�H[DFWO\�WKDW��LW�GLVSDWFKHV�WKH�PHVVDJH�WR�WKH�ZLQGRZ�ZLWK�WKH�VDPH�K:QG�DV�LQ�WKH�PHVVDJH�VWUXFWXUH��,I�WKH�K:QG�LV�18//��'LVSDWFK0HVVDJH�LJQRUHV�WKH�PHVVDJH�DQG�UHWXUQV��,I�K:QG�LV�HTXDO�WR�+:1'B7230267��DOO�WRS�OHYHO�ZLQGRZV�LQ�WKH�V\VWHP����DQG�QRW�MXVW�ZLWKLQ�WKH�SURFHVV����ZLOO�UHFHLYH�WKLV�PHVVDJH���

������0HVVDJHV�

$�PHVVDJH�KDV�WKH�VWUXFWXUH���W\SHGHI�VWUXFW�WDJ06*�^�����+:1'���KZQG�������8,17���PHVVDJH���

Page 56: Visual Basic - Subclassing and Hooking with VB & VB NET

����:3$5$0�Z3DUDP�������/3$5$0�O3DUDP�������':25'��WLPH�������32,17��SW���`�06*�� 306*��7KH�06*�VWUXFWXUH�HOHPHQWV�ZHUH�GHILQHG�HDUOLHU�LQ�WKLV�FKDSWHU�LQ�6HFWLRQ���������,I�\RX�FRPSDUH�WKH�DUJXPHQWV�RI�WKH�ZLQGRZ�SURFHGXUH�ZLWK�WKH�06*�VWUXFWXUH��\RX�ZLOO�QRWLFH�WZR�DUJXPHQWV�PLVVLQJ�LQ�WKH�ZLQGRZ�SURFHGXUH��7KH�WLPH�DQG�SW�YDOXHV�DUH�QRW�VHQW�WR�WKH�ZLQGRZ�SURFHGXUH��)RUWXQDWHO\��WZR�$3,�FDOOV�DOORZ�\RX�WR�UHWULHYH�WKH�WLPH�DQG�SW�HOHPHQWV�LQIRUPDWLRQ�PDQXDOO\��WKH\�DUH�*HW0HVVDJH7LPH�DQG�*HW0HVVDJH3RV���

������7KH�'LIIHUHQW�7\SHV�RI�0HVVDJHV�

7KHUH�DUH�PDQ\�GLIIHUHQW�W\SHV�RI�PHVVDJHV�LQ�WKH�:LQGRZV�RSHUDWLQJ�V\VWHP��7KH�PHVVDJH�FRQVWDQWV�FRQWDLQHG�LQ�WKH�PHVVDJH�HOHPHQW�RI�WKH�06*�VWUXFWXUH�KDYH�D�SUHIL[�IROORZHG�E\�DQ�XQGHUVFRUH�DQG�WKHQ�WKH�QDPH�RI�WKH�PHVVDJH��)RU�H[DPSOH��PHVVDJHV�UHODWLQJ�WR�WKH�FRPER�ER[�FRQWURO�DUH�SUHIL[HG�E\�&%��ZKLOH�PHVVDJHV�UHODWLQJ�WR�PRXVH��NH\ERDUG��FOLSERDUG��VFUROOEDU��DQG�VHYHUDO�RWKHU�FRQWUROV�KDYH�WKH�SUHIL[�:0��$�OLVW�RI�PHVVDJH�SUHIL[HV�DSSHDUV�LQ�7DEOH�������

7DEOH������:LQGRZV�0HVVDJH�3UHIL[HV��3UHIL[� 0HVVDJH�7\SH� 3UHIL[� 0HVVDJH�7\SH�

$%0� $SSOLFDWLRQ�GHVNWRS�WRROEDU�� 0&0� 0RQWK�FDOHQGDU�FRQWURO��%0� %XWWRQ�FRQWURO�� 3%0� 3URJUHVV�EDU��&%� &RPER�ER[�FRQWURO�� 3*0� 3DJHU�FRQWURO��&%(0� ([WHQGHG�FRPER�ER[�FRQWURO�� 360� 3URSHUW\�VKHHW��&'0� &RPPRQ�GLDORJ�ER[�� 5%� 5HEDU�FRQWURO��'%7� 'HYLFH�� 6%� 6WDWXV�EDU�ZLQGRZ��'/� 'UDJ�OLVW�ER[�� 6%0� 6FUROO�EDU�FRQWURO��'0� 'HIDXOW�SXVK�EXWWRQ�FRQWURO�� 670� 6WDWLF�FRQWURO��'70� 'DWH�DQG�WLPH�SLFNHU�FRQWURO�� 7%� 7RROEDU��(0� (GLW�FRQWURO�� 7%0� 7UDFNEDU��+'0� +HDGHU�FRQWURO�� 7&0� 7DE�FRQWURO��+.0� +RW�NH\�FRQWURO�� 770� 7RROWLS�FRQWURO��,30� ,QWHUQHW�SURWRFRO��,3��DGGUHVV�FRQWURO�� 790� 7UHH�YLHZ�FRQWURO��/%� /LVW�ER[�FRQWURO�� 8'0� 8S�GRZQ�FRQWURO��/90� /LVW�YLHZ�FRQWURO�� :0� *HQHUDO�ZLQGRZ��

Page 57: Visual Basic - Subclassing and Hooking with VB & VB NET

����3HUIRUPDQFH�&RQVLGHUDWLRQV�

:KHQ�LPSOHPHQWLQJ�VXEFODVVHV�DQG�KRRNV��SHUIRUPDQFH�LV�D�FULWLFDO�IDFWRU��7RR�PXFK�FRGH�H[HFXWLQJ�ZLWKLQ�D�KRRN�RU�D�VXEFODVVHG�ZLQGRZ�FRXOG�HDVLO\�EULQJ�SHUIRUPDQFH�GRZQ�EHORZ�DQ�XQDFFHSWDEOH�OHYHO��.HHS�WKLV�LQ�WKH�IURQW�RI�\RXU�PLQG�ZKHQ�ZULWLQJ�WKH�FRGH�WR�KDQGOH�VXEFODVVLQJ�DQG�KRRNV��6\VWHP�ZLGH�KRRNV�KDYH�WKH�PRVW�SRWHQWLDO�WR�GHJUDGH�SHUIRUPDQFH��,�ZLOO�GLVFXVV�ZKHUH�WKHVH�SHUIRUPDQFH�ERWWOHQHFNV�FDQ�DULVH�DV�ZH�SURJUHVV�WKURXJK�WKLV�ERRN��

Page 58: Visual Basic - Subclassing and Hooking with VB & VB NET

�&KDSWHU����7KH�%DVLFV�RI�6XEFODVVLQJ�DQG�+RRNV�7KLV�FKDSWHU�ZLOO�LQWURGXFH�KRZ�VXEFODVVLQJ�DQG�KRRNV�RSHUDWH��,�ZLOO�XVH�ELWV�DQG�SLHFHV�RI�FRGH��LQVWHDG�RI�FRPSOHWH�H[DPSOHV��VR�WKDW�ZH�FDQ�IRFXV�RQ�WKH�EDVLFV�RI�KRRNLQJ�DQG�VXEFODVVLQJ��7KH�ILQHU�GHWDLOV�RI�WKH�FRGH�ZLOO�EH�FRYHUHG�LQ�WKH�UHPDLQGHU�RI�WKLV�ERRN���7KLV�FKDSWHU�LV�EURNHQ�XS�LQWR�WZR�VHFWLRQV��7KH�ILUVW�VHFWLRQ�GHDOV�ZLWK�VXEFODVVLQJ�DQG�KRZ�LW�ZRUNV��DV�ZHOO�DV�ZKDW�LW�LV�XVHIXO�IRU��7KH�VHFRQG�VHFWLRQ�GHDOV�ZLWK�WKH�KRRNLQJ�PHFKDQLVP�LQ�D�VLPLODU�IDVKLRQ��2I�WKH�WZR�ODQJXDJHV�,�XVH��,�ZLOO�IRFXV�DV�PXFK�DV�SRVVLEOH�RQ�9LVXDO�%DVLF��9%��DQG�XVH�9LVXDO�&���RQO\�ZKHQ�9%�KDV�UHDFKHG�LWV�OLPLWV��

����:KDW�,V�6XEFODVVLQJ"�

7KH�LGHD�EHKLQG�VXEFODVVLQJ�LV�VLPSOH��LPSOHPHQWLQJ�LW�LV�QRW�VR�VLPSOH��6XEFODVVLQJ�LV��LQ�VLPSOH�WHUPV��WKH�FUHDWLRQ�RI�D�QHZ�ZLQGRZ�SURFHGXUH��ZKLFK�LV�LQVHUWHG�LQWR�WKH�PHVVDJH�VWUHDP�MXVW�EHIRUH�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�WKDW�HYHU\�ZLQGRZ�LQLWLDOO\�VWDUWV�RXW�ZLWK��,�XVH�WKH�WHUP�PHVVDJH�VWUHDP�WR�GHQRWH�WKH�SDWK�D�PHVVDJH�WDNHV�IURP�LWV�VRXUFH�WR�LWV�GHVWLQDWLRQ���7KLV�LV�QRW�WR�VD\�WKDW�VXEFODVVLQJ�LV�QRW�GDQJHURXV�ZKHQ�LPSOHPHQWHG�LQFRUUHFWO\�RU�ZLWKRXW�UHJDUG�WR�RWKHU�SURFHVVHV�UXQQLQJ�LQ�WKH�RSHUDWLQJ�V\VWHP��%XW�E\�XQGHUVWDQGLQJ�WKH�PHVVDJLQJ�V\VWHP�DQG�IROORZLQJ�LWV�UXOHV��ZH�FDQ�VDIHO\�XVH�VXEFODVVLQJ���7KH�GDQJHUV�RI�VXEFODVVLQJ�DUH�ZKDW�VWRS�PDQ\�SURJUDPPHUV�IURP�OHDUQLQJ�DQG�XVLQJ�VXEFODVVLQJ�LQ�WKHLU�SURMHFWV��7KH�IRUHPRVW�GDQJHU�ZLWK�VXEFODVVLQJ�LV�FDXVLQJ�D�*HQHUDO�3URWHFWLRQ�)DXOW��*3)���*3)V�DUH�FULWLFDO�HUURUV�WKDW�ZLOO�HLWKHU�FDXVH�\RXU�DSSOLFDWLRQ�V\VWHP�WR�VWRS�IXQFWLRQLQJ�RU�FDXVH�WKH�DSSOLFDWLRQ�V\VWHP�WR�VKXW�GRZQ��,I�\RX�DUH�UXQQLQJ�DQ�DSSOLFDWLRQ�LQ�WKH�9%�,'(�DQG�LW�FDXVHV�D�*3)��QRW�RQO\�LV�WKH�DSSOLFDWLRQ�VKXW�GRZQ��EXW�DOVR�WKH�,'(��7KLV�LV�EHFDXVH�ERWK�DUH�UXQQLQJ�LQ�WKH�VDPH�SURFHVV��DQG�D�*3)�ZLOO�FDXVH�WKDW�SURFHVV�WR�WHUPLQDWH���6HYHUDO�WKLQJV�FDXVH�*3)V��7KH\�LQFOXGH��

• 8VLQJ�D�SRLQWHU�YDULDEOH�WKDW�SRLQWV�WR�DQ�LQYDOLG�ORFDWLRQ�LQ�PHPRU\��• 7U\LQJ�WR�UHDG�IURP�PHPRU\�WKDW�LV�QRW�DFFHVVLEOH�IURP�WKH�DSSOLFDWLRQ��H�J���LQ�D�

VHSDUDWH�SURFHVV�PHPRU\�VSDFH���• 7U\LQJ�WR�ZULWH�WR�PHPRU\�WKDW�LV�QRW�DFFHVVLEOH�IURP�WKH�DSSOLFDWLRQ��H�J���LQ�D�

VHSDUDWH�SURFHVV�PHPRU\�VSDFH���• 5HDGLQJ�RU�ZULWLQJ�SDVW�DQ�DUUD\�RU�VWULQJ�ERXQGDU\��• ,QFRUUHFWO\�FDOOLQJ�D�G\QDPLF�OLQN�OLEUDU\��'//��IXQFWLRQ��

Page 59: Visual Basic - Subclassing and Hooking with VB & VB NET

*3)V�DUH�HOXVLYH�SUREOHPV�IRU�WKH�9%�SURJUDPPHU�WR�WUDFN�GRZQ��LQ�IDFW��WKH\UH�HYHQ�HOXVLYH�SUREOHPV�IRU�WKH�&���SURJUDPPHU�WR�WUDFN�GRZQ��7KDW�LV�ZK\�XVLQJ�WRROV�VXFK�DV�1X0HJD�%RXQGV�&KHFNHU�DQG�0LFURVRIW�6S\����ZKLFK�DUH�GLVFXVVHG�LQ�&KDSWHU����DUH�QHFHVVDU\�ZKHQ�WUDFNLQJ�GRZQ�KDUG�WR�ILQG�SUREOHPV�VXFK�DV�WKHVH���7KH�PRVW�SUHYDOHQW�UHDVRQ�WKDW�*3)V�DUH�FDXVHG�LQ�VXEFODVVLQJ�RU�KRRNLQJ�DSSOLFDWLRQV�LV�WKH�XVH�RI�LQYDOLG�SRLQWHUV��$Q�LQYDOLG�SRLQWHU�LV�D�YDULDEOH�WKDW�FRQWDLQV�WKH�DGGUHVV�WR�D�PHPRU\�ORFDWLRQ�WKDW�ZDV�QRW�DOORFDWHG�FRUUHFWO\�E\�WKH�DSSOLFDWLRQ��6XEFODVVLQJ�DQG�KRRNLQJ�UHO\�KHDYLO\�RQ�SRLQWHUV����VSHFLILFDOO\��RQ�IXQFWLRQ�SRLQWHUV�XVHG�WR�DFFHVV�FDOOEDFN�IXQFWLRQV��DQG�RQ�SRLQWHUV�WR�GDWD�UHWXUQHG�LQ�D�PHVVDJH�DUJXPHQW��9LVXDO�%DVLF�GHYHORSHUV�RUGLQDULO\�GR�QRW�KDYH�WR�GHDO�ZLWK�SRLQWHUV�LQ�WKH�VDPH�ZD\�DV�9LVXDO�&���SURJUDPPHUV�GR��3RLQWHUV�DUH�ZHOO�KLGGHQ�LQ�WKH�9%�HQYLURQPHQW��%XW�WKURXJK�WKH�PDQLSXODWLRQ�RI�PHVVDJH�SDUDPHWHUV�DQG�WKH�XVH�RI�PRUH�DGYDQFHG�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IXQFWLRQV��WKH�9%�GHYHORSHU�VRRQ�ILQGV�KHUVHOI�QHFN�GHHS�LQ�SRLQWHUV��7DNH��IRU�H[DPSOH��WKH�*HW&ODVV,QIR([�$3,�IXQFWLRQ�WKDW�ZDV�LQWURGXFHG�LQ�&KDSWHU����7KH�WKLUG�DQG�ILQDO�DUJXPHQW�WR�WKLV�IXQFWLRQ�LV�D�SRLQWHU�WR�D�:1'&/$66(;�VWUXFWXUH��:LWKRXW�NQRZOHGJH�RI�KRZ�WR�XVH�WKH�&RS\0HPRU\�$3,�IXQFWLRQ�WR�JHW�WR�WKH�VWUXFWXUH��WKH�9%�SURJUDPPHU�LV�ORVW���$QRWKHU�UHDVRQ�IRU�*3)V�LQ�WKHVH�W\SHV�RI�DSSOLFDWLRQV�LV�WKDW�9%�XVHV�:LQGRZV�$3,�IXQFWLRQV�H[WHQVLYHO\�WR�PDNH�VXEFODVVLQJ�DQG�KRRNLQJ�ZRUN��0DNLQJ�D�VLPSOH�HUURU�LQ�FDOOLQJ�DQ�$3,�IXQFWLRQ�FRXOG�HDVLO\�UHVXOW�LQ�D�*3)��(UURUV�LQ�FDOOLQJ�$3,�IXQFWLRQV�XVXDOO\�RFFXU�EHFDXVH�RI�GHFODULQJ�RU�FDOOLQJ�DQ�$3,�IXQFWLRQ�LQFRUUHFWO\��7ZR�RI�WKH�PRVW�FRPPRQ�VRXUFHV�RI�HUURUV�LQ�FDOOLQJ�:LQ���$3,�IXQFWLRQV�LQFOXGH���

• )DLOLQJ�WR�XVH�%\9DO�FRUUHFWO\�LQ�WKH�GHFODUDWLRQ�RI�DQ�$3,�IXQFWLRQ��• 3DVVLQJ�LQ�D�VWULQJ�WR�DQ�$3,�IXQFWLRQ�WKDW�LV�QRW�FRUUHFWO\�WHUPLQDWHG�ZLWK�D�18//��

$V�,�WDNH�\RX�WKURXJK�HDFK�VWHS�RI�WKH�SURFHVV��,�ZLOO�SRLQW�RXW�WKH�SLWIDOOV�DQG�SRWHQWLDO�WURXEOH�DUHDV�WKDW�\RX�ZLOO�HQFRXQWHU��+RZHYHU��E\�UHDGLQJ�WKLV�ERRN�DQG�IROORZLQJ�LWV�JXLGHOLQHV�IRU�VXEFODVVLQJ��\RX�ZLOO�JDLQ�WKH�VNLOOV�QHHGHG�WR�VDIHO\�LQFRUSRUDWH�VXEFODVVLQJ�DQG�KRRNLQJ�LQWR�\RXU�DSSOLFDWLRQV���

������+RZ�'RHV�6XEFODVVLQJ�:RUN"�

$V�,�VDLG��VXEFODVVLQJ�LQYROYHV�LQVHUWLQJ�D�XVHU�GHILQHG�ZLQGRZ�SURFHGXUH�ULJKW�EHIRUH�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�LV�FDOOHG���6R��WKH�REMHFW�WKDW�ZH�DUH�VXEFODVVLQJ�PXVW�KDYH�D�ZLQGRZ�SURFHGXUH��7KLV�PHDQV�WKDW�ZH�ZLOO�EH�GHDOLQJ�ZLWK�ZLQGRZV����WKRXJK�WKH�WHUP��ZLQGRZ��LV�WR�EH�XQGHUVWRRG�YHU\�EURDGO\��ZH�FDQ�VXEFODVV�D�9%�IRUP�DV�ZHOO�DV�D�EXWWRQ��FRPER�ER[��RU�HYHQ�D�VFUROOEDU��$FWLYH;�FRQWUROV�ZH�FUHDWH�RXUVHOYHV�WKURXJK�9%�DOVR�FDQ�EH�VXEFODVVHG�MXVW�OLNH�DQ\�RWKHU�ZLQGRZ�LQ�WKH�RSHUDWLQJ�V\VWHP�FDQ���

Page 60: Visual Basic - Subclassing and Hooking with VB & VB NET

7KHUH�DUH�WZR�FDYHDWV�SHUWDLQLQJ�WR�WKH�SUHYLRXV�SDUDJUDSK��)RU�D�ZLQGRZ�WR�EH�VXEFODVVHG�LW�PXVW�KDYH�D�ZLQGRZ�KDQGOH��K:QG���7KLV�K:QG�LV�VHQW�DV�DQ�DUJXPHQW�WR�WKH�6HW:LQGRZ/RQJ3WU�$3,�IXQFWLRQ��ZKLFK�ZLOO�EH�GHVFULEHG�LQ�GHWDLO�ODWHU�LQ�WKLV�FKDSWHU��,I�WKH�FRQWURO�KDV�QR�K:QG��WKH�FDOO�WR�6HW:LQGRZ/RQJ3WU�ZLOO�IDLO��:LQGRZOHVV��RU�OLJKWZHLJKW��FRQWUROV�GR�QRW�KDYH�ZLQGRZ�KDQGOHV�DQG�WKHUHIRUH�FDQQRW�EH�VXEFODVVHG��7KH�IROORZLQJ�FRQWUROV�KDYH�QR�ZLQGRZ�KDQGOH�DQG�DUH�FRQVLGHUHG�ZLQGRZOHVV���

• /DEHO�• /LQH�• 6KDSH�• ,PDJH�• :/&KHFN�&RQWURO��FRQWDLQHG�LQ�06:/HVV�2&;�VKLSSHG�ZLWK�9%�����• :/&RPER�&RQWURO��FRQWDLQHG�LQ�06:/HVV�2&;�VKLSSHG�ZLWK�9%�����• :/&RPPDQG�&RQWURO��FRQWDLQHG�LQ�06:/HVV�2&;�VKLSSHG�ZLWK�9%�����• :/)UDPH�&RQWURO��FRQWDLQHG�LQ�06:/HVV�2&;�VKLSSHG�ZLWK�9%�����• :/+6FUROO�&RQWURO��FRQWDLQHG�LQ�06:/HVV�2&;�VKLSSHG�ZLWK�9%�����• :/96FUROO�&RQWURO��FRQWDLQHG�LQ�06:/HVV�2&;�VKLSSHG�ZLWK�9%�����• ://LVW�&RQWURO��FRQWDLQHG�LQ�06:/HVV�2&;�VKLSSHG�ZLWK�9%�����• :/2SWLRQ�&RQWURO��FRQWDLQHG�LQ�06:/HVV�2&;�VKLSSHG�ZLWK�9%�����• :/7H[W�&RQWURO��FRQWDLQHG�LQ�06:/HVV�2&;�VKLSSHG�ZLWK�9%�����

7KH�VHFRQG�FDYHDW�LV�WKDW�DQ\�ZLQGRZ�RXWVLGH�RI�WKH�SURFHVV�WKDW�LV�SHUIRUPLQJ�WKH�VXEFODVVLQJ�FDQQRW�EH�VXEFODVVHG��,Q�RWKHU�ZRUGV��SURFHVV�$�FDQQRW�VXEFODVV�D�ZLQGRZ�LQ�SURFHVV�%��7KLV�LV�EHFDXVH�WKH�DGGUHVV�VSDFH�RI�D�SURFHVV�LV�RII�OLPLWV�WR�DOO�RWKHU�SURFHVVHV��7KLV�OLPLWDWLRQ�SURWHFWV�DSSOLFDWLRQV�IURP�ZULWLQJ�RU�UHDGLQJ�PHPRU\�ZLWKLQ�DQRWKHU�DSSOLFDWLRQV�DGGUHVV�VSDFH��'RLQJ�VR�FRXOG�FDXVH�D�*3)��ZKLFK�ZRXOG�FUDVK�WKH�RIIHQGLQJ�DSSOLFDWLRQ��DQG�SRVVLEO\�RWKHUV���$V�ZH�VDZ�LQ�&KDSWHU����DOO�ZLQGRZV�GHULYH�IURP�D�ZLQGRZ�FODVV��7KLV�ZLQGRZ�FODVV�KDV�WKH�OSIQ:QG3URF�HOHPHQW�LQ�LWV�VWUXFWXUH��OSIQ:QG3URF�LV�D�SRLQWHU�WR�D�IXQFWLRQ����WKDW�LV��LW�FRQWDLQV�WKH�DGGUHVV�RI�D�IXQFWLRQ��LQ�WKLV�FDVH�WKH�DGGUHVV�RI�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�WKDW�ZDV�FUHDWHG�ZKHQ�WKH�ZLQGRZ�FODVV�ZDV�UHJLVWHUHG���)XQFWLRQ�SRLQWHUV�ZLOO�EH�GLVFXVVHG�LQ�JUHDWHU�GHSWK�LQ�&KDSWHU�����(YHU\�PHVVDJH�GLUHFWHG�WR�WKLV�ZLQGRZ�ZLOO�EH�VHQW�WR�WKH�ZLQGRZ�SURFHGXUH�SRLQWHG�WR�E\�WKH�OSIQ:QG3URF�IXQFWLRQ�SRLQWHU��7KLV�IXQFWLRQ�SRLQWHU�LV�WKH�NH\�WR�VXEFODVVLQJ��2XU�PDLQ�PLVVLRQ�LV�WR�FKDQJH�WKH�OSIQ:QG3URF�IXQFWLRQ�SRLQWHU�WR�SRLQW�WR�D�ZLQGRZ�SURFHGXUH�WKDW�ZH�FUHDWH��)LJXUH�����LOOXVWUDWHV�WKLV�SDUW�RI�WKH�SURFHVV��$V�)LJXUH�����VKRZV��WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�LV�QRW�GHVWUR\HG��,W�VWLOO�SOD\V�DQ�DFWLYH�UROH�LQ�KDQGOLQJ�PHVVDJHV���

)LJXUH������,QVHUWLQJ�D�QHZ�ZLQGRZ�SURFHGXUH�EHIRUH�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�GXULQJ�VXEFODVVLQJ�

Page 61: Visual Basic - Subclassing and Hooking with VB & VB NET

%HIRUH�ZH�PRGLI\�WKH�OSIQ:QG3URF�IXQFWLRQ�SRLQWHU��ZH�QHHG�WR�KDYH�D�IXQFWLRQ�IRU�LW�WR�SRLQW�WR��6R��WKH�ILUVW�ELW�RI�FRGH�ZH�QHHG�WR�ZULWH�LV�RXU�RZQ�ZLQGRZ�SURFHGXUH��7KLV�FXVWRP�FRGH�LV�UHVSRQVLEOH�IRU�KDQGOLQJ�DOO�PHVVDJHV�RU�MXVW�VSHFLILF�PHVVDJHV�LQ�WKH�ZD\�WKDW�\RX�ZDQW��DQG��E\�LPSOLFDWLRQ��LQ�D�ZD\�WKDWV�GLIIHUHQW�IURP�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH���2WKHUZLVH��ZKDW�ZRXOG�EH�WKH�SRLQW�RI�VXEFODVVLQJ"��7KLV�FRGH�XVXDOO\�WDNHV�WKH�IRUP�RI�D�ODUJH�6HOHFW�&DVH�VWDWHPHQW��ZKLFK�ZHOO�RPLW�LQ�WKLV�FKDSWHU��,W�GRHV�QRW�PDWWHU�ZKDW�ZH�FDOO�WKH�SURFHGXUH��VR�,OO�XVH�WKH�JHQHULF�QDPH�RI�:LQ3URF��7KH�SDUDPHWHUV�DQG�UHWXUQ�YDOXH�DUH�YHU\�LPSRUWDQW�WR�WKH�SURSHU�RSHUDWLRQ�RI�WKLV�QHZ�ZLQGRZ�SURFHGXUH��5HPHPEHU��WKH�PHVVDJH�ORRS�ZLOO�EH�FDOOLQJ�RXU�QHZ�ZLQGRZ�SURFHGXUH��VR�LW�H[SHFWV�WKH�VDPH�IXQFWLRQ�VLJQDWXUH�DV�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH��$V�ZH�VDZ�LQ�&KDSWHU����WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�KDV�WKH�IROORZLQJ�&�ODQJXDJH�SURWRW\SH���/5(68/7�&$//%$&.�:LQGRZ3URF����+:1'�+:1'����������KDQGOH�WR�ZLQGRZ���8,17�X0VJ����������PHVVDJH�LGHQWLILHU���:3$5$0�Z3DUDP������ILUVW�PHVVDJH�SDUDPHWHU���/3$5$0�O3DUDP������VHFRQG�PHVVDJH�SDUDPHWHU����:H�FDQ�WUDQVODWH�WKLV�LQWR�9%�DV�IROORZV��3XEOLF�)XQFWLRQ�:LQ3URF��B�

Page 62: Visual Basic - Subclassing and Hooking with VB & VB NET

�������%\9DO�KZQG�$V�/RQJ��B��������%\9DO�X0VJ�$V�/RQJ��B��������%\9DO�Z3DUDP�$V�/RQJ��B��������%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ��(QG�)XQFWLRQ�2I�FRXUVH��WKLV�IXQFWLRQ�KDV�QR�FRGH��VR�LW�LV�SUHWW\�PXFK�XVHOHVV�DW�WKLV�SRLQW��,Q�IDFW��LW�FDQ�EH�ZRUVH�WKDQ�XVHOHVV��DV�ZH�ZLOO�VHH�D�OLWWOH�ODWHU��WKLV�IXQFWLRQ�FDQ�FDXVH�VRPH�RU�DOO�RSHQ�DSSOLFDWLRQV�WR�VWRS�UHVSRQGLQJ�WR�LQSXW���1RZ�ZH�KDYH�D�QHZ�ZLQGRZ�SURFHGXUH��EXW�QR�ZD\�RI�XVLQJ�LW��7R�XVH�LW��ZH�QHHG�WR�SODFH�LW�EHIRUH�WKH�GHIDXOW�PHVVDJH�SURFHGXUH�LQ�WKH�PHVVDJH�VWUHDP��)RU�WKLV�SXUSRVH��ZH�FDQ�FDOO�WKH�6HW:LQGRZ/RQJ3WU�$3,�IXQFWLRQ��ZKLFK�PRGLILHV�D�SDUWLFXODU�DWWULEXWH�RI�D�VSHFLILF�ZLQGRZ���7KH�:LQ���DQG�:LQ���$3,V�DOVR�LQFOXGH�DQRWKHU�IXQFWLRQ��6HW:LQGRZ/RQJ��WKDW�\RX�FDQ�XVH�WR�LQVHUW�\RXU�QHZ�ZLQGRZ�SURFHGXUH��+RZHYHU��ZH�GR�QRW�UHFRPPHQG�LWV�XVH�EHFDXVH�LW�PDNHV�FRQYHUVLRQ�WR����ELW�:LQGRZV�GLIILFXOW��6HH�WKH�VLGHEDU�RQ����ELW�FRPSDWLELOLW\�ODWHU�LQ�WKLV�VHFWLRQ���7KH�9%�GHFODUDWLRQ�IRU�WKH�6HW:LQGRZ/RQJ3WU�$3,�IXQFWLRQ�LV���'HFODUH�)XQFWLRQ�6HW:LQGRZ/RQJ3WU�/LE��XVHU����$OLDV��6HW:LQGRZ/RQJ$��B�� � � �%\9DO�KZQG�$V�/RQJ��B�� � � %\9DO�Q,QGH[�$V�/RQJ��B�� � � %\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ�7KH�IXQFWLRQ�KDV�WKH�IROORZLQJ�SDUDPHWHUV��K:QG

7KH�KDQGOH�RI�WKH�ZLQGRZ�ZKRVH�DWWULEXWH�LV�WR�EH�PRGLILHG��,W�FDQ�EH�REWDLQHG�E\�UHWULHYLQJ�WKH�YDOXH�RI�D�IRUP�RU�FRQWUROV�K:QG�SURSHUW\���

Q,QGH[

$�/RQJ�LQGLFDWLQJ�WKH�ZLQGRZ�DWWULEXWH�WR�EH�PRGLILHG��$�QXPEHU�RI�YDOXHV�DUH�SRVVLEOH��WKRXJK�WKH�YDOXH�XVHG�WR�UHSODFH�D�ZLQGRZ�SURFHGXUH�LV�*:/3B:1'352&��RU������1RWH�WKDW�\RX�PXVW�XVH�WKH�&RQVW�VWDWHPHQW�WR�GHILQH�WKH�FRQVWDQW�\RXUVHOI�LI�\RX�FKRRVH�WR�XVH�LW����

GZ1HZ/RQJ

7KH�UHSODFHPHQW�YDOXH��)RU�D�VXEFODVVHG�ZLQGRZ��WKLV�SDUDPHWHU�UHSUHVHQWV�WKH�DGGUHVV�RI�WKH�QHZ�ZLQGRZ�SURFHGXUH��<RX�FDQ�JHW�WKH�DGGUHVV�RI�\RXU�QHZ�ZLQGRZ�SURFHGXUH�E\�SDVVLQJ�LWV�QDPH�DV�DQ�DUJXPHQW�WR�WKH�$GGUHVV2I�RSHUDWRU���

,I�WKH�FDOO�WR�6HW:LQGRZ/RQJ3WU�VXFFHHGV��WKH�IXQFWLRQ�UHWXUQV�WKH�RULJLQDO�YDOXH�EHIRUH�UHSODFHPHQW��LQ�WKLV�FDVH��WKH�RULJLQDO�DGGUHVV�RI�WKH�ZLQGRZ�SURFHGXUH���,I�LW�IDLOV��LW�UHWXUQV�]HUR���

���ELW�&RPSDWLELOLW\�

Page 63: Visual Basic - Subclassing and Hooking with VB & VB NET

7R�PDNH�\RXU�DSSOLFDWLRQV�SRUWDEOH�WR�WKH�XSFRPLQJ����ELW�:LQGRZV�RSHUDWLQJ�V\VWHP��\RX�PXVW�IROORZ�VRPH�VLPSOH�UXOHV��%HIRUH�FRQWLQXLQJ��\RX�PLJKW�ZDQW�WR�LQVWDOO�WKH�ODWHVW�3ODWIRUP�6RIWZDUH�'HYHORSPHQW�.LW�RU�6'.��WKHUH�LV�DOVR�D�QHZ�3ODWIRUP�'HYLFH�'ULYHU�.LW��RU�''.��IURP�WKH�0LFURVRIW�ZHE�VLWH�DW�KWWS���PVGQ�PLFURVRIW�FRP��7KLV�LV�D�UDWKHU�ODUJH�ILOH��EXW�\RX�FDQ�GRZQORDG�DQG�LQVWDOO�RQO\�WKH�SLHFHV�WKDW�DUH�RI�LQWHUHVW�WR�\RX��,I�\RX�DUH�JRLQJ�WR�SURJUDP�VROHO\�LQ�WKH�9%�HQYLURQPHQW��LW�LV�RSWLRQDO�IRU�\RX�WR�GRZQORDG�WKLV�LQIRUPDWLRQ��%H�IRUHZDUQHG��WKRXJK��WKDW�DQ\�GRFXPHQWV�FRQWDLQLQJ����ELW�:LQGRZV�WRSLFV�DUH�VXEMHFW�WR�FKDQJH���0LFURVRIW�LV�PDNLQJ�WKH�WUDQVLWLRQ�IURP����ELW�WR����ELW�DV�HDV\�DV�SRVVLEOH�IRU�WKH�GHYHORSHU��7KHRUHWLFDOO\��LI�\RX�IROORZ�WKHVH�VHYHQ�UXOHV��\RXU�FRGH�VKRXOG�FRPSLOH�DQG�UXQ�RQ�ERWK�SODWIRUPV��7KHVH�UXOHV�DUH�JHDUHG�WRZDUG�WKH�9LVXDO�&���GHYHORSHU��7KH�UXOHV�DUH�DV�IROORZV���

��� 3RLQWHUV�FDQQRW�EH�FDVW�WR�LQW��ORQJ��8/21*��RU�':25'�W\SHV������ ,I�D����ELW�SRLQWHU�LV�QHFHVVDU\��XVH�RQO\�WKH�3WU7R/RQJ�DQG�

3WU7R8ORQJ�IXQFWLRQV�LQ�WKH�%DVHWVG�K�KHDGHU�ILOH�WR�WUXQFDWH����ELW�SRLQWHUV�WR����ELW�SRLQWHUV��1RWH�WKDW�FRQYHUWLQJ�D����ELW�SRLQWHU�WR�D����ELW�SRLQWHU�LV�H[WUHPHO\�GDQJHURXV�EHFDXVH�WKH�XSSHU�KDOI�RI�WKH�SRLQWHUV�LQIRUPDWLRQ�LV�UHPRYHG���

��� 7DNH�FDUH�ZKHQ�FDVWLQJ�D�SRLQWHU�UHWXUQHG�IURP�DQ�$3,�IXQFWLRQ��&DVWLQJ�D�UHWXUQHG�SRLQWHU�FRXOG�FRUUXSW�LW���

��� 8VLQJ�WKH�':25'�GDWDW\SH�IRU�SRO\PRUSKLF�LQSXW�SDUDPHWHUV�WR�D�IXQFWLRQ�ZLOO�FDXVH�SUREOHPV��LQVWHDG��XVH�WKH�8,17B375�RU�392,'�GDWDW\SHV���

��� 5HSODFH�WKHVH�$3,�FDOOV������ ����������������*HW:LQGRZ/RQJ���� � ��������6HW:LQGRZ/RQJ���� �� � *HW&ODVV/RQJ�

�� � 6HW&ODVV/RQJ�

Page 64: Visual Basic - Subclassing and Hooking with VB & VB NET

ZLWK�WKHVH�$3,�FDOOV��

����������������*HW:LQGRZ/RQJ3WU��� � 6HW:LQGRZ/RQJ3WU��� � *HW&ODVV/RQJ3WU��� � 6HW&ODVV/RQJ3WU�

��� :KHQ�DFFHVVLQJ�WKH�H[WUD�E\WHV�RI�D�FODVV�RU�ZLQGRZ��XVH�WKH�),(/'B2))6(7�PDFUR�WR�JHW�WKH�RIIVHW�YDOXH�IRU�WKH�GDWD�\RX�QHHG��7KH�FE&OV([WUD�DQG�FE:QG([WUD�PHPEHUV�RI�WKH�:1'&/$66(;�VWUXFWXUH�DOORFDWH�PHPRU\�IRU�WKHVH�H[WUD�E\WHV���

����/3$5$0��:3$5$0��DQG�/5(68/7�DUH�DOO����ELWV�ZLGH��'R�QRW�XVH�':25'��8/21*��8,17��,17��LQW��RU�ORQJ�GDWDW\SHV�ZLWK�WKHVH�W\SHV�EHFDXVH�WKH\�PLJKW�WUXQFDWH�WKHP���

7KH�PRVW�REYLRXV�FKDQJH�EHWZHHQ����ELW�DQG����ELW�V\VWHPV�LV�WKH�GDWDW\SHV��$����ELW�SRLQWHU�LV����ELWV�ZLGH��D����ELW�SRLQWHU�LV����ELWV�ZLGH��7KLV�DOORZV�IRU�D�JUHDW�GHDO�PRUH�PHPRU\�WR�EH�DFFHVVHG�E\�D�VLQJOH�SURFHVV�������WHUDE\WHV��WR�EH�H[DFW���7KH�QHZ�3ODWIRUP�6'.�DOVR�FRQWDLQV�D�V\QWD[�FKHFNHU�ZKLFK�ZRUNV�ZLWK�WKH�9LVXDO�&���FRPSLOHU�WR�GHWHFW�SUREOHPV�LQ�\RXU�FRGH�WKDW�ZLOO�PDNH�LW�GLIILFXOW�WR�SRUW�IURP����ELW�FRGH�WR����ELW�FRGH���$V�IRU�9%�GHYHORSHUV��ZH�FXUUHQWO\�QHHG�WR�PDNH�RQO\�RQH�FKDQJH�WR�RXU�FRGH�WR�DOORZ�XV�WR�UXQ�RXU�DSSOLFDWLRQV�RQ����ELW�DV�ZHOO�DV����ELW�:LQGRZV�RSHUDWLQJ�V\VWHPV��7KH�FKDQJHG�FRGH�LV�VKRZQ�KHUH����,I�:LQ���7KHQ�����3ULYDWH�'HFODUH�)XQFWLRQ�6HW:LQGRZ/RQJ3WU�/LE��XVHU����B�����������$OLDV��6HW:LQGRZ/RQJ$��B��� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Q,QGH[�$V�/RQJ��B��������%\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ�����3ULYDWH�'HFODUH�)XQFWLRQ�6HW&ODVV/RQJ3WU�/LE��XVHU����B�����������$OLDV��6HW&ODVV/RQJ$��B��B��� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Q,QGH[�$V�/RQJ��B��������%\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ�����3ULYDWH�&RQVW�*:/B+,167$1&(� ������

Page 65: Visual Basic - Subclassing and Hooking with VB & VB NET

����3ULYDWH�&RQVW�*:/B:1'352&� ����������3ULYDWH�&RQVW�*:/B86(5'$7$� �����������3ULYDWH�&RQVW�*:/B+:1'3$5(17� ����������3ULYDWH�&RQVW�*&/B0(181$0(� ����������3ULYDWH�&RQVW�*&/B+%5%$&.*5281'� �����������3ULYDWH�&RQVW�*&/B+&85625� �����������3ULYDWH�&RQVW�*&/B+,&2160� �����������3ULYDWH�&RQVW�*&/B+02'8/(� �����������3ULYDWH�&RQVW�*&/B:1'352&� �����������3ULYDWH�&RQVW�':/B06*5(68/7� �������3ULYDWH�&RQVW�':/B'/*352&� �������3ULYDWH�&RQVW�':/B86(5� ����(OVH,I�1RW�:LQ���$QG�1RW�:LQ���7KHQ�����3ULYDWH�'HFODUH�)XQFWLRQ�6HW:LQGRZ/RQJ3WU�/LE��XVHU����B��B������������$OLDV��6HW:LQGRZ/RQJ3WU$��B��B��� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Q,QGH[�$V�/RQJ��B���������%\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ�����3ULYDWH�'HFODUH�)XQFWLRQ�6HW&ODVV/RQJ3WU�/LE��XVHU����B�����������$OLDV��6HW&ODVV/RQJ$3WU$��B��B��� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Q,QGH[�$V�/RQJ��B��������%\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ�����3ULYDWH�&RQVW�*:/3B+,167$1&(� ����������3ULYDWH�&RQVW�*:/3B:1'352&� ����������3ULYDWH�&RQVW�*:/3B86(5'$7$� ������� ������3ULYDWH�&RQVW�*:/3B+:1'3$5(17� ����������3ULYDWH�&RQVW�*:/3B,'� �����������3ULYDWH�&RQVW�*&/3B0(181$0(� ����������3ULYDWH�&RQVW�*&/3B+%5%$&.*5281'� �����������3ULYDWH�&RQVW�*&/3B+&85625� �����������3ULYDWH�&RQVW�*&/3B+,&2160� �����������3ULYDWH�&RQVW�*&/3B+02'8/(� ����������3ULYDWH�&RQVW�*&/3B:1'352&� �����������3ULYDWH�&RQVW�':/3B06*5(68/7� �������3ULYDWH�&RQVW�':/3B'/*352&� �������3ULYDWH�&RQVW�':/3B86(5� ����6HW:LQGRZ/RQJ3WU�DQG�6HW&ODVV/RQJ3WU�DUH�ERWK�GHILQHG�WR�EH�LQ�8VHU���'//�UHJDUGOHVV�RI�WKH�SODWIRUP��7KH�RQO\�GLIIHUHQFH�LQ�WKH����ELW�DQG����ELW�9%�$3,�GHFODUDWLRQV�LV�WKH�DOLDV��ZKLFK�SRLQWV�WR�WKH�H[SRUWHG�IXQFWLRQ�QDPH�LQ�8VHU���'//��7KLV�FRGH�ZLOO�DOORZ�\RXU�

Page 66: Visual Basic - Subclassing and Hooking with VB & VB NET

DSSOLFDWLRQV�WR�SRUW�HDVLO\�WR�WKH����ELW�:LQGRZV�RSHUDWLQJ�V\VWHP��1RWH�WKDW�WKH�0LFURVRIW�GRFXPHQWDWLRQ�IRU�:LQ���LV�VXEMHFW�WR�FKDQJH��WKHUHIRUH��WKH�FRGH�SUHVHQWHG�KHUH�DOVR�LV�VXEMHFW�WR�FKDQJH��7KH�ZD\�WKLV�IXQFWLRQ�LV�XVHG�WR�VXEFODVV�D�ZLQGRZ�LV�VKRZQ�EHORZ��3ULYDWH�O2ULJ:LQ3URF�DV�/RQJ��6XE�)RUP�B/RDG������ O2ULJ:LQ3URF� �6HW:LQGRZ/RQJ3WU�)RUP��KZQG��B�� � � *:/3B:1'352&��$GGUHVV2I�:LQ3URF��(QG�6XE�7KLV�FRGH�VXEFODVVHV�WKH�)RUP��ZLQGRZ�LQ�D�9%�DSSOLFDWLRQ��7KH�ILUVW�DUJXPHQW�WR�6HW:LQGRZ/RQJ3WU�LV�WKH�KDQGOH�WR�WKH�ZLQGRZ�WR�EH�VXEFODVVHG��7KH�VHFRQG�DUJXPHQW�LV�WKH�*:/3B:1'352&�FRQVWDQW��ZKLFK�WHOOV�6HW:LQGRZ/RQJ3WU�WKDW�ZH�DUH�JRLQJ�WR�UHSODFH�WKH�SRLQWHU�WR�WKH�ZLQGRZ�SURFHGXUH�RI�WKH�)RUP��ZLQGRZ��7KH�YDOXH�RI�*:/3B:1'352&�LV�����7KH�WKLUG�DUJXPHQW�LV�WKH�SRLQWHU�WR�RXU�QHZ�ZLQGRZ�SURFHGXUH��7KLV�ODVW�DUJXPHQW�XVHV�WKH�$GGUHVV2I�RSHUDWRU��LQWURGXFHG�LQ�9%����WR�SURYLGH�D�SRLQWHU�WR�RXU�QHZ�ZLQGRZ�SURFHGXUH�IXQFWLRQ���7KH�$GGUHVV2I�RSHUDWRU�LV�ZKDW�9%�GHYHORSHUV�ZHUH�ZDLWLQJ�IRU�WR�XVH�IXQFWLRQ�FDOOEDFNV�DQG�VXEFODVVLQJ�LQ�WKHLU�DSSOLFDWLRQV�ZLWKRXW�UHO\LQJ�RQ�WKLUG�SDUW\�SURGXFWV��:H�ZLOO�GLVFXVV�LW�LQ�JUHDWHU�GHSWK�LQ�&KDSWHU�����$IWHU�WKH�6HW:LQGRZ/RQJ3WU�IXQFWLRQ�KDV�VXFFHHGHG��LW�UHWXUQV�WKH�ZLQGRZV�RULJLQDO�ZLQGRZ�SURFHGXUH�SRLQWHU��'R�QRW�FKDQJH�RU�GLVFDUG�WKH�YDOXH�RI�WKLV�SRLQWHU��RU�HOVH�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�ZLOO�EH�ORVW��:H�QHHG�WR�NHHS�WKLV�VDIHO\�WXFNHG�DZD\�LQ�WKH�O2ULJ:LQ3URF�YDULDEOH�IRU�XVH�ODWHU���2.��VR�QRZ�ZH�KDYH�RXU�RZQ�ZLQGRZ�SURFHGXUH�LQ�SODFH��7KLV�PHDQV�WKDW�WKH�OSIQ:QG3URF�IXQFWLRQ�SRLQWHU�LV�FXUUHQWO\�SRLQWLQJ�WR�RXU�QHZ�ZLQGRZ�SURFHGXUH�IXQFWLRQ�FDOOHG�:LQ3URF��DQG�WKDW�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�ZLOO�QRW�EH�XVHG��+RZHYHU��WKLV�LV�KLJKO\�XQGHVLUDEOH��WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�FRQWDLQV�WKH�PLQLPDO�DPRXQW�RI�FRGH�UHTXLUHG�WR�XVH�D�ZLQGRZ��)RU�LQVWDQFH��WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�FRQWDLQV�WKH�FRGH�WR�SDLQW�WKH�ZLQGRZ�RQ�WKH�VFUHHQ�ZKHQ�LW�UHFHLYHV�D�:0B3$,17�PHVVDJH��:H�QHHG�WR�PDNH�VXUH�WKDW�WKLV�SDLQWLQJ�IXQFWLRQDOLW\�ZRUNV��RU�HOVH�WKH�ZLQGRZ�ZLOO�VWRS�SDLQWLQJ�LWVHOI��:H�FRXOG�KDQGOH�WKLV�E\�DGGLQJ�DOO�WKH�QHFHVVDU\�FRGH�WR�RXU�RZQ�ZLQGRZ�SURFHGXUH��WKRXJK�WKLV�LV�DQ�XQQHFHVVDU\�GXSOLFDWLRQ�RI�FRGH��,QVWHDG��LWV�PXFK�HDVLHU�DQG�PRUH�HIILFLHQW�WR�VLPSO\�VHQG�WKH�:0B3$,17�PHVVDJH�RQ�WR�WKH�GHIDXOW�PHVVDJH�SURFHGXUH���,Q�RWKHU�ZRUGV��WR�JHW�WKH�PLQLPDO�IXQFWLRQDOLW\�RXW�RI�RXU�QHZ�ZLQGRZ�SURFHGXUH��ZH�QHHG�WR�SDVV�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�WKH�PHVVDJH�WKDW�:LQ3URF��RXU�FXVWRP�PHVVDJH�KDQGOHU��UHFHLYHV��7KLV�JXDUDQWHHV�XV�WKDW�WKH�GHIDXOW�IXQFWLRQDOLW\�RI�RXU�)RUP��ZLQGRZ�ZLOO�VWLOO�EH�LQ�SODFH�ZKHQ�ZH�XVH�LW��:H�FDQ�GR�WKLV�E\�FDOOLQJ�WKH�&DOO:LQGRZ3URF�$3,�IXQFWLRQ��ZKLFK�LV�GHFODUHG�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�&DOO:LQGRZ3URF�/LE��XVHU����B�� � $OLDV��&DOO:LQGRZ3URF$��B�

Page 67: Visual Basic - Subclassing and Hooking with VB & VB NET

� � �%\9DO�O3UHY:QG)XQF�$V�/RQJ��B�� � %\9DO�K:QG�$V�/RQJ��B�� � %\9DO�0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��B�� � %\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�&DOO:LQGRZ3URF�KDV�WKH�IROORZLQJ�SDUDPHWHUV��O3UHY:QG)XQF

$�SRLQWHU�WR�WKH�ZLQGRZ�SURFHGXUH�WR�EH�FDOOHG��,Q�WKH�FDVH�RI�RXU�H[DPSOH��WKLV�LV�D�SRLQWHU�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�WKDW�ZH�VDYHG�LQ�WKH�O2ULJ:LQ3URF�YDULDEOH�ZKHQ�LQVHUWLQJ�WKH�QHZ�ZLQGRZ�SURFHGXUH�LQWR�WKH�PHVVDJH�VWUHDP���

K:QG, 0VJ, Z3DUDP, and O3DUDP

7KHVH�SDUDPHWHUV�PDWFK�SHUIHFWO\��LQ�QXPEHU�DQG�LQ�W\SH��WR�WKH�SDUDPHWHUV�LQ�WKH�:LQ3URF�IXQFWLRQ��7KH\�VLPSO\�DOORZ�WKH�PHVVDJH�LQIRUPDWLRQ�WR�EH�SDVVHG�RQ�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH���

7KLV�IXQFWLRQV�UHWXUQ�YDOXH�GHSHQGV�RQ�WKH�W\SH�RI�PHVVDJH��LGHQWLILHG�E\�WKH�0VJ�DUJXPHQW��SURFHVVHG���$IWHU�LQVHUWLQJ�WKLV�IXQFWLRQ�LQWR�RXU�:LQ3URF�IXQFWLRQ��:QG3URF�ORRNV�OLNH�WKLV���3XEOLF�)XQFWLRQ�:LQ3URF��%\9DO�KZQG�$V�/RQJ��B�� � � � %\9DO�X0VJ�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��B�� � � � %\9DO�O3DUDP�$V�/RQJ��$V�/RQJ��� 6HOHFW�&DVH�VWUXFWXUH�WR�KDQGOH�PHVVDJHV�JRHV�KHUH���� :LQ3URF� �&DOO:LQ3URF�O2ULJ:LQ3URF��KZQG��X0VJ��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�:LWK�RXU�FXVWRP�ZLQGRZ�SURFHGXUH�LQ�SODFH��ZH�FDQ�GR�VRPH�UHDOO\�SRZHUIXO�WKLQJV��(YHU\�PHVVDJH�GLUHFWHG�WR�WKLV�ZLQGRZ�SDVVHV�WKURXJK�WKLV�IXQFWLRQ��$�6HOHFW�&DVH�VWDWHPHQW�FDQ�EH�VHW�XS�WR�WUDS�IRU�FHUWDLQ�PHVVDJHV��VXFK�DV�WKH�:0B0286(029(�PHVVDJH��RU�ZH�FDQ�MXVW�PRQLWRU�DOO�PHVVDJHV�FRPLQJ�LQWR�WKLV�ZLQGRZ��:DWFKLQJ�DQG�HYHQ�PDQLSXODWLQJ�WKH�PHVVDJHV�WKDW�DUH�SDVVHG�WR�WKLV�IXQFWLRQ�DOORZ�XV�PRUH�IOH[LELOLW\�WR�GHYHORS�SRZHUIXO�DQG�IHDWXUH�ULFK�DSSOLFDWLRQV�WKDQ�E\�MXVW�XVLQJ�WKH�HYHQWV�WKDW�9%�PDNHV�DYDLODEOH�WR�XV���0HVVDJHV�FDQ�EH�KDQGOHG�LQ�RQH�RI�WKUHH�GLIIHUHQW�ZD\V���

• 7KH�PHVVDJH�FDQ�EH�LJQRUHG�DQG�SDVVHG�WKURXJK�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH��DV�LQ�WKH�FRGH�VDPSOH�DERYH���

• 7KH�PHVVDJH�FDQ�EH�GLVFDUGHG�VR�WKDW�LW�LV�QRW�SDVVHG�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�DW�DOO��%H�YHU\�FDUHIXO��WKRXJK��WKDW�LQ�VWRSSLQJ�WKH�PHVVDJH�IURP�EHLQJ�SDVVHG�RQ�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�\RX�GR�QRW�VWRS�\RXU�DSSOLFDWLRQ�IURP�IXQFWLRQLQJ�FRUUHFWO\���

Page 68: Visual Basic - Subclassing and Hooking with VB & VB NET

• 7KH�PHVVDJH�FDQ�EH�PRGLILHG�DQG�SDVVHG�RQ�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH��1RW�DOO�PHVVDJHV�VKRXOG�EH�PRGLILHG���

3UHVXPDEO\��LW�LV�DOVR�SRVVLEOH�WR�PRGLI\�WKH�PHVVDJH�DQG�QRW�SDVV�LW�RQ�WR�WKH�GHIDXOW�PHVVDJH�SURFHGXUH��EXW�WKDW�ZRXOG�DFFRPSOLVK�QRWKLQJ���$�PHVVDJH�DOVR�FDQ�EH�SDVVHG�RQ�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�DW�GLIIHUHQW�WLPHV�ZLWKLQ�RXU�:LQ3URF�IXQFWLRQ���

• ,I�ZH�SODFH�WKH�FDOO�WR�WKH�&DOO:LQ3URF�$3,�IXQFWLRQ�DIWHU�RXU�PHVVDJH�KDQGOLQJ�FRGH��ZH�FDQ�DIIHFW�WKH�PHVVDJH�EHIRUH�LW�UHDFKHV�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH��7KLV�LV�VKRZQ�LQ�WKH�SUHYLRXV�FRGH�H[DPSOH���

• ,I�ZH�SODFH�WKH�FDOO�WR�WKH�&DOO:LQ3URF�$3,�IXQFWLRQ�EHIRUH�RXU�PHVVDJH�KDQGOLQJ�FRGH��WKH�GHIDXOW�IXQFWLRQDOLW\�IRU�WKH�PHVVDJH�UHPDLQV�LQWDFW��7KH�FRGH�ZRXOG�WKHQ�ORRN�OLNH�WKLV���

• 3XEOLF�)XQFWLRQ�:LQ3URF��%\9DO�KZQG�$V�/RQJ��B�• �������������������������%\9DO�X0VJ�$V�/RQJ��B�• �������������������������%\9DO�Z3DUDP�$V�/RQJ��B�• �������������������������%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�• �• ����:LQ3URF� �&DOO:LQ3URF�O2ULJ:LQ3URF��KZQG��X0VJ��Z3DUDP��O3DUDP��• �• ����6HOHFW�&DVH�VWUXFWXUH�WR�KDQGOH�PHVVDJHV�JRHV�KHUH��

(QG�)XQFWLRQ�

$IWHU�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�UHWXUQV�FRQWURO�WR�RXU�:LQ3URF�IXQFWLRQ��ZH�FDQ�H[DPLQH�WKH�PHVVDJH�DV�ZHOO�DV�WKH�VWDWH�RI�WKH�ZLQGRZ�WR�GHWHUPLQH�LI�DQ\WKLQJ�PRUH�QHHGV�WR�EH�GRQH���

7KH�ODVW�SDUW�RI�VXEFODVVLQJ�LQYROYHV�UHPRYLQJ�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�IURP�WKH�PHVVDJH�VWUHDP��7KLV�PXVW�RFFXU�SULRU�WR�XQORDGLQJ�WKH�ZLQGRZ�IURP�PHPRU\�RU�HQGLQJ�WKH�DSSOLFDWLRQ��,Q�UHPRYLQJ�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�IURP�WKH�PHVVDJH�VWUHDP��WKH�SRLQWHU�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��UHSUHVHQWHG�LQ�RXU�H[DPSOH�E\�O2ULJ:LQ3URF��PXVW�EH�UHVWRUHG��2WKHUZLVH��WKH�QH[W�WLPH�D�PHVVDJH�LV�GLUHFWHG�WRZDUG�WKDW�ZLQGRZ�DQG�WKH�ZLQGRZ�SURFHGXUH�LV�FDOOHG��OSIQ:QG3URF�ZLOO�SRLQW�WR�DQ�LQYDOLG�PHPRU\�ORFDWLRQ��DQG�ZH�DOO�NQRZ�ZKDW�WKDW�PHDQV��*3)��7R�UHPRYH�WKH�QHZ�ZLQGRZ�SURFHGXUH�WKDW�ZH�FUHDWHG��VLPSO\�XVH�WKH�6HW:LQGRZ/RQJ3WU�$3,�IXQFWLRQ�VLPLODUO\�WR�WKH�ZD\�\RX�XVHG�LW�WR�VXEFODVV�WKH�ZLQGRZ�EXW�ZLWK�D�VOLJKW�FKDQJH��,QVWHDG�RI�WKH�ODVW�DUJXPHQW�EHLQJ�$GGUHVV2I�:LQ3URF��DV�LW�ZDV�LQ�WKH�)RUP�B/RDG�HYHQW��\RX�QHHG�WR�VXSSO\�WKH�O2ULJ:LQ3URF�YDULDEOH�DV�DQ�DUJXPHQW��7KH�FRGH�LV�VKRZQ�EHORZ���

Page 69: Visual Basic - Subclassing and Hooking with VB & VB NET

6XE�)RUP�B8QORDG������ 'LP�O5HWXUQ9DOXH�DV�/RQJ��� /5HWXUQ9DOXH� �6HW:LQGRZ/RQJ3WU�)RUP��KZQG��*:/3B:1'352&��O2ULJ:LQ3URF��(QG�6XE�$IWHU�WKH�RULJLQDO�YDOXH�WKDW�ZDV�LQ�WKH�OSIQ:QG3URF�HOHPHQW�RI�WKH�ZLQGRZ�FODVV�LV�UHVWRUHG��WKH�ZLQGRZ�FDQ�EH�FORVHG�GRZQ�VDIHO\���7KDW�LV�KRZ�VXEFODVVLQJ�ZRUNV��7KHUH�LV�QRW�PXFK�FRGH�LQYROYHG�KHUH��PRVW�RI�WKH�FRGLQJ�ZLOO�GHDO�ZLWK�VSHFLILF�PHVVDJHV�WKDW�WKH�:LQ3URF�IXQFWLRQ�LV�ZDWFKLQJ�IRU��&KDSWHU���ZLOO�GHDO�ZLWK�WKH�FRGH�LQYROYHG�LQ�VXEFODVVLQJ�D�ZLQGRZ�LQ�PRUH�GHWDLO���

������7KH�7\SHV�RI�6XEFODVVLQJ�

2XU�GLVFXVVLRQ�RI�VXEFODVVLQJ�LQ�WKH�ODVW�VHFWLRQ�LOOXVWUDWHG�MXVW�RQH�W\SH�RI�VXEFODVVLQJ��+RZHYHU��\RX�FDQ�FKRRVH�IURP�WZR�GLIIHUHQW�W\SHV�RI�VXEFODVVLQJ��ZKLFK�ZHOO�H[DPLQH�LQ�WKLV�VHFWLRQ���

��������,QVWDQFH�VXEFODVVLQJ�

:KHQ�ZH�FDOO�WKH�6HW:LQGRZ/RQJ3WU�IXQFWLRQ��DV�ZH�GLG�LQ�WKH�SUHYLRXV�VHFWLRQ��ZH�VXEFODVV�D�VSHFLILF�ZLQGRZ�GHQRWHG�E\�WKH�ZLQGRZ�KDQGOH�SDVVHG�WR�WKH�KZQG�SDUDPHWHU�RI�6HW:LQGRZ/RQJ3WU��7KH�ZLQGRZ�KDV�DOUHDG\�EHHQ�FUHDWHG�ZKHQ�ZH�LQVHUW�WKH�QHZ�ZLQGRZ�SURFHGXUH�LQWR�WKH�FODVV�VWUXFWXUH��7KHUHIRUH��ZH�DUH�RQO\�PRGLI\LQJ�D�FRS\�RI�WKH�ZLQGRZ�FODVV�LQIRUPDWLRQ�DVVRFLDWHG�ZLWK�WKLV�SDUWLFXODU�ZLQGRZ��7KLV�LV�FDOOHG�LQVWDQFH�VXEFODVVLQJ��2QO\�RQH�LQVWDQFH�RI�WKH�ZLQGRZ�KDV�EHHQ�VXEFODVVHG���)RU�H[DPSOH��XVLQJ�6HW:LQGRZ/RQJ3WU��ZH�FDQ�VXEFODVV�)RUP���DV�ZH�GLG�LQ�WKH�SUHYLRXV�FRGH�VDPSOHV��,I�WKLV�VDPH�SURMHFW�KDG�D�VHFRQG�IRUP�QDPHG�)RUP���WKDW�IRUP�ZRXOG�FRQWLQXH�WR�UHO\�H[FOXVLYHO\�RQ�LWV�RULJLQDO�ZLQGRZ�SURFHGXUH�IRU�PHVVDJH�SURFHVVLQJ��,W�LV�QRW�DIIHFWHG�E\�WKH�FDOO�WR�6HW:LQGRZ/RQJ3WU�WKDW�UHSODFHG�)RUP�V�ZLQGRZ�SURFHGXUH��7R�VXEFODVV�)RUP��FRUUHFWO\��VRPH�FKDQJHV�ZLOO�KDYH�WR�EH�PDGH�WR�WKH�RULJLQDO�FRGH��7KH�QHZ�FRGH�WR�VXEFODVV�ERWK�IRUPV�ZRXOG�ORRN�OLNH�WKLV���6XE�)RUP�B/RDG������ O2ULJ:LQ3URF� �6HW:LQGRZ/RQJ3WU�)RUP��KZQG��B�� � � *:/3B:1'352&��$GGUHVV2I�:LQ3URF���� O2ULJ:LQ3URF�� �6HW:LQGRZ/RQJ3WU�)RUP��KZQG��B�� � � *:/3B:1'352&��$GGUHVV2I�:LQ3URF��(QG�6XE�

Page 70: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�QHZ�FRGH�PDNHV�WZR�VHSDUDWH�FDOOV�WR�6HW:LQGRZ/RQJ3WU�IRU�HDFK�ZLQGRZ�WKDW�LV�WR�EH�VXEFODVVHG��1RWLFH�DOVR�WKDW�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�LV�VDYHG�LQWR�WZR�VHSDUDWH�YDULDEOHV��O2ULJ:LQ3URF�DQG�O2ULJ:LQ3URF���VR�WKDW�HDFK�LV�QRW�ORVW���,W�LV�SRVVLEOH�IRU�WKH�VDPH�VXEFODVVHG�ZLQGRZ�SURFHGXUH��:LQ3URF��WR�EH�XVHG�IRU�ERWK�IRUPV��RU�D�VHFRQG�VXEFODVVHG�ZLQGRZ�SURFHGXUH�FRXOG�EH�FUHDWHG�IRU�)RUP���7KLV�GHFLVLRQ�ZLOO�GHSHQG�RQ�ZKHWKHU�)RUP�V�IXQFWLRQDOLW\�ZLOO�EH�WKH�VDPH�DV�)RUP�V��,I�WKH�:LQ3URF�IXQFWLRQ�LV�XVHG�IRU�ERWK�IRUPV��LW�ZLOO�EH�PRGLILHG�WR�ORRN�OLNH�WKLV���3XEOLF�)XQFWLRQ�:LQ3URF��%\9DO�KZQG�$V�/RQJ��B�� � � � %\9DO�X0VJ�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��B�� � � � %\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�� �� 6HOHFW�&DVH�VWUXFWXUH�WR�KDQGOH�PHVVDJHV�JRHV�KHUH���� ,I�KZQG� �)RUP��KZQG�WKHQ�� � :LQ3URF� �&DOO:LQ3URF�O2ULJ:LQ3URF��KZQG��B�� � � � � X0VJ��Z3DUDP��O3DUDP��� (OVH,I�KZQG� �)RUP��KZQG�WKHQ�� � :LQ3URF� �&DOO:LQ3URF�O2ULJ:LQ3URF���KZQG��B�� � � � � X0VJ��Z3DUDP��O3DUDP��� (QG�,I�(QG�)XQFWLRQ�7KLV�IXQFWLRQ�XVHV�WKH�KZQG�DUJXPHQW�SDVVHG�LQ�WR�WKH�:LQ3URF�IXQFWLRQ�WR�GHWHUPLQH�ZKLFK�RULJLQDO�ZLQGRZ�SURFHGXUH�VKRXOG�EH�FDOOHG���,I�D�QHZ�VXEFODVV�ZLQGRZ�SURFHGXUH�LV�FUHDWHG�IRU�)RUP���LW�ZLOO�ORRN�OLNH�WKLV���3XEOLF�)XQFWLRQ�:LQ3URF���%\9DO�KZQG�$V�/RQJ��B�� � � � %\9DO�X0VJ�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��B�� � � � %\9DO�O3DUDP�$V�/RQJ��$V�/RQJ��� 6HOHFW�&DVH�VWUXFWXUH�WR�KDQGOH�PHVVDJHV�JRHV�KHUH��� �� :LQ3URF�� �&DOO:LQ3URF�O2ULJ:LQ3URF���KZQG��B�� � � � X0VJ��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�1RWH�WKDW�ZH�QHHG�WR�SDVV�$GGUHVV2I�:LQ3URF��LQVWHDG�RI�$GGUHVV2I�:LQ3URF�WR�WKH�6HW:LQGRZ/RQJ3WU�IXQFWLRQ�XVHG�WR�VXEFODVV�)RUP����7KH�FRGH�WR�UHPRYH�WKH�VXEFODVVLQJ�RQ�ERWK�ZLQGRZV�LV�DV�IROORZV���6XE�)RUP�B8QORDG������ 'LP�O5HWXUQ9DOXH�DV�/RQJ�

Page 71: Visual Basic - Subclassing and Hooking with VB & VB NET

�� O5HWXUQ9DOXH� �6HW:LQGRZ/RQJ3WU�)RUP��KZQG��*:/3B:1'352&��O2ULJ:LQ3URF���� O5HWXUQ9DOXH� �6HW:LQGRZ/RQJ3WU�)RUP��KZQG��*:/3B:1'352&��O2ULJ:LQ3URF���(QG�6XE�

��������*OREDO�VXEFODVVLQJ�

,QVWHDG�RI�VXSSO\LQJ�D�QHZ�ZLQGRZ�SURFHGXUH�RQ�D�ZLQGRZ�E\�ZLQGRZ�EDVLV��\RX�FDQ�VLPSO\�PRGLI\�WKH�ZLQGRZ�SURFHGXUH�RI�D�ZLQGRZ�FODVV�GLUHFWO\��WKLV�WHFKQLTXH�LV�FDOOHG�JOREDO�VXEFODVVLQJ��,W�GLIIHUV�IURP�LQVWDQFH�VXEFODVVLQJ�LQ�WKDW�WKH�DFWXDO�ZLQGRZ�FODVV����DQG�QRW�WKH�FRS\�RI�WKH�FODVV�LQIRUPDWLRQ�D�ZLQGRZ�JHWV�ZKHQ�LW�LV�ILUVW�FUHDWHG����LV�EHLQJ�PRGLILHG�GLUHFWO\��7KLV�PHDQV�WKDW�DQ\�ZLQGRZ�FUHDWHG�ZLWK�WKLV�PRGLILHG�FODVV�ZLOO�DXWRPDWLFDOO\�XVH�WKH�ZLQGRZ�SURFHGXUH�ZKRVH�SRLQWHU�\RX�SURYLGHG�WR�WKLV�FODVV��+RZHYHU��DQ\�ZLQGRZV�WKDW�ZHUH�FUHDWHG�IURP�WKLV�FODVV�EHIRUH�LW�ZDV�PRGLILHG�ZLOO�XVH�WKH�RULJLQDO�FODVVV�ZLQGRZ�SURFHGXUH���7KLV�FRQILUPV��LQFLGHQWDOO\��WKDW�ZKHQ�DQ\�ZLQGRZ�LV�FUHDWHG�IURP�D�ZLQGRZ�FODVV��WKDW�FODVVV�LQIRUPDWLRQ�LV�HPEHGGHG�LQWR�WKH�QHZO\�FUHDWHG�ZLQGRZ�VWUXFWXUH��:KHQ�ZH�VXEFODVV�D�ZLQGRZ��ZH�PRGLI\�WKH�OSIQ:QG3URF�FODVV�HOHPHQW�HPEHGGHG�LQ�WKH�ZLQGRZ��:KHQ�ZH�JOREDOO\�VXEFODVV��ZH�PRGLI\�WKH�OSIQ:QG3URF�HOHPHQW�ZLWKLQ�WKH�FODVV�LWVHOI��1HZ�ZLQGRZV�FUHDWHG�IURP�WKLV�FODVV�ZLOO�WKHQ�LQKHULW�WKH�FKDQJHV�WR�WKH�FODVV��)LJXUH�����LOOXVWUDWHV�JOREDO�VXEFODVVLQJ���

)LJXUH������*OREDO�VXEFODVVLQJ�

Page 72: Visual Basic - Subclassing and Hooking with VB & VB NET

7R�JOREDOO\�VXEFODVV�D�ZLQGRZ��\RX�FDOO�WKH�6HW&ODVV/RQJ3WU�IXQFWLRQ��7KH�9%�GHFODUDWLRQ�RI�WKLV�IXQFWLRQ�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�6HW&ODVV/RQJ3WU�/LE��XVHU����$OLDV��6HW&ODVV/RQJ$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Q,QGH[�$V�/RQJ��B�� � %\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ�7KH�6HW&ODVV/RQJ3WU�IXQFWLRQ�KDV�WKH�IROORZLQJ�SDUDPHWHUV���KZQG

7KH�KDQGOH�WR�D�ZLQGRZ�WKDW�ZDV�FUHDWHG�XVLQJ�WKH�FODVV�ZH�ZDQW�WR�PRGLI\��,W�FDQ�EH�REWDLQHG�E\�UHWULHYLQJ�WKH�YDOXH�RI�D�IRUP�RU�FRQWUROV�K:QG�SURSHUW\���

Q,QGH[

$�/RQJ�LQGLFDWLQJ�WKH�ZLQGRZ�DWWULEXWH�WR�EH�PRGLILHG��$�QXPEHU�RI�YDOXHV�DUH�SRVVLEOH��WKRXJK�WKH�YDOXH�XVHG�WR�WHOO�WKLV�IXQFWLRQ�WR�PRGLI\�WKH�ZLQGRZ�SURFHGXUH�LV�*&/3B:1'352&��RU�������1RWH�WKDW�\RX�PXVW�XVH�WKH�&RQVW�VWDWHPHQW�WR�GHILQH�WKH�FRQVWDQW�\RXUVHOI�LI�\RX�FKRRVH�WR�XVH�LW����

GZ1HZ/RQJ

Page 73: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�UHSODFHPHQW�YDOXH��)RU�D�VXEFODVVHG�ZLQGRZ��WKLV�SDUDPHWHU�UHSUHVHQWV�WKH�DGGUHVV�RI�WKH�QHZ�ZLQGRZ�SURFHGXUH��<RX�FDQ�JHW�WKH�DGGUHVV�RI�\RXU�QHZ�ZLQGRZ�SURFHGXUH�E\�SDVVLQJ�LWV�QDPH�DV�DQ�DUJXPHQW�WR�WKH�$GGUHVV2I�RSHUDWRU���

7KH�UHWXUQ�YDOXH�RI�WKLV�IXQFWLRQ�ZLOO�EH�WKH�RULJLQDO�YDOXH�LQ�WKH�FODVV�VWUXFWXUH�WKDW�ZDV�UHSODFHG�ZLWK�WKH�YDOXH�LQ�WKH�GZ1HZ/RQJ�DUJXPHQW��)RU�RXU�SXUSRVHV��WKLV�IXQFWLRQ�ZLOO�UHWXUQ�HLWKHU�D�]HUR�LI�DQ�HUURU�RFFXUUHG��RU�WKH�DGGUHVV�RI�WKH�RULJLQDO�FODVV�ZLQGRZ�SURFHGXUH�LI�LW�ZDV�VXFFHVVIXO���7KH�VWHSV�WR�SHUIRUP�JOREDO�VXEFODVVLQJ�FORVHO\�IROORZ�WKH�VWHSV�IRU�LQVWDQFH�VXEFODVVLQJ��7KLV�FRGH�ZLOO�LQLWLDWH�JOREDO�VXEFODVVLQJ���3ULYDWH�O2ULJ&OV3URF�DV�/RQJ��6XE�)RUP�B/RDG������ /RDG�IUP+LGGHQ��� O2ULJ&OV3URF� �6HW&ODVV/RQJ3WU�IUP+LGGHQ�KZQG��B�� � � *&/3B:1'352&��$GGUHVV2I�&OV3URF��(QG�6XE�7KH�ILUVW�OLQH�RI�WKLV�IXQFWLRQ�ZLOO�ORDG�D�KLGGHQ�IRUP�FDOOHG�IUP+LGGHQ�LQWR�PHPRU\��7KH�K:QG�RI�WKLV�IRUP�LV�XVHG�LQ�WKH�ILUVW�DUJXPHQW�WR�WKH�6HW&ODVV/RQJ3WU�IXQFWLRQ��7R�XVH�WKLV�IXQFWLRQ�WR�PRGLI\�D�FODVVV�VWUXFWXUH��ZH�QHHG�WR�JLYH�LW�D�KDQGOH�WR�D�ZLQGRZ�WKDW�ZDV�FUHDWHG�XVLQJ�WKLV�FODVV��7KH�IXQFWLRQ�XVHV�WKLV�KDQGOH�WR�JHW�LQGLUHFWO\�WR�WKH�FODVV�VWUXFWXUH�LQ�PHPRU\��7KLV�KDQGOH�DOVR�LV�XVHG�ZKHQ�UHPRYLQJ�WKH�JOREDO�VXEFODVV��7KHUHIRUH��WKLV�ZLQGRZ�LV�KLGGHQ�WR�SURWHFW�LW�IURP�EHLQJ�FORVHG�E\�WKH�XVHU��ZKLFK�ZRXOG�UHQGHU�WKH�K:QG�QHHGHG�IRU�JOREDO�VXEFODVVLQJ�LQYDOLG���7KH�ODVW�SDUDPHWHU�RI�WKH�6HW&ODVV/RQJ3WU�IXQFWLRQ�VHQGV�WKH�DGGUHVV�RI�WKH�&OV3URF�IXQFWLRQ�WKDW�ZH�GHILQH�LQ�RXU�9%�FRGH��7KLV�IXQFWLRQ�ZLOO�EDVLFDOO\�ORRN�OLNH�WKLV���3XEOLF�)XQFWLRQ�&OV3URF��%\9DO�KZQG�$V�/RQJ��B�� � � � %\9DO�X0VJ�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��B�� � � � %\9DO�O3DUDP�$V�/RQJ��$V�/RQJ��� 6HOHFW�&DVH�VWUXFWXUH�WR�KDQGOH�PHVVDJHV�JRHV�KHUH���� &OV3URF� �&DOO:LQ3URF�O2ULJ&OV3URF��KZQG��X0VJ��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�1RWKLQJ�LV�QHZ�KHUH��1RWLFH�WKDW�WKH�RULJLQDO�FODVV�ZLQGRZ�SURFHGXUH�PXVW�EH�FDOOHG�KHUH��DV�LW�LV�ZLWK�LQVWDQFH�VXEFODVVLQJ��7KLV�HQVXUHV�WKDW�WKH�GHIDXOW�SURFHVVLQJ�ZLOO�RFFXU�IRU�DQ\�PHVVDJHV�VHQW�WR�WKLV�IXQFWLRQ���7KH�PHVVDJHV�WKDW�SDVV�WKURXJK�WKLV�IXQFWLRQ�FDQ�EH�KDQGOHG�LQ�RQH�RI�WKUHH�GLIIHUHQW�ZD\V��VLPLODU�WR�LQVWDQFH�VXEFODVVLQJ���

Page 74: Visual Basic - Subclassing and Hooking with VB & VB NET

• 7KH�PHVVDJH�FDQ�EH�LJQRUHG�DQG�SDVVHG�RQ�WR�WKH�&DOO:LQ3URF�IXQFWLRQ���• 7KH�PHVVDJH�FDQ�EH�GLVFDUGHG�EHIRUH�FDOOLQJ�WKH�&DOO:LQ3URF�IXQFWLRQ���• 7KH�PHVVDJH�DUJXPHQWV�FDQ�EH�PRGLILHG�DQG�WKHQ�SDVVHG�RQ�WR�WKH�&DOO:LQ3URF�

IXQFWLRQ���

7KH�PHVVDJH�DOVR�FDQ�EH�SDVVHG�WR�WKH�&DOO:LQ3URF�IXQFWLRQ�DW�GLIIHUHQW�WLPHV���

• 7KH�PHVVDJH�FDQ�EH�SURFHVVHG�DQG�WKHQ�VHQW�WR�WKH�&DOO:LQ3URF�IXQFWLRQ���• 7KH�PHVVDJH�FDQ�EH�VHQW�WR�WKH�&DOO:LQ3URF�IXQFWLRQ�DQG�WKHQ�SURFHVVHG���

7KH�ILQDO�VWHS�WR�JOREDO�VXEFODVVLQJ�LV�WR�UHVWRUH�WKH�RULJLQDO�FODVV�ZLQGRZ�SURFHGXUH�WR�WKH�FODVV�ZLWK�D�FRGH�IUDJPHQW�VXFK�DV�WKH�IROORZLQJ���6XE�)RUP�B8QORDG������ 'LP�O5HWXUQ9DOXH�DV�/RQJ��� O5HWXUQ9DOXH� �6HW&ODVV/RQJ3WU�IUP+LGGHQ�KZQG��B�� � � � � *&/3B:1'352&��O2ULJ&OV3URF��(QG�6XE�7KLV�IXQFWLRQ�FDOOV�6HW&ODVV/RQJ3WU�XVLQJ�WKH�VDPH�ZLQGRZ�KDQGOH�WKDW�ZDV�XVHG�WR�LQLWLDWH�JOREDO�VXEFODVVLQJ��7KH�RQO\�GLIIHUHQFH�LV�WKDW�WKH�DGGUHVV�RI�WKH�RULJLQDO�FODVV�ZLQGRZ�SURFHGXUH�LV�EHLQJ�SDVVHG�LQWR�WKH�ODVW�DUJXPHQW�RI�WKLV�IXQFWLRQ��WKXV�UHVWRULQJ�WKH�FODVV�WR�LWV�RULJLQDO�VWDWH���*OREDO�VXEFODVVLQJ�EULQJV�ZLWK�LW�D�ZKROH�QHZ�VHW�RI�XVHV�DV�ZHOO�DV�SUREOHPV��&KDSWHU���ZLOO�GHDO�ZLWK�WKLV�VXEMHFW�PRUH�WKRURXJKO\���

��������6XSHUFODVVLQJ�

:H�FDQ�JR�RQH�VWHS�IXUWKHU�DQG�FUHDWH�RXU�RZQ�ZLQGRZ�FODVV�WKDW�LQKHULWV�IURP�DQ�H[LVWLQJ�ZLQGRZ�FODVV��7KLV�LV�FDOOHG�VXSHUFODVVLQJ��<RX�FUHDWH�WKLV�QHZ�ZLQGRZ�FODVV�E\�ILOOLQJ�LQ�D�QHZ�ZLQGRZ�FODVV�VWUXFWXUH�ZLWK�WKH�LQIRUPDWLRQ�REWDLQHG�IURP�DQ�H[LVWLQJ�FODVV��7KH�H[LVWLQJ�FODVV�PRVW�OLNHO\�LV�D�FODVV�WKDW�:LQGRZV�SURYLGHV���:KHQ�ILOOLQJ�WKH�QHZ�FODVV�VWUXFWXUH�ZLWK�WKH�H[LVWLQJ�FODVVV�LQIRUPDWLRQ��LW�LV�LPSHUDWLYH�WR�UHWULHYH�DQG�VDYH�WKH�RULJLQDO�FODVVV�OSIQ:QG3URF�IXQFWLRQ�SRLQWHU�EHFDXVH�LW�SURYLGHV�RXU�QHZ�FODVV�ZLWK�WKH�HVVHQWLDO�EDVH�IXQFWLRQDOLW\��7KH�RWKHU�FODVV�HOHPHQWV�FDQ�EH�ILOOHG�ZLWK�GDWD�QHHGHG�WR�GHILQH�WKH�QHZ�ZLQGRZ�FODVV��,Q�SDUWLFXODU��WKH�OSV]&ODVV1DPH�HOHPHQW�RI�WKH�QHZ�ZLQGRZ�FODVV�VWUXFWXUH�PXVW�FRQWDLQ�D�XQLTXH�VWULQJ�WKDW�ZLOO�GHILQH�WKLV�FODVV��)URP�WKLV�QHZO\�FUHDWHG�FODVV��ZH�LQ�WXUQ�XVH�WKH�WHFKQLTXH�RI�JOREDO�VXEFODVVLQJ�WR�FKDQJH�WKH�OSIQ:QG3URF�ZLQGRZ�SURFHGXUH�IXQFWLRQ�SRLQWHU�WR�SRLQW�WR�D�QHZ�ZLQGRZ�SURFHGXUH�WKDW�ZH�GHILQH��)LJXUH�����LOOXVWUDWHV�VXSHUFODVVLQJ���

)LJXUH������+RZ�VXSHUFODVVLQJ�ZRUNV��

Page 75: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�QHZ�FODVV����RU��DV�LW�LV�VRPHWLPHV�FDOOHG��WKH�VXSHUFODVV����VKRXOG�KDYH�D�XQLTXH�FODVV�QDPH��ZLWK�D�VLQJOH�H[FHSWLRQ��LW�LV�DOVR�SRVVLEOH�WR�QDPH�WKLV�VXSHUFODVV�ZLWK�RQH�RI�WKH�V\VWHP�ZLGH�FODVV�QDPHV�OLVWHG�KHUH���Button

7KH�EXWWRQ�FRQWURO�FODVV��ComboBox

7KH�FRPER�ER[�FRQWURO�FODVV��Edit

7KH�HGLW�FRQWURO�FODVV��ListBox

7KH�OLVW�ER[�FRQWURO�FODVV��MDIClient

7KH�0',�FOLHQW�ZLQGRZ�FODVV��ScrollBar

7KH�VFUROO�EDU�FRQWURO�FODVV��Static

7KH�VWDWLF�FRQWURO�FODVV��

Page 76: Visual Basic - Subclassing and Hooking with VB & VB NET

)RU�H[DPSOH��,�FRXOG�FUHDWH�D�VXSHUFODVV�ZLWK�WKH�QDPH�RI�%87721��ZKLFK�LV�DQ�H[LVWLQJ�V\VWHP�ZLGH�FODVV�QDPH��:KHQ�,�FUHDWH�D�ZLQGRZ�IURP�D�%87721�FODVV��WKH�V\VWHP�VHDUFKHV�WKH�SURFHVV�IRU�DQ\�ORFDO�FODVVHV�ZLWK�D�FODVV�QDPH�RI�%87721�EHIRUH�VHDUFKLQJ�IRU�DQ\�V\VWHP�ZLGH�FODVVHV�ZLWK�WKLV�QDPH��7KH�RUGHU�LQ�ZKLFK�:LQGRZV�ZLOO�VHDUFK�IRU�FODVVHV�LV���

��� $Q\�DSSOLFDWLRQ�ORFDO�FODVVHV�ZLWK�WKH�VDPH�FODVV�QDPH�ZLWKLQ�WKH�SURFHVV����� $Q\�DSSOLFDWLRQ�JOREDO�FODVVHV�ZLWK�WKH�VDPH�FODVV�QDPH�ZLWKLQ�WKH�SURFHVV����� $OO�V\VWHP�ZLGH�FODVVHV�

:LQGRZV�ZLOO�ILQG�WKH�DSSOLFDWLRQ�ORFDO��RU�DSSOLFDWLRQ�JOREDO�GHILQHG�%87721�VXSHUFODVV�EHIRUH�LW�ILQGV�WKH�V\VWHP�ZLGH�%87721�FODVV��7KLV��LQ�HIIHFW��ZLOO�DOORZ�XV�WR�RYHUULGH�WKH�IXQFWLRQDOLW\�RI�WKH�V\VWHP�ZLGH�%87721�FODVV��7KH�GDQJHU�LV�WKDW�WKH�V\VWHP�ZLGH�%87721�FODVV�FDQ�QHYHU�EH�XVHG�WR�FUHDWH�D�ZLQGRZ�LQ�WKLV�SURFHVV��LQVWHDG��WKH�VXSHUFODVV�ZLOO�DOZD\V�EH�XVHG��,I�D�QHZ�YHUVLRQ�RI�WKH�RSHUDWLQJ�V\VWHP�PRGLILHV�RU�UHPRYHV�WKLV�V\VWHP�ZLGH�FODVV��WKH�VXSHUFODVV�PLJKW�QRW�ZRUN�FRUUHFWO\��LI�DW�DOO���6XSHUFODVVLQJ�D�GHYHORSHU�GHILQHG�FODVV��ZKLFK�LV�D�VXSHUFODVV�LQ�DQG�RI�LWVHOI��LQ�DQ�DSSOLFDWLRQ�LV�JHQHUDOO\�UHGXQGDQW��$�QHZ�ZLQGRZ�FODVV�VKRXOG�EH�EDVHG�RQ�D�ZLQGRZ�FODVV�WKDW�DOUHDG\�H[LVWV��7KLV�RULJLQDO�FODVV�ZLOO�JLYH�WKH�QHZ�FODVV�LWV�GHIDXOW�EHKDYLRU��ZKLFK�LV�SURYLGHG�E\�WKH�RULJLQDO�FODVV�ZLQGRZ�SURFHGXUH��,I�ZH�QRZ�XVH�VXSHUFODVVLQJ�WR�FUHDWH�DQRWKHU�QHZ�FODVV�XVLQJ�WKH�FODVV�WKDW�ZH�MXVW�FUHDWHG��ZH�DUH�DGGLQJ�D�QHZ�OD\HU�RI�FRPSOH[LW\�WR�RXU�DSSOLFDWLRQ��7KLV�DGGHG�OD\HU�FDQ�EH�D�PDLQWHQDQFH�QLJKWPDUH��HVSHFLDOO\�LI�WKH�GHYHORSHUV�PDLQWDLQLQJ�WKH�FRGH�KDYH�QR�GRFXPHQWDWLRQ�WR�LQIRUP�WKHP�KRZ�WKH�FRGH�LV�VXSSRVHG�WR�ZRUN��,W�FDQ�DOVR�KXUW�SHUIRUPDQFH�EHFDXVH�QRZ�ZKHQ�D�PHVVDJH�LV�VHQW�WR�D�ZLQGRZ�RI�WKLV�FODVV��WKH�PHVVDJH�PXVW�EH�SDVVHG�IURP�WKH�VXSHUFODVVHG�ZLQGRZ�SURFHGXUH�WR�WKH�GHYHORSHU�GHILQHG�FODVV�ZLQGRZ�SURFHGXUH�DQG�WKHQ�SDVVHG�RQFH�PRUH�WR�WKH�RULJLQDO�FODVVV�ZLQGRZ�SURFHGXUH��,Q�D�VHQVH��\RX�DUH�VXSHUFODVVLQJ�D�FODVV�ZKLFK�KDV�DOUHDG\�EHHQ�VXSHUFODVVHG��&ODVV�%�VXSHUFODVVHV�D�EDVH�FODVV�$��FODVV�&�WKHQ�VXSHUFODVVHV�&ODVV�%����,QVWHDG��WKH�GHYHORSHU�VKRXOG�ORRN�IRU�D�ZD\�RI�XVLQJ�VXSHUFODVVLQJ�WR�PRGLI\�RQO\�D�V\VWHP�GHILQHG�FODVV��,I�WKH�WZR�VXSHUFODVVHV�FDQQRW�EH�PHUJHG�LQWR�D�VLQJOH�VXSHUFODVV�LQ�RXU�H[DPSOH�RI�VXSHUFODVVLQJ�D�GHYHORSHU�GHILQHG�FODVV��L�H���FODVV�%�PHUJHG�ZLWK�FODVV�&���D�VHFRQG��VHSDUDWH�VXSHUFODVV�VKRXOG�EH�FUHDWHG��RQH�WKDW�LV�EDVHG�RQ�WKH�RULJLQDO�EDVH�FODVV��L�H���FODVV�%�VXSHUFODVVHV�EDVH�FODVV�$��FODVV�&�VXSHUFODVVHV�EDVH�FODVV�$���7KLV�ZLOO�OHVVHQ�WKH�DSSOLFDWLRQV�FRPSOH[LW\�DQG�NHHS�SHUIRUPDQFH�DW�DQ�DFFHSWDEOH�OHYHO���7KLV�LV�EDVLFDOO\�KRZ�VXSHUFODVVLQJ�ZRUNV��1RWLFH�WKH�VLPLODULWLHV�DQG�GLIIHUHQFHV�EHWZHHQ�)LJXUH�����DQG�)LJXUH������ZKLFK�LOOXVWUDWHG�VXEFODVVLQJ��6XSHUFODVVLQJ�ZLOO�EH�GLVFXVVHG�PRUH�WKRURXJKO\�LQ�&KDSWHU�����

������:K\�'R�:H�8VH�6XEFODVVLQJ"�

Page 77: Visual Basic - Subclassing and Hooking with VB & VB NET

:H�XVH�VXEFODVVLQJ�WR�DGG�RU�PRGLI\�WKH�IXQFWLRQDOLW\�RI�DQ\�DSSOLFDWLRQ�ZLQGRZ��DQG�PRVW�9%�FRQWUROV��ZKHQ�WKDW�IXQFWLRQDOLW\�FDQQRW�EH�DGGHG�RU�PRGLILHG�LQ�D�UREXVW�ZD\�E\�XVLQJ�WKH�9%�ODQJXDJH�DORQH��6RPH�H[DPSOHV�RI�VXEFODVVLQJ�LQFOXGH���

• $GGLQJ�WH[W�WR�WKH�VWDWXV�EDU�WKDW�GHVFULEHV�ZKLFK�PHQX�LWHP�WKH�PRXVH�LV�FXUUHQWO\�RYHU���

• ,QGLFDWLQJ�ZKDW�SDUW�RI�D�ZLQGRZV�QRQ�FOLHQW�UHJLRQ�WKH�PRXVH�LV�RYHU��7KLV�FRXOG�EH�WKH�WLWOH�EDU��WKH�&ORVH�EXWWRQ��D�ZLQGRZ�ERUGHU��HWF��1RWH�WKDW�WKH�0RXVH2YHU�HYHQW�LQ�D�9%�IRUP�FDSWXUHV�PRXVH�HYHQWV�RQO\�LQ�WKH�FOLHQW�DUHD�RI�WKH�IRUP��QRW�LQ�WKH�QRQFOLHQW�DUHD���

• 5HVWULFWLQJ�WKH�XVHUV�DELOLW\�WR�PRYH�RU�UHVL]H�D�IRUP�RU�GLDORJ���• ,QVWHDG�RI�ZULWLQJ�QHZ�FRGH�WR�PLPLF�WKH�FRPPRQ�GLDORJ�FRQWUROV��\RX�FDQ�VXEFODVV�

WKHP�DQG�DGG�\RXU�RZQ�IXQFWLRQDOLW\��VXFK�DV�D�ILOH�YLHZHU�IRU�WKH�2SHQ�GLDORJ�ER[�WKDW�DOORZV�\RX�WR�SUHYLHZ�VSHFLILF�W\SHV�RI�ILOHV���

• :LQGRZV�FDQ�EH�PRQLWRUHG�WR�GHWHUPLQH�ZKHQ�WKH\�EHFRPH�DFWLYH�RU�LQDFWLYH���• 7KURXJK�VXEFODVVLQJ��\RX�FDQ�PRGLI\�WKH�ZD\�D�ZLQGRZ�LV�GUDZQ�E\�FDSWXULQJ�WKH�

SDLQW�PHVVDJHV��:0B'5$:,7(0��:0B3$,17��:0B1&3$,17��HWF�����• 3RS�XS�PHQXV�GLVSOD\HG�ZKHQ�ULJKW�FOLFNLQJ�WH[W�ER[HV�FDQ�EH�UHSODFHG�ZLWK�PHQXV�

RI�\RXU�RZQ�GHVLJQ���• $Q�DSSOLFDWLRQ�VLPLODU�WR�6S\���FDQ�EH�GHYHORSHG�WR�ZDWFK�PHVVDJHV�VHQW�WR�D�

SDUWLFXODU�ZLQGRZ�RU�ZLQGRZV�ZLWKLQ�D�VLQJOH�SURFHVV��

����:KDW�$UH�+RRNV"�

7KH�0LFURVRIW�GRFXPHQWDWLRQ�GHILQHV�KRRNV�LQ�WKLV�PDQQHU���

$�KRRN�LV�D�SRLQW�LQ�WKH�V\VWHP�PHVVDJH�KDQGOLQJ�PHFKDQLVP�ZKHUH�DQ�DSSOLFDWLRQ�FDQ�LQVWDOO�D�VXEURXWLQH�WR�PRQLWRU�WKH�PHVVDJH�WUDIILF�LQ�WKH�V\VWHP�DQG�SURFHVV�FHUWDLQ�W\SHV�RI�PHVVDJHV�EHIRUH�WKH\�UHDFK�WKH�WDUJHW�ZLQGRZ�SURFHGXUH���

2QH�PRUH�WKLQJ�VKRXOG�EH�DGGHG�WR�WKLV�GHILQLWLRQ��7KH�DGGLWLRQ�,�KDYH�PDGH�LV�LQ�LWDOLFV���

$�KRRN�LV�D�SRLQW�LQ�WKH�V\VWHP�PHVVDJH�KDQGOLQJ�PHFKDQLVP�ZKHUH�DQ�DSSOLFDWLRQ�FDQ�LQVWDOO�D�VXEURXWLQH�WR�PRQLWRU�WKH�PHVVDJH�WUDIILF�LQ�WKH�V\VWHP�DQG�SURFHVV�FHUWDLQ�W\SHV�RI�PHVVDJHV�EHIRUH�WKH\�UHDFK�WKH�WDUJHW�ZLQGRZ�SURFHGXUH��DV�ZHOO�DV�DIWHU�WKH\�DUH�SURFHVVHG�E\�WKH�WDUJHW�ZLQGRZ�SURFHGXUH���

Page 78: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�VXEURXWLQH�WKDW�LV�LQVWDOOHG�DW�D�KRRN�SRLQW�LV�W\SLFDOO\�FDOOHG�D�ILOWHU�IXQFWLRQ��$�ILOWHU�IXQFWLRQ�LV�DQDORJRXV�WR�D�ZLQGRZ�SURFHGXUH�LQ�WKDW�LW�FDQ�UHFHLYH�DQG�SURFHVV�PHVVDJHV��:KHQ�WKHVH�ILOWHU�IXQFWLRQV�DUH�SODFHG�LQWR�WKH�PHVVDJH�VWUHDP�DW�D�KRRN�SRLQW�E\�XVLQJ�WKH�6HW:LQGRZ+RRN([�$3,�IXQFWLRQ��ZKLFK�ZLOO�EH�GHILQHG�ODWHU�LQ�WKLV�FKDSWHU���LW�LV�FDOOHG�LQVWDOOLQJ�D�KRRN��$�KRRN�SRLQW�LV�D�V\VWHP�GHILQHG�SRLQW�LQ�WKH�PHVVDJH�VWUHDP�DW�ZKLFK�D�ILOWHU�IXQFWLRQ�FDQ�EH�LQVWDOOHG��7KHVH�KRRN�SRLQWV�FDQQRW�EH�FKDQJHG���+RRNV�DUH�VLPLODU�WR�VXEFODVVLQJ�LQ�WKDW�ERWK�LQWHUFHSW�PHVVDJHV��DOWKRXJK�WKLV�LV�ZKHUH�PRVW�RI�WKH�VLPLODULWLHV�HQG��<RX�PLJKW�WKLQN�RI�KRRNV�DV�H[WHQVLRQV�WR�VXEFODVVLQJ��,I�D�SUREOHP�FDQQRW�EH�VROYHG�ZLWK�VXEFODVVLQJ��ORRN�LQWR�XVLQJ�KRRNV�WR�DXJPHQW�RU�HYHQ�UHSODFH�VXEFODVVLQJ��,W�LV�KLJKO\�SRVVLEOH�WKDW�VHYHUDO�KRRNV�FRXOG�EH�XVHG�LQ�FRPELQDWLRQ�WR�VROYH�D�SUREOHP���7KH�IXQGDPHQWDO�FKDUDFWHULVWLF�RI�DOO�W\SHV�RI�VXEFODVVLQJ�LV�WKDW�D�QHZ�GHYHORSHU�GHILQHG�ZLQGRZ�SURFHGXUH�LV�FUHDWHG�ZKLFK�LQWHUFHSWV�PHVVDJHV�EHIRUH�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�KDV�D�FKDQFH�WR�UHFHLYH�WKHP��7KLV�QHZ�ZLQGRZ�SURFHGXUH�WKHQ�GHFLGHV�KRZ�WR�KDQGOH�WKH�PHVVDJH�DQG�ZKHWKHU�LW�ZLOO�EH�SDVVHG�RQ�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH���+RRNV�LQWHUFHSW�PHVVDJHV�DW�YDULRXV�VHW�ORFDWLRQV�LQ�WKH�RSHUDWLQJ�V\VWHP��7KH�:+B*(70(66$*(�KRRN�FDQ�LQWHUFHSW�PHVVDJHV�LPPHGLDWHO\�EHIRUH�WKH\�DUULYH�DW�WKHLU�GHVWLQDWLRQ�ZLQGRZ�SURFHGXUH��VLPLODU�WR�VXEFODVVLQJ��7KH�:+B&$//:1'352&5(7�KRRN�FDQ�LQWHUFHSW�PHVVDJHV�DIWHU�EHLQJ�SURFHVVHG�E\�D�ZLQGRZ�SURFHGXUH��7KH�:+B-2851$/5(&25'�KRRN�LQWHUFHSWV�PHVVDJHV�DIWHU�EHLQJ�VHQW�IURP�WKH�UDZ�LQSXW�WKUHDG��5,7��EXW�EHIRUH�WKH\�DUULYH�DW�WKHLU�GHVWLQDWLRQ�WKUHDGV�PHVVDJH�TXHXH���+RRNV�KDYH�PRUH�VSHFLILF�IXQFWLRQDOLW\�WKDQ�VXEFODVVLQJ�GRHV��7KH�:+B&%7�KRRN�LV�D�JRRG�LOOXVWUDWLRQ�RI�WKLV��$OWKRXJK�WKLV�KRRN�FDQ�EH�XVHG�IRU�VHYHUDO�GLIIHUHQW�W\SHV�RI�WDVNV��LW�ZDV�FUHDWHG�WR�PDNH�WKH�SURFHVV�RI�FUHDWLQJ�FRPSXWHU�EDVHG�WUDLQLQJ��&%7��DSSOLFDWLRQV�HDVLHU�DQG�PRUH�UREXVW��7KLV�KRRN�FDQ�EH�XVHG�WR�ZDWFK�WKH�DFWLRQV�D�XVHU�SHUIRUPV�LQ�WKH�V\VWHP��7KH�KRRN�FDQ�WKHQ�JLYH�IHHGEDFN�WR�WKH�&%7�DSSOLFDWLRQ�DERXW�ZKHWKHU�WKH�XVHU�LV�SHUIRUPLQJ�WKH�DFWLRQ�FRUUHFWO\��7KH�KRRN�DFFRPSOLVKHV�WKLV�E\�FDSWXULQJ�PHVVDJHV�UHODWLQJ�WR�ZLQGRZ�DFWLYDWLRQ��FUHDWLRQ��GHVWUXFWLRQ��PLQLPL]DWLRQ��PD[LPL]DWLRQ��PRYHPHQW��DQG�VL]LQJ��DV�ZHOO�DV�PRXVH�DQG�NH\ERDUG�DFWLYLW\��7KLV�LV�MXVW�D�VDPSOLQJ�RI�WKH�PHVVDJHV�WKDW�WKLV�KRRN�FDQ�UHFHLYH���7DEOH�����SUHVHQWV�PDQ\�RI�WKH�VLPLODULWLHV�DQG�GLIIHUHQFHV�DPRQJ�VXEFODVVLQJ�DQG�KRRNLQJ���

7DEOH������&RPSDULVRQ�%HWZHHQ�6XEFODVVLQJ�DQG�+RRNLQJ��6XEFODVVLQJ� +RRNV�

,QWHUFHSWV�PHVVDJHV�� ,QWHUFHSWV�PHVVDJHV��7KH�EDVLF�VWHSV�DUH�WR�ZULWH�D�VXEFODVVHG�ZLQGRZ�SURFHGXUH��FDOO�6HW:LQGRZ/RQJ3WU�RU�6HW&ODVV/RQJ3WU�WR�LQLWLDWH�VXEFODVVLQJ��DQG�WKHQ�XVH�WKH�VDPH�IXQFWLRQ�WR�WHUPLQDWH�WKH�VXEFODVVLQJ���

7KH�EDVLF�VWHSV�DUH�WR�ZULWH�D�KRRN�ILOWHU�IXQFWLRQ��FDOO�6HW:LQGRZV+RRN([�WR�LQVWDOO�WKH�KRRN��DQG�WKHQ�XVH�8QKRRN:LQGRZV+RRN([�WR�WHUPLQDWH�WKH�KRRNLQJ���

Page 79: Visual Basic - Subclassing and Hooking with VB & VB NET

&DQ�FDXVH�VHULRXV�*3)V�LI�LPSOHPHQWHG�LQFRUUHFWO\���

&DQ�FDXVH�VHULRXV�*3)V�LI�LPSOHPHQWHG�LQFRUUHFWO\��

&DQ�SDVV�PHVVDJHV�RQ�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�RI�WKH�VXEFODVVHG�ZLQGRZ���

&DQ�SDVV�PHVVDJHV�RQ�WR�WKH�QH[W�KRRN�LQ�D�FKDLQ�RI�KRRNV��

&DSWXUHV�HYHU\�W\SH�RI�PHVVDJH�WKDW�LV�ERXQG�IRU�LWV�ZLQGRZ��

6SHFLILF�W\SHV�RI�PHVVDJHV�FDQ�EH�FDSWXUHG��RU�HYHU\�PHVVDJH�LQ�WKH�V\VWHP�FDQ�EH�FDSWXUHG���

$OO�ZLQGRZ�SURFHGXUH�IXQFWLRQV�DFFHSW�WKHVH�DUJXPHQWV��KZQG��0VJ��O3DUDP��DQG�Z3DUDP���

$OO�KRRN�ILOWHU�IXQFWLRQV�DFFHSW�WKHVH�DUJXPHQWV��FRGH��O3DUDP��DQG�Z3DUDP���

6XEFODVVLQJ�LV�SHUIRUPHG�DW�RQH�SRLQW�LQ�WKH�V\VWHP��LPPHGLDWHO\�EHIRUH�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH���

+RRN�SRLQWV�DUH�ORFDWHG�DW�YDULRXV�SODFHV�VSUHDG�WKURXJKRXW�WKH�PHVVDJLQJ�V\VWHP���

:LQGRZV�LQ�D�VHSDUDWH�SURFHVV�FDQQRW�EH�VXEFODVVHG���

+RRNV�FDQ�RSHUDWH�RQ�D�VLQJOH�ZLQGRZ�LQ�D�SURFHVV��RU�RQ�DOO�ZLQGRZV�LQ�DOO�SURFHVVHV���

8VHV�D�VXEFODVVHG�ZLQGRZ�SURFHGXUH�WR�SURFHVV�PHVVDJHV��

8VHV�D�KRRN�ILOWHU�IXQFWLRQ�WR�SURFHVV�PHVVDJHV��

7KH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LV�D�FDOOEDFN�IXQFWLRQ�� 7KH�KRRN�ILOWHU�IXQFWLRQ�LV�D�FDOOEDFN�IXQFWLRQ��

$�VLQJOH�ZLQGRZ�FDQ�EH�VXEFODVVHG�PXOWLSOH�WLPHV��

$�VLQJOH�KRRN�FDQ�KDYH�PXOWLSOH�ILOWHU�IXQFWLRQV�FKDLQHG�WR�LW��

7KHUH�DUH����GLIIHUHQW�W\SHV�RI�KRRNV�WR�FKRRVH�IURP��7KHUH�LV�DOVR�D���WK�KRRN�FDOOHG�:+B+$5':$5(��EXW�LW�LV�QRW�FXUUHQWO\�LPSOHPHQWHG�LQ�:LQGRZV��7KH����GRFXPHQWHG�KRRN�W\SHV�DUH���WH_CALLWNDPROC

&DOOHG�EHIRUH�D�PHVVDJH�UHDFKHV�D�ZLQGRZ�SURFHGXUH���WH_CALLWNDPROCRET

&DOOHG�DIWHU�D�ZLQGRZ�SURFHGXUH�ILQLVKHV�SURFHVVLQJ�D�PHVVDJH���WH_CBT

&DSWXUHV�PHVVDJHV�WKDW�PDNH�LW�HDVLHU�IRU�WKH�GHYHORSHU�WR�FUHDWH�&%7�DSSOLFDWLRQV���WH_DEBUG

&DOOHG�HYHU\�WLPH�DQRWKHU�KRRN�IXQFWLRQ�LV�DERXW�WR�EH�FDOOHG��7KLV�KRRN�IXQFWLRQ�LV�DOZD\V�FDOOHG�ILUVW��ZKLFK�PDNHV�LW�XVHIXO�LQ�GHEXJJLQJ�KRRN�IXQFWLRQ�FDOOV���

WH_FOREGROUNDIDLE

&DOOHG�ZKHQ�WKHUH�DUH�QR�SHQGLQJ�PHVVDJHV�LQ�WKH�FXUUHQW�WKUHDGV�PHVVDJH�TXHXH���WH_GETMESSAGE

&DOOHG�LPPHGLDWHO\�EHIRUH�WKH�*HW0HVVDJH�RU�3HHN0HVVDJH�$3,�IXQFWLRQV�UHWXUQ�D�PHVVDJH���

WH_JOURNALRECORD

&DSWXUHV�DOO�PRXVH�DQG�NH\ERDUG�PHVVDJHV�EHIRUH�WKH\�FDQ�DUULYH�DW�WKHLU�GHVWLQDWLRQ�ZLQGRZ�SURFHGXUH���

WH_JOURNALPLAYBACK

Page 80: Visual Basic - Subclassing and Hooking with VB & VB NET

3OD\V�EDFN�WKH�PHVVDJHV�UHFRUGHG�ZLWK�WKH�:+B-2851$/5(&25'�KRRN���WH_KEYBOARD

&DSWXUHV�VSHFLILF�NH\ERDUG�PHVVDJHV�DIWHU�WKH\�DUH�SRVWHG�WR�D�WKUHDGV�PHVVDJH�TXHXH�EXW�EHIRUH�WKH\�DUH�SURFHVVHG�E\�D�ZLQGRZ�SURFHGXUH���

WH_KEYBOARD_LL

&DSWXUHV�VSHFLILF�NH\ERDUG�PHVVDJHV�EHIRUH�WKH\�DUH�SRVWHG�WR�D�WKUHDGV�PHVVDJH�TXHXH���

WH_MOUSE

&DSWXUHV�PRXVH�PHVVDJHV�DIWHU�WKH\�DUH�SRVWHG�WR�D�WKUHDGV�PHVVDJH�TXHXH�EXW�EHIRUH�WKH\�DUH�SURFHVVHG�E\�D�ZLQGRZ�SURFHGXUH���

WH_MOUSE_LL

&DSWXUHV�VSHFLILF�PRXVH�PHVVDJHV�EHIRUH�WKH\�DUH�SRVWHG�WR�D�WKUHDGV�PHVVDJH�TXHXH���

WH_MSGFILTER

&DOOHG�ZKHQHYHU�D�GLDORJ�ER[��D�PHVVDJH�ER[��D�VFUROOEDU�FRQWURO��RU�D�PHQX�UHFHLYHV�D�PHVVDJH��7KLV�KRRN�DOVR�LV�FDOOHG�ZKHQ�WKH�XVHU�SUHVVHV�WKH�$/7�7$%�RU�$/7�(6&�NH\V��7KLV�KRRN�UHFHLYHV�WKHVH�PHVVDJHV�RQO\�IRU�D�VLQJOH�WKUHDG���

WH_SYSMSGFILTER

7KH�V\VWHP�ZLGH�RU�JOREDO�KRRN�HTXLYDOHQW�WR�:+B06*),/7(5��7KLV�ILOWHU�UHFHLYHV�PHVVDJHV�IURP�DOO�WKUHDGV�UXQQLQJ�LQ�WKH�V\VWHP���

WH_SHELL

&DOOHG�ZKHQ�DQ�DFWLRQ�LV�SHUIRUPHG�RQ�D�WRS�OHYHO�ZLQGRZ���WH_HARDWARE

1RW�LPSOHPHQWHG�LQ�:LQ�����,W�VKRXOG�EH�QRWHG�WKDW�ORZ�OHYHO�KRRNV����WKRVH�ZLWK�B//�DSSHQGHG�WR�WKH�KRRN�QDPH����DUH�DYDLODEOH�RQO\�LQ�:LQGRZV������DQG�:LQGRZV�17�6HUYLFH�3DFN���RU�KLJKHU���(DFK�KRRN�UHVLGHV�DW�YDULRXV�SODFHV�WKURXJKRXW�WKH�:LQGRZV�PHVVDJLQJ�V\VWHP��$OO�KRRNV�DUH�SODFHG�E\�WKH�RSHUDWLQJ�V\VWHP�DQG�FDQQRW�EH�PRYHG�WR�D�GLIIHUHQW�VSRW�LQ�WKH�PHVVDJLQJ�V\VWHP��7KLQN�RI�D�KRRN�DV�DQ�RSHQLQJ�LQ�WKH�PHVVDJLQJ�V\VWHP��$V�PHVVDJHV�IORZ�WKURXJKRXW�WKH�RSHUDWLQJ�V\VWHP��WKH\�SDVV�WKURXJK�RQH�RU�PRUH�RI�WKHVH�KRRN�SRLQWV�RU�RSHQLQJV��$�KRRN�DORQH�LV�XVHOHVV�WR�WKH�GHYHORSHU�XQOHVV�D�ILOWHU�IXQFWLRQ�LV�DWWDFKHG�WR�WKH�KRRN��$�ILOWHU�IXQFWLRQ�LV�VLPLODU�LQ�FRQFHSW�WR�WKH�:LQ3URF�ZLQGRZ�SURFHGXUH�WKDW�ZH�FUHDWHG�LQ�WKH�VXEFODVVLQJ�VHFWLRQ��7KH�ILOWHU�IXQFWLRQ�LV�WKHQ�DWWDFKHG�WR�WKH�KRRN��$W�WKLV�SRLQW��DQ\�PHVVDJHV�WKDW�JR�WKURXJK�WKLV�KRRN�DUH�SDVVHG�RQ�WR�WKH�DWWDFKHG�ILOWHU�IXQFWLRQ�EHIRUH�EHLQJ�VHQW�RQ�WR�WKHLU�QH[W�GHVWLQDWLRQ��+RRNLQJ�LV�LOOXVWUDWHG�LQ�)LJXUH�������

)LJXUH������$�KRRN�SRLQW�LQ�WKH�V\VWHP�EHIRUH�DQG�DIWHU�D�ILOWHU�IXQFWLRQ�LV�DWWDFKHG�WR�LW�

Page 81: Visual Basic - Subclassing and Hooking with VB & VB NET

,I�PRUH�WKDQ�RQH�DSSOLFDWLRQ�DWWDFKHV�D�ILOWHU�IXQFWLRQ�WR�D�KRRN��WKH�ILOWHU�IXQFWLRQV�DUH�FKDLQHG�WRJHWKHU��7KLV�LV�FDOOHG�D�ILOWHU�IXQFWLRQ�FKDLQ��LW�LV�LOOXVWUDWHG�LQ�)LJXUH�������

)LJXUH������$�KRRN�FKDLQ�LQ�DFWLRQ��WKH�KRRN�SRLQW�KDV�WKUHH�ILOWHU�IXQFWLRQV�DWWDFKHG�WR�LW�

7KH�RSHUDWLQJ�V\VWHP�PDLQWDLQV�WKLV�ILOWHU�FKDLQ�LQWHUQDOO\�VR�WKDW�ZH�GR�QRW�KDYH�WR�ERWKHU�FKHFNLQJ�IRU�WKH�H[LVWHQFH�RI�RWKHU�ILOWHU�IXQFWLRQV�DQG�LQVHUWLQJ�DQG�UHPRYLQJ�RXU�ILOWHU�IXQFWLRQV�IURP�WKH�FKDLQ��7KH�RQO\�WKLQJ�ZH�KDYH�WR�UHPHPEHU�LV�WKDW�RWKHU�DSSOLFDWLRQV�PLJKW�KDYH�LQVWDOOHG�ILOWHU�IXQFWLRQV�WR�WKH�VDPH�KRRN�WKDW�ZH�DUH�XVLQJ��7KXV��ZKHQ�ZH�DUH�GRQH�SURFHVVLQJ�LQ�RXU�ILOWHU�IXQFWLRQ��ZH�QHHG�WR�SDVV�WKH�LQIRUPDWLRQ�RQ�WR�WKH�QH[W�KRRN�LQ�WKH�FKDLQ��7KLV�LV�VLPLODU�LQ�FRQFHSW�WR�D�VXEFODVVHG�ZLQGRZ�SDVVLQJ�WKH�LQIRUPDWLRQ�DERXW�WKH�PHVVDJH�RQ�IURP�WKH�QHZ�ZLQGRZ�SURFHGXUH�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH���2QH�DGGLWLRQDO�GHWDLO�DERXW�KRRNV�LV�WKDW�WKH�ODVW�ILOWHU�IXQFWLRQ�LQVWDOOHG�LQ�D�FKDLQ�LV�LQVWDOOHG�DW�WKH�EHJLQQLQJ�RI�WKH�FKDLQ��7KHUHIRUH��WKH�ODVW�LQVWDOOHG�ILOWHU�IXQFWLRQ�LV�WKH�ILUVW�WR�UHFHLYH�PHVVDJHV�IURP�WKH�KRRN��7KLV�LQIRUPDWLRQ�FDQ�FRPH�LQ�KDQG\�ODWHU�LI�\RX�LQVWDOO�PRUH�WKDQ�RQH�ILOWHU�IXQFWLRQ�IRU�D�VLQJOH�KRRN��RU�LI�RWKHU�DSSOLFDWLRQV�LQVWDOO�D�ILOWHU�IXQFWLRQ�WKDW�LV�PLVEHKDYLQJ�DQG�SRVVLEO\�QRW�UHOD\LQJ�WKH�FRUUHFW�PHVVDJH�LQIRUPDWLRQ�WR�\RXU�ILOWHU�IXQFWLRQ���

������+RZ�'R�+RRNV�:RUN"�

Page 82: Visual Basic - Subclassing and Hooking with VB & VB NET

8VLQJ�KRRNV�LV�D�OLWWOH�PRUH�FRPSOLFDWHG�WKDQ�VXEFODVVLQJ�D�ZLQGRZ��7KHUH�LV�PXFK�PRUH�IOH[LELOLW\�DQG�SRZHU�ZLWK�KRRNV�WKDQ�ZLWK�VXEFODVVLQJ��VR�LW�VWDQGV�WR�UHDVRQ�WKDW�KRRNV�ZLOO�EH�PRUH�FRPSOLFDWHG���6HWWLQJ�XS�D�KRRN�LV�VLPLODU�WR�VHWWLQJ�XS�D�VXEFODVVLQJ�SURFHGXUH��)LUVW��D�ILOWHU�IXQFWLRQ�QHHGV�WR�EH�ZULWWHQ��$OWKRXJK�D�ILOWHU�IXQFWLRQ�LV�VLPLODU�WR�D�ZLQGRZ�SURFHGXUH��WKH�SDUDPHWHUV�LW�WDNHV�DUH�FRPSOHWHO\�GLIIHUHQW��$�ILOWHU�IXQFWLRQ�KDV�WKH�IROORZLQJ�SURWRW\SH���3XEOLF�)XQFWLRQ�0HVVDJH3URF����������%\9DO�X&RGH�$V�/RQJ��B��������%\9DO�Z3DUDP�$V�/RQJ��B��������O3DUDP�$V�/RQJ��$V�/RQJ�(QG�)XQFWLRQ�)RU�QRZ�WKHUH�LV�QR�FRGH�ZLWKLQ�WKLV�IXQFWLRQ��VR�LW�ZLOO�QRW�GR�DQ\WKLQJ���(DFK�W\SH�RI�KRRN�ZLOO�XVH�WKLV�VDPH�IXQFWLRQ�SURWRW\SH�IRU�LWV�ILOWHU�IXQFWLRQ��DOWKRXJK�WKH�IXQFWLRQ�LWVHOI�GRHV�QRW�KDYH�WR�EH�QDPHG�0HVVDJH3URF��DV�LW�LV�LQ�WKLV�FRGH��7KH�DUJXPHQWV�WR�WKLV�IXQFWLRQ�DUH�GHILQHG�DV�IROORZV���XFRGH

,GHQWLILHV�DQ�DFWLRQ�VSHFLILF�WR�WKH�KRRN��7KLV�DUJXPHQW�XVXDOO\�VSHFLILHV�WKH�W\SH�RI�DFWLRQ�WKDW�RFFXUUHG��H�J���ZLQGRZ�DFWLYDWLRQ���ZKHQ�WKH�DFWLRQ�RFFXUUHG��H�J���WKH�ZLQGRZ�LV�DERXW�WR�EH�GHVWUR\HG���RU�HYHQ�ZKHWKHU�WKH�KRRN�VKRXOG�SURFHVV�WKH�PHVVDJH���

ZSDUDP

7KH�YDOXH�LV�GHSHQGHQW�RQ�WKH�W\SH�RI�KRRN��7KLV�DUJXPHQW�XVXDOO\�FRQWDLQV�LQIRUPDWLRQ�UHODWLQJ�WR�D�PHVVDJH�VXFK�DV�DQ�K:K:QGQG��YLUWXDO�NH\�FRGH��V\VWHP�FRPPDQG�YDOXH��RU�,'�RI�WKH�FDSWXUHG�PHVVDJH���

OSDUDP

7KH�YDOXH�LV�GHSHQGHQW�RQ�WKH�W\SH�RI�KRRN��7KLV�DUJXPHQW�XVXDOO\�FRQWDLQV�D�SRLQWHU�WR�D�VWUXFWXUH�WKDW�UHODWHV�WR�WKH�PHVVDJH�WKDW�ZDV�FDSWXUHG���

1H[W��DIWHU�WKH�ILOWHU�IXQFWLRQ�KDV�EHHQ�ZULWWHQ��WKH�KRRN�QHHGV�WR�EH�LQVWDOOHG��7KLV�LV�GRQH�XVLQJ�WKH�6HW:LQGRZV+RRN([�$3,�IXQFWLRQ��7KLV�$3,�IXQFWLRQ�LV�GHFODUHG�LQ�9%�DV�IROORZV���'HFODUH�)XQFWLRQ�6HW:LQGRZV+RRN([�/LE��XVHU����$OLDV��6HW:LQGRZV+RRN([$��B�������������������������������������%\9DO�LG+RRN�$V�/RQJ��B������������������������������������%\9DO�OSIQ�$V�/RQJ��B������������������������������������%\9DO�KPRG�$V�/RQJ��B������������������������������������%\9DO�GZ7KUHDG,G�$V�/RQJ��$V�/RQJ��,WV�SDUDPHWHUV�DUH�DV�IROORZV���K+RRN

$�FRQVWDQW�WKDW�GHILQHV�WKH�W\SH�RI�KRRN�SURFHGXUH�WKDW�ZH�DUH�LQVWDOOLQJ���OSIQ

$�SRLQWHU�WR�WKH�ILOWHU�IXQFWLRQ�WKDW�ZH�KDYH�SUHYLRXVO\�ZULWWHQ���KPRG

Page 83: Visual Basic - Subclassing and Hooking with VB & VB NET

,I�WKH�KRRN�ILOWHU�IXQFWLRQ�UHVLGHV�LQ�D�'//��WKLV�DUJXPHQW�FRQWDLQV�WKH�KDQGOH�WR�WKLV�'//��7KH�'//�KDQGOH�FDQ�EH�REWDLQHG�LQ�D�9%�DSSOLFDWLRQ�WKURXJK�WKH�$SS�K,QVWDQFH�SURSHUW\��,I�WKH�KRRN�ILOWHU�IXQFWLRQ�UHVLGHV�LQ�WKH�DSSOLFDWLRQ�FRGH�DQG�QRW�LQ�D�'//��WKLV�DUJXPHQW�LV�VHW�WR�18//���

GZ7KUHDG,G

,I�WKH�KRRN�ILOWHU�IXQFWLRQ�UHVLGHV�LQ�WKH�DSSOLFDWLRQ�FRGH�DQG�QRW�LQ�D�'//��WKLV�DUJXPHQW�LV�VHW�WR�WKH�WKUHDG�,'�LQ�ZKLFK�WKH�KRRN�ILOWHU�IXQFWLRQ�UHVLGHV��,I�WKH�KRRN�ILOWHU�IXQFWLRQ�UHVLGHV�LQ�D�'//��WKLV�DUJXPHQW�LV�]HUR���9%�VWDQGDUG�(;(�DSSOLFDWLRQV�DUH�VLQJOH�WKUHDGHG�E\�GHIDXOW��7R�JHW�WKH�,'�RI�WKH�WKUHDG�WKDW�FRQWDLQV�WKH�KRRN�ILOWHU�IXQFWLRQ��\RX�XVH�$SS�7KUHDG,'��,I�D�9%�DSSOLFDWLRQ�XVHV�WKH�&UHDWH7KUHDG�$3,�IXQFWLRQ�WR�VSDZQ�PXOWLSOH�WKUHDGV��WKH�$SS�7KUHDG,'�SURSHUW\�ZLOO�UHWXUQ�WKH�WKUHDG�,'�RI�WKH�FXUUHQWO\�H[HFXWLQJ�WKUHDG��WKH�WRSLF�RI�FUHDWLQJ�WKUHDGV�LQ�9%�LV�EH\RQG�WKH�VFRSH�RI�WKLV�ERRN���,Q�RWKHU�ZRUGV��LI�D�9%�DSSOLFDWLRQ�FUHDWHV�WZR�WKUHDGV�DQG�VHSDUDWH�FDOOV�WR�$SS�7KUHDG,'�DUH�PDGH�LQ�HDFK�WKUHDG��\RX�ZLOO�JHW�EDFN�WZR�GLIIHUHQW�WKUHDG�,'V��7R�JHW�WKH�WKUHDG�,'�RI�WKH�WKUHDG�FRQWDLQLQJ�WKH�FRGH�IRU�WKH�KRRN�ILOWHU�IXQFWLRQ��\RX�PXVW�FDOO�$SS�7KUHDG,'�ZLWKLQ�WKH�VDPH�WKUHDG�WKDW�FRQWDLQV�WKH�KRRN�ILOWHU�IXQFWLRQ��,I�D�WKUHDG�WHUPLQDWHV��LWV�,'�LV�QR�ORQJHU�YDOLG���)RU�D�9LVXDO�&���DSSOLFDWLRQ��WKH�*HW&XUUHQW7KUHDG,'�$3,�IXQFWLRQ�DOVR�ZLOO�UHWXUQ�WKH�,'�RI�WKH�FXUUHQWO\�UXQQLQJ�WKUHDG��*HW&XUUHQW7KUHDG,'WDNHV�QR�DUJXPHQWV�DQG�UHWXUQV�D�/RQJ�YDOXH��ZKLFK�LV�WKH�WKUHDG�,'���

,I�WKH�FDOO�WR�6HW:LQGRZV+RRN([�LV�VXFFHVVIXO�LQ�LQVWDOOLQJ�WKH�ILOWHU�IXQFWLRQ�LQ�WKH�ILOWHU�IXQFWLRQ�FKDLQ��WKH�UHWXUQ�YDOXH�ZLOO�EH�D�KDQGOH�WR�WKH�KRRNV�ILOWHU�IXQFWLRQ��,I�6HW:LQGRZV+RRN([�UHWXUQV�D�]HUR��DQ�HUURU�KDV�RFFXUUHG���:H�XVH�WKLV�$3,�IXQFWLRQ�DV�VKRZQ�EHORZ�WR�LQVWDOO�D�PHVVDJH�ILOWHU�KRRN���3ULYDWH�K+RRN�DV�/RQJ��6XE�)RUP�B/RDG������ K+RRN� �6HW:LQGRZV+RRN([�:+B06*),/7(5��B�� � � � � $GGUHVV2I�0HVVDJH3URF��B�� � � � � ���B�� � � � � $SS�7KUHDG,'��(QG�6XE�K+RRN�LV�D�YDULDEOH�RI�W\SH�/RQJ�WKDW�VWRUHV�WKH�UHWXUQHG�KRRN�KDQGOH��:H�ZLOO�QHHG�LW�WR�DFFHVV�WKH�KDQGOH�VWRUHG�WR�WKLV�YDULDEOH�LQ�WKH�ILOWHU�IXQFWLRQ�DQG�LQ�WKH�IXQFWLRQ�UHVSRQVLEOH�IRU�XQKRRNLQJ�WKH�ILOWHU�IXQFWLRQ�IURP�WKH�KRRN�SRLQW���:H�DOVR�QHHG�WR�DGG�D�IXQFWLRQ�WR�RXU�ILOWHU�IXQFWLRQ�WKDW�ZLOO�FDOO�WKH�QH[W�ILOWHU�IXQFWLRQ�LQ�WKH�FKDLQ��7KLV�LV�WKH�&DOO1H[W+RRN([�$3,�IXQFWLRQ��ZKLFK�LV�GHFODUHG�LQ�9%�DV�VKRZQ���3ULYDWH�'HFODUH�)XQFWLRQ�&DOO1H[W+RRN([�/LE��XVHU���B�� � �%\9DO�K+RRN�$V�/RQJ��B�

Page 84: Visual Basic - Subclassing and Hooking with VB & VB NET

� � %\9DO�QFRGH�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��B�� � O3DUDP�$V�$Q\��$V�/RQJ�7KH�IXQFWLRQ�KDV�WKH�IROORZLQJ�SDUDPHWHUV��K+RRN

7KH�KDQGOH�WR�WKH�KRRN��7KLV�KRRN�KDQGOH�LV�UHWXUQHG�E\�WKH�6HW:LQGRZ+RRN([�IXQFWLRQ���

QFRGH

$�FRQVWDQW�LGHQWLI\LQJ�WKH�KRRN�FRGH��Z3DUDP

7KH�Z3DUDP�DUJXPHQW�SDVVHG�LQWR�WKH�KRRN�ILOWHU�IXQFWLRQ��7KH�YDOXH�RI�WKLV�DUJXPHQW�LV�GHSHQGHQW�RQ�WKH�PHVVDJH�WKDW�LW�LV�DVVRFLDWHG�ZLWK���

O3DUDP

7KH�O3DUDP�DUJXPHQW�SDVVHG�LQWR�WKH�KRRN�ILOWHU�IXQFWLRQ��7KH�YDOXH�RI�WKLV�DUJXPHQW�LV�GHSHQGHQW�RQ�WKH�PHVVDJH�WKDW�LW�LV�DVVRFLDWHG�ZLWK���

7KH�UHWXUQ�YDOXH�LV�GHSHQGHQW�RQ�WKH�W\SH�RI�KRRN�WKDW�LV�LQVWDOOHG���7KLV�$3,�IXQFWLRQ�LV�VLPLODU�WR�WKH�&DOO:LQ3URF�$3,�IXQFWLRQ�XVHG�LQ�VXEFODVVLQJ��,W�ZLOO�SDVV�RQ�WKLV�ILOWHU�IXQFWLRQV�SDUDPHWHUV�WR�WKH�QH[W�ILOWHU�IXQFWLRQ�LQ�WKH�FKDLQ��LI�WKHUH�LV�RQH��<RX�QHYHU�NQRZ�LI�VRPHRQH�HOVH�KDV�DOUHDG\�LQVWDOOHG�D�ILOWHU�IXQFWLRQ�IRU�WKH�VDPH�KRRN�DV�\RX�KDYH��VR�WR�EH�SROLWH��ZH�SDVV�WKH�SDUDPHWHUV�RQ�WR�WKH�QH[W�ILOWHU�IXQFWLRQ���:KHQ�WKLV�IXQFWLRQ�LV�SODFHG�LQ�WKH�ILOWHU�IXQFWLRQ��LW�ZLOO�ORRN�OLNH�WKLV�LQ�RXU�FRGH���3XEOLF�)XQFWLRQ�0HVVDJH3URF� �%\9DO�X&RGH�$V�/RQJ��B�� %\9DO�Z3DUDP�$V�/RQJ��B�� O3DUDP�$V�/RQJ��$V�/RQJ�� &RGH�WR�KDQGOH�PHVVDJHV�JRHV�KHUH���� 0HVVDJH3URF� �&DOO1H[W+RRN([�K+RRN��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KLV�ILOWHU�IXQFWLRQ�ZLOO�LQWHUFHSW�PHVVDJHV��EXW�LW�GRHV�QRW�GR�DQ\WKLQJ�XVHIXO�ZLWK�WKHP���+RRNLQJ��OLNH�VXEFODVVLQJ��DOORZV�\RX�WR�GR�RQH�RI�WKUHH�WKLQJV�ZLWK�WKH�LQWHUFHSWHG�PHVVDJH���

• 7KH�PHVVDJH�LQIRUPDWLRQ�FDQ�EH�LJQRUHG�DQG�SDVVHG�WKURXJK�WR�WKH�QH[W�KRRN�IXQFWLRQ�LQ�WKH�FKDLQ���

• 7KH�PHVVDJH�FDQ�EH�GLVFDUGHG�VR�WKDW�WKH�QH[W�ILOWHU�IXQFWLRQ�LQ�WKH�FKDLQ�ZLOO�QRW�EH�FDOOHG��7KLV�FRXOG�EH�YHU\�GDQJHURXV�EHFDXVH�DQRWKHU�DSSOLFDWLRQ�PLJKW�DOUHDG\�KDYH�D�ILOWHU�IXQFWLRQ�LQVWDOOHG�IRU�WKLV�VDPH�KRRN�DQG�LW�PLJKW�QHHG�WR�NQRZ�DERXW�WKH�PHVVDJH�WKDW�\RX�MXVW�GLVFDUGHG���

• 7KH�PHVVDJH�LQIRUPDWLRQ�FDQ�EH�PRGLILHG�DQG�SDVVHG�RQ�WR�WKH�QH[W�ILOWHU�IXQFWLRQ�LQ�WKH�FKDLQ��1RW�DOO�KRRNV�DOORZ�\RX�WR�PRGLI\�WKH�PHVVDJHV�LQIRUPDWLRQ��WKRXJK���

Page 85: Visual Basic - Subclassing and Hooking with VB & VB NET

$V�ZLWK�PRVW�WKLQJV�LQ�:LQGRZV��DIWHU�\RX�XVH�LW��\RX�PXVW�FOHDQ�XS�DIWHU�\RXUVHOI��$IWHU�DOO��ZH�GRQW�OHDYH�WKH�UHIULJHUDWRU�GRRU�RSHQ�DIWHU�JHWWLQJ�RXW�D�JODVV�RI�PLON��6R��WRR��PXVW�ZH�DOZD\V�EH�FDUHIXO�WR�FOHDQ�XS�DIWHU�RXUVHOYHV�ZKHQ�XVLQJ�KRRNV��7R�UHOHDVH�D�ILOWHU�IXQFWLRQ�IURP�WKH�KRRN�FKDLQ�JUDFHIXOO\��ZH�PXVW�XVH�WKH�8QKRRN:LQGRZV+RRN([�$3,�IXQFWLRQ��7KH�9%�GHFODUDWLRQ�RI�WKLV�$3,�IXQFWLRQ�LV���3ULYDWH�'HFODUH�)XQFWLRQ�8QKRRN:LQGRZV+RRN([�/LE��XVHU����B���������������������������%\9DO�K+RRN�$V�/RQJ��$V�/RQJ�,WV�VLQJOH�SDUDPHWHU�LV��K+RRN

7KH�KDQGOH�WR�WKH�KRRN��7KLV�KRRN�KDQGOH�LV�UHWXUQHG�E\�WKH�6HW:LQGRZ+RRN([�IXQFWLRQ���

7KH�FRGH�WR�XQKRRN�WKH�ILOWHU�IXQFWLRQ�LV�VKRZQ�EHORZ���6XE�)RUP�B8QORDG������ 'LP�O5HWXUQ9DO�$V�/RQJ�� O5HWXUQ9DO� �8QKRRN:LQGRZV+RRN([�K+RRN��(QG�6XE�7KH�8QKRRN:LQGRZV+RRN([�$3,�IXQFWLRQ�ZLOO�UHPRYH�WKH�KRRNV�ILOWHU�IXQFWLRQ�IURP�WKH�FKDLQ�WKDW�LV�DVVRFLDWHG�ZLWK�WKH�KRRN�KDQGOH�K+RRN��5HPHPEHU��WKH�KDQGOH�K+RRN�ZDV�UHWXUQHG�E\�WKH�6HW:LQGRZV+RRN([�$3,�IXQFWLRQ���7KHVH�DUH�WKH�EDVLFV�RI�XVLQJ�D�KRRN��7KRXJK�WKH�PHFKDQLFV�RI�FUHDWLQJ�DQG�UHOHDVLQJ�D�KRRN�DUH�WKH�VDPH�UHJDUGOHVV�RI�KRRN�W\SH��HDFK�RI�WKH����W\SHV�RI�KRRN�IXQFWLRQV�DUH�YHU\�GLIIHUHQW�IURP�RQH�DQRWKHU��DQG�DOO�SOD\�XQLTXH�UROHV�ZLWKLQ�WKH�V\VWHP��,Q�3DUW�,,,�RI�WKLV�ERRN��,�KDYH�GHGLFDWHG�D�FKDSWHU�WR�HDFK�KRRN�IXQFWLRQ�WR�IXUWKHU�GLVFXVV�WKHLU�DSSOLFDWLRQ�DQG�RSHUDWLRQ���

������+RRN�6FRSH�

$�KRRN�FDQ�EH�LQVWDOOHG�WR�LQWHUFHSW�PHVVDJHV�IRU�RQH�WKUHDG�LQ�RQH�SURFHVV�RU�IRU�DOO�WKUHDGV�LQ�DOO�SURFHVVHV�UXQQLQJ�LQ�WKH�V\VWHP��7KH�VFRSH�RI�D�KRRN�GHSHQGV�RQ�ZKHUH�LW�UHVLGHV��LQ�DQ�DSSOLFDWLRQ�RU�D�'//��DQG�KRZ�LW�LV�FUHDWHG�ZLWK�WKH�6HW:LQGRZV+RRN([�$3,�IXQFWLRQ��7KH�WKLUG�DQG�IRXUWK�SDUDPHWHUV�RI�WKLV�IXQFWLRQ�GHWHUPLQH�WKH�VFRSH�RI�WKH�KRRN���

��������7KUHDG�VSHFLILF�

:KHQ�D�KRRN�RQO\�LQWHUFHSWV�PHVVDJHV�WKDW�SHUWDLQ�WR�D�VLQJOH�WKUHDG��WKH�KRRN�KDV�WKUHDG�VSHFLILF�VFRSH��7KHVH�KRRNV�FDQ�UHVLGH�LQ�D�'//�EXW�XVXDOO\�UHVLGH�LQ�WKH�DSSOLFDWLRQ��(;(���7KH�WKUHDG�VSHFLILF�KRRNV�ZH�ZLOO�EH�LQVWDOOLQJ�XVLQJ�9%�ZLOO�UHVLGH�LQ�WKH�DSSOLFDWLRQV�(;(�FRGH��QRW�LQ�D�'//��7KUHDG�VSHFLILF�KRRNV�PXVW�VHW�WKH�KPRG�SDUDPHWHU�RI�WKH�6HW:LQGRZV+RRN([�IXQFWLRQ�WR�]HUR��PHDQLQJ�WKDW�WKH�KRRN�ILOWHU�IXQFWLRQ�ZLOO�EH�ORFDWHG�

Page 86: Visual Basic - Subclassing and Hooking with VB & VB NET

ZLWKLQ�WKH�FRGH�UXQQLQJ�LQ�D�WKUHDG�LQVLGH�WKH�DSSOLFDWLRQ��7KH�GZ7KUHDG,G�SDUDPHWHU�LV�VHW�HTXDO�WR�WKH�WKUHDG�,'�RI�WKH�DSSOLFDWLRQ�WKDW�ZLOO�LQVWDOO�WKH�ILOWHU�IXQFWLRQ���+RRNV�WKDW�FDQ�KDYH�WKUHDG�VSHFLILF�VFRSH�DUH��

• :+B&$//:1'352&�• :+B&$//:1'352&5(7�• :+B&%7�• :+B'(%8*�• :+B)25(*5281','/(�• :+B*(70(66$*(�• :+B.(<%2$5'�• :+B0286(�• :+B06*),/7(5�• :+B6+(//�

��������6\VWHP�ZLGH�

+RRNV�WKDW�FDQ�LQWHUFHSW�PHVVDJHV�GLVSDWFKHG�WR�DOO�WKUHDGV�LQ�WKH�V\VWHP�DUH�FRQVLGHUHG�WR�KDYH�JOREDO�RU�V\VWHP�ZLGH�VFRSH��7KH�ILOWHU�IXQFWLRQV�IRU�WKHVH�W\SHV�RI�KRRNV�PXVW�EH�FRQWDLQHG�ZLWKLQ�D�:LQ���'//���7R�FUHDWH�D�V\VWHP�ZLGH�KRRN��6HW:LQGRZ+RRN([�LV�FDOOHG�ZLWK�WKH�KPRG�DUJXPHQW�VHW�WR�WKH�'//�KDQGOH�DQG�WKH�GZ7KUHDG,'�DUJXPHQW�VHW�WR�18//��6HWWLQJ�WKH�GZ7KUHDG,'�DUJXPHQW�WR�18//�LQIRUPV�WKH�V\VWHP�WKDW�WKLV�KRRN�VKRXOG�EH�LQVWDOOHG�IRU�HYHU\�WKUHDG�UXQQLQJ�LQ�HYHU\�SURFHVV��,I�WKLV�DUJXPHQW�LV�VHW�WR�D�YDOLG�WKUHDG�,'��WKH�V\VWHP�LQVWDOOV�D�KRRN�VSHFLILFDOO\�IRU�WKH�WKUHDG�KDYLQJ�WKLV�,'��:KHQ�WKH�V\VWHP�FUHDWHV�WKLV�KRRN��LW�LQMHFWV�RU�PDSV�WKH�'//�ZLWK�WKH�KDQGOH�IRXQG�LQ�WKH�KPRG�DUJXPHQW�LQWR�HYHU\�UXQQLQJ�SURFHVV�RQ�WKH�V\VWHP��7R�EH�PRUH�SUHFLVH��ZKHQ�WKH�V\VWHP�LV�DOHUWHG�WKDW�D�V\VWHP�ZLGH�ILOWHU�IXQFWLRQ�QHHGV�WR�EH�FDOOHG�IRU�WKH�ILUVW�WLPH�E\�D�WKUHDG��WKH�V\VWHP�ZLOO�GHWHUPLQH�LI�WKH�'//�FRQWDLQLQJ�WKH�KRRN�ILOWHU�IXQFWLRQ�KDV�EHHQ�PDSSHG�LQWR�WKH�SURFHVV�FRQWDLQLQJ�WKDW�WKUHDG��,I�LW�FDQQRW�EH�ORFDWHG��LW�LV�PDSSHG�LQWR�WKH�SURFHVV�DW�WKLV�SRLQW��7KLV�DOORZV�HDFK�SURFHVV�WR�KDYH�LWV�RZQ�PDSSLQJ�RI�WKH�KRRN�ILOWHU�IXQFWLRQ�FRGH�FRQWDLQHG�ZLWKLQ�WKH�'//���1RZ�WKDW�D�'//�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�WKDW�LV�UXQQLQJ�LQ�WKH�V\VWHP��ZH�KDYH�WKH�SUREOHP�RI�UHPRYLQJ�RU�XQPDSSLQJ�WKH�'//�IURP�HDFK�SURFHVV�VSDFH�ZKHQ�ZH�UHPRYH�WKH�KRRN��)RUWXQDWHO\��:LQGRZV�WDNHV�FDUH�RI�WKLV�IRU�XV�ZKHQ�8QKRRN:LQGRZV+RRN([�LV�FDOOHG��7KLV�IXQFWLRQ�LWHUDWHV�WKURXJK�HYHU\�SURFHVV�WKDW�LV�FXUUHQWO\�UXQQLQJ�LQ�WKH�V\VWHP�DQG�GHFUHPHQWV�WKH�ORFNV�KHOG�RQ�HDFK�'//�E\�RQH��,I�QR�RWKHU�UHVRXUFH�KROGV�D�ORFN�RQ�WKH�'//��LW�LV�DXWRPDWLFDOO\�XQPDSSHG�IURP�WKH�SURFHVV�VSDFH���$OO�KRRNV�FDQ�KDYH�V\VWHP�ZLGH�VFRSH��7KH�IROORZLQJ�KRRNV��KRZHYHU��FDQ�EH�XVHG�RQO\�DV�V\VWHP�ZLGH�KRRNV���

Page 87: Visual Basic - Subclassing and Hooking with VB & VB NET

• :+B-2851$/3/$<%$&.�• :+B-2851$/5(&25'�• :+B0286(B//�• :+B.(<%2$5'B//�• :+B6<606*),/7(5�

������:K\�'R�:H�8VH�+RRNV"�

+RRNV��OLNH�VXEFODVVLQJ��DUH�XVHG�WR�DXJPHQW�DSSOLFDWLRQV�ZLWK�IXQFWLRQDOLW\�WKDW�FDQW�EH�SURJUDPPHG�WKURXJK�VWDQGDUG�WHFKQLTXHV��,I�LW�ZHUH�QRW�IRU�KRRNV��VRPH�V\VWHP�IHDWXUHV�ZRXOG�EH�LQDFFHVVLEOH�WR�WKH�9%�SURJUDPPHU�DQG��WR�D�OHVVHU�H[WHQW��WR�WKH�9LVXDO�&���SURJUDPPHU���+RRNV�DOORZ�XV�WR�ZULWH�SURJUDPV�WKDW���

• 3URYLGH�IXQFWLRQ�NH\�VXSSRUW�WR�GLDORJ�ER[HV�ZLWKLQ�RXU�DSSOLFDWLRQ��LQFOXGLQJ�PHVVDJHV�ER[HV��ZKLFK�DUH�D�VSHFLDO�W\SH�RI�PRGDO�GLDORJ�ER[���

• 5HFRUG�DQG�SOD\�EDFN�PRXVH�DFWLRQV�DQG�NH\VWURNHV��VLPLODU�WR�WKH�PDFUR�UHFRUGHU�IRXQG�LQ�0LFURVRIW�([FHO�DQG�0LFURVRIW�:RUG���

• :DWFK�IRU�RQH�RU�PRUH�PHVVDJHV�ZLWKLQ�DQ�DSSOLFDWLRQ�RU�WKH�V\VWHP��DQG�DFW�RQ�MXVW�WKRVH�VSHFLILF�PHVVDJHV��3URJUDPV�RI�WKLV�W\SH��VXFK�DV�6S\����PDNH�H[WHQVLYH�XVH�RI�KRRNV���

• &%7�DSSOLFDWLRQV�ZRXOG�EH�GLIILFXOW��LI�QRW�LPSRVVLEOH��WR�FUHDWH�ZLWKRXW�XVLQJ�VSHFLDO�KRRNV�GHVLJQHG�IRU�&%7�DSSOLFDWLRQV���

• $XWRPDWHG�WHVWLQJ�DSSOLFDWLRQV�DUH�DQRWKHU�W\SH�RI�DSSOLFDWLRQ�WKDW�XVHV�PDQ\�RI�WKH�KRRNV�LQ�:LQGRZV���

• 6XEFODVVLQJ�D�ZLQGRZ�LQ�DQRWKHU�SURFHVV�FDQ�EH�PLPLFNHG�E\�XVLQJ�KRRNV���

$V�\RX�FDQ�VHH��WKHUH�DUH�PDQ\�JRRG�XVHV�IRU�KRRNV���

������'HFLGLQJ�%HWZHHQ�+RRNLQJ�RU�6XEFODVVLQJ�

:KHQ�GHFLGLQJ�ZKHWKHU�WR�LPSOHPHQW�VXEFODVVLQJ�RU�KRRNLQJ��WKHUH�DUH�PDQ\�IDFWRUV�WR�FRQVLGHU��(DFK�WHFKQLTXH�KDV�LWV�RZQ�SURV�DQG�FRQV��2QH�RI�WKH�PDLQ�IDFWRUV�WR�FRQVLGHU�LV�SHUIRUPDQFH��$�V\VWHP�ZLGH�KRRN�LV�WKH�ZRUVW�RIIHQGHU��7KHUH�DUH�WZR�ELJ�SHUIRUPDQFH�GHWUDFWRUV�IRU�WKLV�W\SH�RI�KRRN��7KH�ILUVW�LV�WKDW�WKH�KRRN�ZLOO�LQFXU�SURFHVVLQJ�RYHUKHDG�IRU�HDFK�DSSOLFDWLRQ�LQ�WKH�V\VWHP��UHJDUGOHVV�RI�ZKHWKHU�WKH�DSSOLFDWLRQ�PDNHV�XVH�RI�WKH�KRRN��5HPHPEHU��WKH�'//�FRQWDLQLQJ�WKH�KRRN�IXQFWLRQ�LV�LQMHFWHG�LQWR�HYHU\�UXQQLQJ�SURFHVV�RQ�WKH�V\VWHP��7KH�VHFRQG�SUREOHP�LV�WKDW�D�V\VWHP�ZLGH�KRRN�ZLOO�VHULDOL]H�DOO�PHVVDJHV�WKDW�SHUWDLQ�WR�WKH�VSHFLILF�KRRN��7KLV�PHDQV�WKDW�LQVWHDG�RI�PHVVDJHV�JRLQJ�GLUHFWO\�LQWR�WKH�PHVVDJH�TXHXHV��WKH\�DUH�ILUVW�URXWHG�WKURXJK�WKH�LQVWDOOHG�KRRNV�ILOWHU�IXQFWLRQ��ZKLFK�

Page 88: Visual Basic - Subclassing and Hooking with VB & VB NET

UHVLGHV�LQ�WKH�'//��7KHVH�PHVVDJHV�SDVV�WKURXJK�WKH�'//�LQ�D�VHULDOL]HG�IDVKLRQ��RQH�DIWHU�WKH�RWKHU���7KUHDG�VSHFLILF�KRRNV�FDQ�EH�VHULRXV�RIIHQGHUV�DV�ZHOO��EXW�WKH�SHUIRUPDQFH�KLW�LV�DERXW�WKH�VDPH�DV�ZLWK�VXEFODVVLQJ��7KLV�LV�EHFDXVH�ERWK�WHFKQLTXHV�LQYROYH�FDSWXULQJ�PHVVDJHV�IRU�RQO\�RQH�SDUWLFXODU�WKUHDG��7KLV�SODFHV�VLJQLILFDQWO\�OHVV�VWUHVV�RQ�WKH�V\VWHP�WKDQ�FDSWXULQJ�PHVVDJHV�IRU�HYHU\�UXQQLQJ�WKUHDG�LQ�WKH�V\VWHP��,QVWDQFH�VXEFODVVLQJ�RIIHUV�WKH�EHVW�SHUIRUPDQFH�RI�WKH�YDULRXV�WHFKQLTXHV�EHFDXVH�RQO\�PHVVDJHV�IRU�D�VLQJOH�ZLQGRZ�DUH�FDSWXUHG���7DEOH�����DQG�7DEOH�����GHWDLO�WKH�PDLQ�SURV�DQG�FRQV�RI�XVLQJ�KRRNV�DQG�VXEFODVVLQJ���

7DEOH������3URV�DQG�&RQV�RI�8VLQJ�+RRNV��3URV� &RQV�

$OORZV�9%�DFFHVV�WR�PRUH�SRZHUIXO�IXQFWLRQDOLW\�QRW�RWKHUZLVH�DYDLODEOH���

'HJUDGHV�SHUIRUPDQFH�PRUH�WKDQ�VXEFODVVLQJ��

&DQ�RSHUDWH�RQ�D�VLQJOH�ZLQGRZ�LQ�D�SURFHVV��6\VWHP�ZLGH�KRRNV�PXVW�EH�SODFHG�LQ�D�:LQ���'//��ZKLFK�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�ZKLFK�FDOOV�WKH�KRRN�ILOWHU�IXQFWLRQ���

&DQ�RSHUDWH�RQ�PXOWLSOH�ZLQGRZV�LQ�PXOWLSOH�SURFHVVHV���

7KH�:LQ���'//�XVHG�LQ�V\VWHP�ZLGH�KRRNLQJ�FDQQRW�EH�IRUFLEO\�UHPRYHG�IURP�HDFK�SURFHVV�DIWHU�WKH�KRRN�LV�XQLQVWDOOHG���

)LIWHHQ�GLIIHUHQW�W\SHV�RI�KRRNV�FDQ�EH�XWLOL]HG��,I�D�SUHFHGLQJ�KRRN�GRHV�QRW�SDVV�D�PHVVDJH�DORQJ�WR�\RXU�KRRN��LW�ZLOO�QHYHU�NQRZ�WKDW�WKH�PHVVDJH�ZDV�VHQW���

0RUH�WKDQ�RQH�ILOWHU�IXQFWLRQ�FDQ�EH�LQVWDOOHG�IRU�D�VLQJOH�KRRN�� �

,W�LV�SRVVLEOH�WR��LQ�HIIHFW��VXEFODVV�D�ZLQGRZ�LQ�D�VHSDUDWH�SURFHVV�E\�XVLQJ�WKH�:+B*(70(66$*(�KRRN���

7DEOH������3URV�DQG�&RQV�RI�8VLQJ�6XEFODVVLQJ��3URV� &RQV�

$OORZV�9%�DFFHVV�WR�PRUH�SRZHUIXO�IXQFWLRQDOLW\�QRW�RWKHUZLVH�DYDLODEOH��� &DQ�RSHUDWH�RQO\�RQ�ZLQGRZV�ZLWKLQ�D�VLQJOH�SURFHVV��

$UH�OHVV�RI�D�EXUGHQ�RQ�WKH�V\VWHP�WKDQ�KRRNV�� &DQ�SRVVLEO\�GHJUDGH�SHUIRUPDQFH��

$�VLQJOH�ZLQGRZ�FDQ�EH�VXEFODVVHG�PXOWLSOH�WLPHV��

,I�FULWLFDO�PHVVDJHV�DUH�QRW�SDVVHG�EDFN�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��WKH�DSSOLFDWLRQ�PLJKW�VHHP�DV�LI�LW�LV�IUR]HQ���

0XOWLSOH�ZLQGRZV�RI�WKH�VDPH�FODVV� 0XOWLSOH�ZLQGRZV�KDYLQJ�GLIIHUHQW�FODVVHV�FDQQRW�EH�

Page 89: Visual Basic - Subclassing and Hooking with VB & VB NET

FDQ�EH�VXEFODVVHG�ZLWK�D�VLQJOH�FDOO�WR�6HW&ODVV/RQJ3WU���

VXEFODVVHG�ZLWK�D�VLQJOH�FDOO�WR�6HW&ODVV/RQJ3WU��WKLV�IXQFWLRQ�PXVW�EH�FDOOHG�VHSDUDWHO\�IRU�HDFK�FODVV���

$�VLQJOH�FODVV�FDQ�EH�VXEFODVVHG�XVLQJ�JOREDO�VXEFODVVLQJ�RU�VXSHUFODVVLQJ���

5HJDUGOHVV�RI�KRZ�VRXQG�\RXU�FKRLFH�RI�WHFKQLTXH��WKRXJK��EDGO\�ZULWWHQ�FRGH�ZLOO�FDXVH�DQ\�RI�WKHVH�WHFKQLTXHV�WR�JUHDWO\�GHJUDGH�SHUIRUPDQFH��(DFK�RI�WKH�FKDSWHUV�LQ�3DUW�,,�DQG�3DUW�,,,�DOVR�ZLOO�VKRZ�ZKHUH�SHUIRUPDQFH�FDQ�EH�DIIHFWHG�E\�LQFRUUHFWO\�RU�SRRUO\�ZULWWHQ�FRGH���

Page 90: Visual Basic - Subclassing and Hooking with VB & VB NET

3DUW�,,��6XEFODVVLQJ�DQG�6XSHUFODVVLQJ�,Q�WKLV�VHFWLRQ��ZHOO�H[SORUH�WHFKQLTXHV�IRU�VXEFODVVLQJ�ZLQGRZV��GLDORJ�ER[HV��DQG�$FWLYH;�FRQWUROV��,Q�DGGLWLRQ��ZHOO�H[SORUH�WKH�UHODWHG�WHFKQLTXH�RI�VXSHUFODVVLQJ��)LQDOO\��EHFDXVH�VXEFODVVHG�DQG�VXSHUFODVVHG�DSSOLFDWLRQV�DUH�RIWHQ�XQVWDEOH�EHFDXVH�RI�WKH�GHYHORSHUV�IDLOXUH��IRU�ZKDWHYHU�UHDVRQ��WR�IROORZ�DOO�WKH�UXOHV�RI�VXEFODVVLQJ�DQG�VXSHUFODVVLQJ��ZHOO�H[DPLQH�WHFKQLTXHV�IRU�GHEXJJLQJ�DQ�DSSOLFDWLRQ�DQG�GHWHFWLQJ�ZKDW�LV�FDXVLQJ�WKH�DSSOLFDWLRQ�WR�EHKDYH�LQ�XQLQWHQGHG�ZD\V���

Page 91: Visual Basic - Subclassing and Hooking with VB & VB NET
Page 92: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU����6XEFODVVLQJ�7KLV�FKDSWHU�WDNHV�\RX�GHHSHU�LQWR�WKH�VXEMHFW�RI�VXEFODVVLQJ��VWDUWLQJ�RII�ZLWK�D�GLVFXVVLRQ�RI�WKH�$GGUHVV2I�RSHUDWRU��$�IDLU�DPRXQW�RI�GLVFXVVLRQ�LV�JLYHQ�WR�WKLV�RSHUDWRU�EHFDXVH�LW�SOD\V�D�SLYRWDO�UROH�LQ�XVLQJ�9LVXDO�%DVLF��9%��WR�VXEFODVV�ZLQGRZV��3UHVHQWHG�QH[W�ZLOO�EH�WKH�WZR�W\SHV�RI�VXEFODVVLQJ����LQVWDQFH�DQG�JOREDO�VXEFODVVLQJ��7KHLU�VLPLODULWLHV��GLIIHUHQFHV��DQG�DSSOLFDWLRQV�DUH�GLVFXVVHG�DW�OHQJWK��&RGH�H[DPSOHV�ZLOO�EH�SUHVHQWHG�IRU�ERWK�W\SHV�RI�VXEFODVVLQJ��7KHVH�H[DPSOHV�DUH�PHDQW�WR�EH�IRU�LOOXVWUDWLRQ�RQO\��VXFK�WKLQJV�DV�HUURU�KDQGOLQJ�FRGH�ZLOO�EH�RPLWWHG�IRU�FODULW\���$V�ZH�SURJUHVV�WKURXJK�WKLV�FKDSWHU�,�ZLOO�EH�SODFLQJ�WKH�NH\�SRLQWV�DQG�UXOHV�RI�VXEFODVVLQJ�LQ�EROG�W\SH��7KHVH�SRLQWV�DQG�UXOHV�ZLOO�EH�VXPPDUL]HG�DW�WKH�FRQFOXVLRQ�RI�WKH�FKDSWHU���

����7KH�$GGUHVV2I�2SHUDWRU�

7KH�$GGUHVV2I�RSHUDWRU��ILUVW�LQWURGXFHG�LQ�9HUVLRQ���RI�9%��JDYH�GHYHORSHUV�OLPLWHG�DFFHVV�WR�SRLQWHUV��D�IHDWXUH�WKDW�9%�HIIHFWLYHO\�KLGHV�IURP�WKHP�EXW�WKDW�LV�HVVHQWLDO�WR�KLJK�HQG�GHYHORSPHQW�HQYLURQPHQWV�VXFK�DV�9LVXDO�&����7KH�$GGUHVV2I�RSHUDWRU�JUHDWO\�LQFUHDVHV�WKH�SRWHQWLDO�RI�D�9%�DSSOLFDWLRQ��$V�ZH�VKDOO�VHH��WKRXJK��WKHUH�DUH�DOZD\V�EXPSV�LQ�WKH�URDG�ZKHQ�LPSOHPHQWLQJ�PRUH�DGYDQFHG�IXQFWLRQDOLW\��DQG�$GGUHVV2I�KDV�VHYHUDO�RI�WKHP���$GGUHVV2I�SURYLGHV�WKH�9%�GHYHORSHU�ZLWK�D�VLPSOH�ZD\�RI�XVLQJ�IXQFWLRQ�SRLQWHUV�ZLWKRXW�UHO\LQJ�RQ�DQRWKHU�ODQJXDJH��$�IXQFWLRQ�SRLQWHU�LV�VLPSO\�D�YDULDEOH�WKDW�FRQWDLQV�WKH�PHPRU\�ORFDWLRQ�RI�D�VLQJOH�IXQFWLRQ��,Q�RWKHU�ZRUGV��WKLV�YDULDEOH�SRLQWV�WR�D�IXQFWLRQ��1RZ��LQVWHDG�RI�KDYLQJ�WR�XVH�WKH�IXQFWLRQ�QDPH�WR�FDOO�WKH�IXQFWLRQ��ZH�FDQ�LQVWHDG�XVH�WKH�IXQFWLRQ�SRLQWHU�WR�FDOO�WKH�IXQFWLRQ���$�FDOOEDFN�RU�FDOOEDFN�IXQFWLRQ�LV�WKH�IXQFWLRQ�ZKLFK�WKH�IXQFWLRQ�SRLQWHU�UHIHUHQFHV��&RGH�WKDW�UHFHLYHV�D�IXQFWLRQ�SRLQWHU�FDQ�XVH�LW�WR�FDOO�EDFN��KHQFH�WKH�QDPH��FDOOEDFN���WR�WKDW�IXQFWLRQ��8VXDOO\��WKHVH�FDOOEDFN�IXQFWLRQV�DUH�VPDOO�LQ�VL]H�EHFDXVH�WKH\�PLJKW�EH�FDOOHG�PDQ\�WLPHV�SHU�VHFRQG�DQG�DIIHFW�DSSOLFDWLRQ�SHUIRUPDQFH���)XQFWLRQ�SRLQWHUV�DQG�FDOOEDFN�IXQFWLRQV�DUH�PDLQO\�XVHG�IRU�DV\QFKURQRXV�SURFHVVLQJ�DQG�ZLWK�WKH�HQXPHUDWLRQ�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IXQFWLRQV��(QXP:LQGRZV��(QXP&KLOG:LQGRZV��DQG�(QXP'HVNWRS:LQGRZV�DUH�MXVW�VRPH�RI�:LQGRZV�HQXPHUDWLRQ�$3,�IXQFWLRQV��7KHVH�IXQFWLRQV�HDFK�WDNH�D�IXQFWLRQ�SRLQWHU�LQ�WKHLU�DUJXPHQW�OLVW��7KLV�IXQFWLRQ�SRLQWHU�LV�XVHG�WR�LQYRNH�D�FDOOEDFN�IXQFWLRQ�IRU�HDFK�LWHP����D�ZLQGRZ��LQ�WKLV�FDVH����IRXQG�E\�WKH�$3,�IXQFWLRQ��:HOO�ORRN�DW�VRPH�H[DPSOHV�RI�HQXPHUDWLRQ�IXQFWLRQV�DQG�DV\QFKURQRXV�SURFHVVLQJ�ODWHU�LQ�WKLV�VHFWLRQ���

������8VLQJ�$GGUHVV2I�

Page 93: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�UXOHV�GHILQLQJ�KRZ�$GGUHVV2I�PXVW�EH�XVHG�JUHDWO\�OLPLW�LWV�IXQFWLRQDOLW\�DQG�PDNH�LW�IDU�OHVV�SRZHUIXO�WKDQ�PDQ\�9%�GHYHORSHUV�KDG�RULJLQDOO\�KRSHG��,W�VHHPV�WKDW�0LFURVRIWV�SODQV�IRU�LQWURGXFLQJ�9%�GHYHORSHUV�WR�IXQFWLRQ�SRLQWHUV�ZDV�SULPDULO\�PHDQW�WR�DOORZ�DFFHVV�WR�:LQGRZV�$3,�IXQFWLRQV�WKDW�ZHUH�SUHYLRXVO\�XQXVDEOH��*UHDW��EXW�ZKDW�DERXW�XVLQJ�IXQFWLRQ�SRLQWHUV�ZLWKLQ�D�SXUH�9%�DSSOLFDWLRQ"�%\�WKLV�,�PHDQ�FDOOLQJ�D�9%�IXQFWLRQ�DQG�SDVVLQJ�LW�D�IXQFWLRQ�SRLQWHU�XVLQJ�$GGUHVV2I��7KLV�FDOOHG�IXQFWLRQ�ZRXOG�DFFHSW�WKH�IXQFWLRQ�SRLQWHU�DQG�XVH�LW�WR�GLUHFWO\�FDOO�D�FDOOEDFN�IXQFWLRQ��7KH�DQVZHU�LV�WKDW�$GGUHVV2I�FDQQRW�EH�XVHG�LQ�WKLV�PDQQHU��'LVDSSRLQWLQJ��\HV��EXW�ZH�VWLOO�KDYH�WKH�XVH�RI�PDQ\�$3,�IXQFWLRQV�WKDW�ZHUH�SUHYLRXVO\�XQXVDEOH���7KHUH�DUH�VHYHUDO�RWKHU�OLPLWDWLRQV�DQG�SUREOHPV�WR�ZDWFK�RXW�IRU�ZKHQ�XVLQJ�$GGUHVV2I�LQ�\RXU�DSSOLFDWLRQV��$GGUHVV2I�PXVW�EH�SODFHG�LPPHGLDWHO\�EHIRUH�D�IXQFWLRQ�QDPH�LQ�DQ�DUJXPHQW�OLVW�IRU�D�FDOOHG�IXQFWLRQ��)RU�H[DPSOH���&DOO�'//)XQFWLRQ�KZQG�����$GGUHVV2I�9%&DOOEDFN)XQFWLRQ��7KLV�DUJXPHQW�PXVW�EH�WKH�QDPH�RI�D�SUHYLRXVO\�GHILQHG�IXQFWLRQ��%HFDXVH�DQ\�NLQG�RI�SRLQWHU�LV�XVHOHVV�RXWVLGH�RI�WKH�SURFHVV�WKDW�FUHDWHG�LW��LW�PDNHV�VHQVH�WKDW�WKH�IXQFWLRQ�WKDW�$GGUHVV2I�SUHFHGHV�PXVW�EH�LQ�WKH�VDPH�SURFHVV���$GGUHVV2I�FDQ�EH�XVHG�RQO\�ZLWK�9%�IXQFWLRQV��VXEV��DQG�SURSHUWLHV��<RX�FDQQRW�XVH�LW�WR�JHW�D�SRLQWHU�WR�DQ�$3,�IXQFWLRQ�WKDW�\RX�KDYH�GHFODUHG�LQ�\RXU�FRGH�XVLQJ�WKH�'HFODUH�VWDWHPHQW��)RU�H[DPSOH��\RX�FDQQRW�GR�WKH�IROORZLQJ���5HW9DO� �(QXP:LQGRZV�$GGUHVV2I�(QXP&KLOG:LQGRZV�����(QXP&KLOG:LQGRZV�LV�D�:LQGRZV�GHILQHG�$3,�IXQFWLRQ��QRW�D�9%�IXQFWLRQ��VXE��RU�SURSHUW\��7KLV�ZLOO�FDXVH�DQ�HUURU�ZKHQ�FRPSLOLQJ�\RXU�DSSOLFDWLRQ���,W�ZRXOG�EH�QLFH�LI�WKH�IXQFWLRQ�ZKRVH�SRLQWHU�ZH�SDVV�XVLQJ�WKH�$GGUHVV2I�RSHUDWRU�FRXOG�UHVLGH�DQ\ZKHUH�LQ�RXU�9%�DSSOLFDWLRQ��EXW�XQIRUWXQDWHO\��WKLV�LV�QRW�SHUPLWWHG���,W�LV�DOVR�LPSRUWDQW�WKDW�DQ\�IXQFWLRQ�WKDW�LV�SDVVHG�D�IXQFWLRQ�SRLQWHU�NQRZV�H[DFWO\�KRZ�WR�FDOO�WKH�FDOOEDFN�IXQFWLRQ��7KH�SDUDPHWHU�OLVWV�RI�WKH�FDOOEDFN�IXQFWLRQ�DQG�WKH�FRGH�WKDW�ZLOO�EH�FDOOLQJ�LW�PXVW�PDWFK�H[DFWO\�LQ�QXPEHU�DQG�LQ�W\SH���3HUKDSV�WKH�PRVW�VLJQLILFDQW�OLPLWDWLRQ�RI�XVLQJ�FDOOEDFNV�LV�WKDW�WKH�IXQFWLRQ�SRLQWHG�WR�E\�WKH�$GGUHVV2I�RSHUDWRU�PXVW�UHVLGH�LQ�D�FRGH��%$6��PRGXOH��UDWKHU�WKDQ�D�IRUP��)50��RU�FODVV��&/6��PRGXOH��2I�FRXUVH��ZH�FDQ�FDOO�IXQFWLRQV�ZLWKLQ�WKH�&/6�RU�)50�ILOHV�IURP�WKH�FDOOEDFN�LQ�WKH�%$6�PRGXOH��EXW�RXU�SUREOHP�UHPDLQV�WKDW�ZH�FDQQRW�FOHDQO\�SDFNDJH�RXU�FDOOEDFN�IXQFWLRQ�LQWR�DQ�REMHFW���

�&DOOEDFN�IXQFWLRQV��LQFOXGLQJ�VXEFODVVHG�ZLQGRZ�SURFHGXUHV��PXVW�UHVLGH�LQ�D�%$6�PRGXOH����

<RX�PLJKW�ZRQGHU�ZK\�WKLV�OLPLWDWLRQ�H[LVWV��)50�DQG�&/6�PRGXOHV�DUH�FRQVLGHUDEO\�GLIIHUHQW�IURP�%$6�PRGXOHV��RQO\�RQH�FRS\�RI�WKH�GDWD�LQ�D�%$6�PRGXOH�LV�VWRUHG�LQ�WKH�DSSOLFDWLRQV�SURFHVV�VSDFH��ZKLOH�)50�DQG�&/6�PRGXOH�GDWD�FDQ�EH�LQVWDQWLDWHG�PXOWLSOH�WLPHV��ZLWK�HDFK�

Page 94: Visual Basic - Subclassing and Hooking with VB & VB NET

FRS\�RI�WKH�REMHFW�KDYLQJ�LWV�RZQ�GDWD��$ORQJ�ZLWK�LQVWDQWLDWLQJ�D�)50�RU�&/6�PRGXOH��\RX�DOVR�FDQ�GHVWUR\�LW�E\�VHWWLQJ�LW�WR�HTXDO�1RWKLQJ��DV�IROORZV���6HW�&2EM� �1RWKLQJ�7KLV��LQ�HIIHFW��UHPRYHV�DOO�WUDFHV�RI�WKDW�LQVWDQFH�RI�WKH�REMHFW�IURP�WKH�SURFHVVV�DGGUHVV�VSDFH��7KLQN�KRZ�PXFK�WURXEOH�ZH�FRXOG�JHW�RXUVHOYHV�LQWR�LI�ZH�GHVWUR\HG�DQ�REMHFW�WKDW�FRQWDLQHG�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�EHIRUH�ZH�KDG�UHSODFHG�LW�ZLWK�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��7KH�UHVXOWV�ZRXOG�EH�GLVDVWURXV��6LPLODU�SUREOHPV�ZRXOG�DULVH�LI�ZH�WULHG�WR�XVH�6HW:LQGRZ/RQJ3WU�WR�LQVHUW�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�IURP�DQ�REMHFW�WKDW�KDG�QRW�EHHQ�FUHDWHG���:LWKLQ�WKH�%$6�PRGXOH��WKH�FDOOEDFN�SURFHGXUHV�VKRXOG�EH�GHILQHG�DV�3XEOLF��$�SXEOLF�IXQFWLRQ�LQ�D�%$6�PRGXOH�LV�DOZD\V�YLVLEOH�IURP�DQ\ZKHUH�LQ�WKH�DSSOLFDWLRQ��$�SXEOLF�IXQFWLRQ�LQ�D�)50�RU�&/6�PRGXOH�LV�RQO\�YLVLEOH�ZKHQ�\RX�KDYH�VXFFHVVIXOO\�FUHDWHG�DQ�REMHFW�YDULDEOH�UHIHUHQFLQJ�WKDW�REMHFW��)50�RU�&/6�PRGXOH����

�'HILQH�D�FDOOEDFN�IXQFWLRQ��LQFOXGLQJ�D�VXEFODVVHG�ZLQGRZ�SURFHGXUH��DV�3XEOLF����

7KHUH�LV�RQH�ODVW�SUREOHP�ZLWK�DOO�RZLQJ�FDOOEDFN�IXQFWLRQV�WR�UHVLGH�LQ�)50�RU�&/6�PRGXOHV��WKH\�XVH�YWDEOHV�WR�JHW�WR�WKHLU�IXQFWLRQV��$�)50�RU�&/6�PRGXOH�LV�EDVLFDOO\�D�&RPSRQHQW�2EMHFW�0RGHO��&20��REMHFW����WKDW�LV��WKH\�DGKHUH�WR�WKH�&20�VWDQGDUGV��7KLV�PHDQV�WKDW�DQ�H[WUD�OHYHO�RI�DEVWUDFWLRQ�H[LVWV�WR�JHW�WR�WKDW�REMHFWV�SXEOLF�IXQFWLRQV��%$6�PRGXOHV��EHFDXVH�WKH\�DUH�QRW�&20�REMHFWV��GR�QRW�KDYH�WKLV�H[WUD�OD\HU�RI�DEVWUDFWLRQ��DQG�WKHUHIRUH�WKHLU�SXEOLF�IXQFWLRQV�DUH�GLUHFWO\�DFFHVVLEOH�IURP�DQ\ZKHUH�LQ�WKH�DSSOLFDWLRQV�FRGH���)LQDOO\��LWV�LPSRUWDQW�WR�XQGHUVWDQG�WKDW��ZKHQ�\RX�SDVV�D�IXQFWLRQ�SRLQWHU�XVLQJ�$GGUHVV2I��\RX�DUH�DUUDQJLQJ�IRU�VRPH�URXWLQH��XVXDOO\�D�IXQFWLRQ�LQ�WKH�:LQ���$3,��WKDWV�H[WHUQDO�WR�\RXU�DSSOLFDWLRQ�WR�WHPSRUDULO\�SDVV�IORZ�FRQWURO�WR�D�URXWLQH�LQ�\RXU�RZQ�DSSOLFDWLRQ��WKDW�LV��WR�WKH�FDOOEDFN�IXQFWLRQ���%HFDXVH�IURP�\RXU�SRLQW�RI�YLHZ�WKLV�H[WHUQDO�URXWLQH�LV�D�EODFN�ER[�WKDWV�EH\RQG�\RXU�FRQWURO��\RX�VKRXOG�QRW�UDLVH�DQ\�HUURUV�LQ�WKH�FDOOEDFN�IXQFWLRQ�WKDW�DUH�SURSDJDWHG�EDFN�WR�WKH�FDOOLQJ�URXWLQH��<RX�VKRXOG�XVH�2Q�(UURU�5HVXPH�1H[W�WR�E\SDVV�WKH�HUURU��,I�QHFHVVDU\��\RX�FDQ�FKHFN�WKH�(UU�REMHFW�WR�VHH�LI�DQ�HUURU�KDV�EHHQ�UDLVHG�ZKLOH�VWLOO�LQVLGH�WKH�9%�FDOOEDFN�IXQFWLRQ��,I�RQH�KDV�EHHQ�UDLVHG��\RX�VKRXOG�KDQGOH�LW�LPPHGLDWHO\��FOHDU�WKH�HUURU��DQG�FRQWLQXH�RQ���

�8VH�2Q�(UURU�5HVXPH�1H[W�IRU�HUURU�KDQGOLQJ�LQ�WKH�FDOOEDFN�IXQFWLRQ����

������&DOOEDFNV�DQG�(QXPHUDWLRQ�)XQFWLRQV�

Page 95: Visual Basic - Subclassing and Hooking with VB & VB NET

7R�VHH�KRZ�FDOOEDFN�IXQFWLRQV�ZRUN�ZLWK�WKH�:LQ���HQXPHUDWLRQ�IXQFWLRQV��OHWV�XVH�(QXP&KLOG:LQGRZV�LQ�D�VLPSOH�H[DPSOH��(QXP&KLOG:LQGRZV�LV�GHFODUHG�LQ�9%�LQ�WKH�IROORZLQJ�PDQQHU���3XEOLF�'HFODUH�)XQFWLRQ�(QXP&KLOG:LQGRZV�/LE��XVHU����$OLDV��(QXP&KLOG:LQGRZV��B�� � �%\9DO�K:QG3DUHQW�$V�/RQJ��%\9DO�OS(QXP)XQF�$V�/RQJ��B�� � %\9DO�O3DUDP�$V�/RQJ��$V�/RQJ��,WV�SDUDPHWHUV�DUH��K:QG3DUHQW

7KH�KDQGOH�WR�WKH�SDUHQW�ZLQGRZ�ZKRVH�FKLOG�ZLQGRZV�ZH�ZDQW�WR�HQXPHUDWH��OS(QXP)XQF

$�SRLQWHU�WR�D�FDOOEDFN�IXQFWLRQ�O3DUDP

$Q\�RWKHU�GDWD�WKDW�QHHGV�WR�EH�VHQW�WR�WKH�FDOOEDFN�IXQFWLRQ�7R�XVH�WKLV�IXQFWLRQ��D�FDOOEDFN�SURFHGXUH�QHHGV�WR�EH�ZULWWHQ��7KH�FDOOEDFN�IXQFWLRQ�IRU�WKLV�H[DPSOH�ZLOO�EH�FDOOHG�(QXP3URF��7KH�GRFXPHQWDWLRQ�IRU�(QXP&KLOG:LQGRZV�DOVR�GHVFULEHV�WKLV�FDOOEDFN�IXQFWLRQ�LQ�GHWDLO��,W�PXVW�KDYH�WKH�SURWRW\SH���3XEOLF�)XQFWLRQ�(QXP3URF�%\9DO�K:QG�$V�/RQJ��O3DUDP�$V�/RQJ��$V�/RQJ�7KLV�IXQFWLRQ�WDNHV�WZR�DUJXPHQWV��7KH�ILUVW��K:QG��LV�D�KDQGOH�WR�D�ZLQGRZ�LQ�WKH�HQXPHUDWLRQ�OLVW��7KH�VHFRQG�DUJXPHQW�LV�O3DUDP��ZKLFK�UHFHLYHV�D�GHYHORSHU�GHILQHG�YDOXH��%HFDXVH�LW�LV�SDVVHG�E\�UHIHUHQFH��WKLV�YDOXH�DOVR�LV�SDVVHG�EDFN�WR�WKH�FDOOLQJ�URXWLQH��8VLQJ�WKLV�DUJXPHQW��RQH�FDQ�SDVV�LQIRUPDWLRQ�LQWR�DQG�RXW�RI�WKLV�FDOOEDFN�IXQFWLRQ��7R�FRQWLQXH�HQXPHUDWLQJ�ZLQGRZV��WKLV�IXQFWLRQ�VKRXOG�UHWXUQ�758(��WR�VWRS�HQXPHUDWLQJ�WKHP��LW�VKRXOG�UHWXUQ�)$/6(��7KXV��D�YHU\�VLPSOH�(QXP3URF�FDOOEDFN�IXQFWLRQ�DSSHDUV�DV�IROORZV���3XEOLF�)XQFWLRQ�(QXP3URF�%\9DO�K:QG�$V�/RQJ��O3DUDP�$V�/RQJ��$V�/RQJ�� 'R�ZRUN�KHUH��� (QXP3URF� �7UXH��������(QG�)XQFWLRQ�1RZ�WKDW�ZH�KDYH�D�FDOOEDFN�IXQFWLRQ��ZH�FDQ�ZULWH�WKH�FRGH�WR�FDOO�WKH�(QXP&KLOG:LQGRZV�IXQFWLRQ��7KH�ILUVW�DUJXPHQW�WR�WKLV�IXQFWLRQ�LV�$GGUHVV2I�(QXP3URF��7KLV�HYDOXDWHV�WR�D�IXQFWLRQ�SRLQWHU��ZKLFK�SRLQWV�WR�WKH�(QXP3URF�IXQFWLRQ��7KH�VHFRQG�DUJXPHQW�LV�]HUR��ZKLFK�LV�SDVVHG�LQ�WR�WKH�O3DUDP�DUJXPHQW�IRU�WKH�(QXP3URF�IXQFWLRQ���6XE�0DLQ������ 5HW9DO� �(QXP&KLOG:LQGRZV�$GGUHVV2I�(QXP3URF�����(QG�6XE�:KHQ�WKLV�SURJUDP�LV�UXQ�LW�ZLOO�FDOO�(QXP&KLOG:LQGRZV��7KLV�IXQFWLRQ��LQ�WXUQ��FDOOV�WKH�(QXP3URF�FDOOEDFN�IXQFWLRQ�RQFH�IRU�HYHU\�WRS�OHYHO�ZLQGRZ�FXUUHQWO\�UXQQLQJ�LQ�WKH�V\VWHP��:KHQ�(QXP:LQGRZV�LV�ILQLVKHG�SURFHVVLQJ��LW�UHWXUQV�FRQWURO�WR�WKH�0DLQ�IXQFWLRQ���

������&DOOEDFNV�DQG�$V\QFKURQRXV�3URFHVVLQJ�

Page 96: Visual Basic - Subclassing and Hooking with VB & VB NET

$V\QFKURQRXV�SURFHVVLQJ�LV�GLIIHUHQW�IURP�DQ�HQXPHUDWLRQ�IXQFWLRQ��$V\QFKURQRXV�SURFHVVLQJ�DOORZV�FRGH�LQ�WKH�PDLQ�DSSOLFDWLRQ�WR�FDOO�D�IXQFWLRQ�DQG�WKHQ�LPPHGLDWHO\�UHWXUQ�DQG�FRQWLQXH�H[HFXWLRQ�RI�WKH�PDLQ�DSSOLFDWLRQV�FRGH�EHIRUH�WKH�IXQFWLRQV�FRGH�KDV�ILQLVKHG�SURFHVVLQJ��:LWK�LW�\RX�FDQ�ZULWH�FRGH�WKDW�DOORZV�D�XVHU�WR�SHUIRUP�VRPH�WLPH�FRQVXPLQJ�WDVN��VXFK�DV�VRUWLQJ�D�ODUJH�DPRXQW�RI�LQIRUPDWLRQ��DQG�WKH�XVHU�ZLOO�EH�DEOH�WR�FRQWLQXH�XVLQJ�WKH�VDPH�DSSOLFDWLRQ�ZLWKRXW�ZDLWLQJ�IRU�WKH�VRUWLQJ�WR�ILQLVK��7KLV�JLYHV�WKH�XVHU�WKH�LOOXVLRQ�RI�D�IDVW�DSSOLFDWLRQ�HYHQ�WKRXJK�WKH�VRUWLQJ�PLJKW�WDNH�TXLWH�VRPH�WLPH���$�FDOOEDFN�IXQFWLRQ�FDQ�EH�FDOOHG�GXULQJ�WKH�VRUWLQJ�SURFHVV�WR�GHWHUPLQH�LI�WKH�XVHU�KDV�FDQFHOHG�WKH�DFWLRQ��,Q�SURFHVVLQJ�LQYROYLQJ�ODUJH�QHVWHG�ORRSV��\RX�FDQ�XVH�D�IXQFWLRQ�SRLQWHU�WR�FDOO�D�FDOOEDFN�IXQFWLRQ��ZKLFK�GHWHUPLQHV�LI�WKH�XVHU�KDV�FOLFNHG�D�&DQFHO�EXWWRQ��,I�VR��WKH�FDOOEDFN�IXQFWLRQ�UHWXUQV�D�VWDWXV�FRGH�LQIRUPLQJ�WKH�VRUWLQJ�URXWLQH�WKDW�WKH�XVHU�ZDQWV�WR�FDQFHO�WKH�VRUWLQJ�RSHUDWLRQ��7KH�RSHUDWLRQ�LV�FDQFHOHG�DQG�WKH�DSSOLFDWLRQ�SURFHHGV�RQZDUG���$�FDOOEDFN�IXQFWLRQ�DOVR�FRXOG�EH�FDOOHG�WR�LQIRUP�WKH�DSSOLFDWLRQ�RI�WKH�VRUWLQJ�RSHUDWLRQV�SURJUHVV��7KH�DSSOLFDWLRQ�FRXOG�WKHQ�XSGDWH�VWDWXV�LQIRUPDWLRQ�GLVSOD\HG�WR�WKH�XVHU�WKDW�NHHSV�WKH�XVHU�LQIRUPHG�RI�KRZ�PXFK�ZRUN�VWLOO�QHHGV�WR�EH�GRQH�E\�WKH�VRUW�URXWLQH���)LJXUH�����LOOXVWUDWHV�WKH�RUGHU�LQ�ZKLFK�IXQFWLRQV�DUH�FDOOHG�IRU�D�9%�DSSOLFDWLRQ�LPSOHPHQWLQJ�DV\QFKURQRXV�SURFHVVLQJ��,Q�VWHS����D�IXQFWLRQ��0DLQ��LQ�WKH�%$6�ILOH�FDOOV�D�IXQFWLRQ�LQ�D�G\QDPLF�OLQN�OLEUDU\��'//��DQG�SDVVHV�LW�D�IXQFWLRQ�SRLQWHU�WR�WKH�&%�FDOOEDFN�IXQFWLRQ��DOVR�ZLWKLQ�WKH�%$6�ILOH��,Q�VWHS����WKH�'//�IXQFWLRQ��'//)XQFW��XVHV�WKLV�IXQFWLRQ�SRLQWHU�WR�FDOO�WKH�IXQFWLRQ�&%�LQ�WKH�%$6�ILOH�GXULQJ�LWV�SURFHVVLQJ��7KLV�IXQFWLRQ�PLJKW�QRWLI\�WKH�PDLQ�DSSOLFDWLRQ�RI�WKH�VWDWXV�RI�WKH�'//)XQFW�IXQFWLRQ�RU�GHWHUPLQH�LI�WKH�XVHU�ZDQWV�WR�FDQFHO�LWV�RSHUDWLRQ��,Q�VWHS����WKH�&%�IXQFWLRQ�ILQLVKHV�SURFHVVLQJ�DQG�LPPHGLDWHO\�UHWXUQV�FRQWURO�WR�WKH�'//)XQFW�IXQFWLRQ��,Q�VWHS����WKH�'//)XQFW�IXQFWLRQ�UHWXUQV�FRQWURO�WR�WKH�0DLQ�IXQFWLRQ�LQ�WKH�%$6�ILOH���

)LJXUH������$�GLDJUDP�RI�KRZ�IXQFWLRQ�SRLQWHUV�ZRUN�LQ�9%�ZLWK�WKH�RUGHU�RI�HYHQWV�

Page 97: Visual Basic - Subclassing and Hooking with VB & VB NET

$V�,�PHQWLRQHG�LQ�&KDSWHU����WKH�OSIQ:QG3URF�PHPEHU�RI�WKH�ZLQGRZ�FODVV�VWUXFWXUH�LV�D�IXQFWLRQ�SRLQWHU�WR�WKH�ZLQGRZ�SURFHGXUH��7KH�OSIQ�SUHIL[�WHOOV�XV�WKDW�WKLV�LV�D�/RQJ�SRLQWHU�WR�D�IXQFWLRQ���7KHUH�LV�RQH�SUREOHP�ZLWK�WKH�DSSOLFDWLRQ�DQG�'//�LQ�)LJXUH������7KH�DSSOLFDWLRQ�VWRSV�H[HFXWLQJ�DV�VRRQ�DV�LW�FDOOV�'//)XQFW�IURP�WKH�%$6�ILOH��7KH�DSSOLFDWLRQ�LV�ZDLWLQJ�IRU�WKH�'//)XQFW�IXQFWLRQ�WR�UHWXUQ��7KH�FRGH�LQ�WKH�FDOOEDFN�IXQFWLRQ��&%��ZLOO�VWLOO�H[HFXWH�HYHU\�WLPH�LW�LV�FDOOHG��EXW�IRU�DOO�SUDFWLFDO�SXUSRVHV�WKH�9%�DSSOLFDWLRQ�LV�ZDLWLQJ�IRU�WKH�'//�WR�ILQLVK�H[HFXWLRQ��7R�VROYH�WKLV�SUREOHP�DQG�PDNH�WKH�DSSOLFDWLRQ�WUXO\�DV\QFKURQRXV��ZH�QHHG�WR�VWDUW�D�QHZ�WKUHDG�LQ�WKH�'//�DQG�XVH�WKLV�WKUHDG�WR�H[HFXWH�WKH�'//)XQFW�IXQFWLRQ�FRGH��7KH�RQO\�FKDQJH�WR�)LJXUH�����LV�WKH�DGGLWLRQ�RI�D�QHZ�IXQFWLRQ�WKDW�LV�FDOOHG�IURP�WKH�0DLQ�VXEURXWLQH�LQ�SODFH�RI�WKH�'//)XQFW�'//�IXQFWLRQ��7KLV�QHZ�IXQFWLRQ�ZRXOG�FUHDWH�D�QHZ�WKUHDG��UXQ�WKH�'//)XQFW�FRGH�RQ�WKLV�WKUHDG��DQG�LPPHGLDWHO\�UHWXUQ�FRQWURO�WR�WKH�0DLQ�VXEURXWLQH�LQ�WKH�%$6�ILOH��:LWK�WKH�DGGLWLRQ�RI�WKLV�QHZ�IXQFWLRQ��RXU�9%�DSSOLFDWLRQ�FDQ�FRQWLQXH�UXQQLQJ�DV�LI�WKH�'//)XQFW�SURFHGXUH�KDG�QHYHU�EHHQ�FDOOHG���

������$GGUHVV2I�DQG�6XEFODVVLQJ�

:LWK�VXEFODVVLQJ��ZH�ZLOO�EH�XVLQJ�WKH�$GGUHVV2I�RSHUDWRU�WR�JHW�D�IXQFWLRQ�SRLQWHU�WR�RXU�QHZ�ZLQGRZ�SURFHGXUH��7KLV�QHZ�ZLQGRZ�SURFHGXUH�LV�WKH�FDOOEDFN�IXQFWLRQ�WKDW�WKH�ZLQGRZ�PHVVDJH�ORRS�FDOOV�ILUVW��DIWHU�UHFHLYLQJ�D�PHVVDJH��7KH�FRGH�UHTXLUHG�WR�LPSOHPHQW�$GGUHVV2I�LV�TXLWH�VLPSOH��)LUVW�\RX�FRGH�WKH�FDOOEDFN�IXQFWLRQ���3XEOLF�)XQFWLRQ�1HZ:QG3URF�%\9DO�K:QG�$V�/RQJ��B�� � � � �%\9DO�X0VJ�$V�/RQJ��B�� � � � �%\9DO�Z3DUDP�$V�/RQJ��B�� � � � �%\9DO�O3DUDP�$V�/RQJ��DV�/RQJ�� <RXU�FRGH�JRHV�KHUH�(QG�)XQFWLRQ�7KLV�IXQFWLRQ�ZLOO�HYHQWXDOO\�VHUYH�DV�RXU�QHZ�VXEFODVVHG�ZLQGRZ�SURFHGXUH��1H[W�ZH�XVH�WKH�$GGUHVV2I�RSHUDWRU�WR�SDVV�D�SRLQWHU�UHIHUULQJ�WR�WKLV�IXQFWLRQ�LQWR�WKH�:LQ���6HW:LQGRZ/RQJ3WU�IXQFWLRQ��7KH�6HW:LQGRZ/RQJ3WU�IXQFWLRQ�FDOO�ZLOO�ORRN�OLNH�WKLV���PBO2ULJ:QG3URF� �6HW:LQGRZ/RQJ3WU�K:QG��*:/3B:1'352&��$GGUHVV2I�1HZ:QG3URF��6HW:LQGRZ/RQJ3WU�LV�GHVFULEHG�LQ�GHWDLO�LQ�&KDSWHU����7KLV�VLQJOH�OLQH�RI�FRGH�HIIHFWLYHO\�VXEFODVVHV�WKH�ZLQGRZ�WKDW�KDV�K:QG�DV�LWV�KDQGOH��,W�DFFRPSOLVKHV�WKLV�E\�UHSODFLQJ�WKH�IXQFWLRQ�SRLQWHU�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�ZLWK�D�IXQFWLRQ�SRLQWHU�WR�RXU�1HZ:QG3URF�IXQFWLRQ��DFTXLUHG�E\�XVLQJ�WKH�$GGUHVV2I�RSHUDWRU��7KH�6HW:LQGRZ/RQJ3WU�IXQFWLRQ�ZLOO�WKHQ�UHWXUQ�WKH�SRLQWHU�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�WR�WKH�FDOOLQJ�IXQFWLRQ���7KLV�ZLQGRZ�LV�QRZ�VXEFODVVHG��$Q\�PHVVDJHV�VHQW�WR�WKLV�ZLQGRZ�ZLOO�EH�VHQW�WR�WKH�1HZ:QG3URF�IXQFWLRQ��,QVWHDG�RI�VLPSO\�FDOOLQJ�WKLV�IXQFWLRQ�D�FDOOEDFN�IXQFWLRQ��LW�LV�XVXDOO\�FDOOHG�D�VXEFODVVHG�ZLQGRZ�SURFHGXUH��$Q\�ZLQGRZ�SURFHGXUH�RU�VXEFODVVHG�ZLQGRZ�

Page 98: Visual Basic - Subclassing and Hooking with VB & VB NET

SURFHGXUH�LV�MXVW�D�FDOOEDFN�IXQFWLRQ�XVHG�VSHFLILFDOO\�WR�SURFHVV�ZLQGRZ�PHVVDJHV��7KLV�LV�ZK\�WKH\�DUH�FDOOHG�ZLQGRZ�SURFHGXUHV�LQVWHDG�RI�FDOOEDFN�IXQFWLRQV���$V�ZH�QRWHG��DQ\�URXWLQH�WKDW�LV�SDVVHG�D�IXQFWLRQ�SRLQWHU�PXVW�NQRZ�H[DFWO\�KRZ�WR�FDOO�WKH�FDOOEDFN�IXQFWLRQ��7KLV�LV�QRW�WRR�KDUG�LQ�WKH�FDVH�RI�VXEFODVVLQJ�EHFDXVH�DOO�ZLQGRZ�SURFHGXUHV�WDNH�WKH�VDPH�QXPEHU�DQG�W\SH�RI�DUJXPHQWV��,I�ZH�GHYLDWH�IURP�WKLV��RXU�FRGH�ZLOO�QRW�ZRUN�DQG�ZLOO�HYHQWXDOO\�FUDVK�WKH�SURFHVV�WKDW�LW�LV�UXQQLQJ�LQ��,W�LV�QRW�RQO\�QHFHVVDU\�WR�PDWFK�WKH�IXQFWLRQ�SDUDPHWHUV��EXW�LW�LV�DOVR�ZLVH�WR�XQGHUVWDQG�KRZ�WKH�FDOOLQJ�IXQFWLRQ�DQG�WKH�FDOOEDFN�IXQFWLRQ�ZRUN��7KLV�NQRZOHGJH�ZLOO�KHOS�WR�SUHYHQW�SDVVLQJ�EDG�GDWD�WR�D�FDOOEDFN�IXQFWLRQ��ZKLFK�FRXOG�FDXVH�SUREOHPV�UDQJLQJ�IURP�VLPSOH�ORJLF�HUURUV�WR�PRUH�WURXEOHVRPH�*HQHUDO�3URWHFWLRQ�)DXOW��*3)��SUREOHPV��7KLV�DOVR�DOORZV�XV�WR�FRUUHFWO\�KDQGOH�GDWD�UHWXUQHG�IURP�D�FDOOEDFN�IXQFWLRQ���

����6RPH�6XEFODVVLQJ�7LSV�

$V�ZHYH�VHHQ��VXEFODVVLQJ�LQYROYHV�FUHDWLQJ�D�SDUWLFXODU�NLQG�RI�FDOOEDFN�IXQFWLRQ��RQH�WKDW�LV�FDOOHG�E\�D�ZLQGRZV�HYHQW�ORRS��+HQFH��WKH�JHQHUDO�WLSV�WKDW�ZHYH�SUHVHQWHG�IRU�FDOOEDFN�IXQFWLRQV��VXFK�DV�GHILQLQJ�WKH�FDOOEDFN�DV�D�3XEOLF�IXQFWLRQ�LQ�D�%$6�PRGXOH�DQG�XVLQJ�2Q�(UURU�5HVXPH�1H[W�IRU�HUURU�KDQGOLQJ�LQ�WKH�FDOOEDFN�IXQFWLRQ��DSSO\�DV�ZHOO�WR�VXEFODVVHG�ZLQGRZ�SURFHGXUHV��,Q�DGGLWLRQ��WKRXJK��WZR�WLSV�DQG�SLWIDOOV�WKDW�DUH�XQLTXH�WR�VXEFODVVLQJ�DUH�ZRUWK�PHQWLRQLQJ���)LUVW��UHPHPEHU�WKDW�DOO�PHVVDJHV�IRU�D�ZLQGRZ�DUH�SDVVHG�WKURXJK�LWV�VXEFODVVHG�ZLQGRZ�SURFHGXUH��$V�D�UHVXOW��WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH��DV�ZHOO�DV�D�KRRNV�ILOWHU�IXQFWLRQ��FDQ�SRWHQWLDOO\�EH�FDOOHG�KXQGUHGV�RU�HYHQ�WKRXVDQGV�RI�WLPHV�SHU�VHFRQG��,I�ODUJH�DPRXQWV�RI�FRGH�DUH�H[HFXWHG�LQ�WKH�ZLQGRZ�SURFHGXUH�IRU�PDQ\�RI�WKH�PHVVDJHV��WKH�SHUIRUPDQFH�RI�WKH�DSSOLFDWLRQ�ZLOO�GHJUDGH�FRQVLGHUDEO\��7KLV�PDNHV�LW�FULWLFDOO\�LPSRUWDQW�WR�DYRLG�GRLQJ�WRR�PXFK�ZRUN�ZLWKLQ�D�FDOOEDFN�IXQFWLRQ��3HUIRUPLQJ�ILOH�,�2�LQ�HLWKHU�W\SH�RI�SURFHGXUH�LV�RQH�W\SH�RI�RSHUDWLRQ�WKDW�FRXOG�WDNH�XS�DQ�XQXVXDOO\�ORQJ�DPRXQW�RI�WLPH�WR�ILQLVK�EHFDXVH�RI�UHODWLYHO\�VORZ�GLVN�DFFHVV��,I�VXFK�ORQJ�SURFHVVHV�DUH�LQFOXGHG�ZLWKLQ�WKHVH�FDOOEDFN�IXQFWLRQV��WKH�UHVXOWV�FRXOG�EH�OHVV�WKDQ�VDWLVIDFWRU\���

�'R�DV�OLWWOH�ZRUN�DV�SRVVLEOH�LQ�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH���

6HFRQG��QHYHU�XVH�WKH�'R(YHQWV�IXQFWLRQ�LQVLGH�WKH�ZLQGRZ�SURFHGXUH��'R(YHQWV�ZLOO�KDOW�SURFHVVLQJ�WR�DOORZ�RWKHU�TXHXHG�PHVVDJHV�WR�EH�SURFHVVHG��8VLQJ�WKLV�IXQFWLRQ�LQVLGH�D�ZLQGRZ�SURFHGXUH�VWRSV�SURFHVVLQJ�IRU�WKDW�SDUWLFXODU�PHVVDJH��7KH�SUREOHP�RFFXUV�ZKHQ�D�QHZ�PHVVDJH�LV�VHQW�WR�WKH�ZLQGRZ�SURFHGXUH�EHIRUH�WKH�SUHYLRXV�PHVVDJH�FDQ�ILQLVK�SURFHVVLQJ��7KH�ILUVW�PHVVDJH�\LHOGV�WR�WKH�VHFRQG�PHVVDJH��WKH�VHFRQG�PHVVDJH�\LHOGV�WR�

Page 99: Visual Basic - Subclassing and Hooking with VB & VB NET

WKH�WKLUG�PHVVDJH��DQG�VR�RQ��7KH�RXWFRPH�RI�WKLV�LV�XQSUHGLFWDEOH�EHFDXVH�PHVVDJHV�PLJKW�EH�SURFHVVHG�RXW�RI�RUGHU��RU�QRW�EH�SURFHVVHG�DW�DOO���

� 'R�QRW�XVH�WKH�'R(YHQWV�IXQFWLRQ�ZLWKLQ�DQ\�ZLQGRZ�SURFHGXUH����

)LQDOO\��VWHSSLQJ�WKURXJK�D�VXEFODVVLQJ�DSSOLFDWLRQ�LQ�EUHDN�PRGH�IURP�ZLWKLQ�WKH�9%�,'(�LV�SUREOHPDWLF��'RLQJ�VR�FDQ�FDXVH�WKH�DSSOLFDWLRQ��DV�ZHOO�DV�WKH�9%�,'(��WR�IUHH]H��7KLV�PDNHV�LW�PXFK�PRUH�GLIILFXOW�WR�GHEXJ�WKHVH�W\SHV�RI�DSSOLFDWLRQV��'HEXJJLQJ�DSSOLFDWLRQV�XVLQJ�VXEFODVVLQJ�LV�GLVFXVVHG�LQ�GHSWK�LQ�&KDSWHU�����

� 6WHSSLQJ�WKURXJK�D�VXEFODVVLQJ�DSSOLFDWLRQ�LQ�WKH�,'(�FDQ�EH�SUREOHPDWLF����

����,QVWDQFH�6XEFODVVLQJ��$Q�([DPSOH�

$V�ZH�VDZ�LQ�&KDSWHU����LQVWDQFH�VXEFODVVLQJ�LQYROYHV�XVLQJ�WKH�6HW:LQGRZ/RQJ3WU�IXQFWLRQ�WR�UHSODFH�WKH�ZLQGRZ�SURFHGXUH�RI�D�VSHFLILF�ZLQGRZ�LQVWDQFH���,Q�WKLV�VHFWLRQ��ZHOO�ZULWH�RXU�ILUVW�VLPSOH�VXEFODVVLQJ�DSSOLFDWLRQ��7KH�DSSOLFDWLRQ�ZLOO�KDYH�WZR�EXWWRQV��RQH�WR�VXEFODVV�WKH�9%�IRUP�DQG�DQRWKHU�WR�UHPRYH�WKH�VXEFODVV��7KH�RQO\�RWKHU�FRQWURO�ZLOO�EH�D�PXOWLOLQH�WH[W�ER[�WKDW�ZLOO�GLVSOD\�PHVVDJHV�DV�WKH\�DUH�VHQW�WR�WKLV�IRUP��,�ZLOO�DGG�VRPH�PRUH�IXQFWLRQDOLW\�WR�WKLV�DSSOLFDWLRQ�LQ�WKH�H[DPSOH�IROORZLQJ�WKLV�RQH���/HWV�VWDUW�ZLWK�WKH�OD\RXW�RI�WKH�IRUP��,WV�UDWKHU�VLPSOH��WKH�QRQGHIDXOW�SURSHUWLHV�DUH�OLVWHG�LQ�7DEOH������DQG�WKH�IRUP�LV�GLVSOD\HG�LQ�)LJXUH�������

7DEOH������1RQGHIDXOW�3URSHUWLHV�RI�)RUP�DQG�&RQWUROV�IRU�6XEFODVVLQJ�([DPSOH��2EMHFW� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�

IUP&K�� &DSWLRQ� �&KDSWHU������6XEFODVVLQJ�([DPSOH��IUP&K�� &OLHQW+HLJKW�� �����IUP&K�� &OLHQW/HIW�� ���IUP&K�� &OLHQW7RS�� ����IUP&K�� &OLHQW:LGWK�� �����7H[W�� +HLJKW�� �����7H[W�� /HIW�� �����7H[W�� 0XOWL/LQH�� ���C7UXH�7H[W�� 6FUROO%DUV�� ��C9HUWLFDO�7H[W�� 7RS�� ����

Page 100: Visual Basic - Subclassing and Hooking with VB & VB NET

7H[W�� :LGWK�� �����FPG8Q6XEFODVV� &DSWLRQ�� �8Q�6XEFODVV��FPG8Q6XEFODVV� +HLJKW�� ����FPG8Q6XEFODVV� /HIW�� ����FPG8Q6XEFODVV� 7RS�� ����FPG8Q6XEFODVV� :LGWK�� �����FPG6XEFODVV� &DSWLRQ�� �6XEFODVV��FPG6XEFODVV� +HLJKW�� ����FPG6XEFODVV� /HIW�� ����FPG6XEFODVV� 7RS�� ����FPG6XEFODVV� :LGWK�� �����+HUH�LV�KRZ�LW�ZLOO�ZRUN��7KH�WH[W�ER[�LV�LQLWLDOO\�EODQN��:KHQ�\RX�FOLFN�WKH�6XEFODVV�EXWWRQ��PHVVDJHV�WKDW�DUH�VHQW�WR�WKH�ZLQGRZ�SURFHGXUH�IRU�WKH�9%�IRUP�ZLOO�GLVSOD\�LQ�WKH�WH[W�ER[��(DFK�OLQH�LQ�WKH�WH[W�ER[�LV�D�VHSDUDWH�PHVVDJH��,Q�RXU�ILUVW�FXW�DW�WKLV�SURMHFW��PHVVDJHV�ZLOO�EH�GLVSOD\LQJ�IDVWHU�WKDQ�\RX�FDQ�UHDG�WKHP���:H�ZLOO�GLVFXVV�WKH�QXPEHU�DQG�IUHTXHQF\�RI�PHVVDJHV�VHQW�WR�D�ZLQGRZ�ODWHU�LQ�WKLV�FKDSWHU���7R�UHPRYH�WKH�VXEFODVV�SURFHGXUH��VLPSO\�FOLFN�WKH�8Q�6XEFODVV�EXWWRQ��WKH�PHVVDJHV�ZLOO�VWRS�GLVSOD\LQJ���

)LJXUH������7KH�ILUVW�H[DPSOH�VXEFODVVLQJ�DSSOLFDWLRQ�

7KH�FRGH�ZLOO�LQFOXGH�IXQFWLRQDOLW\�WR�KDQGOH�SUREOHPV�VXFK�DV�FOLFNLQJ�WKH�6XEFODVV�EXWWRQ�PRUH�WKDQ�RQFH�DQG�FOLFNLQJ�WKH�8Q�6XEFODVV�EXWWRQ�ZKHQ�QR�VXEFODVV�SURFHGXUH�KDV�EHHQ�LQVWDOOHG��7KHUH�LV�DOVR�DQRWKHU�SUREOHP�WKDW�QHHGV�WR�EH�KDQGOHG��SUHPDWXUHO\�HQGLQJ�WKH�DSSOLFDWLRQ�EHIRUH�FOLFNLQJ�WKH�8Q�6XEFODVV�EXWWRQ��,Q�RWKHU�ZRUGV��\RX�FDQQRW�VWRS�DQ�DSSOLFDWLRQ�FOHDQO\�ZLWKRXW�ILUVW�UHPRYLQJ�DQ\�VXEFODVVHG�ZLQGRZ�SURFHGXUH�WKDW�KDV�EHHQ�LQVWDOOHG��(QGLQJ�DQ�DSSOLFDWLRQ�DQ\�RWKHU�ZD\�ZLOO�FDXVH�D�*3)�WR�RFFXU���

Page 101: Visual Basic - Subclassing and Hooking with VB & VB NET

7R�GHPRQVWUDWH�WKLV��OHWV�DVVXPH�WKDW�ZH�IRUJHW�WR�UHVWRUH�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�EHIRUH�VKXWWLQJ�GRZQ�WKH�DSSOLFDWLRQ��7KH�VXEFODVVHG�ZLQGRZ�ZLOO�FRQWLQXH�WR�FDOO�RXU�VXEFODVVHG�ZLQGRZ�SURFHGXUH�HYHQ�DV�WKH�DSSOLFDWLRQ�LV�EHLQJ�GHVWUR\HG��:KLOH�WKH�DSSOLFDWLRQ�LV�EHLQJ�GHVWUR\HG��WKH�FRGH�ZLWKLQ�WKH�%$6�PRGXOH�WKDW�FRQWDLQV�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LV�UHPRYHG�IURP�PHPRU\��,I�WKH�VXEFODVVHG�ZLQGRZ�UHFHLYHV�DQ\�PHVVDJHV�SDVVHG�WR�LW��VXFK�DV�:0B'(6752<��WKH�PHVVDJH�LQGLFDWLQJ�WKDW�WKH�ZLQGRZ�LV�DERXW�WR�EH�GHVWUR\HG���WKH�ZLQGRZ�WULHV�WR�FDOO�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�XVLQJ�LWV�IXQFWLRQ�SRLQWHU��,I�WKH�FRGH�IRU�WKLV�VXEFODVVHG�ZLQGRZ�SURFHGXUH�KDV�EHHQ�UHPRYHG�IURP�PHPRU\��WKLV�IXQFWLRQ�SRLQWHU�ZLOO�SRLQW�WR�XQDOORFDWHG�PHPRU\�DQG�FDXVH�D�*3)���

�'R�QRW�HQG�DQ�DSSOLFDWLRQ�EHIRUH�UHPRYLQJ�DOO�VXEFODVVHG�ZLQGRZ�SURFHGXUHV����

,�VKRXOG�PHQWLRQ�KHUH�WKDW�WKH�(QG�VWDWHPHQW�LQ�9%�ZLOO�FUDVK�\RXU�DSSOLFDWLRQ��7KH�(QG�VWDWHPHQW�IRUFHV�WKH�DSSOLFDWLRQ�WR�VWRS�GHDG�LQ�LWV�WUDFNV��7KLV�PHDQV�WKDW�DQ\�XQORDG�HYHQWV�IRU�WKH�)RUP�RU�7HUPLQDWH�HYHQWV�IRU�WKH�FODVV�PRGXOHV�ZLOO�QRW�H[HFXWH��7KH�8QORDG�DQG�7HUPLQDWH�HYHQWV�SURYLGH�WKH�SHUIHFW�SODFH�WR�FOHDQ�XS�WKH�DSSOLFDWLRQ�DQG�SUHSDUH�LW�WR�VKXW�GRZQ�SURSHUO\��7KHVH�HYHQWV�DUH�RXU�ODVW�OLQHV�RI�GHIHQVH��,W�LV�KHUH�WKDW�,�ZLOO�SODFH�FRGH�WR�PDNH�DEVROXWHO\�VXUH�WKDW�WKH�DSSOLFDWLRQ�FDQ�VKXW�GRZQ�ZLWKRXW�D�FUDVK���8VLQJ�WKH�(QG�VWDWHPHQW�E\SDVVHV�WKHVH�HYHQWV�DQG�KDV�WKH�SRWHQWLDO�WR�FUHDWH�VHULRXV�SUREOHPV��&DOOLQJ�WKH�(QG�VWDWHPHQW�DIWHU�FOHDQLQJ�XS�\RXU�DSSOLFDWLRQ�DQG�SUHSDULQJ�LW�WR�VKXW�GRZQ�ZRXOG�EH�ILQH��EXW�EHLQJ�JRRG�SURJUDPPHUV��ZH�ZRXOG�QRW�XVH�WKH�(QG�VWDWHPHQW�DQ\ZD\��ULJKW"�$V�D�QRWH��WKH�6WRS�EXWWRQ�LQ�WKH�9%�,'(�ZLOO�DFW�WKH�VDPH�DV�XVLQJ�WKH�(QG�VWDWHPHQW���

�'R�QRW�XVH�WKH�(QG�VWDWHPHQW�LQ�\RXU�FRGH�RU�WKH�6WRS�EXWWRQ�LQ�WKH�9%�,'(����

7KLV�ILUVW�H[DPSOH�DSSOLFDWLRQ�ZLOO�FRQVLVW�RI�D�IRUP��VHH�)LJXUH�������D�%$6�PRGXOH��DQG�D�FODVV�PRGXOH���

• 7KH�%$6�PRGXOH��DV�\RX�JXHVVHG��KROGV�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�WKDW�ZLOO�EH�LQVWDOOHG�EHIRUH�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�LQ�WKH�PHVVDJH�VWUHDP��7KLV��IRU�QRZ��LV�WKH�H[WHQW�RI�WKH�FRGH�LQ�WKH�%$6�PRGXOH���

• 7KH�FODVV�PRGXOH�LV�ZKHUH�WKH�FRGH�WR�LQVWDOO�DQG�XQLQVWDOO�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�FRQWDLQHG�LQ�WKH�%$6�PRGXOH�UHVLGHV��,W�ZRXOG�EH�QLFH�WR�SODFH�WKH�QHZ�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LQ�WKH�FODVV�PRGXOH�DV�ZHOO��EXW�DV�ZH�NQRZ��WKH�$GGUHVV2I�RSHUDWRU�GRHV�QRW�VXSSRUW�WKLV��%\�SODFLQJ�FRGH�LQ�WKH�FODVV�PRGXOH�WR�FRQWURO�LQVWDOOLQJ�DQG�XQLQVWDOOLQJ�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH��ZH�DUH�DEOH�WR�HQVXUH�WKDW�WKH�DSSOLFDWLRQ�ZLOO�IXQFWLRQ�SURSHUO\��%\�FDOOLQJ�D�SXEOLF�IXQFWLRQ�LQ�WKH�FODVV��ZH�FDQ�LQVWDOO�WKH�VXEFODVVHG�ZLQGRZV�SURFHGXUH��%XW�ZKDW�LI�VRPHWKLQJ�JRHV�

Page 102: Visual Basic - Subclassing and Hooking with VB & VB NET

ZURQJ�DQG�HLWKHU�ZH�IRUJHW�WR�UHPRYH�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�RU�WKH�DSSOLFDWLRQ�HQFRXQWHUV�DQ�XQKDQGOHG�HUURU"�,Q�HLWKHU�FDVH��WKH�FODVV�LV�GHVWUR\HG�EHIRUH�WKH�IRUP��7KH�FRGH�WKDW�LV�SODFHG�LQ�WKH�&ODVVB7HUPLQDWH�HYHQW�ZLOO�DOORZ�WKH�DSSOLFDWLRQ�WR�UHPRYH�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�DQG�VKXW�GRZQ�JUDFHIXOO\���

$�GLVFXVVLRQ�RI�HDFK�PRGXOH�IROORZV��

������7KH�&ODVV�0RGXOH�

$�JRRG�VWDUWLQJ�SRLQW�LV�WKH�FRGH�IRU�WKH�FODVV�PRGXOH��ZKLFK�LV�QDPHG�&6XEFODVV��7KH�SULYDWH�FRQVWDQWV��WKH�YDULDEOHV��DQG�WKH�:LQGRZV�$3,�IXQFWLRQ�ZLOO�EH�GHFODUHG�LQ�WKH�GHFODUDWLRQV�VHFWLRQ�RI�WKH�PRGXOH��DV�IROORZV���3ULYDWH�'HFODUH�)XQFWLRQ�6HW:LQGRZ/RQJ3WU�/LE��XVHU����$OLDV��6HW:LQGRZ/RQJ$��B�� � �%\9DO�KZQG�$V�/RQJ��B�� � %\9DO�Q,QGH[�$V�/RQJ��B�� � %\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ��3ULYDWH�&RQVW�*:/3B:1'352&� �����3ULYDWH�PBO2ULJ:QG3URF�$V�/RQJ�3ULYDWH�PBKZQG�$V�/RQJ�6HW:LQGRZ/RQJ3WU�ZLOO�EH�XVHG�WR�GR�WKH�DFWXDO�VXEFODVVLQJ��7KH�*:/3B:1'352&�FRQVWDQW�LV�XVHG�DV�DQ�DUJXPHQW�WR�6HW:LQGRZ/RQJ3WU�DQG�LQGLFDWHV�WKDW�WKH�ZLQGRZV�SURFHGXUH�LV�EHLQJ�UHSODFHG��7KH�ODVW�WZR�SULYDWH�PHPEHU�YDULDEOHV�ZLOO�KROG�GDWD�SHUWDLQLQJ�WR�WKH�ZLQGRZ�EHLQJ�VXEFODVVHG���7ZR�YDULDEOHV�DOVR�DUH�GHFODUHG�LQ�WKH�FODVV�PRGXOHV�GHFODUDWLRQV�VHFWLRQ��7KH�YDULDEOH�PBKZQG�KROGV�WKH�ZLQGRZ�KDQGOH�RI�WKH�VXEFODVVHG�ZLQGRZ��DQG�WKH�PBO2ULJ:QG3URF�YDULDEOH�KROGV�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�IRU�WKDW�VDPH�ZLQGRZ��7KH�&ODVVB,QLWLDOL]H�HYHQW��ZKLFK�LV�VKRZQ�LQ�([DPSOH������LV�XVHG�WR�LQLWLDOL]H�WKHVH�WZR�SULYDWH�PHPEHU�YDULDEOHV�WR�]HUR���

([DPSOH������7KH�&ODVVB,QLWLDOL]H�(YHQW�3URFHGXUH��

3ULYDWH�6XE�&ODVVB,QLWLDOL]H���������PBO2ULJ&ODVV3URF� �������PBKZQG� ���(QG�6XE�7ZR�SXEOLF�SURSHUWLHV�DUH�QHHGHG�IRU�WKH�WZR�SULYDWH�PHPEHU�YDULDEOHV�PBKZQG�DQG�PBO2ULJ:QG3URF��WKHVH�DUH�VKRZQ�LQ�([DPSOH�������

([DPSOH������3URSHUWLHV�RI�WKH�&6XE&ODVV�&ODVV��

Page 103: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�3URSHUW\�*HW�2ULJ:QG3URF�����$V�/RQJ�����2ULJ:QG3URF� �PBO2ULJ:QG3URF�(QG�3URSHUW\��3XEOLF�3URSHUW\�/HW�KZQG�+DQGOH�$V�/RQJ������PBKZQG� �+DQGOH�(QG�3URSHUW\�7KH�DGGUHVV�RI�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�FRQWDLQHG�LQ�WKH�PHPEHU�YDULDEOH�PBO2ULJ:QG3URF�QHHGV�WR�EH�DYDLODEOH�WR�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LQ�WKH�%$6�ILOH��7KH�ILUVW�SURSHUW\�WKDW�ZH�H[SRVH�LQ�WKLV�FODVV��2ULJ:QG3URF��ZLOO�WDNH�FDUH�RI�WKLV�UHTXLUHPHQW��7KH�VHFRQG�SURSHUW\�LV�XVHG�RQO\�E\�DQ�H[WHUQDO�IXQFWLRQ�WR�VHW�WKH�PBKZQG�PHPEHU�YDULDEOH��7KH�FODVV�QHHGV�WR�NQRZ�WKH�ZLQGRZ��PBKZQG��LQ�ZKLFK�WR�LQVWDOO�DQG�UHPRYH�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH���1RZ�WKDW�ZH�KDYH�WKH�FODVV�GDWD�ZUDSSHG�XS��ZH�FDQ�JHW�WR�WKH�PHDW�RI�WKH�FODVV�FRGH��7KH�SXEOLF�IXQFWLRQ�WKDW�ZLOO�DFWXDOO\�SHUIRUP�WKH�VXEFODVVLQJ�LV�VKRZQ�LQ�([DPSOH�������

([DPSOH������7KH�(QDEOH6XEFODVV�)XQFWLRQ��

3XEOLF�)XQFWLRQ�(QDEOH6XEFODVV�����$V�%RROHDQ�����,I�PBO2ULJ:QG3URF�!���7KHQ���������$OUHDG\�VXEFODVVHG�����������'R�QRW�DOORZ�WR�VXEFODVV�D��QG�WLPH���������0VJ%R[��(UURU��$OUHDG\�VXEFODVVHG������(OVH���������PBO2ULJ:QG3URF� �6HW:LQGRZ/RQJ3WU�PBKZQG��B�� � � � � � *:/3B:1'352&��B�� � � � � � $GGUHVV2I�0RGXOH��1HZ:QG3URF������(QG�,I����������,I�PBO2ULJ:QG3URF�!���7KHQ���������(QDEOH6XEFODVV� �7UXH�����(OVH���������(QDEOH6XEFODVV� �)DOVH�����(QG�,I�(QG�)XQFWLRQ�:KHQ�WKLV�IXQFWLRQ�LV�FDOOHG��ZH�ZDQW�WR�FKHFN�WKH�PBO2ULJ:QG3URF�PHPEHU�YDULDEOH�WR�ILQG�RXW�LI�LW�FRQWDLQV�D�QXPEHU�RWKHU�WKDQ�]HUR��,I�LW�GRHV��ZH�NQRZ�WKDW�WKLV�ZLQGRZ�KDV�EHHQ�VXEFODVVHG�DQG�VKRXOG�QRW�EH�VXEFODVVHG�D�VHFRQG�WLPH��,I�WKH�ZLQGRZ�ZHUH�WR�EH�VXEFODVVHG�PRUH�WKDQ�RQFH�XVLQJ�WKH�FRGH�LQ�WKLV�H[DPSOH��ZH�ZRXOG�ORVH�WKH�IXQFWLRQ�

Page 104: Visual Basic - Subclassing and Hooking with VB & VB NET

SRLQWHU�WR�RXU�RULJLQDO�ZLQGRZ�SURFHGXUH��:LWKRXW�WKLV�SRLQWHU�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��WKH�DSSOLFDWLRQ�ZLOO�FUDVK�ZKHQ�LW�LV�VKXW�GRZQ��/HW�PH�H[SODLQ�ZK\�LQ�D�OLWWOH�PRUH�GHWDLO���/RRNLQJ�DW�)LJXUH������ZH�VHH�ZK\�VXEFODVVLQJ�D�ZLQGRZ�PRUH�WKDQ�RQFH�ZLOO�OHDG�WR�D�FUDVK��7KH�PBO2ULJ:QG3URF�PHPEHU�YDULDEOH�LV�ILUVW�LQLWLDOL]HG�WR�]HUR�WR�LQGLFDWH�WKDW�QR�VXEFODVVLQJ�KDV�RFFXUUHG��:KHQ�WKH�ZLQGRZ�LV�VXEFODVVHG�XVLQJ�6HW:LQGRZ/RQJ3WU��WKH�SRLQWHU�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�LV�VWRUHG�LQ�WKLV�YDULDEOH��5HPRYLQJ�WKH�VXEFODVV�DW�WKLV�SRLQW�ZLOO�EH�VXFFHVVIXO��,I�LQVWHDG�WKH�ZLQGRZ�LV�VXEFODVVHG�D�VHFRQG�WLPH��DQG�WKHQ�ZH�WU\�WR�UHPRYH�WKH�VXEFODVVLQJ��WKH�DSSOLFDWLRQ�ZLOO�FUDVK��DQG�ZH�ZLOO�JHW�D�PHVVDJH�VLPLODU�WR�WKLV���352-B&+��FDXVHG�D�VWDFN�IDXOW�LQ�PRGXOH�069%90���'//�DW�����������H����$�VWDFN�IDXOW�RFFXUV�ZKHQ�PHPRU\�LV�DFFHVVHG�EH\RQG�WKH�OLPLWV�RI�WKH�VWDFN��7KH�VWDFN�LV�D�OLQNHG�OLVW�XVHG�E\�IXQFWLRQ�FDOOV�WR�VWRUH�LQIRUPDWLRQ�WKDW�JRHV�RXW�RI�VFRSH��(YHU\�WKUHDG�KDV�LWV�RZQ�VWDFN�VSDFH��7KH�VWDFN�VSDFH�IRU�DQ\�RQH�WKUHDG�FDQ�EH�XS�WR��0%�LQ�VL]H��,QIRUPDWLRQ�FDQ�RQO\�EH�LQVHUWHG��SXVKHG��RQWR�WKH�WRS�RI�WKH�VWDFN�RU�UHWULHYHG��SRSSHG��IURP�WKH�WRS�RI�WKH�VWDFN��7KLV�LV�D�)LUVW�,Q��/DVW�2XW��),/2��W\SH�RI�VWUXFWXUH��9%�XVHV�WKH�VWDFN�PDLQO\�WR�VWRUH�IXQFWLRQ�DUJXPHQWV�DQG�ORFDO�YDULDEOHV�GHFODUHG�LQ�IXQFWLRQV���,QIRUPDWLRQ�VXFK�DV�JOREDO�DQG�VWDWLF�YDULDEOHV�LV�VWRUHG�LQ�WKH�DSSOLFDWLRQV�GHIDXOW�KHDS��$�KHDS�LV�D�EORFN�RI�PHPRU\�VHW�DVLGH�E\�WKH�DSSOLFDWLRQ�WR�VWRUH�LQIRUPDWLRQ��+HDS�PHPRU\�LV�DFFHVVLEOH�WKURXJKRXW�WKH�HQWLUH�DSSOLFDWLRQ��DQG�WKHUHIRUH�SURYLGHV�DQ�H[FHOOHQW�DUHD�WR�VWRUH�JOREDO�DQG�VWDWLF�YDULDEOHV��9DULDEOHV�RI�WKLV�W\SH�QHYHU�JR�RXW�RI�VFRSH��DQG�WKXV�UHTXLUH�QR�VWDFN�VSDFH���9DULDEOHV�ORFDO�WR�D�IXQFWLRQ�JR�RXW�RI�VFRSH�ZKHQ�FDOOLQJ�DQRWKHU�IXQFWLRQ��7KLV�LV�QHFHVVDU\�WR�SUHYHQW�YDULDEOHV�ORFDO�WR�RQH�IXQFWLRQ�IURP�EHLQJ�PRGLILHG�IURP�ZLWKLQ�DQRWKHU�IXQFWLRQ��7KH�VWDFN�SURYLGHV�D�ZD\�WR�VDYH�WKH�FDOOLQJ�IXQFWLRQV�ORFDO�YDULDEOHV�ZKLOH�WKH�FDOOHG�IXQFWLRQ�LV�H[HFXWLQJ��8SRQ�UHWXUQLQJ�IURP�WKH�FDOOHG�IXQFWLRQ�WKH�FDOOLQJ�IXQFWLRQV�ORFDO�YDULDEOHV�DUH�UHVWRUHG�SURSHUO\���)XQFWLRQ�DUJXPHQWV�DOVR�DUH�SXVKHG�RQWR�WKH�VWDFN��$UJXPHQWV�GHFODUHG�DV�%\9DO�KDYH�WKHLU�DFWXDO�GDWD�SODFHG�RQ�WKH�VWDFN��$UJXPHQWV�GHFODUHG�DV�%\5HI�KDYH�SRLQWHUV�WR�WKH�GDWD�SODFHG�RQ�WKH�VWDFN��)RU�%\5HI�DUJXPHQWV��WKH�FDOOHG�IXQFWLRQ�REWDLQV�D�SRLQWHU�WR�WKH�DFWXDO�GDWD�DQG�FDQ�VXEVHTXHQWO\�PRGLI\�WKH�DFWXDO�GDWD��%\9DO�DUJXPHQWV�RQO\�SDVV�D�FRS\�RI�WKH�GDWD�WR�D�IXQFWLRQ��7KH�FRS\�FDQ�EH�PRGLILHG�ZLWKRXW�DOVR�FKDQJLQJ�WKH�YDOXH�ZLWKLQ�WKH�FDOOLQJ�IXQFWLRQ���7R�GHPRQVWUDWH�WKLV��D�IXQFWLRQ�IRR�LV�FDOOHG�LQ�9%�IURP�WKH�IXQFWLRQ�&DOOBIRR���3ULYDWH�)XQFWLRQ�&DOOBIRR�VWU;�DV�VWULQJ��OQJ<�DV�/RQJ��DV�ORQJ�� 'LP�LQW=�DV�,QWHJHU��� LQW=� ���� VWU;� ��18//��� OQJ<� �����

Page 105: Visual Basic - Subclassing and Hooking with VB & VB NET

�� 'HEXJ�3ULQW��%HIRUH�&DOO��� 5HW9DO� �IRR�VWU;��OQJ<��� 'HEXJ�3ULQW��$IWHU�&DOO��(QG�)XQFWLRQ�7KH�DUJXPHQWV�WR�WKH�IXQFWLRQ�IRR�DUH�SODFHG�DW�WKH�WRS�RI�WKH�VWDFN��)RU�WKLV�IXQFWLRQ��ERWK�VWU;�DQG�OQJ<�DUH�SODFHG�RQ�WKH�VWDFN��7KRXJK�LW�LV�QRW�SDVVHG�WR�WKH�IRR�IXQFWLRQ��WKH�LQWHJHU�LQW=�DOVR�LV�SODFHG�RQ�WKH�VWDFN�EHFDXVH�LW�LV�ORFDO�LQ�VFRSH�WR�WKH�&DOOBIRR�IXQFWLRQ��7KH�VWDFN�ZRXOG�ORRN�VRPHWKLQJ�OLNH�WKLV���7RS�RI�6WDFN��!�������LQW=� ���� � � ��������OQJ<� �SRLQWHU�WR�WKH�YDOXH�RI�OQJ<�� � � ��������VWU;� ��18//��1H[W��WKH�IXQFWLRQ�IRR�LV�FDOOHG��DQG�WKH�V\VWHP�VWDUWV�H[HFXWLQJ�FRGH�LQ�WKLV�IXQFWLRQ��5HPHPEHU�WKDW�WKH�YDULDEOHV�ORFDO�WR�WKH�IXQFWLRQ�&DOOBIRR�DUH�QRZ�RXW�RI�VFRSH��7KH�IRR�IXQFWLRQ�LV�DV�IROORZV���3ULYDWH�)XQFWLRQ�IRR�%\9DO�LQBVWU;�DV�VWULQJ��%\5HI�LQBOQJ<�DV�/RQJ��DV�ORQJ�� 6WU;� ��7H[W��� /QJ<� �����(QG�)XQFWLRQ�:KHQ�(QG�)XQFWLRQ�LV�HQFRXQWHUHG��H[HFXWLRQ�LV�UHWXUQHG�WR�WKH�&DOOBIRR�IXQFWLRQ��7KH�LQIRUPDWLRQ�RQ�WKH�VWDFN�LV�UHPRYHG�DQG�WKH�&DOOBIRR�ORFDO�YDULDEOHV�DUH�UHVWRUHG��,Q�WKLV�FDVH���

• LQW=�ZLOO�VWLOO�HTXDO���EHFDXVH�WKLV�ORFDO�YDULDEOH�ZDV�RQO\�VWRUHG�RQ�WKH�VWDFN���• OQJ<�ZLOO�HTXDO�����EHFDXVH�WKH�SRLQWHU�ZDV�SDVVHG�LQ�WR�WKH�IXQFWLRQ�IRR���• VWU;�ZLOO�HTXDO�18//�EHFDXVH�RQO\�D�FRS\�RI�WKLV�YDULDEOH�ZDV�PRGLILHG�LQ�WKH�IXQFWLRQ�

IRR���

1RZ�WKDW�ZH�XQGHUVWDQG�KRZ�WKH�VWDFN�ZRUNV��ZH�FDQ�EHWWHU�XQGHUVWDQG�WKH�VWDFN�IDXOW�SUREOHP��:KHQ�D�IXQFWLRQ�LV�FDOOHG��YDULRXV�GDWD�UHODWHG�WR�WKDW�IXQFWLRQ�LV�SODFHG�RQ�WKH�VWDFN��:KHQ�D�IXQFWLRQ�UHWXUQV��WKH�GDWD�SODFHG�RQ�WKH�VWDFN�LV�UHPRYHG�DQG�WKH�PHPRU\�LV�IUHHG�VR�WKDW�LW�FDQ�EH�XVHG�DJDLQ��,I�WKDW�IXQFWLRQ�QHYHU�UHWXUQV��WKH�LQIRUPDWLRQ�RQ�WKH�VWDFN�ZLOO�UHPDLQ�DQG�WKH�PHPRU\�ZLOO�QRW�EH�IUHHG���7KH�SUREOHP�ZLWK�ORVLQJ�D�IXQFWLRQ�SRLQWHU�WR�D�ZLQGRZ�SURFHGXUH�LV�LOOXVWUDWHG�LQ�)LJXUH������D�VWHS�E\�VWHS�H[DPSOH�WKDW�VKRZV�WKH�YDOXHV�RI�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��PBO2ULJ:QG3URF��DQG�WKH�SRLQWHU�WR�WKH�FRUUHFW�ZLQGRZ�SURFHGXUH��OSIQ:QG3URF���7KH�DGGUHVV�+�����)�%�SRLQWV�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��+������%%�SRLQWV�WR�WKH�ILUVW�VXEFODVVHG�ZLQGRZ�SURFHGXUH��DQG�+���)�����SRLQWV�WR�WKH�VHFRQG�VXEFODVVHG�ZLQGRZ�SURFHGXUH��,I�\RX�QRWLFH�ZKHQ�RXU�VHFRQG�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LV�FDOOHG��LW�WKLQNV�WKDW�WKH�ILUVW�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LV�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��VHH�6WHS���LQ�)LJXUH�������&DOO:LQGRZ3URF�ZLOO�XVH�WKH�SRLQWHU�VWRUHG�LQ�WKH�YDULDEOH�PBO2ULJ:QG3URF�

Page 106: Visual Basic - Subclassing and Hooking with VB & VB NET

WR�FDOO�WKH�ILUVW�VXEFODVVHG�ZLQGRZ��$FWXDOO\��WKLV�ZRXOG�EH�ILQH�H[FHSW�IRU�WKH�IDFW�WKDW�ZH�GR�QRW�KDYH�WKH�IXQFWLRQ�SRLQWHU�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��7KLV�IXQFWLRQ�SRLQWHU�ZDV�ORVW�ZKHQ�ZH�VXEFODVVHG�WKLV�ZLQGRZ�D�VHFRQG�WLPH��8QIRUWXQDWHO\��WKH�FRGH�QRZ�WKLQNV�WKDW�WKH�ILUVW�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LV�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��:KHQ�&DOO:LQGRZ3URF�LV�H[HFXWHG�LQ�WKH�ILUVW�ZLQGRZ�SURFHGXUH��LW�FDOOV�LWVHOI�EHFDXVH�WKH�IXQFWLRQ�SRLQWHU�LQ�WKH�YDULDEOH�PBO2ULJ:QG3URF�LV�SRLQWLQJ�WR�LWVHOI��7KLV�VHWV�XS�D�UHDOO\�QDVW\�UHFXUVLYH�IXQFWLRQ�FDOO�LQ�ZKLFK�WKH�ILUVW�VXEFODVVHG�ZLQGRZ�SURFHGXUH�NHHSV�FDOOLQJ�LWVHOI�DQG�QHYHU�UHWXUQV��7KLV�ZLOO�FRQWLQXH�WR�KDSSHQ�XQWLO�WKH�VWDFN�ILOOV�XS�DQG�WKHQ�WULHV�WR�ZULWH�SDVW�LWV�ERXQGDU\��FDXVLQJ�D�VWDFN�IDXOW���

�1HYHU�ORVH�WKH�IXQFWLRQ�SRLQWHU�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�IRU�WKH�VXEFODVVHG�ZLQGRZ����

7R�FRUUHFW�WKLV�SUREOHP��WKH�DGGUHVV�RI�HDFK�ZLQGRZ�SURFHGXUH��LQFOXGLQJ�WKH�RULJLQDO�RQH��KDV�WR�EH�VDYHG��7KHVH�YDOXHV�FRXOG�SRVVLEO\�EH�VWRUHG�LQ�DQ�DUUD\��:KHQ�WKH�VHFRQG�VXEFODVVHG�ZLQGRZ�SURFHGXUH�FDOOV�WKH�&DOO:LQGRZ3URF�IXQFWLRQ��WKLV�DUUD\�ZRXOG�EH�XVH�WR�ORRN�XS�WKH�QH[W�VXEFODVVHG�ZLQGRZ�SURFHGXUH�WR�FDOO��,Q�WKLV�FDVH��LW�ZRXOG�EH�WKH�ILUVW�ZLQGRZ�SURFHGXUH��$IWHU�WKH�ILUVW�ZLQGRZ�SURFHGXUH�LV�ILQLVKHG��WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�ZRXOG�EH�FDOOHG��7KH�RULJLQDO�ZLQGRZ�SURFHGXUH�VKRXOG�EH�VWRUHG�LQ�WKLV�DUUD\�DV�ZHOO���7KHUH�DUH�WZR�WKLQJV�WR�NHHS�LQ�PLQG�ZLWK�VXEFODVVLQJ�D�ZLQGRZ�PXOWLSOH�WLPHV��)LUVW��WKH�ZLQGRZ�SURFHGXUHV�VKRXOG�EH�FDOOHG�LQ�WKH�UHYHUVH�RUGHU�LQ�ZKLFK�WKH\�ZHUH�LQVWDOOHG��)RU�H[DPSOH��WKH�ODVW�LQVWDOOHG�VXEFODVVHG�ZLQGRZ�SURFHGXUH�VKRXOG�EH�FDOOHG�ILUVW��WKH�VHFRQG�LQVWDOOHG�ZLQGRZ�SURFHGXUH�VKRXOG�EH�FDOOHG�QH[W��DQG�VR�RQ��6HFRQG��ZKHQ�UHPRYLQJ�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUHV��WKH\�PXVW�EH�UHPRYHG�LQ�WKH�UHYHUVH�RUGHU�IURP�ZKLFK�WKH\�ZHUH�LQVWDOOHG��$GKHULQJ�WR�WKHVH�UXOHV�ZLOO�HQVXUH�WKDW�SUREOHPV�UHVXOWLQJ�IURP�WKH�LQWHUDFWLRQ�EHWZHHQ�VXEFODVVHG�ZLQGRZ�SURFHGXUHV�DUH�DW�D�PLQLPXP���

)LJXUH������/RVLQJ�WKH�IXQFWLRQ�SRLQWHU�WR�D�ZLQGRZ�SURFHGXUH�

Page 107: Visual Basic - Subclassing and Hooking with VB & VB NET

*HWWLQJ�EDFN�WR�RXU�(QDEOH6XEFODVV�PHWKRG��LI�QR�VXEFODVVLQJ�KDV�RFFXUUHG��6HW:LQGRZ/RQJ3WULV�FDOOHG�WR�SODFH�RXU�QHZ�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LQWR�WKH�PHVVDJH�VWUHDP�MXVW�EHIRUH�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��7KLV�IXQFWLRQ�ZLOO�UHWXUQ�D�VXFFHVV�RU�HUURU�VWDWXV�WR�WKH�FDOOLQJ�IXQFWLRQ���7KH�QH[W�IXQFWLRQ�LQ�WKLV�FODVV�LV�WKH�'LVDEOH6XEFODVV�PHWKRG��ZKLFK�LV�VKRZQ�LQ�([DPSOH������7KLV�IXQFWLRQ�UHPRYHV�WKH�LQVWDOOHG�VXEFODVVHG�ZLQGRZ�SURFHGXUH�DQG�UHWXUQV�D�VXFFHVV�RU�HUURU�VWDWXV��2QFH�DJDLQ�WKH�PBO2ULJ:QG3URF�PHPEHU�YDULDEOH�LV�FKHFNHG�WR�VHH�LI�LQ�IDFW�D�VXEFODVVHG�ZLQGRZ�SURFHGXUH�KDV�EHHQ�LQVWDOOHG��$�YDOXH�RI�]HUR�PHDQV�WKDW�QRQH�KDV�EHHQ�LQVWDOOHG��,I�WKH�YDOXH�LV�QRQ]HUR��6HW:LQGRZ/RQJ3WU�LV�FDOOHG��WKLV�WLPH�ZLWK�WKH�PBO2ULJ:QG3URF�YDULDEOH�SDVVHG�LQ�WKH�ODVW�DUJXPHQW�WR�WKH�IXQFWLRQ��7KH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LV�UHPRYHG�IURP�WKH�PHVVDJH�VWUHDP��7KLV�ZLOO�KDYH�WKH�HIIHFW�RI�UHVHWWLQJ�WKH�ZLQGRZ�WR�WKH�ZD\�LW�RSHUDWHG�EHIRUH�WKH�VXEFODVVLQJ�ZDV�SHUIRUPHG���

([DPSOH������7KH�'LVDEOH6XEFODVV�0HWKRG��

3XEOLF�)XQFWLRQ�'LVDEOH6XEFODVV�����$V�%RROHDQ�����,I�PBO2ULJ:QG3URF� ���7KHQ���������'R�QRW�UHPRYH�VXEFODVV���QRQH�H[LVW���������'LVDEOH6XEFODVV� �)DOVH�����(OVH���������6HWZLQGRZORQJ3WU�PBKZQG��*:/3B:1'352&��PBO2ULJ:QG3URF���������PBO2ULJ:QG3URF� �����������'LVDEOH6XEFODVV� �7UXH�

Page 108: Visual Basic - Subclassing and Hooking with VB & VB NET

����(QG�,I�(QG�)XQFWLRQ�7KHUH�LV�RQH�ODVW�ELW�RI�FRGH�WR�ORRN�DW�LQ�WKH�&ODVVB7HUPLQDWH�HYHQW���3ULYDWH�6XE�&ODVVB7HUPLQDWH���������&DOO�'LVDEOH6XEFODVV�(QG�6XE�7KLV�FRGH�VLPSO\�FDOOV�WKH�'LVDEOH6XEFODVV�PHWKRG�WR�PDNH�VXUH�WKDW�WKH�VXEFODVVLQJ�LV�SURSHUO\�UHPRYHG��7KLV�HYHQW�LV�ILUHG�EHIRUH�WKH�VXEFODVVHG�ZLQGRZ�ILQLVKHV�VKXWWLQJ�GRZQ��1RWH�WKDW��EHFDXVH�'LVDEOH6XEFODVV�WHVWV�WKH�YDOXH�RI�PBO2ULJ:QG3URF�WR�PDNH�VXUH�WKDW�VXEFODVVLQJ�LV�LQ�HIIHFW��ZH�GR�QRW�QHHG�WR�EH�FRQFHUQHG�WKDW�WKH�FODVV�7HUPLQDWH�HYHQW�ZLOO�UHPRYH�VXEFODVVLQJ�ZKHQ�QRQH�LV�LQ�HIIHFW���

������7KH�%$6�0RGXOH�

7KH�%$6�PRGXOH�GHILQHV�VHYHUDO�$3,�IXQFWLRQV�DQG�FRQVWDQWV�WKDW�ZLOO�EH�XVHG�WKURXJKRXW�WKH�SURMHFW��7KH\�DUH�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�&DOO:LQGRZ3URF�/LE��XVHU����$OLDV��&DOO:LQGRZ3URF$��B�� � �%\9DO�OS3UHY:QG)XQF�$V�/RQJ��%\9DO�KZQG�$V�/RQJ��B�� � %\9DO�0VJ�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ��3XEOLF�'HFODUH�6XE�&RS\0HPRU\�/LE��NHUQHO����$OLDV��5WO0RYH0HPRU\��B�� � �'HVWLQDWLRQ�$V�$Q\��6RXUFH�$V�$Q\��%\9DO�/HQJWK�$V�/RQJ����3XEOLF�'HFODUH�)XQFWLRQ�'HI:LQGRZ3URF�/LE��XVHU����$OLDV��'HI:LQGRZ3URF$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Z0VJ�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B�� � %\9DO�O3DUDP�$V�/RQJ��$V�/RQJ��3XEOLF�&RQVW�:0B&7/&2/25(',7� �+����3XEOLF�&RQVW�:0B6(7&85625� �+���3XEOLF�&RQVW�:0B1&+,77(67� �+���3XEOLF�&RQVW�:0B0286(029(� �+����3XEOLF�&RQVW�:0B1&/%87721'2:1� �+$��3XEOLF�&RQVW�:06=B%27720� ���3XEOLF�&RQVW�:0B6,=,1*� �+����3XEOLF�&RQVW�+70,1%87721� ���3XEOLF�&RQVW�:0B6<6&200$1'� �+����3XEOLF�&RQVW�6&B0,1,0,=(� �+)�����3XEOLF�7\SH�32,17$3,�

Page 109: Visual Basic - Subclassing and Hooking with VB & VB NET

��������[�$V�/RQJ���������\�$V�/RQJ�(QG�7\SH��3XEOLF�7\SH�0,10$;,1)2���������SW5HVHUYHG�$V�32,17$3,���������SW0D[6L]H�$V�32,17$3,���������SW0D[3RVLWLRQ�$V�32,17$3,���������SW0LQ7UDFN6L]H�$V�32,17$3,���������SW0D[7UDFN6L]H�$V�32,17$3,�(QG�7\SH�7KH�%$6�PRGXOH�FRQWDLQV�RQO\�WZR�LWHPV�RI�LQWHUHVW��WKH�SXEOLF�GHFODUDWLRQ�RI�WKH�FODVV�PRGXOH�YDULDEOH�DQG�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH��7KH�FRGH�IRU�WKH�ILUVW�LWHP�LV���'LP�&6XE&OV$SS�$V�&6XEFODVV�7KH�REMHFW�YDULDEOH�QHHGV�WR�EH�GHFODUHG�DV�D�JOREDO�YDULDEOH�LQ�WKH�%$6�PRGXOH��,W�LV�WKHQ�LQVWDQWLDWHG�LQ�WKH�)RUPB/RDG�HYHQW��DV�IROORZV���6HW�&6XE&OV$SS� �1HZ�&6XEFODVV�,I�\RX�GHFODUH�WKH�YDULDEOH�LQ�WKH�IRUP�PRGXOH��WKH�DSSOLFDWLRQ�ZRUNV�ILQH�XQWLO�LW�LV�VWRSSHG�ZLWKRXW�ILUVW�FOLFNLQJ�WKH�8Q�6XEFODVV�EXWWRQ��7KH�SUREOHP�LV�WKDW�WKH�IRUP�PRGXOH�LV�GHVWUR\HG�EHIRUH�WKH�%$6�PRGXOH�FRQWDLQLQJ�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LV�GHVWUR\HG��7KH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�KDV�D�UHIHUHQFH�WR�WKH�IRUP�PRGXOHV�WH[W�ER[��:H�DOO�NQRZ�WKDW�ZKHQ�\RX�DFFHVV�D�FRQWURO�RQ�D�IRUP�WKDW�LV�QRW�ORDGHG��:LQGRZV�DXWRPDWLFDOO\�ORDGV�WKH�IRUP��7KLV��LQ�WXUQ��FUHDWHV�D�QHZ�&6XE&OV$SS�REMHFW��7KH�ILUVW�&6XE&OV$SS�REMHFW�LV�GHVWUR\HG�DORQJ�ZLWK�LWV�PBO2ULJ:QG3URF�YDULDEOH��:KHQ�WKH�DSSOLFDWLRQ�WULHV�WR�ILQLVK�VKXWWLQJ�GRZQ��WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�LV�QRW�UHVWRUHG��$W�WKLV�SRLQW�WKH�ZLQGRZ�LV�VWLOO�VHQGLQJ�PHVVDJHV�WR�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LQ�WKH�%$6�PRGXOH��7KH�%$6�PRGXOH�LV�WKHQ�UHPRYHG�IURP�PHPRU\��ZKLFK�LQYDOLGDWHV�WKH�IXQFWLRQ�SRLQWHU�WR�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH��1RZ�WKLV�IXQFWLRQ�SRLQWHU�LV�SRLQWLQJ�WR�JDUEDJH��:KHQ�D�PHVVDJH�LV�VHQW�WR�WKLV�ZLQGRZ��WKH�DSSOLFDWLRQ�WULHV�WR�FDOO�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�IXQFWLRQ�XVLQJ�WKLV�LQYDOLG�SRLQWHU��DQG�WKH�DSSOLFDWLRQ�FUDVKHV���7KH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LQ�WKH�%$6�PRGXOH�LV�WKH�KHDUW�RI�WKH�VXEFODVVLQJ�RSHUDWLRQ��7KLV�LV�ZKHUH�ZH�FDQ�GR�DOO�RXU�PDJLF��%DVLFDOO\��WKLV�VXEFODVVHG�ZLQGRZ�SURFHGXUH�GLVSOD\V�DOO�PHVVDJHV�VHQW�WR�WKH�ZLQGRZ�E\�ZULWLQJ�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUHV�SDUDPHWHUV�WR�WKH�WH[W�ER[�RQ�WKH�IRUP��7KH�IROORZLQJ�OLQH�RI�FRGH�GRHV�WKLV���IUP&K��W[W0HVVDJHV�7H[W� �IUP&K��W[W0HVVDJHV�7H[W��B�� � �K:QG����KZQG��B��� � ���X0VJ����+H[��X0VJ���B�� � ���Z3DUDP����Z3DUDP��B�� � ���OSDUDP����O3DUDP��YE1HZ/LQH�

Page 110: Visual Basic - Subclassing and Hooking with VB & VB NET

,I�WKLV�LV�WKH�RQO\�OLQH�RI�FRGH�LQ�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH��H[FOXGLQJ�WKH�FDOO�WR�WKH�&DOO:LQGRZ3URF�$3,�IXQFWLRQ���HYHU\�PHVVDJH�VHQW�WR�WKLV�ZLQGRZ�ZLOO�GLVSOD\�LQ�WKH�WH[W�ER[��7KH�QXPEHU�RI�PHVVDJHV�DQG�WKH�VSHHG�DW�ZKLFK�WKH\�DUH�GLVSOD\HG�DUH�RYHUZKHOPLQJ��7R�PDNH�WKLQJV�PRUH�UHDGDEOH��OHWV�SUHYHQW�VRPH�RI�WKH�PRUH�IUHTXHQW�PHVVDJHV�IURP�GLVSOD\LQJ�VR�WKDW�ZH�FDQ�EHWWHU�VHH�ZKDW�LV�JRLQJ�RQ�E\�PRGLI\LQJ�RXU�FRGH�DV�IROORZV���,I�X0VJ� �:0B&7/&2/25(',7�2U�B���������X0VJ� �:0B6(7&85625�2U�B���������X0VJ� �:0B1&+,77(67�2U�B���������X0VJ� �:0B0286(029(�7KHQ�����6NLS�GLVSOD\LQJ�WKHVH�PHVVDJHV�(OVH�����IUP&K��W[W0HVVDJHV�7H[W� �IUP&K��W[W0HVVDJHV�7H[W��B�� � ���K:QG����KZQG��B�� � ���X0VJ����+H[��X0VJ���B�� � ���Z3DUDP����Z3DUDP��B�� � ���OSDUDP����O3DUDP��YE1HZ/LQH�(QG�,I�$GGLQJ�WKLV�,I�7KHQ�(OVH�VWDWHPHQW�WR�ILOWHU�RXW�WKH�PRUH�IUHTXHQW�PHVVDJHV�PDNHV�WKH�UHPDLQLQJ�PHVVDJHV�HDVLHU�WR�UHDG���7KH�ILQDO�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LV�VKRZQ�LQ�([DPSOH�������

([DPSOH������1HZ:QG3URF��WKH�6XEFODVVHG�:LQGRZ�3URFHGXUH��

3XEOLF�)XQFWLRQ�1HZ:QG3URF�%\9DO�KZQG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�����,I�X0VJ� �:0B&7/&2/25(',7�2U�B��������X0VJ� �:0B6(7&85625�2U�B��������X0VJ� �:0B1&+,77(67�2U�B��������X0VJ� �:0B0286(029(�7KHQ������ � 6NLS�GLVSOD\LQJ�WKHVH�PHVVDJHV�� (OVH������ IUP&K��W[W0HVVDJHV�7H[W� �IUP&K��W[W0HVVDJHV�7H[W��B�� � � �K:QG����KZQG��B�� � � ���X0VJ����+H[��X0VJ���B�� � � ���Z3DUDP����Z3DUDP��B�� � � ���OSDUDP����O3DUDP��YE1HZ/LQH�� (QG�,I�� �� 3DVV�PHVVDJH�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�

Page 111: Visual Basic - Subclassing and Hooking with VB & VB NET

����1HZ:QG3URF� �&DOO:LQGRZ3URF�&6XE&OV$SS�2ULJ:QG3URF��KZQG��X0VJ��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�:KHQ�\RX�UXQ�WKH�ILQLVKHG�DSSOLFDWLRQ��LI�\RX�UHPRYH�WKH�,I���(OVH���(QG�,I�FRQVWUXFW�VR�WKDW�DOO�PHVVDJHV�DUH�OLVWHG�LQ�WKH�WH[W�ER[��\RXOO�GLVFRYHU�WKDW�IDU�WRR�PDQ\�PHVVDJHV�DUH�JHQHUDWHG�IRU�\RX�WR�PHDQLQJIXOO\�UHDG�DQG�DQDO\]H��7R�XQGHUVWDQG�ZK\�WKHVH�PHVVDJHV�DUH�EHLQJ�VHQW�VR�IUHTXHQWO\��OHWV�H[DPLQH�WKH�SXUSRVH�RI�HDFK�PHVVDJH�WKDW�ZH�DUH�GHOLEHUDWHO\�LJQRULQJ��(YHU\�WLPH�D�QHZ�OLQH�RI�LQIRUPDWLRQ�LV�ZULWWHQ�WR�WKH�WH[W�ER[�DQG�GLVSOD\HG��WKH�WH[W�ER[�PXVW�UHSDLQW�LWVHOI��7KH�:0B&7/&2/25(',7�PHVVDJH�LV�VHQW�E\�WKH�PXOWLOLQH�WH[W�ER[�WR�LWV�SDUHQW�ZLQGRZ��WKH�RQH�ZKLFK�ZH�DUH�VXEFODVVLQJ��HYHU\�WLPH�WKH�WH[W�ER[�ZDQWV�WR�UHSDLQW�LWVHOI��7KH�SDUHQW��VXEFODVVHG��ZLQGRZ�XVHV�WKLV�LQIRUPDWLRQ�WR�GLUHFW�WKH�UHSDLQWLQJ�RI�WKH�WH[W�ER[�FRQWURO���7KH�:0B6(7&85625�PHVVDJH�LV�VHQW�WR�WKH�ZLQGRZ�GLUHFWO\�XQGHU�WKH�PRXVH�FXUVRU�ZKHQHYHU�WKH�PRXVH�LV�PRYHG�RYHU�WKDW�ZLQGRZ��<RX�FDQ�JHW�DQ�LGHD�RI�WKH�QXPEHU�RI�:0B6(7&85625�PHVVDJHV�WKH�ZLQGRZ�UHFHLYHV�MXVW�E\�UHPRYLQJ�WKH�FKHFN�IRU�WKLV�PHVVDJH�DQG�WKHQ�PRYLQJ�WKH�PRXVH�EDFN�DQG�IRUWK�RYHU�WKH�VXEFODVVHG�ZLQGRZ���7KH�:0B1&+,77(67�PHVVDJH�LV�VLPLODU�WR�WKH�:0B6(7&85625�PHVVDJH�EHFDXVH�LW�LV�VHQW�WR�WKH�ZLQGRZ�ZKHQHYHU�WKH�PRXVH�LV�PRYHG��7KH�:0B1&+,77(67�PHVVDJH�DOVR�LV�VHQW�WR�WKH�ZLQGRZ�ZKHQHYHU�DQ\�PRXVH�EXWWRQ�HYHQW��D�PRXVH�EXWWRQ�GRZQ�PHVVDJH��D�PRXVH�EXWWRQ�XS�PHVVDJH��DQG�RWKHUV��RFFXUV�DV�ZHOO��7KLV�PHVVDJH�LV�VHQW�WR�WKH�ZLQGRZ�EHIRUH�WKH�DFWXDO�PRXVH�PHVVDJHV��H�J���:0B/%87721'2:1��:0B/%8772183��:0B0286(029(��HWF����7KH�:0B1&+,77(67�PHVVDJH�GHWHUPLQHV�ZKHUH�WKH�PRXVH�HYHQW�RFFXUUHG�RQ�WKH�ZLQGRZ��7KLV�LQIRUPDWLRQ�DLGV�WKH�V\VWHP�LQ�GHWHUPLQLQJ�KRZ�WR�SURFHVV�WKH�VXEVHTXHQW�PRXVH�PHVVDJH��)RU�H[DPSOH��:0B1&+,77(67�FDQ�GHWHUPLQH�LI�WKH�PRXVH�HYHQW�RFFXUUHG�LQ�WKH�FOLHQW�RU�QRQFOLHQW�DUHD�RI�D�ZLQGRZ��,I�WKH�OHIW�PRXVH�EXWWRQ�ZDV�SUHVVHG�LQ�D�QRQFOLHQW�SRUWLRQ�RI�D�ZLQGRZ��WKH�:0B1&/%87721'2:1�PHVVDJH�ZRXOG�EH�VHQW��,I�WKH�VDPH�PRXVH�HYHQW�RFFXUUHG�LQ�WKH�FOLHQW�DUHD�RI�D�ZLQGRZ��WKH�:0B/%87721'2:1�PHVVDJH�ZRXOG�EH�VHQW���7KH�ILQDO�PHVVDJH�WKDW�ZLOO�QRW�EH�GLVSOD\HG�LV�WKH�:0B0286(029(�PHVVDJH��$W�ILUVW�JODQFH�LW�PLJKW�VHHP�WKDW�WKLV�PHVVDJH�LV�WKH�VDPH�DV�WKH�:0B6(7&85625�PHVVDJH��%RWK�DUH�VHQW�IRU�PRXVH�PRYH�HYHQWV��7KH�GLIIHUHQFH�LV�LQ�HDFK�PHVVDJHV�SDUDPHWHUV��7KH�:0B0286(029(�PHVVDJH�KDV�SDUDPHWHUV�WR�GHWHUPLQH�LI�D�PRXVH�EXWWRQ�LV�GHSUHVVHG��7KLV�PHVVDJH�FDQ�EH�XVHIXO�ZKHQ�VXEFODVVLQJ�D�ZLQGRZ�WR�PRGLI\�LWV�GUDJ�DQG�GURS�RSHUDWLRQV���<RX�VKRXOG�H[SHULPHQW�E\�DOORZLQJ�VSHFLILF�PHVVDJHV�RU�DOO�PHVVDJHV�WR�EH�GLVSOD\HG�LQ�WKH�WH[W�ER[��7KLV�ZLOO�JLYH�\RX�DQ�LQGLFDWLRQ�RI�WKH�QXPEHU�RI�PHVVDJHV�D�ZLQGRZ�ZLOO�UHFHLYH�HYHU\�VHFRQG�RI�LWV�H[LVWHQFH���

������7KH�)RUP�0RGXOH�

Page 112: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�FRGH�IRU�WKH�IRUP�PRGXOH��ZKLFK�LV�VKRZQ�LQ�([DPSOH������LV�YHU\�VLPSOH��:KHQ�WKH�IRUP�ORDGV��LW�FUHDWHV�DQ�REMHFW�LQVWDQFH�RI�WKH�&6XEFODVV�FODVV�DQG�VHWV�LWV�K:QG�SURSHUW\��:KHQ�WKH�6XEFODVV�EXWWRQ�LV�FOLFNHG��WKH�VXEFODVVLQJ�REMHFW��&6XE&OV$SS��ZLOO�VXEFODVV�WKH�ZLQGRZ�LGHQWLILHG�E\�WKH�&6XE&OV$SS�KZQG�SURSHUW\��7KLV�LV�SHUIRUPHG�LQ�WKH�&6XE&OV$SS�(QDEOH6XEFODVV�IXQFWLRQ��:KHQ�WKH�8Q�6XEFODVV�EXWWRQ�LV�FOLFNHG��WKH�VXEFODVVLQJ�FRGH�LV�UHPRYHG�E\�FDOOLQJ�WKH�&6XE&OV$SS�'LVDEOH6XEFODVV�IXQFWLRQ��)LQDOO\��WKH�REMHFW�ZH�FUHDWHG�LV�GHVWUR\HG�ZKHQ�ZH�XQORDG�WKLV�ZLQGRZ��7KLV�DOORZV�WKH�FRGH�LQ�WKH�&6XEFODVVB7HUPLQDWH�HYHQW�WR�UHPRYH�DQ\�VXEFODVVLQJ�VR�WKDW�WKH�DSSOLFDWLRQ�FDQ�VKXW�GRZQ�ZLWKRXW�FUDVKLQJ���

([DPSOH������&RGH�IRU�WKH�IUP&K��)RUP��

3ULYDWH�6XE�)RUPB/RDG���������6HW�&6XE&OV$SS� �1HZ�&6XEFODVV�����&6XE&OV$SS�KZQG� �0H�KZQG�(QG�6XE��3ULYDWH�6XE�FPG6XEFODVVB&OLFN���������&DOO�&6XE&OV$SS�(QDEOH6XEFODVV�(QG�6XE��3ULYDWH�6XE�FPG8Q6XEFODVVB&OLFN���������&DOO�&6XE&OV$SS�'LVDEOH6XEFODVV�(QG�6XE��3ULYDWH�6XE�)RUPB4XHU\8QORDG�&DQFHO�$V�,QWHJHU��8QORDG0RGH�$V�,QWHJHU������6HW�&6XE&OV$SS� �1RWKLQJ�(QG�6XE�

������'RLQJ�6RPHWKLQJ�,QWHUHVWLQJ�

$OWKRXJK�WKLV�LV�D�JRRG�H[HUFLVH�LQ�OHDUQLQJ�KRZ�WR�VXEFODVV�D�ZLQGRZ��ZH�DUH�QRW�GRLQJ�DQ\WKLQJ�XVHIXO�KHUH��,Q�WKLV�VHFWLRQ��,�ZLOO�VKRZ�\RX�KRZ�WR�DOORZ�D�XVHU�WR�UHVL]H�RQO\�RQH�VLGH�RI�D�ZLQGRZ�ZLWKRXW�UHVL]LQJ�DQ\�RWKHU�SRUWLRQ�RI�WKH�ZLQGRZ��$OVR��,�ZLOO�RYHUULGH�WKH�GHIDXOW�ZLQGRZV�PLQLPL]H�IXQFWLRQDOLW\�E\�FDSWXULQJ�PHVVDJHV�VSHFLILF�WR�ZLQGRZ�PLQLPL]DWLRQ��%\�LQWHUFHSWLQJ�WKHVH�PHVVDJHV��ZH�FDQ�IRUFH�WKH�ZLQGRZ�WR�UROO�XS�RU�KLGH�LWVHOI�LQ�DQ\�RWKHU�ZD\�WKDW�ZH�ZDQW�ZKHQ�WKH�XVHU�WULHV�WR�PLQLPL]H�WKH�ZLQGRZ���

��������2YHUULGLQJ�ZLQGRZ�UHVL]LQJ��

Page 113: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�ILUVW�WKLQJ�ZH�PXVW�GR��EHIRUH�ZULWLQJ�DQ\�FRGH��LV�ILJXUH�RXW�ZKLFK�PHVVDJH�RU�PHVVDJHV�WR�FDSWXUH��,�XVXDOO\�XVH�WKH�6S\���WRRO�LQ�FRQMXQFWLRQ�ZLWK�WKH�0LFURVRIW�'HYHORSHU�1HWZRUN��06'1��&'�520��,�XVH�WKH�6S\���WRRO�WR�ZDWFK�IRU�VSHFLILF�PHVVDJHV�RU�IRU�SDWWHUQV�RI�PHVVDJHV��7KHQ�,�ORRN�XS�WKHLU�PHDQLQJV�LQ�WKH�06'1��<RX�DOVR�FRXOG�GR�WKH�UHYHUVH�DQG�ILJXUH�RXW�ZKLFK�PHVVDJHV�\RX�ZLOO�QHHG�WR�ZDWFK�IRU�E\�ORRNLQJ�XS�PHVVDJHV�VSHFLILF�WR�WKH�W\SH�RI�ZLQGRZ�\RX�DUH�VXEFODVVLQJ�LQ�WKH�06'1��7KHQ��XVLQJ�6S\����ZDWFK�IRU�WKHVH�VSHFLILF�PHVVDJHV���

�7KRURXJKO\�UHVHDUFK�WKH�PHVVDJHV�WKDW�\RX�ZLOO�EH�WUDSSLQJ�LQ�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH��(DFK�PHVVDJH�KDV�LWV�RZQ�LGLRV\QFUDVLHV����

8VXDOO\�LW�WDNHV�PRUH�WKDQ�RQH�PHVVDJH�WR�SHUIRUP�DQ�DFWLRQ�LQ�:LQGRZV��7DNH��IRU�H[DPSOH��UHVL]LQJ�D�ZLQGRZ��'XULQJ�WKLV�RSHUDWLRQ��PDQ\�PHVVDJHV�DUH�VHQW�WR�DQG�IURP�D�ZLQGRZ�ZKHQ�LW�LV�JRLQJ�WKURXJK�WKH�UHVL]LQJ�SURFHVV��7KH�IROORZLQJ�LV�D�OLVW�RI�WKH�PHVVDJHV�VHQW�DQG�WKHLU�RUGHU�IRU�WKH�VL]LQJ�SURFHVV���:0B1&/%87721'2:1������������������������3RVWHG�:0B6<6&200$1'���������������������������6HQW������:0B(17(56,=(029(�������������������6HQW������:0B(17(56,=(029(�������������������5HFHLYHG������:0B6,=,1*��������������������������6HQW������:0B6,=,1*��������������������������5HFHLYHG������:0B:,1'2:326&+$1*,1*���������������6HQW�����������:0B*(70,10$;,1)2��������������6HQW�����������:0B*(70,10$;,1)2��������������5HFHLYHG������:0B:,1'2:326&+$1*,1*���������������5HFHLYHG������:0B:,1'2:326&+$1*('����������������6HQW������:0B6,=(����������������������������6HQW�� � ���:LQGRZ�LV�UHSDLQWHG�������:0B6,=(����������������������������5HFHLYHG������:0B:,1'2:326&+$1*('����������������5HFHLYHG������:0B(;,76,=(029(��������������������6HQW������:0B(;,76,=(029(��������������������5HFHLYHG�:0B6<6&200$1'���������������������������5HFHLYHG�7KH�SURFHVV�VWDUWV�ZLWK�WKH�XVHU�FOLFNLQJ�WKH�OHIW�PRXVH�EXWWRQ�RYHU�D�ZLQGRZ�ERUGHU�DQG�GUDJJLQJ�WKDW�ERUGHU�WR�UHVL]H�LW��$�:0B1&/%87721'2:1�PHVVDJH�LV�SRVWHG�WR�WKLV�ZLQGRZ�LQ�UHVSRQVH�WR�WKH�XVHU�FOLFNLQJ�DQG�KROGLQJ�GRZQ�WKH�OHIW�PRXVH�EXWWRQ��7KLV�PHVVDJH�FRQWDLQV�LQIRUPDWLRQ�DERXW�ZKLFK�ERUGHU�WKH�PRXVH�LV�RYHU�LQ�LWV�Z3DUDP�DUJXPHQW��7KLV�PHVVDJH�LV�WKHQ�SDVVHG�RQ�WR�WKH�'HI:LQGRZ3URF�IXQFWLRQ�DIWHU�WKH�ZLQGRZ�SURFHGXUH�KDV�ILQLVKHG�SURFHVVLQJ�LW��'HI:LQGRZ3URF�GHWHUPLQHV�LI�D�VL]LQJ�RSHUDWLRQ�QHHGV�WR�EH�

Page 114: Visual Basic - Subclassing and Hooking with VB & VB NET

LQLWLDWHG��,I�VR��'HI:LQGRZ3URF�VHQGV�D�:0B6<6&200$1'�PHVVDJH�WR�WKH�PHVVDJH�TXHXH�RI�WKH�ZLQGRZ�EHLQJ�UHVL]HG��7KH�Z3DUDP�PHPEHU�IRU�WKLV�PHVVDJH�FRQWDLQV�WKH�YDOXH�6&B6,=(��ZKLFK�LQIRUPV�WKH�ZLQGRZ�WKDW�LW�LV�EHLQJ�VL]HG��7KH�O3DUDP�PHPEHU�FRQWDLQV�WKH�PRXVH�FXUVRUV�[�DQG�\�SRVLWLRQ��$W�WKLV�SRLQW��WKH�XVHU�LV�KROGLQJ�WKH�OHIW�PRXVH�EXWWRQ�GRZQ�ZKLOH�GUDJJLQJ�D�ERUGHU�RI�WKH�ZLQGRZ��$OO�PHVVDJHV�IURP�WKLV�SRLQW�DUH�QHVWHG�ZLWKLQ�WKH�:0B6<6&200$1'�PHVVDJH��,Q�RWKHU�ZRUGV��WKH�ZLQGRZ�SURFHGXUH�GRHV�QRW�UHWXUQ�LPPHGLDWHO\�ZKHQ�LW�LV�SDVVHG�WKLV�PHVVDJH��LQVWHDG��RWKHU�PHVVDJHV�DUH�VHQW�LQ�UHVSRQVH�WR�WKLV�PHVVDJH���7KH�RQO\�PHVVDJH�WKDW�LV�SRVWHG�LV�:0B1&/%87721'2:1��DOO�RWKHU�PHVVDJHV�IRU�WKH�VL]LQJ�SURFHVV�DUH�VHQW�WR�WKH�ZLQGRZ��7KH�GLIIHUHQFH�LV�WKDW�SRVWHG�PHVVDJHV�DUH�VHQW�WR�WKH�ZLQGRZV�PHVVDJH�TXHXH��ZKLOH�VHQW�PHVVDJHV�DUH�VHQW�GLUHFWO\�WR�WKH�ZLQGRZ�SURFHGXUH�IRU�LPPHGLDWH�SURFHVVLQJ��7KH�'HI:LQGRZ3URF�IXQFWLRQ�VHQGV�WKHVH�PHVVDJHV�WR�WKH�ZLQGRZ�VR�WKDW�WKH\�FDQ�EH�SURFHVVHG�EHIRUH�DQ\�SHQGLQJ�PHVVDJHV�LQ�WKH�TXHXH��:KHQ�VL]LQJ�D�ZLQGRZ��WKH�V\VWHP�GRHV�QRW�ZDQW�DQ\�RWKHU�PHVVDJHV�WR�LQWHUIHUH�ZLWK�WKLV�RSHUDWLRQ���,Q�UHVSRQVH�WR�WKH�:0B6<6&200$1'�PHVVDJH��'HI:LQGRZ3URF�VHQGV�WKH�:0B(17(56,=(029(�PHVVDJH�WR�WKH�ZLQGRZ��7KLV�PHVVDJH�LQIRUPV�WKH�ZLQGRZ�WKDW�LW�KDV�HQWHUHG�D�VL]LQJ�RU�PRYLQJ�PRGDO�ORRS��:KLOH�LQ�WKLV�PRGDO�ORRS��WKH�ZLQGRZ�LV�IRUFHG�WR�SURFHVV�RQO\�SRVLWLRQLQJ�RU�VL]LQJ�PHVVDJHV��7KLV�SXWV�DOO�RWKHU�PHVVDJHV�WKDW�FRXOG�DGYHUVHO\�DIIHFW�WKH�VL]LQJ�RU�SRVLWLRQLQJ�RI�D�ZLQGRZ�RQ�KROG��7KLV�PRGDO�ORRS�UXQV�IURP�ZLWKLQ�WKH�'HI:LQGRZ3URF�IXQFWLRQ��:KLOH�LQ�WKLV�ORRS��WKH�IXQFWLRQ�ZLOO�RQO\�VHQG�PHVVDJHV�WR�WKH�ZLQGRZ�UHODWLQJ�WR�WKH�VL]LQJ�SURFHVV���$IWHU�VHQGLQJ�WKH�:0B(17(56,=(029(�PHVVDJH��WKH�'HI:LQGRZ3URF�IXQFWLRQ�VHQGV�WKH�:0B6,=,1*�PHVVDJH�WR�WKH�ZLQGRZ��7KH�Z3DUDP�PHPEHU�IRU�WKLV�PHVVDJH�FRQWDLQV�WKH�ZLQGRZ�ERUGHU�WKDW�LV�EHLQJ�VL]HG��7KH�O3DUDP�PHPEHU�FRQWDLQV�D�SRLQWHU�WR�D�5(&7�VWUXFWXUH��ZKLFK�GHILQHV�WKH�GLPHQVLRQ�DQG�SRVLWLRQ�RI�WKH�ZLQGRZ��7KH�ZLQGRZ�SURFHGXUH�VHQGV�WKLV�PHVVDJH�WR�WKH�'HI:LQGRZ3URF�IXQFWLRQ�ZKHQ�LW�LV�ILQLVKHG�SURFHVVLQJ�LW���1H[W��'HI:LQGRZ3URF�VHQGV�WKH�:0B:,1'2:326&+$1*,1*�PHVVDJH�FRQWDLQLQJ�WKH�QHZ�YDOXHV�IRU�WKH�ZLQGRZ�VL]H��SRVLWLRQ��DQG�=�RUGHU��7KLV�PHVVDJH�FRQWDLQV�D�SRLQWHU�WR�WKH�:,1'2:326�VWUXFWXUH�LQ�WKH�O3DUDP�PHPEHU�DQG�18//�LQ�WKH�Z3DUDP�PHPEHU��7KH�:,1'2:326�VWUXFWXUH�FRQWDLQV�WKH�VL]H��SRVLWLRQ��DQG�=�RUGHU�YDOXHV�RI�WKH�ZLQGRZ��7KHVH�YDOXHV�FDQ�EH�PRGLILHG�WR�RYHUULGH�WKH�GHIDXOW�VL]LQJ��PRYLQJ��DQG�=�RUGHU�EHKDYLRUV���,Q�UHVSRQVH�WR�WKH�:0B:,1'2:326&+$1*,1*�PHVVDJH��'HI:LQGRZ3URF�VHQGV�D�:0B*(70,10$;,1)2�PHVVDJH�WR�WKH�ZLQGRZ�EHLQJ�VL]HG��7KLV�PHVVDJH�DOORZV�WKH�DSSOLFDWLRQ�WR�YDOLGDWH�WKH�ZLQGRZ�VL]H�DQG�SRVLWLRQ�EHIRUH�SURFHHGLQJ��7KLV�PHVVDJH�FRQWDLQV�D�SRLQWHU�WR�WKLV�VWUXFWXUH�GHILQLQJ�WKH�GHIDXOW�YDOXHV�IRU�WKLV�ZLQGRZV�PD[LPL]HG�SRVLWLRQ��PD[LPL]HG�VL]H��DQG�WUDFNLQJ�VL]H�LQ�WKH�O3DUDP�PHPEHU��7KH�YDOXHV�LQ�WKLV�VWUXFWXUH�FDQ�EH�PRGLILHG�WR�FRQWURO�WKH�RXWFRPH�RI�WKH�VL]LQJ�RU�PRYLQJ�RSHUDWLRQ��7KH�Z3DUDP�PHPEHU�FRQWDLQV�D�18//���1H[W��'HI:LQGRZ3URF�VHQGV�WKH�:0B:,1'2:326&+$1*('�PHVVDJH��7KLV�PHVVDJH�LV�VLPLODU�WR�WKH�:0B:,1'2:326&+$1*,1*�PHVVDJH��H[FHSW�WKDW�WKH�VL]H��SRVLWLRQ��DQG�=�

Page 115: Visual Basic - Subclassing and Hooking with VB & VB NET

RUGHU�RI�WKH�ZLQGRZ�KDYH�EHHQ�FKDQJHG��7KH�O3DUDP�DQG�Z3DUDP�PHPEHUV�DUH�H[DFWO\�WKH�VDPH�IRU�ERWK�PHVVDJHV��0RGLILFDWLRQV�PDGH�WR�WKH�:,1'2:326�VWUXFWXUH�FRQWDLQHG�LQ�WKH�O3DUDP�PHPEHU�RI�WKLV�PHVVDJH�ZLOO�KDYH�QR�HIIHFW�RQ�WKH�ZLQGRZ���:KHQ�WKH�XVHU�UHOHDVHV�WKH�OHIW�PRXVH�EXWWRQ��WKH�:0B6,=(�PHVVDJH�LV�VHQW�E\�'HI:LQGRZ3URF�LQIRUPLQJ�WKH�ZLQGRZ�WKDW�WKH�XVHU�LV�ILQLVKHG�VL]LQJ�WKH�ZLQGRZ��7KH�O3DUDP�PHPEHU�RI�WKLV�PHVVDJH�FRQWDLQV�WKH�6,=(B5(6725('�IODJ��ZKLFK�LQIRUPV�WKH�ZLQGRZ�WKDW�LW�KDV�EHHQ�UHVL]HG��7KH�Z3DUDP�PHPEHU�FRQWDLQV�WKH�QHZ�ZLGWK�DQG�KHLJKW�RI�WKH�FOLHQW�DUHD�RI�WKLV�ZLQGRZ��0RUH�PHVVDJHV�DUH�VHQW�WR�UHSRVLWLRQ�DQG�UHSDLQW�WKH�QHZO\�VL]HG�ZLQGRZ��)LQDOO\��D�:0B(;,76,=(029(�PHVVDJH�LV�VHQW�E\�'HI:LQGRZ3URF�WR�WKH�ZLQGRZ��IRUFLQJ�WKH�ZLQGRZ�WR�H[LW�WKH�VL]LQJ�PRGDO�ORRS�DQG�DOORZ�RWKHU�PHVVDJHV�LQ�WKH�PHVVDJH�TXHXH�WR�EH�SURFHVVHG�QRUPDOO\��7KLV�PHVVDJH�FRQWDLQV�18//V�LQ�LWV�Z3DUDP�DQG�O3DUDP�PHPEHUV��,W�LV�KHUH�WKDW�WKH�:0B6<6&200$1'�PHVVDJH�UHWXUQV�IURP�WKH�'HI:LQGRZ3URF�IXQFWLRQ�DQG�WKH�ZLQGRZ�LV�RQFH�DJDLQ�DEOH�WR�SXOO�PHVVDJHV�IURP�LWV�PHVVDJH�TXHXH���0DQ\�DFWLRQV�SHUIRUPHG�RQ�D�ZLQGRZ�FRQVLVW�RI�D�VHULHV�RI�PHVVDJHV��&RQVLGHU�FUHDWLQJ�D�ZLQGRZ��GHVWUR\LQJ�D�ZLQGRZ��PD[LPL]LQJ�D�ZLQGRZ��RU�HYHQ�DFWLYDWLQJ�D�ZLQGRZ��7KLV�GRHV�QRW�PHDQ�WKDW�DOO�DFWLRQV�WKDW�WDNH�SODFH�DUH�WKLV�FRPSOH[��EXW�EH�SUHSDUHG�WR�GLJ�LQ�WR�WKH�PHVVDJHV�DQG�WKHLU�GHILQLWLRQV���7R�GHWHUPLQH�ZKLFK�PHVVDJHV�,�ZDV�LQWHUHVWHG�LQ��,�VHW�XS�6S\���WR�ZDWFK�IRU�*HQHUDO�PHVVDJHV�DQG�1RQ�&OLHQW�PHVVDJHV�IRU�D�SDUWLFXODU�ZLQGRZ��7KHQ�,�SUHVVHG�WKH�)��NH\�WR�DOORZ�6S\���WR�VWDUW�ORJJLQJ�PHVVDJHV��,�DFWLYDWHG�WKH�ZLQGRZ�WKDW�ZDV�EHLQJ�VSLHG�RQ�DQG�UHVL]HG�D�ERUGHU��$V�VRRQ�DV�,�ZDV�GRQH��,�VWRSSHG�6S\���IURP�ORJJLQJ�DQ\�PRUH�PHVVDJHV��0DQ\�PHVVDJHV�ZHUH�ILUHG��EXW�IRUWXQDWHO\�PDQ\�RI�WKHVH�ZHUH�GXSOLFDWHV�IURP�VXFK�DFWLRQV�DV�PRYLQJ�WKH�PRXVH��:0B1&+,77(67�LV�RQH�RI�WKH�PHVVDJHV�WKDW�DSSHDU�PXOWLSOH�WLPHV��$V�,�PHQWLRQHG�HDUOLHU�LQ�WKLV�FKDSWHU��LQ�6HFWLRQ��������WKLV�PHVVDJH�LV�GLUHFWO\�UHODWHG�WR�PRXVH�DFWLRQV��%HFDXVH�PRXVH�DFWLRQV�DUH�UHTXLUHG�IRU�VL]LQJ�D�ZLQGRZ�ERUGHU��FOLFNLQJ�WKH�PRXVH�EXWWRQ�DQG�GUDJJLQJ�WKH�ZLQGRZ�ERUGHU���WKLV�PHVVDJH�LV�RI�LPSRUWDQFH��/RRNLQJ�GRZQ�WKURXJK�WKH�OLVW�RI�PHVVDJHV��,�QRWLFHG�WKH�VSRW�ZKHUH�VL]LQJ�DQG�UHSDLQWLQJ�PHVVDJHV�VWDUWHG�WR�DSSHDU��H�J���:0B6,=,1*��:0B:,1'2:326&+$1*('��:0B6,=(��HWF����7KLV�LV�WKH�DUHD�ZKHUH�WKH�ZLQGRZ�UHVL]LQJ�WRRN�SODFH��$W�WKH�EHJLQQLQJ�RI�WKH�UHVL]LQJ�RSHUDWLRQ��D�:0B1&/%87721'2:1�PHVVDJH�LV�SRVWHG�ZLWK�WKH�SDUDPHWHU�+7%27720��7KLV�PHDQV�WKDW�WKH�OHIW�PRXVH�EXWWRQ�ZDV�FOLFNHG�ZKLOH�WKH�FXUVRU�ZDV�RYHU�WKH�ERWWRP�ERUGHU�RI�WKH�ZLQGRZ��+7%27720����6R��QRZ�WKDW�ZH�KDYH�D�VHQVH�RI�WKH�VHTXHQFH�RI�PHVVDJHV�LQYROYHG�LQ�UHVL]LQJ�D�ZLQGRZ��ZH�FDQ�ZULWH�D�ZLQGRZ�SURFHGXUH�WKDW�ZLOO�RQO\�DOORZ�WKH�ZLQGRZV�ERWWRP�ERUGHU�WR�EH�UHVL]HG��7KLV�SURFHGXUH��ZKLFK�LV�VKRZQ�LQ�([DPSOH������XVHV�&DOO:LQGRZ3URF�WR�SDVV�DOO�PHVVDJHV�RQ�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��ZLWK�D�VLQJOH�H[FHSWLRQ��DQ\�:0B1&/%87721'2:1�PHVVDJH�ZKRVH�Z3DUDP�PHPEHU�KDV�D�YDOXH�RWKHU�WKDQ�+7%27720��LQGLFDWLQJ�WKDW�WKH�XVHU�LV�DWWHPSWLQJ�WR�UHVL]H�WKH�WRS��OHIW��ULJKW��WRS�ULJKW��WRS�OHIW��ERWWRP�ULJKW��RU�ERWWRP�OHIW�ERUGHUV��LV�KDQGOHG�E\�RXU�ZLQGRZ�SURFHGXUH�DORQH��,W�DGGV�D�OLQH�WR�WKH�WH[W�ER[���6NLSSLQJ�WKH�UHVL]H�SURFHVV���DQG�UHWXUQV�D����LQGLFDWLQJ�WKDW�SURFHVVLQJ�

Page 116: Visual Basic - Subclassing and Hooking with VB & VB NET

RI�WKH�PHVVDJH�LV�FRPSOHWH��$V�D�UHVXOW��WKH�GHIDXOW�VL]LQJ�EHKDYLRU�RFFXUV�RQO\�ZKHQ�WKH�Z3DUDP�RI�WKLV�PHVVDJH�LV�HTXDO�WR�+7%27720��2WKHUZLVH��WKH�GHIDXOW�VL]LQJ�URXWLQH�LV�QRW�FDOOHG���

([DPSOH������:LQGRZ�3URFHGXUH�WR�$OORZ�5HVL]LQJ�RI�2QO\�WKH�%RWWRP�:LQGRZ�%RUGHU��

3XEOLF�)XQFWLRQ�1HZ:QG3URF�%\9DO�KZQG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�� ,I�X0VJ� �:0B1&/%87721'2:1�$QG�B��������Z3DUDP� �+7/()7�2U�Z3DUDP� �+75,*+7�2U�B�������Z3DUDP� �+7723�2U�Z3DUDP� �+7723/()7�2U�B�������Z3DUDP� �+77235,*+7�2U�Z3DUDP� �+7%27720/()7�2U�B�������Z3DUDP� �+7%277205,*+7��7KHQ������ ����IUP&K��W[W0HVVDJHV�7H[W� �IUP&K��W[W0HVVDJHV�7H[W��B�� � � �6NLSSLQJ�WKH�UHVL]H�SURFHVV���YE1HZ/LQH������ ����1HZ:QG3URF� ���� (OVH�� � 1HZ:QG3URF� �&DOO:LQGRZ3URF�&6XE&OV$SS�2ULJ:QG3URF��B�� � � KZQG��X0VJ��Z3DUDP��O3DUDP��� (QG�,I�(QG�)XQFWLRQ�

�7R�DOORZ�WKH�ZLQGRZ�WR�SHUIRUP�WKH�GHIDXOW�SURFHVVLQJ�IRU�D�PHVVDJH��LW�PXVW�EH�SDVVHG�RQ�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��&DOO:LQGRZ3URF��RU�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH��'HI:LQGRZ3URF�����

7KHUH�LV�RQH�SUREOHP��WKRXJK��,I�\RX�FOLFN�WKH�V\VWHP�PHQX�RI�WKH�VXEFODVVHG�ZLQGRZ��FKRRVH�WKH�6L]H�PHQX�LWHP��DQG�WKHQ�VL]H�DQ\�ZLQGRZ�ERUGHU��RXU�FRGH�ZLOO�QRW�VWRS�DQ\�EXW�WKH�ERWWRP�ERUGHU�IURP�EHLQJ�UHVL]HG��)RU�VRPH�UHDVRQ��RXU�FRGH�LV�QRW�EHLQJ�H[HFXWHG��:K\�LV�WKLV"�6WDUW�XS�6S\���DQG�ZDWFK�WKH�1RQ�&OLHQW�DQG�*HQHUDO�PHVVDJHV��VHOHFW�WKHVH�WZR�RQ�WKH�0HVVDJHV�WDE�RI�WKH�0HVVDJH�2SWLRQV�GLDORJ�ER[��ZKHQ�UHVL]LQJ�WKH�ZLQGRZ�XVLQJ�WKH�6L]H�V\VWHP�PHQX�LWHP��$�ODUJH�QXPEHU�RI�:0B1&+,77(67�PHVVDJHV�ZLOO�DSSHDU��2GGO\��QR�:0B1&/%87721'2:1�PHVVDJHV�DSSHDU��6L]LQJ�WKH�ZLQGRZ�ERUGHUV�XVLQJ�WKH�6L]H�PHQX�LWHP�E\SDVVHV�WKH�:0B1&/%87721'2:1�PHVVDJH��6S\���VKRZV�WKDW�WKLV�LV�EHFDXVH�ZKHQ�ZH�UHVL]H�D�ZLQGRZ�E\�FOLFNLQJ�DQG�GUDJJLQJ�ZLWK�WKH�PRXVH��WKH�:0B1&/%87721'2:1�PHVVDJH�LV�ZKDW�FDXVHV�WKH�:0B6<6&200$1'�PHVVDJH�WR�EH�ILUHG�ZLWK�D�Z3DUDP�YDOXH�RI�6&B6,=(��:KHQ�ZH�UHVL]H�WKH�ZLQGRZ�E\�XVLQJ�WKH�6L]H�PHQX�LWHP��WKH�:0B6<6&200$1'�PHVVDJH�ZLWK�WKH�6&B6,=(�Z3DUDP�YDOXH�LV�DXWRPDWLFDOO\�

Page 117: Visual Basic - Subclassing and Hooking with VB & VB NET

SRVWHG�WR�WKH�ZLQGRZV�PHVVDJH�TXHXH��7KXV��EHFDXVH�WKH�ZLQGRZ�LV�DOUHDG\�LQ�WKH�VL]LQJ�PRGDO�ORRS��WKH�:0B1&/%87721'2:1�PHVVDJH�LV�XQQHFHVVDU\���7R�VROYH�RXU�GLOHPPD��ZH�FRXOG�UHPRYH�WKH�6L]H�PHQX�LWHP�IURP�WKH�V\VWHP�PHQX��EXW�D�VROXWLRQ�WKDW�GRHV�QRW�IRUFH�XV�WR�PRGLI\�RWKHU�EHKDYLRUV�MXVW�WR�IL[�WKH�LPPHGLDWH�SUREOHP�LV�SUHIHUDEOH��7KHVH�VKRUW�WHUP�VROXWLRQV�DUH�VKRUW�FXWV�DQG�KDYH�FDXVHG�SUREOHPV�IRU�PDQ\�D�GHYHORSHU�ODWHU�RQ�LQ�WKH�GHYHORSPHQW�F\FOH��,QVWHDG��LQ�VXFK�FDVHV��PRUH�UHVHDUFK�DQG�PRUH�REVHUYDWLRQ�XVXDOO\�KHOSV��<RX�PLJKW�QRWLFH�LQ�WKH�6S\���RXWSXW�WKDW�RQH�PHVVDJH�LV�DOZD\V�XVHG�LQ�WKH�VL]LQJ�SURFHVV��:0B6,=,1*��7KLV�PHVVDJH��VLPLODU�WR�:0B1&/%87721'2:1��FRQWDLQV�D�FRQVWDQW�LGHQWLI\LQJ�WKH�ERUGHU�WKDW�LV�EHLQJ�VL]HG�LQ�WKH�Z3DUDP�PHPEHU��7KH�O3DUDP�PHPEHU�LV�D�SRLQWHU�WR�D�5(&7�VWUXFWXUH�GHILQLQJ�WKH�QHZ�VL]H�RI�WKH�ZLQGRZ���/LPLWLQJ�ZLQGRZ�VL]LQJ�WR�WKH�ERWWRP�ERUGHU�LV�VWUDLJKWIRUZDUG��:HOO�XVH�WKH�*HW:LQGRZ5HFW�$3,�IXQFWLRQ�WR�JHW�WKH�FXUUHQW�VL]H�DQG�SRVLWLRQ�RI�WKH�ZLQGRZ��5HPHPEHU��WKH�ZLQGRZ�KDV�QRW�EHHQ�VL]HG�DW�WKLV�SRLQW��*HW:LQGRZ5HFW�LV�GHILQHG�LQ�9%�DV�IROORZV���3ULYDWH�'HFODUH�)XQFWLRQ�*HW:LQGRZ5HFW�/LE��XVHU����B�� � �%\9DO�KZQG�$V�/RQJ��OS5HFW�$V�5(&7��$V�/RQJ�,WV�SDUDPHWHUV�DUH��KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�OS5HFW

$�SRLQWHU�WR�D�5(&7�VWUXFWXUH�$�5(&7�VWUXFWXUH�LV�GHILQHG�LQ�9%�DV�IROORZV���3XEOLF�7\SH�5(&7���������/HIW�$V�/RQJ���������(TXDO�WR�WKH�/HIW�SURSHUW\�RI�D�IRUP���������7RS�$V�/RQJ����������(TXDO�WR�WKH�7RS�SURSHUW\�RI�D�IRUP���������5LJKW�$V�/RQJ��������(TXDO�WR�WKH�:LGWK�SURSHUW\�RI�D�IRUP���������%RWWRP�$V�/RQJ�������(TXDO�WR�WKH�+HLJKW�SURSHUW\�RI�D�IRUP�(QG�7\SH�*HW:LQGRZ5HFW�LV�XVHG�WR�JHW�WKH�SUHYLRXV�SRVLWLRQ�DQG�VL]H�RI�WKH�ZLQGRZ��7KLV�LQIRUPDWLRQ�LV�XVHG�WR�UHSODFH�WKH�GDWD�SRLQWHG�WR�E\�WKH�O3DUDP�PHPEHU�RI�WKH�:0B6,=,1*�PHVVDJH�VWUXFWXUH�LQ�DOO�VLWXDWLRQV�H[FHSW�ZKHQ�WKH�ERWWRP�ERUGHU�LV�EHLQJ�VL]HG��7KH�FRGH�WR�GR�WKLV�LV�VKRZQ�LQ�([DPSOH�������

([DPSOH������:LQGRZ�3URFHGXUH�WR�+DQGOH�5HVL]LQJ�ZLWK�WKH�6\VWHP�0HQX��

3XEOLF�)XQFWLRQ�1HZ:QG3URF�%\9DO�KZQG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ����������'LP�5HFW6WUXFW�$V�5(&7�����'LP�2ULJ5HFW6WUXFW�$V�5(&7�� �

Page 118: Visual Basic - Subclassing and Hooking with VB & VB NET

� ,I�X0VJ� �:0B6,=,1*�$QG�Z3DUDP��!�:06=B%27720�7KHQ��'R�QRW�VL]H���������*HW�QHZ�ZLQGRZ�GLPHQVLRQV���������&RS\0HPRU\�5HFW6WUXFW��%\9DO�O3DUDP��/HQ%�5HFW6WUXFW�������������������*HW�RULJLQDO�ZLQGRZ�GLPHQVLRQV���������*HW:LQGRZ5HFW�KZQG��2ULJ5HFW6WUXFW������������������'R�QRW�DOORZ�WKHVH�VLGHV�WR�EH�VL]HG���������5HFW6WUXFW�7RS� �2ULJ5HFW6WUXFW�7RS���������5HFW6WUXFW�/HIW� �2ULJ5HFW6WUXFW�/HIW���������5HFW6WUXFW�5LJKW� �2ULJ5HFW6WUXFW�5LJKW������������������6HW�QHZ�ZLQGRZ�GLPHQVLRQV���������&RS\0HPRU\�%\9DO�O3DUDP��5HFW6WUXFW��/HQ%�5HFW6WUXFW������(QG�,I��������������1HZ:QG3URF� �&DOO:LQGRZ3URF�&6XE&OV$SS�2ULJ:QG3URF��KZQG��X0VJ��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�&RS\0HPRU\�LV�XVHG�WR�UHWULHYH�DQG�VHW�WKH�O3DUDP�PHPEHU�RI�WKH�:0B6,=,1*�PHVVDJH�VWUXFWXUH���

��������2YHUULGLQJ�D�ZLQGRZV�PLQLPL]H�EHKDYLRU�

)RU�WKLV�QH[W�H[DPSOH��ZH�ZLOO�RYHUULGH�WKH�PLQLPL]H�EHKDYLRU�RI�WKH�ZLQGRZ��,Q�VKRUW��ZKHQ�WKH�0LQLPL]H�EXWWRQ�RQ�WKH�ZLQGRZV�WLWOH�EDU�LV�FOLFNHG��WKH�GHIDXOW�ZLQGRZ�EHKDYLRU�LV�UHSODFHG�ZLWK�D�QHZ�EHKDYLRU��,QVWHDG�RI�PLQLPL]LQJ�WKH�ZLQGRZ��RXU�ZLQGRZ�SURFHGXUH�ZLOO�UROO�XS�WKH�ZLQGRZ�VR�WKDW�RQO\�WKH�WLWOH�EDU�LV�VKRZLQJ��7KH�UHVXOW�ZLOO�ORRN�VLPLODU�WR�)LJXUH�������

)LJXUH������7KH�UROOHG�XS�ZLQGRZ�

/HWV�VWDUW�ZLWK�WKH�:0B1&/%87721'2:1�PHVVDJH�RQFH�DJDLQ��7KLV�PHVVDJH�SURYLGHV�JUHDW�LQIRUPDWLRQ�RQ�ZKHUH�WKH�PRXVH�LV�ORFDWHG�ZKHQ�WKH�OHIW�PRXVH�EXWWRQ�LV�SUHVVHG��7KLV�WLPH��ZH�DUH�ORRNLQJ�IRU�WKH�Z3DUDP�SDUDPHWHU�WR�FRQWDLQ�WKH�+70,1%87721�FRQVWDQW��7KLV�PHDQV�WKDW�WKH�OHIW�PRXVH�EXWWRQ�KDV�EHHQ�FOLFNHG�RQ�WKH�0LQLPL]H�EXWWRQ�RQ�WKH�ZLQGRZV�WLWOH�EDU��$V�D�QRWH��ZH�ZDQW�WR�PDNH�VXUH�WKDW�RXU�FRGH�LV�QRW�H[HFXWHG�ZKHQ�WKH�ZLQGRZ�LV�PD[LPL]HG��DQG�WKDW�LQVWHDG�WKH�GHIDXOW�IXQFWLRQDOLW\�LV�H[HFXWHG��,I�ZH�ZHUH�WR�WU\�WR�FKDQJH�WKH�KHLJKW�RI�WKH�ZLQGRZ�ZKLOH�LW�LV�PD[LPL]HG��D�*3)�ZRXOG�RFFXU�LQ�WKH�DSSOLFDWLRQ��:H�

Page 119: Visual Basic - Subclassing and Hooking with VB & VB NET

SUHYHQW�WKLV�E\�FKHFNLQJ�WR�PDNH�VXUH�WKDW�WKH�IUP&K��:LQGRZ6WDWH�SURSHUW\�LV�QRW�HTXDO�WR�YE0D[LPL]HG��7KH�ILUVW�FXW�RI�WKH�FRGH�LQ�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�ORRNV�OLNH�([DPSOH�������

([DPSOH������:LQGRZ�3URFHGXUH�WR�&KDQJH�WKH�'HIDXOW�0LQLPL]H�%HKDYLRU��

3XEOLF�)XQFWLRQ�1HZ:QG3URF�%\9DO�KZQG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�� ,I�X0VJ� �:0B1&/%87721'2:1�$QG�B�� �Z3DUDP� �+70,1%87721�$QG�B�� �IUP&K��:LQGRZ6WDWH��!�YE0D[LPL]HG�7KHQ�����������IUP&K��+HLJKW� ��������������1HZ:QG3URF� ���� (OVH������ 3DVV�PHVVDJH�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�����������1HZ:QG3URF� �&DOO:LQGRZ3URF�&6XE&OV$SS�2ULJ:QG3URF��B������������������������KZQG��X0VJ��Z3DUDP��O3DUDP���� (QG�,I�(QG�)XQFWLRQ�,I�ZH�XVH�WKLV�FRGH��RXU�ZLQGRZ�ZLOO�UROO�XS�ZKHQ�WKH�0LQLPL]H�EXWWRQ�RQ�WKH�WLWOH�EDU�LV�FOLFNHG��7KHUH�DUH�WZR�SUREOHPV�ZLWK�WKLV�DSSURDFK��7KH�ILUVW�LV�VLPLODU�WR�WKH�SUHYLRXV�H[DPSOH��WKH�0LQLPL]H�PHQX�LWHP�LQ�WKH�V\VWHP�PHQX�VWLOO�PLQLPL]HV�WKH�ZLQGRZ�ZLWKRXW�H[HFXWLQJ�RXU�FRGH�WR�UROO�LW�XS��7KH�VHFRQG�SUREOHP�LV�WKDW�WKH�0LQLPL]H�EXWWRQ�LV�QRW�YLVXDOO\�GHSUHVVHG�ZKHQ�LW�LV�FOLFNHG��7KH�FDXVH�RI�WKLV�VHFRQG�SUREOHP�LV�WKDW�WKH�FRGH�WR�GUDZ�WKH�EXWWRQ�LQ�WKH�GHSUHVVHG�VWDWH�LV�LQ�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH��,I�\RX�QRWLFH��WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�LV�QHYHU�FDOOHG�LQ�RXU�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LI�WKH�XVHU�FOLFNV�WKH�0LQLPL]H�EXWWRQ��,Q�DGGLWLRQ��WKHUH�LV�D�WKLUG�PLQRU�SUREOHP��:KHQ�WKH�ZLQGRZ�LV�VXEFODVVHG�DQG�UROOHG�XS��WKH�UHVWRUH�IXQFWLRQDOLW\�LV�QRW�DYDLODEOH��7KLV�LV�EHFDXVH�WKH�UHVWRUH�IXQFWLRQDOLW\�LV�DYDLODEOH�RQO\�ZKHQ�WKH�ZLQGRZ�LV�LQ�WKH�PLQLPL]HG�VWDWH��,Q�WKLV�FDVH��WKH�ZLQGRZ�LV�VWLOO�LQ�WKH�QRUPDO�VWDWH�ZKHQ�LW�LV�UROOHG�XS��WKHUHIRUH��WKH�5HVWRUH�EXWWRQ�DQG�WKH�5HVWRUH�PHQX�LWHP�DUH�QRW�DYDLODEOH���,QVWHDG�RI�IRFXVLQJ�RQ�WKH�FDXVH�RI�WKH�PLQLPL]DWLRQ�DFWLRQ��ZH�ZLOO�IRFXV�RQ�WKH�UHVXOW�RI�FOLFNLQJ�WKH�0LQLPL]H�EXWWRQ��&OHDUO\��WKH�:0B6<6&200$1'�PHVVDJH�ZLWK�WKH�6&B0,1,0,=(�YDOXH�IRU�WKH�Z3DUDP�DUJXPHQW�LV�ZKDW�LQVWLJDWHV�WKH�PLQLPL]DWLRQ�DFWLRQ��/HWV�XVH�WKLV�PHVVDJH�WR�WULJJHU�RXU�UROO�XS�IXQFWLRQDOLW\��7KH�FRGH�IRU�WKLV�VROXWLRQ�LV�VKRZQ�LQ�([DPSOH��������

([DPSOH�������0LQLPL]LQJ�D�:LQGRZ�8VLQJ�WKH�:0B6<6&200$1'�0HVVDJH��

Page 120: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�)XQFWLRQ�1HZ:QG3URF�%\9DO�KZQG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B�����������������%\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ����������'LP�6L]LQJ6WUXFW�$V�0,10$;,1)2������,I�X0VJ� �:0B6<6&200$1'�7KHQ���������,I�Z3DUDP� �6&B0,1,0,=(�7KHQ�������������,I�IUP&K��:LQGRZ6WDWH��!�YE0D[LPL]HG�7KHQ�����������������'R�QRW�SURFHVV�PHVVDJH���LQVWHDG�GR�RXU�RZQ�ZRUN������������������IUP&K��+HLJKW� ����������������(OVH������������������+DQGOH�WKLV�KRZHYHU�\RX�ZDQW�������������(QG�,I���������� �������������1HZ:QG3URF� �����������(OVH�������������1HZ:QG3URF� �'HI:LQGRZ3URF�KZQG��X0VJ��Z3DUDP��O3DUDP�����������(QG�LI�����(OVH���������3DVV�PHVVDJH�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH���������1HZ:QG3URF� �&DOO:LQGRZ3URF�&6XE&OV$SS�2ULJ:QG3URF��B�������������������������������������KZQG��X0VJ��Z3DUDP��O3DUDP������(QG�,I�(QG�)XQFWLRQ�7KLV�FRGH�ZRUNV�DV�LW�VKRXOG��7KLV�LV�QRW�WR�VD\�WKDW�WKH�:0B1&/%87721'2:1�PHVVDJH�LV�SUREOHPDWLF��,QVWHDG��,�ZDQWHG�WR�VKRZ�\RX�KRZ�,�DUULYHG�DW�P\�FRQFOXVLRQV�DV�ZHOO�DV�VKRZ�H[DPSOHV�RI�FDSWXULQJ�GLIIHUHQW�PHVVDJHV��$V�\RX�FDQ�VHH�IURP�WKHVH�ODVW�WZR�H[DPSOHV��PRGLI\LQJ�WKH�GHIDXOW�EHKDYLRU�RI�D�ZLQGRZ�FDQ�EHFRPH�D�GDXQWLQJ�WDVN���

����*OREDO�6XEFODVVLQJ�

*OREDO�VXEFODVVLQJ�UHYROYHV�DURXQG�WKH�VDPH�SULQFLSOHV�DV�LQVWDQFH�VXEFODVVLQJ��:LWK�JOREDO�VXEFODVVLQJ��WKRXJK��ZH�DUH�JRLQJ�WR�JR�RQH�OHYHO�GHHSHU�EHIRUH�SHUIRUPLQJ�WKH�VXEFODVVLQJ��%\�WKLV�,�PHDQ�WKDW�WKH�PRGLILFDWLRQV�WR�WKH�ZLQGRZ�SURFHGXUH�IXQFWLRQ�SRLQWHU�ZLOO�RFFXU�LQ�WKH�FODVV�LWVHOI��QRW�WKH�LQGLYLGXDO�ZLQGRZ�FUHDWHG�IURP�WKH�FODVV��2QO\�WKRVH�ZLQGRZV�FUHDWHG�IURP�WKH�FODVV�DIWHU�WKH�VXEFODVVLQJ�KDV�RFFXUUHG�ZLOO�XVH�WKH�QHZ�VXEFODVVHG�ZLQGRZ�SURFHGXUH��:KHQ�,�PHQWLRQ�VXEFODVVLQJ�LQ�WKLV�VHFWLRQ��,�DP�UHIHUULQJ�WR�JOREDO�VXEFODVVLQJ���

Page 121: Visual Basic - Subclassing and Hooking with VB & VB NET

�,QVWDQFH�VXEFODVVLQJ�DIIHFWV�D�VSHFLILF�ZLQGRZ�DQG�LWV�ZLQGRZ�SURFHGXUH��*OREDO�VXEFODVVLQJ�DIIHFWV�HYHU\�ZLQGRZ�FUHDWHG�IURP�D�ZLQGRZ�FODVV�WKDW�KDV�KDG�LWV�FODVV�ZLQGRZ�SURFHGXUH�PRGLILHG����

8QOLNH�LQVWDQFH�VXEFODVVLQJ��JOREDO�VXEFODVVLQJ�FDQ�FDSWXUH�WKH�ZLQGRZ�FUHDWLRQ�PHVVDJHV����DQG��PRUH�VSHFLILFDOO\��:0B&5($7(�DQG�:0B1&&5($7(��:KHQ�D�ZLQGRZ�LV�FUHDWHG��WKH�:0B1&&5($7(�PHVVDJH�LV�VHQW�ILUVW�WR�WKH�ZLQGRZ�WR�ILQLVK�FUHDWLQJ�LWV�QRQFOLHQW�DUHD�LQ�PHPRU\��7KH�:0B&5($7(�PHVVDJH�LV�VHQW�QH[W�WR�ILQLVK�FUHDWLQJ�WKH�ZLQGRZV�FOLHQW�DUHD�LQ�PHPRU\��1RWH�WKDW�WKH�ZLQGRZ�LV�VWLOO�QRW�GLVSOD\HG�RQ�WKH�VFUHHQ�DW�WKLV�SRLQW��2WKHU�PHVVDJHV�VWLOO�QHHG�WR�EH�VHQW�WR�WKH�ZLQGRZ�WR�SRVLWLRQ��VL]H��DQG�SDLQW�LW�RQ�WKH�GHVNWRS���7KH�UHDVRQ�WKDW�LQVWDQFH�VXEFODVVLQJ�FDQQRW�FDSWXUH�WKHVH�PHVVDJHV�LV�WKDW�ZKHQ�LQVWDQFH�VXEFODVVLQJ�RFFXUV��WKH�ZLQGRZ�KDV�DOUHDG\�EHHQ�FUHDWHG��7KHUHIRUH��WKH�ZLQGRZ�FUHDWLRQ�PHVVDJHV�KDYH�DOUHDG\�EHHQ�SURFHVVHG��*OREDO�VXEFODVVLQJ��RQ�WKH�RWKHU�KDQG��RFFXUV�EHIRUH�D�ZLQGRZ�LV�FUHDWHG��7KH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LV�LQ�SODFH�DW�WKH�SRLQW�ZKHQ�WKH�ZLQGRZ�LV�FUHDWHG��7KHUHIRUH��DOO�ZLQGRZ�FUHDWLRQ�PHVVDJHV�DUH�FDSWXUHG���

�*OREDO�VXEFODVVLQJ�DOORZV�WKH�ZLQGRZ�FUHDWLRQ�PHVVDJHV�WR�EH�SURFHVVHG��,QVWDQFH�VXEFODVVLQJ�GRHV�QRW�KDYH�WKLV�DELOLW\����

7R�VHH�KRZ�JOREDO�VXEFODVVLQJ�GLIIHUV�IURP�LQVWDQFH�VXEFODVVLQJ��ZHOO�H[DPLQH�WKH�PRGLILFDWLRQV�QHHGHG�WR�FKDQJH�WKH�SUHYLRXV�LQVWDQFH�VXEFODVVLQJ�H[DPSOH��UROOLQJ�XS�WKH�IRUP�XVLQJ�WKH�ZLQGRZ�SURFHGXUH�VKRZQ�LQ�([DPSOH�������WR�SHUIRUP�JOREDO�VXEFODVVLQJ���

������&KDQJHV�WR�WKH�&ODVV�

7KH�RQO\�UHDO�FKDQJH�WR�WKH�FODVV�PRGXOH�LV�WKDW�\RX�PXVW�VZDS�6HW:LQGRZ/RQJ3WU�IRU�WKH�6HW&ODVV/RQJ3WU�$3,�IXQFWLRQ��7KLV�FKDQJH�ZLOO�SURYLGH�WKH�OSIQ:QG3URF�PHPEHU�RI�WKH�FODVV�VWUXFWXUH�ZLWK�D�SRLQWHU�WR�RXU�QHZ�ZLQGRZ�SURFHGXUH��$ORQJ�ZLWK�XVLQJ�WKLV�QHZ�$3,�IXQFWLRQ��WKHUH�LV�DOVR�D�QHZ�FRQVWDQW��*&/3B&/6352&��7KLV�FRQVWDQW�WHOOV�6HW&ODVV/RQJ3WU�WR�PRGLI\�WKH�OSIQ:QG3URF�IXQFWLRQ�SRLQWHU�LQ�WKH�FODVV�VWUXFWXUH�WR�SRLQW�WR�D�QHZ�ZLQGRZ�SURFHGXUH�WKDW�ZH�GHILQH���7R�FDOO�6HW&ODVV/RQJ3WU��ZH�QHHG�WR�UHSODFH�WKH�IROORZLQJ�GHFODUDWLRQV�DQG�FRQVWDQWV���3ULYDWH�'HFODUH�)XQFWLRQ�6HW:LQGRZ/RQJ3WU�/LE��XVHU����$OLDV��6HW:LQGRZ/RQJ$��B�� � �%\9DO�KZQG�$V�/RQJ��B�� � %\9DO�Q,QGH[�$V�/RQJ��B�� � %\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ��3ULYDWH�&RQVW�*:/3B:1'352&� ����

Page 122: Visual Basic - Subclassing and Hooking with VB & VB NET

ZLWK�WKHVH��3ULYDWH�'HFODUH�)XQFWLRQ�6HW&ODVV/RQJ3WU�/LE��XVHU����$OLDV��6HW&ODVV/RQJ$��B�� �%\9DO�KZQG�$V�/RQJ��%\9DO�Q,QGH[�$V�/RQJ��%\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ��3ULYDWH�&RQVW�*&/3B&/6352&� �������,Q�DGGLWLRQ��\RX�PXVW�FKDQJH�WKH�(QDEOH6XEFODVV�IXQFWLRQ�LQ�RXU�FODVV�PRGXOH�WR�XVH���PBO2ULJ&ODVV3URF� �6HW&ODVV/RQJ3WU�PBKZQG��*&/3B&/6352&��B�� � $GGUHVV2I�0RGXOH��1HZ&ODVV3URF��LQVWHDG�RI���PBO2ULJ&ODVV3URF� �6HWZLQGRZORQJ3WU�PBKZQG��*:/3B:1'352&��B�� � $GGUHVV2I�0RGXOH��1HZ:QG3URF��7KH�VDPH�PXVW�EH�GRQH�IRU�WKH�'LVDEOH6XEFODVV�IXQFWLRQ��,W�VKRXOG�XVH���6HW&ODVV/RQJ3WU�PBKZQG��*&/3B&/6352&��PBO2ULJ&ODVV3URF�LQVWHDG�RI���6HW:LQGRZORQJ3WU�PBKZQG��*:/3B:1'352&��PBO2ULJ&ODVV3URF�$GGLWLRQDOO\��DOO�UHIHUHQFHV�WR�WKH�PBO2ULJ:QG3URF�PHPEHU�YDULDEOH�VKRXOG�EH�FKDQJHG�WR�PBO2ULJ&ODVV3URF���7KH�6HW&ODVV/RQJ3WU�$3,�IXQFWLRQ�DOORZV�XV�WR�PRGLI\�WKH�VWUXFWXUH�RI�D�FODVV�DV�ORQJ�DV�ZH�KDYH�D�KDQGOH�WR�WKH�ZLQGRZ�WKDW�ZDV�FUHDWHG�IURP�WKLV�FODVV��7KLV�PHDQV�WKDW�EHIRUH�ZH�FDQ�JOREDOO\�VXEFODVV�D�ZLQGRZ�FODVV��ZH�PXVW�ILUVW�FUHDWH�D�QHZ�ZLQGRZ�IURP�WKDW�FODVV��7KH�ZLQGRZ�KDQGOH�IURP�WKLV�ZLQGRZ�LV�XVHG�LQ�WKH�ILUVW�DUJXPHQW�RI�WKH�6HW&ODVV/RQJ3WU�IXQFWLRQ���7KLV�H[DPSOH�ZLOO�FUHDWH�WKH�ZLQGRZ�EHIRUH�JOREDOO\�VXEFODVVLQJ�WKH�FODVV��8VXDOO\��WKLV�ZLQGRZ�LV�KLGGHQ�IURP�WKH�XVHU�VR�WKDW�WKH�XVHU�GRHV�QRW�LQDGYHUWHQWO\�FORVH�WKH�ZLQGRZ�DQG�GHVWUR\�LWV�KDQGOH��7KLV�KDQGOH�LV�DOVR�ZKDW�ZH�QHHG�WR�UHPRYH�WKH�JOREDO�VXEFODVVLQJ�DQG�UHVWRUH�WKH�DSSOLFDWLRQ�WR�LWV�LQLWLDO�VWDWH��2WKHUZLVH��WKH�DSSOLFDWLRQ�ZRXOG�FUDVK���

�*OREDO�VXEFODVVLQJ�UHTXLUHV�WKDW�D�ZLQGRZ��XVXDOO\�KLGGHQ��LV�FUHDWHG�DQG�LWV�K:QG�XVHG�IRU�JOREDO�VXEFODVVLQJ��7KLV�ZLQGRZ�PXVW�UHPDLQ�LQ�PHPRU\�IRU�WKH�OLIH�RI�WKH�DSSOLFDWLRQ����

$�PLQRU�PRGLILFDWLRQ�LV�QHHGHG�LQ�WKH�'LVDEOH6XEFODVV�IXQFWLRQ��7KH�PRGLILFDWLRQ�PLJKW�VHHP�PLQRU��EXW�LW�ZLOO�KDYH�D�ELJ�LPSDFW�RQ�ZKHWKHU�WKH�H[DPSOH�ZLOO�ZRUN��/RRN�DW�WKH�IROORZLQJ�OLQH�LQ�WKH�'LVDEOH6XEFODVV�IXQFWLRQ���PBO2ULJ&ODVV3URF� ���7KLV�OLQH�PXVW�EH�UHPRYHG��,I�WKH�UHDVRQ�IRU�WKLV�LV�QRW�DSSDUHQW�DW�ILUVW��OHW�PH�H[SODLQ��7KH�REMHFW�FUHDWHG�IURP�WKH�&6XEFODVV�FODVV�KROGV�WKH�ZLQGRZ�KDQGOH��PBKZQG��RI�WKH�RULJLQDO�ZLQGRZ�ZH�FUHDWHG�EHIRUH�PRGLI\LQJ�WKH�FODVV��:H�QHHG�WR�NHHS�WKLV�KDQGOH�IRU�WKH�OLIHWLPH�RI�WKH�DSSOLFDWLRQ��:H�DOVR�KDYH�WKH�SRLQWHU�WR�WKH�RULJLQDO�FODVV�SURFHGXUH��PBO2ULJ&ODVV3URF���

Page 123: Visual Basic - Subclassing and Hooking with VB & VB NET

ZKLFK�ZH�QHHG�WR�NHHS�IRU�WKH�OLIHWLPH�RI�WKH�DSSOLFDWLRQ��7KLV�LV�EHFDXVH�ZKHQ�ZH�PRGLI\�D�FODVV�WKURXJK�JOREDO�VXEFODVVLQJ�DQG�WKHQ�FUHDWH�QHZ�ZLQGRZV�IURP�WKH�PRGLILHG�FODVV��WKRVH�QHZ�ZLQGRZV�FDQ�H[LVW�IRU�WKH�OLIHWLPH�RI�WKH�DSSOLFDWLRQ���:KHQ�D�PHVVDJH�LV�VHQW�WR�WKH�JOREDOO\�VXEFODVVHG�ZLQGRZ��WKDW�ZLQGRZ�ZLOO�ORRN�XS�LWV�RZQ�PRGLILHG�ZLQGRZ�SURFHGXUH�DQG�FDOO�LW��,Q�WKLV�H[DPSOH��WKDW�ZLQGRZ�SURFHGXUH�ZRXOG�EH�WKH�1HZ&ODVV3URF�IXQFWLRQ�LQ�RXU�%$6�PRGXOH��7KH�SUREOHP�GRHVQW�OLH�KHUH��WKRXJK��,W�OLHV�DW�WKH�HQG�RI�WKH�ZLQGRZ�SURFHGXUH��ZKHUH�ZH�WU\�WR�FDOO�WKH�RULJLQDO�FODVV�SURFHGXUH��5HPHPEHU��WKH�FODVV�ZDV�VXEFODVVHG��QRW�WKH�ZLQGRZ���:KHQ�D�ZLQGRZ�LV�FUHDWHG�IURP�WKH�PRGLILHG�FODVV��WKH�ZLQGRZ�SURFHGXUH�LW�UHFHLYHV�IURP�WKH�FODVV�LV�FRQVLGHUHG�WR�EH�WKDW�ZLQGRZV�RULJLQDO�ZLQGRZ�SURFHGXUH��,I�ZH�KDG�LQWHQWLRQDOO\�UHPRYHG�WKH�JOREDO�VXEFODVV�DQG�WKH�FRGH�KDG�VHW�WKH�PBO2ULJ&ODVV3URF�YDULDEOH�WR��DV�LW�ZRXOG�LQ�LQVWDQFH�VXEFODVVLQJ���&DOO:LQGRZ3URF�ZRXOG�WU\�WR�GHUHIHUHQFH�D�18//�SRLQWHU�WR�JHW�WKH�DGGUHVV�RI�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��<RX�PLJKW�KDYH�WKRXJKW�WKDW�MXVW�EHFDXVH�WKH�JOREDO�VXEFODVVLQJ�KDG�EHHQ�UHPRYHG��DOO�ZLQGRZV�ZRXOG�VXGGHQO\�UHYHUW�WR�FDOOLQJ�WKHLU�RULJLQDO�ZLQGRZ�SURFHGXUH��7KLV�LV�QRW�WKH�FDVH�EHFDXVH�WKH�OSIQ:QG3URF�PHPEHU�RI�WKH�ZLQGRZ�VWUXFWXUH�RI�SUHH[LVWLQJ�ZLQGRZV�LV�QRW�PRGLILHG�E\�WKH�FDOO�WR�6HW&ODVV/RQJ3WU��:KHQHYHU�D�PHVVDJH�LV�VHQW�WR�D�JOREDOO\�VXEFODVVHG�ZLQGRZ��LW�VWLOO�WULHV�WR�FDOO�RXU�1HZ&ODVV3URF�IXQFWLRQ�DQG��LQ�WXUQ��WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��LQGLFDWHG�E\�PBO2ULJ&ODVV3URF���7KLV�LV�LOOXVWUDWHG�LQ�)LJXUH������7KLV�GLDJUDP�ZLOO�EH�GLVFXVVHG�LQ�PRUH�GHWDLO�ODWHU�LQ�WKLV�FKDSWHU���

)LJXUH������7KH�OLIHWLPH�RI�WKH�JOREDOO\�VXEFODVVHG�H[DPSOH�DSSOLFDWLRQ�ZKHUH�:QG3URF��LV�WKH�ZLQGRZ�SURFHGXUH�RI�WKH�XQPRGLILHG�FODVV�DQG�:QG3URF��LV�WKH�ZLQGRZ�SURFHGXUH�RI�WKH�

PRGLILHG�FODVV�

Page 124: Visual Basic - Subclassing and Hooking with VB & VB NET

7KHVH�DUH�WKH�RQO\�PRGLILFDWLRQV�WKDW�ZH�ZLOO�PDNH�WR�WKLV�FODVV��

�'R�QRW�ORVH�WKH�K:QG�DQG�RULJLQDO�ZLQGRZ�SURFHGXUH�FRQWDLQHG�LQ�WKH�&6XEFODVV�FODVV�ZKHQ�LPSOHPHQWLQJ�JOREDO�VXEFODVVLQJ����

7KH�ILQDO�FRGH�IRU�WKH�FODVV�LV�VKRZQ�LQ�([DPSOH�������ZLWK�UHYLVHG�OLQHV�LQ�EROGIDFH���

([DPSOH�������0RGLILHG�&6XEFODVV�FOV�0RGXOH�IRU�WKH�*OREDO�6XEFODVVLQJ�([DPSOH��

�,I�:LQ���7KHQ�����3ULYDWH�'HFODUH�)XQFWLRQ�6HW:LQGRZ/RQJ3WU�/LE��XVHU����$OLDV��6HW:LQGRZ/RQJ$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Q,QGH[�$V�/RQJ��%\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ�����3ULYDWH�'HFODUH�)XQFWLRQ�6HW&ODVV/RQJ3WU�/LE��XVHU����$OLDV��6HW&ODVV/RQJ$��B�

Page 125: Visual Basic - Subclassing and Hooking with VB & VB NET

� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Q,QGH[�$V�/RQJ��%\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ�����PBO2ULJ&ODVV3URF� �6HW&ODVV/RQJ3WU�PBKZQG��*&/3B:1'352&��B����������������������������������������$GGUHVV2I�0RGXOH��1HZ&ODVV3URF������3ULYDWH�&RQVW�*:/3B86(5'$7$� �����������3ULYDWH�&RQVW�*:/3B+:1'3$5(17� ����������3ULYDWH�&RQVW�*&/3B0(181$0(� ����������3ULYDWH�&RQVW�*&/3B+%5%$&.*5281'� �����������3ULYDWH�&RQVW�*&/3B+&85625� �����������3ULYDWH�&RQVW�*&/3B+,&2160� �����������3ULYDWH�&RQVW�*&/3B+02'8/(� �����������3ULYDWH�&RQVW�*&/3B:1'352&� �����������3ULYDWH�&RQVW�':/3B06*5(68/7� �������3ULYDWH�&RQVW�':/3B'/*352&� �������3ULYDWH�&RQVW�':/3B86(5� ����(OVH,I�1RW�:LQ���$QG�1RW�:LQ���7KHQ�����3ULYDWH�'HFODUH�)XQFWLRQ�6HW:LQGRZ/RQJ3WU�/LE��XVHU����$OLDV��6HW:LQGRZ/RQJ3WU$��B�����������%\9DO�KZQG�$V�/RQJ��%\9DO�Q,QGH[�$V�/RQJ��%\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ�����3ULYDWH�'HFODUH�)XQFWLRQ�6HW&ODVV/RQJ3WU�/LE��XVHU����$OLDV��6HW&ODVV/RQJ3WU$��B�����������%\9DO�KZQG�$V�/RQJ��%\9DO�Q,QGH[�$V�/RQJ��%\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ�����3ULYDWH�&RQVW�*:/3B+,167$1&(� ����������3ULYDWH�&RQVW�*:/3B:1'352&� ����������3ULYDWH�&RQVW�*:/3B86(5'$7$� �����������3ULYDWH�&RQVW�*:/3B+:1'3$5(17� ����������3ULYDWH�&RQVW�*:/3B,'� �����������3ULYDWH�&RQVW�*&/3B0(181$0(� ����������3ULYDWH�&RQVW�*&/3B+%5%$&.*5281'� �����������3ULYDWH�&RQVW�*&/3B+&85625� �����������3ULYDWH�&RQVW�*&/3B+,&2160� �����������3ULYDWH�&RQVW�*&/3B+02'8/(� �����������3ULYDWH�&RQVW�*&/3B:1'352&� �����������3ULYDWH�&RQVW�':/3B06*5(68/7� �������3ULYDWH�&RQVW�':/3B'/*352&� �������3ULYDWH�&RQVW�':/3B86(5� �����(QG�,I��3ULYDWH�PBO2ULJ&ODVV3URF�$V�/RQJ�3ULYDWH�PBKZQG�$V�/RQJ��3XEOLF�3URSHUW\�*HW�2ULJ:QG3URF�����$V�/RQJ�

Page 126: Visual Basic - Subclassing and Hooking with VB & VB NET

����2ULJ:QG3URF� �PBO2ULJ&ODVV3URF�(QG�3URSHUW\��3XEOLF�3URSHUW\�/HW�KZQG�+DQGOH�$V�/RQJ������PBKZQG� �+DQGOH�(QG�3URSHUW\��3ULYDWH�6XE�&ODVVB,QLWLDOL]H���������PBO2ULJ&ODVV3URF� �������PBKZQG� ���(QG�6XE��3XEOLF�)XQFWLRQ�(QDEOH6XEFODVV�����$V�%RROHDQ�����,I�PBO2ULJ&ODVV3URF��!���7KHQ���������$OUHDG\�VXEFODVVHG�����������'R�QRW�DOORZ�WR�VXEFODVV�D��QG�WLPH�����(OVH���������PBO2ULJ&ODVV3URF� �6HW&ODVV/RQJ3WU�PBKZQG��*&/3B:1'352&��$GGUHVV2I�0RGXOH���1HZ&ODVV3URF������(QG�,I����������,I�PBO2ULJ&ODVV3URF��!���7KHQ���������(QDEOH6XEFODVV� �7UXH�����(OVH���������(QDEOH6XEFODVV� �)DOVH�����(QG�,I�(QG�)XQFWLRQ��3XEOLF�)XQFWLRQ�'LVDEOH6XEFODVV�����$V�%RROHDQ�����5HPRYH�JOREDO�VXEFODVV�����,I�PBO2ULJ&ODVV3URF� ���7KHQ���������'R�QRW�UHPRYH�VXEFODVV���QRQH�H[LVW���������'LVDEOH6XEFODVV� �)DOVH�����(OVH���������6HW&ODVV/RQJ3WU�PBKZQG��*&/3B:1'352&��PBO2ULJ&ODVV3URF���������'2�127�6(7�7+,6�72�=(52��$6�:,7+�,167$1&(�68%&/$66,1*�����������25�:(�:,//�/26(�285�1(:�:,1352&��������PBO2ULJ&ODVV3URF� ���

Page 127: Visual Basic - Subclassing and Hooking with VB & VB NET

���������'LVDEOH6XEFODVV� �7UXH�����(QG�,I�(QG�)XQFWLRQ��3ULYDWH�6XE�&ODVVB7HUPLQDWH���������&DOO�'LVDEOH6XEFODVV�(QG�6XE�

������&KDQJHV�WR�WKH�%$6�0RGXOH�

7KH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LQ�WKLV�PRGXOH�ZLOO�IRUFH�HDFK�JOREDOO\�VXEFODVVHG�ZLQGRZ�WR�UROO�XS�LQVWHDG�RI�PLQLPL]H��WKLV�LV�VLPLODU�WR�WKH�ODVW�H[DPSOH�LQ�6HFWLRQ�����RI�WKLV�FKDSWHU���6RPH�FRGH�QHHGV�WR�EH�DGGHG�WR�WKLV�VXEFODVVHG�ZLQGRZ�SURFHGXUH�IRU�LW�WR�ZRUN�RQ�WKH�FRUUHFW�ZLQGRZ��7KLV�FRGH�ZLOO�LWHUDWH�WKURXJK�HYHU\�ZLQGRZ�EHORQJLQJ�WR�WKLV�DSSOLFDWLRQ�DQG�WU\�WR�ILQG�WKH�ZLQGRZ�KDQGOH�WKDW�PDWFKHV�WKH�RQH�SDVVHG�LQ�WR�WKLV�IXQFWLRQ��7KLV�ZLOO�EH�WKH�ZLQGRZ�WKDW�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�ZLOO�RSHUDWH�RQ��7KH�FRGH�PRGLILFDWLRQ�LV�DV�IROORZV���'LP�,�$V�,QWHJHU�'LP�)RFXV:LQGRZ�$V�/RQJ��)RFXV:LQGRZ� ���)RU�,� ���7R�)RUPV�&RXQW���������,I�)RUPV�,��KZQG� �KZQG�7KHQ���������)RFXV:LQGRZ� �,���������([LW�)RU�����(QG�,I�1H[W�,�*OREDO�VXEFODVVLQJ�ZLOO�DOORZ�PRUH�WKDQ�RQH�ZLQGRZ�WR�XVH�WKH�VDPH�VXEFODVVHG�ZLQGRZ�SURFHGXUH��7KLV�FDQ�EH�YHU\�SRZHUIXO�EHFDXVH�LW�DOORZV�XV�WR�DGG�IXQFWLRQDOLW\�WR�D�QXPEHU�RI�VLPLODU�ZLQGRZV�ZLWKRXW�KDYLQJ�WR�ZULWH�VXEFODVVLQJ�FRGH�IRU�HDFK�VHSDUDWH�ZLQGRZ��DV�ZH�ZRXOG�ZLWK�LQVWDQFH�VXEFODVVLQJ��7KH�SUREOHP�LV�WKDW�DOO�WKH�ZLQGRZV�WKDW�KDYH�EHHQ�JOREDOO\�VXEFODVVHG�ZLOO�XVH�WKH�VDPH�ZLQGRZ�SURFHGXUH��1HZ&ODVV3URF���6R�WKH�WULFN�LV�WR�GHWHUPLQH�ZKLFK�ZLQGRZ�WKH�PHVVDJH�LV�ERXQG�IRU��7KLV�LV�HDVLHU�WKDQ�LW�ORRNV��5HPHPEHU��ZH�DUH�DOZD\V�SDVVHG�D�K:QG�ZLQGRZ�KDQGOH�LQ�RXU�VXEFODVVHG�ZLQGRZ�SURFHGXUH��:H�FDQ�XVH�WKH�KZQG�DUJXPHQW�WR�VHW�XS�D�ORRS�LWHUDWLQJ�WKURXJK�HDFK�ZLQGRZ�RI�WKH�SURMHFW�WR�GHWHUPLQH�ZKLFK�ZLQGRZ�ZH�QHHG�WR�ZRUN�ZLWK��RI�FRXUVH��WKLV�LV�QRW�WKH�RSWLPDO�VROXWLRQ��:KHQHYHU�ZH�QHHG�WR�VHW�WKH�IRUP�KHLJKW�SURSHUW\�RI�WKLV�ZLQGRZ��IRU�H[DPSOH��ZH�FRXOG�VLPSO\�XVH�WKH�IROORZLQJ�FRGH���)RUPV�)RFXV:LQGRZ��+HLJKW� ����

Page 128: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�ZLQGRZ�SURFHGXUH�WKHQ�QHHGV�WR�EH�PRGLILHG�VR�WKDW�ZH�SHUIRUP�RXU�RSHUDWLRQV�RQ�WKH�ZLQGRZ�LQ�WKH�)RFXV:LQGRZ�RUGLQDO�SRVLWLRQ�LQ�WKH�)RUPV�FROOHFWLRQ��([DPSOH������VKRZV�WKH�FRPSOHWH�ZLQGRZ�SURFHGXUH��ZLWK�UHYLVHG�OLQHV�LQGLFDWHG�LQ�EROGIDFH���

([DPSOH�������7KH�:LQGRZ�3URFHGXUH�IRU�WKH�*OREDO�6XEFODVVLQJ�([DPSOH��

3XEOLF�)XQFWLRQ�1HZ&ODVV3URF�%\9DO�KZQG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B������������������%\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ����������'LP�,�$V�,QWHJHU�����'LP�)RFXV:LQGRZ�$V�/RQJ������1HZ&ODVV3URF� �&DOO:LQGRZ3URF�&6XE&OV$SS�2ULJ:QG3URF��KZQG��X0VJ��B�����������������������������������Z3DUDP��O3DUDP������)RU�,� ���7R�)RUPV�&RXQW�������������,I�)RUPV�,��KZQG� �KZQG�7KHQ�������������)RFXV:LQGRZ� �,�������������([LW�)RU���������(QG�,I�����1H[W�,����������0RGLI\�WKH�ZLQGRZV�GHIDXOW�SURFHVVLQJ�LI�QHFHVVDU\�����,I�X0VJ� �:0B6<6&200$1'�$QG�)RFXV:LQGRZ��!���7KHQ���������,I�Z3DUDP� �6&B0,1,0,=(�7KHQ�������������,I�)RUPV�)RFXV:LQGRZ��:LQGRZ6WDWH��!�YE0D[LPL]HG�7KHQ�����������������'R�QRW�SURFHVV�PHVVDJH���LQVWHDG�GR�RXU�RZQ�ZRUN�����������������)RUPV�)RFXV:LQGRZ��+HLJKW� ����������������(QG�,I�������������1HZ&ODVV3URF� �����������(OVH�������������1HZ&ODVV3URF� �&DOO:LQGRZ3URF�&6XE&OV$SS�2ULJ:QG3URF��KZQG��X0VJ��B�������������������������������������������Z3DUDP��O3DUDP����������(QG�,I�����(OVH���������3DVV�PHVVDJH�WR�GHIDXOW�KDQGOHU���������1HZ&ODVV3URF� �&DOO:LQGRZ3URF�&6XE&OV$SS�2ULJ:QG3URF��KZQG��X0VJ��B���������������������������������������Z3DUDP��O3DUDP������(QG�,I�(QG��)XQFWLRQ��

Page 129: Visual Basic - Subclassing and Hooking with VB & VB NET

�$OO�JOREDOO\�VXEFODVVHG�ZLQGRZV�ZLOO�FDOO�WKH�VDPH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LQ�\RXU�%$6�PRGXOH��7KLV�PHDQV�WKDW�\RXU�ZLQGRZ�SURFHGXUH�PXVW�EH�DEOH�WR�GHWHUPLQH�ZKLFK�ZLQGRZ�WKH�PHVVDJH�LV�LQWHQGHG�IRU����

������&KDQJHV�WR�WKH�)RUP�

7KH�QXPEHU�RI�FRGH�FKDQJHV�WKDW�PXVW�EH�PDGH�WR�WKH�IRUP�DUH�VXEVWDQWLDO��0RVW�QRWDEO\��WKH�RUGHU�RI�HYHQWV�QHHGHG�WR�LQVWDOO�DQG�XQLQVWDOO�WKH�JOREDO�VXEFODVV�PXVW�EH�FKDQJHG��$OVR��WKHUH�LV�D�QHZ�EXWWRQ�RQ�WKH�IRUP�FDOOHG�&UHDWH�:QG��7KLV�EXWWRQ�ZLOO�FUHDWH�D�IRUP��ZH�XVH�WKLV�IRUPV�KDQGOH�WR�LQLWLDWH�JOREDO�VXEFODVVLQJ��7KH�PDLQ�IRUP�ORRNV�WKH�VDPH�DV�WKH�IRUP�XVHG�LQ�WKH�LQVWDQFH�VXEFODVVLQJ�H[DPSOHV��H[FHSW�IRU�WKH�DGGLWLRQ�RI�WKLV�QHZ�EXWWRQ��,Q�DGGLWLRQ�WR�WKHVH�FKDQJHV��D�EUDQG�QHZ�IRUP�QDPHG�IUP*OREDO6XE�LV�DGGHG�WR�WKH�SURMHFW��7KLV�QHZ�IRUP�KDV�QR�FRGH�DVVRFLDWHG�ZLWK�LW��DQG�RQO\�LWV�&DSWLRQ�SURSHUW\�LV�FKDQJHG�WR�UHDG��*OREDOO\�6XEFODVVHG�)RUP���7KLV�QHZ�IRUP�LV�XVHG�WR�SURYLGH�WKH�K:QG�WKDW�LV�XVHG�LQ�WKH�FDOO�WR�6HW&ODVV/RQJ3WU���([DPSOH������VKRZV�WKH�FRGH�EHKLQG�WKH�QHZ�EXWWRQ��ZKLFK�LV�QDPHG�FPG&UHDWH:QG��7KLV�EXWWRQ�FOLFN�HYHQW�ILUVW�FUHDWHV�D�QHZ�IRUP�IURP�WKH�IUP*OREDO6XE�IRUP�WKDW�ZDV�DGGHG�WR�WKH�SURMHFW��,Q�D�UHDO�OLIH�DSSOLFDWLRQ��WKLV�ZLQGRZ�ZRXOG�EH�KLGGHQ�IURP�WKH�XVHU��1H[W��DQ�LQVWDQFH�RI�WKH�&6XEFODVV�FODVV�LV�FUHDWHG�DQG�LQLWLDOL]HG�ZLWK�WKH�KDQGOH�RI�WKH�ZLQGRZ�MXVW�FUHDWHG��)LQDOO\��WKLV�EXWWRQ�LV�GLVDEOHG��7KLV�LV�WR�UHPRYH�WKH�XVHUV�DELOLW\�WR�FUHDWH�DQRWKHU�ZLQGRZ�DQG�D�QHZ�&6XEFODVV�REMHFW���

([DPSOH�������7KH�&UHDWH�:QG�%XWWRQV�&OLFN�(YHQW�3URFHGXUH��

3ULYDWH�6XE�FPG&UHDWH:QGB&OLFN������ &UHDWH�QHZ�IRUP�����'LP�&*6XE)RUP�$V�1HZ�IUP*OREDO6XE�� &*6XE)RUP�&DSWLRQ� ��2ULJLQDO�:LQGRZ������&*6XE)RUP�9LVLEOH� �7UXH������&UHDWH�VXEFODVVLQJ�REMHFW�����6HW�&6XE&OV$SS� �1HZ�&6XEFODVV�� &6XE&OV$SS�KZQG� �&*6XE)RUP�KZQG������'R�QRW�FUHDWH�D�VHFRQG�LQVWDQFH��ZH�ZLOO�ORVH�WKH�RULJLQDO�KZQG�����FPG&UHDWH:QG�(QDEOHG� �)DOVH�(QG�6XE�

Page 130: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�&OLFN�HYHQW�SURFHGXUH�IRU�WKH�6XEFODVV�EXWWRQ�LV�HQWLUHO\�QHZ��LW�LV�VKRZQ�LQ�([DPSOH�������7KH�FRGH�FKHFNV�WR�PDNH�VXUH�WKDW�D�ZLQGRZ�KDV�EHHQ�FUHDWHG�WKDW�FDQ�EH�XVHG�WR�LQLWLDWH�JOREDO�VXEFODVVLQJ��7KLV�LV�GRQH�E\�PDNLQJ�VXUH�WKDW�WKH�FPG&UHDWH:QG�EXWWRQ�KDV�EHHQ�GLVDEOHG��,I�LW�KDV�EHHQ�GLVDEOHG��WKH�(QDEOH6XEFODVV�SXEOLF�PHWKRG�LQ�WKH�&6XEFODVV�REMHFW�LV�FDOOHG��7KLV�PHWKRG�ZLOO�XVH�6HW&ODVV/RQJ3WU�WR�PRGLI\�WKH�OSIQ:QG3URF�PHPEHU�RI�WKH�FODVV�VWUXFWXUH��7KH�ODVW�WKLQJ�WKLV�PHWKRG�GRHV�LV�FUHDWH�D�QHZ�IRUP�XVLQJ�WKH�PRGLILHG�FODVV���

([DPSOH�������7KH�FPG6XEFODVVB&OLFN�(YHQW�3URFHGXUH��

3ULYDWH�6XE�FPG6XEFODVVB&OLFN���������'LP�1HZ)RUP�$V�IUP*OREDO6XE��� ,I�FPG&UHDWH:QG�(QDEOHG� �)DOVH�7KHQ���������&DOO�&6XE&OV$SS�(QDEOH6XEFODVV������������������6HW�1HZ)RUP� �1HZ�IUP*OREDO6XE���������1HZ)RUP�6KRZ�� (OVH���������0VJ%R[��&OLFN�RQ�WKH�&UHDWH�:QG�EXWWRQ�WR�FUHDWH�D�ZLQGRZ�WR�VXEFODVV�������(QG�,I�(QG�6XE�7KLV�EXWWRQ�FDQ�EH�FOLFNHG�PXOWLSOH�WLPHV�WR�FUHDWH�PXOWLSOH�JOREDOO\�VXEFODVVHG�ZLQGRZV�ZLWKRXW�FUDVKLQJ�WKH�DSSOLFDWLRQ��7KLV�LV�EHFDXVH�WKH�(QDEOH6XEFODVV�PHWKRG�ZLOO�FDOO�WKH�6HW&ODVV/RQJ3WU�$3,�IXQFWLRQ�RQO\�RQFH��$IWHU�WKLV�PHWKRG�KDV�VXFFHVVIXOO\�EHHQ�FDOOHG��LW�NQRZV�QRW�WR�FDOO�6HW&ODVV/RQJ3WU�D�VHFRQG�WLPH��&DOOLQJ�6HW&ODVV/RQJ3WU�D�VHFRQG�WLPH�ZRXOG�FDXVH�XV�WR�ORVH�WKH�IXQFWLRQ�SRLQWHU��PBO2ULJ&ODVV3URF��WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�LQ�WKH�FODVV���7KH�8Q�6XEFODVV�EXWWRQ�VWLOO�FDOOV�WKH�'LVDEOH6XEFODVV�SXEOLF�PHWKRG�RI�WKH�&6XEFODVV�FODVV��7KH�RQO\�GLIIHUHQFH�LV�WKDW�LW�QRZ�FKHFNV�WR�VHH�LI�WKH�FPG&UHDWH:QG�EXWWRQ�KDV�EHHQ�GLVDEOHG�EHIRUH�FDOOLQJ�WKH�'LVDEOH6XEFODVV�PHWKRG��,WV�VLQJOH�OLQH�RI�FRGH�WKHQ�DSSHDUV�DV�IROORZV���,I�1RW�0H�FPG&UHDWH:QG�(QDEOHG�7KHQ�&DOO�&6XE&OV$SS�'LVDEOH6XEFODVV�$OO�WKH�FRGH�LQ�WKH�)RUPB/RDG�HYHQW�VKRXOG�EH�UHPRYHG���1H[W��DGG�WKH�IROORZLQJ�FRGH�EHIRUH�WKH�H[LVWLQJ�FRGH�LQ�WKH�)RUPB4XHU\8QORDG�HYHQW�SURFHGXUH���5HPRYH�DOO�FKLOG�ZLQGRZV�WR�SUHYHQW�D�*3)�'LP�,�$V�,QWHJHU�)RU�,� �)RUPV�&RXQW�����7R���6WHS����

Page 131: Visual Basic - Subclassing and Hooking with VB & VB NET

� ,I�)RUPV�,��&DSWLRQ��!��&KDSWHU�����6XEFODVVLQJ�([DPSOH��$QG�B�� � � )RUPV�,��&DSWLRQ��!��2ULJLQDO�:LQGRZ��7KHQ�� ���� 8QORDG�)RUPV�,������(QG�,I�1H[W�,��7KLV�HYHQW�VWLOO�GHVWUR\V�WKH�&6XE&OV$SS�REMHFW��EXW�FHUWDLQ�SURFHVVLQJ�PXVW�QRZ�KDSSHQ�EHIRUH�DQG�DIWHU�WKH�&6XE&OV$SS�REMHFW�GHVWUXFWLRQ��%HIRUH�WKH�FODVV�LV�GHVWUR\HG��DOO�JOREDOO\�VXEFODVVHG�ZLQGRZV�PXVW�EH�XQORDGHG��7KLV�FRGH�GHVWUR\V�RQO\�WKH�JOREDOO\�VXEFODVVHG�ZLQGRZV��GHVWUR\LQJ�DQ\�RWKHU�ZLQGRZ�ZRXOG�FDXVH�RXU�DSSOLFDWLRQ�WR�FUDVK��%HFDXVH�ZH�NQRZ�ZKDW�WKH�ZLQGRZ�FDSWLRQV�ZLOO�FRQWDLQ��LW�LV�D�VLPSOH�PDWWHU�RI�ORRSLQJ�WKURXJK�DOO�WKH�FXUUHQW�ZLQGRZV�LQ�WKH�DSSOLFDWLRQ�DQG�RQO\�XQORDGLQJ�WKH�RQHV�WKDW�KDYH�EHHQ�JOREDOO\�VXEFODVVHG��:H�GR�QRW�ZDQW�WR�XQORDG�WKH�PDLQ�IRUP�EHFDXVH�LW�LV�DOUHDG\�LQ�WKH�SURFHVV�RI�EHLQJ�XQORDGHG��1HLWKHU�GR�ZH�ZDQW�WR�XQORDG�WKH�RULJLQDO�ZLQGRZ�EHFDXVH��DV�,�PHQWLRQHG�HDUOLHU��ZH�ZRXOG�ORVH�RXU�ZLQGRZ�KDQGOH��PBKZQG��WKDW�LV�QHHGHG�WR�UHOHDVH�WKH�JOREDO�VXEFODVVLQJ���,QVWHDG�RI�XVLQJ�WKH�IRUPV�FDSWLRQ�WR�GHWHUPLQH�LI�WKH�ZLQGRZ�KDV�EHHQ�JOREDOO\�VXEFODVVHG��\RX�PLJKW�ZDQW�WR�VWRUH�DQ�DUUD\�RI�ZLQGRZ�KDQGOHV��<RX�FDQ�WKHQ�ORRS�WKURXJK�WKLV�DUUD\�DQG�XQORDG�HDFK�ZLQGRZ�LQ�WKH�DUUD\��:KHQ�XVLQJ�WKLV�PHWKRG��PDNH�DEVROXWHO\�FHUWDLQ�WKDW�\RX�XQORDG�HYHU\�JOREDOO\�VXEFODVVHG�ZLQGRZ�RU�\RXU�DSSOLFDWLRQ�FRXOG�FUDVK���$IWHU�WKH�FODVV�KDV�EHHQ�GHVWUR\HG��WKH�RULJLQDO�ZLQGRZ�FDQ�EH�GHVWUR\HG��7KH�IROORZLQJ�FRGH��ZKLFK�VKRXOG�EH�DGGHG�WR�WKH�HQG�RI�WKH�)RUPB4XHU\8QORDG�SURFHGXUH��GRHV�MXVW�WKDW���5HPRYH�WKH�RULJLQDO�ZLQGRZ�WR�FOHDQ�XS�)RU�,� �)RUPV�&RXQW�����7R���6WHS����� ,I�)RUPV�,��&DSWLRQ� ��2ULJLQDO�:LQGRZ��7KHQ������ 8QORDG�)RUPV�,������(QG�,I�1H[W�,�

�8QORDG�DOO�JOREDOO\�VXEFODVVHG�IRUPV�EHIRUH�GHVWUR\LQJ�WKH�&6XEFODVV�REMHFW��8QORDG�WKH�RULJLQDO�ZLQGRZ�WKDW�LV�XVHG�WR�JHW�WKH�K:QG�WR�LQLWLDWH�JOREDO�VXEFODVVLQJ�RQO\�DIWHU�GHVWUR\LQJ�WKH�&6XEFODVV�REMHFW����

([DPSOH������VKRZV�WKH�FRPSOHWH�ZLQGRZ�SURFHGXUH��ZLWK�UHYLVHG�OLQHV�LQGLFDWHG�LQ�EROGIDFH���

([DPSOH�������7KH�0RGLILHG�IUP&K��IUP�0RGXOH�IRU�WKH�*OREDO�6XEFODVVLQJ([DPSOH��

3ULYDWH�6XE�FPG&UHDWH:QGB&OLFN���������&UHDWH�QHZ�IRUP�����'LP�&*6XE)RUP�$V�1HZ�IUP*OREDO6XE�

Page 132: Visual Basic - Subclassing and Hooking with VB & VB NET

����&*6XE)RUP�&DSWLRQ� ��2ULJLQDO�:LQGRZ������&*6XE)RUP�9LVLEOH� �7UXH����������&UHDWH�VXEFODVVLQJ�REMHFW�����6HW�&6XE&OV$SS� �1HZ�&6XEFODVV�����&6XE&OV$SS�KZQG� �&*6XE)RUP�KZQG������'R�QRW�FUHDWH�D�VHFRQG�LQVWDQFH��ZH�ZLOO�ORVH�WKH�RULJLQDO�KZQG�����FPG&UHDWH:QG�(QDEOHG� �)DOVH�(QG�6XE��3ULYDWH�6XE�FPG6XEFODVVB&OLFN���������,I�FPG&UHDWH:QG�(QDEOHG� �)DOVH�7KHQ���������&DOO�&6XE&OV$SS�(QDEOH6XEFODVV������������������6HW�1HZ)RUP� �1HZ�IUP*OREDO6XE���������1HZ)RUP�6KRZ�����(OVH���������0VJ%R[��&OLFN�RQ�WKH�&UHDWH�:QG�EXWWRQ�WR�FUHDWH�D�ZLQGRZ�WR�VXEFODVV�������(QG�,I�(QG�6XE��3ULYDWH�6XE�FPG8Q6XEFODVVB&OLFN���������,I�FPG&UHDWH:QG�(QDEOHG� �)DOVH�7KHQ���������&DOO�&6XE&OV$SS�'LVDEOH6XEFODVV�����(OVH���������0VJ%R[��&OLFN�RQ�WKH�&UHDWH�:QG�EXWWRQ�WR�FUHDWH�D�ZLQGRZ�WR�VXEFODVV�������(QG�,I�(QG�6XE��3ULYDWH�6XE�)RUPB4XHU\8QORDG�&DQFHO�$V�,QWHJHU��8QORDG0RGH�$V�,QWHJHU������5HPRYH�DOO�FKLOG�ZLQGRZV�WR�SUHYHQW�D�*3)�����'LP�,�$V�,QWHJHU�����)RU�,� �)RUPV�&RXQW�����7R���6WHS������������,I�)RUPV�,��&DSWLRQ��!��&KDSWHU�����6XEFODVVLQJ�([DPSOH��B�� ������$QG�)RUPV�,��&DSWLRQ��!��2ULJLQDO�:LQGRZ��7KHQ�������������8QORDG�)RUPV�,����������(QG�,I�����1H[W�,������

Page 133: Visual Basic - Subclassing and Hooking with VB & VB NET

����0DNH�VXUH�FODVV�LV�GHVWUR\HG�KHUH�����6HW�&6XE&OV$SS� �1RWKLQJ������5HPRYH�WKH�RULJLQDO�ZLQGRZ�WR�FOHDQ�XS�����)RU�,� �)RUPV�&RXQW�����7R���6WHS������������,I�)RUPV�,��&DSWLRQ� ��2ULJLQDO�:LQGRZ��7KHQ�������������8QORDG�)RUPV�,����������(QG�,I�����1H[W�,�(QG�6XE�4XLWH�D�IHZ�FRGH�FKDQJHV�DQG�DGGLWLRQV�ZHUH�PDGH�WR�WKH�IRUP�PRGXOH��EXW�JOREDO�VXEFODVVLQJ�GRHV�RSHUDWH�D�ELW�GLIIHUHQWO\�WKDQ�LQVWDQFH�VXEFODVVLQJ���

������+RZ�,W�$OO�:RUNV�

:KHQ�\RX�UXQ�WKLV�FRGH��WKH�JOREDO�VXEFODVVLQJ�DSSOLFDWLRQ�LV�HDV\�WR�XVH��KHUH�DUH�WKH�VWHSV�\RX�IROORZ�WR�XVH�WKLV�DSSOLFDWLRQ���

��� &OLFN�WKH�&UHDWH�:QG�EXWWRQ����� &OLFN�WKH�6XEFODVV�EXWWRQ���7KLV�EXWWRQ�FDQ�EH�FOLFNHG�PXOWLSOH�WLPHV�WR�FUHDWH�JOREDOO\�

VXEFODVVHG�ZLQGRZV������� &ORVLQJ�WKH�DSSOLFDWLRQ�FDQ�EH�GRQH�LQ�RQH�RI�WZR�ZD\V��

D�� &OLFN�WKH�8Q�6XEFODVV�EXWWRQ�DQG�WKHQ�FORVH�WKH�DSSOLFDWLRQ��E�� &ORVH�WKH�DSSOLFDWLRQ�ZLWKRXW�FOLFNLQJ�WKH�8Q�6XEFODVV�EXWWRQ��

:KHQ�\RX�FOLFN�WKH�&UHDWH�:QG�EXWWRQ��D�QHZ�ZLQGRZ�LV�FUHDWHG�ZLWK�WKH�FDSWLRQ��2ULJLQDO�:LQGRZ���7KLV�ZLQGRZV�KDQGOH�LV�QHHGHG�E\�6HW&ODVV/RQJ3WU�WR�LQLWLDWH�JOREDO�VXEFODVVLQJ��7KLV�LV�DOVR�WKH�ZLQGRZ�WKDW�LV�XVXDOO\�KLGGHQ�IURP�WKH�XVHU��1RZ�WKH�DSSOLFDWLRQ�KDV�DOO�WKH�LQIRUPDWLRQ�LW�QHHGV�IRU�JOREDO�VXEFODVVLQJ���:KHQ�WKH�XVHU�FOLFNV�WKH�6XEFODVV�EXWWRQ��D�QHZ�ZLQGRZ�LV�FUHDWHG�DQG�GLVSOD\HG��7KLV�ZLQGRZ�KDV�WKH�FDSWLRQ��*OREDOO\�6XEFODVVHG�)RUP���+HUHV�WKH�LQWHUHVWLQJ�SDUW��:KHQ�\RX�FOLFN�WKH�0LQLPL]H�EXWWRQ�RQ�WKH�WLWOH�EDU�RI�WKH�ZLQGRZ�ZLWK�WKH�FDSWLRQ��2ULJLQDO�:LQGRZ���WKH�ZLQGRZ�LV�PLQLPL]HG�DV�LW�QRUPDOO\�ZRXOG�EH��:KHQ�\RX�FOLFN�WKH�0LQLPL]H�EXWWRQ�IRU�WKH�ZLQGRZ�ZLWK�WKH�FDSWLRQ��*OREDOO\�6XEFODVVHG�)RUP���WKH�IRUP�UROOV�XS�LQVWHDG�RI�EHLQJ�PLQLPL]HG��7KDWV�QRW�DOO��,I�\RX�FOLFN�WKH�6XEFODVV�EXWWRQ�UHSHDWHGO\��QHZ�ZLQGRZV�ZLOO�EH�GLVSOD\HG�ZLWK�WKH�FDSWLRQ��*OREDOO\�6XEFODVVHG�)RUP���(DFK�QHZ�ZLQGRZ�ZLOO�DOVR�UROO�XS�ZKHQ�WKH�0LQLPL]H�EXWWRQ�LV�FOLFNHG���,QVWHDG�RI�SHUIRUPLQJ�LQVWDQFH�VXEFODVVLQJ�RQ�HDFK�ZLQGRZ�VHSDUDWHO\��ZKLFK�ZRXOG�EH�D�ORW�RI�ZRUN��ZH�KDYH�DOWHUHG�WKH�EDVH�IXQFWLRQDOLW\�RI�HYHU\�ZLQGRZ�WR�VXLW�RXU�QHHGV��&OLFNLQJ�WKH�

Page 134: Visual Basic - Subclassing and Hooking with VB & VB NET

8Q�6XEFODVV�EXWWRQ�DQG�FORVLQJ�WKH�DSSOLFDWLRQ�ZLOO�GHVWUR\�DOO�WKH�FUHDWHG�ZLQGRZV�DQG�UHVWRUH�WKH�RULJLQDO�OSIQ:QG3URF�IXQFWLRQ�SRLQWHU�LQ�WKH�IRUP�ZLQGRZ�FODVV���1RZ�WKDW�\RX�NQRZ�KRZ�WR�XVH�WKLV�H[DPSOH�DSSOLFDWLRQ��OHWV�WDNH�D�ORRN�DW�ZKDW�LV�JRLQJ�RQ�EHKLQG�WKH�VFHQHV��1RWKLQJ�RI�UHDO�LQWHUHVW�KDSSHQV�ZKHQ�WKH�DSSOLFDWLRQ�LV�ILUVW�VWDUWHG��&OLFNLQJ�WKH�&UHDWH�:QG�EXWWRQ�RQO\�VHWV�XS�WKH�DSSOLFDWLRQ�IRU�JOREDO�VXEFODVVLQJ��$W�WKLV�SRLQW��QR�VXEFODVVLQJ�RI�DQ\�NLQG�KDV�RFFXUUHG��7KH�DSSOLFDWLRQ�ZLOO�EH�GLVSOD\HG�RQ�WKH�VFUHHQ�VLPLODU�WR�)LJXUH�������

)LJXUH������6FUHHQVKRW�RI�WKH�H[DPSOH�DSSOLFDWLRQ�DIWHU�FOLFNLQJ�WKH�&UHDWH�:QG�EXWWRQ�

1RWKLQJ�PXFK�KDV�KDSSHQHG�VR�IDU��1HLWKHU�ZLQGRZ�KDV�EHHQ�PRGLILHG��VR�WKH\�HDFK�ZLOO�XVH�WKHLU�RZQ�GHIDXOW�ZLQGRZ�SURFHGXUH��7KH�VWDWH�RI�WKH�DSSOLFDWLRQ�FDQ�EH�VHHQ�LQ�)LJXUH�������

)LJXUH������6WDWH�RI�WKH�DSSOLFDWLRQ�DIWHU�FOLFNLQJ�WKH�&UHDWH�:QG�EXWWRQ�

7KH�QH[W�VWHS�LV�WR�FOLFN�WKH�6XEFODVV�EXWWRQ��7KLV�FUHDWHV�D�QHZ�ZLQGRZ��DQG�WKH�DSSOLFDWLRQ�QRZ�DSSHDUV�DV�LQ�)LJXUH�������

)LJXUH������6FUHHQVKRW�RI�WKH�H[DPSOH�DSSOLFDWLRQ�DIWHU�FOLFNLQJ�WKH�6XEFODVV�EXWWRQ�

Page 135: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�FRGH�IRU�WKH�6XEFODVV�EXWWRQ�FDOOV�WKH�(QDEOH6XEFODVV�SXEOLF�PHWKRG�RI�WKH�&6XEFODVV�FODVV��7KH�(QDEOH6XEFODVV�PHWKRG�ZLOO�XVH�6HW&ODVV/RQJ3WU�WR�PRGLI\�WKH�FODVV�WKDW�ZDV�XVHG�WR�FUHDWH�WKH�RULJLQDO�ZLQGRZ��IURP�KHUH�RQ�RXW��ZKHQ�,�XVH�WKH�WHUP��RULJLQDO�ZLQGRZ��,�DP�UHIHUULQJ�WR�WKH�ZLQGRZ�ZLWK�WKH�FDSWLRQ��2ULJLQDO�:LQGRZ����7KH�FODVV�WKDW�WKLV�IXQFWLRQ�PRGLILHV�LV�7KXQGHU57�)RUP'&��7KH�6HW&ODVV/RQJ3WU�$3,�IXQFWLRQ�UHTXLUHV�D�ZLQGRZ�KDQGOH��PBKZQG��WR�PRGLI\�WKH�IXQFWLRQ�SRLQWHU�WR�WKH�FODVV�ZLQGRZ�SURFHGXUH��7KLV�ZLQGRZ�KDQGOH�PXVW�EH�WDNHQ�IURP�D�ZLQGRZ�FUHDWHG�IURP�WKH�FODVV�WKDW�ZH�ZDQW�WR�JOREDOO\�VXEFODVV���$IWHU�FDOOLQJ�6HW&ODVV/RQJ3WU��WKH�FODVV�OSIQ:QG3URF�IXQFWLRQ�SRLQWHU�WR�LWV�ZLQGRZ�SURFHGXUH�LV�QRZ�SRLQWLQJ�WR�RXU�QHZ�VXEFODVVHG�ZLQGRZ�SURFHGXUH��1HZ&ODVV3URF��$V�ZLWK�LQVWDQFH�VXEFODVVLQJ��ZH�UHWDLQ�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�LQ�WKH�PBO2ULJ&ODVV3URF�PHPEHU�YDULDEOH�VR�WKDW�ZH�FDQ�UHVWRUH�WKH�FODVV�WR�LWV�RULJLQDO�VWDWH���%HFDXVH�WKH�FODVV�ZDV�JOREDOO\�VXEFODVVHG�DIWHU�WKH�RULJLQDO�ZLQGRZ�ZDV�FUHDWHG��WKH�RULJLQDO�ZLQGRZ�ZLOO�FRQWLQXH�XVLQJ�WKH�SRLQWHU�WR�WKH�FODVVV�RULJLQDO�ZLQGRZ�SURFHGXUH��WKLV�LV�WKH�VDPH�SRLQWHU�WKDW�LV�FRQWDLQHG�LQ�WKH�PBO2ULJ&ODVV3URF�PHPEHU�YDULDEOH���:KHQ�WKH�RULJLQDO�ZLQGRZ�ZDV�FUHDWHG��WKH�FODVV�LQIRUPDWLRQ�XVHG�WR�FUHDWH�WKLV�ZLQGRZ�ZDV�FRSLHG�LQWR�WKH�ZLQGRZ�VWUXFWXUH��7KH�SRLQWHU�WR�WKLV�ZLQGRZV�ZLQGRZ�SURFHGXUH�LV�QR�ORQJHU�WLHG�WR�WKH�FODVVV�ZLQGRZ�SURFHGXUH��7KHUHIRUH��LW�UHPDLQV�XQFKDQJHG���7KH�VHFRQG�WKLQJ�WKDW�WKH�6XEFODVV�EXWWRQ�GRHV�LV�FUHDWH�D�QHZ�ZLQGRZ�IURP�WKH�VDPH�IRUP�REMHFW�IURP�ZKLFK�WKH�RULJLQDO�ZLQGRZ�ZDV�FUHDWHG��7KLV�QHZ�ZLQGRZ�XVHV�WKH�IXQFWLRQ�SRLQWHU�WR�WKH�ZLQGRZ�SURFHGXUH�WKDW�LV�QRZ�FRQWDLQHG�LQ�WKH�PRGLILHG�FODVV��7KHUHIRUH��ZKHQ�\RX�FOLFN�WKH�0LQLPL]H�EXWWRQ�IRU�WKH�RULJLQDO�ZLQGRZ��WKH�ZLQGRZ�LV�DFWXDOO\�PLQLPL]HG�WKH�ZD\�:LQGRZV�LQWHQGHG��DQG�ZKHQ�\RX�FOLFN�WKH�0LQLPL]H�EXWWRQ�RI�WKH�QHZ�ZLQGRZ��LW�UROOV�XS�LQVWHDG�RI�PLQLPL]HV��)LJXUH�����VKRZV�WKH�VWDWH�RI�WKH�DSSOLFDWLRQ�DW�WKLV�SRLQW���

)LJXUH������6WDWH�RI�WKH�DSSOLFDWLRQ�DIWHU�FOLFNLQJ�WKH�6XEFODVV�EXWWRQ�

Page 136: Visual Basic - Subclassing and Hooking with VB & VB NET

(DFK�WLPH�WKH�6XEFODVV�EXWWRQ�LV�FOLFNHG��D�QHZ�ZLQGRZ�LV�FUHDWHG��7KLV�QHZ�ZLQGRZ�ZLOO�XVH�WKH�VDPH�FODVV�WKDW�ZH�SUHYLRXVO\�PRGLILHG��7KHUHIRUH��HDFK�QHZ�ZLQGRZ�ZLOO�UROO�XS�DV�ZHOO���7KH�QH[W�VWHS�LV�WR�FOLFN�WKH�8Q�6XEFODVV�EXWWRQ��7KH�VFUHHQ�VKRXOG�ORRN�VRPHWKLQJ�VLPLODU�WR�)LJXUH�������7KH�FRGH�EHKLQG�WKLV�EXWWRQ�FDOOV�WKH�'LVDEOH6XEFODVV�SXEOLF�PHPEHU�IXQFWLRQ�RI�WKH�&6XEFODVV�FODVV��7KH�RQO\�DFWLRQ�'LVDEOH6XEFODVV�SHUIRUPV�LV�WR�FDOO�6HW&ODVV/RQJ3WU��ZKLFK�UHPRYHV�WKH�JOREDO�VXEFODVV��,I�\RX�REVHUYH�WKH�IXQFWLRQDOLW\�RI�HDFK�FUHDWHG�ZLQGRZ��\RX�ZLOO�QRWLFH�WKDW�WKH�ZD\�WKH\�IXQFWLRQ�KDV�QRW�FKDQJHG��HYHQ�WKRXJK�WKH�JOREDO�VXEFODVV�KDV�EHHQ�UHPRYHG��7KLV�LV�EHFDXVH�RQO\�WKH�FODVV�VWUXFWXUH�KDV�FKDQJHG��QRW�WKH�ZLQGRZ�VWUXFWXUH�RI�HDFK�H[LVWLQJ�ZLQGRZ��,I�\RX�PLQLPL]H�WKH�RULJLQDO�ZLQGRZ��LW�VWLOO�ZRUNV�WKH�ZD\�WKH�:LQGRZV�RSHUDWLQJ�V\VWHP�LQWHQGHG�LW�WR�ZRUN��(DFK�QHZ�ZLQGRZ�FUHDWHG�DIWHU�WKH�6XEFODVV�EXWWRQ�ZDV�FOLFNHG�UHWDLQV�WKH�UROO�XS�IXQFWLRQDOLW\���

�*OREDO�VXEFODVVLQJ�DIIHFWV�WKH�FODVV�VWUXFWXUH��QRW�WKH�ZLQGRZ�VWUXFWXUH�RI�H[LVWLQJ�ZLQGRZV����

)LJXUH�������6FUHHQVKRW�RI�WKH�DSSOLFDWLRQ�DIWHU�FOLFNLQJ�WKH�8Q�6XEFODVV�EXWWRQ�

7KHUH�LV�QR�UHDVRQ�IRU�WKLV�DSSOLFDWLRQ�WR�FUDVK�DW�WKLV�SRLQW��7KH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�1HZ&ODVV3URF�LV�VWLOO�DYDLODEOH�DW�WKH�VDPH�ORFDWLRQ��7KHUHIRUH��QR�IXQFWLRQ�SRLQWHUV�DUH�SRLQWLQJ�WR�LQYDOLG�PHPRU\�ORFDWLRQV��:H�VWLOO�KDYH�WKH�PHPEHU�YDULDEOH�WKDW�FRQWDLQV�WKH�RULJLQDO�FODVVV�ZLQGRZ�SURFHGXUH��PBO2ULJ&ODVV3URF���7KDW�ZD\��ZKHQ�RXU�VXEFODVVHG�ZLQGRZ�SURFHGXUH��1HZ&ODVV3URF��FDOOV�&DOO:LQGRZ3URF�WR�SDVV�RQ�WKH�

Page 137: Visual Basic - Subclassing and Hooking with VB & VB NET

PHVVDJH��D�YDOLG�ZLQGRZ�SURFHGXUH�LV�IRXQG��7KH�PRGLILHG�ZLQGRZ�FODVV�KDV�EHHQ�FKDQJHG�EDFN�WR�XVH�LWV�RULJLQDO�FODVV�ZLQGRZ�SURFHGXUH��ZKLFK�LV�DOVR�VWLOO�YDOLG���7KH�LQWHUHVWLQJ�WKLQJ�WR�GR�QRZ�LV�FOLFN�WKH�6XEFODVV�EXWWRQ�DJDLQ��%HFDXVH�WKH�PBO2ULJ&ODVV3URF�PHPEHU�YDULDEOH�VWLOO�FRQWDLQV�WKH�FODVVV�RULJLQDO�ZLQGRZ�SURFHGXUH��WKH�FRGH�ZLOO�QRW�DOORZ�6HW&ODVV/RQJ3WU�WR�EH�FDOOHG�D�VHFRQG�WLPH��7KLV�ZD\�ZH�DUH�DVVXUHG�RI�QRW�ORVLQJ�WKH�RULJLQDO�FODVVV�ZLQGRZ�SURFHGXUH��$IWHU�E\SDVVLQJ�WKH�FDOO�WR�VHW�DQRWKHU�JOREDO�VXEFODVV��WKH�FRGH�FUHDWHV�D�QHZ�ZLQGRZ��7KLV�ZLQGRZ�LQKHULWV�LWV�SURSHUWLHV�IURP�WKH�UHVWRUHG�ZLQGRZ�FODVV��ZKLFK�QRZ�KDV�LWV�RULJLQDO�FODVV�ZLQGRZ�SURFHGXUH��7KH�QHZO\�FUHDWHG�ZLQGRZ�XVHV�WKLV�ZLQGRZ�SURFHGXUH�DV�LWV�GHIDXOW��&OLFNLQJ�WKH�0LQLPL]H�EXWWRQ�RI�WKLV�QHZ�ZLQGRZ�ZLOO�PLQLPL]H�LW�WKH�ZD\�:LQGRZV�LQWHQGHG�LW�WR�EH�PLQLPL]HG��7KLV�LV�VKRZQ�LQ�)LJXUH��������

)LJXUH�������6WDWH�RI�WKH�DSSOLFDWLRQ�DIWHU�FOLFNLQJ�WKH�8Q�6XEFODVV�EXWWRQ��WKH�*OREDOO\�6XEFODVVHG�:LQGRZ����LV�FUHDWHG�DIWHU�UHPRYLQJ�WKH�JOREDO�VXEFODVV�ZLWK�WKH�

6HW&ODVV/RQJ3WU�$3,�IXQFWLRQ��QRWLFH�WKDW�LW�XVHV�WKH�XQPRGLILHG�FODVVV�ZLQGRZ�SURFHGXUH�DV�LWV�RZQ���

,W�LV�DOVR�LPSRUWDQW�WR�QRWH�WKDW�LI�WKH�DSSOLFDWLRQ�LV�FORVHG�EHIRUH�WKH�JOREDO�VXEFODVV�LV�UHPRYHG��WKH�&6XEFODVV�FODVV�ZLOO�DXWRPDWLFDOO\�UHPRYH�WKH�JOREDO�VXEFODVV�ZKHQ�WKH�FODVV�LV�GHVWUR\HG��7KLV�SUHYHQWV�RXU�DSSOLFDWLRQ�IURP�FUDVKLQJ���

������%HKLQG�WKH�6FHQHV�ZLWK�6S\���

7R�VHH�KRZ�WKLV�DSSOLFDWLRQ�ZRUNV�IURP�WKH�LQVLGH��OHWV�XVH�WKH�6S\���XWLOLW\�WR�VS\�RQ�WKH�JOREDO�VXEFODVVLQJ�H[DPSOH��)RU�WKLV�SXUSRVH��\RX�VKRXOG�XVH�WKH�DSSOLFDWLRQV�FRPSLOHG�(;(��UDWKHU�WKDQ�UXQQLQJ�LW�IURP�WKH�GHYHORSPHQW�HQYLURQPHQW��7KH�LQIRUPDWLRQ�WKDW�\RX�VHH�LQ�6S\���IRU�DQ�DSSOLFDWLRQ�WKDW�LV�UXQQLQJ�LQ�WKH�GHYHORSPHQW�HQYLURQPHQW�PRVW�OLNHO\�ZLOO�QRW�EH�FRUUHFW�EHFDXVH�RI�WKH�ZD\�9%�KDQGOHV�WKH�$GGUHVV2I�RSHUDWRU�ZKLOH�UXQQLQJ�DQ�DSSOLFDWLRQ�LQ�WKH�,'(��1RWH��WKRXJK��WKDW�ZKHQ�UXQQLQJ�WKLV�H[DPSOH�RQ�\RXU�FRPSXWHU�\RX�ZLOO�QRW�VHH�WKH�PHPRU\�DGGUHVVHV�DQG�KDQGOHV�WKDW�,�XVH�KHUH��,�DP�XVLQJ�WKHVH�YDOXHV�WR�VKRZ�\RX�WKH�UHODWLRQVKLSV�EHWZHHQ�FODVVHV�DQG�WKHLU�ZLQGRZV���)LUVW��OHWV�VWDUW�XS�WKH�JOREDO�VXEFODVVLQJ�H[DPSOH�DQG�WKHQ�UXQ�6S\����9LHZ�WKH�DSSOLFDWLRQV�ZLQGRZV�E\�VHOHFWLQJ�WKH�6S\� :LQGRZV�PHQX�LWHP�RU�E\�SUHVVLQJ�&WUO�:��)LQG�WKH�OLQH�

Page 138: Visual Basic - Subclassing and Hooking with VB & VB NET

ZKLFK�KDV�WKH�ZLQGRZ�FDSWLRQ�IROORZHG�E\�WKH�ZRUG�7KXQGHU57�0DLQ��L�H����&KDSWHU������6XEFODVVLQJ�([DPSOH��7KXQGHU57�0DLQ���,�ZLOO�UHIHU�WR�WKLV�ZLQGRZ�DV�WKH�PDLQ�IRUP��$W�WKLV�SRLQW��WKH�PDLQ�ZLQGRZ�LV�GLVSOD\HG��DQG�WKH�LQIRUPDWLRQ�ZH�JDWKHU�IURP�WKH�*HQHUDO�DQG�&ODVV�WDEV�RI�WKH�:LQGRZV�3URSHUWLHV�GLDORJ�ER[�LV�DV�IROORZV���:LQGRZ�&DSWLRQ� ��&KDSWHU�����6XEFODVVLQJ�([DPSOH��K:QG� ����������:QG�3URF� �����))&%�&ODVV�1DPH� �7KXQGHU57�)RUP'&�&ODVV�:QG�3URF� �����))&%�$�ZLQGRZ�KDV�EHHQ�FUHDWHG�DQG�GLVSOD\HG��WKDW�LV�DERXW�LW��1H[W��FOLFN�WKH�&UHDWH�:QG�EXWWRQ�RQ�WKH�PDLQ�IRUP��WKHQ�VZLWFK�WR�6S\���DQG�SUHVV�)��WR�UHIUHVK�WKH�6S\���GLVSOD\��$�QHZ�ZLQGRZ�LV�GLVSOD\HG�ZLWK�WKH�IROORZLQJ�DWWULEXWHV���:LQGRZ�&DSWLRQ� ��2ULJLQDO�:LQGRZ��K:QG� ����������:QG�3URF� �����))&%�&ODVV�1DPH� �7KXQGHU57�)RUP'&�&ODVV�:QG�3URF� �����))&%�7KH�PDLQ�ZLQGRZV�DWWULEXWHV�UHPDLQ�WKH�VDPH�DV�EHIRUH�\RX�FOLFNHG�WKH�&UHDWH�:QG�EXWWRQ��1RZ�HYHU\WKLQJ�LV�LQ�SODFH�IRU�XV�WR�VXFFHVVIXOO\�SHUIRUP�JOREDO�VXEFODVVLQJ��+HUH�FRPHV�WKH�LQWHUHVWLQJ�SDUW��&OLFN�WKH�6XEFODVV�EXWWRQ�RQ�WKH�PDLQ�IRUP��1RZ�OHWV�WDNH�D�ORRN�DW�WKH�DWWULEXWHV�RI�DOO�WKUHH�ZLQGRZV���:LQGRZ�&DSWLRQ� ��&KDSWHU�����6XEFODVVLQJ�([DPSOH��K:QG� ����������:QG�3URF� �����))&%�&ODVV�1DPH� �7KXQGHU57�)RUP'&�&ODVV�:QG�3URF� �������&���:LQGRZ�&DSWLRQ� ��2ULJLQDO�:LQGRZ��K:QG� ����������:QG�3URF� �����))&%�&ODVV�1DPH� �7KXQGHU57�)RUP'&�&ODVV�:QG�3URF� �������&���:LQGRZ�&DSWLRQ� ��*OREDOO\�6XEFODVVHG�)RUP��K:QG� ���'����(�:QG�3URF� �������&��&ODVV�1DPH� �7KXQGHU57�)RUP'&�&ODVV�:QG�3URF� �������&��$V�\RX�PLJKW�QRWLFH��WKH�&ODVV�:QG�3URF�ILHOG�FKDQJHG�IURP�����))&%�WR�������&���7KLV�ILHOG�ZDV�FKDQJHG�WKURXJK�WKH�6HW&ODVV/RQJ3WU�IXQFWLRQ��7KLV�&ODVV�:QG�3URF�ILHOG�LV�WKH�

Page 139: Visual Basic - Subclassing and Hooking with VB & VB NET

VDPH�IRU�DOO�ZLQGRZV��7KLV�LV�FRUUHFW�EHFDXVH�WKH�FODVV�LQIRUPDWLRQ�LV�VWRUHG�VHSDUDWHO\�IURP�WKH�ZLQGRZ�LQIRUPDWLRQ��%\�ORRNLQJ�DW�WKLV�LQIRUPDWLRQ��\RX�FDQ�VHH�WKDW�WKH�ILUVW�WZR�ZLQGRZV�WKDW�ZHUH�FUHDWHG�UHPDLQHG�XQFKDQJHG����WKH\�FRQWLQXH�WR�XVH�WKHLU�ROG�ZLQGRZ�SURFHGXUHV��7KH�WKLUG�ZLQGRZ�LV�XVLQJ�WKH�QHZ�ZLQGRZ�SURFHGXUH��:QG�3URF��IURP�WKH�7KXQGHU57�)RUP'&�FODVV��7KLV�LV�EHFDXVH�WKH�ILUVW�WZR�ZLQGRZV�ZHUH�FUHDWHG�XVLQJ�WKH�RULJLQDO�FODVV�LQIRUPDWLRQ��ZKLOH�WKH�WKLUG�ZLQGRZ�ZDV�FUHDWHG�DIWHU�ZH�PRGLILHG�WKH�FODVVV�ZLQGRZ�SURFHGXUH��,I�ZH�FUHDWH�PRUH�JOREDO�VXEFODVVHG�ZLQGRZV��WKHLU�LQIRUPDWLRQ�LV�WKH�VDPH�DV�WKH�ZLQGRZ�ZLWK�WKH�FDSWLRQ��*OREDOO\�6XEFODVVHG�)RUP���H[FHSW��RI�FRXUVH��IRU�WKH�ZLQGRZ�KDQGOH��ZKLFK�PXVW�EH�XQLTXH�IRU�DOO�ZLQGRZV����1RZ�FOLFN�WKH�8Q�6XEFODVV�EXWWRQ�RQ�WKH�PDLQ�IRUP��6ZLWFK�WR�6S\����SUHVV�)��WR�UHIUHVK�LWV�GLVSOD\��DQG�QRZ�YLHZ�HDFK�ZLQGRZV�LQIRUPDWLRQ��7KH�QHZ�ZLQGRZ�LQIRUPDWLRQ�LV�DV�IROORZV���:LQGRZ�&DSWLRQ� ��&KDSWHU�����6XEFODVVLQJ�([DPSOH��K:QG� ����������:QG�3URF� �����))&%�&ODVV�1DPH� �7KXQGHU57�)RUP'&�&ODVV�:QG�3URF� �����))&%��:LQGRZ�&DSWLRQ� ��2ULJLQDO�:LQGRZ��K:QG� ����������:QG�3URF� �����))&%�&ODVV�1DPH� �7KXQGHU57�)RUP'&�&ODVV�:QG�3URF� �����))&%��:LQGRZ�&DSWLRQ� ��*OREDOO\�6XEFODVVHG�)RUP��K:QG� ���'����(�:QG�3URF� �������&��&ODVV�1DPH� �7KXQGHU57�)RUP'&�&ODVV�:QG�3URF� �����))&%�7KH�FODVVV�ZLQGRZ�SURFHGXUH�KDV�EHHQ�FKDQJHG�EDFN�WR�LWV�RULJLQDO�YDOXH��7KLV�YDOXH�ZDV�NHSW�LQ�WKH�PBO2ULJ&ODVV3URF�PHPEHU�YDULDEOH�LQ�WKH�&6XEFODVV�FODVV��(YHQ�WKRXJK�WKH�FODVVV�ZLQGRZ�SURFHGXUH�LV�FKDQJHG�EDFN��HDFK�ZLQGRZV�ZLQGRZ�SURFHGXUH�UHPDLQV�DV�LW�ZDV�EHIRUH�FOLFNLQJ�WKH�8Q�6XEFODVV�EXWWRQ��(YHU\�ZLQGRZ�ZKRVH�:QG�3URF�ILHOG�SRLQWV�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�ZLOO�DFW�OLNH�D�QRUPDO�ZLQGRZ��(YHU\�ZLQGRZ�ZKRVH�:QG�3URF�ILHOG�SRLQWV�WR�WKH�QHZ�ZLQGRZ�SURFHGXUH�WKDW�ZH�FUHDWHG�ZLOO�XVH�RXU�PRGLILHG�IXQFWLRQDOLW\���+HUH�LV�WKH�WULFN\�SDUW��ZKLFK�FDQ�EULQJ�\RXU�DSSOLFDWLRQ�FUDVKLQJ�GRZQ�DURXQG�\RX�LI�\RX�DUH�QRW�FDUHIXO��EHFDXVH�HDFK�ZLQGRZV�ZLQGRZ�SURFHGXUH�UHPDLQV�WKH�VDPH��VXEFODVVHG�ZLQGRZV�ZLOO�VWLOO�FDOO�WKH�JOREDOO\�VXEFODVVHG�ZLQGRZ�SURFHGXUH��1HZ&ODVV3URF��7KH�1HZ&ODVV3URF�ZLQGRZ�SURFHGXUH�VWLOO�QHHGV�WR�NQRZ�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�WR�FDOO�ZKHQHYHU�LW�UHFHLYHV�D�PHVVDJH��,I�ZH�JHW�ULG�RI�WKH�YDOXH�LQ�WKH�PBO2ULJ&ODVV3URF�PHPEHU�YDULDEOH��WKH�DSSOLFDWLRQ�ZLOO�FUDVK�EHFDXVH�PBO2ULJ&ODVV3URF�ZRXOG�WKHQ�SRLQW�WR�DQ�LQYDOLG�

Page 140: Visual Basic - Subclassing and Hooking with VB & VB NET

ORFDWLRQ�LQ�PHPRU\��6R��ZH�QHHG�WR�SURWHFW�WKH�PBO2ULJ&ODVV3URF�PHPEHU�YDULDEOH�IURP�EHLQJ�PRGLILHG�LQ�DQ\�ZD\���:KDW�KDSSHQV�LI�WKH�6XEFODVV�EXWWRQ�LV�FOLFNHG�DW�WKLV�SRLQW"�,I�ZH�FOLFN�LW��D�QHZ�ZLQGRZ�DSSHDUV�ZLWK�WKH�FDSWLRQ��*OREDOO\�6XEFODVVHG�)RUP���7KLV�IRUP�KDV�WKH�IROORZLQJ�DWWULEXWHV���:LQGRZ�&DSWLRQ� ��*OREDOO\�6XEFODVVHG�)RUP��K:QG� ��%�(���&�:QG�3URF� �����))&%�&ODVV�1DPH� �7KXQGHU57�)RUP'&�&ODVV�:QG�3URF� �����))&%�7KH�H[DPSOH�FRGH�E\SDVVHV�WKH�FDOO�WR�6HW&ODVV/RQJ3WU�DQG�LQVWHDG�FUHDWHV�D�ZLQGRZ�IURP�WKH�FXUUHQW�7KXQGHU57�)RUP'&�FODVV��7KLV�ZLQGRZ�ZLOO�QRW�KDYH�WKH�PRGLILHG�ZLQGRZ�EHKDYLRU��QRWLFH�WKH�YDOXH�IRU�WKH�:QG�3URF�ILHOG���

����6XPPDU\�RI�.H\�3RLQWV�LQ�6XEFODVVLQJ�

7KLV�FKDSWHU�SUHVHQWHG�D�JUHDW�GHDO�RI�LQIRUPDWLRQ�DERXW�VXEFODVVLQJ��%HIRUH�SURFHHGLQJ�RQ�WR�WKH�IROORZLQJ�FKDSWHUV��PDNH�VXUH�WKDW�\RX�KDYH�D�VROLG�JUDVS�RI�WKH�FRQFHSWV�SUHVHQWHG�LQ�WKLV�FKDSWHU��7KHVH�FRQFHSWV�ZLOO�EH�XVHG�WKURXJKRXW�WKH�UHVW�RI�WKH�ERRN��7R�KHOS�ZLWK�WKLV��WKH�IROORZLQJ�LV�D�OLVW�RI�NH\�SRLQWV�PHQWLRQHG�LQ�WKH�FRXUVH�RI�WKLV�FKDSWHU���

• 8VH�2Q�(UURU�5HVXPH�1H[W�IRU�HUURU�KDQGOLQJ�LQ�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH���• 'R�DV�OLWWOH�ZRUN�DV�SRVVLEOH�LQ�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH��• 6WHSSLQJ�WKURXJK�D�VXEFODVVLQJ�DSSOLFDWLRQ�LQ�WKH�,'(�FDQ�EH�SUREOHPDWLF���• 6XEFODVVHG�ZLQGRZ�SURFHGXUHV�DQG�RWKHU�FDOOEDFN�IXQFWLRQV�PXVW�UHVLGH�LQ�D�%$6�

PRGXOH���• 'HILQH�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�DQG�DQ\�RWKHU�FDOOEDFN�IXQFWLRQV�DV�3XEOLF���• 'R�QRW�HQG�DQ�DSSOLFDWLRQ�EHIRUH�UHPRYLQJ�DOO�VXEFODVVHG�ZLQGRZ�SURFHGXUHV���• 'R�QRW�XVH�WKH�(QG�VWDWHPHQW�LQ�\RXU�FRGH�RU�WKH�6WRS�EXWWRQ�LQ�WKH�9%�,'(���• 1HYHU�ORVH�WKH�IXQFWLRQ�SRLQWHU�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�IRU�WKH�VXEFODVVHG�

ZLQGRZ���• 'R�QRW�XVH�WKH�'R(YHQWV�IXQFWLRQ�ZLWKLQ�DQ\�ZLQGRZ�SURFHGXUH���• 7KRURXJKO\�UHVHDUFK�WKH�PHVVDJHV�WKDW�\RX�ZLOO�EH�WUDSSLQJ�LQ�WKH�VXEFODVVHG�

ZLQGRZ�SURFHGXUH��(DFK�PHVVDJH�KDV�LWV�RZQ�OLWWOH�TXLUNV���• 7R�DOORZ�WKH�ZLQGRZ�WR�SHUIRUP�WKH�GHIDXOW�SURFHVVLQJ�IRU�D�PHVVDJH��LW�PXVW�EH�

SDVVHG�RQ�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��&DOO:LQGRZ3URF��RU�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH��'HI:LQGRZ3URF����

Page 141: Visual Basic - Subclassing and Hooking with VB & VB NET

• ,QVWDQFH�VXEFODVVLQJ�DIIHFWV�D�VSHFLILF�ZLQGRZ�DQG�LWV�ZLQGRZ�SURFHGXUH��*OREDO�VXEFODVVLQJ�DIIHFWV�HYHU\�ZLQGRZ�FUHDWHG�IURP�D�ZLQGRZ�FODVV�WKDW�KDV�KDG�LWV�FODVV�ZLQGRZ�SURFHGXUH�PRGLILHG���

• *OREDO�VXEFODVVLQJ�DOORZV�ZLQGRZ�FUHDWLRQ�PHVVDJHV�WR�EH�SURFHVVHG��,QVWDQFH�VXEFODVVLQJ�GRHV�QRW�KDYH�WKLV�DELOLW\���

• *OREDO�VXEFODVVLQJ�UHTXLUHV�WKDW�D�ZLQGRZ��XVXDOO\�KLGGHQ��ZLOO�EH�FUHDWHG�DQG�LWV�K:QG�XVHG�IRU�JOREDO�VXEFODVVLQJ��7KLV�ZLQGRZ�PXVW�UHPDLQ�LQ�PHPRU\�IRU�WKH�OLIH�RI�WKH�DSSOLFDWLRQ���

• 'R�QRW�ORVH�WKH�K:QG�DQG�RULJLQDO�ZLQGRZ�SURFHGXUH�FRQWDLQHG�LQ�WKH�&6XEFODVV�FODVV�ZKHQ�LPSOHPHQWLQJ�JOREDO�VXEFODVVLQJ���

• $OO�JOREDOO\�VXEFODVVHG�ZLQGRZV�ZLOO�FDOO�WKH�VDPH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LQ�\RXU�%$6�PRGXOH���

• 8QORDG�DOO�JOREDOO\�VXEFODVVHG�IRUPV�EHIRUH�GHVWUR\LQJ�WKH�&6XEFODVV�REMHFW��8QORDG�WKH�RULJLQDO�ZLQGRZ��XVHG�WR�JHW�WKH�K:QG�WR�LQLWLDWH�JOREDO�VXEFODVVLQJ��DIWHU�GHVWUR\LQJ�WKH�&6XEFODVV�REMHFW���

• *OREDO�VXEFODVVLQJ�DIIHFWV�WKH�FODVV�VWUXFWXUH��QRW�WKH�ZLQGRZ�VWUXFWXUH���

Page 142: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU����6XEFODVVLQJ�WKH�:LQGRZV�&RPPRQ�'LDORJ�%R[HV�7KLV�FKDSWHU�ZLOO�IRFXV�RQ�VXEFODVVLQJ��EXW�LQ�D�PRUH�VSHFLILF�DUHD��,Q�WKLV�FKDSWHU�,�ZLOO�VKRZ�\RX�KRZ�WR�VXEFODVV�WKH�:LQGRZV�FRPPRQ�GLDORJV��6XEFODVVLQJ�LV�WKH�WHUP�FRPPRQO\�XVHG�WR�GHVFULEH�ZKDW�ZH�ZLOO�EH�GRLQJ�LQ�WKLV�FKDSWHU��EXW�DV�ZH�VKDOO�VHH��WKH�WHUP�PLJKW�QRW�EH�HQWLUHO\�DFFXUDWH��7KH�2SHQ��6DYH�$V��3ULQW��3DJH�6HWXS��3ULQW�3URSHUW\�6KHHW��)RQW��+HOS��)LQG��5HSODFH��DQG�&RORU�GLDORJV�DUH�DOO�SDUW�RI�WKH�VWDQGDUG�GLDORJV�WKDW�VKLS�ZLWK�WKH�:LQGRZV�RSHUDWLQJ�V\VWHP��7KHVH�GLDORJV�DUH�IRXQG�LQ�FRPGOJ���GOO��0RVW�RI�WKHP�DOVR�DUH�HQFDSVXODWHG�LQ�DQ�$FWLYH;�FRQWURO�FDOOHG�WKH�&RPPRQ�'LDORJ�FRQWURO���9LVXDO�%DVLF��9%��FDQ�XVH�HLWKHU�FRPGOJ���GOO�RU�WKH�&RPPRQ�'LDORJ�FRQWURO�WR�FUHDWH�DQG�PDQLSXODWH�WKHVH�GLDORJ�ER[HV��8VLQJ�WKH�&RPPRQ�'LDORJ�FRQWURO�KLGHV�PXFK�RI�WKH�FRPSOH[LW\�RI�XVLQJ�WKH�FRPPRQ�GLDORJV��+RZHYHU��LI�\RX�ZDQW�WR�VXEFODVV�D�FRPPRQ�GLDORJ��\RX�KDYH�WR�XVH�FRPGOJ���GOO�GLUHFWO\��7KURXJKRXW�WKLV�FKDSWHU�,�ZLOO�EH�XVLQJ�FRPGOJ���GOO�WR�FUHDWH�DQG�PDQLSXODWH�WKH�FRPPRQ�GLDORJ�ER[HV�WKDW�ZH�ZLOO�VXEFODVV���<RX�PLJKW�ZRQGHU�ZK\�\RX�ZRXOG�ZDQW�WR�VXEFODVV�RQH�RI�WKH�:LQGRZV�FRPPRQ�GLDORJV��HVSHFLDOO\�EHFDXVH�PRGLI\LQJ�D�FRPPRQ�GLDORJ�LV�XVXDOO\�WKH�H[FHSWLRQ�UDWKHU�WKDQ�WKH�UXOH��%XW�VRPHWLPHV�PRGLI\LQJ�D�FRPPRQ�GLDORJ�ER[�LV�D�PRUH�HIILFLHQW�DSSURDFK�WR�VROYLQJ�D�SUREOHP��HVSHFLDOO\�ZKHQ�WKH�GHYHORSHU�QHHGV�PRUH�FRQWURO�RYHU�D�XVHUV�LQWHUDFWLRQ�ZLWK�D�FRPPRQ�GLDORJ�ER[��,QVWHDG�RI�FUHDWLQJ�D�ZKROH�QHZ�6DYH�$V�RU�3ULQW�6HWXS�GLDORJ�ER[�IURP�VFUDWFK��ZH�FDQ�XVH�WKH�IXQFWLRQDOLW\�RI�WKH�6DYH�$V�FRPPRQ�GLDORJ�ER[�DQG�DXJPHQW��FXVWRPL]H��RU�PRGLI\�LWV�EHKDYLRU��7KLV�VDYHV�WKH�GHYHORSHU�PDQ\�KRXUV�RI�UH�FUHDWLQJ�D�FRPPRQ�GLDORJ�E\�OHYHUDJLQJ�WKH�SUHEXLOW�FRGH�ZLWKLQ�FRPGOJ���GOO���,Q�WKLV�FKDSWHU��ZHOO�EXLOG�DQ�H[DPSOH�DSSOLFDWLRQ��VHH�)LJXUH������WKDW�IRFXVHV�RQ�WHDFKLQJ�WKH�IXQGDPHQWDOV�RI�VXEFODVVLQJ�D�FRPPRQ�GLDORJ�ER[��7KH�FRPPRQ�GLDORJ�XVHG�LQ�WKLV�DSSOLFDWLRQ�LV�WKH�6DYH�$V�GLDORJ��ZKLFK�ZHOO�PRGLI\�WR�SHUIRUP�D�VLPSOH�IXQFWLRQ�E\�DGGLQJ�IRXU�FRQWUROV�WR�LW��D�FKHFNER[��D�GURS�GRZQ�OLVW�ER[��D�WH[W�ER[��DQG�D�EXWWRQ���7KH�EXWWRQ�LV�WKH�RQO\�FRQWURO�WKDW�VHUYHV�QR�UHDO�SXUSRVH��H[FHSW�WR�GLVSOD\�D�PHVVDJH�ER[��,�MXVW�ZDQWHG�WR�DGG�LW�LQ�WKLV�H[DPSOH�WR�VKRZ�\RX�KRZ�WR�XVH�D�EXWWRQ�FRQWURO�LQ�D�VXEFODVVHG�FRPPRQ�GLDORJ�ER[���(VVHQWLDOO\��RXU�VDPSOH�DSSOLFDWLRQ�ZLOO�WUDQVIRUP�WKH�6DYH�$V�GLDORJ�LQWR�D�UXGLPHQWDU\�([SRUW�$V�GLDORJ�ER[��DV�VKRZQ�LQ�)LJXUH������7KLV�VXEFODVVHG�FRPPRQ�GLDORJ�ER[�ZLOO�WDNH�D�WH[W�ILOH�FRQWDLQLQJ�VHYHUDO�FROXPQV�RI�ZRUGV�RU�QXPEHUV�DQG�GHOLPLW�HDFK�ZRUG�RU�QXPEHU�ZLWK�D�FKDUDFWHU�RU�FKDUDFWHUV�RI�WKH�XVHUV�FKRLFH��7KH�GURS�GRZQ�OLVW�ER[�FRQWDLQV�D�OLVW�RI�VWDQGDUG�GHOLPLWHUV�WKDW�WKH�XVHU�FDQ�FKRRVH�IURP���

)LJXUH������7KH�PDLQ�DSSOLFDWLRQ�ZLQGRZ�

Page 143: Visual Basic - Subclassing and Hooking with VB & VB NET

)LJXUH������7KH�VXEFODVVHG�FRPPRQ�GLDORJ�ER[�

�7KH�GLDORJ�ZHOO�ZRUN�ZLWK�LV�WKH�([SORUHU�VW\OH�6DYH�$V�GLDORJ��DV�RSSRVHG�WR�WKH�RXWGDWHG�ROG�VW\OH�6DYH�$V�GLDORJ�ER[�XVHG�LQ�HDUOLHU�YHUVLRQV�RI�:LQGRZV��,�FKRVH�WKH�6DYH�$V�GLDORJ�ER[�EHFDXVH�LW�LV�DOPRVW�LGHQWLFDO�WR�WKH�2SHQ�GLDORJ�ER[��DQG�WKHVH�WZR�FRPPRQ�GLDORJV�DUH�DOVR�WKH�PRVW�ZLGHO\�XVHG�LQ�DSSOLFDWLRQV����

&KHFNLQJ�WKH�8VH�3UHGHILQHG�'HOLPLWHU�FKHFNER[�GLVSOD\V�WKH�GURS�GRZQ�OLVW�ER[�DQG�KLGHV�WKH�WH[W�ER[��:KHQ�WKH�FKHFNER[�LV�XQFKHFNHG��WKH�GURS�GRZQ�OLVW�ER[�LV�KLGGHQ�DQG�WKH�WH[W�ER[�LV�GLVSOD\HG��7KLV�WH[W�ER[�LV�DYDLODEOH�WR�DOORZ�WKH�XVHU�WR�HQWHU�D�GHOLPLWLQJ�FKDUDFWHU�RI�KLV�RU�KHU�FKRLFH��1RZ��,�NQRZ�WKDW�,�FRXOG�SODFH�WKH�GHOLPLWLQJ�IXQFWLRQDOLW\�RXWVLGH�RI�WKH�FRPPRQ�GLDORJ�ER[�DQG�HYHU\WKLQJ�ZRXOG�ZRUN�MXVW�ILQH��2Q�WKH�RWKHU�KDQG��E\�HQFDSVXODWLQJ�

Page 144: Visual Basic - Subclassing and Hooking with VB & VB NET

WKLV�IXQFWLRQDOLW\�ZLWKLQ�D�FRPPRQ�GLDORJ�ER[��RWKHU�GHYHORSHUV�FDQ�XVH�WKH�VDPH�H[SRUWLQJ�FRGH�MXVW�E\�LQVWDQWLDWLQJ�WKLV�FRPPRQ�GLDORJ�ER[���7KH�UHVW�RI�WKH�FRPPRQ�GLDORJ�FRQWUROV�UHWDLQ�WKHLU�GHIDXOW�IXQFWLRQDOLW\��$V�DQ�DGGHG�IHDWXUH��HYHU\�WLPH�D�PHVVDJH�RI�LQWHUHVW�LV�FDSWXUHG�E\�RXU�GLDORJ�KRRN�SURFHGXUH��LW�ZLOO�EH�GLVSOD\HG�LQ�WKH�PXOWLOLQH�WH[W�ER[�RQ�WKH�PDLQ�DSSOLFDWLRQ�ZLQGRZ��7KH�PDLQ�DSSOLFDWLRQ�ZLQGRZ�LV�GLVSOD\HG�LQ�)LJXUH�������7KH�RWKHU�FRPPRQ�GLDORJ�ER[HV�ZRUN�OLNH�WKH�2SHQ�DQG�6DYH�$V�GLDORJV��DOWKRXJK�HDFK�KDV�LWV�RZQ�VSHFLDO�FKDUDFWHULVWLFV��7ZR�IHDWXUHV�WKDW�GLIIHU�EHWZHHQ�FRPPRQ�GLDORJ�ER[HV�DUH�WKH�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IXQFWLRQV�XVHG�WR�FUHDWH�WKH�GLDORJV��DQG�WKH�VWUXFWXUHV�WKDW�KROG�WKH�GLDORJV�LQIRUPDWLRQ��(YHQ�ZLWK�WKHVH�GLIIHUHQFHV��WKH�VDPH�EDVLF�UXOHV�FDQ�EH�IROORZHG�WR�VXEFODVV�DOO�FRPPRQ�GLDORJV��

����+RZ�&RPPRQ�'LDORJ�%R[6XEFODVVLQJ�:RUNV�

6XEFODVVLQJ�D�FRPPRQ�GLDORJ�ER[�LV�QRW�DV�HDV\�DV�VXEFODVVLQJ�D�ZLQGRZ��$�IHZ�H[WUD�VWHSV�DUH�LQYROYHG��7KH�IRXU�PDLQ�VWHSV�DUH���

��� &UHDWH�D�FKLOG�GLDORJ�WHPSODWH�UHVRXUFH����� 3DFNDJH�WKLV�UHVRXUFH�LQ�D�G\QDPLF�OLQN�OLEUDU\��'//���RSWLRQDO���� &UHDWH�D�KRRN�SURFHGXUH�WKDW�ZLOO�LQWHUFHSW�PHVVDJHV�IRU�WKH�FRPPRQ�GLDORJ�ER[������ 8VH�WKH�$3,�IXQFWLRQ�LQ�WKH�FRPGOJ���GOO�ILOH�WR�FUHDWH�WKH�PRGLILHG�FRPPRQ�GLDORJ���

,�ZLOO�EH�XVLQJ�WKH�WHUP�GLDORJ�SURFHGXUH�LQVWHDG�RI��ZLQGRZ�SURFHGXUH��WR�GHVFULEH�WKH�PHVVDJH�SURFHVVLQJ�IXQFWLRQ�IRU�WKH�FRPPRQ�GLDORJ�ER[��7KHVH�WZR�W\SHV�RI�SURFHGXUHV��IRU�DOO�SUDFWLFDO�SXUSRVHV��DUH�WKH�VDPH��2QH�VPDOO�GLIIHUHQFH�LV�WKDW�WKH�GLDORJ�SURFHGXUH�VHQGV�DOO�XQSURFHVVHG�PHVVDJHV�WR�WKH�'HI'OJ3URF�IXQFWLRQ��ZKHUHDV�WKH�ZLQGRZ�SURFHGXUH�VHQGV�DOO�XQSURFHVVHG�PHVVDJHV�WR�WKH�'HI:LQGRZ3URF�IXQFWLRQ���

������8VLQJ�WKH�&20'/*���'//�

%HIRUH�JRLQJ�DQ\�IXUWKHU�ZLWK�VXEFODVVLQJ�FRPPRQ�GLDORJV��ZH�ZLOO�VHH�KRZ�WR�XVH�WKH�FRPGOJ���GOO�$3,V��7KH�FRPPRQ�GLDORJ�WKDW�ZH�XVH�IRU�VXEFODVVLQJ�PXVW�EH�FUHDWHG�ZLWK�WKH�FRPGOJ���GOO�$3,�LQVWHDG�RI�ZLWK�WKH�$FWLYH;�&RPPRQ�'LDORJ�FRQWURO��FRPGOJ���RF[���7KH�FRQVHTXHQFH�RI�XVLQJ�WKH�'//�LQVWHDG�RI�WKH�$FWLYH;�FRQWURO��2&;��LV�PDLQO\�DGGHG�FRPSOH[LW\��DOO�WKH�GHWDLOV�WKDW�WKH�2&;�KLG�IURP�XV�DUH�QRZ�XS�WR�XV�WR�KDQGOH��7KH�JRRG�WKLQJ�LV�WKDW�WKHUH�LV�QR�ORQJHU�D�SHUIRUPDQFH�SHQDOW\�IRU�KDYLQJ�WR�ORDG�WKH�FRPGOJ���RF[��DQG�WKLV�ILOH�ZLOO�QRW�KDYH�WR�EH�VKLSSHG�DORQJ�ZLWK�\RXU�ILQDO�DSSOLFDWLRQ���7KH�FRPPRQ�GLDORJ�ER[�UHOLHV�RQ�FRPGOJ���GOO�IRU�PXFK�PRUH�WKDW�MXVW�LWV�FUHDWLRQ��7KLV�'//�SURYLGHV�WKH�GLDORJ�SURFHGXUH�IRU�WKH�GLDORJ��D�GLDORJ�SURFHGXUH�GRHV�IRU�D�GLDORJ�ZKDW�D�

Page 145: Visual Basic - Subclassing and Hooking with VB & VB NET

ZLQGRZ�SURFHGXUH�GRHV�IRU�D�ZLQGRZ���7KLV�'//�DOVR�FRQWDLQV�WKH�GHIDXOW�GLDORJ�UHVRXUFHV�QHHGHG�WR�GHVFULEH�WKH�FRPPRQ�GLDORJ�ER[��7KLV�LV�ZK\�ZH�PXVW�DGG�RXU�RZQ�GLDORJ�WHPSODWH�UHVRXUFH�WR�WKH�FRPPRQ�GLDORJ�ER[�LQVWHDG�RI�MXVW�PRGLI\LQJ�WKH�FRPPRQ�GLDORJ�ER[�UHVRXUFH�GLUHFWO\��7KH�'//�DOVR�KDQGOHV�PHVVDJH�URXWLQJ�ZLWKLQ�WKH�FRPPRQ�GLDORJ�ER[HV���)RU�RXU�H[DPSOH��ZHOO�FUHDWH�D�6DYH�$V�FRPPRQ�GLDORJ�ER[��$V�ZHOO�VHH��XVLQJ�WKH�FRPGOJ���GOO�WR�FUHDWH�FRPPRQ�GLDORJ�ER[HV�E\�KDQG�LV�QRW�DV�KDUG�DV�LW�VRXQGV��7R�VWDUW�RII��WKH�*HW6DYH)LOH1DPH�$3,�IXQFWLRQ�DQG�WKH�23(1),/(1$0(�VWUXFWXUH�PXVW�EH�GHILQHG��7KH�*HW6DYH)LOH1DPH�IXQFWLRQ��ZKLFK�RSHQV�WKH�6DYH�$V�FRPPRQ�GLDORJ��LV�GHFODUHG�DV�IROORZV���3ULYDWH�'HFODUH�)XQFWLRQ�*HW6DYH)LOH1DPH�/LE��FRPGOJ���GOO��B�� $OLDV��*HW6DYH)LOH1DPH$���S6DYHILOHQDPH�$V�23(1),/(1$0(��$V�/RQJ�,WV�VLQJOH�SDUDPHWHU�LV��S6DYH)LOHQDPH

$�SRLQWHU�WR�DQ�23(1),/(1$0(�VWUXFWXUH�7KH�*HW6DYH)LOH1DPH�$3,�IXQFWLRQ�WDNHV�WKH�23(1),/(1$0(�VWUXFWXUH�DV�LWV�RQO\�SDUDPHWHU�DQG�XVHV�LW�WR�FUHDWH�DQG�GLVSOD\�WKH�6DYH�$V�FRPPRQ�GLDORJ�ER[��7KLV�IXQFWLRQ�ZLOO�UHWXUQ�]HUR�LI�WKHUH�LV�DQ�HUURU��LI�WKH�&ORVH�EXWWRQ�RQ�WKH�WLWOHEDU�ZDV�FOLFNHG��RU�LI�WKH�&DQFHO�EXWWRQ�ZDV�FOLFNHG���7KH�23(1),/(1$0(�VWUXFWXUH�LV�GHFODUHG�DV�IROORZV��3ULYDWH�7\SH�23(1),/(1$0(�����O6WUXFW6L]H�$V�/RQJ�����KZQG2ZQHU�$V�/RQJ�����K,QVWDQFH�$V�/RQJ�����OSVWU)LOWHU�$V�6WULQJ�����OSVWU&XVWRP)LOWHU�$V�6WULQJ�����Q0D[&XVW)LOWHU�$V�/RQJ�����Q)LOWHU,QGH[�$V�/RQJ�����OSVWU)LOH�$V�6WULQJ�����Q0D[)LOH�$V�/RQJ�����OSVWU)LOH7LWOH�$V�6WULQJ�����Q0D[)LOH7LWOH�$V�/RQJ�����OSVWU,QLWLDO'LU�$V�6WULQJ�����OSVWU7LWOH�$V�6WULQJ�����IODJV�$V�/RQJ�����Q)LOH2IIVHW�$V�,QWHJHU�����Q)LOH([WHQVLRQ�$V�,QWHJHU�����OSVWU'HI([W�$V�6WULQJ�����O&XVW'DWD�$V�/RQJ�����OSIQ+RRN�$V�/RQJ�����OS7HPSODWH1DPH�$V�6WULQJ�����SY5HVHUYHG�$V�/RQJ�

Page 146: Visual Basic - Subclassing and Hooking with VB & VB NET

����GZ5HVHUYHG�$V�/RQJ�����)ODJV([�$V�/RQJ�(QG�7\SH�,W�KDV�WKH�IROORZLQJ�PHPEHUV���O6WUXFW6L]H

6L]H�RI�WKLV�VWUXFWXUH��,W�VKRXOG�EH�VHW�WR�/HQ�23(1),/(1$0(����KZQG2ZQHU

7KH�KDQGOH�RI�WKH�GLDORJV�RZQLQJ�ZLQGRZ��,W�FDQ�EH�]HUR�LI�QR�ZLQGRZ�RZQV�WKLV�GLDORJ���

K,QVWDQFH

7KH�KDQGOH�WR�WKH�REMHFW�WKDW�FRQWDLQV�WKH�GLDORJ�WHPSODWH�UHVRXUFH��)RU�WKLV�H[DPSOH��WKLV�LV�D�KDQGOH�WR�RXU�UHVRXUFH�'//��7R�JHW�WKLV�KDQGOH��WKH�/RDG/LEUDU\�$3,�IXQFWLRQ�LV�XVHG��7KLV�IXQFWLRQ�WDNHV�RQH�SDUDPHWHU��WKH�SDWK�DQG�ILOHQDPH�RI�WKH�'//��/RDG/LEUDU\�UHWXUQV�WKH�KDQGOH�WR�WKH�'//���

OSVWU)LOWHU $�VWULQJ�GHILQLQJ�WKH�ILOWHUV��LI�DQ\��XVHG�LQ�WKH�GLDORJ�ER[V�6DYH�$V�7\SH�GURS�GRZQ�OLVW��7KH�ILOWHU�LV�LQ�WKH�IRUPDW�^ILOWHU�QDPH`_^ILOWHU`��7KH�ILOWHU�QDPH�LV�D�QDPH�IRU�WKH�ILOWHU��VXFK�DV��$OO�)LOHV���7KH�ILOWHU�LV�DQ�H[SUHVVLRQ�XVHG�WR�GHVFULEH�WKH�ILOWHU��VXFK�DV�� � ���7KHUHIRUH��WKH�FRGH�WR�GHVFULEH�WKLV�ILOWHU�ZRXOG�ORRN�OLNH�WKH�IROORZLQJ���23(1),/(1$0(�OSVWU)LOWHU� ��$OO)LOHV�_� � ��

OSVWU&XVWRP)LOWHU 7KH�ODVW�ILOWHU�FKRVHQ�E\�WKH�XVHU��

Q0D[&XVW)LOWHU 7KH�VL]H�RI�OSVWU&XVWRP)LOWHU��

Q)LOWHU,QGH[

7KH�LQGH[�RI�WKH�FKRVHQ�ILOWHU��OSVWU)LOH

:KHQ�LQLWLDOL]LQJ�WKH�GLDORJ��WKLV�PHPEHU�FRQWDLQV�WKH�GHIDXOW�WH[W�IRU�WKH�)LOH�1DPH�HGLW�FRQWURO��:KHQ�WKH�XVHU�VHOHFWV�D�ILOH�DQG�H[LWV�WKH�GLDORJ�ER[��WKLV�PHPEHU�FRQWDLQV�WKH�FRPSOHWH�SDWK�RI�WKH�VHOHFWHG�ILOH���

Q0D[)LOH

7KH�VL]H�RI�OSVWU)LOH��OSVWU)LOH7LWOH

7KH�ILOHQDPH�DQG�H[WHQVLRQ�RI�RQO\�WKH�UHWXUQHG�ILOH���Q0D[)LOH7LWOH

7KH�VL]H�RI�OSVWU)LOH7LWOH��OSVWU,QLWLDO'LU

7KH�GHIDXOW�SDWK�IRU�WKH�GLDORJ�ER[�ZKHQ�LW�LV�LQLWLDOL]HG��OSVWU7LWOH

7KH�WLWOH�RI�WKH�GLDORJ�ER[��

Page 147: Visual Basic - Subclassing and Hooking with VB & VB NET

)ODJV

9DULRXV�IODJV�XVHG�WR�LQLWLDOL]H�WKH�GLDORJ�ER[��6RPH�RI�WKH�PRUH�FRPPRQO\�XVHG�IODJV�DUH���

OFN_ALLOWMULTISELECT (&H200)

$OORZV�WKH�XVHU�WR�VHOHFW�PRUH�WKDQ�RQH�ILOH��OFN_EXPLORER (&H80000)

&UHDWHV�D�QHZ�([SORUHU�VW\OH�FRPPRQ�GLDORJ�ER[��OFN_FILEMUSTEXIST (&H1000)

7R�RSHQ�D�ILOH��WKH�ILOH�PXVW�H[LVW�RU�DQ�HUURU�LV�UDLVHG��OFN_HIDEREADONLY (&H04)

7KH�5HDG�2QO\�FKHFNER[�RQ�WKH�GLDORJ�LV�KLGGHQ��OFN_NOVALIDATE (&H100)

7KH�ILOH�DQG�SDWK�DUH�QRW�YDOLGDWHG�GXULQJ�SURFHVVLQJ�E\�WKH�GLDORJ��OFN_PATHMUSTEXIST (&H800)

7KH�SDWK�FKRVHQ�LQ�WKH�GLDORJ�PXVW�H[LVW��RU�DQ�HUURU�LV�UDLVHG��OFN_SHOWHELP (&H10)

7KH�+HOS�EXWWRQ�LV�GLVSOD\HG��OFN_ENABLEHOOK (&H20)

8VHG�IRU�VXEFODVVLQJ��HQDEOHV�WKH�XVH�RI�D�GLDORJ�KRRN�SURFHGXUH��OFN_ENABLETEMPLATE (&H40)

8VHG�IRU�VXEFODVVLQJ��HQDEOHV�WKH�XVH�RI�D�UHVRXUFH�LQ�HLWKHU�D��5(6�RU��'//�IRUPDW���OFN_ENABLETEMPLATEHANDLE (&H80)

8VHG�IRU�VXEFODVVLQJ��HQDEOHV�WKH�XVH�RI�D�UHVRXUFH�VWRUHG�LQ�PHPRU\��OFN_ENABLEINCLUDENOTIFY (&H400000)

8VHG�IRU�VXEFODVVLQJ��HQDEOHV�WKH�GLDORJ�WR�VHQG�WKH�&'1B,1&/8'(,7(0�QRWLILFDWLRQ���

Q)LOH2IIVHW 7KH�SRVLWLRQ�RI�WKH�ILUVW�FKDUDFWHU�RI�WKH�ILOHQDPH�LQ�OSVWU)LOH��7KLV�PHPEHU�LV�]HUR�EDVHG���

Q)LOH([WHQVLRQ

7KH�SRVLWLRQ�RI�WKH�ILUVW�FKDUDFWHU�RI�WKH�ILOHQDPH�H[WHQVLRQ�LQ�OSVWU)LOH��7KLV�PHPEHU�LV�]HUR�EDVHG���

OSVWU'HI([W 7KH�ILOH�H[WHQVLRQ�DSSHQGHG�WR�WKH�ILOHQDPH��LI�RQH�LV�QRW�SURYLGHG��

O&XVW'DWD

([WUD�GDWD�WKDW�FDQ�EH�VHQW�WR�WKH�GLDORJ�KRRN�SURFHGXUH�YLD�WKH�:0B,1,7',$/2*�PHVVDJH��:KHQ�WKLV�PHVVDJH�LV�VHQW�WR�WKH�KRRN�SURFHGXUH��LW�FRQWDLQV�D�SRLQWHU�WR�WKLV�VWUXFWXUH�LQ�WKH�O3DUDP�SDUDPHWHU�RI�WKLV�PHVVDJH���

OSIQ+RRN

7KH�SRLQWHU�WR�RXU�GLDORJ�KRRN�SURFHGXUH��OS7HPSODWH1DPH

7KH�GLDORJ�WHPSODWH�UHVRXUFH�,'��SY5HVHUYHG

Page 148: Visual Basic - Subclassing and Hooking with VB & VB NET

5HVHUYHG�E\�WKH�V\VWHP��GZ5HVHUYHG

5HVHUYHG�E\�WKH�V\VWHP��)ODJV([

6HWWLQJ�WKLV�IODJ�WR�]HUR�DOORZV�WKH�3ODFHV�EDU�WR�EH�GLVSOD\HG�RQ�WKH�FRPPRQ�GLDORJ�ER[��VHWWLQJ�WKLV�IODJ�WR�DQ\�RWKHU�QXPEHU�SUHYHQWV�WKLV�EDU�IURP�GLVSOD\LQJ��7KH�3ODFHV�EDU�LV�ORFDWHG�RQ�WKH�OHIWKDQG�VLGH�RI�WKH�2SHQ�DQG�6DYH�$V�FRPPRQ�GLDORJ�ER[HV�XQGHU�:LQGRZV������DQG�FRQWDLQV�VKRUWFXWV�WR�FRPPRQO\�XVHG�IROGHUV��VXFK�DV�'HVNWRS��+LVWRU\��0\�'RFXPHQWV��0\�&RPSXWHU��DQG�0\�1HWZRUN�3ODFHV���

7KH�23(1),/(1$0(�VWUXFWXUH�FRQWDLQV�LQIRUPDWLRQ�QHHGHG�WR�LQLWLDOL]H�WKH�6DYH�$V�FRPPRQ�GLDORJ�ER[��$IWHU�WKH�*HW6DYH)LOH1DPH�IXQFWLRQ�UHWXUQV��WKH�23(1),/(1$0(�VWUXFWXUH�LV�UHWXUQHG�ZLWK�VRPH�PHPEHU�YDOXHV�FKDQJHG��7KH�OSVWU)LOH7LWOH�PHPEHU�IRU�WKLV�VWUXFWXUH�UHWXUQV�LQIRUPDWLRQ�DERXW�WKH�ILOH�DQG�H[WHQVLRQ�WKH�XVHU�KDV�VHOHFWHG�RU�W\SHG�LQWR�WKH�6DYH�$V�GLDORJ�ER[��7KH�OSVWU)LOH�PHPEHU�UHWXUQV�WKH�HQWLUH�SDWK�DQG�ILOHQDPH�IRU�WKH�VHOHFWHG�RU�W\SHG�LQ�ILOHQDPH���$OWKRXJK�WKH�23(1),/(1$0(�VWUXFWXUH�DQG�WKH�*HW6DYH)LOH1DPH�$3,�IXQFWLRQ�DUH�XVHG�IRU�WKH�6DYH�$V�GLDORJ�ER[��PRVW�HYHU\�RWKHU�FRPPRQ�GLDORJ�ER[�LV�FUHDWHG�XVLQJ�D�GLIIHUHQW�VWUXFWXUH�DQG�D�GLIIHUHQW�$3,�IXQFWLRQ��7KH�VWUXFWXUH�QDPHV�DQG�$3,�IXQFWLRQ�FDOOV�IRU�WKHVH�RWKHU�FRPPRQ�GLDORJV�DUH�OLVWHG�LQ�7DEOH�������

7DEOH������6WUXFWXUHV�DQG�)XQFWLRQV�IRU�$OO�&RPPRQ�'LDORJ�%R[HV��&RPPRQ�'LDORJ�7\SH� 'LDORJ�6WUXFWXUH� 'LDORJ�&UHDWLRQ�)XQFWLRQ�

2SHQ� 23(1),/(1$0(� *HW2SHQ)LOH1DPH�6DYH�$V� 23(1),/(1$0(� *HW6DYH)LOH1DPH�&RORU� &+226(&2/25� &KRRVH&RORU�)RQW� &+226()217� &KRRVH)RQW�3ULQW� 35,17'/*� 3ULQW'OJ�3ULQW�3URSHUW\�6KHHW��:LQ������ 35,17'/*(;� 3ULQW'OJ([�3DJH�6HWXS� 3$*(6(783'/*� 3DJH6HWXS'OJ�)LQG� ),1'5(3/$&(� )LQG7H[W�5HSODFH� ),1'5(3/$&(� 5HSODFH7H[W�7KH�FRGH�LQ�([DPSOH�����VKRZV�KRZ�WR�LQLWLDOL]H�WKH�23(1),/(1$0(�VWUXFWXUH�DQG�FDOO�WKH�*HW6DYH)LOH1DPH�$3,�IXQFWLRQ��7R�XVH�WKLV�FRGH��FUHDWH�D�QHZ�9%�6WDQGDUG�(;(�SURMHFW�DQG�DGG�D�EXWWRQ�FDOOHG�&RPPDQG��WR�WKH�IRUP��1RQH�RI�WKH�GHIDXOW�SURSHUWLHV�QHHGV�WR�EH�FKDQJHG�IRU�HLWKHU�WKH�IRUP�RU�WKH�EXWWRQ��1H[W��LQVHUW�WKLV�FRGH�LQWR�WKH�IRUPV�FRGH�ZLQGRZ��5XQ�WKH�SURMHFW�DQG�FOLFN�WKH�EXWWRQ��$�6DYH�$V�GLDORJ�ER[�ZLOO�DSSHDU�ZLWK�WKH�WLWOH��&RPPRQ�'LDORJ�([DPSOH����

([DPSOH������2SHQLQJ�WKH�6DYH�$V�&RPPRQ�'LDORJ��

Page 149: Visual Basic - Subclassing and Hooking with VB & VB NET

3ULYDWH�'HFODUH�)XQFWLRQ�*HW6DYH)LOH1DPH�/LE��FRPGOJ���GOO��$OLDV�B������*HW6DYH)LOH1DPH$���S2SHQILOHQDPH�$V�2SHQ)LOHQDPH��$V�/RQJ��3ULYDWH�7\SH�2SHQ)LOHQDPH�����O6WUXFW6L]H�$V�/RQJ�����KZQG2ZQHU�$V�/RQJ�����K,QVWDQFH�$V�/RQJ�����OSVWU)LOWHU�$V�6WULQJ�����OSVWU&XVWRP)LOWHU�$V�6WULQJ�����Q0D[&XVW)LOWHU�$V�/RQJ�����Q)LOWHU,QGH[�$V�/RQJ�����OSVWU)LOH�$V�6WULQJ�����Q0D[)LOH�$V�/RQJ�����OSVWU)LOH7LWOH�$V�6WULQJ�����Q0D[)LOH7LWOH�$V�/RQJ�����OSVWU,QLWLDO'LU�$V�6WULQJ�����OSVWU7LWOH�$V�6WULQJ�����IODJV�$V�/RQJ�����Q)LOH2IIVHW�$V�,QWHJHU�����Q)LOH([WHQVLRQ�$V�,QWHJHU�����OSVWU'HI([W�$V�6WULQJ�����O&XVW'DWD�$V�/RQJ�����OSIQ+RRN�$V�/RQJ�����OS7HPSODWH1DPH�$V�/RQJ�����SY5HVHUYHG�$V�/RQJ�����GZ5HVHUYHG�$V�/RQJ�����)ODJV([�$V�/RQJ��(QG�7\SH���3ULYDWH�6XE�&RPPDQG�B&OLFN���������'LP�6DYH$V'OJ6WUXFW�$V�2SHQ)LOHQDPH�����'LP�O5HW9DO�$V�/RQJ������,QLWLDOL]H�GDWD�VWUXFWXUH�����6DYH$V'OJ6WUXFW�O6WUXFW6L]H� �/HQ�6DYH$V'OJ6WUXFW������6DYH$V'OJ6WUXFW�KZQG2ZQHU� �0H�K:QG�����6DYH$V'OJ6WUXFW�OSVWU)LOWHU� ��$OO�)LOHV���&KU������� � ���&KU������&KU���������6DYH$V'OJ6WUXFW�OSVWU)LOH� �&KU������6SDFH����������6DYH$V'OJ6WUXFW�Q0D[)LOH� �/HQ�6DYH$V'OJ6WUXFW�OSVWU)LOH������

Page 150: Visual Basic - Subclassing and Hooking with VB & VB NET

����6DYH$V'OJ6WUXFW�Q)LOWHU,QGH[� �������6DYH$V'OJ6WUXFW�OSVWU,QLWLDO'LU� ��&�?������6DYH$V'OJ6WUXFW�OSVWU7LWOH� ��&RPPRQ�'LDORJ�([DPSOH������6DYH$V'OJ6WUXFW�IODJV� �������6DYH$V'OJ6WUXFW�)ODJV([� ��������&DOO�$3,�IXQFWLRQ�WR�FUHDWH�WKH�FRPPRQ�GLDORJ�ER[�����O5HW9DO� �*HW6DYH)LOH1DPH�6DYH$V'OJ6WUXFW�������'HWHUPLQH�DQG�DFW�RQ�WKH�UHWXUQ�YDOXH�����,I�O5HW9DO� ���7KHQ���������'HEXJ�3ULQW��7KH�&DQFHO�EXWWRQ�ZDV�FOLFNHG�RU�DQ�HUURU�RFFXUHG������(OVH���������'HEXJ�3ULQW�7ULP�6DYH$V'OJ6WUXFW�OSVWU)LOH�����LV�WKH�ILOH�WR�EH�VDYHG������(QG�,I�(QG�6XE�%DVLFDOO\�WKUHH�VWHSV�DUH�LQYROYHG�LQ�WKLV�FRGH�VDPSOH���

��� ,QLWLDOL]H�WKH�23(1),/(1$0(�VWUXFWXUH��0DQ\�RI�WKH�PHPEHUV�LQ�WKLV�VWUXFWXUH�DUH�IDPLOLDU�WR�\RX�LI�\RX�KDYH�XVHG�WKH�$FWLYH;�FRPPRQ�GLDORJ�FRQWURO��6RPH�ZLOO�QRW�EH�IDPLOLDU��2QH�RI�WKH�PHPEHUV�WKDW�PLJKW�QRW�EH�IDPLOLDU�WR�\RX�LV�O6WUXFW6L]H��ZKLFK�PXVW�EH�VHW�WR�WKH�OHQJWK�RI�WKH�HQWLUH�VWUXFWXUH��WKLV�HQVXUHV�WKDW�WKH�*HW6DYH)LOH1DPH�IXQFWLRQ�ZLOO�QRW�ZULWH�WR�PHPRU\�SDVW�WKH�ERXQGV�RI�WKLV�VWUXFWXUH��7KH�KZQG2ZQHU�PHPEHU�LV�WKH�KDQGOH�WR�WKH�ZLQGRZ�WKDW�RZQV�WKLV�FRPPRQ�GLDORJ�ER[��LQ�RXU�FDVH��LW�LV�HTXDO�WR�IUP0DLQ�KZQG���

��� &DOO�WKH�*HW6DYH)LOH1DPH�IXQFWLRQ�WR�FUHDWH�DQG�GLVSOD\�WKH�GLDORJ�ER[������ 5HWULHYH�WKH�SDWK�DQG�ILOHQDPH�RI�WKH�VHOHFWHG�ILOH�EDVHG�RQ�WKH�UHWXUQ�YDOXH�RI�

*HW6DYH)LOH1DPH���

7KH�FRGH�KHUH�GRHV�QRW�GR�PXFK�PRUH�WKDQ�WKH�FRPGOJ���RF[�FRQWURO�ZRXOG�GR��7KH�GLIIHUHQFH�LV�WKDW�XVLQJ�WKH�FRPGOJ���RF[�FRQWURO�GHFUHDVHV�WKH�DPRXQW�RI�FRGH�WKDW�ZH�KDYH�WR�ZULWH�IRU�WKLV�H[DPSOH��7KLV�H[DPSOH�GRHV�QRW�DOORZ�WKH�FRPPRQ�GLDORJ�WR�EH�VXEFODVVHG��7R�LPSOHPHQW�D�FRPPRQ�GLDORJ�KRRN�SURFHGXUH�WR�LQWHUFHSW�PHVVDJHV�DQG�D�GLDORJ�WHPSODWH�UHVRXUFH�WR�PRGLI\�WKH�XVHU�LQWHUIDFH��8,��RI�WKH�FRPPRQ�GLDORJ��ZH�PXVW�OHDUQ�D�OLWWOH�PRUH�DERXW�WKH�FRPGOJ���GOO�DQG�WKH�ZD\�LW�IXQFWLRQV���

������7KH�5HVRXUFH�)LOH�

7KH�ILUVW�VWHS�LQ�VXEFODVVLQJ�D�FRPPRQ�GLDORJ�ER[�LQYROYHV�FUHDWLQJ�D�GLDORJ�UHVRXUFH�WKDW�ZLOO�EH�VWRUHG�LQ�D�UHVRXUFH�ILOH��9%�UHTXLUHV�WKH�UHVRXUFH�ILOH�WR�KDYH�DQ�H[WHQVLRQ�RI��5(6��7KLV�

Page 151: Visual Basic - Subclassing and Hooking with VB & VB NET

ILOH�FRQWDLQV�LQIRUPDWLRQ�RQ�HDFK�LQGLYLGXDO�UHVRXUFH�VWRUHG�ZLWKLQ�LW��0DQ\�W\SHV�RI�UHVRXUFHV�FDQ�EH�VWRUHG�LQ�WKLV�ILOH��VRPH�RI�WKH�PDLQ�W\SHV�RI�UHVRXUFHV�XVHG�E\�:LQGRZV�DUH���Strings Cursors Accelerator tables Bitmaps Dialogs Icons Menus Fonts User-defined resources

$OO�UHVRXUFHV�LQ�:LQGRZV�IROORZ�D�VWDQGDUGL]HG�IRUPDW��(DFK�UHVRXUFH�KDV�D�XQLTXH�LGHQWLILHU��D�FRQVWDQW�FDOOHG�D�UHVRXUFH�LG��WKDW�LV�XVHG�E\�DQ�DSSOLFDWLRQ�WR�PDQLSXODWH�WKDW�SDUWLFXODU�UHVRXUFH��)RU�WKH�DSSOLFDWLRQ�WR�XVH�WKH�UHVRXUFH��WKLV�LGHQWLILHU�PXVW�EH�GHILQHG�LQ�\RXU�9%�DSSOLFDWLRQ�DV�ZHOO�DV�LQ�WKH�UHVRXUFH�ILOH��,I�\RX�XVH�D�UHVRXUFH�HGLWRU��WKH�UHVRXUFH�,'�LV�SURYLGHG�WR�\RX��)LQDOO\��WKH�UHVRXUFH�ILOH�FRQWDLQV�WKH�DFWXDO�GDWD�WKDW�FRQVWLWXWHV�WKH�UHVRXUFH���5HVRXUFH�ILOHV�FDQ�EH�FUHDWHG�E\�KDQG��EXW�LW�LV�PXFK�HDVLHU�WR�FUHDWH�WKHP�WKURXJK�D�UHVRXUFH�HGLWLQJ�WRRO��9LVXDO�&���KDV�VXFK�D�WRRO�FDOOHG�WKH�5HVRXUFH�(GLWRU�WKDW�FDQ�SURGXFH�VWDQGDUG�:LQGRZV�UHVRXUFHV��7KLV�LV�WKH�WRRO�,�ZLOO�XVH�LQ�WKLV�FKDSWHU��EXW�\RX�FDQ�XVH�ZKDW�LV�PRVW�IDPLOLDU�WR�\RX���8VLQJ�UHVRXUFH�ILOHV�FDQ�LPSURYH�DSSOLFDWLRQ�UHVSRQVH�WLPH��,QVWHDG�RI�ORDGLQJ�DOO�UHVRXUFHV�DW�RQH�WLPH��\RX�FDQ�ORDG�LQGLYLGXDO�UHVRXUFHV�DV�WKH\�DUH�QHHGHG��7DNH��IRU�LQVWDQFH��LPDJHV�RQ�D�IRUP�LQ�9%��,I�WKH�LPDJHV�ZHUH�VWRUHG�RQ�WKH�IRUP��WKH\�ZRXOG�DOO�EH�ORDGHG�LQWR�PHPRU\�ZKHQ�WKH�IRUP�ZDV�ORDGHG�LQWR�PHPRU\��,I��LQVWHDG��WKH�LPDJHV�ZHUH�LQ�D�UHVRXUFH�ILOH�VHSDUDWH�IURP�WKH�IRUP��WKH�IRUP�FRXOG�ORDG�LWVHOI�LQWR�PHPRU\�DQG�WKHQ�ORDG�WKH�LPDJHV�LQWR�PHPRU\�RQH�E\�RQH�DV�QHHGHG���$QRWKHU�XVHIXO�IHDWXUH�RI�UHVRXUFH�ILOHV�LV�WKH�DELOLW\�WR�LQWHUQDWLRQDOL]H�DQ�DSSOLFDWLRQ�ZLWK�PLQLPDO�FKDQJHV�WR�WKH�DSSOLFDWLRQ�LWVHOI��,I�DOO�VWULQJV�XVHG�E\�DQ�DSSOLFDWLRQ�UHVLGH�LQ�D�VLQJOH�UHVRXUFH�ILOH��WKDW�ILOH�FRXOG�EH�WUDQVODWHG�LQWR�DQRWKHU�ODQJXDJH�DQG�WKHQ�UHFRPSLOHG�LQWR�WKH�DSSOLFDWLRQ��7KLV�ZRXOG�DOORZ�WKH�DSSOLFDWLRQ�WR�VXSSRUW�PXOWLSOH�ODQJXDJHV�ZLWKRXW�WKH�GHYHORSHU�KDYLQJ�WR�WRXFK�WKH�DSSOLFDWLRQ�RU�DQ\�RI�LWV�FRGH��2I�FRXUVH��IRU�WKLV�WR�ZRUN�WR�LWV�IXOOHVW�SRWHQWLDO��DOO�VWULQJV����LQFOXGLQJ�ILHOG�LGHQWLILHUV��DOO�FDSWLRQV��VWDWLF�WH[W�IRU�DQ\�IRUP�RU�FRQWURO��DQG�DQ\�PHVVDJH�ER[�DQG�GLDORJ�WH[W��MXVW�WR�PHQWLRQ�D�IHZ����PXVW�UHVLGH�LQ�WKH�UHVRXUFH�ILOH���,Q�WKLV�FKDSWHU��ZH�ZLOO�QRW�IRFXV�RQ�WKHVH�WZR�XVHV�RI�UHVRXUFH�ILOHV��5DWKHU��ZH�ZLOO�EH�XVLQJ�WKH�UHVRXUFH�ILOH�IRU�WKH�SXUSRVH�RI�VWRULQJ�D�GLDORJ�UHVRXUFH�WKDW�GHILQHV�WKH�FRQWUROV�ZH�DUH�DGGLQJ�WR�WKH�GLDORJ�DQG�WKHLU�SODFHPHQW��7KH�UHVRXUFH�ZLOO�WKHQ�EH�LQFOXGHG�LQ�WKH�VWDQGDUG�FRPPRQ�GLDORJ�ER[�DV�D�FKLOG�GLDORJ�ZLQGRZ��)RU�UHIHUHQFH��,�ZLOO�FDOO�WKLV�UHVRXUFH�D�GLDORJ�WHPSODWH�UHVRXUFH�ILOH���

�,Q�WKLV�FKDSWHU�,�UHIHU�WR�ERWK�D�SDUHQW�DQG�D�FKLOG�GLDORJ�ZLQGRZ��7KH�SDUHQW�GLDORJ�ZLQGRZ�LV�WKH�RULJLQDO�GLDORJ�

Page 152: Visual Basic - Subclassing and Hooking with VB & VB NET

ZLQGRZ��7KH�SDUHQW�GLDORJ�ZLQGRZ�LV�WKH�RULJLQDO�GLDORJ�ZLQGRZ�WKDW�ZH�LQWHQG�WR�VXEFODVV��DQG�WKH�GLDORJ�WHPSODWH�UHVRXUFH�ILOH�GHVFULEHV�WKH�FKLOG�GLDORJ�ZLQGRZ��)RU�D�YLVXDO�GHVFULSWLRQ��VHH�)LJXUH������ZKLFK�LV�D�VXEFODVVHG�6DYH�$V�GLDORJ��7KH�SDUHQW�GLDORJ�LV�WKH�ZLQGRZ�FRQWDLQLQJ�DOO�WKH�RULJLQDO�FRQWUROV�IRU�WKLV�GLDORJ��7KH�FKLOG�GLDORJ�LV�WKH�ZLQGRZ�LQGLFDWHG�E\�WKH�GRWWHG�OLQH��WKLV�LV�ZKHUH�WKH�FRQWUROV�ZH�DGGHG�DUH�SODFHG��7KH�FKLOG�GLDORJ�LV�VXSHULPSRVHG�RQWR�WKH�SDUHQW�GLDORJ��DQG�WKH�XSSHU�OHIW�FRRUGLQDWH�RI�WKH�FKLOG�GLDORJ�EHJLQV�DW�ORFDWLRQ�����RI�WKH�FRPPRQ�GLDORJV�FOLHQW�DUHD����

6XEFODVVLQJ�D�FRPPRQ�GLDORJ�ER[�DOORZV�XV�WR�LQWHUFHSW�PHVVDJHV�WR�FRQWURO�WKH�ORRN�DQG�EHKDYLRU�RI�WKH�GLDORJ��7KH�GLDORJ�UHVRXUFH�DOORZV�XV�WR�DGG�FRQWUROV�WR�WKH�H[LVWLQJ�FRPPRQ�GLDORJ�ER[��8VLQJ�VXEFODVVLQJ��ZH�DOVR�FDQ�LQWHUFHSW�PHVVDJHV�IURP�WKHVH�QHZ�FRQWUROV�DGGHG�E\�WKH�UHVRXUFH�WHPSODWH��,W�LV�SRVVLEOH�WR�VXEFODVV�D�FRPPRQ�GLDORJ�ER[�ZLWKRXW�ILUVW�FUHDWLQJ�D�GLDORJ�UHVRXUFH��,I�D�GLDORJ�UHVRXUFH�LV�QRW�LPSOHPHQWHG��WKH�ORRN�RI�WKH�FRPPRQ�GLDORJ�ZLOO�QRW�EH�PRGLILHG�IURP�LWV�RULJLQDO�DSSHDUDQFH���:H�QHHG�WR�FUHDWH�WKLV�GLDORJ�WHPSODWH�UHVRXUFH�ILOH�EHFDXVH�LW�LV�QRW�SRVVLEOH�WR�GLUHFWO\�PRGLI\�WKH�GHIDXOW�GLDORJ�WHPSODWH�IRU�WKH�([SORUHU�VW\OH�2SHQ�DQG�6DYH�$V�FRPPRQ�GLDORJ�ER[HV��(YHU\�FRPPRQ�GLDORJ�ER[�KDV�D�GHIDXOW�GLDORJ�WHPSODWH�WKDW�GHWHUPLQHV�ZKHUH�FRQWUROV�DUH�SODFHG�RQ�WKH�GLDORJ�DQG�ZKDW�HDFK�FRQWUROV�SURSHUWLHV�DUH�VHW�WR��0RVW�FRPPRQ�GLDORJ�GHIDXOW�WHPSODWHV�DUH�FRQWDLQHG�LQ�D�KHDGHU���K��ILOH�WKDW�LV�DFFHVVLEOH�E\�WKH�GHYHORSHU��PRUH�RQ�WKHVH�KHDGHU�ILOHV�ODWHU�LQ�WKLV�FKDSWHU���7KHVH�KHDGHU�ILOHV�FDQ�EH�PRGLILHG�DQG�UHFRPSLOHG�WR�FKDQJH�WKH�GHIDXOW�DSSHDUDQFH�RI�WKH�GLDORJ��+RZHYHU��WKH�GHIDXOW�GLDORJ�WHPSODWHV�IRU�WKH�([SORUHU�VW\OH�2SHQ�DQG�6DYH�$V�GLDORJV�DUH�FRPSLOHG�LQWR�WKH�FRPGOJ���GOO�ILOH�DQG��WKHUHIRUH��DUH�QRW�DFFHVVLEOH���

)LJXUH������'LDJUDP�VKRZLQJ�ZKHUH�WKH�FKLOG�GLDORJ�LV�SODFHG�ZLWKLQ�WKH�FRPPRQ�GLDORJ�ER[�

Page 153: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�FRPPRQ�GLDORJ�ER[�ZLOO�WUHDW�WKH�GLDORJ�WHPSODWH�UHVRXUFH�WKDW�ZH�FUHDWH�DV�D�FKLOG�ZLQGRZ�WR�LWVHOI��DV�)LJXUH�����VKRZV��$Q\�WLPH�,�UHIHUHQFH�HLWKHU�WKH�FKLOG�GLDORJ�WHPSODWH�UHVRXUFH�RU�WKH�GLDORJ�WHPSODWH�UHVRXUFH��,�DP�VSHDNLQJ�RI�WKH�GLDORJ�UHVRXUFH�WKDW�LV�FRQWDLQHG�ZLWKLQ�WKH�UHVRXUFH�ILOH���5(6��RU�WKH��'//���0XOWLSOH�UHVRXUFHV�FDQ�EH�FRQWDLQHG�ZLWKLQ�D�VLQJOH��5(6�ILOH��6R��LI�\RX�QHHG�WR�PRGLI\�PRUH�WKDQ�RQH�FRPPRQ�GLDORJ�RU�PRGLI\�RQH�FRPPRQ�GLDORJ�LQ�VHYHUDO�GLIIHUHQW�ZD\V��DOO�WKH�GLDORJ�WHPSODWH�UHVRXUFHV�FDQ�EH�SODFHG�ZLWKLQ�D�VLQJOH��5(6�ILOH��:KHQ�SODFLQJ�PXOWLSOH�UHVRXUFHV�ZLWKLQ�D�VLQJOH��5(6�ILOH��PDNH�VXUH�WKDW�D�XQLTXH�,'�LGHQWLILHV�HDFK�UHVRXUFH��3ODFLQJ�PXOWLSOH�UHVRXUFHV�LQ�D�VLQJOH�UHVRXUFH�ILOH�LV�QHFHVVDU\�EHFDXVH�9%�DOORZV�RQO\�RQH�UHVRXUFH�ILOH�SHU�SURMHFW��$GGLQJ�D�VHFRQG�ILOH�ZLOO�SURGXFH�DQ�HUURU��DQG�LW�ZLOO�QRW�EH�DGGHG�WR�WKH�SURMHFW���

������&UHDWLQJ�D�'LDORJ�5HVRXUFH�)LOH�8VLQJ9%�DQG�9LVXDO�&���

7KRXJK�\RX�FRXOG�FUHDWH�WKH�GLDORJ�UHVRXUFH�XVLQJ�RQO\�9LVXDO�&����,�ZLOO�VKRZ�\RX�KRZ�WR�XVH�9%�WR�VWDUW�RXW�WKH�SURFHVV��)RU�WKRVH�RI�\RX�PRUH�FRPIRUWDEOH�XVLQJ�WKH�9LVXDO�&���GLDORJ�HGLWRU��IHHO�IUHH�WR�XVH�RQO\�WKDW�HGLWRU��)RU�WKRVH�RI�\RX�ZKR�GHYHORS�PDLQO\�LQ�9%��\RX�PLJKW�IHHO�PRUH�FRPIRUWDEOH�XVLQJ�WKH�GLDORJ��IRUP��HGLWRU�LQ�9%��,W�GRHV�QRW�PDWWHU�ZKLFK�WRRO�LV�XVHG�WR�VWDUW�WKH�SURFHVV�RI�FUHDWLQJ�WKH�GLDORJ�UHVRXUFH���,Q�9%��FUHDWH�D�QHZ�6WDQGDUG�(;(�SURMHFW�DQG�SODFH�WKH�IRXU�FRQWUROV�WKDW�ZH�DUH�DGGLQJ�WR�WKH�FRPPRQ�GLDORJ�ER[��D�FKHFNER[��D�GURS�GRZQ�OLVW�ER[��D�WH[W�ER[��DQG�D�FRPPDQG�EXWWRQ��RQ�WKH�IRUP��DV�VKRZQ�LQ�)LJXUH������7KH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�FRQWUROV�DUH�OLVWHG�LQ�7DEOH�����DQG�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DUH�OLVWHG�LQ�7DEOH�������

)LJXUH������7KH�9%�IRUP�ZLWK�WKH�FRQWUROV�SODFHG�RQ�LW�

Page 154: Visual Basic - Subclassing and Hooking with VB & VB NET

7DEOH������1RQGHIDXOW�3URSHUWLHV�RI�WKH�&RQWUROV��

&RQWURO�1DPH� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�&KHFN�� &DSWLRQ� 8VH�3UHGHILQHG�'HOLPLWHU�&KHFN�� 7RS� ���&KHFN��� /HIW� ����&KHFN��� +HLJKW� ����&KHFN��� :LGWK� �����7H[W��� 7RS� ����7H[W��� /HIW� ����7H[W��� +HLJKW� ����7H[W��� :LGWK� ����&RPER��� 6W\OH� 'URSGRZQ�&RPER�&RPER��� 7RS� ����&RPER��� /HIW� ����&RPER��� +HLJKW� ����&RPER��� :LGWK� ����%XWWRQ��� &DSWLRQ� &OLFN�0H�%XWWRQ��� 7RS� ���%XWWRQ��� /HIW� �����%XWWRQ��� +HLJKW� ����%XWWRQ��� :LGWK� �����

7DEOH������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP��3URSHUW\� 9DOXH�

1DPH� IUP)RUP7HPSODWH�7RS� ��/HIW� ��+HLJKW� �����:LGWK� �����

Page 155: Visual Basic - Subclassing and Hooking with VB & VB NET

,W�LV�LPSRUWDQW�WR�QRWH�WKDW�DOO�WKH�FRQWUROV�SODFHG�LQ�WKH�UHVRXUFH�ZLOO�GHIDXOW�WR�EHLQJ�SODFHG�DW�WKH�ERWWRP�RI�WKH�FRPPRQ�GLDORJ�ER[��EHORZ�DOO�WKH�RWKHU�GHIDXOW�FRQWUROV��+RZHYHU��WKH\�VWLOO�UHWDLQ�WKH�VDPH�UHODWLYH�SRVLWLRQ�WR�RQH�DQRWKHU��7KH�FRPPRQ�GLDORJ�ER[�ZLOO�DXWRPDWLFDOO\�UHVL]H�LWV�IRUP�WR�DFFRPPRGDWH�WKHVH�FRQWUROV��PRUH�DERXW�WKLV�ODWHU����$IWHU�SODFLQJ�WKH�FRQWUROV�LQ�WKHLU�SURSHU�SODFH�RQ�WKH�9%�IRUP��VDYH�WKH�SURMHFW��7KH�SURMHFW�ILOHQDPHV�DUH�OLVWHG�LQ�7DEOH�������

7DEOH������)LOHQDPHV�IRU�WKH�9%�3URMHFW��)LOHQDPH� 'HVFULSWLRQ�

)UP)RUP7HPSODWH�IUP� &RQWDLQV�WKH�IRUP�QDPHG�IUP)RUP7HPSODWH�9%B)RUPB5(6�YES� 3URMHFW�ILOH�7KLV�9%�IRUP�ZLOO�EH�LPSRUWHG�LQWR�WKH�9LVXDO�&���HGLWRU�VR�WKDW�D�GLDORJ�WHPSODWH�UHVRXUFH�FDQ�EH�FUHDWHG�IURP�LW���1H[W��VWDUW�XS�9LVXDO�&���DQG�FOLFN�WKH�)LOH� 1HZ����PHQX�LWHP��,Q�WKH�1HZ�GLDORJ��VHOHFW�WKH�)LOHV�WDE��7KLV�WDE�FRQWDLQV�LQGLYLGXDO�LWHPV�WKDW�FDQ�EH�FUHDWHG�ZLWKLQ�WKH�9LVXDO�&���HQYLURQPHQW��6HOHFW�WKH�5HVRXUFH�7HPSODWH�LWHP�LQ�WKH�OLVW�ER[��W\SH�WKH�QDPH�RI�WKH�UHVRXUFH�WHPSODWH��'OJ5HV���LQ�WKH�)LOH�1DPH�WH[W�ER[��GRQW�LQFOXGH�D�ILOH�H[WHQVLRQ���DQG�W\SH�WKH�ORFDWLRQ�ZKHUH�\RX�ZDQW�WKLV�ILOH�WR�EH�VDYHG�LQ�WKH�/RFDWLRQ�WH[W�ER[��&OLFN�WKH�2.�EXWWRQ���$�QHZ�ZLQGRZ�RSHQV�XS�LQ�WKH�9LVXDO�&���,'(�ZLWK�DQ�HPSW\�UHVRXUFH�ILOH�LQ�LW��7KLV�UHVRXUFH�ILOH�KDV�WKH�QDPH�RI�WKH�ILOH�\RX�W\SHG�LQWR�WKH�)LOH�1DPH�WH[W�ER[�LQ�WKH�1HZ�GLDORJ��IROORZHG�E\�D��UFW�H[WHQVLRQ��5LJKW�FOLFN�WKLV�LWHP�DQG�FKRRVH�WKH�,PSRUW����RSWLRQ�IURP�WKH�SRS�XS�PHQX��7KLV�ZLOO�RSHQ�WKH�,PSRUW�5HVRXUFH�GLDORJ�ER[��)LUVW��VHOHFW�9LVXDO�%DVLF�)RUPV���IUP��IURP�WKH�)LOHV�RI�7\SH�GURS�GRZQ�ER[��7KHQ�ILQG�DQG�VHOHFW�WKH�IRUP�ILOH�WKDW�ZH�MXVW�FUHDWHG�LQ�9%��)UP)RUP7HPSODWH�IUP���7KH�9LVXDO�&���GLDORJ�HGLWRU�ZLOO�FRQYHUW�WKLV�ILOH�WR�RQH�WKDW�LW�FDQ�XVH�DQG�GLVSOD\�LW�LQ�LWV�RZQ�HGLWRU��:KHQ�FUHDWLQJ�WKLV�H[DPSOH�DSSOLFDWLRQ��,�QRWLFHG�WKDW�WKH�GURS�GRZQ�OLVW�ER[�ZDV�QRW�LPSRUWHG�IURP�WKH�9%�IRUP��,�DP�QRW�VXUH�ZK\�WKLV�KDSSHQHG��EXW�LI�WKLV�RFFXUV�RQ�\RXU�SURMHFW��VLPSO\�UH�DGG�WKH�FRQWURO�XVLQJ�WKH�9LVXDO�&���HGLWRU�LQ�WKH�VDPH�ZD\�DV�\RX�ZRXOG�LQ�9%���:H�PXVW�PDNH�D�IHZ�FULWLFDO�PRGLILFDWLRQV�WR�WKLV�IRUP��5LJKW�FOLFN�WKH�IRUP�DQG�VHOHFW�3URSHUWLHV�IURP�WKH�SRS�XS�PHQX��7KH�'LDORJ�3URSHUWLHV�GLDORJ�ZLOO�DSSHDU��2Q�WKH�*HQHUDO�WDE��UHPRYH�DQ\�WH[W�IURP�WKH�&DSWLRQ�WH[W�ER[��$OVR��PDNH�VXUH�WKDW�WKH�;�3RV�DQG�<�3RV�WH[W�ER[HV�FRQWDLQ�D�]HUR��0RVW�RI�WKH�WLPH�WKHUH�ZLOO�EH�QR�UHDVRQ�WR�PRGLI\�WKH�YDOXH�LQ�WKH�,'�GURS�GRZQ�FRPER�ER[��2Q�WKH�6W\OHV�WDE��WKH�6W\OH�GURS�GRZQ�ER[�VKRXOG�FRQWDLQ�WKH�LWHP�&KLOG��7KH�%RUGHU�GURS�GRZQ�ER[�VKRXOG�FRQWDLQ�WKH�LWHP�1RQH��7KH��&OLS�VLEOLQJV��FKHFNER[�VKRXOG�EH�FKHFNHG���6HWWLQJ�WKH�6W\OH�GURS�GRZQ�ER[�WR�&KLOG�JLYHV�WKLV�GLDORJ�D�VW\OH�RI�:6B&+,/'��7KLV�VW\OH�LQIRUPV�:LQGRZV�WKDW�WKLV�LV�D�FKLOG�ZLQGRZ��&KLOG�ZLQGRZV�DUH�FRQWDLQHG�ZLWKLQ�D�SDUHQW�ZLQGRZ��,Q�WKLV�FDVH��RXU�GLDORJ�WHPSODWH�ZLOO�EH�D�FKLOG�ZLQGRZ�RI�WKH�FRPPRQ�GLDORJ�ER[��ZKLFK�LV�WKH�SDUHQW��7KH�FRRUGLQDWH�V\VWHP�IRU�WKH�FKLOG�ZLQGRZ�RULJLQDWHV�DW�WKH�WRS�OHIW�

Page 156: Visual Basic - Subclassing and Hooking with VB & VB NET

FRUQHU�RI�WKH�SDUHQW�ZLQGRZV�FOLHQW�DUHD��$OVR��DQ\�SDUW�RI�WKH�FKLOG�ZLQGRZ�WKDW�LV�RXWVLGH�RI�WKH�SDUHQW�ZLQGRZV�FOLHQW�DUHD�LV�FOLSSHG�RU�KLGGHQ��)DLOXUH�WR�PDNH�WKLV�D�FKLOG�ZLQGRZ�ZLOO�PRVW�OLNHO\�FDXVH�WKH�GLDORJ�WHPSODWH�FRQWUROV�QRW�WR�GLVSOD\���&KHFNLQJ�WKH��&OLS�VLEOLQJV��FKHFNER[�JLYHV�WKLV�FKLOG�ZLQGRZ�D�ZLQGRZ�VW\OH�RI�:6B&/,36,%/,1*6��7KLV�VW\OH�ZLOO�QRW�DOORZ�DQ\�RI�WKH�FRQWUROV�RQ�WKH�FKLOG�GLDORJ�ER[�WR�SDLQW�RQ�WRS�RI�WKH�FRQWUROV�RQ�WKH�GHIDXOW�FRPPRQ�GLDORJ�ER[���2Q�WKH�0RUH�6W\OHV�WDE��WKH�RQO\�ER[HV�WKDW�VKRXOG�EH�FKHFNHG�DUH�WKH�9LVLEOH�FKHFNER[��WKH��'�ORRN�FKHFNER[��DQG�WKH�&RQWURO�FKHFNER[��7KH�ODVW�WZR�WDEV�DUH�WKH�([WHQGHG�6W\OHV�WDE�DQG�WKH�0RUH�([WHQGHG�6W\OHV�WDE��7KHVH�WDEV�FRQWDLQ�VHYHUDO�FKHFNER[HV��DOO�RI�ZKLFK�VKRXOG�EH�XQFKHFNHG���7KH�&RQWURO�FKHFNER[�RQ�WKH�0RUH�6W\OHV�WDE�VHWV�WKH�'6B&21752/�VW\OH��7KLV�VW\OH�DOORZV�WKH�XVHU�WR�XVH�WKH�7$%�NH\�WR�PRYH�EHWZHHQ�WKH�FRQWUROV�RQ�WKH�SDUHQW�GLDORJ�ZLQGRZ�DQG�WKRVH�RI�WKH�FKLOG�ZLQGRZ�GHILQHG�IURP�WKH�GLDORJ�WHPSODWH�UHVRXUFHV��,W�DOVR�DOORZV�WKH�XVHU�WR�XVH�DQ\�DFFHOHUDWRU�NH\V�GHILQHG�LQ�WKH�FKLOG�ZLQGRZ��%DVLFDOO\��WKLV�VW\OH�PDNHV�IXOO\�LQWHJUDWLQJ�RXU�GLDORJ�WHPSODWH�UHVRXUFH�LQWR�WKH�FRPPRQ�GLDORJ�ER[�PXFK�HDVLHU���7KH��'�ORRN�FKHFNER[�VHWV�WKH�'6B�'/22.�VW\OH��$�ZLQGRZ�XVLQJ�WKLV�VW\OH�GUDZV�LWV�FRQWUROV�ZLWK�D��'�ERUGHU��DQG�WKH�IRQW�IRU�WKH�ZLQGRZ�ZLOO�EH�QRQEROG�DV�ZHOO��7KLV�VW\OH�LV�UHTXLUHG�RQO\�IRU�DSSOLFDWLRQV�FRPSLOHG�WR�UXQ�XQGHU�YHUVLRQV�RI�:LQGRZV�17�EHORZ������:LQGRZV��[�DQG�:LQGRZV�17�YHUVLRQV�����DQG�DERYH�GR�QRW�UHTXLUH�WKLV�VW\OH�WR�EH�VHW��WKH��'�ORRN�DQG�IHHO�LV�DXWRPDWLFDOO\�DSSOLHG�WR�ZLQGRZV�UXQQLQJ�XQGHU�WKHVH�RSHUDWLQJ�V\VWHPV���7KH�SURSHUWLHV�VKRXOG�EH�FKHFNHG�IRU�HDFK�FRQWURO�RQ�WKLV�GLDORJ�DV�ZHOO��)RU�HDFK�FRQWURO��LW�LV�D�JRRG�LGHD�WR�FKHFN�WKH��7DE�VWRS��DQG�9LVLEOH�FKHFNER[HV�RQ�WKH�*HQHUDO�WDE�RI�WKH�3URSHUWLHV�GLDORJ�ER[��$OVR��IRU�FKHFNER[�FRQWUROV��WKH�$XWR�FKHFNER[�RQ�WKH�6W\OHV�WDE�VKRXOG�EH�FKHFNHG�DV�ZHOO��7KH�$XWR�FKHFNER[�VHWV�WKH�%6B$872&+(&.%2;�VW\OH�IRU�WKH�FKHFNER[��7KLV�VW\OH�ZLOO�DXWRPDWLFDOO\�WRJJOH�WKH�FKHFNER[�WR�EH�FKHFNHG�RU�XQFKHFNHG�HYHU\�WLPH�D�XVHU�FOLFNV�LW���7KLV�LV�DERXW�DOO�WKDW�QHHGV�WR�EH�GRQH�LQ�WKH�9LVXDO�&���GLDORJ�HGLWRU��6DYH�\RXU�ZRUN�DQG�H[LW�9LVXDO�&����,I�WKH�HGLWRU�FUHDWHV�D�ILOH�ZLWK�DQ�H[WHQVLRQ�RWKHU�WKDQ��5(6��\RX�VKRXOG�FOLFN�WKH�)LOH� 6DYH�$V����PHQX�LWHP�DQG�FKRRVH�WR�VDYH�WKH�ILOH�DV�W\SH� �5(6��7KH�UHVRXUFH�ILOH���5(6��FUHDWHG�E\�9LVXDO�&���ZLOO�EH�XVHG�E\�RXU�DSSOLFDWLRQ�WR�PRGLI\�WKH�ORRN�RI�WKH�FRPPRQ�GLDORJ�ER[���

�%HFDXVH�LW�LV�PXFK�HDVLHU�WR�XVH�D�WRRO�VXFK�DV�WKH�GLDORJ�HGLWRU�LQ�9LVXDO�&���WR�FUHDWH�WKH�GLDORJ�WHPSODWH�UHVRXUFH��,�DP�QRW�JRLQJ�WR�GHYRWH�WLPH�WR�VKRZLQJ�\RX�KRZ�WR�FUHDWH�D�GLDORJ�UHVRXUFH�E\�KDQG��,I�\RX�DUH�LQWHUHVWHG��\RX�FDQ�VDYH�WKH�GLDORJ�WHPSODWH�DV�D�5HVRXUFH�6FULSW��5&��ILOH�E\�FOLFNLQJ�)LOH� 6DYH�$V����LQ�WKH�9LVXDO�&���HGLWRU�DQG�FKRRVLQJ�WR�VDYH�\RXU�GLDORJ�WHPSODWH�DV�DQ�5&�� �UF��ILOH��

Page 157: Visual Basic - Subclassing and Hooking with VB & VB NET

FKRRVLQJ�WR�VDYH�\RXU�GLDORJ�WHPSODWH�DV�DQ�5&�� �UF��ILOH��2SHQ�WKLV�ILOH�LQ�1RWHSDG�DQG�H[DPLQH�WKH�UHVXOWV��7KH�VHFWLRQ�WKDW�LV�FRPPHQWHG�ZLWK�WKH�ZRUG��'LDORJ��LV�WKH�VHFWLRQ�ZKHUH�\RXU�GLDORJ�UHVRXUFH�LV�DFWXDOO\�GHILQHG��7KH�UHVRXUFH�FRPSLOHU��5&�(;(��WKDW�VKLSV�ZLWK�9LVXDO�6WXGLR�FDQ�EH�XVHG�WR�FRPSLOH�WKLV��UF�ILOH��7KLV�LV�D�FRPPDQG�OLQH�XWLOLW\�WKDW�WDNHV�D��UF�ILOH�DQG�FUHDWHV�D��UHV�ILOH�WKDW�FDQ�EH�OLQNHG�WR�\RXU�DSSOLFDWLRQ�E\�WKH�9LVXDO�&���OLQNHU����

,W�DOVR�ZLOO�EH�KHOSIXO�WR�VDYH�WKH�ILOH�DV�D�UHVRXUFH�VFULSW��:KHQ�D�UHVRXUFH�LV�VDYHG�DV�D�UHVRXUFH�VFULSW�ILOH��D�UHVRXUFH�K�&���KHDGHU�ILOH�LV�FUHDWHG��,Q�WKLV�ILOH�DUH�DOO�WKH�FRQVWDQWV�WKDW�\RX�QHHG�LQ�\RXU�DSSOLFDWLRQ�WR�UHIHUHQFH�WKH�GLDORJ�WHPSODWH�UHVRXUFH�DQG�WKH�FRQWUROV�WKDW�\RX�SODFHG�RQ�WKLV�UHVRXUFH��7KHVH�FRQVWDQWV�ZLOO�QHHG�WR�EH�GHFODUHG�LQ�\RXU�9%�VXEFODVVLQJ�DSSOLFDWLRQ���

������0DQLSXODWLQJ�&RQWURO�3ODFHPHQW�RQ�WKH�'LDORJ�

)ROORZLQJ�WKH�VWHSV�DERYH�DOORZV�\RX�WR�FUHDWH�D�UHVRXUFH�WKDW�ZLOO�EH�GLVSOD\HG�DW�WKH�GHIDXOW�ORFDWLRQ�LQ�WKH�FRPPRQ�GLDORJ�ER[��7KLV�GHIDXOW�ORFDWLRQ�ZLOO�DOZD\V�EH�DW�WKH�ERWWRP�RI�WKH�GLDORJ�ER[��7KH�FRPPRQ�GLDORJ�ER[�ZLOO�EH�UHVL]HG�WR�DFFRPPRGDWH�DOO�WKH�FRQWUROV�RQ�WKH�FKLOG�GLDORJ�WHPSODWH��,Q�WKH�FDVH�RI�RXU�VDPSOH�DSSOLFDWLRQ��WKLV�LV�SUHFLVHO\�ZKDW�ZH�ZDQW��DV�)LJXUH�����VKRZV��DOO�WKH�FRQWUROV�IURP�RXU�UHVRXUFH�ILOH�VKRXOG�DSSHDU�LQ�WKH�ORZHU�OHIW�FRUQHU�RI�WKH�6DYH�$V�GLDORJ���7KLV�SODFHPHQW�SRVHV�D�SUREOHP�LI�DQ\�FRQWUROV�PXVW�EH�SODFHG�RQ�WKH�OHIW�VLGH��ULJKW�VLGH��RU�WRS�RI�WKH�FRPPRQ�GLDORJ�ER[��+RZHYHU��WKHUH�LV�D�ZD\�WR�WHOO�WKH�FRPPRQ�GLDORJ�ER[�ZKHUH�\RX�ZDQW�WR�SODFH�WKHVH�FRQWUROV��\RX�FDQ�LQFOXGH�D�VWDWLF�WH[W�FRQWURO�LQ�\RXU�FXVWRP�GLDORJ�ER[�WHPSODWH��LQ�9%��WKH�VWDWLF�WH[W�FRQWURO�LV�UHSUHVHQWHG�E\�WKH�/DEHO�FRQWURO��DQG�DVVLJQ�LQ�WKH�LGHQWLILHU�VWF�����7KLV�YDOXH�LV�GHILQHG�LQ�WKH�'OJV�K�KHDGHU�ILOH��ZKLFK�LV�D�:LQGRZV�VXSSOLHG�KHDGHU�ILOH�WKDW�FRQWDLQV�GHILQLWLRQV�QHHGHG�IRU�:LQGRZV�GLDORJV���:KHQ�D�FKLOG�ZLQGRZ�KDV�D�FRQWURO�ZKRVH�LGHQWLILHU�LV�VWF����:LQGRZV�ZLOO�SODFH�WKH�SDUHQW�ZLQGRZV�FRQWUROV�LQ�WKH�DUHD�GHILQHG�E\�WKH�VWF���FRQWURO��DQG�ZLOO�SODFH�WKH�FKLOG�ZLQGRZV�FRQWUROV�VR�WKDW�WKH\�KDYH�WKH�VDPH�SRVLWLRQ�DV�WKH\�GR�UHODWLYH�WR�WKH�VWF���FRQWURO��:LQGRZV�DOVR�ZLOO�DGG�WKH�QHFHVVDU\�VSDFH�WR�WKH�OHIW��ULJKW��ERWWRP��DQG�WRS�RI�WKH�GLDORJ�ER[�WR�DFFRPPRGDWH�WKH�DGGLWLRQDO�FRQWUROV���$�TXLFN�H[DPSOH��ZKLFK�\RX�GRQW�KDYH�WR�FUHDWH�IRU�\RXUVHOI��VKRZV�KRZ�WKLV�ZRUNV��,PDJLQH�WKDW�ZH�FUHDWH�D�IRUP�WKDW�KDV�IRXU�FRPPDQG�EXWWRQV�DQG�D�/DEHO�FRQWURO��:KHQ�ZH�LPSRUW�LW�LQWR�WKH�9LVXDO�&���UHVRXUFH�HGLWRU��LW�DSSHDUV�DV�LQ�)LJXUH������1RWH�WKDW�RXU�/DEHO�FRQWURO�LQ�9%�EHFRPHV�D�VWDWLF�WH[W�FRQWURO�LQ�9LVXDO�&����7KLV�FRQWURO�ZLOO�GHILQH�WKH�DUHD�RI�WKH�

Page 158: Visual Basic - Subclassing and Hooking with VB & VB NET

FRPPRQ�GLDORJ�ER[�ZKHUH�WKH�GHIDXOW�FRQWUROV�DUH�SODFHG��%\�SODFLQJ�RXU�QHZ�FRQWUROV�DURXQG�WKLV�ODEHO�FRQWURO��ZH�DOORZ�WKHVH�FRQWUROV�WR�EH�GUDZQ�UHODWLYH�WR�WKH�GHIDXOW�FRQWUROV�RQ�WKH�FRPPRQ�GLDORJ�ER[��:LQGRZV�ZLOO�WU\�WR�PDLQWDLQ�WKH�FRUUHODWLRQ�WKDW�WKH�GHIDXOW�FRQWUROV�KDYH�WR�WKH�VWDWLF�WH[W�FRQWURO���

)LJXUH������7KH�GLDORJ�WHPSODWH�UHVRXUFH�ZLWK�WKH�VWF���ODEHO�DGGHG�

7R�GR�WKLV��XVH�WKH�VWDWLF�WH[W�FRQWUROV�3URSHUWLHV�GLDORJ�WR�FKDQJH�LWV�FRQWURO�LGHQWLILHU�WR�VWF����$V�,YH�PHQWLRQHG��WKLV�YDOXH�LV�SUHGHILQHG�LQ�WKH�:LQGRZV�GLDORJ�KHDGHU�ILOH��'OJV�K��,Q�9%��WKLV�FRQVWDQW�LV�GHILQHG�DV���&RQVW�VWF��� �+��)�,Q�9LVXDO�&����VWF���LV�GHILQHG�DV���GHILQH�VWF����������[���I�)LJXUH�����VKRZV�KRZ�:LQGRZV�XVHV�WKH�VWDWLF�WH[W�FRQWURO�WR�GHILQH�ZKHUH�WKH�QHZ�FRQWUROV�DUH�SODFHG��:LQGRZV�WULHV�WR�SODFH�DOO�WKH�VWDQGDUG�FRQWUROV�LQ�WKH�FRPPRQ�GLDORJ�ER[�LQVLGH�WKH�VWDWLF�WH[W�FRQWURO��7KH�WRS�OHIW�FRRUGLQDWH�RI�WKH�DUHD�FRQWDLQLQJ�WKH�GHIDXOW�FRPPRQ�GLDORJ�FRQWUROV�LV�SODFHG�DW�WKH�VDPH�ORFDWLRQ�DV�WKH�WRS�OHIW�FRRUGLQDWH�RI�WKH�VWDWLF�WH[W�FRQWURO��,I�WKH�VWDWLF�WH[W�FRQWURO�FDQ�KROG�DOO�WKH�GHIDXOW�GLDORJ�FRQWUROV��DOO�LV�ILQH��,I��LQVWHDG��WKH�VWDWLF�WH[W�FRQWURO�LV�WRR�VPDOO��WKH�KHLJKW�DQG�ZLGWK�RI�WKH�VWDWLF�WH[W�FRQWURO�DUH�LQFUHDVHG�XQWLO�DOO�WKH�GHIDXOW�GLDORJ�FRQWUROV�FDQ�EH�SODFHG�ZLWKLQ�LW��7KH�QHZ�FRQWUROV�WKDW�DUH�DGGHG�WR�WKH�FRPPRQ�GLDORJ�ZLOO�UHWDLQ�WKHLU�SRVLWLRQ�UHODWLYH�WR�WKH�WRS�OHIW�FRUQHU�RI�WKH�VWF���VWDWLF�WH[W�FRQWURO��7KLV�PHDQV�WKDW�DQ\�FRQWUROV�SODFHG�DERYH�WKH�VWDWLF�WH[W�FRQWURO�ZLOO�EH�SODFHG�DERYH�WKH�GHIDXOW�FRQWUROV�LQ�WKH�GLDORJ��FRQWUROV�SODFHG�WR�WKH�ULJKW�RI�WKH�VWDWLF�WH[W�FRQWURO�ZLOO�EH�SODFHG�WR�WKH�ULJKW�RI�WKH�GHIDXOW�FRQWUROV�LQ�WKH�GLDORJ��DQG�VR�RQ��7KH�FRPPRQ�GLDORJ�ER[�ZLOO�UHVL]H�LWVHOI�WR�DFFRPPRGDWH�WKH�QHZ�FRQWUROV���

Page 159: Visual Basic - Subclassing and Hooking with VB & VB NET

)LJXUH������7KH�FRPPRQ�GLDORJ�ER[�FUHDWHG�ZLWK�WKH�GLDORJ�WHPSODWH�LQ�)LJXUH�����

����8VLQJ�WKH�5HVRXUFH�

$IWHU�WKH�UHVRXUFH�ILOH���5(6��LV�FUHDWHG��WKHUH�DUH�WZR�ZD\V�WR�XVH�LW�ZLWKLQ�D�VXEFODVVLQJ�DSSOLFDWLRQ�LQ�9%��7KH�ILUVW�ZD\�LV�WR�VLPSO\�DGG�WKH�UHVRXUFH�ILOH�WR�WKH�DSSOLFDWLRQ��7KH�VHFRQG�ZD\�LV�WR�DGG�WKH�UHVRXUFH�ILOH�WR�D�'//�DQG�ORDG�WKH�UHVRXUFH�IURP�WKLV�'//��7KHUH�LV�D�UHDVRQ�IRU�XVLQJ�HDFK�PHWKRG�WR�LQFRUSRUDWH�D�UHVRXUFH�LQWR�D�SURMHFW��,I�DQ�DSSOLFDWLRQ�LV�UXQQLQJ�LQ�WKH�,'(�DW�GHVLJQ�WLPH��WKH�UHVRXUFH�PXVW�EH�LQ�D�'//��:KHQ�WKH�DSSOLFDWLRQ�LV�UXQQLQJ�DV�D�VWDQGDORQH�(;(��WKH�UHVRXUFH�FDQ�EH�HPEHGGHG�LQWR�WKH�(;(�DV�D��5(6�ILOH��RU�LW�FDQ�EH�FRQWDLQHG�ZLWKLQ�D�'//��7KLV�LV�D�OLPLWDWLRQ�RI�9%��QRW�RI�WKH�UHVRXUFH�ILOH���1R�RWKHU�DSSOLFDWLRQ�FDQ�DFFHVV�WKH�GLDORJ�WHPSODWH�UHVRXUFH�LI�LW�LV�HPEHGGHG�ZLWKLQ�WKLV�DSSOLFDWLRQ�DV�D��5(6�ILOH�EHFDXVH�WKH\�DUH�UXQQLQJ�LQ�VHSDUDWH�SURFHVVHV��3ODFLQJ�D�UHVRXUFH�LQ�D�VHSDUDWH�'//�DOORZV�PXOWLSOH�DSSOLFDWLRQV�WR�DFFHVV�WKH�VDPH�UHVRXUFHV��$�VLQJOH�DSSOLFDWLRQ�DOVR�FDQ�DFFHVV�PXOWLSOH�UHVRXUFH�'//V���9%�KDV�WKUHH�IXQFWLRQV�IRU�ORDGLQJ�DQG�XVLQJ�UHVRXUFHV��/RDG5HV6WULQJ��/RDG5HV'DWD��DQG�/RDG5HV3LFWXUH��$OWKRXJK�/RDG5HV6WULQJ�DQG�/RDG5HV3LFWXUH�DUH�IXQFWLRQV�WKDW�ORDG�SDUWLFXODU�NLQGV�RI�GDWD��VWULQJV�DQG�LPDJHV��UHVSHFWLYHO\��IURP�UHVRXUFH�ILOHV��/RDG5HV'DWD�LV�D�JHQHUDO�SXUSRVH�IXQFWLRQ�IRU�UHWULHYLQJ�LWHPV�IURP�UHVRXUFH�ILOHV��,WV�V\QWD[�LV���/RDG5HV'DWD�UHV,'��UHV7\SH��ZKHUH�UHV,'�LV�WKH�LGHQWLILHU�RI�WKH�UHVRXUFH��DQG�UHV7\SH�LV�DQ�LQWHJHU�WKDW�LGHQWLILHV�WKH�W\SH�RI�UHVRXUFH�WKDWV�EHLQJ�ORDGHG��7R�ORDG�D�GLDORJ�UHVRXUFH��\RX�VXSSO\�WKH�/RDG5HV'DWD�IXQFWLRQ�ZLWK�D�UHV7\SH�YDOXH�RI����LQGLFDWLQJ�WKDW�WKLV�LV�D�GLDORJ�UHVRXUFH��8QIRUWXQDWHO\��WKLV�PHWKRG�RQO\�UHWXUQV�DQ�DUUD\�RI�E\WHV��ZKLFK�\RX�DUH�WKHQ�UHTXLUHG�WR�SURFHVV�WKURXJK�\RXU�

Page 160: Visual Basic - Subclassing and Hooking with VB & VB NET

RZQ�FRGH��$IWHU�SURFHVVLQJ�WKLV�LQIRUPDWLRQ��\RX�KDYH�WR�FUHDWH�WKH�GLDORJ�PDQXDOO\�WKURXJK�\RXU�FRGH���

�(YHQ�WKRXJK�WKH�/RDG5HV'DWD�IXQFWLRQ�KDV�DQ�LQGH[�YDOXH�WR�VXSSRUW�ORDGLQJ�D�GLDORJ�UHVRXUFH��\RX�DUH�QRW�PHDQW�WR�XVH�LW�WKLV�ZD\�LQ�9%��,�NQRZ�WKLV�PLJKW�VRXQG�RGG��EXW�VHH�WKH�0LFURVRIW�DUWLFOH�HQWLWOHG��/RDG5HV'DWD�)XQFWLRQ�'RHV�1RW�6XSSRUW�$OO�)RUPDWV���7KH�,'�RI�WKLV�DUWLFOH�LV�4�������LQ�WKH�0LFURVRIW�'HYHORSHU�1HWZRUN��06'1��NQRZOHGJHEDVH��0D\EH�WKLV�DUWLFOH�ZLOO�FODULI\�WKLQJV�IRU�\RX�PRUH�WKDQ�LW�GLG�IRU�PH����

)RUWXQDWHO\��XVLQJ�RXU�GLDORJ�WHPSODWH�UHVRXUFH�ZLOO�QRW�EH�D�SUREOHP�IRU�XV�EHFDXVH�FRPGOJ���GOO�ZLOO�KDQGOH�ORDGLQJ�DQG�LQFRUSRUDWLQJ�WKH�GLDORJ�WHPSODWH�UHVRXUFH�LQWR�WKH�FRPPRQ�GLDORJ�ER[��$OO�ZH�KDYH�WR�GR�LV�WHOO�FRPGOJ���GOO�ZKHUH�WKH�UHVRXUFH�LV�ORFDWHG��,�ZLOO�VKRZ�\RX�KRZ�WKLV�LV�GRQH�D�OLWWOH�ODWHU�LQ�WKLV�FKDSWHU���

������(PEHGGLQJ�WKH�5HVRXUFH�LQ�WKH�(;(�

(PEHGGLQJ�D�UHVRXUFH�LQ�DQ�H[HFXWDEOH�LV�D�IDLUO\�VWUDLJKWIRUZDUG�SURFHVV��7KH�UHVRXUFH���5(6��ILOH�QHHGV�WR�EH�DGGHG�WR�WKH�SURMHFW�E\�XVLQJ�WKH�3URMHFW�"�$GG�)LOH�PHQX�RSWLRQ��DQG�WKHQ�WKH�SURMHFW�QHHGV�WR�EH�FRPSLOHG�LQWR�DQ�H[HFXWDEOH���(PEHGGLQJ�WKH�UHVRXUFH�LQWR�DQ�(;(�PLJKW�VLPSOLI\�WKH�FRGLQJ�UHTXLUHG�DQG�PLJKW�HYHQ�LQFUHDVH�SHUIRUPDQFH�RYHU�SODFLQJ�WKH�UHVRXUFH�LQWR�D�'//��2QH�SUREOHP�ZLWK�WKLV�PHWKRG�LV�WKDW�WKH�DSSOLFDWLRQ�PXVW�EH�UHFRPSLOHG�DQ\�WLPH�RQH�RU�PRUH�UHVRXUFHV�DUH�FKDQJHG��7KLV�FRXOG�SRVH�D�SUREOHP�LI�WKH�(;(�ILOH�KDV�WR�EH�XSGDWHG�RQ�VHYHUDO�GLIIHUHQW�PDFKLQHV�HYHU\�WLPH�LW�LV�UHFRPSLOHG��8VH�\RXU�RZQ�MXGJPHQW�ZKHQ�GHFLGLQJ�ZKHWKHU�WR�SODFH�WKH�UHVRXUFH�V��LQWR�WKH�(;(�RU�LQWR�WKH�'//���

������8VLQJ�D�5HVRXUFH�LQ�D�'//�

$�PRUH�IOH[LEOH�PHWKRG�IRU�DGGLQJ�D�UHVRXUFH�WR�DQ�DSSOLFDWLRQ�LV�WR�SDFNDJH�LW�ZLWKLQ�D�'//��:H�FDQ�FUHDWH�WKLV�'//�LQ�WZR�ZD\V��2QH�LV�WR�XVH�9LVXDO�&���WR�FUHDWH�WKH�'//��DQG�WKH�RWKHU�LV�WR�XVH�9%��7KDWV�ULJKW����ZH�FDQ�FUHDWH�D�UHVRXUFH�'//�IURP�ZLWKLQ�9%�DORQH��,�ZLOO�JR�WKURXJK�WKH�FUHDWLRQ�RI�D�UHVRXUFH�'//�IURP�ERWK�GHYHORSPHQW�HQYLURQPHQWV���

��������&UHDWLQJ�D�9LVXDO�&���UHVRXUFH�'//�

7R�FUHDWH�D�&���UHVRXUFH�'//��IROORZ�WKHVH�VWHSV���

Page 161: Visual Basic - Subclassing and Hooking with VB & VB NET

��� 2SHQ�9LVXDO�&���DQG�VHOHFW�WKH�)LOH� 1HZ����PHQX�LWHP��7KLV�ZLOO�GLVSOD\�WKH�1HZ�GLDORJ�ER[���

��� 2Q�WKH�3URMHFWV�WDE��VHOHFW�WKH�LWHP�:LQ���'\QDPLF�/LQN�/LEUDU\�LQ�WKH�OLVW��DQG�HQWHU�WKH�QDPH�RI�WKH�'//�LQ�WKH�3URMHFW�1DPH�ILHOG�DQG�WKH�ORFDWLRQ�LQ�WKH�/RFDWLRQ�ILHOG��&OLFN�WKH�2.�EXWWRQ���

��� $�'//�FUHDWLRQ�ZL]DUG�GLDORJ�ZLOO�EH�GLVSOD\HG��6HOHFW�WKH��$�VLPSOH�'//�SURMHFW��UDGLR�EXWWRQ��WKHQ�FOLFN�WKH�)LQLVK�EXWWRQ���

��� 7KH�1HZ�3URMHFW�,QIRUPDWLRQ�GLDORJ�DSSHDUV��&OLFN�WKH�2.�EXWWRQ�DQG�WKH�UHVRXUFH�'//�SURMHFW�ZLOO�EH�FUHDWHG���

��� 7R�DGG�WKH�UHVRXUFH�WR�WKLV�SURMHFW��ORFDWH�WKH�5HVRXUFH�)LOHV�IROGHU�LQ�WKH�SURMHFW�ZLQGRZ�LQ�)LOH�YLHZ�DQG�ULJKW�FOLFN�LW��6HOHFW�WKH��$GG�)LOHV�WR�)ROGHUV�����PHQX�LWHP��7KH�,QVHUW�)LOHV�,QWR�3URMHFW�GLDORJ�ER[�LV�GLVSOD\HG���

��� 6HOHFW�5HVRXUFH�)LOHV�LQ�WKH�)LOHV�RI�7\SH�GURS�GRZQ�ER[��WKHQ�ILQG�DQG�VHOHFW�WKH��5(6�ILOH�WKDW�\RX�SUHYLRXVO\�FUHDWHG�LQ�\RXU�UHVRXUFH�HGLWRU�RI�FKRLFH��&OLFN�WKH�2.�EXWWRQ���

��� 7KH�UHVRXUFH�LV�QRZ�DGGHG�WR�\RXU�&���'//��&RPSLOH�WKLV�'//�DQG�WKH�UHVRXUFH�ZLOO�EH�DYDLODEOH�WR�RWKHU�DSSOLFDWLRQV���

7KLV�LV�WKH�VLPSOHVW�ZD\�WKDW�,�KDYH�IRXQG�WR�FUHDWH�D�UHVRXUFH�'//�LQ�9LVXDO�&�����

��������&UHDWLQJ�D�9%�UHVRXUFH�'//�

7KHUH�LV�QRW�PXFK�LQYROYHG�LQ�FUHDWLQJ�D�UHVRXUFH�'//�IURP�9%��)LUVW��VWDUW�XS�9%�DQG�FUHDWH�D�QHZ�$FWLYH;�'//�SURMHFW��:KHQ�9%�FUHDWHV�WKLV�SURMHFW��LW�DOVR�FUHDWHV�D�FODVV�PRGXOH�FDOOHG�&ODVV��ZLWKLQ�WKH�SURMHFW��(YHQ�WKRXJK�WKHUH�LV�QR�FRGH�LQ�WKLV�FODVV��LW�ZLOO�QHHG�WR�UHPDLQ�LQ�WKH�SURMHFW�EHFDXVH�9%�UHTXLUHV�WKDW�DQ\�$FWLYH;�REMHFW��(;(��'//��RU�&RQWURO��PXVW�FRQWDLQ�D�FODVV�PRGXOH�WR�ORDG�WKH�REMHFW�FRUUHFWO\�LQWR�PHPRU\��2WKHUZLVH��\RX�ZLOO�JHW�D�FRPSLOHU�HUURU���1R�FUHDWDEOH�SXEOLF�FRPSRQHQW�GHWHFWHG���ZKHQ�WU\LQJ�WR�FRPSLOH�RU�UXQ�WKLV�SURMHFW���7KH�VWHSV�WR�DGG�D�UHVRXUFH�ILOH�WR�D�9%�SURMHFW�DUH���

��� 2SHQ�D�QHZ�$FWLYH;�'//�SURMHFW�LQ�WKH�9%�,'(���7KH�6WDUWXS�2EMHFW�SURSHUW\�RI�WKH�SURMHFW�LV�VHW�WR�1RQH�E\�GHIDXOW�IRU�D�UHVRXUFH�'//����

��� 5LJKW�FOLFN�WKH�3URMHFW�H[SORUHU�ZLQGRZ�DQG�VHOHFW�WKH�$GG� $GG�)LOH����PHQX�LWHP�LQ�WKH�SRS�XS�PHQX��7KLV�ZLOO�GLVSOD\�WKH�$GG�)LOH�GLDORJ�ER[���

��� ,Q�WKH�)LOHV�RI�7\SH�GURS�GRZQ�ER[��VHOHFW�WKH�5HVRXUFH�)LOHV�� �UHV��LWHP��WKHQ�ILQG�DQG�VHOHFW�WKH�UHVRXUFH�ILOH�WKDW�\RX�ZDQW�WR�DGG�WR�WKH�SURMHFW�DQG�FOLFN�WKH�2SHQ�EXWWRQ���

��� &RPSLOH�WKH�'//��

Page 162: Visual Basic - Subclassing and Hooking with VB & VB NET

7R�VHH�WKH�UHVRXUFH�ILOH��ORFDWH�WKH�5HODWHG�'RFXPHQWV�QRGH�LQ�WKH�3URMHFW�([SORUHU�ZLQGRZ�DQG�H[SDQG�WKDW�EUDQFK��7KH�UHVRXUFH�ILOHQDPH�LV�GLVSOD\HG�XQGHU�WKLV�QRGH���9%�GRHV�QRW�SURYLGH�D�ZD\�WR�GLUHFWO\�HGLW�UHVRXUFHV�ZLWKLQ�WKH�,'(��$Q�DGG�LQ�VKLSV�ZLWK�9%�WR�DOORZ�WKH�FUHDWLRQ�DQG�HGLWLQJ�RI�UHVRXUFH�ILOHV��EXW�HYHQ�WKLV�DGG�LQ�ZLOO�QRW�OHW�\RX�FUHDWH�RU�HGLW�GLDORJ�WHPSODWH�UHVRXUFHV��7KLV�OLPLWDWLRQ�SUHYHQWV�XV�IURP�FUHDWLQJ�WKH�UHVRXUFH�HQWLUHO\�ZLWKLQ�WKH�9%�HQYLURQPHQW��

����&UHDWLQJ�WKH�6XEFODVVLQJ�$SSOLFDWLRQ�

7KH�DSSOLFDWLRQ�ZH�ZLOO�FUHDWH�LQ�WKLV�VHFWLRQ�VXEFODVVHV�WKH�6DYH�$V�FRPPRQ�GLDORJ�ER[��7KLV�DSSOLFDWLRQ�KDV�RQH�IRUP�PRGXOH�FDOOHG�IUP0DLQ�IUP��ZKLFK�LV�GLVSOD\HG�LQ�)LJXUH������7KH�QRQGHIDXOW�SURSHUWLHV�RI�WKLV�IRUP�DUH�OLVWHG�LQ�7DEOH������7KH�IRUP�FRQWDLQV�D�FRPPDQG�EXWWRQ�FRQWURO�FDOOHG�&RPPDQG��DQG�D�WH[W�ER[�FRQWURO�FDOOHG�(GLW����

)LJXUH������7KH�PDLQ�IRUP�RI�WKH�VDPSOH�DSSOLFDWLRQ�

7DEOH������1RQGHIDXOW�3URSHUWLHV�RI�IUP0DLQ�DQG�,WV�&RQWUROV��

&RQWURO�1DPH�� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�IUP0DLQ� &DSWLRQ� &K����&RPPRQ�'LDORJ�6XEFODVVLQJ�([DPSOH�IUP0DLQ� %RUGHU6W\OH� ��)L[HG�'LDORJ�IUP0DLQ� 7RS� ��IUP0DLQ� /HIW� ��IUP0DLQ� +HLJKW� �����IUP0DLQ� :LGWK� �����&RPPDQG�� &DSWLRQ� 'LVSOD\�6XEFODVVHG�'LDORJ�&RPPDQG�� 7RS� ���&RPPDQG�� /HIW� ���&RPPDQG�� +HLJKW� ����&RPPDQG�� :LGWK� �����W[W0VJ�� 0XOWLOLQH� 7UXH�W[W0VJ� 7RS� ���

Page 163: Visual Basic - Subclassing and Hooking with VB & VB NET

W[W0VJ� /HIW� �����W[W0VJ� +HLJKW� �����W[W0VJ� :LGWK� �����&OLFNLQJ�WKH�EXWWRQ�FRQWURO�FUHDWHV�D�6DYH�$V�FRPPRQ�GLDORJ�ER[��VXEFODVVHV�LW��DQG�GLVSOD\V�LW��7KH�6DYH�$V�GLDORJ�LV�PRGLILHG�WR�LQFOXGH�WKH�H[WUD�FRQWUROV�WKDW�DUH�FRQWDLQHG�LQ�RXU�UHVRXUFH�'//��7KLV�GLDORJ�LV�GLVSOD\HG�LQ�)LJXUH�������

)LJXUH������7KH�VXEFODVVHG�6DYH�$V�FRPPRQ�GLDORJ�ER[�

7KH�ILUVW�WKLQJ�\RX�PLJKW�QRWLFH�DERXW�WKLV�QHZ�GLDORJ�LV�WKDW�WKH�FDSWLRQ�RI�WKLV�GLDORJ�KDV�EHHQ�FKDQJHG�WR��([SRUW�$V��6XEFODVVHG�&RPPRQ�'LDORJ����$GGLWLRQDO�8,�FKDQJHV�GHULYH�IURP�WKH�FKLOG�GLDORJ�WHPSODWH�XVHG�WR�FUHDWH�WKH�FRQWUROV�DW�WKH�ERWWRP�RI�WKH�GLDORJ�ER[��7KHVH�FRQWUROV�KDYH�QR�UHDO�IXQFWLRQDOLW\��7KH�EXWWRQ�FRQWURO�ZLWK�WKH�FDSWLRQ��&OLFN�0H��VLPSO\�GLVSOD\V�D�PHVVDJH�ER[�LQGLFDWLQJ�WKDW�WKH�EXWWRQ�KDV�EHHQ�FOLFNHG��7KH�8VH�3UHGHILQHG�'HOLPLWHU�FKHFNER[�DOORZV�WKH�XVHU�WR�VZLWFK�EHWZHHQ�GLVSOD\LQJ�DQ�HGLW�ER[��VKRZQ�LQ�)LJXUH������DQG�D�GURS�GRZQ�OLVW�ER[��,I�WKLV�ZHUH�D�UHDO�ZRUNLQJ�H[DPSOH��WKH�HGLW�ER[�ZRXOG�DOORZ�D�XVHU�WR�HQWHU�LQ�D�GHOLPLWHU�RI�KLV�RU�KHU�RZQ�FKRLFH��+RZHYHU��LI�WKH�FKHFNER[�LV�FKHFNHG��WKH�GURS�GRZQ�OLVW�ER[�LV�GLVSOD\HG��DOORZLQJ�WKH�XVHU�WR�FKRRVH�IURP�IRXU�SUHGHILQHG�GHOLPLWHUV���7KLV�SURMHFW�FRQVLVWV�RI�D�IRUP��IUP0DLQ�IUP��DQG�D�FRGH�PRGXOH��0RGXOH��EDV���,W�DOVR�XVHV�WKH�UHVRXUFH�'//�WKDW�ZDV�FUHDWHG�HDUOLHU�LQ�WKLV�FKDSWHU��7KH�UHVRXUFH�'//�LV�QDPHG�'OJ5HVB9%�'//���

������7KH�&RGH�%HKLQG�WKH�IUP0DLQ�IUP�0RGXOH�

1RW�PXFK�FRGH�LV�FRQWDLQHG�LQ�WKH�IRUP����RQO\�EHKLQG�WKH�&RPPDQG��EXWWRQ�WKDW�FDOOV�WKH�6WDUW�SURFHGXUH�LQ�WKH�0RGXOH��EDV�PRGXOH��7KH�FRGH�IRU�WKH�IRUP�LV�VKRZQ�LQ�([DPSOH�������

Page 164: Visual Basic - Subclassing and Hooking with VB & VB NET

([DPSOH������7KH�&RPPDQG�B&OLFN�(YHQW�3URFHGXUH��

3ULYDWH�6XE�&RPPDQG�B&OLFN���������&DOO�6WDUW�0H�KZQG��(QG�6XE�

������7KH�&RGH�%HKLQG�WKH�0RGXOH��EDV�0RGXOH�

7KLV�VHFWLRQ�GHVFULEHV�WKH�FRGH�WKDW�FUHDWHV�WKH�GLDORJ�DQG�SHUIRUPV�WKH�VXEFODVVLQJ��,�ZLOO�VWDUW�RXW�E\�GHVFULELQJ�VRPH�RI�WKH�ILQHU�SRLQWV�RI�WKH�GLDORJ�FUHDWLRQ�VWUXFWXUH�DV�LW�UHODWHV�WR�VXEFODVVLQJ�WKH�FRPPRQ�GLDORJ��1H[W��,�ZLOO�VKRZ�\RX�WKH�FRGH�IRU�WKLV�PRGXOH��DQG�ILQDOO\��,�ZLOO�HQG�ZLWK�D�GHWDLOHG�GLVFXVVLRQ�RI�WKH�VXEFODVV�SURFHGXUH���

��������7KH�GLDORJ�FUHDWLRQ�VWUXFWXUH�

7R�EH�FUHDWHG��HYHU\�FRPPRQ�GLDORJ�KDV�D�VWUXFWXUH�WKDW�PXVW�EH�ILOOHG�LQ�ZLWK�GDWD��)RU�WKH�6DYH�$V�GLDORJ��WKLV�LV�WKH�23(1),/(1$0(�VWUXFWXUH��%HIRUH�ZH�FRQWLQXH��ZH�PXVW�EHFRPH�IDPLOLDU�ZLWK�D�IHZ�PHPEHUV�LQ�WKLV�VWUXFWXUH���7KH�)ODJV�PHPEHU�FRQWDLQV�VSHFLILF�IODJV�XVHG�WR�GHILQH�WKH�DSSHDUDQFH�DQG�EHKDYLRU�RI�WKLV�FRPPRQ�GLDORJ�ER[��7KH�IODJV�WKDW�\RX�ZLOO�QHHG�WR�EH�FRQFHUQHG�DERXW�ZKHQ�VXEFODVVLQJ�WKH�6DYH�$V�FRPPRQ�GLDORJ��&RQVW�VWDWHPHQWV�IRU�DOO�RI�ZKLFK�VKRXOG�EH�DGGHG�WR�\RXU�SURMHFW��DUH���OFN_ENABLEHOOK (&H20 )

$OORZV�WKH�FRPPRQ�GLDORJ�KRRN�SURFHGXUH�WR�EH�FDOOHG�RQO\�LI�WKH�OSIQ+RRN�VWUXFWXUH�PHPEHU�SRLQWV�WR�D�KRRN�SURFHGXUH���

OFN_ENABLETEMPLATE (&H40 )

:KHQ�WKH�GLDORJ�WHPSODWH�UHVRXUFH�LV�FRQWDLQHG�ZLWKLQ�WKH�DSSOLFDWLRQ�RU�ZLWKLQ�D�UHVRXUFH�'//��WKLV�IODJ�LQGLFDWHV�WKDW�WKH�K,QVWDQFH�PHPEHU�RI�WKH�VWUXFWXUH�LV�VHW�WR�WKH�LQVWDQFH�KDQGOH�RI�WKH�DSSOLFDWLRQ��$SS�K,QVWDQFH����

OFN_ENABLETEMPLATEHANDLE (&H80 )

:KHQ�WKH�GLDORJ�WHPSODWH�UHVRXUFH�LV�DOUHDG\�VHW�LQ�D�VHFWLRQ�RI�PHPRU\��WKLV�IODJ�FDQ�EH�XVHG�WR�REWDLQ�WKDW�UHVRXUFH��,Q�WKLV�FDVH��WKH�K,QVWDQFH�VWUXFWXUH�PHPEHU�QHHGV�WR�EH�VHW�WR�WKH�KDQGOH�RI�WKH�PHPRU\�REMHFW�IRU�WKH�FRPPRQ�GLDORJ�WR�EH�GLVSOD\HG�FRUUHFWO\��7KLV�IODJ�RYHUULGHV�WKH�2)1B(1$%/(7(03/$7(�IODJ�LI�ERWK�DUH�VHW���

OFN_EXPLORER (&H800000 )

7KLV�IODJ�LV�UHTXLUHG�WR�GLVSOD\�WKH�QHZ�([SORUHU�VW\OH�FRPPRQ�GLDORJ�ER[HV�VHHQ�LQ�:LQGRZV�17�9HUVLRQ���DQG�:LQGRZV��[��7KLV�IODJ�DOVR�PXVW�EH�VHW�ZKHQ�DGGLQJ�D�KRRN�SURFHGXUH�RU�D�GLDORJ�WHPSODWH�WR�DQ�2SHQ�RU�6DYH�$V�FRPPRQ�GLDORJ�ER[��7R�VWD\�FXUUHQW�ZLWK�\RXU�8,��,�VXJJHVW�WKDW�\RX�DOZD\V�XVH�WKLV�IODJ���

OFN_ENABLEINCLUDENOTIFY (&H400000 )

(QDEOHV�WKH�FRPPRQ�GLDORJ�ER[�WR�VHQG�&'1B,1&/8'(,7(0�QRWLILFDWLRQ�PHVVDJHV�WR�WKH�KRRN�SURFHGXUH�GHILQHG�LQ�WKH�OSIQ+RRN�VWUXFWXUH�PHPEHU��7KLV�PHVVDJH�LV�

Page 165: Visual Basic - Subclassing and Hooking with VB & VB NET

VHQW�RQFH�IRU�HDFK�LWHP�LQ�D�IROGHU�ZKHQ�WKH�XVHU�RSHQV�WKDW�VSHFLILF�IROGHU�LQ�WKH�2SHQ�RU�6DYH�$V�FRPPRQ�GLDORJ�ER[HV��,Q�WKH�KRRN�SURFHGXUH��D�]HUR�FDQ�EH�UHWXUQHG�LI�\RX�GR�QRW�ZDQW�WKDW�LWHP�WR�EH�GLVSOD\HG�LQ�WKH�ILOH�OLVWYLHZ�FRQWURO�RI�WKH�FRPPRQ�GLDORJ�ER[��2WKHUZLVH��VHQG�D�QRQ]HUR�YDOXH�WR�GLVSOD\�WKH�LWHP�LQ�WKLV�FRQWURO��7KLV�IODJ�LV�XVHG�RQO\�LQ�:LQGRZV�������:LQGRZV�17�DQG�:LQGRZV��[�GR�QRW�XVH�WKLV�IODJ��7KLV�QRWLILFDWLRQ�FRGH�ZLOO�VWLOO�EH�VHQW�WR�WKH�GLDORJ�KRRN�SURFHGXUH�LQ�:LQGRZV�17�DQG��[��EXW�WKH�UHWXUQ�YDOXH�PHDQV�QRWKLQJ�WR�WKHVH�RSHUDWLQJ�V\VWHPV���

)RU�WKH�SXUSRVH�RI�RXU�VXEFODVVLQJ�H[DPSOH��,�ZLOO�EH�VHWWLQJ�WKH�2)1B(;3/25(5��2)1B(1$%/(+22.��2)1B(1$%/(7(03/$7(��DQG�2)1B(1$%/(,1&/8'(127,)<�IODJV��%HFDXVH�WKH�GLDORJ�WHPSODWH�UHVRXUFH�LV�LQ�D�'//��WKH�2)1B(1$%/(7(03/$7(�IODJ�PXVW�EH�XVHG�LQVWHDG�RI�WKH�2)1B(1$%/(7(03/$7(+$1'/(�IODJ��7KH�2)1B(1$%/(,1&/8'(127,)<�IODJ�LV�VHW�WR�HQVXUH�IRUZDUG�FRPSDWLELOLW\�ZLWK�:LQGRZV��������7KH�OSIQ+RRN�PHPEHU�LQ�WKH�23(1),/(1$0(�VWUXFWXUH�KROGV�D�IXQFWLRQ�SRLQWHU�WR�WKH�FRPPRQ�GLDORJ�KRRN�SURFHGXUH��7KHUH�LV�RQH�SUREOHP�KHUH��LQ�9%��ZH�XVH�WKH�$GGUHVV2I�RSHUDWRU�WR�JHW�D�IXQFWLRQ�SRLQWHU��7KH�$GGUHVV2I�RSHUDWRU�PXVW�EH�XVHG�LQ�WKH�SDUDPHWHU�OLVW�RI�D�IXQFWLRQ�FDOO��:H�QHHG�D�ZD\�IRU�9%�WR�JHW�WKH�IXQFWLRQ�SRLQWHU�WR�RXU�KRRN�SURFHGXUH�LQWR�WKLV�PHPEHU�RI�WKH�VWUXFWXUH��$GGUHVV2I�ZDV�QRW�VSHFLILFDOO\�GHVLJQHG�WR�GR�WKLV��EXW�WKHUH�LV�DQ�LQWHUHVWLQJ�ZRUNDURXQG�IRU�WKLV�SUREOHP��$V�ZH�NQRZ��WKLV�FRGH�ZLOO�SURGXFH�DQ�HUURU���'LP�)XQFW3WU�$V�/RQJ�)XQFW3WU� �$GGUHVV2I�2)1+RRN3URF�,QVWHDG��ZH�QHHG�WR�FUHDWH�D�IXQFWLRQ�VXFK�DV�WKH�IROORZLQJ�RQH�WKDW�UHWXUQV�WKH�DGGUHVV�SDUDPHWHU��LQ�WKLV�H[DPSOH�LW�LV�)XQFW$GGU��SDVVHG�LQ�WR�WKLV�IXQFWLRQ���)XQFWLRQ�6DYH$V3URF�)XQFW$GGU�$V�/RQJ��$V�/RQJ�����6DYH$V3URF �)XQFW$GGU�(QG�)XQFWLRQ�7KLV�IXQFWLRQ�LV�WKHQ�FDOOHG�XVLQJ�WKH�IROORZLQJ�OLQH�RI�FRGH��'LP�)XQFW3WU�$V�/RQJ�)XQFW3WU� �6DYH$V3URF�$GGUHVV2I�2)1+RRN3URF��7KLV�OLQH�FDOOV�6DYH$V3URF�DQG�SDVVHV�WR�LW�WKH�DGGUHVV�RI�WKH�6DYH$V3URF�IXQFWLRQ��7KLV�IXQFWLRQ�ZLOO�UHVLGH�LQ�RQH�RI�RXU�FRGH��%$6��PRGXOHV��7KH�IXQFWLRQ�VLPSO\�SDVVHV�EDFN�WKH�DGGUHVV�RI�WKH�2)1+RRN3URF�IXQFWLRQ�WR�WKH�)XQFW3WU�YDULDEOH��1RZ�WKDW�ZH�KDYH�D�YDOLG�YDOXH�LQ�WKH�)XQFW3WU�YDULDEOH��ZH�FDQ�VLPSO\�VHW�WKH�OSIQ+RRN�VWUXFWXUH�PHPEHU�HTXDO�WR�WKH�)XQFW3WU�YDULDEOH���7KH�FRPPRQ�GLDORJ�ER[�XVHV�WKH�OS7HPSODWH1DPH�PHPEHU�RQO\�LI�WKH�2)1B(1$%/(7(03/$7(�IODJ�LV�VHW�LQ�WKH�)ODJV�PHPEHU�RI�WKH�23(1),/(1$0(�VWUXFWXUH��7R�SODFH�D�YDOXH�LQ�WKH�OS7HPSODWH1DPH�PHPEHU��ZH�ILUVW�QHHG�WR�JR�EDFN�WR�WKH�UHVRXUFH�ILOH�WKDW�ZH�FUHDWHG�LQ�WKH�9LVXDO�&���UHVRXUFH�HGLWRU��:KHQ�ZH�VDYHG�WKLV�ILOH�DV�D�UHVRXUFH�VFULSW��JLYLQJ�WKH�UHVRXUFH�ILOH�DQ�H[WHQVLRQ�RI��UF���WKH�UHVRXUFH�HGLWRU�DOVR�FUHDWHG�D�UHVRXUFH�K�KHDGHU�ILOH��2SHQLQJ�WKLV�ILOH�UHYHDOV�WKH�FRQVWDQWV�IRU�WKH�GLDORJ�WHPSODWH�LWVHOI��DV�

Page 166: Visual Basic - Subclassing and Hooking with VB & VB NET

ZHOO�DV�IRU�HDFK�FRQWURO�RQ�WKLV�GLDORJ��7KLV�LQIRUPDWLRQ�LV�SUHVHQWHG�DV�D�OLVW�RI��GHILQH�VWDWHPHQWV�LQ�WKH�UHVRXUFH�K�ILOH��7KH��GHILQHV�IRXQG�LQ�WKH�UHVRXUFH�K�ILOH�IRU�WKH�H[DPSOH�SUHVHQWHG�LQ�WKLV�FKDSWHU�DUH����GHILQH�,''B',$/2*���������������������������GHILQH�,'&B(',7������������������������������GHILQH�,'&B&+(&.�����������������������������GHILQH�,'&B%87721����������������������������GHILQH�,'&B&20%2����������������������������:H�QHHG�WR�FRS\�DOO�WKHVH��GHILQHV�DQG�DGG�WKHP�DV�&RQVW�VWDWHPHQWV�WR�RXU�0RGXOH��EDV�PRGXOH��7KH�9%�FRGH�ORRNV�VRPHWKLQJ�OLNH�WKLV���&RQVW�,''B',$/2*�� �����&RQVW�,'&B(',7�� ������&RQVW�,'&B&+(&.�� ������&RQVW�,'&B%87721�� ������&RQVW�,'&B&20%2�� ������7KH�,''B',$/2*��FRQVWDQW�LV�WKH�RQH�ZH�DUH�ORRNLQJ�IRU��7KLV�FRQVWDQW�LV�WKH�LGHQWLILHU�IRU�WKH�GLDORJ�WHPSODWH�UHVRXUFH�WKDW�ZH�ZDQW�WR�DGG�WR�WKH�FRPPRQ�GLDORJ�ER[��7KH�OS7HPSODWH1DPH�PHPEHU�QHHGV�WR�EH�VHW�HTXDO�WR�WKLV�FRQVWDQW�VR�WKDW�:LQGRZV�ZLOO�NQRZ�ZKLFK�GLDORJ�UHVRXUFH�LQ�WKH�DSSOLFDWLRQV�SURFHVV�VSDFH�WR�DGG�WR�WKH�GHIDXOW�FRPPRQ�GLDORJ�ER[��7KH�PLQLPXP�UHTXLUHPHQW�WR�DGG�D�GLDORJ�WHPSODWH�UHVRXUFH�WR�D�FRPPRQ�GLDORJ�LV�WR�VHW�WKH�2)1B(1$%/(7(03/$7(�IODJ�LQ�WKH�)ODJV�PHPEHU�RI�WKH�23(1),/(1$0(�VWUXFWXUH�DQG�DOVR�WR�VHW�WKH�OS7HPSODWH1DPH�PHPEHU�RI�WKLV�VDPH�VWUXFWXUH�WR�WKH�GLDORJ�WHPSODWH�UHVRXUFH�,'�IRXQG�LQ�WKH�UHVRXUFH�K�ILOH��2WKHUZLVH��DQ�HUURU�ZLOO�EH�UDLVHG�ZKHQ�WKH�V\VWHP�WULHV�WR�ILQG�D�YDOLG�GLDORJ�UHVRXUFH���7KH�ODVW�VWUXFWXUH�PHPEHU�,�ZDQW�WR�ORRN�DW�LV�QRW�UHTXLUHG�IRU�VXEFODVVLQJ�D�FRPPRQ�GLDORJ�ER[��EXW�LW�FDQ�EH�XVHIXO�LQ�VHQGLQJ�LQIRUPDWLRQ�EDFN�DQG�IRUWK�IURP�WKH�DSSOLFDWLRQ�WR�WKH�FRPPRQ�GLDORJ�ER[��7KLV�LV�WKH�O&XVW'DWD�PHPEHU��ZKLFK�FDQ�FRQWDLQ�GDWD�RI�W\SH�/RQJ�RU�D�SRLQWHU��7KH�UHDVRQ�,�DP�LQFOXGLQJ�LW�KHUH�LV�WKDW�WKLV�GDWD�LV�DYDLODEOH�WR�WKH�GLDORJ�KRRN�SURFHGXUH�ZKHQ�D�PHVVDJH�WKDW�WKH�KRRN�LQWHUFHSWV�FRQWDLQV�D�SRLQWHU�WR�WKLV�23(1),/(1$0(�VWUXFWXUH��7DNH��IRU�LQVWDQFH��WKH�&'1B,1,7'21(�PHVVDJH�WKDW�LV�VHQW�WR�WKH�GLDORJ�KRRN�SURFHGXUH�ZKHQ�LW�LV�ILQLVKHG�SODFLQJ�WKH�FRQWUROV�RQ�WKH�GLDORJ�ER[��7KLV�PHVVDJH�KDV�DQ�O3DUDP�SDUDPHWHU�WKDW�FRQWDLQV�D�SRLQWHU�WR�DQ�2)127,)<�VWUXFWXUH��7KH�2)127,)<�VWUXFWXUH�FRQWDLQV�D�SRLQWHU�WR�WKH�23(1),/(1$0(�VWUXFWXUH�ZLWKLQ�LWV�OS2)1�PHPEHU��7KH�GDWD�VDYHG�E\�WKH�DSSOLFDWLRQ�LQ�WKH�O&XVW'DWD�PHPEHU�RI�WKH�23(1),/(1$0(�VWUXFWXUH�LV�WKXV�DYDLODEOH�WR�WKH�GLDORJ�KRRN�SURFHGXUH�WKURXJK�WKLV�PHVVDJH��DV�ZHOO�DV�WKURXJK�DQ\�RWKHU�PHVVDJH�WKDW�KDV�D�SRLQWHU�WR�WKH�23(1),/(1$0(�VWUXFWXUH���7KH�PHPEHUV�RI�WKH�23(1),/(1$0(�VWUXFWXUH�DOVR�DUH�XSGDWHG�ZKHQ�FRQWUROV�UHWXUQ�IURP�WKH�*HW6DYH)LOH1DPH�IXQFWLRQ��7KH�O&XVW'DWD�PHPEHU�RI�WKLV�VWUXFWXUH�FDQ�EH�FKDQJHG�ZLWKLQ�WKH�GLDORJ�KRRN�SURFHGXUH��:KHQ�WKLV�VWUXFWXUH�LV�SDVVHG�EDFN�WR�WKH�FDOOLQJ�DSSOLFDWLRQ��LW�FDQ�UHWULHYH�DQ\�LQIRUPDWLRQ�WKDW�WKH�GLDORJ�KRRN�SURFHGXUH�KDV�SODFHG�WKHUH��

Page 167: Visual Basic - Subclassing and Hooking with VB & VB NET

7KLV�FDQ�EH�XVHIXO�LQ�VROYLQJ�WKH�SUREOHP�RI�SDVVLQJ�LQIRUPDWLRQ�EDFN�DQG�IRUWK�EHWZHHQ�WKH�PDLQ�DSSOLFDWLRQ�DQG�LWV�FRPPRQ�GLDORJ�ER[��DQG�HVSHFLDOO\�LWV�&DQFHO�EXWWRQ���

��������7KH�FRGH�IRU�WKH�0RGXOH��EDV�PRGXOH�

7KH�FRGH�IRU�WKLV�PRGXOH�LV�VKRZQ�LQ�([DPSOH������

([DPSOH������&RGH�IRU�WKH�0RGXOH��EDV�0RGXOH��

�����������������������������������������������&UHDWH�DQG�VXEFODVV�WKH�6DYH�$V����&RPPRQ�GLDORJ�ER[�����������������������������������������������6XE�6WDUW�2ZQHU+:QG�$V�/RQJ�����'LP�&RPPRQ'LDORJ6WUXFW�$V�2SHQ)LOHQDPH����'LP�5HW9DO�$V�/RQJ���������:LWK�&RPPRQ'LDORJ6WUXFW��������O6WUXFW6L]H� �/HQ�&RPPRQ'LDORJ6WUXFW���������KZQG2ZQHU� �2ZQHU+:QG��������OSIQ+RRN� �*HW$GGUHVV2I�$GGUHVV2I�6DYH$V3URF���������OS7HPSODWH1DPH� �,''B',$/2*���������OSVWU)LOWHU� ��$OO�)LOHV���&KU������� � ���&KU������&KU������������Q)LOWHU,QGH[� ����������OSVWU)LOH� �&KU������6SDFH�������������Q0D[)LOH� �/HQ��OSVWU)LOH�������������OSVWU7LWOH� ��([SRUW�$V��6XEFODVVHG�&RPPRQ�'LDORJ����������IODJV� �2)1B),/(0867(;,67�2U�B����������������2)1B6+2:+(/3�2U�B����������������2)1B(;3/25(5�2U�B����������������2)1B(1$%/(+22.�2U�B����������������2)1B(1$%/(7(03/$7(�2U�B����������������2)1B(1$%/(,1&/8'(127,)<��������K,QVWDQFH� �/RDG/LEUDU\�$SS�3DWK���?'OJ5HVB9%�GOO����������)ODJV([� ������(QG�:LWK���������5HW9DO� �*HW6DYH)LOH1DPH�&RPPRQ'LDORJ6WUXFW�����������

Page 168: Visual Basic - Subclassing and Hooking with VB & VB NET

���,I�5HW9DO� ���7KHQ�������0VJ%R[��7KH�&DQFHO�EXWWRQ�ZDV�FOLFNHG�����(OVH,I�5HW9DO� ���7KHQ�������0VJ%R[�7ULP�&RPPRQ'LDORJ6WUXFW�OSVWU)LOH�����(OVH�������HUURU�������0VJ%R[�&RPP'OJ([WHQGHG(UURU����(QG�,I�������������)UHH/LEUDU\��&RPPRQ'LDORJ6WUXFW�K,QVWDQFH��(QG�6XE��������������������������������������������������+HOSHU�IXQFWLRQV������������������������������������������������)XQFWLRQ�*HW$GGUHVV2I�%\9DO�3URF$GGU�$V�/RQJ��$V�/RQJ����*HW$GGUHVV2I� �3URF$GGU�(QG�)XQFWLRQ��3XEOLF�)XQFWLRQ�*HW+L:RUG�%\5HI�9DOXH�$V�/RQJ��$V�/RQJ����,I��9DOXH�$QG�+���������� �+���������7KHQ�������*HW+L:RUG� ���9DOXH�$QG�+�)))������?�+�������2U�+��������(OVH�������*HW+L:RUG� ��9DOXH�$QG�+))))������?�+���������(QG�,I�(QG�)XQFWLRQ��3XEOLF�)XQFWLRQ�*HW/R:RUG�%\5HI�9DOXH�$V�/RQJ��$V�/RQJ����*HW/R:RUG� ��9DOXH�$QG�+))))��(QG�)XQFWLRQ��������������������������������������������������7KH�6XEFODVV�3URFHGXUH������������������������������������������������3XEOLF�)XQFWLRQ�6DYH$V3URF�%\9DO�KZQG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B�����������������%\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�

Page 169: Visual Basic - Subclassing and Hooking with VB & VB NET

���'LP�10+6WUXFW�$V�10+'5����'LP�O&RQWH[W�$V�/RQJ����'LP�O7HPS�$V�/RQJ����'LP�O1RWLILFDWLRQ&RGH�$V�/RQJ����'LP�O&RQWURO,'�$V�/RQJ����'LP�K&WUO�$V�/RQJ����'LP�O5HW9DO�$V�/RQJ���������6DYH$V3URF� �����������6HOHFW�&DVH�X0VJ�������&DVH�:0B,1,7',$/2*����������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG�����:0B,1,7',$/2*���B��������������������������������YE1HZ/LQH����������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W���'LDORJ�PRGLILFDWLRQV�FDQ����B���������������������������������RFFXU�KHUH�EHIRUH�LW�LV�VKRZQ���YE1HZ/LQH����������'R(YHQWV�����������������������,QLW�WKH�FRPER�ER[�LWHPV����������K&WUO� �*HW'OJ,WHP�KZQG��,'&B&20%2������������O5HW9DO� �6HQG0HVVDJH6WU�K&WUO��&%B,16(57675,1*�������������������O5HW9DO� �6HQG0HVVDJH/RQJ�K&WUO��&%B6(7,7(0'$7$�����������������O5HW9DO� �6HQG0HVVDJH6WU�K&WUO��&%B,16(57675,1*�������������������O5HW9DO� �6HQG0HVVDJH/RQJ�K&WUO��&%B6(7,7(0'$7$�����������������O5HW9DO� �6HQG0HVVDJH6WU�K&WUO��&%B,16(57675,1*�������������������O5HW9DO� �6HQG0HVVDJH/RQJ�K&WUO��&%B6(7,7(0'$7$�����������������O5HW9DO� �6HQG0HVVDJH6WU�K&WUO��&%B,16(57675,1*�������������������O5HW9DO� �6HQG0HVVDJH/RQJ�K&WUO��&%B6(7,7(0'$7$�����������������O5HW9DO� �6HQG0HVVDJH/RQJ�K&WUO��&%B6(7&856(/���������������&DVH�:0B127,)<����������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W���:0B127,)<��!������������'R(YHQWV�����������&RS\0HPRU\�10+6WUXFW��%\9DO�O3DUDP��/HQ%�10+6WUXFW������������6HOHFW�&DVH�10+6WUXFW�FRGH�������������&DVH�&'1B,1&/8'(,7(0����������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B����������������������������������������&'1B,1&/8'(,7(0���YE1HZ/LQH����������������'R(YHQWV�

Page 170: Visual Basic - Subclassing and Hooking with VB & VB NET

������������&DVH�&'1B,1,7'21(����������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B����������������������������������������&'1B,1,7'21(���YE1HZ/LQH����������������'R(YHQWV�������������&DVH�&'1B6(/&+$1*(����������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B����������������������������������������&'1B6(/&+$1*(���YE1HZ/LQH����������������'R(YHQWV�������������&DVH�&'1B)2/'(5&+$1*(����������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B����������������������������������������&'1B)2/'(5&+$1*(���YE1HZ/LQH����������������'R(YHQWV�������������&DVH�&'1B+(/3�����������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B�����������������������������������������&'1B+(/3���YE1HZ/LQH����������������'R(YHQWV�������������&DVH�&'1B),/(2.����������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B����������������������������������������&'1B),/(2.���YE1HZ/LQH����������������'R(YHQWV�������������&DVH�&'1B6+$5(9,2/$7,21����������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B�����������������������������������������&'1B6+$5(9,2/$7,21���YE1HZ/LQH����������������'R(YHQWV�������������&DVH�&'1B7<3(&+$1*(����������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B����������������������������������������&'1B7<3(&+$1*(���YE1HZ/LQH����������������'R(YHQWV�������������&DVH�(OVH����������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B�������������������������������������������&6WU�X0VJ����������YE1HZ/LQH����������(QG�6HOHFW�������&DVH�:0B&200$1'����������O1RWLILFDWLRQ&RGH� �*HW+L:RUG�Z3DUDP�����������6HOHFW�&DVH�O1RWLILFDWLRQ&RGH�������������&DVH�(1B&+$1*(����������������O&RQWURO,'� �*HW/R:RUG�Z3DUDP�����������������6HOHFW�&DVH�O&RQWURO,'�������������������&DVH�,'&B(',7�����������������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG��B�

Page 171: Visual Basic - Subclassing and Hooking with VB & VB NET

������������������������������������,'&B(',7���!�(1B&+$1*('���YE1HZ/LQH����������������������'R(YHQWV����������������(QG�6HOHFW�������������&DVH�(1B.,//)2&86����������������O&RQWURO,'� �*HW/R:RUG�Z3DUDP�����������������6HOHFW�&DVH�O&RQWURO,'�������������������&DVH�,'&B(',7�����������������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B��������������������������������,'&B(',7���!�(1B.,//)2&86���YE1HZ/LQH����������������������'R(YHQWV����������������(QG�6HOHFW�������������&DVH�(1B6(7)2&86����������������O&RQWURO,'� �*HW/R:RUG�Z3DUDP�����������������6HOHFW�&DVH�O&RQWURO,'�������������������&DVH�,'&B(',7�����������������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B�������������������������������������,'&B(',7���!�(1B6(7)2&86���YE1HZ/LQH����������������������'R(YHQWV����������������(QG�6HOHFW�������������&DVH�%1B&/,&.('����������������O&RQWURO,'� �*HW/R:RUG�Z3DUDP�����������������6HOHFW�&DVH�O&RQWURO,'�������������������&DVH�,'&B%87721�����������������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B������������������������������������,'&B%87721���!�%1B&/,&.('���YE1HZ/LQH����������������������'R(YHQWV���������������������������������������������������$�PHVVDJH�ER[�LV�QRW�D�UHDOO\�JRRG�WKLQJ����������������������WR�KDYH�LQ�D�KRRN�IXQFWLRQ����������������������0VJ%R[��7KH�EXWWRQ�KDV�EHHQ�FOLFNHG���������������������&DVH�,'&B&+(&.�����������������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B��������������������������������,'&B&+(&.���!�%1B&/,&.('���YE1HZ/LQH����������������������'R(YHQWV���������������������������������������������������'R�VRPHWKLQJ�WR�WKH�8,����������������������,I�&%RRO�6HQG0HVVDJH/RQJ�O3DUDP��%0B*(7&+(&.���������7KHQ�������������������������K&WUO� �*HW'OJ,WHP�KZQG��,'&B(',7���������������������������&DOO�6KRZ:LQGRZ�K&WUO��6:B+,'(�����������������������������������

Page 172: Visual Basic - Subclassing and Hooking with VB & VB NET

������������������������K&WUO� �*HW'OJ,WHP�KZQG��,'&B&20%2���������������������������&DOO�6KRZ:LQGRZ�K&WUO��6:B6+2:�����������������������(OVH�������������������������K&WUO� �*HW'OJ,WHP�KZQG��,'&B&20%2���������������������������&DOO�6KRZ:LQGRZ�K&WUO��6:B+,'(�����������������������������������������������������������K&WUO� �*HW'OJ,WHP�KZQG��,'&B(',7���������������������������&DOO�6KRZ:LQGRZ�K&WUO��6:B6+2:�����������������������(QG�,I����������������(QG�6HOHFW�������������&DVH�&%1B&/26(83����������������O&RQWURO,'� �*HW/R:RUG�Z3DUDP�����������������6HOHFW�&DVH�O&RQWURO,'�������������&DVH�,'&B&20%2�����������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B���������������������������������,'&B&20%2���!�&%1B&/26(83���YE1HZ/LQH����������������'R(YHQWV����������(QG�6HOHFW�������&DVH�(OVH����������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��B��������������������������8QKDQGOHG�QRWLILFDWLRQ�PHVVDJH������YE1HZ/LQH����������'R(YHQWV�������(QG�6HOHFW�������&DVH�:0B'(6752<����������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B���������������������������������:0B'(6752<���YE1HZ/LQH�������&DVH�:0B1&'(6752<����������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B����������������������������������:0B1&'(6752<���YE1HZ/LQH����(QG�6HOHFW�(QG�)XQFWLRQ�7KH�6WDUW�SURFHGXUH�LQLWLDOL]HV�WKH�23(1),/(1$0(�VWUXFWXUH��FDOOV�WKH�:LQ���*HW6DYH)LOH1DPH�IXQFWLRQ��DQG�XQORDGV�WKH�UHVRXUFH�'//�DIWHU�WKH�VXEFODVVHG�FRPPRQ�GLDORJ�LV�FORVHG��7KH�6DYH$V3URF�SURFHGXUH�LV�WKH�GLDORJ�KRRN�SURFHGXUH��LQ�WKH�QH[W�VHFWLRQ��ZHOO�GLVFXVV�KRZ�WKH�GLDORJ�KRRN�SURFHGXUH�ZRUNV�DQG�KRZ�PHVVDJHV�DUH�SDVVHG�RQ�LW���

��������7KH�GLDORJ�KRRN�SURFHGXUH�

&DSWXULQJ�PHVVDJHV�IURP�WKH�GLDORJ�WHPSODWH�UHVRXUFH�LV�WKH�MRE�RI�WKH�GLDORJ�KRRN�SURFHGXUH��7KH�GLDORJ�KRRN�SURFHGXUH�LV�VLPLODU�WR�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�WKDW�ZH�

Page 173: Visual Basic - Subclassing and Hooking with VB & VB NET

GLVFXVVHG�LQ�WKH�HDUOLHU�FKDSWHUV��%XW�ZH�GR�QRW�FDOO�LW�D�VXEFODVVHG�GLDORJ�SURFHGXUH�EHFDXVH�D�VXEFODVVHG�GLDORJ�SURFHGXUH�FDSWXUHV�PHVVDJHV�ERXQG�IRU�D�GLDORJ�EHIRUH�WKH�GLDORJV�RULJLQDO�ZLQGRZ�SURFHGXUH�FDQ�SURFHVV�WKH�PHVVDJH��7KH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�WKHQ�SDVVHV�WKH�PHVVDJH�RQ�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�WKURXJK�WKH�&DOO:LQGRZ3URF�$3,�FDOO��7KH�GLDORJ�KRRN�SURFHGXUH�WKDW�ZH�ZLOO�XVH�LQ�WKLV�FKDSWHU�FDSWXUHV�PHVVDJHV�EHIRUH�WKH\�UHDFK�WKH�GLDORJ�SURFHGXUH�DQG�DIWHU�WKH\�KDYH�EHHQ�SURFHVVHG�E\�WKH�GLDORJ�SURFHGXUH��7KH�GLDORJ�KRRN�SURFHGXUH�ZLOO�FDSWXUH�QRWLILFDWLRQ�PHVVDJHV�VHQW�E\�WKH�FRPPRQ�GLDORJ�ER[�DQG�PHVVDJHV�IRU�WKH�FRQWUROV�DGGHG�WR�WKH�GLDORJ�WHPSODWH�UHVRXUFH���7KH�FRPGOJ���GOO�ILOH�ZLOO�KDQGOH�URXWLQJ�PHVVDJHV�WR�WKH�GHIDXOW�GLDORJ�SURFHGXUH�VR�WKDW�WKH�GLDORJ�KRRN�SURFHGXUH�ZLOO�QRW�KDYH�WR��,QVWHDG�RI�FDOOLQJ�DQ�$3,�IXQFWLRQ�WR�SDVV�WKH�PHVVDJH�RQ��DV�LW�ZRXOG�GR�LQ�D�VXEFODVVHG�ZLQGRZ�SURFHGXUH��WKH�GLDORJ�KRRN�SURFHGXUH�UHWXUQV�D�YDOXH�LQGLFDWLQJ�ZKHWKHU�LW�SURFHVVHG�WKH�PHVVDJH���+RRN�SURFHGXUH�QDPHV�IRU�HDFK�W\SH�RI�FRPPRQ�GLDORJ�ER[�DUH�OLVWHG�LQ�7DEOH������7KHVH�DUH�VWDQGDUG�QDPHV��\RX�FDQ�XVH�\RXU�RZQ�QDPHV�IRU�WKHVH�GLDORJ�KRRN�SURFHGXUHV�LI�\RX�ZDQW���

7DEOH������+RRN�3URFHGXUHV�IRU�(DFK�7\SH�RI�&RPPRQ�'LDORJ�%R[��&RPPRQ�'LDORJ�7\SH� +RRN�3URFHGXUH�1DPH��5HFRPPHQGHG��

&RORU� &&+RRN3URF�)LQG� )5+RRN3URF�5HSODFH� )5+RRN3URF�)RQW� &)+RRN3URF�2SHQ� 2)1+RRN3URF�6DYH�$V� 2)1+RRN3URF�3ULQW� 3ULQW+RRN3URF�3DJH�6HWXS� 3DJH6HWXS+RRN�RU�3DJH3DLQW+RRN��1RWH�LQ�7DEOH�����WKDW�WKH�3DJH�6HWXS�GLDORJ�ER[�LV�QRZ�XVHG�LQVWHDG�RI�WKH�RXWGDWHG�3ULQW�6HWXS�GLDORJ�ER[��$OVR��WKH�3DJH�6HWXS�FRPPRQ�GLDORJ�ER[�FDQ�KDYH�WZR�KRRNV��3DJH6HWXS+RRN�LV�WKH�GLDORJ�KRRN�SURFHGXUH�XVHG�WR�UHFHLYH�PHVVDJHV�IURP�WKH�FKLOG�GLDORJ�FRQWUROV�DQG�WR�UHFHLYH�QRWLILFDWLRQ�FRGHV�IURP�WKH�SDUHQW�GLDORJ��7KLV�KRRN�SURFHGXUH�LV�VLPLODU�WR�WKH�RWKHU�KRRN�SURFHGXUHV�OLVWHG�LQ�WKLV�WDEOH��7KH�3DJH3DLQW+RRN�SURFHGXUH�DOORZV�PRGLILFDWLRQV�WR�EH�PDGH�WR�WKH�VDPSOH�SDJH�REMHFW�IRXQG�LQ�WKH�3DJH�6HWXS�FRPPRQ�GLDORJ�ER[��:LWK�WKLV�VHFRQG�KRRN�SURFHGXUH��WKH�PHVVDJHV�WR�GUDZ�PDUJLQV��SDSHU�VL]HV��DQG�HQYHORSH�LWHPV�FDQ�EH�LQWHUFHSWHG�DQG�FKDQJHG���7KH�SDUHQW�GLDORJ�ER[�GRHV�QRW�VHQG�PHVVDJHV�RULJLQDWLQJ�IURP�WKH�GHIDXOW�FRQWUROV�WR�WKH�GLDORJ�KRRN�SURFHGXUH��,QVWHDG��QRWLILFDWLRQ�PHVVDJHV�DUH�VHQW�WR�WKH�GLDORJ�KRRN�SURFHGXUH�ZKLFK�DOORZ�LW�WR�JHW�LQIRUPDWLRQ�DERXW�D�VXEVHW�RI�WKH�XVHUV�DFWLRQV�ZLWKLQ�WKH�SDUHQW�GLDORJ�ER[��)RU�H[DPSOH��ZKHQ�WKH�XVHU�FKDQJHV�IROGHUV�LQ�DQ�2SHQ�FRPPRQ�GLDORJ�ER[��HYHU\�PRXVH�RU�NH\ERDUG�HYHQW�LV�QRW�SDVVHG�LQ�WR�WKH�GLDORJ�KRRN�SURFHGXUH��UDWKHU��D�QRWLILFDWLRQ�

Page 174: Visual Basic - Subclassing and Hooking with VB & VB NET

FRGH��&'1B)2/'(5&+$1*(��LV�VHQW�WR�WKH�KRRN�YLD�WKH�:0B127,)<�PHVVDJH�GHVFULEHG�VKRUWO\���7R�VHH�KRZ�PHVVDJLQJ�ZRUNV�LQ�D�VXEFODVVHG�FRPPRQ�GLDORJ�ER[��VHH�)LJXUH������,Q�WKLV�GLDJUDP��D�FRQWURO�RQ�WKH�FKLOG�GLDORJ�ZLOO�VHQG�D�QRWLILFDWLRQ�FRGH�ZUDSSHG�LQ�D�:0B&200$1'�PHVVDJH�WR�LWV�SDUHQW�������7KH�FKLOG�GLDORJ�WKHQ�SDVVHV�WKLV�:0B&200$1'�PHVVDJH�RQ�WR�WKH�GLDORJ�KRRN�SURFHGXUH�������7KH�GLDORJ�KRRN�SURFHGXUH�PLJKW�RU�PLJKW�QRW�SDVV�WKH�:0B&200$1'�PHVVDJH�RQ�WR�WKH�GHIDXOW�GLDORJ�SURFHGXUH�������GHSHQGLQJ�RQ�LWV�UHWXUQ�YDOXH���7KH�SDUHQW�GLDORJ�ER[�ZLOO�UHFHLYH�QRWLILFDWLRQV�IURP�LWV�FKLOG�FRQWUROV�������7KHVH�QRWLILFDWLRQV�JR�WR�WKH�GHIDXOW�GLDORJ�SURFHGXUH�������XQOHVV�WKH\�DUH�VSHFLDO�GLDORJ�KRRN�QRWLILFDWLRQ�FRGHV�ZUDSSHG�LQVLGH�D�:0B127,)<�PHVVDJH��7KHVH�PHVVDJHV�QHHG�WR�EH�VHQW�ILUVW�WR�WKH�GLDORJ�KRRN�SURFHGXUH�DQG�WKHQ�RQ�WR�WKH�GHIDXOW�GLDORJ�SURFHGXUH��������

)LJXUH������7KH�PHVVDJH�IORZ�EHWZHHQ�WKH�FKLOG�DQG�SDUHQW�GLDORJ�ER[HV�

:H�ZLOO�ZDQW�WR�LQWHUFHSW�DQG�SRVVLEO\�KDQGOH�IRXU�PDLQ�W\SHV�RI�PHVVDJHV�LQ�WKH�GLDORJ�KRRN�SURFHGXUH��7KHVH�DUH�LQLWLDOL]DWLRQ��QRWLILFDWLRQ��$FWLYH;�FRQWURO��DQG�VKXWGRZQ�PHVVDJHV��7KH\�DUH�H[SODLQHG�LQ�PRUH�GHWDLO�LQ�WKH�QH[W�IRXU�VHFWLRQV���

��������'LDORJ�LQLWLDOL]DWLRQ�

'LDORJ�LQLWLDOL]DWLRQ�LQYROYHV�ORDGLQJ�FRPER�ER[HV�DQG�OLVW�ER[HV�ZLWK�GHIDXOW�GDWD��SODFLQJ�FRQWUROV��VL]LQJ�FRQWUROV��DV�ZHOO�DV�H[HFXWLQJ�RWKHU�W\SHV�RI�LQLWLDOL]DWLRQV�WKDW�\RX�PLJKW�ZDQW�WR�SHUIRUP��<RX�FDQ�SHUIRUP�\RXU�LQLWLDOL]DWLRQV�DW�WZR�SRLQWV�LQ�WKH�GLDORJ�KRRN�SURFHGXUH��7KH�ILUVW�RFFXUV�ZKHQ�WKH�KRRN�SURFHGXUH�UHFHLYHV�WKH�:0B,1,7',$/2*�PHVVDJH��WKLV�LV�ZKHUH�,�FKRVH�WR�GR�WKH�LQLWLDOL]DWLRQV�LQ�([DPSOH������7KH�VHFRQG�LV�GXULQJ�WKH�&'1B,1,7'21(�QRWLILFDWLRQ��ZKLFK�LV�FRQWDLQHG�LQ�D�VWUXFWXUH�SRLQWHG�WR�E\�WKH�O3DUDP�SDUDPHWHU�RI�WKH�:0B127,)<�PHVVDJH��$V�D�QRWH��WKH�:0B,1,7',$/2*�PHVVDJH�LV�VHQW�ILUVW�WR�WKH�GHIDXOW�FRPPRQ�GLDORJ�ER[��WKH�SDUHQW���WKHQ�D�VHFRQG�VHSDUDWH�:0B,1,7',$/2*�PHVVDJH�LV�VHQW�WR�WKH�FKLOG�GLDORJ��7KH�SDUHQW�GLDORJ�ER[�ZLOO�DOZD\V�UHFHLYH�WKH�

Page 175: Visual Basic - Subclassing and Hooking with VB & VB NET

:0B,1,7',$/2*�PHVVDJH�EHIRUH�WKH�FKLOG�GLDORJ�UHFHLYHV�LWV�:0B,1,7',$/2*�PHVVDJH��$OVR��:0B,1,7',$/2*�LV�WKH�RQO\�PHVVDJH�WKDW�LV�SURFHVVHG�ILUVW�E\�WKH�GHIDXOW�GLDORJ�ER[�SURFHGXUH�DQG�WKHQ�VHQW�WR�WKH�GLDORJ�KRRN�SURFHGXUH��$OO�RWKHU�PHVVDJHV�ZLOO�EH�UHFHLYHG�E\�WKH�GLDORJ�KRRN�SURFHGXUH�ILUVW��7KH�KRRN�SURFHGXUH�WKHQ�GHFLGHV�ZKHWKHU�WR�SDVV�WKHP�RQ�WR�WKH�GHIDXOW�GLDORJ�SURFHGXUH���)LJXUH������GHVFULEHV�WKLV�SURFHVV��7KH�:0B,1,7',$/2*�PHVVDJH�LV�VHQW�ILUVW�WR�WKH�GHIDXOW�GLDORJ�SURFHGXUH�������$IWHU�WKH�GHIDXOW�GLDORJ�SURFHGXUH�LV�GRQH�LQLWLDOL]LQJ��LW�SDVVHV�WKH�:0B,1,7',$/2*�PHVVDJH�RQ�WR�WKH�KRRN�SURFHGXUH�������/DVWO\��WKH�&'1B,1,7'21(�QRWLILFDWLRQ�FRGH�LV�VHQW�WR�WKH�KRRN�SURFHGXUH�������7KH�&'1B,1,7'21(�QRWLILFDWLRQ�LV�VHQW�E\�WKH�FKLOG�GLDORJ�XSRQ�FRPSOHWLQJ�LWV�LQLWLDOL]DWLRQ���

)LJXUH�������7KH�LQLWLDOL]DWLRQ�PHVVDJLQJ�IORZ�LQ�D�VXEFODVVHG�FRPPRQ�GLDORJ�ER[�

:KHQ�GHFLGLQJ�ZKHUH�LQ�WKH�KRRN�SURFHGXUH�WR�SXW�\RXU�LQLWLDOL]DWLRQ�FRGH��FRQVLGHU�WKHVH�SRLQWV��7KH�:0B,1,7',$/2*�PHVVDJH�LV�VHQW�WR�WKH�KRRN�SURFHGXUH�EHIRUH�WKH�&'1B,1,7'21(�PHVVDJH��%RWK�PHVVDJHV�DUH�VHQW�WR�WKH�KRRN�SURFHGXUH�EHIRUH�WKH�GLDORJ�LV�GLVSOD\HG��7KH�&'1B,1,7'21(�LV�QRW�UHDOO\�D�PHVVDJH�LQ�DQG�RI�LWVHOI��LQVWHDG��LW�LV�D�QRWLILFDWLRQ�FRGH�WKDW�LV�FRQWDLQHG�ZLWKLQ�WKH�:0B127,)<�PHVVDJH�VHQW�WR�WKH�GLDORJ�KRRN�SURFHGXUH�LQIRUPLQJ�LW�RI�LWV�VWDWXV��7KLV�PHVVDJH�LV�DOVR�VSHFLILF�WR�WKH�([SORUHU�VW\OH�2SHQ�DQG�6DYH�$V�FRPPRQ�GLDORJ�ER[HV��,W�LV�QRW�VHQW�DV�D�QRWLILFDWLRQ�E\�DQ\�RWKHU�FRPPRQ�GLDORJ�ER[���$�YHU\�LPSRUWDQW�GLIIHUHQFH�EHWZHHQ�WKHVH�WZR�PHVVDJHV�LV�WKH�SRLQW�DW�ZKLFK�WKH�FRPPRQ�GLDORJ�ER[�LV�LQLWLDOO\�VL]HG��:KHQ�WKH�:0B,1,7',$/2*�PHVVDJH�LV�VHQW��WKH�FRPPRQ�GLDORJ�ER[�KDV�QRW�EHHQ�VL]HG�WR�DFFRPPRGDWH�WKH�QHZ�FRQWUROV�FRQWDLQHG�LQ�WKH�GLDORJ�WHPSODWH�UHVRXUFH��$IWHU�WKH�&'1B,1,7'21(�QRWLILFDWLRQ�LV�VHQW��WKH�FRPPRQ�GLDORJ�ER[�KDV�EHHQ�UHVL]HG�WR�LQFOXGH�WKH�QHZ�FRQWUROV�LQ�WKH�GLDORJ�WHPSODWH�UHVRXUFH��7KLV�GLIIHUHQFH�ZLOO�FRPH�LQ�KDQG\�ZKHQ�PRGLI\LQJ�WKH�VL]H�DQG�SRVLWLRQ�RI�WKH�FRPPRQ�GLDORJ�DQG�LWV�FRQWUROV�GXULQJ�LWV�FUHDWLRQ��$V�D�UXOH�RI�WKXPE��NHHS�FRGH�WR�UHVL]H�DQG�SRVLWLRQ�WKH�FRPPRQ�GLDORJ�ER[�LQ�WKH�&'1B,1,7'21(�QRWLILFDWLRQ���

Page 176: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�ILQDO�GLIIHUHQFH�EHWZHHQ�WKHVH�WZR�PHVVDJHV�LV�WKDW�WKH�UHWXUQ�YDOXH�IRU�WKH�GLDORJ�KRRN�SURFHGXUH�LV�LJQRUHG�ZKHQ�SURFHVVLQJ�WKH�&'1B,1,7'21(�QRWLILFDWLRQ��7KH�UHWXUQ�YDOXH�IRU�WKH�GLDORJ�KRRN�SURFHGXUH�LV�QRW�LJQRUHG�ZKHQ�SURFHVVLQJ�WKH�:0B,1,7',$/2*�PHVVDJH��7KH�UHWXUQ�YDOXH�IRU�WKH�GLDORJ�KRRN�SURFHGXUH�FDQ�EH�HLWKHU�758(�RU�)$/6(�IRU�WKLV�PHVVDJH��,I�LW�LV�)$/6(��WKH�NH\ERDUG�IRFXV�LV�VHW�WR�WKH�ILUVW�FRQWURO�LQ�WKH�WDE�RUGHU�RI�WKH�FRPPRQ�GLDORJ�ER[�WKDW�LV�YLVLEOH��HQDEOHG��DQG�KDV�WKH�:6B7$%6723�VW\OH��,I�LW�LV�)$/6(��WKH�NH\ERDUG�IRFXV�LV�VHW�WR�WKH�FRQWURO�WKDW�KDV�DQ�K:QG�YDOXH�HTXDO�WR�WKH�YDOXH�LQ�WKH�Z3DUDP�YDOXH�RI�WKLV�PHVVDJH��7KH�Z3DUDP�SDUDPHWHU�FRQWDLQV�WKH�K:QG�RI�WKH�FRQWURO�WKDW�LV�WR�UHFHLYH�NH\ERDUG�IRFXV�ZKHQ�WKH�FRPPRQ�GLDORJ�LV�GLVSOD\HG���&RPPRQ�DFWLRQV�SHUIRUPHG�LQ�WKH�GLDORJ�KRRN�SURFHGXUH�DUH�WR�TXHU\�DQG�PRGLI\�FRQWURO�SURSHUWLHV��)RU�WKLV��\RX�QHHG�WR�NQRZ�WKH�FRQWUROV�KDQGOH��7KLV�LV�D�IDLUO\�VLPSOH�WDVN��-XVW�XVH�WKH�*HW'OJ,WHP�$3,�IXQFWLRQ���3XEOLF�'HFODUH�)XQFWLRQ�*HW'OJ,WHP�/LE��XVHU����$OLDV��*HW'OJ,WHP��B�� � �%\9DO�K'OJ�$V�/RQJ��%\9DO�Q,''OJ,WHP�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��K'OJ

7KH�KDQGOH�WR�WKH�GLDORJ�ER[�ZKHUH�WKH�FRQWURO�LV�ORFDWHG��WKLV�LV�HLWKHU�WKH�GHIDXOW�FRPPRQ�GLDORJ�ER[�RU�WKH�FKLOG�GLDORJ�ER[���

Q,''OJ,WHP

7KH�,'�RI�WKH�FRQWURO�LQ�WKH�UHVRXUFH�ILOH���7KLV�$3,�IXQFWLRQ�UHWXUQV�WKH�KDQGOH�RI�WKH�FRQWURO�WKDW�\RX�VSHFLI\���7R�JHW�WKH�KDQGOH�RI�D�FRQWURO�\RX�ZDQW�WR�GHDO�ZLWK�RQ�WKH�FKLOG�GLDORJ�ER[��\RX�QHHG�WR�VHW�WKH�K'OJ�SDUDPHWHU�RI�WKLV�$3,�IXQFWLRQ�HTXDO�WR�WKH�KDQGOH�RI�WKH�FKLOG�GLDORJ�ER[��7KH�KDQGOH�IRU�WKH�FKLOG�GLDORJ�ER[�LV�VWRUHG�LQ�WKH�KZQG�SDUDPHWHU�SDVVHG�LQ�WR�WKH�GLDORJ�KRRN�IXQFWLRQ��7KH�VHFRQG�SDUDPHWHU��Q,''OJ,WHP��LV�WKH�,'�RI�WKH�FRQWURO�ZKRVH�KDQGOH�\RX�QHHG�WR�JHW��$�OLVW�RI�WKH�FKLOG�GLDORJ�ER[HV�FRQWURO�,'V�LV�IRXQG�LQ�WKH�UHVRXUFH�K�ILOH�FUHDWHG�HDUOLHU���7KLV�LV�ILQH�IRU�FRQWUROV�LQ�WKH�FKLOG�GLDORJ�ER[��EXW�ZKDW�LI�\RX�QHHG�WR�ILQG�D�FRQWUROV�KDQGOH�WKDW�LV�ORFDWHG�RQ�WKH�SDUHQW�GLDORJ�ER["�7R�GR�WKLV��ZH�QHHG�WR�XVH�WKH�*HW3DUHQW�$3,�IXQFWLRQ�EHIRUH�FDOOLQJ�*HW'OJ,WHP��*HW3DUHQW�LV�GHILQHG�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�*HW3DUHQW�/LE��XVHU����$OLDV��*HW3DUHQW��B�� � �%\9DO�KZQG�$V�/RQJ��$V�/RQJ�,WV�VLQJOH�SDUDPHWHU�LV��KZQG

7KH�KDQGOH�RI�WKH�FKLOG�ZLQGRZ�*HW3DUHQW�UHWXUQV�WKH�KDQGOH�RI�WKDW�FKLOGV�SDUHQW�ZLQGRZ��:H�WKHQ�XVH�WKLV�KDQGOH�LQ�WKH�K'OJ�SDUDPHWHU�RI�WKH�*HW'OJ,WHP�IXQFWLRQ��7KH�Q,''OJ,WHP�SDUDPHWHU�XVHV�D�SUHGHILQHG�YDOXH��7KH�SUHGHILQHG�FRQWURO�,'�YDOXHV�IRU�WKH�2SHQ�DQG�6DYH�$V�FRPPRQ�GLDORJ�ER[HV�DUH���3XEOLF�&RQVW�FK[�� �+�����������5HDG�RQO\�FKHFNER[�3XEOLF�&RQVW�FPE�� �+�����������)LOH�W\SH�ILOWHUV�GURS�GRZQ�FRPER�ER[�3XEOLF�&RQVW�FPE�� �+�����������&XUUHQW�GULYH�DQG�IROGHU�GURS�GRZQ�FRPER�ER[�

Page 177: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�&RQVW�FPE��� �+��&�������&XUUHQW�VHOHFWHG�ILOH�GURS�GRZQ�FRPER�ER[�������������������������������������8VHG�IRU�:LQGRZV�������3XEOLF�&RQVW�HGW�� �+�����������&XUUHQW�VHOHFWHG�ILOH�HGLW�ER[��������������������������������������8VHG�LQ�SUHYLRXV�YHUVLRQV�RI�:LQGRZV��3XEOLF�&RQVW�OVW�� �+�����������'LVSOD\V�FRQWHQWV�RI�WKH�VHOHFWHG�GULYH�RU�������������������������������������IROGHU��WKLV�LV�D�OLVW�ER[�3XEOLF�&RQVW�VWF�� �+�����������/DEHO�IRU�OVW��FRQWURO�3XEOLF�&RQVW�VWF�� �+�����������/DEHO�IRU�FPE��FRQWURO�3XEOLF�&RQVW�VWF�� �+�����������/DEHO�IRU�HGW��FRQWURO�3XEOLF�&RQVW�VWF�� �+�����������/DEHO�IRU�FPE��FRQWURO�3XEOLF�&RQVW�,'2.� ��������������7KH�GHIDXOW�GLDORJ�2.�EXWWRQ��������������������������������������ZLOO�QRW�KDYH�2.�LQ�LWV�FDSWLRQ��3XEOLF�&RQVW�,'&$1&(/� ����������7KH�GLDORJ�FDQFHO�EXWWRQ�3XEOLF�&RQVW�SVK+HOS� �SVK�������7KH�GLDORJ�KHOS�EXWWRQ�$GGLWLRQDO�FRQWURO�,'V�QRW�OLVWHG�KHUH�DUH�XVHG�LQ�WKH�RWKHU�W\SHV�RI�FRPPRQ�GLDORJ�ER[HV��8VLQJ�6S\����ZH�FDQ�ILQG�WKH�FRQWURO�,'V�IRU�WKHVH�RWKHU�FRPPRQ�GLDORJ�FRQWUROV��7KH�YDOXHV�IRU�DOO�FRPPRQ�GLDORJ�ER[�FRQWUROV�DOVR�FDQ�EH�IRXQG�LQ�WKH�'OJV�K�KHDGHU�ILOH���

�7R�ILQG�D�FRQWURO�,'�ZLWK�6S\����RSHQ�DQ�LQVWDQFH�RI�WKH�FRPPRQ�GLDORJ�ER[�DQG�ILQG�LW�LQ�WKH�:LQGRZV�OLVW�LQ�6S\����)LQG�WKH�FRQWURO�WR�ZKLFK�\RX�QHHG�WR�JHW�DQ�,'�DQG�GRXEOH�FOLFN�LW��7KH�:LQGRZ�3URSHUWLHV�GLDORJ�ER[�ZLOO�DSSHDU��/RFDWH�WKH�&RQWURO�,'�ILHOG�RQ�WKH�*HQHUDO�WDE��7KLV�LV�WKH�KLJKOLJKWHG�FRQWUROV�,'��7KH�&RQWURO�,'�ILHOG�LV�YLVLEOH�RQO\�IRU�FRQWUROV��QRW�IRU�RWKHU�W\SHV�RI�ZLQGRZV��1RWH�WKDW�WKHVH�FRQVWDQWV�FRXOG�FKDQJH�LQ�IXWXUH�UHOHDVHV�RI�WKH�:LQGRZV�RSHUDWLQJ�V\VWHP��7KLV�FRXOG�FDXVH�FRPSDWLELOLW\�LVVXHV�IRU�\RXU�DSSOLFDWLRQ�LQ�WKH�IXWXUH����

$IWHU�ZH�KDYH�WKH�KDQGOH�WR�WKH�FRQWURO�WKDW�ZH�DUH�LQWHUHVWHG�LQ��ZH�FDQ�XVH�WKH�6HQG0HVVDJH��6HQG0HVVDJH6WU��RU�6HQG0HVVDJH/RQJ�$3,�IXQFWLRQV�WR�VHQG�PHVVDJHV�WR�WKRVH�FRQWUROV��6RPH�RI�WKH�PHVVDJHV�WKDW�ZH�FDQ�VHQG��ZKLFK�DUH�VSHFLILF�WR�WKH�FRPPRQ�GLDORJ�ER[HV��DUH���,QLWLDO�9DOXHV�3XEOLF�&RQVW�:0B86(5� �+����3XEOLF�&RQVW�&'0B),567� ��:0B86(5���������*HWV�WKH�IXOO�SDWK�DQG�QDPH�RI�WKH�VHOHFWHG�ILOH�3XEOLF�&RQVW�&'0B*(7),/(3$7+� ��&'0B),567���+���

Page 178: Visual Basic - Subclassing and Hooking with VB & VB NET

�*HWV�WKH�OLVW�RI�LWHP�,'V�IRU�WKH�FXUUHQW�IROGHU�3XEOLF�&RQVW�&'0B*(7)2/'(5,'/,67� ��&'0B),567���+����*HWV�WKH�FXUUHQW�SDWK�RQ�WKH�VHOHFWHG�IROGHU�3XEOLF�&RQVW�&'0B*(7)2/'(53$7+� ��&'0B),567���+����*HWV�RQO\�WKH�QDPH�RI�WKH�VHOHFWHG�ILOH�DQG�LWV�H[WHQVLRQ�3XEOLF�&RQVW�&'0B*(763(&� ��&'0B),567���+����$OORZV�D�FRQWURO�WR�EH�KLGGHQ�3XEOLF�&RQVW�&'0B+,'(&21752/� ��&'0B),567���+����$OORZV�WH[W�LQ�D�FRQWURO�WR�EH�FKDQJHG�3XEOLF�&RQVW�&'0B6(7&21752/7(;7� ��&'0B),567���+����$OORZV�WKH�GHIDXOW�ILOH�QDPH�H[WHQVLRQ�WR�EH�VHW�3XEOLF�&RQVW�&'0B6(7'()(;7� ��&'0B),567���+���0RVW�RI�WKHVH�PHVVDJHV�DUH�XVHIXO�RQO\�LQ�WKH�2SHQ�DQG�6DYH�$V�FRPPRQ�GLDORJ�ER[HV���2WKHU�FRQWURO�VSHFLILF�PHVVDJHV�FDQ�EH�VHQW�DV�ZHOO��)RU�WKH�OLVW�RI�PHVVDJHV�VSHFLILF�WR�D�FRQWURO��VHH�WKH�0LFURVRIW�3ODWIRUP�6RIWZDUH�'HYHORSPHQW�.LW��6'.��GRFXPHQWDWLRQ�LQ�WKH�06'1���

��������3URFHVVLQJ�GLDORJ�ER[�QRWLILFDWLRQ�PHVVDJHV�

7KH�SDUHQW�FRPPRQ�GLDORJ�LV�DEOH�WR�VHQG�VHYHUDO�GLIIHUHQW�QRWLILFDWLRQ�PHVVDJHV�WR�LWV�KRRN�SURFHGXUH�LQGLFDWLQJ�WKDW�DQ�DFWLRQ�KDV�RFFXUUHG��7KHVH�QRWLILFDWLRQ�PHVVDJHV�DUH�FRQWDLQHG�LQ�D�:0B127,)<�PHVVDJH�WKDW�KDV�LQIRUPDWLRQ�LQ�ERWK�LWV�O3DUDP�DQG�Z3DUDP�SDUDPHWHUV��7KH�O3DUDP�SDUDPHWHU�FRQWDLQV�WKH�,'�RI�WKH�FRQWURO�WKDW�LV�VHQGLQJ�WKLV�PHVVDJH�WR�LWV�SDUHQW��7KH�FRQWURO�,'V�FDQ�EH�IRXQG�LQ�WKH�5HVRXUFH�K�ILOH�IRU�RXU�GLDORJ�WHPSODWH�UHVRXUFH��7KH�Z3DUDP�SDUDPHWHU�FRQWDLQV�D�SRLQWHU�WR�D�10+'5�VWUXFWXUH��7KH�10+'5�VWUXFWXUH�LV�GHILQHG�LQ�9%�DV�IROORZV���3ULYDWH�7\SH�10+'5�����KZQG)URP�$V�/RQJ�����LGIURP�$V�/RQJ�����FRGH�$V�/RQJ�(QG�7\SH�,WV�PHPEHUV�DUH��KZQG)URP

7KH�KDQGOH�WR�WKH�FRQWURO�VHQGLQJ�WKLV�QRWLILFDWLRQ�PHVVDJH�

Page 179: Visual Basic - Subclassing and Hooking with VB & VB NET

LGIURP

7KH�LGHQWLILHU�RI�WKH�FRQWURO�VHQGLQJ�WKLV�QRWLILFDWLRQ�PHVVDJH�FRGH

$�FRGH�LGHQWLI\LQJ�WKH�W\SH�RI�QRWLILFDWLRQ�

� 7KH�Z3DUDP�SDUDPHWHU�FRQWDLQV�WKH�FRQWURO�,'�RI�WKH�FRQWURO�WKDW�VHQW�WKH�PHVVDJH��7KH�0LFURVRIW�GRFXPHQWDWLRQ�VWDWHV�WKDW�WKH�FRQWURO�,'�LQ�WKLV�SDUDPHWHU�LV�QRW�JXDUDQWHHG�WR�EH�XQLTXH��LQVWHDG��XVH�WKH�KZQG)URP�RU�LGIURP�YDOXHV�IRXQG�LQ�WKH�10+'5�VWUXFWXUH�SRLQWHG�WR�E\�WKH�O3DUDP�SDUDPHWHU�RI�WKLV�PHVVDJH����

&RPPRQ�GLDORJ�ER[HV�FDQ�VHQG�VHYHUDO�GLIIHUHQW�W\SHV�RI�QRWLILFDWLRQ�FRGHV��%HFDXVH�WKH�GLDORJ�ER[�FRQWUROV�WKHPVHOYHV�FDQQRW�VHQG�QRWLILFDWLRQ�PHVVDJHV�WR�WKH�KRRN�SURFHGXUH��WKH�FRPPRQ�GLDORJ�ER[�KDV�D�VHW�RI�WKHVH�QRWLILFDWLRQ�PHVVDJHV�WKDW�LW�FDQ�VHQG�WR�WKH�KRRN�SURFHGXUH��(DFK�FRGH�LV�GHILQHG�EHORZ���CDN_FILEOK

7KH�XVHU�KDV�VHOHFWHG�DQ�LWHP�DQG�WKHQ�FOLFNHG�WKH�2.�EXWWRQ��ZKLFK�LV�DFWXDOO\�WKH�GHIDXOW�EXWWRQ�RI�WKH�FRPPRQ�GLDORJ�ER[���RU�GRXEOH�FOLFNHG�D�ILOH�LQ�WKH�OLVWYLHZ�FRQWURO���

CDN_FOLDERCHANGE

7KH�XVHU�KDV�PRYHG�WR�D�GLIIHUHQW�IROGHU���CDN_HELP

7KH�GLDORJ�+HOS�EXWWRQ�ZDV�FOLFNHG���CDN_INCLUDEITEM

�:LQGRZV������RQO\���,I�WKH�2)1B(1$%/(,1&/8'(127,)<�IODJ�ZDV�VHW�LQ�WKH�23(1),/(1$0(�VWUXFWXUH��WKLV�QRWLILFDWLRQ�LV�VHQW�WR�WKH�GLDORJ�KRRN�SURFHGXUH�RQFH�IRU�HYHU\�IROGHU�DQG�ILOH�GLVSOD\HG�LQ�WKH�2SHQ�RU�6DYH�$V�FRPPRQ�GLDORJ�ER[��5HWXUQLQJ�D�QRQ]HUR�YDOXH�IURP�WKH�GLDORJ�KRRN�SURFHGXUH�IRU�WKLV�PHVVDJH�SUHYHQWV�WKH�GLDORJ�IURP�GLVSOD\LQJ�WKDW�ILOH�RU�IROGHU��UHWXUQLQJ�D�]HUR�DOORZV�WKH�ILOH�RU�IROGHU�WR�EH�GLVSOD\HG��7KLV�QRWLILFDWLRQ�ZLOO�EH�VHQW�LQ�:LQGRZV����DQG�:LQGRZV�17��EXW�UHWXUQLQJ�HLWKHU�D�]HUR�RU�QRQ]HUR�YDOXH�ZLOO�KDYH�QR�HIIHFW���

CDN_INITDONE

7KLV�QRWLILFDWLRQ�LV�VHQW�XSRQ�FRPSOHWLRQ�RI�WKH�:0B,1,7',$/2*�PHVVDJH�WKDW�LV�VHQW�WR�WKLV�FKLOG�GLDORJ�ER[��:KHQ�WKLV�QRWLILFDWLRQ�PHVVDJH�KDV�EHHQ�VHQW��DOO�WKH�FRQWUROV�ZLOO�EH�SODFHG�RQ�WKH�FRPPRQ�GLDORJ�DQG�WKH�GLDORJ�ZLOO�EH�VHW�WR�LWV�ILQDO�VL]H��$W�WKLV�SRLQW��WKH�V\VWHP�LV�GRQH�SODFLQJ�DQG�VL]LQJ�WKH�FRQWUROV�DV�ZHOO�DV�WKH�GLDORJ��DQG�\RX�FDQ�VDIHO\�UHDUUDQJH�DQG�VL]H�WKH�FRQWUROV�DQG�WKH�GLDORJ�LWVHOI���

CDN_SELCHANGE

7KLV�QRWLILFDWLRQ�LV�VHQW�ZKHQHYHU�D�XVHU�FKDQJHV�WKH�FXUUHQW�VHOHFWLRQ�LQ�WKH�OLVWYLHZ�FRQWURO���

CDN_SHAREVIOLATION

Page 180: Visual Basic - Subclassing and Hooking with VB & VB NET

,I�WKH�2.�EXWWRQ�LV�FOLFNHG�DQG�D�VKDULQJ�YLRODWLRQ�RFFXUV�RQ�WKLV�ILOH��WKLV�QRWLILFDWLRQ�LV�VHQW��7R�SUHYHQW�DQ�HUURU�DQG�WR�IRUFH�WKH�FRPPRQ�GLDORJ�ER[�WR�UHWXUQ�WKH�ORFNHG�ILOH��VLPSO\�UHWXUQ�D�QRQ]HUR�YDOXH�IRU�WKH�GLDORJ�KRRN�SURFHGXUH���

CDN_TYPECHANGE

7KLV�QRWLILFDWLRQ�LV�VHQW�ZKHQ�WKH�XVHU�FKDQJHV�WKH�ILOH�FXUUHQWO\�VHOHFWHG�WR�D�ILOH�RI�D�GLIIHUHQW�W\SH��6ZLWFKLQJ�VHOHFWLRQ�EHWZHHQ�ILOHV�RI�WKH�VDPH�W\SH�ZLOO�QRW�IRUFH�WKLV�QRWLILFDWLRQ�WR�EH�VHQW���

7KH�VRXUFH�RI�WKHVH�QRWLILFDWLRQ�PHVVDJHV�LV�DSSDUHQW�IURP�WKH�SUHIL[�DSSOLHG�WR�WKH�QRWLILFDWLRQ�FRGH�QDPH��7KH�&'1�SUHIL[�WHOOV�\RX�WKDW�WKHVH�PHVVDJHV�DUH�&RPPRQ�'LDORJ�1RWLILFDWLRQ�PHVVDJHV��7KH�LQGLYLGXDO�FRQWUROV�GR�QRW�VHQG�WKHVH�QRWLILFDWLRQ�PHVVDJHV��2QO\�WKH�GLDORJ�LWVHOI�VHQGV�WKHVH�PHVVDJHV���$V�\RX�PLJKW�KDYH�QRWLFHG��VRPH�RI�WKHVH�QRWLILFDWLRQ�FRGHV�ZLOO�EH�VHQW�RQO\�IURP�WKH�2SHQ�RU�6DYH�$V�FRPPRQ�GLDORJ�ER[HV��,I�\RX�DUH�H[SHFWLQJ�D�QRWLILFDWLRQ�IURP�WKH�GLDORJ�ER[�DQG�\RX�DUH�QRW�UHFHLYLQJ�RQH��PDNH�VXUH�WKDW�WKH�FRUUHFW�IODJV�KDYH�EHHQ�VHW�LQ�WKH�)ODJV�PHPEHU�RI�WKH�23(1),/(1$0(�VWUXFWXUH��7KH�2)1B(;3/25(5�IODJ�LV�UHTXLUHG�WR�DOORZ�QRWLILFDWLRQV�WR�EH�VHQW�IURP�([SORUHU�6W\OH�2SHQ�DQG�6DYH�$V�GLDORJ�ER[HV���7R�DFFHVV�WKH�10+'5�VWUXFWXUH�LQ�9%��\RX�ZLOO�QHHG�WR�XVH�WKH�&RS\0HPRU\�$3,�IXQFWLRQ��7KH�IROORZLQJ�FRGH�IUDJPHQW�XVHV�WKH�&RS\0HPRU\�IXQFWLRQ�WR�FRS\�WKH�VWUXFWXUH�SRLQWHG�WR�E\�WKH�O3DUDP�SDUDPHWHU�LQWR�WKH�10+'5�VWUXFWXUH�GHILQHG�LQ�9%���'LP�XGW10�$V�10+'5�&RS\0HPRU\�XGW10��%\9DO�O3DUDP��/HQ%�10+'5��

��������3URFHVVLQJ�PHVVDJHV�IURP�WKH�FRQWUROV�RQ�WKH�FKLOG�GLDORJ�ER[�

,I�\RX�SODFH�QHZ�FRQWUROV�RQ�WKH�FRPPRQ�GLDORJ�YLD�WKH�GLDORJ�WHPSODWH�UHVRXUFH��REYLRXVO\�\RX�ZLOO�ZDQW�WR�EH�DEOH�WR�PDNH�WKHP�GR�VRPHWKLQJ��7R�PDNH�WKH�FRQWUROV�IXQFWLRQ��ZH�QHHG�WR�EH�DEOH�WR�FDWFK�PHVVDJHV�WKDW�WKH\�VHQG��VXFK�DV�WKH�EXWWRQ�FOLFN�PHVVDJH��%1B&/,&.���7R�FDWFK�PHVVDJHV�VXFK�DV�WKHVH��ZH�QHHG�WR�ZDWFK�IRU�WKH�:0B&200$1'�PHVVDJH�LQ�WKH�GLDORJ�KRRN�SURFHGXUH��7KH�Z3DUDP�SDUDPHWHU�RI�WKH�:0B&200$1'�PHVVDJH�FRQWDLQV�WZR�SLHFHV�RI�LQIRUPDWLRQ��7KH�QRWLILFDWLRQ�FRGH�LV�FRQWDLQHG�LQ�WKH�KLJK�RUGHU�ZRUG�RI�WKH�Z3DUDP�SDUDPHWHU��7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�FRQWUROV�,'��7KH�FRQWURO�,'V�DUH�VSHFLILHG�LQ�WKH�&���UHVRXUFH�K�KHDGHU�ILOH�WKDW�ZH�FUHDWHG�DW�WKH�EHJLQQLQJ�RI�WKLV�FKDSWHU��7KH�O3DUDP�SDUDPHWHU�FRQWDLQV�WKH�K:QG�RI�WKH�FRQWURO�WKDW�VHQW�WKLV�PHVVDJH��,I�D�FRQWURO�GLG�QRW�VHQG�WKLV�PHVVDJH��WKLV�SDUDPHWHU�LV�18//���

([WUDFWLQJ�WKH�+LJK��DQG�/RZ�2UGHU�:RUGV�7R�JHW�WKH�KLJK�RUGHU�ZRUG�RI�WKH�Z3DUDP�SDUDPHWHU��MXVW�PDVN�RII�LWV�ORZ�RUGHU�ZRUG��<RX�PXVW�GHWHUPLQH�LI�WKH�VLJQ�ELW�LV�VHW��WKH�VLJQ�ELW�GHWHUPLQHV�WKH�PHWKRG�XVHG�WR�PDVN�RII�WKH�ORZ�RUGHU�ZRUG��7R�

Page 181: Visual Basic - Subclassing and Hooking with VB & VB NET

GHWHUPLQH�WKH�YDOXH�RI�WKH�VLJQ�ELW��VLPSO\�$1'�WKH�YDOXH�ZLWK�+����������7KH�FRGH�XVHG�WR�GR�WKLV�LV���3XEOLF�)XQFWLRQ�*HW+L:RUG�%\5HI�9DOXH�$V�/RQJ��$V�/RQJ����,I��9DOXH�$QG�+���������� �+���������7KHQ��������*HW+L:RUG� ���9DOXH�$QG�+�)))������?�+�������2U�+��������(OVH��������*HW+L:RUG� ��9DOXH�$QG�+))))������?�+���������(QG�,I�(QG�)XQFWLRQ�7R�JHW�WKH�ORZ�RUGHU�ZRUG�RI�Z3DUDP��WKH�KLJK�RUGHU�ZRUG�PXVW�EH�PDVNHG�RII��7KH�VLJQ�ELW�GRHV�QRW�KDYH�DQ\�EHDULQJ�RQ�WKLV�IXQFWLRQ��7KH�FRGH�WKDW�DFFRPSOLVKHV�WKLV�LV���3XEOLF�)XQFWLRQ�*HW/R:RUG�%\5HI�9DOXH�$V�/RQJ��$V�/RQJ�����*HW/R:RUG� ��9DOXH�$QG�+))))��(QG�)XQFWLRQ�:KHQ�DQ�DFWLRQ�LV�SHUIRUPHG�RQ�D�FRQWURO�LQ�WKH�FKLOG�GLDORJ�ER[��PHVVDJHV�DUH�URXWHG�LQ�WKH�PDQQHU�LOOXVWUDWHG�HDUOLHU�LQ�)LJXUH������)RU�H[DPSOH��LI�WKH�XVHU�FOLFNV�D�EXWWRQ�WKDW�ZDV�DGGHG�WR�WKH�FKLOG�GLDORJ�ER[���

��� 7KH�EXWWRQ�QRWLILHV�LWV�SDUHQW��ZKLFK�LV�WKH�FKLOG�GLDORJ�FUHDWHG�IURP�WKH�GLDORJ�WHPSODWH�UHVRXUFH��WKDW�LW�KDV�EHHQ�FOLFNHG��7KLV�QRWLILFDWLRQ�LV�SDFNDJHG�LQ�D�:0B&200$1'�PHVVDJH��QRW�WKH�:0B127,)<�PHVVDJH�XVHG�IRU�SDUHQW�GLDORJ�FRQWURO�QRWLILFDWLRQV���

��� 7KH�GLDORJ�KRRN�SURFHGXUH�UHFHLYHV�WKH�QRWLILFDWLRQ�PHVVDJH�SDFNDJHG�LQ�D�:0B&200$1'�PHVVDJH���

��� 7KH�GLDORJ�KRRN�SURFHGXUH�XVHV�WKH�KLJK�RUGHU�ZRUG�RI�WKH�Z3DUDP�SDUDPHWHU�WR�JHW�WKH�QRWLILFDWLRQ�FRGH��7KLV�FRGH�LV�SURFHVVHG�LQ�D�6HOHFW�&DVH�VWDWHPHQW���

��� 7KH�ORZ�RUGHU�ZRUG�RI�WKH�Z3DUDP�SDUDPHWHU�LV�XVHG�WR�JHW�WKH�,'�RI�WKH�FRQWURO��7KLV�,'�DOVR�LV�SURFHVVHG�LQ�D�6HOHFW�&DVH�VWDWHPHQW�ZKLFK�LV�QHVWHG�ZLWKLQ�WKH�SUHYLRXV�6HOHFW�&DVH�VWDWHPHQW���

��� $IWHU�WKH�GLDORJ�KRRN�SURFHGXUH�LV�ILQLVKHG�SURFHVVLQJ�WKLV�PHVVDJH��LW�FDQ�VHQG�LW�RQ�WR�WKH�GHIDXOW�GLDORJ�SURFHGXUH�E\�UHWXUQLQJ�D�]HUR���

7KH�PRVW�FRPPRQ�ZD\�RI�UHVSRQGLQJ�WR�WKH�FRQWUROV�WKDW�KDYH�EHHQ�DGGHG�WR�WKH�FRPPRQ�GLDORJ�ER[�LV�WR�VHW�XS�QHVWHG�6HOHFW�&DVH�VWDWHPHQWV��7KH�FRGH�XVHG�LQ�WKH�H[DPSOH�IRU�WKLV�FKDSWHU�ORRNV�VLPLODU�WR�WKH�RXWOLQH�RI�D�6HOHFW�&DVH�VWDWHPHQW�VKRZQ�KHUH���6HOHFW�&DVH�X0VJ�� &DVH�:0B&200$1'�� ����O1RWLILFDWLRQ&RGH� �*HWB+L:RUG�Z3DUDP��

Page 182: Visual Basic - Subclassing and Hooking with VB & VB NET

� ����6HOHFW�&DVH�O1RWLILFDWLRQ&RGH�� � &DVH�%1B&/,&.('�� � ����O&RQWURO,'� �*HWB/R:RUG�Z3DUDP��� � ����6HOHFW�&DVH�O&RQWURO,'�� � � &DVH�,'&B%87721��� � � ����'R�EXWWRQ�FOLFN�ZRUN�KHUH�� � ����(QG�6HOHFW�� ����(QG�6HOHFW�(QG�6HOHFW�7KH�RXWHU�6HOHFW�&DVH�VWDWHPHQW�ZLOO�WHVW�IRU�WKH�:0B&200$1'�PHVVDJH�EHLQJ�VHQW�LQ�WKH�X0VJ�SDUDPHWHU�RI�WKH�GLDORJ�KRRN�SURFHGXUH��7KH�ILUVW�QHVWHG�6HOHFW�&DVH�VWDWHPHQW�ZLOO�WHVW�WKH�KLJK�RUGHU�ZRUG�RI�Z3DUDP�IRU�VSHFLILF�QRWLILFDWLRQ�FRGHV��%1B&/,&.('�LQ�WKH�FRGH�DERYH���7KHQ�WKH�LQQHUPRVW�QHVWHG�6HOHFW�&DVH�VWDWHPHQW�ZLOO�WHVW�IRU�D�VSHFLILF�FRQWURO�,'��WKLV�LV�,'&B%87721��LQ�WKH�SUHYLRXV�FRGH���7KH�FRQWURO�,'�LV�REWDLQHG�IURP�WKH�ORZ�RUGHU�ZRUG�RI�WKH�Z3DUDP�SDUDPHWHU�IRU�WKH�PHVVDJH��1RZ�WKH�FRQWURO�FDQ�GR�VRPHWKLQJ�LQ�UHVSRQVH�WR�WKH�QRWLILFDWLRQ�PHVVDJH��7R�GHWHUPLQH�ZKLFK�QRWLILFDWLRQ�PHVVDJHV�FDQ�EH�VHQW�E\�D�SDUWLFXODU�FRQWURO��VHH�WKH�0LFURVRIW�3ODWIRUP�6'.�GRFXPHQWDWLRQ���7KH�GHIDXOW�FRQWUROV�RQ�WKH�SDUHQW�GLDORJ�DOVR�KDYH�FRQWURO�,'V��WKHVH�ZHUH�OLVWHG�HDUOLHU�LQ�WKLV�FKDSWHU���7U\LQJ�WR�LQWHUFHSW�PHVVDJHV�VHQW�IURP�WKHVH�GHIDXOW�FRQWUROV�GRHV�QRW�ZRUN�EHFDXVH�WKRVH�PHVVDJHV�DUH�VHQW�VWUDLJKW�WR�WKH�GLDORJ�SURFHGXUH�DQG�QRW�WR�RXU�GLDORJ�KRRN�SURFHGXUH���

��������3URFHVVLQJ�WKH�GLDORJ�VKXWGRZQ�PHVVDJHV�

:H�FDQ�VKXW�GRZQ�WKH�GLDORJ�HLWKHU�E\�IRUFLQJ�LW�WR�FORVH�XVLQJ�$OW�)���E\�XVLQJ�WKH�&ORVH�EXWWRQ�RQ�WKH�GLDORJ�WLWOHEDU��E\�FOLFNLQJ�WKH�2.�EXWWRQ��RU�E\�FOLFNLQJ�WKH�&DQFHO�EXWWRQ��:KHQ�WKH�XVHU�FORVHV�WKH�GLDORJ��WZR�PHVVDJHV�DSSHDU�WKDW�\RX�FDQ�LQWHUFHSW�LQ�WKH�GLDORJ�KRRN�SURFHGXUH��:0B'(6752<�DQG�:0B1&'(6752<��7KH�:0B'(6752<�PHVVDJH�LV�VHQW�WR�WKH�GLDORJ�ER[�ILUVW��DQG�WKHQ�WKH�:0B1&'(6752<�PHVVDJH�IROORZV�LW��7KH�:0B'(6752<�PHVVDJH�LV�VHQW�WR�WKH�ZLQGRZ�DV�LWV�FOLHQW�DUHD�LV�UHPRYHG�IURP�PHPRU\�DQG�DIWHU�WKH�GLDORJ�ER[�KDV�EHHQ�UHPRYHG�IURP�WKH�VFUHHQ��7KH�:0B1&'(6752<�PHVVDJH�LV�VHQW�WR�WKH�GLDORJ�WR�OHW�LW�NQRZ�WKDW�LWV�QRQFOLHQW�DUHD�LV�EHLQJ�UHPRYHG�IURP�PHPRU\���&OHDQXS�FRGH�FDQ�EH�SODFHG�LQ�WKH�&'1B),/(2.�QRWLILFDWLRQ�FRGH�KDQGOHU�ORFDWHG�LQ�WKH�GLDORJ�KRRN�SURFHGXUH��,I�WKH�XVHU�FORVHV�WKH�GLDORJ�LQ�DQ\�ZD\�RWKHU�WKDQ�FOLFNLQJ�WKH�2.�EXWWRQ��DQ�HUURU�LV�UDLVHG��7KH�DSSOLFDWLRQ�UHFHLYHV�WKH�HUURU�DQG�PXVW�KDQGOH�LW���

��������'HIDXOW�PHVVDJH�SURFHVVLQJ�

Page 183: Visual Basic - Subclassing and Hooking with VB & VB NET

<RX�KDYH�WR�GR�DOPRVW�QRWKLQJ�IRU�GHIDXOW�PHVVDJH�SURFHVVLQJ��7KLV�LV�EHFDXVH�WKH�GLDORJ�KRRN�SURFHGXUH�SURFHVVHV�PHVVDJHV�GLIIHUHQWO\�WKDQ�D�W\SLFDO�VXEFODVVHG�ZLQGRZ�SURFHGXUH�RU�HYHQ�D�W\SLFDO�KRRN�SURFHGXUH���7KH�RQO\�WKLQJ�\RX�PXVW�GR�LV�UHWXUQ�HLWKHU�D�]HUR��)$/6(��RU�D�QRQ]HUR��758(��YDOXH�IURP�WKH�KRRN�SURFHGXUH��$�UHWXUQ�YDOXH�RI�]HUR�RU�)DOVH�LQGLFDWHV�WKDW�WKH�GHIDXOW�GLDORJ�SURFHGXUH�VKRXOG�SURFHVV�WKLV�PHVVDJH��$�QRQ]HUR�RU�7UXH�UHWXUQ�YDOXH�LQGLFDWHV�WKDW�WKH�GHIDXOW�GLDORJ�SURFHGXUH�PXVW�QRW�SURFHVV�WKLV�PHVVDJH��7KH�YDOXH�UHWXUQHG�IURP�WKH�GLDORJ�KRRN�SURFHGXUH�UHDOO\�GHSHQGV�RQ�WKH�PHVVDJH�LWVHOI�DQG�VRPHWLPHV�RQ�WKH�DFWLRQV�WDNHQ�LQ�WKH�KRRN�SURFHGXUH��7R�GHWHUPLQH�ZKDW�WR�UHWXUQ�LQ�WKH�KRRN�SURFHGXUH��H[DPLQH�WKH�PHVVDJH�GHILQLWLRQV�DQG�WKHLU�UHTXLUHPHQWV�IRU�UHWXUQHG�YDOXHV��2QH�WKLQJ�\RX�VKRXOG�GR�LV�VHW�WKH�GHIDXOW�UHWXUQ�YDOXH�IRU�WKLV�GLDORJ�KRRN�SURFHGXUH�WR�]HUR�DQG�WKHQ��LI�LW�LV�UHTXLUHG��FKDQJH�WKDW�YDOXH�WR�QRQ]HUR�RQ�D�SHU�PHVVDJH�EDVLV���

����6XEFODVVLQJ�&RPPRQ�'LDORJ�%R[HV�2WKHU�7KDQ�2SHQ�DQG�6DYH�$V�

7KH�SUHYLRXV�PDWHULDO�FRYHUHG�VXEFODVVLQJ�WKH�([SORUHU�VW\OH�2SHQ�DQG�6DYH�$V�FRPPRQ�GLDORJ�ER[HV��7KLV�VHFWLRQ�FRYHUV�VXEFODVVLQJ�DOO�RWKHU�W\SHV�RI�FRPPRQ�GLDORJ�ER[HV��7KH�WHFKQLTXHV�LQ�WKLV�VHFWLRQ�SHUWDLQ�WR�WKHVH�FRPPRQ�GLDORJV���Color Font Print Print Property Sheet (Win2000) Page Setup Find Replace

������7KH�'LDORJ�7HPSODWH�5HVRXUFH�

7KH�IRUHPRVW�GLIIHUHQFH�EHWZHHQ�WKH�2SHQ�DQG�6DYH�$V�FRPPRQ�GLDORJV�DQG�WKH�UHPDLQLQJ�FRPPRQ�GLDORJV�LV�KRZ�WKH�GLDORJ�WHPSODWH�UHVRXUFH�LV�FUHDWHG��:LWK�WKH�2SHQ�DQG�6DYH�$V�FRPPRQ�GLDORJV��D�VHSDUDWH�FKLOG�GLDORJ�KDG�WR�EH�FUHDWHG�DQG�LQWHJUDWHG�LQWR�WKH�SDUHQW�FRPPRQ�GLDORJ�ER[��7KLV�LV�QHFHVVDU\�EHFDXVH�WKH�GLDORJ�UHVRXUFH�IRU�WKHVH�WZR�FRPPRQ�GLDORJV�LV�HPEHGGHG�LQ�WKH�FRPGOJ���GOO��1RW�VR�ZLWK�WKHVH�RWKHU�FRPPRQ�GLDORJ�ER[HV��7KHLU�GLDORJ�UHVRXUFHV�DUH�DYDLODEOH�LQ�&���KHDGHU�ILOHV�� �K��DQG�LQ�UHVRXUFH�� �GOJ��ILOHV��7KH�KHDGHU�ILOHV�FRQWDLQ�DOO�WKH�FRQWURO�,'V�IRU�HDFK�FRQWURO�RQ�WKHVH�GLDORJV��7KH�UHVRXUFH�ILOHV�FRQWDLQ�WKH�DFWXDO�GLDORJ�UHVRXUFH��7DEOH�����OLVWV�DOO�UHVRXUFH�,'V��KHDGHU�ILOHV��DQG�UHVRXUFH�ILOHV�WKDW�HDFK�FRPPRQ�GLDORJ�ER[�XVHV��7KHVH�ILOHV�DUH�VKLSSHG�ZLWK�WKH�9LVXDO�&���GHYHORSPHQW�HQYLURQPHQW���7DEOH������5HVRXUFH�,'V��+HDGHU�)LOHV��DQG�5HVRXUFH�)LOHV�RI�WKH�&RPPRQ�'LDORJ�%R[HV��

Page 184: Visual Basic - Subclassing and Hooking with VB & VB NET

'LDORJ�W\SH� 5HVRXUFH�,'� 5HVRXUFH�)LOH� +HDGHU�)LOH�&RORU�� '/*B&2/25� &RORU�GOJ�� &RORU'OJ�K��)RQW�� )250$7'/*25'��� )RQW�GOJ�� 'OJV�K��3ULQW�� 35,17'/*25'� 3UQVHWXS�GOJ�� 'OJV�K��3ULQW�6HWXS� 3516(783'/*25'� 3UQVHWXS�GOJ�� 'OJV�K��3DJH�6HWXS� 3$*(6(783'/*25'� 3UQVHWXS�GOJ�� 'OJV�K��3ULQW�3URSHUW\�6KHHW� 35,17'/*(;25'� 3UQVHWXS�GOJ� 'OJV�K�)LQG�� ),1''/*25'� )LQGWH[W�GOJ�� 'OJV�K��5HSODFH� 5(3/$&('/*25'� )LQGWH[W�GOJ�� 'OJV�K�

��������&UHDWLQJ�D�GLDORJ�UHVRXUFH�ILOH�

,�ZLOO�XVH�WKH�&RORU�FRPPRQ�GLDORJ�ER[�WR�LOOXVWUDWH�KRZ�WR�FUHDWH�D�GLDORJ�UHVRXUFH�IRU�WKHVH�FRPPRQ�GLDORJV��$IWHU�WKH�UHVRXUFH�ILOH�LV�FUHDWHG��LW�FDQ�EH�SODFHG�HLWKHU�LQ�D�UHVRXUFH�'//�DQG�ORDGHG�LQWR�WKH�SURMHFW�YLD�/RDG/LEUDU\��RU�LQ�D��5(6�ILOH�DQG�HPEHGGHG�LQWR�WKH�9%�SURMHFW���7KH�ILUVW�VWHS�LV�WR�RSHQ�9LVXDO�&���DQG�FUHDWH�D�UHVRXUFH�ILOH�VLPLODU�WR�WKH�ZD\�\RX�FUHDWHG�WKH�UHVRXUFH�ILOH�IRU�WKH�6DYH�$V�H[DPSOH�DSSOLFDWLRQ��$IWHU�WKH�ILOH�LV�FUHDWHG��LPPHGLDWHO\�VDYH�WKH�HPSW\�ILOH�DV�D�UHVRXUFH�VFULSW�ILOH����WKDW�LV��ZLWK�D��UF�H[WHQVLRQ��1RWH�WKDW�QR�UHVRXUFHV�ZHUH�DGGHG�WR�WKH�ILOH���1H[W��RSHQ�WKH�&2/25�'/*�ILOH�ORFDWHG�LQ�WKH�,QFOXGH�GLUHFWRU\�LQ�WKH�9LVXDO�&���GLUHFWRU\��&RS\�MXVW�WKH�WH[W�WKDW�PDNHV�XS�WKH�UHVRXUFH�VFULSW�IRU�WKH�&RORU�FRPPRQ�GLDORJ�ER[�IURP�WKLV�ILOH�RQWR�WKH�&OLSERDUG��7KH�SRUWLRQ�RI�WKH�ILOH�WKDW�LV�FRSLHG�LV�VKRZQ�LQ�([DPSOH�������

([DPSOH������&RGH�IURP�WKH�&2/25�'/*�5HVRXUFH�6FULSW��

&+226(&2/25�',$/2*�',6&$5'$%/(�����������������67</(�'6B02'$/)5$0(�_�'6B�'/22.�_�'6B&217(;7+(/3�_�:6B32383�_�:6B&$37,21�_������:6B6<60(18�&$37,21��&RORU��)217�����06�6KHOO�'OJ��%(*,1�����/7(;7������������%DVLF�FRORUV���,'&B67$7,&���������������&21752/������������&2/25B%2;���6WDWLF��66B6,03/(�_�:6B*5283�_�:6B7$%6723��������������������������������������/7(;7������������&XVWRP�FRORUV���,'&B67$7,&�����������������&21752/������������&2/25B&86720���6WDWLF��66B6,03/(�_�:6B*5283�_����������������������:6B7$%6723��������������

Page 185: Visual Basic - Subclassing and Hooking with VB & VB NET

����386+%87721�������'HILQH�&XVWRP�&RORUV�!!��&2/25B0,;�����������������������������������:6B*5283�����'()386+%87721����2.��,'2.�������������:6B*5283�����386+%87721�������&DQFHO��,'&$1&(/��������������:6B*5283�����386+%87721�������+HOS���������������������:6B*5283�����&21752/������������&2/25B5$,1%2:��6WDWLF��66B6,03/(�_�66B681.(1����������������������������������������&21752/������������&2/25B/806&52//��6WDWLF��66B6,03/(�_�66B681.(1��������������������������������������&21752/������������&2/25B&855(17��6WDWLF��66B6,03/(�_�66B681.(1����������������������������������������386+%87721�������R��&2/25B62/,'��������������:6B*5283�����57(;7������������&RORU��&2/25B62/,'B/()7������������������/7(;7������������_6ROLG��&2/25B62/,'B5,*+7������������������57(;7������������+XH���&2/25B+8($&&(/������������������(',77(;7��������&2/25B+8(���������������:6B*5283�����57(;7������������6DW���&2/25B6$7$&&(/������������������(',77(;7��������&2/25B6$7���������������:6B*5283�����57(;7������������/XP���&2/25B/80$&&(/������������������(',77(;7��������&2/25B/80���������������:6B*5283�����57(;7������������5HG���&2/25B5('$&&(/������������������(',77(;7��������&2/25B5('���������������:6B*5283�����57(;7������������*UHHQ���&2/25B*5((1$&&(/������������������(',77(;7��������&2/25B*5((1���������������:6B*5283�����57(;7������������%OXH���&2/25B%/8($&&(/������������������(',77(;7��������&2/25B%/8(���������������:6B*5283�����386+%87721�������$GG�WR�&XVWRP�&RORUV��&2/25B$''�������������������������������������:6B*5283�����386+%87721�������7HVW�%XWWRQ��,'&B%87721���������������(1'�3DVWH�WKLV�VFULSW�LQWR�WKH��UF�ILOH�WKDW�\RX�MXVW�FUHDWHG�LQ�9LVXDO�&���EHWZHHQ�WKH�VHFWLRQ�FRPPHQWHG�ZLWK������������������������������������������������������������������������������������(QJOLVK��8�6���UHVRXUFHV�DQG�WKH�VHFWLRQ�FRPPHQWHG�ZLWK��������������������������������������������������������������������������������������7(;7,1&/8'(����6DYH�DQG�FORVH�WKLV��UF�ILOH���

Page 186: Visual Basic - Subclassing and Hooking with VB & VB NET

1H[W��RSHQ�WKH�5HVRXUFH�K�ILOH�WKDW�ZDV�FUHDWHG�E\�WKH�9LVXDO�&���UHVRXUFH�HGLWRU�DORQJ�ZLWK�WKH��UF�ILOH��$GG�WKH�,'�IRU�WKH�FRPPRQ�GLDORJ�WR�WKH�WRS�RI�WKLV�ILOH��7KH�,'�IRU�WKH�&RORU�GLDORJ�LV����GHILQH�&+226(&2/25������������������������1H[W��ILQG�WKH�FRORUGOJ�K�KHDGHU�ILOH�IRU�WKH�RULJLQDO�&RORU�FRPPRQ�GLDORJ�ER[��2SHQ�WKLV�ILOH�LQ�1RWHSDG�DQG�FRS\�DOO�WKH��GHILQH�VWDWHPHQWV�LQWR�WKH�5HVRXUFH�K�ILOH�WKDW�\RX�MXVW�FUHDWHG��7KHVH��GHILQH�VWDWHPHQWV�GHVFULEH�WKH�H[LVWLQJ�FRQWUROV�RQ�WKH�&RORU�FRPPRQ�GLDORJ�ER[���1RZ�\RX�FDQ�RSHQ�WKLV�UHVRXUFH�LQ�9LVXDO�&���DQG�WKH�GLDORJ�UHVRXUFH�ZLOO�DSSHDU�LQ�WKH�HGLWRU��GRXEOH�FOLFN�WKH�UHVRXUFH�WR�RSHQ�LW��,�LQFUHDVHG�WKH�KHLJKW�RI�WKLV�GLDORJ�ER[�DQG�DGGHG�D�EXWWRQ�WR�WKH�ERWWRP�RI�LW��DV�VKRZQ�LQ�)LJXUH��������

)LJXUH�������7KH�PRGLILHG�&RORU�FRPPRQ�GLDORJ�ER[�UHVRXUFH�

7KH�,'�WKDW�LV�JLYHQ�WR�WKLV�QHZ�EXWWRQ�LV�������7KLV�QHHGV�WR�EH�PDQXDOO\�DGGHG�WR�WKH�WRS�RI�WKH�UHVRXUFH�K�ILOH�DV�ZHOO��7KH�FRGH�ZLOO�ORRN�OLNH�WKLV����GHILQH�,'&B%87721���������������������������6DYH�WKLV�UHVRXUFH�DV�D�5(6�ILOH��7KH�VWHSV�WR�DGG�WKLV�UHVRXUFH�WR�WKH�DSSOLFDWLRQ�DUH�WKH�VDPH�DV�LQ�WKH�SUHYLRXV�6DYH�$V�FRPPRQ�GLDORJ�VXEFODVVLQJ�H[DPSOH���

��������7KH�&RORU�FRPPRQ�GLDORJ�

7KH�&RORU�FRPPRQ�GLDORJ�ER[�DOORZV�WKH�XVHU�WR�FKRRVH�D�SUHGHILQHG�FRORU�RU�D�XVHU�GHILQHG�FRORU��7KH�GLDORJ�DOORZV�WKH�XVHU�WR�GHILQH�D�FRORU�QRW�DYDLODEOH�LQ�WKH�SUHVHW�OLVW�RI�FRORUV���

Page 187: Visual Basic - Subclassing and Hooking with VB & VB NET

7R�FUHDWH�WKLV�FRPPRQ�GLDORJ��LQLWLDOL]H�WKH�&+226(&2/25�VWUXFWXUH��7KLV�VWUXFWXUH�LV�GHILQHG�LQ�9%�DV�IROORZV���3XEOLF�7\SH�&+226(&2/25���������O6WUXFW6L]H�$V�/RQJ���������VL]H�RI�WKLV�VWUXFWXUH���������KZQG2ZQHU�$V�/RQJ�����������RZQLQJ�ZLQGRZ���������K,QVWDQFH�$V�/RQJ�����������LQVWDQFH�KDQGOH���������UJE5HVXOW�$V�/RQJ�����������XVHU�FKRVH�FRORU�UHWXUQHG�WR�DSSOLFDWLRQ���������OS&XVW&RORUV�$V�/RQJ��������SRLQWHU�WR�DUUD\�RI�&2/255()�VWUXFWXUHV���������IODJV�$V�/RQJ���������������RQH�RU�PRUH�IODJV�25HG�WRJHWKHU���������O&XVW'DWD�$V�/RQJ�����������DSS�GHILQHG�GDWD�SDVVHG�LQ�WR�WKH�KRRN���������OSIQ+RRN�$V�/RQJ������������SRLQWHU�WR�GLDORJ�KRRN�SURFHGXUH���������OS7HPSODWH1DPH�$V�ORQJ������FKRRVH�FRORU�GLDORJ�WHPSODWH�QDPH�(QG�7\SH�7KH�PHPEHUV�WKDW�DUH�UHODWHG�WR�VXEFODVVLQJ�DUH��K,QVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�REMHFW�WKDW�FRQWDLQV�WKH�GLDORJ�UHVRXUFH��7KLV�LV�XVXDOO\�VHW�HTXDO�WR�WKH�$SS�K,QVWDQFH�SURSHUW\���

IODJV

)ODJV�GHVFULELQJ�WKLV�FRPPRQ�GLDORJ�ER[��7KH�&&B(1$%/(7(03/$7(�DQG�&&B(1$%/(+22.�IODJV�PXVW�XVH�D�PRGLILHG�WHPSODWH�DQG�D�GLDORJ�KRRN�IXQFWLRQ���

OSIQ+RRN

$�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��OS7HPSODWH1DPH

7KH�,'�RI�WKH�PRGLILHG�GLDORJ�UHVRXUFH���7KLV�VWUXFWXUH�LV�SDVVHG�LQ�WR�WKH�&KRRVH&RORU�$3,�IXQFWLRQ�WR�FUHDWH�DQG�GLVSOD\�WKH�&RORU�FRPPRQ�GLDORJ�ER[��7KLV�IXQFWLRQ�LV�GHFODUHG�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�&KRRVH&RORU�/LE��FRPGOJ���GOO��$OLDV��&KRRVH&RORU$��B�� � �S&KRRVHFRORU�$V�&+226(&2/25��$V�/RQJ��7KH�6WDUW�SURFHGXUH�ZH�FUHDWHG�LQ�WKH�SUHYLRXV�H[DPSOH�WKDW�VXEFODVVHG�WKH�6DYH�$V�FRPPRQ�GLDORJ�FDQ�EH�PRGLILHG��DV�VKRZQ�LQ�([DPSOH������WR�XVH�WKH�&+226(&2/25�VWUXFWXUH�DQG�WKH�&KRRVH&RORU'OJ�IXQFWLRQ�WR�FUHDWH�WKH�VXEFODVVHG�&RORU�FRPPRQ�GLDORJ��7KH�FRGH�PRGLILFDWLRQV�DSSHDU�LQ�EROGIDFH��7KH�FRGH�LV�PRGLILHG�WR�XVH�WKH�&+226(&2/25�VWUXFWXUH�DQG�WKH�&KRRVH&RORU'OJ�IXQFWLRQ�WR�FUHDWH�WKLV�GLDORJ��7KHVH�DUH�WKH�PRGLILFDWLRQV�WKDW�PXVW�EH�PDGH�WR�DOORZ�WKH�FRGH�IRU�WKH�6DYH�$V�H[DPSOH�WR�ZRUN�ZLWK�WKH�&RORU�GLDORJ�DV�ZHOO�DV�ZLWK�WKH�RWKHU�FRPPRQ�GLDORJV�WKDW�,�ZLOO�EH�GHVFULELQJ�QH[W���

([DPSOH������7KH�6WDUW�3URFHGXUH�0RGLILHG�WR�6XEFODVV�WKH�&RORU�&RPPRQ�'LDORJ��

6XE�6WDUW�2ZQHU+:QG�$V�/RQJ������'LP�&RPPRQ'LDORJ6WUXFW�$V�&+226(&2/25�����'LP�5HW9DO�$V�/RQJ�

Page 188: Visual Basic - Subclassing and Hooking with VB & VB NET

���������:LWK�&RPPRQ'LDORJ6WUXFW����������O6WUXFW6L]H� �/HQ�&RPPRQ'LDORJ6WUXFW�����������KZQG2ZQHU� �2ZQHU+:QG����������OSIQ+RRN� �*HW$GGUHVV2I�$GGUHVV2I�'OJ3URF�����������OS7HPSODWH1DPH� �,''B',$/2*�����������K,QVWDQFH� �/RDG/LEUDU\�$SS�3DWK���?'OJ5HVB9%�GOO������������IODJV� �2)1B(1$%/(+22.�2U�B������������������2)1B(1$%/(7(03/$7(�2U�B������������������2)1B(1$%/(,1&/8'(127,)<�����(QG�:LWK����������5HW9DO� �&KRRVH&RORU�&RPPRQ'LDORJ6WUXFW���������������,I�5HW9DO� ���7KHQ���������0VJ%R[��7KH�&DQFHO�EXWWRQ�ZDV�FOLFNHG������(OVH,I�5HW9DO� ���7KHQ���������0VJ%R[�7ULP�&RPPRQ'LDORJ6WUXFW�UJE5HVXOW������(OVH���������HUURU���������0VJ%R[�&RPP'OJ([WHQGHG(UURU�����(QG�,I��������������)UHH/LEUDU\��&RPPRQ'LDORJ6WUXFW��K,QVWDQFH��(QG�6XE�

��������7KH�)RQW�FRPPRQ�GLDORJ�

7KH�)RQW�FRPPRQ�GLDORJ�ER[�DOORZV�WKH�XVHU�WR�FKRRVH�D�IRQW�DV�ZHOO�DV�WKH�SURSHUWLHV�IRU�WKDW�IRQW��3URSHUWLHV�LQFOXGH�VW\OH��VL]H��HIIHFWV��DQG�FRORU���7R�FUHDWH�WKLV�FRPPRQ�GLDORJ��LQLWLDOL]H�WKH�&+226()217�VWUXFWXUH��7KLV�VWUXFWXUH�LV�GHILQHG�LQ�9%�DV�IROORZV���3XEOLF�7\SH�&+226()217���������O6WUXFW6L]H�$V�/RQJ�������������VL]H�RI�WKLV�VWUXFWXUH���������KZQG2ZQHU�$V�/RQJ���������������FDOOLQJ�ZLQGRZV�KDQGOH���������KGF�$V�/RQJ���������������������SULQWHU�'&�,&���������OS/RJ)RQW�$V�/RQJ���������������SRLQWHU�WR�WKH�/2*)217�VWUXFWXUH���������L3RLQW6L]H�$V�/RQJ����������������� �VL]H�LQ�SRLQWV�RI�VHOHFWHG�IRQW���������IODJV�$V�/RQJ�������������������RQH�RU�PRUH�IODJV�25HG�WRJHWKHU�

Page 189: Visual Basic - Subclassing and Hooking with VB & VB NET

��������UJE&RORUV�$V�/RQJ���������������UHWXUQHG�WH[W�FRORU���������O&XVW'DWD�$V�/RQJ���������������GDWD�SDVVHG�WR�KRRN���������OSIQ+RRN�$V�/RQJ����������������SRLQWHU�WR�KRRN����������OS7HPSODWH1DPH�$V�6WULQJ��������FXVWRP�WHPSODWH�QDPH���������K,QVWDQFH�$V�/RQJ���������������LQVWDQFH�KDQGOH�RI�(;(�WKDW��������������������������������������������FRQWDLQV�FXVWRP�GOJ��WHPSODWH���������OSV]6W\OH�$V�6WULQJ�������������VW\OH�ILHOG�KHUH��������������������������������������������PXVW�EH�/)B)$&(6,=(�RU�ELJJHU���������Q)RQW7\SH�$V�,QWHJHU������������VDPH�YDOXH�UHSRUWHG�WR�WKH�(QXP)RQWV��������������������������������������������FDOO�EDFN�ZLWK�WKH�H[WUD�)2177<3(B��������������������������������������������ELWV�DGGHG���������0,66,1*B$/,*10(17�$V�,QWHJHU��������������Q6L]H0LQ�$V�/RQJ����������������PLQLPXP�SW�VL]H�DOORZHG����������Q6L]H0D[�$V�/RQJ����������������PD[�SW�VL]H�DOORZHG������(QG�7\SH�,WV�PHPEHUV�WKDW�UHODWH�WR�VXEFODVVLQJ�DUH��K,QVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�REMHFW�WKDW�FRQWDLQV�WKH�GLDORJ�UHVRXUFH��7KLV�LV�XVXDOO\�VHW�HTXDO�WR�WKH�$SS�K,QVWDQFH�SURSHUW\���

IODJV

)ODJV�GHVFULELQJ�WKLV�FRPPRQ�GLDORJ�ER[��7KH�&)B(1$%/(7(03/$7(�DQG�&)B(1$%/(+22.�IODJV�PXVW�EH�VHW�WR�XVH�D�PRGLILHG�WHPSODWH�DQG�D�GLDORJ�KRRN�IXQFWLRQ���

OSIQ+RRN

$�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��OS7HPSODWH1DPH

7KH�,'�RI�WKH�PRGLILHG�GLDORJ�UHVRXUFH���7KLV�VWUXFWXUH�LV�SDVVHG�LQ�WR�WKH�&KRRVH)RQW'OJ�$3,�IXQFWLRQ�WR�FUHDWH�DQG�GLVSOD\�WKH�)RQW�FRPPRQ�GLDORJ�ER[��7KLV�IXQFWLRQ�LV�GHFODUHG�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�&KRRVH)RQW�/LE��FRPGOJ���GOO��$OLDV��&KRRVH)RQW$��B�� � �S&KRRVHIRQW�$V�&+226()217��$V�/RQJ�

��������7KH�3ULQW�FRPPRQ�GLDORJ�

7KH�3ULQW�FRPPRQ�GLDORJ�ER[�DOORZV�WKH�XVHU�WR�FKRRVH�IURP�DQ�DVVRUWPHQW�RI�RSWLRQV�IRU�D�SDUWLFXODU�SULQW�MRE��2SWLRQV�LQFOXGH�WKH�SULQWHU�WR�VHQG�WKH�MRE�WR��WKH�QXPEHU�RI�WLPHV�WR�SULQW�WKH�MRE��DQG�WKH�SDJHV�WKDW�FDQ�EH�SULQWHG�LQ�WKH�GRFXPHQW��7KLV�FRPPRQ�GLDORJ�LV�DYDLODEOH�WR�DOO����ELW�:LQGRZV�RSHUDWLQJ�V\VWHPV���7R�FUHDWH�WKLV�FRPPRQ�GLDORJ��LQLWLDOL]H�WKH�35,176758&7�VWUXFWXUH��$�3ULQW�6HWXS�GLDORJ�ER[�UDWKHU�WKDQ�WKH�3ULQW�FRPPRQ�GLDORJ�ER[�DOVR�FDQ�EH�GLVSOD\HG�E\�VHWWLQJ�WKH�

Page 190: Visual Basic - Subclassing and Hooking with VB & VB NET

3'B35,176(783�IODJ�LQ�WKH�IODJV�PHPEHU�RI�WKLV�VWUXFWXUH��)RU�QHZ�GHYHORSPHQW��WKLV�FRPPRQ�GLDORJ�VKRXOG�QRW�EH�XVHG��LQVWHDG��XVH�WKH�3DJH�6HWXS�FRPPRQ�GLDORJ��GHVFULEHG�QH[W��7KH�35,17'/*�VWUXFWXUH�LV�GHILQHG�LQ�9%�DV�IROORZV���3XEOLF�7\SH�35,17'/*���������O6WUXFW6L]H�$V�/RQJ���������������VL]H�RI�WKLV�VWUXFWXUH���������KZQG2ZQHU�$V�/RQJ�����������������RZQLQJ�ZLQGRZ���������K'HY0RGH�$V�/RQJ������������������SRLQWHU�WR�'(902'(�VWUXFWXUH���������K'HY1DPHV�$V�/RQJ�����������������SRLQWHU�WR�'(91$0(6�VWUXFWXUH���������KGF�$V�/RQJ�����������������������KDQGOH�WR�D�GHYLFH�FRQWH[W���������IODJV�$V�/RQJ���������������������RQH�RU�PRUH�IODJV�25HG�WRJHWKHU���������Q)URP3DJH�$V�,QWHJHU��������������VWDUW�SDJH���������Q7R3DJH�$V�,QWHJHU����������������HQGLQJ�SDJH���������Q0LQ3DJH�$V�,QWHJHU���������������PLQLPXP�VWDUW�SDJH�QXPEHU���������Q0D[3DJH�$V�,QWHJHU���������������PD[LPLQ�HQGLQJ�SDJH�QXPEHU���������Q&RSLHV�$V�,QWHJHU����������������QXPEHU�RI�FRSLHV���������K,QVWDQFH�$V�/RQJ�����������������LQVWDQFH�KDQGOH���������O&XVW'DWD�$V�/RQJ�����������������DSS�GHILQHG�GDWD�SDVVHG�LQ�WR�WKH�KRRN���������OSIQ3ULQW+RRN�$V�/RQJ�������������SRLQWHU�WR�SULQW�KRRN���������OSIQ6HWXS+RRN�$V�/RQJ�������������SRLQWHU�WR�VHWXS�KRRN���������OS3ULQW7HPSODWH1DPH�$V�/RQJ�������SULQW�WHPSODWH�QDPH��LQ�UHVRXUFH�ILOH����������OS6HWXS7HPSODWH1DPH�$V�/RQJ�������VHWXS�WHPSODWH�QDPH��LQ�UHVRXUFH�ILOH����������K3ULQW7HPSODWH�$V�/RQJ������������SULQW�WHPSODWH�QDPH��LQ�PHPRU\�REMHFW����������K6HWXS7HPSODWH�$V�/RQJ������������VHWXS�WHPSODWH�QDPH�LQ�PHPRU\�REMHFW��(QG�7\SH�7KH�IROORZLQJ�PHPEHUV�RI�WKH�35,17'/*�VWUXFWXUH�DUH�UHODWHG�WR�VXEFODVVLQJ���K,QVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�REMHFW�WKDW�FRQWDLQV�WKH�GLDORJ�UHVRXUFH��7KLV�LV�XVXDOO\�VHW�HTXDO�WR�WKH�$SS�K,QVWDQFH�SURSHUW\���

IODJV

)ODJV�GHVFULELQJ�WKLV�FRPPRQ�GLDORJ�ER[��7KH�3'B(1$%/(35,177(03/$7(�IODJ�PXVW�EH�VHW�WR�XVH�D�PRGLILHG�WHPSODWH�IRU�WKH�3ULQW�GLDORJ�ER[��7KH�3'B(1$%/(6(7837(03/$7(�IODJ�PXVW�EH�VHW�WR�XVH�D�PRGLILHG�WHPSODWH�IRU�WKH�3ULQW�6HWXS�GLDORJ�ER[���

OSIQ3ULQW+RRN

$�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��OSIQ6HWXS+RRN

$�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��OS3ULQW7HPSODWH1DPH

7KH�,'�RI�WKH�PRGLILHG�3ULQW�GLDORJ�UHVRXUFH���OS6HWXS7HPSODWH1DPH

Page 191: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�,'�RI�WKH�PRGLILHG�3ULQW�6HWXS�GLDORJ�UHVRXUFH���7KLV�VWUXFWXUH�LV�SDVVHG�WR�WKH�3ULQW'OJ�$3,�IXQFWLRQ�WR�FUHDWH�DQG�GLVSOD\�WKH�3ULQW�FRPPRQ�GLDORJ�ER[��7KLV�IXQFWLRQ�LV�GHFODUHG�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�3ULQW'OJ�/LE��FRPGOJ���GOO��$OLDV��3ULQW'OJ$��B�� � �S3ULQWGOJ�$V�35,17'/*��$V��/RQJ�

��������7KH�3DJH�6HWXS�FRPPRQ�GLDORJ�

7KH�3DJH�6HWXS�FRPPRQ�GLDORJ�ER[�DOORZV�WKH�XVHU�WR�FKRRVH�WKH�SULQWLQJ�SURSHUWLHV�IRU�D�SDUWLFXODU�SULQW�MRE��3URSHUWLHV�LQFOXGH�WKH�SDSHU�VL]H��SDSHU�VRXUFH��RULHQWDWLRQ��DQG�PDUJLQ�VL]HV���7R�FUHDWH�WKLV�FRPPRQ�GLDORJ��LQLWLDOL]H�WKH�3$*(6(783'/*�VWUXFWXUH��7KLV�VWUXFWXUH�LV�GHILQHG�LQ�9%�DV�IROORZV���3XEOLF�7\SH�3$*(6(783'/*���������O6WUXFW6L]H�$V�/RQJ���������������VL]H�RI�WKLV�VWUXFWXUH���������KZQG2ZQHU�$V�/RQJ�����������������RZQLQJ�ZLQGRZ���������K'HY0RGH�$V�/RQJ������������������SRLQWHU�WR�'(902'(�VWUXFWXUH���������K'HY1DPHV�$V�/RQJ�����������������SRLQWHU�WR�'(91$0(6�VWUXFWXUH���������IODJV�$V�/RQJ���������������������RQH�RU�PRUH�IODJV�25HG�WRJHWKHU���������SW3DSHU6L]H�$V�32,17$3,�����������SRLQWHU�WR�D�32,17$3,�VWUXFWXUH���������UW0LQ0DUJLQ�$V�5HFW���������������PLQLPXP�VL]HV�RI�WKH�PDUJLQV���������UW0DUJLQ�$V�5HFW������������������DFWXDO�VL]HV�RI�WKH�PDUJLQV���������K,QVWDQFH�$V�/RQJ�����������������LQVWDQFH�KDQGOH���������O&XVW'DWD�$V�/RQJ�����������������DSS�GHILQHG�GDWD�SDVVHG�LQ�WR�WKH�KRRN���������OSIQ3DJH6HWXS+RRN�$V�/RQJ���������SRLQWHU�WR�SDJH�VHWXS�GLDORJ�KRRN���������OSIQ3DJH3DLQW+RRN�$V�/RQJ���������SRLQWHU�WR�VDPSOH�SDJH�GLDORJ�KRRN���������OS3DJH6HWXS7HPSODWH1DPH�$V�/RQJ���SDJH�VHWXS�WHPSODWH�QDPH���������K3DJH6HWXS7HPSODWH�$V�/RQJ��������KDQGOH�WR�SDJH�VHWXS�WHPSODWH�(QG�7\SH�,W�KDV�WKH�IROORZLQJ�PHPEHUV�WKDW�DUH�UHODWHG�WR�VXEFODVVLQJ��K,QVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�REMHFW�WKDW�FRQWDLQV�WKH�GLDORJ�UHVRXUFH��7KLV�LV�XVXDOO\�VHW�HTXDO�WR�WKH�$SS�K,QVWDQFH�SURSHUW\���

IODJV

)ODJV�GHVFULELQJ�WKLV�FRPPRQ�GLDORJ�ER[��7KH�36'B(1$%/(3$*(��6(7837(03/$7(�IODJ�PXVW�EH�VHW�WR�XVH�D�PRGLILHG�WHPSODWH��7KH�36'B(1$%/(3$*(6(783+22.�IODJ�PXVW�EH�VHW�WR�XVH�WKH�SDJH�VHWXS�KRRN�SRLQWHG�WR�E\�WKH�OSIQ3DJH6HWXS+RRN�IXQFWLRQ�SRLQWHU��7KH�

Page 192: Visual Basic - Subclassing and Hooking with VB & VB NET

36'B(1$%/(3$*(3$,17+22.�IODJ�PXVW�EH�VHW�WR�XVH�WKH�SDJH�VHWXS�KRRN�SRLQWHG�WR�E\�WKH�OSIQ3DJH3DLQW+RRN�IXQFWLRQ�SRLQWHU���

OSIQ3DJH6HWXS+RRN

7KH�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��OSIQ3DJH3DLQW+RRN

7KH�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��ZKLFK�VSHFLILFDOO\�LQWHUFHSWV�WKH�SDLQWLQJ�PHVVDJHV�IRU�WKH�VDPSOH�SDJH�REMHFW�RQ�WKLV�GLDORJ�ER[���

OS3ULQW7HPSODWH1DPH

7KH�,'�RI�WKH�PRGLILHG�GLDORJ�UHVRXUFH���7KLV�VWUXFWXUH�LV�SDVVHG�LQ�WR�WKH�3DJH6HWXS'OJ�$3,�IXQFWLRQ�WR�FUHDWH�DQG�GLVSOD\�WKH�3DJH�6HWXS�FRPPRQ�GLDORJ�ER[��7KLV�IXQFWLRQ�LV�GHFODUHG�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�3DJH6HWXS'OJ�/LE��FRPGOJ���GOO��$OLDV��3DJH6HWXS'OJ$��B�� � �S3DJHVHWXSGOJ�$V�3$*(6(783'/*��$V�/RQJ�

��������7KH�3ULQW�3URSHUW\�6KHHW�FRPPRQ�GLDORJ�

7KH�3ULQW�3URSHUW\�6KHHW�FRPPRQ�GLDORJ�ER[�DOORZV�WKH�XVHU�WR�FKRRVH�IURP�DQ�DVVRUWPHQW�RI�SURSHUWLHV�IRU�D�SDUWLFXODU�SULQW�MRE��2SWLRQV�LQFOXGHG�RQ�WKLV�GLDORJ�DUH�VLPLODU�WR�WKH�RSWLRQV�RQ�WKH�3ULQW�FRPPRQ�GLDORJ�ER[��ZLWK�WKH�DGGLWLRQDO�RSWLRQV�WR�SULQW�RQO\�WKH�FXUUHQW�SDJH�DQG�WR�SULQW�PRUH�WKDQ�RQH�UDQJH�RI�SDJHV�IRU�D�VLQJOH�GRFXPHQW��7KLV�FRPPRQ�GLDORJ�UHSODFHV�WKH�3ULQW�FRPPRQ�GLDORJ�ER[�RQ�:LQGRZV������DQG�JUHDWHU�SODWIRUPV���7R�FUHDWH�WKLV�FRPPRQ�GLDORJ��LQLWLDOL]H�WKH�35,17'/*(;�VWUXFWXUH��7KLV�VWUXFWXUH�LV�GHFODUHG�LQ�9%�DV�IROORZV���3XEOLF�7\SH�35,17'/*(;���������O6WUXFW6L]H�$V�/RQJ�����������VL]H�RI�WKLV�VWUXFWXUH���������KZQG2ZQHU�$V�/RQJ�������������RZQLQJ�ZLQGRZ���������K'HY0RGH�$V�/RQJ��������������SRLQWHU�WR�'(902'(�VWUXFWXUH���������K'HY1DPHV�$V�/RQJ�������������SRLQWHU�WR�'(91$0(6�VWUXFWXUH���������KGF�$V�/RQJ�������������������KDQGOH�WR�D�GHYLFH�FRQWH[W���������IODJV�$V�/RQJ�����������������RQH�RU�PRUH�IODJV�25HG�WRJHWKHU���������IODJV��$V�/RQJ����������������PXVW�EH�VHW�WR�]HUR���������([FOXVLRQIODJV�$V�/RQJ��������H[FOXGHV�FWUOV��IURP�SUQ��'UY��3URS��SDJH���������Q3DJH5DQJHV�$V�/RQJ�����������QXPEHU�RI�SDJH�UDQJHV���������Q0D[3DJH5DQJHV�$V�/RQJ��������VL]H�RI�OS3DJH5DQJHV���������OS3DJH5DQJHV�$V�/RQJ����������SRLQWHU�WR�DUUD\�RI�35,173$*(5$1*(�VWUXFWV���������Q0LQ3DJH�$V�,QWHJHU�����������PLQLPXP�VWDUW�SDJH�QXPEHU���������Q0D[3DJH�$V�,QWHJHU�����������PD[LPLQ�HQGLQJ�SDJH�QXPEHU���������Q&RSLHV�$V�,QWHJHU������������QXPEHU�RI�FRSLHV���������K,QVWDQFH�$V�/RQJ�������������LQVWDQFH�KDQGOH���������OS3ULQW7HPSODWH1DPH�$V�/RQJ���GLDORJ�WHPSODWH�IRU�*HQHUDO�WDE�

Page 193: Visual Basic - Subclassing and Hooking with VB & VB NET

��������OS&DOOEDFN�$V�/RQJ������������SRLQWHU�WR�D�FDOOEDFN�REMHFW���������Q3URSHUW\3DJHV�$V�/RQJ��������QXPEHU�RI�SURSHUW\�SDJH�KDQGOHV���������OSK3URSHUW\3DJHV$V�6WULQJ�����SRLQWHU�WR�DUUD\�RISURSHUW\�SDJH�KDQGOHV���������QQ6WDUW3DJH�$V�/RQJ�����������SURSHUW\�SDJH�LQLWLDOO\�GLVSOD\HG���������GZ5HVXOW$FWLRQ�$V�/RQJ��������UHWXUQV�WKH�UHVXOWV�RI�DFWLRQV�LQ�WKLV�GOJ��(QG�7\SH�,WV�PHPEHUV�WKDW�DUH�UHODWHG�WR�VXEFODVVLQJ�DUH��K,QVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�REMHFW�WKDW�FRQWDLQV�WKH�GLDORJ�UHVRXUFH��7KLV�LV�XVXDOO\�VHW�HTXDO�WR�WKH�$SS�K,QVWDQFH�SURSHUW\���

IODJV

)ODJV�GHVFULELQJ�WKLV�FRPPRQ�GLDORJ�ER[��7KH�3'B(1$%/(35,177(03/$7(�IODJ�PXVW�EH�VHW�WR�XVH�D�PRGLILHG�GLDORJ�WHPSODWH�IRU�WKH�*HQHUDO�WDE���

OS&DOOEDFN

$�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��OS3ULQW7HPSODWH1DPH

7KH�,'�RI�WKH�PRGLILHG�GLDORJ�UHVRXUFH�IRU�WKH�*HQHUDO�WDE���7KLV�VWUXFWXUH�LV�SDVVHG�LQ�WR�WKH�3ULQW'OJ([�$3,�IXQFWLRQ�WR�FUHDWH�DQG�GLVSOD\�WKH�3ULQW�3URSHUW\�6KHHW�FRPPRQ�GLDORJ��7KLV�IXQFWLRQ�LV�GHFODUHG�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�3ULQW'OJ([�/LE��FRPGOJ���GOO��$OLDV��3ULQW'OJ$��B�� � �S3ULQWGOJ�$V�35,17'/*(;��$V�/RQJ�7KH�35,17'/*(;25'�GLDORJ�WHPSODWH�ORFDWHG�LQ�WKH�3UQ6HWXS�GOJ�WHPSODWH�ILOH�VKRXOG�EH�PRGLILHG��7KLV�GLDORJ�WHPSODWH�ZLOO�EH�GLVSOD\HG�RQ�WKH�ORZHU�SRUWLRQ�RI�WKH�*HQHUDO�WDE���7KHUH�LV�QR�PHPEHU�ZLWKLQ�WKH�35,17'/*(;�VWUXFWXUH�WR�DGG�WKH�W\SLFDO�GLDORJ�KRRN�IXQFWLRQ�SRLQWHU��DV�WKHUH�LV�ZLWK�WKH�VWUXFWXUHV�IRU�WKH�RWKHU�W\SHV�RI�FRPPRQ�GLDORJ�ER[HV��,QVWHDG��DQ�OS&DOOEDFN�PHPEHU�LV�DYDLODEOH��7KLV�PHPEHU�KROGV�D�SRLQWHU�WR�D�&RPSRQHQW�2EMHFW�0RGHO��&20��REMHFW��ZKLFK�LPSOHPHQWV�WKH�,3ULQW'LDORJ&DOOEDFN�LQWHUIDFH��7KLV�LQWHUIDFH�FRQWDLQV�WKUHH�PHWKRGV�WKDW�DUH�FDOOHG�WR�SDVV�LQIRUPDWLRQ�EDFN�WR�WKH�DSSOLFDWLRQ�LPSOHPHQWLQJ�WKH�FDOOEDFN��&RGH�LV�DGGHG�WR�WKHVH�WKUHH�PHWKRGV�DOORZLQJ�PHVVDJHV�VHQW�WR�WKH�PRGLILHG�GLDORJ�UHVRXUFH�WR�EH�KDQGOHG��7KH�WKUHH�PHWKRGV�DUH���InitDone

&DOOHG�ZKHQ�WKH�*HQHUDO�WDE�KDV�ILQLVKHG�LQLWLDOL]LQJ��,WV�SURWRW\SH�LV���+5(68/7�,QLW'RQH������� +:1'�K'OJ����������8,17�X0VJ��� :3$5$0�Z3DUDP��� /3$5$0�O3DUDP��� /5(68/7� S5HVXOW���

SelectionChanged

&DOOHG�ZKHQ�WKH�XVHU�VHOHFWV�D�GLIIHUHQW�SULQWHU�RQ�WKH�*HQHUDO�WDE��,WV�SURWRW\SH�LV���

Page 194: Visual Basic - Subclassing and Hooking with VB & VB NET

+5(68/7�6HOHFWLRQ&KDQJHG������� +:1'�K'OJ��� 8,17�X0VJ��� :3$5$0�Z3DUDP��� /3$5$0�O3DUDP��� /5(68/7� S5HVXOW���

HandleMessage

,QWHUFHSWV�DQ\�PHVVDJHV�VHQW�WR�WKH�PRGLILHG�GLDORJ�UHVRXUFH�ORFDWHG�RQ�WKH�*HQHUDO�WDE��,WV�SURWRW\SH�LV���+5(68/7�+DQGOH0HVVDJH��� +:1'�K'OJ��� 8,17�X0VJ��� :3$5$0�Z3DUDP��� /3$5$0�O3DUDP��� /5(68/7� S5HVXOW���

ZLWK�WKH�IROORZLQJ�SDUDPHWHUV��K'OJ

+DQGOH�WR�WKH�PRGLILHG�GLDORJ�UHVRXUFH�RQ�WKH�*HQHUDO�WDE��X0VJ

0HVVDJH�,'�UHFHLYHG�E\�WKH�PRGLILHG�GLDORJ�UHVRXUFH��Z3DUDP

([WUD�LQIRUPDWLRQ�VHQW�ZLWK�WKH�PHVVDJH��GHSHQGHQW�RQ�WKH�W\SH�RI�PHVVDJH���O3DUDP

([WUD�LQIRUPDWLRQ�VHQW�ZLWK�WKH�PHVVDJH��GHSHQGHQW�RQ�WKH�W\SH�RI�PHVVDJH���S5HVXOW

3RLQWHU�WR�D�YDOXH�WKDW�HTXDOV�758(�LI�WKH�PHVVDJH�ZDV�SURFHVVHG�LQ�WKLV�PHWKRG��7KLV�YDOXH�HTXDOV�)$/6(�LI�WKH�PHVVDJH�ZDV�QRW�SURFHVVHG���

7KLV�IXQFWLRQ�UHWXUQV�6B2.�WR�VWRS�WKH�3ULQW'OJ([�IXQFWLRQ�IURP�SHUIRUPLQJ�LWV�GHIDXOW�IXQFWLRQDOLW\�IRU�WKLV�PHVVDJH��$�UHWXUQ�YDOXH�RI�6B)$/6(�DOORZV�WKH�3ULQW'OJ([�IXQFWLRQ�WR�ILQLVK�SHUIRUPLQJ�LWV�GHIDXOW�KDQGOLQJ�RI�WKLV�PHVVDJH���

��������7KH�)LQG�FRPPRQ�GLDORJ�

7KH�)LQG�FRPPRQ�GLDORJ�ER[�DOORZV�D�XVHU�WR�VHDUFK�IRU�D�ZKROH�RU�SDUWLDO�ZRUG�LQ�WKH�GLVSOD\HG�WH[W��7KH�XVHU�FRQWUROV�WKH�GLUHFWLRQ�DQG�WKH�FDVH�VHQVLWLYLW\�RI�WKH�VHDUFK��7KLV�GLDORJ�DQG�WKH�5HSODFH�GLDORJ�DUH�WKH�RQO\�WZR�FRPPRQ�GLDORJ�ER[HV�WKDW�DUH�PRGHOHVV���7R�FUHDWH�WKLV�FRPPRQ�GLDORJ��LQLWLDOL]H�WKH�),1'5(3/$&(�VWUXFWXUH��7KLV�VWUXFWXUH�LV�GHILQHG�LQ�9%�DV�IROORZV���3XEOLF�7\SH�),1'5(3/$&(���������O6WUXFW6L]H�$V�/RQJ����������������VL]H�RI�WKLV�VWUXFW��

Page 195: Visual Basic - Subclassing and Hooking with VB & VB NET

��������KZQG2ZQHU�$V�/RQJ������������������KDQGOH�WR�RZQLQJ�ZLQGRZ���������K,QVWDQFH�$V�/RQJ������������������LQVWDQFH�KDQGOH�RI�(;(�WKDW�����������������������������������������������FRQWDLQV�FXVW��GOJ��WHPSODWH���������IODJV�$V�/RQJ����������������������RQH�RU�PRUH�IODJV�25HG�WRJHWKHU���������OSVWU)LQG:KDW�$V�6WULQJ������������SRLQWHU�WR�VHDUFK�VWULQJ���������OSVWU5HSODFH:LWK�$V�6WULQJ���������SRLQWHU�WR�UHSODFH�VWULQJ���������Z)LQG:KDW/HQ�$V�,QWHJHU������������VL]H�RI�ILQG�EXIIHU���������Z5HSODFH:LWK/HQ�$V�,QWHJHU���������VL]H�RI�UHSODFH�EXIIHU���������O&XVW'DWD�$V�/RQJ������������������FXVWRP�GDWD�SDVVHG�WR�KRRN�IXQFWLRQ���������OSIQ+RRN�$V�/RQJ�������������������SRLQWHU�WR�KRRN�IXQFWLRQ���������OS7HPSODWH1DPH�$V�/RQJ�������������FXVWRP�WHPSODWH�QDPH�(QG�7\SH�7KH�),1'5(3/$&(�PHPEHUV�UHODWHG�WR�VXEFODVVLQJ�DUH��K,QVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�REMHFW�WKDW�FRQWDLQV�WKH�GLDORJ�UHVRXUFH��7KLV�LV�XVXDOO\�VHW�HTXDO�WR�WKH�$SS�K,QVWDQFH�SURSHUW\���

IODJV

)ODJV�GHVFULELQJ�WKLV�FRPPRQ�GLDORJ�ER[��7KH�)5B(1$%/(7(03/$7(�DQG�)5B(1$%/(+22.�IODJV�PXVW�EH�VHW�WR�XVH�D�PRGLILHG�WHPSODWH�DQG�D�GLDORJ�KRRN�IXQFWLRQ���

OSIQ+RRN

7KH�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��OS7HPSODWH1DPH

7KH�,'�RI�WKH�PRGLILHG�GLDORJ�UHVRXUFH���7KLV�VWUXFWXUH�LV�SDVVHG�WR�WKH�)LQG7H[W�$3,�IXQFWLRQ�WR�FUHDWH�DQG�GLVSOD\�WKH�)LQG�FRPPRQ�GLDORJ�ER[��7KLV�IXQFWLRQ�LV�GHFODUHG�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�)LQG7H[W�/LE��FRPGOJ���GOO��$OLDV��)LQG7H[W$���B�� � �S)LQGUHSODFH�$V�),1'5(3/$&(��$V�/RQJ�

��������7KH�5HSODFH�FRPPRQ�GLDORJ�

7KH�5HSODFH�FRPPRQ�GLDORJ�ER[�DOORZV�D�XVHU�WR�VHDUFK�IRU�DQG�UHSODFH�D�ZKROH�RU�SDUWLDO�ZRUG�LQ�WKH�GLVSOD\HG�WH[W��7KH�XVHU�FRQWUROV�WKH�FDVH�VHQVLWLYLW\�RI�WKH�VHDUFK��7ZR�HGLW�ER[HV�DUH�SURYLGHG��RQH�IRU�WKH�WH[W�WR�EH�UHSODFHG�DQG�RQH�IRU�WKH�UHSODFHPHQW�WH[W��%XWWRQV�DUH�SURYLGHG�RQ�WKLV�GLDORJ�WR�DOORZ�VHDUFKLQJ�IRU�WH[W�WR�EH�UHSODFHG��UHSODFLQJ�WKH�VHOHFWHG�WH[W��UHSODFLQJ�DOO�WH[W�LQ�WKH�GRFXPHQW�DW�RQFH��DQG�FDQFHOLQJ�WKH�GLDORJ��7KLV�GLDORJ�DQG�WKH�)LQG�GLDORJ�DUH�WKH�RQO\�WZR�FRPPRQ�GLDORJ�ER[HV�WKDW�DUH�PRGHOHVV���7R�FUHDWH�WKLV�FRPPRQ�GLDORJ��LQLWLDOL]H�WKH�),1'5(3/$&(�VWUXFWXUH��7KLV�VWUXFWXUH�LV�GHILQHG�LQ�9%�DV�IROORZV���3XEOLF�7\SH�),1'5(3/$&(�

Page 196: Visual Basic - Subclassing and Hooking with VB & VB NET

��������O6WUXFW6L]H�$V�/RQJ����������VL]H�RI�WKLV�VWUXFW����������KZQG2ZQHU�$V�/RQJ������������KDQGOH�WR�RZQLQJ�ZLQGRZ���������K,QVWDQFH�$V�/RQJ������������LQVWDQFH�KDQGOH�RI�(;(�WKDW�����������������������������������������FRQWDLQV�FXVW��GOJ��WHPSODWH���������IODJV�$V�/RQJ����������������RQH�RU�PRUH�IODJV�25HG�WRJHWKHU���������OSVWU)LQG:KDW�$V�6WULQJ������SRLQWHU�WR�VHDUFK�VWULQJ���������OSVWU5HSODFH:LWK�$V�6WULQJ���SRLQWHU�WR�UHSODFH�VWULQJ���������Z)LQG:KDW/HQ�$V�,QWHJHU������VL]H�RI�ILQG�EXIIHU���������Z5HSODFH:LWK/HQ�$V�,QWHJHU���VL]H�RI�UHSODFH�EXIIHU���������O&XVW'DWD�$V�/RQJ������������FXVWRP�GDWD�SDVVHG�WR�KRRN�IXQFWLRQ���������OSIQ+RRN�$V�/RQJ�������������SRLQWHU�WR�KRRN�IXQFWLRQ���������OS7HPSODWH1DPH�$V�/RQJ�������FXVWRP�WHPSODWH�QDPH�(QG�7\SH�7KH�PHPEHUV�RI�),1'5(3/$&(�WKDW�DUH�UHODWHG�WR�VXEFODVVLQJ�DUH���K,QVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�REMHFW�WKDW�FRQWDLQV�WKH�GLDORJ�UHVRXUFH��7KLV�LV�XVXDOO\�VHW�HTXDO�WR�WKH�$SS�K,QVWDQFH�SURSHUW\���

IODJV

)ODJV�GHVFULELQJ�WKLV�FRPPRQ�GLDORJ�ER[��7KH�)5B(1$%/(7(03/$7(�DQG�)5B(1$%/(+22.�IODJV�PXVW�EH�VHW�WR�XVH�D�PRGLILHG�WHPSODWH�DQG�D�GLDORJ�KRRN�IXQFWLRQ���

OSIQ+RRN

7KH�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��OS7HPSODWH1DPH

7KH�,'�RI�WKH�PRGLILHG�GLDORJ�UHVRXUFH���7KLV�VWUXFWXUH�LV�SDVVHG�LQ�WR�WKH�5HSODFH7H[W�$3,�IXQFWLRQ�WR�FUHDWH�DQG�GLVSOD\�WKH�5HSODFH�FRPPRQ�GLDORJ�ER[��7KLV�IXQFWLRQ�LV�GHFODUHG�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�5HSODFH7H[W�/LE��FRPGOJ���GOO��$OLDV��5HSODFH7H[W$��B�� � �S)LQGUHSODFH�$V�),1'5(3/$&(��$V�/RQJ�

������5HFHLYLQJ�1RWLILFDWLRQ�DQG�&RQWURO�0HVVDJHVIURP�WKH�'LDORJ�

7KH�EDVLF�VWUXFWXUH�RI�WKH�GLDORJ�KRRN�SURFHGXUH�IRU�WKHVH�FRPPRQ�GLDORJ�ER[HV�UHPDLQV�WKH�VDPH�DV�WKH�RQH�SURYLGHG�ZLWK�WKH�6DYH�$V�H[DPSOH��1RWH��WKRXJK��WKDW�VHYHUDO�RI�WKH�FRPPRQ�GLDORJV�XVH�PHVVDJHV�VSHFLILF�WR�WKHLU�RZQ�RSHUDWLRQ��)RU�H[DPSOH��WKH�2SHQ�DQG�6DYH�$V�GLDORJV�XVH�WKH�&'1B)2/'(5&+$1*(�PHVVDJH�WR�LQGLFDWH�WKDW�WKH�XVHU�KDV�FKDQJHG�IROGHUV�LQ�WKH�GLDORJ��WKLV�PHVVDJH�GRHV�QRW�DSSO\�WR�WKH�RWKHU�FRPPRQ�GLDORJV���:KDW�IROORZV�LV�D�OLVW�RI�PHVVDJHV�VSHFLILF�WR�HDFK�FRPPRQ�GLDORJ��WKH�&RORU�GLDORJ�LPSOHPHQWV�WKH�IROORZLQJ�PHVVDJHV���COLOROKSTRING

Page 197: Visual Basic - Subclassing and Hooking with VB & VB NET

6HQW�ZKHQ�WKH�XVHU�FOLFNV�WKH�GLDORJV�2.�EXWWRQ��,I�WKH�GLDORJ�KRRN�SURFHGXUH�UHWXUQV�D����WKH�VHOHFWHG�FRORU�LV�UHMHFWHG��DQG�WKH�GLDORJ�VWD\V�RSHQ���

SETRGBSTRING

7KLV�PHVVDJH�FDQ�EH�VHQW�E\�WKH�GLDORJ�KRRN�SURFHGXUH�WR�IRUFH�D�FRORU�WR�EH�VHOHFWHG�LQ�WKH�GLDORJ�ER[���

7R�XVH�HLWKHU�PHVVDJH��WKH�PHVVDJH�PXVW�ILUVW�EH�PDQXDOO\�UHJLVWHUHG�E\�\RXU�DSSOLFDWLRQ�XVLQJ�WKH�5HJLVWHU:LQGRZ0HVVDJH�IXQFWLRQ��7KLV�IXQFWLRQ�LV�GHFODUHG�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�5HJLVWHU:LQGRZ0HVVDJH�/LE��XVHU����B��������$OLDV��5HJLVWHU:LQGRZ0HVVDJH$��B���������%\9DO�OS6WULQJ�$V�6WULQJ��$V�/RQJ�7KH�IXQFWLRQV�VLQJOH�SDUDPHWHU�LV��OS6WULQJ

$�QXOO�WHUPLQDWHG�VWULQJ�WKDW�LGHQWLILHV�WKH�QHZ�PHVVDJH�7KH�IXQFWLRQ�UHWXUQV�D�XQLTXH�QXPEHU�LGHQWLI\LQJ�WKH�PHVVDJH�LQ�WKH�UDQJH�RI�+&����WR�+))))��0HVVDJHV�LQ�WKLV�UDQJH�DUH�JOREDO�WR�WKH�V\VWHP��WKHUHIRUH��DIWHU�D�PHVVDJH�LV�UHJLVWHUHG��DQ\�DSSOLFDWLRQ�FDQ�XVH�LW��,I�D�]HUR�LV�UHWXUQHG��WKH�PHVVDJH�IDLOHG�WR�UHJLVWHU��:KHQ�UHJLVWHUHG��WKH�QHZ�PHVVDJH�FDQ�EH�VHQW�XVLQJ�6HQG0HVVDJH�RU�3RVW0HVVDJH��7KH�GLDORJ�KRRN�SURFHGXUH�DOVR�FDQ�LQWHUFHSW�LW���7KH�IROORZLQJ�LV�WKH�FRGH�XVHG�WR�UHJLVWHU�WKHVH�WZR�&RORU�GLDORJ�PHVVDJHV���'LP�&OU2.0VJ�DV�/RQJ�'LP�6HW5*%0VJ�DV�/RQJ��&OU2.0VJ� �5HJLVWHU:LQGRZ0HVVDJH��&2/252.675,1*���6HW5*%0VJ� �5HJLVWHU:LQGRZ0HVVDJH��6(75*%675,1*���7KH�)RQW�GLDORJ�LPSOHPHQWV�WKH�IROORZLQJ�PHVVDJHV��WM_CHOOSEFONT_GETLOGFONT

7KLV�PHVVDJH�FDQ�EH�VHQW�E\�WKH�GLDORJ�KRRN�SURFHGXUH�WR�UHWXUQ�LQIRUPDWLRQ�RQ�WKH�FXUUHQWO\�VHOHFWHG�IRQW���

WM_CHOOSEFONT_SETLOGFONT

7KLV�PHVVDJH�FDQ�EH�VHQW�E\�WKH�GLDORJ�KRRN�SURFHGXUH�WR�VHW�WKH�VHOHFWHG�IRQW���WM_CHOOSEFONT_SETFLAGS

7KLV�PHVVDJH�FDQ�EH�VHQW�E\�WKH�GLDORJ�KRRN�SURFHGXUH�WR�FKDQJH�WKH�IODJV�FXUUHQWO\�VHW�LQ�WKH�&+226()217�VWUXFWXUH���

7KH�2SHQ�DQG�6DYH�$V�GLDORJV�LPSOHPHQW�WKH�IROORZLQJ�PHVVDJHV��CDN_FILEOK

7KH�2SHQ�RU�6DYH�EXWWRQ�ZDV�FOLFNHG��CDN_FOLDERCHANGE

7KH�FXUUHQWO\�VHOHFWHG�IROGHU�KDV�FKDQJHG��CDN_HELP

7KH�+HOS�EXWWRQ�ZDV�FOLFNHG��CDN_INITDONE

Page 198: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�GLDORJ�KDV�ILQLVKHG�LWV�LQLWLDOL]DWLRQ��LQFOXGLQJ�SURFHVVLQJ�WKH�:0B,1,7',$/2*�PHVVDJH���

CDN_SELCHANGE

$�QHZ�ILOH�RU�IROGHU�KDV�EHHQ�VHOHFWHG��CDN_SHAREVIOLATION

$�VKDULQJ�YLRODWLRQ�KDV�RFFXUUHG�ZKLOH�WU\LQJ�WR�VDYH�RU�RSHQ�WKH�VHOHFWHG�ILOH���CDN_TYPECHANGE

$�QHZ�ILOH�W\SH�KDV�EHHQ�VHOHFWHG��$OO�WKHVH�PHVVDJHV�DUH�VHQW�WR�WKH�GLDORJ�DV�D�SDUDPHWHU�RI�WKH�:0B127,)<�PHVVDJH��7KH�6DYH�$V�DQG�2SHQ�GLDORJ�ER[HV�DUH�WKH�RQO\�WZR�WKDW�VXSSRUW�WKHVH�QRWLILFDWLRQ�PHVVDJHV���7KH�IROORZLQJ�6HOHFW�&DVH�FRGH�EORFN�VKRXOG�EH�XVHG�LQ�WKH�GLDORJ�KRRN�SURFHGXUH�RQO\�ZKHQ�XVLQJ�HLWKHU�WKH�6DYH�$V�RU�2SHQ�GLDORJV�������6HOHFW�&DVH�X0VJ���������&DVH�:0B127,)<�������������&RS\0HPRU\�10+6WUXFW��%\9DO�O3DUDP��/HQ%�10+6WUXFW���������������6HOHFW�&DVH�10+6WUXFW�FRGH�����������������&DVH�&'1B,1&/8'(,7(0���������������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B�� � � � ��&'1B,1&/8'(,7(0���YE1HZ/LQH���������������������'R(YHQWV�����������������&DVH�&'1B,1,7'21(���������������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B�� � � � ��&'1B,1,7'21(���YE1HZ/LQH���������������������'R(YHQWV�����������������&DVH�&'1B6(/&+$1*(���������������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B�� � � � ��&'1B6(/&+$1*(���YE1HZ/LQH���������������������'R(YHQWV�����������������&DVH�&'1B)2/'(5&+$1*(���������������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B�� � � � ��&'1B)2/'(5&+$1*(���YE1HZ/LQH���������������������'R(YHQWV�����������������&DVH�&'1B+(/3���������������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B�� � � � ��&'1B+(/3���YE1HZ/LQH���������������������'R(YHQWV�����������������&DVH�&'1B),/(2.���������������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B�� � � � ��&'1B),/(2.���YE1HZ/LQH���������������������'R(YHQWV�

Page 199: Visual Basic - Subclassing and Hooking with VB & VB NET

����������������&DVH�&'1B6+$5(9,2/$7,21���������������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B�� � � � ��&'1B6+$5(9,2/$7,21���YE1HZ/LQH���������������������'R(YHQWV�����������������&DVH�&'1B7<3(&+$1*(���������������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B�� � � � ��&'1B7<3(&+$1*(���YE1HZ/LQH���������������������'R(YHQWV�����������������&DVH�(OVH���������������������IUP0DLQ�W[W0VJ�7H[W� �IUP0DLQ�W[W0VJ�7H[W��+H[��KZQG���B�� � � � �����&6WU�X0VJ����������YE1HZ/LQH������������(QG�6HOHFW�����������������2WKHU�&DVH�VWDWHPHQWV��������(QG�6HOHFW�)RU�WKH�3DJH�6HWXS�GLDORJ��LI�WKH�36'B(1$%/(3$*(3$,17+22.�IODJ�LV�VHW�LQ�WKH�3$*(6(783'/*�IODJV�PHPEHU��D�VHFRQG�KRRN�IXQFWLRQ�FDQ�EH�LPSOHPHQWHG��7KLV�KRRN�IXQFWLRQ�LQWHUFHSWV�WKH�IROORZLQJ�PHVVDJHV��ZKLFK�PRGLI\�WKH�ORRN�RI�WKH�VDPSOH�SDJH�LPDJH�DW�WKH�WRS�RI�WKLV�FRPPRQ�GLDORJ�ER[���WM_PSD_PAGESETUPDLG

&RQWDLQV�LQIRUPDWLRQ�UHJDUGLQJ�WKH�SDSHU�VL]H��SDSHU�RULHQWDWLRQ��DQG�W\SH�RI�SULQWHU�GHYLFH���

WM_PSD_FULLPAGERECT

&RQWDLQV�D�5(&7�VWUXFWXUH�GHILQLQJ�WKH�ORFDWLRQ�DQG�VL]H�RI�WKH�VDPSOH�SDJH�LPDJH���WM_PSD_MINMARGINRECT

&RQWDLQV�D�5(&7�VWUXFWXUH�GHILQLQJ�WKH�ORFDWLRQ�DQG�PLQLPXP�VL]H�RI�WKH�UHFWDQJOH�LQGLFDWLQJ�WKH�PDUJLQ���

WM_PSD_MARGINRECT

&RQWDLQV�D�5(&7�VWUXFWXUH�GHILQLQJ�WKH�ORFDWLRQ�DQG�VL]H�RI�WKH�UHFWDQJOH�LQGLFDWLQJ�WKH�PDUJLQ���

WM_PSD_GREEKTEXTRECT

&RQWDLQV�D�5(&7�VWUXFWXUH�GHILQLQJ�WKH�ORFDWLRQ�DQG�VL]H�RI�WKH�UHFWDQJOH�FRQWDLQLQJ�WKH�*UHHN�WH[W���

WM_PSD_ENVSTAMPRECT

&RQWDLQV�D�5(&7�VWUXFWXUH�GHILQLQJ�WKH�ORFDWLRQ�DQG�VL]H�RI�WKH�UHFWDQJOH�LQGLFDWLQJ�WKH�HQYHORSH�DQG�VWDPS��7KLV�PHVVDJH�LV�VHQW�RQO\�IRU�HQYHORSH�SULQW�MREV���

WM_PSD_YAFULLPAGERECT

&RQWDLQV�D�5(&7�VWUXFWXUH�GHILQLQJ�WKH�ORFDWLRQ�DQG�PLQLPXP�VL]H�RI�WKH�UHFWDQJOH�LQGLFDWLQJ�DQ�HQYHORSHV�UHWXUQ�DGGUHVV��7KLV�PHVVDJH�LV�VHQW�RQO\�IRU�HQYHORSH�SULQW�MREV���

7KH�)LQG�DQG�5HSODFH�GLDORJV�LPSOHPHQW�WKH�IROORZLQJ�PHVVDJH��

Page 200: Visual Basic - Subclassing and Hooking with VB & VB NET

FINDMSGSTRING

6HQW�E\�WKH�)LQG�RU�5HSODFH�GLDORJ�ER[�WR�WKH�ZLQGRZ�SURFHGXUH�RI�WKH�ZLQGRZ�WKDW�RZQV�HLWKHU�RI�WKHVH�FRPPRQ�GLDORJV��7KLV�PHVVDJH�LV�VHQW�LQ�UHVSRQVH�WR�WKH�XVHU�FOLFNLQJ�WKH�5HSODFH��5HSODFH�$OO��RU�)LQG�1H[W�EXWWRQ��7KLV�PHVVDJH�DOVR�LV�VHQW�WR�LQIRUP�WKH�RZQLQJ�ZLQGRZ�WKDW�WKH�XVHU�KDV�FORVHG�WKLV�GLDORJ���

7KLV�PHVVDJH�DOVR�PXVW�EH�UHJLVWHUHG�ZLWK�WKH�5HJLVWHU:LQGRZ0HVVDJH�IXQFWLRQ��7KH�RZQLQJ�ZLQGRZ�FDQ�EH�VXEFODVVHG�WR�ZDWFK�IRU�WKLV�PHVVDJH��

����3UREOHPV�6XEFODVVLQJ�WKH�)LQG�DQG�5HSODFH�&RPPRQ�'LDORJV�

7KH�)LQG�DQG�5HSODFH�FRPPRQ�GLDORJ�ER[HV�RSHUDWH�GLIIHUHQWO\�WKDQ�DOO�RWKHU�FRPPRQ�GLDORJ�ER[HV�LQ�RQH�UHVSHFW��7KHVH�FRPPRQ�GLDORJV�DUH�PRGHOHVV��7KLV�PHDQV�WKDW�FRGH�ZLOO�FRQWLQXH�H[HFXWLQJ�LQ�WKH�FDOOLQJ�SURFHGXUH��LW�ZLOO�QRW�ZDLW�IRU�WKH�GLDORJ�WR�EH�FORVHG��)RU�D�PRGHOHVV�GLDORJ�WR�ZRUN�SURSHUO\��:LQGRZV�UHTXLUHV�WKDW�WKH�,V'LDORJ0HVVDJH�$3,�IXQFWLRQ�EH�XVHG�LQ�WKH�PDLQ�PHVVDJH�ORRS�RI�WKH�DSSOLFDWLRQ��7KH�,V'LDORJ0HVVDJH�$3,�IXQFWLRQ�EDVLFDOO\�GRHV�WKH�ZRUN�RI�WKH�7UDQVODWH0HVVDJH�DQG�WKH�'LVSDWFK0HVVDJH�$3,�IXQFWLRQV��EXW�IRU�PRGHOHVV�GLDORJ�ER[HV��7KHUHIRUH��LI�,V'LDORJ0HVVDJH�UHWXUQV�D�758(�YDOXH��LW�KDV�SURFHVVHG�WKH�PHVVDJH�DQG�WKH�7UDQVODWH0HVVDJH�DQG�WKH�'LVSDWFK0HVVDJH�$3,�IXQFWLRQV�VKRXOG�QRW�EH�FDOOHG��7KH�,V'LDORJ0HVVDJH�$3,�IXQFWLRQV�PDLQ�SXUSRVH�LV�WR�SURYLGH�GHIDXOW�GLDORJ�NH\ERDUG�SURFHVVLQJ�IRU�WKH�PRGHOHVV�GLDORJ�ER[��0RGDO�GLDORJ�ER[HV�DXWRPDWLFDOO\�VXSSRUW�GHIDXOW�GLDORJ�NH\ERDUG�SURFHVVLQJ��+HUH�LV�WKH�OLVW�RI�GHIDXOW�GLDORJ�NH\ERDUG�NH\V�SURFHVVHG�E\�WKH�,V'LDORJ0HVVDJH�$3,�IXQFWLRQ���ALT+mnemonic

0RYHV�WKH�IRFXV�WR�WKH�ILUVW�FRQWURO�LQ�WKH�WDE�RUGHU�DIWHU�WKH�VWDWLF�FRQWURO�FRQWDLQLQJ�WKLV�PQHPRQLF��

DOWN

0RYHV�WKH�IRFXV�WR�WKH�QH[W�FRQWURO�UP

0RYHV�WKH�IRFXV�WR�WKH�SUHYLRXV�FRQWURO�ENTER

6LPXODWHV�FOLFNLQJ�WKH�2.�EXWWRQ�ESC

6LPXODWHV�FOLFNLQJ�WKH�&DQFHO�EXWWRQ�LEFT

0RYHV�WKH�IRFXV�WR�WKH�SUHYLRXV�FRQWURO�RIGHT

0RYHV�WKH�IRFXV�WR�WKH�QH[W�FRQWURO�TAB

0RYHV�WKH�IRFXV�WR�WKH�QH[W�FRQWURO�SHIFT+TAB

0RYHV�WKH�IRFXV�WR�WKH�SUHYLRXV�FRQWURO�Mnemonic (performs same action as the ALT+mnemonic key combination)

Page 201: Visual Basic - Subclassing and Hooking with VB & VB NET

0RYHV�WKH�IRFXV�WR�WKH�ILUVW�FRQWURO�LQ�WKH�WDE�RUGHU�DIWHU�WKH�VWDWLF�FRQWURO�FRQWDLQLQJ�WKLV�PQHPRQLF��

8VLQJ�6S\���WR�3HHU�LQWR�WKH�&RPPRQ�'LDORJ�6XEFODVVLQJ�$SSOLFDWLRQ�

6WDUW�WKH�&KDSWHU���H[DPSOH�DQG�WKHQ�UXQ�6S\����&OLFN�WKH�EXWWRQ�LQ�WKH�H[DPSOH�DSSOLFDWLRQ�WR�GLVSOD\�WKH�VXEFODVVHG�6DYH�$V�FRPPRQ�GLDORJ�ER[��/RFDWH�WKH�H[DPSOH�DSSOLFDWLRQ�DQG�WKH�([SRUW�$V�VXEFODVVHG�FRPPRQ�GLDORJ�ER[�LQ�WKH�:LQGRZV�FKLOG�ZLQGRZ�RI�6S\����7KH�([SRUW�$V�FRPPRQ�GLDORJ�ER[�ZLOO�EH�ODEHOHG��([SRUW�$V��6XEFODVVHG�&RPPRQ�'LDORJ����,W�DOVR�ZLOO�FRQWDLQ�WKH�WH[W��������DIWHU�WKH�ZLQGRZ�FDSWLRQ��7KLV�YDOXH�LV�WKH�FODVV�QDPH�IRU�D�ZLQGRZV�GLDORJ�ER[��'RXEOH�FOLFN�WKLV�GLDORJ�ER[�WR�GLVSOD\�WKH�:LQGRZ�3URSHUWLHV�GLDORJ�ER[��7KLV�FODVV�QDPH�DOVR�FDQ�EH�IRXQG�RQ�WKH�&ODVV�WDE�RI�WKH�:LQGRZ�3URSHUWLHV�GLDORJ�ER[���,I�\RX�H[SDQG�WKH�EUDQFK�IRU�WKH�([SRUW�$V�FRPPRQ�GLDORJ��\RX�ZLOO�VHH�DOO�WKH�FRQWUROV�WKDW�PDNH�XS�WKDW�FRPPRQ�GLDORJ�ER[��,W�LV�KHUH�WKDW�\RX�FDQ�ILQG�WKH�,'V�IRU�DOO�WKH�GLDORJV�FRQWUROV��<RX�DOVR�ZLOO�VHH�D�ZLQGRZ�LQ�WKLV�OLVW�ZLWK�QR�FDSWLRQ�DQG�WKH�FODVV�QDPH�RI���������7KLV�LV�WKH�FKLOG�GLDORJ�RI�WKH�FRPPRQ�GLDORJ�ER[��FUHDWHG�IURP�WKH�GLDORJ�WHPSODWH�UHVRXUFH��,I�\RX�ORRN�DW�WKH�ZLQGRZ�SURFHGXUH�IRU�WKLV�FKLOG�GLDORJ�DQG�FRPSDUH�LW�WR�WKH�ZLQGRZ�SURFHGXUH�RI�LWV�SDUHQW�GLDORJ�ER[��\RX�ZLOO�VHH�WKDW�WKH\�DUH�WKH�VDPH��7KHUHIRUH��ZH�FDQ�GHGXFH�WKDW�DOO�PHVVDJHV�IRU�WKH�SDUHQW�DQG�WKH�FKLOG�GLDORJ�ER[HV�DUH�KDQGOHG�LQ�RQH�ZLQGRZ�SURFHGXUH��7KLV�ZLQGRZ�SURFHGXUH�LV�WKH�VDPH�IRU�WKH�GLDORJ�ER[��*HQHUDO�WDE��DV�LW�LV�IRU�WKH�FODVV��&ODVV�WDE���7KLV�PHDQV�WKDW�WKLV�ZLQGRZ��GLDORJ��SURFHGXUH�KDV�QRW�EHHQ�VXEFODVVHG��6R��WKH�GLDORJ�KRRN�SURFHGXUH�UHDOO\�LV�D�KRRN�DQG�QRW�D�VXEFODVVHG�GLDORJ�SURFHGXUH���,I�\RX�H[SDQG�WKH�EUDQFK�IRU�WKH�FKLOG�GLDORJ�ER[��\RX�ZLOO�VHH�DOO�WKH�FRQWUROV�WKDW�\RX�SODFHG�RQ�\RXU�GLDORJ�WHPSODWH�UHVRXUFH��7KH�FODVV�QDPHV�IRU�WKH�FRQWUROV�DUH�QRW�SUHFHGHG�E\�WKH�ZRUG��7KXQGHU���HYHQ�

Page 202: Visual Basic - Subclassing and Hooking with VB & VB NET

LI�\RX�GLG�LPSRUW�WKH�9%�IRUP�LQWR�WKH�9LVXDO�&���UHVRXUFH�HGLWRU��7KHUHIRUH��WKH\�ZLOO�DOO�KDYH�GLIIHUHQW�ZLQGRZ�SURFHGXUHV�ZLWK�UHVSHFW�WR�WKHLU�FODVVHV���8VLQJ�WKH�:LQGRZV�WDE�RI�WKH�:LQGRZ�3URSHUWLHV�GLDORJ�ER[��ZH�FDQ�YHULI\�WKDW�WKH�RULJLQDO�FRPPRQ�GLDORJ�ER[�LV�WKH�SDUHQW�WR�WKH�FKLOG�GLDORJ�ER[�FUHDWHG�IURP�WKH�UHVRXUFH�ILOH��7R�GR�WKLV��GRXEOH�FOLFN�WKH�FKLOG�GLDORJ�ER[�DQG�ILQG�WKH�KDQGOH�YDOXH�LQ�WKH�3DUHQW�:LQGRZ�ILHOG�RQ�WKH�:LQGRZV�WDE��&RPSDUH�WKLV�WR�WKH�KDQGOH�RI�WKH�GHIDXOW�FRPPRQ�GLDORJ�ER[��7KH\�DUH�WKH�VDPH���)RU�D�9%�DSSOLFDWLRQ��WKHUH�LV�D�ZD\�DURXQG�WKLV��7KH�:+B*(70(66$*(�KRRN�PXVW�EH�XVHG�WR�WUDS�PHVVDJHV�VHQW�WR�WKH�GLDORJ�ER[�EHIRUH�WKH\�UHDFK�WKH�GLDORJ�ER[V�GLDORJ�SURFHGXUH��7KLV�KRRN�LV�LQVWDOOHG�ZKLOH�KDQGOLQJ�WKH�:0B,1,7',$/2*�PHVVDJH�DQG�LW�LV�XQLQVWDOOHG�ZKLOH�KDQGOLQJ�WKH�:0B'(6752<�PHVVDJH��7KH�:+B*(70(66$*(�KRRN�IXQFWLRQ�WKHQ�ZDLWV�IRU�NH\ERDUG�PHVVDJHV�WR�DUULYH��:KHQ�D�NH\ERDUG�PHVVDJH�DUULYHV��LW�VHQGV�LW�WR�WKH�,V'LDORJ0HVVDJH�$3,�IXQFWLRQ��,I�WKLV�$3,�IXQFWLRQ�UHWXUQV�758(��LW�KDV�SURFHVVHG�WKH�PHVVDJH��DQG�WKH�NH\ERDUG�PHVVDJH�VKRXOG�QRW�EH�SDVVHG�RQ�WR�WKH�GHIDXOW�GLDORJ�SURFHGXUH��,I�LW�UHWXUQV�)$/6(��LW�GLG�QRW�SURFHVV�WKH�PHVVDJH��DQG�WKH�GHIDXOW�GLDORJ�SURFHGXUH�QHHGV�WR�SURFHVV�WKLV�PHVVDJH��7KH�:+B*(70(66$*(�KRRN�IXQFWLRQ�LV�GLVFXVVHG�LQ�&KDSWHU������8QIRUWXQDWHO\��LW�LV�QRW�SRVVLEOH�WR�DGG�WKH�,V'LDORJ0HVVDJH�$3,�IXQFWLRQ�WR�WKH�PDLQ�PHVVDJH�ORRS�RI�D�9%�DSSOLFDWLRQ��7KH�PDLQ�PHVVDJH�ORRS�IRU�D�9%�DSSOLFDWLRQ�LV�ORFDWHG�LQ�7KXQGHU57�0DLQ��,Q�D�9LVXDO�&���DSSOLFDWLRQ��WKH�PDLQ�PHVVDJH�ORRS�RI�DQ�DSSOLFDWLRQ�WKDW�XVHV�PRGHOHVV�GLDORJ�ER[HV�ZRXOG�ORRN�VRPHWKLQJ�OLNH�WKLV���ZKLOH��*HW0HVVDJH�PVJ��18//����������^��� � LI��18//� �K'OJ&XUUHQW�__��,V'LDORJ0HVVDJH�K'OJ&XUUHQW��PVJ���� � ^�� � ����7UDQVODWH0HVVDJH�PVJ����� � ����'LVSDWFK0HVVDJH�PVJ����� � `��`��

Page 203: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU����$FWLYH;�&RQWUROV�DQG�6XEFODVVLQJ�7KLV�FKDSWHU�GHDOV�ZLWK�WKH�GLIIHUHQW�ZD\V�RI�XVLQJ�VXEFODVVLQJ�ZLWK�DQ�$FWLYH;�FRQWURO��,W�FRYHUV�WKH�IROORZLQJ�WRSLFV���

• 6XEFODVVLQJ�D�WKLUG�SDUW\�$FWLYH;�FRQWURO�• 6XEFODVVLQJ�DQ�$FWLYH;�FRQWURO�WKDW�\RX�FUHDWHG�• 6XEFODVVLQJ�D�8VHU&RQWURO�IURP�ZLWKLQ�WKH�9LVXDO�%DVLF��9%��FRQWURO�• 6XEFODVVLQJ�D�9%�IRUP�IURP�RQH�RU�PRUH�$FWLYH;�FRQWUROV�

����6XEFODVVLQJ�D�7KLUG�3DUW\$FWLYH;�&RQWURO�

7KLV�LV�WKH�HDVLHVW�RI�WKH�IRXU�W\SHV�RI�VXEFODVVLQJ�GLVFXVVHG�LQ�WKLV�FKDSWHU��6XEFODVVLQJ�D�WKLUG�SDUW\�$FWLYH;�FRQWURO�LV�H[DFWO\�WKH�VDPH�DV�VXEFODVVLQJ�D�9%�IRUP��7KHUH�LV�QR�GLIIHUHQFH�EHFDXVH�WKH�V\VWHP�VHHV�ERWK�WKH�FRQWURO�DQG�WKH�IRUP�DV�ZLQGRZV��8VLQJ�6HW:LQGRZ/RQJ3WU��\RX�ZRXOG�VXEFODVV�WKH�FRQWURO�MXVW�OLNH�\RX�ZRXOG�DQ\�RWKHU�ZLQGRZ���3ULYDWH�6XE�)RUPB/RDG���������J&WUO:QG3URF� �6HW:LQGRZ/RQJ3WU�%XWWRQ��*HW+ZQG��*:/B:1'352&��$GGUHVV2I�&WUO3URF��(QG�6XE�<RX�VHW�XS�WKH�VXEFODVV�IXQFWLRQ�MXVW�OLNH�\RX�ZRXOG�DQ\�RWKHU�VXEFODVV�IXQFWLRQ��E\�SDVVLQJ�WKH�ZLQGRZ�PHVVDJH�RQ�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�E\�ZD\�RI�&DOO:LQGRZ3URF��DV�WKH�IROORZLQJ�VXEFODVV�IXQFWLRQ�LQGLFDWHV���3XEOLF�)XQFWLRQ�&WUO3URF�%\9DO�K:QG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�� 'R�VXEFODVVLQJ�ZRUN�KHUH�����J&WUO:QG3URF� �6HW:LQGRZ/RQJ3WU�%XWWRQ��*HW+ZQG��*:/B:1'352&��B�������������������������������������$GGUHVV2I�&WUO3URF��8VLQJ�6HW:LQGRZ/RQJ3WU��WKH�VXEFODVV�SURFHGXUH�LV�UHPRYHG�IURP�WKH�FRQWURO��VLPLODU�WR�UHPRYLQJ�WKH�VXEFODVV�SURFHGXUH�IURP�DQ\�RWKHU�ZLQGRZ���3ULYDWH�6XE�)RUPB8QORDG�&DQFHO�$V�,QWHJHU������'LP�5HW9DO�$V�/RQJ�����5HW9DO� �6HW:LQGRZ/RQJ3WU�%XWWRQ��*HW+ZQG��*:/B:1'352&��J&WUO:QG3URF��(QG�6XE�1RZ�WKDW�ZH�FDQ�VXEFODVV�D�FRQWURO��ZH�ZLOO�PRYH�RQ�WR�VXEFODVVLQJ�D�FRQWURO�WKDW�ZH�FUHDWH�ZLWKLQ�WKH�9%�HQYLURQPHQW���

Page 204: Visual Basic - Subclassing and Hooking with VB & VB NET

����6XEFODVVLQJ�DQ�$FWLYH;�&RQWURO&UHDWHG�LQ�9%��

6XEFODVVLQJ�DQ�$FWLYH;�FRQWURO�WKDW�ZH�FUHDWH�WKURXJK�9%�LV�VLPLODU�WR�VXEFODVVLQJ�D�WKLUG�SDUW\�FRQWURO��+RZHYHU��ZH�PXVW�RYHUFRPH�RQH�VPDOO�KXUGOH�ILUVW��7KH�SUREOHP�LV�WKDW�WKH�8VHU&RQWURO�PRGXOHV�KZQG�SURSHUW\�LV�QRW�YLVLEOH�RXWVLGH�RI�WKH�8VHU&RQWURO�PRGXOH���<RX�FDQ�RYHUFRPH�WKLV�SUREOHP�LQ�WZR�ZD\V��)LUVW��\RX�FDQ�XVH�WKH�)LQG:LQGRZ([�IXQFWLRQ�WR�JHW�WKH�KDQGOH�WR�WKH�FRQWURO��7KLV�IXQFWLRQ�LV�GHFODUHG�LQ�WKLV�PDQQHU�LQ�9%���3ULYDWH�'HFODUH�)XQFWLRQ�)LQG:LQGRZ([�/LE��XVHU����$OLDV��)LQG:LQGRZ([$��B�� � �%\9DO�K:QG��$V�/RQJ��%\9DO�K:QG��$V�/RQJ��B�� � %\9DO�OSV]��$V�6WULQJ��%\9DO�OSV]��$V�6WULQJ��$V�/RQJ�7KH�IXQFWLRQ�KDV�WKH�IROORZLQJ�SDUDPHWHUV��K:QG�

7KH�K:QG�RI�WKH�SDUHQW�ZLQGRZ�WR�WKH�ZLQGRZ�WKDW�\RX�ZDQW�WR�ILQG��7KH�IXQFWLRQ�XVHV�WKLV�SDUDPHWHU�DV�D�VWDUWLQJ�SRLQW�IRU�VHDUFKLQJ�IRU�WKH�WDUJHW�ZLQGRZ��,I�1XOO��WKH�IXQFWLRQ�XVHV�WKH�GHVNWRS�DV�WKH�SDUHQW�ZLQGRZ���

K:QG�

7KH�K:QG�RI�DQ\�FKLOG�ZLQGRZV�WR�WKH�ZLQGRZ�VSHFLILHG�E\�WKH�K:QG��SDUDPHWHU��,I�D�YDOLG�FKLOG�ZLQGRZ�KDQGOH�LV�SURYLGHG��WKLV�IXQFWLRQ�VWDUWV�VHDUFKLQJ�WKURXJK�DOO�WKH�ZLQGRZV�WKDW�DUH�FKLOGUHQ�WR�WKH�ZLQGRZ�VSHFLILHG�E\�WKLV�SDUDPHWHU���

OSV]�

7KH�FODVV�QDPH�RU�FODVV�DWRP�RI�WKH�ZLQGRZ�WKDW�ZH�DUH�VHDUFKLQJ�IRU��OSV]�

7KH�FDSWLRQ�RI�WKH�ZLQGRZ�WKDW�ZH�DUH�VHDUFKLQJ�IRU���,I�WKLV�IXQFWLRQ�VXFFHHGV��WKH�K:QG�RI�WKH�ZLQGRZ�LV�UHWXUQHG��RWKHUZLVH��D�]HUR�LV�UHWXUQHG��LQGLFDWLQJ�IDLOXUH���([DPSOH�����VKRZV�WKH�FRGH�WR�ILQG�WKH�K:QG�RI�D�9%�FUHDWHG�$FWLYH;�FRQWURO���

([DPSOH������)LQGLQJ�WKH�:LQGRZ�+DQGOH�RI�DQ�$FWLYH;�&RQWURO�&UHDWHG�ZLWK�9%��

3ULYDWH�6XE�)RUPB/RDG���������'LP�UHWYDO�$V�/RQJ������� 8VH�WKH�7KXQGHU8VHU&RQWURO'&�FODVV�LI�\RX�DUH�UXQQLQJ�LQVLGH�RI�WKH�,'(�����UHWYDO� �)LQG:LQGRZ([�)RUP��K:QG������7KXQGHU57�8VHU&RQWURO'&���YE1XOO6WULQJ�����(QG��6XE�

Page 205: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�ILUVW�DUJXPHQW�WR�WKH�)LQG:LQGRZ([�IXQFWLRQ�LV�WKH�KDQGOH�WR�WKH�IRUP�ZKHUH�WKH�8VHU&RQWURO�H[LVWV��7KH�VHFRQG�DUJXPHQW�LV�]HUR�EHFDXVH�WKH�8VHU&RQWURO�LV�QRW�D�FKLOG�ZLQGRZ�RI�DQRWKHU�FRQWURO�RQ�WKH�IRUP��,I�WKH�8VHU&RQWURO�ZHUH�FRQWDLQHG�LQVLGH�DQRWKHU�FRQWURO�RQ�WKH�IRUP��WKH�VHFRQG�SDUDPHWHU��K:QG���ZRXOG�FRQWDLQ�WKH�K:QG�RI�WKLV�FRQWURO���7KH�WKLUG�DUJXPHQW�LV�WKH�FODVV�QDPH�RI�WKH�8VHU&RQWURO��<RX�ILQG�WKH�FODVV�QDPH�XVLQJ�6S\����5HPHPEHU�WKDW�WKH�FODVV�QDPH�LV�GLIIHUHQW�ZKHQ�UXQQLQJ�LQVLGH�WKH�,'(�DV�RSSRVHG�WR�UXQQLQJ�LQ�D�VWDQGDORQH�H[HFXWDEOH��7KH�FODVV�QDPH�IRU�D�8VHU&RQWURO�UXQQLQJ�LQ�WKH�,'(�LV�7KXQGHU8VHU&RQWURO'&��WKH�FODVV�QDPH�IRU�D�8VHU&RQWURO�UXQQLQJ�LQ�D�VWDQGDORQH�H[HFXWDEOH�LV�7KXQGHU57�8VHU&RQWURO'&���7KH�ODVW�DUJXPHQW�LV�YE1XOO6WULQJ��<RX�XVH�WKLV�EHFDXVH�WKH�8VHU&RQWURO�KDV�QR�FDSWLRQ��:H�FDQ�YDOLGDWH�WKLV�DV�ZHOO�WKURXJK�6S\����DV�VKRZQ�LQ�)LJXUH�������

)LJXUH������/RRNLQJ�DW�WKH�FDSWLRQ�RI�D�8VHU&RQWURO�

$V�QRWHG�SUHYLRXVO\��\RX�FDQ�JHW�WKH�K:QG�RI�D�8VHU&RQWURO�LQ�DQRWKHU�ZD\��,I�\RX�XVH�WKH�2EMHFW�%URZVHU�LQFOXGHG�ZLWK�9%�WR�ORRN�WKURXJK�WKH�SURSHUWLHV�RI�WKH�8VHU&RQWURO�PRGXOH��\RXOO�ILQG�WKDW�LW�H[SRVHV�DQ�KZQG�SURSHUW\��DV�)LJXUH�����LOOXVWUDWHV��8QIRUWXQDWHO\��LW�LV�QRW�YLVLEOH�IURP�RXWVLGH�WKH�FRQWURO���

)LJXUH������%URZVLQJ�WKH�8VHU&RQWURO�REMHFW�

Page 206: Visual Basic - Subclassing and Hooking with VB & VB NET

7R�FLUFXPYHQW�WKLV�SUREOHP��,�SURYLGHG�D�SXEOLF�IXQFWLRQ�WKDW�H[SRVHV�WKH�K:QG�RI�WKH�FRQWURO��([DPSOH�����VKRZV�WKH�FRGH�XVHG�WR�H[SRVH�WKH�K:QG�RI�D�8VHU&RQWURO��$V�D�QRWH��WKLV�FRGH�PXVW�EH�FRQWDLQHG�ZLWKLQ�WKH�8VHU&RQWURO�PRGXOH�WR�DFFHVV�LWV�KZQG�SURSHUW\���

([DPSOH������5HWULHYLQJ�WKH�K:QG�RI�D�8VHU&RQWURO��

3XEOLF�)XQFWLRQ�*HW+ZQG���������*HW+ZQG� �K:QG�(QG�)XQFWLRQ�

������&UHDWLQJ�WKH�&RQWURO�

/HWV�VHH�KRZ�WKLV�ZRUNV�E\�FUHDWLQJ�D�VLPSOH�$FWLYH;�FRQWURO��6WDUW�D�QHZ�SURMHFW�DQG�VHOHFW�WKH�$FWLYH;�&RQWURO�RSWLRQ�LQ�WKH�1HZ�3URMHFW�GLDORJ��$IWHU�9%�FUHDWHV�WKH�SURMHFW��LW�ZLOO�FRQWDLQ�D�VLQJOH�8VHU&RQWURO�PRGXOH�FDOOHG�8VHU&RQWURO���7KH�ILOH�IRU�WKH�8VHU&RQWURO��PRGXOH�LV�FDOOHG�8VHU&RQWURO��FWO���)LUVW��VHOHFW�D�EDFNJURXQG�FRORU�WKDW�ZLOO�VKRZ�XS�DJDLQVW�D�IRUP�EDFNJURXQG��,Q�WKLV�FDVH��,�XVHG�WKH�3URSHUWLHV�ZLQGRZ�WR�VHW�WKH�%DFN&RORU�SURSHUW\�WR�*UHHQ��1H[W��SODFH�WKH�FRGH�VKRZQ�LQ�([DPSOH�����LQWR�8VHU&RQWURO���7KLV�DOORZV�WKH�DSSOLFDWLRQ�WKDW�LV�VXEFODVVLQJ�WKLV�FRQWURO�WR�DFFHVV�LWV�K:QG��1H[W��ZH�ZLOO�EHJLQ�WR�FUHDWH�WKH�DSSOLFDWLRQ�WKDW�VXEFODVVHV�WKLV�FRQWURO���

������&UHDWLQJ�WKH�3URMHFW�WR�6XEFODVV�WKH�&RQWURO�

Page 207: Visual Basic - Subclassing and Hooking with VB & VB NET

7R�VXEFODVV�WKH�$FWLYH;�FRQWURO�ZH�FUHDWHG��ZH�QHHG�D�FRQWDLQHU�WR�KRVW�WKH�FRQWURO��)LUVW��DGG�D�6WDQGDUG�(;(�SURMHFW�WR�WKH�$FWLYH;�FRQWURO�SURMHFW�ZH�FUHDWHG�SUHYLRXVO\��7KH�QHZ�SURMHFW�ZLOO�EH�FUHDWHG�ZLWK�D�IRUP�PRGXOH�FDOOHG�)RUP���1H[W��DGG�D��EDV�PRGXOH�WR�WKH�QHZ�SURMHFW��7KLV��EDV�PRGXOH�ZLOO�FRQWDLQ�WKH�VXEFODVV�SURFHGXUH�IRU�WKH�FRQWURO���%HIRUH�WKH�$FWLYH;�FRQWURO�WKDW�ZH�FUHDWHG�FDQ�EH�KRVWHG�LQ�WKH�IRUP�LQ�WKH�VHFRQG�SURMHFW��LW�PXVW�EH�FRPSLOHG�LQWR�DQ��RF[��7KH�FRQWURO�ZLOO�QRZ�DSSHDU�LQ�WKH�7RROER[�WRRO�ZLQGRZ��3ODFH�DQ�LQVWDQFH�RI�WKH�FRQWURO�LQ�WKH�)RUP��PRGXOH��$OVR�DGG�D�EXWWRQ��&RPPDQG���DQG�D�WH[W�ER[��7H[W���WR�WKH�IRUP��)LJXUH�����VKRZV�WKH�ILQDO�IRUP���7DEOH�����SUHVHQWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���

7DEOH������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��2EMHFW� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�

)RUP� &DSWLRQ� �6XEFODVV�D�9%�&UHDWHG�$FWLYH;�&WUO��)RUP� 7RS� ����)RUP� /HIW� ���)RUP� +HLJKW� �����)RUP� :LGWK� �����8VHU&RQWURO� 1DPH� 8VHU&RQWURO��8VHU&RQWURO� 7RS� ���8VHU&RQWURO� /HIW� ���8VHU&RQWURO� +HLJKW� �����8VHU&RQWURO� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH� &RPPDQG��&RPPDQG�%XWWRQ�� &DSWLRQ� �6XEFODVV��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ���&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����7H[W%R[� 1DPH� 7H[W��7H[W%R[� 0XOWL/LQH� 7UXH�7H[W%R[� 7RS� ���7H[W%R[� /HIW� �����7H[W%R[� +HLJKW� �����7H[W%R[� :LGWK� �����1H[W��DGG�WKH�FRGH�VKRZQ�LQ�([DPSOH�����WR�WKH�&OLFN�HYHQW�RI�WKH�&RPPDQG��EXWWRQ�FRQWURO�FRQWDLQHG�RQ�WKH�)RUP��PRGXOH��7KLV�FRGH�XVHV�WKH�*HW+ZQG�SXEOLF�PHWKRG�RI�WKH�

Page 208: Visual Basic - Subclassing and Hooking with VB & VB NET

8VHU&RQWURO��WR�UHWULHYH�LWV�K:QG��7KLV�YDOXH�LV�XVHG�LQ�WKH�6HW:LQGRZ/RQJ3WU�IXQFWLRQ�WR�VXEFODVV�WKH�$FWLYH;�FRQWURO���

)LJXUH������7KH�)RUP��IRUP��ZKLFK�KRVWV�WKH�$FWLYH;�FRQWURO�WKDW�ZH�FUHDWHG�

([DPSOH������7KH�&RPPDQG�B&OLFN�(YHQW�3URFHGXUH��

3ULYDWH�6XE�&RPPDQG�B&OLFN���������)RUP��7H[W��7H[W� ��������J&WUO:QG3URF� �6HW:LQGRZ/RQJ3WU�8VHU&RQWURO��*HW+ZQG��*:/3B:1'352&��B��������������������$GGUHVV2I�&WUO3URF��(QG�6XE�$GG�WKH�FRGH�VKRZQ�LQ�([DPSOH�����WR�WKH�)RUPB8QORDG�VXEURXWLQH�WR�UHPRYH�WKH�VXEFODVV�SURFHGXUH�IURP�WKH�$FWLYH;�FRQWURO��7KLV�LV�WKH�RQO\�FRGH�WKDW�\RX�QHHG�WR�DGG�WR�WKH�)RUP��PRGXOH���

([DPSOH������7KH�)RUPB8QORDG�(YHQW�3URFHGXUH��

3ULYDWH�6XE�)RUPB8QORDG�&DQFHO�$V�,QWHJHU������'LP�5HW9DO�$V�/RQJ�����5HW9DO� �6HW:LQGRZ/RQJ3WU�8VHU&RQWURO���*HW+ZQG��*:/3B:1'352&��J&WUO:QG3URF��(QG�6XE�1H[W��ZHOO�DGG�WKH�FRGH�VKRZQ�LQ�([DPSOH�����WR�WKH�0RGXOH��EDV�PRGXOH��7KLV��EDV�PRGXOH�FRQWDLQV�WKH�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��GHFODUDWLRQV��YDULDEOHV��DQG�FRQVWDQWV�QHHGHG�WR�LPSOHPHQW�VXEFODVVLQJ��LW�DOVR�FRQWDLQV�WKH�VXEFODVV�SURFHGXUH��$�JOREDO�YDULDEOH��J&WUO:QG3URF��LV�GHILQHG�WKDW�FRQWDLQV�D�SRLQWHU�WR�WKH�RULJLQDO�$FWLYH;�FRQWUROV�ZLQGRZ�SURFHGXUH���

Page 209: Visual Basic - Subclassing and Hooking with VB & VB NET

([DPSOH������&RGH�IRU�WKH�0RGXOH��EDV�0RGXOH��

3XEOLF�'HFODUH�)XQFWLRQ�6HW:LQGRZ/RQJ3WU�/LE��XVHU����$OLDV��6HW:LQGRZ/RQJ$��B�� � �%\9DO�K:QG�$V�/RQJ��%\9DO�Q,QGH[�$V�/RQJ��%\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ�3XEOLF�'HFODUH�)XQFWLRQ�&DOO:LQGRZ3URF�/LE��XVHU����$OLDV��&DOO:LQGRZ3URF$��B�� � �%\9DO�OS3UHY:QG)XQF�$V�/RQJ��%\9DO�K:QG�$V�/RQJ��%\9DO�0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ��3XEOLF�&RQVW�*:/3B:1'352&� ������3XEOLF�&RQVW�*:/3B86(5'$7$� �������3XEOLF�&RQVW�:0B0286($&7,9$7(� �+���3XEOLF�&RQVW�:0B/%8772183� �+����3XEOLF�&RQVW�:0B/%87721'2:1� �+����3XEOLF�&RQVW�:0B/%87721'%/&/.� �+����3XEOLF�&RQVW�:0B5%87721'%/&/.� �+����3XEOLF�&RQVW�:0B5%87721'2:1� �+����3XEOLF�&RQVW�:0B5%8772183� �+�����3XEOLF�J&WUO:QG3URF�$V�/RQJ���3XEOLF�)XQFWLRQ�&WUO3URF�%\9DO�K:QG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�����6HOHFW�&DVH�X0VJ���������&DVH�:0B/%8772183�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:0B/%8772183���YE1HZ/LQH���������&DVH�:0B/%87721'2:1�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:0B/%87721'2:1���YE1HZ/LQH���������&DVH�:0B/%87721'%/&/.�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:0B/%87721'%/&/.���YE1HZ/LQH���������&DVH�:0B5%8772183�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:0B5%8772183���YE1HZ/LQH���������&DVH�:0B5%87721'2:1�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:0B5%87721'2:1���YE1HZ/LQH���������&DVH�:0B5%87721'%/&/.�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:0B5%87721'%/&/.���YE1HZ/LQH�����(QG�6HOHFW�

Page 210: Visual Basic - Subclassing and Hooking with VB & VB NET

���������&WUO3URF� �&DOO:LQGRZ3URF�J&WUO:QG3URF��K:QG��X0VJ��Z3DUDP��%\9DO�O3DUDP��(QG�)XQFWLRQ�7KH�&WUO3URF�VXEFODVV�SURFHGXUH�FRQWDLQV�FRGH�WKDW�ZLOO�ZULWH�RXW�WH[W�WR�WKH�7H[W��WH[W�ER[�ZKHQHYHU�WKH�ULJKW�RU�OHIW�PRXVH�EXWWRQ�LV�VLQJOH�FOLFNHG�RU�GRXEOH�FOLFNHG�ZKLOH�RYHU�WKH�VXEFODVVHG�FRQWURO���7R�XVH�WKLV�DSSOLFDWLRQ��FOLFN�WKH�6XEFODVV�EXWWRQ�WR�DOORZ�WKH�IRUP�WR�VXEFODVV�WKH�9%�$FWLYH;�FRQWURO��$IWHU�WKH�FRQWURO�LV�VXEFODVVHG��\RX�FDQ�ULJKW��RU�OHIW�FOLFN�WKH�FRQWURO�ZLWK�WKH�PRXVH��DQG�WKH�7H[W��WH[W�ER[�ZLOO�GLVSOD\�WKH�PRXVH�EXWWRQV�WKDW�ZHUH�FOLFNHG��'RXEOH�FOLFN�HYHQWV�DOVR�DUH�WUDFNHG�E\�WKH�VXEFODVV�SURFHGXUH��1RWLFH�WKDW�ZKHQ�\RX�GRXEOH�FOLFN�HLWKHU�WKH�ULJKW�RU�OHIW�PRXVH�EXWWRQV��\RX�VHH�WKH�IROORZLQJ�SDWWHUQ���:0B/%87721'2:1�:0B/%8772183�:0B/%87721'%/&/.�:0B/%8772183�7KH�UHDVRQ�IRU�WKLV�SDWWHUQ�LV�GHWDLOHG�LQ�&KDSWHU����RQ�WKH�:+B0286(�PRXVH�KRRN���7KLV�LV�KRZ�\RX�VXEFODVV�DQ�$FWLYH;�FRQWURO�FUHDWHG�LQ�9%��7KH�RQO\�WKLQJ�\RX�PXVW�GR�EH\RQG�QRUPDO�VXEFODVVLQJ�LV�WR�JHW�WKH�K:QG�RI�WKH�FRQWURO�HLWKHU�E\�XVLQJ�WKH�)LQG:LQGRZ([�IXQFWLRQ�RU�E\�DGGLQJ�D�SXEOLF�PHWKRG�WR�WKH�8VHU&RQWURO�WKDW�H[SRVHV�WKH�K:QG�RI�WKH�FRQWURO���

����6XEFODVVLQJ�D�8VHU&RQWURO�IURP�:LWKLQ�D�9%�&UHDWHG�$FWLYH;�&RQWURO�

7KH�8VHU&RQWURO�LV�WKH�EDVH�RQ�ZKLFK�\RX�FUHDWH�\RXU�FRQWURO��<RX�FDQ�VXEFODVV�WKH�8VHU&RQWURO�ZKLOH�FUHDWLQJ�\RXU�RZQ�$FWLYH;�FRQWURO��)RU�H[DPSOH��\RX�PLJKW�QHHG�WR�ZDWFK�IRU�VSHFLILF�PRXVH�RU�NH\ERDUG�HYHQWV�WKDW�DUH�GLUHFWHG�WR�\RXU�FRQWURO��7R�ZDWFK�IRU�WKHVH�DQG�DQ\�RWKHU�PHVVDJHV��\RX�QHHG�WR�VXEFODVV�WKH�8VHU&RQWURO���6XEFODVVLQJ�D�8VHU&RQWURO�ZKHQ�RQO\�RQH�FRQWURO�LV�RQ�WKH�IRUP�DW�DQ\�RQH�WLPH�LV�HDV\��,Q�IDFW��LW�LV�QRW�PXFK�GLIIHUHQW�IURP�VXEFODVVLQJ�DQ\�RWKHU�ZLQGRZ��7KH�SUREOHP�RFFXUV�ZKHQ�PRUH�WKDQ�RQH�RI�WKH�VXEFODVVHG�FRQWUROV�H[LVWV�RQ�D�IRUP�DW�DQ\�RQH�WLPH���7R�VHH�ZKDW�,�PHDQ��OHWV�H[DPLQH�D�OLWWOH�PRUH�RI�KRZ�VXEFODVVLQJ�ZRUNV�ZLWK�D�9%�$FWLYH;�FRQWURO��7KH�VXEFODVV�SURFHGXUH�PXVW�H[LVW�LQ�D��EDV�PRGXOH��DQG�RQH�LQVWDQFH�RI�WKLV�PRGXOH�H[LVWV�IRU�HYHU\�FRQWURO�WKDW�LV�LQVWDQWLDWHG��+RZHYHU��RQH�LQVWDQFH�RI�D�8VHU&RQWURO�PRGXOH�LV�FUHDWHG�IRU�HDFK�LQVWDQFH�RI�WKH�FRQWURO��:KHQ�WKH�FRQWURO�LV�VXEFODVVHG��D�PHVVDJH�ZLOO�ILUVW�EH�VHQW�WR�WKH�RQO\�IXQFWLRQ�LQ�WKH��EDV�PRGXOH�WKDW�LV�DFWLQJ�DV�WKH�VXEFODVV�SURFHGXUH�IRU�DOO�LQVWDQFHV�RI�WKH�FRQWURO��7KLV�SURFHGXUH�PXVW�WKHQ�NQRZ�ZKLFK�LQVWDQFH�RI�WKH�8VHU&RQWURO�

Page 211: Visual Basic - Subclassing and Hooking with VB & VB NET

PRGXOH�WR�IRUZDUG�WKH�PHVVDJH�WR�VR�WKDW�LW�FDQ�EH�SURFHVVHG��$IWHU�WKH�PHVVDJH�LV�SURFHVVHG��LW�PXVW�EH�VHQW�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�RI�WKDW�LQVWDQFH�RI�WKH�FRQWURO��,I�WKH�PHVVDJH�LV�QRW�IRUZDUGHG�WR�WKH�FRUUHFW�RULJLQDO�ZLQGRZ�SURFHGXUH��DOO�LQVWDQFHV�RI�WKH�FRQWURO�PLJKW�VHHP�DV�WKRXJK�WKH\�DUH�QRW�SURFHVVLQJ�DQ\�PHVVDJHV���7R�EH�DEOH�WR�GLUHFW�WKH�PHVVDJH�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�RI�WKH�FRUUHFW�FRQWURO��ZH�PXVW�VWRUH�D�SRLQWHU�WR�HDFK�FRQWURO��7KLV�SRLQWHU�LV�XVHG�WR�SDVV�WKH�PHVVDJH�RQ�WR�D�IXQFWLRQ�WKDW�H[LVWV�ZLWKLQ�WKH�FRUUHFW�LQVWDQFH�RI�WKH�FRQWURO����RU��PRUH�VSHFLILFDOO\��ZLWKLQ�WKH�FRUUHFW�LQVWDQFH�RI�WKH�8VHU&RQWURO�PRGXOH��7KH�EHVW�SODFH�WR�VWRUH�WKLV�SRLQWHU�LV�LQ�WKH�8VHU'DWD�VHFWLRQ�RI�HDFK�FRQWURO��7KHQ��DV�HDFK�FRQWURO�LV�VXEFODVVHG��LW�ZLOO�VWRUH�D�UHIHUHQFH�WR�LWVHOI�LQ�LWV�RZQ�8VHU'DWD�VHFWLRQ��(YHU\�ZLQGRZ�KDV�D�8VHU'DWD�VHFWLRQ�LQ�ZKLFK�WR�VWRUH�LQIRUPDWLRQ�SHUWLQHQW�WR�LWVHOI��<RX�SODFH�GDWD�LQ�WKH�8VHU'DWD�VHFWLRQ�WKURXJK�6HW:LQGRZ/RQJ3WU�LQ�WKLV�IDVKLRQ���&DOO�6HW:LQGRZ/RQJ3WU�K:QG��*:/3B86(5'$7$�������<RX�DFFHVV�GDWD�IURP�WKH�8VHU'DWD�VHFWLRQ�WKURXJK�*HW:LQGRZ/RQJ3WU�LQ�WKLV�PDQQHU���S8VHU'DWD� �*HW:LQGRZ/RQJ3WU�K:QG��*:/3B86(5'$7$��<RX�XVH�6HW:LQGRZ/RQJ3WU�WR�VWRUH�D�SRLQWHU�WR�WKH�FRQWURO��ULJKW�DIWHU�WKH�FRQWURO�LV�VXEFODVVHG��7KH�OLQH�RI�FRGH�WKDW�GRHV�WKLV�LV���&DOO�6HW:LQGRZ/RQJ3WU�K:QG��*:/3B86(5'$7$��2EM3WU�0H���(YHU\�WLPH�WKH�VXEFODVV�IXQFWLRQ�LQ�WKH��EDV�PRGXOH�LV�FDOOHG��LW�XVHV�WKH�K:QG�YDOXH�WKDW�LV�SDVVHG�LQ�WR�LW�WR�UHWULHYH�D�SRLQWHU�WR�WKH�FRQWURO�WKURXJK�WKH�*HW:LQGRZ/RQJ3WU�IXQFWLRQ��7KH�OLQH�RI�FRGH�WKDW�GRHV�WKLV�LV���S8VHU'DWD� �*HW:LQGRZ/RQJ3WU�K:QG��*:/3B86(5'$7$��S8VHU'DWD�ZLOO�UHFHLYH�WKH�YDOXH�FRQWDLQHG�LQ�WKH�8VHU'DWD�VHFWLRQ�RI�WKH�FRQWURO�FRUUHVSRQGLQJ�WR�WKH�K:QG�YDOXH�SDVVHG�LQ�WR�LW��7KLV�YDOXH�LV�WKHQ�FDVW�WR�D�8VHU&RQWURO��REMHFW�W\SH�VR�WKDW�D�IXQFWLRQ�RQ�LW�FDQ�EH�FDOOHG�WR�KDQGOH�WKH�PHVVDJH�VHQW�WR�LW��<RX�XVH�&RS\0HPRU\�WR�FRS\�WKH�YDOXH�RI�WKH�S8VHU'DWD�YDULDEOH����ZKLFK��E\�WKH�ZD\��SRLQWV�WR�WKH�YWDEOH�RI�WKH�FRQWURO����LQWR�D�YDULDEOH�RI�W\SH�8VHU&RQWURO���7KH�FRGH�WR�GR�WKLV�LV���&RS\0HPRU\�FWO5HI7R&WUO��S8VHU'DWD����1RZ�WKH�YDULDEOH�FWO5HI7R&WUO�SRLQWV�WR�WKH�FRUUHFW�LQVWDQFH�RI�WKH�FRQWURO�WR�ZKLFK�ZH�QHHG�WR�SDVV�WKH�LQWHUFHSWHG�PHVVDJH��8VLQJ�WKLV�YDULDEOH��WKH�&WUO3URF�IXQFWLRQ�FDQ�EH�FDOOHG�RQ�WKDW�LQVWDQFH�RI�WKH�FRQWURO��7KLV�IXQFWLRQ�SURFHVVHV�WKH�PHVVDJH�DQG�SDVVHV�LW�RQ�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�RI�WKDW�FRQWURO���0DLQ&WUO3URF� �FWO5HI7R&WUO�&WUO3URF�K:QG��0VJ��Z3DUDP��O3DUDP��:KHQ�WKLV�IXQFWLRQ�UHWXUQV��WKH�FWO5HI7R&WUO�YDULDEOH�PXVW�EH�FOHDQHG�XS�DV�IROORZV���&RS\0HPRU\�FWO5HI7R&WUO�������6HW�FWO5HI7R&WUO� �1RWKLQJ�)RU�D�GLDJUDP�RI�KRZ�WKLV�ZRUNV��VHH�)LJXUH������

)LJXUH������6XEFODVVLQJ�PRUH�WKDQ�RQH�8VHU&RQWURO�

Page 212: Visual Basic - Subclassing and Hooking with VB & VB NET

<RX�PLJKW�QRWLFH�WKDW�ZH�XVHG�WKH�2EM3WU�IXQFWLRQ�WR�JHW�D�SRLQWHU�WR�DQ�LQVWDQFH�RI�WKH�FRQWURO��7KLV�LV�DQ�XQGRFXPHQWHG�IXQFWLRQ�LQ�9%�WKDW�WDNHV�DQ�REMHFW�DV�LWV�RQO\�SDUDPHWHU�DQG�UHWXUQV�D�SRLQWHU�WR�WKDW�REMHFW��,QWHUHVWLQJO\��WKLV�IXQFWLRQ�ZLOO�QRW�LQFUHPHQW�WKH�UHIHUHQFH�FRXQW�RI�WKH�REMHFW�RU�FRQWURO��7KLV�ZLOO�EH�XVHIXO�LQ�WKH�ODVW�VHFWLRQ�RI�WKLV�FKDSWHU��ZKHUH�ZHOO�EH�XVLQJ�PRUH�WKDQ�RQH�FRQWURO�WR�VXEFODVV�WKH�VDPH�IRUP���

������&UHDWLQJ�WKH�&RQWURO�

7KH�$FWLYH;�FRQWURO�WKDW�ZH�ZLOO�FUHDWH�FRQVLVWV�RI�RQO\�D�8VHU&RQWURO�DQG�QR�RWKHU�FRQVWLWXHQW�FRQWUROV��7KH�VXEFODVV�SURFHGXUH�ZDWFKHV�IRU�PRXVH�FOLFNV�DQG�FKDQJHV�WKH�EDFNJURXQG�FRORU�RI�WKH�FRQWURO�WR�D�VSHFLILF�FRORU�GHSHQGLQJ�RQ�WKH�W\SH�RI�PRXVH�PHVVDJH�LQWHUFHSWHG���

��������7KH�8VHU&RQWURO�PRGXOH�

7R�FUHDWH�WKH�$FWLYH;�FRQWURO��FUHDWH�DQ�$FWLYH;�&RQWURO�SURMHFW�LQ�9%��WKHQ�RSHQ�WKH�8VHU&RQWURO�V�FRGH�PRGXOH�VR�WKDW�\RX�FDQ�DGG�FRGH�WR�LW���)LUVW��GHFODUH�D�SULYDWH�YDULDEOH��PB2ULJ&WUO3URF�WR�KROG�WKH�DGGUHVV�RI�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�IRU�WKH�FRQWURO�LQVWDQFH���3ULYDWH�PB2ULJ&WUO3URF�$V�/RQJ�$OVR��GHFODUH�D�SULYDWH�YDULDEOH��PBKZQG&WUO��WR�FRQWDLQ�WKH�KDQGOH�WR�WKH�FRQWURO�LQVWDQFH���3ULYDWH�PBKZQG&WUO�$V�/RQJ�7KH�8VHU&RQWUROB,QLWLDOL]H�HYHQW�RFFXUV�ZKHQ�WKH�FRQWURO�LV�ILUVW�FUHDWHG�EXW�EHIRUH�LW�LV�VLWHG�RQ�WKH�FRQWDLQHU��,W�LV�XVHIXO�WR�QRWH�WKDW�WKLV�HYHQW�DOVR�LV�ILUHG�DW�GHVLJQ�WLPH��7KHUHIRUH��ZH�FDQ�XVH�WKLV�HYHQW�WR�FDOO�WKH�IXQFWLRQ�WR�VXEFODVV�WKH�FRQWURO�ERWK�DW�UXQWLPH�DQG�ZKLOH�LW�LV�LQ�WKH�,'(��DV�VKRZQ�LQ�([DPSOH�������

([DPSOH������7KH�8VHU&RQWUROB,QLWLDOL]H�(YHQW�3URFHGXUH��

Page 213: Visual Basic - Subclassing and Hooking with VB & VB NET

3ULYDWH�6XE�8VHU&RQWUROB,QLWLDOL]H���������6XE&ODVV�(QG�6XE�7KH�8VHU&RQWUROB7HUPLQDWH�HYHQW�RFFXUV�DIWHU�WKH�FRQWURO�LV�XQVLWHG�IURP�LWV�FRQWDLQHU�EXW�LPPHGLDWHO\�EHIRUH�WKH�FRQWURO�LV�GHVWUR\HG��7KLV�HYHQW�DOVR�LV�ILUHG�GXULQJ�GHVLJQ�WLPH�ZKHQ�\RX�FORVH�WKH�FKLOG�ZLQGRZ�WKDW�FRQWDLQV�WKH�IRUP�WKLV�FRQWURO�LV�VLWHG�RQ�LQ�WKH�,'(��%HFDXVH�\RX�PXVW�UHPRYH�D�VXEFODVV�SURFHGXUH�EHIRUH�WKH�VXEFODVVHG�ZLQGRZ�LV�GHVWUR\HG��LW�LV�D�JRRG�LGHD�WR�SODFH�WKH�FRGH�WR�UHPRYH�WKH�VXEFODVV�SURFHGXUH�LQ�WKH�7HUPLQDWH�HYHQW��,I�WKH�FRGH�WR�UHPRYH�WKH�VXEFODVV�SURFHGXUH�LV�QRW�H[HFXWHG��PHPRU\�OHDNV�RU�D�*HQHUDO�3URWHFWLRQ�)DXOW��*3)��PLJKW�UHVXOW�HYHU\�WLPH�WKH�FRQWURO�LV�GHVWUR\HG�LQ�WKH�,'(�RU�LQ�D�FRPSLOHG�DSSOLFDWLRQ��7KHUHIRUH��ZHOO�XVH�WKLV�HYHQW�WR�UHPRYH�WKH�VXEFODVV�IURP�WKH�FRQWURO��DV�([DPSOH�����VKRZV���

([DPSOH������7KH�8VHU&RQWUROB7HUPLQDWH�(YHQW�3URFHGXUH��

3ULYDWH�6XE�8VHU&RQWUROB7HUPLQDWH���������5HPRYH6XE&ODVV�(QG�6XE�7KH�6XE&ODVV�IXQFWLRQ�LQ�WKH�8VHU&RQWURO�PRGXOH�SHUIRUPV�WKH�VXEFODVVLQJ��LW�LV�VKRZQ�LQ�([DPSOH������,W�FKHFNV�WKH�PB2ULJ&WUO3URF�YDULDEOH�WR�GHWHUPLQH�LI�WKH�FRQWURO�ZDV�DOUHDG\�VXEFODVVHG��,I�LW�ZDV��WKH�FRQWURO�FDQQRW�EH�VXEFODVVHG�D�VHFRQG�WLPH��1H[W��LW�XVHV�6HW:LQGRZ/RQJ3WU�WR�VXEFODVV�WKH�FRQWURO��0DLQ&WUO3URF�LV�WKH�VXEFODVV�SURFHGXUH��DQG�LW�LV�FRQWDLQHG�LQ�WKH�0RGXOH��EDV�PRGXOH�LQ�WKH�FRQWURO�SURMHFW��WKLV�PRGXOH�LV�GLVFXVVHG�LQ�WKH�QH[W�VHFWLRQ���7KH�ILQDO�WKLQJ�WKLV�IXQFWLRQ�GRHV�LV�FULWLFDO�WR�WKH�FRUUHFW�RSHUDWLRQ�RI�WKH�VXEFODVVHG�FRQWURO��,W�XVHV�6HW:LQGRZ/RQJ3WU�WR�VWRUH�D�SRLQWHU�WR�WKH�LQVWDQFH�RI�WKLV�FRQWURO�LQ�LWV�RZQ�8VHU'DWD�VHFWLRQ��7KLV�DOORZV�D�SRLQWHU�WR�WKLV�FRQWURO�WR�EH�UHWULHYHG�ZKHQ�\RX�RQO\�KDYH�WKH�K:QG�WR�WKH�FRQWURO�LWVHOI���

([DPSOH������7KH�6XE&ODVV�)XQFWLRQ�WR�3HUIRUP�WKH�6XEFODVVLQJ��

3ULYDWH�6XE�6XE&ODVV��������,I�PB2ULJ&WUO3URF� ���7KHQ�������PB2ULJ&WUO3URF� �6HW:LQGRZ/RQJ3WU�K:QG��*:/3B:1'352&��$GGUHVV2I�0DLQ&WUO3URF��������PBKZQG&WUO� �K:QG��������&DOO�6HW:LQGRZ/RQJ3WU�K:QG��*:/3B86(5'$7$��2EM3WU�0H������(QG�,I�(QG�6XE�

Page 214: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�5HPRYH6XE&ODVV�IXQFWLRQ�VKRZQ�LQ�([DPSOH�����XVHV�6HW:LQGRZ/RQJ3WU�WR�UHPRYH�WKH�VXEFODVV�SURFHGXUH�IURP�WKH�FRQWURO�LQVWDQFH��,W�VHWV�PB2ULJ&WUO3URF�EDFN�WR�]HUR�WR�LQGLFDWH�WKDW�WKH�VXEFODVV�SURFHGXUH�ZDV�UHPRYHG�IURP�WKH�FRQWURO���

([DPSOH������7KH�5HPRYH6XE&ODVV�)XQFWLRQ�WR�5HPRYH�WKH�6XEFODVVLQJ��

3ULYDWH�6XE�5HPRYH6XE&ODVV������ ,I�PB2ULJ&WUO3URF��!���7KHQ��� � 6HW:LQGRZ/RQJ3WU�PBKZQG&WUO��*:/3B:1'352&��PB2ULJ&WUO3URF�� � PB2ULJ&WUO3URF� ���� (QG�,I�(QG�6XE�7KH�&WUO3URF�IXQFWLRQ�VKRZQ�LQ�([DPSOH������DFWV�DV�WKH�VXEFODVV�SURFHGXUH��7KLV�SURFHGXUH�FKDQJHV�WKH�EDFNJURXQG�FRORU�RI�WKH�FRQWURO�DQ\�WLPH�D�ULJKW�RU�OHIW�PRXVH�EXWWRQ�PHVVDJH�LV�LQWHUFHSWHG��1RWLFH�WKDW�WKH�IXQFWLRQ�LV�GHFODUHG�DV�D�)ULHQG�IXQFWLRQ��7KLV�DOORZV�IXQFWLRQV�ZLWKLQ�WKH�VFRSH�RI�WKH�SURMHFW�WR�DFFHVV�WKLV�IXQFWLRQ��EXW�GHQLHV�DFFHVV�WR�IXQFWLRQV�RXWVLGH�RI�WKLV�SURMHFW��7KLV�SUHYHQWV�DQ\�IXQFWLRQ�ZLWKLQ�WKH�DSSOLFDWLRQ�WKDW�LV�KRVWLQJ�WKLV�FRQWURO�IURP�FDOOLQJ�WKLV�IXQFWLRQ��<RX�FDQ�PDNH�WKLV�D�SXEOLF�IXQFWLRQ��EXW�LI�\RX�GLG��LW�ZRXOG�EH�YLVLEOH�IRU�WKH�ZRUOG�WR�VHH�DQG�FDOO���

([DPSOH�������&WUO3URF��WKH�6XEFODVV�3URFHGXUH��

)ULHQG�)XQFWLRQ�&WUO3URF�%\9DO�K:QG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�� 6HOHFW�&DVH�X0VJ���������&DVH�:0B/%87721'%/&/.�������������8VHU&RQWURO�%DFN&RORU� �YE%OXH���������&DVH�:0B/%87721'2:1�������������8VHU&RQWURO�%DFN&RORU� �YE5HG���������&DVH�:0B/%8772183�������������8VHU&RQWURO�%DFN&RORU� �YE&\DQ���������&DVH�:0B5%87721'%/&/.�������������8VHU&RQWURO�%DFN&RORU� �YE*UHHQ���������&DVH�:0B5%87721'2:1�������������8VHU&RQWURO�%DFN&RORU� �YE:KLWH���������&DVH�:0B5%8772183�������������8VHU&RQWURO�%DFN&RORU� �YE%ODFN�����(QG�6HOHFW������

Page 215: Visual Basic - Subclassing and Hooking with VB & VB NET

����&WUO3URF� �&DOO:LQGRZ3URF�PB2ULJ&WUO3URF��K:QG��X0VJ��Z3DUDP��%\9DO�O3DUDP��(QG�)XQFWLRQ�

��������7KH�0RGXOH��EDV�PRGXOH�

6LQFH�RXU�VXEFODVV�SURFHGXUH�PXVW�UHVLGH�RXWVLGH�RI�WKH�8VHU&RQWURO�PRGXOH�LWVHOI��DGG�D�FRGH�PRGXOH�WR�WKH�SURMHFW��%\�GHIDXOW��9%�ZLOO�QDPH�LW�0RGXOH����'HFODUH�D�FRQVWDQW�LQ�WKH�0RGXOH��EDV�PRGXOH�WR�DOORZ�WKH�6HW:LQGRZ/RQJ3WU�IXQFWLRQ�WR�SODFH�GDWD�LQWR�WKH�FRQWUROV�8VHU'DWD�VHFWLRQ���3XEOLF�&RQVW�*:/3B86(5'$7$� �������'HILQH�WKH�FWUO5HI7R&WUO�YDULDEOH�DV�IROORZV���'LP�FWO5HI7R&WUO�$V�8VHU&RQWURO��7KH�FWO5HI7R&WUO�YDULDEOH�FRQWDLQV�D�UHIHUHQFH�WR�WKH�8VHU&RQWURO��REMHFW��<RX�XVH�WKLV�UHIHUHQFH�WR�FDOO�D�IXQFWLRQ�LQ�D�SDUWLFXODU�LQVWDQFH�RI�D�FRQWURO��<RX�PXVW�XVH�WKH�8VHU&RQWURO��W\SH��\RX�FDQQRW�XVH�D�W\SH�VXFK�DV�2EMHFW�RU�&RQWURO���1H[W��DGG�WKH�S8VHU'DWD�YDULDEOH��ZKLFK�KROGV�DQ�DGGUHVV�WR�WKH�8VHU'DWD�VHFWLRQ�RI�WKH�FRQWURO���'LP�S8VHU'DWD�$V�/RQJ�7KH�0DLQ&WUO3URF�IXQFWLRQ�VKRZQ�LQ�([DPSOH������DFWV�DV�WKH�FHQWUDO�VXEFODVV�SURFHGXUH�WKDW�LQLWLDOO\�LV�FDOOHG��7KLV�IXQFWLRQ�XVHV�WKH�K:QG�YDOXH�SDVVHG�WR�LW�WR�JHW�WKH�GDWD�VWRUHG�LQ�WKH�8VHU'DWD�VHFWLRQ�RI�WKH�LQVWDQFH�RI�WKH�FRQWURO�WKDW�WKH�K:QG�YDOXH�UHIHUV�WR��,W�XVHV�WKH�SRLQWHU�VWRUHG�LQ�WKH�8VHU'DWD�VHFWLRQ�RI�WKLV�ZLQGRZ�WR�GHWHUPLQH�ZKLFK�LQVWDQFH�RI�WKH�&WUO3URF�IXQFWLRQ�LV�FDOOHG�LQ�WKH�8VHU&RQWURO��PRGXOH���

([DPSOH�������7KH�0DLQ&WUO3URF�)XQFWLRQ��

3XEOLF�)XQFWLRQ�0DLQ&WUO3URF�%\9DO�K:QG�$V�/RQJ��%\9DO�0VJ�$V�/RQJ��B���������%\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�����S8VHU'DWD� �*HW:LQGRZ/RQJ�K:QG��*:/3B86(5'$7$�������&RS\0HPRU\�FWO5HI7R&WUO��S8VHU'DWD��������0DLQ&WUO3URF� �FWO5HI7R&WUO�&WUO3URF�K:QG��0VJ��Z3DUDP��O3DUDP������&RS\0HPRU\�FWO5HI7R&WUO������������6HW�FWO5HI7R&WUO� �1RWKLQJ�(QG�)XQFWLRQ�$Q\�WLPH�DQ\�LQVWDQFH�RI�D�VXEFODVVHG�FRQWURO�UHFHLYHV�D�PHVVDJH��WKH�PHVVDJH�LV�VHQW�WR�WKLV�ZLQGRZ�SURFHGXUH��7KLV�ZLQGRZ�SURFHGXUH�FDOOV�*HW:LQGRZ/RQJ�WR�REWDLQ�WKH�8VHU'DWD�LQIRUPDWLRQ�IRU�WKH�FRQWURO�WKDW�WKH�PHVVDJH�LV�EHLQJ�VHQW�WR��5HPHPEHU�WKDW�ZKHQ�WKH�FRQWURO�LV�VXEFODVVHG��D�UHIHUHQFH�WR�LV�VWRUHG�LQ�WKH�8VHU'DWD�VHFWLRQ�RI�WKH�FRQWURO��7KH�VXEFODVV�

Page 216: Visual Basic - Subclassing and Hooking with VB & VB NET

SURFHGXUH�LV�VHQW�WKH�K:QG�RI�WKH�FRQWURO�WKDW�WKH�PHVVDJH�LV�EHLQJ�VHQW�WR��:H�FDQ�XVH�WKLV�K:QG�YDOXH�LQ�WKH�*HW:LQGRZ/RQJ�IXQFWLRQ�WR�REWDLQ�D�UHIHUHQFH�WR�WKH�FRQWURO��7R�DFWXDOO\�XVH�WKLV�UHIHUHQFH��ZH�PXVW�FRS\�LW�WR�D�YDULDEOH�RI�WKH�VDPH�W\SH�DV�WKH�UHIHUHQFH��8VLQJ�&RS\0HPRU\��ZH�FDQ�FRS\�WR�WKH�FWO5HI7R&WUO�YDULDEOH�WKH�UHIHUHQFH�FRQWDLQHG�LQ�WKH�S8VHU'DWD�YDULDEOH��ZKLFK�LV�RI�W\SH�8VHU&RQWURO��1RZ�WKH�FWO5HI7R&WUO�YDULDEOH�SRLQWV�WR�WKH�FRQWURO�WKDW�WKH�PHVVDJH�LV�EHLQJ�VHQW�WR��7KLV�YDULDEOH�LV�XVHG�WR�FDOO�WKH�&WUO3URF�IXQFWLRQ�RQ�WKH�LQVWDQFH�RI�WKH�FRQWURO�WKDW�LV�EHLQJ�SDVVHG�WKH�PHVVDJH��7KH�IXQFWLRQ�RQ�WKH�FRQWURO�LQVWDQFH�GRHV�LWV�ZRUN�DQG�UHWXUQV��,W�XVHV�&RS\0HPRU\�WR�UHPRYH�WKH�UHIHUHQFH�FRQWDLQHG�LQ�WKH�FWO5HI7R&WUO�YDULDEOH��7KHQ�LW�VHWV�WKH�FWO5HI7R&WUO�YDULDEOH�WR�1RWKLQJ���

������+RVWLQJ�WKH�&RQWURO�

7R�KRVW�WKH�FRQWURO��\RX�VLPSO\�FRPSLOH�WKH�$FWLYH;�FRQWURO�SURMHFW�LQWR�DQ�$FWLYH;�FRQWURO��2&;��DQG�WKHQ�FUHDWH�D�VHSDUDWH�VWDQGDUG�(;(�SURMHFW�WR�KRVW�WKH�FRQWURO��7KLV�SURMHFW�ZLOO�EH�FUHDWHG�ZLWK�RQH�IRUP�LQLWLDOO\��3ODFH�WKH�2&;�RQ�WKLV�IRUP��1RWH�WKDW�LI�WKH�VWDQGDUG�(;(�SURMHFW�LV�QRW�LQ�WKH�VDPH�SURMHFW�JURXS��\RX�ZLOO�KDYH�WR�VHW�D�UHIHUHQFH�WR�WKH�QHZ�FRQWURO�XVLQJ�WKH�&RPSRQHQWV�GLDORJ�ER[���3ODFH�DW�OHDVW�WZR�FRQWUROV�RQ�WKH�IRUP��<RX�GR�QRW�QHHG�WR�ZULWH�DQ\�FRGH��&RPSLOH�WKH�SURMHFW�DQG�WKHQ�UXQ�LW��7KH�IRUP�LQ�WKH�H[DPSOH�ZLOO�ORRN�OLNH�WKH�RQH�LQ�)LJXUH������7KH�FRQWUROV�DUH�DXWRPDWLFDOO\�VXEFODVVHG�ZKHQ�WKH�DSSOLFDWLRQ�LV�VWDUWHG��7KH�VXEFODVVLQJ�LV�DXWRPDWLFDOO\�UHPRYHG�ZKHQ�WKH�DSSOLFDWLRQ�HQGV��&OLFNLQJ�HDFK�FRQWURO�FKDQJHV�WKH�EDFNJURXQG�FRORU�RI�HDFK�FRQWURO�LQGHSHQGHQWO\�RI�WKH�RWKHU���

)LJXUH������6FUHHQVKRW�RI�WKH�DSSOLFDWLRQ�WKDW�LV�KRVWLQJ�WZR�RI�WKH�VXEFODVVHG�FRQWUROV�

:KHQ�\RX�FOLFN�WKH�OHIW�PRXVH�EXWWRQ�RYHU�D�FRQWURO��WKH�EDFNJURXQG�FRORU�ZLOO�FKDQJH�DFFRUGLQJ�WR�WKH�PHVVDJH�UHFHLYHG��7KH�FRORU�ZLOO�FKDQJH�WR�UHG�ZKHQ�\RX�GHSUHVV�WKH�OHIW�PRXVH�EXWWRQ�DQG�WR�F\DQ�ZKHQ�\RX�UHOHDVH�WKH�EXWWRQ��,I�\RX�GHSUHVV�WKH�OHIW�PRXVH�EXWWRQ�DQG�KROG�LW�GRZQ��\RX�ZLOO�VHH�WKH�FRQWURO�FKDQJH�WR�UHG��:KHQ�\RX�GRXEOH�FOLFN�WKH�OHIW�PRXVH�EXWWRQ��WKH�VXEFODVV�SURFHGXUH�ZLOO�UHFHLYH�PRXVH�PHVVDJHV�LQ�WKH�IROORZLQJ�RUGHU���:0B/%87721'2:1�:0B/%8772183�

Page 217: Visual Basic - Subclassing and Hooking with VB & VB NET

:0B/%87721'%/&/.�:0B/%8772183�7KH�FRQWURO�FKDQJHV�FRORU�IRU�HDFK�PHVVDJH��,I�\RX�GRXEOH�FOLFN�WKH�OHIW�PRXVH�EXWWRQ�DQG�KROG�LW�GRZQ�RQ�WKH�VHFRQG�FOLFN��\RX�ZLOO�QRWLFH�WKDW�WKH�FRORU�FKDQJHV�WR�EOXH��:KHQ�\RX�UHOHDVH�LW��WKH�FRORU�FKDQJHV�EDFN�WR�F\DQ���

����&UHDWLQJ�DQ�$FWLYH;�&RQWURO�7KDW�6XEFODVVHV�2WKHU�:LQGRZV�

:H�QHHG�WR�H[DPLQH�RQH�ODVW�VLWXDWLRQ��FUHDWLQJ�DQ�$FWLYH;�FRQWURO�WKDW�VXEFODVVHV�WKH�IRUP�WKDW�LW�LV�VLWHG�RQ��7KLV�JLYHV�XV�D�ZD\�WR�HQFDSVXODWH�D�VXEFODVVLQJ�URXWLQH�WKDW�ZH�FDQ�OLWHUDOO\�GURS�RQWR�D�IRUP�DQG�KDYH�LW�ZRUN�ZLWKRXW�UHTXLULQJ�WKDW�WKH�XVHU�RI�WKH�FRQWURO�WR�GR�DQ\WKLQJ��7KH�XVHU�GRHV�QRW�HYHQ�KDYH�WR�VHW�DQ\�SURSHUWLHV�RQ�WKH�FRQWURO��7KLV�LV�D�JRRG�ZD\�WR�GLVWULEXWH�FRPPRQ�VXEFODVVLQJ�IXQFWLRQDOLW\�EHWZHHQ�SURMHFW�GHYHORSHUV�ZLWKRXW�HYHU\�GHYHORSHU�KDYLQJ�WR�NQRZ�WKH�LQWULFDFLHV�RI�VXEFODVVLQJ�D�IRUP��)RU�LQVWDQFH��LI�HYHU\�IRUP�LQ�DQ�DSSOLFDWLRQ�QHHGHG�WR�NQRZ�ZKHWKHU�D�ODSWRSV�EDWWHU\�ZDV�JHWWLQJ�ORZ�RQ�SRZHU��\RX�FRXOG�FUHDWH�D�FRQWURO�WKDW�VXEFODVVHV�WKH�IRUP�RQWR�ZKLFK�LW�LV�GURSSHG�DQG�WKHQ�ZDWFKHV�IRU�WKH�:0B32:(5%52$'&$67�PHVVDJH���8VLQJ�D�FRQWURO�WR�VXEFODVV�WKH�IRUP�RQWR�ZKLFK�LW�LV�GURSSHG�KDV�VHYHUDO�SUREOHPV��)LUVW��ZKHQ�RQH�FRQWURO�LV�GURSSHG�RQWR�WKH�IRUP��LW�LPPHGLDWHO\�VXEFODVVHV�WKH�IRUP�DQG�VWRUHV�LWV�RULJLQDO�ZLQGRZ�SURFHGXUH��7KLV�LV�ILQH��EXW�ZKHQ�D�GHYHORSHU�GURSV�DQRWKHU�FRQWURO�RQWR�WKH�VDPH�IRUP��WKH�QHZ�FRQWURO�VXEFODVVHV�WKH�IRUP�D�VHFRQG�WLPH�DQG�VWRUHV�ZKDW�LW�WKLQNV�LV�WKH�IRUPV�RULJLQDO�ZLQGRZ�SURFHGXUH��,QVWHDG��LW�LV�VWRULQJ�WKH�DGGUHVV�WR�WKH�VXEFODVV�SURFHGXUH�RI�WKH�ILUVW�FRQWURO��$FWXDOO\��WKH�DSSOLFDWLRQ�ZLOO�VHHP�WR�ZRUN�XQWLO�\RX�FORVH�LW��:KHQ�\RX�FORVH�WKH�DSSOLFDWLRQ��WKH�RSHUDWLQJ�V\VWHP�GRHV�QRW�GHVWUR\�WKH�FRQWUROV�LQ�WKH�UHYHUVH�RUGHU�LQ�ZKLFK�WKH\�ZHUH�FUHDWHG��LQVWHDG��LW�GHVWUR\V�WKHP�LQ�QR�JXDUDQWHHG�RUGHU��7KHUHIRUH��WKH�IRUPV�RULJLQDO�ZLQGRZ�SURFHGXUH�PLJKW�RU�PLJKW�QRW�EH�UHVWRUHG��0RVW�OLNHO\�LW�ZLOO�QRW��7KLV�ZLOO�FDXVH�WKH�DSSOLFDWLRQ�WR�FUDVK���

������&UHDWLQJ�WKH�)LUVW�9HUVLRQ�RI�WKH�&RQWURO�

/HWV�VWDUW�ZLWK�WKH�FRGH�WKDW�LV�FRQWDLQHG�LQ�WKH�0RGXOH��EDV�PRGXOH��LW�LV�VKRZQ�LQ�([DPSOH��������

([DPSOH�������&RGH�LQ�WKH�0RGXOH��EDV�0RGXOH��

3ULYDWH�6XE&ODVVHG)RUPBK:QG�$V�/RQJ�������������K:QG�RI�WKH�9%�)RUP�3ULYDWH�&WUO,QVWDQFHB3WU�$V�/RQJ����������������3RLQWHU�WR�LQVWDQFH�RI�&WUO�3ULYDWH�6XE&ODVVHG)RUPB2ULJ:QG3URF�$V�/RQJ������2ULJLQDO�:QG3URF�RI�9%�)RUP�

Page 218: Visual Basic - Subclassing and Hooking with VB & VB NET

�3XEOLF�)XQFWLRQ�6XE&ODVV�K)RUP�$V�/RQJ��S6XE&ODVV&WUO�$V�8VHU&RQWURO���$V�%RROHDQ�����6XE&ODVV� �)DOVH����������,I�6XE&ODVVHG)RUPBK:QG� ���7KHQ���������6XE&ODVV� �7UXH������������������6XE&ODVVHG)RUPBK:QG� �K)RUP���������&WUO,QVWDQFHB3WU� �2EM3WU�S6XE&ODVV&WUO����������6XE&ODVVHG)RUPB2ULJ:QG3URF� �6HW:LQGRZ/RQJ3WU�K)RUP��*:/B:1'352&��B��������������������������������������$GGUHVV2I�9%)RUP:QG3URF������(QG�,I�(QG�)XQFWLRQ��3XEOLF�6XE�8Q6XE&ODVV���������&DOO�6HW:LQGRZ/RQJ3WU�6XE&ODVVHG)RUPBK:QG��*:/B:1'352&��B���������������������������6XE&ODVVHG)RUPB2ULJ:QG3URF��(QG�6XE��3ULYDWH�)XQFWLRQ�9%)RUP:QG3URF�%\9DO�K:QG�$V�/RQJ��%\9DO�Z0VJ�$V�/RQJ��B���������%\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�����'LP�R2EMHFW�$V�8VHU&RQWURO�����������&UHDWH�WKH�REMHFW�DQG�FDOO�WKH�IRUP�SURF�LQ�WKH�REMHFW�����&DOO�&RS\0HPRU\�R2EMHFW��&WUO,QVWDQFHB3WU���������9%)RUP:QG3URF� �R2EMHFW�+DQGOH0HVVDJH�6XE&ODVVHG)RUPB2ULJ:QG3URF��B�� � � � � � K:QG��Z0VJ��Z3DUDP��O3DUDP������&DOO�&RS\0HPRU\�R2EMHFW��������(QG�)XQFWLRQ�7KH�PRGXOH�GHILQHV�WKH�IROORZLQJ�WKUHH�SULYDWH�PHPEHU�YDULDEOHV���6XE&ODVVHG)RUPBK:QG

+ROGV�WKH�KDQGOH�WR�WKH�ZLQGRZ�WKDW�LV�EHLQJ�VXEFODVVHG�E\�WKH�FRQWURO���&WUO,QVWDQFHB3WU

+ROGV�D�SRLQWHU�WR�WKH�LQVWDQFH�RI�WKH�FRQWURO��7KH��EDV�PRGXOHV�VXEFODVV�SURFHGXUH�XVHV�WKLV�WR�GHWHUPLQH�ZKLFK�FRQWURO�WR�VHQG�WKH�PHVVDJH�WR���

6XE&ODVVHG)RUPB2ULJ:QG3URF

+ROGV�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�RI�WKH�VXEFODVVHG�IRUP���

Page 219: Visual Basic - Subclassing and Hooking with VB & VB NET

7KLV��EDV�PRGXOH�FRQWDLQV�WKUHH�IXQFWLRQV��RQH�WKDW�VXEFODVVHV�WKH�FRQWDLQHU�IRUP��RQH�WKDW�UHPRYHV�WKH�VXEFODVV�SURFHGXUH�IURP�WKH�FRQWDLQHU�IRUP��DQG�RQH�WKDW�FRQWDLQV�WKH�FHQWUDO�VXEFODVV�SURFHGXUH���7KH�6XE&ODVV�IXQFWLRQ�DFWXDOO\�GRHV�WKH�VXEFODVVLQJ��7KLV�IXQFWLRQ�WDNHV�WKH�IRUP�KDQGOH�WR�WKH�VXEFODVVHG�IRUP��K)RUP��DQG�WKH�SRLQWHU�WR�WKH�FRQWURO�WKDW�LV�WU\LQJ�WR�SHUIRUP�WKH�VXEFODVVLQJ��,I�WKH�6XE&ODVVHG)RUPBK:QG�YDULDEOH�FRQWDLQV�]HUR��WKH�IRUP�KDV�QRW�\HW�EHHQ�VXEFODVVHG��,Q�WKLV�FDVH��WKLV�FRQWURO�VXEFODVVHV�WKH�IRUP��WKHUHE\�SODFLQJ�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�LQ�WKH�6XE&ODVVHG)RUPB2ULJ:QG3URF�YDULDEOH�DQG�WKH�SRLQWHU�WR�LWVHOI�LQ�WKH�&WUO,QVWDQFHB3WU�YDULDEOH��7KH�VXEFODVVHG�IRUP�KZQG�DOVR�LV�VWRUHG�LQ�WKH�6XE&ODVVHG)RUPBK:QG�YDULDEOH���7KH�8Q6XE&ODVV�IXQFWLRQ�UHPRYHV�WKH�VXEFODVV�SURFHGXUH�IURP�WKH�FRQWDLQHU�IRUP��6HW:LQGRZ/RQJ3WU�LV�FDOOHG�ZLWK�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�WR�WKH�FRQWDLQHU�IRUP���9%)RUP:QG3URF�DFWV�DV�WKH�VXEFODVV�SURFHGXUH��7KLV�LV�WKH�IXQFWLRQ�WKDW�LQWHUFHSWV�WKH�PHVVDJH�EHIRUH�LW�LV�DFWXDOO\�VHQW�WR�WKH�ZLQGRZ��7KLV�IXQFWLRQ�FUHDWHV�D�SRLQWHU�WR�WKH�FRQWURO�WKDW�VKRXOG�UHFHLYH�WKH�PHVVDJH�E\�XVLQJ�&RS\0HPRU\�DQG�WKHQ�FDOOV�WKH�IXQFWLRQ�RQ�WKDW�LQVWDQFH�RI�WKH�FRQWURO�WKDW�FDQ�KDQGOH�WKH�PHVVDJH��,Q�WKLV�FDVH��WKH�+DQGOH0HVVDJH�IXQFWLRQ��VKRZQ�LQ�([DPSOH�������ZLOO�KDQGOH�WKH�PHVVDJH�VHQW�WR�LW��7KLV�WHFKQLTXH�LV�WKH�VDPH�DV�ZDV�XVHG�SUHYLRXVO\�WR�DOORZ�HDFK�FRQWURO�LQVWDQFH�WR�UHFHLYH�WKH�LQWHUFHSWHG�PHVVDJH���([DPSOH������VKRZV�WKH�FRGH�IRU�WKH�8VHU&RQWURO��FWO�PRGXOH�RI�WKH�FRQWURO���

([DPSOH�������&RGH�IRU�WKH�8VHU&RQWURO��FWO�0RGXOH��

3ULYDWH�&RQVW�:0B/%87721'2:1� �+����3ULYDWH�&RQVW�:0B/%8772183� �+�����3ULYDWH�6XEFODVVLQJ&WUO�$V�%RROHDQ��3ULYDWH�6XE�8VHU&RQWUROB,QLWLDOL]H���������6XEFODVVLQJ&WUO� �)DOVH�(QG�6XE��)ULHQG�)XQFWLRQ�+DQGOH0HVVDJH�%\9DO�SO2OG3URF�$V�/RQJ��%\9DO�K:QG�$V�/RQJ��B���������%\9DO�Z0VJ�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�����6HOHFW�&DVH�Z0VJ���������&DVH�:0B/%87721'2:1�������������8VHU&RQWURO�%DFN&RORU� �YE%OXH���������&DVH�:0B/%8772183�������������8VHU&RQWURO�%DFN&RORU� �YE:KLWH�����(QG�6HOHFW�

Page 220: Visual Basic - Subclassing and Hooking with VB & VB NET

���������+DQGOH0HVVDJH� �&DOO:LQGRZ3URF�SO2OG3URF��K:QG��Z0VJ��Z3DUDP��O3DUDP��(QG�)XQFWLRQ��3ULYDWH�6XE�8VHU&RQWUROB5HDG3URSHUWLHV�3URS%DJ�$V�3URSHUW\%DJ������6XEFODVVLQJ&WUO� �6XE&ODVV�8VHU&RQWURO�3DUHQW�K:QG��0H��(QG�6XE��3ULYDWH�6XE�8VHU&RQWUROB7HUPLQDWH���������,I�6XEFODVVLQJ&WUO�7KHQ�&DOO�8Q6XE&ODVV�(QG�6XE�7KLV�PRGXOH�KDV�RQH�SULYDWH�PHPEHU�YDULDEOH��6XE&ODVVLQJ&WUO��7KLV�YDULDEOH�DFWV�DV�D�IODJ�WKDW�GHWHUPLQHV�ZKHWKHU�WKLV�LQVWDQFH�RI�WKH�FRQWURO�LV�WKH�RQH�WKDW�DFWXDOO\�VXEFODVVHG�WKH�IRUP�DQG��WKHUHIRUH��KROGV�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��7KLV�YDULDEOH�LV�VHW�LQ�WKH�8VHU&RQWUROB5HDG3URSHUWLHV�HYHQW��ZKLFK�WULHV�WR�VXEFODVV�WKH�IRUP��,I�VXFFHVVIXO��WKLV�PHPEHU�YDULDEOH�LV�VHW�WR�758(��RWKHUZLVH��LW�LV�VHW�WR�)$/6(���7KH�8VHU&RQWUROB,QLWLDOL]H�HYHQW�LV�ILUHG�ILUVW�ZKHQ�WKH�FRQWURO�LV�VLWHG��7KLV�HYHQW�VLPSO\�LQLWLDOL]HV�WKH�6XEFODVVLQJ&WUO�PHPEHU�YDULDEOH���7KH�8VHU&RQWUROB5HDG3URSHUWLHV�HYHQW�LV�ILUHG�DIWHU�WKH�8VHU&RQWUROB,QLWLDOL]H�HYHQW�ILUHV��7KLV�HYHQW�FDOOV�WKH�PHWKRG�LQ�WKH��EDV�PRGXOH�WR�VXEFODVV�WKH�FRQWDLQHU�IRUP��,W�VHQGV�WKH�6XE&ODVV�IXQFWLRQ�WKH�K:QG�RI�WKH�SDUHQW����RU�FRQWDLQHU����ZLQGRZ�DQG�D�SRLQWHU�WR�LWVHOI��WKH�0HSRLQWHU����7KH�8VHU&RQWUROB7HUPLQDWH�HYHQW�LV�ILUHG�EHIRUH�WKH�FRQWURO�LV�GHVWUR\HG��7KLV�IXQFWLRQ�UHPRYHV�WKH�VXEFODVV�SURFHGXUH�IURP�WKH�IRUP�RQO\�LI�WKLV�LQVWDQFH�LV�UHVSRQVLEOH�IRU�LQVWDOOLQJ�WKH�VXEFODVV�SURFHGXUH��$V�D�QRWH��FRQWUROV�DUH�DOZD\V�GHVWUR\HG�EHIRUH�WKHLU�FRQWDLQLQJ�ZLQGRZ��WKLV�PHDQV�WKDW�WKH�IRUP�ZLOO�QHYHU�EH�GHVWUR\HG�EHIRUH�WKH�VXEFODVV�SURFHGXUH�LV�UHPRYHG���7KH�+DQGOH0HVVDJH�IXQFWLRQ�KDQGOHV�WKH�PHVVDJHV�VHQW�WR�WKH�ZLQGRZ�RQ�D�SHU�FRQWURO�EDVLV��7KLV�IXQFWLRQ�VLPSO\�VHWV�WKH�EDFNJURXQG�FRORU�RI�WKH�FRQWURO�GHSHQGLQJ�RQ�ZKHWKHU�WKH�OHIW�PRXVH�EXWWRQ�LV�SUHVVHG�RU�UHOHDVHG���7KLV�FRGH�FDQ�QRZ�EH�FRPSLOHG�LQWR�DQ�$FWLYH;�FRQWURO�DQG�SODFHG�RQ�D�IRUP��7KH�WHVW�IRUP��VKRZQ�LQ�)LJXUH������KDV�WKUHH�RI�WKHVH�FRQWUROV�GURSSHG�RQWR�LW��1RWH�WKDW�WKH�WHVW�IRUP�DQG�LWV�SURMHFW�FRQWDLQ�QR�FRGH��WKH�$FWLYH;�FRQWURO�GRHV�DOO�WKH�ZRUN���

)LJXUH������7KH�WHVW�IRUP�IRU�WKH�$FWLYH;�FRQWURO�

Page 221: Visual Basic - Subclassing and Hooking with VB & VB NET

5XQQLQJ�WKH�DSSOLFDWLRQ��ZH�QRWLFH�WKDW�ZKHQ�ZH�FOLFN�WKH�OHIW�PRXVH�EXWWRQ�RQ�WKH�FOLHQW�DUHD�RI�WKH�IRUP��D�VLQJOH�FRQWURO�FKDQJHV�FRORUV�DFFRUGLQJ�WR�WKH�PRXVH�FOLFNV��7KH�FRQWURO�WKDW�FKDQJHV�FRORU�LV�WKH�FRQWURO�WKDW�LQLWLDOO\�VXEFODVVHG�WKH�IRUP���&OLFNLQJ�WKH�QRQFOLHQW�DUHD�RI�WKH�IRUP�SURGXFHV�:0B1&/%87721'2:1�DQG�:0B1&/%8772183�PHVVDJHV��ZKLFK�ZH�GR�QRW�FDSWXUH��&OLFNLQJ�DQ\�RI�WKH�$FWLYH;�FRQWUROV�ZLOO�QRW�IRUFH�WKH�RQH�FRQWURO�WR�FKDQJH�EDFNJURXQG�FRORUV�HLWKHU��7KLV�LV�EHFDXVH�WKH�PRXVH�FOLFN�PHVVDJH�LV�QRW�SDVVHG�RQ�IURP�WKH�FRQWDLQHU�WR�WKH�FRQWURO���,I�ZH�SODFHG�WKHVH�FRQWUROV�ZLWKLQ�DQRWKHU�FRQWURO����VD\��D�3LFWXUH%R[�FRQWURO����ZKHUH�WKH�3LFWXUH%R[�FRQWURO�ZDV�D�FKLOG�WR�WKH�IRUP��WKH�DSSOLFDWLRQ�ZRXOG�VWLOO�ZRUN�WKH�VDPH��7KDW�LV��WKH�RQH�FRQWURO�ZRXOG�VWLOO�FKDQJH�FRORUV�RQO\�ZKHQ�WKH�FOLHQW�DUHD�RI�WKH�IRUP�ZDV�FOLFNHG��QRW�ZKHQ�WKH�FOLHQW�DUHD�RI�WKH�3LFWXUH%R[�ZDV�FOLFNHG���

������&UHDWLQJ�WKH�6HFRQG�9HUVLRQ�RI�WKH�&RQWURO�

7KH�SUHYLRXV�GHVLJQ�IRU�WKH�FRQWURO�KDV�RQH�VOLJKW�IODZ����RQO\�RQH�FRQWURO�RQ�WKH�IRUP�ZLOO�LQWHUFHSW�PHVVDJHV�WKDW�DUH�VHQW�WR�WKH�IRUP��7KLV�PHDQV�WKDW�HYHQ�WKRXJK�WKH�RWKHU�FRQWUROV�H[LVW�RQ�WKH�IRUP��WKH\�GR�QRWKLQJ�RI�DQ\�XVH��,I�\RX�PHUHO\�ZDQW�WR�SUHYHQW�SUREOHPV�ZKHQ�D�GHYHORSHU�LQDGYHUWHQWO\�DGGV�PRUH�WKDQ�RQH�FRQWURO�WR�D�IRUP��WKLV�GHVLJQ�PLJKW�EH�VXIILFLHQW��,I��LQVWHDG��\RX�ZDQW�HYHU\�VXEFODVVLQJ�FRQWURO�WR�UHFHLYH�PHVVDJHV��ZH�PXVW�PDNH�VRPH�FKDQJHV�WR�WKH�FXUUHQW�FRQWURO���,W�LV�SRVVLEOH�WR�DOORZ�WKH�LQWHUFHSWHG�PHVVDJH�WR�EH�SDVVHG�LQWR�DOO�IRUPV�VLPXOWDQHRXVO\��7KLV�DOVR�LQWURGXFHV�VRPH�SUREOHPV�WKDW�ZH�PXVW�GHDO�ZLWK��,�ZLOO�GLVFXVV�WKHVH�SUREOHPV�DV�,�GHVFULEH�WKH�UHTXLUHG�FRGH�FKDQJHV�WR�DOORZ�DOO�FRQWUROV�WR�UHFHLYH�WKH�IRUPV�PHVVDJHV���([DPSOH������SUHVHQWV�WKH�PRGLILHG�FRGH�IRU�WKH�0RGXOH��EDV�PRGXOH���

([DPSOH�������0RGLILHG�&RGH�IRU�WKH�0RGXOH��EDV�0RGXOH��

3ULYDWH�6XE&ODVVHG)RUPBK:QG�$V�/RQJ�������������K:QG�RI�WKH�9%�)RUP�3ULYDWH�&WUO,QVWDQFHB3WU����$V�/RQJ�������������$UUD\�RI�3RLQWHUV�

Page 222: Visual Basic - Subclassing and Hooking with VB & VB NET

3ULYDWH�6XE&ODVVHG)RUPB2ULJ:QG3URF�$V�/RQJ������2ULJLQDO�:QG3URF�RI�9%�)RUP��3ULYDWH�1H[WB&WUO,QVWDQFH�$V�,QWHJHU���3XEOLF�)XQFWLRQ�6XE&ODVV�K)RUP�$V�/RQJ��S6XE&ODVV&WUO�$V�8VHU&RQWURO���$V�%RROHDQ�����'LP�7HPS�$V�/RQJ�����'LP�,�$V�,QWHJHU����������6XE&ODVV� �)DOVH����������,I�1H[WB&WUO,QVWDQFH�!���7KHQ���������0VJ%R[��1R�PRUH�FRQWUROV�FDQ�VXEFODVV�WKH�IRUP������(OVH���������,I�6XE&ODVVHG)RUPBK:QG� ���7KHQ�������������1H[WB&WUO,QVWDQFH� ���������������)RU�,� ���7R�������������������&WUO,QVWDQFHB3WU�,�� ���������������1H[W�,�������������6XE&ODVVHG)RUPB2ULJ:QG3URF� �6HW:LQGRZ/RQJ3WU�K)RUP��*:/B:1'352&��B�� � � � � � $GGUHVV2I�9%)RUP:QG3URF����������(QG�,I����������������������6XE&ODVVHG)RUPBK:QG� �K)RUP���������&WUO,QVWDQFHB3WU�1H[WB&WUO,QVWDQFH�� �2EM3WU�S6XE&ODVV&WUO�������������������1H[WB&WUO,QVWDQFH� �1H[WB&WUO,QVWDQFH�������������6XE&ODVV� �7UXH�����(QG�,I�(QG�)XQFWLRQ��3XEOLF�6XE�8Q6XE&ODVV���������'LP�,�$V�,QWHJHU����������,I�6XE&ODVVHG)RUPB2ULJ:QG3URF��!���7KHQ���������&DOO�6HW:LQGRZ/RQJ3WU�6XE&ODVVHG)RUPBK:QG��*:/B:1'352&��B�������������������������������6XE&ODVVHG)RUPB2ULJ:QG3URF����������6XE&ODVVHG)RUPB2ULJ:QG3URF� �����������)RU�,� ���7R���������������&WUO,QVWDQFHB3WU�,�� ���

Page 223: Visual Basic - Subclassing and Hooking with VB & VB NET

��������1H[W�,�����(QG�,I�(QG�6XE��3ULYDWH�)XQFWLRQ�9%)RUP:QG3URF�%\9DO�K:QG�$V�/RQJ��%\9DO�Z0VJ�$V�/RQJ��B���������%\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�����'LP�R2EMHFW�$V�8VHU&RQWURO������'LP�,�$V�,QWHJHU����������)RU�,� ���7R�����������,I�&WUO,QVWDQFHB3WU�,��!���7KHQ�������������&DOO�&RS\0HPRU\�R2EMHFW��&WUO,QVWDQFHB3WU�,������������������9%)RUP:QG3URF� �R2EMHFW�+DQGOH0HVVDJH�6XE&ODVVHG)RUPB2ULJ:QG3URF��B�� � � � � � � K:QG��Z0VJ��Z3DUDP��O3DUDP��������������&DOO�&RS\0HPRU\�R2EMHFW����������������(QG�,I�����1H[W�,�(QG�)XQFWLRQ�7KH�PDMRU�FKDQJH�WR�WKLV�PRGXOH�LV�WKDW�WKH�&WUO,QVWDQFHB3WU�PHPEHU�YDULDEOH�LV�QRZ�DQ�DUUD\��7KRXJK�WKLV�DUUD\�LV�VHW�WR�D�VL]H�RI�ILYH��WKH�FRGH�FRXOG�EH�FKDQJHG�WR�DOORZ�DQ�XQERXQGHG�QXPEHU�RI�FRQWUROV�WR�EH�SODFHG�RQ�WKH�IRUP�DW�DQ\�RQH�WLPH��,�OHIW�WKLV�LQIOH[LELOLW\�LQ�WKH�FRGH�VR�WKDW�WKH�FRGH�ZRXOG�VWD\�OHDQ�DQG�HDVLHU�WR�UHDG���7KH�6XE&ODVV�IXQFWLRQ�VWLOO�XVHV�RQO\�6HW:LQGRZ/RQJ3WU�WR�VXEFODVV�WKH�IRUP�IRU�WKH�ILUVW�LQVWDQFH�RI�WKH�FRQWURO�WKDW�LV�VLWHG�RQ�WKH�IRUP��7KLV�IXQFWLRQ�DGGV�FRGH�WR�VDYH�D�SRLQWHU�WR�HDFK�LQVWDQFH�RI�WKH�FRQWURO�LQWR�WKH�&WUO,QVWDQFHB3WU�DUUD\���7KH�8Q6XE&ODVV�IXQFWLRQ�FDOOV�6HW:LQGRZ/RQJ3WU�WR�UHPRYH�WKH�VXEFODVV�SURFHGXUH�IRU�WKH�FRQWURO�WKDW�LQVWDOOHG�WKH�VXEFODVV�SURFHGXUH��7KHQ��HDFK�HOHPHQW�RI�WKH�&WUO,QVWDQFHB3WU�DUUD\�LV�LQLWLDOL]HG�EDFN�WR�]HUR���7KH�9%)RUP:QG3URF�IXQFWLRQ�LV�PRGLILHG�WR�LWHUDWH�WKURXJK�WKH�HQWLUH�DUUD\�RI�SRLQWHUV�WR�FRQWUROV�DQG�FDOO�WKH�+DQGOH0HVVDJH�IXQFWLRQ�RQ�HDFK�FRQWURO���1R�FKDQJHV�ZHUH�PDGH�WR�WKH�8VHU&RQWURO��FWO�PRGXOH���:H�QRZ�FDQ�SODFH�WKLV�FRQWURO�RQ�D�WHVW�IRUP��2QFH�DJDLQ��ZH�GR�QRW�QHHG�WR�DGG�DQ\�FRGH�WR�WKH�IRUP�IRU�WKH�VXEFODVVLQJ�WR�ZRUN�SURSHUO\��)LJXUH�����VKRZV�D�WHVW�IRUP�WKDW�KRVWV�WKUHH�FRQWUROV���

)LJXUH������6FUHHQVKRW�RI�WKH�WHVW�IRUP�KRVWLQJ�WKUHH�RI�WKH�QHZ�FRQWUROV�

Page 224: Visual Basic - Subclassing and Hooking with VB & VB NET

:KHQ�WKLV�DSSOLFDWLRQ�UXQV�DQG�WKH�FOLHQW�DUHD�RI�WKH�IRUP�LV�FOLFNHG��WKH�EDFNJURXQG�FRORUV�RI�HDFK�FRQWURO�QRZ�FKDQJH�FRORU�LQ�XQLVRQ��$�VPDOO�SUREOHP�RFFXUV��KRZHYHU��DQG�ZH�PXVW�UHPHG\�LW��LI�WKH�IRUP�LV�UHVL]HG��PRYHG��PLQLPL]HG��RU�PD[LPL]HG��WKH�DSSOLFDWLRQ�JRHV�KD\ZLUH��7KH�IRUP�DQG�LWV�FRQWUROV�ZLOO�QRW�SDLQW�SURSHUO\��DQG�WKH�PRXVH�FXUVRU�EHFRPHV�VWXFN�ZKHQ�WKH�IRUP�LV�UHVL]HG��7KHVH�DUH�MXVW�VRPH�RI�WKH�SUREOHPV��5DWKHU�WKDQ�JRLQJ�RQ�DERXW�KRZ�WKH�DSSOLFDWLRQ�IDLOV�WR�ZRUN�SURSHUO\��,�ZLOO�VKRZ�\RX�ZK\�LW�IDLOV�WR�ZRUN�SURSHUO\���1RWLFH�WKDW�WKH�9%)RUP:QG3URF�VXEFODVV�SURFHGXUH�LQ�([DPSOH������ORRSV�WKURXJK�DOO�WKH�FRQWUROV�WKDW�H[LVW�LQ�WKH�&WUO,QVWDQFHB3WU�DUUD\�DQG�FDOOV�WKH�+DQGOH0HVVDJH�IXQFWLRQ�IRU�HDFK�LQVWDQFH�RI�WKH�FRQWURO��:KHQ�WKH�ORRS�LV�GRQH��LW�SDVVHV�EDFN�WKH�UHWXUQ�YDOXH�RI�WKH�ODVW�FDOO�WR�+DQGOH0HVVDJH��7KLV�YDOXH�ZLOO�DOPRVW�DOZD\V�EH�]HUR�XQOHVV�RQO\�RQH�FRQWURO�H[LVWV�RQ�WKH�IRUP��5HPHPEHU�WKDW�WKH�9%)RUP:QG3URF�IXQFWLRQ�LV�WKH�VXEFODVV�SURFHGXUH�DQG�WKH�YDOXH�WKDW�WKLV�IXQFWLRQ�UHWXUQV�GHWHUPLQHV�KRZ�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�KDQGOHV�WKLV�PHVVDJH��:KHQ�D�]HUR�LV�UHWXUQHG��WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�WKLQNV�WKH�PHVVDJH�ZDV�KDQGOHG�DQG�QR�PRUH�SURFHVVLQJ�VKRXOG�RFFXU�RQ�WKDW�PHVVDJH��7KH�RSHUDWLQJ�V\VWHP�EHFRPHV�FRQIXVHG�DERXW�ZKDW�LW�VKRXOG�GR��LI�DQ\WKLQJ��7KLV�LV�ZK\�WKH�IRUP�EHKDYHV�RGGO\���

������&UHDWLQJ�WKH�7KLUG�9HUVLRQ�RI�WKH�&RQWURO�

7R�IL[�WKLV�SUREOHP��ZH�FDQ�PRGLI\�9%)RUP:QG3URF��DV�([DPSOH������VKRZV��(VVHQWLDOO\��WKLV�IXQFWLRQ�QRZ�FDOOV�RQO\�WKH�+DQGOH0HVVDJH�IXQFWLRQ�IRU�WKH�LQVWDQFH�RI�WKH�FRQWURO�WKDW�VXEFODVVHG�WKH�IRUP��IRU�DOO�RWKHU�LQVWDQFHV�RI�WKH�FRQWURO��LW�FDOOV�WKH�+DQGOH2WKHUV�PHWKRG��7KLV�DOORZV�WKH�UHWXUQ�YDOXH�RI�WKH�FRQWURO�WKDW�DFWXDOO\�VXEFODVVHG�WKH�IRUP�WR�EH�UHWDLQHG��7KLV�YDOXH�LV�WKHQ�SDVVHG�EDFN�E\�WKLV�IXQFWLRQ���

([DPSOH�������7KH�7KLUG�9HUVLRQ�RI�WKH�9%)RUP:QG3URF�3URFHGXUH��

3ULYDWH�)XQFWLRQ�9%)RUP:QG3URF�%\9DO�K:QG�$V�/RQJ��%\9DO�Z0VJ�$V�/RQJ��B���������%\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�����'LP�R2EMHFW�$V�8VHU&RQWURO������'LP�,�$V�,QWHJHU�����'LP�5HW9DO�$V�/RQJ������

Page 225: Visual Basic - Subclassing and Hooking with VB & VB NET

����)RU�,� ���7R�����������,I�&WUO,QVWDQFHB3WU�,���!���7KHQ�������������&DOO�&RS\0HPRU\�R2EMHFW��&WUO,QVWDQFHB3WU�,������������������,I�,� ���7KHQ�����������������5HW9DO� �R2EMHFW�+DQGOH0HVVDJH�6XE&ODVVHG)RUPB2ULJ:QG3URF��B�� � � � � � K:QG��Z0VJ��Z3DUDP��O3DUDP��������������(OVH�����������������&DOO�R2EMHFW�+DQGOH2WKHUV�K:QG��Z0VJ��Z3DUDP��O3DUDP��������������(QG�,I�������������&DOO�&RS\0HPRU\�R2EMHFW����������������(QG�,I�����1H[W�,����������2WKHUZLVH�WKLV�PDLQ�VXEFODVV�SURF�RQO\�UHWXUQV�]HUR������9%)RUP:QG3URF� �5HW9DO�(QG�)XQFWLRQ�7KH�8VHU&RQWURO��FOW�PRGXOH�LV�PRGLILHG��DV�([DPSOH������VKRZV��(YHU\WKLQJ�VWD\V�WKH�VDPH�LQ�WKLV�PRGXOH�H[FHSW�IRU�WKH�DGGLWLRQ�RI�WKH�+DQGOH2WKHUV�IXQFWLRQ��7KLV�IXQFWLRQ�KDQGOHV�WKH�PHVVDJHV�SDVVHG�WR�DOO�WKH�RWKHU�FRQWUROV�WKDW�GLG�QRW�VXEFODVV�WKH�IRUP��1RWLFH�WKDW�WKH�RQO\�GLIIHUHQFH�EHWZHHQ�WKH�+DQGOH2WKHUV�DQG�+DQGOH0HVVDJH�IXQFWLRQV�LV�WKDW�WKH�ODWWHU�FDOOV�&DOO:LQGRZ3URF��7KLV�DOORZV�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�WR�KDQGOH�WKH�PHVVDJH�RQO\�RQFH��,I�DOO�FRQWUROV�FDOOHG�WKH�+DQGOH0HVVDJH�IXQFWLRQ��WKH�PHVVDJH�ZRXOG�EH�SDVVHG�LQ�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�RQFH�IRU�HYHU\�FRQWURO�LQVWDQFH��7KLV�LV�YHU\�EDG�DQG�FRQIXVHV�WKH�ZLQGRZ�DERXW�ZKDW�VWDWH�LW�LV�LQ���

([DPSOH�������7KH�7KLUG�9HUVLRQ�RI�WKH�8VHU&RQWURO��FWO�0RGXOH��

3ULYDWH�&RQVW�:0B/%87721'2:1� �+����3ULYDWH�&RQVW�:0B/%8772183� �+�����3ULYDWH�6XEFODVVLQJ&WUO�$V�%RROHDQ��3ULYDWH�6XE�8VHU&RQWUROB,QLWLDOL]H���������6XEFODVVLQJ&WUO� �)DOVH�(QG�6XE��)ULHQG�)XQFWLRQ�+DQGOH2WKHUV�%\9DO�K:QG�$V�/RQJ��%\9DO�Z0VJ�$V�/RQJ��B�� � � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�����6HOHFW�&DVH�Z0VJ�

Page 226: Visual Basic - Subclassing and Hooking with VB & VB NET

��������&DVH�:0B/%87721'2:1�������������8VHU&RQWURO�%DFN&RORU� �YE%OXH���������&DVH�:0B/%8772183�������������8VHU&RQWURO�%DFN&RORU� �YE:KLWH�����(QG�6HOHFW�(QG�)XQFWLRQ��)ULHQG�)XQFWLRQ�+DQGOH0HVVDJH�%\9DO�2ULJ3URF�$V�/RQJ��%\9DO�K:QG�$V�/RQJ��B���������%\9DO�Z0VJ�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�����6HOHFW�&DVH�Z0VJ���������&DVH�:0B/%87721'2:1�������������8VHU&RQWURO�%DFN&RORU� �YE%OXH���������&DVH�:0B/%8772183�������������8VHU&RQWURO�%DFN&RORU� �YE:KLWH�����(QG�6HOHFW����������+DQGOH0HVVDJH� �&DOO:LQGRZ3URF�2ULJ3URF��K:QG��Z0VJ��Z3DUDP��O3DUDP��(QG�)XQFWLRQ��3ULYDWH�6XE�8VHU&RQWUROB5HDG3URSHUWLHV�3URS%DJ�$V�3URSHUW\%DJ������6XEFODVVLQJ&WUO� �6XE&ODVV�8VHU&RQWURO�3DUHQW�K:QG��0H��(QG�6XE��3ULYDWH�6XE�8VHU&RQWUROB7HUPLQDWH���������,I�6XEFODVVLQJ&WUO�7KHQ�&DOO�8Q6XE&ODVV�(QG�6XE�$V�\RX�FDQ�VHH��WKHUH�DUH�PDQ\�GLIIHUHQW�ZD\V�WR�XVH�VXEFODVVLQJ�ZLWK�$FWLYH;�FRQWUROV��:KLFK�PHWKRG�\RX�FKRRVH�ZLOO�GHSHQG�RQ�WKH�DSSOLFDWLRQ���7KH�UHDO�EHQHILW�RI�XVLQJ�VXEFODVVLQJ�ZLWK�$FWLYH;�FRQWUROV�LV�WKDW�\RX�JDLQ�WKH�DELOLW\�WR�GURS�D�VXEFODVVLQJ�FRQWURO�RQWR�D�IRUP��DQG�QRWKLQJ�PRUH�QHHGV�WR�EH�GRQH��7KLV�HQFDSVXODWLRQ�RI�WKH�VXEFODVVLQJ�IXQFWLRQDOLW\�LV�D�ZRQGHUIXO�WKLQJ���

Page 227: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU����6XSHUFODVVLQJ�7KLV�FKDSWHU�LV�GLYLGHG�LQWR�WZR�VHFWLRQV��7KH�ILUVW�VHFWLRQ�GHDOV�VWULFWO\�ZLWK�GHILQLQJ�DQG�FRPSDULQJ�VXSHUFODVVLQJ�WR�VXEFODVVLQJ��7KH�VHFRQG�VHFWLRQ�WDNHV�D�FORVHU�ORRN�DW�XVLQJ�RQO\�WKH�:LQGRZV�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IURP�ZLWKLQ�9LVXDO�%DVLF��9%��WR�FUHDWH�D�ZLQGRZ�FODVV�DQG�LQVWDQWLDWH�D�ZLQGRZ�IURP�WKDW�FODVV��7KLV�PDWHULDO�ZLOO�QRW�RQO\�GLVFXVV�WKH�XVH�RI�VHYHUDO�$3,V�UHTXLUHG�IRU�VXSHUFODVVLQJ�ZLWKLQ�9%��EXW�LW�ZLOO�DOVR�JLYH�D�EHWWHU�ORRN�LQWR�PHVVDJH�ORRSV�DQG�ZLQGRZ�FUHDWLRQ��,�ZLOO�SURYLGH�DQ�H[DPSOH��ZULWWHQ�VWULFWO\�LQ�9%��WR�GHPRQVWUDWH�VXSHUFODVVLQJ�IURP�VWDUW�WR�ILQLVK���

����:KDW�,V�6XSHUFODVVLQJ"�

6XSHUFODVVLQJ��DOVR�NQRZQ�DV�FODVV�FORQLQJ��DOORZV�XV�WR�EXLOG�XSRQ�DQ�H[LVWLQJ�ZLQGRZ�FODVV��6HH�)LJXUH�����IRU�DQ�LOOXVWUDWLRQ�RI�WKLV�WHFKQLTXH��7KH�H[LVWLQJ�FODVV�LV�FDOOHG�WKH�EDVH�FODVV��7KLV�FDQ�EH�DQ\�DYDLODEOH�FODVV�GHILQHG�E\�WKH�V\VWHP�RU�E\�DQ�DSSOLFDWLRQ��7KH�EDVH�FODVV�LQIRUPDWLRQ��REWDLQHG�IURP�LWV�:1'&/$66(;�VWUXFWXUH��LV�FRSLHG�LQWR�D�VHFRQG�:1'&/$66(;�VWUXFWXUH��7KLV�VHFRQG�:1'&/$66(;�VWUXFWXUH�LV�WKH�EHJLQQLQJ�RI�RXU�VXSHUFODVV��%HIRUH�ZH�KDYH�D�XVDEOH�VXSHUFODVV��ZH�PXVW�GR�D�FRXSOH�RI�WKLQJV�WR�WKLV�QHZ�FODVV�VWUXFWXUH��:H�PXVW�JLYH�LW�D�QHZ�FODVV�QDPH��D�QHZ�LQVWDQFH�KDQGOH��DQG�D�QHZ�ZLQGRZ�SURFHGXUH��$OVR��ZH�PXVW�UHJLVWHU�LW�ZLWK�WKH�V\VWHP��$IWHU�ZH�GR�WKLV�ZH�KDYH�D�VXSHUFODVV�WKDW�ZH�FDQ�XVH�WR�FUHDWH�QHZ�VSHFLDOL]HG�ZLQGRZV�IRU�RXU�DSSOLFDWLRQV���

)LJXUH������7KH�VXSHUFODVVLQJ�WHFKQLTXH�

Page 228: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�QHZ�ZLQGRZ�SURFHGXUH�ZH�SURYLGH�IRU�WKH�VXSHUFODVV�GHILQHV�WKH�EHKDYLRU�RI�ZLQGRZV�GHULYHG�IURP�WKLV�FODVV��:H�FDQ�DOVR�PRGLI\�PHPEHUV�RI�WKH�VXSHUFODVVV�:1'&/$66(;�VWUXFWXUH��)RU�H[DPSOH��WKH�VW\OH�PHPEHU�FDQ�EH�PRGLILHG�WR�FKDQJH�WKH�ZLQGRZV�ERUGHU��RU�WKH�KEU%DFNJURXQG�PHPEHU�FDQ�EH�FKDQJHG�WR�GHILQH�WKH�ZLQGRZV�GHIDXOW�EDFNJURXQG�FRORU��7KHVH�PRGLILFDWLRQV�DUH�OHIW�WR�WKH�GHYHORSHUV�GLVFUHWLRQ���:KHQ�WKH�VXSHUFODVVLQJ�DSSOLFDWLRQ�WHUPLQDWHV��LW�VKRXOG�UHPRYH�DOO�VXSHUFODVVHV�WKDW�LW�FUHDWHG�IURP�PHPRU\��,W�GRHV�WKLV�WKURXJK�D�FDOO�WR�WKH�8QUHJLVWHU&ODVV�$3,�IXQFWLRQ��:KHQ�DQ�DSSOLFDWLRQ�WHUPLQDWHV��LW�DXWRPDWLFDOO\�XQUHJLVWHUV�LWV�FODVVHV��H[FHSW�IRU�FODVVHV�FUHDWHG�E\�G\QDPLF�OLQN�OLEUDULHV��'//V��XQGHU�:LQGRZV�17�RU�:LQGRZV�������)RU�WKLV�UHDVRQ��\RX�VKRXOG�DOZD\V�FDOO�8QUHJLVWHU&ODVV���

������6LPLODULWLHV�DQG�'LIIHUHQFHV�%HWZHHQ�6XEFODVVLQJ�DQG�6XSHUFODVVLQJ�

6XSHUFODVVLQJ�KDV�PXFK�LQ�FRPPRQ�ZLWK�JOREDO�VXEFODVVLQJ��VHH�)LJXUH�����DQG�)LJXUH�����IRU�WKLV�FRPSDULVRQ��(DFK�PRGLILHV�D�ZLQGRZ�FODVV�VWUXFWXUH��*OREDO�VXEFODVVLQJ�PRGLILHV�

Page 229: Visual Basic - Subclassing and Hooking with VB & VB NET

WKH�RULJLQDO�ZLQGRZ�FODVV�VWUXFWXUH��ZKLOH�VXSHUFODVVLQJ�PRGLILHV�D�QHZ�ZLQGRZ�FODVV�FUHDWHG�IURP�WKH�RULJLQDO��RU�EDVH��ZLQGRZ�FODVV�VWUXFWXUH���

)LJXUH������*OREDO�VXEFODVVLQJ�

%RWK�WKH�VXSHUFODVVLQJ�DQG�JOREDO�VXEFODVVLQJ�WHFKQLTXHV�PRGLI\�WKH�OSIQ:QG3URF�PHPEHU�IXQFWLRQ�RI�WKH�ZLQGRZ�FODVV��*OREDO�VXEFODVVLQJ�PRGLILHV�WKH�OSIQ:QG3URF�PHPEHU�RI�WKH�RULJLQDO�ZLQGRZ�FODVV��6XSHUFODVVLQJ�PRGLILHV�WKH�OSIQ:QG3URF�PHPEHU�RI�WKH�QHZ�VXSHUFODVV�VWUXFWXUH���%HFDXVH�VXSHUFODVVLQJ�DQG�JOREDO�VXEFODVVLQJ�PRGLI\�WKH�ZLQGRZ�FODVV��VXEVHTXHQW�ZLQGRZV�FUHDWHG�IURP�WKLV�PRGLILHG�FODVV�FDOO�WKH�QHZ�ZLQGRZ�SURFHGXUH��ZKLFK�ZH�GHILQH��7KHUHIRUH��ZH�FDQ�XVH�ERWK�WHFKQLTXHV�WR�PRGLI\�WKH�EHKDYLRU�RI�DOO�ZLQGRZV�EHORQJLQJ�WR�D�VLQJOH�ZLQGRZ�FODVV��,QVWDQFH�VXEFODVVLQJ�DOORZV�RQO\�D�VLQJOH�ZLQGRZ�LQVWDQFH�WR�EH�PRGLILHG���6XSHUFODVVLQJ�LV�YHU\�GLIIHUHQW�IURP�LQVWDQFH�VXEFODVVLQJ��DV�)LJXUH�����DQG�)LJXUH�����VKRZ��6XSHUFODVVLQJ�PRGLILHV�WKH�OSIQ:QG3URF�PHPEHU�RI�WKH�FODVV�VWUXFWXUH��ZKLOH�LQVWDQFH�

Page 230: Visual Basic - Subclassing and Hooking with VB & VB NET

VXEFODVVLQJ�PRGLILHV�WKH�OSIQ:QG3URF�FRQWDLQHG�LQ�WKH�ZLQGRZ�LWVHOI��5HPHPEHU��ZKHQ�WKH�ZLQGRZ�LV�FUHDWHG��LW�UHFHLYHV�D�FRS\�RI�WKH�FODVV�VWUXFWXUH�LQIRUPDWLRQ�XVHG�WR�FUHDWH�LW��,Q�LQVWDQFH�VXEFODVVLQJ��WKH�OSIQ:QG3URF�UHVLGLQJ�LQ�WKH�ZLQGRZ�LV�PRGLILHG��7KHUHIRUH��LQVWDQFH�VXEFODVVLQJ�PRGLILHV�WKH�EHKDYLRU�RI�RQO\�D�VLQJOH�ZLQGRZ���

)LJXUH������,QVWDQFH�VXEFODVVLQJ�

$OO�W\SHV�RI�VXEFODVVLQJ�UHTXLUH�WKDW�WKH�OSIQ:QG&ODVV�IXQFWLRQ�SRLQWHU�EH�UHVWRUHG�WR�LWV�RULJLQDO�YDOXH��,I�WKLV�LV�QRW�GRQH��WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�ZLOO�EH�GHVWUR\HG�ZKLOH�PHVVDJHV�DUH�VWLOO�EHLQJ�VHQW�WR�LW�WKURXJK�WKH�OSIQ:QG3URF�IXQFWLRQ�SRLQWHU��7KH�OSIQ:QG3URF�EHFRPHV�LQYDOLG�DW�WKLV�SRLQW�DQG�FDXVHV�\RXU�DSSOLFDWLRQ�WR�FUDVK���6XSHUFODVVLQJ��RQ�WKH�RWKHU�KDQG��GRHV�QRW�UHTXLUH�WKH�OSIQ:QG3URF�IRU�DQ\�FODVV�RU�ZLQGRZ�EH�UHVWRUHG�WR�LWV�RULJLQDO�VWDWH��6XSHUFODVVLQJ�FUHDWHV�D�QHZ�ZLQGRZ�FODVV�IURP�WKH�EDVH�FODVV��EXW�XQOLNH�JOREDO�VXEFODVVLQJ��LW�GRHV�QRW�PRGLI\�WKH�EDVH�ZLQGRZ�FODVV��,QVWHDG��VXSHUFODVVLQJ�PRGLILHV�WKH�QHZ�ZLQGRZ�FODVV��DQG�WKHUHIRUH��WKH�OSIQ:QG3URF�RI�WKH�EDVH�FODVV�LV�DOZD\V�YDOLG��7KLV�PHDQV�WKDW�WKHUH�LV�QR�QHHG�WR�UHVWRUH�WKH�PHPEHU�YDOXHV�RI�WKH�EDVH�FODVV�ZKHQ�H[LWLQJ�WKH�DSSOLFDWLRQ��$V�IRU�WKH�VXSHUFODVV��DQ\�ZLQGRZ�WKH�VXSHUFODVV�FUHDWHV�ZLOO�EH�GHVWUR\HG�EHIRUH�WKH�VXSHUFODVV�ZLQGRZ�SURFHGXUH�LV�GHVWUR\HG��7KHUHIRUH��WKH�OSIQ:QG3URF�LV�YDOLG�DV�ORQJ�DV�WKH�ZLQGRZ�LV�LQ�PHPRU\���

Page 231: Visual Basic - Subclassing and Hooking with VB & VB NET

6XSHUFODVVLQJ�DOORZV�WKH�:0B&5($7(�DQG�:0B1&&5($7(�ZLQGRZ�PHVVDJHV�WR�EH�FDSWXUHG��2QO\�JOREDO�VXEFODVVLQJ�DOVR�JLYHV�\RX�WKLV�DELOLW\��7KLV�ZRUNV�EHFDXVH�WKH�PRGLILHG�OSIQ:QG3URF�LV�LQKHULWHG�IURP�WKH�ZLQGRZ�FODVV�ZKHQ�D�ZLQGRZ�LV�FUHDWHG��7KLV�IRUFHV�DOO�ZLQGRZ�FUHDWLRQ�PHVVDJHV�WR�LQLWLDOO\�SDVV�WKURXJK�RXU�ZLQGRZ�SURFHGXUH��:H�FDQQRW�FDSWXUH�ZLQGRZ�FUHDWLRQ�PHVVDJHV�XVLQJ�LQVWDQFH�VXEFODVVLQJ�EHFDXVH�WKLV�WHFKQLTXH�GRHV�QRW�RSHUDWH�RQ�WKH�ZLQGRZ�FODVV��,QVWDQFH�VXEFODVVLQJ�LV�SHUIRUPHG�DIWHU�D�ZLQGRZ�KDV�EHHQ�FUHDWHG���7R�UHFDS��WKH�IROORZLQJ�OLVW�FRPSDUHV�VXSHUFODVVLQJ�ZLWK�VXEFODVVLQJ��

• 6XSHUFODVVLQJ�LV�VLPLODU�WR�JOREDO�VXEFODVVLQJ�LQ�WKH�IROORZLQJ�ZD\V��o %RWK�GHDO�ZLWK�D�FODVV�VWUXFWXUH��o %RWK�PRGLI\�WKH�OSIQ:QG3URF�PHPEHU�RI�D�ZLQGRZ�FODVV�VWUXFWXUH���o 6XEVHTXHQW�ZLQGRZV�FUHDWHG�IURP�WKH�PRGLILHG�FODVV�XVH�WKH�VDPH�

GHYHORSHU�GHILQHG�ZLQGRZ�SURFHGXUH���o %RWK�DOORZ�WKH�FDSWXUH�RI�ZLQGRZ�FUHDWLRQ�PHVVDJHV���

• 6XSHUFODVVLQJ�LV�GLIIHUHQW�IURP�JOREDO�VXEFODVVLQJ�LQ�WKH�IROORZLQJ�ZD\V���o 6XSHUFODVVLQJ�FUHDWHV�D�QHZ�ZLQGRZ�FODVV�DQG�PRGLILHV�LW��ZKLOH�JOREDO�

VXEFODVVLQJ�PRGLILHV�WKH�RULJLQDO�ZLQGRZ�FODVV���o $SSOLFDWLRQV�LQFRUSRUDWLQJ�VXSHUFODVVLQJ��FOHDQ�XS��E\�FDOOLQJ�

8QUHJLVWHU&ODVV�RQ�DOO�VXSHUFODVVHG�FODVVHV��$SSOLFDWLRQV�LQFRUSRUDWLQJ�JOREDO�VXEFODVVLQJ��FOHDQ�XS��E\�FDOOLQJ�6HW&ODVV/RQJ3WU�WR�UHVWRUH�WKH�RULJLQDO�ZLQGRZ�FODVV�WR�LWV�LQLWLDO�VWDWH���

o 6XSHUFODVVLQJ�UHTXLUHV�WKDW�WKH�OS&ODVV1DPH�PHPEHU�RI�WKH�ZLQGRZ�FODVV�VWUXFWXUH�EH�PRGLILHG��<RX�VKRXOG�QRW�PRGLI\�WKLV�PHPEHU�WKURXJK�JOREDO�VXEFODVVLQJ���

• 6XSHUFODVVLQJ�LV�FRPSOHWHO\�GLIIHUHQW�IURP�LQVWDQFH�VXEFODVVLQJ�LQ�WKH�IROORZLQJ�ZD\���o 6XSHUFODVVLQJ�PRGLILHV�WKH�EHKDYLRU�RI�DOO�ZLQGRZV�FUHDWHG�IURP�D�VLQJOH�

FODVV��,QVWDQFH�VXEFODVVLQJ�PRGLILHV�WKH�EHKDYLRU�RI�D�VLQJOH�ZLQGRZ�LQVWDQFH���

������:KHQ�WR�8VH�6XSHUFODVVLQJ�

<RX�VKRXOG�XVH�VXSHUFODVVLQJ�LQVWHDG�RI�LQVWDQFH�VXEFODVVLQJ�ZKHQ�\RX�QHHG�WR�PRGLI\�WKH�EHKDYLRU�RI�DOO�ZLQGRZV�FUHDWHG�IURP�D�VLQJOH�ZLQGRZ�FODVV��,QVWDQFH�VXEFODVVLQJ�GRHV�QRW�JLYH�XV�WKLV�DELOLW\��$OWKRXJK�JOREDO�VXEFODVVLQJ�DOVR�PRGLILHV�WKH�EHKDYLRU�RI�DOO�ZLQGRZV�FUHDWHG�IURP�D�VLQJOH�FODVV��WKHUH�DUH�VXEWOH�GLIIHUHQFHV�EHWZHHQ�VXSHUFODVVLQJ�DQG�JOREDO�VXEFODVVLQJ���7KH�PDLQ�DGYDQWDJH�WR�XVLQJ�VXSHUFODVVLQJ�RYHU�JOREDO�VXEFODVVLQJ�LV�WKDW�VXSHUFODVVLQJ�GRHV�QRW�PRGLI\�WKH�EDVH�ZLQGRZ�FODVV��,QVWHDG��LW�SUHVHUYHV�WKH�EDVH�ZLQGRZ�FODVV�LQIRUPDWLRQ��7KLV�DOORZV�XV�WR�XVH�ERWK�WKH�EDVH�ZLQGRZ�FODVV�DQG�WKH�VXSHUFODVVHG�ZLQGRZ�

Page 232: Visual Basic - Subclassing and Hooking with VB & VB NET

FODVV�LQ�RXU�DSSOLFDWLRQV��7KLV�LV�QRW�SRVVLEOH�ZLWK�JOREDO�VXEFODVVLQJ��*OREDO�VXEFODVVLQJ�GLUHFWO\�PRGLILHV�WKH�ZLQGRZ�FODVV�VWUXFWXUH�VR�WKDW�DOO�ZLQGRZV�FUHDWHG�DIWHU�ZH�KDYH�PRGLILHG�WKH�OSIQ:QG3URF�PHPEHU�DUH�QHFHVVDULO\�VXEFODVVHG���

����+RZ�WKH�6XSHUFODVVLQJ�([DPSOH�:RUNV�

7R�LOOXVWUDWH�KRZ�\RX�XVH�VXSHUFODVVLQJ��,�ZLOO�VWHS�WKURXJK�FUHDWLQJ�D�UHODWLYHO\�VLPSOH�DSSOLFDWLRQ�ZKLFK�VXSHUFODVVHV�WZR�H[LVWLQJ�ZLQGRZ�FODVVHV��,�ZURWH�WKH�FRGH�FRPSOHWHO\�LQ�9%��+RZHYHU��,�ZURWH�LW�XVLQJ�:LQGRZV�$3,�IXQFWLRQV��9LVXDO�&���GHYHORSHUV�PLJKW�UHFRJQL]H�WKLV�FRGH�WR�EH�VLPLODU�WR�WKH�VWDQGDUG��KHOOR�ZRUOG��DSSOLFDWLRQ�ZULWWHQ�LQ�9LVXDO�&�����7KH�H[DPSOH�ZLOO�ILUVW�VXSHUFODVV�WKH�7KXQGHU5W�)RUP'&�FODVV�WKDW�LV�XVHG�WR�FUHDWH�9%�IRUPV��7KH�QHZ�FODVV�ZLOO�EH�LGHQWLILHG�E\�WKH�QDPH�1HZ0DLQ:LQGRZ&ODVV��,W�ZLOO�KDYH�LWV�RZQ�ZLQGRZ�SURFHGXUH�DQG�ZLOO�XVH�WKH�,'&B83$552:�PRXVH�SRLQWHU�DV�LWV�GHIDXOW�SRLQWHU��1RUPDOO\��ZLQGRZ�FODVVHV�XVH�WKH�,'&B$552:�IRU�WKHLU�PRXVH�SRLQWHU��7KH�,'&B83$552:�PRXVH�SRLQWHU�LV�VLPSO\�DQ�DUURZ�SRLQWHU�VLPLODU�WR�WKH�GHIDXOW�PRXVH�SRLQWHU��H[FHSW�WKDW�LW�SRLQWV�VWUDLJKW�XS�LQVWHDG�RI�XSZDUG�DQG�WR�WKH�OHIW���7KH�FDSWLRQ�IRU�WKH�ILUVW�ZLQGRZ�FUHDWHG�IURP�WKH�1HZ0DLQ:LQGRZ&ODVV�VXSHUFODVV�ZLOO�EH��0DLQ�:LQGRZ���DV�)LJXUH�����VKRZV��$OO�VXEVHTXHQW�ZLQGRZV�FUHDWHG�IURP�WKLV�FODVV�ZLOO�KDYH�WKH�FDSWLRQ��1HZ�:LQGRZ���DV�)LJXUH�����VKRZV���

)LJXUH������7KH�PDLQ�ZLQGRZ�

)LJXUH������7KH�QHZ�ZLQGRZ�

Page 233: Visual Basic - Subclassing and Hooking with VB & VB NET

,Q�DGGLWLRQ�WR�VXSHUFODVVLQJ�7KXQGHU57�)RUP'&��ZHOO�DOVR�VXSHUFODVV�WKH�V\VWHP�ZLGH�%87721�ZLQGRZ�FODVV��7KLV�LV�WKH�FODVV�WKDW�FUHDWHV�WKH�VWDQGDUG�SXVK�EXWWRQ�RU�FRPPDQG�EXWWRQ�FRQWURO��:HOO�QDPH�WKH�QHZ�%87721�FODVV�1HZ%XWWRQ&ODVV�DQG�GHILQH�D�QHZ�ZLQGRZ�SURFHGXUH�IRU�LW��7KLV�QHZ�ZLQGRZ�SURFHGXUH�ZLOO�FKDQJH�WKH�EHKDYLRU�RI�WKH�:0B/%8772183�PRXVH�EXWWRQ�PHVVDJH��:KHQ�WKH�XVHU�FOLFNV�WKH�OHIW�PRXVH�EXWWRQ�RYHU�WKLV�VXSHUFODVVHG�EXWWRQ��LW�ZLOO�FUHDWH�D�QHZ�ZLQGRZ�IURP�WKH�FODVV�1HZ0DLQ:LQGRZ&ODVV�DQG�WKHQ�SODFH�D�EXWWRQ�FUHDWHG�IURP�WKH�1HZ%XWWRQ&ODVV�FODVV�RQ�WKH�ZLQGRZ���:KHQ�\RX�VWDUW�XS�WKH�(;(�IRU�WKLV�H[DPSOH��LW�ZLOO�LQLWLDOO\�FUHDWH�D�VXSHUFODVVHG�7KXQGHU57�)RUP'&�ZLQGRZ�FRQWDLQLQJ�D�VXSHUFODVVHG�%87721�FRQWURO��:KHQ�\RX�FOLFN�WKH�EXWWRQ�FRQWURO��LW�ZLOO�FUHDWH�D�QHZ�IRUP�ZLWK�D�QHZ�EXWWRQ�FRQWURO��7KH�FDSWLRQ�IRU�WKLV�QHZ�ZLQGRZ�ZLOO�EH��1HZ�:LQGRZ���7KH�EXWWRQ�RQ�WKH�QHZO\�FUHDWHG�ZLQGRZ�DOVR�FDQ�FUHDWH�D�QHZ�VXSHUFODVVHG�7KXQGHU57�)RUP'&�ZLQGRZ�FRQWDLQLQJ�D�VXSHUFODVVHG�%87721�FRQWURO���7KH�DSSOLFDWLRQ�WHUPLQDWHV�ZKHQ�\RX�FORVH�WKH�PDLQ�ZLQGRZ��WKH�RQH�ZLWK�WKH��0DLQ�:LQGRZ��FDSWLRQ���7KLV�FORVHV�DOO�ZLQGRZV�EHORQJLQJ�WR�WKLV�DSSOLFDWLRQ�DQG�VKXWV�GRZQ�WKH�DSSOLFDWLRQ���

������7KH�&RGH�

,W�LV�QRW�DV�HDV\�WR�LPSOHPHQW�VXSHUFODVVLQJ�LQ�9%�DV�LW�LV�WR�LPSOHPHQW�VXEFODVVLQJ��9%�GRHV�QRW�DOORZ�WKH�GHYHORSHU�GLUHFW�DFFHVV�WR�ZLQGRZ�FODVVHV�RU�WR�WKH�PHVVDJH�ORRS��9%�KDQGOHV�WKHVH�WKLQJV�EHKLQG�WKH�VFHQHV��7KLV�LV�ZK\�ZH�QHHG�WR�LQFRUSRUDWH�VHYHUDO�:LQGRZV�$3,�IXQFWLRQV�LQWR�RXU�VXSHUFODVVLQJ�DSSOLFDWLRQ��7KHVH�:LQGRZV�$3,�IXQFWLRQV�JLYH�XV�WKH�DELOLW\�WR�FUHDWH�RXU�RZQ�ZLQGRZ�FODVVHV��LQVWDQWLDWH�D�ZLQGRZ�IURP�WKDW�FODVV��DQG�FUHDWH�RXU�RZQ�PHVVDJH�ORRS���7KH�PHVVDJH�ORRS�WKDW�ZH�FUHDWH�GRHV�QRW�UHSODFH�WKH�PHVVDJH�ORRS�WKDW�9%�SURYLGHV��,QVWHDG��WKH�PHVVDJH�ORRS�ZH�FUHDWH�UXQV�LQ�SDUDOOHO�ZLWK�WKH�9%�PHVVDJH�ORRS��%RWK�ORRSV�ZLOO�EH�UXQQLQJ�LQ�WKH�VDPH�WKUHDG�DQG�ZLOO�EH�JUDEELQJ�PHVVDJHV�IURP�WKDW�WKUHDGV�PHVVDJH�TXHXH��5HPHPEHU��9%�FUHDWHV�RQH�WKUHDG�IRU�DOO�LWV�DSSOLFDWLRQV��DQG�HYHU\�WKUHDG�FUHDWHV�D�PHVVDJH�TXHXH�DQG�D�PHVVDJH�ORRS�IRU�LWVHOI��$V�VXFK��ERWK�PHVVDJH�ORRSV��LQVWHDG�RI�RQO\�WKH�WKUHDGV�GHIDXOW�PHVVDJH�ORRS��ZLOO�EH�UXQQLQJ��,W�GRHV�QRW�PDWWHU�ZKLFK�ORRS�UHFHLYHV�D�PHVVDJH�EHFDXVH�ERWK�ORRSV�ZLOO�GLVSDWFK�WKH�PHVVDJH�WR�WKH�FRUUHFW�ZLQGRZ�IRU�SURFHVVLQJ���

Page 234: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�SURMHFW�W\SH�IRU�WKLV�DSSOLFDWLRQ�LV�D�6WDQGDUG�(;(�SURMHFW�DQG�ZLOO�FRQWDLQ�D�IRUP��)RUP��IUP��WKDW�FRQWDLQV�QR�FRQWUROV�DQG�QR�FRGH��,WV�RQO\�XVH�LV�WR�SURYLGH�WKH�RULJLQDO�FODVV�LQIRUPDWLRQ�WKDW�ZLOO�EH�WKH�IRXQGDWLRQ�RI�RXU�1HZ0DLQ:LQGRZ&ODVV�FODVV��7KLV�SURMHFW�DOVR�ZLOO�FRQWDLQ�D�%$6�PRGXOH��0RGXOH��EDV��WKDW�FRQWDLQV�DOO�WKH�FRGH�IRU�WKLV�SURMHFW���

��������7KH�PRGXOH�OHYHO�GHFODUDWLRQV�

7KH�FRQVWDQWV�IRU�WKH�%$6�PRGXOH�DUH�GHILQHG�DV�IROORZV��0RGXOH�6FRSH�&RQVW�3ULYDWH�&RQVW�6&%XWWRQ&ODVV1DPH� ��1HZ%WWQ&ODVV��3ULYDWH�&RQVW�:LQGRZ&ODVV1DPH� ��1HZ0DLQ:QG&ODVV��7KHVH�WZR�FRQVWDQWV�FRQWDLQ�WKH�FODVV�QDPHV�RI�WKH�VXSHUFODVVHG�EXWWRQ�DQG�IRUP���7KH�YDULDEOHV�IRU�WKH�%$6�PRGXOH�DUH�GHILQHG�DV�IROORZV��0RGXOH�6FRSH�9DUV�3ULYDWH�PBKZQG0DLQ�$V�/RQJ��3ULYDWH�PB2ULJ%WWQ:LQ3URF�$V�/RQJ�3ULYDWH�PB2ULJ:LQ3URF�$V�/RQJ��3ULYDWH�PB&UHDWHG:QG+DQGOHV�����$V�/RQJ�PBKZQG0DLQ�FRQWDLQV�WKH�KDQGOH�WR�WKH�ILUVW�LQVWDQFH�RI�WKH�ZLQGRZ�FUHDWHG�IURP�WKH�1HZ0DLQ:QG&ODVV�FODVV��PB2ULJ%WWQ:LQ3URF�FRQWDLQV�WKH�SRLQWHU�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�RI�WKH�%87721�FODVV��/LNHZLVH��PB2ULJ:LQ3URF�FRQWDLQV�WKH�SRLQWHU�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�RI�WKH�7KXQGHU57�)RUP'&�FODVV���7KH�PB&UHDWHG:QG+DQGOHV�G\QDPLF�DUUD\�ZLOO�FRQWDLQ�WKH�K:QGV�RI�HYHU\�QHZ�VXSHUFODVVHG�ZLQGRZ�WKDW�LV�FUHDWHG�ZKHQ�\RX�FOLFN�WKH�VXSHUFODVVHG�EXWWRQ�FRQWURO��:H�XVH�WKLV�DUUD\�EHFDXVH�ZH�PXVW�WHUPLQDWH�DOO�WKH�ZLQGRZV�WKDW�ZH�FUHDWH�IURP�WKH�VXSHUFODVVHG�7KXQGHU57�)RUP'&�FODVV��,I�ZH�GR�QRW��WKH�8QUHJLVWHU&ODVV�IXQFWLRQ�ZLOO�QRW�EH�DEOH�WR�UHPRYH�WKH�ZLQGRZV�IURP�PHPRU\�EHIRUH�WKH�DSSOLFDWLRQ�VKXWV�GRZQ���

��������7KH�6XE�0DLQ�SURFHGXUH�

%HFDXVH�WKH�SURMHFWV�VWDUWXS�REMHFW�LV�VHW�WR�6XE�0DLQ��WKH�0DLQ�VXEURXWLQH�LV�WKH�ILUVW�FRGH�H[HFXWHG�LQ�WKLV�H[DPSOH�DSSOLFDWLRQ��7KH�FRGH�IRU�WKH�0DLQ�VXEURXWLQH�DSSHDUV�LQ�([DPSOH������7KH�VXEURXWLQH�ILUVW�ORDGV�D�9%�IRUP��ZKLFK�ZH�XVH�WR�UHWULHYH�WKH�FODVV�LQIRUPDWLRQ�IRU�WKH�7KXQGHU57�)RUP'&�FODVV��1H[W��WKLV�VXEURXWLQH�FDOOV�WKH�5HJLVWHU)RUP&ODVV�DQG�5HJLVWHU%XWWRQ&ODVV�IXQFWLRQV��ZKLFK�DUH�VKRZQ�LQ�([DPSOH�����DQG�([DPSOH������UHVSHFWLYHO\��%RWK�RI�WKHVH�IXQFWLRQV�FUHDWH�WKH�VXSHUFODVVHG�FODVVHV�IURP�WKH�7KXQGHU57�)RUP'&�DQG�%87721�FODVVHV��$IWHU�ZHYH�VXSHUFODVVHG�ERWK�WKH�9%�IRUP�DQG�WKH�FRPPDQG�EXWWRQ��WKH�QH[W�IXQFWLRQ��&UHDWH0DLQ:LQGRZ��ZKLFK�LV�VKRZQ�LQ�([DPSOH���

Page 235: Visual Basic - Subclassing and Hooking with VB & VB NET

���FDOOV�&UHDWH:LQGRZ([�WR�FUHDWH�WKH�LQLWLDO�ZLQGRZ�IURP�WKH�VXSHUFODVVHG�7KXQGHU57�)RUP'&�FODVV��7KH�&UHDWH6XSHU&OV%WWQ�IXQFWLRQ��ZKLFK�LV�VKRZQ�LQ�([DPSOH������FDOOV�&UHDWH:LQGRZ([�WR�FUHDWH�WKH�EXWWRQ�FRQWURO��ZKLFK�LV�SODFHG�RQ�WKH�SUHYLRXVO\�FUHDWHG�ZLQGRZ���

([DPSOH������7KH�0DLQ�6XEURXWLQH��

3XEOLF�6XE�0DLQ���������'LP�VWUXFW0VJ�$V�0VJ�����'LP�VWUXFW$FFHO�$V�/RQJ���3RLQWHU�WR�+$&&(/�VWUXFWXUH����������,QLWLDOL]DWLRQ�����VWUXFW$FFHO� ���������������1R�DFFHOHUDWRU�WDEOHV�LQ�WKLV�SURMHFW������&UHDWH�ZLQGRZ�WR�VWHDO�FODVV�LQIR�IURP�����/RDG�)RUP���������������5HJLVWHU�PDLQ�ZLQGRZ�����,I�5HJLVWHU)RUP&ODVV� �7UXH�7KHQ���������5HJLVWHU�EXWWRQ�VXSHUFODVV���������,I�5HJLVWHU%XWWRQ&ODVV� �7UXH�7KHQ�������������&UHDWLRQ�������������,I�&UHDWH0DLQ:LQGRZ� �7UXH�7KHQ�������������&UHDWH�PDLQ�ZLQGRZ�����������������,I�&UHDWH6XSHU&OV%WWQ� �7UXH�7KHQ�������&UHDWH�EXWWRQ�VXSHUFODVV���������������������0HVVDJH�ORRS��0HVVDJH�SXPS����������������������'R�:KLOH�*HW0HVVDJH�VWUXFW0VJ�����������������������������������,I�1RW��7UDQVODWH$FFHOHUDWRU�VWUXFW0VJ�KZQG��VWUXFW$FFHO��B���������������������������������VWUXFW0VJ���7KHQ�����������������������������&DOO�7UDQVODWH0HVVDJH�VWUXFW0VJ������������������������������&DOO�'LVSDWFK0HVVDJH�VWUXFW0VJ��������������������������(QG�,I���������������������/RRS�����������������(QG�,I�������������(QG�,I����������������������&OHDQ�XS�������������&DOO�8QUHJLVWHU&ODVV�6&%XWWRQ&ODVV1DPH��$SS�K,QVWDQFH��������������&DOO�8QUHJLVWHU&ODVV�:LQGRZ&ODVV1DPH��$SS�K,QVWDQFH����������(QG�,I�

Page 236: Visual Basic - Subclassing and Hooking with VB & VB NET

����(QG�,I����������8QORDG�)RUP��(QG�6XE�,I�HDFK�IXQFWLRQ�UHWXUQV�VXFFHVVIXOO\��WKH�PHVVDJH�ORRS�LV�VWDUWHG��7KLV�ORRS�UXQV�XQWLO�WKH�:0B48,7�PHVVDJH�LV�UHFHLYHG��:KHQ�WKH�*HW0HVVDJH�IXQFWLRQ�SURFHVVHV�WKH�:0B48,7�PHVVDJH��LW�DXWRPDWLFDOO\�UHWXUQV�D�)$/6(�YDOXH��7KLV�LV�WKH�RQO\�PHVVDJH�WKDW�SURGXFHV�D�)$/6(�UHWXUQ�YDOXH�IRU�WKH�*HW0HVVDJH�IXQFWLRQ���7KH�FRGH�ZLWKLQ�WKLV�PHVVDJH�ORRS�ILUVW�FKHFNV�LI�WKLV�LV�DQ�DFFHOHUDWRU�PHVVDJH��,I�VR��7UDQVODWH$FFHOHUDWRU�LV�WKH�RQO\�IXQFWLRQ�WKDW�SURFHVVHV�WKH�PHVVDJH��,I�WKH�PHVVDJH�LV�QRW�DQ�DFFHOHUDWRU��WKH�7UDQVODWH0HVVDJH�DQG�WKH�'LVSDWFK0HVVDJH�IXQFWLRQV�SURFHVV�WKH�PHVVDJH�DQG�SDVV�LW�RQ�WR�WKH�DSSURSULDWH�ZLQGRZ�SURFHGXUH���$IWHU�WKH�PHVVDJH�ORRS�UHFHLYHV�WKH�:0B48,7�PHVVDJH��WKH�*HW0HVVDJH�IXQFWLRQ�UHWXUQV�)$/6(�DQG�WKH�PHVVDJH�ORRS�LV�H[LWHG��1RZ�WKDW�WKH�DSSOLFDWLRQ�LV�WHUPLQDWLQJ��WKH�VXSHUFODVVHG�7KXQGHU57�)RUP'&�DQG�%87721�FODVVHV�PXVW�EH�GHVWUR\HG�WR�SURSHUO\�FOHDQ�XS�WKH�DSSOLFDWLRQ��7KH�8QUHJLVWHU&ODVV�IXQFWLRQ�GHVWUR\V�WKHVH�FODVVHV��,W�LV�GHILQHG�LQ�9%�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�8QUHJLVWHU&ODVV�/LE��XVHU����$OLDV��8QUHJLVWHU&ODVV$��B�� � �%\9DO�OS&ODVV1DPH�$V�6WULQJ��%\9DO�K,QVWDQFH�$V�/RQJ��$V�/RQJ�7KLV�IXQFWLRQ�UHPRYHV�WKH�FODVV�WKDW�WKH�5HJLVWHU&ODVV([�$3,�IXQFWLRQ�FUHDWHG�IURP�PHPRU\��,W�WDNHV�RQO\�WZR�DUJXPHQWV��WKH�ILUVW�LV�WKH�QDPH�RI�WKH�FODVV��OS&ODVV1DPH���DQG�WKH�VHFRQG�LV�WKH�PRGXOH�KDQGOH�IRU�WKH�FODVV��K,QVWDQFH���7KH�YDOXH�IRU�WKH�PRGXOH�KDQGOH�DUJXPHQW��K,QVWDQFH��LV�HTXLYDOHQW�WR�WKH�K,QVWDQFH�PHPEHU�RI�WKH�:1'&/$66(;�VWUXFWXUH���/DVWO\��WKH�)RUP��IRUP�LV�XQORDGHG�IURP�PHPRU\��%HFDXVH�WKLV�LV�WKH�ODVW�IRUP�OHIW�LQ�WKH�DSSOLFDWLRQ��WKH�DSSOLFDWLRQ�HQGV���1RWH�WKDW�9%�FRQVLGHUV�WKLV�DSSOLFDWLRQ�WR�FRQVLVW�RI�RQO\�D�VLQJOH�IRUP��)RUP���7KLV�LV�EHFDXVH��E\�XVLQJ�&UHDWH:LQGRZ([�WR�FUHDWH�D�ZLQGRZ��ZH�DUH�FLUFXPYHQWLQJ�9%V�IRUP�FUHDWLRQ�PHWKRGV��,Q�GRLQJ�VR��9%�ZLOO�QRW�NHHS�D�UHIHUHQFH�FRXQW�RI�RXU�ZLQGRZV�FUHDWHG�ZLWK�&UHDWH:LQGRZ([���

��������0HVVDJH�ORRS�RSHUDWLRQ�

,�DGGHG�D�PHVVDJH�ORRS�WR�WKLV�DSSOLFDWLRQ�WR�JLYH�\RX�D�EHWWHU�LGHD�RI�KRZ�WKH�ORRS�ZRUNV�DQG�ZKHUH�LW�ILWV�LQWR�DQ�DSSOLFDWLRQ��:H�GR�QRW�DFWXDOO\�KDYH�WR�ZULWH�WKLV�SLHFH�RI�FRGH�EHFDXVH�9%�FUHDWHV�LWV�RZQ�PHVVDJH�ORRS�IRU�HDFK�DSSOLFDWLRQ��<RX�FDQ�GHWHUPLQH�WKLV�E\�UHPRYLQJ��RU�FRPPHQWLQJ�RXW��WKH�FRGH�WKDW�PDNHV�XS�WKH�ORRS��DV�([DPSOH�����VKRZV��DQG�UXQQLQJ�WKH�DSSOLFDWLRQ��$V�D�QRWH��\RX�DOVR�ZLOO�KDYH�WR�UHPRYH�WKH�OLQH�FRQWDLQLQJ�WKH�FRGH�8QORDG�)RUP��LQ�WKLV�IXQFWLRQ��7KH�DSSOLFDWLRQ�IXQFWLRQV�WKH�VDPH�UHJDUGOHVV�RI�ZKHWKHU�WKLV�ORRS�LV�LQFOXGHG�LQ�WKH�FRGH���

Page 237: Visual Basic - Subclassing and Hooking with VB & VB NET

([DPSOH������7KH�0DLQ�6XEURXWLQH��

3XEOLF�6XE�0DLQ���������'LP�VWUXFW0VJ�$V�0VJ�����'LP�VWUXFW$FFHO�$V�/RQJ���3RLQWHU�WR�+$&&(/�VWUXFWXUH����������,QLWLDOL]DWLRQ�����VWUXFW$FFHO� ���������������1R�DFFHOHUDWRU�WDEOHV�LQ�WKLV�SURMHFW������&UHDWH�ZLQGRZ�WR�VWHDO�FODVV�LQIR�IURP�����/RDG�)RUP���������������5HJLVWHU�PDLQ�ZLQGRZ�����,I�5HJLVWHU)RUP&ODVV� �7UXH�7KHQ���������5HJLVWHU�EXWWRQ�VXSHUFODVV���������,I�5HJLVWHU%XWWRQ&ODVV� �7UXH�7KHQ�������������&UHDWLRQ�������������,I�&UHDWH0DLQ:LQGRZ� �7UXH�7KHQ�������������&UHDWH�PDLQ�ZLQGRZ�����������������,I�&UHDWH6XSHU&OV%WWQ� �7UXH�7KHQ�������&UHDWH�EXWWRQ�VXSHUFODVV�����������������(QG�,I�������������(QG�,I���������(QG�,I�����(QG�,I�(QG�6XE�,I��KRZHYHU��ZH�GR�DGG�WKLV�PHVVDJH�ORRS�WR�WKH�DSSOLFDWLRQ��ERWK�PHVVDJH�ORRSV�ZLOO�EH�ZRUNLQJ�LQ�SDUDOOHO�WR�SXOO�PHVVDJHV�RII�WKH�PHVVDJH�TXHXH��SURFHVV�WKHP��DQG�GLVSDWFK�WKHP�WR�WKH�FRUUHFW�ZLQGRZ��6\QFKURQL]DWLRQ�LV�QRW�D�SUREOHP�EHFDXVH�ERWK�PHVVDJH�ORRSV�DUH�UXQQLQJ�LQ�WKH�VDPH�WKUHDG��$�WKUHDG�H[HFXWHV�FRGH�RQH�OLQH�DW�D�WLPH��7KHUHIRUH��RQO\�RQH�PHVVDJH�ORRS�FDQ�EH�UHPRYLQJ�PHVVDJHV�IURP�WKH�TXHXH�DQG�GLVSDWFKLQJ�WKHP�DW�DQ\�RQH�WLPH���<RX�ZULWH�D�FRPSOHWH�PHVVDJH�ORRS�LQ�9%�FRGH�OLNH�WKLV���'R�:KLOH�*HW0HVVDJH�VWUXFW0VJ������������ ,I�1RW��7UDQVODWH$FFHOHUDWRU�VWUXFW0VJ�KZQG��VWUXFW$FFHO��VWUXFW0VJ���7KHQ�� � ,I�1RW��,V'LDORJ0HVVDJH�PBKZQG0RGDO'OJ��VWUXFW0VJ���7KHQ�� � � &DOO�7UDQVODWH0HVVDJH�VWUXFW0VJ��� � � &DOO�'LVSDWFK0HVVDJH�VWUXFW0VJ��� � (QG�,I�� (QG�,I�/RRS�

Page 238: Visual Basic - Subclassing and Hooking with VB & VB NET

0DQ\�WLPHV��PHVVDJH�ORRSV�LQ�DQ�DSSOLFDWLRQ�DUH�ZULWWHQ�ZLWKRXW�FDOOLQJ�WKH�,V'LDORJ0HVVDJH�DQG�7UDQVODWH$FFHOHUDWRU�IXQFWLRQV��,Q�WKH�FDVH�RI�RXU�VDPSOH�DSSOLFDWLRQ��WKHVH�IXQFWLRQV�DUH�SURYLGHG�LQ�WKH�PHVVDJH�ORRS�IRU�FRPSOHWHQHVV��7KH�,V'LDORJ0HVVDJH�IXQFWLRQ�LV�XVHG�WR�SURFHVV�NH\VWURNHV�IRU�DOO�QRQPRGDO�GLDORJ�ER[HV��:LQGRZV�GRHV�QRW�DXWRPDWLFDOO\�GR�WKLV�SURFHVVLQJ�IRU�QRQPRGDO�GLDORJV��7KH�7UDQVODWH$FFHOHUDWRU�IXQFWLRQ�DOORZV�PHQX�DFFHOHUDWRU�NH\VWURNHV�WR�EH�SURFHVVHG��,I�DQ�DFFHOHUDWRU�WDEOH�UHVRXUFH�LV�ORDGHG��WKLV�IXQFWLRQ�ZLOO�SURFHVV�WKHVH�NH\VWURNHV�DV�ZHOO��$SSOLFDWLRQV�WKDW�GR�QRW�XVH�DQ\�DFFHOHUDWRU�NH\VWURNHV�DQG�GR�QRW�KDYH�DQ\�QRQPRGDO�GLDORJ�ER[HV��VXFK�DV�RXU�VDPSOH�DSSOLFDWLRQ��GR�QRW�QHHG�WR�FDOO�HLWKHU�RI�WKHVH�WZR�IXQFWLRQV���

��������&ODVV�FUHDWLRQ�

7KH�:1'&/$66(;�VWUXFWXUH�PDNHV�XS�HYHU\�ZLQGRZ�FODVV��$OO�WKH�EDVLF�LQIRUPDWLRQ�QHHGHG�WR�FUHDWH�DQ\�W\SH�RI�ZLQGRZ��LQFOXGLQJ�ZLQGRZV��GLDORJ�ER[HV��FRQWUROV��HWF���LV�FRQWDLQHG�ZLWKLQ�WKLV�VWUXFWXUH���7R�FUHDWH�D�VXSHUFODVV�IURP�D�EDVH�ZLQGRZ�FODVV��ZH�ILUVW�QHHG�WR�FDOO�WKH�*HW&ODVV,QIR([�IXQFWLRQ�WR�H[WUDFW�WKH�LQIRUPDWLRQ�IURP�WKH�EDVH�ZLQGRZ�FODVV�VWUXFWXUH��:H�WKHQ�FDQ�XVH�WKH�LQIRUPDWLRQ�IURP�WKLV�IXQFWLRQ�WR�FUHDWH�WKH�VXSHUFODVV��*HW&ODVV,QIR([�LV�GHILQHG�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�*HW&ODVV,QIR([�/LE��XVHU����$OLDV��*HW&ODVV,QIR([$��B�� � �%\9DO�K,QVWDQFH�$V�/RQJ��%\9DO�OS&ODVV1DPH�$V�6WULQJ��B�� � OS:QG&ODVV�$V�:1'&/$66(;��$V�/RQJ�,WV�SDUDPHWHUV�DUH��K,QVWDQFH

+DQGOH�WR�WKH�DSSOLFDWLRQ�LQVWDQFH�WKDW�FUHDWHG�WKH�FODVV��7KLV�DUJXPHQW�LV�18//�LI�WKH�V\VWHP�FUHDWHG�WKH�FODVV��V\VWHP�ZLGH�FODVV����

OS&ODVV1DPH

7KH�QDPH�RU�FODVV�DWRP�RI�D�UHJLVWHUHG�FODVV���OS:QG&ODVV

3RLQWHU�WR�D�:1'&/$66(;�VWUXFWXUH��ZKLFK�LV�SDVVHG�EDFN�WR�WKH�FDOOLQJ�IXQFWLRQ���7KLV�IXQFWLRQ�UHWXUQV�D�QRQ]HUR�YDOXH�LI�LW�VXFFHVVIXOO\�UHWXUQV�D�ZLQGRZ�FODVV�VWUXFWXUH��,W�UHWXUQV�D�]HUR�LI�WKH�IXQFWLRQ�IDLOV���7KH�:1'&/$66(;�VWUXFWXUH�FRQWDLQV�VHYHUDO�LWHPV�RI�SDUWLFXODU�LQWHUHVW��VSHFLILFDOO\�WKH�LQVWDQFH�KDQGOH��K,QVWDQFH���WKH�PHQX�QDPH��OS0HQX1DPH���DQG�WKH�FODVV�QDPH��OS&ODVV1DPH��PHPEHUV�IURP�WKH�EDVH�ZLQGRZ�FODVV�VWUXFWXUH��7KHVH�PHPEHUV�PXVW�EH�PRGLILHG�WR�FUHDWH�WKH�VXSHUFODVV���7KH�K,QVWDQFH�PHPEHU�UHTXLUHV�WKH�LQVWDQFH�KDQGOH�RI�WKH�DSSOLFDWLRQ��$SS�K,QVWDQFH��ZKLFK�FUHDWHV�DQG�UHJLVWHUV�WKLV�QHZ�FODVV��7KH�OSV]0HQX1DPH�PHPEHU�FRQWDLQV�WKH�QDPH�RI�WKH�GHIDXOW�PHQX�UHVRXUFH�WKDW�LV�SURYLGHG�IRU�HYHU\�ZLQGRZ�FUHDWHG�IURP�WKLV�EDVH�FODVV��RU�HOVH�LW�FRQWDLQV�18//�WR�VLJQLI\�WKDW�QR�PHQX�H[LVWV��7KLV�PHQX�UHVRXUFH�PXVW�EH�FRQWDLQHG�ZLWKLQ�WKH�DSSOLFDWLRQ�FUHDWLQJ�WKH�QHZ�FODVV��%HFDXVH�D�PHQX�UHVRXUFH�IRU�D�V\VWHP�ZLGH�EDVH�

Page 239: Visual Basic - Subclassing and Hooking with VB & VB NET

FODVV�PLJKW�QRW�EH�DYDLODEOH�WR�WKH�DSSOLFDWLRQ��ZH�PXVW�DVVLJQ�D�QHZ�UHVRXUFH�QDPH�WR�WKH�OSV]0HQX1DPH�PHPEHU��)LQDOO\��WKH�OSV]&ODVV1DPH�PHPEHU�PXVW�FRQWDLQ�D�XQLTXH�QDPH�LGHQWLI\LQJ�WKH�QHZ�FODVV��7KLV�QDPH�QHHGV�WR�EH�XQLTXH�RQO\�ZLWKLQ�WKH�DSSOLFDWLRQ�WKDW�FUHDWHG�DQG�UHJLVWHUHG�LW��8VLQJ�WKH�UHWXUQHG�EDVH�FODVV�QDPH�ZLOO�FDXVH�UHJLVWUDWLRQ�RI�WKLV�QHZ�FODVV�WR�IDLO�EHFDXVH�RI�D�GXSOLFDWH�FODVV�QDPH���$V�ZHYH�PHQWLRQHG��WKH�ILUVW�FODVV�WKDW�WKH�DSSOLFDWLRQ�VXSHUFODVVHV�LV�7KXQGHU57�)RUP'&��WKH�9%�IRUP��7KH�5HJLVWHU)RUP&ODVV�IXQFWLRQ�VKRZQ�LQ�([DPSOH�����SHUIRUPV�WKLV�WDVN���

([DPSOH������7KH�5HJLVWHU)RUP&ODVV�)XQFWLRQ��

3ULYDWH�)XQFWLRQ�5HJLVWHU)RUP&ODVV�����$V�%RROHDQ�����'LP�VWUXFW2ULJ:LQ&ODVV�$V�:1'&/$66(;�����'LP�VWUXFW:LQ&ODVV�$V�:1'&/$66(;�����'LP�OUHWYDO�$V�/RQJ�����'LP�V&ODVV1DPH�$V�6WULQJ� ���������'LP�O5HW/HQJWK�$V�/RQJ�����'LP�P\K,QVW�$V�/RQJ����������O5HW/HQJWK� �*HW&ODVV1DPH�)RUP��KZQG��V&ODVV1DPH�����������P\K,QVW� �*HW&ODVV/RQJ�)RUP��KZQG��*&/B+02'8/(������OUHWYDO� �*HW&ODVV,QIR([�P\K,QVW��/HIW��V&ODVV1DPH��O5HW/HQJWK���B�������������������������������VWUXFW2ULJ:LQ&ODVV������,I�OUHWYDO� ���7KHQ���������0VJ%R[��(UURU�LQ�JHWWLQJ�RULJLQDO�IRUP�FODVV�LQIRUPDWLRQ�����(UU�/DVW'OO(UURU���������5HJLVWHU)RUP&ODVV� �)DOVH�����(OVH���������*HW�D�FRS\�RI�LWV�HOHPHQWV���������&RS\0HPRU\�VWUXFW:LQ&ODVV��VWUXFW2ULJ:LQ&ODVV��/HQ%�VWUXFW2ULJ:LQ&ODVV�������������������*HW�RULJLQDO�IRUP�ZLQGRZ�SURFHGXUH�DQG�VDYH�LW���������PB2ULJ:LQ3URF� �VWUXFW:LQ&ODVV�OSIQ:QG3URF����������3ODFH�WKH�RULJLQDO�HOHPHQW�YDOXHV�LQWR�WKH�QHZ�VXSHUFODVVHG�IRUP�FODVV���������:LWK�VWUXFW:LQ&ODVV��������������FE6L]H� �/HQ%�VWUXFW:LQ&ODVV���������������OSV]&ODVV1DPH� �:LQGRZ&ODVV1DPH�������������:LQGRZ�SURFHGXUH�DGGUHVV��������������OSIQ:QG3URF� �*HW3URF$GGU�$GGUHVV2I�0DLQ:QG3URF���������������K,QVWDQFH� �$SS�K,QVWDQFH��������������K&XUVRU� �/RDG&XUVRU����,'&B83$552:��

Page 240: Visual Basic - Subclassing and Hooking with VB & VB NET

��������(QG�:LWK������������������5HJLVWHU�WKLV�FODVV���������,I�5HJLVWHU&ODVV([�VWUXFW:LQ&ODVV���!���7KHQ�������������5HJLVWHU)RUP&ODVV� �7UXH���������(OVH�������������5HJLVWHU)RUP&ODVV� �)DOVH���������(QG�,I�����(QG�,I�(QG�)XQFWLRQ�,Q�PRVW�FDVHV��*HW&ODVV,QIR([�FDQ�EH�FDOOHG�ZLWK�D�OLWHUDO�UHSUHVHQWLQJ�WKH�FODVV�QDPH�LQ�WKH�VHFRQG�DUJXPHQW�RI�WKH�IXQFWLRQ��DV�LQ�WKH�IROORZLQJ�FRGH�IUDJPHQW���OUHWYDO� �*HW&ODVV,QIR([�$SS�K,QVWDQFH���%87721���VWUXFW2ULJ%WWQ&ODVV��)RU�9%�FODVVHV��WKLV�LV�QRW�SRVVLEOH�EHFDXVH�WKH�FODVV�QDPH�RI�D�9%�IRUP�LV�7KXQGHU �ZKHQ�UXQQLQJ�LQ�WKH�,'(�DQG�7KXQGHU57� �ZKHQ�UXQQLQJ�DV�DQ�H[HFXWDEOH��&RQVHTXHQWO\��ZH�PXVW�ILUVW�UHWULHYH�9%�FODVV�QDPHV�XVLQJ�WKH�*HW&ODVV1DPH�$3,�IXQFWLRQ���O5HW/HQJWK� �*HW&ODVV1DPH�)RUP��KZQG��V&ODVV1DPH�������+HUH�LV�ZKHUH�WKH�)RUP��IRUP�FRPHV�LQWR�SOD\��8VLQJ�WKH�KDQGOH�RI�WKLV�IRUP��ZH�DUH�DEOH�WR�UHWULHYH�LWV�FODVV�QDPH��ZKLFK�LV�SODFHG�LQ�WKH�V&ODVV1DPH�VWULQJ�YDULDEOH���1H[W��ZH�PXVW�UHWULHYH�WKH�LQVWDQFH�KDQGOH�RI�WKH�PRGXOH�WKDW�FUHDWHG�WKH�FODVV��7KH�*HW&ODVV/RQJ�$3,�IXQFWLRQ�DOORZV�XV�WR�JHW�WKLV�LQIRUPDWLRQ��2QFH�DJDLQ��WKH�KDQGOH�WR�)RUP��LV�HPSOR\HG���P\K,QVW� �*HW&ODVV/RQJ�)RUP��KZQG��*&/B+02'8/(��,QVWHDG�RI�FDOOLQJ�*HW&ODVV/RQJ��\RX�ZRXOG�H[SHFW�WKDW�\RX�FRXOG�VLPSO\�UHWULHYH�WKH�LQVWDQFH�KDQGOH�IURP�WKH�$SS�REMHFWV�K,QVWDQFH�SURSHUW\�DQG�SDVV�LW�WR�*HW&ODVV,QIR([��%XW�WKH�LQVWDQFH�KDQGOH�RI�WKH�PRGXOH�WKDW�FUHDWHG�WKH�FODVV�LV�GLIIHUHQW�IURP�$SS�K,QVWDQFH�ZKHQ�DQ�DSSOLFDWLRQ�LV�UXQQLQJ�DV�DQ�H[HFXWDEOH��7KH\�DUH�WKH�VDPH�ZKHQ�UXQQLQJ�LQ�WKH�,'(��8VLQJ�WKH�'HSHQGHQF\�:DONHU�DSSOLFDWLRQ�WKDW�VKLSV�ZLWK�9LVXDO�&����ZH�FDQ�VHH�WKDW�WKH�(;(�PRGXOH�IRU�WKH�H[DPSOH�DSSOLFDWLRQ�KDV�DQ�K,QVWDQFH�RI�+����������DQG�WKDW�069%90���'//�KDV�DQ�K,QVWDQFH�RI�+����������7KH�EDVH�FODVVV�K,QVWDQFH�PHPEHU�VLJQLILHV�ZKLFK�PRGXOH�FUHDWHG�WKLV�FODVV��,Q�WKLV�FDVH��WKH�069%90���'//�PRGXOH�FUHDWHG�LW��7KLV�LV�DOVR�WKH�PRGXOH�ZKHUH�LWV�FODVV�ZLQGRZ�SURFHGXUH�UHVLGHV��069%90���'//�LV�WKH�9%�YLUWXDO�PDFKLQH��7KLV�ILOH�PXVW�H[LVW�RQ�WKH�PDFKLQH�LI�LW�LV�WR�UXQ�D�9%�����DSSOLFDWLRQ��6RPH�RI�WKH�LWHPV�FRQWDLQHG�ZLWKLQ�WKLV�'//�DUH�WKH�FRQWUROV�LQWULQVLF�WR�9%��WKH�FRGH�WKDW�FUHDWHV�WKH�7KXQGHU �FODVVHV��DQG�PDQ\�RWKHU�IXQFWLRQV�XVHG�E\�D�9%�DSSOLFDWLRQ���,I�$SS�K,QVWDQFH�KDG�EHHQ�XVHG�LQ�WKH�K,QVWDQFH�DUJXPHQW�WR�*HW&ODVV,QIR([��WKH�IXQFWLRQ�ZRXOG�KDYH�UHWXUQHG�DQ�HUURU��7KLV�LV�EHFDXVH�WKH�IXQFWLRQ�ZRXOG�KDYH�ORRNHG�LQ�WKH�ZURQJ�PRGXOH�IRU�WKH�FODVV�GHILQLWLRQ��,W�ZRXOG�KDYH�ORRNHG�LQ�WKH�(;(�PRGXOH�LQVWHDG�RI�WKH�069%90���'//�PRGXOH���

Page 241: Visual Basic - Subclassing and Hooking with VB & VB NET

8VLQJ�*HW&ODVV,QIR([��ZH�FDQ�REWDLQ�WKH�FODVV�LQIRUPDWLRQ��7KH�LQVWDQFH�KDQGOH�P\K,QVW�LV�XVHG�DV�WKH�ILUVW�DUJXPHQW��DQG�V&ODVV1DPH�LV�XVHG�DV�WKH�VHFRQG�DUJXPHQW���OUHWYDO� �*HW&ODVV,QIR([�P\K,QVW��/HIW��V&ODVV1DPH��O5HW/HQJWK���VWUXFW2ULJ:LQ&ODVV��7KLV�IXQFWLRQ�UHWXUQV�WKH�7KXQGHU57�)RUP'&�FODVV�LQIRUPDWLRQ�LQ�WKH�VWUXFW2ULJ:LQ&ODVV�YDULDEOH��ZKLFK�LV�D�SRLQWHU�WR�WKH�:1'&/$66(;�VWUXFWXUH��&RS\0HPRU\�LV�XVHG�WR�FRS\�LQWR�WKH�VWUXFW:LQ&ODVV�YDULDEOH�WKH�VWUXFWXUH�WKDW�WKLV�SRLQWHU�SRLQWV�WR��7KLV�LV�RXU�VXSHUFODVV���1RZ�WKDW�ZH�KDYH�WKH�:1'&/$66(;�VWUXFWXUH�IRU�WKH�FODVV��ZH�QHHG�WR�PDNH�VRPH�PRGLILFDWLRQV�WR�LW���:LWK�VWUXFW:LQ&ODVV�� �FE6L]H� �/HQ%�VWUXFW:LQ&ODVV��� �OSV]&ODVV1DPH� ��1HZ0DLQ:QG&ODVV��� �OSIQ:QG3URF� �*HW3URF$GGU�$GGUHVV2I�0DLQ:QG3URF��:LQGRZ�SURFHGXUH�DGGUHVV�� �K,QVWDQFH� �$SS�K,QVWDQFH�� �K&XUVRU� �/RDG&XUVRU����,'&B83$552:��(QG�:LWK�)LUVW�WKH�VL]H�LV�UHFDOFXODWHG�DQG�SODFHG�LQ�WKH�FE6L]H�PHPEHU��$�XQLTXH�QDPH�PXVW�EH�SODFHG�LQ�WKH�OSV]&ODVV1DPH�PHPEHU�IRU�WKLV�FODVV�WR�UHJLVWHU�ZLWK�WKH�V\VWHP�SURSHUO\��7KLV�QHZ�FODVV�LV�QDPHG�1HZ0DLQ:QG&ODVV��7KH�IRUHPRVW�UHDVRQ�WR�XVH�VXSHUFODVVLQJ�LV�WR�VXEVWLWXWH�RXU�VXSHUFODVV�SURFHGXUH�IRU�WKDW�RI�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH��:H�DFFRPSOLVK�WKLV�E\�SODFLQJ�WKH�IXQFWLRQ�SRLQWHU�WR�RXU�VXSHUFODVV�SURFHGXUH��0DLQ:QG3URF��ZKLFK�LV�VKRZQ�LQ�([DPSOH�������LQ�WKH�OSIQ:QG3URF�PHPEHU��:H�GR�WKLV�WKURXJK�WKH�*HW3URF$GGU�IXQFWLRQ��ZKLFK�LV�GHILQHG�DV�IROORZV���)XQFWLRQ�*HW3URF$GGUHVV�O)XQFWLRQ$GGUHVV�DV�ORQJ��� *HW3URF$GGUHVV� �O)XQFWLRQ$GGUHVV�(QG�)XQFWLRQ�7KH�K,QVWDQFH�LV�FKDQJHG�WR�RXU�DSSOLFDWLRQV�LQVWDQFH�KDQGOH�XVLQJ�$SS�K,QVWDQFH��$SS�K,QVWDQFH�KROGV�WKH�LQVWDQFH�KDQGOH�WR�WKH��(;(�PRGXOH�RI�RXU�DSSOLFDWLRQ��+�����������7KH�FODVV�XVHV�WKLV�LQVWDQFH�KDQGOH�WR�GHWHUPLQH�LQ�ZKLFK�PRGXOH�WR�ORRN�IRU�WKH�VXSHUFODVV�SURFHGXUH��7KHUHIRUH��LW�PXVW�EH�WKH�DSSOLFDWLRQV�LQVWDQFH�KDQGOH�EHFDXVH�WKDW�LV�ZKHUH�WKH�VXSHUFODVV�SURFHGXUH�LV�ORFDWHG���7KH�ODVW�LWHP�PRGLILHG�LV�WKH�K&XUVRU�PHPEHU��:H�GR�QRW�KDYH�WR�PRGLI\�WKLV�PHPEHU��)RU�WKLV�H[DPSOH��,�ZDQWHG�HYHU\�ZLQGRZ�FUHDWHG�IURP�WKLV�FODVV�WR�XVH�WKH�XS�DUURZ�PRXVH�SRLQWHU�DV�LWV�GHIDXOW��:H�DOVR�FDQ�PRGLI\�RWKHU�PHPEHUV�RI�WKH�FODVV�VWUXFWXUH��VXFK�DV�WKH�VW\OH�PHPEHU��WR�FKDQJH�WKH�ORRN�RU�IHHO�RI�WKH�ZLQGRZ���7ZR�PHPEHUV�WKDW�ZH�PXVW�KDQGOH�FDUHIXOO\�DUH�FE&OV([WUD�DQG�FE:QG([WUD��7KHVH�WZR�PHPEHUV�FRQWDLQ�H[WUD�LQIRUPDWLRQ��LQ�E\WH�IRUPDW��IRU�WKH�FODVV�DQG�DQ\�ZLQGRZ�FUHDWHG�IURP�WKDW�FODVV��UHVSHFWLYHO\��:H�FDQ�DGG�H[WUD�E\WHV�WR�WKHVH�WZR�PHPEHUV��EXW�ZH�FDQQRW�WDNH�

Page 242: Visual Basic - Subclassing and Hooking with VB & VB NET

WKHP�DZD\��5HPRYLQJ�WKLV�LQIRUPDWLRQ�IURP�WKH�FODVV�VWUXFWXUH�PLJKW�FDXVH�XQSUHGLFWDEOH�EHKDYLRU��GHSHQGLQJ�RQ�WKH�RULJLQDO�XVH�RI�WKH�H[WUD�ZLQGRZ�RU�FODVV�E\WHV���/DVWO\��ZH�UHJLVWHU�WKH�QHZ�FODVV�ZLWK�WKH�V\VWHP�E\�XVLQJ�WKH�5HJLVWHU&ODVV([�IXQFWLRQ��7KLV�IXQFWLRQ�LV�GHILQHG�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�5HJLVWHU&ODVV([�/LE��XVHU����$OLDV��5HJLVWHU&ODVV([$��B�� � �SF:QG&ODVV([�$V�:1'&/$66(;��$V�,QWHJHU�:KHQ�ZH�FDOO�5HJLVWHU&ODVV([��ZH�SODFH�WKH�QHZ�FODVV�VWUXFWXUH�LQ�WKH�SF:QG&ODVV([�DUJXPHQW�RI�WKH�5HJLVWHU&ODVV([�IXQFWLRQ���,I�5HJLVWHU&ODVV([�VWUXFW:LQ&ODVV���!���7KHQ�,I�WKLV�FDOO�LV�VXFFHVVIXO��WKH�QHZ�FODVV�LV�UHJLVWHUHG�ZLWK�WKH�V\VWHP��DQG�D�XQLTXH�LQWHJHU�LGHQWLI\LQJ�WKH�QHZ�FODVV��FDOOHG�D�FODVV�DWRP��LV�UHWXUQHG��7KH�UHJLVWHUHG�FODVV�LV�QRZ�UHDG\�WR�EH�XVHG�WR�FUHDWH�QHZ�ZLQGRZV���1H[W��ZH�QHHG�WR�VXSHUFODVV�WKH�%87721�FODVV��:H�GR�WKLV�LQ�WKH�5HJLVWHU%XWWRQ&ODVV�IXQFWLRQ�VKRZQ�LQ�([DPSOH������5HWULHYLQJ�WKH�%87721�FODVV�VWUXFWXUH�LV�PRUH�VWUDLJKWIRUZDUG�WKDQ�UHWULHYLQJ�WKH�7KXQGHU57�)RUP'&�FODVV��7KLV�LV�EHFDXVH�%87721�LV�D�V\VWHP�ZLGH�FODVV��7KH�V\VWHP�UHJLVWHUV�WKLV�FODVV�IRU�XVH�E\�DOO�DSSOLFDWLRQV��DQG�EHFDXVH�RI�WKLV��WKH�%87721�FODVV�KDV�DQ�K,QVWDQFH�RI�18//��:KHQ�FDOOLQJ�WKH�*HW&ODVV,QIR([�IXQFWLRQ��WKH�ILUVW�DUJXPHQW��K,QVWDQFH��FDQ�EH�18//�RU�]HUR�WR�VLJQLI\�WKDW�WKLV�LV�D�V\VWHP�ZLGH�FODVV���

([DPSOH������7KH�5HJLVWHU%XWWRQ&ODVV�)XQFWLRQ��

3ULYDWH�)XQFWLRQ�5HJLVWHU%XWWRQ&ODVV�����$V�%RROHDQ�����'LP�VWUXFW2ULJ%WWQ&ODVV�$V�:1'&/$66(;�����'LP�VWUXFW%WWQ6XSHU&ODVV�$V�:1'&/$66(;�����'LP�OUHWYDO�$V�/RQJ����������*HW�RULJLQDO�:LQGRZV�EXWWRQ�FODVV�����OUHWYDO� �*HW&ODVV,QIR([�����%87721���VWUXFW2ULJ%WWQ&ODVV������,I�OUHWYDO� ���7KHQ���������0VJ%R[��(UURU�LQ�JHWWLQJ�RULJLQDO�EXWWRQ�FODVV�LQIRUPDWLRQ����������5HJLVWHU%XWWRQ&ODVV� �)DOVH�����(OVH���������*HW�D�FRS\�RI�LWV�HOHPHQWV���������&RS\0HPRU\�VWUXFW%WWQ6XSHU&ODVV��VWUXFW2ULJ%WWQ&ODVV��B���������������������/HQ%�VWUXFW2ULJ%WWQ&ODVV�������������������*HW�RULJLQDO�EXWWRQ�ZLQGRZ�SURFHGXUH�DQG�VDYH�LW���������PB2ULJ%WWQ:LQ3URF� �VWUXFW%WWQ6XSHU&ODVV�OSIQ:QG3URF������������������3ODFH�WKH�RULJLQDO�HOHPHQW�YDOXHV�LQWR�WKH�QHZ�VXSHUFODVVHG�EXWWRQ�FODVV�

Page 243: Visual Basic - Subclassing and Hooking with VB & VB NET

��������:LWK�VWUXFW%WWQ6XSHU&ODVV��������������FE6L]H� �/HQ%�VWUXFW%WWQ6XSHU&ODVV���������������OSV]&ODVV1DPH� ��1HZ%WWQ&ODVV���������������K,QVWDQFH� �$SS�K,QVWDQFH��������������OSIQ:QG3URF� �*HW3URF$GGU�$GGUHVV2I�%XWWRQ:QG3URF��������������(QG�:LWK������������������5HJLVWHU�WKH�FODVV���������,I�5HJLVWHU&ODVV([�VWUXFW%WWQ6XSHU&ODVV���!���7KHQ�������������5HJLVWHU%XWWRQ&ODVV� �7UXH���������(OVH�������������5HJLVWHU%XWWRQ&ODVV� �)DOVH���������(QG�,I�����(QG�,I�(QG�)XQFWLRQ�:H�XVH�&RS\0HPRU\�WR�FRQYHUW�WKH�VWUXFW2ULJ%WWQ&ODVV�SRLQWHU�WR�D�VWUXFWXUH��7KH�RULJLQDO�FODVV�VWUXFWXUH�LV�VWRUHG�LQ�WKH�VWUXFW%WWQ6XSHU&ODVV�YDULDEOH��2QFH�DJDLQ��WKH�OSIQ:QG3URF�SRLQWHU�RI�WKH�RULJLQDO�FODVV�VWUXFWXUH�LV�VDYHG�LQ�WKH�PB2ULJ%WWQ:LQ3URF�YDULDEOH���PB2ULJ%WWQ:LQ3URF� �VWUXFW%WWQ6XSHU&ODVV�OSIQ:QG3URF�7KH�FE6L]H��OSV]&ODVV1DPH��K,QVWDQFH��DQG�OSIQ:QG3URF�PHPEHUV�DOVR�DUH�PRGLILHG�DV�IROORZV���:LWK�VWUXFW%WWQ6XSHU&ODVV�� �FE6L]H� �/HQ%�VWUXFW%WWQ6XSHU&ODVV��� �OSV]&ODVV1DPH� ��1HZ%WWQ&ODVV��� �K,QVWDQFH� �$SS�K,QVWDQFH�� �OSIQ:QG3URF� �*HW3URF$GGU�$GGUHVV2I�%XWWRQ:QG3URF������(QG�:LWK�7KH�QDPH�IRU�WKLV�QHZ�FODVV�LV�1HZ%WWQ&ODVV��7KH�RWKHU�PHPEHUV�DUH�PRGLILHG�VLPLODU�WR�WKH�7KXQGHU57�)RUP'&�VXSHUFODVV��/DVWO\��WKH�FODVV�LV�UHJLVWHUHG���

��������:LQGRZ�FUHDWLRQ�

1RZ�WKDW�ZH�KDYH�RXU�UHJLVWHUHG�FODVVHV��IURP�WKH�FRGH�SUHVHQWHG�LQ�WKH�SUHYLRXV�VHFWLRQ�ZH�FDQ�FUHDWH�ZLQGRZV�IURP�WKHP��7KH�FRGH�LQ�WKH�&UHDWH0DLQ:LQGRZ�IXQFWLRQ�VKRZQ�LQ�([DPSOH�����FDOOV�WKH�&UHDWH:LQGRZ([�IXQFWLRQ�WR�FUHDWH�D�ZLQGRZ�IURP�WKH�1HZ0DLQ:QG&ODVV�VXSHUFODVV���

([DPSOH������7KH�&UHDWH0DLQ:LQGRZ�)XQFWLRQ��

3ULYDWH�)XQFWLRQ�&UHDWH0DLQ:LQGRZ�����$V�%RROHDQ�

Page 244: Visual Basic - Subclassing and Hooking with VB & VB NET

����&UHDWH�PDLQ�ZLQGRZ�����PBKZQG0DLQ� �&UHDWH:LQGRZ([�����1HZ0DLQ:QG&ODVV����0DLQ�:LQGRZ���B������������������:6B29(5/$33(':,1'2:��&:B86('()$8/7��&:B86('()$8/7��B����������������������������������$SS�K,QVWDQFH��%\9DO���������,I�PBKZQG0DLQ�!���7KHQ���������6KRZ�PDLQ�ZLQGRZ���������&DOO�6KRZ:LQGRZ�PBKZQG0DLQ��6:B6+2:1250$/����������&UHDWH0DLQ:LQGRZ� �7UXH�����(OVH���������0VJ%R[��0DLQ�ZLQGRZ�FRXOG�QRW�EH�FUHDWHG����������&UHDWH0DLQ:LQGRZ� �)DOVH�����(QG�,I�(QG�)XQFWLRQ�7KH�DFWXDO�ZLQGRZ�FUHDWLRQ�LQ�([DPSOH�����LV�SHUIRUPHG�E\�WKH�&UHDWH:LQGRZ([�IXQFWLRQ��7KH�GHFODUDWLRQ�IRU�&UHDWH:LQGRZ([�LV�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�&UHDWH:LQGRZ([�/LE��XVHU����$OLDV��&UHDWH:LQGRZ([$��B�� � �%\9DO�GZ([6W\OH�$V�/RQJ��%\9DO�OS&ODVV1DPH�$V�6WULQJ��B�� � %\9DO�OS:LQGRZ1DPH�$V�6WULQJ��%\9DO�GZ6W\OH�$V�/RQJ��B�� � %\9DO�[�$V�/RQJ��%\9DO�\�$V�/RQJ��%\9DO�Q:LGWK�$V�/RQJ��B�� � %\9DO�Q+HLJKW�$V�/RQJ��%\9DO�K:QG3DUHQW�$V�/RQJ��B�� � %\9DO�K0HQX�$V�/RQJ��%\9DO�K,QVWDQFH�$V�/RQJ��OS3DUDP�$V�$Q\��$V�/RQJ�7KH�IXQFWLRQ�KDV�WKH�IROORZLQJ�SDUDPHWHUV��GZ([6W\OH

2QH�RU�PRUH�RI�WKH�IROORZLQJ�H[WHQGHG�VW\OHV�RI�WKH�ZLQGRZ�25HG�WRJHWKHU���WS_EX_APPWINDOW

$�WRS�OHYHO�ZLQGRZ�LV�SODFHG�RQ�WKH�WDVNEDU�ZKHQ�WKH�ZLQGRZ�LV�YLVLEOH�WS_EX_CLIENTEDGE

6SHFLILHV�D�ZLQGRZ�ZLWK�D�ERUGHU�DQG�D�VXQNHQ�HGJH�WS_EX_DLGMODALFRAME

6SHFLILHV�D�ZLQGRZ�ZLWK�D�GRXEOH�ERUGHU�WS_EX_NOACTIVATE

8VHG�LQ�:LQGRZV������WR�VSHFLI\�D�ZLQGRZ�WKDW�D�XVHU�FDQQRW�FDXVH�WR�EHFRPH�WKH�IRUHJURXQG�ZLQGRZ��

WS_EX_NOPARENTNOTIFY

6SHFLILHV�D�FKLOG�ZLQGRZ�WKDW�GRHV�QRW�VHQG�WKH�:0B3$5(17127,)<�PHVVDJH�WR�LWV�SDUHQW�ZLQGRZ��

WS_EX_OVERLAPPEDWINDOW

(TXLYDOHQW�WR��:6B(;B&/,(17('*(�25�:6B(;B:,1'2:('*(���WS_EX_STATICEDGE

6SHFLILHV�D�ZLQGRZ�WKDW�KDV�D�WKUHH�GLPHQVLRQDO�ERUGHU�EXW�GRHV�QRW�WDNH�XVHU�LQSXW��

Page 245: Visual Basic - Subclassing and Hooking with VB & VB NET

WS_EX_TOPMOST

6SHFLILHV�D�ZLQGRZ�WKDW�VKRXOG�DOZD\V�EH�SODFHG�RQ�WRS�RI�RWKHU�ZLQGRZV�WKDW�DUH�VHW�WR�EH�WRS�PRVW�ZLQGRZV��

WS_EX_WINDOWEDGE

6SHFLILHV�D�ZLQGRZ�ZLWK�D�ERUGHU�DQG�D�UDLVHG�HGJH�OS&ODVV1DPH

$�VWULQJ�FRQWDLQLQJ�WKH�QDPH�RI�WKH�FODVV�IURP�ZKLFK�WKLV�ZLQGRZ�LQKHULWV��OS:LQGRZ1DPH

$�VWULQJ�GLVSOD\HG�LQ�WKH�WLWOH�EDU�RI�WKH�ZLQGRZ�GZ6W\OH

2QH�RU�PRUH�RI�WKH�IROORZLQJ�ZLQGRZ�VW\OHV�RU�FRQWURO�VW\OHV�25HG�WRJHWKHU���WS_BORDER

6SHFLILHV�D�ZLQGRZ�ZLWK�D�WKLQ�OLQH�ERUGHU��WS_CAPTION

6SHFLILHV�D�ZLQGRZ�ZLWK�D�WLWOH�EDU��WS_CLIPCHILDREN

6SHFLILHV�D�ZLQGRZ�WKDW�GRHV�QRW�SDLQW�WKH�DUHD�WKDW�FRQWDLQV�D�FKLOG�ZLQGRZ���WS_CLIPSIBLINGS

6SHFLILHV�D�ZLQGRZ�WKDW�GRHV�QRW�SDLQW�DOO�RYHUODSSLQJ�FKLOG�ZLQGRZV�RXWVLGH�WKH�UHJLRQ�RI�WKH�FKLOG�ZLQGRZV�FOLHQW�DUHD��

WS_DLGFRAME

6SHFLILHV�D�ZLQGRZ�ZLWK�D�GLDORJ�ER[�ERUGHU�DQG�QR�FDSWLRQ��WS_MINIMIZE

7KH�ZLQGRZ�LV�FUHDWHG�LQ�D�PLQLPL]HG�VWDWH��WS_MINIMIZEBOX

6SHFLILHV�D�ZLQGRZ�ZLWK�D�PLQLPL]H�EXWWRQ�LQ�WKH�WLWOH�EDU��WS_MAXIMIZE

7KH�ZLQGRZ�LV�FUHDWHG�LQ�D�PD[LPL]HG�VWDWH��WS_MAXIMIZEBOX

6SHFLILHV�D�ZLQGRZ�ZLWK�D�PD[LPL]H�EXWWRQ�LQ�WKH�WLWOH�EDU��WS_OVERLAPPED

6SHFLILHV�D�ZLQGRZ�ZLWK�D�WLWOH�EDU�DQG�D�ERUGHU��WS_OVERLAPPEDWINDOW

(TXLYDOHQW�WR��:6B29(5/$33('�25�:6B&$37,21�25�:6B6<60(18�25�:6B7+,&.)5$0(�25�:6B0,1,0,=(%2;�25�:6B0$;,0,=(%2;���

WS_POPUP

6SHFLILHV�D�SRS�XS�ZLQGRZ��WS_POPUPWINDOW

6SHFLILHV�D�SRS�XS�ZLQGRZ�ZLWK�WKH�VW\OHV��:6B%25'(5�25�:6B32383�25�:6B6<60(18�25�:6B&$37,21���

WS_SYSMENU

6SHFLILHV�D�ZLQGRZ�FRQWDLQLQJ�D�ZLQGRZ�PHQX�RQ�LWV�WLWOH�EDU��WS_THICKFRAME

6SHFLILHV�D�ZLQGRZ�ZLWK�D�VL]LQJ�ERUGHU��WS_TILED

6DPH�DV�:6B29(5/$33('��

Page 246: Visual Basic - Subclassing and Hooking with VB & VB NET

WS_TILEDWINDOW

6DPH�DV�:6B29(5/$33(':,1'2:��WS_VISIBLE

6SHFLILHV�D�ZLQGRZ�WKDW�LV�LQLWLDOO\�YLVLEOH��[

7KH�SRVLWLRQ�RI�WKH�ZLQGRZ�ZLWK�UHVSHFW�WR�WKH�OHIW�VLGH�RI�WKH�VFUHHQ�\

7KH�SRVLWLRQ�RI�WKH�ZLQGRZ�ZLWK�UHVSHFW�WR�WKH�WRS�RI�WKH�VFUHHQ�Q:LGWK

7KH�ZLGWK�RI�WKH�ZLQGRZ�Q+HLJKW

7KH�KHLJKW�RI�WKH�ZLQGRZ�K:QG3DUHQW

+DQGOH�WR�WKH�SDUHQW�RU�RZQHU�ZLQGRZ�WR�WKLV�ZLQGRZ�K0HQX

+DQGOH�WR�WKH�PHQX�WKDW�LV�XVHG�E\�WKLV�ZLQGRZ�K,QVWDQFH

+DQGOH�RI�WKH�PRGXOH�LQVWDQFH�WR�EH�DVVRFLDWHG�ZLWK�WKLV�ZLQGRZ�OS3DUDP

3RLQWHU�WR�D�YDOXH�WKDW�FDQ�EH�SDVVHG�LQ�WR�WKH�ZLQGRZ�WKURXJK�WKH�&5($7(6758&7�VWUXFWXUH��

,I�WKLV�IXQFWLRQ�VXFFHHGV�LQ�FUHDWLQJ�WKH�ZLQGRZ��D�KDQGOH�WR�WKDW�ZLQGRZ�LV�UHWXUQHG��RWKHUZLVH��D�]HUR�LV�UHWXUQHG���,Q�WKH�FDOO�WR�&UHDWH:LQGRZ([�LQ�([DPSOH������ZH�GHILQH�WKH�QHZ�ZLQGRZV�FDSWLRQ�WR�EH��0DLQ�:LQGRZ���DV�)LJXUH�����VKRZV���7KH�OS&ODVV1DPH�DUJXPHQW�UHFHLYHV�WKH�VDPH�YDOXH�SODFHG�LQ�WKH�OSV]&ODVV1DPH�PHPEHU�RI�WKH�:1'&/$66(;�VWUXFWXUH��7KH�K,QVWDQFH�DUJXPHQW�LV�LJQRUHG�LQ�:LQGRZV�17�DQG�:LQGRZV�������,I�\RX�DUH�XVLQJ�:LQGRZV��[��\RX�QHHG�WR�VXSSO\�WKH�LQVWDQFH�KDQGOH�RI�WKH�PRGXOH�WKDW�LV�FUHDWLQJ�WKLV�ZLQGRZ��)RU�RXU�H[DPSOH��ZH�FDQ�XVH�$SS�K,QVWDQFH�IRU�WKLV�DUJXPHQW���7KH�FRQVWDQW�&:B86('()$8/7�LQGLFDWHV�WKDW�WKH�V\VWHP�VKRXOG�VHW�WKH�GHIDXOW�[�DQG�\�FRRUGLQDWHV�RI�WKH�QHZ�ZLQGRZ��:H�DOVR�FDQ�XVH�WKLV�FRQVWDQW�LQ�WKH�Q+HLJKW�DQG�Q:LGWK�DUJXPHQWV�WR�DOORZ�WKH�V\VWHP�WR�VHW�WKH�GHIDXOW�KHLJKW�DQG�ZLGWK�RI�WKH�QHZ�ZLQGRZ���$�]HUR�LV�SURYLGHG�IRU�WKH�K:QG3DUHQW�DUJXPHQW��7KLV�LQIRUPV�WKH�QHZ�ZLQGRZ�WKDW�LW�KDV�QR�SDUHQW�RU�RZQLQJ�ZLQGRZV���7KH�6KRZ:LQGRZ�IXQFWLRQ�LV�FDOOHG�WR�GLVSOD\�WKH�ZLQGRZ�DIWHU�LW�LV�VXFFHVVIXOO\�FUHDWHG�EHFDXVH�&UHDWH:LQGRZ([�GRHV�QRW�GR�WKLV�DXWRPDWLFDOO\��7KH�GHFODUDWLRQ�IRU�6KRZ:LQGRZ�LV�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�6KRZ:LQGRZ�/LE��XVHU����B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Q&PG6KRZ�$V�/RQJ��$V�/RQJ�

Page 247: Visual Basic - Subclassing and Hooking with VB & VB NET

6KRZ:LQGRZ�KDV�WKH�IROORZLQJ�SDUDPHWHUV��KZQG

7KH�ZLQGRZ�KDQGOH��Q&PG6KRZ

6SHFLILHV�KRZ�WKH�ZLQGRZ�LV�GLVSOD\HG��,W�FDQ�EH�RQH�RI�WKH�IROORZLQJ�FRQVWDQWV���SW_FORCEMINIMIZE

'LVSOD\V�D�PLQLPL]HG�ZLQGRZ�HYHQ�LI�WKH�WKUHDG�WKDW�RZQV�WKH�ZLQGRZ�LV�KXQJ���SW_HIDE

+LGHV�WKH�ZLQGRZ�DQG�DFWLYDWHV�DQRWKHU�ZLQGRZ��SW_MAXIMIZE

'LVSOD\V�D�PD[LPL]HG�ZLQGRZ��SW_MINIMIZE

'LVSOD\V�D�PLQLPL]HG�ZLQGRZ��SW_RESTORE

'LVSOD\V�D�ZLQGRZ�LQ�LWV�UHVWRUHG�VWDWH��SW_SHOW

$FWLYDWHV�D�ZLQGRZ��SW_SHOWMAXIMIZED

$FWLYDWHV�DQG�PD[LPL]HV�WKH�ZLQGRZ��SW_SHOWMINIMIZED

$FWLYDWHV�DQG�PLQLPL]HV�WKH�ZLQGRZ��SW_SHOWMINNOACTIVE

'LVSOD\V�D�PLQLPL]HG�ZLQGRZ�EXW�GRHV�QRW�DFWLYDWH�LW��SW_SHOWNA

'LVSOD\V�D�ZLQGRZ�EXW�GRHV�QRW�DFWLYDWH�LW��SW_SHOWNORMAL

$FWLYDWHV�DQG�GLVSOD\V�D�ZLQGRZ��,I�WKH�ZLQGRZ�LV�PLQLPL]HG�RU�PD[LPL]HG��LW�LV�ILUVW�UHVWRUHG���

SW_SHOWNOACTIVATE

6DPH�DV�6:B6+2:1250$/��EXW�WKH�ZLQGRZ�LV�QRW�DFWLYDWHG���7KH�UHWXUQ�YDOXH�RI�WKLV�IXQFWLRQ�LV�]HUR�LI�WKH�ZLQGRZ�ZDV�SUHYLRXVO\�KLGGHQ��,I�WKH�ZLQGRZ�ZDV�SUHYLRXVO\�YLVLEOH��WKH�UHWXUQ�YDOXH�LV�QRQ]HUR���:H�FUHDWH�WKH�EXWWRQ�FRQWURO�FUHDWHG�IURP�WKH�1HZ%WWQ&ODVV�VXSHUFODVV�LQ�D�VLPLODU�ZD\��7KH�&UHDWH6XSHU&OV%WWQ�IXQFWLRQ�VKRZQ�LQ�([DPSOH�����FUHDWHV�WKLV�FRQWURO��7KH�EXWWRQ�FRQWURO�KDV�D�FDSWLRQ�RI��&OLFN�0H��DQG�LV�FRQWDLQHG�ZLWKLQ�WKH�ZLQGRZ�FUHDWHG�IURP�WKH�1HZ0DLQ:QG&ODVV�VXSHUFODVV��DV�)LJXUH�����VKRZV��7KH�ZLQGRZ�VW\OH�:6B&+,/'�PHDQV�WKDW�WKLV�FRQWURO�ZLOO�EH�D�FKLOG�RI�WKH�SDUHQW�ZLQGRZ�ZKRVH�K:QG�LV�VHW�LQ�WKH�K:QG3DUHQW�DUJXPHQW�RI�WKH�&UHDWH:LQGRZ([�IXQFWLRQ��7KH�K:QG3DUHQW�DUJXPHQW�FRQWDLQV�WKH�KDQGOH�WR�WKH�PDLQ�ZLQGRZ��ZKLFK�ZH�FUHDWHG�SUHYLRXVO\��7KH�%6B386+%87721�VW\OH�FUHDWHV�D�SXVK�EXWWRQ�LQVWHDG�RI�DQRWKHU�EXWWRQ�W\SH��VXFK�DV�WKH�FKHFNER[�VW\OH�EXWWRQ��7KLV�EXWWRQ�FRQWURO�DOVR�ZLOO�KDYH�WKH�VDPH�K,QVWDQFH�DV�WKH�DSSOLFDWLRQ���

([DPSOH������7KH�&UHDWH6XSHU&OV%WWQ�)XQFWLRQ��

Page 248: Visual Basic - Subclassing and Hooking with VB & VB NET

3ULYDWH�)XQFWLRQ�&UHDWH6XSHU&OV%WWQ�����$V�%RROHDQ�����&UHDWH�VXSHUFODVVHG�EXWWRQ�����PBKZQG6&%WWQ� �&UHDWH:LQGRZ([�����1HZ%WWQ&ODVV����&OLFN�0H���B�� � � :6B&+,/'�2U�:6B9,6,%/(�2U�%6B386+%87721��B�������������� ����������������PBKZQG0DLQ�����$SS�K,QVWDQFH����������6KRZ�WKH�EXWWRQ�����,I�PBKZQG6&%WWQ�!���7KHQ���������&DOO�6KRZ:LQGRZ�PBKZQG6&%WWQ��6:B6+2:1250$/����������&UHDWH6XSHU&OV%WWQ� �7UXH�����(OVH���������0VJ%R[��6XSHUFODVVHG�EXWWRQ�FRXOG�QRW�EH�FUHDWHG����������&UHDWH6XSHU&OV%WWQ� �)DOVH�����(QG�,I�(QG�)XQFWLRQ�$IWHU�WKLV�FRQWURO�LV�VXFFHVVIXOO\�FUHDWHG��LW�LV�GLVSOD\HG�RQ�LWV�SDUHQW�ZLQGRZ�WKURXJK�WKH�FDOO�WR�6KRZ:LQGRZ���

��������7KH�VXSHUFODVV�SURFHGXUHV�

)LQDOO\��ZH�QHHG�WR�FUHDWH�WKH�ZLQGRZ�SURFHGXUHV�WKDW�DUH�DVVRFLDWHG�ZLWK�RXU�VXSHUFODVVHV��6XFK�D�ZLQGRZ�SURFHGXUH�LV�QRUPDOO\�UHIHUUHG�WR�DV�WKH�VXSHUFODVV�SURFHGXUH��7KH�ILUVW�VXSHUFODVV�SURFHGXUH�LV�IRU�WKH�1HZ0DLQ:QG&ODVV�VXSHUFODVV�DQG�LV�VKRZQ�LQ�([DPSOH�������

([DPSOH������7KH�0DLQ:QG3URF�:LQGRZ�3URFHGXUH��

3XEOLF�)XQFWLRQ�0DLQ:QG3URF�%\9DO�KZQG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�����'LP�&RXQW�$V�/RQJ����������6HOHFW�&DVH�X0VJ���������&DVH�:0B/%87721'2:1�������������0VJ%R[��:LQGRZ�����KZQG����ZDV�FOLFNHG�����������&DVH�:0B'(6752<��������������,I�ZH�DUH�GHVWUR\LQJ�WKH�PDLQ�ZLQGRZ���������������WKHQ�ZH�ZLOO�ZDQW�WR�HQG�WKH�DSSOLFDWLRQ�������������,I�KZQG� �PBKZQG0DLQ�7KHQ�����������������)RU�&RXQW� ���7R�8%RXQG�PB&UHDWHG:QG+DQGOHV��������������������������'HVWUR\:LQGRZ��PB&UHDWHG:QG+DQGOHV�&RXQW���

Page 249: Visual Basic - Subclassing and Hooking with VB & VB NET

����������������1H[W������������������������������([LW�WKH�PHVVDJH�ORRS�DQG�6WRS�WKH�DSSOLFDWLRQ�����������������&DOO�3RVW4XLW0HVVDJH����������������(QG�,I�������������([LW�)XQFWLRQ�����(QG�6HOHFW����������/HW�WKH�PDLQ�ZLQGRZ�EHKDYH�DV�D�QRUPDO�ZLQGRZ�����0DLQ:QG3URF� �'HI:LQGRZ3URF�KZQG��X0VJ��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KLV�IXQFWLRQ�WUDSV�WZR�PHVVDJHV��,W�FKDQJHV�WKH�:0B/%87721'2:1�PHVVDJH�EHKDYLRU�WR�GLVSOD\�D�PHVVDJH�ER[�FRQWDLQLQJ�WKH�KDQGOH�RI�WKH�ZLQGRZ�WKDW�ZDV�FOLFNHG��7KH�:0B'(6752<�PHVVDJH�EHKDYLRU�LV�PRGLILHG�DV�ZHOO��7KLV�PHVVDJH�PRGLILFDWLRQ�LV�YHU\�LPSRUWDQW�WR�WKLV�DSSOLFDWLRQ�IRU�LW�WR�VKXW�GRZQ�SURSHUO\��,I�D�ZLQGRZ�RWKHU�WKDQ�WKH�PDLQ�ZLQGRZ��ZKLFK�KDV�WKH��0DLQ�:LQGRZ��FDSWLRQ��LV�EHLQJ�FORVHG��WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�VLPSO\�FORVHV�RQO\�WKDW�ZLQGRZ��,I��KRZHYHU��WKH�PDLQ�ZLQGRZ�LV�EHLQJ�FORVHG��WKLV�PHVVDJH�ZLOO�ILUVW�GHVWUR\�DOO�ZLQGRZV�FUHDWHG�IURP�WKH�1HZ0DLQ:QG&ODVV�VXSHUFODVV��:H�DFFRPSOLVK�WKLV�E\�LWHUDWLQJ�WKURXJK�WKH�PB&UHDWHG:QG+DQGOHV�DUUD\�RI�VWRUHG�ZLQGRZ�KDQGOHV�DQG�FDOOLQJ�WKH�'HVWUR\:LQGRZ�IXQFWLRQ�IRU�DOO�WKHVH�ZLQGRZV��7KH�'HVWUR\:LQGRZ�IXQFWLRQ�VHQGV�WKH�:0B'(6752<�DQG�:0B1&'(6752<�PHVVDJHV�WR�WKH�UHVSHFWLYH�ZLQGRZV�WR�GHVWUR\�WKHP��$IWHU�WKH\�DUH�GHVWUR\HG��WKH�PHVVDJH�TXHXH�LV�IOXVKHG�RI�DOO�PHVVDJHV�SHUWDLQLQJ�WR�WKDW�ZLQGRZ���)RU�&RXQW� ���7R�8%RXQG�PB&UHDWHG:QG+DQGOHV������� 'HVWUR\:LQGRZ��PB&UHDWHG:QG+DQGOHV�&RXQW���1H[W�7KH�3RVW4XLW0HVVDJH�IXQFWLRQ�LV�WKHQ�FDOOHG�WR�MXPS�RXW�RI�WKH�PHVVDJH�ORRS�DQG�FORVH�GRZQ�WKH�DSSOLFDWLRQ���,W�LV�QHFHVVDU\�WR�GHVWUR\�WKHVH�ZLQGRZV�LQ�WKLV�PDQQHU�WR�DOORZ�RXU�DSSOLFDWLRQ�WR�VKXW�GRZQ�FOHDQO\��,I�ZH�GLG�QRW�GHVWUR\�WKHVH�ZLQGRZV��8QUHJLVWHU&ODVV�ZRXOG�IDLO�WR�GHVWUR\�WKH�1HZ0DLQ:QG&ODVV�DQG�1HZ%WWQ&ODVV�VXSHUFODVVHV��0RVW�OLNHO\��WKH�FODVVHV�ZLOO�EH�GHVWUR\HG�DIWHU�WKH�DSSOLFDWLRQ�ILQLVKHV�VKXWWLQJ�GRZQ��%XW�LI�D�'//�ZHUH�WR�UHJLVWHU�WKHVH�FODVVHV�RQ�D�:LQGRZV�17�RU�D�:LQGRZV������V\VWHP��WKH�FODVVHV�ZRXOG�QRW�EH�XQUHJLVWHUHG�DQG�WKH�PHPRU\�XVHG�WR�VWRUH�WKH�FODVV�LQIRUPDWLRQ�ZRXOG�QRW�EH�UHFODLPHG��7KLV�FDXVHV�D�PHPRU\�OHDN��7R�EH�VDIH��DOO�FODVVHV�UHJLVWHUHG�E\�WKH�DSSOLFDWLRQ�VKRXOG�EH�XQUHJLVWHUHG�E\�WKDW�DSSOLFDWLRQ�EHIRUH�WHUPLQDWLQJ���)LQDOO\��WKLV�VXSHUFODVV�SURFHGXUH�SDVVHV�DOO�PHVVDJHV�H[FHSW�IRU�:0B'(6752<�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH���$V�\RX�FDQ�VHH��WKHUH�LV�QR�GLIIHUHQFH�LQ�WKH�VWUXFWXUH�DQG�RSHUDWLRQ�RI�D�VXSHUFODVV�SURFHGXUH�FRPSDUHG�WR�WKH�ZLQGRZ�SURFHGXUHV�ZH�DUH�XVHG�WR�ZRUNLQJ�ZLWK���

Page 250: Visual Basic - Subclassing and Hooking with VB & VB NET

([DPSOH�����VKRZV�WKH�VXSHUFODVV�SURFHGXUH�IRU�WKH�1HZ%WWQ&ODVV�VXSHUFODVV��7KLV�VXSHUFODVV�SURFHGXUH�WUDSV�WKH�:0B/%8772183�PHVVDJH�IRU�WKH�VXSHUFODVVHG�EXWWRQ�FRQWURO��:KHQ�WKLV�PHVVDJH�LV�UHFHLYHG��D�QHZ�ZLQGRZ�LV�FUHDWHG�IURP�WKH�1HZ0DLQ:QG&ODVV�VXSHUFODVV��DQG�D�EXWWRQ�FRQWURO�FUHDWHG�IURP�WKH�1HZ%WWQ&ODVV�VXSHUFODVV�LV�SODFHG�RQ�WKLV�ZLQGRZ��DV�)LJXUH�����VKRZV��7KH�6KRZ:LQGRZ�IXQFWLRQ�LV�FDOOHG�WR�GLVSOD\�ERWK�ZLQGRZV��)RU�DOO�ZLQGRZV�FUHDWHG�LQ�WKLV�PDQQHU��DQ�HQWU\�LV�DGGHG�WR�WKH�PB&UHDWHG:LQGRZV�DUUD\��7KLV�DOORZV�XV�WR�FOHDQO\�GHVWUR\�DOO�ZLQGRZV�FUHDWHG�LQ�WKLV�PDQQHU�ZKHQ�WKH�PDLQ�ZLQGRZ�LV�FORVHG���

([DPSOH������7KH�%XWWRQ:QG3URF�:LQGRZ�3URFHGXUH��

3XEOLF�)XQFWLRQ�%XWWRQ:QG3URF�%\9DO�KZQG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B����������%\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ����������'LP�WHPS+ZQG�$V�/RQJ����������'LP�WHPS%XWWRQ+ZQG�$V�/RQJ����������6HOHFW�&DVH�X0VJ���������&DVH�:0B/%8772183��������������&UHDWH�D�QHZ�ZLQGRZ�ZLWK�WKH�VXSHUFODVVHG�EXWWRQ�RQ�LW�������������WHPS+ZQG� �&UHDWH:LQGRZ([�����1HZ0DLQ:QG&ODVV����1HZ�:LQGRZ���B�� � � :6B29(5/$33(':,1'2:��&:B86('()$8/7��&:B86('()$8/7������������B�� � � ������&/QJ�$SS�K,QVWDQFH���%\9DO�����������������������������WHPS%XWWRQ+ZQG� �&UHDWH:LQGRZ([�����1HZ%WWQ&ODVV����&OLFN�0H���B�� � � :6B&+,/'�2U�:6B9,6,%/(�2U�%6B386+%87721��B�� � � ����������������WHPS+ZQG�����&/QJ�$SS�K,QVWDQFH�������������������������������6KRZ�DOO�QHZ�ZLQGRZV�������������&DOO�6KRZ:LQGRZ�WHPS+ZQG��6:B6+2:1250$/��������������&DOO�6KRZ:LQGRZ�WHPS%XWWRQ+ZQG��6:B6+2:1250$/���������������������������$GG�WKLV�ZLQGRZV�KZQG�WR�WKH�OLVW�RI�FUHDWHG�ZLQGRZV�������������PB&UHDWHG:QG+DQGOHV�8%RXQG�PB&UHDWHG:QG+DQGOHV��� �WHPS+ZQG�������������5H'LP�3UHVHUYH�PB&UHDWHG:QG+DQGOHV�8%RXQG�PB&UHDWHG:QG+DQGOHV�����������(QG�6HOHFW����������3DVV�PHVVDJHV�RQ�WR�RULJLQDO�EXWWRQ�ZLQGRZ�SURFHGXUH�����%XWWRQ:QG3URF� �&DOO:LQGRZ3URF�PB2ULJ%WWQ:LQ3URF��KZQG��X0VJ��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�

Page 251: Visual Basic - Subclassing and Hooking with VB & VB NET

$OO�PHVVDJHV�DUH�SDVVHG�RQ�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��,W�LV�LQWHUHVWLQJ�WR�QRWH�WKDW�ZH�FDQ�XVH�&DOO:LQGRZ3URF�WR�SDVV�WR�WKH�EXWWRQ�FODVVV�RULJLQDO�ZLQGRZ�SURFHGXUH�DOO�WKH�PHVVDJHV�IRU�WKH�VXSHUFODVVHG�EXWWRQ�FRQWURO��:H�FDQQRW�GR�WKLV�ZLWK�ZLQGRZV�FUHDWHG�IURP�WKH�VXSHUFODVVHG�7KXQGHU57�)RUP'&�FODVV��,I�ZH�WU\�XVLQJ�WKH�&DOO:LQGRZ3URF�LQVWHDG�RI�WKH�'HI:LQGRZ3URF�IXQFWLRQ��D�*HQHUDO�3URWHFWLRQ�)DXOW��*3)��LV�JHQHUDWHG�LQVLGH�WKH�069%90���'//�PRGXOH��7KH�UHDVRQ�IRU�WKLV�FDQ�EH�IRXQG�LQ�WKH�ZD\�WKH�FODVVHV�DUH�UHJLVWHUHG��7KH�%87721�FODVV�LV�UHJLVWHUHG�DV�D�JOREDO�FODVV��,WV�VFRSH�LQFOXGHV�DOO�PRGXOHV�LQ�DOO�UXQQLQJ�DSSOLFDWLRQV��7KLV�LV�QRW�VR�ZLWK�WKH�7KXQGHU57�)RUP'&�FODVV��LW�LV�UHJLVWHUHG�DV�DQ�DSSOLFDWLRQ�ORFDO�FODVV��7KLV�LV�KRZ�\RX�FDQ�GHWHUPLQH�WKH�VFRSH�RI�FODVV���

• ,I�WKH�K,QVWDQFH�PHPEHU�RI�WKH�FODVV�VWUXFWXUH�LV�]HUR��WKH�FODVV�LV�D�V\VWHP�ZLGH�FODVV���

• ,I�WKH�&6B*/2%$/&/$66�VW\OH�LV�LQFOXGHG�LQ�WKH�VW\OH�PHPEHU�RI�WKH�FODVV�VWUXFWXUH��WKH�FODVV�LV�DQ�DSSOLFDWLRQ�JOREDO�FODVV���

• ,I�WKH�&6B*/2%$/&/$66�VW\OH�LV�QRW�LQFOXGHG�LQ�WKH�VW\OH�PHPEHU�RI�WKH�FODVV�VWUXFWXUH��WKH�FODVV�LV�DQ�DSSOLFDWLRQ�ORFDO�FODVV���

$Q�DSSOLFDWLRQ�ORFDO�FODVV�LV�RQH�WKDW�LV�FUHDWHG�E\�D�PRGXOH�RQO\�WR�EH�XVHG�E\�WKDW�PRGXOH��7KH�7KXQGHU57�)RUP'&�FODVV�LV�GHVLJQHG�WR�ZRUN�RQO\�ZLWKLQ�WKH�069%90���'//�PRGXOH��2XU�VXSHUFODVV��ZKLFK�LV�FUHDWHG�IURP�WKH�7KXQGHU57�)RUP'&�EDVH�FODVV��ZRUNV�ILQH�XQWLO�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�LV�FDOOHG��7KH�RULJLQDO�ZLQGRZ�SURFHGXUH�LV�ORFDWHG�LQ�WKH�069%90���'//�PRGXOH��DQG�WKH�VXSHUFODVV�SURFHGXUH�LV�ORFDWHG�LQ�WKH�(;(�PRGXOH��7KH�SUREOHP�RFFXUV�ZKHQ�ZH�WU\�WR�FDOO�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�IURP�ZLWKLQ�WKH�(;(�PRGXOH��ZKLFK�KDV�D�GLIIHUHQW�LQVWDQFH�KDQGOH��7KH�DSSOLFDWLRQ�ZLOO�QRW�DOORZ�WKLV�DQG�VXEVHTXHQWO\�WKURZV�D�*3)���7R�VHH�WKLV�IURP�D�GLIIHUHQW�DQJOH��VWDUW�6S\���DQG�FRPSDUH�WKH�,QVWDQFH�+DQGOH�ILHOGV�IRU�DOO�FRQWUROV�FUHDWHG�GLUHFWO\�IURP�WKH�7KXQGHU �FODVVHV��7KH\�DUH�DOO�WKH�VDPH��7KH�ZLQGRZV�FUHDWHG�IURP�WKH�1HZ0DLQ:LQGRZ&ODVV�VXSHUFODVV�DOO�KDYH�WKH�LQVWDQFH�KDQGOH�RI�WKH�(;(�PRGXOH���:H�FDQ�VXSHUFODVV�WKH�%87721�FODVV�EHFDXVH�LW�LV�D�V\VWHP�ZLGH�FODVV��7KLV�FODVV�LV�DYDLODEOH�IRU�XVH�LQ�DOO�PRGXOHV��7KLV�FODVV�DOVR�DOORZV�FRGH�ZLWKLQ�DQ\�PRGXOH�WR�FDOO�EDFN�WR�WKH�ZLQGRZ�SURFHGXUH�RI�WKH�RULJLQDO�%87721�FODVV���

����3HHULQJ�LQWR�WKH�6XSHUFODVVLQJ�$SSOLFDWLRQ�ZLWK�6S\���

:KHQ�XVLQJ�6S\���WR�DQDO\]H�WKLV�VXSHUFODVVLQJ�H[DPSOH�DSSOLFDWLRQ��ZH�VHH�VHYHUDO�LQWHUHVWLQJ�WKLQJV��([DPLQLQJ�WKH�ZLQGRZ�DQG�ZLQGRZ�FODVV�LQIRUPDWLRQ�IRU�HDFK�ZLQGRZ�RI�

Page 252: Visual Basic - Subclassing and Hooking with VB & VB NET

WKH�DSSOLFDWLRQ��ZH�QRWLFH�WKDW�DOO�WKH�LQIRUPDWLRQ�IURP�WKH�RULJLQDO�FODVV�LV�FRSLHG�RYHU�WR�WKH�VXSHUFODVV��)RU�H[DPSOH��WKH�7KXQGHU57�)RUP'&�EDVH�FODVV�LQIRUPDWLRQ�FRQWDLQV�WKLV�GDWD���&ODVV�:QG3URF�����������))&%�K,QVWDQFH��������������������6W\OH���������������&6B'%/&/.6�RU�&6B2:1'&�&ODVV�([WUD�%\WHV�����:QG�([WUD�%\WHV�������0HQX�����������������QRQH��,FRQ�+DQGOH����������QRQH��&XUVRU�+DQGOH�������,'&B$552:�%NJQG�%UXVK���������&2/25B:,1'2:�8VLQJ�*HW&ODVV,QIR([�DQG�5HJLVWHU&ODVV([��ZH�PDGH�D�FRS\�RI�WKH�7KXQGHU57�)RUP'&�EDVH�FODVV�DQG�UHJLVWHUHG�LW�DV�WKH�1HZ0DLQ:QG&ODVV�VXSHUFODVV��7KH�1HZ0DLQ:QG&ODVV�VXSHUFODVV�LQIRUPDWLRQ�FRQWDLQV�WKLV�GDWD���&ODVV�:QG3URF�������������&(�K,QVWDQFH��������������������6W\OH���������������&6B'%/&/.6�RU�&6B2:1'&�&ODVV�([WUD�%\WHV�����:QG�([WUD�%\WHV�������0HQX�����������������QRQH��,FRQ�+DQGOH����������QRQH��&XUVRU�+DQGOH�������,'&B83$552:�%NJQG�%UXVK���������&2/25B:,1'2:�7KH�FODVV�QDPH��OSV]&ODVV1DPH���WKH�FODVV�ZLQGRZ�SURFHGXUH��OSIQ:QG3URF���WKH�LQVWDQFH�KDQGOH��K,QVWDQFH���DQG�WKH�&XUVRU�+DQGOH��K&XUVRU��ZHUH�WKH�RQO\�FODVV�VWUXFWXUH�PHPEHUV�PRGLILHG��7KH�DERYH�LQIRUPDWLRQ�UHIOHFWV�WKHVH�FKDQJHV��$OO�RWKHU�FODVV�LQIRUPDWLRQ�LV�FRSLHG�LQWR�WKH�1HZ0DLQ:QG&ODVV�VXSHUFODVV�YHUEDWLP���:H�VXSHUFODVV�WKH�%87721�EDVH�FODVV�LQ�D�VLPLODU�ZD\��H[FHSW�K&XUVRU�LV�QRW�PRGLILHG��7KH�JOREDO�%87721�EDVH�FODVV�FRQWDLQV�WKLV�GDWD���&ODVV�:QG3URF���������(�%%���K,QVWDQFH�����������18//�6W\OH���������������&6B3$5(17'&�RU�&6B'%/&/.6�RU�&6B+5('5$:�RU�&6B95('5$:�&ODVV�([WUD�%\WHV�����:QG�([WUD�%\WHV�������0HQX�����������������QRQH��,FRQ�+DQGOH����������QRQH��&XUVRU�+DQGOH�������,'&B$552:�%NJQG�%UXVK����������QRQH��&RPSDUDWLYHO\��WKH�1HZ%WWQ&ODVV�VXSHUFODVV�FRQWDLQV�WKLV�GDWD���&ODVV�:QG3URF������������&���

Page 253: Visual Basic - Subclassing and Hooking with VB & VB NET

K,QVWDQFH��������������������6W\OH���������������&6B3$5(17'&�RU�&6B'%/&/.6�RU�&6B+5('5$:�RU�&6B95('5$:�&ODVV�([WUD�%\WHV�����:QG�([WUD�%\WHV�������0HQX�����������������QRQH��,FRQ�+DQGOH����������QRQH��&XUVRU�+DQGOH�������,'&B$552:�%NJQG�%UXVK����������QRQH��$V�D�QRWH��DOO�VXSHUFODVVHG�ZLQGRZV�KDYH�WKH�VDPH�ZLQGRZ�SURFHGXUH�DGGUHVV��(YHU\�ZLQGRZ�FUHDWHG�IURP�WKH�1HZ0DLQ:QG&ODVV�VXSHUFODVV�LQKHULWV�WKH�ZLQGRZ�SURFHGXUH�DGGUHVV�IURP�WKH�FODVV�LW�ZDV�FUHDWHG�IURP��7KHUHIRUH��DOO�ZLQGRZV�RI�WKLV�W\SH�ZLOO�FDOO�WKH�VDPH�VXSHUFODVV�SURFHGXUH��XQOHVV�WKH\�WKHPVHOYHV�DUH�VXEFODVVHG���,W�LV�SRVVLEOH�WKDW�RQH�RI�WKHVH�ZLQGRZV�ZLOO�QHHG�WR�SURFHVV�D�PHVVDJH�GLIIHUHQWO\�IURP�WKH�UHVW�RI�WKH�ZLQGRZV��7R�GR�WKLV��VLPSO\�FKHFN�WKH�K:QG�SDVVHG�LQWR�WKH�VXSHUFODVV�SURFHGXUH�IRU�WKH�ZLQGRZ�LQ�TXHVWLRQ���7KH�H[DPSOH�DSSOLFDWLRQ�IRU�WKLV�FKDSWHU�KDV�DQ�LOOXVWUDWLRQ�RI�WKLV�SUREOHP��7KH�DSSOLFDWLRQ�LV�VKXW�GRZQ�RQO\�ZKHQ�WKH�PDLQ�ZLQGRZ�LV�FORVHG��7KH�K:QG�YDOXH�LV�FKHFNHG�LQ�WKH�VXSHUFODVV�SURFHGXUH�DQ\�WLPH�D�ZLQGRZ�LV�FORVHG��,I�WKH�ZLQGRZ�KDQGOH�PDWFKHV�WKH�PDLQ�ZLQGRZV�KDQGOH��WKH�DSSOLFDWLRQ�LV�VKXW�GRZQ��2WKHUZLVH��RQO\�WKH�ZLQGRZ�EHLQJ�FORVHG�LV�GHVWUR\HG���$OO�VXSHUFODVVHG�EXWWRQ�FRQWUROV�ZLOO�FDOO�WKH�VDPH�VXSHUFODVV�SURFHGXUH��7KLV�LV�VLPLODU�WR�KRZ�WKH�VXSHUFODVVHG�ZLQGRZV�RSHUDWH���8VLQJ�6S\���WR�H[DPLQH�WKH�ZLQGRZV�DV�WKH\�DUH�UXQQLQJ�LQ�WKH�9%�,'(��DV�RSSRVHG�WR�D�FRPSLOHG�H[HFXWDEOH��ZH�QRWLFH�VRPHWKLQJ�RI�LQWHUHVW��)LUVW��WKH�LQVWDQFH�KDQGOHV�WR�DOO�ZLQGRZV�DQG�ZLQGRZ�FODVVHV�DUH�WKH�VDPH�ZKHQ�UXQQLQJ�LQ�WKH�,'(��:KLOH�UXQQLQJ�LQ�D�FRPSLOHG�H[HFXWDEOH��DOO�7KXQGHU �FODVVHV�KDYH�WKH�LQVWDQFH�KDQGOH�RI�WKH�069%90���'//�PRGXOH��ZKLOH�DOO�FODVVHV�UHJLVWHUHG�LQ�WKH�(;(�PRGXOH�KDYH�WKH�LQVWDQFH�KDQGOH�RI�WKH�(;(���7KLV�SRVHV�D�SUREOHP�ZKHQ�WU\LQJ�WR�UXQ�DQ�DSSOLFDWLRQ�ZKLFK�VXSHUFODVVHV�7KXQGHU �FODVVHV�LQ�WKH�,'(�DQG�DV�D�FRPSLOHG�H[HFXWDEOH��,Q�WKH�,'(��WKHUH�LV�QR�SUREOHP�XVLQJ�WKH�7KXQGHU �FODVV�QDPH�GLUHFWO\�LQ�WKH�*HW&ODVV,QIR([�IXQFWLRQ�FDOO��5HPHPEHU�WR�OHDYH�RII�WKH�57��IURP�WKH�FODVV�QDPH�ZKLOH�UXQQLQJ�LQ�WKH�,'(��7KH�IROORZLQJ�FRGH�ZLOO�ZRUN�ZKLOH�UXQQLQJ�ZLWKLQ�WKH�,'(�EXW�QRW�IURP�D�FRPSLOHG�H[HFXWDEOH���O5HW9DO� �*HW&ODVV,QIR([�$SS�K,QVWDQFH���7KXQGHU)RUP'&���B�����������VWUXFW2ULJ:LQ&ODVV��7KH�IXQFWLRQ�FDQQRW�ILQG�WKH�7KXQGHU)RUP'&�FODVV�IURP�ZLWKLQ�WKH�(;(�PRGXOH�RI�D�FRPSLOHG�DSSOLFDWLRQ�EHFDXVH�WKH�FODVV�GRHV�QRW�H[LVW�LQ�WKDW�PRGXOH��WKH�$SS�K,QVWDQFH�SURSHUW\�FRQWDLQV�WKH�(;(�PRGXOH�LQVWDQFH�KDQGOH��QRW�WKH�069%90���'//�PRGXOH�LQVWDQFH�KDQGOH����7R�PDNH�RXU�DSSOLFDWLRQV�IOH[LEOH�HQRXJK�WR�ZRUN�ERWK�LQ�WKH�,'(�DQG�DV�D�FRPSLOHG�(;(��ZH�VKRXOG�XVH�WKH�IROORZLQJ�FRGH���O5HW/HQJWK� �*HW&ODVV1DPH�)RUP��KZQG��V&ODVV1DPH�������

Page 254: Visual Basic - Subclassing and Hooking with VB & VB NET

P\K,QVW� �*HW&ODVV/RQJ�)RUP��KZQG��*&/B+02'8/(��OUHWYDO� �*HW&ODVV,QIR([�P\K,QVW��/HIW��V&ODVV1DPH��O5HW/HQJWK���VWUXFW2ULJ:LQ&ODVV��7KH�ODVW�LWHP�RI�LQWHUHVW�LV�WKH�RUGHU�LQ�ZKLFK�WKH�:0B'(6752<�DQG�:0B1&'(6752<�PHVVDJHV�DUH�VHQW�WR�WKH�YDULRXV�ZLQGRZV�WKDW�PDNH�XS�WKLV�DSSOLFDWLRQ��7KLV�ZLOO�SURYLGH�VRPH�LQVLJKW�RQ�KRZ�WKH�ZLQGRZV�DUH�V\VWHPDWLFDOO\�GHVWUR\HG�XSRQ�FORVLQJ�WKH�DSSOLFDWLRQ���7KH�IROORZLQJ�RUGHU�RI�HYHQWV�LV�REVHUYHG�E\�XVLQJ�6S\���WR�PRQLWRU�PHVVDJHV�IRU�WKH�H[DPSOH�DSSOLFDWLRQ�SUHVHQWHG�LQ�WKLV�FKDSWHU��ZKLOH�LW�LV�VKXWWLQJ�GRZQ���

��� 0DLQ�:LQGRZ��FOLHQW�DUHD����� 1HZ�:LQGRZ��FOLHQW�DUHD����� 1HZ�:LQGRZ����%XWWRQ��FOLHQW�DUHD����� 1HZ�:LQGRZ����%XWWRQ��QRQFOLHQW�DUHD����� 1HZ�:LQGRZ��QRQFOLHQW�DUHD����� 0DLQ�:LQGRZ����%XWWRQ��FOLHQW�DUHD����� 0DLQ�:LQGRZ����%XWWRQ��QRQFOLHQW�DUHD����� 0DLQ�:LQGRZ��QRQFOLHQW�DUHD����� )RUP���FOLHQW�DUHD������)RUP���QRQFOLHQW�DUHD������7KXQGHU57�0DLQ��FOLHQW�DUHD������9%)RFXV57���FOLHQW�DUHD������9%)RFXV57���QRQFOLHQW�DUHD������7KXQGHU57�0DLQ��QRQFOLHQW�DUHD������9%0VR6WG&RPS0JU��FOLHQW�DUHD������9%0VR6WG&RPS0JU��QRQFOLHQW�DUHD������2OH0DLQ7KUHDG:QG&ODVV��FOLHQW�DUHD������2OH0DLQ7KUHDG:QG&ODVV��QRQFOLHQW�DUHD��

7KH�FOLHQW�DUHD�RI�D�ZLQGRZ�LV�DOZD\V�GHVWUR\HG�EHIRUH�WKH�QRQFOLHQW�DUHD��WKHUHIRUH��WKH�:0B'(6752<�PHVVDJH�LV�VHQW�WR�D�ZLQGRZ�EHIRUH�:0B1&'(6752<��7KLV�LV�WKH�RUGHU�LQ�ZKLFK�WKLV�DSSOLFDWLRQV�ZLQGRZV�DUH�GHVWUR\HG��1RWH�WKDW�WKH�LQGHQWHG�ZLQGRZV��6WHSV���WKURXJK����PXVW�EH�GHVWUR\HG�EHIRUH�WKH�0DLQ�:LQGRZV�FOLHQW�DUHD�FDQ�EH�GHVWUR\HG��6WHS�����7KH�0DLQ�:LQGRZV�FOLHQW�DUHD�FRPSOHWHV�LWV�GHVWUXFWLRQ�DIWHU�DOO�RWKHU�RSHQ�ZLQGRZV�DQG�WKHLU�UHVSHFWLYH�EXWWRQ�FRQWUROV�DUH�GHVWUR\HG���$IWHU�WKH�XVHU�FORVHV�WKH�PDLQ�ZLQGRZ��WKH�:0B'(6752<�PHVVDJH�LV�VHQW�WR�WKDW�ZLQGRZ��,Q�UHVSRQVH�WR�WKDW�PHVVDJH��WKH�VXSHUFODVV�SURFHGXUH�ORRSV�WKURXJK�DOO�RWKHU�RSHQ�ZLQGRZV�DQG�GHVWUR\V�HDFK�RI�WKHP�LQ�WXUQ��7KLV�LV�ZK\�WKH�QHZ�ZLQGRZV�DQG�WKHLU�EXWWRQ�FRQWUROV�DUH�EHLQJ�GHVWUR\HG�EHIRUH�WKH�PDLQ�ZLQGRZ�FDQ�ILQLVK�GHVWUR\LQJ�LWV�RZQ�FOLHQW�DUHD���7KH�EXWWRQ�FRQWURO�RQ�WKH�PDLQ�ZLQGRZ�LV�GHVWUR\HG�QH[W��6WHSV���DQG�����IROORZHG�E\�WKH�QRQFOLHQW�DUHD�RI�WKH�PDLQ�ZLQGRZ��6WHS�����7KH�ODVW�DFWLRQ�WKH�FRGH�SHUIRUPV�LV�WR�XQORDG�WKH�

Page 255: Visual Basic - Subclassing and Hooking with VB & VB NET

)RUP��ZLQGRZ��7KLV�GHVWUR\V�ERWK�WKH�FOLHQW�DQG�QRQFOLHQW�DUHDV�RI�WKLV�IRUP��6WHSV���DQG������7KLV�ILQLVKHV�WKH�GHVWUXFWLRQ�RI�DOO�IRUPV�WKDW�ZH�JHQHUDWHG�LQ�WKH�DSSOLFDWLRQ�FRGH���7KH�UHVW�RI�WKH�VKXWGRZQ�SURFHVV�LQYROYHV�GHVWUR\LQJ�WKH�ZLQGRZV�WKDW�9%�FUHDWHV�EHKLQG�WKH�VFHQHV��7KH�ILUVW�LV�WKH�7KXQGHU57�0DLQ�IRUP��6WHS������ZKLFK�FRQWDLQV�WKH�9%)RFXV57��ZLQGRZ��7KH�9%)RFXV57��ZLQGRZ�PXVW�EH�FRPSOHWHO\�GHVWUR\HG��6WHSV����DQG�����EHIRUH�WKH�QRQFOLHQW�DUHD�RI�WKH�7KXQGHU57�0DLQ�IRUP�FDQ�EH�GHVWUR\HG��6WHS������7KH�ODVW�WZR�ZLQGRZV�WR�EH�GHVWUR\HG�DUH�9%0VR6WG&RPS0JU��6WHSV����DQG�����DQG�2OH0DLQ7KUHDG:QG&ODVV��6WHSV����DQG������LQ�WKDW�RUGHU���:KHQ�WKH�DSSOLFDWLRQ�LV�VWDUWLQJ��LW�FUHDWHV�WKHVH�ZLQGRZV�LQ�WKH�UHYHUVH�RUGHU���

Page 256: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU����'HEXJJLQJ�7HFKQLTXHV�IRU�6XEFODVVLQJ�'HEXJJLQJ�DQ�DSSOLFDWLRQ�WKDW�XVHV�DQ\�W\SH�RI�VXEFODVVLQJ�RU�VXSHUFODVVLQJ�LV�GLIILFXOW��DW�EHVW��7R�DLG�\RX�LQ�WKLV�HQGHDYRU��WKLV�FKDSWHU�ZLOO�GLVFXVV�WKH�PHWKRGV�DQG�WRROV�XVHIXO�LQ�GHEXJJLQJ�LQVWDQFH�VXEFODVVLQJ��JOREDO�VXEFODVVLQJ��DQG�VXSHUFODVVLQJ�DSSOLFDWLRQV���7KH�ILUVW�VHFWLRQ�GLVFXVVHV�ZD\V�WR�WUDFH�WKURXJK�\RXU�DSSOLFDWLRQV�FRGH�WR�GHWHUPLQH�ZKHUH�D�SUREOHP�OLHV��7KH�QH[W�VHFWLRQ�SURYLGHV�LQIRUPDWLRQ�RQ�WRROV�SURYLGHG�E\�0LFURVRIW��7KH�ODVW�VHFWLRQ�FRYHUV�6PDUW&KHFN��D�WRRO�GHYHORSHG�E\�1X0HJD�WR�DVVLVW�GHYHORSHUV�LQ�GHEXJJLQJ�9LVXDO�%DVLF��9%��DSSOLFDWLRQV���

����:KHUH�WR�6WDUW�

7KH�PRVW�LPSRUWDQW�WKLQJ�WKDW�\RX�VKRXOG�UHPHPEHU�LV�WR�VDYH�\RXU�ZRUN�RIWHQ��,�WHOO�\RX�WKLV�IURP�H[SHULHQFH��,I�\RXU�VXEFODVVLQJ�DSSOLFDWLRQ�FUDVKHV�ZKLOH�UXQQLQJ�LQ�WKH�9LVXDO�%DVLF�,'(��WKH�HQWLUH�9%�HQYLURQPHQW�LQFOXGLQJ�WKH�UXQQLQJ�DSSOLFDWLRQ�LV�ORVW��$OO�XQVDYHG�FRGH�DOVR�LV�ORVW���7KHUH�DUH�UHOLDEOH�ZD\V�WR�GHEXJ�VXEFODVVLQJ�DSSOLFDWLRQV��,�ZLOO�SUHVHQW�WKH�RQHV�,�XVH�UHJXODUO\�KHUH���:KHQ�ZULWLQJ�D�VXEFODVVLQJ�DSSOLFDWLRQ��LW�LV�XVXDOO\�EHWWHU�WR�VWDUW�VLPSOH��:ULWH�WKH�VXEFODVVLQJ�FRGH�XVLQJ�RQO\�D�PLQLPDO�ZLQGRZ�SURFHGXUH�IXQFWLRQ��%\�WKLV��,�PHDQ�GR�QRW�KDQGOH�DQ\�PHVVDJHV�ZLWKLQ�WKLV�IXQFWLRQ��RQO\�SDVV�WKH�PHVVDJHV�RQ�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��7KLV�LV�WKH�FRGH�IRU�D�PLQLPDO�ZLQGRZ�SURFHGXUH���3XEOLF�)XQFWLRQ�:LQ3URF�%\9DO�KZQG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B�����������������%\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�����:LQ3URF� �&DOO:LQGRZ3URF�2ULJ:QG3URF��KZQG��X0VJ��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KLV�DOORZV�\RX�WR�WHVW�\RXU�VXEFODVVLQJ�FRGH�DORQH��$IWHU�DOO�SUREOHPV�DUH�UHVROYHG�ZLWK�WKH�VXEFODVVLQJ�FRGH��\RX�FDQ�SURFHHG��DGGLQJ�WKH�QHFHVVDU\�FRGH�WR�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH��,I�WKHUH�LV�D�SUREOHP�DIWHU�DGGLQJ�FRGH�WR�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH��\RX�FDQ�QDUURZ�LW�GRZQ�WR�WKLV�QHZ�FRGH���

������6XEFODVVLQJ�&KHFNOLVW�

%HIRUH�UXQQLQJ�\RXU�VXEFODVVLQJ�DSSOLFDWLRQ�IRU�WKH�ILUVW�WLPH��LW�LV�D�JRRG�LGHD�WR�UXQ�WKURXJK�D�EDVLF�FKHFNOLVW�WR�YHULI\�WKDW�DOO�SLHFHV�UHTXLUHG�IRU�VXEFODVVLQJ�DUH�DFFRXQWHG�IRU��<RX�FDQ�XVH�WKH�IROORZLQJ�FKHFNOLVWV�DV�JXLGHOLQH�IRU�YHULI\LQJ�VXEFODVVLQJ�FRGH���

Page 257: Visual Basic - Subclassing and Hooking with VB & VB NET

��� 7KH�6HW:LQGRZ/RQJ3WU�RU�6HW&ODVV/RQJ3WU�IXQFWLRQ�XVHG�WR�LQLWLDWH�VXEFODVVLQJ�LV�SUHVHQW�DQG�DOO�LWV�SDUDPHWHUV�DUH�FRUUHFW��7KH�$GGUHVV2I�RSHUDWRU�PXVW�UHIHUHQFH�D�YDOLG�ZLQGRZ�SURFHGXUH���

��� 7KH�RULJLQDO�ZLQGRZ�SURFHGXUH�UHWXUQHG�IURP�WKH�6HW:LQGRZ/RQJ3WU�RU�6HW&ODVV/RQJ3WU�IXQFWLRQ�LV�VWRUHG�LQ�D�YDULDEOH���

��� 7KH�VXEFODVV�ZLQGRZ�SURFHGXUH�LV�DFFRXQWHG�IRU�DQG�UHVLGHV�LQ�D�FRGH��%$6��PRGXOH���

��� 7KH�QXPEHU�DQG�W\SH�RI�DUJXPHQWV�IRU�WKH�VXEFODVV�ZLQGRZ�SURFHGXUH�DUH�FRUUHFW������ 7KH�VXEFODVV�ZLQGRZ�SURFHGXUH�FRQWDLQV�D�FDOO�WR�HLWKHU�&DOO:LQGRZ3URF�RU�

'HI:LQGRZ3URF�IRU�GHIDXOW�PHVVDJH�SURFHVVLQJ������ 7KH�QXPEHU�DQG�W\SH�RI�DUJXPHQWV�IRU�WKH�&DOO:LQGRZ3URF�RU�'HI:LQGRZ3URF�

IXQFWLRQ�DUH�FRUUHFW������ ,I�&DOO:LQGRZ3URF�LV�XVHG��WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�SDVVHG�DV�WKH�ILUVW�

DUJXPHQW�LV�YDOLG������ 7KH�6HW:LQGRZ/RQJ3WU�RU�6HW&ODVV/RQJ3WU�IXQFWLRQ�XVHG�WR�WHUPLQDWH�VXEFODVVLQJ�LV�

SUHVHQW��DQG�DOO�LWV�SDUDPHWHUV�DUH�FRUUHFW������ %HIRUH�WKH�VXEFODVVHG�ZLQGRZ�LV�FORVHG��LWV�RULJLQDO�ZLQGRZ�SURFHGXUH�LV�UHSODFHG�������7KHUH�DUH�QR�(QG�VWDWHPHQWV�LQ�WKH�DSSOLFDWLRQ������'R�QRW�XVH�'R(YHQWV��

,Q�DGGLWLRQ��LI�\RX�DUH�SHUIRUPLQJ�JOREDO�VXEFODVVLQJ��DGG�WKHVH�LWHPV�WR�WKH�FKHFNOLVW���

��� $�KLGGHQ�ZLQGRZ�LV�FUHDWHG�WR�LQLWLDWH�JOREDO�VXEFODVVLQJ��7KLV�ZLQGRZ�LV�GHVWUR\HG�RQO\�DIWHU�JOREDO�VXEFODVVLQJ�KDV�EHHQ�WHUPLQDWHG���

��� 'HVWUR\�DOO�JOREDOO\�VXEFODVVHG�ZLQGRZV�EHIRUH�WHUPLQDWLQJ�JOREDO�VXEFODVVLQJ���

,I�\RX�DUH�SHUIRUPLQJ�VXSHUFODVVLQJ��DGG�WKHVH�LWHPV�WR�WKH�ILUVW�FKHFNOLVW���

��� 7KH�SRLQWHU�WR�WKH�EDVH�FODVVV�ZLQGRZ�SURFHGXUH�LV�VDYHG�DQG�XVHG�WR�SURYLGH�WKH�GHIDXOW�SURFHVVLQJ�IRU�PHVVDJHV�LQ�WKH�VXSHUFODVV�SURFHGXUH���

��� 7KH�VXSHUFODVV�LV�JLYHQ�D�QHZ�XQLTXH�FODVV�QDPH����� 7KH�VXSHUFODVV�LV�JLYHQ�D�YDOLG�LQVWDQFH�KDQGOH���

7KLV�LV�D�VHSDUDWH�FKHFNOLVW�\RX�FDQ�XVH�ZLWK�FRPPRQ�GLDORJ�ER[�VXEFODVVLQJ���

��� $�YDOLG�GLDORJ�WHPSODWH�UHVRXUFH�LV�XVHG������ 7KH�UHVRXUFH�LV�FRUUHFWO\�SDFNDJHG�DV�HLWKHU�D�G\QDPLF�OLQN�OLEUDU\��'//��RU�D�

UHVRXUFH��5(6��ILOH��<RX�FDQ�XVH�5(6�ILOHV�RQO\�LQ�FRPSLOHG�DSSOLFDWLRQV������ 7KH�FRUUHFW�VWUXFWXUH�LV�XVHG�WR�FUHDWH�WKH�FRPPRQ�GLDORJ�ER[����� 7KH�FRUUHFW�WHPSODWH�UHVRXUFH�DQG�KRRN�SURFHGXUH�KDYH�EHHQ�DGGHG�WR�WKH�FRPPRQ�

GLDORJ�ER[�VWUXFWXUH���

Page 258: Visual Basic - Subclassing and Hooking with VB & VB NET

��� 7KH�K,QVWDQFH�PHPEHU�RI�WKH�FRPPRQ�GLDORJ�ER[�VWUXFWXUH�FRQWDLQV�WKH�KDQGOH�WR�WKH�PRGXOH�FRQWDLQLQJ�WKH�GLDORJ�WHPSODWH�UHVRXUFH���

��� 7KH�FRUUHFW�IODJV�KDYH�EHHQ�VHW�LQ�WKH�IODJV�PHPEHU�LQ�WKH�FRPPRQ�GLDORJ�ER[�VWUXFWXUH���

��� 7KH�QXPEHU�DQG�W\SH�RI�DUJXPHQWV�IRU�WKH�GLDORJ�KRRN�SURFHGXUH�DUH�FRUUHFW���

������6WHSSLQJ�7KURXJK�WKH�$SSOLFDWLRQ�

$OWKRXJK�LW�LV�SRVVLEOH�WR�VHW�EUHDNSRLQWV�LQ�\RXU�VXEFODVVLQJ�DSSOLFDWLRQ�DQG�VWHS�WKURXJK�WKH�FRGH��,�GR�QRW�UHFRPPHQG�WKLV�SUDFWLFH��,Q�PDQ\�FDVHV��WKLV�ZLOO�FDXVH�\RXU�DSSOLFDWLRQ�DQG�WKH�9%�HQYLURQPHQW�WR�IUHH]H�RU�FUDVK���$IWHU�VXEFODVVLQJ�LV��WXUQHG�RQ��IRU�DQ�DSSOLFDWLRQ�WKDW�\RX�DUH�VWHSSLQJ�WKURXJK��DOO�PHVVDJHV�VHQW�WR�WKDW�ZLQGRZ�ZLOO�FDXVH�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�WR�EH�FDOOHG��8QIRUWXQDWHO\��WKHUH�LV�D�ELJ�SUREOHP�ZLWK�DFWLYDWLRQ�EHWZHHQ�\RXU�DSSOLFDWLRQV�ZLQGRZ�DQG�WKH�FRGH�ZLQGRZ�ZLWKLQ�WKH�,'(��$V�\RX�DUH�VWHSSLQJ�WKURXJK�\RXU�FRGH��WKH�FRGH�ZLQGRZ�PXVW�EH�WKH�DFWLYH�ZLQGRZ��,I�\RX�WU\�WR�VHW�\RXU�DSSOLFDWLRQ�ZLQGRZ�DV�WKH�DFWLYH�ZLQGRZ��WKH�V\VWHP�ZLOO�LPPHGLDWHO\�VWDUW�VHQGLQJ�PHVVDJHV�WR�WKDW�ZLQGRZ�WR�DFWLYDWH�LW��SDLQW�LW�RQ�WKH�VFUHHQ��DQG�VR�IRUWK��(YHU\�PHVVDJH�WKDW�LV�VHQW�WR�WKH�DSSOLFDWLRQ�ZLQGRZ�FDXVHV�WKH�FRGH�ZLQGRZ�WR�DFWLYDWH��DOORZLQJ�\RX�WR�VWHS�WKURXJK�WKH�FRGH�LQ�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH��$V�\RX�VWHS�WKURXJK�WKH�FRGH�\RX�ZLOO�QRWLFH�WKDW�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LV�FDOOHG�D�ODUJH�QXPEHU�RI�WLPHV��0DQ\�RI�WKH�PHVVDJHV�EHLQJ�VHQW�WR�WKLV�SURFHGXUH�DUH�WU\LQJ�WR�SRVLWLRQ�DQG�SDLQW�WKH�VXEFODVVHG�ZLQGRZ�RQ�WKH�VFUHHQ��:KDW�LV�KDSSHQLQJ�LV�WKDW�WKH�FRGH�ZLQGRZ�RI�WKH�,'(�LV�FRQWHQGLQJ�ZLWK�WKH�VXEFODVVHG�ZLQGRZ�IRU�DFWLYDWLRQ��7KLV�ZLOO�FDXVH�HDFK�ZLQGRZ�WR�SDLQW�RQ�WKH�VFUHHQ�LQ�DQ�HUUDWLF�ZD\��7KLV�ZLOO�PRVW�OLNHO\�HQG�XS�IUHH]LQJ�\RXU�DSSOLFDWLRQ��DQG�WKH�RQO\�ZD\�RXW�LV�WR�NLOO�RII�WKH�DSSOLFDWLRQV�SURFHVV�DQG�WKH�9%�,'(�ZLWK�LW���7KHUH�DUH�PRUH�UREXVW�ZD\V�RI�GHEXJJLQJ�\RXU�FRGH��7KH�PDLQ�GUDZEDFN�LV�WKDW�\RX�PLJKW�QRW�JHW�WKH�LQVWDQW�IHHGEDFN�WKDW�\RX�FDQ�JHW�E\�VWHSSLQJ�WKURXJK�\RXU�DSSOLFDWLRQ�LQ�WKH�,'(��DQG�\RX�FDQQRW�FKDQJH�WKH�FRGH�RQ�WKH�IO\���

������/RJ�)LOHV�

7KH�EHVW�ZD\�WR�WUDFH�H[HFXWLRQ�LQ�\RXU�VXEFODVVLQJ�DSSOLFDWLRQ��VKRUW�RI�XVLQJ�WKLUG�SDUW\�WRROV��LV�WR�XVH�WKH�HYHQW�ORJJLQJ�FDSDELOLWLHV�RI�9%��7KLV�WHFKQLTXH�LV�VLPSOH�DQG�HIIHFWLYH��7KH�LQIRUPDWLRQ�\RX�JOHDQ�IURP�WKHVH�ORJ�ILOHV�FDQ�WHOO�\RX�ZKDW�\RXU�DSSOLFDWLRQ�ZDV�GRLQJ�ZKHQ�LW�FUDVKHG��ZKHUH�LW�FUDVKHG��DQG�HYHQ�ZKDW�PDGH�LW�FUDVK���,�KDYH�XVHG�WZR�GLIIHUHQW�PHWKRGV�IRU�LPSOHPHQWLQJ�ORJ�ILOHV��7KH�ILUVW�LV�WR�SURYLGH�D�WH[W�ER[�RQ�D�ZLQGRZ�WKDW�FDQ�UHFHLYH�PHVVDJHV�DQG�FRPPHQWV��$W�VWUDWHJLF�ORFDWLRQV�WKURXJKRXW�WKH�FRGH��,�SODFH�OLQHV�WKDW�DGG�LQIRUPDWLRQ�WR�WKLV�WH[W�ER[��)RU�H[DPSOH��,�PLJKW�DGG�D�OLQH�LQ�WKH�FRGH�WKDW�ZULWHV�WKH�YDOXH�RI�WKH�RULJLQDO�ZLQGRZ�SURFHGXUHV�IXQFWLRQ�SRLQWHU�WR�WKLV�WH[W�ER[��7KH�OLQH�PLJKW�ORRN�VRPHWKLQJ�OLNH�WKLV���

Page 259: Visual Basic - Subclassing and Hooking with VB & VB NET

)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���2ULJLQDO�:LQGRZ�3URF�����PB2ULJ:LQ3URF��B���������������������YE&U/I�7KLV�LV�D�IDVW�DQG�HDV\�ZD\�WR�JHW�IHHGEDFN�RQ�KRZ�\RXU�DSSOLFDWLRQ�LV�RSHUDWLQJ��7KHUH�DUH�WZR�GUDZEDFNV�WR�WKLV�PHWKRG��KRZHYHU��7KH�ILUVW�LV�WKDW�\RX�PXVW�VXSSO\�WKH�FRGH�WR�DGG�PHVVDJHV�WR�WKLV�WH[W�ER[�WKURXJKRXW�\RXU�FRGH��7KLV�PLJKW�WDNH�VRPH�WULDO�DQG�HUURU�WR�JHW�DOO�WKH�LQIRUPDWLRQ�WKDW�\RX�QHHG�WR�GHEXJ�\RXU�DSSOLFDWLRQ���7KH�RWKHU�GUDZEDFN�LV�WKDW�LI�\RX�DUH�VHQGLQJ�D�ODUJH�QXPEHU�RI�PHVVDJHV�WR�WKLV�WH[W�ER[����VD\�����OLQHV����DQG�\RXU�DSSOLFDWLRQ�FUDVKHV��\RX�ZLOO�QRW�EH�DEOH�WR�VHH�DOO�WKH�LQIRUPDWLRQ�LQ�\RXU�WH[W�ER[��7KH�IL[�IRU�WKLV�SUREOHP�LV�D�VOLJKWO\�GLIIHUHQW�PHWKRG�RI�ORJJLQJ�PHVVDJHV��,Q�DGGLWLRQ��EHFDXVH�LWV�GHEXJJLQJ�FRGH��\RX�KDYH�WR�UHPRYH�LW�RU�FRPPHQW�LW�RXW�LQ�WKH�SURGXFWLRQ�YHUVLRQ��$�FRPPRQ��DQG�HPEDUUDVVLQJ��VRXUFH�RI�HUURUV�LV�WR�IDLO�WR�UHPRYH�DOO�GHEXJJLQJ�FRGH���,QVWHDG�RI�XVLQJ�D�WH[W�ER[��\RX�FDQ�ZULWH�RXW�LQIRUPDWLRQ�WR�WKH�HYHQW�ORJ��$GGLQJ�HYHQW�ORJJLQJ�WR�\RXU�DSSOLFDWLRQV�LV�DFWXDOO\�YHU\�HDV\��7KHUH�LV�D�VLQJOH�PHWKRG�RI�WKH�$SS�REMHFW��/RJ(YHQW��ZKLFK�LV�XVHG�ZKHQ�ORJJLQJ�LQIRUPDWLRQ�IURP�D�9%�DSSOLFDWLRQ��7KH�IROORZLQJ�FRGH�H[DPSOH�GHPRQVWUDWHV�WKH�XVH�RI�WKLV�PHWKRG���3XEOLF�&RQVW�YE/RJ(YHQW7\SH,QIRUPDWLRQ� ����3ULYDWH�6XE�FPG&UHDWH/RJB&OLFN���������$SS�/RJ(YHQW��7KLV�LV�D�WHVW���YE/RJ(YHQW7\SH,QIRUPDWLRQ�(QG�6XE�7KH�ILUVW�SDUDPHWHU�RI�WKH�/RJ(YHQW�PHWKRG�LV�WKH�WH[W�VWULQJ�WKDW�LV�VHQW�WR�WKH�HYHQW�ORJ��7KH�VHFRQG�SDUDPHWHU�LV�RQH�RI�IROORZLQJ�WKUHH�YDOXHV���3XEOLF�&RQVW�YE/RJ(YHQW7\SH(UURU� ��������������(UURU�PHVVDJH�3XEOLF�&RQVW�YE/RJ(YHQW7\SH:DUQLQJ� ������������:DUQLQJ�PHVVDJH�3XEOLF�&RQVW�YE/RJ(YHQW7\SH,QIRUPDWLRQ� ��������,QIRUPDWLRQDO�PHVVDJH�,W�LV�LPSRUWDQW�WR�NHHS�WKH�IROORZLQJ�LQ�PLQG�ZKHQ�XVLQJ�HYHQW�ORJJLQJ���

• (YHQW�ORJJLQJ�ZRUNV�RQO\�LQ�FRPSLOHG�DSSOLFDWLRQV��• 7KH�6RXUFH�FROXPQ�LQ�WKH�(YHQW�9LHZHU�IRU�DQ\�9%�DSSOLFDWLRQ�HQWU\�LV�DOZD\V�VHW�WR�

�9%5XQWLPH����• <RX�FDQ�FXVWRPL]H�9%V�ORJJLQJ�EHKDYLRU�VRPHZKDW�E\�FDOOLQJ�WKH�$SS�REMHFWV�

6WDUW/RJJLQJ�PHWKRG��ZKLFK�KDV�WKH�IROORZLQJ�V\QWD[���

6WDUW/RJJLQJ�V/RJ7DUJHW��O/RJ0RGHV�

• ZKHUH�V/RJ7DUJHW�LV�D�VWULQJ�FRQWDLQLQJ�WKH�SDWK�DQG�ILOHQDPH�RI�WKH�ORJ�ILOH��DQG�O/RJ0RGHV�LV�RQH�RU�PRUH�RI�WKH�IROORZLQJ�LQWULQVLF�FRQVWDQWV���

vbLogAuto (0)

Page 260: Visual Basic - Subclassing and Hooking with VB & VB NET

2Q�:LQGRZV��[��ORJV�PHVVDJHV�WR�WKH�ILOH�VSHFLILHG�LQ�WKH�/RJ)LOH�SURSHUW\��2Q�:LQGRZV�17�������ORJV�PHVVDJHV�WR�WKH�$SSOLFDWLRQ�(YHQW�/RJ��ZLWK��9%5XQ7LPH��XVHG�DV�WKH�DSSOLFDWLRQ�VRXUFH�DQG�$SS�7LWOH�DSSHDULQJ�LQ�WKH�GHVFULSWLRQ���vbLogOff (1)

7XUQV�DOO�ORJJLQJ�RII�DQG�FDXVHV�VXEVHTXHQW�FDOOV�WR�WKH�/RJ(YHQW�PHWKRG�WR�EH�LJQRUHG���vbLogToFile (2)

)RUFHV�ORJJLQJ�WR�D�ILOH�VSHFLILHG�E\�/RJ3DWK���VbLogToNT (3)

)RUFHV�ORJJLQJ�WR�WKH�17�HYHQW�ORJ��,I�QRW�UXQQLQJ�RQ�:LQGRZV�17��RU�LI�WKH�HYHQW�ORJ�LV�XQDYDLODEOH��ORJJLQJ�LV�LJQRUHG�DQG�WKH�SURSHUW\�LV�VHW�WR�YE/RJ2II���VbLogOverwrite (16)

)RU�:LQGRZV��[�RQO\��LQGLFDWHV�WKDW�ORJILOH�VKRXOG�EH�UH�FUHDWHG�HDFK�WLPH�WKH�DSSOLFDWLRQ�VWDUWV���%\�GHIDXOW��LWHPV�DUH�DSSHQGHG�WR�WKH�ORJ���7KLV�YDOXH�FDQ�EH�25HG�ZLWK�RWKHU�FRQVWDQWV���VbLogThreadID (32)

,QGLFDWHV�WKDW�WKH�FXUUHQW�WKUHDG�,'�EH�SUHSHQGHG�WR�WKH�PHVVDJH��LQ�WKH�IRUP��>7��QQQ@���7KLV�YDOXH�FDQ�EH�25HG�ZLWK�RWKHU�FRQVWDQWV���

• ,I�\RX�GR�QRW�XVH�6WDUW/RJJLQJ�WR�RYHUULGH�WKH�GHIDXOW�VHWWLQJV�IRU�WKH�(YHQW�9LHZHU��WKH�ORJ�HQWULHV�JR�WR�WKH�HYHQW�ORJ�RQ�:LQGRZV�17������DQG�WKH�9%(YHQWV�ORJ�ILOH�LQ�WKH��6\VWHP5RRW��GLUHFWRU\�RQ�D�:LQGRZV��[�V\VWHP���

7KH�EHDXW\�RI�XVLQJ�WKLV�PHWKRG�IRU�ORJJLQJ�LQIRUPDWLRQ�LV�WKDW��LI�\RXU�DSSOLFDWLRQ�FUDVKHV��LQIRUPDWLRQ�FDQ�EH�ZULWWHQ�WR�WKH�ORJ�ILOH�XS�WR�WKH�SRLQW�WKDW�LW�FUDVKHG�RU�IUR]H��8VXDOO\�ZKHQ�DQ�DSSOLFDWLRQ�FUDVKHV��LW�VWRSV�DFFHSWLQJ�PHVVDJHV��:KHQ�WKLV�KDSSHQV��WKH�ZLQGRZ�IDLOV�WR�XSGDWH�SURSHUO\��7KLV�SUHYHQWV�\RX�IURP�YLHZLQJ�WKH�LQIRUPDWLRQ�VHQW�WR�D�WH[W�ER[�LPPHGLDWHO\�EHIRUH�WKH�DSSOLFDWLRQ�FUDVKHG��7KH�ODVW�OLQHV�RI�LQIRUPDWLRQ�LQ�\RXU�ORJ�ILOH�DUH�XVXDOO\�WKH�PRVW�FULWLFDO��7KH\�FDQ�KHOS�\RX�SLQSRLQW�ZKHUH�WKH�FUDVK�RFFXUUHG�DQG�ZKDW�YDOXHV�ZHUH�FRQWDLQHG�LQ�WKH�YDULDEOHV�EHIRUH�WKH�FUDVK���

����0LFURVRIW�7RROV�

0LFURVRIW�SURYLGHV�VRPH�XVHIXO�GHEXJJLQJ�WRROV�DORQJ�ZLWK�LWV�GHYHORSPHQW�SURGXFWV��<RX�FDQ�ILQG�WKHVH�WRROV�RQ�0LFURVRIWV�ZHE�VLWH��7KH\�DOVR�DUH�EXQGOHG�ZLWK�9LVXDO�&���DQG�9%���

������6S\���

6S\���LV�RQH�RI�WKH�PRVW�XVHIXO�WRROV�WR�JLYH�XV�LQVLJKW�RQ�KRZ�RXU�DSSOLFDWLRQ�LV�VWUXFWXUHG��DV�ZHOO�DV�WR�DOORZ�XV�WR�H[DPLQH�WKH�PHVVDJHV�RXU�DSSOLFDWLRQ�LV�UHFHLYLQJ��,�KDYH�SURYLGHG�

Page 261: Visual Basic - Subclassing and Hooking with VB & VB NET

DQ�LQWURGXFWLRQ�WR�XVLQJ�WKLV�WRRO�LQ�&KDSWHU����7KURXJKRXW�PDQ\�RI�WKH�FKDSWHUV��,�KDYH�GHVFULEHG�VSHFLILF�XVHV�RI�WKLV�WRRO�DV�LW�UHODWHV�WR�HDFK�FKDSWHUV�WRSLF���

������'%*:352&�'//�

7KLV�WRRO��ZKLFK�0LFURVRIW�GHVLJQHG��LV�DYDLODEOH�DW�KWWS���PVGQ�PLFURVRIW�FRP�YEDVLF�GRZQORDGV�FRQWUROV�DVS��7KLV�WRRO�LV�SURYLGHG�IUHH�RI�FKDUJH���7KLV�LV�VLPSO\�D�&RPSRQHQW�2EMHFW�0RGHO��&20��'//�WKDW�\RX�DGG�WR�\RXU�DSSOLFDWLRQ��<RX�QHHG�WR�DGG�YHU\�OLWWOH�FRGH�WR�DOORZ�\RXU�DSSOLFDWLRQ�WR�XVH�WKLV�'//���7R�LQFRUSRUDWH�WKLV�'//�LQWR�\RXU�DSSOLFDWLRQ��UHJLVWHU�LW�XVLQJ�UHJVYU���H[H�DQG�DGG�LW�WR�\RXU�SURMHFW�UHIHUHQFHV�E\�FKHFNLQJ�WKH��'HEXJ�2EMHFW�IRU�$GGUHVV2I�6XEFODVVLQJ��RSWLRQ�LQ�WKH�5HIHUHQFHV�GLDORJ��&OLFN�RQ�WKH�0DNH�WDE�LQ�WKH�3URMHFW�3URSHUWLHV�GLDORJ�ER[��$GG�WKH�WH[W��'(%8*:,1'2:352&� ������86(*(73523� �����WR�WKH�&RQGLWLRQDO�&RPSLODWLRQ�WH[W�ER[��)RU�WKH�UHOHDVH�YHUVLRQ�RI�WKLV�DSSOLFDWLRQ��\RX�VKRXOG�FKDQJH�WKH����YDOXHV�WR�]HURHV�DQG�UHPRYH�WKH�UHIHUHQFH�WR�'%*:352&�'//���1H[W��\RX�PXVW�FUHDWH�DQ�REMHFW�PB'EJ+RRN�IURP�WKH�:LQGRZ3URF+RRN�FODVV����,I�'(%8*:,1'2:352&�7KHQ�� 3ULYDWH�PB'EJ+RRN�$V�:LQGRZ3URF+RRN��(QG�,I�,I�ZH�DUH�QRW�XVLQJ�'%*:352&�'//��ZH�FDQ�FDOO�6HW:LQGRZ/RQJ3WU�DV�ZH�QRUPDOO\�ZRXOG�WR�VXEFODVV�D�ZLQGRZ��2WKHUZLVH��ZH�VHW�XS�'%*:352&�'//�WR�FRQWURO�WKH�VXEFODVVLQJ��DV�LQ�WKH�IROORZLQJ�FRGH����,I�'(%8*:,1'2:352&�7KHQ����2Q�(UURU�5HVXPH�1H[W����6HW�PB'EJ+RRN� �&UHDWH:LQGRZ3URF+RRN����,I�(UU�7KHQ�������0VJ%R[�(UU�'HVFULSWLRQ�������(UU�&OHDU�������'LVDEOH6XEFODVV����5HSODFH�ZLWK�\RXU�RZQ�GLVDEOH�VXEFODVV�IXQFWLRQ�������([LW�)XQFWLRQ����(QG�,I����2Q�(UURU�*R7R������:LWK�PB'EJ+RRN��������6HW0DLQ3URF�$GGUHVV2I�0RGXOH��1HZ:QG3URF���5HSODFH�ZLWK�\RXU�ZLQ�SURF�������PBO2ULJ:QG3URF� �6HW:LQGRZ/RQJ3WU�PBKZQG��*:/3B:1'352&���3URF$GGUHVV���������6HW'HEXJ3URF�PBO2ULJ:QG3URF�����������(QG�:LWK��(OVH�

Page 262: Visual Basic - Subclassing and Hooking with VB & VB NET

���PBO2ULJ:QG3URF� �6HW:LQGRZ/RQJ3WU�PBKZQG��*:/3B:1'352&��$GGUHVV2I�0RGXOH��1HZ:QG3URF���(QG�,I�7KH�PRVW�UHOHYDQW�FRGH�LV�ZLWKLQ�WKH�:LWK�PB'EJ+RRN�FRGH�EORFN��7KH�ILUVW�OLQH�LQ�WKLV�EORFN�RI�FRGH�VWRUHV�WKH�DGGUHVV�RI�\RXU�VXEFODVV�ZLQGRZ�SURFHGXUH�LQ�WKH�'//��LQ�WKLV�FDVH��LW�LV�WKH�DGGUHVV�RI�WKH�0RGXOH��1HZ:QG3URF�IXQFWLRQ��7KH�VHFRQG�OLQH�XVHV�WKH�IDPLOLDU�6HW:LQGRZ/RQJ3WU�WR�LQLWLDWH�WKH�VXEFODVVLQJ��H[FHSW�WKDW�WKH�DGGUHVV�RI�WKH�QHZ�ZLQGRZ�SURFHGXUH�LV�QRW�RXU�IXQFWLRQ��LQVWHDG��LW�LV�VHW�WR�3URF$GGUHVV��ZKLFK�LV�D�UHDG�RQO\�SURSHUW\�RI�WKH�'//�WKDW�FRQWDLQV�DQ�DGGUHVV�WR�D�IXQFWLRQ�ZLWKLQ�WKH�'//��7KLV�LV�WKH�DFWXDO�VXEFODVV�ZLQGRZ�SURFHGXUH�WKDW�LV�FDOOHG�IRU�RXU�ZLQGRZ��)LQDOO\��WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�LV�VWRUHG�LQ�WKH�'//�WKURXJK�WKH�6HW'HEXJ3URF�IXQFWLRQ���7KLV�LV�KRZ�WKH�'//�ZRUNV��

��� 6XEFODVVLQJ�LV�LQLWLDWHG�DV�LQ�WKH�SUHYLRXV�FRGH����� :KHQ�D�PHVVDJH�LV�VHQW�WR�WKH�VXEFODVVHG�ZLQGRZ��LW�DUULYHV�LQ�WKH�VXEFODVV�ZLQGRZ�

SURFHGXUH�GHILQHG�E\�WKH�3URF$GGUHVV�SURSHUW\������ 7KH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�WKHQ�GHWHUPLQHV�ZKHUH�WR�VHQG�WKH�PHVVDJH���

D�� ,I�WKH�$GGUHVV2I�RSHUDWRU�UHWXUQV�D�]HUR�WR�WKH�6HW0DLQ3URF�PHWKRG��WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�LV�FDOOHG��7KH�RULJLQDO�ZLQGRZ�SURFHGXUH�IXQFWLRQ�DGGUHVV�ZDV�VHQW�WR�WKH�6HW'HEXJ3URF�PHWKRG�RI�WKH�'//���

E�� 2WKHUZLVH�RXU�VXEFODVV�ZLQGRZ�SURFHGXUH�LV�FDOOHG��7KLV�LV�WKH�IXQFWLRQ�DGGUHVV�VHQW�WR�WKH�6HW0DLQ3URF�PHWKRG�RI�WKH�'//���

7KH�RULJLQDO�LQWHQW�RI�WKLV�'//�ZDV�WR�FLUFXPYHQW�WKH�HUURU�FDXVHG�E\�WKH�$GGUHVV2I�RSHUDWRU�UHWXUQLQJ�D�]HUR�ZKLOH�UXQQLQJ�ZLWKLQ�WKH�9%�,'(��2GGO\�HQRXJK��,�GLVFRYHUHG�WKDW�$GGUHVV2I�UHWXUQV�D�YDOLG�IXQFWLRQ�SRLQWHU�ZKLOH�UXQQLQJ�ZLWKLQ�WKH�,'(��DOWKRXJK��WKLV�PLJKW�ZRUN�GLIIHUHQWO\�IRU�9%�SULRU�WR�9HUVLRQ�����<RX�PLJKW�EH�ZRQGHULQJ�ZK\�WR�HYHQ�XVH�WKLV�'//�IRU�GHEXJJLQJ�LI�WKH�$GGUHVV2I�RSHUDWRU�UHWXUQV�D�YDOLG�IXQFWLRQ�DGGUHVV��7KH�DQVZHU�LV�WKDW�XVLQJ�WKLV�'//�VROYHV�WKH�SUREOHP�RI�WKH�FRGH�ZLQGRZ�DQG�WKH�DSSOLFDWLRQ�ZLQGRZ�FRPSHWLQJ�WR�EH�WKH�DFWLYH�ZLQGRZ�ZKHQ�VWHSSLQJ�WKURXJK�WKH�FRGH��7KLV�PDNHV�LW�PXFK�HDVLHU�DQG�VDIHU�WR�VWHS�WKURXJK�FRGH�ZKLOH�LQ�WKH�9%�,'(��

����1X0HJDV�6PDUW&KHFN�

,�KDYH�QRW�PHQWLRQHG�WKLV�WRRO�PXFK��DOWKRXJK�,�XVH�LW�IUHTXHQWO\��6PDUW&KHFN�SURYLGHV�GHEXJ�LQIRUPDWLRQ�DERXW�D�9%�DSSOLFDWLRQ�GXULQJ�UXQWLPH��7KLV�WRRO�LV�LQYDOXDEOH�LQ�GHEXJJLQJ�

Page 263: Visual Basic - Subclassing and Hooking with VB & VB NET

DSSOLFDWLRQ�FUDVKHV��HUURQHRXV�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��FDOOV��DQG�PXFK�PRUH��<RX�FDQ�VHW�XS�WKLV�WRRO�DV�DQ�DGG�LQ�WR�9%��DQG�LW�LV�IDLUO\�LQWXLWLYH�WR�XVH���%HVLGHV�SRLQWLQJ�RXW�DSSOLFDWLRQ�HUURUV��6PDUW&KHFN�DOVR�GLVSOD\V�$3,�IXQFWLRQV��IXQFWLRQ�SDUDPHWHUV��UHWXUQ�YDOXHV��DQG�HYHQ�WKH�GDWD�WR�ZKLFK�D�SRLQWHU�SRLQWV��7KLV�LV�YHU\�XVHIXO�ZKHQ�GHWHUPLQLQJ�LI�WKH�VWULQJ�GDWD�RU�D�VWUXFWXUH�SRLQWHG�WR�E\�D�SRLQWHU�FRQWDLQV�WKH�FRUUHFW�LQIRUPDWLRQ��)LJXUH�����GLVSOD\V�D�VFUHHQVKRW�RI�6PDUW&KHFN���

)LJXUH������6FUHHQVKRW�RI�WKH�6PDUW&KHFN�GHEXJJLQJ�WRRO�

7R�LOOXVWUDWH�ZKDW�W\SH�RI�LQIRUPDWLRQ�6PDUW&KHFN�SURYLGHV�\RX�ZLWK�DQG�ZKDW�D�9%�VXEFODVVLQJ�DSSOLFDWLRQ�ORRNV�OLNH�RQ�WKH�LQVLGH��,�ZLOO�VWHS�WKURXJK�WKH�RXWSXW�RI�D�SUHYLRXV�H[DPSOH�DSSOLFDWLRQ��7KH�H[DPSOH�DSSOLFDWLRQ�,�ZLOO�H[DPLQH�LV�WKH�0LQLPL]H�EXWWRQ�VXEFODVVLQJ�H[DPSOH�RI�&KDSWHU����)LJXUH�����VKRZV�D�VFUHHQVKRW�RI�WKLV�DSSOLFDWLRQ���

)LJXUH������7KH�0LQLPL]H�VXEFODVVLQJ�H[DPSOH�DSSOLFDWLRQ�RI�&KDSWHU���

Page 264: Visual Basic - Subclassing and Hooking with VB & VB NET

,�ZLOO�UXQ�WKLV�DSSOLFDWLRQ�XQGHU�6PDUW&KHFN��VXEFODVV�WKH�0LQLPL]H�EXWWRQ��UHPRYH�WKH�VXEFODVVLQJ��DQG�WKHQ�VKXW�GRZQ�WKH�DSSOLFDWLRQ��%HIRUH�VKXWWLQJ�GRZQ�WKH�DSSOLFDWLRQ��,�ZLOO�XVH�6S\���WR�JHW�WKH�ZLQGRZ�KDQGOHV�RI�DOO�ZLQGRZV�EHORQJLQJ�WR�WKLV�DSSOLFDWLRQ��7KH�ZLQGRZV�DQG�WKHLU�KDQGOHV�DUH�OLVWHG�LQ�7DEOH������.QRZLQJ�WKLV�LQIRUPDWLRQ�DOORZV�XV�WR�GHWHUPLQH�RQ�ZKLFK�ZLQGRZ�WKH�DFWLRQ�LV�WDNLQJ�SODFH���

7DEOH������:LQGRZ�+DQGOHV�IRU�WKH�([DPSOH�$SSOLFDWLRQ��+ZQG� :LQGRZ�'HVFULSWLRQ�

+������� 7KXQGHU57�)RUP'&����WKH�RQO\�9%�IRUP�LQ�WKH�SURMHFW�+����$� 7KXQGHU57�(GLW����WKH�RQO\�WH[W�ER[�RQ�WKH�IRUP��+(����� 7KXQGHU57�&RPPDQG%XWWRQ����WKH�8Q�6XEFODVV�EXWWRQ�+%���&� 7KXQGHU57�&RPPDQG%XWWRQ����WKH�6XEFODVV�EXWWRQ�+������� 9%%XEEOH57��+�����$� 2OH0DLQ7KUHDG:QG1DPH�+������� 7KXQGHU57�0DLQ�+����(� 9%0VR6WG&RPS0JU�+����&� 9%)RFXV57��([DPLQLQJ�WKH�RXWSXW�IURP�6PDUW&KHFN�VKRZV�WKDW�RQH�RI�WKH�ILUVW�WKLQJV�9%�GRHV�LV�FUHDWH�WKH�7KXQGHU57�0DLQ�ZLQGRZ��7KLV�ZLQGRZ�RZQV�WKH�RWKHU�DSSOLFDWLRQ�ZLQGRZV��$IWHU�WKLV�ZLQGRZ�LV�GHVWUR\HG��WKH�DSSOLFDWLRQ�VKXWV�GRZQ�DQG�XQORDGV�LWVHOI�IURP�PHPRU\��$IWHU�WKLV�ZLQGRZ�LV�FUHDWHG��WKH�LQLWLDO�IRUP�LV�FUHDWHG�IURP�WKH�7KXQGHU57�)RUP'&�FODVV��7KLV�SURFHVV�LV�LOOXVWUDWHG�LQ�)LJXUH������LQ�ZKLFK�D�ZLQGRZSDQH�LFRQ�LQGLFDWHV�D�PHVVDJH�WKDW�KDV�EHHQ�KDQGOHG�E\�D�ZLQGRZ�SURFHGXUH��$�GLDPRQG�LFRQ�LQGLFDWHV�$3,�FDOOV��/LJKWQLQJ�EROW�LFRQV�LQGLFDWH�D�9%�HYHQW�EHLQJ�ILUHG��9%�SHUIRUPV�WKH�FDOO�WR�&UHDWH:LQGRZ([$��/LQH������WR�FUHDWH�WKH�7KXQGHU57�)RUP'&�ZLQGRZ�LQ�PHPRU\��<RX�FDQ�WHOO�WKDW�WKLV�FRGH�LV�H[HFXWLQJ�LQ�WKH�069%90���'//�PRGXOH�IURP�WKH�K,QVWDQFH�DUJXPHQW�WR�WKLV�IXQFWLRQ��WKLV�DUJXPHQW�DQG�VHYHUDO�RWKHUV�DUH�GLVSOD\HG�RII�WKH�HGJH�RI�WKH�VFUHHQ���,W�LV�����������ZKLFK�LV�WKH�VDPH�

Page 265: Visual Basic - Subclassing and Hooking with VB & VB NET

K,QVWDQFH�DV�WKLV�'//��<RX�FDQ�VHH�WKLV�XVLQJ�WKH�'HSHQGHQF\�:DONHU�WRRO�VXSSOLHG�ZLWK�9LVXDO�&�����

)LJXUH������6PDUW&KHFN�RXWSXW�IRU�FUHDWLQJ�D�9%�IRUP�

:KLOH�ZLWKLQ�WKH�&UHDWH:LQGRZ([$�IXQFWLRQ��ZH�FDQ�VHH�WKDW�VHYHUDO�PHVVDJHV�DUH�KDQGOHG�DQG�RWKHU�$3,�FDOOV�DUH�PDGH��)LUVW��WKH�:0B*(70,10$;,1)2�PHVVDJH�LV�VHQW�WR�WKH�QHZO\�FUHDWHG�ZLQGRZ��$W�WKLV�SRLQW��ZH�NQRZ�WKDW�WKH�ZLQGRZ�SURFHGXUH�IRU�WKLV�ZLQGRZ�ZDV�FUHDWHG�EHFDXVH�LW�LV�DFFHSWLQJ�WKLV�PHVVDJH��7KH�QH[W�PHVVDJH�WKDW�&UHDWH:LQGRZ([$�VHQGV�WR�WKLV�ZLQGRZ�SURFHGXUH�LV�WKH�:0B1&&5($7(�PHVVDJH��1RWLFH�WKDW�DIWHU�WKH�ZLQGRZ�SURFHGXUH�SURFHVVHV�WKLV�PHVVDJH��LW�SDVVHV�LW�RQ�WR�WKH�'HI:LQGRZ3URF$�IXQFWLRQ�IRU�GHIDXOW�SURFHVVLQJ��/LQH�������<RX�ZLOO�VHH�WKH�'HI:LQGRZ3URF$�IXQFWLRQ�FDOOHG�PDQ\�WLPHV�LQ�DQ�DSSOLFDWLRQ�EHFDXVH�LW�FRQWDLQV�WKH�GHIDXOW�IXQFWLRQDOLW\�IRU�DOO�ZLQGRZV���'HI:LQGRZ3URF$�UHWXUQV�D���IRU�WKH�:0B1&&5($7(�PHVVDJH��7KLV�DOORZV�ZLQGRZ�FUHDWLRQ�WR�FRQWLQXH��,I�D�]HUR�ZDV�UHWXUQHG��WKH�&UHDWH:LQGRZ([$�IXQFWLRQ�ZRXOG�KDYH�VWRSSHG�WKH�FUHDWLRQ�RI�WKLV�ZLQGRZ�DQG�UHWXUQHG�FRQWURO�WR�WKH�FDOOLQJ�SURFHGXUH���1H[W��WKLV�QHZ�ZLQGRZ�SURFHVVHV�WKH�:0B1&&$/&6,=(�PHVVDJH��/LQH�������IROORZHG�E\�WKH�:0B&5($7(�PHVVDJH��/LQH�������:KHQ�WKH�ZLQGRZ�SURFHGXUH�SURFHVVHV�WKH�:0B&5($7(�PHVVDJH��LW�FDOOV�WKH�*HW6\VWHP0HQX�DQG�6HW:LQGRZ&RQWH[W+HOS,G�IXQFWLRQV�EHIRUH�VHQGLQJ�WKH�PHVVDJH�RQ�WR�WKH�'HI:LQGRZ3URF$�IXQFWLRQ��/LQH�������7KH�*HW6\VWHP0HQX�IXQFWLRQ�PDNHV�D�FRS\�RI�WKH�V\VWHP�PHQX�WR�EH�XVHG�E\�WKLV�ZLQGRZ��7KH�6HW:LQGRZ&RQWH[W+HOS,G�IXQFWLRQ�UHWXUQV�DQ\�KHOS�FRQWH[W�,'�IRU�WKH�ZLQGRZ�VSHFLILHG�E\�WKH�KZQG�DUJXPHQW���$IWHU�WKH�'HI:LQGRZ3URF$�IXQFWLRQ�UHWXUQV�VXFFHVVIXOO\��WKH�&UHDWH:LQGRZ([$�IXQFWLRQ�UHWXUQV�H[HFXWLRQ�WR�LWV�FDOOLQJ�IXQFWLRQ��7KH�UHWXUQ�YDOXH�IRU�WKLV�IXQFWLRQ�LV�WKH�KDQGOH�RI�WKH�QHZO\�FUHDWHG�ZLQGRZ��/LQH��������)LJXUH�����VKRZV�KRZ�D�FDOO�FDQ�EH�QHVWHG�ZLWKLQ�DQRWKHU�IXQFWLRQ�FDOO��,Q�WKLV�VDPSOH�RXWSXW��WKH�PDLQ�ZLQGRZ�LV�EHLQJ�DFWLYDWHG��:H�NQRZ�LW�LV�WKH�PDLQ�ZLQGRZ�IURP�WKH�+:1'�DUJXPHQW�RI�WKH�:0B1&$&7,9$7(�PHVVDJH��/LQH�������7KLV�PHVVDJH�KDV�FRPSOHWHG�LWV�SURFHVVLQJ�LQ�WKH�ZLQGRZ�SURFHGXUH�DVVRFLDWHG�ZLWK�WKLV�+:1'��$�FDOO�LV�WKHQ�PDGH�WR�'HI:LQGRZ3URF$��/LQH�������:KLOH�ZLWKLQ�WKLV�IXQFWLRQ��WKH�:0B*(77(;7�PHVVDJH�LV�VHQW�WR�WKH�ZLQGRZ�SURFHGXUH�RI�WKH�PDLQ�ZLQGRZ�YLD�WKH�6HQG0HVVDJH�IXQFWLRQ��/LQH�������:H�NQRZ�WKDW�WKH�6HQG0HVVDJH�IXQFWLRQ�LV�XVHG�EHFDXVH�WKH�PHVVDJH�LV�LPPHGLDWHO\�SURFHVVHG��,I�WKH�PHVVDJH�ZHUH�SRVWHG��ZH�ZRXOG�VHH�LW�SURFHVVHG�ODWHU�RQ�E\�WKH�PHVVDJH�ORRS��,�ZLOO�GLVFXVV�WKH�PHVVDJH�ORRS�ODWHU�LQ�WKLV�FKDSWHU���

Page 266: Visual Basic - Subclassing and Hooking with VB & VB NET

)LJXUH������1HVWHG�IXQFWLRQ�FDOOV�

7KH�:0B1&$&7,9$7(�PHVVDJH�FKDQJHV�WKH�QRQFOLHQW�DUHD�RI�D�ZLQGRZ�WR�HLWKHU�DQ�DFWLYH�RU�LQDFWLYH�VWDWH��7KH�Z3DUDP�RI�WKLV�PHVVDJH�LV�VHW�WR�7UXH��WHOOLQJ�XV�WKDW�WKH�DFWLYH�WLWOH�EDU�QHHGV�WR�EH�UHGUDZQ��%HIRUH�UHGUDZLQJ�WKH�WLWOH�EDU��WKH�V\VWHP�QHHGV�WR�JHW�DQG�VWRUH�WKH�ZLQGRZ�FDSWLRQ�VR�WKDW�LW�FDQ�EH�UHSODFHG�DIWHU�WKH�QRQFOLHQW�DUHD�LV�UHGUDZQ��7R�GR�WKLV��WKH�'HI:LQGRZ3URF$�IXQFWLRQ�VHQGV�WKH�:0B*(77(;7�PHVVDJH�WR�UHWULHYH�WKH�ZLQGRZ�FDSWLRQ�RI�WKH�PDLQ�ZLQGRZ��/LQH�������'HI:LQGRZ3URF$�LV�FDOOHG�DJDLQ�IURP�ZLWKLQ�WKH�ZLQGRZ�SURFHGXUH�ZKLOH�LW�LV�SURFHVVLQJ�WKH�:0B*(77(;7�PHVVDJH��/LQH��������'HI:LQGRZ3URF$�LV�D�UHHQWUDQW�IXQFWLRQ��,Q�RWKHU�ZRUGV��EHIRUH�WKH�FRGH�LQ�WKLV�IXQFWLRQ�LV�ILQLVKHG�H[HFXWLQJ��LW�FRXOG�EH�FDOOHG�DJDLQ��7R�EH�UHHQWUDQW��WKH�IXQFWLRQ�QHHGV�WR�EH�DEOH�WR�VDYH�LWV�VWDWH��SURFHVV�WKH�QHVWHG�IXQFWLRQ�FDOO��DQG�WKHQ�UHVWRUH�LWV�VWDWH�DQG�FRQWLQXH�H[HFXWLQJ���$IWHU�WKH�LQQHU�'HI:LQGRZ3URF$�IXQFWLRQ�LV�ILQLVKHG��/LQH�������LW�UHWXUQV�FRQWURO�WR�WKH�RXWHU�'HI:LQGRZ3URF$�IXQFWLRQ��/LQH�������:KHQ�WKH�GHIDXOW�SURFHVVLQJ�LV�ILQLVKHG�IRU�WKH�:0B1&$&7,9$7(�PHVVDJH��WKH�RXWHU�'HI:LQGRZ3URF$�IXQFWLRQ�UHWXUQV��DQG�WKHQ�WKH�DSSOLFDWLRQ�SURFHHGV�WR�DFWLYDWH�LWV�FOLHQW�DUHD�E\�VHQGLQJ�WKH�:0B$&7,9$7(�PHVVDJH��/LQH��������7KH�QH[W�WKLQJ�,�ZDQW�WR�VKRZ�\RX�LV�WKH�9%�PHVVDJH�ORRS��7KH�9%�PHVVDJH�ORRS��ZKLFK�LV�VKRZQ�LQ�)LJXUH������LV�QRW�TXLWH�OLNH�WKH�PHVVDJH�ORRSV�,�KDYH�SUHYLRXVO\�VKRZQ�\RX��$V�\RX�FDQ�VHH�WKHUH�LV�QR�*HW0HVVDJH�IXQFWLRQ�LQ�WKLV�ORRS��,QVWHDG�3HHN0HVVDJH�LV�XVHG��/LQH��������7KLV�IXQFWLRQ�LV�GHILQHG�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�3HHN0HVVDJH�/LE��XVHU����$OLDV��3HHN0HVVDJH$��B�� � �OS0VJ�$V�06*��%\9DO�KZQG�$V�/RQJ��%\9DO�Z0VJ)LOWHU0LQ�$V�/RQJ��B�� � %\9DO�Z0VJ)LOWHU0D[�$V�/RQJ��%\9DO�Z5HPRYH0VJ�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��OS0VJ

$�ORQJ�SRLQWHU�WR�DQ�06*�VWUXFWXUH��KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�ZKRVH�PHVVDJHV�DUH�WR�EH�UHDG�IURP�WKH�TXHXH��,I�WKLV�LV�]HUR��DOO�PHVVDJHV�ZLOO�EH�UHDG���

Z0VJ)LOWHU0LQ

7KH�PLQLPXP�PHVVDJH�YDOXH�WKDW�LV�UHDG�IURP�WKH�PHVVDJH�TXHXH��Z0VJ)LOWHU0D[

7KH�PD[LPXP�PHVVDJH�YDOXH�WKDW�LV�UHWULHYHG�IURP�WKH�PHVVDJH�TXHXH��,I�WKLV�YDOXH�LV�]HUR��DOO�PHVVDJHV�VWDUWLQJ�ZLWK�WKH�Z0VJ)LOWHU0LQ�YDOXH�DUH�UHDG�IURP�WKH�PHVVDJH�TXHXH���

Page 267: Visual Basic - Subclassing and Hooking with VB & VB NET

Z5HPRYH0VJ

,I�WKLV�LV�VHW�WR����WKH�PHVVDJH�LV�UHDG�DQG�WKHQ�UHPRYHG�IURP�WKH�TXHXH��,I�WKLV�LV�VHW�WR����WKH�PHVVDJH�LV�UHDG�EXW�OHIW�RQ�WKH�TXHXH���

)LJXUH������7KH�9%�PHVVDJH�ORRS�

,I�WKHUH�DUH�QR�PHVVDJHV�RQ�WKH�TXHXH��WKH�UHWXUQ�YDOXH�IRU�WKLV�IXQFWLRQ�LV�]HUR��$�QRQ]HUR�UHWXUQ�YDOXH�PHDQV�WKDW�D�PHVVDJH�ZDV�UHDG�IURP�WKH�TXHXH���,I�ZH�ZHUH�WR�ZULWH�WKLV�PHVVDJH�ORRS�LQ�9%��LW�ZRXOG�ORRN�VRPHWKLQJ�OLNH�WKLV���6XE�0DLQ�9%0HVVDJH/RRS���������:KLOH�758(�������:KLOH�3HHN0HVVDJH�VWUXFW0VJ�����������������������,I�VWUXFW0VJ�PHVVDJH� �:0B48,7�7KHQ�������������([LW�)XQFWLRQ����������(OVH�������������,I�,V:LQGRZ�$QG�1RW�,V,FRQLF�����WKHQ����������������7UDQVODWH0HVVDJH��VWUXFW0VJ�����������������'LVSDWFK0HVVDJH��VWUXFW0VJ��������������(QG�,I����������(QG�,I�������/RRS��������,I�%DFNJURXQG3URFHVVLQJ5HDG\�����7KHQ����������'R%DFN*URXQG3URFHVVLQJ�������(OVH����������:DLW0HVVDJH�������(QG�,I����/RRS�(QG�6XE�3HHN0HVVDJH�LV�W\SLFDOO\�XVHG�LQ�PHVVDJH�ORRSV�IRU�DSSOLFDWLRQV�WKDW�QHHG�WR�GR�EDFNJURXQG�SURFHVVLQJ��%RWK�3HHN0HVVDJH�DQG�*HW0HVVDJH�RSHUDWH�LQ�D�VLPLODU�IDVKLRQ����WKDW�LV��XQWLO�WKHUH�DUH�QR�PRUH�PHVVDJHV�WR�EH�SURFHVVHG��:KHQ�WKHUH�DUH�QR�PRUH�PHVVDJHV�LQ�WKH�TXHXH��WKH�*HW0HVVDJH�IXQFWLRQ�ZLOO�QRW�UHWXUQ�FRQWURO�WR�WKH�DSSOLFDWLRQ�DQG�LQVWHDG�SODFHV�WKH�DSSOLFDWLRQ�LQ�D�VOHHS�VWDWH��:KLOH�DQ�DSSOLFDWLRQ�LV�VOHHSLQJ��LW�ZLOO�QRW�XVH�XS�&38�SURFHVVLQJ�F\FOHV��&RQYHUVHO\��WKH�3HHN0HVVDJH�IXQFWLRQ�ZLOO�UHWXUQ�FRQWURO�WR�WKH�

Page 268: Visual Basic - Subclassing and Hooking with VB & VB NET

DSSOLFDWLRQ��DQG�LW�ZLOO�QRW�SODFH�WKH�DSSOLFDWLRQ�LQ�D�VOHHS�VWDWH��,I�WKHUH�DUH�QR�PHVVDJHV�WR�EH�SURFHVVHG��WKLV�ORRS�ZLOO�HDW�XS�&38�SURFHVVLQJ�F\FOHV�WKDW�FRXOG�EH�XVHG�E\�RWKHU�DSSOLFDWLRQV��7R�VWRS�WKLV�IURP�KDSSHQLQJ��ZH�FDQ�FDOO�WKH�:DLW0HVVDJH�IXQFWLRQ��7KLV�IXQFWLRQ�WDNHV�QR�DUJXPHQWV�DQG�UHWXUQV�RQO\�ZKHQ�D�PHVVDJH�LV�SODFHG�LQ�WKH�PHVVDJH�TXHXH��7KH�UHWXUQ�YDOXH�RI�WKLV�IXQFWLRQ�LV�RI�W\SH�%RROHDQ��%\�SXWWLQJ�WKH�DSSOLFDWLRQ�WR�VOHHS�ZLWK�:DLW0HVVDJH��ZH�GR�QRW�WLH�XS�WKH�&38�ZLWK�QHHGOHVV�SURFHVVLQJ���:KHQ�XVLQJ�3HHN0HVVDJH�LQ�WKH�PHVVDJH�ORRS��ZH�DOVR�QHHG�WR�PDQXDOO\�FKHFN�IRU�WKH�:0B48,7�PHVVDJH��7KLV�PHVVDJHV�UHWXUQV�)DOVH�WR�ERWK�*HW0HVVDJH�DQG�3HHN0HVVDJH��*HW0HVVDJH�DOVR�ZLOO�UHWXUQ�WKLV�YDOXH�DQG�DXWRPDWLFDOO\�H[LW�WKH�PHVVDJH�ORRS��3HHN0HVVDJH�UHWXUQV�7UXH�ZKHQ�LW�SURFHVVHV�WKLV�PHVVDJH�DQG�WKH�PHVVDJH�ORRS�LV�QRW�H[LWHG��3HHN0HVVDJH�UHWXUQV�)DOVH�RQO\�ZKHQ�QR�PHVVDJHV�DUH�LQ�WKH�PHVVDJH�TXHXH���)LJXUH�����VKRZV�DQRWKHU�YLHZ�RI�WKH�9%�PHVVDJH�ORRS��RQO\�WKLV�WLPH�LW�LV�SURFHVVLQJ�D�:0B3$,17��+)��PHVVDJH�IRU�WKH�(GLW�FRQWURO��3HHN0HVVDJH�LQ�WKLV�ORRS�IRXQG�DQG�UHPRYHG�D�:0B3$,17�PHVVDJH�RQ�WKH�PHVVDJH�TXHXH��/LQH��������,V:LQGRZ�DQG�,V,FRQLF�DUH�FDOOHG�WR�GHWHUPLQH�LI�WKLV�LV�WKH�KDQGOH�WR�DQ�H[LVWLQJ�ZLQGRZ��DQG�LI�VR��LI�LW�LV�LQ�DQ�LFRQLF�VWDWH��/LQHV������DQG��������%HFDXVH�LW�LV�DQ�H[LVWLQJ�ZLQGRZ�DQG�WKLV�ZLQGRZ�LV�QRW�LFRQL]HG��H[HFXWLRQ�FRQWLQXHV�WR�WKH�7UDQVODWH0HVVDJH�IXQFWLRQ��/LQH��������7KLV�LV�QRW�D�NH\ERDUG�LQSXW�PHVVDJH��VR�WKLV�IXQFWLRQ�UHWXUQV�ZLWKRXW�KDQGOLQJ�WKH�PHVVDJH��([HFXWLRQ�FRQWLQXHV�RQ�WR�WKH�'LVSDWFK0HVVDJH�IXQFWLRQ��7KLV�IXQFWLRQ�VHQGV�WKH�PHVVDJH�WR�WKH�DSSURSULDWH�ZLQGRZ�SURFHGXUH��/LQH������RI�)LJXUH�����VKRZV�WKH�:0B3$,17�PHVVDJHV�EHLQJ�SURFHVVHG�E\�WKH�(GLW�FRQWURO��7KH�SURFHVVLQJ�RI�WKLV�PHVVDJH�E\�WKH�(GLW�FRQWUROV�ZLQGRZ�SURFHGXUH�FDXVHV�WKH�:0B&7/&2/25(',7�PHVVDJH�WR�EH�VHQW�WR�WKH�FRQWUROV�SDUHQW�ZLQGRZ��$IWHUZDUG��VHYHUDO�RWKHU�$3,�IXQFWLRQV�DUH�FDOOHG��HQDEOLQJ�WKH�:0B3$,17�PHVVDJH�WR�FRPSOHWH���

)LJXUH������3URFHVVLQJ�WKH�:0B3$,17�PHVVDJH�

1RZ�WKDW�ZH�KDYH�RXU�ZLQGRZ�FUHDWHG�DQG�RXU�PHVVDJH�ORRS�UXQQLQJ��ZH�FDQ�FOLFN�WKH�6XEFODVVLQJ�EXWWRQ��)LJXUH�����VKRZV�ZKDW�KDSSHQV�ZKHQ�WKH�XVHU�FOLFNV�WKLV�EXWWRQ����9%�ILUHV�WKH�B&OLFN�HYHQW��7KLV�B&OLFN�HYHQW�LV�LQ�UHVSRQVH�WR�WKH�'LVSDWFK0HVVDJH�IXQFWLRQ�VHQGLQJ�WKH�:0B/%8772183�PHVVDJH�WR�WKH�6XEFODVV�EXWWRQ��7KH�&OLFN�HYHQW�RI�WKH�6XEFODVV�EXWWRQ�FDOOV�D�IXQFWLRQ��ZKLFK�FDOOV�WKH�6HW:LQGRZ/RQJ3WU�IXQFWLRQ��7KLV�IXQFWLRQ�LV�

Page 269: Visual Basic - Subclassing and Hooking with VB & VB NET

PDSSHG�WR�WKH�6HW:LQGRZ/RQJ$�IXQFWLRQ�EHFDXVH�ZH�DUH�VWLOO�XVLQJ����ELW�:LQGRZV�WR�SHUIRUP�WKH�VXEFODVVLQJ���

)LJXUH������&OLFNLQJ�WKH�6XEFODVV�EXWWRQ�

)RU�9%�WR�FDOO�WKLV�$3,�IXQFWLRQ��LW�PXVW�XVH�DQ�LQWHUQDO�PHWKRG�FDOOHG�'OO)XQFWLRQ&DOO�WR�ORDG�WKH�8VHU���OLEUDU\�DQG�JHW�D�SRLQWHU�WR�WKH�6HW:LQGRZ/RQJ$�IXQFWLRQ�ZLWKLQ�WKLV�OLEUDU\��7KH�9%�'HFODUH�VWDWHPHQW�IRU�WKH�6HW:LQGRZ/RQJ3WU�IXQFWLRQ�SURYLGHV�WKH�LQIRUPDWLRQ�XVHG�E\�'OO)XQFWLRQ&DOO�WR�NQRZ�ZKLFK�IXQFWLRQ�LQ�ZKLFK�OLEUDU\�WR�XVH���$IWHU�LW�ILQGV�WKLV�IXQFWLRQ��9%�FDOOV�WKH�6HW:LQGRZ/RQJ$�IXQFWLRQ��/LQH��������7KH�QHZ�ZLQGRZ�SURFHGXUH�LV�SXW�LQ�SODFH��DQG�WKH�DGGUHVV�RI�WKH�ROG�SURFHGXUH�LV�UHWXUQHG��<RX�VKRXOG�PDNH�D�QRWH�RI�WKH�ROG�ZLQGRZ�SURFHGXUH�SRLQWHU�DQG�WKH�QHZ�RQH��7KLV�LQIRUPDWLRQ�LV�XVHIXO�ZKHQ�WKHUH�LV�D�SUREOHP�ZLWK�UHVWRULQJ�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��<RX�FDQ�VHDUFK�WKURXJK�WKH�6PDUW&KHFN�RXWSXW�WR�GHWHUPLQH�ZKHQ�WKH�ODVW�6HW:LQGRZ/RQJ$�IXQFWLRQ�ZDV�FDOOHG��&RPSDUH�WKH�ZLQGRZ�SURFHGXUH�SRLQWHU�WKDW�ZDV�VHW�KHUH�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�SRLQWHU��,I�WKH\�DUH�QRW�WKH�VDPH��\RX�KDYH�D�SUREOHP��<RX�ZLOO�QHHG�WR�GHWHUPLQH�ZK\�WKLV�KDSSHQHG��3HUKDSV�\RX�ORVW�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�SRLQWHU��RU�6HW:LQGRZ/RQJ$�ZDV�QRW�FDOOHG�WR�UHVWRUH�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�EHIRUH�WKH�DSSOLFDWLRQ�HQGHG���1H[W��9%�SHUIRUPV�VRPH�HUURU�FKHFNLQJ�DQG�WKHQ�UHWXUQV�IURP�WKH�B&OLFN�HYHQW���$W�WKLV�SRLQW��RXU�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LV�EHLQJ�FDOOHG��7R�NHHS�WKH�RXWSXW�RI�6PDUW&KHFN�UHODWLYHO\�VLPSOH��WKH�RQO\�FRGH�,�DGGHG�WR�WKLV�IXQFWLRQ�LV�&DOO:LQGRZ3URF��)LJXUH�����VKRZV�WKLV��7KH�PHVVDJH�ORRSV�3HHN0HVVDJH�IXQFWLRQ�JUDEV�D�:0B0286(029(�HYHQW�IURP�WKH�PHVVDJH�TXHXH��/LQH��������7KH�:0B0286(029(�PHVVDJH�LV�FRQWDLQHG�ZLWKLQ�WKH�375�DUJXPHQW�RI�WKH�3HHN0HVVDJH�IXQFWLRQ��6PDUW&KHFN�FDQ�GLVSOD\�WKH�YDOXH�RI�WKLV�SRLQWHU�DV�DQ�06*�VWUXFWXUH���

)LJXUH������,QVLGH�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�

Page 270: Visual Basic - Subclassing and Hooking with VB & VB NET

%HFDXVH�WKH�PRXVH�LV�PRYLQJ�DFURVV�WKH�6XEFODVV�EXWWRQ��KZQG�+%���&���WKH�:0B1&+,77(67��/LQH�������DQG�:0B6(7&85625��/LQH�������PHVVDJHV�DUH�VHQW�GLUHFWO\�WR�WKLV�ZLQGRZ��+RZHYHU��WKH�:0B6(7&85625�PHVVDJH�DOVR�LV�VHQW�WR�WKH�SDUHQW�ZLQGRZ�RI�WKH�6XEFODVV�EXWWRQ��/LQH��������7KH�SDUHQW�ZLQGRZ�LV�WKH�ZLQGRZ�WKDW�ZH�MXVW�VXEFODVVHG��%HFDXVH�WKLV�LV�WKH�ILUVW�WLPH�WKDW�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LV�FDOOHG��LW�ZLOO�XVH�WKH�'OO)XQFWLRQ&DOO�PHWKRG��/LQH�������WR�ORRN�XS�WKH�OLEUDU\�DQG�DGGUHVV�IRU�WKH�&DOO:LQGRZ3URF$�IXQFWLRQ���,PPHGLDWHO\�IROORZLQJ�WKH�'OO)XQFWLRQ&DOO�PHWKRG��WKH�VDPH�VXEFODVVHG�ZLQGRZ��FRPSDUH�/LQH������WR�/LQH�������SURFHVVHV�WKH�:0B6(7&85625�PHVVDJH�D�VHFRQG�WLPH��7KH�ILUVW�WLPH�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LV�SURFHVVLQJ�WKH�PHVVDJH��7KH�VHFRQG�WLPH�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�LV�SURFHVVLQJ�WKH�PHVVDJH��$IWHU�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�SURFHVVHV�WKLV�PHVVDJH��LW�SDVVHV�LW�DORQJ�WR�WKH�'HI:LQGRZ3URF$�IXQFWLRQ��/LQH���������7KLV�LV�WKH�XVXDO�RUGHU�RI�HYHQWV�LQ�WKH�VXEFODVV�ZLQGRZ�SURFHGXUH��,I�DQ\�HYHQW�GRHV�QRW�RFFXU��\RX�VKRXOG�H[DPLQH�WKH�SDUDPHWHUV�IRU�WKH�IXQFWLRQV��HVSHFLDOO\�'HI:LQGRZ3URF$�DQG�&DOO:LQGRZ3URF$��,I�WKH�LQFRUUHFW�K:QG�RU�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�LV�QRW�EHLQJ�SDVVHG�LQWR�WKHVH�IXQFWLRQV�FRUUHFWO\��SUREOHPV�ZLOO�RFFXU��$OVR��LI�WKHVH�IXQFWLRQV�DUH�QRW�FDOOHG��WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�ZLOO�QRW�SURFHVV�WKH�PHVVDJHV��7KLV�ZLOO�HIIHFWLYHO\�FDXVH�WKH�VXEFODVVHG�ZLQGRZ�WR�QRW�UHVSRQG�WR�WKRVH�PHVVDJHV�WKDW�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�GLG�QRW�SURFHVV���6RPHWLPHV��WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�LV�FDOOHG�DW�WKH�ZURQJ�WLPH��)RU�H[DPSOH��LI�&DOO:LQGRZ3URF$�RU�'HI:LQGRZ3URF$�LV�FDOOHG�DKHDG�RI�WKH�VXEFODVV�ZLQGRZ�SURFHGXUH��WKH�ZLQGRZ�ZLOO�SURFHVV�WKH�PHVVDJH�DV�LW�QRUPDOO\�ZRXOG��EHIRUH�WKH�VXEFODVV�ZLQGRZ�SURFHGXUH�JHWV�D�FKDQFH�WR�SURFHVV�LW��,I�WKH�VXEFODVV�ZLQGRZ�SURFHGXUH�PRGLILHV�DQ\�PHVVDJH�SDUDPHWHUV��WKH�SDUDPHWHUV�ZLOO�QHYHU�EH�SDVVHG�LQWR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��7R�IL[�WKLV�SUREOHP��\RX�QHHG�WR�SODFH�WKH�&DOO:LQGRZ3URF$�RU�'HI:LQGRZ3URF$�IXQFWLRQV�DW�WKH�HQG�RI�WKH�VXEFODVV�ZLQGRZ�SURFHGXUH���7KH�ODVW�OLQH�LV�WKH�'LVSDWFK0HVVDJH�IXQFWLRQ��7KLV�IXQFWLRQ�FDQ�QRZ�SURFHVV�WKH�RULJLQDO�PHVVDJH�WKDW�3HHN0HVVDJH�SXOOHG�IURP�WKH�TXHXH��ZKLFK�ZDV�WKH�:0B0286(029(�PHVVDJH�IRU�WKH�6XEFODVV�EXWWRQ���7KLV�RXWSXW�FDQ�EH�XVHIXO�LQ�GHWHUPLQLQJ�WKH�W\SHV�RI�PHVVDJHV�WKDW�WKH�ZLQGRZ�SURFHGXUH�LV�SURFHVVLQJ�DQG�WKH�RUGHU�LQ�ZKLFK�WKH\�DUH�SURFHVVHG��,I�\RXU�DSSOLFDWLRQ�GLVSOD\V�RGG�

Page 271: Visual Basic - Subclassing and Hooking with VB & VB NET

EHKDYLRU��\RX�FDQ�GHWHUPLQH�WKH�PHVVDJH�RU�PHVVDJHV�WKDW�DUH�EHLQJ�SURFHVVHG�E\�WKH�ZLQGRZ�SURFHGXUH�GXULQJ�WKH�RGG�EHKDYLRU��$V�,�SUHYLRXVO\�PHQWLRQHG��VRPH�PHVVDJHV��DV�WKH\�DUH�SURFHVVHG��FDQ�SURGXFH�RWKHU�PHVVDJHV��7KHVH�QHZ�PHVVDJHV�FDQ�FDXVH�WKH�RGG�EHKDYLRU���,W�LV�HYHQ�SRVVLEOH�WR�JHW�VWXFN�LQ�DQ�LQILQLWH�ORRS�ZLWKLQ�WKH�ZLQGRZ�SURFHGXUH��7KLV�SUREOHP�ZLOO�PRVW�OLNHO\�FDXVH�D�VWDFN�RYHUIORZ�H[FHSWLRQ�LQ�\RXU�DSSOLFDWLRQ�DQG�VKXW�LW�GRZQ��3UREOHPV�VXFK�DV�WKHVH�FDQ�EH�WUDFNHG�GRZQ�IDLUO\�HDVLO\�XVLQJ�6PDUW&KHFN���,Q�WKH�QH[W�VHFWLRQ�RI�GHEXJJHU�RXWSXW��,�FOLFN�WKH�8Q�6XEFODVV�EXWWRQ��7KH�UHVXOW�LV�WKH�RXWSXW�VKRZQ�LQ�)LJXUH������7KH�3HHN0HVVDJH�IXQFWLRQ��QRW�VKRZQ��SXOOV�WKH�:0B/%8772183�PHVVDJH�IURP�WKH�TXHXH�DQG�SDVVHV�LW�WR�'LVSDWFK0HVVDJH��/LQH��������7KLV�PHVVDJH�LV�LQ�UHVSRQVH�WR�WKH�XVHU�FOLFNLQJ�DQG�UHOHDVLQJ�WKH�OHIW�PRXVH�EXWWRQ�ZKLOH�RYHU�WKH�8Q�6XEFODVV�EXWWRQ��7KH�'LVSDWFK0HVVDJH�IXQFWLRQ�WKHQ�VHQGV�WKH�:0B/%8772183�PHVVDJH�WR�WKH�ZLQGRZ�SURFHGXUH�RI�WKH�8Q�6XEFODVV�EXWWRQ��7KLV�FDXVHV�D�FKDLQ�RI�HYHQWV�WR�RFFXU��ZKLFK�HQGV�XS�ZLWK�WKH�B&OLFN�HYHQW�EHLQJ�UDLVHG�IRU�WKLV�EXWWRQ�FRQWURO��/LQH��������7KH�FRGH�LQ�WKLV�HYHQW�VLPSO\�FDOOV�WKH�6HW:LQGRZ/RQJ3WU�IXQFWLRQ�WR�UHPRYH�WKH�VXEFODVVLQJ��/LQH���������

)LJXUH������&OLFN�WKH�8Q�6XEFODVV�EXWWRQ�

$W�WKLV�SRLQW��\RX�VKRXOG�FRPSDUH�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�SRLQWHU�WKDW�ZDV�UHSODFHG�ZLWK�WKH�ZLQGRZ�SURFHGXUH�SRLQWHU�WKDW�ZDV�VHW�XVLQJ�6HW:LQGRZ/RQJ3WU��,I�WKH\�PDWFK��HYHU\WKLQJ�LV�ILQH��RWKHUZLVH��\RX�QHHG�WR�WUDFN�GRZQ�ZK\�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�SRLQWHU�ZDV�QRW�UHVWRUHG���1RWLFH�WKDW�HYHU\�WLPH�D�PHVVDJH�LV�VHQW�WR�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH��LW�LV�OLVWHG�WZLFH�LQ�WKH�GHEXJJHU�RXWSXW��7KH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�SURFHVVHV�WKH�ILUVW�PHVVDJH��DQG�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�SURFHVVHV�WKH�VHFRQG�PHVVDJH��<RX�FDQ�VHH�WKLV�RQ�/LQHV�������������������DQG��������

Page 272: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�ILQDO�SURFHVVLQJ�WKDW�,�ZDQW�WR�H[DPLQH�LV�WKH�GHVWUXFWLRQ�RI�D�ZLQGRZ��$V�)LJXUH������VKRZV��ZKHQ�WKH�&ORVH�EXWWRQ�RQ�WKH�PDLQ�IRUP�LV�FOLFNHG��DOO�ZLQGRZV�LQ�WKH�DSSOLFDWLRQ�DUH�GHVWUR\HG�DQG�WKH�DSSOLFDWLRQ�LWVHOI�LV�VKXW�GRZQ���

)LJXUH�������6KXWWLQJ�GRZQ�WKH�DSSOLFDWLRQ�YLD�WKH�ZLQGRZV�&ORVH�EXWWRQ�

)LJXUH������GHWDLOV�WKH�PHVVDJH�ORRS�KDQGOLQJ�WKH�PHVVDJHV�JHQHUDWHG�ZKHQ�WKH�XVHU�FOLFNV�WKH�&ORVH�EXWWRQ�RQ�WKH�PDLQ�IRUP��$Q\�PRXVH�DFWLRQ�LQ�WKH�QRQFOLHQW�DUHD�RI�D�ZLQGRZ�ZLOO�ILUVW�FDXVH�WKH�:0B1&+,77(67�PHVVDJH�WR�EH�VHQW�WR�WKDW�ZLQGRZV�ZLQGRZ�SURFHGXUH��7KH�ZLQGRZ�KDQGOHV�WKLV�PHVVDJH��/LQH�������DQG�WKHQ�SDVVHV�LW�RQ�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH��/LQH��������7KH�GHIDXOW�ZLQGRZ�SURFHGXUH�UHWXUQV�D�YDOXH�RI�+����ZKLFK�LV�WKH�+7&/26(�FRGH�LQGLFDWLQJ�WKDW�WKH�ZLQGRZV�&ORVH�EXWWRQ�ZDV�FOLFNHG���:LQGRZV�ZLOO�LPPHGLDWHO\�VHQG�WKH�:0B6(7&85625�PHVVDJH�WR�WKDW�ZLQGRZ�WR�GHWHUPLQH�LI�WKH�PRXVH�FXUVRU�QHHGV�WR�EH�PRGLILHG�DQG��LI�VR��PRGLILHV�WKH�FXUVRU���%HFDXVH�WKH�OHIW�PRXVH�EXWWRQ�ZDV�FOLFNHG�RYHU�WKH�&ORVH�EXWWRQ�RI�WKH�ZLQGRZ��WKH�V\VWHP�SRVWV�WKH�:0B1&/%87721'2:1�PHVVDJH�WR�WKDW�ZLQGRZ��ZLWK�WKH�+7&/26(�FRGH�LQ�WKH�Z3DUDP�RI�WKLV�PHVVDJH��/LQH��������:KHQ�WKLV�PHVVDJH�LV�VHQW�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH��/LQH��������LW�VHWV�RII�WKH�IROORZLQJ�VHULHV�RI�HYHQWV���

��� /LQH�������7KLV�ZLQGRZ�LV�QRWLILHG�WKDW�LW�LV�ORVLQJ�WKH�PRXVH�FDSWXUH�ZLQGRZ�WKURXJK�WKH�:0B&$3785(&+$1*('�PHVVDJH��7KH�PRXVH�FDSWXUH�ZLQGRZ�LV�WKH�DFWLYH�ZLQGRZ�WKDW�UHFHLYHV�PRXVH�PHVVDJHV���

��� /LQH�������7KH�:0B6<6&200$1'�PHVVDJH�LV�VHQW�WR�WKH�ZLQGRZ�ZLWK�WKH�6&B&/26(�FRGH�LQ�WKH�Z3DUDP�RI�WKLV�PHVVDJH���

Page 273: Visual Basic - Subclassing and Hooking with VB & VB NET

��� /LQH�������7KH�B4XHU\8QORDG�HYHQW�LV�UDLVHG��7KLV�HTXDWHV�WR�WKH�IRUPV�)RUP�B4XHU\8QORDG�HYHQW���

��� /LQH�������7KH�(GLW�FRQWURO�RQ�WKH�IRUP�LV�GHVWUR\HG����� /LQH�������7KH�8Q�6XEFODVV�EXWWRQ�RQ�WKH�IRUP�LV�GHVWUR\HG����� /LQH�������7KH�6XEFODVV�EXWWRQ�RQ�WKH�IRUP�LV�GHVWUR\HG����� 7KH�PDLQ�IRUP�LV�GHVWUR\HG��/LQH������RI�)LJXUH������VKRZV�WKLV���

$OWKRXJK�WKH�PDLQ�IRUP�DQG�DOO�LWV�FRQWUROV�ZHUH�GHVWUR\HG��WKH�9%�DSSOLFDWLRQ�VWLOO�UHPDLQV�LQ�PHPRU\��7KLV�LV�EHFDXVH�QRW�DOO�RI�WKH�DSSOLFDWLRQV�ZLQGRZV�ZHUH�GHVWUR\HG��9%�FRQWLQXHV�LWV�VKXWGRZQ�SURFHVV�E\�GHVWUR\LQJ�WKH�ZLQGRZV�FUHDWHG�IURP�WKH�9%%XEEOH57��FODVV��WKH�2OH0DLQ7KUHDG:QG1DPH�FODVV��WKH�9%0VR6WG&RPS0JU�FODVV��WKH�9%)RFXV57��FODVV��DQG�WKH�7KXQGHU57�0DLQ�FODVV��:KHQ�WKHVH�ZLQGRZV�KDYH�EHHQ�GHVWUR\HG��WKH�DSSOLFDWLRQ�FDQ�FRPSOHWHO\�UHPRYH�LWVHOI�IURP�PHPRU\���)LJXUH������GHWDLOV�WKH�'HVWUR\:LQGRZ�IXQFWLRQ�IRU�WKH�PDLQ�IRUP��ZKLFK�LV�FDOOHG�LQ�UHVSRQVH�WR�WKH�XVHU�FOLFNLQJ�WKH�ZLQGRZV�&ORVH�EXWWRQ��7KH�'HVWUR\:LQGRZ�IXQFWLRQ�LPPHGLDWHO\�FDXVHV�WKH�:0B'(6752<�PHVVDJH�WR�EH�VHQW�WR�WKH�ZLQGRZ�EHLQJ�FORVHG��/LQH��������7KLV�PHVVDJH�FDOOV�WKH�6HQG0HVVDJH$��/LQH��������,V:LQGRZ9LVLEOH��/LQH��������DQG�6HOHFW2EMHFW��/LQH�������IXQFWLRQV���

)LJXUH�������7KH�GHVWUXFWLRQ�RI�WKH�9%�IRUP�

1RWLFH�WKH�6HQG0HVVDJH$�IXQFWLRQ��/LQH��������LW�VHQGV�WKH�:0B6(7,&21�PHVVDJH�GLUHFWO\�WR�WKH�ZLQGRZ�SURFHGXUH��ZKLFK�SURFHVVHV�LW�DQG�SDVVHV�LW�RQ�WR�'HI:LQGRZ3URF��2QO\�DIWHU�WKLV�SURFHVVLQJ�LV�ILQLVKHG�GRHV�WKH�6HQG0HVVDJH$�IXQFWLRQ�UHWXUQ��7KLV�LV�KRZ�WKH�6HQG0HVVDJH�IXQFWLRQ�RSHUDWHV���$IWHU�WKH�GHIDXOW�SURFHVVLQJ�LV�ILQLVKHG�IRU�WKH�:0B'(6752<�PHVVDJH��WKH�:0B1&'(6752<�PHVVDJH�LV�VHQW�WR�WKH�ZLQGRZ��/LQH��������7KLV�PHVVDJH�XVHV�6HOHFW2EMHFW�WR�UHVWRUH�DOO�*',�REMHFWV�WR�WKHLU�RULJLQDO�VWDWH��DQG�WKHQ�LW�XVHV�'HOHWH2EMHFW�WR�UHPRYH�DQ\�REMHFWV�FUHDWHG�E\�9%�IURP�PHPRU\��)LQDOO\��5HOHDVH'&�IUHHV�XS�WKH�GHYLFH�FRQWH[W�PHPRU\�IRU�WKH�ZLQGRZ��7KH�PHVVDJH�LV�WKHQ�VHQW�WR�'HI:LQGRZ3URF��/LQH�������IRU�GHIDXOW�SURFHVVLQJ��DQG�WKHQ�WKH�'HVWUR\:LQGRZ�IXQFWLRQ�FDQ�UHWXUQ��/LQH���������

Page 274: Visual Basic - Subclassing and Hooking with VB & VB NET
Page 275: Visual Basic - Subclassing and Hooking with VB & VB NET

3DUW�,,,��+RRNLQJ�7KLV�VHFWLRQ�GHYRWHV�LQGLYLGXDO�FKDSWHUV�WR�WKH�IROORZLQJ�KRRNV���

WH_CALLWNDPROC

,QWHUFHSWV�PHVVDJHV�VHQW�XVLQJ�WKH�6HQG0HVVVDJH�$3,�IXQFWLRQ��WH_CALLWNDPROCRET

,QWHUFHSWV�PHVVDJHV�DIWHU�WKH\�KDYH�EHHQ�SURFHVVHG�E\�WKHLU�ZLQGRZ�SURFHGXUH��WH_CBT

8VHG�WR�FUHDWH�&RPSXWHU�%DVHG�7UDLQLQJ��&%7��DSSOLFDWLRQV�WH_DEBUG

,QWHUFHSWV�FDOOV�WR�DQ�LQVWDOOHG�KRRNV�ILOWHU�IXQFWLRQ�WH_FOREGROUNDIDLE

&DOOHG�ZKHQ�DQ�DSSOLFDWLRQ�LV�DERXW�WR�HQWHU�DQ�LGOH�VWDWH�WH_GETMESSAGE

,QWHUFHSWV�SRVWHG��DQG�QRW�VHQW��PHVVDJHV�WH_JOURNALPLAYBACK

3RVWV�SUHUHFRUGHG�PHVVDJHV�WR�WKH�UDZ�LQSXW�WKUHDGV�PHVVDJH�TXHXH�VR�WKDW�WKH\�PD\�EH�SURFHVVHG���SOD\HG�EDFN���E\�WKH�V\VWHP���WH_JOURNALRECORD

,QWHUFHSW�PRXVH��NH\ERDUG��DQG�RWKHU�KDUGZDUH�PHVVDJHV�UHFHLYHG�E\�WKH�V\VWHP��WH_KEYBOARD and WH_KEYBOARD_LL

,QWHUFHSWV�NH\ERDUG�PHVVDJHV�WH_MOUSE and WH_MOUSE_LL

,QWHUFHSW�PRXVH�PHVVDJHV�WH_MSGFILTER

,QWHUFHSWV�VHQW�PHVVDJHV�SURGXFHG�E\�PHQXV��GLDORJ�ER[HV��PHVVDJH�ER[HV��DQG�VFUROO�EDUV��WH_SYSMSGFILTER

,QWHUFHSWV�VHQW�PHVVDJHV�SURGXFHG�E\�PHQXV��GLDORJ�ER[HV��PHVVDJH�ER[HV��DQG�VFUROO�EDUV�RQ�D�V\VWHP�ZLGH�EDVLV��WH_SHELL

,QWHUFHSWV�PHVVDJHV�WKDW�QRWLI\�DQ�DSSOLFDWLRQ�RI�DFWLRQV�RFFXUULQJ�WR�LW�HLWKHU�WKURXJK�XVHU�LQWHUYHQWLRQ�RU�WKURXJK�D�FKDQJH�LQ�WKH�V\VWHPV�VWDWH��

(DFK�FKDSWHU�ZLOO�GLVFXVV�D�KRRN�LQ�GHWDLO��7KH�FKDSWHUV�ZLOO�EHJLQ�E\�GLVFXVVLQJ�WKH�KRRN�DQG�SURYLGLQJ�UHOHYDQW�EDFNJURXQG�LQIRUPDWLRQ��,�ZLOO�XVH�

Page 276: Visual Basic - Subclassing and Hooking with VB & VB NET

H[DPSOHV�WR�DLG�LQ�WKHVH�GLVFXVVLRQV��(DFK�FKDSWHU�ZLOO�HQG�ZLWK�D�GLVFXVVLRQ�RI�WKH�SUREOHPV�WR�ZDWFK�IRU�ZKLOH�XVLQJ�WKH�KRRN���

Page 277: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU����:+B&$//:1'352&�7KH�:+B&$//:1'352&�KRRN�LQWHUFHSWV�PHVVDJHV�WKDW�\RX�VHQG�WKURXJK�WKH�6HQG0HVVDJH�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IXQFWLRQ��7KLV�KRRN�FDQ�YLHZ�PHVVDJHV��EXW�LW�FDQQRW�PRGLI\�RU�GLVFDUG�WKHP��1RUPDOO\��ILOWHU�IXQFWLRQV�GLVFDUG�PHVVDJHV�E\�QRW�FDOOLQJ�WKH�&DOO1H[W+RRN([�IXQFWLRQ�DQG�UHWXUQLQJ�D�]HUR��%XW�LQ�WKH�FDVH�RI�WKH�:+B&$//:1'352&�KRRN��DIWHU�WKH�ILOWHU�IXQFWLRQ�LV�ILQLVKHG�SURFHVVLQJ�WKH�PHVVDJH��LW�UHWXUQV�FRQWURO�WR�WKH�6HQG0HVVDJH�IXQFWLRQ��ZKLFK�WKHQ�SURFHHGV�WR�VHQG�WKH�PHVVDJH��)RU�WKLV�UHDVRQ��LW�LV�QRW�SRVVLEOH�WR�GLVFDUG�WKH�VHQW�PHVVDJH���

����+RZ�:+B&$//:1'352&�:RUNV�

<RX�DOVR�FDQ�XVH�WKLV�KRRN�WR�ZDWFK�IRU�DQ\�PHVVDJHV�VHQW�WR�D�ZLQGRZ��)RU�LQVWDQFH��WKH�6S\���XWLOLW\�XVHV�WKLV�KRRN�ZKHQ�LW�ZDWFKHV�IRU�VHQW�PHVVDJHV��7KLV�KRRN�LV�DOVR�XVHIXO�LI�\RX�QHHG�WR�SHUIRUP�DQ�DFWLRQ�ZKHQ�D�VSHFLILF�PHVVDJH�LV�VHQW�WR�RQH�RU�PRUH�ZLQGRZV��)RU�H[DPSOH��RQH�DSSOLFDWLRQ�FRXOG�EURDGFDVW�D�XVHU�GHILQHG�PHVVDJH��7KLV�PHVVDJH�ZRXOG�WKHQ�EH�SLFNHG�XS�DQG�DFWHG�XSRQ�E\�HYHU\�RWKHU�DSSOLFDWLRQ�WKDW�ZDV�XVLQJ�WKLV�KRRN�WR�ZDWFK�IRU�WKDW�SDUWLFXODU�PHVVDJH���<RX�FDQ�XVH�WKLV�KRRN�DV�D�WKUHDG�VSHFLILF�KRRN��RU�\RX�FDQ�SODFH�LW�LQ�D�G\QDPLF�OLQN�OLEUDU\��'//��DQG�XVH�LW�DV�D�V\VWHP�ZLGH�KRRN��$�WKUHDG�VSHFLILF�KRRN�LQWHUFHSWV�DOO�PHVVDJHV�ZLWKLQ�WKH�WKUHDG�LQ�ZKLFK�LW�LV�LQVWDOOHG��:KHQ�D�KRRN�LV�LQVWDOOHG�DV�D�V\VWHP�ZLGH�KRRN��LW�KDV�WR�EH�SODFHG�LQ�D�'//��7KLV�'//�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�VR�WKDW�WKH�KRRN�FDQ�RSHUDWH�RQ�DOO�PHVVDJHV�LQ�WKH�V\VWHP��&KDSWHU���SURYLGHV�D�WKRURXJK�GLVFXVVLRQ�RI�WKLV�WHFKQLTXH���0HVVDJHV�VHQW�WR�ZLQGRZV�WKURXJK�WKH�6HQG0HVVDJH�IXQFWLRQ�DUH�VHQW�GLUHFWO\�WR�WKH�ZLQGRZ�SURFHGXUH��E\SDVVLQJ�ERWK�WKH�V\VWHP�DQG�WKUHDG�PHVVDJH�TXHXHV��7KH\�GR�QRW�JR�WKURXJK�WKH�PHVVDJH�TXHXH��DV�D�SRVWHG�PHVVDJH�GRHV��$V�D�UHVXOW��WKHVH�W\SHV�RI�PHVVDJHV�DUH�SURFHVVHG�EHIRUH�SRVWHG�PHVVDJHV�DUH��7KH�IROORZLQJ�VKRZV�WKH�RUGHU�LQ�ZKLFK�D�PHVVDJH�ORRS�SURFHVVHV�PHVVDJHV���

��� 6HQW�PHVVDJHV���� 3RVWHG�PHVVDJHV���� ,QSXW�PHVVDJHV�IURP�KDUGZDUH�DQG�LQWHUQDO�V\VWHP�HYHQWV���� 6HQW�PHVVDJHV��D�VHFRQG�WLPH����� :0B3$,17�PHVVDJHV���� :0B7,0(5�PHVVDJHV��

Page 278: Visual Basic - Subclassing and Hooking with VB & VB NET

$V�\RX�FDQ�VHH��VHQW�PHVVDJHV�DUH�SURFHVVHG�QRW�RQO\�ILUVW��EXW�DOVR�IRXUWK��$�VHQW�PHVVDJH�LV�SURFHVVHG�EHIRUH�DQ\�RWKHU�PHVVDJHV�WR�PDNH�VXUH�WKDW�WKH�VHQW�PHVVDJH�GRHV�QRW�KDYH�WR�ZDLW�IRU�WKH�V\VWHP�WR�SURFHVV�DQ\�RWKHU�W\SH�RI�PHVVDJHV�EHIRUH�SURFHVVLQJ�WKH�QH[W�VHQW�PHVVDJH��6HQW�PHVVDJHV�DUH�V\QFKURQRXV��WKHUHIRUH�UHTXLULQJ�WKH�FDOOHG�ZLQGRZ�WR�UHWXUQ�FRQWURO�EHIRUH�WKH�FDOOHU�VHQGLQJ�WKH�PHVVDJH�FDQ�FRQWLQXH��,I�RWKHU�PHVVDJHV��VXFK�DV�:0B3$,17�PHVVDJHV��WDNH�D�JUHDW�GHDO�RI�WLPH�WR�SURFHVV��WKH�IXQFWLRQ�WKDW�VHQW�WKH�PHVVDJH�FDQQRW�FRQWLQXH�SURFHVVLQJ��DW�OHDVW�QRW�LQ�D�WLPHO\�PDQQHU���1H[W��SRVWHG�PHVVDJHV�DUH�SURFHVVHG�EHFDXVH�WKH\�DUH�XVXDOO\�FULWLFDO�WR�WKH�DSSOLFDWLRQV�RSHUDWLRQ��3RVWHG�PHVVDJH�LQFOXGH�PHVVDJHV�DERXW�PRXVH�PRYHPHQW��PRXVH�EXWWRQ�FOLFNV��DQG�NH\ERDUG�HYHQWV���,QSXW�PHVVDJHV�IURP�KDUGZDUH�DQG�LQWHUQDO�V\VWHP�HYHQWV�LQFOXGH�PHVVDJHV�SRVWHG�IURP�RWKHU�KDUGZDUH�DWWDFKHG�WR�WKH�V\VWHP�DQG�IURP�HYHQWV�VXFK�DV�ORZ�EDWWHU\�SRZHU�RQ�D�ODSWRS���6HQW�PHVVDJHV�DUH�SURFHVVHG�D�VHFRQG�WLPH�WR�PDNH�VXUH�WKH\�DUH�SURFHVVHG�EHIRUH�WKH�:0B3$,17�DQG�:0B7,0(5�PHVVDJHV��7KLV�LV�EHFDXVH�WKHVH�WZR�PHVVDJHV�KDYH�D�ORZHU�SULRULW\��DQG�WKH�:0B3$,17�PHVVDJH�WDNHV�FRQVLGHUDEOH�WLPH�WR�SURFHVV���:KHQ�WKH�:+B&$//:1'352&�KRRN�LV�LQVWDOOHG�RQ�D�:LQGRZV��[�RU�17������V\VWHP��WKH�KRRNV�ILOWHU�IXQFWLRQ�LV�FDOOHG�ZKHQ�WKH�6HQG0HVVDJH�IXQFWLRQ�LV�FDOOHG��+RZHYHU��RQ�17�����DQG�:LQGRZV������V\VWHPV��WKH�ILOWHU�IXQFWLRQ�LV�FDOOHG�LPPHGLDWHO\�EHIRUH�WKH�ZLQGRZ�SURFHGXUH�KDQGOHV�WKH�VHQW�PHVVDJH��(VVHQWLDOO\��RQ�D��[�RU�17������V\VWHP��WKH�KRRN�LV�FDOOHG�IURP�ZLWKLQ�WKH�FRQWH[W�RI�WKH�WKUHDG�WKDW�FDOOHG�6HQG0HVVDJH��+RZHYHU��RQ�DQ�17����������V\VWHP��WKH�KRRNV�ILOWHU�IXQFWLRQ�LV�FDOOHG�ZLWKLQ�WKH�FRQWH[W�RI�WKH�WKUHDG�WKDW�FRQWDLQV�WKH�WDUJHW�ZLQGRZ��7KLV�GLIIHUHQFH�GRHV�QRW�PDWWHU�ZKHQ�\RX�XVH�WKLV�KRRN�LQ�D�9LVXDO�%DVLF��9%��DSSOLFDWLRQ�ZLWK�D�WKUHDG�VSHFLILF�VFRSH��7KLV�LV�EHFDXVH�WKH�ILOWHU�IXQFWLRQ�LV�DOZD\V�FDOOHG�IURP�ZLWKLQ�WKH�FRQWH[W�RI�WKH�VDPH�WKUHDG��+RZHYHU��WKLV�LV�QRW�WKH�FDVH�ZKHQ�PXOWLSOH�WKUHDGV�DUH�FUHDWHG�IURP�ZLWKLQ�D�9%�DSSOLFDWLRQ��RU�ZKHQ�PHVVDJHV�DUH�EHLQJ�VHQW�EHWZHHQ�SURFHVVHV��1RZ�WKH�ILOWHU�IXQFWLRQ�FDQ�EH�FDOOHG�IURP�ZLWKLQ�GLIIHUHQW�WKUHDGV��GHSHQGLQJ�RQ�WKH�RSHUDWLQJ�V\VWHP�XVHG��7KLV�PLJKW�FDXVH�SUREOHPV�LI�\RX�DUH�XVLQJ�WKH�KRRN�LQ�D�KHWHURJHQHRXV�HQYLURQPHQW���7R�DLG�LQ�GHWHUPLQLQJ�WKH�VRXUFH�RI�WKH�VHQW�PHVVDJH��WKLV�KRRN�VHWV�WKH�Z3DUDP�SDUDPHWHU�LQ�LWV�ILOWHU�IXQFWLRQ�WR�D�]HUR�RU�QRQ]HUR�YDOXH��$�QRQ]HUR�YDOXH�PHDQV�WKDW�WKH�PHVVDJH�ZDV�VHQW�IURP�ZLWKLQ�WKH�VDPH�WKUHDG�WKDW�LV�KDQGOLQJ�WKH�PHVVDJH��$�]HUR�YDOXH�PHDQV�WKDW�WKH�PHVVDJH�ZDV�VHQW�IURP�DQRWKHU�WKUHDG��'LVWLQJXLVKLQJ�WKH�VRXUFH�RI�WKH�VHQW�PHVVDJH�DOORZV�\RX�WR�KDQGOH�LW�LQ�DQ�DSSURSULDWH�ZD\��7KLV�LV�XVHIXO�ZKHQ�\RX�XVH�D�V\VWHP�ZLGH�:+B&$//:1'352&�KRRN��,Q�WKLV�FDVH��\RXU�'//�FRQWDLQLQJ�WKH�ILOWHU�IXQFWLRQ�LV�LQMHFWHG�LQWR�DOO�UXQQLQJ�SURFHVVHV��8VLQJ�WKH�Z3DUDP�SDUDPHWHU��\RXU�FRGH�FDQ�GHWHUPLQH�ZKHUH�WKH�PHVVDJH�RULJLQDWHG���:KHQ�XVLQJ�WKLV�KRRN��\RX�VKRXOG�EH�DZDUH�RI�WKH�GLIIHUHQW�PHWKRGV�RI�VHQGLQJ�PHVVDJHV��<RX�FDQ�VHQG�D�PHVVDJH�XVLQJ�DQ\�RQH�RI�VL[�$3,�IXQFWLRQV��6HQG0HVVDJH��6HQG0HVVDJH7LPHRXW��6HQG1RWLI\0HVVDJH��6HQG0HVVDJH&DOOEDFN��6HQG'OJ,WHP0HVVDJH��

Page 279: Visual Basic - Subclassing and Hooking with VB & VB NET

DQG�%URDGFDVW6\VWHP0HVVDJH��7KHVH�IXQFWLRQV�GR�QRW�SRVW�PHVVDJHV�WR�D�WKUHDGV�PHVVDJH�TXHXH��LQVWHDG��WKH\�VHQG�WKH�PHVVDJH�GLUHFWO\�WR�WKH�ZLQGRZ�SURFHGXUH�RU�SURFHGXUHV��7KH�PDLQ�GLIIHUHQFH�EHWZHHQ�WKHVH�IXQFWLRQV�LV�WKH�ZD\�FRQWURO�LV�UHWXUQHG�EDFN�WR�WKH�IXQFWLRQ�WKDW�FDOOHG�6HQG0HVVDJH�DQG�ZKHWKHU�WKH�PHVVDJH�LV�VHQW�WR�RQH�RU�PRUH�ZLQGRZV��7KH�ILUVW�RI�WKHVH�IXQFWLRQV�LV�6HQG0HVVDJH��ZKLFK�KDV�WKH�IROORZLQJ�V\QWD[�LQ�9%���3XEOLF�'HFODUH�)XQFWLRQ�6HQG0HVVDJH�/LE��XVHU����$OLDV��6HQG0HVVDJH$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Z0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��O3DUDP�$V�$Q\��$V�/RQJ�,WV�SDUDPHWHUV�DUH��KZQG

7KH�KDQGOH�RI�WKH�WDUJHW�ZLQGRZ��RU�+:1'B%52$'&$67�LI�WKH�PHVVDJH�LV�WR�EH�VHQW�WR�DOO�WRS�OHYHO�ZLQGRZV�LQ�WKH�V\VWHP��

Z0VJ

7KH�PHVVDJH�WR�VHQG�WR�WKH�WDUJHW�ZLQGRZ�Z3DUDP

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH�O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH�6HQG0HVVDJH�VLPSO\�VHQGV�D�PHVVDJH�WR�WKH�VSHFLILHG�WDUJHW�ZLQGRZ��7KH�UHWXUQ�YDOXH�GHSHQGV�RQ�WKH�PHVVDJH�VHQW��7KH�PDLQ�GUDZEDFN�WR�XVLQJ�WKLV�IXQFWLRQ�LV�WKDW�LW�LV�V\QFKURQRXV��7KLV�PHDQV�WKDW�6HQG0HVVDJH�ZLOO�VHQG�WKH�PHVVDJH�DQG�WKHQ�ZDLW�IRU�WKH�WDUJHW�ZLQGRZ�SURFHGXUH�WR�UHWXUQ��,I�WKH�WDUJHW�ZLQGRZ�SURFHGXUH�QHYHU�UHWXUQV��WKH�IXQFWLRQ�WKDW�FDOOHG�6HQG0HVVDJH�FDQ�QHYHU�FRQWLQXH�SURFHVVLQJ��<RX�FDQ�XVH�VHYHUDO�RWKHU�$3,�IXQFWLRQV�WR�VROYH�WKLV�SUREOHP��7KH�ILUVW�RI�WKHVH�LV�6HQG0HVVDJH7LPHRXW���3XEOLF�'HFODUH�)XQFWLRQ�6HQG0HVVDJH7LPHRXW�/LE��XVHU����B������������$OLDV��6HQG0HVVDJH7LPHRXW$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��B�� � %\9DO�IX)ODJV�$V�/RQJ��%\9DO�X7LPHRXW�$V�/RQJ��B�� � OSGZ5HVXOW�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��KZQG

7KH�KDQGOH�RI�WKH�WDUJHW�ZLQGRZ��RU�+:1'B%52$'&$67�LI�WKH�PHVVDJH�LV�WR�EH�VHQW�WR�DOO�WRS�OHYHO�ZLQGRZV�LQ�WKH�V\VWHP���

0VJ

7KH�PHVVDJH�WR�VHQG�WR�WKH�WDUJHW�ZLQGRZ��Z3DUDP

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH��O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH��

Page 280: Visual Basic - Subclassing and Hooking with VB & VB NET

IX)ODJV

'HWHUPLQHV�KRZ�WKH�PHVVDJH�LV�VHQW��9DOLG�YDOXHV�DUH�DV�IROORZV��3XEOLF�&RQVW�6072B1250$/� �+��XQWLO��������'RHV�QRW�EORFN�FDOOLQJ�WKUHDG���������������������������������������������IXQFWLRQ�UHWXUQV�3XEOLF�&RQVW�6072B%/2&.� �+����������������%ORFNV�FDOOLQJ�WKUHDG�XQWLO����������������������������������������������IXQFWLRQ�UHWXUQV�3XEOLF�&RQVW�6072B$%257,)+81*� �+��5HWXUQV�LI�DSS�LV�KXQJ�3XEOLF�&RQVW�6072B127,0(287,)127+81*� �+����:LQ�����RQO\��'RHV�QRW�UHWXUQ����������������������������������������������IURP�WKH�IXQFWLRQ�LI�DSS�LV�QRW����������������������������������������������KXQJ��HYHQ�WKRXJK�WKH�WLPHRXW����������������������������������������������SHULRG�PD\�EH�H[SLUHG�

X7LPHRXW 7KH�WLPHRXW�YDOXH�LQ�PLOOLVHFRQGV�EHIRUH�WKH�IXQFWLRQ�WLPHV�RXW�DQG�UHWXUQV���

OSGZ5HVXOW 7KH�UHVXOW�RI�SURFHVVLQJ�WKH�PHVVDJH��

6HQG0HVVDJH7LPHRXW�VROYHV�WKH�SUREOHP�RI�V\QFKURQRXVO\�VHQGLQJ�PHVVDJHV��LW�VHQGV�WKH�PHVVDJH�WR�WKH�WDUJHW�ZLQGRZ�DQG�WKHQ�ZDLWV�WKH�QXPEHU�RI�PLOOLVHFRQGV�VSHFLILHG�LQ�WKH�X7LPHRXW�SDUDPHWHU��7KH�UHWXUQ�YDOXH�IRU�WKLV�IXQFWLRQ�LV�]HUR�LI�WKH�IXQFWLRQ�VXFFHHGHG�DQG�QRQ]HUR�LI�LW�WLPHG�RXW�RU�IDLOHG��8QIRUWXQDWHO\��LI�\RX�ZDQW�WR�JHW�D�UHWXUQ�YDOXH�WKDW�GHSHQGV�RQ�WKH�PHVVDJH����VLPLODU�WR�WKH�UHWXUQ�YDOXH�RI�6HQG0HVVDJH����\RX�DUH�RXW�RI�OXFN���,Q�DGGLWLRQ�WR�6HQG0HVVDJH7LPHRXW��6HQG1RWLI\0HVVDJH�DOVR�DGGUHVVHV�WKH�SUREOHP�RI�VHQGLQJ�D�PHVVDJH�V\QFKURQRXVO\��,WV�V\QWD[�LV���3XEOLF�'HFODUH�)XQFWLRQ�6HQG1RWLI\0HVVDJH�/LE��XVHU����B����������$OLDV��6HQG1RWLI\0HVVDJH$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��KZQG

7KH�KDQGOH�RI�WKH�WDUJHW�ZLQGRZ��RU�+:1'B%52$'&$67�LI�WKH�PHVVDJH�LV�WR�EH�VHQW�WR�DOO�WRS�OHYHO�ZLQGRZV�LQ�WKH�V\VWHP��

Z0VJ

7KH�PHVVDJH�WR�VHQG�WR�WKH�WDUJHW�ZLQGRZ�Z3DUDP

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH�O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH�6HQG1RWLI\0HVVDJH�ZRUNV�GLIIHUHQWO\�GHSHQGLQJ�RQ�ZKHWKHU�WKH�WDUJHW�WKUHDG�LV�WKH�VDPH�WKUHDG�DV�WKH�FDOOLQJ�WKUHDG�RU�LV�D�GLIIHUHQW�WKUHDG��,I�\RX�XVH�WKLV�IXQFWLRQ�WR�VHQG�D�PHVVDJH�

Page 281: Visual Basic - Subclassing and Hooking with VB & VB NET

WR�D�ZLQGRZ�LQ�WKH�VDPH�WKUHDG��WKH�FDOOLQJ�IXQFWLRQ�KDOWV�SURFHVVLQJ�XQWLO�WKH�6HQG1RWLI\0HVVDJH�IXQFWLRQ�UHWXUQV��VLPLODU�WR�WKH�6HQG0HVVDJH�IXQFWLRQ��,I�\RX�VHQG�WKH�PHVVDJH�WR�D�ZLQGRZ�LQ�D�GLIIHUHQW�WKUHDG��WKH�IXQFWLRQ�UHWXUQV�LPPHGLDWHO\��7KLV�IXQFWLRQ�UHWXUQV�RQO\�DQ�HUURU�VWDWXV��]HUR�RQ�IDLOXUH��QRQ]HUR�RQ�VXFFHVV��DQG�QR�RWKHU�LQIRUPDWLRQ���7KH�QH[W�:LQ���$3,�PHVVDJH�IXQFWLRQ��6HQG0HVVDJH&DOOEDFN��LV�DV\QFKURQRXV��,W�KDV�WKH�IROORZLQJ�9%�GHFODUDWLRQ���3XEOLF�'HFODUH�)XQFWLRQ�6HQG0HVVDJH&DOOEDFN�/LE��XVHU����B������������$OLDV��6HQG0HVVDJH&DOOEDFN$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��B�� � %\9DO�OS5HVXOW&DOO%DFN�$V�/RQJ��%\9DO�GZ'DWD�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��KZQG

7KH�KDQGOH�RI�WKH�WDUJHW�ZLQGRZ��RU�+:1'B%52$'&$67�LI�WKH�PHVVDJH�LV�WR�EH�VHQW�WR�DOO�WRS�OHYHO�ZLQGRZV�LQ�WKH�V\VWHP��

Z0VJ

7KH�PHVVDJH�WR�VHQG�WR�WKH�WDUJHW�ZLQGRZ�Z3DUDP

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH�O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH�OS5HVXOW&DOO%DFN

7KH�FDOOEDFN�IXQFWLRQ�DGGUHVV�GZ'DWD

'DWD�WR�EH�SDVVHG�LQWR�WKH�FDOOEDFN�IXQFWLRQ�6HQG0HVVDJH&DOOEDFN�VHQGV�D�PHVVDJH�WR�D�ZLQGRZ�DQG�UHWXUQV�LPPHGLDWHO\��7KH�UHWXUQ�YDOXH�LV�D�VXFFHVV�RU�IDLOXUH��D�]HUR�RU�D�QRQ]HUR�YDOXH��UHVSHFWLYHO\���+RZHYHU��WKLV�IXQFWLRQ�XVHV�D�FDOOEDFN�IXQFWLRQ�WR�UHWULHYH�WKH�PHVVDJH�GHSHQGHQW�UHWXUQ�YDOXH��7KLV�PHDQV�WKDW�ZH�FDQ�XVH�6HQG0HVVDJH�DV\QFKURQRXVO\�DQG�VWLOO�JHW�WKH�PHVVDJH�GHSHQGHQW�UHWXUQ�YDOXH����VLPLODU�WR�WKH�UHWXUQ�YDOXH�RI�6HQG0HVVDJH���7KH�FDOOEDFN�IXQFWLRQ�LV�GHILQHG�LQ�WKLV�PDQQHU��3XEOLF�6XE�'XPP\&DOOEDFN�%\9DO�KZQG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B�� � %\9DO�GZ'DWD�$V�/RQJ��%\9DO�O5HVXOW�$V�/RQJ��,WV�SDUDPHWHUV�DUH��KZQG

7KH�KDQGOH�RI�WKH�WDUJHW�ZLQGRZ�X0VJ

7KH�PHVVDJH�WR�VHQG�WR�WKH�WDUJHW�ZLQGRZ�GZ'DWD

7KH�YDOXH�VHQW�LQ�WKH�GZ'DWD�SDUDPHWHU�RI�WKH�6HQG0HVVDJH&DOOEDFN�IXQFWLRQ��

Page 282: Visual Basic - Subclassing and Hooking with VB & VB NET

O5HVXOW 7KH�PHVVDJH�GHSHQGHQW�UHVXOW��VLPLODU�WR�WKH�UHVXOW�YDOXH�IURP�6HQG0HVVDJH���

8VLQJ�WKH�O5HVXOW�SDUDPHWHU��ZH�FDQ�REWDLQ�WKH�VDPH�UHVXOW�YDOXH�WKDW�WKH�6HQG0HVVDJH�IXQFWLRQ�UHWXUQV���6HQG'OJ,WHP0HVVDJH�VHQGV�D�PHVVDJH�WR�D�FRQWURO�RQ�D�GLDORJ��7KLV�IXQFWLRQ�KDV�WKH�IROORZLQJ�GHFODUDWLRQ���3XEOLF�'HFODUH�)XQFWLRQ�6HQG'OJ,WHP0HVVDJH�/LE��XVHU����B������������$OLDV��6HQG'OJ,WHP0HVVDJH$��B�� � �%\9DO�K'OJ�$V�/RQJ��%\9DO�Q,''OJ,WHP�$V�/RQJ��B�� � %\9DO�Z0VJ�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B�� � %\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��K'OJ

7KH�KDQGOH�RI�WKH�WDUJHW�GLDORJ�ER[��Q,''OJ,WHP

7KH�,'�RI�WKH�FRQWURO�RQ�WKH�GLDORJ�ER[�WKDW�WKH�K'OJ�KDQGOH�VSHFLILHV��<RX�FDQ�ILQG�WKH�FRQWURO�,'�E\�XVLQJ�6S\�����

Z0VJ

7KH�PHVVDJH�WR�VHQG�WR�WKH�WDUJHW�ZLQGRZ��Z3DUDP

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH��O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH��6HQG'OJ,WHP0HVVDJH�RSHUDWHV�VLPLODUO\�WR�WKH�6HQG0HVVDJH�IXQFWLRQ��%RWK�DUH�V\QFKURQRXV��DQG�ERWK�UHWXUQ�D�YDOXH�WKDW�GHSHQGV�RQ�WKH�PHVVDJH�VHQW��7KH�PDLQ�GLIIHUHQFH�EHWZHHQ�WKHVH�WZR�IXQFWLRQV�LV�WKDW�\RX�FDQ�VSHFLI\�D�FRQWURO�,'�LQ�6HQG'OJ,WHP0HVVDJH��7KLV�PHDQV�\RX�FDQ�VHQG�D�PHVVDJH�WR�D�FRQWURO�ZKHQ�\RX�NQRZ�LWV�,'�EXW�QRW�LWV�K:QG���7KH�ILQDO�IXQFWLRQ�IRU�VHQGLQJ�PHVVDJHV�WKDW�ZH�ZLOO�H[DPLQH�LV�%URDGFDVW6\VWHP0HVVDJH��ZKLFK�LV�GHILQHG�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�%URDGFDVW6\VWHP0HVVDJH�/LE��XVHU����B�����$OLDV��%URDGFDVW6\VWHP0HVVDJH��B�� �%\9DO�GZ�$V�/RQJ��SGZ�$V�/RQJ��%\9DO�XQ�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B�� %\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��GZ

6SHFLILHV�RQH�RI�WKH�IROORZLQJ�EURDGFDVWLQJ�IODJV��BSF_ALLOWSFW

(QDEOHV�WKH�UHFLSLHQW�WR�VHW�WKH�IRUHJURXQG�ZLQGRZ�LQ�WKH�:LQGRZV������V\VWHP���BSF_FLUSHDISK

)OXVKHV�WKH�GLVN�DIWHU�HDFK�VHQW�PHVVDJH�LV�SURFHVVHG��BSF_FORCEIFHUNG

Page 283: Visual Basic - Subclassing and Hooking with VB & VB NET

6HQGV�WKH�PHVVDJH�HYHQ�LI�RQH�RU�PRUH�UHFLSLHQWV�DUH�KXQJ��BSF_IGNORECURRENTTASK

3UHYHQWV�WKH�VHQGLQJ�DSSOLFDWLRQ�IURP�UHFHLYLQJ�LWV�RZQ�PHVVDJH��BSF_NOHANG

6WRSV�EURDGFDVWLQJ�PHVVDJHV�LI�RQH�UHFLSLHQW�LV�KXQJ��BSF_NOTIMEOUTIFNOTHUNG

'RHV�QRW�WLPH�RXW�XQOHVV�D�UHFLSLHQW�LV�KXQJ��BSF_POSTMESSAGE

3RVWV�WKH�PHVVDJH�LQVWHDG�RI�VHQGLQJ�LW��BSF_QUERY

(DFK�UHFLSLHQW�PXVW�UHVSRQG�ZLWK�D�7UXH�YDOXH�IRU�WKH�PHVVDJH�WR�EH�VHQW�WR�WKH�QH[W�UHFLSLHQW���

BSF_SENDNOTIFYMESSAGE

8VHV�WKH�6HQG1RWLI\0HVVDJH�IXQFWLRQ�WR�VHQG�WKH�PHVVDJH�LQ�WKH�:LQGRZV������V\VWHP���

SGZ

6SHFLILHV�D�IODJ�WKDW�GHWHUPLQHV�WKH�PHVVDJH�UHFLSLHQWV��,W�FDQ�EH�RQH�RI�WKH�IROORZLQJ�FRQVWDQWV���

BSM_ALLCOMPONENTS

%URDGFDVWV�WR�DOO�FRPSRQHQWV�LQ�WKH�V\VWHP�BSM_ALLDESKTOPS

%URDGFDVWV�WR�DOO�GHVNWRSV�LQ�:LQGRZV�17������V\VWHPV�BSM_APPLICATIONS

%URDGFDVWV�WR�DOO�DSSOLFDWLRQV�BSM_INSTALLABLEDRIVERS

%URDGFDVWV�WR�LQVWDOODEOH�GULYHUV�LQ�:LQGRZV��[�V\VWHPV�BSM_NETDRIVER

%URDGFDVWV�WR�QHWZRUN�GULYHUV�LQ�:LQGRZV��[�V\VWHPV�BSM_VXDS

%URDGFDVWV�WR�DOO�V\VWHP�OHYHO�GHYLFH�GULYHUV�LQ�:LQGRZV��[�V\VWHPV�XQ

7KH�PHVVDJH�LGHQWLILHU��Z3DUDP

$GGLWLRQDO�LQIRUPDWLRQ�IRU�WKH�PHVVDJH�VSHFLILHG�LQ�XQ���O3DUDP

$GGLWLRQDO�LQIRUPDWLRQ�IRU�WKH�PHVVDJH�VSHFLILHG�LQ�XQ���7KLV�IXQFWLRQ�UHWXUQV�D�SRVLWLYH�YDOXH�LI�LW�VXFFHVVIXOO\�VHQGV�WKH�PHVVDJH�WR�LWV�UHFLSLHQWV��,W�UHWXUQV�D����YDOXH�LI�LW�ZDV�XQDEOH�WR�VHQG�WKH�PHVVDJH��0HVVDJHV�DUH�VHQW�WR�UHFLSLHQWV�DV�GHWHUPLQHG�E\�WKH�SGZ�SDUDPHWHU���

������)LOWHU�)XQFWLRQ�'HILQLWLRQ�

7KH�ILOWHU�IXQFWLRQ�SURWRW\SH�IRU�WKLV�KRRN�LV�ZULWWHQ�DV�IROORZV���3XEOLF�)XQFWLRQ�:QG3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B�

Page 284: Visual Basic - Subclassing and Hooking with VB & VB NET

������������������������O3DUDP�$V�&:36758&7��$V�/RQJ�,WV�SDUDPHWHUV�DUH��X&RGH

7KH�FRGH�WKH�V\VWHP�VHQGV�WR�WKLV�ILOWHU�IXQFWLRQ��)RU�D�:+B&$//:1'352&�KRRN��WKH�RQO\�KRRN�FRGH�WKDW�LW�VHQW�WR�WKLV�ILOWHU�IXQFWLRQ�LV�+&B$&7,21��ZKLFK�LV�GHILQHG�DV�IROORZV���3ULYDWH�&RQVW�+&B$&7,21� ���:KHQ�WKH�V\VWHP�VHQGV�WKLV�FRGH�WR�WKH�ILOWHU�IXQFWLRQ��WKH�VHQW�PHVVDJH�FDQ�EH�SURFHVVHG��,I�+&B$&7,21�LV�QRW�SDVVHG��\RX�VKRXOG�VNLS�PHVVDJH�SURFHVVLQJ�DQG�FDOO�&DOO1H[W+RRN([�LPPHGLDWHO\���

Z3DUDP

,I�WKLV�LV�QRQ]HUR��WKH�FXUUHQW�WKUHDG�VHQW�WKH�PHVVDJH��RWKHUZLVH��DQRWKHU�WKUHDG�VHQW�WKH�PHVVDJH���

O3DUDP

3RLQWHU�WR�D�&:36758&7�VWUXFWXUH���7KH�UHWXUQ�YDOXH�IRU�WKLV�ILOWHU�IXQFWLRQ�VKRXOG�EH�WKH�UHWXUQ�YDOXH�RI�WKH�&DOO1H[W+RRN([�IXQFWLRQ��,I�WKLV�IXQFWLRQ�LV�QRW�FDOOHG��WKH�ILOWHU�IXQFWLRQ�VKRXOG�UHWXUQ�D�]HUR��,�GR�QRW�UHFRPPHQG�VNLSSLQJ�WKH�FDOO�WR�&DOO1H[W+RRN([��WKRXJK��)DLOLQJ�WR�FDOO�WKLV�IXQFWLRQ�ZLOO�IRUFH�RWKHU�ILOWHU�IXQFWLRQV�LQ�WKH�FKDLQ�WR�QRW�EH�FDOOHG���7KH�&:36758&7�VWUXFWXUH�WKDW�WKH�O3DUDP�SDUDPHWHU�SRLQWV�WR�LV�GHILQHG�DV�IROORZV���3XEOLF�7\SH�&:36758&7���������O3DUDP�$V�/RQJ���������Z3DUDP�$V�/RQJ���������PHVVDJH�$V�/RQJ���������KZQG�$V�/RQJ�(QG�7\SH�,WV�PHPEHUV�DUH��O3DUDP

7KH�O3DUDP�SDUDPHWHU�IRU�WKLV�PHVVDJH�Z3DUDP

7KH�Z3DUDP�SDUDPHWHU�IRU�WKLV�PHVVDJH�PHVVDJH

7KH�PHVVDJH�LGHQWLILHU�RI�WKH�LQWHUFHSWHG�PHVVDJH�KZQG

7KH�ZLQGRZ�KDQGOH�WKDW�WKLV�PHVVDJH�LV�GLUHFWHG�WR�7KLV�VWUXFWXUH�FRQWDLQV�WKH�PHVVDJH�LQIRUPDWLRQ�WKDW�WKH�6HQG0HVVDJH�IXQFWLRQ�VHQW��7KLV�LV�WKH�VDPH�LQIRUPDWLRQ�FRQWDLQHG�LQ�WKH�SDUDPHWHUV�WR�WKH�6HQG0HVVDJH�IXQFWLRQ��DV�\RX�FDQ�VHH�E\�H[DPLQLQJ�LWV�SURWRW\SH�HDUOLHU�LQ�WKLV�FKDSWHU��WKHUH�LV�D�RQH�WR�RQH�FRUUHVSRQGHQFH�EHWZHHQ�WKH�6HQG0HVVDJH�SDUDPHWHUV�DQG�WKH�&:36758&7�VWUXFWXUH�PHPEHUV���

Page 285: Visual Basic - Subclassing and Hooking with VB & VB NET

������/RFDWLRQ�RI�7KLV�+RRN�LQ�WKH�6\VWHP�

7KH�:+B&$//:1'352&�KRRN�LV�ORFDWHG�ZLWKLQ�WKH�6HQG0HVVDJH�$3,�IXQFWLRQ�LQ�WKH�:LQGRZV��[�DQG�:LQGRZV�17������RSHUDWLQJ�V\VWHPV��+RZHYHU��LQ�WKH�:LQGRZV�17�����DQG�:LQGRZV������RSHUDWLQJ�V\VWHPV��WKH�KRRN�LV�ORFDWHG�LPPHGLDWHO\�EHIRUH�WKH�ZLQGRZ�SURFHGXUH��7KH�KRRN�DOVR�LV�ORFDWHG�LQ�WKH�WKUHDG�WKDW�UHFHLYHV�WKH�VHQW�PHVVDJH��7KLV�LV�GLIIHUHQW�IURP�WKH�:LQGRZV��[�DQG�17������RSHUDWLQJ�V\VWHPV��ZKHUH�WKH�KRRN�LV�ILUHG�IURP�ZLWKLQ�WKH�WKUHDG�WKDW�VHQW�WKH�PHVVDJH��,I�WKH�ZLQGRZ�SURFHGXUH�LV�VXEFODVVHG��WKH�KRRN�LV�ORFDWHG�EHIRUH�ERWK�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�DQG�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��DV�)LJXUH�����LOOXVWUDWHV���

)LJXUH������7KH�ORFDWLRQ�RI�WKH�:+B&$//:1'352&�KRRN�LQ�WKH�:LQGRZV�17�����DQG�:LQGRZV������RSHUDWLQJ�V\VWHPV�

7KLV�KRRNV�GHSHQGHQF\�RQ�WKH�RSHUDWLQJ�V\VWHP�FRXOG�FDXVH�SUREOHPV��HVSHFLDOO\�ZKHQ�PHVVDJHV�DUH�VHQW�IURP�RWKHU�SURFHVVHV��,Q�WKLV�FDVH�\RX�ZRXOG�QRW�KDYH�DFFHVV�WR�WKH�VDPH�SURFHVV�LQIRUPDWLRQ�IURP�\RXU�ILOWHU�IXQFWLRQ��GHSHQGLQJ�RQ�WKH�RSHUDWLQJ�V\VWHP�\RX�ZHUH�XVLQJ��,Q�ERWK�FDVHV��KRZHYHU��WKH�ILOWHU�IXQFWLRQ�LV�FDOOHG�EHIRUH�WKH�GHVWLQDWLRQ�ZLQGRZ�SURFHVVHV�WKH�VHQW�PHVVDJH��

Page 286: Visual Basic - Subclassing and Hooking with VB & VB NET

����$�7KUHDG�6SHFLILF�([DPSOH�

7KH�H[DPSOH�SUHVHQWHG�KHUH�VKRZV�LQ�PRUH�GHWDLO�KRZ�WR�VHW�XS�DQG�XVH�WKLV�KRRN��$�VLQJOH�ZLQGRZ�LV�FUHDWHG�LQ�WKLV�H[DPSOH��ZKLFK�LV�VKRZQ�LQ�)LJXUH������7DEOH�����GHILQHV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV��7KLV�ZLQGRZ�KDV�D�KRRN�DQG�DQ�XQKRRN�EXWWRQ�LQ�WKH�&$//:1'352&�IUDPH��<RX�XVH�WKHVH�EXWWRQV�WR�LQVWDOO�DQG�UHPRYH�WKH�KRRN���

7DEOH������1RQGHIDXOW�3URSHUW\�9DOXHV�IRU�WKH�)RUP�DQG�,WV�&RQWUROV��&RQWURO� 3URSHUW\� 9DOXH�

)RUP� &DSWLRQ� :+B&$//:1'352&�+RRN�7HVW�FPG6HQG0VJ� &DSWLRQ� 6HQG0VJ�FPG6HQG0VJ72� &DSWLRQ� 6HQG0VJ72�FPG3RVW0HVVDJH� &DSWLRQ� 3RVW0HVVDJH�FPG6HQG0VJ&%� &DSWLRQ� 6HQG0VJ&%�FPG%URDGFDVW0VJ� &DSWLRQ� %URDGFDVW0VJ�FPG6HQG'OJ0VJ� &DSWLRQ� 6HQG'OJ0VJ�)UDPH�� &DSWLRQ� &DOO:QG3URF�7H[W�� 0XOWL/LQH� 7UXH�(DFK�EXWWRQV�IXQFWLRQDOLW\�LV�GHILQHG�DV�IROORZV��SendMsg

&DOOV�WKH�6HQG0HVVDJH�IXQFWLRQ��SendMsgNotify

&DOOV�WKH�6HQG1RWLI\0HVVDJH�IXQFWLRQ��SendMsgTO

&DOOV�WKH�6HQG0HVVDJH7LPHRXW�IXQFWLRQ��SendMsgCB

&DOOV�WKH�6HQG0HVVDJH&DOOEDFN�IXQFWLRQ��7KH�FDOOEDFN�IXQFWLRQ�LV�FDOOHG�'XPP\&DOOEDFN�DQG�LV�ORFDWHG�LQ�WKH�0RGXOH��EDV�ILOH���

SendDlgMsg

&DOOV�WKH�6HQG'OJ,WHP0HVVDJH�IXQFWLRQ��BroadcastMsg

&DOOV�WKH�%URDGFDVW6\VWHP0HVVDJH�IXQFWLRQ��PostMessage

&DOOV�WKH�3RVW0HVVDJH�IXQFWLRQ��<RX�XVH�WKH�WH[W�ER[�RQ�WKLV�ZLQGRZ�WR�GLVSOD\�WKH�YDOXHV�RI�SDUDPHWHUV�SDVVHG�WR�WKH�:+B&$//:1'352&�ILOWHU�IXQFWLRQ���

)LJXUH������6FUHHQVKRW�RI�WKH�:+B&$//:1'352&�KRRN�H[DPSOH�DSSOLFDWLRQ�

Page 287: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�FHQWHUSLHFH�RI�WKH�SURMHFW�LV�WKH�FRGH�PRGXOH��0RGXOH��EDV��ZKLFK�LQFOXGHV�WKH�IROORZLQJ�GHFODUDWLRQ�RI�WKH�K+RRN�PHPEHU�YDULDEOH�DQG�WKH�,V+RRNHG�SXEOLF�YDULDEOH���3ULYDWH�K+RRN�$V�/RQJ�3XEOLF�,V+RRNHG�$V�%RROHDQ�<RX�XVH�WKH�K+RRN�PHPEHU�YDULDEOH�WR�KROG�WKH�KDQGOH�WR�WKH�:+B&$//:1'352&�KRRN��7KH�,V+RRNHG�JOREDO�YDULDEOH�LV�D�IODJ�WKDW�LV�VHW�WR�7UXH�ZKLOH�WKH�KRRN�LV�LQVWDOOHG��7KLV�SUHYHQWV�XV�IURP�LQVWDOOLQJ�WKH�KRRN�PRUH�WKDQ�RQFH�DQG�IURP�VKXWWLQJ�GRZQ�WKH�DSSOLFDWLRQ�EHIRUH�UHPRYLQJ�WKH�KRRN��(LWKHU�DFWLRQ�FDQ�FDXVH�D�*HQHUDO�3URWHFWLRQ�)DXOW��*3)����$V�([DPSOH�����VKRZV��6HW:QG3URF+RRN��ZKLFK�LV�UHVSRQVLEOH�IRU�VHWWLQJ�WKH�KRRN�LQ�SODFH��XVHV�6HW:LQGRZV+RRN([�WR�LQVWDOO�WKH�:+B&$//:1'352&�KRRN�DV�D�WKUHDG�VSHFLILF�KRRN��7KH�,V+RRNHG�IODJ�LV�VHW�WR�7UXH��LQGLFDWLQJ�WKDW�WKH�KRRN�LV�LQVWDOOHG���

([DPSOH������(VWDEOLVKLQJ�D�:+B&$//:1'352&�+RRN�:LWK�6HW:QG3URF+RRN��

3XEOLF�6XE�6HW:QG3URF+RRN���������,I�,V+RRNHG�7KHQ���������0VJ%R[��'RQW�KRRN�&$//:1'352&�WZLFH�RU�\RX�ZLOO�EH�XQDEOH�WR�XQKRRN�LW�������(OVH���������OS3UHY:QG3URF� �6HW:LQGRZV+RRN([�:+B&$//:1'352&��$GGUHVV2I�:QG3URF�����B�������������������������$SS�7KUHDG,'����������,V+RRNHG� �7UXH�����(QG�,I�(QG�6XE�([DPSOH�����VKRZV�WKH�5HPRYH:QG3URF+RRN�IXQFWLRQ��ZKLFK�XQLQVWDOOV�WKH�:+B&$//:1'352&�KRRN��,W�XVHV�8QKRRN:LQGRZV+RRN([�WR�UHPRYH�WKH�:+B&$//:1'352&�KRRN�IURP�WKH�KRRN�FKDLQ��,V+RRNHG�LV�VHW�WR�)DOVH��DOORZLQJ�WKH�KRRN�WR�EH�UHLQVWDOOHG�RU�WKH�DSSOLFDWLRQ�WR�EH�VKXW�GRZQ���

Page 288: Visual Basic - Subclassing and Hooking with VB & VB NET

([DPSOH������7KH�5HPRYH:QG3URF+RRN�3URFHGXUH�WR�5HPRYH�D�:+B&$//:1'352&�+RRN��

3XEOLF�6XE�5HPRYH:QG3URF+RRN���������'LP�WHPS�$V�/RQJ�����WHPS� �8QKRRN:LQGRZV+RRN([�OS3UHY:QG3URF������,V+RRNHG� �)DOVH�(QG�6XE�7KH�:QG3URF�IXQFWLRQ��ZKLFK�LV�VKRZQ�LQ�([DPSOH������LV�WKH�ILOWHU�IXQFWLRQ�IRU�WKLV�KRRN��,I�WKH�X&RGH�SDUDPHWHU�IRU�WKLV�IXQFWLRQ�FRQWDLQV�WKH�+&B$&7,21�FRGH�DQG�WKH�PHVVDJH�VHQW�LV�:0B18//��WKH�Z3DUDP�DQG�O3DUDP�SDUDPHWHUV�IRU�WKLV�IXQFWLRQ�DUH�ZULWWHQ�WR�WKH�WH[W�ER[�RQ�WKH�IRUP��7KH�GHFODUDWLRQ�RI�:0B18//�LV�DV�IROORZV���&RQVW�:0B18//� �+���6LPSO\�SXW��WKLV�PHVVDJH�GRHV�QRWKLQJ��7KLV�PHVVDJH�DOORZV�WKH�KRRN�WR�ZDWFK�IRU�D�VSHFLILF�PHVVDJH�WKDW�ZH�LQWHQWLRQDOO\�VHQG��7KLV�PHVVDJH�ZLOO�QRW�DGYHUVHO\�DIIHFW�RXU�DSSOLFDWLRQ���7KH�YDOXH�WKDW�WKH�,Q6HQG0HVVDJH�IXQFWLRQ�UHWXUQV�DOVR�LV�ZULWWHQ�WR�WKH�WH[W�ER[�WR�VKRZ�ZKHUH�WKH�PHVVDJH�RULJLQDWHG��,Q6HQG0HVVDJH�LV�GHILQHG�LQ�9%�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�,Q6HQG0HVVDJH�/LE��XVHU���������$V�/RQJ�7KLV�IXQFWLRQ�WDNHV�QR�SDUDPHWHUV�DQG�UHWXUQV�HLWKHU�D�]HUR�RU�D����,I�WKH�IXQFWLRQ�UHWXUQV�D�]HUR��WKH�WKUHDG�WKDW�UHFHLYHG�WKH�PHVVDJH�VHQW�WKH�PHVVDJH��,I�WKH�IXQFWLRQ�UHWXUQV�D����D�VHSDUDWH�WKUHDG�VHQW�WKH�PHVVDJH���7KH�ILQDO�OLQH�LQ�WKLV�ILOWHU�IXQFWLRQ�FDOOV�&DOO1H[W+RRN([�WR�DOORZ�WKH�RWKHU�ILOWHU�IXQFWLRQV�LQ�WKLV�KRRN�FKDLQ�WR�SURFHVV�WKH�PHVVDJH���7KHUH�LV�D�SRWHQWLDO�SUREOHP�ZLWK�WKLV�ILOWHU�IXQFWLRQ��,I�WKH�,I���7KHQ�VWDWHPHQW�WKDW�FKHFNV�IRU�WKH�:0B18//�PHVVDJH�LV�QRW�SUHVHQW��WKH�DSSOLFDWLRQ�ZLOO�FUDVK��7KLV�LV�EHFDXVH�WKH�OLQH�WKDW�ZULWHV�WKH�PHVVDJHV�WR�WKH�7H[W��WH[W�ER[�FDXVHV�D�:0B&7/&2/25(',7�PHVVDJH�WR�EH�VHQW�WR�WKH�WH[W�ER[��7KLV��LQ�WXUQ��FDXVHV�WKH�:QG3URF�ILOWHU�IXQFWLRQ�WR�EH�UH�HQWHUHG��(YHU\�WLPH�WH[W�LV�ZULWWHQ�WR�WKH�7H[W��WH[W�ER[��WKH�IXQFWLRQ�LV�UH�HQWHUHG�DQG�LW�QHYHU�UHWXUQV��7KLV�FDXVHV�D�VWDFN�RYHUIORZ�DQG�D�*3)��8VLQJ�WKH�,I���7KHQ�VWDWHPHQW�WR�WUDS�RQO\�WKH�:0B18//�PHVVDJH�DOORZV�DOO�RWKHU�PHVVDJHV�WR�EH�E\SDVVHG�DQG�SURFHVVHG�ZLWKRXW�WKH�ILOWHU�IXQFWLRQ�LQWHUYHQLQJ��:KHQ�XVLQJ�KRRNV�DQG�VXEFODVVLQJ��\RX�VKRXOG�DOZD\V�EH�DZDUH�RI�DQ\�FRGH�ZLWKLQ�WKH�VXEFODVV�SURFHGXUH�RU�WKH�ILOWHU�IXQFWLRQ�WKDW�FRXOG�FDXVH�RWKHU�PHVVDJHV�WR�EH�ILUHG���

([DPSOH������7KH�:+B&$//:1'352&�)LOWHU�)XQFWLRQ��

3XEOLF�)XQFWLRQ�:QG3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B�������������������������O3DUDP�$V�&:36758&7��$V�/RQJ����,I�O3DUDP�PHVVDJH� �:0B18//�7KHQ�������6HOHFW�&DVH�X&RGH�

Page 289: Visual Basic - Subclassing and Hooking with VB & VB NET

���������&DVH�+&B$&7,21�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���06*����+H[��O3DUDP�PHVVDJH��B��������������������������������������+:1'����+H[��O3DUDP�KZQG��B��������������������������������������:3$5$0����+H[��O3DUDP�Z3DUDP��B��������������������������������������/3$5$0����+H[��O3DUDP�O3DUDP��B��������������������������������������&8557+5($'����Z3DUDP�B��������������������������������������,Q60����,Q6HQG0HVVDJH������YE1HZ/LQH�������������'R(YHQWV����������&DVH�(OVH�������(QG�6HOHFW����(QG�,I���������:QG3URF� ����5HWXUQLQJ�]HUR�WR�WU\�DQG�GLVFDUG�WKH�PHVVDJH�GRHV�QRW�ZRUN�����:QG3URF� �&DOO1H[W+RRN([�OS3UHY:QG3URF��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KH�'XPP\&DOOEDFN�IXQFWLRQ��ZKLFK�LV�VKRZQ�LQ�([DPSOH������LV�EDVLFDOO\�D�VWXE�IXQFWLRQ�IRU�6HQG0HVVDJH&DOOEDFN��ZKLFK�\RX�XVH�WR�VHQG�D�PHVVDJH�ZKHQ�WKH�XVHU�FOLFNV�WKH�6HQG0VJ&%�EXWWRQ��,W�GRHV�QR�SURFHVVLQJ��LWV�RQO\�UHDVRQ�IRU�H[LVWLQJ�LV�WR�DOORZ�WKH�UHFHLYLQJ�WKUHDG�WR�SURSHUO\�FDOO�EDFN�WR�D�FDOOEDFN�IXQFWLRQ���

([DPSOH������7KH�&DOOEDFN�)XQFWLRQ�IRU�WKH�6HQG0HVVDJH&DOOEDFN�)XQFWLRQ��

3XEOLF�6XE�'XPP\&DOOEDFN�%\9DO�KZQG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B��������������������������%\9DO�GZ'DWD�$V�/RQJ��%\9DO�O5HVXOW�$V�/RQJ������'R�QRWKLQJ�DQG�UHWXUQ�(QG�6XE�7KDW�LV�LW�IRU�WKH�FRGH�LQ�WKH�0RGXOH��EDV�PRGXOH��$V�([DPSOH�����VKRZV��PRVW�RI�WKH�FRGH�LQ�WKH�)RUP��IUP�PRGXOH�FRQVLVWV�RI�HYHQW�KDQGOHUV�IRU�WKH�FRPPDQG�EXWWRQV��,W�DOVR�LQFOXGHV�WKH�)RUPB4XHU\8QORDG�VKXWGRZQ�PHWKRG���

([DPSOH������6RXUFH�&RGH�IRU�WKH�)RUP��IUP�0RGXOH��

������������67$57�������������3ULYDWH�6XE�FPG6XEFODVVB&OLFN���������7H[W��7H[W� ��������&DOO�6HW:QG3URF+RRN�(QG�6XE��

Page 290: Visual Basic - Subclassing and Hooking with VB & VB NET

3ULYDWH�6XE�FPG8Q6XEFODVVB&OLFN���������&DOO�5HPRYH:QG3URF+RRN�(QG�6XE��3ULYDWH�6XE�FPG6HQG0VJ1RWLI\B&OLFN���������&DOO�6HQG1RWLI\0HVVDJH�)RUP��KZQG��:0B18//��������(QG�6XE��3ULYDWH�6XE�FPG6HQG0VJB&OLFN���������&DOO�6HQG0HVVDJH�)RUP��KZQG��:0B18//���������������(QG�6XE��3ULYDWH�6XE�FPG6HQG0VJ72B&OLFN���������'LP�UHWYDO�$V�/RQJ�����&DOO�6HQG0HVVDJH7LPHRXW�)RUP��KZQG��:0B18//��������6072B%/2&.��������UHWYDO��(QG�6XE��3ULYDWH�6XE�FPG3RVW0HVVDJHB&OLFN���������&DOO�3RVW0HVVDJH�)RUP��KZQG��:0B18//��������(QG�6XE��3ULYDWH�6XE�FPG6HQG0VJ&%B&OLFN���������&DOO�6HQG0HVVDJH&DOOEDFN�)RUP��KZQG��:0B18//��������$GGUHVV2I�'XPP\&DOOEDFN�����(QG�6XE��3ULYDWH�6XE�FPG%URDGFDVW0VJB&OLFN���������'LP�5HW,QGLFDWRU�$V�/RQJ�� 5HW,QGLFDWRU� �%URDGFDVW6\VWHP0HVVDJH�%6)B127,0(287,)127+81*��B�� � � %60B$//&20321(176��:0B18//�������������0VJ%R[��7KH�UHWXUQ�YDOXH�IRU�%URDGFDVW6\VWHP0HVVDJH�����+H[��5HW,QGLFDWRU��(QG�6XE��3ULYDWH�6XE�FPG6HQG'OJ0VJB&OLFN���������&DOO�6HQG'OJ,WHP0HVVDJH�)RUP��KZQG�����:0B18//���������� 7KH�FRQWURO�,'�����FDQ�EH�IRXQG�E\�XVLQJ�6S\���(QG�6XE��������������&/($183�������������

Page 291: Visual Basic - Subclassing and Hooking with VB & VB NET

3ULYDWH�6XE�)RUPB4XHU\8QORDG�&DQFHO�$V�,QWHJHU��8QORDG0RGH�$V�,QWHJHU������,I�,V+RRNHG�2U�,V'%*+RRNHG�7KHQ�����&DQFHO� �������0VJ%R[��8QKRRN�EHIRUH�FORVLQJ��RU�WKH�,'(�ZLOO�FUDVK�������(QG�,I�(QG�6XE�7KH�FRGH�EHKLQG�WKH�WRS�WZR�EXWWRQV�LQVWDOOV�DQG�UHPRYHV�WKH�:+B&$//:1'352&�KRRN��7KH�RWKHU�EXWWRQV�FDOO�HDFK�6HQG0HVVDJH�IXQFWLRQ��DORQJ�ZLWK�D�3RVW0HVVDJH�IXQFWLRQ��1RWLFH�WKDW�WKH�6HQG0HVVDJH�DQG�3RVW0HVVDJH�IXQFWLRQV�DOO�VHQG�WKH�:0B18//�PHVVDJH��7KLV�LV�EHFDXVH�WKLV�PHVVDJH�GRHV�QRWKLQJ�DQG��WKHUHIRUH��ZLOO�QRW�DIIHFW�RWKHU�DSSOLFDWLRQV�DGYHUVHO\�ZKHQ�EURDGFDVW��7KH�)RUPB4XHU\8QORDG�PHWKRG�VWRSV�WKH�DSSOLFDWLRQ�IURP�VKXWWLQJ�GRZQ�LI�WKH�KRRN�LV�VWLOO�LQVWDOOHG�DQG�SUHVHQWV�D�PHVVDJH�WR�WKH�XVHU�WR�UHPRYH�WKH�KRRN�EHIRUH�VKXWWLQJ�GRZQ���7R�XVH�WKH�DSSOLFDWLRQ��GRXEOH�FOLFN�LWV�H[HFXWDEOH�ILOH�DQG�FOLFN�WKH�KRRN�EXWWRQ��$W�WKLV�SRLQW�WKH�KRRN�LV�LQ�SODFH�DQG�LV�ZDWFKLQJ�IRU�WKH�:0B18//�PHVVDJH��&OLFNLQJ�WKH�6HQG0VJ��6HQG0VJ1RWLI\��6HQG0VJ72��6HQG0VJ&%��RU�6HQG'OJ0VJ�EXWWRQV�ZLOO�SODFH�D�QHZ�OLQH�RI�WH[W�LQ�WKH�WH[W�ER[�EHFDXVH�HDFK�6HQG0HVVDJH�IXQFWLRQ�LV�VHQGLQJ�WKH�:0B18//�PHVVDJH�WR�WKH�)RUP��ZLQGRZ��7KH�KRRNV�ILOWHU�IXQFWLRQ�LQWHUFHSWV�WKH�PHVVDJH�EHIRUH�LW�LV�VHQW�DQG�VHQGV�D�OLQH�RI�LQIRUPDWLRQ�UHJDUGLQJ�WKH�PHVVDJH�WR�WKH�7H[W��WH[W�ER[��$IWHU�WKH�ILOWHU�IXQFWLRQ�UHWXUQV��WKH�6HQG0HVVDJH�IXQFWLRQ�FDQ�VHQG�WKH�PHVVDJH�WR�LWV�GHVWLQDWLRQ�ZLQGRZ���:KHQ�\RX�FOLFN�WKH�%URDGFDVW0VJ�EXWWRQ��D�VLQJOH�:0B18//�PHVVDJH�LV�VHQW�WR�DOO�WKH�WRS�OHYHO�ZLQGRZV�DQG�GHYLFH�GULYHUV�LQ�WKH�V\VWHP�WKURXJK�%URDGFDVW6\VWHP0HVVDJH��$�GLIIHUHQW�OLQH�LV�DGGHG�WR�WKH�7H[W��WH[W�ER[�IRU�HDFK�:0B18//�PHVVDJH�VHQW��7KH�ZLQGRZ�KDQGOH�LV�GLVSOD\HG��LQGLFDWLQJ�WR�ZKLFK�ZLQGRZ�WKH�:0B18//�PHVVDJH�ZDV�VHQW���<RX�DOVR�FDQ�VHQG�PHVVDJHV�WR�WRS�OHYHO�ZLQGRZV�E\�XVLQJ�WKH�+:1'B%52$'&$67�FRQVWDQW�LQ�WKH�KZQG�SDUDPHWHU�RI�WKH�6HQG0HVVDJH�IXQFWLRQ��8VLQJ�WKLV�IXQFWLRQ�ZLOO�QRW�VHQG�PHVVDJHV�WR�GHYLFH�GULYHUV��ZKLFK�LV�ZKDW�KDSSHQV�ZKHQ�\RX�XVH�%URDGFDVW6\VWHP0HVVDJH����$�UHWXUQ�YDOXH�LV�VHW�LQ�WKH�OSGZ5HFLSLHQWV�SDUDPHWHU�RI�WKH�%URDGFDVW6\VWHP0HVVDJH�IXQFWLRQ�DIWHU�WKH�IXQFWLRQ�UHWXUQV��7KH�UHWXUQ�YDOXH�GHILQHV�ZKDW�ZLQGRZV�RU�GHYLFH�GULYHUV�UHFHLYHG�WKH�PHVVDJH��$1'LQJ�WKLV�UHVXOW�ZLWK�WKH�IROORZLQJ�FRQVWDQWV�SURYLGHV�LQIRUPDWLRQ�DERXW�ZKLFK�ZLQGRZV�RU�GHYLFH�GULYHUV�UHFHLYHG�WKH�EURDGFDVW�PHVVDJH���3XEOLF�&RQVW�%60B$//&20321(176� �+��3XEOLF�&RQVW�%60B9;'6� �+��3XEOLF�&RQVW�%60B1(7'5,9(5� �+��3XEOLF�&RQVW�%60B,167$//$%/('5,9(56� �+��3XEOLF�&RQVW�%60B$33/,&$7,216� �+��3XEOLF�&RQVW�%60B$//'(6.7236� �+���&OLFNLQJ�WKH�3RVW0HVVDJH�EXWWRQ�SRVWV�D�PHVVDJH�WR�WKLV�DSSOLFDWLRQV�PHVVDJH�TXHXH��7KLV�ZLOO�QRW�GLVSOD\�D�QHZ�OLQH�LQ�WKH�7H[W��WH[W�ER[��7KLV�LV�WKH�FRUUHFW�EHKDYLRU�EHFDXVH�WKH�PHVVDJH�LV�EHLQJ�SRVWHG�DQG�QRW�VHQW�WKURXJK�RQH�RI�WKH�6HQG0HVVDJH�IXQFWLRQV���

Page 292: Visual Basic - Subclassing and Hooking with VB & VB NET

6XEVWLWXWLQJ�WKH�%6)B32670(66$*(�FRQVWDQW�LQ�WKH�GZ)ODJV�SDUDPHWHU�RI�WKH�%URDGFDVW6\VWHP0HVVDJH�IXQFWLRQ�FDXVHV�PHVVDJHV�WR�EH�SRVWHG�LQVWHDG�RI�VHQW�WR�DOO�ZLQGRZV�DQG�GHYLFH�GULYHUV��,I�WKLV�VXEVWLWXWLRQ�LV�PDGH��WKH�:+B&$//:1'352&�KRRN�ZLOO�QRW�EH�DEOH�WR�LQWHUFHSW�WKH�SRVWHG�PHVVDJH��DQG�QR�WH[W�ZLOO�EH�SODFHG�LQ�WKH�7H[W��WH[W�ER[���

����&DYHDWV�

7KH�PDLQ�WKLQJ�WR�UHPHPEHU�ZKHQ�XVLQJ�WKLV�KRRN�LV�WKDW�LW�FDSWXUHV�RQO\�PHVVDJHV�WKDW�DUH�VHQW�XVLQJ�WKH�6HQG0HVVDJH�IXQFWLRQ��,W�ZLOO�QRW�FDSWXUH�PHVVDJHV�WKDW�\RX�SRVW�WR�WKH�PHVVDJH�TXHXH�XVLQJ�WKH�3RVW0HVVDJH�IXQFWLRQ��)RU�WKH�FDVH�RI�SRVWHG�PHVVDJHV��\RX�VKRXOG�XVH�WKH�:+B*(70(66$*(�KRRN��ZKLFK�LV�GLVFXVVHG�LQ�&KDSWHU������<RX�VKRXOG�WDNH�FDUH�ZKHQ�XVLQJ�DQ\�KRRN��DV�SHUIRUPDQFH�FDQ�EH�VHULRXVO\�GHJUDGHG��8VLQJ�D�WKUHDG�VSHFLILF�KRRN�FDQ�GHJUDGH�SHUIRUPDQFH�IRU�D�VLQJOH�WKUHDG�EHFDXVH�LW�RSHUDWHV�IURP�ZLWKLQ�WKDW�WKUHDG�RQO\��$�V\VWHP�ZLGH�KRRN�UHVLGHV�LQ�D�'//�WKDW�LV�LQMHFWHG�LQWR�DOO�UXQQLQJ�SURFHVVHV��7KHUHIRUH��LI�WKH�KRRNV�ILOWHU�IXQFWLRQ�FRGH�SXWV�XQGXH�VWUDLQ�RQ�WKH�V\VWHP��HYHU\�WKUHDG�LQ�WKH�V\VWHP�FDQ�VORZ�WR�D�FUDZO��7KLV�FDXVHV�WKH�HQWLUH�V\VWHP�WR�DFW�VOXJJLVKO\��:KHQ�ZULWLQJ�ILOWHU�IXQFWLRQV�IRU�KRRNV�RI�HLWKHU�VFRSH��\RX�VKRXOG�H[LW�WKH�FRGH�DV�VRRQ�DV�SRVVLEOH��%\�WKLV�,�PHDQ�WKDW�LI�WKH�KRRN�LQWHUFHSWV�PHVVDJHV�WKDW�DUH�RI�QR�LQWHUHVW��\RX�VKRXOG�H[LW�WKH�ILOWHU�IXQFWLRQ�LPPHGLDWHO\��$V�ZH�VDZ�HDUOLHU��ZLQGRZV�DUH�FRQVWDQWO\�EHLQJ�ERPEDUGHG�ZLWK�PHVVDJHV��6SHQGLQJ�WLPH�SURFHVVLQJ�D�IHZ�RI�WKRVH�PHVVDJHV�PRVW�OLNHO\�ZLOO�QRW�SXW�D�VWUDLQ�RQ�WKH�V\VWHP��+RZHYHU��VSHQGLQJ�WLPH�SURFHVVLQJ�DOO�PHVVDJHV�ZLOO�FHUWDLQO\�SODFH�D�VWUDLQ�RQ�WKH�V\VWHP���7KHUH�LV�D�EXJ�XVLQJ�WKLV�KRRN�RQ�WKH�:LQGRZV����RSHUDWLQJ�V\VWHP��7KLV�EXJ�LV�GHVFULEHG�LQ�DUWLFOH�4��������,Q�VKRUW��ZKHQ�WKLV�KRRN�LV�LQVWDOOHG�DV�D�V\VWHP�ZLGH�KRRN�DQG�WKH�XVHU�SUHVVHV�WKH�$/7�(6&�NH\�FRPELQDWLRQ��WKH�'//�LV�LQMHFWHG�LQWR�WKH�.(51(/���'//�SURFHVV��:KHQ�WKH�KRRN�LV�UHOHDVHG��WKH�KRRN�'//�LV�QRW�UHPRYHG�IURP�WKH�.(51(/���'//�SURFHVV��7KH�RQO\�VROXWLRQ�LV�WR�UHVWDUW�WKH�PDFKLQH���

Page 293: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU�����:+B&$//:1'352&5(7�7KH�QH[W�ORJLFDO�FKRLFH�RI�KRRNV�WR�GLVFXVV�LV�WKH�:+B&$//:1'352&5(7�KRRN��7KLV�KRRN�LQWHUFHSWV�PHVVDJHV�QRW�RQO\�DIWHU�WKH�:+B&$//:1'352&�KRRN�KDV�LQWHUFHSWHG�WKH�PHVVDJH��EXW�DOVR�DIWHU�WKH�ZLQGRZ�SURFHGXUH�KDV�SURFHVVHG�WKH�PHVVDJH��7KLV�FKDSWHU�ZLOO�GLVFXVV�WKH�:+B&$//:1'352&5(7�KRRN�DQG�FRPSDUH�DQG�FRQWUDVW�LW�ZLWK�WKH�:+B&$//:1'352&�KRRN��ZKLFK�ZDV�GLVFXVVHG�LQ�&KDSWHU�����

�����+RZ�:+B&$//:1'352&5(7�:RUNV�

/LNH�WKH�:+B&$//:1'352&�KRRN��WKH�:+B&$//:1'352&5(7�KRRN�LV�XVHG�WR�LQWHUFHSW�PHVVDJHV�VHQW�WKURXJK�WKH�YDULRXV�6HQG0HVVDJH�IXQFWLRQ�W\SHV��+RZHYHU��:+B&$//:1'352&5(7�LQWHUFHSWV�LWV�PHVVDJHV�ODWHU�WKDQ�:+B&$//:1'352&�GRHV��ZKHUHDV�WKH�ODWWHU�LQWHUFHSWV�PHVVDJHV�EHIRUH�WKH\�DUH�SURFHVVHG�E\�WKHLU�ZLQGRZ�SURFHGXUH��WKH�IRUPHU�LQWHUFHSWV�PHVVDJHV�RQO\�DIWHU�WKH�ZLQGRZ�SURFHGXUH�KDV�SURFHVVHG�WKHP��$V�D�UHVXOW��\RX�RQFH�DJDLQ�FDQQRW�PRGLI\�RU�GLVFDUG�WKH�PHVVDJH�LQWHUFHSWHG�WKURXJK�WKLV�KRRN��LQ�WKLV�FDVH�EHFDXVH�PHVVDJH�SURFHVVLQJ�LV�ODUJHO\�FRPSOHWH���<RX�FDQ�XVH�WKLV�KRRN�WR�PRQLWRU�VHQW�PHVVDJHV��VLPLODU�WR�WKH�:+B&$//:1'352&�KRRN��+RZHYHU��WKH�:+B&$//:1'352&5(7�KRRN�SURYLGHV�H[WUD�LQIRUPDWLRQ�WKDW�:+B&$//:1'352&�GRHV�QRW��)LUVW��LW�PDNHV�DYDLODEOH�WKH�UHWXUQ�YDOXH�RI�WKH�FDOO�WR�WKH�6HQG0HVVDJH�IXQFWLRQ��6HFRQG��WKH�Z3DUDP�VSHFLILHV�ZKHWKHU�WKH�VHQW�PHVVDJH�RULJLQDWHV�IURP�WKH�VDPH�SURFHVV�LQ�ZKLFK�WKH�KRRN�LV�LQVWDOOHG��RU�IURP�DQRWKHU�SURFHVV��$Q�DSSOLFDWLRQ�FRXOG�XVH�WKLV�KRRN�WR�OLVWHQ�IRU�D�VSHFLILF�PHVVDJH�WKDW�LV�EURDGFDVW�IURP�DQRWKHU�DSSOLFDWLRQ�DQG�WDNH�VRPH�DFWLRQ�EDVHG�RQ�UHFHLYLQJ�WKDW�PHVVDJH���<RX�FDQ�XVH�WKLV�KRRN�DV�D�WKUHDG�VSHFLILF�KRRN��RU�\RX�FDQ�SODFH�LW�LQ�D�G\QDPLF�OLQN�OLEUDU\��'//��DQG�XVH�LW�DV�D�V\VWHP�ZLGH�KRRN��$�WKUHDG�VSHFLILF�KRRN�LQWHUFHSWV�DOO�PHVVDJHV�ZLWKLQ�WKH�WKUHDG�LQ�ZKLFK�LW�LV�LQVWDOOHG��:KHQ�D�KRRN�LV�LQVWDOOHG�DV�D�V\VWHP�ZLGH�KRRN��LW�KDV�WR�EH�SODFHG�LQ�D�'//��7KLV�'//�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�VR�WKDW�WKH�KRRN�FDQ�RSHUDWH�RQ�DOO�PHVVDJHV�LQ�WKH�V\VWHP��6HH�&KDSWHU���IRU�D�WKRURXJK�GLVFXVVLRQ�RI�WKLV�WRSLF���8VLQJ�WKH�:+B&$//:1'352&�DQG�:+B&$//:1'352&5(7�KRRNV�WRJHWKHU��\RX�KDYH�WKH�DELOLW\�WR�ZDWFK�IRU�VHQW�PHVVDJHV�DQG�GHWHUPLQH�LI�DQ\�RI�WKHLU�SDUDPHWHUV�ZHUH�PRGLILHG�E\�D�VXEFODVV�SURFHGXUH�RU�SRVVLEO\�E\�D�FRPSOHWHO\�GLIIHUHQW�KRRN�WKDW�LV�LQVWDOOHG��7KLV�LV�KRZ�LW�ZRXOG�RSHUDWH���

Page 294: Visual Basic - Subclassing and Hooking with VB & VB NET

��� 7KH�:+B&$//:1'352&�KRRN�FDSWXUHV�WKH�PHVVDJH��ZKHUH�WKH�PHVVDJH�SDUDPHWHU�YDOXHV�DUH�VWRUHG�LQ�WKH�DSSOLFDWLRQ���

��� 7KH�ZLQGRZ�SURFHGXUH�DQG�DQ\�VXEFODVV�ZLQGRZ�SURFHGXUHV�WKDW�PLJKW�KDYH�EHHQ�LQVWDOOHG�SURFHVV�WKH�PHVVDJH���

��� 7KH�PHVVDJH�LV�VHQW�WR�WKH�:+B&$//:1'352&5(7�KRRN��ZKHUH�WKH�PHVVDJH�SDUDPHWHUV�DUH�H[DPLQHG�DQG�FRPSDUHG�WR�WKH�RULJLQDO�SDUDPHWHUV�WKDW�ZHUH�VHQW�WR�WKH�:+B&$//:1'352&�KRRN��,I�WKH\�DUH�GLIIHUHQW��\RX�NQRZ�WKDW�VRPHZKHUH�LQ�WKH�ZLQGRZ�SURFHGXUH����RU�SHUKDSV�LQ�D�VXEFODVV�ZLQGRZ�SURFHGXUH����WKH�PHVVDJH�SDUDPHWHUV�ZHUH�PRGLILHG���

�������)LOWHU�)XQFWLRQ�'HILQLWLRQ�

7KH�ILOWHU�IXQFWLRQ�SURWRW\SH�IRU�WKLV�KRRN�LV�ZULWWHQ�DV�IROORZV���3XEOLF�)XQFWLRQ�:QG3URF5HW�%\9DO�X&RGH�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��B�� � � � O3DUDP�$V�&:35(76758&7��$V�/RQJ�,WV�SDUDPHWHUV�DUH��X&RGH

7KH�FRGH�WKH�V\VWHP�VHQGV�WR�WKLV�ILOWHU�IXQFWLRQ��7KH�+&B$&7,21�FRGH�LV�WKH�RQO\�KRRN�FRGH�WKDW�WKH�V\VWHP�VHQGV�WR�WKLV�ILOWHU�IXQFWLRQ��7KLV�FRGH�LV�GHILQHG�DV���3ULYDWH�&RQVW�+&B$&7,21� ���:KHQ�WKLV�FRGH�LV�VHQW�WR�WKH�ILOWHU�IXQFWLRQ��WKH�VHQW�PHVVDJH�FDQ�EH�SURFHVVHG��,I�+&B$&7,21�LV�QRW�SDVVHG��\RX�VKRXOG�VNLS�PHVVDJH�SURFHVVLQJ�DQG�FDOO�&DOO1H[W+RRN([�LPPHGLDWHO\���

Z3DUDP

6SHFLILHV�ZKLFK�SURFHVV�WKH�PHVVDJH�RULJLQDWHG�IURP��,I�LWV�YDOXH�LV����WKH�PHVVDJH�RULJLQDWHG�IURP�D�GLIIHUHQW�SURFHVV��,I�LWV�YDOXH�LV�]HUR��WKH�PHVVDJH�RULJLQDWHG�IURP�WKH�FXUUHQW�SURFHVV���

O3DUDP

+ROGV�D�SRLQWHU�WR�WKH�&:35(76758&7�VWUXFWXUH���7KH�UHWXUQ�YDOXH�IRU�WKLV�ILOWHU�IXQFWLRQ�VKRXOG�EH�WKH�UHWXUQ�YDOXH�RI�WKH�&DOO1H[W+RRN([�IXQFWLRQ��,I�WKLV�IXQFWLRQ�LV�QRW�FDOOHG��WKH�ILOWHU�IXQFWLRQ�VKRXOG�UHWXUQ�D�]HUR��,�GR�QRW�UHFRPPHQG�VNLSSLQJ�WKH�FDOO�WR�&DOO1H[W+RRN([��WKRXJK��)DLOLQJ�WR�FDOO�WKLV�IXQFWLRQ�ZLOO�IRUFH�RWKHU�ILOWHU�IXQFWLRQV�LQ�WKH�FKDLQ�WR�QRW�EH�FDOOHG���7KH�GHILQLWLRQ�IRU�WKH�X&RGH�SDUDPHWHU�LV�H[DFWO\�WKH�VDPH�IRU�WKLV�KRRN�DV�LW�LV�IRU�WKH�:+B&$//:1'352&�KRRN��7KH�Z3DUDP�DQG�O3DUDP�SDUDPHWHUV�RI�WKLV�KRRN�FRQWDLQ�GLIIHUHQW�LQIRUPDWLRQ�FRPSDUHG�WR�WKH�:+B&$//:1'352&�KRRN��7KH�:+B&$//:1'352&5(7�KRRN�XVHV�Z3DUDP�WR�GHWHUPLQH�ZKLFK�SURFHVV�WKH�PHVVDJH�RULJLQDWHG�IURP��7KH�:+B&$//:1'352&�KRRN�XVHV�LW�WR�GHWHUPLQH�ZKLFK�WKUHDG�WKLV�

Page 295: Visual Basic - Subclassing and Hooking with VB & VB NET

PHVVDJH�RULJLQDWHG�IURP��7KH�O3DUDP�SDUDPHWHU�IRU�HDFK�KRRN�FRQWDLQV�D�SRLQWHU�WR�D�VWUXFWXUH�VSHFLILF�WR�WKDW�KRRN���7KH�&:35(76758&7�VWUXFWXUH�WKDW�WKH�O3DUDP�SDUDPHWHU�SRLQWV�WR�LV�GHILQHG�DV�IROORZV���3XEOLF�7\SH�&:35(76758&7���������O5HVXOW�$V�/RQJ���������O3DUDP�$V�/RQJ���������Z3DUDP�$V�/RQJ���������PHVVDJH�$V�/RQJ���������KZQG�$V�/RQJ�(QG�7\SH�,W�KDV�WKH�IROORZLQJ�PHPEHUV��O5HVXOW

7KH�UHWXUQ�YDOXH�RI�WKH�ZLQGRZ�SURFHGXUH�DIWHU�SURFHVVLQJ�WKH�PHVVDJH�O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH�Z3DUDP

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH�PHVVDJH

7KH�PHVVDJH�LGHQWLILHU�KZQG

7KH�ZLQGRZ�KDQGOH�WKDW�WKH�PHVVDJH�LV�GLUHFWHG�WR�7KLV�VWUXFWXUH�LV�VLPLODU�WR�WKH�&:36758&7�VWUXFWXUH�WKDW�WKH�:+B&$//:1'352&�KRRN�XVHV��H[FHSW�WKDW�WKLV�VWUXFWXUH�FRQWDLQV�DQ�H[WUD�PHPEHU��O5HVXOW��%HFDXVH�WKH�KRRN�LQWHUFHSWV�WKH�PHVVDJH�DIWHU�WKH�ZLQGRZ�SURFHGXUH�UHWXUQV��WKLV�YDOXH�LV�DYDLODEOH���

�������/RFDWLRQ�RI�7KLV�+RRN�LQ�WKH�6\VWHP�

7KLV�KRRN�LV�ORFDWHG�DIWHU�WKH�ZLQGRZ�SURFHGXUH�ILQLVKHV�SURFHVVLQJ�WKH�VHQW�PHVVDJH��DV�)LJXUH������VKRZV��7KLV�KRRN�LQWHUFHSWV�WKH�PHVVDJH�IURP�LQVLGH�WKH�WKUHDG�WKDW�UHFHLYHG�WKH�VHQW�PHVVDJH���

)LJXUH�������7KH�ORFDWLRQ�RI�WKH�:+B&$//:1'352&5(7�IXQFWLRQ�LQ�WKH�PHVVDJLQJ�V\VWHP�

Page 296: Visual Basic - Subclassing and Hooking with VB & VB NET

�����$�7KUHDG�6SHFLILF�([DPSOH�

7R�EHWWHU�LOOXVWUDWH�WKLV�KRRNV�IXQFWLRQ�DQG�SRVLWLRQ�LQ�WKH�PHVVDJLQJ�V\VWHP��,�ZLOO�PRGLI\�WKH�WKUHDG�VSHFLILF�H[DPSOH�IRU�WKH�:+B&$//:1'352&�KRRN�WR�LQFRUSRUDWH�WKH�:+B&$//:1'352&5(7�KRRN��$V�)LJXUH������VKRZV��WKH�LQWHUIDFH�LV�VLPLODU�WR�WKH�H[DPSOH�LQ�&KDSWHU����H[FHSW�IRU�WKH�RXWSXW���

)LJXUH�������$�VFUHHQVKRW�RI�WKH�:+B&$//:1'352&5(7�H[DPSOH�DSSOLFDWLRQ�

Page 297: Visual Basic - Subclassing and Hooking with VB & VB NET

7DEOH������GHILQHV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���7DEOH�������1RQGHIDXOW�3URSHUW\�9DOXHV�IRU�WKH�)RUP�DQG�,WV�&RQWUROV��&RQWURO� 3URSHUW\� 9DOXH�

)RUP� &DSWLRQ� :+B&$//:1'352&�+RRN�7HVW�FPG6HQG0VJ� &DSWLRQ� 6HQG0VJ�FPG6HQG0VJ72� &DSWLRQ� 6HQG0VJ72�FPG3RVW0HVVDJH� &DSWLRQ� 3RVW0HVVDJH�FPG3RVW7KUHDG0VJ� &DSWLRQ� 3RVW7KUHDG0VJ�FPG6HQG0VJ&%� &DSWLRQ� 6HQG0VJ&%�FPG%URDGFDVW0VJ� &DSWLRQ� %URDGFDVW0VJ�FPG6HQG'OJ0VJ� &DSWLRQ� 6HQG'OJ0VJ�FPG6HQG0VJ1RWLI\� &DSWLRQ� 6HQG0VJ1RWLI\�)UDPH�� &DSWLRQ� &DOO:QG3URF�7H[W�� 0XOWL/LQH� 7UXH�7KH�FRGH�IRU�WKLV�H[DPSOH�LV�YHU\�VLPLODU�WR�WKH�FRGH�IRU�WKH�:+B&$//:1'352&�H[DPSOH��,�ZLOO�IRFXV�WKH�IROORZLQJ�GLVFXVVLRQ�RQ�WKH�FKDQJHV�WR�WKH�FRGH��VWDUWLQJ�ZLWK�WKH�0RGXOH��EDV�PRGXOH���$�VLQJOH�SULYDWH�PHPEHU�YDULDEOH��E3URF5HW+RRN��ZDV�DGGHG�WR�WKH�FRGH��%$6��PRGXOH�WR�KROG�WKH�KRRN�KDQGOH�IRU�WKH�:+B&$//:1'352&5(7�KRRN��7KH�SXEOLF�DQG�PRGXOH�OHYHO�YDULDEOHV�GHFODUHG�LQ�WKH�%$6�PRGXOH�DUH�QRZ���3ULYDWH�K3URF5HW+RRN�$V�/RQJ�3ULYDWH�K3URF+RRN�$V�/RQJ��3XEOLF�,V+RRNHG�$V�%RROHDQ�7KH�6HW+RRNV�IXQFWLRQ��ZKLFK�LV�VKRZQ�LQ�([DPSOH�������DGGV�D�OLQH�RI�FRGH�WKDW�FDOOV�6HW:LQGRZV+RRN([�WR�VHW�WKH�:+B&$//:1'352&5(7�KRRN���

Page 298: Visual Basic - Subclassing and Hooking with VB & VB NET

([DPSOH�������7KH�6HW+RRNV�)XQFWLRQ�WR�,QVWDOO�WKH�:+B&$//:1'352&5(7�+RRN��

3XEOLF�6XE�6HW+RRNV���������,I�,V+RRNHG�7KHQ���������0VJ%R[��'RQW�KRRN�&$//:1'352&�WZLFH�RU�\RX�ZLOO�EH�XQDEOH�WR�XQKRRN�LW�������(OVH���������K3URF+RRN� �6HW:LQGRZV+RRN([�:+B&$//:1'352&��$GGUHVV2I�:QG3URF�����B���������������������$SS�7KUHDG,'����������K3URF5HW+RRN� �6HW:LQGRZV+RRN([�:+B&$//:1'352&5(7��$GGUHVV2I�:QG3URF5HW��B���������������������������$SS�7KUHDG,'����������,V+RRNHG� �7UXH�����(QG�,I�(QG�6XE�7KH�5HPRYH+RRNV�IXQFWLRQ��ZKLFK�LV�VKRZQ�LQ�([DPSOH�������DGGV�D�OLQH�RI�FRGH�WKDW�FDOOV�8QKRRN:LQGRZV+RRN([�WR�UHPRYH�WKH�:+B&$//:1'352&5(7�KRRN���

([DPSOH�������7KH�5HPRYH+RRNV�)XQFWLRQ�WR�5HPRYH�WKH�:+B&$//:1'352&5(7�+RRN��

3XEOLF�6XE�5HPRYH+RRNV���������'LP�WHPS�$V�/RQJ�����WHPS� �8QKRRN:LQGRZV+RRN([�K3URF5HW+RRN������WHPS� �8QKRRN:LQGRZV+RRN([�K3URF+RRN������,V+RRNHG� �)DOVH�(QG�6XE�7KH�:QG3URF5HW�IXQFWLRQ��ZKLFK�LV�VKRZQ�LQ�([DPSOH�������LV�WKH�ILOWHU�IXQFWLRQ�IRU�WKH�:+B&$//:1'352&5(7�KRRN��7KLV�IXQFWLRQ�RXWSXWV�WKH�QDPH�RI�WKH�KRRN�IXQFWLRQ��WKH�Z3DUDP�YDOXH��DQG�WKH�YDOXHV�RI�WKH�&:35(76758&7�VWUXFWXUH��$�FDOO�LV�PDGH�WR�&DOO1H[W+RRN([�DW�WKH�HQG�RI�WKH�IXQFWLRQ��DQG�WKH�YDOXH�WKDW�WKLV�IXQFWLRQ�UHWXUQV�LV�SDVVHG�RQ�DV�WKH�UHWXUQ�YDOXH�RI�WKH�ILOWHU�IXQFWLRQ���

([DPSOH�������7KH�:QG3URF5HW�)LOWHU�)XQFWLRQ�IRU�WKH�:0B&$//:1'352&5(7+RRN��

3XEOLF�)XQFWLRQ�:QG3URF5HW�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B����������������������������O3DUDP�$V�&:35(76758&7��$V�/RQJ����,I�O3DUDP�PHVVDJH� �:0B18//�7KHQ�������6HOHFW�&DVH�X&RGH����������&DVH�+&B$&7,21�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���&$//:1'352&5(7��B��������������������������������������+:1'����+H[��O3DUDP�KZQG��B�

Page 299: Visual Basic - Subclassing and Hooking with VB & VB NET

�������������������������������������:3$5$0����+H[��O3DUDP�Z3DUDP��B��������������������������������������/3$5$0����+H[��O3DUDP�O3DUDP��B��������������������������������������5(79$/����+H[��O3DUDP�O5HVXOW��B��������������������������������������&8557+5($'����+H[��Z3DUDP��B��������������������������������������,Q60����,Q6HQG0HVVDJH������YE1HZ/LQH��������������'R(YHQWV����������&DVH�(OVH�������(QG�6HOHFW����(QG�,I���������:QG3URF5HW� �&DOO1H[W+RRN([�K3URF5HW+RRN��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KH�:QG3URF�IXQFWLRQ�VKRZQ�LQ�([DPSOH������LV�WKH�ILOWHU�IXQFWLRQ�IRU�WKH�:+B&$//:1'352&�KRRN���

([DPSOH�������7KH�:QG3URF�)LOWHU�)XQFWLRQ�IRU�WKH�:0B&$//:1'352&�+RRN��

3XEOLF�)XQFWLRQ�:QG3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B�������������������������O3DUDP�$V�&:36758&7��$V�/RQJ����,I�O3DUDP�PHVVDJH� �:0B18//�7KHQ�������6HOHFW�&DVH�X&RGH����������&DVH�+&B$&7,21�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���&$//:1'352&��B��������������������������������������+:1'����+H[��O3DUDP�KZQG��B��������������������������������������:3$5$0����+H[��O3DUDP�Z3DUDP��B��������������������������������������/3$5$0����+H[��O3DUDP�O3DUDP��B��������������������������������������&8557+5($'����Z3DUDP�B��������������������������������������,Q60����,Q6HQG0HVVDJH������YE1HZ/LQH�������������'R(YHQWV����������&DVH�(OVH�������(QG�6HOHFW����(QG�,I���������:QG3URF� �&DOO1H[W+RRN([�K3URF+RRN��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KH�'XPP\&DOOEDFN�IXQFWLRQ�VKRZQ�LQ�([DPSOH������LV�EDVLFDOO\�D�VWXE�IXQFWLRQ�IRU�6HQG0HVVDJH&DOOEDFN��,W�GRHV�QR�SURFHVVLQJ��LWV�RQO\�UHDVRQ�IRU�H[LVWLQJ�LV�WR�DOORZ�WKH�UHFHLYLQJ�WKUHDG�WR�SURSHUO\�FDOO�EDFN�WR�D�FDOOEDFN�IXQFWLRQ���

([DPSOH�������7KH�&DOOEDFN�)XQFWLRQ�IRU�WKH�6HQG0HVVDJH&DOOEDFN�$3,�)XQFWLRQ��

Page 300: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�6XE�'XPP\&DOOEDFN�%\9DO�KZQG�$V�/RQJ��%\9DO�X0VJ�$V�/RQJ��B�� � � � %\9DO�GZ'DWD�$V�/RQJ��%\9DO�O5HVXOW�$V�/RQJ������'R�QRWKLQJ�DQG�UHWXUQ�(QG�6XE�([DPSOH������VKRZV�WKH�FRGH�FRQWDLQHG�LQ�WKH�)RUP��IUP�PRGXOH���

([DPSOH�������6RXUFH�&RGH�IRU�WKH�)RUP��IUP�0RGXOH��

2SWLRQ�([SOLFLW��3ULYDWH�6XE�FPG+RRNB&OLFN���������7H[W��7H[W� ��������&DOO�6HW+RRNV�(QG�6XE��3ULYDWH�6XE�FPG8Q+RRNB&OLFN���������&DOO�5HPRYH+RRNV�(QG�6XE��3ULYDWH�6XE�FPG6HQG0VJ1RWLI\B&OLFN���������&DOO�6HQG1RWLI\0HVVDJH�)RUP��KZQG��:0B18//��������(QG�6XE��3ULYDWH�6XE�FPG6HQG0VJB&OLFN���������&DOO�6HQG0HVVDJH�)RUP��KZQG��:0B18//��������������+:1'B7230267�(QG�6XE��3ULYDWH�6XE�FPG6HQG0VJ72B&OLFN���������'LP�UHWYDO�$V�/RQJ�����&DOO�6HQG0HVVDJH7LPHRXW�)RUP��KZQG��:0B18//��������6072B%/2&.��������B�����������������������������UHWYDO��(QG�6XE��3ULYDWH�6XE�FPG3RVW0HVVDJHB&OLFN���������&DOO�3RVW0HVVDJH�)RUP��KZQG��:0B18//��������(QG�6XE��3ULYDWH�6XE�FPG6HQG0VJ&%B&OLFN���������&DOO�6HQG0HVVDJH&DOOEDFN�)RUP��KZQG��:0B18//��������B������������������������������$GGUHVV2I�'XPP\&DOOEDFN�����

Page 301: Visual Basic - Subclassing and Hooking with VB & VB NET

(QG�6XE��3ULYDWH�6XE�FPG%URDGFDVW0VJB&OLFN���������'LP�5HW,QGLFDWRU�$V�/RQJ�����&DOO�%URDGFDVW6\VWHP0HVVDJH�%6)B127,0(287,)127+81*��5HW,QGLFDWRU��B���������������������������������:0B18//�������������0VJ%R[��7KH�UHWXUQ�YDOXH�IRU�%URDGFDVW6\VWHP0HVVDJH�����+H[��5HW,QGLFDWRU��(QG�6XE��3ULYDWH�6XE�FPG6HQG'OJ0VJB&OLFN���������&DOO�6HQG'OJ,WHP0HVVDJH�)RUP��KZQG�����:0B18//���������� 7KH�FRQWURO�,'�FDQ�EH�IRXQG�E\�XVLQJ�6S\���(QG�6XE��3ULYDWH�6XE�FPG3RVW7KUHDG0VJB&OLFN���������&DOO�3RVW7KUHDG0HVVDJH�$SS�7KUHDG,'��:0B18//��������(QG�6XE��������������&/($183�������������3ULYDWH�6XE�)RUPB4XHU\8QORDG�&DQFHO�$V�,QWHJHU��8QORDG0RGH�$V�,QWHJHU������,I�,V+RRNHG�7KHQ�����&DQFHO� �������0VJ%R[��8QKRRN�EHIRUH�FORVLQJ��RU�WKH�DSSOLFDWLRQ�ZLOO�FUDVK�������(QG�,I�(QG�6XE�:KHQ�\RX�FOLFN�WKH�KRRN�EXWWRQ��WKH�:+B&$//:1'352&�DQG�:+B&$//:1'352&5(7�KRRNV�DUH�ERWK�LQVWDOOHG��&OLFNLQJ�HLWKHU�WKH�3RVW0HVVDJH�RU�WKH�3RVW7KUHDG0VJ�EXWWRQV�GRHV�QRW�SURGXFH�DQ\�RXWSXW��2QFH�DJDLQ��WKLV�KRRN�LQWHUFHSWV�RQO\�VHQW�PHVVDJHV��QRW�SRVWHG�PHVVDJHV���:KHQ�\RX�FOLFN�DQ\�RI�WKH�6HQG0HVVDJH�EXWWRQV��WKH�RXWSXW�WR�WKH�WH[W�ER[�LV�DV�IROORZV���&$//:1'352&�&$//:1'352&5(7�7KLV�LV�WKH�H[SHFWHG�RXWSXW��:H�FDQ�VHH�WKLV�E\�ORRNLQJ�DW�WKH�ORFDWLRQV�RI�HDFK�KRRN�LQ�WKH�PHVVDJLQJ�V\VWHP���,QLWLDOO\��WKH�6HQG0HVVDJH�IXQFWLRQ�LV�FDOOHG��7KLV�IXQFWLRQ�SDVVHV�D�PHVVDJH�GLUHFWO\�WR�WKH�PHVVDJH�ORRS�RI�WKH�WKUHDG�WKDW�FRQWDLQV�WKH�GHVWLQDWLRQ�ZLQGRZ��7KH�:+B&$//:1'352&�KRRN�LV�FDOOHG�EHIRUH�WKH�PHVVDJH�LV�SDVVHG�RQ�WR�WKH�ZLQGRZ�SURFHGXUH��WKH�RSHUDWLQJ�

Page 302: Visual Basic - Subclassing and Hooking with VB & VB NET

V\VWHP�GHWHUPLQHV�WKH�ORFDWLRQ��VHH�&KDSWHU���IRU�PRUH�LQIRUPDWLRQ���$IWHU�WKH�:+B&$//:1'352&�KRRN�UHWXUQV��WKH�PHVVDJH�LV�SDVVHG�RQ�WR�WKH�ZLQGRZ�SURFHGXUH��,I�WKH�ZLQGRZ�SURFHGXUH�KDSSHQV�WR�EH�VXEFODVVHG��WKH�PHVVDJH�LV�ILUVW�SDVVHG�WR�WKH�VXEFODVV�IXQFWLRQ�V��DQG�WKHQ�RQ�WR�WKH�ZLQGRZ�SURFHGXUH��:KHQ�WKH�ZLQGRZ�SURFHGXUH�LV�ILQLVKHG�SURFHVVLQJ�WKH�PHVVDJH��WKH�IXQFWLRQ�UHWXUQV�DQG�WKH�:+B&$//:1'352&5(7�KRRN�WKHQ�LQWHUFHSWV�WKH�PHVVDJH�DQG�LWV�UHWXUQ�YDOXH��$IWHU�WKLV�KRRN�LV�ILQLVKHG�SURFHVVLQJ��LW�SDVVHV�WKH�PHVVDJH�RQ�WR�WKH�QH[W�KRRN�LQ�WKH�KRRN�FKDLQ��LI�RQH�H[LVWV��$IWHU�HDFK�KRRN�KDV�SURFHVVHG�WKH�PHVVDJH��FRQWURO�LV�UHWXUQHG�WR�WKH�6HQG0HVVDJH�IXQFWLRQ��7KH�6HQG0HVVDJH�IXQFWLRQ�WKHQ�UHWXUQV�FRQWURO�WR�WKH�FRGH�WKDW�FDOOHG�LW����LQ�WKLV�FDVH��WKH�9LVXDO�%DVLF��9%��FRGH�LQ�WKH�)RUP��IUP�PRGXOH���7R�IXUWKHU�LQYHVWLJDWH�WKH�RUGHU�RI�HYHQWV�IRU�ERWK�KRRNV��PRGLI\�WKH�DERYH�IXQFWLRQV�DV�IROORZV��)LUVW�PRGLI\�WKH�6HQG0HVVDJH�EXWWRQ��&RPPDQG�B&OLFN��WR�DSSHDU�DV�VKRZQ�LQ�([DPSOH�������PRGLILHG�FRGH�LV�VKRZQ�LQ�EROGIDFH���

([DPSOH�������7KH�0RGLILHG�(YHQW�+DQGOHU�IRU�WKH�6HQG0VJ�%XWWRQ��

3ULYDWH�6XE�&RPPDQG�B&OLFN���������&DOO�6HQG0HVVDJH�7H[W��KZQG��:0B6(77(;7������6HQW�7H[W���(QG�6XE�&DOOLQJ�6HQG0HVVDJH�LQ�WKLV�PDQQHU�ZLOO�VHQG�WKH�WH[W��6HQW�7H[W��WR�WKH�7H[W��WH[W�ER[���1H[W��PRGLI\�WKH�:QG3URF�IXQFWLRQ�VR�WKDW�LW�DSSHDUV�DV�VKRZQ�LQ�([DPSOH�������RQFH�DJDLQ��FKDQJHG�OLQHV�DUH�VKRZQ�LQ�EROGIDFH���

([DPSOH�������7KH�0RGLILHG�:QG3URF�)XQFWLRQ��

3XEOLF�)XQFWLRQ�:QG3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B�������������������������O3DUDP�$V�&:36758&7��$V�/RQJ�� ,I�O3DUDP�PHVVDJH� �:0B6(77(;7�$QG�O3DUDP�KZQG� �)RUP��7H[W��KZQG�7KHQ���������6HOHFW�&DVH�X&RGH�������������&DVH�+&B$&7,21�����������������0VJ%R[��,QVLGH�WKH�:+B&$//:1'352&�KRRN���������������&DVH�(OVH���������(QG�6HOHFW�����(QG�,I����������:QG3URF� �&DOO1H[W+RRN([�K3URF+RRN��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KLV�ILOWHU�IXQFWLRQ�ZDLWV�IRU�WKH�:0B6(77(;7�PHVVDJH�WR�EH�VHQW�WR�WKH�7H[W��WH[W�ER[��:KHQ�WKLV�PHVVDJH�LV�VHQW��WKH�ILOWHU�IXQFWLRQ�GLVSOD\V�D�PHVVDJH�ER[�ZLWK�WKH�WH[W��,QVLGH�WKH�:+B&$//:1'352&�KRRN���:H�ZRXOG�QRW�ZDQW�WR�WU\�WR�SODFH�D�PHVVDJH�LQ�WKH�WH[W�ER[�LQ�

Page 303: Visual Basic - Subclassing and Hooking with VB & VB NET

WKLV�IXQFWLRQ�EHFDXVH�WKLV�ZRXOG�DXWRPDWLFDOO\�FDXVH�D�:0B6(77(;7�PHVVDJH�WR�EH�VHQW�WR�WKH�WH[W�ER[�ZLWK�WKH�UHOHYDQW�WH[W�LQVLGH�RI�WKH�PHVVDJH�VWUXFWXUH��7KH�ILOWHU�IXQFWLRQ�ZRXOG�WKHQ�EH�UH�HQWHUHG�ZKHQ�LW�GHWHFWHG�WKLV�PHVVDJH��7KHUHIRUH��WKH�IXQFWLRQ�ZRXOG�QHYHU�UHWXUQ�DQG�ZRXOG�HYHQWXDOO\�*3)�ZLWK�D�VWDFN�RYHUIORZ��8VLQJ�WKH�PHVVDJH�ER[�FLUFXPYHQWV�WKLV�SUREOHP���)LQDOO\��\RX�VKRXOG�PRGLI\�WKH�:QG3URF5HW�IXQFWLRQ�WR�DSSHDU�DV�VKRZQ�LQ�([DPSOH�������PRGLILHG�OLQHV�DUH�LQ�EROGIDFH����

([DPSOH�������7KH�0RGLILHG�:QG3URF5HW�)XQFWLRQ��

3XEOLF�)XQFWLRQ�:QG3URF5HW�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B����������������������������O3DUDP�$V�&:35(76758&7��$V�/RQJ��� ,I�O3DUDP�PHVVDJH� �:0B6(77(;7�$QG�O3DUDP�KZQG� �)RUP��7H[W��KZQG�7KHQ���������6HOHFW�&DVH�X&RGH�������������&DVH�+&B$&7,21�����������������0VJ%R[��,QVLGH�WKH�:+B&$//:1'352&5(7�KRRN���������������&DVH�(OVH���������(QG�6HOHFW�����(QG�,I����������:QG3URF5HW� �&DOO1H[W+RRN([�K3URF5HW+RRN��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�2QFH�DJDLQ��ZH�XVH�WKH�PHVVDJH�ER[�WR�GHFODUH�WKDW�WKH�FRGH�LQVLGH�WKH�:+B&$//:1'352&5(7�ILOWHU�IXQFWLRQ�LV�EHLQJ�H[HFXWHG���$IWHU�\RX�PDNH�WKHVH�FKDQJHV��FRPSLOH�WKH�DSSOLFDWLRQ�DQG�H[HFXWH�LW��%HIRUH�JRLQJ�DQ\�IXUWKHU��\RX�QHHG�WR�VWDUW�6S\���DQG�VHW�LW�WR�ZDWFK�IRU�DOO�:0B6(77(;7�PHVVDJHV�VHQW�WR�WKLV�DSSOLFDWLRQV�7H[W��WH[W�ER[���&OLFN�WKH�KRRN�EXWWRQ�RQ�WKH�DSSOLFDWLRQ�WR�LQVWDOO�ERWK�KRRNV��1H[W��FOLFN�WKH�6HQG0HVVDJH�EXWWRQ��7KH�HYHQWV��DV�WKH\�RFFXU��KDSSHQ�DV�IROORZV���

��� 7KH�6HQG0HVVDJH�IXQFWLRQ�LV�FDOOHG��VHQGLQJ�WKH�:0B6(77(;7�PHVVDJH�ZLWK�WKH�VWULQJ��6HQW�7H[W��WR�WKH�7H[W��WH[W�ER[��,Q�)LJXUH�������6S\���VKRZV�WKDW�WKH�:0B6(77(;7�PHVVDJH�KDV�EHHQ�VHQW�WR�WKH�GHVWLQDWLRQ�ZLQGRZ��7KH�WKLUG�LWHP�GLVSOD\HG�LQ�6S\���LV�DQ�6��PHDQLQJ�WKDW�WKH�6HQG0HVVDJH�IXQFWLRQ�KDV�VHQW�WKH�PHVVDJH��$Q�5�PHDQV�WKDW�WKH�6HQG0HVVDJH�IXQFWLRQ�KDV�UHWXUQHG���

��� 7KH�:+B&$//:1'352&�IXQFWLRQ�LQWHUFHSWV�WKH�:0B6(77(;7�PHVVDJH�EHIRUH�LW�JHWV�WR�WKH�ZLQGRZ�SURFHGXUH�RI�WKH�GHVWLQDWLRQ�ZLQGRZ���

��� 7KH�:+B&$//:1'352&�IXQFWLRQ�GLVSOD\V�WKH�PHVVDJH�ER[�ZLWK�WKH�WH[W��,QVLGH�WKH�:+B&$//:1'352&�KRRN����

Page 304: Visual Basic - Subclassing and Hooking with VB & VB NET

��� 7KH�:+B6(77(;7�PHVVDJH�LV�SDVVHG�RQ�WR�DQ\�RWKHU�:+B&$//:1'352&�KRRNV�LQ�WKLV�KRRN�FKDLQ���

��� 7KH�PHVVDJH�LV�VHQW�RQ�WR�WKH�ZLQGRZ�SURFHGXUH�WR�EH�SURFHVVHG��3URFHVVLQJ�WKLV�PHVVDJH�VHQGV�WKH��6HQW�7H[W��VWULQJ�WR�WKH�7H[W��WH[W�ER[��DV�)LJXUH������VKRZV���

��� $IWHU�H[LWLQJ�WKH�ZLQGRZ�SURFHGXUH��WKH�:0B6(77(;7�PHVVDJH�LV�VHQW�WR�WKH�:+B&$//:1'352&5(7�KRRN���

��� 7KH�ILOWHU�IXQFWLRQ�IRU�WKH�:+B&$//:1'352&5(7�KRRN�GLVSOD\V�D�PHVVDJH�ER[�ZLWK�WKH�VWULQJ��,QVLGH�WKH�:+B&$//:1'352&5(7�KRRN���([DPLQLQJ�6S\���UHYHDOV�WKDW�WKH�6HQG0HVVDJH�IXQFWLRQ�KDV�QRW�UHWXUQHG�DW�WKLV�SRLQW���

��� 7KH�:+B6(77(;7�PHVVDJH�LV�SDVVHG�RQ�WR�DQ\�RWKHU�:+B&$//:1'352&5(7�KRRNV�LQ�WKLV�KRRN�FKDLQ���

��� )LQDOO\��WKH�6HQG0HVVDJH�IXQFWLRQ�UHWXUQV�FRQWURO�WR�WKH�FRGH�WKDW�H[HFXWHG�LW��$V�)LJXUH������VKRZV��6S\���VKRZV�WKDW�WKH�6HQG0HVVDJH�IXQFWLRQ�KDV�LQGHHG�UHWXUQHG���

)LJXUH�������7KH�VWDWH�RI�WKH�:0B6(77(;7�PHVVDJH�EHIRUH�WKH�:+B&$//:1'352&�KRRN�ILQLVKHV�SURFHVVLQJ�LW�

)LJXUH�������7KH�RXWSXW�RI�WKH�DSSOLFDWLRQ�DIWHU�WKH�ZLQGRZ�SURFHGXUH�KDV�SURFHVVHG�WKH�:0B6(77(;7�PHVVDJH�

Page 305: Visual Basic - Subclassing and Hooking with VB & VB NET

)LJXUH�������7KH�VWDWH�RI�WKH�:0B6(77(;7�PHVVDJH�EHIRUH�WKH�:+B&$//:1'352&5(7�KRRN�ILQLVKHV�SURFHVVLQJ�LW�

�����&DYHDWV�

$V�ZLWK�WKH�:+B&$//:1'352&�KRRN��WKH�PDLQ�WKLQJ�WR�UHPHPEHU�LV�WKDW�WKLV�KRRN�FDSWXUHV�RQO\�PHVVDJHV�WKDW�DUH�VHQW�XVLQJ�WKH�6HQG0HVVDJH�IXQFWLRQ��7KLV�IXQFWLRQ�ZLOO�QRW�FDSWXUH�PHVVDJHV�WKDW�DUH�SRVWHG�WR�WKH�PHVVDJH�TXHXH�XVLQJ�WKH�3RVW0HVVDJH�IXQFWLRQ��,Q�WKH�FDVH�RI�SRVWHG�PHVVDJHV��\RX�VKRXOG�XVH�WKH�:+B*(70(66$*(�KRRN��WKLV�KRRN�LV�GLVFXVVHG�LQ�&KDSWHU������7KH�RWKHU�WKLQJ�WR�UHPHPEHU�LV�WKDW�WKLV�KRRN�FDSWXUHV�PHVVDJHV�DIWHU�WKH�ZLQGRZ�SURFHGXUH�KDV�SURFHVVHG�WKH�PHVVDJH��7KH�:+B&$//:1'352&�KRRN�FDSWXUHV�WKH�VHQW�PHVVDJH�EHIRUH�WKH�ZLQGRZ�SURFHGXUH�KDV�SURFHVVHG�LW���7DNH�FDUH�ZKHQ�XVLQJ�DQ\�KRRN�EHFDXVH�SHUIRUPDQFH�FDQ�EH�VHULRXVO\�GHJUDGHG��8VLQJ�D�WKUHDG�VSHFLILF�KRRN�FDQ�GHJUDGH�SHUIRUPDQFH�IRU�D�VLQJOH�WKUHDG�EHFDXVH�LW�RSHUDWHV�IURP�ZLWKLQ�WKDW�WKUHDG�RQO\��$�V\VWHP�ZLGH�KRRN�UHVLGHV�LQ�D�'//�WKDW�LV�LQMHFWHG�LQWR�DOO�UXQQLQJ�SURFHVVHV��7KHUHIRUH��LI�WKH�KRRNV�ILOWHU�IXQFWLRQ�FRGH�SXWV�XQGXH�VWUDLQ�RQ�WKH�V\VWHP��HYHU\�WKUHDG�LQ�WKH�V\VWHP�FDQ�VORZ�WR�D�FUDZO��7KLV�FDXVHV�WKH�HQWLUH�V\VWHP�WR�DFW�VOXJJLVKO\��:KHQ�ZULWLQJ�ILOWHU�IXQFWLRQV�IRU�KRRNV�RI�HLWKHU�VFRSH��\RX�VKRXOG�H[LW�WKH�FRGH�DV�HDUO\�DV�SRVVLEOH��%\�WKLV�,�PHDQ�WKDW�LI�WKH�KRRN�LQWHUFHSWV�PHVVDJHV�WKDW�DUH�RI�QR�LQWHUHVW��\RX�VKRXOG�H[LW�WKH�ILOWHU�IXQFWLRQ�LPPHGLDWHO\���

Page 306: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU�����:+B*(70(66$*(�$W�ILUVW�JODQFH��WKH�:+B*(70(66$*(�KRRN�VHHPV�WR�EH�VLPLODU�WR�WKH�:+B&$//:1'352&�DQG�:+B&$//:1'352&5(7�KRRNV��$V�ZH�VKDOO�VHH��WKRXJK��WKLV�KRRN�LV�YHU\�GLIIHUHQW�IURP�WKH�RWKHU�WZR�KRRNV��7KLV�FKDSWHU�ZLOO�IRFXV�RQ�WKH�:+B*(70(66$*(�KRRN��ZKLOH�DOVR�FRPSDULQJ�DQG�FRQWUDVWLQJ�LW�ZLWK�WKH�:+B&$//:1'352&�DQG�:+B&$//:1'352&5(7�KRRNV��

�����+RZ�:+B*(70(66$*(�:RUNV�

<RX�XVH�WKH�:+B*(70(66$*(�KRRN�WR�LQWHUFHSW�RQO\�SRVWHG��DQG�QRW�VHQW��PHVVDJHV��8VLQJ�WKLV�KRRN��\RX�DOVR�FDQ�PRGLI\�D�PHVVDJH�EHIRUH�WKH�ZLQGRZ�SURFHGXUH�SURFHVVHV�LW��7KHVH�DUH�WKH�WZR�PDLQ�GLIIHUHQFHV�EHWZHHQ�WKLV�KRRN�DQG�WKH�:+B&$//:1'352&�DQG�:+B&$//:1'352&5(7�KRRNV��7KH�:+B&$//:1'352&�DQG�:+B&$//:1'352&5(7�KRRNV�RQO\�LQWHUFHSW�VHQW�PHVVDJHV�DQG�FDQQRW�PRGLI\�WKH�PHVVDJHV�WKH\�LQWHUFHSW��<RX�FDQ�XVH�WKLV�KRRN�DV�D�WKUHDG�VSHFLILF�KRRN��RU�\RX�FDQ�SODFH�LW�LQ�D�G\QDPLF�OLQN�OLEUDU\��'//��DQG�XVH�LW�DV�D�V\VWHP�ZLGH�KRRN��$�WKUHDG�VSHFLILF�KRRN�LQWHUFHSWV�DOO�PHVVDJHV�ZLWKLQ�WKH�WKUHDG�LQ�ZKLFK�LW�LV�LQVWDOOHG��:KHQ�\RX�LQVWDOO�D�KRRN�DV�D�V\VWHP�ZLGH�KRRN��\RX�PXVW�SODFH�LW�LQ�D�'//��7KLV�'//�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�VR�WKDW�WKH�KRRN�FDQ�RSHUDWH�RQ�DOO�PHVVDJHV�LQ�WKH�V\VWHP�&KDSWHU���SURYLGHV�D�WKRURXJK�GLVFXVVLRQ�RI�WKLV�FRQFHSW��%HIRUH�H[SODLQLQJ�KRZ�WKLV�KRRN�RSHUDWHV��,�QHHG�WR�GLVFXVV�ERWK�WKH�*HW0HVVDJH�DQG�WKH�3HHN0HVVDJH�IXQFWLRQV��*HW0HVVDJH�UHWULHYHV�D�VLQJOH�PHVVDJH�IURP�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�LQ�ZKLFK�WKLV�IXQFWLRQ�ZDV�FDOOHG��7KLV�IXQFWLRQ�LV�XVHG�PRVWO\�LQ�D�PHVVDJH�ORRS�IRU�DQ�DSSOLFDWLRQ��*HW0HVVDJH�LV�GHILQHG�DV�IROORZV��3XEOLF�'HFODUH�)XQFWLRQ�*HW0HVVDJH�/LE��XVHU����$OLDV��*HW0HVVDJH$��B����������OS0VJ�$V�06*��%\9DO�KZQG�$V�/RQJ��%\9DO�Z0VJ)LOWHU0LQ�$V�/RQJ��B���������%\9DO�Z0VJ)LOWHU0D[�$V�/RQJ��$V�/RQJ�*HW0HVVDJH�KDV�WKH�IROORZLQJ�SDUDPHWHUV��OS0VJ

$�/RQJ�SRLQWHU�WR�DQ�06*�VWUXFWXUH�WKDW�UHFHLYHV�WKH�PHVVDJH��KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�ZKRVH�PHVVDJHV�DUH�WR�EH�UHDG�IURP�WKH�TXHXH��,I�WKLV�LV�]HUR��DOO�PHVVDJHV�ZLOO�EH�UHDG��

Z0VJ)LOWHU0LQ

7KH�PLQLPXP�PHVVDJH�YDOXH�WKDW�LV�UHDG�IURP�WKH�PHVVDJH�TXHXH��

Page 307: Visual Basic - Subclassing and Hooking with VB & VB NET

Z0VJ)LOWHU0D[

7KH�PD[LPXP�PHVVDJH�YDOXH�WKDW�LV�UHWULHYHG�IURP�WKH�PHVVDJH�TXHXH��,I�WKLV�YDOXH�LV�]HUR��DOO�PHVVDJHV�VWDUWLQJ�ZLWK�WKH�Z0VJ)LOWHU0LQ�YDOXH�DUH�UHDG�IURP�WKH�PHVVDJH�TXHXH��

,I�DQ�HUURU�RFFXUV��WKLV�IXQFWLRQ�ZLOO�UHWXUQ�����,I�WKLV�IXQFWLRQ�SURFHVVHV�D�:0B48,7�PHVVDJH��LW�ZLOO�UHWXUQ�D�]HUR��RWKHUZLVH��LW�UHWXUQV�D�QRQ]HUR�YDOXH��,W�DOVR�UHWXUQV�D�]HUR�ZKHQ�WKH�:0B48,7�PHVVDJH�LV�SURFHVVHG�WR�DOORZ�WKH�PHVVDJH�ORRS�WR�H[LW�DQG�WKH�DSSOLFDWLRQ�WR�VKXW�GRZQ��3HHN0HVVDJH�LV�VLPLODU�WR�*HW0HVVDJH�LQ�WKDW�LW�JHWV�D�PHVVDJH�IURP�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�LQ�ZKLFK�WKLV�IXQFWLRQ�LV�FDOOHG��7KH�PDLQ�GLIIHUHQFH�LV�WKDW�3HHN0HVVDJH�GRHV�QRW�DXWRPDWLFDOO\�UHPRYH�WKH�PHVVDJH�IURP�WKH�PHVVDJH�TXHXH��DV�*HW0HVVDJH�GRHV��3HHN0HVVDJH�LV�GHILQHG�DV�IROORZV��3XEOLF�'HFODUH�)XQFWLRQ�3HHN0HVVDJH�/LE��XVHU����$OLDV��3HHN0HVVDJH$��B�� � �OS0VJ�$V�06*��%\9DO�KZQG�$V�/RQJ��%\9DO�Z0VJ)LOWHU0LQ�$V�/RQJ��B�� � %\9DO�Z0VJ)LOWHU0D[�$V�/RQJ��%\9DO�Z5HPRYH0VJ�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��OS0VJ

$�/RQJ�SRLQWHU�WR�DQ�06*�VWUXFWXUH��KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�ZKRVH�PHVVDJHV�DUH�WR�EH�UHDG�IURP�WKH�TXHXH��,I�WKLV�LV�]HUR��DOO�PHVVDJHV�ZLOO�EH�UHDG��

Z0VJ)LOWHU0LQ

7KH�PLQLPXP�PHVVDJH�YDOXH�WKDW�LV�UHDG�IURP�WKH�PHVVDJH�TXHXH��Z0VJ)LOWHU0D[

7KH�PD[LPXP�PHVVDJH�YDOXH�WKDW�LV�UHWULHYHG�IURP�WKH�PHVVDJH�TXHXH��,I�WKLV�YDOXH�LV�]HUR��DOO�PHVVDJHV�VWDUWLQJ�ZLWK�WKH�Z0VJ)LOWHU0LQ�YDOXH�DUH�UHDG�IURP�WKH�PHVVDJH�TXHXH��

Z5HPRYH0VJ

,I�WKLV�LV�VHW�WR�30B5(029(������WKH�PHVVDJH�LV�UHDG�DQG�WKHQ�UHPRYHG�IURP�WKH�TXHXH��,I�WKLV�LV�VHW�WR�30B125(029(������WKH�PHVVDJH�LV�UHDG�EXW�OHIW�RQ�WKH�TXHXH��

,I�QR�PHVVDJHV�DUH�RQ�WKH�TXHXH��WKH�UHWXUQ�YDOXH�IRU�WKLV�IXQFWLRQ�LV�]HUR��$�QRQ]HUR�UHWXUQ�YDOXH�PHDQV�WKDW�D�PHVVDJH�ZDV�UHDG�IURP�WKH�TXHXH��<RX�FDQ�XVH�WKH�3HHN0HVVDJH�IXQFWLRQ�LQ�D�PHVVDJH�ORRS�LQ�SODFH�RI�WKH�*HW0HVVDJH�IXQFWLRQ��<RX�GR�WKLV�WR�DOORZ�EDFNJURXQG�SURFHVVLQJ�WR�EH�SHUIRUPHG�ZKHQ�WKH�DSSOLFDWLRQ�KDV�QR�PRUH�PHVVDJHV�WR�SURFHVV�LQ�LWV�PHVVDJH�TXHXH��)RU�D�PRUH�GHWDLOHG�GLVFXVVLRQ�RI�WKLV�WHFKQLTXH��VHH�&KDSWHU����7KH�:+B*(70(66$*(�KRRN�LQWHUFHSWV�PHVVDJHV�DV�HLWKHU�WKH�*HW0HVVDJH�RU�WKH�3HHN0HVVDJH�IXQFWLRQV�DUH�SXOOLQJ�WKHP�RII�RI�WKH�PHVVDJH�TXHXH��

Page 308: Visual Basic - Subclassing and Hooking with VB & VB NET

:KHQ�XVLQJ�WKLV�KRRN��EH�FRQFHUQHG�ZLWK�SHUIRUPDQFH��$V�\RX�NQRZ��WKH�UDZ�LQSXW�WKUHDG��5,7��SRVWV�PRXVH�DQG�NH\ERDUG�LQSXW�WR�HDFK�WKUHDG��$W�OHDVW�RQH�*HW0HVVDJH�DQG�RU�3HHN0HVVDJH�IXQFWLRQ�LV�FDOOHG�IRU�HDFK�PHVVDJH��7KDW�PHDQV�WKHVH�IXQFWLRQV�PDNH�WKH�VDPH�QXPEHU�RI�FDOOV�WR�WKH�:+B*(70(66$*(�KRRNV�ILOWHU�IXQFWLRQ��%HFDXVH�WKH�SRWHQWLDO�H[LVWV�IRU�PHVVDJHV��HVSHFLDOO\�:0B0286(029(�PHVVDJHV��WR�EH�SRVWHG�DW�D�IXULRXV�UDWH�WR�WKH�WKUHDG�RU�WKUHDGV�WR�ZKLFK�WKLV�KRRN�LV�DWWDFKHG��ZH�PXVW�WDNH�FDUH�WR�QRW�H[HFXWH�XQQHHGHG�FRGH�IURP�ZLWKLQ�WKH�ILOWHU�IXQFWLRQ��8VLQJ�:0B*(70(66$*(�DV�D�V\VWHP�ZLGH�KRRN�RQO\�FRPSRXQGV�WKLV�SUREOHP��:LWK�D�V\VWHP�ZLGH�KRRN��WKH�ILOWHU�IXQFWLRQ�LV�FDOOHG�HYHU\�WLPH�D�*HW0HVVDJH�RU�3HHN0HVVDJH�IXQFWLRQ�LV�FDOOHG�WKURXJKRXW�HYHU\�WKUHDG�LQ�WKH�V\VWHP��7KLV�FDQ�YHU\�TXLFNO\�FDXVH�SHUIRUPDQFH�WR�GHJUDGH��1RWH�DOVR�WKDW�WKH�:+B*(70(66$*(�KRRN�RQO\�LQWHUFHSWV�PHVVDJHV�EHIRUH�WKH�ZLQGRZ�SURFHGXUH��RU�DQ\�VXEFODVV�SURFHGXUH��UHFHLYHV�WKH�PHVVDJH��7KHUH�LV�QR�W\SH�RI�:+B*(70(66$*(�KRRN�WKDW�LQWHUFHSWV�PHVVDJHV�DIWHU�WKH�ZLQGRZ�SURFHGXUH�UHWXUQV����VLPLODU�WR�KRZ�WKH�:+B&$//:1'352&5(7�KRRN�RSHUDWHV��7R�EHWWHU�XQGHUVWDQG�WKLV�KRRN�DV�ZHOO�DV�WKH�H[DPSOH�SUHVHQWHG�LQ�WKLV�FKDSWHU��LW�LV�XVHIXO�WR�XQGHUVWDQG�ZKDW�D�SRVWHG�PHVVDJH�LV�DQG�KRZ�LW�GLIIHUV�IURP�D�VHQW�PHVVDJH��$�SRVWHG�PHVVDJH�LV�D�PHVVDJH�WKDW�LV�SODFHG�DW�WKH�HQG�RI�D�WKUHDGV�PHVVDJH�TXHXH��7KH�PHVVDJHV�LQ�WKH�TXHXH�DUH�SURFHVVHG�LQ�WKH�RUGHU�LQ�ZKLFK�WKH\�DUH�UHFHLYHG��:KHQ�DQ�DSSOLFDWLRQ�SRVWV�D�PHVVDJH��WKH�DSSOLFDWLRQ�FRQWLQXHV�SURFHVVLQJ�DQG�GRHV�QRW�ZDLW�WR�VHH�LI�WKH�SRVWHG�PHVVDJH�LV�SURFHVVHG�FRUUHFWO\��RU�DW�DOO��,Q�FRQWUDVW��D�VHQW�PHVVDJH�LV�VHQW�GLUHFWO\�WR�RQH�RU�PRUH�ZLQGRZV��QRW�WR�D�WKUHDGV�PHVVDJH�TXHXH��%\SDVVLQJ�WKH�PHVVDJH�TXHXH�DOORZV�WKH�VHQW�PHVVDJH�WR�EH�SURFHVVHG�LPPHGLDWHO\��6HQW�PHVVDJHV�DUH�XVXDOO\�SURFHVVHG�V\QFKURQRXVO\��WKDW�LV��WKH�DSSOLFDWLRQ�WKDW�VHQGV�WKH�PHVVDJH�PXVW�ZDLW�XQWLO�WKH�WDUJHW�ZLQGRZ�ILQLVKHV�SURFHVVLQJ�LW��2QH�IXQFWLRQ��6HQG0HVVDJH&DOOEDFN��DOORZV�D�VHQW�PHVVDJH�WR�EH�SURFHVVHG�DV\QFKURQRXVO\��6HQGLQJ�D�PHVVDJH�DOORZV�WKH�IXQFWLRQ�WKDW�VHQW�WKH�PHVVDJH�WR�UHFHLYH�D�YDOXH�LQGLFDWLQJ�LI�WKH�VHQW�PHVVDJH�ZDV�SURFHVVHG�FRUUHFWO\��&KDSWHU��GLVFXVVHV�VHQGLQJ�PHVVDJHV�LQ�JUHDWHU�GHWDLO��7KH�ILUVW�DQG�PRVW�FRPPRQO\�XVHG�PHWKRG�RI�SRVWLQJ�PHVVDJHV�LV�WKH�3RVW0HVVDJH�IXQFWLRQ��7KLV�IXQFWLRQ�VLPSO\�SRVWV�D�PHVVDJH�WR�WKH�PHVVDJH�TXHXH�RI�RQH�RU�PRUH�WKUHDGV��$IWHU�SRVWLQJ�WKH�PHVVDJH��WKH�3RVW0HVVDJH�IXQFWLRQ�UHWXUQV��,W�GRHV�QRW�ZDLW�IRU�D�UHVSRQVH�WR�WKH�SRVWHG�PHVVDJH��DV�GRHV�6HQG0HVVDJH��7KLV�IXQFWLRQ�LV�GHILQHG�DV�IROORZV��3XEOLF�'HFODUH�)XQFWLRQ�3RVW0HVVDJH�/LE��XVHU����$OLDV��3RVW0HVVDJH$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Z0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�3RVW0HVVDJH�KDV�WKH�IROORZLQJ�SDUDPHWHUV��KZQG

7KH�ZLQGRZ�KDQGOH�WKDW�WKH�PHVVDJH�LV�GLUHFWHG�WR��,I�WKLV�SDUDPHWHU�LV�VHW�WR�+:1'B%52$'&$67��WKH�PHVVDJH�LV�SRVWHG�WR�DOO�WRS�OHYHO�ZLQGRZV�LQ�WKH�V\VWHP��

Page 309: Visual Basic - Subclassing and Hooking with VB & VB NET

,I�WKLV�SDUDPHWHU�LV�VHW�WR�18//��WKH�PHVVDJH�LV�SRVWHG�WR�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�LQ�ZKLFK�WKLV�IXQFWLRQ�ZDV�FDOOHG��

X0VJ

7KH�PHVVDJH�LGHQWLILHU��O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH��Z3DUDP

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH��7KH�UHWXUQ�YDOXH�LV�QRQ]HUR�LI�WKH�IXQFWLRQ�VXFFHHGHG�LQ�SRVWLQJ�WKH�PHVVDJH��RWKHUZLVH��LW�UHWXUQV�D�]HUR�YDOXH��7KH�QH[W�PHWKRG�RI�SRVWLQJ�PHVVDJHV�LV�3RVW7KUHDG0HVVDJH��,QVWHDG�RI�XVLQJ�D�ZLQGRZ�KDQGOH�WR�GHWHUPLQH�ZKLFK�PHVVDJH�TXHXH�LV�WR�UHFHLYH�WKH�PHVVDJH��LW�XVHV�WKH�DFWXDO�WKUHDG�,'��7KLV�IXQFWLRQ�DOVR�GRHV�QRW�ZDLW�IRU�D�UHVSRQVH�WR�WKH�SRVWHG�PHVVDJH��7KLV�IXQFWLRQ�LV�GHILQHG�DV�IROORZV��3XEOLF�'HFODUH�)XQFWLRQ�3RVW7KUHDG0HVVDJH�/LE��XVHU����B����������$OLDV��3RVW7KUHDG0HVVDJH$��B�� � �%\9DO�LG7KUHDG�$V�/RQJ��%\9DO�PVJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��LG7KUHDG

7KH�WKUHDG�LGHQWLILHU�WKDW�WKH�PHVVDJH�LV�SRVWHG�WR��<RX�FDQ�GHWHUPLQH�WKLV�YDOXH�XVLQJ�WKH�9LVXDO�%DVLF��9%��$SS�7KUHDG,'�SURSHUW\��RU�E\�XVLQJ�HLWKHU�RI�WKH�*HW&XUUHQW7KUHDG,'�RU�*HW:LQGRZ7KUHDG3URFHVV,G�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IXQFWLRQV��

X0VJ

7KH�PHVVDJH�LGHQWLILHU��O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH��Z3DUDP

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH��,I�WKH�IXQFWLRQ�VXFFHHGV�LQ�SRVWLQJ�WKH�PHVVDJH�LW�UHWXUQV�D�QRQ]HUR�YDOXH��RWKHUZLVH��LW�UHWXUQV�D�]HUR�YDOXH��7KH�ODVW�PHWKRG�LV�3RVW4XLW0HVVDJH��7KLV�IXQFWLRQ�VLPSO\�SRVWV�D�:0B48,7�PHVVDJH�WR�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�LQ�ZKLFK�LW�ZDV�FDOOHG��7KH�:0B48,7�PHVVDJH�WKHQ�FDXVHV�WKH�DSSOLFDWLRQ�WR�H[LW�LWV�PHVVDJH�ORRS�DQG�VKXW�GRZQ��,�GLG�QRW�XVH�WKLV�IXQFWLRQ�LQ�WKH�H[DPSOH�DSSOLFDWLRQ�IRU�RQH�UHDVRQ��:KHQ�WKH�PHVVDJH�ORRS�UHFHLYHV�WKH�:0B48,7�PHVVDJH��LW�H[LWV�ZLWKRXW�ILUVW�UHPRYLQJ�DOO�WKH�LQVWDOOHG�KRRNV��FDXVLQJ�WKH�DSSOLFDWLRQ�WR�FUDVK��7KH�V\QWD[�RI�3RVW4XLW0HVVDJH�LV��3XEOLF�'HFODUH�6XE�3RVW4XLW0HVVDJH�/LE��XVHU����$OLDV��3RVW4XLW0HVVDJH��B�� � �%\9DO�Q([LW&RGH�$V�/RQJ��

Page 310: Visual Basic - Subclassing and Hooking with VB & VB NET

,WV�VLQJOH�SDUDPHWHU�LV��Q([LW&RGH

$�FRGH�WKDW�LV�VHQW�WR�WKH�Z3DUDP�SDUDPHWHU�RI�WKH�:0B48,7�PHVVDJH��1R�YDOXHV�DUH�UHWXUQHG�IURP�WKLV�IXQFWLRQ��

�,W�PLJKW�EH�KHOSIXO�WR�QRWH�WKDW�:LQGRZV������FDQ�FRQWDLQ�XS�WR��������PHVVDJHV�LQ�DQ\�RQH�PHVVDJH�TXHXH��WKLV�VKRXOG�EH�VXIILFLHQW�IRU�DQ\�DSSOLFDWLRQ��7KH�ORZHVW�YDOXH�WKDW�\RX�FDQ�VHW�IRU�WKLV�VL]H�LV�������PHVVDJHV��<RX�VHW�WKLV�YDOXH�WKURXJK�WKH�IROORZLQJ�UHJLVWU\�NH\��

+.(<B/2&$/B0$&+,1(?62)7:$5(?0LFURVRIW?:LQGRZV�17?&XUUHQW9HUVLRQ?:LQGRZV?86(53RVW0HVVDJH/LPLW�<RX�VKRXOG�VHW�WKH�GHIDXOW�YDOXH�RI�WKLV�NH\�WR�D�QXPEHU�EHWZHHQ�������DQG����������

�������)LOWHU�)XQFWLRQ�'HILQLWLRQ�

7KH�ILOWHU�IXQFWLRQ�SURWRW\SH�IRU�WKLV�KRRN�LV�ZULWWHQ�DV�IROORZV��3XEOLF�)XQFWLRQ�*HW0VJ3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B����������������������������O3DUDP�$V�06*��$V�/RQJ�,WV�SDUDPHWHUV�DUH��X&RGH

7KH�FRGH�WKDW�WKH�V\VWHP�VHQGV�WR�WKLV�ILOWHU�IXQFWLRQ��+&B$&7,21�LV�WKH�RQO\�KRRN�FRGH�WKH�V\VWHP�VHQGV�WR�WKLV�ILOWHU�IXQFWLRQ��7KLV�FRGH�LV�GHILQHG�DV�IROORZV��3ULYDWH�&RQVW�+&B$&7,21� ���:KHQ�WKH�V\VWHP�VHQGV�WKLV�FRGH�WR�WKH�ILOWHU�IXQFWLRQ��WKH�VHQW�PHVVDJH�FDQ�EH�SURFHVVHG��,I�+&B$&7,21�LV�QRW�SDVVHG�LQ��\RX�VKRXOG�VNLS�PHVVDJH�SURFHVVLQJ�DQG�FDOO�&DOO1H[W+RRN([�LPPHGLDWHO\��

Z3DUDP

6SHFLILHV�ZKHWKHU�WKH�PHVVDJH�ZDV�UHPRYHG�IURP�WKH�PHVVDJH�TXHXH��,I�WKLV�YDOXH�LV�VHW�WR�30B125(029(��WKH�PHVVDJH�ZDV�QRW�UHPRYHG�IURP�WKH�PHVVDJH�TXHXH��,I�WKLV�YDOXH�LV�VHW�WR�30B5(029(��WKH�PHVVDJH�ZDV�UHPRYHG�IURP�WKH�PHVVDJH�TXHXH��

O3DUDP

+ROGV�D�SRLQWHU�WR�DQ�06*�VWUXFWXUH��7KH�UHWXUQ�YDOXH�IRU�WKLV�ILOWHU�IXQFWLRQ�VKRXOG�EH�WKH�UHWXUQ�YDOXH�RI�WKH�&DOO1H[W+RRN([�IXQFWLRQ��,I�WKLV�IXQFWLRQ�LV�QRW�FDOOHG��WKH�ILOWHU�IXQFWLRQ�VKRXOG�UHWXUQ�D�]HUR��,�GR�QRW�

Page 311: Visual Basic - Subclassing and Hooking with VB & VB NET

UHFRPPHQG�VNLSSLQJ�WKH�FDOO�WR�&DOO1H[W+RRN([��WKRXJK��)DLOLQJ�WR�FDOO�WKLV�IXQFWLRQ�ZLOO�IRUFH�RWKHU�ILOWHU�IXQFWLRQV�LQ�WKH�FKDLQ�WR�QRW�EH�FDOOHG��:KHQ�WKH�ILOWHU�IXQFWLRQ�UHWXUQV��WKH�Z3DUDP�SDUDPHWHU�RI�WKLV�ILOWHU�IXQFWLRQ�FRQWDLQV�D�YDOXH�WKDW�VSHFLILHV�ZKHWKHU�WKH�PHVVDJH�ZDV�UHPRYHG�IURP�WKH�PHVVDJH�TXHXH��,I�WKH�YDOXH�RI�WKLV�SDUDPHWHU�LV�VHW�WR�30B5(029(��HLWKHU�*HW0HVVDJH�ZDV�XVHG�RU�3HHN0HVVDJH�ZDV�XVHG�ZLWK�WKH�30B5(029(�IODJ��,I�WKH�YDOXH�RI�WKLV�SDUDPHWHU�LV�VHW�WR�30B125(029(��3HHN0HVVDJH�ZDV�XVHG�ZLWK�WKH�30B125(029(�IODJ��7KH�O3DUDP�SDUDPHWHU�KROGV�D�SRLQWHU�WR�DQ�06*�VWUXFWXUH��ZKLFK�LV�GHILQHG�DV�IROORZV��3XEOLF�7\SH�06*�����KZQG�$V�/RQJ�����PHVVDJH�$V�/RQJ�����Z3DUDP�$V�/RQJ�����O3DUDP�$V�/RQJ�����WLPH�$V�/RQJ�����SW�$V�32,17$3,�(QG�7\SH�7KH�PHPEHUV�RI�WKLV�VWUXFWXUH�DUH�GHILQHG�DV�IROORZV��KZQG

+DQGOH�WR�WKH�ZLQGRZ�WKDW�WKLV�PHVVDJH�LV�GLUHFWHG�WR�PHVVDJH

7KH�,'�RI�WKLV�PHVVDJH�Z3DUDP

9DOXH�GHSHQGV�RQ�WKH�PHVVDJH�VHQW�O3DUDP

9DOXH�GHSHQGV�RQ�WKH�PHVVDJH�VHQW�WLPH

7KH�WLPH�WKDW�WKLV�PHVVDJH�ZDV�SRVWHG�SW

7KH�PRXVH�[�DQG�\�FRRUGLQDWHV�DW�WKH�WLPH�WKLV�PHVVDJH�ZDV�SRVWHG�

�������/RFDWLRQ�RI�7KLV�+RRN�LQ�WKH�6\VWHP�

7KLV�KRRN�LV�ORFDWHG�LQVLGH�ERWK�WKH�*HW0HVVDJH�DQG�3HHN0HVVDJH�IXQFWLRQV��7KHVH�IXQFWLRQV�PDNH�XS�SDUW�RI�WKH�PHVVDJH�ORRS�IRU�D�WKUHDG��DV�)LJXUH������VKRZV��:KHQ�HLWKHU�IXQFWLRQ�UHWULHYHV�D�PHVVDJH�IURP�WKH�PHVVDJH�TXHXH��WKH�:+B*(70(66$*(�ILOWHU�IXQFWLRQ�LV�FDOOHG��:KHQ�WKH�ILOWHU�IXQFWLRQ�UHWXUQV��WKH�*HW0HVVDJH�RU�3HHN0HVVDJH�IXQFWLRQ�ILQLVKHV�LWV�SURFHVVLQJ�DQG�WKHQ�UHWXUQV��,I�WKHVH�IXQFWLRQV�DUH�UXQQLQJ�ZLWKLQ�D�PHVVDJH�ORRS��WKH�'LVSDWFK0HVVDJH�IXQFWLRQ�LQVLGH�RI�WKH�PHVVDJH�ORRS�SDVVHV�WKH�PHVVDJH�RQ�WR�WKH�ZLQGRZ�SURFHGXUH��7KLV�LV�ZK\�ZH�FDQQRW�GLVFDUG�D�PHVVDJH�XVLQJ�WKLV�KRRN��(YHQ�WKRXJK�ZH�WU\�WR�GLVFDUG�WKH�PHVVDJH�IURP�ZLWKLQ�WKH�ILOWHU�IXQFWLRQ��LW�LV�VWLOO�SDVVHG�RQ�WR�

Page 312: Visual Basic - Subclassing and Hooking with VB & VB NET

'LVSDWFK0HVVDJH�WR�EH�VHQW�WR�WKH�FRUUHFW�ZLQGRZ�SURFHGXUH�IRU�SURFHVVLQJ��7KH�ILOWHU�IXQFWLRQ�KDV�QR�FRQWURO�RYHU�WKLV��

)LJXUH�������7KH�ORFDWLRQ�RI�WKH�:+B*(70(66$*(�IXQFWLRQ�LQ�WKH�PHVVDJLQJ�V\VWHP�

<RX�FDQ�XVH�VRPHWKLQJ�RI�D�KDFN�WR�GLVFDUG�PHVVDJHV�ZLWK�WKLV�KRRN��KRZHYHU��6LPSO\�PRGLI\�WKH�PHVVDJH�FRQWDLQHG�LQ�WKH�O3DUDP�SDUDPHWHU�WR�D�:0B18//�PHVVDJH��7KH�:0B18//�PHVVDJH�LV�WKHQ�SDVVHG�RQ�WR�WKH�ZLQGRZ�SURFHGXUH��DQG�QRW�WKH�RULJLQDO�PHVVDJH��7R�GR�WKLV��DGG�WKLV�FRGH�EHIRUH�&DOO1H[W+RRN([�LV�FDOOHG��O3DUDP�0HVVDJH� �:0B18//�O3DUDP�O3DUDP� ���O3DUDP�Z3DUDP� ���

�����$�7KUHDG�6SHFLILF�([DPSOH�

7KH�H[DPSOH�SUHVHQWHG�KHUH��ZKLFK�LV�VKRZQ�LQ�)LJXUH�������ZLOO�EXLOG�RQ�ZKDW�\RX�OHDUQHG�LQ�&KDSWHU���DQG�&KDSWHU�����%\�IROORZLQJ�WKLV�H[DPSOH��\RX�ZLOO�VHH�WKH�GLIIHUHQFHV�EHWZHHQ�WKH�:+B&$//:1'352&��:+B&$//:1'352&5(7��DQG�:+B*(70(66$*(�KRRNV��7KLV�H[DPSOH�LQVWDOOV�WKH�WKUHH�KRRNV��1RZ��ZKHQ�\RX�FOLFN�WKH�3RVW0HVVDJH�DQG�

Page 313: Visual Basic - Subclassing and Hooking with VB & VB NET

3RVW7KUHDG0VJ�EXWWRQV��\RX�ZLOO�VHH�WKH�:+B*(70(66$*(�KRRN�GLVSOD\�PHVVDJHV�LQ�WKH�WH[W�ER[��

)LJXUH�������6FUHHQVKRW�RI�H[DPSOH�DSSOLFDWLRQ�

7DEOH������OLVWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV��<RX�XVH�WKLV�DSSOLFDWLRQ�LQ�WKH�VDPH�ZD\�\RX�XVHG�WKH�VDPSOH�DSSOLFDWLRQV�LQ�WKH�SUHYLRXV�WZR�FKDSWHUV��&OLFN�WKH�KRRN�EXWWRQ�WR�LQVWDOO�DOO�WKUHH�KRRNV��DQG�WKHQ�FOLFN�HDFK�RI�WKH�ORZHU�EXWWRQV�VKRZQ�LQ�)LJXUH������WR�VHQG�DQG�SRVW�WKH�:0B18//�PHVVDJH��7KH�WH[W�ER[�ZLOO�LQGLFDWH�ZKLFK�KRRN�LQWHUFHSWHG�WKH�:0B18//�PHVVDJH��DV�ZHOO�DV�WKH�DYDLODEOH�SDUDPHWHUV�IRU�WKDW�KRRN��7KHUH�LV�QR�GLIIHUHQFH�IURP�WKH�SUHYLRXV�DSSOLFDWLRQV�LQ�RXWSXW�GLVSOD\HG�ZKHQ�\RX�FOLFN�WKH�6HQG0HVVDJH�W\SH�EXWWRQV��:KHQ�\RX�FOLFN�WKH�3RVW0HVVDJH�DQG�3RVW7KUHDG0VJ�EXWWRQV��WKH�:+B*(70(66$*(�KRRN�QRZ�GLVSOD\V�D�OLQH�RI�WH[W�LQGLFDWLQJ�WKDW�LW�KDV�LQWHUFHSWHG�WKH�SRVWHG�PHVVDJH��

7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��2EMHFW�7\SH� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�

)RUP� 1DPH� )RUP��)RUP� &DSWLRQ� �:+B*(70(66$*(�+RRN�7HVW��)RUP� 7RS� ����)RUP� /HIW� ����)RUP� +HLJKW� �����)RUP� :LGWK� �����7H[W�%R[� 1DPH� 7H[W��7H[W�%R[� 0XOWLOLQH� 7UXH�7H[W�%R[� 7RS� ����7H[W�%R[� /HIW� �����

Page 314: Visual Basic - Subclassing and Hooking with VB & VB NET

7H[W�%R[� +HLJKW� �����7H[W�%R[� :LGWK� �����7H[W�%R[� 6FUROO%DUV� ��%RWK�)UDPH� &DSWLRQ� �*(70(66$*(��)UDPH� 1DPH� )UDPH��)UDPH� 7RS� ����)UDPH� /HIW� ����)UDPH� +HLJKW� �����)UDPH� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH� FPG+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �KRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� FPG8Q+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �XQKRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� FPG6HQG0VJ�&RPPDQG�%XWWRQ�� &DSWLRQ� �6HQG0VJ��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� FPG6HQG0VJ1RWLI\�&RPPDQG�%XWWRQ�� &DSWLRQ� �6HQG0VJ1RWLI\��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� FPG6HQG0VJ72�

Page 315: Visual Basic - Subclassing and Hooking with VB & VB NET

&RPPDQG�%XWWRQ�� &DSWLRQ� �6HQG0VJ72��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� FPG6HQG0VJ&%�&RPPDQG�%XWWRQ�� &DSWLRQ� �6HQG0VJ&%��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� FPG6HQG'OJ0VJ�&RPPDQG�%XWWRQ�� &DSWLRQ� �6HQG'OJ0VJ��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� FPG%URDGFDVW0VJ�&RPPDQG�%XWWRQ�� &DSWLRQ� �%URDGFDVW0VJ��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� FPG3RVW0HVVDJH�&RPPDQG�%XWWRQ�� &DSWLRQ� �3RVW0HVVDJH��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ��� 1DPH� FPG3RVW7KUHDG0VJ�&RPPDQG�%XWWRQ��� &DSWLRQ� �3RVW7KUHDG0VJ��&RPPDQG�%XWWRQ��� 7RS� �����&RPPDQG�%XWWRQ��� /HIW� ����&RPPDQG�%XWWRQ��� +HLJKW� ����

Page 316: Visual Basic - Subclassing and Hooking with VB & VB NET

&RPPDQG�%XWWRQ��� :LGWK� ����7R�LPSOHPHQW�WKH�:+B*(70(66$*(�KRRN��OHWV�EHJLQ�ZLWK�WKH�FKDQJHV�QHHGHG�WR�WKH�0RGXOH��EDV�FRGH�PRGXOH���7KURXJKRXW�WKLV�GLVFXVVLRQ��WKH�QHZ�OLQHV�RI�FRGH�WKDW�\RX�PXVW�DGG�WR�WKH�SURMHFW�WR�LPSOHPHQW�WKH�:+B*(70(66$*(�KRRN�ZLOO�DSSHDU�LQ�EROGIDFH���$�QHZ�SULYDWH�PHPEHU�YDULDEOH��K*HW0VJ+RRN��LV�DGGHG�WR�VWRUH�WKH�:+B*(70(66$*(�KRRN�KDQGOH��3ULYDWH�K3URF5HW+RRN�$V�/RQJ�3ULYDWH�K3URF+RRN�$V�/RQJ�3ULYDWH�K*HW0VJ+RRN�$V�/RQJ��3XEOLF�,V+RRNHG�$V�%RROHDQ�7KH�6HW+RRNV�IXQFWLRQ��ZKLFK�LV�VKRZQ�LQ�([DPSOH�������FRQWDLQV�D�QHZ�OLQH�WR�LQVWDOO�WKH�:+B*(70(66$*(�KRRN��

([DPSOH�������7KH�6HW+RRNV�)XQFWLRQ�WR�,QVWDOO�WKH�:0B*(70(66$*(�+RRN��

3XEOLF�6XE�6HW+RRNV���������,I�,V+RRNHG�7KHQ���������0VJ%R[��'RQW�KRRN�&$//:1'352&�WZLFH�RU�\RX�ZLOO�EH�XQDEOH�WR�XQKRRN�LW�������(OVH���������K*HW0VJ+RRN� �6HW:LQGRZV+RRN([�:+B*(70(66$*(��$GGUHVV2I�*HW0VJ3URF��B��������������������������$SS�7KUHDG,'����������K3URF+RRN� �6HW:LQGRZV+RRN([�:+B&$//:1'352&��$GGUHVV2I�:QG3URF�����B���������������������$SS�7KUHDG,'����������K3URF5HW+RRN� �6HW:LQGRZV+RRN([�:+B&$//:1'352&5(7��$GGUHVV2I�:QG3URF5HW��B���������������������������$SS�7KUHDG,'����������,V+RRNHG� �7UXH�����(QG�,I�(QG�6XE�7KH�5HPRYH+RRNV�PHWKRG��VKRZQ�LQ�([DPSOH�������FRQWDLQV�D�QHZ�OLQH�WR�UHPRYH�WKH�:+B*(70(66$*(�KRRN��

([DPSOH�������7KH�5HPRYH+RRNV�)XQFWLRQ�WR�5HPRYH�WKH�:0B*(70(66$*(�+RRN��

3XEOLF�6XE�5HPRYH+RRNV���������'LP�WHPS�$V�/RQJ�����WHPS� �8QKRRN:LQGRZV+RRN([�K*HW0VJ+RRN������WHPS� �8QKRRN:LQGRZV+RRN([�K3URF+RRN������WHPS� �8QKRRN:LQGRZV+RRN([�K3URF5HW+RRN��

Page 317: Visual Basic - Subclassing and Hooking with VB & VB NET

����,V+RRNHG� �)DOVH�(QG�6XE�$�QHZ�IXQFWLRQ�VKRZQ�LQ�([DPSOH�������*HW0VJ3URF��LV�DGGHG�WR�DFW�DV�WKH�ILOWHU�IXQFWLRQ�IRU�WKH�:+B*(70(66$*(�KRRN��7KLV�ILOWHU�IXQFWLRQ�RXWSXWV�D�OLQH�RI�WH[W�WR�WKH�7H[W��WH[W�ER[�ZKHQ�D�:0B18//�PHVVDJH�LV�SRVWHG�WR�WKH�PHVVDJH�TXHXH��

([DPSOH�������7KH�*HW0VJ3URF�)LOWHU�)XQFWLRQ��

3XEOLF�)XQFWLRQ�*HW0VJ3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B����������������������������O3DUDP�$V�06*��$V�/RQJ����,I�O3DUDP�PHVVDJH� �:0B18//�7KHQ�������6HOHFW�&DVH�X&RGH����������&DVH�+&B$&7,21�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���*(70(66$*(��B��������������������������������������06*����+H[��O3DUDP�PHVVDJH��B��������������������������������������+:1'����+H[��O3DUDP�KZQG��B��������������������������������������:3$5$0����+H[��O3DUDP�Z3DUDP��B��������������������������������������/3$5$0����+H[��O3DUDP�O3DUDP��B��������������������������������������06*5(029('����+H[��Z3DUDP���YE1HZ/LQH����������&DVH�(OVH�������(QG�6HOHFW����(QG�,I���������*HW0VJ3URF� �&DOO1H[W+RRN([�K*HW0VJ+RRN��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KDW�LV�LW�IRU�FKDQJHV�WR�WKLV�DSSOLFDWLRQ��)URP�WKHVH�FKDQJHV�\RX�FDQ�VHH�KRZ�DOO�WKUHH�KRRNV�DUH�XVHG�DQG�KRZ�WKH\�RSHUDWH��,W�LV�LQWHUHVWLQJ�WR�QRWH�WKDW�EHFDXVH�3HHN0HVVDJH�FDQ�RQO\�UHDG�D�PHVVDJH�IURP�WKH�TXHXH�ZLWKRXW�UHPRYLQJ�LW��\RX�FDQ�FDOO�WKH�:+B*(70(66$*(�KRRN�PRUH�WKDQ�RQFH�IRU�HDFK�PHVVDJH�RQ�WKH�TXHXH��<RX�FDQ�REVHUYH�WKLV�E\�UXQQLQJ�WKH�H[DPSOH�DSSOLFDWLRQ�LQFOXGHG�LQ�WKLV�FKDSWHU�IURP�ZLWKLQ�WKH�9%�,'(�DQG�FOLFNLQJ�WKH�3RVW0HVVDJH�EXWWRQ��)LUVW��\RX�FDQ�VHH�SRVWHG�PHVVDJHV�EHLQJ�UHDG�XVLQJ�WKH�3HHN0HVVDJH�IXQFWLRQ�ZLWK�WKH�30B125(029(�IODJ��1H[W��WKH�PHVVDJH�LV�UHPRYHG�IURP�WKH�PHVVDJH�TXHXH�XVLQJ�WKH�3HHN0HVVDJH�IXQFWLRQ�ZLWK�WKH�30B5(029(�IODJ��6HH�)LJXUH������DQG�)LJXUH������IRU�DQ�H[DPSOH�RI�WKLV��

)LJXUH�������([DPSOH�RI�SRVWLQJ�D�PHVVDJH�IURP�ZLWKLQ�WKH�9%�,'(�

Page 318: Visual Basic - Subclassing and Hooking with VB & VB NET

)LJXUH�������([DPSOH�RI�SRVWLQJ�D�PHVVDJH�IURP�ZLWKLQ�D�FRPSLOHG�(;(�

�������2WKHU�8VHV�RI�7KLV�+RRN�

7KH�:+B*(70(66$*(�KRRN�LV�D�YHU\�XVHIXO�KRRN�IRU�PDQ\�GLIIHUHQW�DSSOLFDWLRQV��2QH�DSSOLFDWLRQ�LV�ZDWFKLQJ�IRU�WKH�:0B&$1&(/-2851$/�PHVVDJH��ZKLFK�LV�GHILQHG�DV�IROORZV��3XEOLF�&RQVW�:0B&$1&(/-2851$/� �+�%�7R�IXOO\�XQGHUVWDQG�ZK\�WKLV�LV�XVHIXO��\RX�QHHG�WR�UHDG�&KDSWHU����DQG�&KDSWHU�����ZKLFK�FRYHU�WKH�:+B-2851$/5(&25'�DQG�:+B-2851$/3/$<%$&.�KRRNV��UHVSHFWLYHO\��,Q�VKRUW��WKH�:0B&$1&(/-2851$/�PHVVDJH�LV�SRVWHG�WR�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�LQ�ZKLFK�RQH�RI�WKHVH�KRRNV�LV�LQVWDOOHG�ZKHQ�WKH�XVHU�IRUFHIXOO\�FDQFHOV�MRXUQDO�UHFRUGLQJ�RU�SOD\EDFN��7KH�KRRNV�DUH�DFWXDOO\�UHPRYHG�DIWHU�WKLV�PHVVDJH�LV�SURFHVVHG��%\�WDNLQJ�DGYDQWDJH�RI�WKLV��ZH�FDQ�SHUIRUP�DQ\�FOHDQXS�UHTXLUHG�EHIRUH�WKH�KRRN�LV�DFWXDOO\�UHPRYHG��7R�GR�WKLV��\RX�FDQ�SODFH�WKH�IROORZLQJ�,I���7KHQ�VWDWHPHQW�LQVLGH�WKH�ILOWHU�IXQFWLRQ�IRU�WKH�:0B*(70(66$*(�KRRN��

Page 319: Visual Basic - Subclassing and Hooking with VB & VB NET

,I�O3DUDP�PHVVDJH� �:0B&$1&(/-2851$/�7KHQ�� 3ODFH�FOHDQXS�FRGH�KHUH��(QG�,I�<RX�DOVR�FDQ�XVH�WKLV�KRRN�WR�IL[�WKH�SUREOHP�RI�WKH�7DE�DQG�$UURZ�NH\V�QRW�IXQFWLRQLQJ�DV�H[SHFWHG�LQ�D�PRGHOHVV�GLDORJ�ER[�DQG��PRUH�VSHFLILFDOO\��LQ�WKH�)LQG�DQG�5HSODFH�FRPPRQ�GLDORJ�ER[HV��)RU�D�PRGHOHVV�GLDORJ�WR�ZRUN�SURSHUO\��:LQGRZV�UHTXLUHV�WKDW�\RX�XVH�WKH�,V'LDORJ0HVVDJH�$3,�IXQFWLRQ�LQ�WKH�PDLQ�PHVVDJH�ORRS�RI�WKH�DSSOLFDWLRQ��7KH�,V'LDORJ0HVVDJH�$3,�IXQFWLRQ�EDVLFDOO\�GRHV�WKH�ZRUN�RI�WKH�7UDQVODWH0HVVDJH�DQG�WKH�'LVSDWFK0HVVDJH�$3,�IXQFWLRQV��EXW�IRU�PRGHOHVV�GLDORJ�ER[HV��7KHUHIRUH��LI�,V'LDORJ0HVVDJH�UHWXUQV�D�758(�YDOXH��LW�KDV�SURFHVVHG�WKH�PHVVDJH�DQG�WKH�7UDQVODWH0HVVDJH�DQG�WKH�'LVSDWFK0HVVDJH�$3,�IXQFWLRQV�VKRXOG�QRW�EH�FDOOHG��7KH�,V'LDORJ0HVVDJH�$3,�IXQFWLRQV�PDLQ�SXUSRVH�LV�WR�SURYLGH�GHIDXOW�GLDORJ�NH\ERDUG�SURFHVVLQJ�IRU�WKH�PRGHOHVV�GLDORJ�ER[��0RGDO�GLDORJ�ER[HV�DXWRPDWLFDOO\�VXSSRUW�GHIDXOW�GLDORJ�NH\ERDUG�SURFHVVLQJ��<RX�FDQQRW�DGG�WKH�,V'LDORJ0HVVDJH�$3,�IXQFWLRQ�WR�WKH�PDLQ�PHVVDJH�ORRS�RI�D�9%�DSSOLFDWLRQ�EHFDXVH�LW�LV�ORFDWHG�LQ�7KXQGHU57�0DLQ��7R�IL[�WKLV�SUREOHP��VLPSO\�LQVWDOO�D�WKUHDG�VSHFLILF�:0B*(70(66$*(�KRRN�XSRQ�UHFHLYLQJ�WKH�:0B,1,7',$/2*�PHVVDJH�LQ�WKH�FRPPRQ�GLDORJ�ER[�VXEFODVV�SURFHGXUH��1H[W��DGG�WR�\RXU�FRGH�D�:+B*(70(66$*(�ILOWHU�IXQFWLRQ�VLPLODU�WR�WKH�IROORZLQJ��3XEOLF�)XQFWLRQ�*HW0VJ3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B����������������������������O3DUDP�$V�06*��$V�/RQJ����,I�Z3DUDP� �30B5(029(�7KHQ�������6HOHFW�&DVH�X&RGH����������&DVH�+&B$&7,21�������������,I�O3DUDP�PHVVDJH�! �:0B.(<),567�$QG�O3DUDP�PHVVDJH�� �:0B.(</$67�7KHQ����������������,I�,V'LDORJ0HVVDJH�KZQG&RPP'LDORJ��O3DUDP��7KHQ�������������������O3DUDP�PHVVDJH� �:0B18//�������������������O3DUDP�Z3DUDP� ���������������������O3DUDP�O3DUDP� ������������������(QG�,I�������������(QG�,I����������&DVH�(OVH�������(QG�6HOHFW����(QG�,I���������*HW0VJ3URF� �&DOO1H[W+RRN([�K*HW0VJ+RRN��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KLV�ZLOO��LQ�HIIHFW��DGG�WKH�PLVVLQJ�,V'LDORJ0HVVDJH�IXQFWLRQ�WR�\RXU�PHVVDJH�ORRS�DQG�FDXVH�WKH�7DE�DQG�$UURZ�NH\V�WR�EH�FRUUHFWO\�SURFHVVHG��7KLV�SUREOHP�ZDV�GLVFXVVHG�LQ�&KDSWHU����

Page 320: Visual Basic - Subclassing and Hooking with VB & VB NET

<RX�FDQ�ILQG�VHYHUDO�RWKHU�H[DPSOHV�RI�XVLQJ�WKLV�KRRN�LQ�WKH�0LFURVRIW�'HYHORSHU�1HWZRUN��06'1���,�KDYH�OLVWHG�WKHP�LQ�7DEOH�������DORQJ�ZLWK�EULHI�GHVFULSWLRQV��

7DEOH�������06'1�$UWLFOHV�RQ�8VLQJ�WKH�:0B*(70(66$*(�+RRN��$UWLFOH�,'� 'HVFULSWLRQ�4�������+RZ�WR�MXPS�WR�D�VSHFLILF�SURSHUW\�SDJH�VKHHW��

4������ +RZ�WR�DOWHU�NH\ERDUG�PHVVDJHV��WKH�:+B.(<%2$5'�KRRN�FDQQRW�DOWHU�PHVVDJHV���

4�������+RZ�WR�SURFHVV�7DE�DQG�$UURZ�NH\V�LQ�D�PRGHOHVV�GLDORJ�ER[��4�������+RZ�WR�NQRZ�ZKHQ�D�VFUHHQVDYHU�DFWLYDWHV��4�������+RZ�WR�VXEFODVV�D�ZLQGRZ�LQ�D�GLIIHUHQW�SURFHVV��

�����&DYHDWV�

<RX�PXVW�UHPHPEHU�WKDW�WKLV�KRRN�RQO\�LQWHUFHSWV�SRVWHG�PHVVDJHV��$Q\�PHVVDJH�VHQW�WR�D�ZLQGRZ�XVLQJ�6HQG0HVVDJH�W\SH�$3,�FDOOV�ZLOO�QRW�EH�FDSWXUHG��$OVR��WKLV�KRRN�PLJKW�PRGLI\�WKH�PHVVDJH��7DNH�FDUH�ZKHQ�PRGLI\LQJ�DQ\�PHVVDJH��YHULI\�WKDW�LW�ZLOO�QRW�DGYHUVHO\�DIIHFW�DQ\�RWKHU�IXQFWLRQDOLW\��7KLV�KRRN�IXQFWLRQV�GLIIHUHQWO\�ZKHQ�UXQQLQJ�LQ�WKH�9%�,'(�WKDQ�ZKHQ�UXQQLQJ�IURP�LQVLGH�DQ�(;(��7KH�GLIIHUHQFH�LV�WKDW�ZKLOH�UXQQLQJ�LQ�WKH�,'(��DQ�DGGLWLRQDO�3HHN0HVVDJH�LV�SHUIRUPHG�ZLWK�D�30B125(029(�IODJ��7KLV�VLPSO\�H[DPLQHV�WKH�PHVVDJH�DQG�LWV�GHWDLOV�EXW�GRHV�QRW�UHPRYH�LW�IURP�WKH�PHVVDJH�TXHXH��7KH�PHVVDJH�LV�UHPRYHG�IURP�WKH�PHVVDJH�TXHXH�LQ�D�VXEVHTXHQW�3HHN0HVVDJH�FDOO��6HH�)LJXUH������DQG�)LJXUH������IRU�H[DPSOHV�RI�WKLV��$V�DOZD\V��\RX�PXVW�WDNH�SHUIRUPDQFH�LQWR�FRQVLGHUDWLRQ�ZKHQ�XVLQJ�WKLV�KRRN��HVSHFLDOO\�ZKHQ�WKH�KRRN�LV�V\VWHP�ZLGH��

Page 321: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU�����:+B.(<%2$5'�DQG�:+B.(<%2$5'B//�7KLV�FKDSWHU�GHDOV�ILUVW�ZLWK�WKH�:+B.(<%2$5'�KRRN�DQG�WKHQ�ZLWK�WKH�:+B.(<%2$5'B//�KRRN��7KH�//�VWDQGV�IRU�ORZ�OHYHO��7KLV�FKDSWHU�GHVFULEHV�WKHVH�KRRNV�DQG�GLVFXVVHV�KRZ�NH\ERDUG�PHVVDJHV�DUH�KDQGOHG�LQ�WKH�:LQGRZV�PHVVDJLQJ�V\VWHP��,�ZLOO�SUHVHQW�H[DPSOHV�XVLQJ�HDFK�KRRN���

�����+RZ�.H\ERDUG�0HVVDJLQJ�2SHUDWHV�

:KHQ�WKH�XVHU�SUHVVHV�DQG�UHOHDVHV�D�NH\�RQ�WKH�NH\ERDUG��VHYHUDO�KLGGHQ�WKLQJV�KDSSHQ�ZLWKLQ�WKH�PHVVDJLQJ�V\VWHP��:KHQ�WKH�XVHU�SUHVVHV�D�NH\�RQ�WKH�NH\ERDUG��WKH�NH\ERDUG�VHQGV�D�VFDQ�FRGH�WR�WKH�NH\ERDUG�GHYLFH�GULYHU�LQGLFDWLQJ�WKDW�D�VSHFLILF�NH\�ZDV�SUHVVHG��7KLV�GHYLFH�GULYHU�FRQYHUWV�WKH�VFDQ�FRGH�WR�D�YLUWXDO�NH\�FRGH�WKDW�:LQGRZV�GHILQHV��$�PHVVDJH�VWUXFWXUH�LV�ILOOHG�ZLWK�HLWKHU�D�:0B.(<'2:1�RU�:0B6<6.(<'2:1�PHVVDJH��DFFRUGLQJ�WR�WKH�W\SH�RI�NH\�WKH�XVHU�SUHVVHG���6\VWHP�NH\�GRZQ�DQG�NH\�XS�PHVVDJHV�DUH�SURGXFHG�LQ�RQH�RI�WKUHH�ZD\V���

• %\�SUHVVLQJ�WKH�)���NH\��ZKLFK�FDXVHV�WKH�PHQX�EDU�WR�DFWLYDWH��• %\�KROGLQJ�GRZQ�WKH�$/7�NH\�ZKLOH�SUHVVLQJ�DQRWKHU�NH\�VXFK�DV�$/7�)���ZKLFK�

FORVHV�D�ZLQGRZ��• :KHQ�QR�ZLQGRZ�LQ�WKH�V\VWHP�KDV�WKH�NH\ERDUG�LQSXW�IRFXV��VXFK�DV�ZKHQ�DOO�

ZLQGRZV�DUH�PLQLPL]HG��

6\VWHP�NH\�PHVVDJHV�DUH�XVHG�PDLQO\�E\�WKH�V\VWHP�DQG�SURYLGH�D�VWDQGDUG�NH\ERDUG�LQWHUIDFH�IRU�PDQLSXODWLQJ�ZLQGRZV��)RU�H[DPSOH��SUHVVLQJ�$/7�)��FORVHV�D�ZLQGRZ����\RX�FDQ�ILQG�WKLV�NH\�FRPELQDWLRQ�LQ�D�ZLQGRZV�V\VWHP�PHQX��2WKHU�H[DPSOHV�RI�V\VWHP�NH\�FRPELQDWLRQV�DUH���CTRL-ESC

2SHQV�WKH�:LQGRZV�6WDUW�PHQX��RU�WKH�7DVN�0DQDJHU�XQGHU�:LQGRZV�17���ALT-ESC

6ZLWFKHV�WR�WKH�QH[W�UXQQLQJ�DSSOLFDWLRQ�LQ�WKH�=�RUGHU��ALT-TAB

6ZLWFKHV�WR�WKH�QH[W�UXQQLQJ�DSSOLFDWLRQ�LQ�WKH�=�RUGHU��ALT-DOWN ARROW

2SHQV�D�GURS�GRZQ�OLVW�ER[��ALT-SPACE

'LVSOD\V�WKH�DFWLYH�ZLQGRZV�V\VWHP�PHQX��

Page 322: Visual Basic - Subclassing and Hooking with VB & VB NET

ALT-F6

6ZLWFKHV�EHWZHHQ�ZLQGRZV�ZLWKLQ�WKH�VDPH�DSSOLFDWLRQ��$�QRQV\VWHP�NH\�LV�D�NH\�WKDW�LV�SUHVVHG�ZLWKRXW�WKH�$/7�NH\�EHLQJ�SUHVVHG��([DPSOHV�RI�QRQV\VWHP�NH\V�DUH�(17(5��7$%��(6&��RU�DQ\�FKDUDFWHU�NH\��D�]��$�=��RQ�WKH�NH\ERDUG���7KH�06*�PHVVDJH�VWUXFWXUH�DV�LW�SHUWDLQV�WR�NH\ERDUG�PHVVDJHV�LV�GHILQHG�DV�IROORZV���3ULYDWH�7\SH�06*�����KZQG�$V�/RQJ�����PHVVDJH�$V�/RQJ�����Z3DUDP�$V�/RQJ�����O3DUDP�$V�/RQJ�����WLPH�$V�/RQJ�����SW�$V�32,17$3,�(QG�7\SH�(DFK�PHPEHU�RI�WKLV�VWUXFWXUH�LV�GHILQHG�DV�IROORZV��KZQG

+DQGOH�WR�WKH�ZLQGRZ�WKDW�WKLV�PHVVDJH�LV�GLUHFWHG�WR��PHVVDJH

7KH�PHVVDJH�,'��HLWKHU�:0B.(<'2:1��:0B.(<83��:0B6<6.(<'2:1��RU�:0B6<6.(<83���

Z3DUDP

7KH�YLUWXDO�NH\�FRGH�RI�WKH�NH\�SUHVVHG��9LUWXDO�NH\�FRGHV�DUH�XVXDOO\�GHILQHG�DV�FRQVWDQWV�LQ�FRGH�DQG�KDYH�WKH�SUHIL[�9.B���

O3DUDP

)ODJV�DQG�RWKHU�LQIRUPDWLRQ�DERXW�WKH�NH\�SUHVVHG��7KH\�LQFOXGH��NH\�UHSHDW�FRXQW

7KH�QXPEHU�RI�WLPHV�WKH�NH\�ZDV�UHSHDWHG�DV�D�UHVXOW�RI�WKH�XVHU�KROGLQJ�WKH�NH\�GRZQ���

VFDQ�FRGH

7KLV�YDOXH�GHSHQGV�RQ�WKH�RULJLQDO�HTXLSPHQW�PDQXIDFWXUHU��2(0���H[WHQGHG�NH\�IODJ

6SHFLILHV�ZKHWKHU�WKH�NH\�SUHVVHG�LV�D�IXQFWLRQ�NH\�RU�D�NH\�RQ�WKH�NH\SDG���FRQWH[W�FRGH

6SHFLILHV�LI�WKH�$/7�NH\�ZDV�SUHVVHG��SUHYLRXV�NH\�VWDWH�IODJ

6SHFLILHV�LI�WKH�DXWRPDWLF�UHSHDW�IHDWXUH�RI�D�NH\ERDUG�JHQHUDWHG�WKLV�PHVVDJH���WUDQVLWLRQ�VWDWH�IODJ

6SHFLILHV�LI�WKH�NH\�LV�EHLQJ�SUHVVHG�RU�UHOHDVHG��WLPH

7KH�WLPH�WKDW�WKLV�PHVVDJH�ZDV�SRVWHG��SW

Page 323: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�PRXVH�[�DQG�\�FRRUGLQDWHV�DW�WKH�WLPH�WKLV�PHVVDJH�ZDV�SRVWHG��7KH�V\VWHP�VHQGV�WKLV�PHVVDJH�WR�WKH�UDZ�LQSXW�WKUHDG��5,7���ZKLFK�SDVVHV�LW�RQ�WR�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�WKDW�KDV�WKH�NH\ERDUG�LQSXW�IRFXV���:KHQ�WKH�XVHU�UHOHDVHV�WKH�NH\��WKH�NH\ERDUG�VHQGV�D�VHSDUDWH�VFDQ�FRGH�WR�WKH�GHYLFH�GULYHU�LQGLFDWLQJ�WKDW�WKH�NH\�EHLQJ�SUHVVHG�ZDV�UHOHDVHG��7KH�GHYLFH�GULYHU�WKHQ�FRQYHUWV�WKLV�VFDQ�FRGH�LQWR�D�YLUWXDO�NH\�FRGH��$�PHVVDJH�VWUXFWXUH�LV�ILOOHG�ZLWK�HLWKHU�D�:0B.(<83�RU�:0B6<6.(<83�PHVVDJH��DFFRUGLQJ�WR�WKH�W\SH�RI�NH\�SUHVVHG��7KLV�PHVVDJH�DOVR�LV�SDVVHG�RQ�WR�WKH�5,7�DQG�WKHQ�RQ�WR�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�WKDW�KDV�WKH�NH\ERDUG�LQSXW�IRFXV���<RX�PLJKW�EH�ZRQGHULQJ�ZKDW�WKH�NH\ERDUG�LQSXW�IRFXV�UHIHUV�WR��7KH�NH\ERDUG�LQSXW�IRFXV�LV�D�SURSHUW\�WKDW�HDFK�WKUHDG�LQ�WKH�V\VWHP�FRQWDLQV��7KLV�SURSHUW\�FRQWDLQV�WKH�ZLQGRZ�KDQGOH�RI�D�ZLQGRZ�ZLWKLQ�WKH�WKUHDG�WKDW�LV�FXUUHQWO\�VHW�WR�UHFHLYH�DOO�WKH�NH\ERDUG�LQSXW��%HFDXVH�DOO�WKUHDGV�FRQWDLQ�WKLV�SURSHUW\��HDFK�WKUHDG�FDQ�KDYH�D�ZLQGRZ�KDQGOH�FRQWDLQHG�LQ�WKLV�SURSHUW\��%XW�WKH�RQO\�ZLQGRZ�WKDW�DFWXDOO\�UHFHLYHV�NH\ERDUG�LQSXW�LV�WKH�ZLQGRZ�WKDW�KDV�WKH�NH\ERDUG�LQSXW�IRFXV�DQG�WKDW�LV�FRQWDLQHG�LQ�WKH�IRUHJURXQG�WKUHDG��(YHQ�WKRXJK�RWKHU�ZLQGRZV�PLJKW�KDYH�WKH�NH\ERDUG�LQSXW�IRFXV�IRU�WKHLU�WKUHDG��WKH\�FDQQRW�UHFHLYH�NH\ERDUG�LQSXW��:KHQ�DQRWKHU�WKUHDG�EHFRPHV�WKH�IRUHJURXQG�WKUHDG��WKH�NH\ERDUG�LQSXW�IRFXV�SURSHUW\�RI�WKH�QHZ�WKUHDG�ZLOO�GHWHUPLQH�ZKLFK�ZLQGRZ�WKH�NH\ERDUG�PHVVDJHV�ZLOO�EH�VHQW�WR���,I�\RX�XVH�6S\���WR�ZDWFK�NH\ERDUG�PHVVDJHV��\RX�ZLOO�VHH�WKDW�DQ�H[WUD�PHVVDJH��:0B&+$5��LV�JHQHUDWHG��7KLV�PHVVDJH�FRQWDLQV�WKH�DFWXDO�FKDUDFWHU�FRGH��HTXLYDOHQW�WR�LWV�$6&,,�YDOXH��LQ�WKH�Z3DUDP�PHPEHU�RI�LWV�06*�VWUXFWXUH��7KH�NH\ERDUG�RQO\�JHQHUDWHV�WKHVH�PHVVDJHV�LQ�WKLV�VHTXHQFH���:0B.(<83�:0B.(<'2:1�%XW�ZKHQ�WKH�ZLQGRZ�SURFHGXUH�UHFHLYHV�WKHVH�PHVVDJHV��WKH�:0B&+$5�PHVVDJH�P\VWHULRXVO\�DSSHDUV��7KH�PHVVDJH�VHTXHQFH�QRZ�ORRNV�OLNH�WKLV���:0B.(<83�:0B&+$5�:0B.(<'2:1�7KH�:0B&+$5�PHVVDJH�LV�JHQHUDWHG�LQVLGH�WKH�PHVVDJH�ORRS�RI�WKH�GHVWLQDWLRQ�WKUHDG��$�VLPSOH�PHVVDJH�ORRS�LV�ZULWWHQ�OLNH�WKLV���ZKLOH��*HW0HVVDJH�PVJ���+:1'��18//����������^�� 7UDQVODWH0HVVDJH�PVJ����� 'LVSDWFK0HVVDJH�PVJ���`��`��7KH�7UDQVODWH0HVVDJH�IXQFWLRQ�LV�NH\�WR�XQGHUVWDQGLQJ�KRZ�:0B&+$5�PHVVDJHV�DUH�JHQHUDWHG��:KHQ�WKH�*HW0HVVDJH�IXQFWLRQ�REWDLQV�D�:0B.(<'2:1�RU�:0B6<6.(<'2:1�PHVVDJH�IURP�WKH�PHVVDJH�TXHXH��LW�VHQGV�LW�WR�WKH�7UDQVODWH0HVVDJH�

Page 324: Visual Basic - Subclassing and Hooking with VB & VB NET

IXQFWLRQ��7KLV�IXQFWLRQ�ILUVW�GHWHUPLQHV�LI�WKH�YLUWXDO�NH\�FRGH�FDQ�EH�FRQYHUWHG�WR�D�FKDUDFWHU�FRGH��,I�LW�FDQ��LW�FUHDWHV�D�:0B&+$5�RU�:0B6<6&+$5�PHVVDJH��GHSHQGLQJ�RQ�WKH�W\SH�RI�NH\�GRZQ�PHVVDJH��7KH�:0B&+$5�RU�:0B6<6&+$5�PHVVDJH�VWUXFWXUH�ZLOO�FRQWDLQ�WKH�FKDUDFWHU�FRGH�RI�WKH�NH\�SUHVVHG�LQ�LWV�Z3DUDP�PHPEHU��7KH�O3DUDP�LQIRUPDWLRQ�IURP�WKH�:0B.(<'2:1�RU�:0B6<6.(<'2:1�PHVVDJH�VWUXFWXUHV�DUH�SDVVHG�RQ��XQFKDQJHG��WR�WKH�O3DUDP�PHPEHU�RI�WKH�:0B&+$5�RU�:0B6<6&+$5�PHVVDJH�VWUXFWXUH���7KH�7UDQVODWH0HVVDJH�IXQFWLRQ�WKHQ�WDNHV�WKH�QHZ�:0B&+$5�RU�:0B6<6&+$5�PHVVDJH�DQG�SODFHV�LW�DW�WKH�KHDG�RI�WKH�PHVVDJH�TXHXH��7KLV�PHDQV�WKDW�DIWHU�WKH�7UDQVODWH0HVVDJH�IXQFWLRQ�REWDLQV�WKH�:0B.(<'2:1�RU�:0B6<6.(<'2:1�PHVVDJH�IURP�WKH�PHVVDJH�TXHXH��LW�ZLOO�REWDLQ�HLWKHU�WKH�:0B&+$5�RU�:0B6<6&+$5�PHVVDJH�QH[W��7KLV�RFFXUV�RQO\�LI�WKH�7UDQVODWH0HVVDJH�IXQFWLRQ�FDQ�WUDQVODWH�WKH�YLUWXDO�NH\�FRGH�LQWR�D�FKDUDFWHU�NH\�FRGH��RWKHUZLVH��LW�ZRQW�FUHDWH�:0B&+$5�RU�:0B6<6&+$5�PHVVDJHV���<RX�FDQ�XVH�DQ\�RI�WKH�IROORZLQJ�NH\V�WR�JHQHUDWH�:0B&+$5�PHVVDJHV���

• %$&.63$&(��• (17(5��FDUULDJH�UHWXUQ���• (6&��• 6+,)7�(17(5��OLQHIHHG���• 7$%��• $OO�FKDUDFWHUV�LQ�WKH�$6&,,�YDOXH�UDQJH�RI�+���WR�+))�

<RX�FDQ�XVH�HLWKHU�RI�WKH�IROORZLQJ�NH\V�WR�JHQHUDWH�:0B6<6&+$5�PHVVDJHV���

• )���• $/7�^NH\`�

7KH�ODVW�VWHS�LV�WR�VHQG�WKH�PHVVDJH�WR�WKH�FRUUHFW�ZLQGRZ�SURFHGXUH��7KH�NH\ERDUG�LQSXW�IRFXV�SURSHUW\�RI�WKH�WKUHDG�GHWHUPLQHV�ZKLFK�ZLQGRZ�SURFHGXUH�ZLOO�UHFHLYH�WKH�NH\ERDUG�PHVVDJH��<RX�FDQ�XVH�WKH�*HW)RFXV�IXQFWLRQ�WR�GHWHUPLQH�ZKLFK�ZLQGRZ�KDV�WKH�NH\ERDUG�IRFXV�IRU�WKH�WKUHDG�LQ�ZKLFK�WKLV�IXQFWLRQ�LV�H[HFXWHG��<RX�GHFODUH�WKLV�IXQFWLRQ�LQ�9LVXDO�%DVLF��9%��DV�IROORZV���3ULYDWH�'HFODUH�)XQFWLRQ�*HW)RFXV�/LE��XVHU����$OLDV��*HW)RFXV�������$V�/RQJ�7KLV�IXQFWLRQ�WDNHV�QR�SDUDPHWHUV�DQG�UHWXUQV�WKH�K:QG�RI�WKH�ZLQGRZ�ZLWK�NH\ERDUG�LQSXW�IRFXV��,I�QR�ZLQGRZ�KDV�WKH�NH\ERDUG�LQSXW�IRFXV��WKLV�IXQFWLRQ�UHWXUQV�D�18//���

�����'HVFULSWLRQ�RI�+RRNV�

7KH�:+B.(<%2$5'�DQG�:+B.(<%2$5'B//�KRRNV�LQWHUFHSW�PHVVDJHV�WKDW�UHODWH�WR�NH\ERDUG�LQSXW��7KH�PDLQ�GLIIHUHQFH�LV�WKDW�WKH�:+B.(<%2$5'B//�KRRN�FDSWXUHV�

Page 325: Visual Basic - Subclassing and Hooking with VB & VB NET

PHVVDJHV�VRRQHU�LQ�WKH�PHVVDJLQJ�V\VWHP�WKDQ�WKH�:+B.(<%2$5'�KRRN�GRHV��7KLV�DOORZV�WKH�:+B.(<%2$5'B//�KRRN�WR�FDSWXUH�FHUWDLQ�NH\ERDUG�PHVVDJHV�WKDW�WKH�:+B.(<%2$5'�KRRN�FDQQRW�FDSWXUH���<RX�FDQ�XVH�WKH�:+B.(<%2$5'�KRRN�DV�D�WKUHDG�VSHFLILF�KRRN��RU�\RX�FDQ�SODFH�LW�LQ�D�G\QDPLF�OLQN�OLEUDU\��'//��DQG�XVH�LW�DV�D�V\VWHP�ZLGH�KRRN��<RX�FDQ�XVH�WKH�:+B.(<%2$5'B//�KRRN�RQO\�DV�D�V\VWHP�ZLGH�KRRN��KRZHYHU��$�WKUHDG�VSHFLILF�KRRN�LQWHUFHSWV�DOO�PHVVDJHV�ZLWKLQ�WKH�WKUHDG�LQ�ZKLFK�LW�LV�LQVWDOOHG��:KHQ�\RX�LQVWDOO�D�KRRN�DV�D�V\VWHP�ZLGH�KRRN��\RX�PXVW�SODFH�LW�LQ�D�'//��7KLV�'//�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�VR�WKDW�WKH�KRRN�FDQ�RSHUDWH�RQ�DOO�PHVVDJHV�LQ�WKH�V\VWHP��&KDSWHU���GLVFXVVHV�WKLV�LQ�GHWDLO���%RWK�KRRNV�FDQ�RQO\�PRQLWRU�RU�UHPRYH�D�NH\ERDUG�PHVVDJH��QHLWKHU�KRRN�FDQ�PRGLI\�WKH�PHVVDJH��7KH�:+B.(<%2$5'�KRRN�FDQ�LQWHUFHSW�WZR�VSHFLILF�PHVVDJHV��WKH\�DUH�:0B.(<'2:1�DQG�:0B.(<83��7KH�:+B.(<%2$5'B//�KRRN�FDQ�LQWHUFHSW�WKHVH�WZR�PHVVDJHV�DV�ZHOO�DV�DQ\�:0B6<6.(<'2:1�DQG�:0B6<6.(<83�PHVVDJHV��7KHUH�LV�RQH�NH\�FRPELQDWLRQ�WKDW�QHLWKHU�KRRN�FDQ�UHPRYH��WKLV�LV�WKH�&75/�$/7�'(/�NH\�FRPELQDWLRQ��%\�SUHYHQWLQJ�WKLV�NH\�FRPELQDWLRQ�IURP�RSHUDWLQJ��\RX�FRXOG�RSHQ�XS�VHFXULW\�KROHV�LQ�WKH�:LQGRZV�17������RSHUDWLQJ�V\VWHPV��7KH�:+B.(<%2$5'B//�KRRN��XQOLNH�WKH�:+B.(<%2$5'�KRRN��FDQ�GHWHFW�WKH�&75/�$/7�'(/�NH\�FRPELQDWLRQ��WKRXJK���$QRWKHU�GLIIHUHQFH�EHWZHHQ�WKH�WZR�KRRNV�LV�WKDW�WKH�:+B.(<%2$5'B//�KRRN�FDQ�GHWHUPLQH�LI�WKH�NH\ERDUG�PHVVDJH�DFWXDOO\�RULJLQDWHG�DW�WKH�NH\ERDUG��RU�LI�LW�ZDV�LQMHFWHG�LQWR�WKH�PHVVDJLQJ�V\VWHP��<RX�FDQ�LQMHFW�D�NH\ERDUG�PHVVDJH�LQWR�WKH�PHVVDJLQJ�V\VWHP�E\�XVLQJ�WKH�6HQG,QSXW�IXQFWLRQ��ZKLFK�LV�GHILQHG�DV�IROORZV���8,17�6HQG,QSXW��8,17�X,QSXWV��/3,1387�S,QSXW��8,17�FE6L]H���,W�KDV�WKH�IROORZLQJ�WKUHH�SDUDPHWHUV��X,QSXWV

7KH�QXPEHU�RI�,1387�VWUXFWXUHV�LQ�WKH�DUUD\�SRLQWHG�WR�E\�S,QSXW��S,QSXW

$�SRLQWHU�WR�DQ�DUUD\�RI�,1387�VWUXFWXUHV�FE6L]H

7KH�VL]H�RI�WKH�,1387�VWUXFWXUH�7KH�,1387�VWUXFWXUH�FRQWDLQV�PHPEHUV�LGHQWLI\LQJ�WKH�W\SH�RI�PHVVDJH��NH\ERDUG��PRXVH��RU�KDUGZDUH��DQG�D�VWUXFWXUH�LGHQWLI\LQJ�WKH�UHOHYDQW�GDWD�IRU�WKH�W\SH�RI�PHVVDJH�LGHQWLILHG���7KH�6HQG,QSXW�IXQFWLRQ�UHSODFHV�WKH�.H\EGBHYHQW�IXQFWLRQ�IRU�DOO�RSHUDWLQJ�V\VWHPV�H[FHSW�:LQGRZV�����1RWH�WKDW�:LQGRZV�17�PXVW�KDYH�6HUYLFH�3DFN���RU�JUHDWHU�LQVWDOOHG��<RX�XVH�6HQG,QSXW�WR�FUHDWH�PHVVDJHV�DQG�LQMHFW�WKHP�LQWR�WKH�PHVVDJH�VWUHDP�VR�WKDW�WKH\�DUH�DOPRVW�LQGLVWLQJXLVKDEOH�IURP�QRUPDO�PHVVDJHV��)RU�H[DPSOH��\RX�FDQ�XVH�WKLV�IXQFWLRQ�WR�FUHDWH�:0B.(<83�DQG�:0B.(<'2:1�PHVVDJHV�WR�VLPXODWH�NH\VWURNHV��)XUWKHU�GLVFXVVLRQ�RI�WKLV�IXQFWLRQ�LV�EH\RQG�WKH�VFRSH�RI�WKLV�ERRN���2QH�SLHFH�RI�LQIRUPDWLRQ�WKDW�RQO\�WKH�:0B.(<%2$5'�KRRN�FDQ�GHWHUPLQH�LV�WKH�UHSHDW�FRXQW�RI�WKH�NH\�EHLQJ�SUHVVHG��7KH�UHSHDW�FRXQW�LV�WKH�QXPEHU�RI�WLPHV�WKH�VDPH�NH\�KDV�

Page 326: Visual Basic - Subclassing and Hooking with VB & VB NET

EHHQ�UHSHDWHG�ZKLOH�WKH�XVHU�LV�KROGLQJ�GRZQ�WKH�NH\��,QVWHDG�RI�VHQGLQJ�DV�D�VHSDUDWH�PHVVDJH�HYHU\�UHSHDWHG�NH\�FKDUDFWHU�WKH�XVHU�VHQGV�WR�WKH�V\VWHP��WKH�V\VWHP�VHQGV�RQH�PHVVDJH�ZLWK�D�UHSHDW�FRXQW�SURSHUW\�WKDW�GHWHUPLQHV�KRZ�PDQ\�WLPHV�WKH�NH\�KDV�UHSHDWHG��<RX�VKRXOG�XVH�WKLV�IHDWXUH�RI�WKH�NH\ERDUG�PHVVDJH�RQO\�ZKHQ�WKH�DSSOLFDWLRQ�FDQQRW�SURFHVV�WKH�LQGLYLGXDO�PHVVDJHV�TXLFNO\�HQRXJK��7R�LOOXVWUDWH�WKLV��WKH�PHVVDJHV�SURGXFHG�IURP�SUHVVLQJ�DQG�KROGLQJ�GRZQ�D�NH\�QRUPDOO\�ORRN�OLNH�WKLV���:0B.(<'2:1�����������������������������5HSHDW�FRXQW� ����:0B&+$5��������������������������������5HSHDW�FRXQW� ����:0B.(<'2:1�����������������������������5HSHDW�FRXQW� ����:0B&+$5��������������������������������5HSHDW�FRXQW� ����:0B.(<'2:1�����������������������������5HSHDW�FRXQW� ����:0B&+$5��������������������������������5HSHDW�FRXQW� ����:0B.(<'2:1�����������������������������5HSHDW�FRXQW� ����:0B&+$5��������������������������������5HSHDW�FRXQW� ����:0B.(<'2:1�����������������������������5HSHDW�FRXQW� ����:0B&+$5��������������������������������5HSHDW�FRXQW� ����:0B.(<'2:1�����������������������������5HSHDW�FRXQW� ����:0B&+$5��������������������������������5HSHDW�FRXQW� ����:0B.(<'2:1�����������������������������5HSHDW�FRXQW� ����:0B&+$5��������������������������������5HSHDW�FRXQW� ����:0B.(<83�������������������������������5HSHDW�FRXQW� ����,I�WKH�DSSOLFDWLRQ�LV�EXV\�SURFHVVLQJ�RWKHU�PHVVDJHV�DQG�FDQQRW�SURFHVV�WKH�:0B.(<'2:1�RU�:0B6<6.(<'2:1�PHVVDJHV�TXLFNO\�HQRXJK��LW�XVHV�WKH�UHSHDW�FRXQW�SURSHUW\��7KH�PHVVDJHV�SURGXFHG�LQ�WKLV�FDVH�ZRXOG�ORRN�OLNH�WKLV���:0B.(<'2:1�����������������������������5HSHDW�FRXQW� �����:0B&+$5��������������������������������5HSHDW�FRXQW� �����:0B.(<'2:1�����������������������������5HSHDW�FRXQW� ����7KLV�DOORZV�WKH�V\VWHP�WR�PRUH�HIILFLHQWO\�TXHXH�PHVVDJHV�LQ�WKH�WKUHDGV�PHVVDJH�TXHXH���7KH�:+B.(<%2$5'B//�KRRN�FDSWXUHV�PHVVDJHV�EHIRUH�WKH\�KDYH�D�FKDQFH�WR�EH�SRVWHG�WR�DQ\�WKUHDGV�PHVVDJH�TXHXH��:LWK�WKLV�KRRN��\RX�DOVR�FDQ�FDSWXUH�V\VWHP�NH\ERDUG�PHVVDJHV��:0B6<6.(<83�DQG�:0B6<6.(<'2:1����:+B.(<%2$5'B//�LV�DQ�LQWHUHVWLQJ�H[FHSWLRQ�EHFDXVH�\RX�FDQ�LQVWDOO�LW�RQO\�DV�D�V\VWHP�ZLGH�KRRN��$V�,�SUHYLRXVO\�PHQWLRQHG��V\VWHP�ZLGH�KRRNV�PXVW�UHVLGH�LQ�D�'//��+RZHYHU��WKLV�KRRN��DV�ZHOO�DV�WKH�:+B0286(B//��:+B-2851$/3/$<%$&.��DQG�:+B-2851$/5(&25'�KRRNV��FDQ�UHVLGH�HLWKHU�LQ�DQ�(;(�RU�'//�PRGXOH��7KLV�PHDQV�WKDW�ZH�FDQ�LPSOHPHQW�WKHVH�IRXU�KRRNV�ZLWKLQ�9%��7KLV�LV�EHFDXVH�WKH�ILOWHU�IXQFWLRQV�RI�WKHVH�KRRNV�DUH�FDOOHG�IURP�ZLWKLQ�WKH�FRQWH[W�RI�WKH�WKUHDG�WKDW�KDV�LQVWDOOHG�WKHVH�W\SHV�RI�KRRNV���7R�XQGHUVWDQG�ZK\�WKHVH�KRRNV�FDQ�UHVLGH�LQ�DQ�(;(��ZH�QHHG�WR�XQGHUVWDQG�KRZ�WKH\�PDQLSXODWH�WKH�PHVVDJH�SURFHVVLQJ�RI�HDFK�WKUHDG�UXQQLQJ�LQ�WKH�V\VWHP��1RUPDOO\��HYHU\�WKUHDG�KDV�LWV�RZQ�PHVVDJH�TXHXH�WR�ZKLFK�LW�LV�FRQQHFWHG��7KHVH�PHVVDJH�TXHXHV�UHFHLYH�

Page 327: Visual Basic - Subclassing and Hooking with VB & VB NET

PHVVDJHV�IURP�WKH�5,7��7KLV�DUFKLWHFWXUH�JLYHV�DOO����ELW�:LQGRZV�RSHUDWLQJ�V\VWHPV�UREXVW�PXOWLWKUHDGLQJ�FDSDELOLW\�DQG�SUHYHQWV�RQH�DSSOLFDWLRQ�IURP�KDQJLQJ�WKH�ZKROH�V\VWHP��$V�ZH�ZLOO�VHH��KRZHYHU��LQVWDOOLQJ�WKH�:+B.(<%2$5'B//�KRRN�GHVWUR\V�WKLV�RQH�WR�RQH�UHODWLRQVKLS�EHWZHHQ�D�WKUHDG�DQG�LWV�PHVVDJH�TXHXH���,W�LV�SRVVLEOH�WR�IRUFH�PXOWLSOH�WKUHDGV�WR�UHFHLYH�PHVVDJHV�IURP�D�VLQJOH�PHVVDJH�TXHXH��<RX�FDQ�DFFRPSOLVK�WKLV�E\�XVLQJ�WKH�$WWDFK7KUHDG,QSXW�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IXQFWLRQ��<RX�GHFODUH�WKLV�IXQFWLRQ�LQ�9%�DV�IROORZV���3ULYDWH�'HFODUH�)XQFWLRQ�$WWDFK7KUHDG,QSXW�/LE��XVHU����B����������$OLDV��$WWDFK7KUHDG,QSXW��� � �%\9DO�LG$WWDFK�$V�/RQJ��B�� � %\9DO�LG$WWDFK7R�$V�/RQJ��B?�� � %\9DO�I$WWDFK�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��LG$WWDFK

7KH�WKUHDG�,'�RI�WKH�WKUHDG�WR�EH�DWWDFKHG�WR�DQRWKHU�WKUHDGV�PHVVDJH�TXHXH���LG$WWDFK7R

7KH�WKUHDG�,'�RI�WKH�WKUHDG�FRQWDLQLQJ�WKH�PHVVDJH�TXHXH�WR�ZKLFK�WKH�WKUHDG�VSHFLILHG�E\�LG$WWDFK�LV�DWWDFKHG���

I$WWDFK

7UXH�VSHFLILHV�WR�DWWDFK�WKH�WZR�WKUHDGV��)DOVH�VSHFLILHV�WR�XQDWWDFK�WKH�WZR�WKUHDGV���$�UHWXUQ�YDOXH�RI�]HUR�LQGLFDWHV�WKDW�WKLV�IXQFWLRQ�IDLOHG��DQ\�RWKHU�YDOXH�LQGLFDWHV�VXFFHVV��1RWH�WKDW�\RX�FDQQRW�DWWDFK�D�WKUHDG�WR�WKH�5,7��WR�LWVHOI��RU�WR�D�WKUHDG�LQ�DQRWKHU�GHVNWRS��7KH�PHVVDJH�TXHXH�WKDW�LV�XVHG�E\�WKH�WKUHDG�WKDW�LG$WWDFK�VSHFLILHV�GRHV�QRW�UHFHLYH�LQSXW�DIWHU�WKLV�WKUHDG�LV�DWWDFKHG�WR�WKH�RWKHU�PHVVDJH�TXHXH���:KHQ�\RX�LQVWDOO�D�:+B.(<%2$5'B//�KRRN�LQ�D�WKUHDG��WKH�V\VWHP�DWWDFKHV�DOO�WKUHDGV�WR�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�WKDW�LQVWDOOHG�WKLV�KRRN��7KLV�LV�VLPLODU�WR�FDOOLQJ�$WWDFK7KUHDG,QSXW�IRU�HDFK�WKUHDG�DQG�VHWWLQJ�WKH�YDOXH�RI�LG$WWDFK�WR�WKH�WKUHDG�,'�IRU�HDFK�LQGLYLGXDO�WKUHDG��DOZD\V�VHWWLQJ�LG$WWDFK7R�WR�WKH�WKUHDG�,'�RI�WKH�WKUHDG�WKDW�LQVWDOOHG�WKH�MRXUQDO�KRRN��DQG�DOZD\V�VHWWLQJ�I$WWDFK�WR�7UXH��7KH�UHVXOW�LV�D�VLQJOH�PHVVDJH�TXHXH�IRU�DOO�WKUHDGV�LQ�WKH�V\VWHP��)LJXUH������LOOXVWUDWHV�WKLV�FRQFHSW���

)LJXUH�������7KUHDG�VWDWH�EHIRUH�DQG�DIWHU�D�:+B.(<%2$5'B//�KRRN�LV�LQVWDOOHG�

Page 328: Visual Basic - Subclassing and Hooking with VB & VB NET

%HFDXVH�D�VLQJOH�PHVVDJH�TXHXH�LV�IHHGLQJ�DOO�WKUHDGV�LQ�WKH�V\VWHP��\RX�FDQ�FDOO�WKHVH�KRRNV�IURP�ZLWKLQ�WKH�FRQWH[W�RI�WKH�WKUHDG�WKDW�LQVWDOOHG�WKH�KRRNV����ZKLFK��LQ�RXU�FDVH��LV�WKH�9%�DSSOLFDWLRQ���2UGLQDULO\��'//V�DUH�UHTXLUHG�IRU�V\VWHP�ZLGH�KRRNV�EHFDXVH�HDFK�WKUHDG�KDV�LWV�RZQ�PHVVDJH�TXHXH��7KLV�'//�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�VR�WKDW�WKH�KRRN�FDQ�RSHUDWH�RQ�DOO�PHVVDJHV��DQG�DOO�PHVVDJH�TXHXHV��LQ�WKH�V\VWHP��$Q�(;(��XQOLNH�D�'//��FDQQRW�EH�LQMHFWHG�LQWR�HYHU\�SURFHVV��DQG�KHQFH�FDQQRW�RSHUDWH�RQ�DOO�PHVVDJHV�ZKHQ�WKHUH�DUH�PXOWLSOH�PHVVDJH�TXHXHV��2Q�WKH�RWKHU�KDQG��\RX�FDQ�LQVWDOO�:+B.(<%2$5'B//�IRU�D�VLQJOH�WKUHDG�DQG�VWLOO�UHFHLYH�HYHU\�PHVVDJH�WKH�V\VWHP�JHQHUDWHV�EHFDXVH�HYHU\�PHVVDJH�LV�EHLQJ�IXQQHOHG�WKURXJK�D�VLQJOH�PHVVDJH�TXHXH���

�������)LOWHU�)XQFWLRQ�'HILQLWLRQV�

Page 329: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�IXQFWLRQ�SURWRW\SH�IRU�WKH�:+B.(<%2$5'�KRRN�LV�GHILQHG�DV�IROORZV���3XEOLF�)XQFWLRQ�:QG.H\%RDUG3URF�%\9DO�X&RGH�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��B�� � %\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��X&RGH

7KH�FRGH�VHQW�WR�WKLV�KRRN�WKDW�LQIRUPV�WKH�GHYHORSHU�KRZ�WR�KDQGOH�WKLV�NH\ERDUG�PHVVDJH���

Z3DUDP

7KH�YLUWXDO�NH\�FRGH��O3DUDP

7KLV�PHPEHU�FRQWDLQV�IODJV�DQG�RWKHU�LQIRUPDWLRQ�DERXW�WKH�NH\�SUHVVHG��,QIRUPDWLRQ�LQFOXGHV�WUDQVLWLRQ�VWDWH�IODJ��SUHYLRXV�NH\�VWDWH�IODJ��FRQWH[W�FRGH��H[WHQGHG�NH\�IODJ��VFDQ�FRGH��DQG�NH\�UHSHDW�FRXQW���

7KH�IXQFWLRQ�SURWRW\SH�IRU�WKH�:+B.(<%2$5'B//�KRRN�LV�GHILQHG�DV�IROORZV���3XEOLF�)XQFWLRQ�:QG.H\%RDUG3URFB//�%\9DO�X&RGH�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��B�� � %\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�7KH�KRRNV�SDUDPHWHUV�DUH��X&RGH

7KH�FRGH�VHQW�WR�WKLV�KRRN�WKDW�LQIRUPV�WKH�GHYHORSHU�KRZ�WR�KDQGOH�WKLV�NH\ERDUG�PHVVDJH��

Z3DUDP

7KH�PHVVDJH�,'��:0B.(<'2:1��:0B.(<83��:0B6<6.(<'2:1��RU�:0B6<6.(<83���

O3DUDP

$�SRLQWHU�WR�D�.%'//+22.6758&7�VWUXFWXUH�7KH�.%'//+22.6758&7�VWUXFWXUH�FRQWDLQV�LQIRUPDWLRQ�VSHFLILF�WR�WKH�:+B.(<%2$5'B//�KRRN��VRPH�RI�ZKLFK�\RX�FDQQRW�REWDLQ�WKURXJK�WKH�:+B.(<%2$5'�KRRN��7KLV�VWUXFWXUH�LV�GHILQHG�LQ�9%�DV�IROORZV���3ULYDWH�7\SH�.%'//+22.6758&7�� YN&RGH�DV�/RQJ�� VFDQ&RGH�DV�/RQJ�� IODJV�DV�/RQJ�� WLPH�DV�/RQJ�� GZ([WUD,QIR�DV�/RQJ�(QG�7\SH�7KH�PHPEHUV�RI�WKH�.%'//+22.6758&7�VWUXFWXUH�DUH��YN&RGH

7KH�YLUWXDO�NH\�FRGH��

Page 330: Visual Basic - Subclassing and Hooking with VB & VB NET

VFDQ&RGH

7KH�VFDQ�FRGH��IODJV

7KLV�PHPEHU�FRQWDLQV�IODJV�IRU�WKH�NH\�SUHVVHG��7KH�IODJV�LQFOXGH�H[WHQGHG�NH\��LQMHFWHG�PHVVDJH��FRQWH[W�FRGH��DQG�WUDQVLWLRQ�VWDWH���

WLPH

7KH�WLPH�WKLV�PHVVDJH�ZDV�SRVWHG��GZ([WUD,QIR

$�SRLQWHU�WR�H[WUD�GHYHORSHU�GHILQHG�LQIRUPDWLRQ���

�������([SODQDWLRQ�RI�+RRN�&RGHV�

7KH�V\VWHP�VHQGV�WZR�FRGHV�WR�WKH�X&RGH�SDUDPHWHU�RI�WKH�:+B.(<%2$5'�KRRNV�ILOWHU�IXQFWLRQ��+&B$&7,21�DQG�+&B125(029(��7KH�:+B.(<%2$5'B//��KRZHYHU��RQO\�UHFHLYHV�WKH�+&B$&7,21�FRGH��7KHUH�LV�QR�UHDVRQ�IRU�WKH�ORZ�OHYHO�NH\ERDUG�KRRN�WR�XVH�WKH�+&B125(029(�FRGH�EHFDXVH�WKH�PHVVDJHV�KDYH�QRW�\HW�EHHQ�SODFHG�RQWR�WKH�PHVVDJH�TXHXH��(DFK�FRGH�LV�GHILQHG�KHUH���+&B$&7,21

7KH�Z3DUDP�DQG�O3DUDP�SDUDPHWHUV�FRQWDLQ�LQIRUPDWLRQ�DERXW�NH\ERDUG�PHVVDJHV�WKDW�KDYH�EHHQ�UHPRYHG�IURP�WKH�PHVVDJH�TXHXH��*HW0HVVDJH����

+&B125(029(

7KH�Z3DUDP�DQG�O3DUDP�SDUDPHWHUV�FRQWDLQ�LQIRUPDWLRQ�DERXW�NH\ERDUG�PHVVDJHV�WKDW�KDYH�EHHQ�UHDG�EXW�QRW�UHPRYHG�IURP�WKH�PHVVDJH�TXHXH��3HHN0HVVDJH����

�������/RFDWLRQ�RI�7KLV�+RRN�LQ�WKH�6\VWHP�

7KH�:+B.(<%2$5'�KRRN�LV�FDOOHG�LQ�WKH�PHVVDJH�ORRS�RI�D�WKUHDG��7KLV�KRRN�LV�ORFDWHG�LQVLGH�RI�WKH�*HW0HVVDJH�DQG�3HHN0HVVDJH�IXQFWLRQV��DV�)LJXUH������LOOXVWUDWHV��7KHUHIRUH��LI�WKH�KRRN�UHWXUQV�D����WKH�V\VWHP�GLVFDUGV�WKH�PHVVDJH�LQVLGH�WKH�*HW0HVVDJH�RU�3HHN0HVVDJH�IXQFWLRQ�DQG�WKH�UHVW�RI�WKH�PHVVDJH�ORRS�GRHV�QRW�SURFHVV�WKH�PHVVDJH���

)LJXUH�������7KH�ORFDWLRQ�RI�WKH�:+B.(<%2$5'�KRRN�

Page 331: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�:+B.(<%2$5'B//�KRRN�DOVR�LV�ORFDWHG�LPPHGLDWHO\�EHIRUH�D�PHVVDJH�LV�SODFHG�LQWR�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�WKDW�LQVWDOOHG�WKH�KRRN��DV�)LJXUH������LOOXVWUDWHV��5HPHPEHU�WKDW�DOO�PHVVDJH�TXHXHV�DUH�DWWDFKHG�WR�WKH�PHVVDJH�ORRS�RI�WKLV�VDPH�WKUHDG���

�����$�7KUHDG�6SHFLILF�([DPSOH�

7KH�ILUVW�H[DPSOH�XVLQJ�WKH�:+B.(<%2$5'�KRRN�ZLOO�EH�WKUHDG�VSHFLILF��7KLV�H[DPSOH�ZLOO�ZDWFK�IRU�WKH�:LQGRZV�NH\�RQ�WKH�NH\ERDUG�WR�EH�SUHVVHG��DORQJ�ZLWK�WKH��Z��NH\��:KHQ�WKH�XVHU�SUHVVHV�WKLV�NH\�FRPELQDWLRQ��,QWHUQHW�([SORUHU�VWDUWV��,W�LV�HDV\�WR�FKDQJH�WKH�NH\�FRPELQDWLRQ�DQG�WKH�DSSOLFDWLRQ�WKDW�LV�VWDUWHG�WR�VXLW�\RXU�RZQ�SXUSRVHV���7R�XVH�WKH�DSSOLFDWLRQ��VLPSO\�FOLFN�WKH�+RRN�EXWWRQ�LQ�WKH�:+B.(<%2$5'�IUDPH�RQ�WKH�9%�IRUP��1H[W��SUHVV�WKH�:LQGRZV�NH\�RQ�WKH�NH\ERDUG�DQG�KROG�LW�GRZQ�ZKLOH�SUHVVLQJ�WKH��Z��NH\��,QWHUQHW�([SORUHU�VKRXOG�VWDUW��)LJXUH������VKRZV�D�VFUHHQVKRW�RI�WKH�DSSOLFDWLRQV�XVHU�LQWHUIDFH��8,����

)LJXUH�������6FUHHQVKRW�RI�WKH�WKUHDG�VSHFLILF�H[DPSOH�

Page 332: Visual Basic - Subclassing and Hooking with VB & VB NET

7DEOH������OLVWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��

2EMHFW�7\SH� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�)RUP� 1DPH� )RUP��)RUP� &DSWLRQ� �:+B.(<%2$5'�+RRN�7HVW��)RUP� %RUGHU6W\OH� ��)L[HG�'LDORJ�)RUP� 7RS� ����)RUP� /HIW� ����)RUP� +HLJKW� �����)RUP� :LGWK� �����)UDPH� &DSWLRQ� �:+B.(<%2$5'��)UDPH� 1DPH� )UDPH��)UDPH� 7RS� ����)UDPH� /HIW� ����)UDPH� +HLJKW� �����)UDPH� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH�� FPG+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �KRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH�� FPG8Q+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �XQKRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����

Page 333: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�DSSOLFDWLRQ�FRQWDLQV�D�KRRN�EXWWRQ�WKDW�LQVWDOOV�WKH�V\VWHP�ZLGH�KRRN��DQG�DQ�XQKRRN�EXWWRQ�WKDW�UHPRYHV�WKH�KRRN��7KH�9%�FRGH�LQ�([DPSOH������LV�SODFHG�EHKLQG�HDFK�EXWWRQ�LQ�WKH�)RUP��IUP�PRGXOH���

([DPSOH�������)RUP��IUP�&RGH��

3ULYDWH�6XE�FPG+RRNB&OLFN���������&DOO�6HW.H\ERDUG+RRN�(QG�6XE��3ULYDWH�6XE�FPG8Q+RRNB&OLFN���������&DOO�5HPRYH.H\ERDUG+RRN�(QG�6XE���������������&/($183�������������3ULYDWH�6XE�)RUPB4XHU\8QORDG�&DQFHO�$V�,QWHJHU��8QORDG0RGH�$V�,QWHJHU������,I�,V+RRNHG�7KHQ���������&DQFHO� �����������0VJ%R[��8QKRRN�EHIRUH�FORVLQJ��RU�WKH�,'(�ZLOO�FUDVK�������(QG�,I�(QG�6XE�7KH�)RUPB4XHU\8QORDG�HYHQW�VLPSO\�FKHFNV�WKH�,V+RRNHG�JOREDO�IODJ�WR�GHWHUPLQH�LI�WKH�KRRN�LV�VWLOO�LQVWDOOHG��,I�LW�LV��WKH�V\VWHP�GLVSOD\V�D�PHVVDJH�ZDUQLQJ�WKH�XVHU�WKDW�WKH�KRRN�LV�VWLOO�LQ�SODFH�DQG�WKDW�VKXWWLQJ�GRZQ�WKH�DSSOLFDWLRQ�LV�FDQFHOHG��,I�WKH�DSSOLFDWLRQ�ZHUH�WR�VKXW�GRZQ�ZLWKRXW�UHPRYLQJ�WKH�KRRN��LW�ZRXOG�VXIIHU�D�*HQHUDO�3URWHFWLRQ�)DXOW��*3)����([DPSOH������SUHVHQWV�WKH�FRGH�IRU�WKH�0RGXOH��EDV�PRGXOH��$�SULYDWH�YDULDEOH��K+RRN��LV�GHFODUHG�WR�KROG�WKH�KDQGOH�WR�WKH�KRRN��$�JOREDO�YDULDEOH��,V+RRNHG��LV�GHFODUHG�DV�D�IODJ�LQGLFDWLQJ�ZKHWKHU�WKH�KRRN�LV�LQVWDOOHG���

([DPSOH�������0RGXOH��EDV�&RGH��

3ULYDWH�K+RRN�$V�/RQJ�3XEOLF�,V+RRNHG�$V�%RROHDQ���������������������������������6(7�0(66$*(�),/7(5�+22.�������������������������������

Page 334: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�6XE�6HW.H\ERDUG+RRN���������,I�,V+RRNHG�7KHQ���������0VJ%R[��'RQW�KRRN�:+B.(<%2$5'�WZLFH�RU�\RX�ZLOO�EH�XQDEOH�WR�XQKRRN�LW�������(OVH���������K+RRN� �6HW:LQGRZV+RRN([�:+B.(<%2$5'��$GGUHVV2I�:QG.H\%RDUG3URF�����B����������������������������������$SS�7KUHDG,'����������,V+RRNHG� �7UXH�����(QG�,I�(QG�6XE���������������������������������5(029(�0(66$*(�),/7(5�+22.�������������������������������3XEOLF�6XE�5HPRYH.H\ERDUG+RRN���������'LP�5HW9DO�$V�/RQJ�����5HW9DO� �8QKRRN:LQGRZV+RRN([�K+RRN������,V+RRNHG� �)DOVH�(QG�6XE���������������������������������+22.�),/7(5�)81&7,21��������������������������������3XEOLF�)XQFWLRQ�:QG.H\%RDUG3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B���������%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�����'LP�E:LQ.H\'RZQ�$V�%RROHDQ�����'LP�E&KDU.H\8S�$V�%RROHDQ�����'LP�L:LQ.H\6WDWH�$V�,QWHJHU����������,I�X&RGH�! ���7KHQ���������6HOHFW�&DVH�X&RGH�������������&DVH�+&B$&7,21�����������������L:LQ.H\6WDWH� �*HW$V\QF.H\6WDWH�9.B/:,1������������������,I��L:LQ.H\6WDWH�$QG�+������ �+�����7KHQ���������������������E:LQ.H\'RZQ� �7UXH�����������������(OVH���������������������E:LQ.H\'RZQ� �)DOVH�����������������(QG�,I������������������,I��O3DUDP�$QG�+���������� �+���������7KHQ���������������������:0B.(<83�

Page 335: Visual Basic - Subclassing and Hooking with VB & VB NET

��������������������E&KDU.H\8S� �7UXH�����������������(OVH���������������������:0B.(<'2:1���������������������E&KDU.H\8S� �)DOVH�����������������(QG�,I����������������������������������,I���+H[��Z3DUDP�� �������$QG�E:LQ.H\'RZQ�$QG�1RW��E&KDU.H\8S���7KHQ���������������������,I�\RX�GR�WKLV�RQ�D�NH\GRZQ�WKHQ�\RX�JHW�����FRSLHV�ORDGHG�����������������������7KLV�RQO\�KDSSHQV�ZKHQ�WKH�9%�GULYHU�DSS�LV�#�WKH�IRUHJURXQG���������������������&DOO�6KHOO��&�?3URJUDP�)LOHV?,QWHUQHW�([SORUHU?,H[SORUH�H[H���B��������������������������������6:B6+2:1250$/�����������������������5HWXUQLQJ�IDOVH�GLVDOORZV�WKH�Z�WR�EH�VHQW�WR�WKH�IRFXV�ZLQGRZ���������������������:QG.H\%RDUG3URF� �����������������������([LW�)XQFWLRQ�����������������(QG�,I�������������&DVH�+&B125(029(�����������������7KH�PHVVDJH�KDV�QRW�EHHQ�UHPRYHG�IURP�WKH�PHVVDJH�TXHXH�������������&DVH�(OVH�����������������'R�QRWKLQJ���������(QG�6HOHFW�����(QG�,I��������������:QG.H\%RDUG3URF� �&DOO1H[W+RRN([�K+RRN��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KH�6HW.H\ERDUG+RRN�IXQFWLRQ�XVHV�WKH�6HW:LQGRZV+RRN([�IXQFWLRQ�WR�LQVWDOO�WKH�:+B.(<%2$5'�KRRN�DQG�VHWV�WKH�,V+RRNHG�IODJ�WR�7UXH��7KH�6HW:LQGRZV+RRN([�IXQFWLRQ�XVHV�WKH�:+B.(<%2$5'�FRQVWDQW�WR�VLJQLI\�WKDW�D�NH\ERDUG�KRRN�LV�WR�EH�LQVWDOOHG��7KH�:+B.(<%2$5'�FRQVWDQW�KDV�D�YDOXH�RI�����([DPSOH������VKRZV�KRZ�WR�FRGH�WKH�ILOWHU�IXQFWLRQ�IRU�WKH�NH\ERDUG�KRRN��,Q�WKLV�ILOWHU�IXQFWLRQ��WKH�SURFHVVLQJ�LV�SHUIRUPHG�ZKHQ�WKH�+&B$&7,21�FRGH�LV�SDVVHG�LQ�WR�WKLV�IXQFWLRQ��RWKHUZLVH��QR�SURFHVVLQJ�RFFXUV��DQG�WKH�QH[W�KRRN�LQ�WKH�FKDLQ�LV�FDOOHG��7KH�ILUVW�WKLQJ�ZH�PXVW�GR�ZKHQ�DQ�+&B$&7,21�FRGH�LV�SDVVHG�LQ�WR�WKLV�IXQFWLRQ�LV�WR�GHWHUPLQH�LI�WKH�:LQGRZV�NH\�LV�FXUUHQWO\�SUHVVHG��7R�GR�WKLV��ZH�PXVW�SDVV�LQ�WKH�YLUWXDO�NH\�FRGH�RI�WKH�:LQGRZV�NH\��9.B/:,1��WR�WKH�*HW$V\QF.H\6WDWH�IXQFWLRQ���*HW$V\QF.H\6WDWH�LV�GHFODUHG�LQ�9LVXDO�%DVLF�DV�IROORZV���3ULYDWH�'HFODUH�)XQFWLRQ�*HW$V\QF.H\6WDWH�/LE��XVHU�����%\9DO�Y.H\�$V�/RQJ��B�����������$V�,QWHJHU�,WV�VLQJOH�SDUDPHWHU�LV��

Page 336: Visual Basic - Subclassing and Hooking with VB & VB NET

9.H\

7KH�YLUWXDO�NH\�ZKRVH�VWDWH�LV�WR�EH�FKHFNHG�7KH�UHWXUQ�YDOXH�RI�WKLV�IXQFWLRQ�LV�DQ�LQWHJHU��7KH�PRVW�VLJQLILFDQW�ELW�LV�VHW�LI�WKH�NH\�DVVRFLDWHG�ZLWK�WKH�Y.H\�SDUDPHWHU�LV�FXUUHQWO\�GRZQ��LW�LV�]HUR�RWKHUZLVH��7KH�OHDVW�VLJQLILFDQW�ELW�LV�VHW�LI�WKH�XVHU�SUHVVHG�WKH�NH\�DIWHU�D�SULRU�FDOO�WR�*HW$V\QF.H\6WDWH��%\�$1'LQJ�WKH�UHWXUQ�YDOXH�RI�WKLV�IXQFWLRQ�ZLWK�WKH�YDOXH�+������ZH�FDQ�GHWHUPLQH�LI�WKH�PRVW�VLJQLILFDQW�ELW�LV�VHW��,I�WKLV�ELW�LV�VHW��WKH�%RROHDQ�E:LQ.H\'RZQ�IODJ�LV�VHW�WR�7UXH��LQGLFDWLQJ�WKDW�WKH�OHIW�:LQGRZV�NH\�LV�FXUUHQWO\�EHLQJ�SUHVVHG���7KH�QH[W�WKLQJ�WR�GHWHUPLQH�LV�WKH�VWDWH�RI�WKH�PRVW�VLJQLILFDQW�ELW�RI�WKH�O3DUDP�SDUDPHWHU�IRU�WKLV�ILOWHU�IXQFWLRQ��7KLV�ELW�LV�WKH�WUDQVLWLRQ�IODJ�IRU�WKH�NH\ERDUG�HYHQW��,I�WKLV�ELW�LV�VHW��WKH�XVHU�LV�UHOHDVLQJ�WKH�NH\��:0B.(<83���RWKHUZLVH��WKH�XVHU�LV�SUHVVLQJ�LW��:0B.(<'2:1���7KH�V\VWHP�VHWV�WKH�%RROHDQ�E&KDU.H\8S�IODJ�WR�7UXH�ZKHQ�WKH�XVHU�LV�UHOHDVLQJ�WKH�NH\���,I�WKH�:LQGRZV�NH\�LV�SUHVVHG��QH[W�ZH�FDQ�GHWHUPLQH�LI�WKH��Z��NH\�DOVR�LV�EHLQJ�SUHVVHG��7KH�YLUWXDO�NH\�FRGH�IRU�WKH��Z��NH\�LV�+����7KH�Z3DUDP�SDUDPHWHU�RI�WKH�ILOWHU�IXQFWLRQ�FRQWDLQV�WKH�YLUWXDO�NH\�FRGH��7KH�IROORZLQJ�OLQH�RI�FRGH�WHVWV�IRU�WKLV���,I���+H[��Z3DUDP�� �������$QG�E:LQ.H\'RZQ�$QG�1RW��E&KDU.H\8S���7KHQ�:KHQ�WKLV�VWDWHPHQW�HYDOXDWHV�WR�7UXH��WKH�,QWHUQHW�([SORUHU�DSSOLFDWLRQ�VWDUWV��:H�PXVW�GR�WZR�PRUH�LPSRUWDQW�WKLQJV�EHIRUH�ZH�FDQ�H[LW�WKLV�IXQFWLRQ��,I�WKH�V\VWHP�GRHV�QRW�WKURZ�RXW�WKH�PHVVDJH��LW�ZLOO�VWLOO�EH�VHQW�WR�LWV�RULJLQDO�GHVWLQDWLRQ��7KLV�FDXVHV�D�SUREOHP�ZKHQ�DQ�HGLW�ZLQGRZ�KDV�WKH�FXUUHQW�NH\ERDUG�LQSXW�IRFXV��,I�WKH�PHVVDJH�UHDFKHV�LWV�RULJLQDO�ZLQGRZ�GHVWLQDWLRQ��WKH�HGLW�ZLQGRZ��D��Z��LV�GLVSOD\HG�LQ�WKH�HGLW�ZLQGRZ��7R�VWRS�WKLV�IURP�KDSSHQLQJ��ZH�VLPSO\�WKURZ�RXW�WKH�PHVVDJH�DQG�VWRS�DQ\�RWKHU�NH\ERDUG�KRRNV�IURP�SURFHVVLQJ�WKH�NH\ERDUG�PHVVDJH��)LUVW��ZH�VHW�WKH�UHWXUQ�YDOXH�IRU�WKH�ILOWHU�IXQFWLRQ�WR����7KLV�FDXVHV�WKH�KRRN�WR�WKURZ�RXW�WKH�NH\ERDUG�PHVVDJH�IRU�WKH��Z��NH\��WKHUHIRUH��LW�ZLOO�QHYHU�UHDFK�WKH�LQWHQGHG�ZLQGRZ�ZLWK�NH\ERDUG�IRFXV��6HFRQG��WKH�ILOWHU�IXQFWLRQ�LV�H[LWHG��DQG�WKH�QH[W�ILOWHU�IXQFWLRQ�LQ�WKH�KRRN�FKDLQ�LV�QRW�FDOOHG���2Q�WKH�RWKHU�KDQG��LI�WKH�:LQGRZV�DQG��Z��NH\V�DUH�QRW�SUHVVHG��ZH�FDOO�&DOO1H[W+RRN([�WR�SDVV�WKH�PHVVDJH�RQ�WR�WKH�QH[W�LQVWDOOHG�ILOWHU�IXQFWLRQ�LQ�WKH�KRRN�FKDLQ���

�����$�6\VWHP�:LGH�([DPSOH�

$OORZLQJ�D�VLQJOH�DSSOLFDWLRQ�WR�PDNH�XVH�RI�WKH�:LQGRZV�NH\�LV�QLFH��EXW�LW�ZRXOG�EH�EHWWHU�LI�ZH�FRXOG�DGG�D�V\VWHP�ZLGH�:LQGRZV�NH\�IXQFWLRQ��7DNLQJ�WKH�SUHYLRXV�H[DPSOH�RQH�VWHS�IXUWKHU��ZH�FRXOG�FUHDWH�WKH�KRRN�ZLWK�D�V\VWHP�ZLGH�VFRSH�VR�WKDW�QR�PDWWHU�ZKLFK�DSSOLFDWLRQ�\RX�ZHUH�LQ��\RX�FRXOG�DOZD\V�SUHVV�WKH�:LQGRZV�NH\�DORQJ�ZLWK�WKH��Z��NH\��DQG�,QWHUQHW�([SORUHU�ZRXOG�VWDUW��7KLV�LV�VLPLODU�LQ�FRQFHSW�WR�:LQGRZV�GHIDXOW�EHKDYLRU�RI�ODXQFKLQJ�:LQGRZV�([SORUHU�ZKHQ�WKH�XVHU�SUHVVHV�WKH�:LQGRZV�NH\�DORQJ�ZLWK�WKH��H��NH\���

Page 337: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�8,�IRU�WKLV�DSSOLFDWLRQ��ZKLFK�)LJXUH������LOOXVWUDWHV��LV�YHU\�VLPSOH��7KH�+RRN�EXWWRQ�VLPSO\�LQVWDOOV�WKH�KRRN�E\�LQMHFWLQJ�WKH�&���'//�FRQWDLQLQJ�WKH�ILOWHU�IXQFWLRQ�LQWR�DOO�UXQQLQJ�SURFHVVHV��1RZ�ZH�FDQ�SUHVV�WKH�+RRN�EXWWRQ�DQG�KDYH�,QWHUQHW�([SORUHU�VWDUW�ZKHQ�ZH�SUHVV�WKH�:LQGRZV�NH\�DQG�WKH��Z��NH\��7KH�8QKRRN�EXWWRQ�UHPRYHV�WKH�KRRN�IURP�DOO�UXQQLQJ�SURFHVVHV���

)LJXUH�������6FUHHQVKRW�RI�V\VWHP�ZLGH�NH\ERDUG�KRRN�DSSOLFDWLRQ�

7DEOH������SUHVHQWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��

2EMHFW�7\SH� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�)RUP� 1DPH� 6\V)RUP��)RUP� &DSWLRQ� �6\V.H\+N��)RUP� %RUGHU6W\OH� ��)L[HG�'LDORJ�)RUP� 7RS� ����)RUP� /HIW� ����)RUP� +HLJKW� �����)RUP� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH�� FPG+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �+RRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH�� FPG8Q+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �8QKRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����:H�GRQW�QHHG�WR�ZULWH�PXFK�9%�FRGH�IRU�WKH�9%�SRUWLRQ�RI�WKLV�DSSOLFDWLRQ��([DPSOH������VKRZV�WKH�FRGH�IRU�WKH�6\V)RUP��IUP�PRGXOH��7KH�WZR�H[WHUQDO�IXQFWLRQV��,QVWDOO)LOWHU'//�

Page 338: Visual Basic - Subclassing and Hooking with VB & VB NET

DQG�8Q,QVWDOO)LOWHU'//��DUH�GHFODUHG�ILUVW��7KH�+RRN�EXWWRQ�VLPSO\�FDOOV�,QVWDOO)LOWHU'//�DQG�WKH�8QKRRN�EXWWRQ�FDOOV�8Q,QVWDOO)LOWHU'//��1RWKLQJ�HOVH�RI�LPSRUWDQFH�KDSSHQV�LQ�WKH�9%�FRGH���

([DPSOH�������9%�6\V)RUP��IUP�&RGH�IRU�D�6\VWHP�ZLGH�.H\ERDUG�+RRN��

3ULYDWH�'HFODUH�)XQFWLRQ�,QVWDOO)LOWHU'//�/LE���?6\V+RRN?'HEXJ?0DLQ+RRN�'OO�������B�����������$V�/RQJ�3ULYDWH�'HFODUH�)XQFWLRQ�8Q,QVWDOO)LOWHU'//�/LE���?6\V+RRN?'HEXJ?0DLQ+RRN�'OO�������B�����������$V�/RQJ������3XEOLF�6XE�FPG+RRNB&OLFN����������'LP�O5HW9DO�$V�/RQJ�����O5HW9DO� �,QVWDOO)LOWHU'//��������������,I�O5HW9DO��!���7KHQ���������0VJ%R[��(UURU�,QVWDOOLQJ�.H\ERDUG�+RRN������(QG�,I�(QG�6XE��3XEOLF�6XE�FPG8QKRRNB&OLFN���������'LP�O5HW9DO�$V�/RQJ�����O5HW9DO� �8Q,QVWDOO)LOWHU'//��������������,I�O5HW9DO��!���7KHQ���������0VJ%R[��(UURU�UHPRYLQJ�.H\ERDUG�+RRN������(QG�,I�(QG�6XE�7KH�'//�FRQWDLQV�WKH�PDLQ�IXQFWLRQDOLW\��,�ZURWH�WKLV�FRGH�LQ�&���DQG�SODFHG�LW�LQ�D�:LQ���'//��,�GLG�WKLV�EHFDXVH�D�V\VWHP�ZLGH�KRRN�PXVW�EH�SODFHG�LQ�D�'//��DQG�9%�FDQQRW�FUHDWH�WUXH�:LQ���'//V��7KH�V\VWHP�LQMHFWV�WKLV�'//�LQWR�HYHU\�SURFHVV��7KHUHIRUH��DQ\�SURFHVV�FDQ�FDOO�RXU�KRRN�IXQFWLRQ���7KH�'//�FRQWDLQV�WZR�H[SRUWHG�IXQFWLRQV��,QVWDOO)LOWHU'//�DQG�8Q,QVWDOO)LOWHU'//��DV�ZHOO�DV�WKH�.H\ERDUG)XQF�ILOWHU�IXQFWLRQ��([DPSOH������VKRZV�WKH�FRGH�DGGHG�WR�WKH�0DLQ+RRN�K�KHDGHU�ILOH��7KH�ILUVW�OLQH�GHILQHV�WKH�6\V0VJ3URF�ILOWHU�IXQFWLRQ�DV�W\SH�&$//%$&.��7KH�UHVW�RI�WKH�FRGH�GHILQHV�WKH�WZR�H[SRUWHG�IXQFWLRQV�DV�0$,1+22.B$3,��0$,1+22.B$3,�LV��LQ�WXUQ��GHILQHG�DV�B�BGHFGOVSHF�GOOH[SRUW����

([DPSOH�������7KH�0DLQ+RRN�K�+HDGHU�)LOH��

Page 339: Visual Basic - Subclassing and Hooking with VB & VB NET

�GHILQH�0$,1+22.B$3,�B��BGHFOVSHF�GOOH[SRUW�����GHILQH�&&219�BVWGFDOO���GHILQH�120$1*/(��� �� �'HILQHV�DQG�6WUXFWXUH�XVHG�E\�:+B.(<%2$5'B//�� ���GHILQH�:+B.(<%2$5'����GHILQH�+&B$&7,21����W\SHGHI�VWUXFW�WDJ.%'//+22.6758&7�^��':25'�YN&RGH���':25'�VFDQ&RGH���':25'�IODJV���':25'�WLPH���':25'�GZ([WUD,QIR��`�.%'//+22.6758&7��)$5� /3.%'//+22.6758&7�� 3.%'//+22.6758&7������)XQFWLRQ�GHFODUDWLRQV�/5(68/7�&$//%$&.�.H\ERDUG)XQF��LQW�Q&RGH��:3$5$0�Z3DUDP��/3$5$0�O3DUDP��������7KHVH�FODVVHV�DUH�H[SRUWHG�IURP�WKH�0DLQ+RRN�GOO��LIGHI�B��BFSOXVSOXV�H[WHUQ��&��^��HQGLI��0$,1+22.B$3,�LQW�,QVWDOO)LOWHU'//�YRLG���0$,1+22.B$3,�LQW�8Q,QVWDOO)LOWHU'//�YRLG����LIGHI�B��BFSOXVSOXV�`��HQGLI��([DPSOH������VKRZV�WKH�0DLQ+RRN�FSS�ILOH���

([DPSOH�������7KH�0DLQ+RRN�FSS�6RXUFH�)LOH��

�LQFOXGH��VWGDI[�K���LQFOXGH��0DLQ+RRN�K���LQFOXGH��:,186(5�+�������FRQWDLQV�DOO�WKHVH�FRQVWDQWV��VWUXFWV��HWF���������������������������������

Page 340: Visual Basic - Subclassing and Hooking with VB & VB NET

���*OREDO�9DULDEOHV�����������������������������+$1'/(� K,QVWDQFH�� � � ���*OREDO�LQVWDQFH�KDQGOH�IRU� '//�++22.� KKRRN+RRNV�� � � ���+RRN�KDQGOH����������������������������������'//�&RGH�����������������������������%22/�$3,(175<�'OO0DLQ��+$1'/(�K0RGXOH��������������������������':25'��XOBUHDVRQBIRUBFDOO��������������������������/392,'�OS5HVHUYHG�� � � � � ���^�� K,QVWDQFH� �K0RGXOH���� VZLWFK��XOBUHDVRQBIRUBFDOO��� ^�� � FDVH�'//B352&(66B$77$&+��� � FDVH�'//B7+5($'B$77$&+��� � FDVH�'//B7+5($'B'(7$&+��� � FDVH�'//B352&(66B'(7$&+��� � � EUHDN������`�����UHWXUQ�758(��`�����������������������������������������7KHV�DUH�WKH�H[SRUWHG�IXQFWLRQV��������������������������������������0$,1+22.B$3,�LQW�,QVWDOO)LOWHU'//�YRLG��^�� KKRRN+RRNV� �6HW:LQGRZV+RRN([�:+B.(<%2$5'��+22.352&��.H\ERDUG)XQF���+,167$1&(�������������������������������������K,QVWDQFH������� UHWXUQ����`��0$,1+22.B$3,�LQW�8Q,QVWDOO)LOWHU'//�YRLG��^�

Page 341: Visual Basic - Subclassing and Hooking with VB & VB NET

� 8QKRRN:LQGRZV+RRN([�KKRRN+RRNV���� UHWXUQ����`�����������������������������������������������������������������������������������)LOWHU�IXQFWLRQ�IRU�:+B.(<%2$5'�������������������������������������������������������������������������������/5(68/7�&$//%$&.�.H\ERDUG)XQF��LQW�Q&RGH��:3$5$0�Z3DUDP��/3$5$0�O3DUDP���^�� ERRO� � E:LQ.H\'RZQ� ����� ERRO� � E.H\8S� ������ LI���Q&RGH� �+&B$&7,21���� ^������������&KHFN�WR�VHH�LI�WKH�&75/�NH\�LV�SUHVVHG��WKH�:0B.(<'2:1�PHVVDJH�ZDV�������������SDVVHG�LQ���������E:LQ.H\'RZQ� �*HW$V\QF.H\6WDWH��9.B/:,1��!!���VL]HRI�6+257�� ����������� ����E.H\8S� ��O3DUDP�!!���VL]HRI�/3$5$0�� ���������������E.H\XS ����:0B.(<83��� ����LI���Z3DUDP� ��[�����E:LQ.H\'RZQ���E.H\8S��� ����^��������������:LQ([HF��&�??3URJUDP�)LOHV??,QWHUQHW�([SORUHU??,H[SORUH�H[H���B����������������������6:B6+2:1250$/����������������UHWXUQ�������5HWXUQLQJ�IDOVH�GLVDOORZV�WKH�Z�WR�EH�VHQW����������������������������WR�WKH�IRFXV�ZLQGRZ�� ����`�� `��� ��3DVV�DOO�PHVVDJHV�RQ�WR�WKH�QH[W�KRRN�LQ�WKH�FKDLQ�� UHWXUQ��&DOO1H[W+RRN([�KKRRN+RRNV��Q&RGH��Z3DUDP��O3DUDP����`�7R�VWDUW��WZR�YDULDEOHV�WKDW�DUH�JOREDO�WR�HDFK�LQVWDQFH�RI�WKH�'//�DUH�GHFODUHG��7R�VKDUH�YDULDEOHV�EHWZHHQ�DOO�LQVWDQFHV�RI�D�'//��ZH�PXVW�GHFODUH�WKH�YDULDEOH�LQ�D��SUDJPD�GDWDBVHJ�FRGH�EORFN�VLPLODU�WR�WKH�IROORZLQJ����SUDJPD�GDWDBVHJ��'//6+$5(���� +:1'�KZQG0DLQ� �18//�����������������SUDJPD�GDWDBVHJ�����7KLV�FDXVHV�D�VLQJOH�KZQG0DLQ�YDULDEOH�WR�EH�VKDUHG�DFURVV�WKH�LQVWDQFHV�RI�WKLV�'//��)RU�WKLV�DSSOLFDWLRQ��WKHUH�DUH�WZR�JOREDO�YDULDEOHV��DQG�QR�YDULDEOHV�DUH�VKDUHG�DFURVV�'//�LQVWDQFHV��7KHVH�DUH�WKH�RQO\�WZR�JOREDO�YDULDEOHV�WKDW�ZH�QHHG�WR�GHILQH���

Page 342: Visual Basic - Subclassing and Hooking with VB & VB NET

+$1'/(�K,QVWDQFH���������������*OREDO�LQVWDQFH�KDQGOH�IRU�'//�++22.�KKRRN+RRNV���������������+RRN�KDQGOH�7KH�K,QVWDQFH�YDULDEOH�FRQWDLQV�WKH�LQVWDQFH�RU�PRGXOH�KDQGOH�IRU�WKH�'//��7KH�V\VWHP�SDVVHV�WKLV�YDOXH�WR�'OO0DLQ����WKH�'//V�HQWU\�SRLQW����DV�WKH�ILUVW�SDUDPHWHU��:H�VLPSO\�QHHG�WR�DGG�WKH�IROORZLQJ�FRGH�WR�WKH�'OO0DLQ�IXQFWLRQ���K,QVWDQFH� �K0RGXOH��7KH�VHFRQG�JOREDO�YDULDEOH�LV�KKRRN+RRNV��7KLV�YDULDEOH�FRQWDLQV�WKH�KDQGOH�WR�WKH�LQVWDOOHG�KRRN��ZKLFK�WKH�6HW:LQGRZV+RRN([�IXQFWLRQ�SDVVHV�EDFN��$V�D�QRWH��QHYHU�VKDUH�WKH�KRRN�KDQGOH�DFURVV�'//�LQVWDQFHV��(DFK�'//�ZLOO�FDOO�LWV�RZQ�,QVWDOO)LOWHU'//�IXQFWLRQ�DQG�REWDLQ�D�XQLTXH�KRRN�KDQGOH��8VLQJ�D�VLQJOH�KRRN�KDQGOH�DFURVV�DOO�'//�LQVWDQFHV�ZLOO�FDXVH�D�VHULRXV�SUREOHP�IRU�UXQQLQJ�DSSOLFDWLRQV�LQWR�ZKLFK�\RX�KDYH�LQMHFWHG�WKLV�'//���7KHUH�DUH�WKUHH�PDLQ�IXQFWLRQV�LQ�WKH�'//��DV�([DPSOH������VKRZV��7KH�ILUVW�LV�,QVWDOO)LOWHU'//��ZKLFK�LQVWDOOV�WKH�NH\ERDUG�KRRN��7KLV�IXQFWLRQ�LV�H[SRUWHG�IURP�WKH�'//��7KH�VHFRQG�LV�8Q,QVWDOO)LOWHU'//��ZKLFK�UHPRYHV�WKH�KRRN��7KLV�IXQFWLRQ�LV�H[SRUWHG�DV�ZHOO��7KH�WKLUG�IXQFWLRQ�LV�.H\ERDUG)XQF��ZKLFK�LV�WKH�ILOWHU�IXQFWLRQ�IRU�WKH�NH\ERDUG�KRRN��,QVWHDG�RI�EHLQJ�H[SRUWHG��WKLV�IXQFWLRQ�LV�GHILQHG�DV�D�FDOOEDFN�URXWLQH��7KH�IXQFWLRQDOLW\�ZLWKLQ�WKLV�ILOWHU�IXQFWLRQ�LV�VLPLODU�WR�WKH�WKUHDG�VSHFLILF�ILOWHU�IXQFWLRQ�LQ�WKH�9%�H[DPSOH�LQ�([DPSOH��������

�����$�/RZ�/HYHO�+RRN�([DPSOH�

7KH�IROORZLQJ�H[DPSOH�XVHV�WKH�:+B.(<%2$5'B//�KRRN�LQ�D�SXUH�9%�DSSOLFDWLRQ��ZKLFK�LV�VKRZQ�LQ�)LJXUH�������<RX�GR�QRW�KDYH�WR�XVH�&���FRGH�WR�LQVWDOO�DQG�XVH�WKLV�KRRN��,Q�IDFW��LQ�PDQ\�LQVWDQFHV�\RX�FDQ�VXEVWLWXWH�WKLV�KRRN�IRU�D�V\VWHP�ZLGH�:+B.(<%2$5'�KRRN��WKLV�ZD\��\RX�GR�QRW�KDYH�WR�XVH�DQ\�ODQJXDJH�RWKHU�WKDQ�9%���

)LJXUH�������6FUHHQVKRW�RI�ORZ�OHYHO�NH\ERDUG�KRRN�DSSOLFDWLRQ�

7DEOH������SUHVHQWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��

2EMHFW�7\SH� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�)RUP� 1DPH� )RUP��)RUP� &DSWLRQ� �:+B.(<%2$5'B//�+RRN�$SSOLFDWLRQ��)RUP� %RUGHU6W\OH� ��)L[HG�'LDORJ�

Page 343: Visual Basic - Subclassing and Hooking with VB & VB NET

)RUP� 7RS� ����)RUP� /HIW� ����)RUP� +HLJKW� �����)RUP� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH�� FPG+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �KRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� �����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH�� FPG8Q+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �XQKRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� �����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����7KLV�DSSOLFDWLRQ�VHWV�D�V\VWHP�ZLGH��ORZ�OHYHO�NH\ERDUG�KRRN�DQG�GLVFDUGV�DQ\�'(/�NH\�SUHVVHV��0RUH�VSHFLILFDOO\��LW�GLVFDUGV�WKH�:0B.(<'2:1�DQG�:0B.(<83�PHVVDJHV�IRU�WKH�'(/�NH\���7R�VHH�KRZ�WKLV�DSSOLFDWLRQ�RSHUDWHV��RSHQ�XS�VHYHUDO�FRSLHV�RI�1RWHSDG�RU�DQRWKHU�ZRUG�SURFHVVRU��&OLFN�WKH�KRRN�EXWWRQ�RQ�WKH�DSSOLFDWLRQ�ZLQGRZ��ZKLFK�LV�VKRZQ�LQ�)LJXUH�������DQG�WKHQ�WU\�WR�GHOHWH�DQ\�FKDUDFWHUV�LQ�WKH�ZRUG�SURFHVVLQJ�SURJUDPV��1RWLFH�WKDW�WKH�'(/�NH\�IDLOV�WR�GR�DQ\WKLQJ��QRW�RQO\�IRU�RQH�ZRUG�SURFHVVRU��EXW�DOVR�IRU�DOO�ZRUG�SURFHVVRUV��&OLFN�WKH�XQKRRN�EXWWRQ�DQG�WKHQ�WU\�WR�GHOHWH�FKDUDFWHUV�LQ�DQ\�RI�WKH�ZRUG�SURFHVVRUV��1RZ�WKH�'(/�NH\�ZRUNV�WKH�ZD\�LW�VKRXOG���7KH�DSSOLFDWLRQ�FRQWDLQV�D�KRRN�EXWWRQ�WKDW�LQVWDOOV�WKH�V\VWHP�ZLGH�KRRN��DQG�DQ�XQKRRN�EXWWRQ�WKDW�UHPRYHV�WKH�KRRN��7KH�9%�FRGH�VKRZQ�LQ�([DPSOH������LV�SODFHG�EHKLQG�HDFK�EXWWRQ�LQ�WKH�)RUP��IUP�PRGXOH���

([DPSOH�������)RUP��IUP�&RGH��

3ULYDWH�6XE�FPG+RRNB&OLFN���������&DOO�6HW.H\ERDUG+RRN�(QG�6XE��3ULYDWH�6XE�FPG8Q+RRNB&OLFN���������&DOO�5HPRYH.H\ERDUG+RRN�

Page 344: Visual Basic - Subclassing and Hooking with VB & VB NET

(QG�6XE��������������&/($183�������������3ULYDWH�6XE�)RUPB4XHU\8QORDG�&DQFHO�$V�,QWHJHU��8QORDG0RGH�$V�,QWHJHU������,I�,V+RRNHG�7KHQ���������&DQFHO� �����������0VJ%R[��8QKRRN�EHIRUH�FORVLQJ��RU�WKH�,'(�ZLOO�FUDVK�������(QG�,I�(QG�6XE�([DPSOH������SUHVHQWV�WKH�FRGH�IRU�WKH�0RGXOH��EDV�PRGXOH���

([DPSOH�������0RGXOH��EDV�&RGH��

3ULYDWH�K+RRN�$V�/RQJ�3XEOLF�,V+RRNHG�$V�%RROHDQ���������������������������������6(7�+22.�������������������������������3XEOLF�6XE�6HW.H\ERDUG+RRN���������,I�,V+RRNHG�7KHQ���������0VJ%R[��'RQW�KRRN�:+B.(<%2$5'B//�WZLFH�RU�\RX�ZLOO�EH�XQDEOH�WR�XQKRRN�LW�������(OVH���������7KLV�PXVW�EH�VHW�XS�DV�D�V\VWHP�ZLGH�KRRN���������K+RRN� �6HW:LQGRZV+RRN([�:+B.(<%2$5'B//��$GGUHVV2I�:QG//.H\%RDUG3URF��B����������������������������������$SS�K,QVWDQFH�������������,V+RRNHG� �7UXH�����(QG�,I�(QG�6XE���������������������������������5(029(�+22.�������������������������������3XEOLF�6XE�5HPRYH.H\ERDUG+RRN���������'LP�5HW9DO�$V�/RQJ�����5HW9DO� �8QKRRN:LQGRZV+RRN([�K+RRN������,V+RRNHG� �)DOVH�(QG�6XE�

Page 345: Visual Basic - Subclassing and Hooking with VB & VB NET

��������������������������������+22.�),/7(5�)81&7,21�������������������������������3XEOLF�)XQFWLRQ�:QG//.H\%RDUG3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B���������O3DUDP�$V�.%'//+22.6758&7��$V�/RQJ�����'LP�E&WUO.H\'RZQ�$V�%RROHDQ�����'LP�E$OW.H\3UHVVHG�$V�%RROHDQ�����'LP�L&WUO.H\6WDWH�$V�,QWHJHU����������,I�X&RGH�! ���7KHQ���������6HOHFW�&DVH�X&RGH�������������&DVH�+&B$&7,21�����������������,I�D�'(/(7(�NH\�LV�SXOOHG�IURP�WKH�TXHXH�WKHQ�GLVFDUG�LW������������������,I�+H[��O3DUDP�YN&RGH�� ���(��7KHQ���������������������:QG//.H\%RDUG3URF� �����������������������([LW�)XQFWLRQ�����������������(QG�,I���81&200(17�7+,6�6(&7,21�72�6((�+2:�7+(�&75/�$/7�'(/�.(<�&20%,1$7,21�$))(&76�7+,6�+22.������������������L&WUO.H\6WDWH� �*HW$V\QF.H\6WDWH�9.B&21752/������������������,I��L&WUO.H\6WDWH�$QG�+������ �+�����7KHQ���������������������E&WUO.H\'RZQ� �7UXH�����������������(OVH���������������������E&WUO.H\'RZQ� �)DOVH�����������������(QG�,I������������������,I��O3DUDP�IODJV�$QG�//.+)B$/7'2:1�� �//.+)B$/7'2:1�7KHQ���������������������E$OW.H\3UHVVHG� �7UXH�����������������(OVH���������������������E$OW.H\3UHVVHG� �)DOVH�����������������(QG�,I������������������,I���+H[��O3DUDP�YN&RGH�� ���(���$QG�E&WUO.H\'RZQ�$QG��E$OW.H\3UHVVHG���7KHQ���������������������5HWXUQLQJ�IDOVH�VWLOO�DOORZV�WKH�&75/�$/7�'(/�WR�EH�VHQW�����������������������WR�WKH�V\VWHP����������������������5HWXUQLQJ�IDOVH�IRU�DQ\�RWKHU�FKDUDFWHUV�GLVDOORZV�LW�WR�EH�VHQW��

Page 346: Visual Basic - Subclassing and Hooking with VB & VB NET

��������������������WR�WKH�IRFXV�ZLQGRZ����������������������:QG//.H\%RDUG3URF� �����������������������([LW�)XQFWLRQ�����������������(QG�,I�������������&DVH�+&B125(029(�����������������7KH�PHVVDJH�KDV�QRW�EHHQ�UHPRYHG�IURP�WKH�PHVVDJH�TXHXH���������(QG�6HOHFW�����(QG�,I��������������:QG//.H\%RDUG3URF� �&DOO1H[W+RRN([�K+RRN��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KH�FRGH�LV�VLPLODU�WR�WKDW�IRU�WKH�SUHYLRXV�WKUHDG�VSHFLILF�KRRNV��H[FHSW�IRU�WKH�ZD\�WKH�KRRN�LV�LQVWDOOHG��1RWLFH�WKH�6HW.H\ERDUG+RRN�IXQFWLRQ��VKRZQ�LQ�([DPSOH�������ZKHUH�WKH�6HW:LQGRZV+RRN([�IXQFWLRQ�LV�FDOOHG��7KH�ODVW�WZR�DUJXPHQWV�WR�WKLV�IXQFWLRQ�DUH�$SS�,QVWDQFH�DQG����7KLV�DOORZV�XV�WR�VHW�WKH�KRRN�DV�D�V\VWHP�ZLGH�KRRN�LQVWHDG�RI�D�WKUHDG�VSHFLILF�RQH��,Q�IDFW��LI�ZH�WULHG�WR�FDOO�WKLV�IXQFWLRQ�ZLWK�WKH�ODVW�WZR�SDUDPHWHUV�VHW�WR���DQG�$SS�7KUHDG,'��DV�ZH�ZRXOG�GR�ZLWK�WKUHDG�VSHFLILF�KRRNV��WKH�IXQFWLRQ�ZRXOG�IDLO�DQG�UHWXUQ�D�]HUR��1RWH�WKDW�WKH�V\VWHP�ZLOO�QRW�DOORZ�XV�WR�LQVWDOO�WKLV�KRRN�DV�D�WKUHDG�VSHFLILF�KRRN�EHFDXVH�RI�WKH�ZD\�WKDW�LW�UHFRQILJXUHV�DOO�WKH�PHVVDJH�TXHXHV�WR�VHQG�PHVVDJHV�WR�WKH�PHVVDJH�ORRS�RQ�WKH�WKUHDG�LQ�ZKLFK�WKH�KRRN�ZDV�LQVWDOOHG���7KH�:QG//.H\%RDUG3URF�IXQFWLRQ��ZKLFK�LV�DOVR�VKRZQ�LQ�([DPSOH�������DFWV�DV�WKH�ILOWHU�IXQFWLRQ�IRU�WKLV�KRRN��7KLV�IXQFWLRQ�ZDWFKHV�IRU�WKH�'(/�:0B.(<'2:1�RU�:0B.(<83�PHVVDJHV�WR�EH�VHQW�WR�WKH�PHVVDJH�TXHXH��7KH�YLUWXDO�NH\�FRGH�IRU�WKLV�NH\�LV��(��$IWHU�WKH�ILOWHU�IXQFWLRQ�ILQGV�WKLV�NH\�FRGH��LW�UHWXUQV�D���DQG�GRHV�QRW�FDOO�WKH�QH[W�ILOWHU�IXQFWLRQ�LQ�WKH�FKDLQ��7KLV�SUHYHQWV�DQ\�RWKHU�KRRN�IURP�DFWLQJ�RQ�WKLV�NH\�FRGH�VR�WKDW�ERWK�WKH�:0B.(<'2:1�DQG�:0B.(<83�PHVVDJHV�DUH�GLVFDUGHG���,I�\RX�ZDQW�WR�VHH�WKDW�WKH�&75/�$/7�'(/�NH\�FRPELQDWLRQ�FDQQRW�EH�GLVFDUGHG��FRPPHQW�WKH�SUHYLRXV�FRGH�WKDW�GLVFDUGHG�RQO\�WKH�'(/�NH\�DQG�XQFRPPHQW�WKH�IROORZLQJ�FRGH���81&200(17�7+,6�6(&7,21�72�6((�+2:�7+,6�+22.�$))(&76�7+(�&75/�$/7�'(/�.(<�&20%,1$7,21�:KHQ�\RX�UXQ�WKLV�DSSOLFDWLRQ�DQG�LQVWDOO�WKH�KRRN��\RX�FDQ�SUHVV�WKH�&75/�$/7�'(/�NH\�FRPELQDWLRQ��(YHQ�WKRXJK�ZH�WU\��ZH�ZLOO�QRW�VXFFHHG�LQ�GLVFDUGLQJ�LW���

�����&DYHDWV�

Page 347: Visual Basic - Subclassing and Hooking with VB & VB NET

3HUIRUPDQFH�PLJKW�EH�DQ�LVVXH�ZKHQ�\RX�XVH�WKH�:+B.(<%2$5'�DQG�:+B.(<%2$5'B//�KRRNV��HVSHFLDOO\�ZLWK�V\VWHP�ZLGH�DQG�ORZ�OHYHO�NH\ERDUG�KRRNV��<RX�VKRXOG�XVH�WKHVH�KRRNV�MXGLFLRXVO\���7KH�ORZ�OHYHO�NH\ERDUG�KRRN�IRUFHV�HYHU\�WKUHDG�WR�UHFHLYH�PHVVDJHV�IURP�D�VLQJOH�TXHXH��7KLV�LV�KRZ����ELW�:LQGRZV�RSHUDWLQJ�V\VWHPV�ZRUN��7KHUHIRUH��WKH�RSHUDWLQJ�V\VWHP�FDQQRW�WDNH�DGYDQWDJH�RI�PXOWLWDVNLQJ��$�SUREOHP�WKDW�RFFXUV�LQ�DOO����ELW�:LQGRZV�RSHUDWLQJ�V\VWHPV�FDQ�QRZ�RFFXU�LQ����ELW�:LQGRZV�RSHUDWLQJ�V\VWHPV��D�VLQJOH�DSSOLFDWLRQ�FDQ�KDQJ�DOO�DSSOLFDWLRQV��HYHQ�WKH�GHVNWRS���%HFDXVH�ORZ�OHYHO�NH\ERDUG�KRRNV�VHULDOL]H�DOO�LQSXW�WR�DOO�ZLQGRZV��WKHUH�LV�D�ODUJH�SHUIRUPDQFH�SHQDOW\��<RX�VKRXOG�EH�FDUHIXO�ZKHQ�XVLQJ�KRRNV�VXFK�DV�WKHVH��:KHQ�\RX�XVH�WKHVH�KRRNV��LQVWDOO�WKHP�IRU�DV�OLWWOH�WLPH�DV�SRVVLEOH���$OVR��ZKHQ�XVLQJ�WKH�:+B.(<%2$5'B//�ORZ�OHYHO�NH\ERDUG�KRRN��QRWH�WKDW�WKH�GHEXJ�KRRN�FDQQRW�UHFHLYH�WKH�LQSXW�WR�WKLV�KRRN�EHIRUH�WKH�KRRN�LV�FDOOHG��7KH�GHEXJ�KRRN�ZRUNV�QRUPDOO\�ZLWK�WKH�NH\ERDUG�KRRN��:+B.(<%2$5'���&KDSWHU����GHVFULEHV�WKH�GHEXJ�KRRN���:KHQ�XVLQJ�:LQGRZV�17�RU�:LQGRZV������DORQJ�ZLWK�WKH�HQKDQFHG�:LQGRZV�NH\ERDUGV��QRWH�WKDW�WKH�NH\V��ZKLFK�DUH�GXSOLFDWHG�RQ�WKH�OHIW�DQG�ULJKW��QRZ�KDYH�GLIIHUHQW�YLUWXDO�NH\�FRGHV��+HUH�LV�D�OLVW�RI�OHIW�DQG�ULJKW�YLUWXDO�NH\�FRGHV���9.B/:,1 and 9.B5:,1

7KH�OHIW�DQG�ULJKW�YLUWXDO�NH\�FRGHV�IRU�WKH�:LQGRZV�NH\V�9.B/6+,)7 and 9.B56+,)7

7KH�OHIW�DQG�ULJKW�YLUWXDO�NH\�FRGHV�IRU�WKH�VKLIW�NH\V�9.B/&21752/ and 9.B5&21752/

7KH�OHIW�DQG�ULJKW�YLUWXDO�NH\�FRGHV�IRU�WKH�FRQWURO�NH\V�9.B/0(18 and 9.B50(18

7KH�OHIW�DQG�ULJKW�YLUWXDO�NH\�FRGHV�IRU�WKH�PHQX�NH\V�$�UHJLVWU\�NH\�LV�DVVRFLDWHG�ZLWK�ORZ�OHYHO�KRRNV�VXFK�DV�:+B.(<%2$5'B//�DQG�:+B0286(B//��:+B0286(B//�LV�GHVFULEHG�LQ�&KDSWHU������7KH�':25'�YDOXH�/RZ/HYHO+RRNV7LPHRXW�LV�ORFDWHG�LQ�WKH�IROORZLQJ�UHJLVWU\�NH\���+.(<B&855(17B86(5?&RQWURO�3DQHO?'HVNWRS�7KLV�UHJLVWU\�NH\�FRQWUROV�WKH�WLPHRXW�YDOXH�IRU�DOO�ORZ�OHYHO�KRRNV��7KLV�YDOXH�LV�H[SUHVVHG�LQ�PLOOLVHFRQGV��,I�WKH�ILOWHU�IXQFWLRQ�IRU�D�ORZ�OHYHO�KRRN�GRHV�QRW�UHWXUQ�ZLWKLQ�WKLV�WLPH�VSDQ��WKH�V\VWHP�ZLOO�FDOO�WKH�QH[W�ORZ�OHYHO�KRRN�LQ�WKH�FKDLQ���$OWKRXJK�DOO����ELW�DQG����ELW�RSHUDWLQJ�V\VWHPV�VXSSRUW�WKH�:+B.(<%2$5'�KRRN��DOO�GR�QRW�VXSSRUW�WKH�:+B.(<%2$5'B//�KRRN��7KH�:+B.(<%2$5'B//�KRRN�LV�IRXQG�RQO\�LQ�:LQGRZV�17��6HUYLFH�3DFN���RU�KLJKHU��DQG�:LQGRZV�������LW�LV�QRW�IRXQG�LQ�:LQGRZV��[���

Page 348: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU�����:+B0286(�DQG�:+B0286(B//�7KLV�FKDSWHU�GHDOV�ILUVW�ZLWK�WKH�:+B0286(�KRRN�DQG�WKHQ�ZLWK�WKH�:+B0286(B//�KRRN��7KH�//�VWDQGV�IRU�ORZ�OHYHO��7KLV�FKDSWHU�GHVFULEHV�WKHVH�KRRNV�DQG�GLVFXVVHV�KRZ�WKH�:LQGRZV�PHVVDJLQJ�V\VWHP�KDQGOHV�PRXVH�PHVVDJHV��,�ZLOO�SURYLGH�H[DPSOHV�XVLQJ�HDFK�KRRN���

�����+RZ�0RXVH�0HVVDJLQJ�2SHUDWHV�

8QOLNH�ZLWK�NH\ERDUG�PHVVDJHV��WKH�V\VWHP�PXVW�EH�DEOH�WR�VHQG�PRXVH�PHVVDJHV�WR�DQ\�YLVLEOH�ZLQGRZ�LQ�WKH�V\VWHP��HYHQ�LI�LW�LV�QRW�WKH�DFWLYH�ZLQGRZ��:H�FDQ�VHH�WKLV�E\�XVLQJ�6S\���WR�YLHZ�PRXVH�PHVVDJHV�RQ�D�V\VWHP�ZLGH�OHYHO��6WDUW�6S\���DQG�FOLFN�WKH�6S\�"�0HVVDJHV�������PHQX�LWHP��7KH�0HVVDJH�2SWLRQV�GLDORJ�ZLOO�DSSHDU��&KHFN�WKH�$OO�:LQGRZV�,Q�6\VWHP�FKHFNER[�RQ�WKH�:LQGRZV�WDE��DQG�FKHFN�WKH�0RXVH�FKHFNER[�RQ�WKH�0HVVDJHV�WDE��)LQDOO\��FOLFN�WKH�2.�EXWWRQ��7KLV�ZLOO�VWDUW�6S\���UHFRUGLQJ�PRXVH�PHVVDJHV��$V�\RX�PRYH�WKH�PRXVH�FXUVRU�RYHU�ZLQGRZV�LQ�WKH�V\VWHP��\RX�ZLOO�VHH�WKDW�D�ZLQGRZ�GRHV�QRW�KDYH�WR�EH�DFWLYH�WR�UHFHLYH�PRXVH�PHVVDJHV��7KH�6S\���RXWSXW�ORRNV�VLPLODU�WR�WKLV���:0B6(7&85625��������6HQW��:0B6(7&85625��������5HWXUQHG��:0B0286(029(��������3RVWHG��7KLV�VHULHV�RI�PHVVDJHV�LV�UHSHDWHG�RYHU�DQG�RYHU�DJDLQ�DV�WKH�XVHU�PRYHV�WKH�PRXVH�DFURVV�DQ\�YLVLEOH�ZLQGRZV�RQ�WKH�GHVNWRS��5LJKW��RU�OHIW�FOLFNLQJ�DQ\�YLVLEOH�ZLQGRZV�DOVR�VHQGV�WKH�DSSURSULDWH�PRXVH�PHVVDJHV�WR�WKDW�ZLQGRZ���$�ZLQGRZ�GRHV�KDYH�WR�EH�YLVLEOH�WR�WKH�PRXVH�FXUVRU�WR�UHFHLYH�PHVVDJHV��WKRXJK��$Q\�ZLQGRZ�RU�SDUW�RI�D�ZLQGRZ�KLGGHQ�EHKLQG�DQRWKHU�ZLQGRZ�LQ�WKH�=�RUGHU�ZLOO�QRW�EH�DEOH�WR�UHFHLYH�PRXVH�PHVVDJHV��<RX�PLJKW�QRWLFH�WKDW�WKH�:LQGRZV�GHVNWRS�DOVR�UHFHLYHV�DQG�SURFHVVHV�PRXVH�PHVVDJHV��7KH�RQO\�ZLQGRZ�WKDW�GRHV�QRW�VHHP�WR�UHFHLYH�PHVVDJHV�DW�DQ\�WLPH�LV�WKH�6S\���ZLQGRZ��6S\���ZDWFKHV�IRU�PHVVDJHV�WKDW�DUH�GLUHFWHG�WR�DQ\�RI�LWV�RZQ�ZLQGRZV�DQG�ZLOO�QRW�GLVSOD\�WKHP��7KLV�LV�E\�GHVLJQ��\RX�GR�QRW�ZDQW�DQ\�PHVVDJHV�WKDW�WKH�6S\���DSSOLFDWLRQ�UHFHLYHV�WR�FOXWWHU�XS�WKH�GLVSOD\�RI�RWKHU�PHVVDJHV���,I�DOO�YLVLEOH�ZLQGRZV�GLG�QRW�UHFHLYH�PRXVH�LQSXW�DW�D�V\VWHP�ZLGH�OHYHO��LW�ZRXOG�EH�YHU\�GLIILFXOW�RU�HYHQ�LPSRVVLEOH�WR�VZLWFK�WR�DQRWKHU�ZLQGRZ�VLPSO\�E\�FOLFNLQJ�LW��DQG�GUDJ�DQG�GURS�DFWLRQV�ZRXOG�QRW�EH�HDV\�WR�LPSOHPHQW�DV�ZHOO��7KHVH�RWKHU�ZLQGRZV�ZRXOG�QRW�EH�DEOH�WR�UHFHLYH�WKH�UHTXLUHG�PRXVH�PHVVDJHV���8VLQJ�6S\����ZH�FDQ�FRQFOXGH�WKDW�WKH�V\VWHP�GLUHFWV�PRXVH�PHVVDJHV�WR�WKH�ZLQGRZ�WKDW�LV�GLUHFWO\�XQGHU�WKH�PRXVH�FXUVRU����RU��PRUH�VSHFLILFDOO\��WKH�PRXVH�FXUVRU�KRW�VSRW��$OVR��D�ZLQGRZ�GRHV�QRW�KDYH�WR�EH�DFWLYH�RU�KDYH�NH\ERDUG�LQSXW�IRFXV�WR�UHFHLYH�PRXVH�PHVVDJHV��

Page 349: Visual Basic - Subclassing and Hooking with VB & VB NET

LW�RQO\�QHHGV�WR�EH�YLVLEOH�WR�WKH�PRXVH�FXUVRU��7KHUH�LV�DQ�H[FHSWLRQ��WKRXJK��ZKLFK�UHYROYHV�DURXQG�ZKLFK�ZLQGRZ�KDV�WKH�PRXVH�FDSWXUH���

�������7KH�0RXVH�&DSWXUH�

:KHQ�D�ZLQGRZ�KDV�WKH�PRXVH�FDSWXUH��WKH�V\VWHP�UHGLUHFWV�DOO�PRXVH�PHVVDJHV�WR�WKDW�ZLQGRZ��UHJDUGOHVV�RI�ZKHWKHU�WKH�PRXVH�FXUVRU�LV�ORFDWHG�LQVLGH�RU�RXWVLGH�RI�WKH�ZLQGRZV�ERXQGLQJ�UHFWDQJOH��2QO\�RQH�ZLQGRZ�LQ�WKH�V\VWHP�FDQ�KDYH�WKH�PRXVH�FDSWXUH�DW�DQ\�RQH�WLPH���$�VLQJOH�GDWD�VWUXFWXUH�ORFDWHG�ZLWKLQ�HDFK�UXQQLQJ�WKUHDG�FRQWDLQV�WKH�PRXVH�FDSWXUH�VWDWH�IRU�D�ZLQGRZ��DORQJ�ZLWK�RWKHU�PRXVH�LQIRUPDWLRQ��VXFK�DV�FXUVRU�VKDSH�DQG�YLVLELOLW\��7KLV�LV�WKH�VDPH�GDWD�VWUXFWXUH�WKDW�FRQWDLQV�WKH�NH\ERDUG�VWDWH�LQIRUPDWLRQ�IRU�HDFK�WKUHDG��$V�GLVFXVVHG�LQ�&KDSWHU�����\RX�FDQ�VHW�WKH�ZLQGRZ�RI�RQH�RU�PRUH�WKUHDGV�WR�KDYH�WKH�NH\ERDUG�LQSXW�IRFXV��7KLV�ZLQGRZ�PXVW�EH�RZQHG�E\�WKH�WKUHDG�WKDW�LV�VHWWLQJ�LWV�NH\ERDUG�LQSXW�IRFXV�VWDWH��%XW�RQO\�WKH�DFWLYH�IRUHJURXQG�ZLQGRZ�FDQ�DFWXDOO\�SURFHVV�NH\ERDUG�PHVVDJHV��0RXVH�FDSWXUH�ZRUNV�VLPLODUO\��DW�PRVW��RQH�ZLQGRZ�LQ�WKH�V\VWHP�FDQ�KDYH�WKLV�DW�DQ\�RQH�WLPH��+RZHYHU��QRUPDOO\��QR�ZLQGRZV�LQ�WKH�V\VWHP�KDYH�WKH�PRXVH�FDSWXUH��:KHQ�QR�ZLQGRZV�KDYH�WKH�PRXVH�FDSWXUH��PRXVH�PHVVDJHV�DUH�SURFHVVHG�E\�WKH�ZLQGRZ�XQGHU�WKH�PRXVH�FXUVRU��DV�WKH\�QRUPDOO\�ZRXOG�EH��:KHQ�D�ZLQGRZ�GRHV�KDYH�WKH�PRXVH�FDSWXUH��WKH�V\VWHP�VHQGV�DOO�PRXVH�PHVVDJHV�WR�WKDW�RQH�ZLQGRZ��QR�PDWWHU�ZKLFK�ZLQGRZ�WKH�PRXVH�FXUVRU�LV�RYHU��6HWWLQJ�WKH�PRXVH�FDSWXUH�LV�PDLQO\�XVHG�IRU�GUDJ�DQG�GURS�DQG�GUDZLQJ�DSSOLFDWLRQV��DV�ZH�VKDOO�VHH���7KH�ZLQGRZ�KDYLQJ�WKH�PRXVH�FDSWXUH�GRHV�QRW�FDSWXUH�PRXVH�PHVVDJHV�LQ�WZR�VLWXDWLRQV��7KH�ILUVW�LV�ZKHQ�WKH�ZLQGRZ�WKDW�WKH�PRXVH�FXUVRU�LV�RYHU�LV�QRW�LQ�WKH�VDPH�SURFHVV�DV�WKH�ZLQGRZ�WKDW�KDV�WKH�PRXVH�FDSWXUH��,Q�WKLV�VLWXDWLRQ��WKH�V\VWHP�VHQGV�PRXVH�PHVVDJHV�WR�WKH�ZLQGRZ�LQ�WKH�VHSDUDWH�SURFHVV��QRW�WR�WKH�ZLQGRZ�WKDW�KDV�WKH�PRXVH�FDSWXUH��7KH�VHFRQG�VLWXDWLRQ�LV�ZKHQ�WKH�PRXVH�FXUVRU�LV�RYHU�D�ZLQGRZ�WKDW�LV�LQ�WKH�VDPH�SURFHVV�DV�WKH�ZLQGRZ�WKDW�KDV�WKH�PRXVH�FDSWXUH��EXW�ERWK�ZLQGRZV�DUH�LQ�VHSDUDWH�WKUHDGV��,Q�WKLV�FDVH��WKH�V\VWHP�GLUHFWV�PRXVH�PHVVDJHV�WR�WKH�ZLQGRZ�WKDW�KDV�WKH�PRXVH�FDSWXUH�RQO\�ZKHQ�D�PRXVH�EXWWRQ�LV�GHSUHVVHG��LQ�DOO�RWKHU�FLUFXPVWDQFHV��WKH�V\VWHP�VHQGV�PRXVH�PHVVDJHV�WR�WKH�ZLQGRZ�LQ�WKH�VHSDUDWH�WKUHDG���7R�VHW�WKH�PRXVH�FDSWXUH�IRU�D�ZLQGRZ��\RX�QHHG�WR�FDOO�RQO\�WKH�6HW&DSWXUH�IXQFWLRQ��ZKLFK�LV�GHFODUHG�LQ�9LVXDO�%DVLF��9%��DV�IROORZV���3ULYDWH�'HFODUH�)XQFWLRQ�6HW&DSWXUH�/LE��XVHU����$OLDV��6HW&DSWXUH��B�� � �%\9DO�KZQG�$V�/RQJ��$V�/RQJ�7KH�VLQJOH�SDUDPHWHU�RI�WKH�6HW&DSWXUH�IXQFWLRQ�LV���KZQG

7KH�ZLQGRZ�KDQGOH�RI�WKH�ZLQGRZ�WKDW�VKRXOG�UHFHLYH�DOO�PRXVH�LQSXW�7KLV�IXQFWLRQ�ZLOO�UHWXUQ�WKH�ZLQGRZ�KDQGOH�RI�WKH�ZLQGRZ�WKDW�SUHYLRXVO\�KDG�WKH�PRXVH�FDSWXUH��,I�QR�ZLQGRZ�KDG�WKH�PRXVH�FDSWXUH��LW�UHWXUQV�D�18//��7KLV�IXQFWLRQ�FDQQRW�VHW�WKH�

Page 350: Visual Basic - Subclassing and Hooking with VB & VB NET

PRXVH�FDSWXUH�IRU�D�ZLQGRZ�WKDW�UHVLGHV�LQ�D�GLIIHUHQW�WKUHDG��<RX�VKRXOG�DOVR�QRWH�WKDW�ZKHQ�WKLV�IXQFWLRQ�LV�VXFFHVVIXOO\�FDOOHG��WKH�PHQX�KRWNH\V�DQG�NH\ERDUG�DFFHOHUDWRUV�ZLOO�QRW�ZRUN�XQWLO�WKH�PRXVH�FDSWXUH�LV�UHOHDVHG��7KLV�LV�VR�WKDW�WKRVH�RSHUDWLRQV�XVLQJ�6HW&DSWXUH��VXFK�DV�GUDZLQJ�DQG�GUDJ�DQG�GURS��ZLOO�QRW�EH�LQWHUUXSWHG���7KH�*HW&DSWXUH�IXQFWLRQ�GHWHUPLQHV�LI�D�ZLQGRZ�FXUUHQWO\�KDV�WKH�PRXVH�FDSWXUH��7KLV�IXQFWLRQ�LV�GHFODUHG�LQ�9%�LQ�WKLV�PDQQHU���3ULYDWH�'HFODUH�)XQFWLRQ�*HW&DSWXUH�/LE��XVHU����$OLDV��*HW&DSWXUH�������$V�/RQJ�7KLV�IXQFWLRQ�WDNHV�QR�SDUDPHWHUV�DQG�UHWXUQV�WKH�ZLQGRZ�KDQGOH�RI�WKH�ZLQGRZ�WKDW�FXUUHQWO\�KDV�WKH�PRXVH�FDSWXUH��,I�QR�ZLQGRZ�KDV�WKH�PRXVH�FDSWXUH��LW�UHWXUQV�D�18//���<RX�FDQ�UHOHDVH�WKH�PRXVH�FDSWXUH�IRU�D�ZLQGRZ�LQ�VHYHUDO�ZD\V��7KH�REYLRXV�ILUVW�FKRLFH�LV�WR�XVH�5HOHDVH&DSWXUH��7KLV�IXQFWLRQ�LV�GHFODUHG�LQ�9%�LQ�WKLV�PDQQHU���3ULYDWH�'HFODUH�)XQFWLRQ�5HOHDVH&DSWXUH�/LE��XVHU����$OLDV��5HOHDVH&DSWXUH�������$V�/RQJ�7KLV�IXQFWLRQ�WDNHV�QR�SDUDPHWHUV�DQG�UHWXUQV�D�QRQ]HUR�YDOXH�LI�WKH�IXQFWLRQ�VXFFHHGV�LQ�UHOHDVLQJ�WKH�PRXVH�FDSWXUH�RQ�WKH�ZLQGRZ��RU�D�]HUR�LI�WKH�IXQFWLRQ�IDLOV��7KLV�IXQFWLRQ�FDQQRW�UHOHDVH�WKH�PRXVH�FDSWXUH�IRU�D�ZLQGRZ�LQ�D�GLIIHUHQW�WKUHDG��RQO\�IRU�ZLQGRZV�ZLWKLQ�WKH�WKUHDG�LQ�ZKLFK�WKLV�IXQFWLRQ�ZDV�FDOOHG��7KH�VHFRQG�ZD\�LV�WR�FDOO�6HW&DSWXUH�D�VHFRQG�WLPH��7KLV�ZLOO�FDXVH�WKH�ZLQGRZ�WKDW�FXUUHQWO\�KDV�WKH�PRXVH�LQSXW�WR�ORVH�LW�DQG�WKHQ�VHW�WKH�PRXVH�FDSWXUH�WR�WKH�ZLQGRZ�VSHFLILHG�LQ�WKH�KZQG�SDUDPHWHU�RI�6HW&DSWXUH��7KH�WKLUG�DQG�ILQDO�ZD\�LV�WR�FOLFN�D�ZLQGRZ�WKDW�GRHV�QRW�KDYH�WKH�PRXVH�FDSWXUH��7KLV�ZLOO�FDXVH�DQ\�ZLQGRZ�WKDW�KDV�WKH�PRXVH�FDSWXUH�WR�ORVH�LW���7R�JHW�D�EHWWHU�XQGHUVWDQGLQJ�RI�PRXVH�FDSWXUH��FRQVLGHU�WKH�IROORZLQJ�H[DPSOH��$�XVHU�FOLFNV�DQG�GUDJV�DQ�LWHP�IURP�RQH�ZLQGRZ�WR�D�VHFRQG�ZLQGRZ��7KH�XVHU�PXVW�ILUVW�FOLFN�WKH�LWHP�LQ�WKH�ILUVW�ZLQGRZ�DQG�GUDJ�LW�ZKLOH�KROGLQJ�WKH�PRXVH�GRZQ�WR�WKH�VHFRQG�ZLQGRZ��$IWHU�WKH�LWHP�LV�RYHU�WKH�VHFRQG�ZLQGRZ��WKH�XVHU�FDQ�UHOHDVH�WKH�PRXVH�EXWWRQ�WR�GURS�WKH�LWHP�RQWR�WKH�VHFRQG�ZLQGRZ��'XULQJ�WKLV�SURFHVV��WKH�XVHU�FOLFNV�DQG�KROGV�GRZQ�WKH�PRXVH�EXWWRQ�ZKLOH�RYHU�WKH�LWHP�LQ�WKH�ILUVW�ZLQGRZ��$W�WKLV�SRLQW��WKH�6HW&DSWXUH�IXQFWLRQ�VKRXOG�EH�FDOOHG��SDVVLQJ�WR�LW�WKH�KDQGOH�RI�WKH�ILUVW�ZLQGRZ��9%�GRHV�WKLV�DXWRPDWLFDOO\�IRU�XV��ZKLOH�\RX�PXVW�GR�LW�PDQXDOO\�LQ�9LVXDO�&����1RZ�WKDW�\RX�KDYH�VHW�WKH�PRXVH�FDSWXUH�WR�WKH�ILUVW�ZLQGRZ��WKH�V\VWHP�ZLOO�VHQG�DOO�PRXVH�PHVVDJHV�WR�WKH�ILUVW�ZLQGRZ�HYHQ�WKRXJK�WKH�XVHU�PRYHV�WKH�PRXVH�RYHU�WKH�VHFRQG�ZLQGRZ��7KLV�DOORZV�WKH�ILUVW�ZLQGRZ�WR�NQRZ�ZKHUH�WKH�XVHU�LV�JRLQJ�WR�GURS�WKH�LWHP�EHFDXVH�WKH�V\VWHP�LV�VWLOO�GLUHFWLQJ�PRXVH�PRYH�DQG�PRXVH�FOLFN�PHVVDJHV�WR�WKH�ILUVW�ZLQGRZ��7KLV�DOVR�DOORZV�WKH�ILUVW�ZLQGRZ�WR�GHILQH�WKH�PRXVH�FXUVRU�VKDSH�DW�D�V\VWHP�ZLGH�OHYHO��RYHUULGLQJ�DQ\�PRXVH�FXUVRU�VKDSHV�VHW�DW�WKH�WKUHDG�OHYHO��:KHQ�WKH�XVHU�GHFLGHV�WR�GURS�WKH�LWHP�RQWR�WKH�VHFRQG�ZLQGRZ�DQG�UHOHDVHV�WKH�PRXVH�EXWWRQ��WZR�LQWHUHVWLQJ�WKLQJV�KDSSHQ��)LUVW��WKH�V\VWHP�VHQGV�WKH�PRXVH�EXWWRQ�XS�PHVVDJH�WR�WKH�ILUVW�ZLQGRZ��1H[W��LW�UHOHDVHV�WKH�PRXVH�FDSWXUH�IURP�WKH�ILUVW�ZLQGRZ����DW�WKLV�SRLQW��QR�ZLQGRZ�ZLOO�KDYH�WKH�PRXVH�FDSWXUH�XQOHVV�DQRWKHU�FDOO�LV�PDGH�WR�6HW&DSWXUH��$OO�PRXVH�PHVVDJHV�DUH�QRZ�GLUHFWHG�WR�WKH�ZLQGRZ�WKDW�WKH�PRXVH�SRLQWHU�LV�GLUHFWO\�RYHU���

�������0RXVH�&OLFN�0HVVDJHV�

Page 351: Visual Basic - Subclassing and Hooking with VB & VB NET

:KHQ�D�XVHU�VLQJOH�FOLFNV�WKH�OHIW�PRXVH�EXWWRQ�RQ�D�ZLQGRZ��WKH�V\VWHP�VHQGV�WKH�IROORZLQJ�VHULHV�RI�PRXVH�PHVVDJHV���:0B/%87721'2:1�:0B/%8772183�:KHQ�D�XVHU�GRXEOH�FOLFNV�WKH�OHIW�PRXVH�EXWWRQ�RQ�D�ZLQGRZ��RQH�RI�WZR�WKLQJV�FDQ�KDSSHQ��7KH�ILUVW�RFFXUV�LI�DOO�WKUHH�RI�WKH�IROORZLQJ�FRQGLWLRQV�DUH�PHW���

��� 7KH�&6B'%/&/.6�FODVV�VW\OH�LV�VHW����� 7KH�VHFRQG�FOLFN�KDSSHQHG�ZLWKLQ�D�VHW�VSDFH�DURXQG�WKH�FXUVRU�KRW�VSRW��7KLV�VHW�

VSDFH�LV�GHILQHG�E\�D�UHFWDQJOH�ZLWK�GLPHQVLRQV�WKDW�\RX�FDQ�REWDLQ�WKURXJK�*HW6\VWHP0HWULFV�DQG�E\�XVLQJ�WKH�60B&;'28%/(&/.�DQG�60B&<'28%/(&/.�IODJV���

��� 7KH�VHFRQG�FOLFN�KDSSHQHG�ZLWKLQ�D�VHW�WLPH�RI�WKH�ILUVW�FOLFN��<RX�FDQ�REWDLQ�WKLV�VHW�WLPH�E\�XVLQJ�WKH�*HW'RXEOH&OLFN7LPH�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IXQFWLRQ�ZLWK�WKH�60B&<'28%/(&/.�RU�60B&;'28%/(&/.�IODJV���

,Q�WKLV�FDVH��WKH�V\VWHP�VHQGV�WKH�IROORZLQJ�VHULHV�RI�PRXVH�PHVVDJHV�WR�WKH�ZLQGRZ���:0B/%87721'2:1�:0B/%8772183�:0B/%87721'%/&/.����������������7KLV�LV�ZKHUH�WKH�GRXEOH�FOLFN�RFFXUV�:0B/%8772183�2WKHUZLVH��LW�VHQGV�WKLV�VHULHV�RI�PRXVH�PHVVDJHV�WR�WKH�ZLQGRZ��:0B/%87721'2:1�:0B/%8772183�:0B/%87721'2:1����������������1R�GRXEOH�FOLFN�RFFXUV�KHUH�:0B/%8772183�$V�\RX�FDQ�VHH��LQ�WKH�VHFRQG�FDVH��WKH�V\VWHP�VHQGV�RQO\�WKH�PRXVH�GRZQ�DQG�PRXVH�XS�PHVVDJHV��RQFH�IRU�HDFK�FOLFN��2WKHUZLVH��LW�UHSODFHV�WKH�VHFRQG�:0B/%87721'2:1�PHVVDJH�ZLWK�D�:0B/%87721'%/&/.�PHVVDJH���

�����'HVFULSWLRQ�RI�+RRNV�

<RX�FDQ�XVH�WKH�:+B0286(�KRRN�DV�D�WKUHDG�VSHFLILF�KRRN��RU�\RX�FDQ�SODFH�LW�LQ�D�G\QDPLF�OLQN�OLEUDU\��'//��DQG�XVH�LW�DV�D�V\VWHP�ZLGH�KRRN��$�WKUHDG�VSHFLILF�KRRN�LQWHUFHSWV�DOO�PHVVDJHV�ZLWKLQ�WKH�WKUHDG�LQ�ZKLFK�LW�LV�LQVWDOOHG��:KHQ�\RX�LQVWDOO�D�KRRN�DV�D�V\VWHP�ZLGH�KRRN��LW�KDV�WR�EH�SODFHG�LQ�D�'//��7KLV�'//�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�VR�WKDW�WKH�KRRN�FDQ�RSHUDWH�RQ�DOO�PHVVDJHV�LQ�WKH�V\VWHP��&KDSWHU���SURYLGHV�D�WKRURXJK�GLVFXVVLRQ�RI�WKLV�FRQFHSW���

Page 352: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�:+B0286(�KRRN�DOORZV�XV�WR�RQO\�ZDWFK�RU�GLVFDUG�PRXVH�PHVVDJHV��<RX�FDQ�XVH�WKLV�KRRN�WR�LQWHUFHSW�PHVVDJHV�IRU�D�VLQJOH�WKUHDG�RU�IRU�DOO�UXQQLQJ�WKUHDGV��7KLV�KRRN�SURYLGHV�D�ODUJH�DPRXQW�RI�FRQWURO�RYHU�WKH�PRXVH�DQG�WKH�ZD\�WKH�XVHU�LV�DEOH�WR�XVH�WKH�PRXVH���7KH�VHFRQG�PRXVH�KRRN��:+B0286(B//��ZDV�LQWURGXFHG�ZLWK�:LQGRZV�17�6HUYLFH�3DFN���DQG�KLJKHU��7KLV�KRRN�LV�VLPLODU�WR�WKH�:+B0286(�KRRN��H[FHSW�WKDW�LW�LQWHUFHSWV�PHVVDJHV�DW�D�PXFK�HDUOLHU�SRLQW�LQ�WKH�:LQGRZV�PHVVDJLQJ�V\VWHP��7KLV�SURYLGHV�H[WUD�LQIRUPDWLRQ�DERXW�PRXVH�PHVVDJHV�WKDW�LV�QRW�DYDLODEOH�WKURXJK�WKH�:+B0286(�KRRN��7DEOH������GHVFULEHV�WKH�LQIRUPDWLRQ�WKDW�\RX�FDQ�REWDLQ�IURP�HDFK�W\SH�RI�PRXVH�KRRN���

7DEOH�������,QIRUPDWLRQ�3URYLGHG�E\�:+B0286(�DQG�:+B0286(B//�+RRNV��:+B0286(� :+B0286(B//�

&XUVRU�FRRUGLQDWHV��[�\�� &XUVRU�FRRUGLQDWHV��[�\��([WUD�LQIRUPDWLRQ� ([WUD�LQIRUPDWLRQ�0HVVDJH�,'� 0HVVDJH�,'�06//+22.6758&7� 0286(+22.6758&7�:LQGRZ�KZQG� 1�$�+LW�WHVW�YDOXH� 1�$�1�$� 0RXVH�ZKHHO�GHOWD�1�$� :KLFK�;%87721�ZDV�SUHVVHG�1�$� )ODJ�WR�GHWHUPLQH�LI�WKH�PHVVDJH�ZDV�LQMHFWHG�1�$� 7LPH�WKH�PHVVDJH�ZDV�VHQW�WR�WKH�PHVVDJH�TXHXH�7KH�:+B0286(B//�KRRN�FDSWXUHV�PHVVDJHV�EHIRUH�WKH\�KDYH�D�FKDQFH�WR�EH�SRVWHG�WR�D�WKUHDGV�PHVVDJH�TXHXH��8VLQJ�WKLV�PRXVH�KRRN��\RX�FDQ�FDSWXUH�PHVVDJHV�GHDOLQJ�ZLWK�WKH�PRXVH�ZKHHO�DQG�WKH�[PRXVH�EXWWRQV���<RX�LQVWDOO�WKH�:+B0286(B//�KRRN�LQ�D�VLPLODU�IDVKLRQ�WR�WKH�:+B.(<%2$5'B//�KRRN��<RX�FDQ�SODFH�WKH�FRGH�LQ�HLWKHU�D�:LQ���'//�RU�D�9%�(;(���7KH�:+B0286(B//�KRRN�LV�DQ�LQWHUHVWLQJ�H[FHSWLRQ�EHFDXVH�\RX�FDQ�LQVWDOO�LW�RQO\�DV�D�V\VWHP�ZLGH�KRRN��$V�,�SUHYLRXVO\�PHQWLRQHG��V\VWHP�ZLGH�KRRNV�PXVW�UHVLGH�LQ�D�'//��+RZHYHU��WKLV�KRRN��DV�ZHOO�DV�WKH�:+B.(<%2$5'B//��:+B-2851$/3/$<%$&.��DQG�:+B-2851$/5(&25'�KRRNV��FDQ�UHVLGH�HLWKHU�LQ�DQ�(;(�RU�'//�PRGXOH��7KLV�PHDQV�WKDW�ZH�FDQ�LPSOHPHQW�WKHVH�IRXU�KRRNV�ZLWKLQ�9%��7KLV�LV�EHFDXVH�WKH�ILOWHU�IXQFWLRQV�RI�WKHVH�KRRNV�DUH�FDOOHG�IURP�ZLWKLQ�WKH�FRQWH[W�RI�WKH�WKUHDG�WKDW�KDV�LQVWDOOHG�WKHVH�W\SHV�RI�KRRNV���7R�XQGHUVWDQG�ZK\�WKHVH�KRRNV�FDQ�UHVLGH�LQ�DQ�(;(��ZH�QHHG�WR�XQGHUVWDQG�KRZ�WKH\�PDQLSXODWH�WKH�PHVVDJH�SURFHVVLQJ�RI�HDFK�WKUHDG�UXQQLQJ�LQ�WKH�V\VWHP��1RUPDOO\��HYHU\�WKUHDG�KDV�LWV�RZQ�PHVVDJH�TXHXH�WR�ZKLFK�LW�LV�FRQQHFWHG��7KHVH�PHVVDJH�TXHXHV�UHFHLYH�PHVVDJHV�IURP�WKH�UDZ�LQSXW�WKUHDG��5,7���7KLV�DUFKLWHFWXUH�JLYHV�DOO����ELW�:LQGRZV�RSHUDWLQJ�V\VWHPV�UREXVW�PXOWLWKUHDGLQJ�FDSDELOLW\�DQG�SUHYHQWV�RQH�DSSOLFDWLRQ�IURP�KDQJLQJ�

Page 353: Visual Basic - Subclassing and Hooking with VB & VB NET

WKH�ZKROH�V\VWHP��$V�ZH�ZLOO�VHH��KRZHYHU��LQVWDOOLQJ�WKH�:+B0286(B//�KRRN�GHVWUR\V�WKLV�RQH�WR�RQH�UHODWLRQVKLS�EHWZHHQ�D�WKUHDG�DQG�LWV�PHVVDJH�TXHXH���,W�LV�SRVVLEOH�WR�IRUFH�PXOWLSOH�WKUHDGV�WR�UHFHLYH�PHVVDJHV�IURP�D�VLQJOH�PHVVDJH�TXHXH��<RX�DFFRPSOLVK�WKLV�E\�XVLQJ�WKH�$WWDFK7KUHDG,QSXW�$3,�IXQFWLRQ��7KLV�IXQFWLRQ�LV�GHFODUHG�LQ�9%�DV�IROORZV���3ULYDWH�'HFODUH�)XQFWLRQ�$WWDFK7KUHDG,QSXW�/LE��XVHU����B����������$OLDV��$WWDFK7KUHDG,QSXW��B�� � �%\9DO�LG$WWDFK�$V�/RQJ��B�� � %\9DO�LG$WWDFK7R�$V�/RQJ��B?�� � %\9DO�I$WWDFK�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��LG$WWDFK

7KH�WKUHDG�,'�RI�WKH�WKUHDG�WR�EH�DWWDFKHG�WR�DQRWKHU�WKUHDGV�PHVVDJH�TXHXH���LG$WWDFK7R

7KH�WKUHDG�,'�RI�WKH�WKUHDG�FRQWDLQLQJ�WKH�PHVVDJH�TXHXH�WR�ZKLFK�WKH�WKUHDG�VSHFLILHG�E\�LG$WWDFK�LV�DWWDFKHG���

I$WWDFK

7UXH�VSHFLILHV�WR�DWWDFK�WKH�WZR�WKUHDGV��)DOVH�VSHFLILHV�WR�GHWDFK�WKH�WZR�WKUHDGV���$�UHWXUQ�YDOXH�RI�]HUR�LQGLFDWHV�WKDW�WKLV�IXQFWLRQ�IDLOHG��DQ\�RWKHU�YDOXH�LQGLFDWHV�VXFFHVV��1RWH�WKDW�D�WKUHDG�FDQQRW�EH�DWWDFKHG�WR�WKH�5,7��WR�LWVHOI��RU�WR�D�WKUHDG�LQ�DQRWKHU�GHVNWRS��7KH�PHVVDJH�TXHXH�XVHG�E\�WKH�WKUHDG�WKDW�LG$WWDFK�VSHFLILHV�GRHV�QRW�UHFHLYH�LQSXW�DIWHU�WKLV�WKUHDG�LV�DWWDFKHG�WR�WKH�RWKHU�PHVVDJH�TXHXH���:KHQ�\RX�LQVWDOO�D�:+B0286(B//�KRRN�LQ�D�WKUHDG��WKH�V\VWHP�DWWDFKHV�DOO�WKUHDGV�WR�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�WKDW�LQVWDOOHG�WKLV�KRRN��7KLV�LV�VLPLODU�WR�FDOOLQJ�$WWDFK7KUHDG,QSXW�IRU�HDFK�WKUHDG�DQG�VHWWLQJ�WKH�YDOXH�RI�LG$WWDFK�WR�WKH�WKUHDG�,'�IRU�HDFK�LQGLYLGXDO�WKUHDG��DOZD\V�VHWWLQJ�LG$WWDFK7R�WR�WKH�WKUHDG�,'�RI�WKH�WKUHDG�WKDW�LQVWDOOHG�WKH�MRXUQDO�KRRN��DQG�DOZD\V�VHWWLQJ�I$WWDFK�WR�7UXH��7KH�UHVXOW�LV�D�VLQJOH�PHVVDJH�TXHXH�IRU�DOO�WKUHDGV�LQ�WKH�V\VWHP��)LJXUH������LOOXVWUDWHV�WKLV�FRQFHSW���

)LJXUH�������7KUHDG�VWDWH�EHIRUH�DQG�DIWHU�D�:+B0286(B//�KRRN�LV�LQVWDOOHG�

Page 354: Visual Basic - Subclassing and Hooking with VB & VB NET

%HFDXVH�D�VLQJOH�PHVVDJH�TXHXH�LV�IHHGLQJ�DOO�WKUHDGV�LQ�WKH�V\VWHP��\RX�FDQ�FDOO�WKHVH�KRRNV�IURP�ZLWKLQ�WKH�FRQWH[W�RI�WKH�WKUHDG�WKDW�LQVWDOOHG�WKH�KRRN����ZKLFK��LQ�RXU�FDVH��LV�WKH�9%�DSSOLFDWLRQ���2UGLQDULO\��'//V�DUH�UHTXLUHG�IRU�V\VWHP�ZLGH�KRRNV�EHFDXVH�HDFK�WKUHDG�KDV�LWV�RZQ�PHVVDJH�TXHXH��7KLV�'//�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�VR�WKDW�WKH�KRRN�FDQ�RSHUDWH�RQ�DOO�PHVVDJHV��DQG�RQ�DOO�PHVVDJH�TXHXHV��LQ�WKH�V\VWHP��$Q�(;(��XQOLNH�D�'//��FDQQRW�EH�LQMHFWHG�LQWR�HYHU\�SURFHVV��DQG�KHQFH�FDQQRW�RSHUDWH�RQ�DOO�PHVVDJHV�ZKHQ�WKHUH�DUH�PXOWLSOH�PHVVDJH�TXHXHV��2Q�WKH�RWKHU�KDQG��\RX�FDQ�LQVWDOO�:+B0286(B//�IRU�D�VLQJOH�WKUHDG�DQG�VWLOO�UHFHLYH�HYHU\�PHVVDJH�WKDW�WKH�V\VWHP�JHQHUDWHV�EHFDXVH�WKH�V\VWHP�LV�IXQQHOLQJ�HYHU\�PHVVDJH�WKURXJK�D�VLQJOH�PHVVDJH�TXHXH���

�������)LOWHU�)XQFWLRQ�'HILQLWLRQV�

Page 355: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�ILOWHU�IXQFWLRQ�IRU�HDFK�KRRN�LV�VLPLODU��H[FHSW�IRU�WKH�O3DUDP�SDUDPHWHU��7KH�:+B0286(�KRRN�ILOWHU�IXQFWLRQ�SURWRW\SH�LV�DV�IROORZV���3XEOLF�)XQFWLRQ�0RXVH3URF�%\9DO�X&RGH�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��B�� � � � O3DUDP�$V�0286(+22.6758&7��$V�/RQJ�,WV�SDUDPHWHUV�DUH��X&RGH

7KH�KRRN�FRGH�SDVVHG�LQ�E\�WKH�V\VWHP�Z3DUDP

7KH�PRXVH�PHVVDJH�LGHQWLILHU�O3DUDP

$�SRLQWHU�WR�WKH�0286(+22.6758&7�VWUXFWXUH�7KH�0286(+22.6758&7�VWUXFWXUH�LV�GHILQHG�LQ�WKLV�PDQQHU���3XEOLF�7\SH�0286(+22.6758&7���������SW�$V�32,17$3,���������KZQG�$V�/RQJ���������Z+LW7HVW&RGH�$V�/RQJ���������GZ([WUD,QIR�$V�/RQJ�(QG�7\SH�7KH�PHPEHUV�RI�WKH�0286(+22.6758&7�VWUXFWXUH�DUH��SW

7KH�[�DQG�\�FRRUGLQDWHV�RI�WKH�PRXVH�SRLQWHU�KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�WKDW�WKH�PRXVH�SRLQWHU�ZDV�RYHU�ZKHQ�WKH�PRXVH�PHVVDJH�ZDV�ILUHG��

Z+LW7HVW&RGH

7KH�KLW�WHVW�FRGH�GHWDLOLQJ�WKH�QRQFOLHQW�DUHD�RI�WKH�ZLQGRZ�WKDW�WKH�PRXVH�FXUVRU�LV�RYHU��

GZ([WUD,QIR

([WUD�LQIRUPDWLRQ�,I�\RX�DUH�UXQQLQJ�:LQGRZV������RU�KLJKHU��O3DUDP�LQVWHDG�SRLQWV�WR�WKH�0286(+22.6758&7(;�VWUXFWXUH��D�VWUXFWXUH�WKDW�:LQGRZV��[�DQG�:LQGRZV�17�GR�QRW�VXSSRUW��7KLV�VWUXFWXUH�LV�GHILQHG�DV�IROORZV���3XEOLF�7\SH�0286(+22.6758&7(;�����VWUXFW0RXVH+RRN�$V�0286(+22.6758&7�����PRXVHGDWD�$V�/RQJ�(QG�7\SH�7KH�PHPEHUV�RI�0286(+22.6758&7(;�DUH��VWUXFW0RXVH+RRN

$�SRLQWHU�WR�WKH�0286(+22.6758&7�VWUXFWXUH��

Page 356: Visual Basic - Subclassing and Hooking with VB & VB NET

PRXVHGDWD

$�/RQJ�LQWHJHU�WKDW�FRQWDLQV�PRXVH�ZKHHO�DQG�[EXWWRQ�LQIRUPDWLRQ�LQ�WKH�KLJK�RUGHU�ZRUG��7KH�ORZ�RUGHU�ZRUG�LV�UHVHUYHG�IRU�V\VWHP�XVH���1HZHU�PRXVH�GHYLFHV�LQFRUSRUDWH�D�PRXVH�ZKHHO�WR�DLG�LQ�VFUROOLQJ��,I�WKH�0RXVH3URF�ILOWHU�IXQFWLRQV�Z3DUDP�SDUDPHWHU�VSHFLILHV�WKH�:0B0286(:+((/�PHVVDJH��WKH�PRXVHGDWD�PHPEHUV�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�PRXVH�ZKHHO�GHOWD��D�SRVLWLYH�YDOXH�PHDQV�WKDW�WKH�PRXVH�ZKHHO�ZDV�UROOHG�IRUZDUG��D�QHJDWLYH�YDOXH�PHDQV�WKDW�LW�ZDV�UROOHG�EDFNZDUG����6RPH�QHZHU�PRXVH�GHYLFHV�DOVR�LQFRUSRUDWH�H[WUD�EXWWRQV�LQ�DGGLWLRQ�WR�WKH�OHIW��ULJKW��DQG�PLGGOH�EXWWRQV��7KHVH�EXWWRQV�DUH�FDOOHG�[EXWWRQV��,I�WKH�0RXVH3URF�ILOWHU�IXQFWLRQV�Z3DUDP�SDUDPHWHU�VSHFLILHV�WKDW�DQ�[EXWWRQ�ZDV�FOLFNHG��WKH�PRXVHGDWD�PHPEHUV�KLJK�RUGHU�ZRUG�GHWHUPLQHV�ZKHWKHU�WKH�ILUVW�RU�VHFRQG�[EXWWRQ�ZDV�SUHVVHG��7KH�V\VWHP�UHVHUYHV�WKH�ORZ�RUGHU�ZRUG�LQ�ERWK�FDVHV���

7KH�ORZ�OHYHO�PRXVH�KRRN�ILOWHU�IXQFWLRQ�SURWRW\SH�LV�DV�IROORZV��3XEOLF�)XQFWLRQ�//0RXVH3URF�%\9DO�X&RGH�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��B�� � � � O3DUDP�$V�06//+22.6758&7��$V�/RQJ�,WV�SDUDPHWHUV�DUH��X&RGH

7KH�KRRN�FRGH�SDVVHG�LQ�E\�WKH�V\VWHP�Z3DUDP

7KH�PRXVH�PHVVDJH�LGHQWLILHU�O3DUDP

$�SRLQWHU�WR�WKH�06//+22.6758&7�VWUXFWXUH�7KH�06//+22.6758&7�VWUXFWXUH�LV�GHILQHG�LQ�WKLV�PDQQHU���3XEOLF�7\SH�06//+22.6758&7���������SW�$V�32,17$3,���������PRXVHGDWD�$V�/RQJ���������IODJV�$V�/RQJ�� ����WLPH�$V�/RQJ���������GZ([WUD,QIR�$V�/RQJ�(QG�7\SH�7KH�PHPEHUV�RI�WKH�06//+22.6758&7�VWUXFWXUH�DUH��SW

7KH�[�DQG�\�FRRUGLQDWHV�RI�WKH�PRXVH�SRLQWHU��PRXVHGDWD

,I�WKH�Z3DUDP�SDUDPHWHU�VSHFLILHV�WKH�:0B0286(:+((/�PHVVDJH��WKLV�PHPEHUV�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�PRXVH�ZKHHO�GHOWD��D�SRVLWLYH�YDOXH�PHDQV�WKDW�WKH�PRXVH�ZKHHO�ZDV�UROOHG�IRUZDUG��D�QHJDWLYH�YDOXH�PHDQV�WKDW�LW�ZDV�UROOHG�EDFNZDUG���,I�WKH�Z3DUDP�SDUDPHWHU�VSHFLILHV�WKDW�DQ�[EXWWRQ�ZDV�FOLFNHG��WKLV�

Page 357: Visual Basic - Subclassing and Hooking with VB & VB NET

PHPEHUV�KLJK�RUGHU�ZRUG�GHWHUPLQHV�ZKHWKHU�WKH�ILUVW�RU�VHFRQG�[EXWWRQ�ZDV�SUHVVHG��7KH�V\VWHP�UHVHUYHV�WKH�ORZ�RUGHU�ZRUG�LQ�ERWK�FDVHV���

IODJV

'HWHUPLQHV�ZKHWKHU�WKH�PHVVDJH�ZDV�LQMHFWHG��,I�$1'LQJ�WKLV�IODJ�ZLWK���UHVXOWV�LQ�D���RU�7UXH��WKLV�PHVVDJH�ZDV�LQMHFWHG��RWKHUZLVH��WKH�PHVVDJH�ZDV�QRW�LQMHFWHG��<RX�FDQ�LQMHFW�D�PRXVH�PHVVDJH�LQWR�WKH�PHVVDJLQJ�V\VWHP�E\�XVLQJ�WKH�6HQG,QSXW�IXQFWLRQ�GHILQHG�LQ�&KDSWHU������

WLPH

7KH�WLPH�WKDW�WKLV�PHVVDJH�ZDV�SRVWHG�WR�WKH�PHVVDJH�TXHXH���GZ([WUD,QIR

([WUD�LQIRUPDWLRQ��$V�\RX�FDQ�VHH��WKH�PDLQ�GLIIHUHQFHV�EHWZHHQ�WKHVH�WZR�IXQFWLRQ�SURWRW\SHV�LV�WKH�VWUXFWXUH�WKDW�O3DUDP�SRLQWV�WR���

�������([SODQDWLRQ�RI�+RRN�&RGHV�

7KH�V\VWHP�VHQGV�WZR�FRGHV�WR�WKH�X&RGH�SDUDPHWHU�RI�WKH�PRXVH�KRRNV�ILOWHU�IXQFWLRQ��7KHVH�FRGHV�DUH�+&B$&7,21�DQG�+&B125(029(��7KH�:+B0286(B//�KRRN�GRHV�QRW�XVH�WKH�+&B125(029(�FRGH�EHFDXVH�WKH�PRXVH�PHVVDJH�KDV�QRW�\HW�EHHQ�SODFHG�LQ�WKH�PHVVDJH�TXHXH��7KH�PHDQLQJ�RI�WKH�FRGHV�LV�DV�IROORZV���HC_ACTION

7KH�Z3DUDP�DQG�O3DUDP�SDUDPHWHUV�FRQWDLQ�LQIRUPDWLRQ�DERXW�PRXVH�PHVVDJHV�WKDW�KDYH�EHHQ�UHPRYHG�IURP�WKH�PHVVDJH�TXHXH��XVLQJ�*HW0HVVDJH����

HC_NOREMOVE

7KH�Z3DUDP�DQG�O3DUDP�SDUDPHWHUV�FRQWDLQ�LQIRUPDWLRQ�DERXW�PRXVH�PHVVDJHV�WKDW�KDYH�EHHQ�UHDG�EXW�QRW�UHPRYHG�IURP�WKH�PHVVDJH�TXHXH��XVLQJ�3HHN0HVVDJH����

�����/RFDWLRQ�RI�7KLV�+RRN�LQ�WKH�6\VWHP�

7KH�:+B0286(�KRRN�LV�FDOOHG�LQ�D�WKUHDGV�PHVVDJH�ORRS��DV�)LJXUH������VKRZV��7KLV�KRRN�LV�ORFDWHG�LQVLGH�WKH�*HW0HVVDJH�DQG�3HHN0HVVDJH�IXQFWLRQV��7KHUHIRUH��LI�WKH�KRRN�UHWXUQV�D����WKH�PHVVDJH�LV�GLVFDUGHG�LQVLGH�WKH�*HW0HVVDJH�RU�3HHN0HVVDJH�IXQFWLRQ�DQG�WKH�UHVW�RI�WKH�PHVVDJH�ORRS�GRHV�QRW�SURFHVV�LW���

)LJXUH�������7KH�ORFDWLRQ�RI�WKH�:+B0286(�DQG�:+B0286(B//�KRRNV�

Page 358: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�:+B0286(B//�KRRN�LV�ORFDWHG�LPPHGLDWHO\�EHIRUH�D�PHVVDJH�LV�SODFHG�LQWR�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�WKDW�LQVWDOOHG�WKH�KRRN��5HPHPEHU�WKDW�DOO�PHVVDJH�TXHXHV�DUH�DWWDFKHG�WR�WKH�PHVVDJH�ORRS�RI�WKLV�WKUHDG��)LJXUH������LOOXVWUDWHV�WKH�ORFDWLRQ�RI�WKLV�KRRN���

�����$�6LQJOH�7KUHDG�([DPSOH�

7KH�H[DPSOH�SUHVHQWHG�KHUH�LV�VLPSOH�LQ�VWUXFWXUH��LW�ZDWFKHV�IRU�DOO�PRXVH�PHVVDJHV�DQG�GLVSOD\V�HDFK�PHVVDJH�LQ�WKH�WH[W�ER[��)LJXUH������VKRZV�D�VFUHHQVKRW�RI�WKLV�DSSOLFDWLRQ��7R�XVH�WKLV�DSSOLFDWLRQ��VLPSO\�FOLFN�WKH�KRRN�EXWWRQ�FRQWDLQHG�LQ�WKH�0286(�IUDPH��7KLV�ZLOO�LQVWDOO�WKH�:+B0286(�KRRN�DQG�VWDUW�GLVSOD\LQJ�WKH�PRXVH�PHVVDJHV�LQ�WKH�WH[W�ER[��7KH�WH[W�ER[�ZLOO�ILOO�XS�UDWKHU�TXLFNO\�DV�WKH�PRXVH�PHVVDJHV�DUH�ILUHG��HYHQ�WKRXJK�WKH�PRXVH�PXVW�EH�ZLWKLQ�WKH�ERUGHUV�RI�WKH�ZLQGRZ�IRU�WKLV�KRRN�WR�FDSWXUH�D�PRXVH�PHVVDJH��$�V\VWHP�ZLGH�PRXVH�KRRN�ZLOO�FDWFK�DOO�PRXVH�PHVVDJHV�IRU�DOO�ZLQGRZV�WKDW�DUH�YLVLEOH�RQ�WKH�VFUHHQ��LQFOXGLQJ�WKH�GHVNWRS��KDG�ZH�LPSOHPHQWHG�LW��RXWSXW�IURP�WKLV�KRRN�WR�WKH�WH[W�ER[�ZRXOG�KDYH�EHHQ�FRPSOHWHO\�RYHUZKHOPLQJ���

)LJXUH�������$�VFUHHQVKRW�RI�WKH�VLQJOH�WKUHDGHG�PRXVH�KRRN�DSSOLFDWLRQ�

Page 359: Visual Basic - Subclassing and Hooking with VB & VB NET

7DEOH������SUHVHQWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��

2EMHFW�7\SH� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�)RUP� 1DPH� )RUP��)RUP� &DSWLRQ� �:+B0286(�+RRN�'HPR��)RUP� 7RS� ����)RUP� /HIW� ����)RUP� +HLJKW� �����)RUP� :LGWK� �����)UDPH� &DSWLRQ� �0286(��)UDPH� 1DPH� )UDPH��)UDPH� 7RS� ����)UDPH� /HIW� ����)UDPH� +HLJKW� �����)UDPH� :LGWK� �����7H[W%R[� 0XOWL/LQH� 7UXH�7H[W%R[� 7RS� ����7H[W%R[� /HIW� �����7H[W%R[� +HLJKW� �����7H[W%R[� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH�� FPG+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �KRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����

Page 360: Visual Basic - Subclassing and Hooking with VB & VB NET

&RPPDQG�%XWWRQ�� 1DPH�� FPG8Q+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �XQKRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����%HIRUH�FORVLQJ�WKLV�DSSOLFDWLRQ��\RX�PXVW�FOLFN�WKH�XQKRRN�EXWWRQ�WR�UHPRYH�WKH�:+B0286(�KRRN��,I�D�KRRN�LV�QRW�UHPRYHG�SURSHUO\��LW�ZLOO�FUDVK�WKH�DSSOLFDWLRQ�DV�LW�LV�VKXWWLQJ�GRZQ���7KH�6HW0RXVH+RRN�IXQFWLRQ��ZKLFK�LV�VKRZQ�LQ�([DPSOH�������LQVWDOOV�WKH�WKUHDG�VSHFLILF�:+B0286(�KRRN�XVLQJ�WKH�6HW:LQGRZV+RRN([�IXQFWLRQ���

([DPSOH�������7KH�6HW0RXVH+RRN�)XQFWLRQ��

3XEOLF�6XE�6HW0RXVH+RRN���������,I�,V+RRNHG�7KHQ���������0VJ%R[��'RQW�KRRN�WKH�0286(�WZLFH��RU�\RX�ZLOO�EH�XQDEOH�WR�XQKRRN�LW�������(OVH���������OS3UHY:QG3URF� �6HW:LQGRZV+RRN([�:+B0286(��B�� � � � � � $GGUHVV2I�0RXVH3URF��B�� � � � � � ���$SS�7KUHDG,'����������,V+RRNHG� �7UXH�����(QG�,I�(QG�6XE�7KH�5HPRYH0RXVH+RRN�IXQFWLRQ��ZKLFK�LV�VKRZQ�LQ�([DPSOH�������XVHV�WKH�8QKRRN:LQGRZV+RRN([�IXQFWLRQ�WR�UHPRYH�WKH�:+B0286(�KRRN���

([DPSOH�������7KH�5HPRYH0RXVH+RRN�)XQFWLRQ��

3XEOLF�6XE�5HPRYH0RXVH+RRN���������'LP�WHPS�$V�/RQJ�����WHPS� �8QKRRN:LQGRZV+RRN([�OS3UHY:QG3URF������,V+RRNHG� �)DOVH�(QG�6XE�)LQDOO\��WKH�0RXVH3URF�IXQFWLRQ�VKRZQ�LQ�([DPSOH������VHUYHV�DV�WKH�ILOWHU�IXQFWLRQ���

([DPSOH�������7KH�0RXVH3URF�)XQFWLRQ��

3XEOLF�)XQFWLRQ�0RXVH3URF�%\9DO�X&RGH�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��B�

Page 361: Visual Basic - Subclassing and Hooking with VB & VB NET

� � � � O3DUDP�$V�0286(+22.6758&7��$V�/RQJ�����,I�X&RGH�����7KHQ���������0RXVH3URF� �&DOO1H[W+RRN([�OS3UHY:QG3URF��X&RGH��Z3DUDP��O3DUDP������(OVH����������6HOHFW�&DVH�X&RGH�������������&DVH�+&B$&7,21�����������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&B$&7,21����06*����Z3DUDP�B�� � � � � ������+:1'����O3DUDP�KZQG�B�� � � � � ������+,7B7(67B&2'(����O3DUDP�Z+LW7HVW&RGH�B�� � � � � ������(;75$B,1)2����O3DUDP�GZ([WUD,QIR�B�� � � � � ������37����&6WU�O3DUDP�SW�\���YE1HZ/LQH�������������&DVH�+&B125(029(�����������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&B125(029(����06*����Z3DUDP�B�� � � � � ������+:1'����O3DUDP�KZQG�B�� � � � � ������+,7B7(67B&2'(����O3DUDP�Z+LW7HVW&RGH�B�� � � � � ������(;75$B,1)2����O3DUDP�GZ([WUD,QIR�B�� � � � � ������37����&6WU�O3DUDP�SW�\���YE1HZ/LQH�������������&DVH�(OVH���������(QG�6HOHFW����������0RXVH3URF� �&DOO1H[W+RRN([�OS3UHY:QG3URF��X&RGH��Z3DUDP��O3DUDP������(QG�,I�(QG�)XQFWLRQ�$V�ZLWK�DOO�ILOWHU�IXQFWLRQV��ZKHQ�WKH�X&RGH�SDUDPHWHU�LV�OHVV�WKDQ����\RX�VKRXOG�VNLS�WKH�IXQFWLRQV�FRGH�DQG�FDOO�&DOO1H[W+RRN([�LPPHGLDWHO\��:KHQ�X&RGH�LV�HTXDO�WR�+&B$&7,21�RU�+&B125(029(��WKLV�FRGH��DORQJ�ZLWK�VHYHUDO�RWKHU�SDUDPHWHUV��LV�ZULWWHQ�WR�WKH�WH[W�ER[��)LQDOO\��WR�DOORZ�RWKHU�KRRNV�LQ�WKLV�FKDLQ�WR�EH�FDOOHG��WKH�&DOO1H[W+RRN([�IXQFWLRQ�LV�FDOOHG���$Q�LQWHUHVWLQJ�WKLQJ�KDSSHQV�ZKHQ�\RX�UXQ�WKLV�DSSOLFDWLRQ�IURP�ZLWKLQ�WKH�9%�,'(�DV�RSSRVHG�WR�D�VWUDLJKW�(;(��:KHQ�\RX�UXQ�LW�LQ�WKH�,'(��WKH�RXWSXW�WKDW�LV�GLVSOD\HG�LQ�WKH�WH[W�ER[�LV�VLPLODU�WR�WKH�IROORZLQJ���+&B125(029(��06*��������+:1'����������+,7B7(67B&2'(������(;75$B,1)2������37����+&B$&7,21����06*��������+:1'����������+,7B7(67B&2'(������(;75$B,1)2������37����

Page 362: Visual Basic - Subclassing and Hooking with VB & VB NET

+&B125(029(��06*��������+:1'����������+,7B7(67B&2'(������(;75$B,1)2������37����+&B$&7,21����06*��������+:1'����������+,7B7(67B&2'(������(;75$B,1)2������37����+&B125(029(��06*��������+:1'����������+,7B7(67B&2'(������(;75$B,1)2������37����+&B$&7,21����06*��������+:1'����������+,7B7(67B&2'(������(;75$B,1)2������37����7KH�ILUVW�WKLQJ�\RX�PLJKW�QRWLFH�LV�WKDW�PHVVDJHV�DUH�FDSWXUHG�ZKHQ�WKH�PRXVH�LV�RYHU�QRW�RQO\�WKH�DSSOLFDWLRQ��EXW�DOVR�WKH�,'(��7KLV�RFFXUV�EHFDXVH�WKH�ZLQGRZV�RI�WKH�,'(�DQG�WKH�DSSOLFDWLRQ�DUH�DOO�ZLWKLQ�WKH�VDPH�WKUHDG�DQG��WKHUHIRUH��VKDUH�WKH�VDPH�PHVVDJH�TXHXH�DQG�PRXVH�KRRN��8VLQJ�6S\����ZH�FDQ�VHH�WKDW�WKH�9%��SURFHVV�FRQWDLQV�WZR�WKUHDGV��RQH�RI�ZKLFK�FRQWDLQV�ERWK�WKH�,'(�DQG�WKH�UXQQLQJ�DSSOLFDWLRQ���7KH�VHFRQG�WKLQJ�\RX�PLJKW�QRWLFH�LV�WKDW�WKH�+&B125(029(�DQG�+&B$&7,21�FRGHV�DUH�UHSHDWHG�IRU�HDFK�PRXVH�PHVVDJH��7KLV�RFFXUV�EHFDXVH�D�3HHN0HVVDJH�LV�SHUIRUPHG�RQ�WKH�PRXVH�PHVVDJH�LQ�WKH�PHVVDJH�TXHXH��DQG�WKHQ�WKH�PRXVH�PHVVDJH�LV�UHPRYHG�XVLQJ�*HW0HVVDJH���:KHQ�\RX�UXQ�WKH�RXWSXW�DV�D�VWDQGDORQH�H[HFXWDEOH��LW�LV�VLPLODU�WR�WKH�IROORZLQJ���+&B$&7,21����06*��������+:1'����������+,7B7(67B&2'(������(;75$B,1)2������37����+&B$&7,21����06*��������+:1'����������+,7B7(67B&2'(������(;75$B,1)2������37����+&B$&7,21����06*��������+:1'����������+,7B7(67B&2'(������(;75$B,1)2������37����7KLV�RXWSXW�LV�VRPHZKDW�GLIIHUHQW�IURP�WKDW�SURGXFHG�E\�UXQQLQJ�WKH�FRGH�LQ�WKH�9LVXDO�%DVLF�,'(��,W�GLVSOD\V�RQO\�RQH�FRGH�IRU�HDFK�PRXVH�PHVVDJH��,Q�WKLV�LQVWDQFH��3HHN0HVVDJH�LV�QRW�FDOOHG�IRU�PRXVH�PHVVDJHV�SODFHG�RQ�WKH�PHVVDJH�TXHXH���

�����$�6\VWHP�:LGH�+RRN�([DPSOH�

,I�\RX�LQVWDOOHG�WKH�:+B0286(�KRRN�DV�D�V\VWHP�ZLGH�KRRN��\RX�ZRXOG�QHHG�WR�FUHDWH�D�:LQ���'//�WR�KRXVH�WKH�ILOWHU�IXQFWLRQ�DV�ZHOO�DV�WKH�FRGH�UHTXLUHG�WR�LQVWDOO�DQG�UHPRYH�WKH�KRRN��7KLV�LV�EHFDXVH�D�V\VWHP�ZLGH�KRRN�PXVW�EH�SODFHG�LQ�D�'//��DQG�9%�FDQQRW�FUHDWH�WUXH�:LQ���'//V��7KH�V\VWHP�LQMHFWV�WKLV�'//�LQWR�HYHU\�SURFHVV��7KHUHIRUH��DQ\�SURFHVV�FDQ�FDOO�RXU�KRRN�IXQFWLRQ���7KH�'//�FRQWDLQV�WZR�H[SRUWHG�IXQFWLRQV��,QVWDOO)LOWHU'//�DQG�8Q,QVWDOO)LOWHU'//��DV�ZHOO�DV�WKH�ILOWHU�IXQFWLRQ��0RXVH)XQF��([DPSOH������VKRZV�WKH�FRGH�DGGHG�WR�WKH�0DLQ+RRN�K�KHDGHU�ILOH��7KH�ILUVW�OLQH�GHILQHV�WKH�0RXVH)XQF�ILOWHU�IXQFWLRQ�DV�W\SH�&$//%$&.��7KH�UHVW�RI�WKH�FRGH�GHILQHV�WKH�WZR�H[SRUWHG�IXQFWLRQV�DV�0$,1+22.B$3,��0$,1+22.B$3,�LV��LQ�WXUQ��GHILQHG�DV�B�BGHFGOVSHF�GOOH[SRUW����

([DPSOH�������7KH�0DLQ+RRN�K�+HDGHU�)LOH��

Page 363: Visual Basic - Subclassing and Hooking with VB & VB NET

�GHILQH�0$,1+22.B$3,�B��BGHFOVSHF�GOOH[SRUW������GHILQH�&&219�BVWGFDOO����GHILQH�120$1*/(��� �� �'HILQHV�DQG�6WUXFWXUH�XVHG�E\�:+B.(<%2$5'B//�� ���GHILQH�:+B0286(��������GHILQH�+&B$&7,21����W\SHGHI�VWUXFW�WDJ0286(+22.6758&7�^�����32,17���SW������+:1'����KZQG������8,17����Z+LW7HVW&RGH������':25'���GZ([WUD,QIR��`�0286(+22.6758&7��)$5� /30286(+22.6758&7�� 30286(+22.6758&7������)XQFWLRQ�GHFODUDWLRQV�/5(68/7�&$//%$&.�0RXVH)XQF��LQW�Q&RGH��:3$5$0�Z3DUDP��/3$5$0�O3DUDP���������7KHVH�FODVVHV�DUH�H[SRUWHG�IURP�WKH�0DLQ+RRN�GOO��LIGHI�B��BFSOXVSOXV�H[WHUQ��&��^��HQGLI��0$,1+22.B$3,�LQW�,QVWDOO)LOWHU'//�YRLG���0$,1+22.B$3,�LQW�8Q,QVWDOO)LOWHU'//�YRLG����LIGHI�B��BFSOXVSOXV�`��HQGLI��([DPSOH������VKRZV�WKH�0DLQ+RRN�FSS�ILOH���

([DPSOH�������7KH�0DLQ+RRN�FSS�6RXUFH�)LOH��

�LQFOXGH��VWGDI[�K���LQFOXGH��0DLQ+RRN�K���LQFOXGH��:,186(5�+�������FRQWDLQV�DOO�WKHVH�FRQVWDQWV��VWUXFWV��HWF���������������������������������

Page 364: Visual Basic - Subclassing and Hooking with VB & VB NET

���*OREDO�9DULDEOHV�����������������������������+$1'/(� K,QVWDQFH�� � � ���*OREDO�LQVWDQFH�KDQGOH�IRU� '//�++22.� KKRRN+RRNV�� � � ���+RRN�KDQGOH���������������������������������'//�&RGH�����������������������������%22/�$3,(175<�'OO0DLQ��+$1'/(�K0RGXOH��������������������������':25'��XOBUHDVRQBIRUBFDOO��������������������������/392,'�OS5HVHUYHG�� � � � � ���^�� K,QVWDQFH� �K0RGXOH���� VZLWFK��XOBUHDVRQBIRUBFDOO��� ^�� � FDVH�'//B352&(66B$77$&+��� � FDVH�'//B7+5($'B$77$&+��� � FDVH�'//B7+5($'B'(7$&+��� � FDVH�'//B352&(66B'(7$&+��� � � EUHDN������`�����UHWXUQ�758(��`�����������������������������������������7KHV�DUH�WKH�H[SRUWHG�IXQFWLRQV��������������������������������������0$,1+22.B$3,�LQW�,QVWDOO)LOWHU'//�YRLG��^�����KKRRN+RRNV� �6HW:LQGRZV+RRN([�:+B0286(��+22.352&��0RXVH)XQF�������������������������������������+,167$1&(��K,QVWDQFH����������UHWXUQ����`��0$,1+22.B$3,�LQW�8Q,QVWDOO)LOWHU'//�YRLG��^�� 8QKRRN:LQGRZV+RRN([�KKRRN+RRNV���� UHWXUQ����

Page 365: Visual Basic - Subclassing and Hooking with VB & VB NET

`�����������������������������������������������������������������������������������)LOWHU�IXQFWLRQ�IRU�:+B0286(�������������������������������������������������������������������������������/5(68/7�&$//%$&.�0RXVH)XQF��LQW�Q&RGH��:3$5$0�Z3DUDP��/3$5$0�O3DUDP���^�� ��3DVV�DOO�PHVVDJHV�RQ�WR�WKH�QH[W�KRRN�LQ�WKH�FKDLQ�� UHWXUQ��&DOO1H[W+RRN([�KKRRN+RRNV��Q&RGH��Z3DUDP��O3DUDP����`�0DLQ+RRN�FSS�LQ�([DPSOH������EHJLQV�E\�GHFODULQJ�WZR�JOREDO�YDULDEOHV��K,QVWDQFH�DQG�KKRRN+RRNV��7KHVH�YDULDEOHV�DUH�JOREDO�WR�WKLV�'//�DQG�QRW�WR�DOO�'//V��7R�VKDUH�YDULDEOHV�EHWZHHQ�DOO�LQVWDQFHV�RI�D�'//��\RX�PXVW�GHFODUH�WKH�YDULDEOH�LQ�D��SUDJPD�GDWDBVHJ�FRGH�EORFN�VLPLODU�WR�WKH�IROORZLQJ����SUDJPD�GDWDBVHJ��'//6+$5(���� +:1'�KZQG0DLQ� �18//�����������������SUDJPD�GDWDBVHJ�����7KLV�FDXVHV�D�VLQJOH�KZQG0DLQ�YDULDEOH�WR�EH�VKDUHG�DFURVV�DOO�LQVWDQFHV�RI�WKLV�'//��)RU�WKLV�DSSOLFDWLRQ��WKHUH�DUH�WZR�JOREDO�YDULDEOHV��DQG�QR�YDULDEOHV�DUH�VKDUHG�DFURVV�'//�LQVWDQFHV��7KHVH�DUH�WKH�RQO\�WZR�JOREDO�YDULDEOHV�WKDW�QHHG�WR�EH�GHILQHG���+$1'/(�������K,QVWDQFH�����������������������*OREDO�LQVWDQFH�KDQGOH�IRU�'//�++22.��������KKRRN+RRNV����������������������+RRN�KDQGOH�7KH�K,QVWDQFH�YDULDEOH�FRQWDLQV�WKH�LQVWDQFH�RU�PRGXOH�KDQGOH�IRU�WKH�'//��7KLV�YDOXH�LV�SDVVHG�LQ�WR�'OO0DLQ����WKH�'//V�HQWU\�SRLQW����DV�WKH�ILUVW�SDUDPHWHU��:H�VLPSO\�QHHG�WR�DGG�WKH�IROORZLQJ�FRGH�WR�WKH�'OO0DLQ�IXQFWLRQ���K,QVWDQFH� �K0RGXOH��7KH�VHFRQG�JOREDO�YDULDEOH�LV�KKRRN+RRNV��7KLV�YDULDEOH�FRQWDLQV�WKH�KDQGOH�WR�WKH�LQVWDOOHG�KRRN��ZKLFK�LV�SDVVHG�EDFN�IURP�WKH�6HW:LQGRZV+RRN([�IXQFWLRQ��$V�D�QRWH��QHYHU�VKDUH�WKH�KRRN�KDQGOH�DFURVV�'//�LQVWDQFHV��(DFK�'//�ZLOO�FDOO�LWV�RZQ�,QVWDOO)LOWHU'//�IXQFWLRQ�DQG�REWDLQ�D�XQLTXH�KRRN�KDQGOH��8VLQJ�D�VLQJOH�KRRN�KDQGOH�DFURVV�DOO�'//�LQVWDQFHV�ZLOO�FDXVH�D�VHULRXV�SUREOHP�IRU�UXQQLQJ�DSSOLFDWLRQV�LQWR�ZKLFK�\RX�KDYH�LQMHFWHG�WKLV�'//���7KHUH�DUH�WKUHH�PDLQ�IXQFWLRQV�LQ�WKH�'//��([DPSOH������VKRZV�WKH�VRXUFH�FRGH�IRU�DOO�WKUHH��7KH�ILUVW�LV�,QVWDOO)LOWHU'//��ZKLFK�LQVWDOOV�WKH�PRXVH�KRRN��7KLV�IXQFWLRQ�LV�H[SRUWHG�IURP�WKH�'//��7KH�VHFRQG�IXQFWLRQ�LV�8Q,QVWDOO)LOWHU'//��ZKLFK�UHPRYHV�WKH�KRRN��7KLV�IXQFWLRQ�LV�DOVR�H[SRUWHG��7KH�WKLUG�IXQFWLRQ�LV�0RXVH)XQF��ZKLFK�LV�WKH�ILOWHU�IXQFWLRQ�IRU�WKH�PRXVH�KRRN��,QVWHDG�RI�EHLQJ�H[SRUWHG��WKLV�IXQFWLRQ�LV�GHILQHG�DV�D�FDOOEDFN�URXWLQH��7KH�IXQFWLRQDOLW\�ZLWKLQ�WKLV�ILOWHU�IXQFWLRQ�LV�VLPLODU�WR�WKH�WKUHDG�VSHFLILF�ILOWHU�IXQFWLRQ�LQ�([DPSOH��������

Page 366: Visual Basic - Subclassing and Hooking with VB & VB NET

1RZ�WKDW�ZH�KDYH�RXU�'//��ZH�QHHG�WR�FDOO�WKH�,QVWDOO)LOWHU'//�IXQFWLRQ�WR�LQVWDOO�WKLV�KRRN��7R�GR�WKLV��VLPSO\�FUHDWH�D�9%�(;(�ZLWK�RQH�IRUP��3ODFH�WZR�FRPPDQG�EXWWRQV�RQ�WKH�IRUP��DQG�SODFH�WKH�FRGH�VKRZQ�LQ�([DPSOH������LQWR�WKH�)RUP��IUP�PRGXOH���7KH�WZR�IXQFWLRQV�H[SRUWHG�IURP�RXU�'//��,QVWDOO)LOWHU'//�DQG�8Q,QVWDOO)LOWHU'//��DUH�GHFODUHG�ILUVW��7KH�+RRN�EXWWRQ�VLPSO\�FDOOV�,QVWDOO)LOWHU'//��DQG�WKH�8QKRRN�EXWWRQ�FDOOV�8Q,QVWDOO)LOWHU'//��1RWKLQJ�HOVH�RI�LPSRUWDQFH�KDSSHQV�LQ�WKH�9%�FRGH���

([DPSOH�������9%�)RUP��IUP�&RGH�IRU�D�6\VWHP�:LGH�0RXVH�+RRN��

3ULYDWH�'HFODUH�)XQFWLRQ�,QVWDOO)LOWHU'//�/LE�0DLQ+RRN�'OO�������$V�/RQJ�3ULYDWH�'HFODUH�)XQFWLRQ�8Q,QVWDOO)LOWHU'//�/LE�0DLQ+RRN�'OO�������$V�/RQJ������3XEOLF�6XE�&RPPDQG�B&OLFN����������'LP�O5HW9DO�$V�/RQJ�����O5HW9DO� �,QVWDOO)LOWHU'//��������������,I�O5HW9DO��!���7KHQ���������0VJ%R[��(UURU�,QVWDOOLQJ�PRXVH�+RRN������(QG�,I�(QG�6XE��3XEOLF�6XE�&RPPDQG�B&OLFN���������'LP�O5HW9DO�$V�/RQJ�����O5HW9DO� �8Q,QVWDOO)LOWHU'//��������������,I�O5HW9DO��!���7KHQ���������0VJ%R[��(UURU�UHPRYLQJ�PRXVH�+RRN������(QG�,I�(QG�6XE�

�������/RZ�/HYHO�0RXVH�+RRN�([DPSOH�

7KLV�H[DPSOH�GHVFULEHV�KRZ�WR�XVH�WKH�:+B0286(B//�KRRN�LQ�D�SXUH�9%�DSSOLFDWLRQ��<RX�GR�QRW�KDYH�WR�XVH�DQ\�&���FRGH�WR�LQVWDOO�DQG�XVH�WKLV�KRRN��,Q�IDFW��LQ�PDQ\�LQVWDQFHV�\RX�FDQ�VXEVWLWXWH�WKLV�KRRN�IRU�D�V\VWHP�ZLGH�:+B0286(�KRRN��WKLV�ZD\��\RX�GR�QRW�KDYH�WR�XVH�DQ\�ODQJXDJH�RWKHU�WKDQ�9%��)LJXUH������VKRZV�WKH�KRRNLQJ�DSSOLFDWLRQ���

)LJXUH�������$�VFUHHQVKRW�RI�WKH�ORZ�OHYHO�PRXVH�KRRN�DSSOLFDWLRQ�

Page 367: Visual Basic - Subclassing and Hooking with VB & VB NET

7DEOH������SUHVHQWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��

2EMHFW�7\SH� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�)RUP� 1DPH� )RUP��)RUP� &DSWLRQ� �:+B0286(B//�+RRN�'HPR��)RUP� 7RS� ����)RUP� /HIW� ����)RUP� +HLJKW� �����)RUP� :LGWK� �����)UDPH�� &DSWLRQ� �0286(B//��)UDPH�� 1DPH� )UDPH��)UDPH�� 7RS� ����)UDPH�� /HIW� ����)UDPH�� +HLJKW� �����)UDPH�� :LGWK� �����)UDPH�� &DSWLRQ� �0RXVH�&RRUGLQDWHV��)UDPH�� 1DPH� )UDPH��)UDPH�� 7RS� �����)UDPH�� /HIW� ����)UDPH�� +HLJKW� ����)UDPH�� :LGWK� �����)UDPH�� &DSWLRQ� �0RXVH�:KHHO�5RWDWLRQ��)UDPH�� 1DPH� )UDPH��)UDPH�� 7RS� �����)UDPH�� /HIW� �����)UDPH�� +HLJKW� �����

Page 368: Visual Basic - Subclassing and Hooking with VB & VB NET

)UDPH�� :LGWK� �����)UDPH�� &DSWLRQ� �0RXVH�;%XWWRQ�,QIRUPDWLRQ��)UDPH�� 1DPH� )UDPH��)UDPH�� 7RS� �����)UDPH�� /HIW� �����)UDPH�� +HLJKW� ����)UDPH�� :LGWK� �����7H[W%R[� 0XOWL/LQH� 7UXH�7H[W%R[� 7RS� ����7H[W%R[� /HIW� �����7H[W%R[� +HLJKW� �����7H[W%R[� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH�� FPG+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �KRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH�� FPG8Q+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �XQKRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����/DEHO�� 1DPH� OEO%WWQ,QIR�/DEHO�� &DSWLRQ� ���/DEHO�� 7RS� ����/DEHO�� /HIW� ����/DEHO�� +HLJKW� ����/DEHO�� :LGWK� �����/DEHO�� 1DPH� OEOZKHHO,QIR�/DEHO�� &DSWLRQ� ���/DEHO�� 7RS� ����/DEHO�� /HIW� ����

Page 369: Visual Basic - Subclassing and Hooking with VB & VB NET

/DEHO�� +HLJKW� ����/DEHO�� :LGWK� �����/DEHO�� 1DPH� OEO;�/DEHO�� &DSWLRQ� �;����/DEHO�� 7RS� ����/DEHO�� /HIW� �����/DEHO�� +HLJKW� ����/DEHO�� :LGWK� ����/DEHO�� 1DPH� OEO<�/DEHO�� &DSWLRQ� �<����/DEHO�� 7RS� ����/DEHO�� /HIW� �����/DEHO�� +HLJKW� ����/DEHO�� :LGWK� ����7R�XVH�WKLV�DSSOLFDWLRQ��FOLFN�WKH�KRRN�EXWWRQ�LQ�WKH�0286(B//�IUDPH�FRQWURO��7KLV�ZLOO�LQVWDOO�WKH�KRRN�DQG�LPPHGLDWHO\�VWDUW�GLVSOD\LQJ�PRXVH�PHVVDJHV�ZKHQ�WKH�V\VWHP�UHFHLYHV�WKHP��<RX�FDQ�PRYH�WKH�PRXVH�SRLQWHU�RYHU�DQ\�ZLQGRZ��DQG�WKH�KRRN�ZLOO�VWLOO�UHFHLYH�PHVVDJHV�HYHQ�WKRXJK�\RX�LQVWDOOHG�WKH�KRRN�LQ�DQ�(;(���7KH�V\VWHP�FDSWXUHV�WKH�PRXVH�SRLQWHUV�FRRUGLQDWHV�DQG�SODFHV�WKHP�LQ�WKH�0RXVH�&RRUGLQDWHV�IUDPH�FRQWURO��7KH�0RXVH�:KHHO�5RWDWLRQ�IUDPH�FRQWURO�GHVFULEHV�DQ\�PRYHPHQWV�RI�WKH�PRXVH�ZKHHO��(YHU\�WLPH�WKH�PRXVH�ZKHHO�LV�PRYHG�IRUZDUG�RU�EDFNZDUG��WKH�GLUHFWLRQ�RI�WKH�PRYHPHQW�LV�SODFHG�LQ�WKLV�IUDPH��$V�D�QRWH��RQH�:0B0286(:+((/�PHVVDJH�FDUULHV�WKH�LQIRUPDWLRQ�WR�GHVFULEH�WKH�GLUHFWLRQ�RI�WKH�PRXVH�ZKHHO��DQG�WKLV�PHVVDJH�DOVR�LV�FRQVLGHUHG�RQH�FKDQJH�LQ�WKH�ZKHHO�URWDWLRQ�RU�ZKHHO�GHOWD��DV�LW�LV�FRPPRQO\�UHIHUUHG�WR��$�ZKHHO�GHOWD�LV�GHILQHG�LQ�FRGH�DV�:+((/B'(/7$��ZKLFK�LV�D�FRQVWDQW�HTXDO�WR������$Q\�WLPH�WKH�XVHU�FOLFNV�RQH�RI�WKH�[EXWWRQV�RQ�WKH�PRXVH��WKH�0RXVH�;%XWWRQ�,QIRUPDWLRQ�IUDPH�ZLOO�FRQWDLQ�WKH�YDOXH�RI�WKH�[EXWWRQ�WKDW�ZDV�FOLFNHG���(YHU\�PRXVH�PHVVDJH�WKDW�WKLV�KRRN�LQWHUFHSWV�KDV�D�IODJ�LQGLFDWLQJ�ZKHWKHU�WKLV�PHVVDJH�ZDV�LQMHFWHG�LQWR�WKH�PHVVDJLQJ�VWUHDP��0RVW�RI�WKH�WLPH��GHYLFH�GULYHUV�LQMHFW�PRXVH�RU�NH\ERDUG�PHVVDJHV�LQWR�WKH�PHVVDJH�VWUHDP�WR�V\QWKHWLFDOO\�SURGXFH�D�PRXVH�RU�NH\ERDUG�PHVVDJH��7KHVH�V\QWKHWLF�PHVVDJHV�FDQQRW�EH�GHWHFWHG�H[FHSW�E\�D�ELW�LQ�WKH�IODJV�PHPEHU�RI�WKH�06//+22.6758&7�VWUXFWXUH�WKDW�LV�SDVVHG�WR�WKLV�KRRN��7KH�IODJV�PHPEHU�FDQ�EH�$1'HG�ZLWK�WKH�//0+)B,1-(&7('�FRQVWDQW�WR�GHWHUPLQH�ZKHWKHU�WKH�PHVVDJH�ZDV�LQMHFWHG���,I�\RX�DUH�XVLQJ�WKH�0LFURVRIW�,QWHOOL6HQVH�PRXVH�GULYHU��\RX�ZLOO�QRWLFH�LQMHFWHG�PHVVDJHV�DSSHDULQJ�IRU�VSHFLILF�HYHQWV��)RU�H[DPSOH��LI�\RX�VHW�\RXU�PRXVH�ZKHHO�WR�UHSURGXFH�D�GRXEOH�FOLFN��ZKHQ�LW�LV�FOLFNHG����WKDW�LV��FOLFNHG��QRW�URWDWHG����\RX�ZLOO�QRWLFH�D�VHULHV�RI�

Page 370: Visual Basic - Subclassing and Hooking with VB & VB NET

PHVVDJHV�WKDW�DUH�LQMHFWHG�IRU�WKLV�DFWLRQ��:KDW�KDSSHQV�LV�WKDW�WKH�PRXVH�GULYHU�GHWHFWV�WKDW�WKH�PRXVH�ZKHHO�KDV�EHHQ�FOLFNHG�DQG�LQMHFWV�WKH�IROORZLQJ�PHVVDJHV���:0B/%87721'2:1�:0B/%8772183�:0B/%87721'2:1�:0B/%8772183�,I�WKH�ZLQGRZ�FODVV�ZKHUH�WKH�GRXEOH�FOLFN�RFFXUUHG�LV�VHW�WR�UHFHLYH�GRXEOH�FOLFN�HYHQWV��WKH�SUHYLRXV�IRXU�PHVVDJHV�DUH�FRQYHUWHG�WR�WKH�IROORZLQJ���:0B/%87721'2:1�:0B/%8772183�:0B/%87721'%/&/.����������������7KLV�LV�ZKHUH�WKH�GRXEOH�FOLFN�RFFXUV�:0B/%8772183�7KLV�LV�RQH�H[DPSOH�RI�DQ�LQMHFWHG�PHVVDJH��2WKHU�GHYLFH�GULYHUV�RU�DSSOLFDWLRQV�WKDW�PLJKW�ZDQW�WR�V\QWKHWLFDOO\�FUHDWH�PRXVH�RU�NH\ERDUG�PHVVDJHV�DOVR�FDQ�LQMHFW�PHVVDJHV�LQWR�WKH�PHVVDJH�VWUHDP���7KH�FRGH�WR�LQVWDOO�DQG�UHPRYH�WKLV�KRRN�LV�VLPLODU�WR�WKH�FRGH�XVHG�LQ�WKH�:+B.(<%2$5'B//�KRRN�DSSOLFDWLRQ��LW�LV�VKRZQ�LQ�([DPSOH�������7KH�SRLQW�RI�LQWHUHVW�LV�WKDW�WKH�6HW:LQGRZV+RRN([�LQVWDOOV�:+B0286(B//�DV�D�V\VWHP�ZLGH�UDWKHU�WKDQ�D�WKUHDG�VSHFLILF�KRRN��1RWH�WKH�ODVW�WZR�SDUDPHWHUV�RI�WKH�6HW:LQGRZV+RRN([�IXQFWLRQ��,Q�WKLV�H[DPSOH��WKH�K0RG�SDUDPHWHU�RI�WKH�6HW:,QGRZV+RRN([�IXQFWLRQ�LV�VHW�HTXDO�WR�$SS�K,QVWDQFH��ZKLFK�LV�WKH�LQVWDQFH�KDQGOH�RI�WKLV�DSSOLFDWLRQ��7KLV�YDOXH�PXVW�EH�HTXDO�WR�WKH�KDQGOH�RI�WKH�PRGXOH�LQ�ZKLFK�WKH�ILOWHU�IXQFWLRQ�UHVLGHV��7KH�ILQDO�SDUDPHWHU��GZ7KUHDG,G��LV�VHW�WR�]HUR��PHDQLQJ�WKDW�WKLV�KRRN�ZLOO�PRQLWRU�HYHU\�WKUHDG�LQ�WKH�V\VWHP�IRU�PRXVH�PHVVDJHV���

([DPSOH�������,QVWDOOLQJ�DQG�5HPRYLQJ�WKH�:+B0286(B//�+RRN��

3ULYDWH�K+RRN�$V�/RQJ�3XEOLF�,V+RRNHG�$V�%RROHDQ��3XEOLF�6XE�6HW0RXVH+RRN���������,I�,V+RRNHG�7KHQ���������0VJ%R[��'RQW�KRRN�WKH�0286(B//�KRRN�WZLFH�RU�\RX�ZLOO�EH�XQDEOH�WR�XQKRRN�LW�������(OVH���������7KLV�KDV�WR�EH�VHW�XS�DV�D�V\VWHP�ZLGH�KRRN���������K+RRN� �6HW:LQGRZV+RRN([�:+B0286(B//��$GGUHVV2I�0RXVH3URF��$SS�K,QVWDQFH�������������,V+RRNHG� �7UXH�����(QG�,I�(QG�6XE�

Page 371: Visual Basic - Subclassing and Hooking with VB & VB NET

�3XEOLF�6XE�5HPRYH0RXVH+RRN���������'LP�WHPS�$V�/RQJ�����WHPS� �8QKRRN:LQGRZV+RRN([�K+RRN������,V+RRNHG� �)DOVH�(QG�6XE�7KH�0RXVH3URF�IXQFWLRQ��ZKLFK�LV�VKRZQ�LQ�([DPSOH�������DFWV�DV�WKH�ILOWHU�IXQFWLRQ�IRU�WKLV�KRRN��7KLV�IXQFWLRQ�VLPSO\�GLVSOD\V�WKH�IROORZLQJ�LQIRUPDWLRQ�WKDW�WKH�KRRN�SURYLGHV���

• 7KH�WH[W�ER[�GLVSOD\V�WKH�KRRN�FRGH��PHVVDJH�,'��H[WUD�LQIRUPDWLRQ�DVVRFLDWHG�ZLWK�WKH�PHVVDJH��WKH�WLPH�WKH�PHVVDJH�ZDV�FUHDWHG��DQG�ZKHWKHU�WKH�PHVVDJH�ZDV�LQMHFWHG���

• 7KH�0RXVH�&RRUGLQDWHV�IUDPH�UHFHLYHV�WKH�[�DQG�\�FRRUGLQDWHV�GHULYHG�IURP�WKH�PHVVDJH��7KH�[�DQG�\�FRRUGLQDWHV�DUH�VWRUHG�LQ�WKH�32,17�VWUXFWXUH�ZLWKLQ�WKH�06//+22.6758&7�VWUXFWXUH���

• 7KH�0RXVH�:KHHO�5RWDWLRQ�IUDPH�GLVSOD\V�WKH�GLUHFWLRQ��IRUZDUG�RU�EDFNZDUG��WKDW�WKH�PRXVH�ZKHHO�LV�URWDWLQJ��,I�WKH�Z3DUDP�SDUDPHWHU�LQGLFDWHV�WKDW�D�:0B0286(:+((/�PHVVDJH�KDV�EHHQ�LQWHUFHSWHG��\RX�FDQ�XVH�WKH�KLJK�RUGHU�ZRUG�RI�WKH�PRXVH'DWD�PHPEHU�RI�WKH�06//+22.6758&7�VWUXFWXUH�WR�GHWHUPLQH�WKH�GLUHFWLRQ�RI�WKLV�URWDWLRQ��,I�WKLV�YDOXH�LV�SRVLWLYH��WKH�PRXVH�ZKHHO�LV�EHLQJ�URWDWHG�IRUZDUG��RWKHUZLVH��LW�LV�EHLQJ�URWDWHG�EDFNZDUG���

• 7KH�0RXVH�;%XWWRQ�,QIRUPDWLRQ�IUDPH�UHFHLYHV�D�YDOXH�LQGLFDWLQJ�ZKLFK�PRXVH�[EXWWRQ�ZDV�SUHVVHG�RU�UHOHDVHG��<RX�FDQ�REWDLQ�WKH�[EXWWRQ�LQIRUPDWLRQ�IURP�WKH�KLJK�RUGHU�ZRUG�RI�WKH�PRXVH'DWD�PHPEHU�RI�WKH�06//+22.6758&7�VWUXFWXUH��EXW�RQO\�ZKHQ�Z3DUDP�FRQWDLQV�RQH�RI�WKH�IROORZLQJ�PHVVDJHV���

• :0B;%87721'2:1�• :0B;%8772183�• :0B;%87721'%/&/.�• :0B1&;%87721'2:1�• :0B1&;%8772183�• :0B1&;%87721'%/&/.�

([DPSOH�������7KH�0RXVH3URF�)LOWHU�)XQFWLRQ��

3XEOLF�)XQFWLRQ�0RXVH3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B�� � � � O3DUDP�$V�06//+22.6758&7��$V�/RQJ�����'LP�VWU,QMHFWHG�$V�6WULQJ����������,I�X&RGH�! ���7KHQ���������,I�//0+)B,1-(&7('�$QG�O3DUDP�IODJV�7KHQ�

Page 372: Visual Basic - Subclassing and Hooking with VB & VB NET

������������VWU,QMHFWHG� ��,QMHFWHG����������(OVH�������������VWU,QMHFWHG� ��1RW�,QMHFWHG����������(QG�,I������������������,I�Z3DUDP� �:0B0286(:+((/�7KHQ�������������,I�&/QJ�O3DUDP�PRXVH'DWD�$QG�+))))������!���7KHQ�����������������)RUP��OEO:KHHO,QIR� ��)RUZDUG��������������(OVH�����������������)RUP��OEO:KHHO,QIR� ��%DFNZDUGV��������������(QG�,I���������(OVH�������������)RUP��OEO%WWQ,QIR� �&6WU�O3DUDP�PRXVH'DWD�$QG�+))))��������������(QG�,I������������������)RUP��OEO;�&DSWLRQ� �O3DUDP�SW�[���������)RUP��OEO<�&DSWLRQ� �O3DUDP�SW�\������������������6HOHFW�&DVH�X&RGH�������������&DVH�+&B$&7,21�����������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&B$&7,21����06*����B�� � � � +H[��Z3DUDP��������([WUD�,QIR����O3DUDP�GZ([WUD,QIR��B�� � � � ����7LPH����O3DUDP�WLPH��������VWU,QMHFWHG��YE1HZ/LQH�������������&DVH�+&B125(029(�����������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&B125(029(����06*����B�� � � � +H[��Z3DUDP��������([WUD�,QIR����O3DUDP�GZ([WUD,QIR��B�� � � � ����7LPH����O3DUDP�WLPH��������VWU,QMHFWHG��YE1HZ/LQH�������������&DVH�(OVH���������(QG�6HOHFW�����(OVH���������)RUP��7H[W��7H[W� ��1$���YE1HZ/LQH�����(QG�,I������������������0RXVH3URF� �&DOO1H[W+RRN([�K+RRN��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�

Page 373: Visual Basic - Subclassing and Hooking with VB & VB NET

�����&DYHDWV�

2QFH�DJDLQ��SHUIRUPDQFH�PLJKW�EH�DQ�LVVXH�ZLWK�WKH�XVH�RI�WKH�:+B0286(�RU�:+B0286(B//�KRRN��HVSHFLDOO\�ZLWK�V\VWHP�ZLGH�DQG�ORZ�OHYHO�PRXVH�KRRNV��<RX�VKRXOG�XVH�WKHVH�KRRNV�MXGLFLRXVO\��)RU�PRUH�LQIRUPDWLRQ�RQ�WKH�SUREOHPV�ZLWK�ORZ�OHYHO�KRRNV��UHIHU�WR�6HFWLRQ������RI�&KDSWHU������:KHQ�XVLQJ�WKH�ORZ�OHYHO�PRXVH�KRRN��:+B0286(B//���QRWH�WKDW�WKH�GHEXJ�KRRN�FDQQRW�UHFHLYH�WKH�LQSXW�WR�WKLV�KRRN�EHIRUH�WKH�KRRN�LV�FDOOHG��7KH�GHEXJ�KRRN�ZRUNV�QRUPDOO\�ZLWK�WKH�PRXVH�KRRN��:+B0286(���7KH�GHEXJ�KRRN�LV�GHVFULEHG�LQ�&KDSWHU������$�UHJLVWU\�NH\�LV�DVVRFLDWHG�ZLWK�ORZ�OHYHO�KRRNV��VXFK�DV�:+B0286(B//�DQG�:+B.(<%2$5'B//��VHH�&KDSWHU������7KH�QXPHULF�UHJLVWU\�YDOXH�/RZ/HYHO+RRNV7LPHRXW�LV�ORFDWHG�LQ�WKH�IROORZLQJ�UHJLVWU\�NH\���+.(<B&855(17B86(5?&RQWURO�3DQHO?'HVNWRS�7KLV�YDOXH�FRQWUROV�WKH�WLPHRXW�SHULRG�LQ�PLOOLVHFRQGV�IRU�DOO�ORZ�OHYHO�KRRNV��,I�WKH�ILOWHU�IXQFWLRQ�IRU�D�ORZ�OHYHO�KRRN�GRHV�QRW�UHWXUQ�ZLWKLQ�WKLV�WLPH�VSDQ��WKH�V\VWHP�ZLOO�FDOO�WKH�QH[W�ORZ�OHYHO�KRRN�LQ�WKH�FKDLQ���$OWKRXJK�DOO����ELW�DQG����ELW�RSHUDWLQJ�V\VWHPV�VXSSRUW�WKH�:+B0286(�KRRN��DOO�GR�QRW�VXSSRUW�WKH�:+B0286(B//�KRRN��7KH�:+B0286(B//�KRRN�LV�IRXQG�RQO\�LQ�:LQGRZV�17��6HUYLFH�3DFN���RU�KLJKHU��DQG�:LQGRZV�������LW�LV�QRW�IRXQG�LQ�:LQGRZV��[���$V�RQH�ILQDO�FDXWLRQ��WKHUH�LV�D�EXJ�ZKHQ�XVLQJ�WKH�PRXVH�KRRNV�IURP�ZLWKLQ�D�9%�XVHU�FRQWURO��$UWLFOH�4�������LQ�WKH�0LFURVRIW�'HYHORSHU�1HWZRUN��06'1��GHWDLOV�WKH�EXJ�DQG�KRZ�WR�ZRUN�DURXQG�LW��9LVXDO�6WXGLR����6HUYLFH�3DFN���VROYHV�WKLV�SUREOHP����

Page 374: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU�����:+B)25(*5281','/(�7KLV�FKDSWHU�FRYHUV�WKH�:+B)25(*5281','/(�KRRN��7KH�FKDSWHU�SURYLGHV�D�GHVFULSWLRQ�RI�WKH�KRRN�DQG�DQ�H[SODQDWLRQ�RI�KRZ�LW�LV�XVHG��,W�DOVR�SURYLGHV�DQ�H[DPSOH�WR�GHPRQVWUDWH�WKLV�KRRNV�XVH�LQ�DQ�DSSOLFDWLRQ��7KH�FKDSWHU�HQGV�ZLWK�D�GLVFXVVLRQ�RI�VRPH�FRQVLGHUDWLRQV�WR�NHHS�LQ�PLQG�ZKHQ�XVLQJ�WKLV�KRRN���

�����'HVFULSWLRQ�

<RX�XVH�WKH�:+B)25(*5281','/(�KRRN�PDLQO\�WR�DOORZ�DQ�DSSOLFDWLRQ�WR�GR�EDFNJURXQG�SURFHVVLQJ�ZKHQ�LW�LV�DERXW�WR�JR�LQWR�DQ�LGOH�VWDWH��7KLV�W\SH�RI�SURFHVVLQJ�LV�QRUPDOO\�FDOOHG�EDFNJURXQG�SURFHVVLQJ�EHFDXVH�LW�RFFXUV�DIWHU�RWKHU�PRUH�LPSRUWDQW�SURFHVVLQJ�KDV�ILQLVKHG��$Q�DSSOLFDWLRQ�DFKLHYHV�DQ�LGOH�VWDWH�ZKHQ�LW�KDV�QR�PRUH�PHVVDJHV�LQ�WKH�PHVVDJH�TXHXH�WR�SURFHVV���7R�EH�PRUH�VSHFLILF��WKH�V\VWHP�FDOOV�WKLV�KRRN�ZKHQ�WKH�IRUHJURXQG�WKUHDG�LV�DERXW�WR�HQWHU�DQ�LGOH�VWDWH��(YHU\�DSSOLFDWLRQ�KDV�RQH�IRUHJURXQG�WKUHDG��DQ\�RWKHU�WKUHDG�LV�FRQVLGHUHG�D�EDFNJURXQG�WKUHDG��%HFDXVH�9LVXDO�%DVLF��9%��DSSOLFDWLRQV�UXQ�LQ�D�VLQJOH�WKUHDG��WKLV�WKUHDG�LV�FRQVLGHUHG�WKH�IRUHJURXQG�WKUHDG��,I�D�9%�DSSOLFDWLRQ�FUHDWHV�PXOWLSOH�WKUHDGV��WKH�V\VWHP�ZLOO�FDOO�WKH�KRRN�RQO\�ZKHQ�WKH�PDLQ�RU�IRUHJURXQG�WKUHDG�LV�DERXW�WR�JR�LQWR�DQ�LGOH�VWDWH���:KHQ�WKH�DSSOLFDWLRQ�LV�DERXW�WR�HQWHU�DQ�LGOH�VWDWH��WKH�V\VWHP�ZLOO�FKHFN�WR�VHH�LI�DQ\�:+B)25(*5281','/(�KRRNV�ZHUH�LQVWDOOHG��,I�VR��WKH�V\VWHP�FDOOV�WKH�ILUVW�ILOWHU�IXQFWLRQ�LQVWDOOHG�LQ�WKH�FKDLQ�IRU�WKLV�KRRN���<RX�FDQ�XVH�WKLV�KRRN�DV�D�WKUHDG�VSHFLILF�KRRN��RU�\RX�FDQ�SODFH�LW�LQ�D�G\QDPLF�OLQN�OLEUDU\��'//��DQG�XVH�LW�DV�D�V\VWHP�ZLGH�KRRN��$�WKUHDG�VSHFLILF�KRRN�LQWHUFHSWV�DOO�PHVVDJHV�ZLWKLQ�WKH�WKUHDG�LQ�ZKLFK�LW�LV�LQVWDOOHG��:KHQ�\RX�LQVWDOO�D�KRRN�DV�D�V\VWHP�ZLGH�KRRN��\RX�PXVW�SODFH�LW�LQ�D�'//��7KLV�'//�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�VR�WKDW�WKH�KRRN�FDQ�RSHUDWH�RQ�DOO�PHVVDJHV�LQ�WKH�V\VWHP��&KDSWHU���GLVFXVVHV�WKLV�LQ�GHWDLO���7KH�Z3DUDP�DQG�O3DUDP�DUJXPHQWV�DUH�QRW�XVHG�IRU�WKLV�KRRN��ZKLFK�PDNHV�WKLV�KRRN�RQH�RI�WKH�VLPSOHU�WR�LPSOHPHQW���

�����/RFDWLRQ�RI�7KLV�+RRN�LQ�WKH�6\VWHP�

7KH�V\VWHP�FDOOV�WKH�ILOWHU�IXQFWLRQ�IRU�WKLV�KRRN�RQO\�ZKHQ�WKH�DSSOLFDWLRQ�KDV�GHWHUPLQHG�WKDW�WKHUH�DUH�QR�PRUH�SHQGLQJ�PHVVDJHV�LQ�WKH�TXHXH�EXW�LPPHGLDWHO\�EHIRUH�WKH�WKUHDG�\LHOGV�LWVHOI�WR�RWKHU�ZDLWLQJ�WKUHDGV��7KLV�KRRN�LV�FDOOHG�IURP�ZLWKLQ�WKH�PHVVDJH�ORRS�IXQFWLRQ���

Page 375: Visual Basic - Subclassing and Hooking with VB & VB NET

$�W\SLFDO�PHVVDJH�ORRS�LV�ZULWWHQ�OLNH�WKLV��ZKLOH��*HW0HVVDJH��PVJ��18//������������^��� 7UDQVODWH0HVVDJH��PVJ������ 'LVSDWFK0HVVDJH��PVJ�����`�:KHQ�QR�PRUH�PHVVDJHV�DUH�SUHVHQW�LQ�WKH�PHVVDJH�TXHXH��WKH�*HW0HVVDJH�IXQFWLRQ�SXWV�WKH�DSSOLFDWLRQ�LQWR�DQ�LGOH�VWDWH��$Q�DSSOLFDWLRQ�LQ�DQ�LGOH�VWDWH�ZLOO�\LHOG�FRQWURO�RI�WKH�&38�WR�RWKHU�DSSOLFDWLRQV��:KLOH�WKH�DSSOLFDWLRQ�LV�LGOH��*HW0HVVDJH�ZDWFKHV�IRU�DQ\�QHZ�PHVVDJHV�SODFHG�LQ�WKH�TXHXH��$IWHU�D�QHZ�PHVVDJH�LV�SODFHG�WKHUH��*HW0HVVDJH�WDNHV�WKH�DSSOLFDWLRQ�RXW�RI�LWV�LGOH�VWDWH�DQG�SURFHHGV�WR�SURFHVV�WKLV�QHZ�PHVVDJH���$�9%�PHVVDJH�ORRS�ORRNV�VRPHWKLQJ�OLNH�WKLV��:KLOH�758(�� :KLOH�3HHN0HVVDJH�VWUXFW0VJ��������������� � ,I�VWUXFW0VJ�PHVVDJH� �:0B48,7�7KHQ�� � � ([LW�)XQFWLRQ�� � (OVH�� � � ,I�,V:LQGRZ�$QG�1RW�,V,FRQLF�����WKHQ�� � � � 7UDQVODWH0HVVDJH��VWUXFW0VJ��� � � � 'LVSDWFK0HVVDJH��VWUXFW0VJ��� � � (QG�,I�� � (QG�,I�� /RRS�� � �� ,I�%DFNJURXQG3URFHVVLQJ5HDG\�����7KHQ�� � 'R%DFN*URXQG3URFHVVLQJ�� (OVH�� � :DLW0HVVDJH�� (QG�,I�/RRS�,QVWHDG�RI�XVLQJ�D�*HW0HVVDJH�PHVVDJH�ORRS��9%�DSSOLFDWLRQV�XVH�D�3HHN0HVVDJH�PHVVDJH�ORRS��,Q�GRLQJ�VR��WKH�DSSOLFDWLRQ�PXVW�FDOO�WKH�:DLW0HVVDJH�IXQFWLRQ�WR�WHOO�WKH�V\VWHP�WKDW�LW�LV�LQ�DQ�LGOH�VWDWH��7KH�:DLW0HVVDJH�IXQFWLRQ�SODFHV�WKH�DSSOLFDWLRQ�LQ�DQ�LGOH�VWDWH�ZKHQ�QR�PHVVDJHV�DUH�LQ�WKH�PHVVDJH�TXHXH��DQG�LW�GRHV�QRW�UHWXUQ�XQWLO�D�QHZ�PHVVDJH�LV�SODFHG�LQ�WKH�TXHXH��VLPLODU�WR�WKH�ZD\�*HW0HVVDJH�ZRUNV���,I�ZH�KDG�DFFHVV�WR�WKLV�FRGH��ZH�FRXOG�VLPSO\�DGG�RXU�EDFNJURXQG�SURFHVVLQJ�IXQFWLRQ�LPPHGLDWHO\�EHIRUH�RU�DIWHU�WKH�'R%DFNJURXQG3URFHVVLQJ�IXQFWLRQ��%HFDXVH�ZH�GR�QRW�KDYH�DFFHVV�WR�WKLV�FRGH��ZH�PXVW�XVH�WKH�:+B)25(*5281','/(�KRRN�LI�ZH�DUH�WR�GR�DQ\�EDFNJURXQG�SURFHVVLQJ���

Page 376: Visual Basic - Subclassing and Hooking with VB & VB NET

8VLQJ�1X0HJDV�6PDUW&KHFN�XWLOLW\��ZH�FDQ�VHH�H[DFWO\�ZKHUH�WKLV�KRRN�LV�FDOOHG��DV�)LJXUH������LOOXVWUDWHV���

)LJXUH�������6PDUW&KHFN�RXWSXW�VKRZLQJ�WKH�PHVVDJH�ORRS�IRU�WKLV�DSSOLFDWLRQ�

/LQH������LV�WKH�VWDUW�RI�WKH�3HHN0HVVDJH�ORRS��/LQH������VKRZV�WKH�'LVSDWFK0HVVDJH�IXQFWLRQ�VHQGLQJ�WKH�PHVVDJH�RQ�WR�WKH�FRUUHFW�ZLQGRZ�SURFHGXUH��/LQH������VKRZV�WKH�:DLW0HVVDJH�IXQFWLRQ�EHLQJ�FDOOHG��,W�LV�KHUH�WKDW�WKH�:+B)25(*5281','/(�KRRN�LV�FDOOHG��/LQHV������WKURXJK������PDLQO\�GHDO�ZLWK�WKH�FRGH�ZLWKLQ�WKH�ILOWHU�IXQFWLRQ�ZKLFK�LQFUHPHQWV�WKH�FRXQWHU�LQ�WKH�WH[W�ER[�RQ�WKH�DSSOLFDWLRQV�PDLQ�IRUP��/LQH������LV�ZKHUH�WKH�&DOO1H[W+RRN([�IXQFWLRQ�FDOOV�WKH�QH[W�:+B)25(*5281','/(�KRRN�LQ�WKH�KRRN�FKDLQ���)LJXUH������LOOXVWUDWHV�ZKHUH�WKH�KRRN�SRLQW�H[LVWV�LQ�WKH�:LQGRZV�PHVVDJLQJ�V\VWHP���

)LJXUH�������7KH�ORFDWLRQ�RI�WKH�:+B)25(*5281','/(�KRRN�LQ�WKH�PHVVDJLQJ�V\VWHP�

Page 377: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�V\VWHP�FDOOV�WKLV�KRRN�ZKHQ�HLWKHU�WKH�*HW0HVVDJH�RU�:DLW0HVVDJH�IXQFWLRQV�DUH�DERXW�WR�SODFH�WKH�IRUHJURXQG�WKUHDG�LQWR�DQ�LGOH�VWDWH���

�����%DFNJURXQG�3URFHVVLQJ�([DPSOH�

7KH�:+B)25(*5281','/(�KRRN�H[DPSOH�IRU�WKLV�FKDSWHU�ZLOO�VLPSO\�LQFUHPHQW�D�QXPEHU�LQ�D�WH[W�ER[��)LJXUH������VKRZV�D�VFUHHQVKRW�RI�WKH�H[DPSOH�DSSOLFDWLRQ��7KLV�DSSOLFDWLRQ�KDV�WZR�EXWWRQV��7KH�KRRN�EXWWRQ�ZLOO�LQVWDOO�WKH�KRRN��DQG�WKH�XQKRRN�EXWWRQ�ZLOO�UHPRYH�WKH�KRRN��,I�WKH�XVHU�WULHV�WR�FORVH�WKH�DSSOLFDWLRQ�EHIRUH�UHPRYLQJ�WKH�KRRN��WKH�DSSOLFDWLRQ�ZLOO�GLVSOD\�D�PHVVDJH�ER[�LQIRUPLQJ�WKH�XVHU�WR�ILUVW�FOLFN�WKH�XQKRRN�EXWWRQ�DQG�WKHQ�VKXW�GRZQ�WKH�DSSOLFDWLRQ���

)LJXUH�������$�VFUHHQVKRW�RI�WKH�H[DPSOH�DSSOLFDWLRQ�

Page 378: Visual Basic - Subclassing and Hooking with VB & VB NET

7DEOH������OLVWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��

2EMHFW�7\SH� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�)RUP� 1DPH� )RUP��)RUP� &DSWLRQ� �:+B)25(*5281','/(�+RRN��)RUP� 7RS� ����)RUP� /HIW� ����)RUP� +HLJKW� �����)RUP� :LGWK� �����7H[W�%R[� 1DPH� 7H[W��7H[W�%R[� 7RS� ����7H[W�%R[� /HIW� �����7H[W�%R[� +HLJKW� �����7H[W�%R[� :LGWK� �����7H[W�%R[� 6FUROO%DUV� ��%RWK�)UDPH� &DSWLRQ� �,'/(��)UDPH� 1DPH� )UDPH��)UDPH� 7RS� ����)UDPH� /HIW� ����)UDPH� +HLJKW� �����)UDPH� :LGWK� �����&RPPDQG�%XWWRQ� 1DPH�� &RPPDQG��&RPPDQG�%XWWRQ� &DSWLRQ� �KRRN��&RPPDQG�%XWWRQ� 7RS� ����&RPPDQG�%XWWRQ� /HIW� ����&RPPDQG�%XWWRQ� +HLJKW� ����&RPPDQG�%XWWRQ� :LGWK� ����&RPPDQG�%XWWRQ� 1DPH�� &RPPDQG��&RPPDQG�%XWWRQ� &DSWLRQ� �XQKRRN��

Page 379: Visual Basic - Subclassing and Hooking with VB & VB NET

&RPPDQG�%XWWRQ� 7RS� ����&RPPDQG�%XWWRQ� /HIW� ����&RPPDQG�%XWWRQ� +HLJKW� ����&RPPDQG�%XWWRQ� :LGWK� ����:KHQ�WKH�XVHU�FOLFNV�WKH�KRRN�EXWWRQ��WKH�DSSOLFDWLRQ�ZLOO�LQFUHPHQW�D�QXPEHU�LQ�WKH�WH[W�ER[�IURP�WR���������ZKHQHYHU�LW�HQWHUV�LWV�LGOH�VWDWH��:KHQ�LW�UHDFKHV���������LW�ZLOO�VWDUW�RYHU�DW�]HUR���([DPSOH������SUHVHQWV�WKH�FRGH�FRQWDLQHG�LQ�WKH�GHFODUDWLRQ�VHFWLRQ�RI�WKH�0RGXOH��EDV�PRGXOH���

([DPSOH�������7KH�'HFODUDWLRQ�6HFWLRQ�IRU�WKH�0RGXOH��EDV�0RGXOH��

3ULYDWH�'HFODUH�)XQFWLRQ�6HW:LQGRZV+RRN([�/LE��XVHU����$OLDV��6HW:LQGRZV+RRN([$��B������%\9DO�LG+RRN�$V�/RQJ��%\9DO�OSIQ�$V�/RQJ��%\9DO�KPRG�$V�/RQJ��B�����%\9DO�GZ7KUHDG,G�$V�/RQJ��$V�/RQJ�3ULYDWH�'HFODUH�)XQFWLRQ�8QKRRN:LQGRZV+RRN([�/LE��XVHU����B������%\9DO�K+RRN�$V�/RQJ��$V�/RQJ�3ULYDWH�'HFODUH�)XQFWLRQ�&DOO1H[W+RRN([�/LE��XVHU�����%\9DO�K+RRN�$V�/RQJ��B�����%\9DO�QFRGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��O3DUDP�$V�$Q\��$V�/RQJ��3ULYDWH�&RQVW�:+B)25(*5281','/(� ����3ULYDWH�&RQVW�+&B$&7,21� ����3ULYDWH�K+RRN�$V�/RQJ�3ULYDWH�,V+RRNHG�DV�%RROHDQ�7KH�:+B)25(*5281','/(�FRQVWDQW�LV�WKH�LGHQWLILHU�IRU�WKLV�KRRN�W\SH��7KH�+&B$&7,21�FRQVWDQW�LV�FRPSDUHG�WR�WKH�X&RGH�DUJXPHQW�VHQW�WR�WKH�ILOWHU�IXQFWLRQ��,I�WKH�X&RGH�DUJXPHQW�LV�HTXDO�WR�RU�JUHDWHU�WKDQ�+&B$&7,21��ZH�FDQ�H[HFXWH�RXU�IXQFWLRQDOLW\��RWKHUZLVH��ZH�QHHG�WR�VNLS�LW���1H[W��ZH�QHHG�WR�GHILQH�D�PRGXOH�OHYHO�YDULDEOH��K+RRN��WR�KROG�WKH�KRRN�KDQGOH�WKDW�ZH�JHW�IURP�6HW:LQGRZV+RRN([��:H�ZLOO�QHHG�WKH�KRRN�KDQGOH�WR�FDOO�WKH�QH[W�KRRN�LQ�WKH�FKDLQ��DV�ZHOO�DV�WR�UHPRYH�WKH�KRRN�ZKHQ�ZH�DUH�ILQLVKHG�XVLQJ�LW���7KH�ILQDO�PRGXOH�OHYHO�YDULDEOH�WKDW�ZH�QHHG�WR�FUHDWH�LV�,V+RRNHG��7KLV�YDULDEOH�ZLOO�DFW�DV�D�IODJ�WR�VLJQLI\�ZKHWKHU�WKH�KRRN�KDV�EHHQ�LQVWDOOHG��7KLV�ZLOO�SUHYHQW�XV�IURP�LQVWDOOLQJ�D�VHFRQG��GXSOLFDWH�KRRN���([DPSOH������SUHVHQWV�WKH�FRGH�IRU�WKH�0RGXOH��EDV�PRGXOH���

([DPSOH�������7KH�0RGXOH��EDV�0RGXOH��

Page 380: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�6XE�6HW,GOH+RRN���������,I�,V+RRNHG�7KHQ���������0VJ%R[��'RQW�KRRN�LW�WZLFH�ZLWKRXW�XQKRRNLQJ�RU�\RX����B�����������������ZLOO�EH�XQDEOH�WR�XQKRRN�LW�������(OVH���������K+RRN� �6HW:LQGRZV+RRN([�:+B)25(*5281','/(��$GGUHVV2I�,GOH3URF����B����������������������������������$SS�7KUHDG,'�����������,V+RRNHG� �7UXH�����(QG�,I�(QG�6XE��3XEOLF�6XE�5HPRYH,GOH+RRN���������'LP�WHPS�$V�/RQJ�����WHPS� �8QKRRN:LQGRZV+RRN([�K+RRN������,V+RRNHG� �)DOVH�(QG�6XE��3XEOLF�)XQFWLRQ�,GOH3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B��������������������������O3DUDP�$V�/RQJ��$V�/RQJ�����,I�X&RGH�! �+&B$&7,21�7KHQ���������,I�,V1XPHULF�)RUP��7H[W��7H[W��7KHQ�������������,I�&'EO�)RUP��7H[W��7H[W��!��������7KHQ�����������������)RUP��7H[W��7H[W� �����������������(OVH�����������������)RUP��7H[W��7H[W� �&'EO�)RUP��7H[W��7H[W������������������(QG�,I���������(QG�,I�����(OVH���������6NLS�SURFHVVLQJ�����(QG�,I����������,GOH3URF� �&DOO1H[W+RRN([�K+RRN��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KH�6HW,GOH+RRN�URXWLQH�LQ�([DPSOH������VKRZV�WKH�FRGH�WR�LQVWDOO�WKH�KRRN��7R�VHW�WKH�KRRN��ZH�FDOO�6HW:LQGRZV+RRN([�ZLWK�WKH�:+B)25(*5281','/(�FRQVWDQW�LQ�WKH�ILUVW�DUJXPHQW�DQG�WKH�DGGUHVV�RI�WKH�ILOWHU�IXQFWLRQ�LQ�WKH�VHFRQG�DUJXPHQW��7KH�WKLUG�DUJXPHQW�LV�D�]HUR�EHFDXVH�WKH�ILOWHU�IXQFWLRQ�LV�QRW�ORFDWHG�ZLWKLQ�D�'//�PRGXOH��7KH�IRXUWK�DUJXPHQW�LV�

Page 381: Visual Basic - Subclassing and Hooking with VB & VB NET

VHW�HTXDO�WR�$SS�7KUHDG,'��7KLV�LV�WKH�LGHQWLILHU�RI�WKH�WKUHDG�LQ�ZKLFK�WKH�ILOWHU�IXQFWLRQ�LV�ORFDWHG���1RWLFH�KRZ�WKH�,V+RRNHG�YDULDEOH�SUHYHQWV�WKH�XVHU�IURP�VHWWLQJ�WKH�KRRN�D�VHFRQG�WLPH���7KH�VHFRQG�IXQFWLRQ�WKDW�ZH�QHHG�WR�ZULWH�UHOHDVHV�WKH�KRRN��LW�LV�QDPHG�5HPRYH,GOH+RRN�DQG�LV�VKRZQ�LQ�([DPSOH�������7KLV�IXQFWLRQ�ZLOO�VLPSO\�FDOO�WKH�8Q+RRN:LQGRZV+RRN([�IXQFWLRQ�DQG�WKHQ�VHW�WKH�,V+RRNHG�IODJ�WR�)DOVH��LQGLFDWLQJ�WKDW�WKH�KRRN�KDV�EHHQ�UHPRYHG���7KH�ODVW�IXQFWLRQ�WKDW�ZH�QHHG�WR�ZULWH�LV�WKH�ILOWHU�IXQFWLRQ�IRU�WKH�KRRN��ZKLFK�DOVR�LV�VKRZQ�LQ�([DPSOH�������7KH�V\VWHP�LQLWLDOO\�SDVVHV�WKH�X&RGH�DUJXPHQW�LQWR�WKLV�IXQFWLRQ��:KHQ�\RXU�ILOWHU�IXQFWLRQ�UHFHLYHV�D�YDOXH�OHVV�WKDQ�]HUR��\RX�PXVW�QRW�SHUIRUP�DQ\�SURFHVVLQJ�DQG�FDOO�&DOO1H[W+RRN([�WR�FDOO�DQ\�RWKHU�ILOWHU�IXQFWLRQV�LQ�WKH�FKDLQ��,I�WKH�X&RGH�DUJXPHQW�FRQWDLQV�D�YDOXH�JUHDWHU�WKDQ�RU�HTXDO�WR�+&B$&7,21��WKLV�LV�D�FRQVWDQW�WKDW�LV�HTXDO�WR�]HUR���\RX�FDQ�SHUIRUP�DQ\�SURFHVVLQJ�IURP�LQVLGH�\RXU�ILOWHU�IXQFWLRQ�DQG�WKHQ�FDOO�WKH�QH[W�ILOWHU�IXQFWLRQ�LQ�WKH�FKDLQ���$V�\RX�FDQ�VHH��WKH�FRGH�WR�LQFUHPHQW�WKH�QXPEHU�GLVSOD\HG�LQ�WKH�WH[W�ER[�LV�H[HFXWHG�RQO\�ZKHQ�X&RGH�LV�JUHDWHU�WKDQ�RU�HTXDO�WR�+&B$&7,21��RWKHUZLVH��ZH�QHHG�WR�VNLS�WKH�SURFHVVLQJ�DQG�FDOO�WKH�QH[W�KRRN�LQ�WKH�FKDLQ��3ODFLQJ�WKH�&DOO1H[W+RRN([�IXQFWLRQ�DW�WKH�HQG�RI�WKLV�IXQFWLRQ�DVVXUHV�XV�WKDW�WKH�V\VWHP�ZLOO�FDOO�WKH�QH[W�KRRN�LQ�WKH�FKDLQ���([DPSOH������VKRZV�WKH�FRGH�LQ�WKH�)RUP��IUP�PRGXOH��7KH�&RPPDQG��EXWWRQ�VHWV�WKH�YDOXH�LQ�WKH�WH[W�ER[�WR�]HUR�DQG�FDOOV�6HW,GOH+RRN�WR�LQVWDOO�WKH�KRRN��7KH�&RPPDQG��EXWWRQ�VLPSO\�FDOOV�5HPRYH,GOH+RRN�WR�UHPRYH�WKH�LQVWDOOHG�KRRN��)LQDOO\��WKH�)RUPB4XHU\8QORDG�HYHQW�SURFHGXUH�WHVWV�WKH�,V+RRNHG�IODJ�WR�GHWHUPLQH�LI�WKH�KRRN�LV�VWLOO�LQVWDOOHG��,I�LW�LV��D�PHVVDJH�ER[�LV�GLVSOD\HG�LQIRUPLQJ�WKH�XVHU�WR�FOLFN�WKH�XQKRRN�EXWWRQ�EHIRUH�VKXWWLQJ�GRZQ�WKH�DSSOLFDWLRQ��,I�WKLV�WHVW�ZDV�QRW�SHUIRUPHG�DQG�WKH�DSSOLFDWLRQ�ZDV�VKXW�GRZQ�ZLWK�WKH�KRRN�VWLOO�LQVWDOOHG��D�*HQHUDO�3URWHFWLRQ�)DXOW��*3)��ZRXOG�RFFXU���

([DPSOH�������6RXUFH�&RGH�IRU�WKH�)RUP��IUP�0RGXOH��

3ULYDWH�6XE�&RPPDQG�B&OLFN���������7H[W��7H[W� ���������&DOO�6HW,GOH+RRN�(QG�6XE��3ULYDWH�6XE�&RPPDQG�B&OLFN���������&DOO�5HPRYH,GOH+RRN�(QG�6XE���������������&/($183�

Page 382: Visual Basic - Subclassing and Hooking with VB & VB NET

������������3ULYDWH�6XE�)RUPB4XHU\8QORDG�&DQFHO�$V�,QWHJHU��8QORDG0RGH�$V�,QWHJHU������,I�,V+RRNHG�7KHQ���������&DQFHO� �����������0VJ%R[��8QKRRN�EHIRUH�FORVLQJ��RU�WKH�DSSOLFDWLRQ�ZLOO�FUDVK�������(QG�,I�(QG�6XE�

�����&DYHDWV�

:KLOH�UXQQLQJ�WKH�H[DPSOH�DSSOLFDWLRQ�SURYLGHG�ZLWK�WKLV�FKDSWHU��\RX�PLJKW�QRWLFH�WKDW�WKH�QXPEHU�VWRSV�LQFUHPHQWLQJ�ZKHQ�DQRWKHU�DSSOLFDWLRQ�LV�EURXJKW�WR�WKH�IRUHJURXQG��,I�\RX�PDNH�WKH�H[DPSOH�DSSOLFDWLRQ�WKH�DFWLYH�ZLQGRZ��WKH�QXPEHU�FRQWLQXHV�WR�LQFUHPHQW��7KLV�LV�EHFDXVH�WKH�PDLQ�WKUHDG�RI�RXU�DSSOLFDWLRQ�LV�FRQVLGHUHG�WKH�IRUHJURXQG�WKUHDG�ZKHQ�WKH�DSSOLFDWLRQ�LV�DFWLYH��$�IRUHJURXQG�WKUHDG�LV�WKH�PDLQ�WKUHDG�RI�DQ�DSSOLFDWLRQ�WKDW�LV�FXUUHQWO\�DFWLYDWHG��$OO�RWKHU�WKUHDGV�DUH�FRQVLGHUHG�EDFNJURXQG�WKUHDGV��7KLV�GHVLJQ�DOORZV�WKH�V\VWHP�WR�JLYH�PRUH�&38�WLPH�WR�WKLV�WKUHDG��WKXV�ERRVWLQJ�WKH�SHUIRUPDQFH�RI�WKH�DFWLYH�DSSOLFDWLRQ��:KHQ�RXU�DSSOLFDWLRQ�LV�GHDFWLYDWHG��DQRWKHU�DSSOLFDWLRQV�PDLQ�WKUHDG�ZLOO�EHFRPH�WKH�IRUHJURXQG�WKUHDG��DQG�WKH�PDLQ�WKUHDG�RI�RXU�DSSOLFDWLRQ�ZLOO�EHFRPH�D�EDFNJURXQG�WKUHDG��$IWHU�RXU�DSSOLFDWLRQV�PDLQ�WKUHDG�FHDVHV�WR�EH�D�IRUHJURXQG�WKUHDG��WKH�V\VWHP�ZLOO�QRW�FDOO�WKH�KRRN�LQVWDOOHG�RQ�WKDW�WKUHDG���7KH�V\VWHP�FDOOV�WKH�:+B)25(*5281','/(�KRRN�RQO\�LPPHGLDWHO\�EHIRUH�WKH�DSSOLFDWLRQ�JRHV�LQWR�DQ�LGOH�VWDWH��QRW�ZKLOH�WKH�DSSOLFDWLRQ�LV�LQ�DQ�LGOH�VWDWH��7KHUHIRUH��WKLV�KRRN�FDQ�SUHYHQW�WKH�DSSOLFDWLRQ�IURP�JRLQJ�LQWR�DQ�LGOH�VWDWH�LI�WKH�FRGH�ZLWKLQ�WKH�KRRN�FDXVHV�D�PHVVDJH�WR�EH�VHQW�WR�WKH�ZLQGRZV�PHVVDJH�TXHXH��7KH�:DLW0HVVDJH�IXQFWLRQ�ZLOO�VHH�WKLV�QHZ�PHVVDJH�DQG�UHWXUQ��SUHYHQWLQJ�WKH�DSSOLFDWLRQ�IURP�HQWHULQJ�DQ�LGOH�VWDWH��<RX�FDQ�VHH�HYLGHQFH�RI�WKLV�LQ�RXU�VDPSOH�DSSOLFDWLRQ��WKH�QXPEHU�LQ�WKH�WH[W�ER[�NHHSV�LQFUHPHQWLQJ�ZKHQ�WKH�ZLQGRZ�LV�WKH�DFWLYH�ZLQGRZ�EXW�QR�LQSXW�LV�EHLQJ�VHQW�WR�LW��7KLV�KDSSHQV�EHFDXVH�RXU�FRGH�LV�ZULWLQJ�WKH�LQFUHPHQWHG�QXPEHU�WR�WKH�WH[W�ER[��HIIHFWLYHO\�VHQGLQJ�VHYHUDO�PHVVDJHV�WR�WKH�WH[W�ER[�FRQWURO�RQ�RXU�IRUP��2QH�RI�WKHVH�PHVVDJHV�LV�WKH�:0B&7/&2/25(',7��ZKLFK�LV�VHQW�WR�LQIRUP�WKH�SDUHQW�ZLQGRZ��RXU�IRUP��WKDW�WKH�WH[W�ER[�LV�JRLQJ�WR�UHSDLQW�LWVHOI��7KH�V\VWHP�SODFHV�WKLV�PHVVDJH�RQ�WKH�PHVVDJH�TXHXH��DQG�ZKHQ�WKLV�KDSSHQV��WKH�DSSOLFDWLRQ�FRPHV�RXW�RI�LWV�LGOH�VWDWH�DQG�EHJLQV�WR�SURFHVV�WKLV�QHZ�PHVVDJH��:KHQ�ILQLVKHG��LW�RQFH�DJDLQ�WULHV�WR�HQWHU�DQ�LGOH�VWDWH��7KH�V\VWHP�FDOOV�RXU�KRRN�IXQFWLRQ�DQG�LQFUHPHQWV�WKH�QXPEHU�LQ�WKH�WH[W�ER[��7KLV�RQFH�DJDLQ�VHQGV�WKH�:0B&7/&2/25(',7�PHVVDJH�WR�WKH�PDLQ�IRUP��SUHYHQWLQJ�RXU�DSSOLFDWLRQ�IURP�HQWHULQJ�DQ�LGOH�VWDWH���$V�DQRWKHU�WHVW��\RX�FDQ�UHSODFH�WKH�IROORZLQJ�FRGH�LQ�WKH�6HW,GOH3URF�ILOWHU�IXQFWLRQ���

Page 383: Visual Basic - Subclassing and Hooking with VB & VB NET

,I�,V1XPHULF�)RUP��7H[W��7H[W��7KHQ�����,I�&'EO�)RUP��7H[W��7H[W��!��������7KHQ���������)RUP��7H[W��7H[W� ���������(OVH���������)RUP��7H[W��7H[W� �&'EO�)RUP��7H[W��7H[W����������(QG�,I�(QG�,I�ZLWK�WKLV�FRGH��,I�)RUP��/HIW�!���WKHQ�� )RUP��/HIW� �)RUP��/HIW�����(QG�,I�,I�)RUP��7RS�!���WKHQ�� )RUP��7RS� �)RUP��7RS�����(QG�,I�7KLV�FRGH�FKHFNV�WKH�ORFDWLRQ�RI�WKH�IRUP�WR�VHH�LI�LWV�WRS�OHIW�FRUQHU�LV�DW�WKH�����FRRUGLQDWHV�RQ�WKH�VFUHHQ��,I�WKH�IRUP�LV�QRW�DW�WKLV�ORFDWLRQ��WKH�FRGH�ZLOO�SURFHHG�WR�PRYH�WKH�IRUP�FORVHU�WR�WKH�WRS�OHIW�FRUQHU�RQH�SL[HO�DW�D�WLPH��7KLV�SURGXFHV�WKH�DQQR\LQJ�HIIHFW�RI�WKH�IRUP�FRQVWDQWO\�PRYLQJ�ZKLOH�\RX�DUH�WU\LQJ�WR�XVH�LW���,I�\RX�UXQ�WKLV�FRGH��\RX�ZLOO�QRWLFH�WKDW�WKH�IRUP�PRYHV�RQO\�ZKHQ�PHVVDJHV�DUH�EHLQJ�VHQW�WR�WKH�ZLQGRZ��)RU�H[DPSOH��PRYH�WKH�PRXVH�DFURVV�WKH�IRUP��7KH�IRUP�ZLOO�PRYH�FORVHU�WR�WKH�WRS�OHIW�FRUQHU�RI�WKH�VFUHHQ��6WRS�PRYLQJ�WKH�PRXVH�DQG�WKH�IRUP�ZLOO�FHDVH�PRYLQJ��7KLV�DJDLQ�SURYHV�WKDW�WKH�FRGH�LQ�WKH�ILOWHU�IXQFWLRQ�LV�EHLQJ�FDOOHG�RQO\�LPPHGLDWHO\�EHIRUH�WKH�DSSOLFDWLRQ�JRHV�LQWR�DQ�LGOH�VWDWH���

Page 384: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU�����:+B06*),/7(5�7KLV�FKDSWHU�ZLOO�GLVFXVV�WKH�:+B06*),/7(5�KRRN�DQG�ZLOO�LQFOXGH�D�WKUHDG�VSHFLILF�H[DPSOH�WR�GHPRQVWUDWH�LWV�VHWXS�DQG�XVH��7KH�:+B06*),/7(5�KRRN�LV�D�VSHFLDO�W\SH�RI�KRRN�WKDW�LQWHUFHSWV�RQO\�D�VSHFLILF�VXEVHW�RI�VHQW�PHVVDJHV��7KLV�KRRN�KDV�D�YHU\�FORVH�FRXVLQ��WKH�:+B6<606*),/7(5�KRRN��7KH�:+B6<606*),/7(5�KRRN�LQWHUFHSWV�WKH�VDPH�W\SH�RI�PHVVDJHV�EXW�DW�D�V\VWHP�ZLGH�OHYHO�RQO\��&KDSWHU����ZLOO�GLVFXVV�WKH�:+B6<606*),/7(5�KRRN�DQG�FRPSDUH�DQG�FRQWUDVW�LW�ZLWK�WKH�:+B06*),/7(5�KRRN��

�����'HVFULSWLRQ�

7KH�:+B06*),/7(5�KRRN�LQWHUFHSWV�RQO\�VHQW�PHVVDJHV��DQG�QRW�SRVWHG�PHVVDJHV��WKDW�PHQXV��GLDORJ�ER[HV��PHVVDJH�ER[HV��DQG�VFUROOEDUV�SURGXFH��)RU�D�PRUH�GHWDLOHG�GLVFXVVLRQ�RI�VHQW�PHVVDJHV�YHUVXV�SRVWHG�PHVVDJHV��VHH�&KDSWHU���DQG�&KDSWHU�����<RX�FDQ�LPSOHPHQW�WKH�:+B06*),/7(5�KRRN�ZLWK�HLWKHU�WKUHDG�VSHFLILF�RU�V\VWHP�ZLGH�VFRSH��<RX�FDQ�LPSOHPHQW�WKH�FRXVLQ�RI�WKLV�KRRN��:+B6<606*),/7(5��RQO\�ZLWK�V\VWHP�ZLGH�VFRSH��<RX�FDQ�XVH�WKH�:+B06*),/7(5�KRRN�DV�D�WKUHDG�VSHFLILF�KRRN��RU�\RX�FDQ�SODFH�LW�LQ�D�G\QDPLF�OLQN�OLEUDU\��'//��DQG�XVH�LW�DV�D�V\VWHP�ZLGH�KRRN��$�WKUHDG�VSHFLILF�KRRN�LQWHUFHSWV�DOO�PHVVDJHV�ZLWKLQ�WKH�WKUHDG�LQ�ZKLFK�LW�LV�LQVWDOOHG��:KHQ�\RX�LQVWDOO�D�KRRN�DV�D�V\VWHP�ZLGH�KRRN��\RX�PXVW�SODFH�LW�LQ�D�'//��7KLV�'//�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�VR�WKDW�WKH�KRRN�FDQ�RSHUDWH�RQ�DOO�PHVVDJHV�LQ�WKH�V\VWHP��&KDSWHU���GLVFXVVHV�WKLV�LQ�GHWDLO��<RX�PLJKW�EH�ZRQGHULQJ�ZK\�WKLV�KRRN�LQWHUFHSWV�D�VHHPLQJO\�DUELWUDU\�VHW�RI�PHVVDJHV��7R�XQGHUVWDQG�ZK\��ZH�QHHG�WR�XQGHUVWDQG�ZKDW�D�PRGDO�ORRS�LV�DQG�KRZ�LW�DIIHFWV�PHVVDJHV�WKDW�\RX�VHQG�DQG�SRVW�WR�D�WKUHDG��

�������7KH�0RGDO�/RRS�

0LFURVRIW�GHILQHV�D�PRGDO�ORRS�DV�IROORZV��

$�PHVVDJH�SURFHVVLQJ�ORRS�GXULQJ�ZKLFK�WKH�V\VWHP�UHWULHYHV�DQG�GLVSDWFKHV�PHVVDJHV�ZLWKRXW�DOORZLQJ�DQ�DSSOLFDWLRQ�WKH�RSSRUWXQLW\�WR�ILOWHU�WKH�PHVVDJHV�LQ�LWV�PDLQ�PHVVDJH�ORRS��

,Q�RWKHU�ZRUGV��ZKHQ�FHUWDLQ�HYHQWV�RFFXU�LQ�WKH�V\VWHP��H�J���D�PHQX�LV�RSHQHG��D�ZLQGRZ�LV�PRYHG�VL]HG��D�PRGDO�GLDORJ�LV�GLVSOD\HG��RU�D�VFUROOEDU�LV�PRYHG���WKH�WKUHDG�HQWHUV�D�ORRS�LQ�

Page 385: Visual Basic - Subclassing and Hooking with VB & VB NET

LWV�RZQ�PHVVDJLQJ�V\VWHP��7KLV�ORRS�LV�FDOOHG�D�PRGDO�ORRS��1RWH�WKDW�ZKHQ�D�ZLQGRZ�HQWHUV�D�PRGDO�ORRS��LW�DIIHFWV�RQO\�WKH�WKUHDG�WKDW�WKH�ZLQGRZ�EHORQJV�WR��'XULQJ�WKLV�ORRS��WKH�ZLQGRZ�SURFHGXUH�UHFHLYHV�PHVVDJHV�SHUWDLQLQJ�RQO\�WR�WKH�VSHFLILF�W\SH�RI�HYHQW�WKDW�RFFXUUHG��H�J���WR�WKH�PHQX�WKDW�ZDV�RSHQHG��WR�WKH�ZLQGRZ�EHLQJ�PRYHG�RU�UHVL]HG��WR�WKH�PRGDO�GLDORJ�EHLQJ�GLVSOD\HG��RU�WR�WKH�VFUROOEDU�EHLQJ�PRYHG���3RVWHG�PHVVDJHV�DUH�QRW�UHWULHYHG�IURP�WKH�PHVVDJH�TXHXH�GXULQJ�WKLV�PRGDO�ORRS��7R�HQG�WKH�ORRS��WKH�XVHU�PXVW�SHUIRUP�DQ�DFWLRQ�WKDW�FDXVHV�WKH�PRGDO�ORRS�WR�WHUPLQDWH��7KLV�DFWLRQ�FDQ�EH�DQ\�RI�WKH�IROORZLQJ��

• &OLFNLQJ�D�PHQX�LWHP��ZKLFK�FORVHV�WKH�PHQX��WHUPLQDWHV�WKH�PRGDO�ORRS��DQG�SHUIRUPV�WKH�PHQX�DFWLRQ�WKH�XVHU�FKRVH��

• 5HOHDVLQJ�WKH�OHIW�PRXVH�EXWWRQ�GXULQJ�D�PRYLQJ�RU�VL]LQJ�RSHUDWLRQ�RQ�D�ZLQGRZ��ZKLFK�FDXVHV�WKH�PRYLQJ�RU�VL]LQJ�RSHUDWLRQ�WR�FHDVH�DQG�WKH�PRGDO�ORRS�WR�WHUPLQDWH��

• 5HOHDVLQJ�WKH�OHIW�PRXVH�EXWWRQ�DIWHU�PRYLQJ�WKH�WKXPE�RQ�D�VFUROOEDU��ZKLFK�VWRSV�WKH�VFUROOLQJ�DFWLRQ�DQG�HQGV�WKH�PRGDO�ORRS��

• &OLFNLQJ�WKH�2.�RU�&DQFHO�EXWWRQV�RQ�D�PRGDO�GLDORJ�RU�PHVVDJH�ER[��ZKLFK�FORVHV�WKH�PRGDO�ZLQGRZ�DQG�HQGV�WKH�PRGDO�ORRS��

• 3UHVVLQJ�WKH�(6&�NH\��ZKLFK�FDXVHV�D�PRGDO�ORRS�WR�WHUPLQDWH��• 6ZLWFKLQJ�WR�D�GLIIHUHQW�ZLQGRZ��ZKLFK�FDXVHV�WKH�PRGDO�ORRS�WR�WHUPLQDWH��H[FHSW�

ZKHQ�D�PRGDO�GLDORJ�ER[�RU�PHVVDJH�ER[�LV�GLVSOD\HG��LQ�WKLV�FDVH��WKH�XVHU�QHHGV�WR�FORVH�WKH�PRGDO�ZLQGRZ�WR�HQG�WKH�PRGDO�ORRS��

:KHQ�WKH�PRGDO�ORRS�HQGV��WKH�ZLQGRZ�FDQ�RQFH�DJDLQ�UHFHLYH�SRVWHG�PHVVDJHV�IURP�WKH�PHVVDJH�TXHXH��7R�VHH�WKLV�LQ�DFWLRQ��OHWV�ILUVW�H[DPLQH�D�PRGDO�ORRS�WKDW�WKH�XVHU�LQLWLDWHV�ZKHQ�KH�FOLFNV�D�PHQX�LWHP��)LJXUH������GLVSOD\V�WKH�6S\���RXWSXW�IURP�WKLV�DFWLRQ��)LUVW��WKH�XVHU�FOLFNV�WKH�OHIW�PRXVH�EXWWRQ�RQ�D�WRS�OHYHO�PHQX�LWHP��7KLV�FRUUHVSRQGV�WR�/LQH����RI�WKH�6S\���RXWSXW��7KLV�DFWLRQ�FDXVHV�WKH�:0B1&/%87721'2:1�PHVVDJH�WR�EH�SRVWHG�ZLWK�D�+LW7HVW�YDOXH�RI�+70(18��7KH�+LW7HVW�YDOXH�FRPHV�IURP�WKH�Z3DUDP�SDUDPHWHU�RI�WKLV�PHVVDJH�DQG�SURYLGHV�LQIRUPDWLRQ�RQ�ZKHUH�WKH�PRXVH�LV�SRVLWLRQHG�ZKHQ�WKH�OHIW�PRXVH�EXWWRQ�LV�GHSUHVVHG��$�YDOXH�RI�+70(18�LQGLFDWHV�WKDW�WKH�PRXVH�LV�SRVLWLRQHG�RYHU�D�PHQX��(YHQWXDOO\��WKH�'HI:LQGRZ3URF�IXQFWLRQ�UHFHLYHV�WKLV�PHVVDJH�DIWHU�WKH�VSHFLILF�ZLQGRZ�SURFHGXUH�SURFHVVHV�LW��7KH�'HI:LQGRZ3URF�IXQFWLRQ�XVHV�WKH�+LW7HVW�YDOXH�WR�GHWHUPLQH�LI�DQ\�RWKHU�DFWLRQV�QHHG�WR�EH�SHUIRUPHG�EHIRUH�UHWXUQLQJ��%HFDXVH�RI�WKLV�+LW7HVW�YDOXH��'HI:LQGRZ3URF�LQ�/LQH����VHQGV�D�:0B6<6&200$1'�PHVVDJH�ZLWK�DQ�6&B0286(0(18�IODJ�WR�WKH�ZLQGRZ�WKDW�RZQV�WKH�PHQX��:KHQ�'HI:LQGRZ3URF�UHFHLYHV�WKH�:0B6<6&200$1'�PHVVDJH��LW�VHQGV�D�:0B(17(50(18/223�PHVVDJH�LQ�/LQH����WR�WKH�ZLQGRZ�WKDW�RZQV�WKH�PHQX��7KH�:0B(17(50(18/223�PHVVDJH�LV�D�QRWLILFDWLRQ�W\SH�PHVVDJH�WKDW�LQIRUPV�WKH�ZLQGRZ�RZQLQJ�WKLV�PHQX�WKDW�D�PRGDO�ORRS�LV�EHLQJ�HQWHUHG��

Page 386: Visual Basic - Subclassing and Hooking with VB & VB NET

1RWLFH�WKDW�WKH�'HI:LQGRZ3URF�IXQFWLRQ�KDV�QRW�UHWXUQHG�IURP�SURFHVVLQJ�WKH�LQLWLDO�:0B6<6&200$1'�PHVVDJH��8QWLO�LW�UHWXUQV�IURP�WKLV�PHVVDJH��LW�FDQQRW�SURFHVV�DQ\�SRVWHG�PHVVDJHV��7KH�'HI:LQGRZ3URF�IXQFWLRQ�ILQDOO\�UHWXUQV�IURP�WKLV�FDOO�LQ�/LQH�����,Q�EHWZHHQ�/LQHV����DQG�����\RX�FDQ�VHH�DOO�WKH�QHVWHG�PHVVDJHV�WKDW�KDYH�EHHQ�VHQW�DQG�UHWXUQHG��$OO�WKHVH�PHVVDJHV�DUH�LQ�UHVSRQVH�WR�VSHFLILF�HYHQWV�RFFXUULQJ�LQ�WKH�PHQX�IURP�WKH�PRXVH�DQG�NH\ERDUG��$OO�WKH�PHVVDJHV�VHQW�ZLWKLQ�WKH�PRGDO�ORRS�DUH�HLWKHU�EHLQJ�VHQW�IURP�WKH�'HI:LQGRZ3URF�RU�GLUHFWO\�IURP�WKH�PHQX��

)LJXUH�������6S\���RXWSXW�GXULQJ�D�PHQX�PRGDO�ORRS�

<RX�PLJKW�EH�ZRQGHULQJ�KRZ�PRXVH�DQG�NH\ERDUG�PHVVDJHV����ZKLFK�DUH�RQO\�SRVWHG����VWLOO�ZRUN�ZKLOH�WKH�ZLQGRZ�LV�LQ�D�PRGDO�ORRS��,W�VHHPV�OLNH�WKH�PRGDO�ORRS�ZRXOG�SUHYHQW�WKH�PRXVH�DQG�NH\ERDUG�IURP�IXQFWLRQLQJ�ZKLOH�LQVLGH�WKH�PHQX��+HUHV�KRZ�:LQGRZV�JHWV�DURXQG�WKDW�SUREOHP��:KHQ�D�PRXVH�RU�NH\ERDUG�PHVVDJH�LV�SRVWHG��WKH�SDUHQW�ZLQGRZ�RI�WKH�PHQX�SXOOV�WKH�PHVVDJH�RII�RI�WKH�PHVVDJH�TXHXH��,W�WKHQ�VHQGV�D�:0B127,)<�PHVVDJH�ZLWK�WKH�DSSURSULDWH�QRWLILFDWLRQ�FRGH�WR�WKH�PHQX��7KH�PHQX�LV�WKHQ�QRWLILHG�RI�PRXVH�DQG�NH\ERDUG�HYHQWV�DV�WKH\�RFFXU��6RPH�RI�WKH�QRWLILFDWLRQ�FRGHV�WKDW�DUH�XVHG�IRU�PRXVH�DQG�NH\ERDUG�LQSXW�DUH��

• 10B.(<'2:1�• 10B+,77(67�• 10B5&/,&.�• 10B&/,&.�• 10B&+$5�

Page 387: Visual Basic - Subclassing and Hooking with VB & VB NET

$V�,�PHQWLRQHG�SUHYLRXVO\��PHQXV�DUH�QRW�WKH�RQO\�WKLQJV�WKDW�FDQ�FDXVH�D�PRGDO�ORRS�WR�RFFXU��$�PRYLQJ�RU�VL]LQJ�RSHUDWLRQ�RQ�D�ZLQGRZ�FDQ�FDXVH�WKLV�DV�ZHOO��1RWH�WKDW�D�PLQLPL]H��UHVWRUH��RU�PD[LPL]H�DFWLRQ�DOVR�ZLOO�FDXVH�D�VL]LQJ�PRGDO�ORRS�WR�RFFXU��$V�ZH�FDQ�VHH�LQ�)LJXUH�������D�ZLQGRZ�HQWHUV�D�PRGDO�ORRS�IRU�D�PRYLQJ�DFWLRQ�RQ�/LQH����RI�WKH�6S\���RXWSXW��7KLV�LV�LQ�UHVSRQVH�WR�WKH�XVHU�FOLFNLQJ�DQG�GUDJJLQJ�WKH�ZLQGRZ��/LQH����VKRZV�WKH�XVHU�EHJLQQLQJ�WKH�PRYLQJ�DFWLRQ��2QFH�DJDLQ��WKH�:0B1&/%87721'2:1�PHVVDJH�LV�VHQW��7KLV�WLPH�WKH�PHVVDJH�FRQWDLQV�D�+LW7HVW�YDOXH�RI�+7&$37,21��ZKLFK�FDXVHV�WKH�'HI:LQGRZ3URF�WR�VHQG�D�:0B6<6&200$1'�PHVVDJH�ZLWK�DQ�6&B029(�IODJ�WR�WKH�ZLQGRZ�EHLQJ�PRYHG��7KH�XVHU�UHOHDVHV�WKH�PRXVH�EXWWRQ��FDXVLQJ�WKH�:0B6<6&200$1'�PHVVDJH�WR�UHWXUQ��<RX�PLJKW�QRWLFH�WKDW�WKH�:0B1&/%8772183�PHVVDJH�LV�QRW�EHLQJ�SRVWHG��7KLV�LV�EHFDXVH�GXULQJ�D�PRGDO�ORRS��QR�PHVVDJHV�FDQ�EH�SRVWHG�WR�WKH�WKUHDGV�PHVVDJH�TXHXH��,QVWHDG��LW�LV�QRWLILHG�WKDW�WKH�DFWLRQ�LV�HQGLQJ��5HOHDVLQJ�WKH�PRXVH�EXWWRQ�FDXVHV�WKH�'HI:LQGRZ3URF�WR�DOORZ�WKH�:0B6<6&200$1'�PHVVDJH�WR�UHWXUQ��HQGLQJ�WKH�PRGDO�ORRS��

)LJXUH�������6S\���RXWSXW�IRU�D�PRGDO�ORRS�FDXVHG�E\�D�PRYLQJ�RSHUDWLRQ�

,Q�PRVW�LQVWDQFHV��WKH�PRGDO�ORRS�IRU�D�PRYLQJ�RSHUDWLRQ�LV�YHU\�ORQJ��7R�VKRZ�WKLV��DQRWKHU�PRYH�PRGDO�ORRS�EHJLQV�RQ�/LQH����RI�)LJXUH�������7KH�PRYH�PRGDO�ORRS�HQGV�RQ�/LQH�����RI�)LJXUH�������$FWXDOO\��VLQFH�PDQ\�RWKHU�PHVVDJHV����VXFK�DV�PRXVH�PRYHPHQW��QRWLILFDWLRQ��DQG�SDLQWLQJ�PHVVDJHV����DUH�EHLQJ�ILUHG��,�FKRVH�WR�HOLPLQDWH�WKHVH�IURP�WKH�RXWSXW�WR�DOORZ�IRU�HDVLHU�UHDGLQJ��

)LJXUH�������6S\���RXWSXW�IRU�HQGLQJ�D�PRGDO�ORRS�FDXVHG�E\�WKH�XVHU�UHOHDVLQJ�WKH�OHIW�PRXVH�EXWWRQ�

Page 388: Visual Basic - Subclassing and Hooking with VB & VB NET

&UHDWLQJ�DQG�GLVSOD\LQJ�D�PRGDO�GLDORJ�RU�PHVVDJH�ER[�FDXVHV�DQRWKHU�PRGDO�ORRS��)LJXUH������VKRZV�WKH�FUHDWLRQ�RI�D�PHVVDJH�ER[�DQG�WKH�VXEVHTXHQW�PRGDO�ORRS��,Q�WKLV�FDVH��WKH�0VJ%R[�FRPPDQG�LQ�9LVXDO�%DVLF��9%��FDXVHV�WKH�:0B&200$1'�PHVVDJH�WR�EH�VHQW�LQ�/LQH�����7KLV�VWDUWV�WKH�PRGDO�ORRS�IRU�WKH�PRGDO�PHVVDJH�ER[��$�VHULHV�RI�PHVVDJHV�IROORZ�WR�FUHDWH��VL]H��SRVLWLRQ��DQG�SDLQW�WKH�PHVVDJH�ER[�RQ�WKH�VFUHHQ��7KH�PRGDO�ORRS�LV�ILQDOO\�H[LWHG�RQ�/LQH�����RI�)LJXUH�������7KH�PRGDO�ORRS�LV�H[LWHG�RQO\�DIWHU�WKH�PHVVDJH�ER[�LV�FORVHG��

)LJXUH�������6S\���RXWSXW�IRU�EHJLQQLQJ�D�PHVVDJH�ER[�PRGDO�ORRS�

)LJXUH�������6S\���RXWSXW�IRU�HQGLQJ�D�PHVVDJH�ER[�PRGDO�ORRS�

Page 389: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�ILQDO�PRGDO�ORRS�GHDOV�ZLWK�XVLQJ�D�VFUROOEDU��$�VFUROOEDU�PRGDO�ORRS�EHJLQV�RQ�/LQH����RI�)LJXUH�������2QFH�DJDLQ��WKH�:0B1&/%87721'2:1�PHVVDJH�LV�ILUHG�ZKHQ�WKH�XVHU�FOLFNV�RQ�WKH�VFUROOEDU�DQG�GUDJV�LW�WR�PRYH�LW��7KH�:0B1&/%87721'2:1�PHVVDJH�FDXVHV�'HI:LQGRZ3URF�WR�VHQG�D�:0B6<6&200$1'�ZLWK�WKH�6&B96&52//�IODJ��7KH�PRGDO�ORRS�HQGV�RQ�/LQH����ZKHQ�WKH�XVHU�UHOHDVHV�WKH�OHIW�PRXVH�EXWWRQ��

)LJXUH�������6S\���RXWSXW�IRU�D�VFUROOEDU�PRGDO�ORRS�

<RX�FDQ�VHH�RWKHU�H[DPSOHV�RI�PRGDO�ORRSV�E\�FKHFNLQJ�WKH��6KRZ�ZLQGRZ�FRQWHQWV�ZKLOH�GUDJJLQJ��RSWLRQ�LQ�WKH�(IIHFWV�WDE�RI�WKH�'LVSOD\�3URSHUWLHV�GLDORJ�ER[��\RX�FDQ�DFFHVV�WKLV�GLDORJ�ER[�E\�VHOHFWLQJ�WKH�&RQWURO�3DQHOV�'LVSOD\�DSSOHW��$IWHU�\RX�FKHFN�WKLV�RSWLRQ��RSHQ�1RWHSDG�DQG�VWDUW�W\SLQJ��$V�\RX�PLJKW�DOUHDG\�KDYH�JXHVVHG��WKH�NH\ERDUG�SRVWV�PHVVDJHV�WR�1RWHSDG��DQG�1RWHSDG�GLVSOD\V�WKHP��1RZ�FOLFN�WKH�WLWOH�EDU�DQG�GUDJ�WKH�ZLQGRZ�DURXQG�WKH�VFUHHQ��:KLOH�\RX�DUH�GRLQJ�WKLV�DQG�EHIRUH�UHOHDVLQJ�WKH�EXWWRQ��WU\�W\SLQJ��7KH�FXUVRU�LV�VWLOO�EOLQNLQJ�LQ�WKH�FOLHQW�DUHD�RI�1RWHSDG��EXW�QR�NH\ERDUG�PHVVDJHV�DUH�EHLQJ�SRVWHG�WR�WKH�ZLQGRZ��:KHQ�\RX�UHOHDVH�WKH�OHIW�PRXVH�EXWWRQ��HQGLQJ�WKH�PRYLQJ�RSHUDWLRQ��\RX�ZLOO�QRWLFH�

Page 390: Visual Basic - Subclassing and Hooking with VB & VB NET

WKDW�QRQH�RI�WKH�NH\V�\RX�W\SHG�LV�GLVSOD\HG��7KH�NH\ERDUG�PHVVDJHV�ZHUH�GLVFDUGHG�IURP�WKH�PHVVDJH�TXHXH�ZKLOH�WKH�ZLQGRZ�ZDV�LQVLGH�WKH�PRGDO�ORRS��7KLV�VKRZV�DQRWKHU�LPSRUWDQW�DVSHFW�RI�PRGDO�ORRSV��'XULQJ�D�PRGDO�ORRS��WKH�WKUHDG�ZLOO�SURFHVV�DQ\�SRVWHG�PHVVDJHV�DQG�VHQG�WKHP�DV�QRWLILFDWLRQV�WR�WKH�PRGDO�ORRS��%HFDXVH�WKH�PRGDO�ORRS�ZLOO�QRW�DOORZ�WKH�FKDUDFWHUV�WR�EH�GLVSOD\HG�RQ�WKH�VFUHHQ��WKH�NH\SUHVVHV�DUH�GLVFDUGHG��'RLQJ�WKLV�HQVXUHV�WKDW�WKH�PRGDO�ORRS�DQG��WKXV��WKH�PRYLQJ�RSHUDWLRQ�DUH�QRW�LQWHUUXSWHG��7KH�PRGDO�ORRS�LV�WKH�PDLQ�UHDVRQ�IRU�KDYLQJ�WKH�:+B06*),/7(5�KRRN��8VLQJ�WKLV�KRRN��ZH�FDQ�SHUIRUP�SURFHVVLQJ�GXULQJ�D�PRGDO�ORRS��8VLQJ�WKH�:+B&$//:1'352&�KRRN��ZH�FDQ�LQWHUFHSW�DOO�PHVVDJHV�VHQW�WR�WKH�ZLQGRZ�SURFHGXUH��EXW�XVLQJ�WKH�:+B06*),/7(5�KRRN��ZH�LQWHUFHSW�RQO\�D�VXEVHW�RI�WKRVH�PHVVDJHV��,W�FDQ�EH�D�ELJ�SHUIRUPDQFH�ERRVWHU�LI�\RX�FDQ�XVH�D�:+B06*),/7(5�KRRN�LQVWHDG�RI�D�:+B&$//:1'352&�KRRN��

�������)LOWHU�)XQFWLRQ�'HILQLWLRQ�

7KH�ILOWHU�IXQFWLRQ�SURWRW\SH�IRU�WKLV�KRRN�LV�ZULWWHQ�DV�IROORZV��3XEOLF�)XQFWLRQ�0HVVDJH3URF��%\9DO�X&RGH�$V�/RQJ��B�� � � � ���%\9DO�Z3DUDP�$V�/RQJ��B�� � � � ���O3DUDP�$V�06*��$V�/RQJ�7KH�SDUDPHWHUV�SDVVHG�WR�LW�DUH��X&RGH

7KH�FRGH�WKH�V\VWHP�VHQGV�WR�WKLV�ILOWHU�IXQFWLRQ��Z3DUDP

7KLV�SDUDPHWHU�LV�QRW�XVHG��O3DUDP

$�SRLQWHU�WR�WKH�06*�VWUXFWXUH��7KH�UHWXUQ�YDOXH�IRU�WKLV�ILOWHU�IXQFWLRQ�VKRXOG�EH�WKH�UHWXUQ�YDOXH�RI�WKH�&DOO1H[W+RRN([�IXQFWLRQ��ZKLFK�RUGLQDULO\�LV�]HUR��,I�WKLV�IXQFWLRQ�LV�QRW�FDOOHG��WKH�ILOWHU�IXQFWLRQ�UHWXUQV�D�]HUR��,�GR�QRW�UHFRPPHQG�VNLSSLQJ�WKH�FDOO�WR�&DOO1H[W+RRN([��WKRXJK��)DLOLQJ�WR�FDOO�WKLV�IXQFWLRQ�ZLOO�IRUFH�RWKHU�ILOWHU�IXQFWLRQV�LQ�WKH�FKDLQ�WR�QRW�EH�FDOOHG��

�������([SODQDWLRQ�RI�+RRN�&RGHV�

7KH�X&RGH�SDUDPHWHU�RI�WKH�ILOWHU�IXQFWLRQ�ZLOO�UHFHLYH�D�KRRN�FRGH��7KHUH�DUH�IRXU�FRGHV�WKDW�PD\�EH�VHQW�WR�WKLV�ILOWHU�IXQFWLRQ��7KH�FRGHV�DUH��MSGF_DIALOGBOX

$Q�LQSXW�HYHQW����VXFK�DV�D�PRXVH�RU�NH\ERDUG�PHVVDJH����KDV�EHHQ�VHQW�WR�D�PHVVDJH�ER[�RU�D�GLDORJ�ER[��)RU�WKH�VLPLODULWLHV�DQG�GLIIHUHQFHV�EHWZHHQ�ZLQGRZV��PHVVDJH�ER[HV��DQG�GLDORJ�ER[HV��VHH�&KDSWHU����<RX�GHFODUH�WKLV�FRQVWDQW�DV�IROORZV��3XEOLF�&RQVW�06*)B',$/2*%2;� ���

Page 391: Visual Basic - Subclassing and Hooking with VB & VB NET

MSGF_SCROLLBAR

$Q�LQSXW�HYHQW�RFFXUUHG�LQ�D�VFUROOEDU��7KLV�FRQVWDQW�GHILQHG�DV�IROORZV��3XEOLF�&RQVW�06*)B6&52//%$5� ���

MSGF_MENU

$Q�LQSXW�HYHQW�KDV�RFFXUUHG�LQ�D�PHQX��7KLV�FRQVWDQW�LV�GHILQHG�DV�IROORZV��3XEOLF�&RQVW�06*)B0(18� ���

MSGF_DDEMGR

$Q�LQSXW�HYHQW�KDV�RFFXUUHG�ZKLOH�WKH�'\QDPLF�'DWD�([FKDQJH�0DQDJHPHQW�/LEUDU\��''(0/��ZDV�LQ�WKH�SURFHVV�RI�ZDLWLQJ�IRU�D�V\QFKURQRXV�WUDQVDFWLRQ�WR�FRPSOHWH��7KH�''(0/�LV�D�:LQ���LQWHUIDFH�WKDW�DOORZV�GHYHORSHUV�WR�DGG�'\QDPLF�'DWD�([FKDQJH��''(��WR�WKHLU�DSSOLFDWLRQV��''(�LV�D�GDWD�WUDQVIHU�PHFKDQLVP�WKDW�DOORZV�PXOWLSOH�DSSOLFDWLRQV�WR�FRPPXQLFDWH�WKURXJK�D�GHILQHG�VHW�RI�PHWKRGV��''(�LV�QRW�VWDWH�RI�WKH�DUW�WHFKQRORJ\��DQG�LW�QHYHU�JDLQHG�ZLGHVSUHDG�DFFHSWDQFH��7KLV�FRQVWDQW�LV�GHILQHG�DV�IROORZV��3XEOLF�&RQVW�06*)B''(0*5� �+�����

,I�QRQH�RI�WKHVH�FRGHV�LV�SDVVHG�LQ��PHVVDJH�SURFHVVLQJ�VKRXOG�EH�VNLSSHG��DQG�&DOO1H[W+RRN([�VKRXOG�EH�FDOOHG�LPPHGLDWHO\��

�������/RFDWLRQ�RI�7KLV�+RRN�LQ�WKH�6\VWHP�

7KLV�KRRN�LV�ORFDWHG�LQVLGH�D�WKUHDGV�PHVVDJH�ORRS��DV�)LJXUH������LOOXVWUDWHV��7KH�KRRN�LV�FDOOHG�EHIRUH�WKH�PHVVDJH�LV�SDVVHG�RQ�WR�WKH�ZLQGRZ�SURFHGXUH�RU�WR�DQ\�LQVWDOOHG�VXEFODVV�SURFHGXUH��

)LJXUH�������7KH�ORFDWLRQ�RI�WKH�:+B06*),/7(5�KRRN�LQ�WKH�PHVVDJLQJ�V\VWHP�

Page 392: Visual Basic - Subclassing and Hooking with VB & VB NET

�����$�7KUHDG�6SHFLILF�([DPSOH�

7KH�H[DPSOH�DSSOLFDWLRQ�SUHVHQWHG�KHUH�LV�VLPLODU�WR�SUHYLRXV�H[DPSOHV��7KH�DSSOLFDWLRQ�SURYLGHV�RQH�EXWWRQ�IRU�LQVWDOOLQJ�WKH�:+B06*),/7(5�KRRN�DQG�RQH�IRU�XQLQVWDOOLQJ�WKH�KRRN��$IWHU�\RX�LQVWDOO�WKH�KRRN��PHVVDJHV�WKDW�WKH�:+B06*),/7(5�KRRN�LQWHUFHSWV�DUH�GLVSOD\HG��DORQJ�ZLWK�WKH�PHPEHUV�RI�WKH�06*�VWUXFWXUH�IRU�HDFK�PHVVDJH��DV�)LJXUH������VKRZV��

)LJXUH�������6FUHHQVKRW�RI�WKH�:+B06*),/7(5�DSSOLFDWLRQ�

Page 393: Visual Basic - Subclassing and Hooking with VB & VB NET

7DEOH������SUHVHQWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV��7KUHH�LWHPV�DUH�SUHVHQW�LQ�WKH�VDPSOH�DSSOLFDWLRQ�WR�WHVW�WKLV�KRRN��7KH�ILUVW�LV�D�PHQX�WKDW�FRQWDLQV�D�VLQJOH�PHQX�LWHP��:KHQ�WKH�KRRN�LV�LQVWDOOHG�DQG�WKLV�PHQX�LV�XVHG��WKH�KRRN�ZLOO�LQWHUFHSW�PHVVDJHV�UHODWHG�WR�DFWLRQV�SHUIRUPHG�RQ�WKH�PHQX�DQG�GLVSOD\�WKHP�LQ�WKH�WH[W�ER[�SURYLGHG��0HQX�PHVVDJHV�WR�WKH�ILOWHU�IXQFWLRQ�ZLWK�D�FRGH�RI�06*)B0(18��$V�D�QRWH��\RX�FDQ�ULJKW�FOLFN�WKH�WH[W�ER[�RU�WKH�ZLQGRZ�WLWOH�EDU�WR�SURGXFH�D�SRS�XS�PHQX��7KH�KRRN�DOVR�ZLOO�LQWHUFHSW�PHVVDJHV�UHODWHG�WR�WKHVH�W\SHV�RI�PHQXV��7KH�VHFRQG�LWHP�LV�D�EXWWRQ�WKDW�GLVSOD\V�D�PHVVDJH�ER[��:KHQ�WKH�PHVVDJH�ER[�LV�GLVSOD\HG��WKH�:+B06*),/7(5�KRRN�ZLOO�LQWHUFHSW�PHVVDJHV�UHODWHG�WR�WKH�PHVVDJH�ER[��0HVVDJH�ER[�PHVVDJHV�DUH�VHQW�WR�WKH�ILOWHU�IXQFWLRQ�ZLWK�D�FRGH�RI�06*)B',$/2*%2;��:KHQ�WKH�XVHU�FOLFNV�WKH�2.�EXWWRQ��WKH�KRRN�FHDVHV�WR�LQWHUFHSW�PHVVDJHV�IRU�WKH�PHVVDJH�ER[��

7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��2EMHFW� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�

)RUP� &DSWLRQ� �:+B06*),/7(5�+RRN�7HVW��)RUP� 7RS� ����)RUP� /HIW� ����)RUP� +HLJKW� �����)RUP� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH� &RPPDQG��&RPPDQG�%XWWRQ�� &DSWLRQ� �KRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� &RPPDQG��&RPPDQG�%XWWRQ�� &DSWLRQ� �XQKRRN��

Page 394: Visual Basic - Subclassing and Hooking with VB & VB NET

&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� FPG8QKRRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �0VJ%R[�7HVW��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ���&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����6FUROO%DU� 7RS� ����6FUROO%DU� /HIW� �����6FUROO%DU� +HLJKW� �����6FUROO%DU� :LGWK� ����7H[W%R[� 0XOWL/LQH� 7UXH�7H[W%R[� 6FUROO%DUV� ��%RWK�7H[W%R[� 7RS� ���7H[W%R[� /HIW� �����7H[W%R[� +HLJKW� �����7H[W%R[� :LGWK� �����7RS�/HYHO�0HQX� &DSWLRQ� �0HQX�7HVW��6XE�0HQX� &DSWLRQ� �'R�1RWKLQJ��7KH�ILQDO�LWHP�SURYLGHG�LV�D�VFUROOEDU�VLWXDWHG�WR�WKH�OHIW�RI�WKH�WH[W�ER[��:KHQ�\RX�XVH�WKLV�VFUROO�EDU����RU�WKH�RQHV�WKH�WH[W�ER[�SURYLGHV����PHVVDJHV�SHUWDLQLQJ�WR�WKH�VFUROOEDU�DUH�GLVSOD\HG��6FUROOEDU�PHVVDJHV�DUH�VHQW�WR�WKH�ILOWHU�IXQFWLRQ�ZLWK�D�FRGH�RI�06*)B6&52//%$5��/HWV�H[DPLQH�WKH�FRGH�IRU�WKLV�DSSOLFDWLRQ�E\�VWDUWLQJ�ZLWK�WKH�0RGXOH��EDV�PRGXOH��7KH�FRGH�LQ�WKLV�PRGXOH�VWDUWV�ZLWK�WKH�GHFODUDWLRQ�RI�D�SULYDWH�PHPEHU�YDULDEOH��K+RRN��WKDW�VWRUHV�WKH�KDQGOH�RI�WKH�:+B06*),/7(5�KRRN��DQG�RI�D�SXEOLF�PHPEHU�YDULDEOH��,V+RRNHG��D�%RROHDQ�IODJ�LQGLFDWLQJ�ZKHWKHU�WKH�KRRN�KDV�EHHQ�LQVWDOOHG��7KH�IROORZLQJ�FRGH�GHFODUHV�WKHVH�WZR�YDULDEOHV��3ULYDWH�K+RRN�$V�/RQJ�3XEOLF�,V+RRNHG�$V�%RROHDQ�

Page 395: Visual Basic - Subclassing and Hooking with VB & VB NET

1H[W��DV�([DPSOH������VKRZV��WKH�6HW:LQGRZV+RRN([�IXQFWLRQ�LQVWDOOV�WKH�:+B06*),/7(5�KRRN�DQG�VHWV�WKH�,V+RRNHG�IODJ�WR�7UXH�WR�LQGLFDWH�WKDW�WKH�KRRN�LV�LQVWDOOHG��

([DPSOH�������,QVWDOOLQJ�WKH�:+B06*),/7(5�+RRN��

3XEOLF�6XE�6HW0HVVDJH+RRN���������,I�,V+RRNHG�7KHQ���������0VJ%R[��'RQW�LQVWDOO�WKH�KRRN�WZLFH�RU�\RX�ZLOO�EH�XQDEOH�WR�XQKRRN�LW�������(OVH���������K+RRN� �6HW:LQGRZV+RRN([�:+B06*),/7(5��$GGUHVV2I�0HVVDJH3URF�����$SS�7KUHDG,'����������,V+RRNHG� �7UXH�����(QG�,I�(QG�6XE�7KH�5HPRYH0HVVDJH+RRN�IXQFWLRQ��ZKLFK�([DPSOH������LOOXVWUDWHV��UHPRYHV�WKH�:+B06*),/7(5�KRRN��

([DPSOH�������5HPRYLQJ�WKH�:+B06*),/7(5�+RRN��

3XEOLF�6XE�5HPRYH0HVVDJH+RRN���������'LP�WHPS�$V�/RQJ�����WHPS� �8QKRRN:LQGRZV+RRN([�K+RRN������,V+RRNHG� �)DOVH�(QG�6XE�7KH�0HVVDJH3URF�IXQFWLRQ��ZKLFK�([DPSOH������VKRZV��DFWV�DV�WKH�ILOWHU�IXQFWLRQ�IRU�WKH�:+B06*),/7(5�KRRN��

([DPSOH�������7KH�:+B06*),/7(5�+RRNV�)LOWHU�)XQFWLRQ��

3XEOLF�)XQFWLRQ�0HVVDJH3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B�����������������������������O3DUDP�$V�06*��$V�/RQJ�����6HOHFW�&DVH�X&RGH���������&DVH�06*)B',$/2*%2;�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���06*)B',$/2*%2;�06*����B��������������������������������+H[��O3DUDP�PHVVDJH���B������������������+:1'����+H[��O3DUDP�KZQG���B������������������:3$5$0����+H[��O3DUDP�Z3DUDP���B������������������/3$5$0����+H[��O3DUDP�O3DUDP���YE1HZ/LQH���������&DVH�06*)B0(18�

Page 396: Visual Basic - Subclassing and Hooking with VB & VB NET

������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���06*)B0(18�06*����B��������������������������������+H[��O3DUDP�PHVVDJH���B������������������+:1'����+H[��O3DUDP�KZQG���B������������������:3$5$0����+H[��O3DUDP�Z3DUDP���B������������������/3$5$0����+H[��O3DUDP�O3DUDP���YE1HZ/LQH���������&DVH�06*)B6&52//%$5�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���06*)B6&52//%$5�06*����B��������������������������������+H[��O3DUDP�PHVVDJH���B������������������+:1'����+H[��O3DUDP�KZQG���B������������������:3$5$0����+H[��O3DUDP�Z3DUDP���B������������������/3$5$0����+H[��O3DUDP�O3DUDP���YE1HZ/LQH���������&DVH�06*)B''(0*5�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���06*)B''(0*5�06*����B��������������������������������+H[��O3DUDP�PHVVDJH���B������������������+:1'����+H[��O3DUDP�KZQG���B������������������:3$5$0����+H[��O3DUDP�Z3DUDP���B������������������/3$5$0����+H[��O3DUDP�O3DUDP���YE1HZ/LQH���������&DVH�(OVH�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���(/6(�����X&RGH�����(QG�6HOHFW��������������'R(YHQWV�����0HVVDJH3URF� �&DOO1H[W+RRN([�K+RRN��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KLV�ILOWHU�IXQFWLRQ�VLPSO\�GLVSOD\V�WKH�PHVVDJHV�WKDW�DUH�IXQQHOHG�WKURXJK�LW�DQG�FDWHJRUL]HV�WKHP�E\�WKH�X&RGH�SDUDPHWHU��7KH�'R(YHQWV�IXQFWLRQ�LV�FDOOHG�WR�JLYH�WKH�WH[W�ER[�WLPH�WR�GLVSOD\�WKH�OLQH�RI�WH[W�EHIRUH�SURFHHGLQJ��<RX�PXVW�LQFOXGH�'R(YHQWV�LI�\RX�FKDQJH�WKH�ODVW�OLQH�RI�FRGH�LQ�WKH�IXQFWLRQ�IURP�WKLV��0HVVDJH3URF� �&DOO1H[W+RRN([�K+RRN��X&RGH��Z3DUDP��O3DUDP��WR�WKLV��0HVVDJH3URF� ���$IWHU�PDNLQJ�WKLV�FKDQJH��FRPSLOH�DQG�UXQ�WKH�DSSOLFDWLRQ��'R�QRW�UXQ�WKLV�DSSOLFDWLRQ�LQ�WKLV�VWDWH�LQVLGH�WKH�,'(�EHFDXVH�\RX�PLJKW�KDYH�WR�VKXW�GRZQ�WKH�,'(�DORQJ�ZLWK�WKH�DSSOLFDWLRQ�LI�LW�ORFNV�XS��1RWH�WKDW�LQ�VRPH�FDVHV�\RX�PLJKW�KDYH�WR�WHUPLQDWH�WKH�SURFHVV�PDQXDOO\�WKURXJK�WKH�7DVN�0DQDJHU��$IWHU�UXQQLQJ�WKH�DSSOLFDWLRQ��FOLFN�WKH�KRRN�EXWWRQ�IRU�WKH�:+B06*),/7(5�KRRN�DQG�WKHQ�WU\�WR�XVH�WKH�SURYLGHG�PHQX��VFUROOEDU��RU�PHVVDJH�ER[�EXWWRQ��$V�\RX�FDQ�VHH��DIWHU�WKH�PRGDO�ORRS�LV�VWDUWHG�IRU�DQ\�RI�WKHVH�LWHPV��WKH�DSSOLFDWLRQ�VWD\V�LQ�WKH�PRGDO�ORRS�XQWLO�LW�LV�PDQXDOO\�IRUFHG�WR�H[LW�LW��7KLV�FKDQJH�FDXVHV�DOO�PHVVDJHV�WKDW�SDVV�WKURXJK�WKLV�ILOWHU�IXQFWLRQ�WR�EH�GLVFDUGHG��,I�WKLV�ILOWHU�IXQFWLRQ�UHWXUQV�D�QRQ]HUR��WKH�PHVVDJH�ZLOO�EH�GLVFDUGHG��%H�YHU\�FDUHIXO�ZKHQ�

Page 397: Visual Basic - Subclassing and Hooking with VB & VB NET

GLVFDUGLQJ�D�PHVVDJH�LQ�WKLV�ILOWHU�IXQFWLRQ��,I�WKH�PHVVDJHV�WKDW�FDXVH�D�PRGDO�ORRS�WR�HQG�DUH�GLVFDUGHG��WKH�DSSOLFDWLRQ�FDQQRW�H[LW�WKH�PRGDO�ORRS��DQG�\RXU�DSSOLFDWLRQ�ZLOO�EH�VWXFN�LQVLGH�WKH�ORRS��1RWH�WKDW�VZLWFKLQJ�WR�D�GLIIHUHQW�DSSOLFDWLRQ�DQG�WKHQ�VZLWFKLQJ�EDFN�WR�WKH�RULJLQDO�VWDOOHG�DSSOLFDWLRQ�ZLOO�XVXDOO\�IRUFH�WKH�PRGDO�ORRS�WR�EH�H[LWHG��7KH�RQH�LQVWDQFH�ZKHUH�WKLV�GRHV�QRW�KROG�WUXH�LV�ZKHQ�D�PHVVDJH�ER[�LV�GLVSOD\HG��([DPSOH������VKRZV�WKH�FRGH�LQ�WKH�)RUP��IUP�PRGXOH��7KH�&RPPDQG��EXWWRQ�FOHDUV�WKH�WH[W�ER[�RI�DOO�LQIRUPDWLRQ�DQG�FDOOV�6HW0HVVDJH+RRN�WR�LQVWDOO�WKH�KRRN��7KH�&RPPDQG��EXWWRQ�VLPSO\�FDOOV�5HPRYH0HVVDJH+RRN�WR�UHPRYH�WKH�LQVWDOOHG�KRRN��7KH�FPG0HVVDJH�EXWWRQ�GLVSOD\V�D�PHVVDJH�ER[�VR�WKDW�\RX�FDQ�WHVW�WKH�HIIHFWV�RI�WKLV�KRRN�ZLWK�D�PHVVDJH�ER[��)LQDOO\��WKH�)RUPB4XHU\8QORDG�HYHQW�SURFHGXUH�WHVWV�WKH�,V+RRNHG�IODJ�WR�GHWHUPLQH�LI�WKH�KRRN�LV�VWLOO�LQVWDOOHG��,I�VR��D�PHVVDJH�ER[�LV�GLVSOD\HG�LQIRUPLQJ�WKH�XVHU�WR�FOLFN�WKH�XQKRRN�EXWWRQ�EHIRUH�VKXWWLQJ�GRZQ�WKH�DSSOLFDWLRQ��,I�WKH�SURFHGXUH�GLG�QRW�SHUIRUP�WKLV�WHVW�DQG�\RX�VKXW�GRZQ�WKH�DSSOLFDWLRQ�ZLWK�WKH�KRRN�VWLOO�LQVWDOOHG��D�*HQHUDO�3URWHFWLRQ�)DXOW��*3)��ZRXOG�UHVXOW��

([DPSOH�������&RGH�IRU�WKH�)RUP��IUP�0RGXOH��

2SWLRQ�([SOLFLW��3ULYDWH�6XE�&RPPDQG�B&OLFN���������7H[W��7H[W� ��������&DOO�6HW0HVVDJH+RRN�(QG�6XE��3ULYDWH�6XE�&RPPDQG�B&OLFN���������&DOO�5HPRYH0HVVDJH+RRN�(QG�6XE��3ULYDWH�6XE�FPG0HVVDJHB&OLFN���������0VJ%R[��0HVVDJH�)LOWHU�+RRN�7HVW��(QG�6XE���������������&/($183�������������3ULYDWH�6XE�)RUPB4XHU\8QORDG�&DQFHO�$V�,QWHJHU��8QORDG0RGH�$V�,QWHJHU������,I�,V+RRNHG�7KHQ���������&DQFHO� �����������0VJ%R[��8QKRRN�EHIRUH�FORVLQJ�RU�WKH�,'(�ZLOO�FUDVK���

Page 398: Visual Basic - Subclassing and Hooking with VB & VB NET

����(QG�,I�(QG�6XE�

�����&DYHDWV�

<RX�VKRXOG�UHPHPEHU�WKDW�WKLV�KRRN�LQWHUFHSWV�VHQW�PHVVDJHV�RQO\��'XULQJ�WKH�PRGDO�ORRS��QR�PHVVDJHV�FDQ�EH�SRVWHG�WR�WKH�WKUHDGV�PHVVDJH�TXHXH��6RPH�DGGLWLRQDO�06*)B�PHVVDJHV�DUH�GHILQHG�LQ�:LQXVHU�K��EXW�WKLV�KRRN�GRHV�QRW�FXUUHQWO\�LPSOHPHQW�WKHP��7KHVH�PHVVDJHV�DUH�OLVWHG�KHUH��3XEOLF�&RQVW�06*)B0$,1/223� ��������1RW�XVHG�ZLWK�0VJ)LOWHU�+RRN�3XEOLF�&RQVW�06*)B0$;� �������������1RW�XVHG�ZLWK�0VJ)LOWHU�+RRN�3XEOLF�&RQVW�06*)B0(66$*(%2;� ������1RW�XVHG�ZLWK�0VJ)LOWHU�+RRN�3XEOLF�&RQVW�06*)B029(� ������������1RW�XVHG�ZLWK�0VJ)LOWHU�+RRN�3XEOLF�&RQVW�06*)B6,=(� ������������1RW�XVHG�ZLWK�0VJ)LOWHU�+RRN�3XEOLF�&RQVW�06*)B86(5� ������������1RW�XVHG�ZLWK�0VJ)LOWHU�+RRN�3XEOLF�&RQVW�06*)B1(;7:,1'2:� ������1RW�XVHG�ZLWK�0VJ)LOWHU�+RRN�(YHQ�WKRXJK�WKLV�KRRN�LQWHUFHSWV�D�VXEVHW�RI�WKH�PHVVDJHV�WKDW�KRRNV�VXFK�DV�:+B&$//:1'352&�RU�:+B&$//:1'352&5(7�LQWHUFHSW��\RX�VKRXOG�VWLOO�ZDWFK�KRZ�WKLV�KRRN�DIIHFWV�\RXU�DSSOLFDWLRQV�SHUIRUPDQFH��

Page 399: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU�����:+B6<606*),/7(5�7KH�:+B6<606*),/7(5�KRRN�LV�D�FORVH�UHODWLYH�RI�WKH�:+B06*),/7(5�KRRN��DV�,�PHQWLRQHG�LQ�&KDSWHU�����7KHVH�KRRNV�DUH�YHU\�VLPLODU�LQ�DSSHDUDQFH��EXW�DV�\RX�ZLOO�VHH��WKH\�HDFK�KDYH�WKHLU�RZQ�SHFXOLDULWLHV��,Q�WKLV�FKDSWHU�,�ZLOO�FRPSDUH�DQG�FRQWUDVW�WKHVH�WZR�KRRNV�DQG�SUHVHQW�DQ�H[DPSOH�XVLQJ�WKH�:+B6<606*),/7(5�KRRN���

�����'HVFULSWLRQ�

%RWK�WKH�:+B6<606*),/7(5�DQG�WKH�:+B06*),/7(5�KRRNV�DOORZ�\RX�WR�PRQLWRU�RU�GLVFDUG�PHVVDJHV�GHDOLQJ�ZLWK�PHQXV��PRGDO�GLDORJ�ER[HV��PHVVDJH�ER[HV��DQG�VFUROOEDUV��7KHVH�PHVVDJHV�DUH�LQWHUFHSWHG�EHIRUH�WKH�ZLQGRZ�SURFHGXUH�RU�DQ\�VXEFODVV�SURFHGXUH�SURFHVVHV�WKHP��$V�PHQWLRQHG�LQ�&KDSWHU�����WKH�:+B6<606*),/7(5�KRRN�LQWHUFHSWV�PHVVDJHV�RQO\�EHORQJLQJ�WR�WKLV�VHW�RI�LWHPV�EHFDXVH�WKH\�DOO�RSHUDWH�ZLWKLQ�D�PRGDO�ORRS��6HH�&KDSWHU����IRU�PRUH�LQIRUPDWLRQ�DERXW�WKH�PRGDO�ORRS�DQG�KRZ�LW�RSHUDWHV���<RX�FDQQRW�XVH�WKLV�KRRN�DV�D�WKUHDG�VSHFLILF�KRRN��\RX�PXVW�SODFH�LW�LQ�D�G\QDPLF�OLQN�OLEUDU\��'//��DQG�XVH�LW�DV�D�V\VWHP�ZLGH�KRRN��:KHQ�\RX�LQVWDOO�D�KRRN�DV�D�V\VWHP�ZLGH�KRRN��\RX�PXVW�SODFH�LW�LQ�D�'//��7KLV�'//�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�VR�WKDW�WKH�KRRN�FDQ�RSHUDWH�RQ�DOO�PHVVDJHV�LQ�WKH�V\VWHP��&KDSWHU���GLVFXVVHV�WKLV�LQ�GHWDLO���$�ELJ�GLIIHUHQFH�EHWZHHQ�WKH�:+B6<606*),/7(5�KRRN�DQG�WKH�:+B06*),/7(5�KRRN�LV�WKDW�\RX�FDQ�XVH�WKH�:+B6<606*),/7(5�KRRN�RQO\�DV�D�V\VWHP�ZLGH�KRRN��ZKHUHDV�\RX�FDQ�XVH�WKH�:+B06*),/7(5�KRRN�DV�ERWK�D�V\VWHP�ZLGH�DQG�D�WKUHDG�VSHFLILF�KRRN���7DEOH������FRPSDUHV�WKH�:+B6<606*),/7(5�DQG�:+B06*),/7(5�KRRNV��/RRNLQJ�DW�WKLV�WDEOH��ZH�FDQ�GHWHUPLQH�WKDW�WKH�:+B6<606*),/7(5�KRRN�HVVHQWLDOO\�FRQWDLQV�D�VXEVHW�RI�WKH�IXQFWLRQDOLW\�RI�WKH�:+B06*),/7(5�KRRN��+RZHYHU��QRWH�WKH�RUGHU�LQ�ZKLFK�WKH�V\VWHP�FDOOV�WKHVH�WZR�KRRNV��:+B6<606*),/7(5�KRRNV�DUH�DOZD\V�FDOOHG�EHIRUH�:+B06*),/7(5�KRRNV��7KH�WKLQJ�WR�UHPHPEHU�KHUH�LV�WKDW�LI�DQ\�RI�WKH�:+B6<606*),/7(5�KRRNV�UHWXUQV�D�]HUR��758(���QRQH�RI�WKH�:+B06*),/7(5�KRRNV�LV�FDOOHG���

7DEOH�������$�&RPSDULVRQ�RI�WKH�:+B6<606*),/7(5�DQG�:+B06*),/7(5�+RRNV��:+B6<606*),/7(5� :+B06*),/7(5�

0RQLWRUV�DQG�GLVFDUGV�PHVVDJHV� 0RQLWRUV�DQG�GLVFDUGV�PHVVDJHV�,QWHUFHSWV�PHQX�PHVVDJHV� ,QWHUFHSWV�PHQX�PHVVDJHV�,QWHUFHSWV�PRGDO�GLDORJ�ER[�PHVVDJHV� ,QWHUFHSWV�PRGDO�GLDORJ�ER[�PHVVDJHV�

Page 400: Visual Basic - Subclassing and Hooking with VB & VB NET

,QWHUFHSWV�PHVVDJH�ER[�PHVVDJHV� ,QWHUFHSWV�PHVVDJH�ER[�PHVVDJHV�,QWHUFHSWV�VFUROOEDU�PHVVDJHV� ,QWHUFHSWV�VFUROOEDU�PHVVDJHV�'RHV�QRW�LQWHUFHSW�'\QDPLF�'DWD�([FKDQJH�0DQDJHPHQW�/LEUDU\��''(0/��PHVVDJHV��

,QWHUFHSWV�''(0/�PHVVDJHV�ZKLOH�LQ�D�V\QFKURQRXV�WUDQVDFWLRQ�

8VHG�RQO\�DV�D�V\VWHP�ZLGH�KRRN� &DQ�EH�XVHG�DV�ERWK�DV�V\VWHP�ZLGH�DQG�D�WKUHDG�VSHFLILF�KRRN�

$YDLODEOH�KRRN�FRGHV��06*)B',$/2*%2;��06*)B6&52//%$5��DQG�06*)B0(18��

$YDLODEOH�KRRN�FRGHV��06*)B''(0/��06*)B',$/2*%2;��06*)B6&52//%$5��DQG�06*)B0(18��

7KH�Z3DUDP�LV�QRW�XVHG� 7KH�Z3DUDP�LV�QRW�XVHG�7KH�O3DUDP�FRQWDLQV�D�SRLQWHU�WR�DQ�06*�VWUXFWXUH��

7KH�O3DUDP�FRQWDLQV�D�SRLQWHU�WR�DQ�06*�VWUXFWXUH��

,QWHUFHSWV�PHVVDJHV�EHIRUH�WKH\�DUH�SURFHVVHG� ,QWHUFHSWV�PHVVDJHV�EHIRUH�WKH\�DUH�SURFHVVHG�

�������)LOWHU�)XQFWLRQ�'HILQLWLRQ�

7KH�ILOWHU�IXQFWLRQ�SURWRW\SH�IRU�WKH�:+B6<606*),/7(5�KRRN�LV���/5(68/7�&$//%$&.�6\V0VJ3URF��LQW�Q&RGH��:3$5$0�Z3DUDP��/3$5$0�O3DUDP���,WV�SDUDPHWHUV�DUH��X&RGH

7KH�FRGH�WKH�V\VWHP�VHQGV�WR�WKLV�ILOWHU�IXQFWLRQ���Z3DUDP

7KLV�SDUDPHWHU�LV�QRW�XVHG��O3DUDP

$�SRLQWHU�WR�DQ�06*�VWUXFWXUH���,YH�SUHVHQWHG�WKLV�IXQFWLRQ�SURWRW\SH�LQ�&���EHFDXVH�WKH�ILOWHU�IXQFWLRQ�FDQ�UHVLGH�RQO\�LQ�D�:LQ���'//��<RX�FDQQRW�FUHDWH�D�:LQ���'//�XVLQJ�9LVXDO�%DVLF��9%���,I�\RX�WUDQVODWHG�WKLV�IXQFWLRQ�SURWRW\SH�LQWR�9%�FRGH��LW�ZRXOG�ORRN�OLNH�WKLV���3XEOLF�)XQFWLRQ�6\V0VJ3URF��%\9DO�X&RGH�$V�/RQJ��B�� � � � ���%\9DO�Z3DUDP�$V�/RQJ��B�� � � � ���%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�7KH�UHWXUQ�YDOXH�IRU�WKLV�ILOWHU�IXQFWLRQ�VKRXOG�EH�WKH�UHWXUQ�YDOXH�RI�WKH�&DOO1H[W+RRN([�IXQFWLRQ��,I�WKLV�IXQFWLRQ�LV�QRW�FDOOHG��WKH�ILOWHU�IXQFWLRQ�VKRXOG�UHWXUQ�D�]HUR��,�GR�QRW�UHFRPPHQG�VNLSSLQJ�WKH�FDOO�WR�&DOO1H[W+RRN([��WKRXJK��)DLOLQJ�WR�FDOO�WKLV�IXQFWLRQ�ZLOO�IRUFH�RWKHU�ILOWHU�IXQFWLRQV�LQ�WKH�FKDLQ�WR�QRW�EH�FDOOHG���

�������([SODQDWLRQ�RI�+RRN�&RGHV�

Page 401: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�X&RGH�SDUDPHWHU�RI�WKH�ILOWHU�IXQFWLRQ�ZLOO�UHFHLYH�D�KRRN�FRGH��7KH�IROORZLQJ�WKUHH�FRGHV�FDQ�EH�VHQW�WR�WKLV�ILOWHU�IXQFWLRQ���MSGF_DIALOGBOX

$Q�LQSXW�HYHQW����VXFK�DV�D�PRXVH�RU�NH\ERDUG�PHVVDJH����KDV�EHHQ�VHQW�WR�D�PHVVDJH�ER[�RU�D�GLDORJ�ER[��)RU�WKH�VLPLODULWLHV�DQG�GLIIHUHQFHV�EHWZHHQ�ZLQGRZV��PHVVDJH�ER[HV��DQG�GLDORJ�ER[HV��VHH�&KDSWHU����7KH�FRQVWDQW�LV�GHILQHG�DV�IROORZV���3XEOLF�&RQVW�06*)B',$/2*%2;� ���

MSGF_SCROLLBAR

$Q�LQSXW�HYHQW�RFFXUUHG�LQ�D�VFUROOEDU��7KH�FRQVWDQW�LV�GHFODUHG�DV�IROORZV���3XEOLF�&RQVW�06*)B6&52//%$5� ���

MSGF_MENU

$Q�LQSXW�HYHQW�RFFXUUHG�LQ�D�PHQX��7KH�FRQVWDQW�LV�GHILQHG�DV�IROORZV��3XEOLF�&RQVW�06*)B0(18� ���

,I�QRQH�RI�WKHVH�FRGHV�LV�SDVVHG�LQ��\RX�VKRXOG�VNLS�WKH�PHVVDJH�SURFHVVLQJ�DQG�FDOO�&DOO1H[W+RRN([�LPPHGLDWHO\���

�������/RFDWLRQ�RI�7KLV�+RRN�LQ�WKH�6\VWHP�

7KH�ILOWHU�IXQFWLRQ�IRU�WKLV�KRRN�LV�FDOOHG�IURP�ZLWKLQ�WKH�PHVVDJH�ORRS�RI�DOO�UXQQLQJ�WKUHDGV��DV�)LJXUH������VKRZV��7KH�KRRN�LV�FDOOHG�EHIRUH�WKH�PHVVDJH�LV�SDVVHG�RQ�WR�WKH�ZLQGRZ�SURFHGXUH�RU�WR�DQ\�VXEFODVV�SURFHGXUH�WKDW�KDV�EHHQ�LQVWDOOHG���

)LJXUH�������7KH�ORFDWLRQ�RI�WKH�:+B6<606*),/7(5�KRRN�LQ�WKH�PHVVDJLQJ�V\VWHP�

Page 402: Visual Basic - Subclassing and Hooking with VB & VB NET

�����$�6\VWHP�:LGH�([DPSOH�

7KLV�H[DPSOH�VKRZV�KRZ�WR�VHW�XS�DQG�LQVWDOO�D�V\VWHP�ZLGH�:+B6<606*),/7(5�KRRN��<RX�PXVW�SODFH�WKH�ILOWHU�IXQFWLRQ�DQG�WKH�IXQFWLRQV�WKDW�LQVWDOO�DQG�UHPRYH�WKH�KRRN�LQ�D�:LQ���'//��)LUVW�,�ZLOO�VKRZ�\RX�WKH�FRGH�FRQWDLQHG�LQ�WKH�9%�(;(�WKDW�ORDGV�DQG�XVHV�WKH�'//��)LJXUH������VKRZV�D�VFUHHQVKRW�RI�WKH�9%�DSSOLFDWLRQ���

)LJXUH�������6FUHHQVKRW�RI�WKH�9%�(;(�

7DEOH������SUHVHQWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��

2EMHFW� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�)RUP� %RUGHU6W\OH� ��)L[HG�'LDORJ�)RUP� &DSWLRQ� �1R�+RRNV�,QVWDOOHG��

Page 403: Visual Basic - Subclassing and Hooking with VB & VB NET

)RUP� 7RS� ����)RUP� /HIW� ���)RUP� +HLJKW� �����)RUP� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH� FPG+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �6<606*),/7(5��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� �����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH� FPG8QKRRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �81+22.��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� �����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����7KH�DSSOLFDWLRQ�FRQWDLQV�D�6<606*),/7(5�EXWWRQ�WKDW�LQVWDOOV�WKH�V\VWHP�ZLGH�KRRN�DQG�DQ�81+22.�EXWWRQ�WKDW�UHPRYHV�WKH�KRRN��7KH�9%�FRGH�WKDW�([DPSOH������LOOXVWUDWHV�LV�SODFHG�EHKLQG�HDFK�EXWWRQ�LQ�WKH�6\V)RUP��IUP�PRGXOH���

([DPSOH�������(YHQW�3URFHGXUHV�IRU�WKH�FPG+RRN�DQG�FPG8QKRRN�%XWWRQV��

3ULYDWH�6XE�FPG+RRNB&OLFN���������&DOO�,QVWDOO�(QG�6XE��3ULYDWH�6XE�FPG8QKRRNB&OLFN���������&DOO�8Q,QVWDOO�(QG�6XE�([DPSOH������VKRZV�WKH�FRGH�EHKLQG�WKH�6\V0RGXOH��EDV�PRGXOH��7KH�FRGH�LQFOXGHV�WKH�GHFODUDWLRQV�RI�WZR�H[WHUQDO�IXQFWLRQV��,QVWDOO)LOWHU'//�DQG�8Q,QVWDOO)LOWHU'//��WKDW�DUH�ORFDWHG�LQ�WKH�:LQ���0DLQ+RRN�'OO�PRGXOH�DQG�WKDW�DUH�WR�EH�FDOOHG�IURP�9%�FRGH��7KH�WZR�RWKHU�IXQFWLRQV��,QVWDOO�DQG�8Q,QVWDOO��FDOO�WKH�WZR�IXQFWLRQV�WKDW�WKH�'//�GHILQHV��([DPSOH������DQG�([DPSOH������OLVW�DOO�WKH�FRGH�WKDW�WKH�(;(�FRQWDLQV���

([DPSOH�������7KH�6\V0RGXOH��EDV�0RGXOH��

Page 404: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�'HFODUH�)XQFWLRQ�,QVWDOO)LOWHU'//�/LE���?0DLQ+RRN?'HEXJ?0DLQ+RRN�'OO�������B����������������������$V�/RQJ�3XEOLF�'HFODUH�)XQFWLRQ�8Q,QVWDOO)LOWHU'//�/LE���?0DLQ+RRN?'HEXJ?0DLQ+RRN�'OO�������B����������������������$V�/RQJ������3XEOLF�6XE�,QVWDOO���������'LP�O5HW9DO�$V�/RQJ�����������O5HW9DO� �,QVWDOO���������������,I�O5HW9DO��!���7KHQ���������6\V)RUP��&DSWLRQ� ��:+B6<606*+22.�+RRN�,QVWDOOHG�����+H[��O5HW9DO������(OVH���������6\V)RUP��&DSWLRQ� ��(UURU�,QVWDOOLQJ�+RRN�����+H[��O5HW9DO������(QG�,I�(QG�6XE��3XEOLF�6XE�8Q,QVWDOO����������'LP�O5HW9DO�$V�/RQJ����������O5HW9DO� �8Q,QVWDOO)LOWHU'//����������0VJ%R[�O5HW9DO����������,I�O5HW9DO� ���7KHQ���������6\V)RUP��&DSWLRQ� ��1R�+RRNV�,QVWDOOHG������(QG�,I�(QG�6XE�7KH�'//�FRQWDLQV�WZR�H[SRUWHG�IXQFWLRQV��,QVWDOO)LOWHU'//�DQG�8Q,QVWDOO)LOWHU'//��DV�ZHOO�DV�WKH�ILOWHU�IXQFWLRQ�6\V0VJ3URF��([DPSOH������VKRZV�WKH�FRGH�DGGHG�WR�WKH�0DLQ+RRN�K�KHDGHU�ILOH��7KH�ILUVW�OLQH�GHILQHV�WKH�6\V0VJ3URF�ILOWHU�IXQFWLRQ�DV�W\SH�&$//%$&.��7KH�UHVW�RI�WKH�FRGH�GHILQHV�WKH�WZR�H[SRUWHG�IXQFWLRQV�DV�0$,1+22.B$3,��0$,1+22.B$3,�LV��LQ�WXUQ��GHILQHG�DV�B�BGHFGOVSHF�GOOH[SRUW����

([DPSOH�������7KH�0DLQ+RRN�K�+HDGHU�)LOH��

���)XQFWLRQ�GHFODUDWLRQV�/5(68/7�&$//%$&.�6\V0VJ3URF��LQW�Q&RGH��:3$5$0�Z3DUDP��/3$5$0�O3DUDP��������([SRUWHG�FODVVHV�IURP�WKH�0DLQ+RRN�GOO�

Page 405: Visual Basic - Subclassing and Hooking with VB & VB NET

�LIGHI�B��BFSOXVSOXV�� H[WHUQ��&��^��HQGLI���GHILQH�0$,1+22.B$3,�B��BGHFOVSHF�GOOH[SRUW��0$,1+22.B$3,�LQW�,QVWDOO)LOWHU'//�YRLG���0$,1+22.B$3,�LQW�8Q,QVWDOO)LOWHU'//�YRLG����LIGHI�B��BFSOXVSOXV�`��HQGLI�([DPSOH������VKRZV�WKH�0DLQ+RRN�FSS�ILOH��)LUVW��WKH�FRGH�GHILQHV�WZR�JOREDO�YDULDEOHV��K,QVWDQFH�DQG�K+RRN��7KH�K,QVWDQFH�YDULDEOH�KROGV�WKH�PRGXOH�KDQGOH�WKDW�LV�SDVVHG�LQ�WR�'OO0DLQ��WKH�'//V�HQWU\�SRLQW��7KH�6HW:LQGRZV+RRN([�IXQFWLRQ�XVHV�WKLV�YDULDEOH�WR�LQVWDOO�WKLV�KRRN�DV�D�V\VWHP�ZLGH�KRRN��7KH�K+RRN�YDULDEOH�FRQWDLQV�WKH�KDQGOH�WR�WKH�LQVWDOOHG�KRRN��7KH�6HW:LQGRZV+RRN([�IXQFWLRQ�UHWXUQV�WKLV�KDQGOH�DQG�LW�LV�XVHG�WKURXJKRXW�WKH�FRGH��1H[W��WKH�VKDUHG�GDWD�VHFWLRQ�LV�LQFOXGHG�LQ�FDVH�DQ\�GDWD�QHHGV�WR�EH�VKDUHG�EHWZHHQ�DOO�LQVWDQFHV�RI�WKH�'//��LQ�RXU�H[DPSOH��KRZHYHU��WKHUH�LV�QR�VKDUHG�GDWD��)ROORZLQJ�WKH�VKDUHG�GDWD�VHFWLRQ�LV�WKH�VRXUFH�FRGH�IRU�'OO0DLQ��WKH�HQWU\�SRLQW�WR�WKLV�'//���

([DPSOH�������7KH�0DLQ+RRN�FSS�6RXUFH�)LOH��

�LQFOXGH��VWGDI[�K���LQFOXGH��0DLQ+RRN�K���LQFOXGH��:,186(5�+�������FRQWDLQV�DOO�WKHVH�FRQVWDQWV��VWUXFWV��HWF�������������������������������������*OREDO�9DULDEOHV�����������������������������+$1'/(� K,QVWDQFH�� � � � ���*OREDO�LQVWDQFH�KDQGOH�IRU� '//�++22.� K+RRN�� � � � � ���+RRN�KDQGOH��������������������������������6KDUHG�'$7$������������������������������SUDJPD�GDWDBVHJ��6+$5'$7$����SUDJPD�GDWDBVHJ������������������������������������'//�&RGH�����������������������������%22/�$3,(175<�'OO0DLQ��+$1'/(�K0RGXOH���

Page 406: Visual Basic - Subclassing and Hooking with VB & VB NET

�����������������������':25'��XOBUHDVRQBIRUBFDOO��������������������������/392,'�OS5HVHUYHG�� � � � � ���^�� K,QVWDQFH� �K0RGXOH���� VZLWFK��XOBUHDVRQBIRUBFDOO��� ^�� � FDVH�'//B352&(66B$77$&+��� � FDVH�'//B7+5($'B$77$&+��� � FDVH�'//B7+5($'B'(7$&+��� � FDVH�'//B352&(66B'(7$&+��� � � EUHDN������`�����UHWXUQ�758(��`��������������������������������������7KLV�LV�DQ�H[SRUWHG�IXQFWLRQ������XVHG�WR�LQVWDOO�WKH�KRRN������������������������������������0$,1+22.B$3,�LQW�,QVWDOO)LOWHU'//�����^�� K+RRN� �6HW:LQGRZV+RRN([�:+B6<606*),/7(5���� � � �+22.352&��6\V0VJ3URF���+,167$1&(��K,QVWDQFH�������� UHWXUQ��LQW�K+RRN��`��������������������������������������7KLV�LV�DQ�H[SRUWHG�IXQFWLRQ������XVHG�WR�XQLQVWDOO�WKH�KRRN������������������������������������0$,1+22.B$3,�LQW�8Q,QVWDOO)LOWHU'//�YRLG��^�� UHWXUQ�8QKRRN:LQGRZV+RRN([�K+RRN���`����������������������������������������������������������������������������������)LOWHU�IXQFWLRQ�IRU�WKH�:+B6<606*),/7(5�KRRN�������������������������������������������������������������������������������/5(68/7�&$//%$&.�6\V0VJ3URF��LQW�Q&RGH��:3$5$0�Z3DUDP��/3$5$0�O3DUDP���^�

Page 407: Visual Basic - Subclassing and Hooking with VB & VB NET

� 06*� � OS0VJ��� OS0VJ� ��06*� ��O3DUDP���� VZLWFK��Q&RGH��� ^�� � FDVH�06*)B',$/2*%2;��� � � ���72'2��$GG�FRGH�WR�GHDO�ZLWK�PRGDO�GLDORJ�ER[HV�DQG�PHVVDJH�ER[HV�� � � EUHDN��� � FDVH�06*)B0(18��� � � ���72'2��$GG�FRGH�WR�GHDO�ZLWK�PHQXV�� � � EUHDN��� � FDVH�06*)B6&52//%$5��� � � ���72'2��$GG�FRGH�WR�GHDO�ZLWK�VFUROO�EDUV�� � � EUHDN��� � GHIDXOW��� � � EUHDN��� `��� ��3DVV�PHVVDJHV�RQ�WR�WKH�QH[W�KRRN�LQ�WKH�FKDLQ�� UHWXUQ�&DOO1H[W+RRN([�K+RRN��Q&RGH��Z3DUDP��O3DUDP���`�7KH�H[SRUWHG�IXQFWLRQ�,QVWDOO)LOWHU'//��ZKLFK�LV�ORFDWHG�DIWHU�WKH�'OO0DLQ�IXQFWLRQ��LQVWDOOV�WKH�:+B6<606*),/7(5�KRRN�E\�FDOOLQJ�WKH�6HW:LQGRZV+RRN([�IXQFWLRQ��7R�PRGLI\�WKLV�'//�WR�LQVWDOO�WKH�:+B06*),/7(5�IXQFWLRQ��VLPSO\�UHSODFH�WKH�:+B6<606*),/7(5�FRQVWDQW�ZLWK�WKH�:+B06*),/7(5�FRQVWDQW���7KH�FRQVWDQWV�WKHPVHOYHV�DUH�GHILQHG�LQ�WKH�ZLQXVHU�K�KHDGHU�ILOH��ZKLFK�LV�LQFOXGHG�E\�WKH�WKLUG��LQFOXGH�GLUHFWLYH����7KH�VHFRQG�H[SRUWHG�IXQFWLRQ��8Q,QVWDOO)LOWHU'//��XVHV�WKH�8QKRRN:LQGRZV+RRN([�IXQFWLRQ�WR�UHPRYH�WKH�:+B6<606*),/7(5�KRRN�IURP�WKH�SURFHVV�VSDFH�LQ�ZKLFK�WKH�'//�UHVLGHV���)LQDOO\��WKH�6\V0VJ3URF�IXQFWLRQ�DFWV�DV�WKH�ILOWHU�IXQFWLRQ�IRU�WKLV�KRRN��$�VZLWFK�VWDWHPHQW��HTXLYDOHQW�WR�WKH�9%�6HOHFW�&DVH�VWDWHPHQW��LV�SURYLGHG�WR�GHDO�ZLWK�HDFK�W\SH�RI�FRGH�WKDW�WKLV�KRRN�FDQ�UHWXUQ��<RX�FDQ�DGG�FRGH�WR�HDFK�72'2�VHFWLRQ�WR�GHDO�ZLWK�PRGDO�GLDORJ�ER[HV��PHVVDJH�ER[HV��PHQXV��DQG�VFUROOEDUV��7KH�IXQFWLRQ�HQGV�E\�FDOOLQJ�&DOO1H[W+RRN([�WR�DOORZ�RWKHU�LQVWDOOHG�ILOWHU�IXQFWLRQV�WR�EH�FDOOHG���([DPSOH������VKRZV�WKH�0DLQ+RRN�GHI�ILOH��,WV�(;32576�VHFWLRQ�OLVWV�WKH�'//V�H[SRUWHG�IXQFWLRQV��7KLV�DOORZV�RWKHU�DSSOLFDWLRQV�DQG�OLEUDULHV��LQFOXGLQJ�RXU�9%�DSSOLFDWLRQ��WR�XVH�WKHVH�IXQFWLRQV���

([DPSOH�������7KH�0DLQ+RRN�GHI�)LOH��

Page 408: Visual Basic - Subclassing and Hooking with VB & VB NET

/,%5$5<�0DLQ+RRN��(;32576�� ,QVWDOO)LOWHU'//� #��� 8Q,QVWDOO)LOWHU'//� #��

�����&DYHDWV�

7KLV�KRRNV�PRVW�RXWVWDQGLQJ�IHDWXUH�LV�WKDW�\RX�FDQ�XVH�LW�RQO\�DV�D�V\VWHP�ZLGH�KRRN��7KLV�PHDQV�WKDW�WKH�ILOWHU�IXQFWLRQ�PXVW�UHVLGH�LQ�D�:LQ���'//��7KLV�'//�LV�LQMHFWHG�LQWR�HYHU\�UXQQLQJ�SURFHVV��7KHUHIRUH��WKLV�KRRN�FDUULHV�ZLWK�LW�D�ELJJHU�SHUIRUPDQFH�SHQDOW\�WKDQ�WKUHDG�VSHFLILF�KRRNV���<RX�VKRXOG�UHPHPEHU�WKDW�WKLV�KRRN�LQWHUFHSWV�VHQW�PHVVDJHV�RQO\��'XULQJ�WKH�PRGDO�ORRS��QR�PHVVDJHV�FDQ�EH�SRVWHG�WR�WKH�WKUHDGV�PHVVDJH�TXHXH���:DWFK�\RXU�UHWXUQ�YDOXHV�EHFDXVH�D�UHWXUQHG�]HUR�ZLOO�SUHYHQW�DQ\�RWKHU�:+B06*),/7(5�KRRN�IURP�RSHUDWLQJ��%HFDXVH�WKLV�KRRN�LV�LQVWDOOHG�RQO\�DV�D�V\VWHP�ZLGH�KRRN��LI�D�]HUR�LV�UHWXUQHG��LW�PHDQV�WKDW�QR�:+B06*),/7(5�KRRNV�ZLOO�EH�FDOOHG�IURP�ZLWKLQ�DQ\�WKUHDG��7KLV�FRXOG�FDXVH�RWKHU�DSSOLFDWLRQV�WKDW�UHO\�RQ�WKHVH�KRRNV�WR�IDLO���6RPH�DGGLWLRQDO�06*)B�PHVVDJHV�DUH�GHILQHG�LQ�:LQXVHU�K��EXW�WKLV�KRRN�FXUUHQWO\�LV�QRW�LPSOHPHQWLQJ�WKHP��7KHVH�PHVVDJHV�DUH���3XEOLF�&RQVW�06*)B0$,1/223� ��������1RW�XVHG�ZLWK�6\V0VJ)LOWHU�+RRN�3XEOLF�&RQVW�06*)B0$;� �������������1RW�XVHG�ZLWK�6\V0VJ)LOWHU�+RRN�3XEOLF�&RQVW�06*)B0(66$*(%2;� ������1RW�XVHG�ZLWK�6\V0VJ)LOWHU�+RRN�3XEOLF�&RQVW�06*)B029(� ������������1RW�XVHG�ZLWK�6\V0VJ)LOWHU�+RRN�3XEOLF�&RQVW�06*)B6,=(� ������������1RW�XVHG�ZLWK�6\V0VJ)LOWHU�+RRN�3XEOLF�&RQVW�06*)B86(5� ������������1RW�XVHG�ZLWK�6\V0VJ)LOWHU�+RRN�3XEOLF�&RQVW�06*)B1(;7:,1'2:� ������1RW�XVHG�ZLWK�6\V0VJ)LOWHU�+RRN�(YHQ�WKRXJK�WKLV�KRRN�LQWHUFHSWV�D�VXEVHW�RI�WKH�PHVVDJHV�WKDW�KRRNV�VXFK�DV�:+B&$//:1'352&�RU�:+B&$//:1'352&5(7�LQWHUFHSW��\RX�VKRXOG�VWLOO�ZDWFK�KRZ�WKLV�KRRN�DIIHFWV�\RXU�DSSOLFDWLRQV�SHUIRUPDQFH���

Page 409: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU�����:+B6+(//�7KLV�FKDSWHU�GHDOV�ZLWK�WKH�:+B6+(//�KRRN��,Q�WKLV�FKDSWHU��,�ZLOO�FRPSDUH�DQG�FRQWUDVW�WKLV�KRRN�ZLWK�:+B&%7��D�VLPLODU�KRRN�WKDW�ZLOO�EH�GLVFXVVHG�LQ�&KDSWHU������

�����'HVFULSWLRQ�

7KH�:+B6+(//�KRRN�LV�D�QRWLILFDWLRQ�KRRN��7KDW�LV��\RX�FDQ�XVH�LW�WR�QRWLI\�DQ�DSSOLFDWLRQ�RI�DFWLRQV�RFFXUULQJ�WR�LW��HLWKHU�WKURXJK�XVHU�LQWHUYHQWLRQ�RU�WKURXJK�D�FKDQJH�LQ�WKH�V\VWHPV�VWDWH��([DPSOHV�RI�XVHU�LQWHUYHQWLRQ�LQFOXGH�D�XVHU�PLQLPL]LQJ�D�ZLQGRZ��SUHVVLQJ�DQ�DSSOLFDWLRQ�FRPPDQG�EXWWRQ�RQ�WKH�PRXVH�RU�NH\ERDUG��RU�HYHQ�DFWLYDWLQJ�D�ZLQGRZ���

�1HZHU�NH\ERDUGV�DQG�PLFH�FDQ�LQFOXGH�H[WUD�DSSOLFDWLRQ�EXWWRQV��7KHVH�H[WUD�EXWWRQV�DOORZ�WKH�XVHU�WR�RSHQ�DSSOLFDWLRQV��FRQWURO�PHGLD�DSSOLFDWLRQV��DQG�RSHQ�DQG�FRQWURO�,QWHUQHW�EURZVHUV��8VLQJ�WKLV�KRRN��DQ�DSSOLFDWLRQ�GHYHORSHU�FDQ�DGG�VXSSRUW�IRU�WKHVH�QHZ�DSSOLFDWLRQ�EXWWRQV�WR�RQH�RU�PRUH�RI�KHU�DSSOLFDWLRQV����

([DPSOHV�RI�D�FKDQJH�LQ�V\VWHP�VWDWH�LQFOXGH�D�FKDQJH�LQ�WKH�NH\ERDUG�ODQJXDJH��D�FKDQJH�LQ�WKH�DFFHVVLELOLW\�VWDWH��RU�WKH�V\VWHP�UHGUDZLQJ�WKH�ZLQGRZ�WLWOH�WH[W�LQ�WKH�WDVN�EDU��7KH�IROORZLQJ�LV�D�FRPSOHWH�OLVW�RI�HYHQWV�IRU�ZKLFK�WKH�:+B6+(//�KRRN�FDQ�SURYLGH�QRWLILFDWLRQ���HSHELL_ACCESSIBILITYSTATE

7KH�DFFHVVLELOLW\�VWDWH�KDV�FKDQJHG��7KLV�LV�D�QRWLILFDWLRQ�IRU�:LQGRZV������DQG�JUHDWHU�RSHUDWLRQ�V\VWHPV���

HSHELL_ACTIVATESHELLWINDOW

7KH�VKHOO�VKRXOG�DFWLYDWH�WKH�QH[W�DSSOLFDWLRQV�PDLQ�ZLQGRZ�LQ�WKH�=�RUGHU�RI�FXUUHQW�ZLQGRZV���

HSHELL_APPCOMMAND

7KH�XVHU�KDV�SUHVVHG�DQ�DSSOLFDWLRQ�FRPPDQG�EXWWRQ�RQ�WKH�PRXVH�RU�RQ�WKH�NH\ERDUG�DQG�WKH�DSSOLFDWLRQ�GLG�QRW�KDQGOH�WKLV�FRPPDQG�

Page 410: Visual Basic - Subclassing and Hooking with VB & VB NET

EXWWRQ�HYHQW��$Q�DSSOLFDWLRQ�FRPPDQG�EXWWRQ�FDQ�HLWKHU�EH�H[WUD�EXWWRQV�DGGHG�WR�D�NH\ERDUG��XVXDOO\�XVHG�WR�FRQWURO�PXOWLPHGLD�GHYLFHV��RU�H[WUD�EXWWRQV�DGGHG�WR�D�PRXVH�EH\RQG�WKH�OHIW��PLGGOH��DQG�ULJKW�EXWWRQV��7KLV�LV�D�QRWLILFDWLRQ�IRU�:LQGRZV������DQG�JUHDWHU�RSHUDWLQJ�V\VWHPV���

HSHELL_GETMINRECT

7KH�XVHU�LV�HLWKHU�PLQLPL]LQJ�RU�PD[LPL]LQJ�WKH�ZLQGRZ�WKDW�LV�KRRNHG���HSHELL_LANGUAGE

7KH�NH\ERDUG�ODQJXDJH�RU�D�QHZ�NH\ERDUG�OD\RXW�ZDV�ORDGHG��HSHELL_REDRAW

7KH�WLWOH�RI�D�ZLQGRZ�LQ�WKH�:LQGRZV�WDVN�EDU��QRW�WKH�WLWOH�LQ�WKH�ZLQGRZ�WLWOH�EDU��KDV�EHHQ�UHGUDZQ���

HSHELL_TASKMAN

7KH�XVHU�KDV�VWDUWHG�WKH�:LQGRZV�WDVN�OLVW���HSHELL_WINDOWACTIVATED

7KH�DFWLYH�ZLQGRZ�KDV�FKDQJHG�IURP�D�GLIIHUHQW�WRS�OHYHO�XQRZQHG�ZLQGRZ����WKH�PDLQ�ZLQGRZ�RI�DQ�DSSOLFDWLRQ��ZKLFK�GRHV�QRW�KDYH�D�KDQGOH�WR�D�SDUHQW�ZLQGRZ����WR�WKH�FXUUHQW�ZLQGRZ��L�H���D�XVHU�KDV�VZLWFKHG�WR�WKH�FXUUHQW�ZLQGRZ�WR�PDNH�LW�WKH�DFWLYH�ZLQGRZ����

HSHELL_WINDOWCREATED

$�WRS�OHYHO�XQRZQHG�ZLQGRZ�KDV�EHHQ�FUHDWHG��7KH�ZLQGRZ�VWLOO�H[LVWV�ZKHQ�WKH�KRRNV�ILOWHU�IXQFWLRQ�UHFHLYHV�WKLV�KRRN�QRWLILFDWLRQ���

HSHELL_WIDNOWDESTROYED

$�WRS�OHYHO�XQRZQHG�ZLQGRZ�LV�DERXW�WR�EH�GHVWUR\HG��7KH�ZLQGRZ�VWLOO�H[LVWV�ZKHQ�WKH�KRRNV�ILOWHU�IXQFWLRQ�UHFHLYHV�WKLV�KRRN�QRWLILFDWLRQ���

7KLV�KRRN�GRHV�QRW�DOORZ�WKH�LQWHUFHSWHG�PHVVDJHV�WR�EH�GLVFDUGHG�RU�PRGLILHG�LQ�DQ\�ZD\��7KHUH�LV�RQH�H[FHSWLRQ�WR�WKLV�UXOH��UHWXUQLQJ�D�758(�IURP�WKH�KRRNV�ILOWHU�IXQFWLRQ�ZKHQ�LW�UHFHLYHV�WKH�+6+(//B7$6.0$1�QRWLILFDWLRQ�ZLOO�SUHYHQW�WKH�WDVN�PDQDJHU�IURP�EHLQJ�GLVSOD\HG���,Q�PRVW�FDVHV��WKH�DFWLRQ�KDV�DOUHDG\�RFFXUUHG�EHIRUH�WKH�:+B6+(//�KRRN�LV�QRWLILHG��7KH�RQO\�WZR�H[FHSWLRQV�DUH�ZKHQ�D�ZLQGRZ�LV�GHVWUR\HG��DQG�ZKHQ�LW�LV�PLQLPL]HG�PD[LPL]HG��'XULQJ�ZLQGRZ�GHVWUXFWLRQ��WKH�ZLQGRZ�VWLOO�H[LVWV�ZKHQ�WKLV�KRRN�LV�QRWLILHG��DQG�WKHQ�LW�LV�UHPRYHG�IURP�WKH�VFUHHQ�DQG�GHVWUR\HG�DIWHU�WKH�KRRNV�ILOWHU�IXQFWLRQ�KDV�EHHQ�FDOOHG��:KHQ�D�ZLQGRZ�LV�EHLQJ�PLQLPL]HG�RU�PD[LPL]HG��WKLV�KRRN�LV�QRWLILHG�WKURXJK�WKH�

Page 411: Visual Basic - Subclassing and Hooking with VB & VB NET

+6+(//B*(70,15(&7�KRRN�FRGH�EHIRUH�WKH�ZLQGRZ�LV�DFWXDOO\�PLQLPL]HG�RU�PD[LPL]HG���<RX�FDQ�XVH�WKLV�KRRN�DV�D�WKUHDG�VSHFLILF�KRRN��RU�\RX�FDQ�SODFH�LW�LQ�D�G\QDPLF�OLQN�OLEUDU\��'//��DQG�XVH�LW�DV�D�V\VWHP�ZLGH�KRRN��$�WKUHDG�VSHFLILF�KRRN�LQWHUFHSWV�DOO�PHVVDJHV�ZLWKLQ�WKH�WKUHDG�LQ�ZKLFK�LW�LV�LQVWDOOHG��:KHQ�\RX�LQVWDOO�D�KRRN�DV�D�V\VWHP�ZLGH�KRRN��\RX�PXVW�SODFH�LW�LQ�D�'//��7KLV�'//�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�VR�WKDW�WKH�KRRN�FDQ�RSHUDWH�RQ�DOO�PHVVDJHV�LQ�WKH�V\VWHP��&KDSWHU���GLVFXVVHV�WKLV�LQ�GHWDLO���

�������)LOWHU�)XQFWLRQ�'HILQLWLRQ�

7KH�ILOWHU�IXQFWLRQ�SURWRW\SH�IRU�WKLV�KRRN�LV�ZULWWHQ�DV�IROORZV���3XEOLF�)XQFWLRQ�6KHOO3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B���������������������������%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��X&RGH

7KH�FRGH�WKH�V\VWHP�VHQGV�WR�WKLV�ILOWHU�IXQFWLRQ��,�GLVFXVV�WKH�X&RGH�YDOXH�LQ�JUHDWHU�GHWDLO�LQ�6HFWLRQ���������

Z3DUDP

7KLV�SDUDPHWHU�GHSHQGV�RQ�WKH�X&RGH��O3DUDP

7KLV�SDUDPHWHU�GHSHQGV�RQ�WKH�X&RGH��7KH�UHWXUQ�YDOXH�IRU�WKLV�ILOWHU�IXQFWLRQ�VKRXOG�EH�WKH�UHWXUQ�YDOXH�RI�WKH�&DOO1H[W+RRN([�IXQFWLRQ��)RUFLQJ�WKH�UHWXUQ�YDOXH�RI�WKLV�ILOWHU�IXQFWLRQ�WR�DQRWKHU�YDOXH�ZLOO�QRW�DIIHFW�WKH�RXWFRPH�RI�WKH�KRRN��H[FHSW�LQ�WKH�FDVH�RI�+6+(//B7$6.0$1��,Q�WKLV�FDVH��UHWXUQLQJ�D�YDOXH�RI�758(�ZLOO�SUHYHQW�WKH�WDVN�PDQDJHU�IURP�EHLQJ�GLVSOD\HG���

�������([SODQDWLRQ�RI�+RRN�&RGHV�

7KH�X&RGH�SDUDPHWHU�RI�WKH�ILOWHU�IXQFWLRQ�ZLOO�UHFHLYH�D�KRRN�FRGH��7KHUH�DUH����FRGHV�WKDW�FDQ�EH�VHQW�WR�WKLV�ILOWHU�IXQFWLRQ��7KH�FRGHV�DUH�GHILQHG�DV�IROORZV���HSHELL_ACCESSIBILITYSTATE

Page 412: Visual Basic - Subclassing and Hooking with VB & VB NET

)RU�:LQGRZV������DQG�JUHDWHU�RSHUDWLQJ�V\VWHPV��WKLV�FRGH�LQGLFDWHV�WKDW�WKH�DFFHVVLELOLW\�VWDWH�KDV�FKDQJHG��$FFHVVLELOLW\�LV�SURYLGHG�LQ�:LQGRZV�WR�DOORZ�SHRSOH�ZLWK�GLVDELOLWLHV�WR�EHWWHU�XVH�:LQGRZV��7KH�FRGH�LV�GHILQHG�DV�IROORZV���3XEOLF�&RQVW�+6+(//B$&&(66,%,/,7<67$7(� ����7KH�O3DUDP�SDUDPHWHU�LV�QRW�XVHG�IRU�WKLV�FRGH��EXW�WKH�Z3DUDP�SDUDPHWHU�RI�WKLV�FRGH�FRQWDLQV�RQH�RI�WKH�IROORZLQJ�WKUHH�FRQVWDQWV���Public Const ACCESS_STICKYKEYS = &H1

,QGLFDWHV�D�FKDQJH�LQ�WKH�VWLFN\NH\V�VWDWH��6WLFN\NH\V�LV�D�IHDWXUH�WKDW�DOORZV�WKH�XVHU�WR�SUHVV�HLWKHU�WKH�6+,)7��&75/��RU�$/7�NH\�RQFH�DQG�WKHQ�SUHVV�DQRWKHU�NH\�LQ�VHTXHQFH��DV�RSSRVHG�WR�SUHVVLQJ�HDFK�NH\�DW�WKH�VDPH�WLPH��3UHVVLQJ�RQH�RI�WKHVH�WKUHH�PRGLILHU�NH\V�RQFH�HIIHFWLYHO\�ORFNV�WKH�NH\�LQ�WKH�GRZQ�VWDWH�XQWLO�WKH�XVHU�SUHVVHV�LW�DJDLQ�WR�XQORFN�LW��RU�XQWLO�WKH�XVHU�FOLFNV�D�PRXVH�EXWWRQ��3UHVVLQJ�WKH�PRGLILHU�NH\�WZLFH�LQ�VXFFHVVLRQ�ORFNV�WKH�NH\�LQ�WKH�GRZQ�VWDWH��\RX�SUHVV�LW�D�WKLUG�WLPH�WR�XQORFN�LW��7KLV�IHDWXUH�KHOSV�SHRSOH�ZLWK�PRWRU�VNLOO�GLVDELOLWLHV�WR�W\SH�PRUH�HDVLO\��<RX�WXUQ�WKLV�IHDWXUH�RQ�RU�RII�E\�SUHVVLQJ�WKH�6+,)7�NH\�ILYH�WLPHV���Public Const ACCESS_FILTERKEYS = &H2

,QGLFDWHV�WKDW�RQH�RI�WKH�IROORZLQJ�NH\ERDUG�SURSHUWLHV�KDV�EHHQ�FKDQJHG���

• 7LPH�GHOD\�EHIRUH�D�NH\�LV�DFFHSWHG�• 7LPH�GHOD\�EHIRUH�D�NH\�LV�UHSHDWHG�• 8VLQJ�VRXQG�DV�D�IHHGEDFN�PHFKDQLVP�

7KLV�IHDWXUH�DOVR�LV�DYDLODEOH�WR�SHRSOH�ZLWK�PRWRU�VNLOO�GLVDELOLWLHV��<RX�WXUQ�LW�RQ�RU�RII�E\�SUHVVLQJ�DQG�KROGLQJ�WKH�5,*+7�6+,)7�NH\�IRU���VHFRQGV���Public Const ACCESS_MOUSEKEYS = &H3

,QGLFDWHV�WKDW�D�FKDQJH�LQ�WKH�PRXVHNH\V�VWDWH�KDV�RFFXUUHG��7KH�PRXVHNH\V�IHDWXUH�DOORZV�WKH�XVHU�WR�XVH�WKH�QXPHULF�NH\SDG�UDWKHU�WKDQ�WKH�PRXVH�WR�FRQWURO�WKH�PRXVH��7KLV�IHDWXUH�LV�RQFH�DJDLQ�DYDLODEOH�WR�SHRSOH�ZLWK�PRWRU�VNLOO�GLVDELOLWLHV��<RX�WXUQ�WKLV�IHDWXUH�RQ�

Page 413: Visual Basic - Subclassing and Hooking with VB & VB NET

RU�RII�E\�SUHVVLQJ�WKH�/()7�$/7���/()7�6+,)7���180�/2&.�NH\V�DW�WKH�VDPH�WLPH���

HSHELL_WINDOWCREATED

,QGLFDWHV�WKDW�D�WRS�OHYHO�XQRZQHG�ZLQGRZ�KDV�EHHQ�FUHDWHG�DQG�GLVSOD\HG��,W�LV�LPSRUWDQW�WR�UHPHPEHU�WKDW�WKH�ZLQGRZ�H[LVWV�ZKHQ�WKH�KRRN�LV�FDOOHG�ZLWK�WKLV�FRGH��7KH�FRQVWDQW�LV�GHILQHG�DV�IROORZV���3XEOLF�&RQVW�+6+(//B:,1'2:&5($7('� ���7KH�O3DUDP�SDUDPHWHU�LV�QRW�XVHG�IRU�WKLV�FRGH��EXW�WKH�Z3DUDP�SDUDPHWHU�RI�WKLV�FRGH�FRQWDLQV�WKH�KDQGOH�WR�WKH�QHZO\�FUHDWHG�ZLQGRZ���

HSHELL_WINDOWDESTROYED

,QGLFDWHV�WKDW�D�WRS�OHYHO�XQRZQHG�ZLQGRZ�LV�DERXW�WR�EH�GHVWUR\HG��,W�LV�LPSRUWDQW�WR�UHPHPEHU�WKDW�WKH�ZLQGRZ�KDV�QRW�EHHQ�GHVWUR\HG�DW�WKLV�SRLQW��LQ�IDFW��LW�LV�VWLOO�EHLQJ�GLVSOD\HG�RQ�WKH�VFUHHQ��7KH�ZLQGRZ�LV�DFWXDOO\�UHPRYHG�IURP�WKH�VFUHHQ�DQG�GHVWUR\HG�DIWHU�WKH�KRRNV�ILOWHU�IXQFWLRQ����DQG�DQ\�RWKHU�LQVWDOOHG�ILOWHU�IXQFWLRQV�IRU�WKLV�KRRN����KDYH�SURFHVVHG�WKLV�FRGH��7KLV�FRQVWDQW�LV�GHILQHG�DV�IROORZV���3XEOLF�&RQVW�+6+(//B:,1'2:'(6752<('� ���7KH�O3DUDP�SDUDPHWHU�LV�QRW�XVHG�IRU�WKLV�FRGH��EXW�WKH�Z3DUDP�SDUDPHWHU�RI�WKLV�FRGH�FRQWDLQV�WKH�KDQGOH�WR�WKH�ZLQGRZ�DERXW�WR�EH�GHVWUR\HG���

HSHELL_ACTIVATESHELLWINDOW

,QGLFDWHV�WKDW�WKH�VKHOO�VKRXOG�DFWLYDWH�LWV�PDLQ�ZLQGRZ��7KH�O3DUDP�DQG�Z3DUDP�SDUDPHWHUV�DUH�QRW�XVHG�IRU�WKLV�FRGH��7KH�FRQVWDQW�LV�GHILQHG�DV�IROORZV���3XEOLF�&RQVW�+6+(//B$&7,9$7(6+(//:,1'2:� ���

HSHELL_APPCOMMAND

)RU�:LQGRZV������DQG�JUHDWHU�RSHUDWLQJ�V\VWHPV��WKLV�FRGH�LQGLFDWHV�WKDW�WKH�XVHU�KDV�SUHVVHG�HLWKHU�D�PRXVH�RU�D�NH\ERDUG�DSSOLFDWLRQ�EXWWRQ��7KH�FRQVWDQW�LV�GHILQHG�DV�IROORZV���3XEOLF�&RQVW�+6+(//B$33&200$1'� ����7KHUH�DUH�WZR�YHU\�LPSRUWDQW�WKLQJV�WR�XQGHUVWDQG�ZKHQ�XVLQJ�WKLV�FRGH��)LUVW��WKLV�FRGH�LV�VHQW�WR�WKH�KRRN�RQO\�ZKHQ�WKH�DSSOLFDWLRQ�GRHV�QRW�SURFHVV�WKH�:0B$33&200$1'�PHVVDJH�WKDW�HLWKHU�WKH�PRXVH�RU�NH\ERDUG�DSSOLFDWLRQ�EXWWRQ�JHQHUDWHG��6HFRQG��LI�WKH�ILOWHU�IXQFWLRQ�

Page 414: Visual Basic - Subclassing and Hooking with VB & VB NET

KDQGOHV�WKLV�FRGH��LW�VKRXOG�QRW�FDOO�&DOO1H[W+RRN([��DQG�LQVWHDG�VKRXOG�UHWXUQ�758(��7KLV�DOORZV�RQO\�WKLV�ILOWHU�IXQFWLRQ�WR�KDQGOH�WKH�+6+(//B$33&200$1'�PHVVDJH�DQG�SUHYHQWV�RWKHU�ILOWHU�IXQFWLRQV�IURP�DOVR�KDQGOLQJ�WKLV�PHVVDJH���7KH�Z3DUDP�SDUDPHWHU�FRQWDLQV�WKH�KDQGOH�RI�WKH�ZLQGRZ�WKDW�ZDV�WKH�RULJLQDO�:0B$33&200$1'�PHVVDJH�GHVWLQDWLRQ���7KH�O3DUDP�SDUDPHWHU�FRQWDLQV�WKUHH�VSHFLILF�YDOXHV�SHUWDLQLQJ�WR�WKH�:0B$33&200$1'�PHVVDJH��7KH�ILUVW�LV�WKH�$33&200$1'�YDOXH��ZKLFK�\RX�FDQ�GHULYH�DV�IROORZV���3XEOLF�)XQFWLRQ�*HW$SS&RPPDQGBO3DUDP�%\5HI�9DOXH�$V�/RQJ��$V�/RQJ�����*HW$SS&RPPDQGBO3DUDP� ���9DOXH�$QG�+))))������$QG�+�)))�����(QG�)XQFWLRQ�7KLV�YDOXH�LV�HTXLYDOHQW�WR�WKH�DSSOLFDWLRQ�FRPPDQG�WKDW�FRUUHVSRQGV�WR�WKH�PRXVH�RU�NH\ERDUG�LQSXW��7KH�YDOXH�IRU�WKLV�FDQ�EH�DQ\�RI�WKH�FRQVWDQWV�OLVWHG�LQ�7DEOH��������

7DEOH�������$33&200$1'�9DOXH�&RQVWDQWV��&RQVWDQW� /LWHUDO� 'HILQLWLRQ�

$33&200$1'B%$66B%2267� ��� 7RJJOH�WKH�EDVV�ERRVW�RQ�DQG�RII�$33&200$1'B%$66B'2:1�� ��� 'HFUHDVH�WKH�EDVV�$33&200$1'B%$66B83�� ��� ,QFUHDVH�WKH�EDVV�$33&200$1'B%52:6(5B%$&.:$5'�� �� 1DYLJDWH�EDFNZDUG�$33&200$1'B%52:6(5B)$925,7(6�� �� 2SHQ�IDYRULWHV�$33&200$1'B%52:6(5B)25:$5'�� �� 1DYLJDWH�IRUZDUG�$33&200$1'B%52:6(5B+20(�� �� 1DYLJDWH�KRPH�$33&200$1'B%52:6(5B5()5(6+�� �� 5HIUHVK�WKH�SDJH�$33&200$1'B%52:6(5B6($5&+�� �� 2SHQ�VHDUFK�$33&200$1'B%52:6(5B6723�� �� 6WRS�WKH�GRZQORDG�$33&200$1'B/$81&+B$33��� ��� 6WDUW�$SS��$33&200$1'B/$81&+B$33��� ��� 6WDUW�$SS��$33&200$1'B/$81&+B0$,/�� ��� 2SHQ�PDLO�$33&200$1'B0(',$B1(;775$&.�� ��� *R�WR�WKH�QH[W�WUDFN�$33&200$1'B0(',$B3/$<B3$86(�� ��� 3OD\�RU�SDXVH�SOD\EDFN�$33&200$1'B0(',$B35(9,28675$&.�� ��� *R�WR�WKH�SUHYLRXV�WUDFN�$33&200$1'B0(',$B6723�� �� 6WRS�SOD\EDFN�

Page 415: Visual Basic - Subclassing and Hooking with VB & VB NET

$33&200$1'B75(%/(B'2:1�� ��� 'HFUHDVH�WKH�WUHEOH�$33&200$1'B75(%/(B83�� ��� ,QFUHDVH�WKH�WUHEOH�$33&200$1'B92/80(B'2:1�� �� /RZHU�WKH�YROXPH�$33&200$1'B92/80(B087(�� �� 0XWH�WKH�YROXPH�$33&200$1'B92/80(B83�� ��� 5DLVH�WKH�YROXPH�7KH�QH[W�SDUW�RI�WKH�O3DUDP�LV�WKH�'(9,&(�YDOXH�WKDW�GHVFULEHV�ZKHUH�WKLV�LQSXW�RULJLQDWHG��<RX�REWDLQ�WKLV�YDOXH�WKURXJK�WKH�IROORZLQJ�FRGH�IXQFWLRQ���3XEOLF�)XQFWLRQ�*HW'HYLFHBO3DUDP�%\5HI�9DOXH�$V�/RQJ��$V�/RQJ�����*HW'HYLFHBO3DUDP� ���9DOXH�$QG�+))))������$QG�+������(QG�)XQFWLRQ�0RVW�OLNHO\��WKH�GHYLFH�ZLOO�EH�WKH�PRXVH�RU�NH\ERDUG��<RX�FDQ�XVH�DQ\�RI�WKH�FRQVWDQWV�LQ�7DEOH������DV�LWV�YDOXH���

7DEOH�������'(9,&(�&RQVWDQWV��&RQVWDQW� /LWHUDO� 'HILQLWLRQ�

)$33&200$1'B.(<� +�� 8VHU�SUHVVHG�D�NH\�)$33&200$1'B0286(�+�����8VHU�FOLFNHG�D�PRXVH�EXWWRQ�

)$33&200$1'B2(0� +�����$Q�XQLGHQWLILHG�KDUGZDUH�VRXUFH�JHQHUDWHG�WKH�HYHQW��,W�FRXOG�EH�D�PRXVH�RU�D�NH\ERDUG�HYHQW���7KH�ILQDO�SDUW�RI�O3DUDP�LV�WKH�)/$*6�YDOXH��ZKLFK�LQGLFDWHV�LI�WKH�XVHU�SUHVVHG�D�&75/�RU�6+,)7�NH\�ZKLOH�SUHVVLQJ�WKH�PRXVH�RU�NH\ERDUG�DSSOLFDWLRQ�EXWWRQ��,W�DOVR�LQGLFDWHV�ZKLFK�PRXVH�EXWWRQ�WKH�XVHU�SUHVVHG��<RX�REWDLQ�WKLV�YDOXH�WKURXJK�WKH�&���*(7B)/$*6B/3$5$0�O3DUDP��PDFUR��<RX�FDQ�XVH�DQ\�RI�WKH�FRQVWDQWV�LQ�7DEOH������DV�LWV�YDOXH���

7DEOH�������)/$*6�&RQVWDQWV��&RQVWDQW� /LWHUDO� 'HILQLWLRQ�

0.B&21752/�� +�� 7KH�&75/�NH\�LV�GRZQ�0.B6+,)7� +�� 7KH�6+,)7�NH\�LV�GRZQ�0.B/%87721� +�� 7KH�OHIW�PRXVH�EXWWRQ�LV�GRZQ�0.B0%87721� +��� 7KH�PLGGOH�PRXVH�EXWWRQ�LV�GRZQ�0.B5%87721�� +�� 7KH�ULJKW�PRXVH�EXWWRQ�LV�GRZQ�0.B;%87721�� +��� 7KH�ILUVW�;�EXWWRQ�LV�GRZQ�0.B;%87721��� +��� 7KH�VHFRQG�;�EXWWRQ�LV�GRZQ�

Page 416: Visual Basic - Subclassing and Hooking with VB & VB NET

HSHELL_WINDOWACTIVATED

7KH�FXUUHQW�ZLQGRZ�KDV�EHHQ�FKDQJHG�WR�WKH�DFWLYH�ZLQGRZ��7KLV�LV�RQO\�IRU�WRS�OHYHO�XQRZQHG�ZLQGRZV��7KH�Z3DUDP�SDUDPHWHU�IRU�WKLV�FRGH�FRQWDLQV�WKH�KDQGOH�RI�WKH�DFWLYDWHG�ZLQGRZ��7KH�O3DUDP�SDUDPHWHU�IRU�WKLV�FRGH�FRQWDLQV�758(�LI�WKH�ZLQGRZ�LV�PD[LPL]HG�RU�)$/6(�LI�LW�LV�QRW��7KLV�FRQVWDQW�LV�GHILQHG�DV�IROORZV���3XEOLF�&RQVW�+6+(//B:,1'2:$&7,9$7('� ���

HSHELL_GETMINRECT

,QGLFDWHV�WKDW�WKH�XVHU�KDV�HLWKHU�PLQLPL]HG�RU�PD[LPL]HG�WKH�DFWLYH�ZLQGRZ��7KLV�FRQVWDQW�LV�GHILQHG�DV�IROORZV���3XEOLF�&RQVW�+6+(//B*(70,15(&7� ���1RWH�WKDW�WKLV�FRGH�GRHV�QRW�LQGLFDWH�WKDW�WKH�XVHU�LV�UHVL]LQJ�RU�PRYLQJ�WKH�ZLQGRZ��7KH�Z3DUDP�SDUDPHWHU�IRU�WKLV�FRGH�FRQWDLQV�WKH�KDQGOH�WR�WKH�ZLQGRZ�WKDW�WKH�XVHU�PLQLPL]HG�RU�PD[LPL]HG��7KH�O3DUDP�SDUDPHWHU�FRQWDLQV�D�SRLQWHU�WR�D�5(&7�VWUXFWXUH�WKDW�GHILQHV�WKH�ZLQGRZ�VL]H��<RX�VKRXOG�XVH�&RS\0HPRU\�WR�FRS\�LQWR�D�VWUXFWXUH�RI�W\SH�5(&7�WKH�LQIRUPDWLRQ�WKDW�WKH�SRLQWHU�SRLQWV�WR��$�5(&7�VWUXFWXUH�LV�GHILQHG�LQ�9LVXDO�%DVLF��9%��DV�IROORZV���3XEOLF�7\SH�5(&7���������/HIW�$V�/RQJ���������7RS�$V�/RQJ���������5LJKW�$V�/RQJ���������%RWWRP�$V�/RQJ�(QG�7\SH�

HSHELL_REDRAW

,QGLFDWHV�WKDW�WKH�ZLQGRZ�WLWOH�GLVSOD\HG�LQ�WKH�:LQGRZV�WDVN�EDU�KDV�EHHQ�UHGUDZQ��7KLV�FRGH�LV�QRW�VHQW�WR�WKH�ILOWHU�IXQFWLRQ�ZKHQ�D�ZLQGRZ�WLWOH�LV�UHGUDZQ�LQ�WKH�ZLQGRZ�WLWOH�EDU�DV�D�UHVXOW�RI�WKH�XVHU�PRYLQJ�RU�VL]LQJ�WKH�ZLQGRZ��7KLV�FRQVWDQW�LV�GHILQHG�DV�IROORZV���3XEOLF�&RQVW�+6+(//B5('5$:� ���7KH�Z3DUDP�SDUDPHWHU�FRQWDLQV�WKH�KDQGOH�WR�WKH�ZLQGRZ�ZKRVH�WLWOH�WKH�V\VWHP�UHGUHZ�LQ�WKH�WDVN�EDU��7KH�O3DUDP�SDUDPHWHU�FRQWDLQV�758(�LI�WKH�ZLQGRZ�LV�IODVKLQJ�RU�)$/6(�RWKHUZLVH���

HSHELL_TASKMAN

,QGLFDWHV�WKDW�WKH�XVHU�KDV�RSHQHG�WKH�:LQGRZV�WDVN�PDQDJHU��5HWXUQLQJ�758(�IURP�WKH�ILOWHU�IXQFWLRQ�ZLOO�SUHYHQW�WKH�V\VWHP�IURP�

Page 417: Visual Basic - Subclassing and Hooking with VB & VB NET

GLVSOD\LQJ�WKH�WDVN�PDQDJHU��7KLV�LV�XVHIXO�LI�\RX�ZDQW�WR�UHSODFH�WKH�WDVN�PDQDJHU�ZLWK�RQH�RI�\RXU�RZQ�GHVLJQ�RU�LI�\RX�ZDQW�WR�SUHYHQW�WKH�XVHU�IURP�GLVSOD\LQJ�WKH�WDVN�PDQDJHU�DOWRJHWKHU��7KLV�FRQVWDQW�LV�GHILQHG�DV�IROORZV���3XEOLF�&RQVW�+6+(//B7$6.0$1� ���7KH�Z3DUDP�DQG�O3DUDP�SDUDPHWHUV�DUH�QRW�XVHG�IRU�WKLV�KRRN�FRGH���

)LJXUH�������7KH�.H\ERDUG�3URSHUWLHV�GLDORJ�ER[�

HSHELL_LANGUAGE

,QGLFDWHV�WKDW�WKH�XVHU�KDV�FKDQJHG�WKH�NH\ERDUG�ODQJXDJH�RU�OD\RXW��7KH�XVHU�GRHV�WKLV�XVLQJ�WKH�,QSXW�/RFDOHV�WDE�RI�WKH�&RQWURO�3DQHOV�.H\ERDUG�DSSOHW��ZKLFK�)LJXUH������LOOXVWUDWHV��7KLV�FRQVWDQW�LV�GHILQHG�DV�IROORZV���3XEOLF�&RQVW�+6+(//B/$1*8$*(� �����6ZLWFKLQJ�ODQJXDJHV�HLWKHU�WKURXJK�WKLV�GLDORJ�ER[�RU�E\�XVLQJ�RQH�RI�WKH�NH\ERDUG�VKRUWFXWV��/HIW�$/7�6+,)7�RU�&75/�6+,)7��VHQGV�WKLV�FRGH�WR�WKLV�KRRNV�ILOWHU�IXQFWLRQ���

,I�QRQH�RI�WKHVH�FRGHV�LV�SDVVHG�LQ��\RX�VKRXOG�VNLS�PHVVDJH�SURFHVVLQJ�DQG�FDOO�&DOO1H[W+RRN([�LPPHGLDWHO\��

Page 418: Visual Basic - Subclassing and Hooking with VB & VB NET

�����/RFDWLRQ�RI�7KLV�+RRN�LQ�WKH�6\VWHP�

7KH�ILOWHU�IXQFWLRQ�IRU�WKLV�KRRN�LV�FDOOHG�IURP�ZLWKLQ�WKH�PHVVDJH�ORRS�RI�WKH�WKUHDG�RU�WKUHDGV�LQ�ZKLFK�WKLV�KRRN�KDV�EHHQ�LQVWDOOHG��)LJXUH������LOOXVWUDWHV�WKLV���

)LJXUH�������7KH�ORFDWLRQ�RI�WKH�:+B6+(//�KRRN�LQ�WKH�V\VWHP�

�����$�7KUHDG�6SHFLILF�([DPSOH�

7KH�H[DPSOH�SUHVHQWHG�KHUH�LV�D�WKUHDG�VSHFLILF�H[DPSOH�WKDW�LQVWDOOV�WKH�:+B6+(//�KRRN�DQG�GLVSOD\V�VKHOO�QRWLILFDWLRQ�PHVVDJHV�DV�WKH\�RFFXU��)LJXUH������SURYLGHV�D�VFUHHQVKRW�RI�WKH�H[DPSOH�DSSOLFDWLRQ���

)LJXUH�������6FUHHQVKRW�RI�H[DPSOH�DSSOLFDWLRQ�

Page 419: Visual Basic - Subclassing and Hooking with VB & VB NET

7DEOH������SUHVHQWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���

�������8VLQJ�WKH�$SSOLFDWLRQ�

7KH�DSSOLFDWLRQ�ZRUNV�OLNH�WKH�SUHYLRXV�H[DPSOHV��&OLFN�WKH�KRRN�EXWWRQ�WR�LQVWDOO�WKH�KRRN�DQG�WKH�XQKRRN�EXWWRQ�WR�UHPRYH�WKH�KRRN��7KH�KRRN�DQG�XQKRRN�EXWWRQV�LQ�WKH�6+(//�IUDPH�GHDO�ZLWK�WKH�:+B6+(//�KRRN��7KH�IROORZLQJ�WKUHH�H[WUD�EXWWRQV�DUH�LQFOXGHG�DV�ZHOO���Create Wnd

&UHDWHV�DQG�GLVSOD\V�D�IRUP�XVLQJ�WKH�FRGH�/RDG�)RUP����TaskBar Title

&KDQJHV�WKH�WH[W�LQ�WKH�ZLQGRZ�WLWOH�EDU�IURP��:+B6+(//�([DPSOH��WR��7LWOH�RI�:LQGRZ�+DV�&KDQJHG���1RWH�WKDW�FKDQJLQJ�WKH�WRS�OHYHO�XQRZQHG�ZLQGRZV�WLWOH�WH[W�FDXVHV�WKH�VDPH�WH[W�WR�EH�GLVSOD\HG�LQ�WKH�WDVN�EDU�IRU�WKLV�ZLQGRZ���

MsgBox

'LVSOD\V�D�VLPSOH�PHVVDJH�ER[���7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��

2EMHFW� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�)RUP�� 1DPH� )RUP��)RUP�� &DSWLRQ� �:+B6+(//�([DPSOH��)RUP�� 7RS� ����)RUP�� /HIW� ����)RUP�� +HLJKW� �����)RUP�� :LGWK� �����)RUP�� 1DPH� )RUP��)RUP�� &DSWLRQ� �1(:�)250��&RPPDQG�%XWWRQ�� 1DPH� FPG+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �KRRN��

Page 420: Visual Basic - Subclassing and Hooking with VB & VB NET

&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� FPG8QKRRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �XQKRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� FPG&UHDWH:QG�&RPPDQG�%XWWRQ�� &DSWLRQ� �&UHDWH:QG��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH� FPG7DVN%DU7LWOH�&RPPDQG�%XWWRQ�� &DSWLRQ� �7DVN%DU�7LWOH��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH� FPG0VJ%R[�&RPPDQG�%XWWRQ�� &DSWLRQ� �0VJ%R[��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����7H[W%R[� 0XOWL/LQH� 7UXH�7H[W%R[� 7RS� ����7H[W%R[� /HIW� �����7H[W%R[� +HLJKW� �����7H[W%R[� :LGWK� �����

Page 421: Visual Basic - Subclassing and Hooking with VB & VB NET

&OLFNLQJ�WKH�&UHDWH�:QG�EXWWRQ�ORDGV�DQG�GLVSOD\V�D�QHZ�9%�IRUP��7KLV�ILUHV�WKH�IROORZLQJ�KRRN�FRGHV���+6+(//B5('5$:������������������KZQG���������)ODVKLQJ�)DOVH�+6+(//B:,1'2:&5($7('�����������KZQG������+6+(//B:,1'2:$&7,9$7('���������KZQG���������0D[LPL]HG�)DOVH�:KDW�KDV�KDSSHQHG�LV�WKDW�WKH�+6+(//B5('5$:�FRGH�ZDV�ILUHG�ZKHQ�WKH�WLWOH�WH[W�RI�WKH�QHZ�ZLQGRZ�ZDV�UHGUDZQ�LQ�WKH�WDVN�EDU��1H[W��WKH�+6+(//B:,1'2:&5($7('�FRGH�LV�ILUHG�RQFH�WKH�QHZ�ZLQGRZ�ZDV�FUHDWHG�DQG�GLVSOD\HG��)LQDOO\��WKH�+6+(//B:,1'2:$&7,9$7('�FRGH�ZDV�ILUHG�ZKHQ�WKH�QHZO\�FUHDWHG�ZLQGRZ�EHFDPH�WKH�DFWLYH�ZLQGRZ���:KHQ�WKLV�ZLQGRZ�LV�GHVWUR\HG��WKH�IROORZLQJ�WH[W�LV�GLVSOD\HG�LQ�WKH�DSSOLFDWLRQV�WH[W�ER[���+6+(//B:,1'2:'(6752<('���������KZQG������+6+(//B:,1'2:$&7,9$7('���������KZQG���������0D[LPL]HG�)DOVH�+6+(//B5('5$:������������������KZQG���������)ODVKLQJ�)DOVH�+6+(//B:,1'2:'(6752<('�LQGLFDWHV�WKDW�WKH�ZLQGRZ�LV�DERXW�WR�EH�GHVWUR\HG��$W�WKLV�SRLQW��WKRXJK��WKH�ZLQGRZ�LV�VWLOO�EHLQJ�GLVSOD\HG�RQ�WKH�VFUHHQ��1H[W��WKH�ZLQGRZ�LV�UHPRYHG�IURP�WKH�VFUHHQ�DQG�GHVWUR\HG��:KHQ�WKLV�KDSSHQV��WKH�QH[W�ZLQGRZ�LQ�WKH�=�RUGHU�IRU�WKLV�DSSOLFDWLRQ��ZKLFK�LV�RXU�LQLWLDO�PDLQ�ZLQGRZ��EHFRPHV�DFWLYH��7KLV�FDXVHV�WKH�+6+(//B:,1'2:$&7,9$7('�FRGH�WR�EH�ILUHG��)LQDOO\��WKH�+6+(//B5('5$:�FRGH�LV�ILUHG��LQGLFDWLQJ�WKDW�WKH�ZLQGRZ�WLWOH�WH[W�RI�WKH�UHFHQWO\�GHVWUR\HG�ZLQGRZ�ZDV�UHPRYHG�IURP�WKH�WDVN�EDU���&OLFNLQJ�WKH�0VJ%R[�EXWWRQ�GRHV�QRW�ILUH�DQ\�:+B6+(//�KRRN�FRGHV��7KLV�LV�EHFDXVH�WKHVH�ZLQGRZV�DUH�QRW�WRS�OHYHO�XQRZQHG�ZLQGRZV��5HPHPEHU�WKDW�WKLV�KRRN�LQWHUFHSWV�RQO\�DFWLRQV�WDNHQ�RQ�WRS�OHYHO�XQRZQHG�ZLQGRZV���:KHQ�WKH�XVHU�FOLFNV�WKH�7DVN%DU�7LWOH�EXWWRQ��WKH�IROORZLQJ�WH[W�DSSHDUV�LQ�WKH�DSSOLFDWLRQV�WH[W�ER[���+6+(//B5('5$:����KZQG���������)ODVKLQJ�)DOVH�7KH�ZLQGRZ�WLWOH�WH[W�LV�PRGLILHG�RQ�WKH�ZLQGRZ�DV�ZHOO�DV�RQ�WKH�WDVN�EDU��$IWHU�WKH�WH[W�KDV�EHHQ�UHGUDZQ�LQ�WKH�WDVN�EDU��WKH�+6+(//B5('5$:�KRRN�FRGH�LV�ILUHG���%ULQJLQJ�XS�WKH�:LQGRZV�WDVN�PDQDJHU�ZLOO�FDXVH�WKH�IROORZLQJ�WH[W�WR�EH�GLVSOD\HG�LQ�WKH�DSSOLFDWLRQV�WH[W�ER[���+6+(//B7$6.0$1�7KH�+6+(//B7$6.0$1�FRGH�LV�ILUHG��LQGLFDWLQJ�WKDW�WKH�XVHU�LV�LQ�WKH�SURFHVV�RI�RSHQLQJ�WKH�WDVN�PDQDJHU�EXW�WKH�WDVN�PDQDJHU�LWVHOI�KDV�QRW�\HW�EHHQ�RSHQHG��%HFDXVH�WKH�WDVN�PDQDJHU�KDV�QRW�EHHQ�RSHQHG��LW�LV�SRVVLEOH�WR�UHWXUQ�D�758(�YDOXH�IURP�WKH�ILOWHU�IXQFWLRQ�WR�SUHYHQW�:LQGRZV�IURP�RSHQLQJ�WKH�WDVN�PDQDJHU���0LQLPL]LQJ�WKH�PDLQ�ZLQGRZ�FDXVHV�WKH�V\VWHP�WR�GLVSOD\�WKH�IROORZLQJ�WH[W�LQ�WKH�WH[W�ER[���+6+(//B*(70,15(&7����KZQG���������������������������723���������������������������������/()7������������

Page 422: Visual Basic - Subclassing and Hooking with VB & VB NET

���������������������+(,*+7��������������������������������:,'7+�������7KH�+6+(//B*(70,15(&7�FRGH�LV�ILUHG�LQ�UHVSRQVH�WR�WKLV�DFWLRQ��7KLV�FRGH�SURYLGHV�D�5(&7�VWUXFWXUH�LQ�LWV�O3DUDP�SDUDPHWHU�LQGLFDWLQJ�WKH�WRS��OHIW��KHLJKW��DQG�ZLGWK�RI�WKH�ZLQGRZ�UHFWDQJOH���5HVWRULQJ�WKH�PDLQ�ZLQGRZ�IURP�LWV�PLQLPL]HG�VWDWH�FDXVHV�WKH�IROORZLQJ�WH[W�WR�EH�GLVSOD\HG�LQ�WKH�WH[W�ER[���+6+(//B:,1'2:$&7,9$7('����������KZQG���������0D[LPL]HG�)DOVH�+6+(//B*(70,15(&7���������������KZQG��������������������������������������723�������������������������������������������/()7�������������������������������������������+(,*+7�������������������������������������������:,'7+�������7KH�ILUVW�KRRN�FRGH�WKDW�LV�ILUHG�LV�+6+(//B:,1'2:$&7,9$7('��7KLV�LQGLFDWHV�WKDW�WKH�ZLQGRZ�EHLQJ�PD[LPL]HG�LV�ILUVW�VHW�DV�WKH�DFWLYH�ZLQGRZ��1H[W��+6+(//B*(70,15(&7�LV�ILUHG�LQ�UHVSRQVH�WR�WKH�ZLQGRZV�UHVWRUDWLRQ��7KLV�FRGH�SURYLGHV�D�5(&7�VWUXFWXUH�LQ�LWV�O3DUDP�SDUDPHWHU�LQGLFDWLQJ�WKH�WRS��OHIW��KHLJKW��DQG�ZLGWK�RI�WKH�ZLQGRZ�UHFWDQJOH���0RGLI\LQJ�WKH�NH\ERDUG�ODQJXDJH�RU�OD\RXW�FDXVHV�WKH�IROORZLQJ�WH[W�WR�EH�GLVSOD\HG�LQ�WKH�WH[W�ER[���+6+(//B/$1*8$*(����KZQG���������.H\EG�+DQGOH����������$IWHU�WKH�QHZ�NH\ERDUG�ODQJXDJH�RU�OD\RXW�LV�ORDGHG��WKLV�KRRN�FRGH�LV�ILUHG��7KH�.H\EG�+DQGOH�FRQWDLQV�D�KDQGOH�IRU�WKH�QHZ�NH\ERDUG�ODQJXDJH�RU�OD\RXW���,I�WKH�XVHU�SUHVVHV�DQ�DSSOLFDWLRQ�EXWWRQ�RQ�WKH�PRXVH�RU�WKH�NH\ERDUG��WKH�IROORZLQJ�KRRN�FRGH�LV�ILUHG���+6+(//B$33&200$1'���������������'HVWLQDWLRQ�������������$33B&0'���������7KH�'HVWLQDWLRQ�YDOXH�LV�WKH�ZLQGRZ�KDQGOH�RI�WKH�PDLQ�ZLQGRZ�LQ�RXU�DSSOLFDWLRQ��7KH�$33B&0'�YDOXH�LV�D�FRPELQDWLRQ�RI�WKH�DSSOLFDWLRQ�FRPPDQG��WKH�GHYLFH�WKDW�JHQHUDWHG�WKH�FRPPDQG��DQG�D�IODJ�YDOXH��8VLQJ�WKLV�LQIRUPDWLRQ��WKH�GHYHORSHU�FDQ�FDXVH�VSHFLILF�DFWLRQV�WR�RFFXU�LQ�UHVSRQVH�WR�WKH�FOLFN�RI�DSSOLFDWLRQ�EXWWRQV�RQ�NH\ERDUGV�DQG�PLFH���,I�WKH�XVHU�FKDQJHV�WKH�DFFHVVLELOLW\�VWDWH��WKH�WH[W�ER[�GLVSOD\V�RQH�RI�WKH�IROORZLQJ�OLQHV�RI�WH[W���+6+(//B$&&(66,%,/,7<67$7(��������Z3DUDP�),/7(5.(<6�+6+(//B$&&(66,%,/,7<67$7(��������Z3DUDP�67,&.<.(<6�+6+(//B$&&(66,%,/,7<67$7(��������Z3DUDP�0286(.(<6�7KH�YDOXH�WKDW�WKH�Z3DUDP�ILHOG�GLVSOD\V�LQ�GHSHQGV�RQ�ZKDW�W\SH�RI�DFFHVVLELOLW\�VWDWH�WKH�XVHU�FKDQJHG���

�������7KH�&RGH�

Page 423: Visual Basic - Subclassing and Hooking with VB & VB NET

7KLV�DSSOLFDWLRQ�FRQVLVWV�RI�D�FRGH�PRGXOH�QDPHG�0RGXOH��EDV��DV�ZHOO�DV�IRUPV�QDPHG�)RUP��DQG�)RUP���WKH�ODWWHU�LV�WKH�DSSOLFDWLRQV�VWDUWXS�IRUP��7KH�0RGXOH��EDV�PRGXOH�RI�WKH�DSSOLFDWLRQ�GHFODUHV�WZR�SULYDWH�PHPEHU�YDULDEOHV���3ULYDWH�K+RRN�$V�/RQJ�3XEOLF�,V+RRNHG�$V�%RROHDQ�7KH�K+RRN�YDULDEOH�FRQWDLQV�WKH�KDQGOH�WR�WKH�LQVWDOOHG�:+B6+(//�KRRN��7KH�6HW:LQGRZ+RRN([�IXQFWLRQ�UHWXUQV�WKLV�YDOXH��7KH�,V+RRNHG�IODJ�LQGLFDWHV�ZKHWKHU�WKLV�KRRN�KDV�EHHQ�LQVWDOOHG���7KH�6HW6KHOO+RRN�LQVWDOOV�WKH�:+B6+(//�KRRN�E\�FDOOLQJ�WKH�6HW:LQGRZV+RRN([�IXQFWLRQ��DV�([DPSOH������VKRZV���

([DPSOH�������,QVWDOOLQJ�WKH�:+B6+(//�+RRN��

3XEOLF�6XE�6HW6KHOO+RRN���������,I�,V+RRNHG�7KHQ���������0VJ%R[��'RQW�KRRN�6+(//�WZLFH�RU�\RX�ZLOO�EH�XQDEOH�WR�XQKRRN�LW�������(OVH���������K+RRN� �6HW:LQGRZV+RRN([�:+B6+(//��$GGUHVV2I�6KHOO3URF�����$SS�7KUHDG,'����������,V+RRNHG� �7UXH�����(QG�,I�(QG�6XE�7KH�5HPRYH6KHOO+RRN��VKRZQ�LQ�([DPSOH�������UHPRYHV�WKH�:+B6+(//�KRRN�E\�FDOOLQJ�WKH�8QKRRN:LQGRZV+RRN([�IXQFWLRQ���

([DPSOH�������8QLQVWDOOLQJ�WKH�:+B6+(//�+RRN��

3XEOLF�6XE�5HPRYH6KHOO+RRN���������'LP�WHPS�$V�/RQJ�����WHPS� �8QKRRN:LQGRZV+RRN([�K+RRN������,V+RRNHG� �)DOVH�(QG�6XE�7KH�6KHOO3URF�IXQFWLRQ�LQ�([DPSOH������DFWV�DV�WKH�ILOWHU�IXQFWLRQ�IRU�WKH�:+B6+(//�KRRN��7KH�VHFRQG�DUJXPHQW�RI�WKH�6HW:LQGRZV+RRN([�IXQFWLRQ��LQ�WKLV�FDVH��$GGUHVV2I�6KHOO3URF��GHILQHV�WKH�ILOWHU�IXQFWLRQ��7KLV�IXQFWLRQ�VLPSO\�SULQWV�RXW�WKH�YDULRXV�KRRN�FRGHV�DQG�WKHLU�SDUDPHWHUV�LQ�WKH�7H[W��WH[W�ER[�RQ�WKLV�DSSOLFDWLRQV�PDLQ�ZLQGRZ���

([DPSOH�������7KH�:+B6+(//�)LOWHU�)XQFWLRQ��

3XEOLF�)XQFWLRQ�6KHOO3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B���������������������������%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�

Page 424: Visual Basic - Subclassing and Hooking with VB & VB NET

����'LP�VWUXFW:LQGRZ6L]H�$V�5(&7����������6HOHFW�&DVH�X&RGH���������&DVH�+6+(//B$&7,9$7(6+(//:,1'2:�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+6+(//B$&7,9$7(6+(//:,1'2:���B���������������������������������YE1HZ/LQH���������&DVH�+6+(//B:,1'2:&5($7('�������������Z3DUDP� �+DQGOH�WR�WKH�FUHDWHG�ZLQGRZ�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+6+(//B:,1'2:&5($7('����KZQG���B����������������������������������Z3DUDP��YE1HZ/LQH���������&DVH�+6+(//B:,1'2:'(6752<('�������������Z3DUDP� �+DQGOH�WR�WKH�GHVWUR\HG�ZLQGRZ�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+6+(//B:,1'2:'(6752<('����KZQG���B����������������������������������Z3DUDP��YE1HZ/LQH���������&DVH�+6+(//B:,1'2:$&7,9$7('�������������Z3DUDP� �+DQGOH�WR�WKH�DFWLYDWHG�ZLQGRZ�������������O3DUDP� �7KH�YDOXH�LV�758(�LI�WKH�ZLQGRZ�LV�LQ�IXOO�VFUHHQ�PRGH��������������RU�)$/6(�RWKHUZLVH�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+6+(//B:,1'2:$&7,9$7('����KZQG���B���������������������������������Z3DUDP������0D[LPL]HG����&%RRO�O3DUDP���YE1HZ/LQH���������&DVH�+6+(//B*(70,15(&7�������������Z3DUDP� �+DQGOH�WR�WKH�PLQLPL]HG�RU�PD[LPL]HG�ZLQGRZ�������������O3DUDP� �3RLQWHU�WR�D�5(&7�VWUXFWXUH�������������&RS\0HPRU\�VWUXFW:LQGRZ6L]H��O3DUDP��/HQ�VWUXFW:LQGRZ6L]H��������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+6+(//B*(70,15(&7����KZQG����B���������������������������������Z3DUDP��YE1HZ/LQH�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W������������������������723���B����������������������������������VWUXFW:LQGRZ6L]H�7RS��YE1HZ/LQH�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W������������������������/()7���B����������������������������������VWUXFW:LQGRZ6L]H�/HIW��YE1HZ/LQH�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W������������������������+(,*+7���B���������������������������������VWUXFW:LQGRZ6L]H�5LJKW��YE1HZ/LQH�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W������������������������:,'7+���B����������������������������������VWUXFW:LQGRZ6L]H�%RWWRP��YE1HZ/LQH���������&DVH�+6+(//B5('5$:�������������Z3DUDP� �+DQGOH�WR�WKH�UHGUDZQ�ZLQGRZ�������������O3DUDP� �7KH�YDOXH�LV�758(�LI�WKH�ZLQGRZ�LV�IODVKLQJ��RU�)$/6(�RWKHUZLVH�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+6+(//B5('5$:����KZQG����Z3DUDP�B�������������������������������������)ODVKLQJ����&%RRO�O3DUDP���YE1HZ/LQH�

Page 425: Visual Basic - Subclassing and Hooking with VB & VB NET

��������&DVH�+6+(//B7$6.0$1�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+6+(//B7$6.0$1���YE1HZ/LQH���������&DVH�+6+(//B/$1*8$*(�������������Z3DUDP� �+DQGOH�WR�WKH�ZLQGRZ�������������O3DUDP� �+DQGOH�WR�D�NH\ERDUG�OD\RXW�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+6+(//B/$1*8$*(����KZQG����B��������������������������������Z3DUDP������.H\EG�+DQGOH����O3DUDP��YE1HZ/LQH���������&DVH�+6+(//B$&&(66,%,/,7<67$7(�������������Z3DUDP� �$&&(66B),/7(5.(<6��$&&(66B0286(.(<6��RU�$&&(66B67,&.<.(<6�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W��B���������������������������������+6+(//B$&&(66,%,/,7<67$7(�Z3DUDP����������������,I�Z3DUDP� �$&&(66B),/7(5.(<6�7KHQ������������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���),/7(5.(<6���YE1HZ/LQH�������������(OVH,I�Z3DUDP� �$&&(66B0286(.(<6�7KHQ������������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���0286(.(<6���YE1HZ/LQH�������������(OVH,I�Z3DUDP� �$&&(66B67,&.<.(<6�7KHQ������������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���67,&.<.(<6���YE1HZ/LQH�������������(QG�,I���������&DVH�+6+(//B$33&200$1'�������������Z3DUDP� �:LQGRZV�������:KHUH�WKH�:0B$33&200$1'�PHVVDJH�ZDV�������������RULJLQDOO\�VHQW�������������O3DUDP� �DSSOLFDWLRQ�FRPPDQG�FRUUHVSRQGLQJ�WR�WKH�LQSXW�HYHQW�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+6+(//$33&200$1'�������B������������������������������������'HVWLQDWLRQ����Z3DUDP����$33B&0'����B��������������������������������O3DUDP��YE1HZ/LQH�������������6LQFH�ZH�KDQGOH�WKLV�PHVVDJH�ZH�VKRXOG�SUHYHQW�LW�IURP�EHLQJ�������������KDQGOHG�HOVHZKHUH�������������6KHOO3URF� �7UXH�������������([LW�)XQFWLRQ�����(QG�6HOHFW����������6KHOO3URF� �&DOO1H[W+RRN([�K+RRN��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KLV�ILOWHU�IXQFWLRQ�KDV�WZR�SRLQWV�RI�LQWHUHVW��7KH�ILUVW�LV�WKH�FRGH�WKDW�KDQGOHV�WKH�+6+(//B*(70,15(&7�FDVH��,W�XVHV�&RS\0HPRU\�WR�JHW�WKH�5(&7�VWUXFWXUH�IURP�WKH�UHWXUQHG�SRLQWHU�LQ�WKH�O3DUDP�SDUDPHWHU��7KLV�LV�VRPHWKLQJ�WKDW�ZH�KDYH�VHHQ�EHIRUH��7KH�VHFRQG�LV�WKH�+6+(//B$33&200$1'�FDVH��,I�ZH�KDQGOH�WKLV�KRRN�FRGH��ZH�QHHG�WR�UHWXUQ�D�758(�YDOXH�DQG�H[LW�WKH�IXQFWLRQ�DW�WKLV�SRLQW��'RLQJ�WKLV�SUHYHQWV�DQ\�RWKHU�LQVWDOOHG�:+B6+(//�ILOWHU�IXQFWLRQV�IURP�KDQGOLQJ�WKLV�KRRN�FRGH��7KH�FRGH�EHKLQG�WKH�)RUP��IUP�

Page 426: Visual Basic - Subclassing and Hooking with VB & VB NET

PRGXOH��ZKLFK�LV�VKRZQ�LQ�([DPSOH�������VLPSO\�FDOOV�WKH�IXQFWLRQV�LQ�WKH�0RGXOH��EDV�PRGXOH�WR�LQVWDOO�DQG�UHPRYH�WKH�:+B6+(//�KRRN��7KH�&RPPDQG��EXWWRQ�FUHDWHV�DQG�GLVSOD\V�D�QHZ�IRUP��WKH�&RPPDQG��EXWWRQ�FKDQJHV�WKH�WLWOH�RI�WKH�PDLQ�ZLQGRZ��DQG�WKH�&RPPDQG��EXWWRQ�GLVSOD\V�D�PHVVDJH�ER[��7KHVH�WZR�EXWWRQV�DOORZ�\RX�WR�WHVW�VHYHUDO�RI�WKH�:+B6+(//�KRRN�FRGHV���

([DPSOH�������7KH�&RGH�IRU�)RUP��IUP��

3ULYDWH�6XE�&RPPDQG�B&OLFN���������7H[W��7H[W� ��������&DOO�6HW6KHOO+RRN�(QG�6XE��3ULYDWH�6XE�&RPPDQG�B&OLFN���������&DOO�5HPRYH6KHOO+RRN�(QG�6XE���3ULYDWH�6XE�&RPPDQG�B&OLFN���������)RUP��6KRZ�(QG�6XE��3ULYDWH�6XE�&RPPDQG�B&OLFN���������,I�0H�&DSWLRQ� ��7LWOH�2I�:LQGRZ�+DV�&KDQJHG��7KHQ���������0H�&DSWLRQ� ��:+B6+(//�([DPSOH������(OVH���������0H�&DSWLRQ� ��7LWOH�2I�:LQGRZ�+DV�&KDQJHG������(QG�,I�(QG�6XE��3ULYDWH�6XE�&RPPDQG�B&OLFN���������0VJ%R[��7KH�:+B6+(//�KRRN�GRHV�QRW�DFNQRZOHGJH�WKH�FUHDWLRQ�RI�WKLV�PHVVDJH�ER[���(QG�6XE��������������&/($183�������������3ULYDWH�6XE�)RUPB4XHU\8QORDG�&DQFHO�$V�,QWHJHU��8QORDG0RGH�$V�,QWHJHU������,I�,V+RRNHG�2U�,V'%*+RRNHG�7KHQ�����&DQFHO� ���

Page 427: Visual Basic - Subclassing and Hooking with VB & VB NET

����0VJ%R[��8QKRRN�EHIRUH�FORVLQJ��RU�WKH�,'(�ZLOO�FUDVK�������(QG�,I�(QG�6XE�

�����&DYHDWV�

$V�ZLWK�DOO�KRRNV��SHUIRUPDQFH�QHHGV�WR�EH�D�WRS�FRQVLGHUDWLRQ��DOWKRXJK�WKLV�KRRN�FDUULHV�D�VPDOOHU�SHUIRUPDQFH�SHQDOW\�WKDQ�PRVW�RWKHU�KRRNV��7KLV�LV�EHFDXVH�WKLV�KRRN�LQWHUFHSWV�IHZHU�PHVVDJHV�WKDQ�RWKHU�KRRNV�GR��)RU�H[DPSOH��WKH�:+B0286(�KRRN�LQWHUFHSWV�PDQ\�PHVVDJHV�HYHU\�VHFRQG����PDLQO\�PHVVDJHV�VXFK�DV�:0B0286(029(��7KH�:+B6+(//�KRRN�LQWHUFHSWV�PHVVDJHV�DW�D�KLJKHU�OHYHO��%\�WKLV�,�PHDQ�WKDW�LQVWHDG�RI�FDOOLQJ�WKH�KRRNV�ILOWHU�IXQFWLRQ�IRU�DOO�PHVVDJHV�WKDW�DUH�HLWKHU�VHQW�RU�SRVWHG�WR�FUHDWH�D�ZLQGRZ��LW�ZDLWV�XQWLO�WKH�ZLQGRZ�KDV�EHHQ�FUHDWHG�DQG�WKHQ�DW�WKDW�SRLQW�LWV�ILOWHU�IXQFWLRQ�LV�FDOOHG���7ZR�RI�WKH�FRGHV�WKDW�WKLV�KRRN�LPSOHPHQWV�ZRUN�RQO\�RQ�:LQGRZV������DQG�JUHDWHU�RSHUDWLQJ�V\VWHPV��7KHVH�FRGHV�DUH���+6+(//B$&&(66,%,/,7<67$7(

+6+(//B$33&200$1'

:H�VKRXOG�SD\�DWWHQWLRQ�WR�ZKHQ�WKH�KRRNV�ILOWHU�IXQFWLRQ�LV�FDOOHG��)RU�LQVWDQFH��ZKHQ�ZLQGRZ�LV�FUHDWHG��WKH�+6+(//B:,1'2:&5($7('�FRGH�LV�ILUHG�DIWHU�WKH�ZLQGRZ�LV�FUHDWHG�DQG�GLVSOD\HG��+RZHYHU��LI�WKH�ZLQGRZ�LV�EHLQJ�GHVWUR\HG��WKH�+6+(//B:,1'2:'(6752<('�FRGH�LV�ILUHG�EHIRUH�WKH�ZLQGRZ�LV�UHPRYHG�IURP�WKH�VFUHHQ�DQG�GHVWUR\HG���7KH�+6+(//B7$6.0$1�FRGH�LV�ILUHG�EHIRUH�WKH�:LQGRZV�WDVN�PDQDJHU�LV�RSHQHG��7KLV�LV�WKH�RQO\�KRRN�FRGH�WKDW�DOORZV�\RX�WR�UHWXUQ�D�758(�YDOXH�WR�SUHYHQW�WKH�DFWLRQ�IURP�RFFXUULQJ��1R�RWKHU�KRRN�FRGHV�KDYH�WKLV�DELOLW\���,W�LV�LPSRUWDQW�WR�UHPHPEHU�WKDW�WKH�+6+(//B$33&200$1'�KRRN�FRGH�LV�ILUHG�RQO\�LI�WKH�DSSOLFDWLRQ�LWVHOI�KDV�QRW�SURFHVVHG�WKH�:0B$33&200$1'�PHVVDJH��$OVR�NHHS�LQ�PLQG�WKDW�LI�WKH�ILOWHU�IXQFWLRQ�SURFHVVHV�WKLV�PHVVDJH��\RX�VKRXOG�LPPHGLDWHO\�UHWXUQ�D�758(�WR�SUHYHQW�WKH�&DOO1H[W+RRN([�IXQFWLRQ�IURP�EHLQJ�FDOOHG���$QG�UHPHPEHU��WKLV�KRRN�RSHUDWHV�RQO\�RQ�WRS�OHYHO�XQRZQHG�ZLQGRZV��7KLV�KRRN�LJQRUHV�PHVVDJH�ER[HV�DQG�RWKHU�YDULRXV�RZQHG�RU�FKLOG�ZLQGRZV���

Page 428: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU�����:+B&%7�<RX�XVH�WKH�:+B&%7�KRRN�SULPDULO\�IRU�EXLOGLQJ�&RPSXWHU�%DVHG�7UDLQLQJ��&%7��DSSOLFDWLRQV��$�&%7�DSSOLFDWLRQ�WUDLQV�D�XVHU�WR�XVH�DQ�DSSOLFDWLRQ��8VXDOO\��LW�ZLOO�SUHVHQW�D�WH[W�EDVHG�VHW�RI�LQVWUXFWLRQV�IRU�XVLQJ�WKH�DSSOLFDWLRQ��KRZHYHU��LW�DOVR�FDQ�FRQWDLQ�PXOWLPHGLD�GHPRQVWUDWLRQV��%XW�WKH�UHDO�SRZHU�RI�&%7�LV�LWV�DELOLW\�WR�ZDON�WKH�XVHU�WKURXJK�VSHFLILF�SLHFHV�RI�WKH�DSSOLFDWLRQ�LQ�ZKLFK�WKH�XVHU�LV�EHLQJ�WUDLQHG��7KH�UHDO�PDJLF�EHKLQG�&%7�LV�WKH�:+B&%7�KRRN��DOWKRXJK�\RX�FDQ�W\SLFDOO\�XVH�RWKHU�KRRNV�DV�ZHOO��LQFOXGLQJ�WKH�:+B-2851$/3/$<%$&.�KRRN�DQG�WKH�:+B0286(�DQG�:+B.(<%2$5'�KRRNV���/HWV�VWHS�WKURXJK�D�SRUWLRQ�RI�DQ�H[DPSOH�&%7�DSSOLFDWLRQ����LQ�WKLV�FDVH��D�VLPSOH�RQH�LQ�ZKLFK�WKH�XVHU�LV�OHDUQLQJ�KRZ�WR�VDYH�DQ�([FHO�VSUHDGVKHHW��:KHQ�WKH�&%7�DSSOLFDWLRQ�VWDUWV�DQ�([FHO�DSSOLFDWLRQ�DQG�RSHQV�D�VDPSOH�VSUHDGVKHHW��LW�JDWKHUV�VRPH�JHQHUDO�LQIRUPDWLRQ�DERXW�WKH�DSSOLFDWLRQ�WKDW�ZLOO�WHOO�LW�ZKDW�WKH�XVHU�LV�GRLQJ�LQ�([FHO��LQFOXGLQJ���

• 7KH�3URFHVV,'�• 7KH�KDQGOH�WR�WKH�WRS�OHYHO�ZLQGRZ�• 7KH�KDQGOH�WR�WKH�PDLQ�PHQX�• 7KH�SRVLWLRQ�RI�WKH�WRS�OHYHO�ZLQGRZ�

1H[W��WKH�DSSOLFDWLRQ�SUHVHQWV�WKH�XVHU�ZLWK�LQVWUXFWLRQV�RQ�KRZ�WR�VDYH�D�VSUHDGVKHHW��SRVVLEO\�LQFOXGLQJ�D�PXOWLPHGLD�SUHVHQWDWLRQ�DV�ZHOO��$IWHU�UHDGLQJ�WKH�H[SODQDWLRQ��WKH�XVHU�LV�SURPSWHG�WR�SHUIRUP�WKH�6DYH�RSHUDWLRQ�RQ�WKH�UXQQLQJ�LQVWDQFH�RI�([FHO��7KLV�LV�ZKHUH�WKH�:+B&%7�KRRN�FRPHV�LQWR�SOD\��WKH�KRRN�LV�LQVWDOOHG�EHIRUH�WKH�XVHU�DFWXDOO\�SHUIRUPV�WKH�6DYH�RSHUDWLRQ�DQG�LV�UHOHDVHG�DIWHU�WKH�XVHU�LV�ILQLVKHG�SHUIRUPLQJ�WKH�RSHUDWLRQ�DQG�WKH�KRRN�LV�QR�ORQJHU�QHHGHG��:KLOH�LW�LV�LQVWDOOHG��WKH�KRRN�PDNHV�LW�SRVVLEOH�WR�ZDWFK�NH\�DFWLRQV�WKDW�WKH�XVHU�PDNHV���7KH�&%7�PLJKW�DOVR�QHHG�WR�LQVWDOO�WKH�:+B0286(�DQG�RU�:+B.(<%2$5'�KRRNV�VR�WKDW�LW�FDQ�EH�QRWLILHG�RI�PRUH�VSHFLILF�DFWLRQV�WKDW�WKH�XVHU�LV�SHUIRUPLQJ��ZKLFK�WKH�:+B&%7�KRRN�PLJKW�QRW�EH�DEOH�WR�VHH����8VLQJ�WKH�:+B&%7�KRRN��WKH�&%7�DSSOLFDWLRQ�FDQ�ZDWFK�WKH�XVHU�VHOHFW�WKH�)LOH�PHQX�LWHP�DQG�WKHQ�FOLFN�WKH�6DYH�PHQX�LWHP��,I�WKLV�LV�WKH�ILUVW�WLPH�WKH�VSUHDGVKHHW�LV�EHLQJ�VDYHG��D�6DYH�GLDORJ�ZLOO�EH�GLVSOD\HG�DOORZLQJ�WKH�XVHU�WR�FKRRVH�ZKHUH�DQG�KRZ�WR�VDYH�WKH�VSUHDGVKHHW��7KH�:+B&%7�KRRN�DOVR�FDQ�VHH�WKH�6DYH�GLDORJ�EHLQJ�GLVSOD\HG�DQG�ZLOO�IROORZ�WKH�XVHUV�DFWLRQV�ZLWKLQ�WKH�6DYH�GLDORJ��,I�WKH�XVHU�GHYLDWHV�IURP�WKH�ZD\�WKDW�WKH�&%7�DSSOLFDWLRQ�ZDQWV�WKH�XVHU�WR�VDYH�D�VSUHDGVKHHW��WKHQ�WKH�&%7�DSSOLFDWLRQ�FDQ�UDLVH�D�ZDUQLQJ�VWDWLQJ�WKDW�WKH�XVHU�LV�QRW�IROORZLQJ�WKH�FRUUHFW�SURFHGXUH��7KLV�LV�D�GLIILFXOW�SURFHVV�IRU�WKH�&%7�DSSOLFDWLRQ�WR�SHUIRUP�EHFDXVH�WKH�XVHU�FDQ�SHUIRUP�PDQ\�GLIIHUHQW�DFWLRQV��DQG�HYHQ�VDYH�WKH�VSUHDGVKHHW�LQ�PDQ\�GLIIHUHQW�ZD\V��)RU�H[DPSOH��WKH�XVHU�FRXOG�XVH�WKH�&WUO�6�NH\�FRPELQDWLRQ��RU�WKH�)LOH� 6DYH�RU�)LOH� 6DYH�$V�PHQX�FRPPDQGV�WR�VDYH�WKH�VSUHDGVKHHW��7KLV�LV�WKH�UHDO�FKDOOHQJH�RI�FUHDWLQJ�D�&%7�DSSOLFDWLRQ���

Page 429: Visual Basic - Subclassing and Hooking with VB & VB NET

,I�WKH�XVHU�FRPSOHWHV�WKH�6DYH�RSHUDWLRQ�FRUUHFWO\��WKH�&%7�DSSOLFDWLRQ�FDQ�GLVSOD\�D�FRQJUDWXODWRU\�PHVVDJH��+RZHYHU��LI�WKH�XVHU�IDLOV�WR�FRPSOHWH�WKH�RSHUDWLRQ�FRUUHFWO\�RU�LQ�WKH�ULJKW�RUGHU��WKH�&%7�DSSOLFDWLRQ�FDQ�SURPSW�WKH�XVHU�WR�VKRZ�WKH�FRUUHFW�SURFHVV��7KLV�LV�ZKHUH�WKH�:+B-2851$/3/$<%$&.�KRRN�FRPHV�LQWR�SOD\��<RX�LQVWDOO�DQG�XVH�WKLV�KRRN�WR�SOD\�EDFN�D�SUHUHFRUGHG�VWULQJ�RI�PHVVDJHV�DJDLQVW�WKH�([FHO�DSSOLFDWLRQ��7KLV�VWULQJ�RI�PHVVDJHV�PLJKW�ORRN�VRPHWKLQJ�OLNH�WKLV���

��� 3RVLWLRQ�WKH�PRXVH�SRLQWHU�RYHU�WKH�([FHO�DSSOLFDWLRQV�)LOH�PHQX������ &OLFN�WKH�)LOH�PHQX����� 3RVLWLRQ�WKH�PRXVH�SRLQWHU�RYHU�WKH�6DYH�PHQX�LWHP����� &OLFN�WKH�6DYH�PHQX�LWHP��7KH�6DYH�GLDORJ�ER[�LV�GLVSOD\HG�KHUH�ZLWK�WKH�IRFXV�RQ�

WKH��)LOH�QDPH��WH[W�ER[������ $�ILOHQDPH�LV�W\SHG�LQWR�WKH��)LOH�QDPH��WH[W�ER[�LQ�WKH�6DYH�GLDORJ�ER[������ 7KH�FRUUHFW�GLUHFWRU\�LQ�ZKLFK�WR�VDYH�WKH�ILOH�LV�FKRVHQ����� 7KH�6DYH�EXWWRQ�LV�FOLFNHG��

$IWHU�WKLV�VWULQJ�RI�SUHUHFRUGHG�PHVVDJHV�LV�SOD\HG�EDFN��WKH�:+B-2851$/3/$<%$&.�KRRN�LV�UHOHDVHG�DQG�WKH�XVHU�FDQ�UHWU\�WKH�RSHUDWLRQ�RU�JR�EDFN�WR�UHUHDG�WKH�ILQHU�SRLQWV�RI�VDYLQJ�D�VSUHDGVKHHW���$V�\RX�FDQ�VHH��WKH�:+B&%7�KRRN�LV�FHQWUDO�WR�ZULWLQJ�&%7�DSSOLFDWLRQV��%XW�EHFDXVH�RI�WKH�DPRXQW�RI�IXQFWLRQDOLW\�EXLOW�LQWR�WKLV�KRRN��\RX�PLJKW�ILQG�PDQ\�RWKHU�LQWHUHVWLQJ�XVHV�IRU�WKLV�KRRN�DV�ZHOO���:LWK�WKH�GHVFULSWLRQ�RI�&%7�RXW�RI�WKH�ZD\��OHWV�JHW�LQWR�WKH�QXWV�DQG�EROWV�RI�WKH�:+B&%7�KRRN���

�����'HVFULSWLRQ�

7KH�:+B&%7�KRRN�FDSWXUHV�D�ZLGH�YDULHW\�RI�LQIRUPDWLRQ�DERXW�WKH�DFWLRQV�D�XVHU�LV�SHUIRUPLQJ�RQ�WKH�V\VWHP��7KH�V\VWHP�QRWLILHV�WKH�:+B&%7�KRRN�EHIRUH�DQ\�RI�WKH�IROORZLQJ�DFWLRQV�RFFXU���

• $�ZLQGRZ�LV�FUHDWHG��• $�ZLQGRZ�LV�GHVWUR\HG��• $�ZLQGRZ�LV�DFWLYDWHG��• $�ZLQGRZ�LV�PRYHG��• $�ZLQGRZ�LV�VL]HG��• $�ZLQGRZ�LV�PLQLPL]HG��• $�ZLQGRZ�LV�PD[LPL]HG��• 7KH�LQSXW�IRFXV�LV�VHW�WR�D�GLIIHUHQW�ZLQGRZ��

Page 430: Visual Basic - Subclassing and Hooking with VB & VB NET

• $�XVHU�FRPSOHWHV�D�V\VWHP�FRPPDQG��6\VWHP�FRPPDQGV�RULJLQDWH�IURP�D�ZLQGRZV�V\VWHP�PHQX��PD[LPL]H�EXWWRQ��PLQLPL]H�EXWWRQ��UHVWRUH�EXWWRQ��RU�FORVH�EXWWRQ���

• $�PRXVH�PHVVDJH�LV�UHPRYHG�IURP�WKH�UDZ�LQSXW�WKUHDG��5,7���• $�NH\ERDUG�PHVVDJH�LV�UHPRYHG�IURP�WKH�5,7��• 7KH�FXUUHQW�WKUHDG�LV�V\QFKURQL]HG�ZLWK�WKH�5,7��

%HFDXVH�WKLV�QRWLILFDWLRQ�RFFXUV�EHIRUH�DQ\�RI�WKHVH�DFWLRQV��\RX�FDQ�SUHYHQW�WKH�DFWLRQ�IURP�RFFXUULQJ�E\�SDVVLQJ�EDFN�D�QRQ]HUR�UHWXUQ�YDOXH�IURP�WKH�ILOWHU�IXQFWLRQ���<RX�FDQ�XVH�WKLV�KRRN�DV�D�WKUHDG�VSHFLILF�KRRN��RU�\RX�FDQ�SODFH�LW�LQ�D�G\QDPLF�OLQN�OLEUDU\��'//��DQG�XVH�LW�DV�D�V\VWHP�ZLGH�KRRN��$�WKUHDG�VSHFLILF�KRRN�LQWHUFHSWV�DOO�PHVVDJHV�ZLWKLQ�WKH�WKUHDG�LQ�ZKLFK�LW�LV�LQVWDOOHG��:KHQ�\RX�LQVWDOO�D�KRRN�DV�D�V\VWHP�ZLGH�KRRN��\RX�PXVW�SODFH�LW�LQ�D�'//��7KLV�'//�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�VR�WKDW�WKH�KRRN�FDQ�RSHUDWH�RQ�DOO�PHVVDJHV�LQ�WKH�V\VWHP��&KDSWHU���GLVFXVVHV�WKLV�LQ�GHWDLO���

�������)LOWHU�)XQFWLRQ�'HILQLWLRQ�

7KH�ILOWHU�IXQFWLRQ�IRU�WKH�:+B&%7�KRRN�LV�GHILQHG�DV�IROORZV���3XEOLF�)XQFWLRQ�&%73URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B��������������������������%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�7KH�ILOWHU�IXQFWLRQV�SDUDPHWHUV�DUH�GHILQHG�DV�IROORZV��X&RGH

7KH�FRGH�WKH�V\VWHP�SDVVHV�LQ�WR�WKH�IXQFWLRQ��7KH�QH[W�VHFWLRQ�H[SODLQV�WKH�YDOLG�FRGHV�IRU�WKLV�KRRN���

Z3DUDP

7KH�YDOXH�GHSHQGV�RQ�WKH�X&RGH�WKDW�LV�SDVVHG�WR�WKH�IXQFWLRQ���O3DUDP

7KH�YDOXH�GHSHQGV�RQ�WKH�X&RGH�WKDW�LV�SDVVHG�WR�WKH�IXQFWLRQ���7KH�UHWXUQ�YDOXH�IRU�WKLV�ILOWHU�IXQFWLRQ�VKRXOG�EH�WKH�UHWXUQ�YDOXH�RI�WKH�&DOO1H[W+RRN([�IXQFWLRQ��,I�WKLV�IXQFWLRQ�LV�QRW�FDOOHG��UHWXUQ�D�]HUR��7R�SUHYHQW�WKH�DFWLRQ�IURP�RFFXUULQJ��UHWXUQ�D����,�GR�QRW�UHFRPPHQG�VNLSSLQJ�WKH�FDOO�WR�&DOO1H[W+RRN([��WKRXJK��)DLOLQJ�WR�FDOO�WKLV�IXQFWLRQ�ZLOO�SUHYHQW�RWKHU�ILOWHU�IXQFWLRQV�LQ�WKH�FKDLQ�IURP�EHLQJ�FDOOHG���7KH�X&RGH�VHQW�WR�WKLV�IXQFWLRQ�ZLOO�HLWKHU�EH�RQH�RI�WKH�+&%7B �FRGHV�VSHFLILFDOO\�XVHG�ZLWK�WKLV�KRRN��RU�D�QHJDWLYH�QXPEHU��,I�DQ\�RI�WKH�+&%7B �FRGHV�LV�SDVVHG�DV�DQ�DUJXPHQW��WKH�ILOWHU�IXQFWLRQ�VKRXOG�SURFHVV�WKH�LQIRUPDWLRQ�SDVVHG�WR�LW��,I�WKH�X&RGH�DUJXPHQW�LV�D�QHJDWLYH�QXPEHU��\RX�VKRXOG�FDOO�&DOO1H[W+RRN([�LPPHGLDWHO\��DQG�WKH�ILOWHU�IXQFWLRQ�VKRXOG�QRW�SURFHVV�DQ\�LQIRUPDWLRQ�SDVVHG�WR�LW���

�������([SODQDWLRQ�RI�+RRN�&RGHV�

Page 431: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�V\VWHP�FDQ�VHQG�WKH�IROORZLQJ����KRRN�FRGHV�WR�WKLV�KRRN��%HFDXVH�WKH�O3DUDP�DQG�Z3DUDP�SDUDPHWHUV�IRU�WKLV�KRRN�IXQFWLRQ�GHSHQG�RQ�WKH�KRRN�FRGH��HDFK�FRGH�GHVFULSWLRQ�DOVR�FRQWDLQV�D�GHILQLWLRQ�RI�WKH�FRGHV�FRUUHVSRQGLQJ�O3DUDP�DQG�Z3DUDP�SDUDPHWHUV��7KH�FRGHV�DUH���HCBT_SETFOCUS

1RWLILHV�WKH�KRRN�WKDW�WKH�XVHU�LV�FDXVLQJ�D�QHZ�FRQWURO�FRQWDLQHG�LQ�D�ZLQGRZ�WR�UHFHLYH�WKH�IRFXV��,Q�WKLV�FDVH��D�ZLQGRZ�UHIHUV�RQO\�WR�D�FRQWURO�FRQWDLQHG�ZLWKLQ�D�SDUHQW�ZLQGRZ��7KHUHIRUH��WKH�:+B&%7�KRRN�ZLOO�EH�VHQW�WKLV�FRGH�ZKHQHYHU�WKH�XVHU�FKDQJHV�WKH�DFWLYH�FRQWURO�RQ�D�ZLQGRZ�WR�D�QHZ�FRQWURO��EXW�QRW�ZKHQ�WKH�XVHU�FKDQJHV�WKH�DFWLYH�ZLQGRZ�WR�D�GLIIHUHQW�ZLQGRZ��7KH�ILOWHU�IXQFWLRQ�FDQ�UHWXUQ�D�QRQ]HUR�YDOXH�WR�SUHYHQW�WKH�QHZ�FRQWURO�IURP�JDLQLQJ�WKH�IRFXV��7KH�RWKHU�SDUDPHWHUV�SDVVHG�WR�WKH�ILOWHU�IXQFWLRQ�DUH���

Z3DUDP

7KH�K:QG�RI�WKH�ZLQGRZ�JDLQLQJ�WKH�IRFXV�O3DUDP

7KH�K:QG�RI�WKH�ZLQGRZ�ORVLQJ�WKH�IRFXV�7KH�+&%7B6(7)2&86�FRQVWDQW�LV�GHILQHG�DV�IROORZV��3XEOLF�&RQVW�+&%7B6(7)2&86� ���HCBT_ACTIVATE

1RWLILHV�WKH�KRRN�WKDW�WKH�XVHU�LV�DFWLYDWLQJ�D�GLIIHUHQW�ZLQGRZ��,Q�WKLV�FDVH��WKH�KRRN�LV�QRWLILHG�RQO\�ZKHQ�D�ZLQGRZ����L�H���D�9LVXDO�%DVLF��9%��IRUP�UDWKHU�WKDQ�D�FRQWURO����LV�DFWLYDWHG��XVH�+&%7B6(7)2&86�WR�GHWHUPLQH�ZKHQ�D�FRQWURO�UHFHLYHV�WKH�IRFXV��1RWH��KRZHYHU��WKDW�XVXDOO\�D�FRQWURO�LV�JLYHQ�WKH�IRFXV�RQ�D�QHZO\�DFWLYDWHG�ZLQGRZ��,Q�WKHVH�FDVHV��\RX�ZLOO�VHH�+&%7B$&7,9$7(�IROORZHG�LPPHGLDWHO\�E\�+&%7B6(7)2&86��7KH�ILOWHU�IXQFWLRQ�FDQ�UHWXUQ�D�QRQ]HUR�YDOXH�WR�SUHYHQW�WKH�ZLQGRZ�IURP�EHLQJ�DFWLYDWHG��7KH�RWKHU�SDUDPHWHUV�SDVVHG�WR�WKH�ILOWHU�IXQFWLRQ�DUH���

Z3DUDP

7KH�K:QG�RI�WKH�ZLQGRZ�WKDW�LV�DERXW�WR�EHFRPH�DFWLYH��O3DUDP

$�SRLQWHU�WR�D�&%7$&7,9$7(6758&7�VWUXFWXUH��ZKLFK�LV�GHILQHG�DV�IROORZV���3XEOLF�7\SH�&%7$&7,9$7(6758&7�� I0RXVH�$V�/RQJ�� K:QG$FWLYH�$V�/RQJ�(QG�7\SH�7DEOH������GHVFULEHV�WKH�PHPEHUV�RI�WKH�&%7$&7,9$7(6758&7�VWUXFWXUH���

7DEOH�������0HPEHUV�RI�WKH�&%7$&7,9$7(6758&7�6WUXFWXUH��0HPEHU� 'HVFULSWLRQ�

I0RXVH� 7UXH�LI�D�PRXVH�FOLFN�DFWLYDWHG�WKH�ZLQGRZ��RWKHUZLVH�)DOVH��LQGLFDWLQJ�WKDW�VRPHWKLQJ�HOVH��VXFK�DV�DQ�$/7�7$%�NH\�FRPELQDWLRQ��DFWLYDWHG�WKH�ZLQGRZ��

Page 432: Visual Basic - Subclassing and Hooking with VB & VB NET

K:QG$FWLYH�7KH�KZQG�RI�WKH�DFWLYH�ZLQGRZ�7KLV�FRQVWDQW�LV�GHILQHG�DV�IROORZV��3XEOLF�&RQVW�+&%7B$&7,9$7(� ���HCBT_MINMAX

1RWLILHV�WKH�KRRN�WKDW�WKH�XVHU�LV�DERXW�WR�PLQLPL]H�RU�PD[LPL]H�D�ZLQGRZ��7KH�ILOWHU�IXQFWLRQ�FDQ�UHWXUQ�D�QRQ]HUR�YDOXH�WR�SUHYHQW�WKH�PLQLPL]H�RU�PD[LPL]H�RSHUDWLRQ��7KH�RWKHU�SDUDPHWHUV�SDVVHG�WR�WKH�ILOWHU�IXQFWLRQ�DUH���Z3DUDP

7KH�K:QG�WR�WKH�ZLQGRZ�WKDW�WKH�XVHU�LV�PLQLPL]LQJ�RU�PD[LPL]LQJ��O3DUDP

7KH�ORZ�RUGHU�ZRUG�RI�WKLV�SDUDPHWHU�LV�RQH�RI�WKH�IROORZLQJ�YDOXHV��3XEOLF�&RQVW�6:B0$;,0,=(� ����������0D[LPL]HV�WKH�ZLQGRZ�3XEOLF�&RQVW�6:B0,1,0,=(� ����������0LQLPL]HV�WKH�ZLQGRZ�3XEOLF�&RQVW�6:B6+2:0$;,0,=('� �����$FWLYDWHV�DQG�PLQLPL]HV�WKH�ZLQGRZ�3XEOLF�&RQVW�6:B6+2:0,1,0,=('� �����$FWLYDWHV�DQG�PD[LPL]HV�WKH�ZLQGRZ�3XEOLF�&RQVW�6:B6+2:0,112$&7,9(� ���0LQLPL]HV�WKH�ZLQGRZ�DQG��������������������������������������GRHV�QRW�DFWLYDWH�LW�7KH�KLJK�RUGHU�ZRUG�RI�WKLV�SDUDPHWHU�LV�XQGHILQHG��7R�ILQG�WKH�ORZ�RUGHU�ZRUG�RI�O3DUDP��VLPSO\�$1'�O3DUDP�ZLWK�WKH�YDOXH�+))))���7KH�+&%7B0,10$;�FRQVWDQW�LV�GHILQHG�DV�IROORZV��3XEOLF�&RQVW�+&%7B0,10$;� ���HCBT_MOVESIZE

1RWLILHV�WKH�KRRN�WKDW�WKH�XVHU�LV�DERXW�WR�PRYH�RU�VL]H�D�ZLQGRZ��7KH�ILOWHU�IXQFWLRQ�FDQ�UHWXUQ�D�QRQ]HUR�YDOXH�WR�SUHYHQW�WKH�ZLQGRZ�IURP�EHLQJ�PRYHG�RU�VL]HG��7KH�RWKHU�SDUDPHWHUV�SDVVHG�WR�WKH�ILOWHU�IXQFWLRQ�DUH���Z3DUDP

7KH�K:QG�RI�WKH�ZLQGRZ�WKDW�WKH�XVHU�LV�PRYLQJ�RU�VL]LQJ��O3DUDP

3RLQWHU�WR�D�5(&7�VWUXFWXUH��ZKLFK�LV�GHILQHG�DV�IROORZV���3XEOLF�7\SH�5(&7�� /HIW�$V�/RQJ�� 7RS�$V�/RQJ�� 5LJKW�$V�/RQJ�� %RWWRP�$V�/RQJ�(QG�7\SH�<RX�FDQ�PRGLI\�WKH�YDOXHV�LQ�WKLV�VWUXFWXUH�WR�FRQWURO�WKH�ILQDO�GHVWLQDWLRQ�RI�D�ZLQGRZ�ZKHQ�WKH�XVHU�LV�PRYLQJ�LW��RU�WKH�ILQDO�VL]H�RI�D�ZLQGRZ�ZKHQ�WKH�XVHU�LV�VL]LQJ�LW���7KH�+&%7B029(6,=(�FRQVWDQW�LV�GHILQHG�DV�IROORZV��3XEOLF�&RQVW�+&%7B029(6,=(� ���HCBT_DESTROYWND

Page 433: Visual Basic - Subclassing and Hooking with VB & VB NET

1RWLILHV�WKH�KRRN�WKDW�D�ZLQGRZ�LV�DERXW�WR�EH�GHVWUR\HG��7KH�ILOWHU�IXQFWLRQ�FDQ�UHWXUQ�D�QRQ]HUR�YDOXH�WR�SUHYHQW�WKH�ZLQGRZV�GHVWUXFWLRQ��7KH�RWKHU�SDUDPHWHUV�SDVVHG�WR�WKH�ILOWHU�IXQFWLRQ�DUH���Z3DUDP

7KH�K:QG�WR�WKH�ZLQGRZ�DERXW�WR�EH�GHVWUR\HG�O3DUDP

1RW�XVHG�7KH�FRQVWDQW�LV�GHILQHG�DV�IROORZV���3XEOLF�&RQVW�+&%7B'(6752<:1'� ���

HCBT_CREATEWND

1RWLILHV�WKH�KRRN�WKDW�WKH�XVHU�LV�DERXW�WR�FUHDWH�D�ZLQGRZ���7KH�RWKHU�SDUDPHWHUV�SDVVHG�WR�WKH�ILOWHU�IXQFWLRQ�DUH���Z3DUDP

7KH�K:QG�RI�WKH�ZLQGRZ�WKDW�WKH�XVHU�LV�DERXW�WR�FUHDWH�O3DUDP

$�SRLQWHU�WR�D�&%7B&5($7(:1'�VWUXFWXUH��ZKLFK�LV�GHILQHG�DV�IROORZV���3XEOLF�7\SH�&%7B&5($7(:1'�� OSFV�$V�&5($7(6758&7�� K:QG,QVHUW$IWHU�$V�/RQJ�(QG�7\SH�7DEOH������VKRZV�WKH�PHPEHUV�RI�WKH�&%7B&5($7(:1'�VWUXFWXUH���

7DEOH�������0HPEHUV�RI�WKH�&%7B&5($7(:1'�6WUXFWXUH��0HPEHU� 'HVFULSWLRQ�

OSFV�

3RLQWHU�WR�D�&5($7(6758&7�VWUXFWXUH��ZKLFK�LV�GHILQHG�DV�IROORZV���3XEOLF�7\SH�&5($7(6758&7�����OS&UHDWH3DUDPV�$V�/RQJ�����K,QVWDQFH�$V�/RQJ�����K0HQX�$V�/RQJ�����K:QG3DUHQW�$V�/RQJ�����F\�$V�/RQJ�����F[�$V�/RQJ�����\�$V�/RQJ�����[�$V�/RQJ�����VW\OH�$V�/RQJ�����OSV]1DPH�$V�6WULQJ�����OSV]&ODVV�$V�6WULQJ�����([6W\OH�$V�/RQJ�(QG�7\SH�,�GLVFXVVHG�WKLV�VWUXFWXUH�LQ�GHWDLO�LQ�&KDSWHU����<RX�FDQ�PRGLI\�WKH�

Page 434: Visual Basic - Subclassing and Hooking with VB & VB NET

PHPEHUV�RI�WKLV�VWUXFWXUH�WR�FKDQJH�WKH�SURSHUWLHV�RI�WKH�QHZ�ZLQGRZ��)RU�LQVWDQFH��\RX�FDQ�VXEVWLWXWH�D�QHZ�PHQX�KDQGOH�LQ�WKH�K0HQX�PHPEHU��RU�\RX�FDQ�PRGLI\�WKH�[��\��F[��DQG�F\�PHPEHUV�WR�FKDQJH�WKH�LQLWLDO�SRVLWLRQ�DQG�VL]H�RI�WKH�ZLQGRZ���

K:QG,QVHUW$IWHU�7KH�K:QG�RI�WKH�ZLQGRZ�ZKRVH�SRVLWLRQ�LQ�WKH�=�RUGHU�LV�WR�SUHFHGH�WKH�ZLQGRZ�EHLQJ�FUHDWHG��<RX�FDQ�PRGLI\�K:QG,QVHUW$IWHU�WR�FKDQJH�WKH�SRVLWLRQ�LQ�WKH�=�RUGHU�RI�WKH�ZLQGRZ�WKDW�LV�EHLQJ�FUHDWHG���

7KH�+&%7B&5($7(:1'�FRQVWDQW�LV�GHILQHG�DV�IROORZV��3XEOLF�&RQVW�+&%7B&5($7(:1'� ���HCBT_SYSCOMMAND

1RWLILHV�WKH�KRRN�WKDW�D�V\VWHP�FRPPDQG�LV�DERXW�WR�EH�SURFHVVHG��7KH�ILOWHU�IXQFWLRQ�FDQ�UHWXUQ�D�QRQ]HUR�YDOXH�WR�GLVDEOH�WKH�V\VWHP�FRPPDQG�WKDW�WKH�XVHU�VHOHFWV��7KH�RWKHU�SDUDPHWHUV�SDVVHG�WR�WKH�ILOWHU�IXQFWLRQ�DUH���Z3DUDP

7KH�W\SH�RI�V\VWHP�FRPPDQG�WKDW�WKH�XVHU�VHOHFWHG��9DOLG�YDOXHV�IRU�WKLV�SDUDPHWHU�DUH���3XEOLF�&RQVW�6&B&/26(� �+)���������&ORVH�WKH�ZLQGRZ�3XEOLF�&RQVW�6&B+27.(<� �+)��������$FWLYDWHV�ZQG�DVVRFLDWHG�ZLWK����������������������������������������������WKH�KRWNH\�3XEOLF�&RQVW�6&B+6&52//� �+)�������6FUROO�KRUL]RQWDOO\�3XEOLF�&RQVW�6&B.(<0(18� �+)�������*HWV�ZQG�PHQX�DV�WKH�UHVXOW�RI�D��������������������������������������NH\SUHVV�3XEOLF�&RQVW�6&B021,72532:(5� �+����)RUFHV�WKH�GLVSOD\�WR�D�ORZ�SRZHU��������������������������������������RU�RII�VHWWLQJ�3XEOLF�&RQVW�6&B0$;,0,=(� �+)������0D[LPL]H�WKH�ZLQGRZ�3XEOLF�&RQVW�6&B0,1,0,=(� �+)������0LQLPL]H�WKH�ZLQGRZ�3XEOLF�&RQVW�6&B0286(0(18� �+)�����*HWV�ZQG�PHQX�DV�WKH�UHVXOW�RI�D��������������������������������������PRXVH�FOLFN�3XEOLF�&RQVW�6&B029(� �+)����������0RYH�WKH�ZLQGRZ�3XEOLF�&RQVW�6&B1(;7:,1'2:� �+)����$FWLYDWHV�WKH�QH[W�ZLQGRZ�3XEOLF�&RQVW�6&B35(9:,1'2:� �+)����$FWLYDWHV�WKH�SUHYLRXV�ZLQGRZ�3XEOLF�&RQVW�6&B5(6725(� �+)�������5HVWRUHV�WKH�FXUUHQW�ZLQGRZ�WR�LWV��������������������������������������RULJLQDO�VWDWH�3XEOLF�&RQVW�6&B6&5((16$9(� �+)����6WDUWV�WKH�VFUHHQVDYHU�3XEOLF�&RQVW�6&B6,=(� �+)����������6L]HV�WKH�ZLQGRZ�3XEOLF�&RQVW�6&B7$6./,67� �+)������$FWLYDWHV�WKH�6WDUW�PHQX�3XEOLF�&RQVW�6&B96&52//� �+)�������6FUROO�YHUWLFDOO\�3XEOLF�&RQVW�6&B,&21� �6&B0,1,0,=(���7KH�ZLQGRZ�LV�EHLQJ�PLQLPL]HG�3XEOLF�&RQVW�6&B=220� �6&B0$;,0,=(���7KH�ZLQGRZ�LV�EHLQJ�PD[LPL]HG�

Page 435: Visual Basic - Subclassing and Hooking with VB & VB NET

O3DUDP

,I�WKH�XVHU�XVHG�WKH�PRXVH�WR�VHOHFW�WKH�V\VWHP�FRPPDQG�IURP�WKH�ZLQGRZ�PHQX��WKH�ORZ�RUGHU�ZRUG�RI�WKLV�SDUDPHWHU�FRQWDLQV�WKH�PRXVH�SRLQWHUV�[�FRRUGLQDWH��DQG�WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�PRXVH�SRLQWHUV�\�FRRUGLQDWH��,I�WKH�XVHU�GLG�QRW�XVH�WKH�PRXVH��WKH�ORZ�RUGHU�ZRUG�RI�WKLV�SDUDPHWHU�LV�QRW�XVHG��DQG�WKH�KLJK�RUGHU�ZRUG�LV����LI�D�V\VWHP�DFFHOHUDWRU�NH\�ZDV�XVHG��RU�]HUR�LI�D�PQHPRQLF�ZDV�XVHG��7KH�IROORZLQJ�IXQFWLRQ�ZLOO�UHWXUQ�WKH�KLJK�RUGHU�ZRUG���3XEOLF�)XQFWLRQ�*HW+L:RUG�%\5HI�9DOXH�$V�/RQJ��$V�/RQJ����,I��9DOXH�$QG�+���������� �+���������7KHQ�������*HW+L:RUG� ���9DOXH�$QG�+�)))������?�+�������2U�+��������(OVH�������*HW+L:RUG� ��9DOXH�$QG�+))))������?�+���������(QG�,I�(QG�)XQFWLRQ�7KH�+&%7B6<6&200$1'�FRQVWDQW�LV�GHILQHG�DV�IROORZV��3XEOLF�&RQVW�+&%7B6<6&200$1'� ���HCBT_QS

8VHG�E\�WKH�KRRN�WR�V\QFKURQL]H�EHWZHHQ�PHVVDJHV�WKDW�D�:+B-2851$/3/$<%$&.�KRRN�SOD\V�EDFN�DQG�PHVVDJHV�WKDW�WKH�PRXVH�DQG�NH\ERDUG�QRUPDOO\�VHQG���,�SURYLGH�PRUH�LQIRUPDWLRQ�DERXW�KRZ�WR�XVH�WKLV�FRGH�ODWHU�LQ�WKLV�FKDSWHU���7KH�V\VWHP�LJQRUHV�WKLV�KRRNV�UHWXUQ�YDOXH��7KH�RWKHU�SDUDPHWHUV�SDVVHG�WR�WKH�ILOWHU�IXQFWLRQ�DUH���Z3DUDP

1RW�XVHG�O3DUDP

1RW�XVHG�7KH�FRQVWDQW�LV�GHILQHG�DV�IROORZV��3XEOLF�&RQVW�+&%7B46� ���HCBT_KEYSKIPPED

,QGLFDWHV�WKDW�D�NH\ERDUG�PHVVDJH�KDV�EHHQ�UHPRYHG�IURP�WKH�5,7���,�SURYLGH�PRUH�LQIRUPDWLRQ�DERXW�KRZ�WR�XVH�WKLV�FRGH�ODWHU�LQ�WKLV�FKDSWHU���7KH�V\VWHP�LJQRUHV�WKLV�KRRNV�UHWXUQ�YDOXH��7KH�RWKHU�SDUDPHWHUV�SDVVHG�WR�WKH�ILOWHU�IXQFWLRQ�DUH���Z3DUDP

7KH�YLUWXDO�NH\�FRGH�RI�WKH�NH\�WKDW�WKH�XVHU�W\SHG��O3DUDP

7KH�UHSHDW�FRXQW��VFDQ�FRGH��H[WHQGHG�NH\�IODJ��FRQWH[W�FRGH��SUHYLRXV�NH\�VWDWH�IODJ��DQG�WUDQVLWLRQ�VWDWH�IODJ�RI�WKH�NH\�WKDW�WKH�XVHU�W\SHG��7KH�O3DUDP�SDUDPHWHU�LV�GLYLGHG�LQWR�WKH�ELW�ILHOGV�VKRZQ�LQ�7DEOH��������

7DEOH�������%LW�)LHOGV�RI�WKH�O3DUDP�3DUDPHWHU�IRU�WKH�+&%7B.(<6.,33('�&RGH��%LW�3RVLWLRQV� 'HVFULSWLRQ�

Page 436: Visual Basic - Subclassing and Hooking with VB & VB NET

����� 7KH�UHSHDW�FRXQW�������� 7KH�VFDQ�FRGH����� ,I����WKLV�LV�DQ�H[WHQGHG�NH\��LI����WKLV�LV�QRW�DQ�H[WHQGHG�NH\�������� 5HVHUYHG����� 7KH�FRQWH[W�FRGH��7KLV�YDOXH�LV�IRU�:0B.(<83�PHVVDJHV������ 7KH�SUHYLRXV�NH\�VWDWH��7KLV�YDOXH�LV�IRU�:0B.(<83�PHVVDJHV������ 7KH�7UDQVLWLRQ�VWDWH��7KLV�YDOXH�LV�IRU�:0B.(<83�PHVVDJHV���7KH�+&%7B.(<6.,33('�FRQVWDQW�LV�GHILQHG�DV�IROORZV��3XEOLF�&RQVW�+&%7B.(<6.,33('� ���HCBT_CLICKSKIPPED

,QGLFDWHV�WKDW�D�PRXVH�PHVVDJH�KDV�EHHQ�UHPRYHG�IURP�WKH�5,7���,�SURYLGH�PRUH�LQIRUPDWLRQ�DERXW�KRZ�WR�XVH�WKLV�FRGH�ODWHU�LQ�WKLV�FKDSWHU���7KH�V\VWHP�LJQRUHV�WKLV�KRRNV�UHWXUQ�YDOXH��7KH�RWKHU�SDUDPHWHUV�SDVVHG�WR�WKH�ILOWHU�IXQFWLRQ�DUH���Z3DUDP

7KH�PRXVH�PHVVDJH�WKDW�ZDV�UHPRYHG�IURP�WKH�5,7��O3DUDP

3RLQWHU�WR�D�0286(+22.6758&7�VWUXFWXUH��ZKLFK�LV�GHILQHG�DV�IROORZV���3XEOLF�7\SH�0286(+22.6758&7�� SW�$V�32,17$3,�� KZQG�$V�/RQJ�� Z+LW7HVW&RGH�$V�/RQJ�� GZ([WUD,QIR�$V�/RQJ�(QG�7\SH�7DEOH������VKRZV�WKH�PHPEHUV�RI�WKH�0286(+22.6758&7�VWUXFWXUH���

7DEOH�������0HPEHUV�RI�WKH�0286(+22.6758&7�6WUXFWXUH��0HPEHU� 'HVFULSWLRQ�

SW�

$�SRLQWHU�WR�D�32,17$3,�VWUXFWXUH��ZKLFK�LV�GHILQHG�DV�IROORZV��3XEOLF�7\SH�32,17$3,�[�$V�/RQJ�\�$V�/RQJ�(QG�7\SH�

KZQG� +DQGOH�RI�WKH�ZLQGRZ�WKDW�LV�WR�UHFHLYH�WKH�PRXVH�PHVVDJH�Z+LW7HVW&RGH� 7KH�KLW�WHVW�YDOXH�GZ([WUD,QIR� &RQWDLQV�DQ\�H[WUD�LQIRUPDWLRQ�DVVRFLDWHG�ZLWK�WKH�PHVVDJH�7KH�+&%7B&/,&.6.,33('�FRQVWDQW�LV�GHILQHG�DV�IROORZV���3XEOLF�&RQVW�+&%7B&/,&.6.,33('� ���

Page 437: Visual Basic - Subclassing and Hooking with VB & VB NET

�������&RPSDULQJ�:+B6+(//�WR�:+B&%7�

7KH�FORVHVW�UHODWLYH�WR�WKH�:+B&%7�KRRN�LV�WKH�:+B6+(//�KRRN��&KDSWHU����GHVFULEHV�WKH�:+B6+(//�KRRN�LQ�GHWDLO��*HQHUDOO\�VSHDNLQJ��\RX�XVH�WKH�:+B6+(//�KRRN�WR�UHWULHYH�LQIRUPDWLRQ�IURP�WRS�OHYHO�ZLQGRZV�DQG�WKH�:+B&%7�KRRN�WR�FUHDWH�&%7�DSSOLFDWLRQV��7KDW�LV�QRW�WR�VD\�WKDW�HDFK�KRRN�LV�FRQILQHG�WR�RQO\�ZRUNLQJ�RQ�WRS�OHYHO�ZLQGRZV�RU�RQ�&%7�DSSOLFDWLRQV��WKH�XVH�RI�HDFK�KRRN�LV�OLPLWHG�RQO\�E\�WKH�GHYHORSHUV�LPDJLQDWLRQ���7KH�WZR�KRRNV�DUH�FRPSDUHG�LQ�7DEOH�������$V�\RX�FDQ�VHH��WKH�KRRNV�KRRN�FRGHV�RYHUODS�VRPHZKDW��%XW�LQ�WHUPV�RI�IXQFWLRQDOLW\��WKH�:+B&%7�KRRN�KDV�PRUH�IOH[LELOLW\�DQG�SRZHU�WKDQ�WKH�:+B6+(//�KRRN��7KH�:+B&%7�KRRN�LV�QRWLILHG�RI�HYHQWV�WKDW�RFFXU�RQ�DOO�ZLQGRZV��QRW�MXVW�RQ�WRS�OHYHO�XQRZQHG�ZLQGRZV��DV�LV�WKH�FDVH�ZLWK�WKH�:+B6+(//�KRRN��3RVVLEO\�RI�PRUH�LPSRUWDQFH��WKRXJK��LV�WKH�:+B&%7�KRRNV�DELOLW\�WR�DFWXDOO\�SUHYHQW�WKH�HYHQW�IURP�RFFXUULQJ�E\�UHWXUQLQJ�D�QRQ]HUR�YDOXH�IURP�WKH�ILOWHU�IXQFWLRQ��7KLV�RFFXUV�EHFDXVH�WKH�:+B&%7�KRRN�LV�QRWLILHG�RI�WKH�HYHQW�EHIRUH�LW�KDV�WDNHQ�SODFH��ZKHUHDV�WKH�:+B6+(//�KRRN�LQ�PRVW�LQVWDQFHV�LV�QRWLILHG�DIWHU�WKH�HYHQW�KDV�WDNHQ�SODFH��7KH�VROH�H[FHSWLRQ�WR�WKLV�UXOH�LV�WKH�:+B6+(//�KRRNV�+6+(//B:,1'2:'(6752<('�KRRN�FRGH��ZKLFK�LQWHUFHSWV�WKH�ZLQGRZ�GHVWUXFWLRQ�EHIRUH�LW�RFFXUV���

7DEOH�������&RPSDULVRQ�RI�WKH�:+B&%7�+RRN�WR�WKH�:+B6+(//�+RRN��:+B&%7�+RRN�&RGH� &RPSDULVRQ�WR�:+B6+(//�

+&%7B$&7,9$7(�

7KH�:+B6+(//�KRRN�XVHV�WKH�+6+(//B:,1'2:$&7,9$7('�KRRN�FRGH�WR�QRWLI\�LWVHOI�WKDW�D�GLIIHUHQW�WRS�OHYHO�XQRZQHG�ZLQGRZ�KDV�EHFRPH�WKH�DFWLYH�ZLQGRZ��7KLV�QRWLILFDWLRQ�LV�VHQW�DIWHU�WKH�ZLQGRZ�KDV�EHFRPH�WKH�DFWLYH�ZLQGRZ�LQVWHDG�RI�EHIRUH��DV�LV�WKH�FDVH�ZLWK�WKH�+&%7B$&7,9$7(�FRGH��$OVR��WKH�+&%7B$&7,9$7(�KRRN�FRGH�QRWLILHV�WKH�:+B&%7�KRRN�RI�DQ\�ZLQGRZV�WKDW�FKDQJH�DFWLYDWLRQ��QRW�RQO\�RI�WRS�OHYHO�XQRZQHG�ZLQGRZV���

+&%7B6(7)2&86� :+B6+(//�KDV�QR�FRPSDUDEOH�KRRN�FRGH��+&%7B&/,&.6.,33('�:+B6+(//�KDV�QR�FRPSDUDEOH�KRRN�FRGH��

+&%7B&5($7(:1'�

7KH�:+B6+(//�KRRN�XVHV�WKH�+6+(//B:,1'2:&5($7('�KRRN�FRGH�WR�QRWLI\�LWVHOI�WKDW�D�WRS�OHYHO�XQRZQHG�ZLQGRZ�KDV�DOUHDG\�EHHQ�FUHDWHG��7KH�ZLQGRZ�H[LVWV�ZKHQ�WKH�:+B6+(//�KRRN�ILOWHU�IXQFWLRQ�LV�FDOOHG��7KH�+&%7B&5($7(:1'�KRRN�FRGH�LV�VHQW�WR�WKH�:+B&%7�KRRN�EHIRUH�WKH�ZLQGRZ�LV�DFWXDOO\�FUHDWHG��7KLV�DOORZV�WKH�:+B&%7�KRRN�WR�PRGLI\�WKH�ZLQGRZV�SURSHUWLHV�EHIRUH�WKH�ZLQGRZ�LV�GLVSOD\HG��RU�HYHQ�WR�SUHYHQW�WKH�ZLQGRZ�IURP�EHLQJ�FUHDWHG�DW�DOO��+&%7B&5($7(:1'�QRWLILHV�WKH�:+B&%7�KRRN�RI�DQ\�ZLQGRZ�EHLQJ�FUHDWHG��QRW�MXVW�RI�WRS�OHYHO�XQRZQHG�ZLQGRZV���

+&%7B'(6752<:1'�7KH�:+B6+(//�KRRN�XVHV�WKH�+6+(//B:,1'2:'(6752<('�

Page 438: Visual Basic - Subclassing and Hooking with VB & VB NET

KRRN�FRGH�WR�QRWLI\�LWVHOI�WKDW�D�WRS�OHYHO�XQRZQHG�ZLQGRZ�LV�DERXW�WR�EH�GHVWUR\HG��7KH�ZLQGRZ�H[LVWV�ZKHQ�WKH�:+B6+(//�KRRN�UHFHLYHV�WKLV�QRWLILFDWLRQ��%RWK�WKLV�KRRN�FRGH�DQG�WKH�+&%7B'(6752<:1'�FRGH�IRU�WKH�:+B&%7�KRRN�QRWLI\�WKH�ILOWHU�IXQFWLRQ�EHIRUH�WKH�ZLQGRZ�LV�DFWXDOO\�GHVWUR\HG��7KH�+&%7B'(6752<:1'�FRGH�QRWLILHV�WKH�:+B&%7�KRRN�RI�DQ\�ZLQGRZ�EHLQJ�GHVWUR\HG��QRW�MXVW�RI�WRS�OHYHO�XQRZQHG�ZLQGRZV���

+&%7B.(<6.,33('� :+B6+(//�KDV�QR�FRPSDUDEOH�KRRN�FRGH��

+&%7B0,10$;�

7KH�:+B6+(//�KRRN�XVHV�WKH�+6+(//B*(70,15(&7�KRRN�FRGH�WR�QRWLI\�LWVHOI�WKDW�D�ZLQGRZ�LV�EHLQJ�PLQLPL]HG�RU�PD[LPL]HG��7KH�+&%7B0,10$;�FRGH�FRQWDLQV�D�VKRZ�ZLQGRZ�YDOXH��6:B ��WKDW�SURYLGHV�PRUH�GHWDLO�RQ�WKH�PLQLPL]DWLRQ�RU�PD[LPL]DWLRQ�RSHUDWLRQ��ZKLFK�WKH�+6+(//B*(70,15(&7�KRRN�FRGH�ODFNV��7KH�+&%7B0,10$;�FRGH�QRWLILHV�WKH�:+B&%7�KRRN�RI�DQ\�ZLQGRZ�EHLQJ�GHVWUR\HG��QRW�MXVW�RI�WRS�OHYHO�XQRZQHG�ZLQGRZV���

+&%7B029(6,=(� :+B6+(//�KDV�QR�FRPSDUDEOH�KRRN�FRGH��+&%7B46� :+B6+(//�KDV�QR�FRPSDUDEOH�KRRN�FRGH��+&%7B6<6&200$1'�:+B6+(//�KDV�QR�FRPSDUDEOH�KRRN�FRGH���

�����$�7KUHDG�6SHFLILF�([DPSOH�

7KLV�ILUVW�H[DPSOH�LOOXVWUDWHV�WKH�LQIRUPDWLRQ�WKDW�\RX�FDQ�REWDLQ�IURP�WKH�:+B&%7�KRRN��)LJXUH������VKRZV�D�VFUHHQVKRW�RI�WKH�DSSOLFDWLRQ��7KLV�DSSOLFDWLRQ�FRQWDLQV�D�PHQX�EDU�ZLWK�WKH�7HVW�PHQX�LWHP��D�&UHDWH:QG�EXWWRQ��DQG�D�06*%2;�EXWWRQ��(DFK�LWHP�ZLOO�DLG�LQ�RXU�XQGHUVWDQGLQJ�RI�WKLV�KRRN���

)LJXUH�������6FUHHQVKRW�RI�WKH�:+B&%7�DSSOLFDWLRQ�

Page 439: Visual Basic - Subclassing and Hooking with VB & VB NET

7DEOH������SUHVHQWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��

2EMHFW� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�)RUP�� 1DPH� )RUP��)RUP�� &DSWLRQ� �:+B&%7�$SSOLFDWLRQ��)RUP�� 7RS� ����)RUP�� /HIW� ����)RUP�� +HLJKW� �����)RUP�� :LGWK� �����)RUP�� 1DPH� )RUP��)RUP�� &DSWLRQ� �1(:�)250��&RPPDQG�%XWWRQ�� 1DPH� FPG+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �KRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� FPG8QKRRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �XQKRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� FPG&UHDWH:QG�&RPPDQG�%XWWRQ�� &DSWLRQ� �&UHDWH:QG��

Page 440: Visual Basic - Subclassing and Hooking with VB & VB NET

&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH� FPG0VJ%R[�&RPPDQG�%XWWRQ�� &DSWLRQ� �0VJ%R[��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����7H[W%R[� 1DPH� 7H[W��7H[W%R[� 0XOWL/LQH� 7UXH�7H[W%R[� 7RS� ����7H[W%R[� /HIW� �����7H[W%R[� +HLJKW� �����7H[W%R[� :LGWK� �����7R�LQVWDOO�WKLV�KRRN��VLPSO\�FOLFN�WKH�KRRN�EXWWRQ�FRQWDLQHG�LQ�WKH�&%7�IUDPH�FRQWURO��$IWHU�WKH�KRRN�LV�LQVWDOOHG��EHJLQ�H[SHULPHQWLQJ�ZLWK�LW�E\�FOLFNLQJ�WKH�&UHDWH:QG�DQG�06*%2;�EXWWRQV��DV�ZHOO�DV�WKH�7HVW�PHQX�LWHP��<RX�ZLOO�QRWLFH�VRPH�LQWHUHVWLQJ�WKLQJV��LQFOXGLQJ�WKH�IROORZLQJ���

• :KHQ�\RX�FUHDWH�D�SRS�XS�PHQX�E\�ULJKW�FOLFNLQJ�HLWKHU�D�WH[W�ER[�RU�WKH�WLWOH�EDU��WKH�:+B&%7�KRRN�LV�VHQW�D�+&%7B&5($7(:1'�FRGH�ZKHQ�LW�DSSHDUV�DQG�D�+&%7B'(6752<:1'�FRGH�ZKHQ�LW�LV�FORVHG���

• ,I�WKH�SRS�XS�PHQX�LV�D�V\VWHP�PHQX�DQG�WKH�XVHU�FKRRVHV�DQ�LWHP�LQ�WKH�PHQX��D�+&%7B6<6&200$1'�FRGH�LV�VHQW�WR�WKH�KRRN�DIWHU�WKH�+&%7B'(6752<:1'�FRGH�LV�VHQW���

• :KHQ�\RX�PLQLPL]H�D�ZLQGRZ�E\�FOLFNLQJ�WKH�0LQLPL]H�EXWWRQ�LQ�WKH�ZLQGRZV�WLWOH�EDU��DQ�+&%7B6<6&200$1'�FRGH�LV�VHQW��7KLV�FRGH�LV�IROORZHG�E\�WKH�+&%7B0,10$;�FRGH��DQG�WKHQ�E\�WKH�+&%7B6(7)2&86�FRGH��7KH�+&%7B6(7)2&86�FRGH�LQGLFDWHV�WKDW�WKH�IRFXV�KDV�VKLIWHG�IURP�WKH�PLQLPL]HG�ZLQGRZ�WR�DQRWKHU�ZLQGRZ��,I�WKH�Z3DUDP�RI�WKH�+&%7B6(7)2&86�FRGH�LV�]HUR��WKH�GHVNWRS�ZLQGRZ�LV�UHFHLYLQJ�WKH�IRFXV���

• ,I�\RX�GHDFWLYDWH�WKH�DSSOLFDWLRQV�PDLQ�ZLQGRZ��QR�FRGHV�DUH�VHQW�WR�WKH�KRRN��EXW�LI�\RX�DFWLYDWH�WKH�DSSOLFDWLRQV�PDLQ�ZLQGRZ��WKH�+&%7B$&7,9$7(�FRGH�LV�VHQW��IROORZHG�E\�DQ�+&%7B6(7)2&86�FRGH��7KLV�+&%7B6(7)2&86�FRGH�LQGLFDWHV�

Page 441: Visual Basic - Subclassing and Hooking with VB & VB NET

ZKLFK�FRQWURO�RQ�WKH�ZLQGRZ�JRW�WKH�IRFXV��7KH�FRQWURO�WKDW�JHWV�WKH�IRFXV�LV�WKH�ODVW�FRQWURO�WR�KDYH�WKH�IRFXV�EHIRUH�WKH�ZLQGRZ�ZDV�GHDFWLYDWHG���

• ,I�FOLFNLQJ�LWV�WLWOH�EDU�DFWLYDWHV�WKH�DSSOLFDWLRQV�PDLQ�ZLQGRZ��WKH�+&%7B$&7,9$7(�FRGH�LV�VHQW��IROORZHG�E\�WKH�+&%7B6(7)2&86�FRGH��ZKLFK�ZH�VDZ�LQ�WKH�SUHYLRXV�EXOOHW��7KH�+&%7B6<6&200$1'�FRGH�LV�WKHQ�VHQW�ZLWK�WKH�6&B029(�YDOXH�LQ�WKH�Z3DUDP�SDUDPHWHU��LQGLFDWLQJ�WKDW�WKH�WLWOH�EDU�ZDV�FOLFNHG��,I�DQ�6&B6,=(�YDOXH�LV�LQ�WKH�Z3DUDP�SDUDPHWHU��\RX�FOLFNHG�D�VL]LQJ�ERUGHU�ZKHQ�\RX�DFWLYDWHG�WKH�ZLQGRZ���

• :KHQ�\RX�FUHDWH�D�ZLQGRZ��UHJDUGOHVV�RI�ZKHWKHU�LW�LV�D�PHVVDJH�ER[��D�GLDORJ�ER[��RU�D�WRS�OHYHO�ZLQGRZ��D�VHULHV�RI�FRGHV�DUH�VHQW�WR�WKLV�KRRN��7KH�+&%7B&5($7(:1'�FRGH�LV�VHQW�IRU�WKH�ZLQGRZ�DQG�IRU�HYHU\�FRQWURO�WKDW�LV�FUHDWHG�RQ�WKH�ZLQGRZ��7KHQ�WKH�+&%7B6(7)2&86�FRGH�LV�VHQW��LQGLFDWLQJ�ZKLFK�FRQWURO�JHWV�WKH�IRFXV�RQ�WKH�QHZ�ZLQGRZ��)LQDOO\��WKH�+&%7B$&7,9$7(�FRGH�LV�VHQW��LQGLFDWLQJ�WKDW�WKH�ZLQGRZ�LV�EHLQJ�DFWLYDWHG���

• :KHQ�\RX�GHVWUR\�D�ZLQGRZ��UHJDUGOHVV�RI�ZKHWKHU�LW�LV�D�PHVVDJH�ER[��D�GLDORJ�ER[��RU�D�WRS�OHYHO�ZLQGRZ��D�VHULHV�RI�FRGHV�DUH�VHQW�WR�WKLV�KRRN��)LUVW��WKH�+&%7B$&7,9$7(�FRGH�LV�VHQW��LQGLFDWLQJ�WKDW�D�QHZ�ZLQGRZ�LV�DERXW�WR�EH�DFWLYDWHG��1H[W��WKH�+&%7B6(7)2&86�FRGH�LV�VHQW��LQGLFDWLQJ�WKDW�D�FRQWURO�RQ�WKH�QHZO\�DFWLYDWHG�ZLQGRZ�LV�DERXW�WR�UHFHLYH�WKH�IRFXV��)LQDOO\��WKH�FRQWUROV�RQ�WKH�ZLQGRZ�DERXW�WR�EH�GHVWUR\HG�DUH�GHVWUR\HG��DORQJ�ZLWK�WKH�ZLQGRZ���

• 7KH�IRUP�LV�DOZD\V�FUHDWHG�ILUVW��WKH�FRQWUROV�DUH�FUHDWHG�LQ�DQ�RUGHU�GHILQHG�E\�WKH�FRQWUROV�FRQWURO�,'��7KH�FRQWURO�ZLWK�D�FRQWURO�,'�RI���LV�DOZD\V�FUHDWHG�ILUVW��7KH�9%)RFXV57��ZLQGRZ�KDV�D�FRQWURO�,'�RI�]HUR��7KHUH�LV�DOZD\V�RQH�RI�WKHVH�ZLQGRZV�IRU�HDFK�9%�DSSOLFDWLRQ��WKHUHIRUH��\RX�ZLOO�QRWLFH�WKDW�WKH�FRQWURO�,'V�VWDUW�DW���DQG�LQFUHDVH�IURP�WKHUH�ZKHQ�D�ZLQGRZ�LV�FUHDWHG�RU�GHVWUR\HG�LQ�D�9%�DSSOLFDWLRQ���

• 7KH�FRQWUROV�DUH�DOZD\V�GHVWUR\HG�LQ�WKH�VDPH�RUGHU�LQ�ZKLFK�WKH\�ZHUH�FUHDWHG��7KLV�DOVR�GHSHQGV�RQ�WKH�FRQWUROV�FRQWURO�,'��7KHUHIRUH��WKH�FRQWURO�ZLWK�DQ�,'�RI���LV�DOZD\V�FUHDWHG�ILUVW�DQG�GHVWUR\HG�ILUVW��7KH�IRUP�LV�GHVWUR\HG�ODVW���

• :KHQ�\RX�PRYH�RU�VL]H�D�ZLQGRZ��DQ�+&%7B6<6&200$1'�FRGH�LV�VHQW�WR�WKH�KRRN�ILUVW�ZLWK�D�Z3DUDP�RI�6&B029(�RU�6&B6,=(��UHVSHFWLYHO\��1H[W��WKH�+&%7B029(6,=(�FRGH�LV�VHQW�WR�WKH�KRRN���

• :KHQ�\RX�PLQLPL]H��PD[LPL]H��RU�UHVWRUH�WKH�ZLQGRZ��DQ�+&%7B6<6&200$1'�FRGH�LV�VHQW�ZLWK�D�Z3DUDP�YDOXH�RI�6&B0,1,0,=(��6&B0$;,0,=(��RU�6&B5(6725(��UHVSHFWLYHO\��1H[W��WKH�+&%7B0,10$;�FRGH�LV�VHQW�ZLWK�D�VKRZ�ZLQGRZ�YDOXH�LQ�WKH�ORZ�RUGHU�ZRUG�RI�WKH�O3DUDP�SDUDPHWHU��7KLV�VKRZ�ZLQGRZ�YDOXH�FDQ�EH�6:B0,1,0,=(��6:B0$;,0,=(��RU�6:B5(6725(���

• ,I�\RX�XVH�WKH�7$%�NH\�WR�VHW�WKH�IRFXV�WR�DQRWKHU�FRQWURO��WKH�+&%7B6(7)2&86�FRGH�LV�VHQW�WR�WKH�KRRN��+RZHYHU��LI�D�:+B.(<%2$5'�KRRN�LV�VHW��WKH�+&%7B.(<6.,33('�FRGH�DOVR�LV�VHQW�WR�WKH�KRRN�ERWK�EHIRUH�DQG�DIWHU�WKH�+&%7B6(7)2&86�FRGH��7KH�WZR�+&%7B.(<6.,33('�FRGHV�LQGLFDWH�WKH�NH\�EHLQJ�SUHVVHG�DQG�WKH�NH\�EHLQJ�UHOHDVHG���

Page 442: Visual Basic - Subclassing and Hooking with VB & VB NET

([DPSOH������OLVWV�WKH�FRGH�EHKLQG�WKH�)RUP��IUP�PRGXOH��7KH�FPG+RRNB&OLFN�DQG�FPG8Q+RRNB&OLFN�HYHQWV�LQVWDOO�DQG�UHPRYH�WKH�&%7�KRRN��UHVSHFWLYHO\��7KH�FPG0VJ%R[B&OLFN�HYHQW�GLVSOD\V�D�PHVVDJH�ER[��DQG�WKH�FPG&UHDWH:QGB&OLFN�HYHQW�VKRZV�WKH�)RUP��IRUP��7KHVH�ODVW�WZR�EXWWRQ�FOLFN�HYHQWV�DOORZ�XV�WR�WHVW�WKH�&%7�KRRNV�IXQFWLRQDOLW\���

([DPSOH�������&RGH�&RQWDLQHG�LQ�WKH�)RUP��IUP�0RGXOH��

3ULYDWH�6XE�FPG+RRNB&OLFN���������7H[W��7H[W� ��������&DOO�6HW&%7+RRN�(QG�6XE��3ULYDWH�6XE�FPG8Q+RRNB&OLFN���������&DOO�5HPRYH&%7+RRN�(QG�6XE���3ULYDWH�6XE�FPG0VJ%R[B&OLFN���������0VJ%R[��WHVW��(QG�6XE���3ULYDWH�6XE�FPG&UHDWH:QGB&OLFN���������)RUP��6KRZ�(QG�6XE��������������&/($183�������������3ULYDWH�6XE�)RUPB4XHU\8QORDG�&DQFHO�$V�,QWHJHU��8QORDG0RGH�$V�,QWHJHU������,I�,V+RRNHG�7KHQ���������&DQFHO� �����������0VJ%R[��8QKRRN�EHIRUH�FORVLQJ��RU�WKH�,'(�ZLOO�FUDVK�������(QG�,I�(QG�6XE�7KH�)RUPB4XHU\8QORDG�HYHQW�WHVWV�WKH�,V+RRNHG�IODJ�WR�GHWHUPLQH�LI�WKH�&%7�KRRN�LV�VWLOO�LQVWDOOHG��,I�LW�LV��D�PHVVDJH�LV�GLVSOD\HG�ZDUQLQJ�WKDW�WKLV�KRRN�LV�VWLOO�LQVWDOOHG�DQG�WKDW�WKH�DSSOLFDWLRQ�FDQQRW�VKXW�GRZQ��:LWKRXW�WKLV�FKHFN��LI�WKH�DSSOLFDWLRQ�ZHUH�WR�VKXW�GRZQ�ZLWK�WKH�

Page 443: Visual Basic - Subclassing and Hooking with VB & VB NET

KRRN�VWLOO�LQVWDOOHG��WKH�DSSOLFDWLRQ�ZRXOG�VXIIHU�D�*HQHUDO�3URWHFWLRQ�)DXOW��*3)��XSRQ�FORVLQJ���<RX�VHW�XS�WKLV�KRRN�LQ�PXFK�WKH�VDPH�ZD\�DV�\RX�GR�WKH�SUHYLRXV�KRRNV��7KH�FRGH�LQ�([DPSOH������FRQWDLQV�D�IXQFWLRQ�WR�LQVWDOO�WKH�KRRN��D�IXQFWLRQ�WR�UHPRYH�WKH�KRRN��DQG�WKH�&%7�ILOWHU�IXQFWLRQ��7KH�FRGH�LQ�([DPSOH������LV�FRQWDLQHG�LQ�WKH�0RGXOH��EDV�PRGXOH���

([DPSOH�������&RGH�&RQWDLQHG�LQ�WKH�0RGXOH��EDV�0RGXOH��

3ULYDWH�K+RRN�$V�/RQJ�3XEOLF�,V+RRNHG�DV�%RROHDQ��3XEOLF�6XE�6HW&%7+RRN��������,I�,V+RRNHG�7KHQ�������0VJ%R[��'RQW�KRRN�&%7�WZLFH�RU�\RX�ZLOO�EH�XQDEOH�WR�XQKRRN�LW������(OVH�������K+RRN� �6HW:LQGRZV+RRN([�:+B&%7��$GGUHVV2I�&%73URF�����$SS�7KUHDG,'��������,V+RRNHG� �7UXH����(QG�,I�(QG�6XE��3XEOLF�6XE�5HPRYH&%7+RRN��������'LP�WHPS�$V�/RQJ����WHPS� �8QKRRN:LQGRZV+RRN([�K+RRN�����,V+RRNHG� �)DOVH�(QG�6XE��3XEOLF�)XQFWLRQ�&%73URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B�������������������������%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ����,I�X&RGH�! ���7KHQ�������6HOHFW�&DVH�X&RGH����������&DVH�+&%7B$&7,9$7(�������������Z3DUDP� �6SHFLILHV�WKH�KDQGOH�WR�WKH�ZLQGRZ�DERXW�WR�EH�DFWLYDWHG�������������O3DUDP� �3RLQWHU�WR�WKH�&%7$&7,9$7(6758&7�VWUXFW�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B$&7,9$7(��+:1'����B��������������������������������Z3DUDP��YE1HZ/LQH����������&DVH�+&%7B&/,&.6.,33('�������������Z3DUDP� �6SHFLILHV�WKH�PRXVH�PHVVDJH�UHPRYHG�IURP�WKH�����������������������V\VWHP�PHVVDJH�TXHXH�������������O3DUDP� �3RLQWHU�WR�WKH�0286(+22.6758&7�VWUXFW�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B&/,&.6.,33('��0RXVH0VJ����B�

Page 444: Visual Basic - Subclassing and Hooking with VB & VB NET

�������������������������������Z3DUDP��YE1HZ/LQH����������&DVH�+&%7B&5($7(:1'�������������Z3DUDP� �6SHFLILHV�WKH�KDQGOH�WR�WKH�QHZ�ZLQGRZ�������������O3DUDP� �3RLQWHU�WR�WKH�&%7B&5($7(:1'�VWUXFW�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B&5($7(:1'����1(:B+:1'����B��������������������������������Z3DUDP�������O3DUDP����O3DUDP��YE1HZ/LQH�������������([LW�)XQFWLRQ�2WKHUZLVH�D�*3)�RFFXUV�LQ�WKH�&DOO1H[W+RRN([�IXQFWLRQ����������&DVH�+&%7B'(6752<:1'�������������Z3DUDP� �6SHFLILHV�WKH�KDQGOH�WR�WKH�ZLQGRZ�DERXW�WR�EH�GHVWUR\HG�������������O3DUDP� ���������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B'(6752<:1'�������B���������������������������������'HVWUR\HGB+:1'����Z3DUDP��YE1HZ/LQH����������&DVH�+&%7B.(<6.,33('�������������Z3DUDP� �6SHFLILHV�WKH�YLUWXDO�NH\�FRGH�������������O3DUDP� �6SHFLILHV�WKH�UHSHDW�FRXQW��VFDQ�FRGH��NH\�WUDQVLWLRQ�FRGH�������������������������SUHYLRXV�NH\�VWDWH��DQG�FRQWH[W�FRGH�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W��B���������������������������������+&%7B.(<6.,33('����9LUWXDO�.H\�&RGH����B��������������������������������Z3DUDP�������0LVFB3DUDPV����O3DUDP��YE1HZ/LQH����������&DVH�+&%7B0,10$;�������������Z3DUDP� �6SHFLILHV�WKH�KDQGOH�WR�WKH�ZLQGRZ�EHLQJ�PLQLPL]HG������������������������RU�PD[LPL]HG�������������O3DUDP� �6SHFLILHV��LQ�WKH�ORZ�RUGHU�ZRUG��D�VKRZ�ZLQGRZ�YDOXH��6:B�������������������������VSHFLI\LQJ�WKH�RSHUDWLRQ��WKH�KLJK�RUGHU�ZRUG�LV�XQGHILQHG�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B0,10$;����+:1'����Z3DUDP��B��������������������������������������O3DUDP�����+))))�$QG�O3DUDP���YE1HZ/LQH����������&DVH�+&%7B029(6,=(�������������Z3DUDP� �6SHFLILHV�WKH�KDQGOH�WR�WKH�ZLQGRZ�WR�EH�PRYHG�RU�VL]HG�������������O3DUDP� �3RLQWHU�WR�D�5(&7�VWUXFW�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B029(6,=(����+:1'����B��������������������������������Z3DUDP��YE1HZ/LQH����������&DVH�+&%7B46�������������Z3DUDP� ���������������O3DUDP� ���������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B46���YE1HZ/LQH����������&DVH�+&%7B6(7)2&86�������������Z3DUDP� �6SHFLILHV�WKH�KDQGOH�WR�WKH�ZLQGRZ�JDLQLQJ�WKH�NH\ERDUG�IRFXV�������������O3DUDP� �6SHFLILHV�WKH�KDQGOH�WR�WKH�ZLQGRZ�ORVLQJ�WKH�NH\ERDUG�IRFXV�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B6(7)2&86����1HZB+:1'����B��������������������������������Z3DUDP���������2OGB+:1'����O3DUDP��YE1HZ/LQH�

Page 445: Visual Basic - Subclassing and Hooking with VB & VB NET

���������&DVH�+&%7B6<6&200$1'�������������Z3DUDP� �6SHFLILHV�D�V\VWHP�FRPPDQG�YDOXH��6&B ��������������O3DUDP� �&RQWDLQV�WKH�VDPH�GDWD�DV�WKH�O3DUDP�YDOXH�RI�D������������������������:0B6<6&200$1'�PHVVDJH�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B6<6&200$1'�������B���������������������������������6\VWHPB&RPPDQG����Z3DUDP��B�������������������������������������O3DUDP����O3DUDP��YE1HZ/LQH�������(QG�6HOHFW����(QG�,I���������,I�X&RGH� �+&%7B029(6,=(�7KHQ�������&%73URF� ������(OVH�������&%73URF� �&DOO1H[W+RRN([�K+RRN��X&RGH��Z3DUDP��O3DUDP�����(QG�,I�(QG�)XQFWLRQ�7KH�&%73URF�ILOWHU�IXQFWLRQ��VKRZQ�LQ�([DPSOH�������GLVSOD\V�WKH�HYHQWV�WKDW�WKLV�KRRN�FDSWXUHV�DV�WKH\�RFFXU�LQ�WKH�7H[W��WH[W�ER[��7KH�RQH�LQWHUHVWLQJ�WKLQJ�DERXW�WKLV�IXQFWLRQ�LV�WKDW�DIWHU�WKLV�KRRN�LV�LQVWDOOHG��WKH�DSSOLFDWLRQV�PDLQ�ZLQGRZ�FDQQRW�EH�PRYHG�RU�VL]HG��7KLV�LV�EHFDXVH�WKH�IXQFWLRQ�UHWXUQV�D�QRQ]HUR�YDOXH�ZKHQHYHU�WKH�+&%7B029(6,=(�KRRN�FRGH�LV�VHQW�WR�WKLV�IXQFWLRQ��7KLV�FDXVHV�WKH�ZLQGRZV�[�DQG�\�FRRUGLQDWHV�WR�EH�UHSODFHG�ZLWK�WKHLU�RULJLQDO�YDOXHV�DIWHU�WKH�XVHU�ILQLVKHV�WKH�PRYH�RSHUDWLRQ��7KLV�DOVR�FDXVHV�WKH�KHLJKW�DQG�ZLGWK�RI�WKH�ZLQGRZ�WR�EH�UHSODFHG�ZLWK�WKHLU�RULJLQDO�YDOXHV�DIWHU�WKH�XVHU�ILQLVKHV�WKH�UHVL]H�RSHUDWLRQ���

�������8VLQJ�WKH�:+B-2851$/3/$<%$&.�+RRNZLWK�D�&%7�

7R�DOORZ�WKH�&%7�DSSOLFDWLRQ�WR�WDNH�FRQWURO�RI�WKH�V\VWHP�IRU�WKH�SXUSRVH�RI�VKRZLQJ�WKH�XVHU�KRZ�WR�SHUIRUP�D�VSHFLILF�WDVN��\RX�PXVW�LQFRUSRUDWH�LQWR�WKH�DSSOLFDWLRQ�VHYHUDO�KRRNV�WKDW�ZRUN�WRJHWKHU��2UGLQDULO\��\RX�LQVWDOO�D�:+B&%7�KRRN�DORQJ�ZLWK�D�:+B.(<%2$5'�KRRN�DQG�RU�D�:+B0286(�KRRN��7KH�:+B.(<%2$5'�DQG�:+B0286(�KRRNV�GXWLHV�LQFOXGH�ZDWFKLQJ�IRU�D�VSHFLILF�VHW�RI�HYHQWV��LQ�UHVSRQVH�WR�WKRVH�HYHQWV�D�:+B-2851$/3/$<%$&.�KRRN�LV�LQVWDOOHG��7KLV�:+B-2851$/3/$<%$&.�KRRN�SOD\V�EDFN�D�SUHUHFRUGHG�VHW�RI�PRXVH�DQG�NH\ERDUG�PHVVDJHV�WR�VKRZ�WKH�XVHU�KRZ�WR�SHUIRUP�D�VSHFLILF�WDVN���/HWV�VHH�KRZ�WR�GR�WKLV�E\�DGGLQJ�WR�WKH�ODVW�H[DPSOH�DSSOLFDWLRQ�WKH�SOD\EDFN�RI�D�SUHUHFRUGHG�VHW�RI�PHVVDJHV�WR�WKH�XVHU��:KHQ�WKH�:+B&%7�DSSOLFDWLRQ�LV�LQVWDOOHG��D�:+B.(<%2$5'�KRRN�LV�LQVWDOOHG�DW�WKH�VDPH�WLPH��,QVWDOOLQJ�WKH�:+B.(<%2$5'�KRRN�DOORZV�WKH�+&%7B.(<6.,33('�FRGH�WR�EH�VHQW�WR�WKH�:+B&%7�KRRNV�ILOWHU�IXQFWLRQ��,I�D�:+B0286(�KRRN�LV�LQVWDOOHG��WKH�+&%7B&/,&.6.,33('�FRGH�LV�VHQW�WR�WKH�ILOWHU�IXQFWLRQ���

Page 446: Visual Basic - Subclassing and Hooking with VB & VB NET

7R�XVH�WKLV�H[DPSOH��ILUVW�FOLFN�WKH�KRRN�EXWWRQ�WR�LQVWDOO�WKH�&%7�KRRN��1H[W��FOLFN�WKH�&UHDWH:QG�EXWWRQ�WR�FUHDWH�DQG�GLVSOD\�WKH�)RUP��IRUP��WKLV�IRUP�KDV�WKH�FDSWLRQ��:+B&%7�7HVW�)RUP���DV�LQ�)LJXUH�������)LQDOO\��ZLWK�WKH�)RUP��IRUP�DV�WKH�DFWLYH�ZLQGRZ��SUHVV�DQG�UHOHDVH�WKH�(6&�NH\��<RX�ZLOO�VHH�WKH�WH[W��WHVW��GLVSOD\HG�LQ�WKH�WH[W�ER[�RQ�)RUP����7KH�FRGH�LQ�WKH�&%7V�ILOWHU�IXQFWLRQ�WHVWV�IRU�WKH�(6&�NH\�EHLQJ�UHOHDVHG�ZKHQ�WKH�+&%7B.(<6.,33('�FRGH�LV�VHQW�WR�WKH�:+B&%7�KRRNV�ILOWHU�IXQFWLRQ��,Q�UHVSRQVH�WR�WKLV�DFWLRQ��D�:+B-2851$/3/$<%$&.�KRRN�LV�LQVWDOOHG�DQG�D�VHULHV�RI�PHVVDJHV�LV�SOD\HG�EDFN�WR�VHQG�WKH�ZRUG��WHVW��WR�WKH�WH[W�ER[�LQ�WKH�)RUP��ZLQGRZ��DV�VKRZQ�LQ�)LJXUH��������

)LJXUH�������7KH�ZRUG��WHVW��LV�VHQW�WR�WKH�WH[W�ER[�ZKHQ�WKH�XVHU�UHOHDVHV�WKH�(6&�NH\�

$V�D�QRWH��LI�ZH�GLG�QRW�WHVW�IRU�WKH�(6&�NH\�EHLQJ�UHOHDVHG��WKH�ZRUG��WHVW��ZRXOG�EH�SULQWHG�WZLFH�LQ�WKH�WH[W�ER[��RQFH�IRU�WKH�:0B.(<'2:1�PHVVDJH�DQG�RQFH�IRU�WKH�:0B.(<83�PHVVDJH���/HWV�VHH�KRZ�WR�PRGLI\�WKH�FRGH�IURP�WKH�SUHYLRXV�H[DPSOH�DSSOLFDWLRQ�WR�DGG�MRXUQDO�SOD\EDFN�FDSDELOLWLHV��-XVW�DGG�WKH�IROORZLQJ�WR�WKH�)RUP��IUP�PRGXOH���3ULYDWH�6XE�)RUP�B/RDG���������&DOO�,QLW�����(QG�6XE�<RX�PXVW�FDOO�WKH�,QLW�IXQFWLRQ�RQFH�GXULQJ�DSSOLFDWLRQ�VWDUWXS��,�ZLOO�GHVFULEH�WKLV�IXQFWLRQ�LQ�GHWDLO�VKRUWO\���([DPSOH������VKRZV�WKH�DGGLWLRQDO�YDULDEOH�DQG�DUUD\�GHFODUDWLRQV���

([DPSOH�������7KH�0RGLILHG�9HUVLRQ�RI�WKH�'HFODUDWLRQV�RI�0RGXOH��EDV��

3ULYDWH�K5HFRUG+RRN�$V�/RQJ�3ULYDWH�K3OD\EDFN+RRN�$V�/RQJ�3ULYDWH�0VJ$UUD\�����$V�/RQJ�

Page 447: Visual Basic - Subclassing and Hooking with VB & VB NET

3ULYDWH�6WDUW7LPH�$V�/RQJ�3ULYDWH�&XUU06*�$V�/RQJ��3ULYDWH�K+RRN�$V�/RQJ�3ULYDWH�K.EG+RRN�$V�/RQJ��3XEOLF�,V+RRNHG�$V�%RROHDQ�3XEOLF�,V3%+RRNHG�$V�%RROHDQ�$V�([DPSOH������VKRZV��DQ�H[WUD�6HW:LQGRZV+RRN([�IXQFWLRQ�FDOO�ZDV�DGGHG�WR�WKH�6HW&%7+RRN�IXQFWLRQ�WR�LQVWDOO�WKH�:+B.(<%2$5'�KRRN���

([DPSOH�������7KH�0RGLILHG�9HUVLRQ�RI�WKH�6HW&%7+RRN�,QVWDOODWLRQ�5RXWLQH��

3XEOLF�6XE�6HW&%7+RRN���������,I�,V+RRNHG�7KHQ���������0VJ%R[��'RQW�KRRN�&%7�WZLFH�RU�\RX�ZLOO�EH�XQDEOH�WR�XQKRRN�LW�������(OVH���������K+RRN� �6HW:LQGRZV+RRN([�:+B&%7��$GGUHVV2I�&%73URF�����$SS�7KUHDG,'����������K.EG+RRN� �6HW:LQGRZV+RRN([�:+B.(<%2$5'��$GGUHVV2I�.EG3URF�����$SS�7KUHDG,'����������,V+RRNHG� �7UXH�����(QG�,I�(QG�6XE�%HFDXVH�ZH�DUH�LQVWDOOLQJ�D�VHFRQG�KRRN��ZH�PXVW�DOVR�UHPRYH�WKDW�KRRN�LQ�WKH�5HPRYH&%7+RRN�IXQFWLRQ��DV�([DPSOH������VKRZV���

([DPSOH�������7KH�0RGLILHG�9HUVLRQ�RI�WKH�5HPRYH&%7+RRN�5RXWLQH��

3XEOLF�6XE�5HPRYH&%7+RRN���������'LP�WHPS�$V�/RQJ�����WHPS� �8QKRRN:LQGRZV+RRN([�K+RRN������WHPS� �8QKRRN:LQGRZV+RRN([�K.EG+RRN������,V+RRNHG� �)DOVH�(QG�6XE�:H�DGG�WKUHH�OLQHV�RI�FRGH�WR�WKH�&%73URF�ILOWHU�IXQFWLRQ��7KH�DGGHG�FRGH�LV�KLJKOLJKWHG�LQ�([DPSOH��������

([DPSOH�������7KH�0RGLILHG�9HUVLRQ�RI�WKH�&%73URF�)LOWHU�)XQFWLRQ��

3XEOLF�)XQFWLRQ�&%73URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B�

Page 448: Visual Basic - Subclassing and Hooking with VB & VB NET

������������������������%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�����,I�X&RGH�! ���7KHQ���������6HOHFW�&DVH�X&RGH�������������&DVH�+&%7B$&7,9$7(�����������������Z3DUDP� �6SHFLILHV�WKH�KDQGOH�WR�WKH�ZLQGRZ�DERXW�WR�EH�DFWLYDWHG�����������������O3DUDP� �3RLQWHU�WR�WKH�&%7$&7,9$7(6758&7�VWUXFW�����������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B$&7,9$7(��+:1'����B������������������������������������Z3DUDP��YE1HZ/LQH�������������&DVH�+&%7B&/,&.6.,33('�����������������Z3DUDP� �6SHFLILHV�WKH�PRXVH�PHVVDJH�UHPRYHG�IURP�WKH�����������������������������V\VWHP�PHVVDJH�TXHXH�����������������O3DUDP� �3RLQWHU�WR�WKH�0286(+22.6758&7�VWUXFW�����������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B&/,&.6.,33('�����B������������������������������������0RXVH0VJ����Z3DUDP��YE1HZ/LQH�������������&DVH�+&%7B&5($7(:1'�����������������Z3DUDP� �6SHFLILHV�WKH�KDQGOH�WR�WKH�QHZ�ZLQGRZ�����������������O3DUDP� �3RLQWHU�WR�WKH�&%7B&5($7(:1'�VWUXFW�����������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B&5($7(:1'�������B������������������������������������1(:B+:1'����Z3DUDP��B�����������������������������������������O3DUDP����O3DUDP��YE1HZ/LQH�����������������([LW�)XQFWLRQ�2WKHUZLVH�D�*3)�RFFXUV�LQ�WKH�&DOO1H[W+RRN([�IXQFWLRQ�������������&DVH�+&%7B'(6752<:1'�����������������Z3DUDP� �6SHFLILHV�WKH�KDQGOH�WR�WKH�ZLQGRZ�DERXW�WR�EH�GHVWUR\HG�����������������O3DUDP� �������������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B'(6752<:1'�������B������������������������������������'HVWUR\HGB+:1'����Z3DUDP��YE1HZ/LQH�������������&DVH�+&%7B.(<6.,33('�����������������Z3DUDP� �6SHFLILHV�WKH�YLUWXDO�NH\�FRGH�����������������O3DUDP� �6SHFLILHV�WKH�UHSHDW�FRXQW��VFDQ�FRGH��NH\�WUDQVLWLRQ�����������������������������FRGH��SUHYLRXV�NH\�VWDWH��DQG�FRQWH[W�FRGH�����������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B.(<6.,33('�������B�������������������������������������9LUWXDO�.H\�&RGH����Z3DUDP��B�����������������������������������������0LVFB3DUDPV����O3DUDP��YE1HZ/LQH��� � �����,I�Z3DUDP� �9.B(6&$3(�$QG��O3DUDP�$QG�+����������7KHQ���������������������&DOO�6HW3OD\EDFN+RRN�����������������(QG�,I�������������&DVH�+&%7B0,10$;�����������������Z3DUDP� �6SHFLILHV�WKH�KDQGOH�WR�WKH�ZLQGRZ�EHLQJ�PLQLPL]HG�����������������������������RU�PD[LPL]HG�

Page 449: Visual Basic - Subclassing and Hooking with VB & VB NET

����������������O3DUDP� �7KH�ORZ�RUGHU�ZRUG�VSHFLILHV�D�VKRZ�ZLQGRZ�YDOXH����������������������������������������������6:B��GHILQLQJ�WKH�RSHUDWLRQ��WKH�KLJK�RUGHU�ZRUG�LV���������������������������XQGHILQHG�����������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B0,10$;����+:1'����B������������������������������������Z3DUDP��������O3DUDP����B�������������������������������������+))))�$QG�O3DUDP���YE1HZ/LQH�������������&DVH�+&%7B029(6,=(�����������������Z3DUDP� �6SHFLILHV�WKH�KDQGOH�WR�WKH�ZLQGRZ�WR�EH�PRYHG�RU�VL]HG�����������������O3DUDP� �3RLQWHU�WR�D�5(&7�VWUXFW�����������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B029(6,=(����+:1'����B�������������������������������������Z3DUDP��YE1HZ/LQH�������������&DVH�+&%7B46�����������������Z3DUDP� �������������������O3DUDP� �������������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B46���YE1HZ/LQH�������������&DVH�+&%7B6(7)2&86�����������������Z3DUDP� �6SHFLILHV�WKH�KDQGOH�WR�WKH�ZLQGRZ�JDLQLQJ�WKH�����������������������������NH\ERDUG�IRFXV�����������������O3DUDP� �6SHFLILHV�WKH�KDQGOH�WR�WKH�ZLQGRZ�ORVLQJ�WKH�����������������������������NH\ERDUG�IRFXV�����������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B6(7)2&86����1HZB+:1'���B�������������������������������������Z3DUDP���������2OGB+:1'����O3DUDP��YE1HZ/LQH�������������&DVH�+&%7B6<6&200$1'�����������������Z3DUDP� �$�V\VWHP�FRPPDQG�YDOXH��6&B ������������������O3DUDP� �&RQWDLQV�WKH�VDPH�GDWD�DV�WKH�O3DUDP�YDOXH�RI�D�����������������������������:0B6<6&200$1'�PHVVDJH�����������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���+&%7B6<6&200$1'�������������������������������������������6\VWHPB&RPPDQG����Z3DUDP��B�����������������������������������������O3DUDP����O3DUDP��YE1HZ/LQH���������(QG�6HOHFW�����(QG�,I�������� ,I�X&RGH� �+&%7B029(6,=(�7KHQ���������&%73URF� �������(OVH���������&%73URF� �&DOO1H[W+RRN([�K+RRN��X&RGH��Z3DUDP��O3DUDP������(QG�,I�(QG�)XQFWLRQ�7KH�&DVH�VWDWHPHQW�WKDW�HYDOXDWHV�WKH�X&RGH�SDUDPHWHU�IRU�WKH�+&%7B.(<6.,33('�FRQVWDQW�FRQWDLQV�DQ�,I���7KHQ�VWDWHPHQW�WKDW�ZDWFKHV�IRU�WKH�(6&�NH\�WR�EH�UHOHDVHG��:KHQ�

Page 450: Visual Basic - Subclassing and Hooking with VB & VB NET

WKH�PRVW�VLJQLILFDQW�ELW�RI�WKH�O3DUDP�SDUDPHWHU�LV�RQ��WKH�(6&�NH\�LV�EHLQJ�UHOHDVHG��<RX�WHVW�IRU�WKLV�E\�$1'LQJ�O3DUDP�ZLWK�WKH�YDOXH�+����������:KHQ�WKH�(6&�NH\�LV�EHLQJ�UHOHDVHG��D�:+B-2851$/3/$<%$&.�KRRN�LV�LQVWDOOHG�WR�SOD\�EDFN�D�SUHUHFRUGHG�VHW�RI�PHVVDJHV���7KH�FRGH�LQ�([DPSOH������VKRZV�WKH�,QLW�IXQFWLRQ�WKDW�LV�FRQWDLQHG�LQ�0RGXOH��EDV��7KLV�IXQFWLRQ�LQLWLDOL]HV�DQ�0VJ$UUD\�DUUD\�ZLWK�WKH�ZLQGRZ�PHVVDJHV�WKDW�WKH�:+B-2851$/3/$<%$&.�KRRN�ZLOO�SOD\�EDFN��7KH�DUUD\�HOHPHQWV�FRQWDLQ�WKH�IROORZLQJ�LQIRUPDWLRQ���MsgArray(1,x)

7KH�ZLQGRZ�PHVVDJH�WKDW�WKH�:+B-2851$/3/$<%$&.�KRRN�LV�WR�SOD\�EDFN���MsgArray(2,x)

7KH�K:QG�RI�WKH�ZLQGRZ�LQ�ZKLFK�WR�SOD\�EDFN�WKH�KRRN�MsgArray(3,x)

7KH�Z3DUDP�IRU�WKH�PHVVDJH�FRQWDLQHG�LQ�DUUD\�HOHPHQW�0VJ$UUD\���[���MsgArray(4,x)

7KH�O3DUDP�IRU�WKH�PHVVDJH�FRQWDLQHG�LQ�DUUD\�HOHPHQW�0VJ$UUD\���[���MsgArray(5,x)

7KH�WLPH�GHOD\�LQ�ZKLFK�WR�SOD\�EDFN�WKH�PHVVDJH�7KLV�DUUD\�VWDUWV�DQG�HQGV�ZLWK�WKH�:0B48(8(6<1&�PHVVDJH����PRUH�DERXW�WKLV�PHVVDJH�VKRUWO\��7KH�UHVW�RI�WKH�DUUD\�FRQWDLQV�D�:0B.(<'2:1�DQG�:0B.(<83�PHVVDJH�IRU�HDFK�OHWWHU�RI�WKH�ZRUG��WHVW����

([DPSOH�������7KH�,QLW�3URFHGXUH�WR�,QLWLDOL]H�0HVVDJHV�IRU�3OD\EDFN��

3XEOLF�6XE�,QLW���������5H'LP�0VJ$UUD\��������$V�/RQJ������:0B48(8(6<1&�����0VJ$UUD\������� �������0VJ$UUD\������� �:0B48(8(6<1&�����0VJ$UUD\������� �)RUP��K:QG������0VJ$UUD\������� �������0VJ$UUD\������� �������0VJ$UUD\������� ����������������7�����0VJ$UUD\������� �������0VJ$UUD\������� �:0B.(<'2:1�����0VJ$UUD\������� �)RUP��K:QG������0VJ$UUD\������� �������0VJ$UUD\������� ����������0VJ$UUD\������� ������

Page 451: Visual Basic - Subclassing and Hooking with VB & VB NET

�����0VJ$UUD\������� �������0VJ$UUD\������� �:0B.(<83�����0VJ$UUD\������� �)RUP��K:QG������0VJ$UUD\������� �������0VJ$UUD\������� ����������0VJ$UUD\������� ���������������(�����0VJ$UUD\������� �������0VJ$UUD\������� �:0B.(<'2:1�����0VJ$UUD\������� �)RUP��K:QG������0VJ$UUD\������� �������0VJ$UUD\������� ����������0VJ$UUD\������� �����������0VJ$UUD\������� �������0VJ$UUD\������� �:0B.(<83�����0VJ$UUD\������� �)RUP��K:QG������0VJ$UUD\������� �������0VJ$UUD\������� ����������0VJ$UUD\������� ���������������6�����0VJ$UUD\������� �������0VJ$UUD\������� �:0B.(<'2:1�����0VJ$UUD\������� �)RUP��K:QG������0VJ$UUD\������� �������0VJ$UUD\������� ����������0VJ$UUD\������� ���������������0VJ$UUD\������� �������0VJ$UUD\������� �:0B.(<83�����0VJ$UUD\������� �)RUP��K:QG������0VJ$UUD\������� �������0VJ$UUD\������� ����������0VJ$UUD\������� ���������������7�����0VJ$UUD\������� ���

Page 452: Visual Basic - Subclassing and Hooking with VB & VB NET

����0VJ$UUD\������� �:0B.(<'2:1�����0VJ$UUD\������� �)RUP��K:QG������0VJ$UUD\������� �������0VJ$UUD\������� ����������0VJ$UUD\������� ���������������0VJ$UUD\������� �������0VJ$UUD\������� �:0B.(<83�����0VJ$UUD\������� �)RUP��K:QG������0VJ$UUD\������� �������0VJ$UUD\������� ����������0VJ$UUD\������� ���������������:0B48(8(6<1&�����0VJ$UUD\������� �������0VJ$UUD\������� �:0B48(8(6<1&�����0VJ$UUD\������� �)RUP��K:QG������0VJ$UUD\������� �������0VJ$UUD\������� �������0VJ$UUD\������� ������(QG�6XE�<RX�PLJKW�QRWLFH�WKDW�WKHUH�LV�RQH�SUREOHP�ZLWK�XVLQJ�WKH�:+B-2851$/3/$<%$&.�KRRN��<RX�GR�QRW�ZDQW�WKH�:+B&%7�KRRN�WR�RSHUDWH�RQ�WKH�DFWLRQV�WKDW�DUH�EHLQJ�SOD\HG�EDFN�WKURXJK�WKH�:+B-2851$/3/$<%$&.�KRRN��7R�GLIIHUHQWLDWH�EHWZHHQ�WKH�XVHUV�DFWLRQV�DQG�WKH�SOD\EDFN�RI�PHVVDJHV�WKURXJK�WKH�:+B-2851$/3/$<%$&.�KRRN��WKH�:0B48(8(6<1&�PHVVDJH�LV�XVHG��7KLV�PHVVDJH�LV�DOZD\V�WKH�ILUVW�DQG�WKH�ODVW�PHVVDJH�WR�EH�SOD\HG�EDFN�WKURXJK�WKH�:+B-2851$/3/$<%$&.�KRRN��:KHQ�WKH�:+B&%7�KRRN�LQWHUFHSWV�WKLV�PHVVDJH��LW�VHQGV�WKH�+&%7B46�FRGH�WR�WKH�:+B&%7�KRRN��7KH�:+B&%7�KRRN�FDQ�VHW�D�IODJ�LQGLFDWLQJ�WKDW�D�:+B-2851$/3/$<%$&.�KRRN�LV�LQVWDOOHG��7KH�ODVW�PHVVDJH�WKDW�WKH�:+B-2851$/3/$<%$&.�KRRN�SOD\V�LV�WKH�:0B48(8(6<1&�PHVVDJH��7KH�+&%7B46�FRGH�LV�VHQW�WR�WKH�:+B&%7�KRRN��7KH�:+B&%7�KRRN�FDQ�WKHQ�UHVHW�WKH�IODJ�WR�LWV�LQLWLDO�VWDWH��LQGLFDWLQJ�WKDW�WKH�:+B-2851$/3/$<%$&.�KRRN�LV�ILQLVKHG��7KLV�IODJ�WKDW�WKH�:+B&%7�KRRN�VHWV�LV�XVHG�WR�WHOO�WKLV�KRRN�WKDW�LW�VKRXOG�GR�QR�SURFHVVLQJ�ZKLOH�LW�LV�VHW��,Q�WKLV�ZD\��WKH�:+B&%7�KRRN�FDQ�GLIIHUHQWLDWH�EHWZHHQ�D�XVHUV�DFWLRQV�DQG�DFWLRQV�EHLQJ�SOD\HG�EDFN�WKURXJK�D�:+B-2851$/3/$<%$&.�KRRN���7KH�EORFN�RI�FRGH�LQ�([DPSOH������LV�DGGHG�WR�WKH�%$6�PRGXOH�RI�WKH�H[DPSOH�DSSOLFDWLRQ�WR�LQVWDOO�DQG�UHPRYH�WKH�:+B-2851$/3/$<%$&.�KRRN���

([DPSOH�������&RGH�WR�,QVWDOO�DQG�5HPRYH�WKH�:+B-2851$/3/$<%$&.�+RRN��

Page 453: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�6XE�6HW3OD\EDFN+RRN���������,I�,V3%+RRNHG�7KHQ���������'RQW�KRRN�:+B-2851$/3/$<%$&.�WZLFH�ZLWKRXW�XQKRRNLQJ������(OVH���������6WDUW7LPH� �*HW7LFN&RXQW���������&XUU06*� �����������K3OD\EDFN+RRN� �6HW:LQGRZV+RRN([�:+B-2851$/3/$<%$&.��B�� � � � $GGUHVV2I�-RXUQDO3OD\EDFN3URF��$SS�K,QVWDQFH�������������,V3%+RRNHG� �7UXH�����(QG�,I�(QG�6XE��3XEOLF�6XE�5HPRYH3OD\EDFN+RRN���������'LP�O5HW9DO�$V�/RQJ�����O5HW9DO� �8QKRRN:LQGRZV+RRN([�K3OD\EDFN+RRN������,V3%+RRNHG� �)DOVH�(QG�6XE�([DPSOH������VKRZV�WKH�ILOWHU�IXQFWLRQ�IRU�WKH�:+B-2851$/3/$<%$&.�KRRN��7KLV�FRGH�LV�DOPRVW�LGHQWLFDO�WR�WKH�ILOWHU�IXQFWLRQ�XVHG�LQ�WKH�H[DPSOH�DSSOLFDWLRQ�LQ�&KDSWHU�����ZKLFK�FRYHUV�WKH�:+B-2851$/3/$<%$&.�KRRN��7KH�PDLQ�GLIIHUHQFH�LV�LQGLFDWHG�LQ�EROGIDFH�LQ�WKH�-RXUQDO3OD\EDFN3URF�IXQFWLRQ��7KLV�,I���7KHQ���(OVH�EORFN�RI�FRGH�PDNHV�VXUH�WKDW�WKH�ILUVW�PHVVDJH�SOD\HG�EDFN�LV�WLPHG�FRUUHFWO\���

([DPSOH�������7KH�)LOWHU�)XQFWLRQ�IRU�WKH�:+B-2851$/3/$<%$&.�+RRN��

3XEOLF�)XQFWLRQ�-RXUQDO3OD\EDFN3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B�������������������������������������O3DUDP�$V�(9(1706*��$V�/RQJ�����,I�X&RGH� �+&B*(71(;7�7KHQ�������SOD\�WKH�FXUUHQW�PHVVDJH���������,I�&XUU06*�! ����7KHQ�������������1R�PRUH�PHVVDJHV�WR�SOD\��UHPRYH�WKH�KRRN�DQG�UHVWRUH�FRQWURO��������������WR�WKH�XVHU�JUDFHIXOO\�������������&DOO�5HPRYH3OD\EDFN+RRN���������(OVH�������������O3DUDP�PHVVDJH� �0VJ$UUD\����&XUU06*��������������O3DUDP�KZQG� �0VJ$UUD\����&XUU06*��������������O3DUDP�SDUDP+� �0VJ$UUD\����&XUU06*��������������O3DUDP�SDUDP/� �0VJ$UUD\����&XUU06*��������������,I�&XUU06*� ���7KHQ�����������������O3DUDP�WLPH� �0VJ$UUD\����&XUU06*������������������-RXUQDO3OD\EDFN3URF� �0VJ$UUD\����&XUU06*��

Page 454: Visual Basic - Subclassing and Hooking with VB & VB NET

������������(OVH�����������������O3DUDP�WLPH� �0VJ$UUD\����&XUU06*����0VJ$UUD\����&XUU06*������������������������-RXUQDO3OD\EDFN3URF� �0VJ$UUD\����&XUU06*����0VJ$UUD\����&XUU06*������������������(QG�,I���������(QG�,I�����(OVH,I�X&RGH� �+&B6.,3�7KHQ������UHWULHYH�WKH�QH[W�PHVVDJH���������,I�&XUU06*�! ����7KHQ�������������1R�PRUH�PHVVDJHV�WR�SOD\��UHPRYH�WKH�KRRN�DQG�UHVWRUH�FRQWURO��������������WR�WKH�XVHU�JUDFHIXOO\�������������&DOO�5HPRYH3OD\EDFN+RRN���������(QG�,I����������&XUU06*� �&XUU06*���������(OVH,I�X&RGH� �+&B125(029(�7KHQ���������6NLS�3OD\EDFN���DQ�DSS�KDV�FDOOHG�3HHN0HVVDJH������(OVH,I�X&RGH� �+&B6<602'$/21�7KHQ���������6NLS�SOD\EDFN�����(OVH,I�X&RGH� �+&B6<602'$/2))�7KHQ���������6NLS�SOD\EDFN�����(QG�,I����������-RXUQDO3OD\EDFN3URF� �&DOO1H[W+RRN([�K3OD\EDFN+RRN��X&RGH���Z3DUDP��O3DUDP��(QG�)XQFWLRQ�

�����&DYHDWV�

7KLV�KRRN�KDPSHUV�V\VWHP�SHUIRUPDQFH�FRQVLGHUDEO\�EHFDXVH�LW�LQWHUFHSWV�PDQ\�FRPPRQ�HYHQWV�WKDW�RFFXU�LQ�WKH�V\VWHP��VXFK�DV�FKDQJLQJ�D�FRQWUROV�IRFXV�RU�PDQLSXODWLQJ�D�ZLQGRZ��8QOLNH�WKH�:+B6+(//�KRRN��WKLV�KRRN�ZRUNV�IRU�DOO�ZLQGRZV�DQG�QRW�MXVW�WKH�WRS�OHYHO�XQRZQHG�ZLQGRZV�LQ�WKH�V\VWHP��,I�\RX�FDQ�VROYH�D�SUREOHP�ZLWK�WKH�:+B6+(//�KRRN�LQVWHDG�RI�ZLWK�WKH�:+B&%7�KRRN��E\�DOO�PHDQV�XVH�WKH�:+B6+(//�KRRN��7KH�:+B6+(//�KRRN�SXWV�OHVV�RI�D�VWUDLQ�RQ�WKH�V\VWHP�EHFDXVH�QRW�DOO�ZLQGRZ�HYHQWV�DUH�LQWHUFHSWHG����MXVW�WKRVH�RI�WRS�OHYHO�XQRZQHG�ZLQGRZV���,I�\RX�ZDQW�WR�XVH�WKH�+&%7B.(<6.,33('�FRGH��\RX�PXVW�LQVWDOO�D�:0B.(<%2$5'�KRRN��/LNHZLVH��LI�\RX�ZDQW�WR�XVH�WKH�+&%7B&/,&.6.,33('�FRGH��\RX�PXVW�LQVWDOO�D�:0B0286(�KRRN���

Page 455: Visual Basic - Subclassing and Hooking with VB & VB NET

,I�\RX�XVH�WKH�+&%7B.(<6.,33('�FRGH�WR�LQLWLDWH�DQ�DFWLRQ�IRU�D�NH\VWURNH��\RX�VKRXOG�DOVR�WHVW�IRU�HLWKHU�WKH�:0B.(<83�RU�:0B.(<'2:1�PHVVDJH�DQG�WKHQ�LQLWLDWH�WKH�DFWLRQ�IRU�RQH�RI�WKHVH�PHVVDJHV��2WKHUZLVH��WKH�DFWLRQ�ZLOO�EH�SHUIRUPHG�WZLFH��RQFH�IRU�HDFK�PHVVDJH���0RVW�OLNHO\��ZKHQ�XVLQJ�WKH�:+B&%7�KRRN��\RX�DOVR�ZLOO�XVH�RQH�RU�PRUH�RWKHU�KRRNV�WR�DXJPHQW�LW��:KHQ�GRLQJ�VR��YHULI\�WKDW�\RX�UHOHDVH�HDFK�KRRN�QRW�RQO\�EHIRUH�WKH�DSSOLFDWLRQ�HQGV��EXW�DOVR�EHIRUH�LW�LV�UHLQVWDOOHG��<RX�FDQ�LQVWDOO�WKH�:+B-2851$/3/$<%$&.�KRRN�PXOWLSOH�WLPHV�LQ�D�VLQJOH�&%7�DSSOLFDWLRQV�OLIHWLPH��,W�LV�LPSHUDWLYH�WKDW�\RX�UHOHDVH�WKLV�KRRN�DIWHU�LW�LV�ILQLVKHG�RU�LW�PLJKW�VHHP�DV�LI�\RXU�DSSOLFDWLRQ�KDV�ORFNHG�XS���7KHUH�LV�DQ�DUWLFOH�LQ�WKH�0LFURVRIW�'HYHORSHU�1HWZRUN��06'1��FDOOHG��C35%��&%7B&5($7(:1'�6WUXFW�5HWXUQV�,QYDOLG�&ODVV�1DPH�,'��4���������ZKLFK�LQGLFDWHV�WKDW�WKHUH�LV�D�SRWHQWLDO�SUREOHP�ZLWK�UHWULHYLQJ�WKH�FODVV�QDPH�RI�D�ZLQGRZ�ZKHQ�WKH�:+B&%7�KRRN�UHFHLYHV�WKH�+&%7B&5($7(:1'�FRGH��7KLV�FRGH�FRQWDLQV�D�SRLQWHU�WR�D�&%7B&5($7(:1'�VWUXFWXUH�LQ�LWV�O3DUDP�SDUDPHWHU��7KLV�VWUXFWXUH�FRQWDLQV�D�QHVWHG�VWUXFWXUH��&5($7(6758&7��WKDW�FRQWDLQV�WKH�FODVV�QDPH�OSV]&ODVV��7KH�OSV]&ODVV�PHPEHU�GRHV�QRW�DOZD\V�FRQWDLQ�WKH�PRVW�UHOLDEOH�LQIRUPDWLRQ��HVSHFLDOO\�ZKHQ�DQ�LQWHUQDO�V\VWHP�ZLQGRZ�LV�EHLQJ�FUHDWHG��7KH�UHFRPPHQGHG�ZRUNDURXQG�LV�WR�XVH�WKH�*HW&ODVV1DPH�IXQFWLRQ�LQVWHDG�RI�WKH�&%7B&5($7(:1'�VWUXFWXUH���

Page 456: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU�����:+B-2851$/5(&25'�7KLV�LV�WKH�ILUVW�RI�WZR�FKDSWHUV�WKDW�ZLOO�H[DPLQH�MRXUQDOLQJ�KRRNV��7R�LOOXVWUDWH�KRZ�WKHVH�KRRNV�RSHUDWH��ZH�ZLOO�EXLOG�D�PDFUR�UHFRUGHU�DSSOLFDWLRQ�WKDW�LV�VLPLODU�WR�WKH�PDFUR�UHFRUGHU�WKDW�VKLSSHG�ZLWK�:LQGRZV��[��,Q�WKLV�FKDSWHU��ZH�ZLOO�XVH�WKH�:+B-2851$/5(&25'�KRRN�WR�EXLOG�WKH�SLHFH�RI�WKH�DSSOLFDWLRQ�WKDW�UHFRUGV�D�PDFUR��,Q�&KDSWHU����ZH�ZLOO�XVH�WKH�:+B-2851$/3/$<%$&.�KRRN�WR�EXLOG�WKH�SLHFH�RI�WKH�DSSOLFDWLRQ�WKDW�SOD\V�EDFN�WKH�UHFRUGHG�PDFUR���

�����'HVFULSWLRQ�

<RX�XVH�WKH�:+B-2851$/5(&25'�KRRN�WR�LQWHUFHSW�PRXVH��NH\ERDUG��DQG�RWKHU�KDUGZDUH�PHVVDJHV�WKDW�WKH�V\VWHP�UHFHLYHV��7KH�V\VWHP�UHGLUHFWV�WKHVH�PHVVDJHV�WR�WKLV�KRRNV�ILOWHU�IXQFWLRQ��7KH�ILOWHU�IXQFWLRQ�FDQ�WKHQ�HLWKHU�PRQLWRU�WKH�PHVVDJH�RU�FRS\�LW�WR�PHPRU\�IRU�ODWHU�XVH��LW�FDQQRW�PRGLI\�WKH�PHVVDJH�LQ�DQ\�ZD\��$IWHU�WKH�ILOWHU�IXQFWLRQ�LV�ILQLVKHG�SURFHVVLQJ�WKH�PHVVDJH��LW�SDVVHV�WKH�PHVVDJH�RQ�WR�WKH�PHVVDJH�ORRS�RI�WKH�WKUHDG�IRU�ZKLFK�LW�ZDV�RULJLQDOO\�GHVWLQHG���:KHQ�\RX�XVH�WKLV�KRRN�WR�FRS\�PHVVDJHV�WR�PHPRU\��\RX�FDQ�SOD\�WKHP�EDFN�XVLQJ�WKH�:+B-2851$/3/$<%$&.�KRRN��ZKLFK�ZH�GLVFXVV�LQ�&KDSWHU�����7\SLFDOO\��\RX�UHIHU�WR�WKHVH�WZR�KRRNV��:+B-2851$/5(&25'�DQG�:+B-2851$/3/$<%$&.��DV�MRXUQDOLQJ�KRRNV���7KH�IXQFWLRQ�SURWRW\SH�IRU�WKH�:+B-2851$/5(&25'�KRRNV�ILOWHU�IXQFWLRQ�LV���3XEOLF�)XQFWLRQ�-RXUQDO3URF�%\9DO�X&RGH�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��B�� � � � O3DUDP�$V�(9(1706*��$V�/RQJ�7KH�X&RGH�SDUDPHWHU�FRQWDLQV�D�VSHFLDO�FRGH�WKDW�LQIRUPV�WKH�ILOWHU�IXQFWLRQ�RI�WKH�DFWLRQV�WKDW�LW�FDQ�WDNH�RQ�HDFK�PHVVDJH��7KH�FRGHV�SDVVHG�LQ�WR�WKH�X&RGH�DUJXPHQW�DUH�GLVFXVVHG�ODWHU�LQ�WKLV�VHFWLRQ��$Q�(9(1706*�VWUXFWXUH�LV�DOZD\V�SDVVHG�LQ�WR�WKH�O3DUDP�DUJXPHQW�RI�WKLV�ILOWHU�IXQFWLRQ��7KH�Z3DUDP�DUJXPHQW�RI�WKLV�IXQFWLRQ�LV�QRW�XVHG���$�PHVVDJH�LV�SDVVHG�LQWR�WKLV�KRRNV�ILOWHU�IXQFWLRQ�WKURXJK�WKH�(9(1706*�VWUXFWXUH��ZKLFK�LV�GHILQHG�DV�IROORZV���3ULYDWH�7\SH�(9(1706*���������PHVVDJH�$V�/RQJ���������SDUDP/�$V�/RQJ���������SDUDP+�$V�/RQJ�

Page 457: Visual Basic - Subclassing and Hooking with VB & VB NET

��������WLPH�$V�/RQJ���������KZQG�$V�/RQJ�(QG�7\SH�7KH�PHPEHUV�RI�WKH�(9(1706*�VWUXFWXUH�DUH��PHVVDJH

7KH�PHVVDJH�LGHQWLILHU���SDUDP/

$�PHVVDJH�SDUDPHWHU��7KH�PHVVDJH�W\SH�GHILQHV�WKH�PHDQLQJ�IRU�WKLV�PHPEHU���SDUDP+

$�PHVVDJH�SDUDPHWHU��7KH�PHVVDJH�W\SH�GHILQHV�WKH�PHDQLQJ�IRU�WKLV�PHPEHU���WLPH

7KH�WLPH�WKDW�WKLV�PHVVDJH�ZDV�SRVWHG��KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�WR�ZKLFK�WKLV��PHVVDJH�LV�WR�EH�VHQW��

&RPSDUH�WKLV�VWUXFWXUH�WR�WKH�06*�VWUXFWXUH�GHILQHG�LQ�&KDSWHU������3ULYDWH�7\SH�06*�����KZQG�$V�/RQJ�����PHVVDJH�$V�/RQJ�����Z3DUDP�$V�/RQJ�����O3DUDP�$V�/RQJ�����WLPH�$V�/RQJ�����SW�$V�32,17$3,�(QG�7\SH�7KH�06*�VWUXFWXUH�LV�WKH�FRPSOHWH�PHVVDJH�VHQW�WR�WKH�UDZ�LQSXW�WKUHDG��5,7��DQG�GLVSDWFKHG�WR�WKH�UHOHYDQW�PHVVDJH�TXHXH��7KHUH�DUH�D�FRXSOH�RI�GLIIHUHQFHV�EHWZHHQ�LW�DQG�WKH�(9(1706*�VWUXFWXUH���

• 7KH�Z3DUDP�PHPEHU�RI�WKH�06*�VWUXFWXUH�PDSV�WR�WKH�SDUDP/�PHPEHU�IRU�WKH�(9(1706*�VWUXFWXUH���

• 7KH�O3DUDP�PHPEHU�RI�WKH�06*�VWUXFWXUH�PDSV�WR�WKH�SDUDP+�PHPEHU�RI�WKH�(9(1706*�VWUXFWXUH���

• 7KH�06*�VWUXFWXUH�KDV�D�SW�PHPEHU��DQG�WKH�(9(1706*�VWUXFWXUH�GRHV�QRW��7KH�SW�PHPEHU�LV�D�32,17$3,�VWUXFWXUH�WKDW�FRQWDLQV�WKH�[�DQG�\�FRRUGLQDWHV�RI�WKH�PRXVH�SRLQWHU�DW�WKH�WLPH�WKLV�PHVVDJH�ZDV�VHQW��7KLV�VWUXFWXUH�LV�GHILQHG�DV�IROORZV���

• 3ULYDWH�7\SH�32,17$3,�• � [�$V�/RQJ�• � \�$V�/RQJ�

(QG�7\SH�

Page 458: Visual Basic - Subclassing and Hooking with VB & VB NET

<RX�GR�QRW�QHHG�WKLV�PHPEHU�LQ�WKH�(9(1706*�VWUXFWXUH�EHFDXVH�LW�LV�LUUHOHYDQW�WR�WKH�PHVVDJHV�SOD\EDFN��7KH�WLPH�PHPEHU�LV�UHOHYDQW�EHFDXVH�LW�LV�XVHG�WR�V\QFKURQL]H�WKH�SOD\EDFN�RI�HDFK�PHVVDJH��:H�ZLOO�VHH�KRZ�WKLV�ZRUNV�LQ�&KDSWHU������

�������6WRSSLQJ�7KLV�+RRN�

:LQGRZV�KDV�D�EXLOW�LQ�ZD\�RI�FDQFHOLQJ�WKH�RSHUDWLRQ�RI�DQ\�W\SH�RI�MRXUQDOLQJ�KRRN��7KH�WZR�NH\�FRPELQDWLRQV�WKDW�GR�WKLV�DUH�&75/�(6&�DQG�&75/�$/7�'(/��:KHQ�WKH�XVHU�HQWHUV�RQH�RI�WKHVH�NH\�FRPELQDWLRQV��WKH�V\VWHP�LPPHGLDWHO\�VWRSV�DQG�UHPRYHV�DOO�MRXUQDOLQJ�KRRNV��7KLV�RYHUULGH�LV�QHFHVVDU\�EHFDXVH�D�VLQJOH�PLVEHKDYLQJ�DSSOLFDWLRQ�FDQ�FDXVH�WKH�V\VWHP�WR�KDQJ���:KHQ�\RX�LQVWDOO�WKLV�KRRN��LW�IRUFHV�DOO�LQSXW�WR�EH�VHULDOL]HG��,Q�RWKHU�ZRUGV��DOO�DSSOLFDWLRQV�ZLOO�WDNH�WXUQV�UHDGLQJ�IURP�WKHLU�PHVVDJH�TXHXHV��7KLV�DOORZV�WKH�KRRN�WR�UHFRUG�PHVVDJHV�LQ�DQ�RUGHUO\�IDVKLRQ��2WKHUZLVH��PHVVDJHV�PLJKW�EH�UHFRUGHG�RXW�RI�VHTXHQFH��DQG�XQSUHGLFWDEOH�EHKDYLRU�PLJKW�UHVXOW�ZKHQ�WKH�:+B-2851$/3/$<%$&.�KRRN�SOD\V�WKHP�EDFN��,I�RQH�DSSOLFDWLRQ�KDQJV��DOO�RWKHU�DSSOLFDWLRQV�PXVW�ZDLW�XQWLO�WKH�KXQJ�DSSOLFDWLRQ�UHWXUQV��LI�LW�HYHU�GRHV��,I�LW�GRHV�QRW�UHWXUQ��WKH�XVHU�PXVW�XVH�HLWKHU�WKH�&75/�(6&�RU�WKH�&75/�$/7�'(/�NH\�FRPELQDWLRQV�WR�VWRS�WKH�MRXUQDOLQJ�KRRNV�DQG�UHWXUQ�FRQWURO�EDFN�WR�WKH�XVHU���7R�GHWHUPLQH�LI�D�XVHU�KDV�VWRSSHG�MRXUQDOLQJ�WKURXJK�RQH�RI�WKHVH�NH\�FRPELQDWLRQV��WKH�DSSOLFDWLRQ�FDQ�ZDWFK�IRU�WKH�:0B&$1&(/-2851$/�PHVVDJH�HLWKHU�E\�DGGLQJ�FRGH�WR�WKH�PHVVDJH�ORRS��WKLV�FDQ�EH�GRQH�RQO\�LQ�D�&���DSSOLFDWLRQ���RU�E\�LQVWDOOLQJ�D�:+B*(70(66$*(�KRRN���7KH�:0B&$1&(/-2851$/�PHVVDJH�LV�VHQW�ZLWK�LWV�KZQG�PHPEHU�VHW�WR�18//��7KLV�FDXVHV�WKH�'LVSDWFK0HVVDJH�IXQFWLRQ�LQ�WKH�PHVVDJH�ORRS�QRW�WR�VHQG�WKLV�PHVVDJH�WR�DQ\�ZLQGRZ��)RU�WKLV�UHDVRQ��ZH�FDQQRW�XVH�DQ\�W\SH�RI�VXEFODVVLQJ�PHWKRG�WR�ZDWFK�IRU�WKLV�PHVVDJH�EHFDXVH�VXEFODVVLQJ�FDSWXUHV�PHVVDJHV�DIWHU�WKH\�KDYH�EHHQ�GLVSDWFKHG�WR�WKH�DSSURSULDWH�ZLQGRZ�SURFHGXUH���7KH�0LFURVRIW�GRFXPHQWDWLRQ�IRU�MRXUQDOLQJ�KRRNV�UHFRPPHQGV�XVLQJ�WKH�&75/�%5($.�NH\�FRPELQDWLRQ�WR�JUDFHIXOO\�VWRS�WKH�MRXUQDOLQJ�KRRN��7KH�V\VWHP�GRHV�QRW�DXWRPDWLFDOO\�LPSOHPHQW�WKLV�NH\�FRPELQDWLRQ�WR�VWRS�DQG�UHPRYH�WKH�MRXUQDOLQJ�KRRNV��WKHUHIRUH��ZH�PXVW�PDQXDOO\�LPSOHPHQW�LW�LQ�RXU�FRGH��7KLV�NH\�FRPELQDWLRQ�KDV�WKH�YLUWXDO�NH\�FRGH�9.B&$1&(/��7KLV�FRGH�LV�GHILQHG�LQ�9LVXDO�%DVLF��9%��LQ�WKLV�PDQQHU���3ULYDWH�&RQVW�9.B&$1&(/� �+��,PSOHPHQWLQJ�WKLV�NH\�FRPELQDWLRQ�WR�FDQFHO�WKH�UHFRUGLQJ�SURFHVV�LV�QRW�YHU\�KDUG��7KLV�FRGH�H[DPSOH�GHPRQVWUDWHV�KRZ�WR�GR�LW���,I�O3DUDP�PHVVDJH� �:0B.(<'2:1�$QG�*HW/RZ%\WH�O3DUDP�SDUDP/�� �9.B&$1&(/�7KHQ�� &DOO�5HPRYH-RXUQDO+RRN�(QG�,I�

Page 459: Visual Basic - Subclassing and Hooking with VB & VB NET

:KHQHYHU�WKH�ILOWHU�IXQFWLRQ�UHFHLYHV�WKH�:0B.(<'2:1�PHVVDJH��WKH�(9(1706*�VWUXFWXUHV�SDUDP/�PHPEHU�GHWHUPLQHV�LI�WKH�&75/�%5($.�NH\�FRPELQDWLRQ�LV�SUHVVHG��7KH�9.B&$1&(/�YDOXH�LV�FRQWDLQHG�ZLWKLQ�WKH�ORZ�RUGHU�E\WH�RI�WKH�SDUDP/�PHPEHU�RI�WKH�(9(1706*�VWUXFWXUH��,I�WKH�9.B&$1&(/�NH\�FRPELQDWLRQ�LV�IRXQG��WKH�FRGH�VLPSO\�FDOOV�WKH�IXQFWLRQ�WR�UHPRYH�WKLV�KRRN��1RWH�WKDW�QR�FRGH�LV�H[HFXWHG�DIWHU�WKH�FDOO�WR�5HPRYH-RXUQDO+RRN��7KLV�LV�EHFDXVH�WKH�ILOWHU�IXQFWLRQ�LV�UHPRYHG�IURP�WKH�V\VWHP�ZKHQHYHU�WKH�KRRN�LV�UHPRYHG��DQG�WKHUHIRUH�WKH�FRGH�DOVR�LV�UHPRYHG��7R�WHVW�WKLV��SODFH�DQ�0VJ%R[�IXQFWLRQ�DIWHU�WKH�FDOO�WR�5HPRYH-RXUQDO+RRN��:KHQ�\RX�SUHVV�WKH�&75/�%5($.�NH\�FRPELQDWLRQ��WKH�0VJ%R[�IXQFWLRQ�QHYHU�H[HFXWHV���7UDSSLQJ�WKLV�NH\�FRPELQDWLRQ�WR�VWRS�WKH�KRRN�ZLOO�DOORZ�\RX�WR�UHPRYH�WKH�KRRN�JUDFHIXOO\��<RX�FDQ�SHUIRUP�DQ\�FOHDQXS�KHUH��RU�HYHQ�LQIRUP�WKH�PDLQ�DSSOLFDWLRQ�WKDW�WKH�XVHU�FDQFHOHG�WKH�UHFRUGLQJ��7KH�&75/�(6&�RU�&75/�$/7�'(/�NH\�FRPELQDWLRQV�ZLOO�VWRS�UHFRUGLQJ�LPPHGLDWHO\��ZLWKRXW�LQIRUPLQJ�\RXU�FRGH��DQG�JLYLQJ�\RX�D�FKDQFH�WR�FOHDQ�XS�EHIRUH�WKH�KRRN�LV�UHPRYHG��7KH�&75/�%5($.�NH\�FRPELQDWLRQ�LV�MXVW�D�UHFRPPHQGDWLRQ��LW�LV�QRW�D�UXOH���

�������([SODQDWLRQ�RI�+RRN�&RGHV�

7KHUH�DUH�WKUHH�VSHFLILF�KRRN�FRGHV�WKDW�FDQ�EH�SDVVHG�LQ�WR�WKLV�KRRNV�ILOWHU�IXQFWLRQ��7KH�X&RGH�DUJXPHQW�RI�WKH�ILOWHU�IXQFWLRQ�ZLOO�UHFHLYH�DQ\�RI�WKH�IROORZLQJ�FRGHV���HC_ACTION

,QIRUPV�XV�WKDW�WKH�5,7�KDV�GLVSDWFKHG�D�PHVVDJH�DQG�WKDW�WKLV�KRRN�KDV�LQWHUFHSWHG�LW��7KH�PHVVDJH�LV�FRQWDLQHG�LQ�WKH�(9(1706*�VWUXFWXUH��7KH�FRQVWDQW�LV�GHILQHG�DV�IROORZV���&RQVW�+&B$&7,21� ���

HC_SYSMODALON

,QIRUPV�XV�WKDW�D�V\VWHP�PRGDO�GLDORJ�ER[�KDV�EHHQ�GLVSOD\HG��$Q\�WLPH�D�V\VWHP�PRGDO�GLDORJ�ER[�LV�GLVSOD\HG��ZH�PXVW�SDXVH�WKH�PHVVDJH�UHFRUGLQJ�IXQFWLRQ�XQWLO�WKDW�GLDORJ�ER[�KDV�EHHQ�VKXW�GRZQ��7KH�FRQVWDQW�LV�GHILQHG�DV�IROORZV���&RQVW�+&B6<602'$/21� ���

HC_SYSMODALOFF

,QIRUPV�XV�WKDW�WKH�V\VWHP�PRGDO�GLDORJ�ER[�KDV�EHHQ�VKXW�GRZQ��$W�WKLV�WLPH��ZH�FDQ�UHVXPH�RXU�UHFRUGLQJ��7KH�FRQVWDQW�LV�GHILQHG�DV�IROORZV���&RQVW�+&B6<602'$/2))� ���

:H�FDQ�LJQRUH�WKH�+&B6<602'$/21�DQG�+&B6<602'$/2))�FRGHV�EHFDXVH�WKHVH�WZR�FRGHV�ZHUH�KHOG�RYHU�IURP�WKH�:LQ���GD\V��,Q�:LQ����WKHUH�FDQQRW�EH�D�WUXH�V\VWHP�PRGDO�ZLQGRZ��VLQFH�WKLV�ZRXOG�FDXVH�DOO�ZLQGRZV�LQ�DOO�WKUHDGV�WR�VWRS�UHFHLYLQJ�LQSXW�XQWLO�WKH�V\VWHP�PRGDO�ZLQGRZ�LV�VKXW�GRZQ��:LQ���GRHV�QRW�DOORZ�WKLV�WR�KDSSHQ�EHFDXVH�LW�LV�D�WUXH�PXOWLWDVNLQJ�V\VWHP��$OWKRXJK�\RX�FDQ�DGG�WKH�YE6\VWHP0RGDO�VHWWLQJ�WR�D�9%�PHVVDJH�ER[��WKLV�VHWWLQJ�ZLOO�QRW�DFW�DV�D�V\VWHP�PRGDO�ZLQGRZ�LQ�WKH�:LQ���HQYLURQPHQW��0HVVDJHV�ZLOO�VWLOO�EH�VHQW�WR�RWKHU�ZLQGRZV��)RU�H[DPSOH��WKH�FRGH���

Page 460: Visual Basic - Subclassing and Hooking with VB & VB NET

0VJ%R[��7HVW���YE6\VWHP0RGDO�FDXVHV�WKH�PHVVDJH�ER[�WR�DSSHDU�DW�WKH�WRS�RI�WKH�ZLQGRZ�=�RUGHU��7KH�RQO\�ZLQGRZ�WKDW�GRHV�QRW�UHFHLYH�PHVVDJHV�XQWLO�WKLV�PHVVDJH�ER[�LV�FORVHG�LV�WKH�ZLQGRZ�WKDW�FUHDWHG�WKH�PHVVDJH�ER[���7KH�:LQ���0HVVDJH%R[([�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IXQFWLRQ�DOVR�KDV�0%B6<67(002'$/��D�FRQVWDQW�VLPLODU�WR�WKH�9%�YE6\VWHP0RGDO�VHWWLQJ��0HVVDJH�ER[HV�ZLWK�WKLV�W\SH�RI�VHWWLQJ�ZRUN�LQ�D�IDVKLRQ�VLPLODU�WR�9%�PHVVDJH�ER[HV�ZLWK�WKH�YE6\VWHP0RGDO�VHWWLQJ���$V�XVXDO��ZH�VKRXOG�VNLS�RXU�KRRN�SURFHVVLQJ�DQG�LPPHGLDWHO\�FDOO�&DOO1H[W+RRN([�LI�WKH�X&RGH�DUJXPHQW�LV�OHVV�WKDQ�]HUR���

�������/RFDWLRQ�RI�7KLV�+RRN�LQ�WKH�6\VWHP�

7KLV�KRRN�LV�ORFDWHG�DW�WKH�SRLQW�LQVLGH�WKH�WKUHDG�WKDW�LQVWDOOHG�WKH�MRXUQDO�KRRN��)LJXUH������VKRZV�ZKHUH�WKH�PDLQ�WKUHDG�RI�SURFHVV�%�KDV�LQVWDOOHG�WKH�:+B-2851$/5(&25'�KRRN���

)LJXUH�������7KH�ORFDWLRQ�RI�WKH�:+B-2851$/5(&25'�KRRN�LQ�WKH�PHVVDJLQJ�V\VWHP�

$V�ZLWK�WKH�:+B-2851$/3/$<%$&.��:+B.(<%2$5'B//��DQG�:+B0286(B//�KRRNV��\RX�FDQ�LQVWDOO�WKH�:+B-2851$/5(&25'�KRRN�RQO\�DV�D�V\VWHP�ZLGH�KRRN��7R�UHYLHZ��WKHVH�KRRNV�FDQ�UHVLGH�HLWKHU�LQ�DQ�(;(�RU�G\QDPLF�OLQN�OLEUDU\��'//��PRGXOH��7KLV�PHDQV�WKDW�ZH�FDQ�LPSOHPHQW�WKHVH�KRRNV�VROHO\�ZLWKLQ�9%��7KLV�LV�EHFDXVH�WKH�KRRNV�ILOWHU�

Page 461: Visual Basic - Subclassing and Hooking with VB & VB NET

IXQFWLRQV�DUH�FDOOHG�IURP�ZLWKLQ�WKH�FRQWH[W�RI�WKH�WKUHDG�WKDW�KDV�LQVWDOOHG�WKHVH�WZR�W\SHV�RI�KRRNV���2UGLQDULO\��ZKHQ�\RX�LQVWDOO�D�KRRN�DV�D�V\VWHP�ZLGH�KRRN��\RX�PXVW�SODFH�LW�LQ�D�'//��7KLV�'//�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�VR�WKDW�WKH�KRRN�FDQ�RSHUDWH�RQ�DOO�PHVVDJHV�LQ�WKH�V\VWHP��+RZHYHU��LQ�WKH�FDVH�RI�WKHVH�IRXU�KRRNV��WKH�KRRN�FDQ�EH�LQVWDOOHG�IRU�D�VLQJOH�WKUHDG�DQG�VWLOO�UHFHLYH�HYHU\�PHVVDJH�WKDW�WKH�V\VWHP�JHQHUDWHV�EHFDXVH�HYHU\�PHVVDJH�LV�EHLQJ�IXQQHOHG�WKURXJK�D�VLQJOH�PHVVDJH�TXHXH��$V�D�UHVXOW��WKH�KRRN�GRHV�QRW�KDYH�WR�UHVLGH�LQ�D�'//��LW�FDQ�UHVLGH�LQ�DQ�(;(�DV�ZHOO���1RUPDOO\��HYHU\�WKUHDG�LV�FRQQHFWHG�WR�LWV�RZQ�PHVVDJH�TXHXH��7KHVH�PHVVDJH�TXHXHV�UHFHLYH�PHVVDJHV�IURP�WKH�5,7��7KLV�DUFKLWHFWXUH�JLYHV�DOO����ELW�:LQGRZV�RSHUDWLQJ�V\VWHPV�UREXVW�PXOWLWKUHDGLQJ�FDSDELOLW\�DQG�SUHYHQWV�RQH�DSSOLFDWLRQ�IURP�KDQJLQJ�WKH�ZKROH�V\VWHP���<RX�FDQ�IRUFH�PXOWLSOH�WKUHDGV�WR�UHFHLYH�PHVVDJHV�IURP�D�VLQJOH�PHVVDJH�TXHXH��<RX�GR�WKLV�E\�FDOOLQJ�WKH�$WWDFK7KUHDG,QSXW�$3,�IXQFWLRQ��7KLV�IXQFWLRQ�LV�GHFODUHG�LQ�9%�DV�IROORZV���3ULYDWH�'HFODUH�)XQFWLRQ�$WWDFK7KUHDG,QSXW�/LE��XVHU����B����������$OLDV��$WWDFK7KUHDG,QSXW��B�� � �%\9DO�LG$WWDFK�$V�/RQJ��B�� � %\9DO�LG$WWDFK7R�$V�/RQJ��B�� � %\9DO�I$WWDFK�$V�/RQJ��$V�/RQJ�,WV�SDUDPHWHUV�DUH��LG$WWDFK

7KH�WKUHDG�,'�RI�WKH�WKUHDG�WR�EH�DWWDFKHG�WR�DQRWKHU�WKUHDGV�PHVVDJH�TXHXH���LG$WWDFK7R

7KH�WKUHDG�,'�RI�WKH�WKUHDG�FRQWDLQLQJ�WKH�PHVVDJH�TXHXH�WR�ZKLFK�WKH�WKUHDG�VSHFLILHG�E\�LG$WWDFK�LV�DWWDFKHG���

I$WWDFK

7UXH�VSHFLILHV�WR�DWWDFK�WKH�WZR�WKUHDGV��)DOVH�VSHFLILHV�WR�XQDWWDFK�WKH�WZR�WKUHDGV���$�UHWXUQ�YDOXH�RI�]HUR�LQGLFDWHV�WKDW�WKLV�IXQFWLRQ�IDLOHG��DQ\�RWKHU�YDOXH�LQGLFDWHV�VXFFHVV��1RWH�WKDW�D�WKUHDG�FDQQRW�EH�DWWDFKHG�WR�WKH�5,7��WR�LWVHOI��RU�WR�D�WKUHDG�LQ�DQRWKHU�GHVNWRS��7KH�PHVVDJH�TXHXH�WKDW�LV�XVHG�E\�WKH�WKUHDG�WKDW�LG$WWDFK�VSHFLILHV�GRHV�QRW�UHFHLYH�LQSXW�DIWHU�WKLV�WKUHDG�LV�DWWDFKHG�WR�WKH�RWKHU�PHVVDJH�TXHXH���7KH�PHVVDJH�TXHXH�WKDW�LV�XVHG�E\�WKH�WKUHDG�WKDW�LG$WWDFK�VSHFLILHV�GRHV�QRW�UHFHLYH�LQSXW�DIWHU�WKLV�WKUHDG�LV�DWWDFKHG�WR�WKH�RWKHU�PHVVDJH�TXHXH���:KHQ�RQH�RI�WKHVH�IRXU�KRRNV�LV�LQVWDOOHG�LQ�D�WKUHDG��WKH�V\VWHP�DWWDFKHV�DOO�WKUHDGV�WR�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�WKDW�LQVWDOOHG�WKH�KRRN��7KLV�LV�VLPLODU�WR�FDOOLQJ�$WWDFK7KUHDG,QSXW�IRU�HDFK�WKUHDG��DV�)LJXUH������LOOXVWUDWHV��%HFDXVH�D�VLQJOH�PHVVDJH�TXHXH�LV�IHHGLQJ�DOO�WKUHDGV�LQ�WKH�V\VWHP��WKH�KRRN�FDQ�EH�FDOOHG�IURP�ZLWKLQ�WKH�FRQWH[W�RI�WKH�WKUHDG�WKDW�LQVWDOOHG�WKH�KRRN����WKH�9%�DSSOLFDWLRQ���

)LJXUH�������7KUHDG�VWDWH�EHIRUH�DQG�DIWHU�D�MRXUQDO�KRRN�LV�LQVWDOOHG�

Page 462: Visual Basic - Subclassing and Hooking with VB & VB NET

�����7KH�0DFUR�5HFRUGHU�([DPSOH�

$V�PHQWLRQHG�SUHYLRXVO\��WKH�H[DPSOH�GHPRQVWUDWLQJ�WKLV�KRRN�LV�DQ�DSSOLFDWLRQ�WKDW�UHFRUGV�XVHU�DFWLRQV��<RX�FDQ�SOD\�EDFN�WKHVH�DFWLRQV�ODWHU�XVLQJ�D�GLIIHUHQW�KRRN����VHH�WKH�H[DPSOH�LQ�&KDSWHU�����ZKHUH�ZHOO�FRPSOHWH�WKLV�SRUWLRQ�RI�RXU�DSSOLFDWLRQ��)LJXUH������GLVSOD\V�D�VFUHHQVKRW�RI�WKLV�DSSOLFDWLRQ���

)LJXUH�������$�VFUHHQVKRW�RI�WKH�H[DPSOH�DSSOLFDWLRQ�

Page 463: Visual Basic - Subclassing and Hooking with VB & VB NET

7DEOH������SUHVHQWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���7KH�5(&25'�IUDPH�RQ�WKLV�IRUP�KROGV�WZR�EXWWRQV��7KH�KRRN�EXWWRQ�ZLOO�LQVWDOO�WKH�:+B-2851$/5(&25'�KRRN��DQG�WKH�XQKRRN�EXWWRQ�ZLOO�UHPRYH�WKLV�KRRN��7KH�7(67�$5($�IUDPH�LQFOXGHV�DQ�06*�%2;�EXWWRQ�WKDW�GLVSOD\V�D�WHVW�PHVVDJH�ER[�ZLWK�DQ�2.�EXWWRQ��$�WH[W�ER[�DQG�D�FKHFNER[�DOVR�DUH�LQFOXGHG��<RX�FDQ�XVH�WKHVH�FRQWUROV�WR�UHFRUG�VRPH�VLPSOH�PDFURV��<RX�DOVR�FDQ�UHFRUG�DFWLRQV�WDNHQ�RQ�RWKHU�DSSOLFDWLRQV���7R�RSHUDWH�WKLV�DSSOLFDWLRQ��FOLFN�WKH�KRRN�EXWWRQ�DQG�WKHQ�SHUIRUP�VRPH�DFWLRQV��7KHVH�DFWLRQV�FRXOG�EH�FOLFNLQJ�WKH�06*�%2;�EXWWRQ�WR�FUHDWH�D�PHVVDJH�ER[��FKHFNLQJ�DQG�XQFKHFNLQJ�WKH�FKHFNER[��RU�HYHQ�SHUIRUPLQJ�DFWLRQV�RQ�D�VHSDUDWH�DSSOLFDWLRQ��7R�VWRS�WKH�UHFRUGLQJ��FOLFN�WKH�XQKRRN�EXWWRQ���,QLWLDOO\�WKLV�DSSOLFDWLRQ�ZLOO�QRW�GR�PXFK��&KDSWHU�����ZKLFK�LQWURGXFHV�WKH�:+B-2851$/3/$<%$&.�KRRN��ZLOO�FRPSOHWH�WKH�IXQFWLRQDOLW\�IRU�WKLV�PDFUR�UHFRUGHU�DSSOLFDWLRQ���

7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��2EMHFW�7\SH� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�

)RUP� 1DPH� )RUP��)RUP� &DSWLRQ� �5HFRUGHU�$SSOLFDWLRQ��)RUP� 7RS� ����)RUP� /HIW� ����)RUP� +HLJKW� �����)RUP� :LGWK� �����)UDPH� &DSWLRQ� �5(&25'��)UDPH� 1DPH� )UDPH��)UDPH� 7RS� ����)UDPH� /HIW� ����

Page 464: Visual Basic - Subclassing and Hooking with VB & VB NET

)UDPH� +HLJKW� �����)UDPH� :LGWK� �����)UDPH� &DSWLRQ� �3/$<%$&.��)UDPH� 1DPH� )UDPH��)UDPH� 7RS� ����)UDPH� /HIW� ����)UDPH� +HLJKW� �����)UDPH� :LGWK� �����)UDPH� &DSWLRQ� �7(67�$5($��)UDPH� 1DPH� )UDPH��)UDPH� 7RS� ����)UDPH� /HIW� �����)UDPH� +HLJKW� �����)UDPH� :LGWK� �����7H[W%R[� 7RS� ����7H[W%R[� /HIW� �����7H[W%R[� +HLJKW� ����7H[W%R[� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH�� FPG+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �KRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH�� FPG8Q+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �XQKRRN��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����&RPPDQG�%XWWRQ�� &DSWLRQ� �06*�%2;��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����

Page 465: Visual Basic - Subclassing and Hooking with VB & VB NET

&RPPDQG�%XWWRQ�� :LGWK� ����&KHFN%R[� &DSWLRQ� �7HVW�&KHFN�%R[�&RQWURO��&KHFN%R[� 7RS� ����&KHFN%R[� /HIW� �����&KHFN%R[� +HLJKW� ����&KHFN%R[� :LGWK� �����/HWV�VWDUW�H[DPLQLQJ�WKH�DSSOLFDWLRQV�FRGH�E\�ORRNLQJ�DW�0RGXOH��EDV��WKH�DSSOLFDWLRQV�FRGH�PRGXOH��:H�PXVW�LQLWLDOO\�GHILQH�VHYHUDO�YDULDEOHV�IRU�WKLV�DSSOLFDWLRQ���3ULYDWH�K5HFRUG+RRN�$V�/RQJ�3ULYDWH�0VJ$UUD\�����$V�/RQJ�3ULYDWH�6WDUW7LPH�$V�/RQJ��3XEOLF�,V+RRNHG�$V�%RROHDQ�7KH�K5HFRUG+RRN�YDULDEOH�ZLOO�KROG�WKH�KRRN�KDQGOH��ZKLFK�LV�UHWXUQHG�IURP�WKH�6HW:LQGRZV+RRN([�IXQFWLRQ�DQG�LV�XVHG�LQ�VHYHUDO�RWKHU�IXQFWLRQV��)RU�WKLV�UHDVRQ��LW�LV�GHFODUHG�DV�D�PRGXOH�OHYHO�YDULDEOH��7KH�8Q+RRN:LQGRZV+RRN([�IXQFWLRQ�XVHV�WKLV�KDQGOH�ZKHQ�UHPRYLQJ�D�KRRN��DQG�WKH�&DOO1H[W+RRN([�IXQFWLRQ�XVHV�LW�ZKHQ�FDOOLQJ�WKH�QH[W�KRRN�LQ�WKH�KRRN�FKDLQ���7KH�0VJ$UUD\�YDULDEOH�LV�D�PXOWLGLPHQVLRQDO�G\QDPLF�DUUD\�WKDW�FRQWDLQV�WKH�PHVVDJHV�WKDW�WKLV�KRRN�UHFRUGV��7KH�:0B-2851$/3/$<%$&.�KRRN�XVHV�WKLV�DUUD\�WR�SOD\�EDFN�WKH�PHVVDJHV��<RX�FRXOG�VWRUH�WKHVH�PHVVDJHV�LQ�D�WH[W�ILOH�RU�LQ�D�GDWDEDVH�LI�WKH\�EHFRPH�H[FHVVLYHO\�ODUJH���7KH�6WDUW7LPH�YDULDEOH�ZLOO�KROG�WKH�WLPH�LQ�ZKLFK�WKH�KRRN�VWDUWHG�UHFRUGLQJ��7KLV�YDOXH�LV�VXEWUDFWHG�IURP�WKH�WLPH�PHPEHU�LQ�WKH�(9(1706*�VWUXFWXUH�WR�JHW�WKH�DPRXQW�RI�WLPH�EHWZHHQ�ZKHQ�WKH�KRRN�ZDV�LQVWDOOHG�DQG�WKH�PHVVDJH�ZDV�GLVSDWFKHG�WR�LWV�UHVSHFWLYH�WKUHDG��7KH�SXUSRVH�RI�WKLV�ZLOO�EHFRPH�DSSDUHQW�ZKHQ�ZH�DWWHPSW�WR�SOD\�EDFN�WKHVH�PHVVDJHV�DW�WKH�VDPH�SDFH�DW�ZKLFK�WKH\�ZHUH�UHFRUGHG���7KH�%RROHDQ�,V+RRNHG�YDULDEOH�LV�XVHG�DV�D�IODJ�WR�GHWHUPLQH�ZKHWKHU�WKH�KRRN�KDV�EHHQ�VHW��7KLV�ZLOO�SUHYHQW�XV�IURP�LQVWDOOLQJ�WKLV�KRRN�PRUH�WKDQ�RQFH���7KH�ILUVW�IXQFWLRQ�WKDW�ZH�QHHG�LV�WKH�ILOWHU�IXQFWLRQ��7KLV�IXQFWLRQ�LV�QDPHG�-RXUQDO3URF�DQG�LV�GHILQHG�LQ�([DPSOH�������7KLV�IXQFWLRQ�UHFRUGV�D�PHVVDJH�RQO\�ZKHQ�WKH�X&RGH�DUJXPHQW�LV�HTXDO�WR�+&B$&7,21��%HIRUH�DFWXDOO\�UHFRUGLQJ�WKH�PHVVDJH��WKH�IXQFWLRQ�ZLOO�WHVW�WR�GHWHUPLQH�ZKHWKHU�WKH�XVHU�SUHVVHG�WKH�&75/�%5($.�NH\�FRPELQDWLRQ��,I�WKH�XVHU�GLG�SUHVV�WKLV�NH\�FRPELQDWLRQ��WKH�FRGH�ZLOO�FOHDQ�XS�DIWHU�LWVHOI�DQG�UHPRYH�WKH�KRRN��,I�WKH�XVHU�GLG�QRW��WKH�FRGH�ZLOO�FRS\�WKH�VWUXFWXUH�PHPEHUV�WR�ZKLFK�WKH�O3DUDP�DUJXPHQW�SRLQWHG�LQWR�WKH�G\QDPLF�DUUD\�0VJ$UUD\��1RWLFH�WKDW�WKH�WLPH�FRSLHG�LQWR�WKLV�DUUD\�LV�WKH�FXUUHQW�WLPH�PLQXV�WKH�WLPH�WKDW�WKH�UHFRUGLQJ�ZDV�VWDUWHG��7KH�ODVW�WKLQJ�WKDW�WKLV�ILOWHU�IXQFWLRQ�GRHV�LV�FDOO�&DOO1H[W+RRN([�WR�SDVV�WKLV�LQIRUPDWLRQ�WR�WKH�QH[W�ILOWHU�IXQFWLRQ�LQ�WKH�KRRN�FKDLQ���

Page 466: Visual Basic - Subclassing and Hooking with VB & VB NET

([DPSOH�������7KH�-RXUQDO3URF�)LOWHU�)XQFWLRQ��

3XEOLF�)XQFWLRQ�-RXUQDO3URF�%\9DO�X&RGH�$V�/RQJ��B�� � � � ��%\9DO�Z3DUDP�$V�/RQJ��B�� � � � ��O3DUDP�$V�(9(1706*��$V�/RQJ�����,I�X&RGH� �+&B$&7,21�7KHQ���������,I�O3DUDP�PHVVDJH� �:0B.(<'2:1�$QG�*HW/RZ%\WH�O3DUDP�SDUDP/�� �9.B&$1&(/�7KHQ�������������3ODFH�FOHDQ�XS�FRGH�KHUH�������������&DOO�5HPRYH-RXUQDO+RRN�������������&RGH�SODFHG�KHUH�ZLOO�QRW�EH�H[HFXWHG���������(QG�,I���������0VJ$UUD\����8%RXQG�0VJ$UUD\������ �X&RGH���������0VJ$UUD\����8%RXQG�0VJ$UUD\������ �O3DUDP�PHVVDJH���������0VJ$UUD\����8%RXQG�0VJ$UUD\������ �O3DUDP�KZQG���������0VJ$UUD\����8%RXQG�0VJ$UUD\������ �O3DUDP�SDUDP+���������0VJ$UUD\����8%RXQG�0VJ$UUD\������ �O3DUDP�SDUDP/���������0VJ$UUD\����8%RXQG�0VJ$UUD\������ ��O3DUDP�WLPH���6WDUW7LPH�������������������5H'LP�3UHVHUYH�0VJ$UUD\�����8%RXQG�0VJ$UUD\�����������$V�/RQJ�����(OVH,I�X&RGH� �+&B6<602'$/21�7KHQ���������6NLS�UHFRUGLQJ�����(OVH,I�X&RGH� �+&B6<602'$/2))�7KHQ���������6NLS�UHFRUGLQJ�����(QG�,I����������-RXUQDO3URF� �&DOO1H[W+RRN([�K5HFRUG+RRN��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KH�6HW-RXUQDO+RRN�VXEURXWLQH�VKRZQ�LQ�([DPSOH������VHWV�XS�DQG�LQVWDOOV�WKLV�MRXUQDOLQJ�KRRN��7KH�,V+RRNHG�IODJ�LV�FKHFNHG�WR�GHWHUPLQH�LI�WKH�KRRN�KDV�DOUHDG\�EHHQ�LQVWDOOHG��,I�LW�KDV�QRW��WKH�0VJ$UUD\�DUUD\�LV�LQLWLDOL]HG��WKH�6WDUW7LPH�YDULDEOH�LV�VHW�WR�WKH�FXUUHQW�V\VWHP�WLPH��DQG�WKH�6HW:LQGRZV+RRN([�IXQFWLRQ�LQVWDOOV�WKH�KRRN��1RWLFH�WKDW�WKLV�KRRN�LV�LQVWDOOHG�VLPLODU�WR�D�V\VWHP�ZLGH�KRRN��HYHQ�WKRXJK�LWV�ILOWHU�IXQFWLRQ�UHVLGHV�LQ�WKLV�DSSOLFDWLRQ�DQG�QRW�LQ�D�'//���

([DPSOH�������,QVWDOOLQJ�WKH�:+B-2851$/5(&25'�+RRN��

3XEOLF�6XE�6HW-RXUQDO+RRN���������,I�,V+RRNHG�7KHQ���������0VJ%R[��'RQW�KRRN�LW�WZLFH�ZLWKRXW�XQKRRNLQJ�RU�\RX�ZLOO�EH�XQDEOH����

Page 467: Visual Basic - Subclassing and Hooking with VB & VB NET

����������������WR�XQKRRN�LW�������(OVH���������5H'LP�0VJ$UUD\�������$V�/RQJ����������6WDUW7LPH� �*HW7LFN&RXQW���������K5HFRUG+RRN� �6HW:LQGRZV+RRN([�:+B-2851$/5(&25'��B�����������������������$GGUHVV2I�-RXUQDO3URF��$SS�K,QVWDQFH�������������,V+RRNHG� �7UXH�����(QG�,I�(QG�6XE�7R�UHPRYH�WKH�KRRN��WKH�5HPRYH-RXUQDO+RRN�VXEURXWLQH�VKRZQ�LQ�([DPSOH������FDOOV�8QKRRN:LQGRZV+RRN([�ZLWK�WKH�KRRNV�KDQGOH��7KH�O5HW9DO�UHWXUQ�YDOXH�IRU�WKLV�IXQFWLRQ�LV�WHVWHG�IRU�D�VXFFHVV�RU�IDLOXUH�WR�UHPRYH�WKH�KRRN��,I�VXFFHVVIXO��WKH�,V+RRNHG�IODJ�LV�VHW�WR�)$/6(���

([DPSOH�������5HPRYLQJ�WKH�:+B-2851$/5(&25'�+RRN��

3XEOLF�6XE�5HPRYH-RXUQDO+RRN���������'LP�O5HW9DO�$V�/RQJ��� O5HW9DO� �8QKRRN:LQGRZV+RRN([�K5HFRUG+RRN������,V+RRNHG� �)DOVH�(QG�6XE�*HW/RZ%\WH�LV�D�IXQFWLRQ�WKDW�WKH�KRRN�SURFHGXUH�FDOOV�WKDW�UHWXUQV�WKH�ORZ�RUGHU�E\WH�RI�WKH�O9DOXH�DUJXPHQW��DV�([DPSOH������LOOXVWUDWHV��<RX�QHHG�WKLV�IXQFWLRQ�WR�JHW�WKH�YLUWXDO�NH\�FRGH�IURP�WKH�SDUDP/�PHPEHU�RI�WKH�(9(1706*�VWUXFWXUH�WKDW�ZDV�SDVVHG�LQ�WR�WKH�ILOWHU�IXQFWLRQ���

([DPSOH�������7KH�*HW/RZ%\WH�)XQFWLRQ��

3XEOLF�)XQFWLRQ�*HW/RZ%\WH�%\5HI�O9DOXH�$V�/RQJ��$V�/RQJ����*HW/RZ%\WH� ��O9DOXH�$QG�+))��(QG�)XQFWLRQ�)LQDOO\��([DPSOH������VKRZV�WKH�FRGH�WKDW�LV�SODFHG�LQ�WKH�IRUP�PRGXOH��7KH�VXEURXWLQHV�XQGHU�WKH�5(&25'�VHFWLRQ�RI�WKH�IRUP�PRGXOH�FRGH�LQVWDOO�DQG�UHPRYH�WKH�KRRN��7KH�VXEURXWLQH�XQGHU�WKH�7(67�VHFWLRQ�VLPSO\�GLVSOD\V�D�PHVVDJH�ER[��ZKLFK�FDQ�EH�XVHG�LQ�WKH�UHFRUGLQJ�SURFHVV��7KH�&/($183�VHFWLRQ�FRQWDLQV�WKH�4XHU\8QORDG�VXEURXWLQH��ZKLFK�WHVWV�IRU�DQ�DFWLYH�KRRN��,I�WKH�KRRN�LV�LQVWDOOHG��D�ZDUQLQJ�LV�GLVSOD\HG�LQIRUPLQJ�WKH�XVHU�WR�UHPRYH�WKH�KRRN�EHIRUH�FORVLQJ�WKH�DSSOLFDWLRQ��,QVWHDG�RI�WKLV�PHVVDJH��ZH�FRXOG�FDOO�WKH�5HPRYH-RXUQDO+RRN�IXQFWLRQ�WR�DXWRPDWLFDOO\�UHPRYH�WKH�KRRN���

([DPSOH�������7KH�6RXUFH�&RGH�IRU�)RUP��IUP��

Page 468: Visual Basic - Subclassing and Hooking with VB & VB NET

������������5(&25'�������������3ULYDWH�6XE�FPG+RRNB&OLFN���������&DOO�,QLW$UUD\�����&DOO�6HW-RXUQDO+RRN�(QG�6XE��3ULYDWH�6XE�FPG8Q+RRNB&OLFN���������&DOO�5HPRYH-RXUQDO+RRN�(QG�6XE���������������7(67�������������3ULYDWH�6XE�&RPPDQG�B&OLFN���������0VJ%R[��-RXUQDOLQJ�7HVW�0HVVDJH�%R[���(QG�6XE���������������&/($183�������������3ULYDWH�6XE�)RUPB4XHU\8QORDG�&DQFHO�$V�,QWHJHU��8QORDG0RGH�$V�,QWHJHU������,I�,V+RRNHG�7KHQ���������&DQFHO� �����������0VJ%R[��8QKRRN�EHIRUH�FORVLQJ�RU�WKH�DSSOLFDWLRQ�PD\�FUDVK�������(QG�,I�(QG�6XE�<RX�GRQW�QHHG�PXFK�FRGH�WR�FUHDWH�WKLV�H[DPSOH��7KH�:0B-2851$/3/$<%$&.�KRRN��GLVFXVVHG�LQ�&KDSWHU�����LV�VOLJKWO\�PRUH�LQYROYHG��

�����&DYHDWV�

7KLV�KRRN��LQ�HIIHFW��IRUFHV�HYHU\�WKUHDG�WR�UHFHLYH�PHVVDJHV�IURP�D�VLQJOH�TXHXH��7KLV�LV�KRZ�WKH����ELW�:LQGRZV�RSHUDWLQJ�V\VWHPV�ZRUNV��7KHUHIRUH��WKH�RSHUDWLQJ�V\VWHP�FDQQRW�WDNH�DGYDQWDJH�RI�PXOWLWDVNLQJ��$�SUREOHP�WKDW�RFFXUV�LQ�DOO����ELW�:LQGRZV�RSHUDWLQJ�

Page 469: Visual Basic - Subclassing and Hooking with VB & VB NET

V\VWHPV�FDQ�QRZ�RFFXU�LQ����ELW�:LQGRZV�RSHUDWLQJ�V\VWHPV��D�VLQJOH�DSSOLFDWLRQ�FDQ�KDQJ�DOO�DSSOLFDWLRQV��HYHQ�WKH�GHVNWRS��7KLV�LV�WKH�UHDVRQ�IRU�KDYLQJ�WKH�&75/�(6&�DQG�&75/�$/7�'(/�NH\�FRPELQDWLRQV�EXLOW�LQWR�WKH�V\VWHP�WR�UHPRYH�DQ\�MRXUQDO�KRRNV���%HFDXVH�WKLV�KRRN�VHULDOL]HV�DOO�LQSXW�WR�DOO�ZLQGRZV��WKHUH�LV�D�ODUJH�SHUIRUPDQFH�SHQDOW\��<RX�VKRXOG�XVH�KRRNV�VXFK�DV�WKLV�FDXWLRXVO\��:KHQ�\RX�GR�XVH�VXFK�KRRNV��\RX�VKRXOG�LQVWDOO�WKHP�IRU�DV�OLWWOH�WLPH�DV�SRVVLEOH��:LQGRZV�FDQQRW�WDNH�DGYDQWDJH�RI�LWV�PXOWLWDVNLQJ�SRZHU�ZKHQ�WKLV�KRRN�LV�LQVWDOOHG���:KHQ�\RX�XVH�WKLV�KRRN��\RX�PLJKW�HQFRXQWHU�D�SUREOHP�ZLWK�WKH�PRXVH�ZKHHO��7KLV�SUREOHP�LV�UHFRUGHG�XQGHU�,'��4������35%��:0B0286(:+((/�'HOWD�9DOXHV�1RW�6XSSRUWHG�E\�-RXUQDO�+RRNV��LQ�WKH�0LFURVRIW�'HYHORSHU�1HWZRUN��06'1���,Q�VKRUW��WKLV�KRRN�GRHV�QRW�UHFRUG�WKH�ZKHHO�GHOWD�YDOXH��7KHUHIRUH��ZKHQ�WKH�PHVVDJHV�DUH�SOD\HG�EDFN�WKURXJK�WKH�:+B-2851$/3/$<%$&.�KRRN��WKH�PRXVH�ZKHHO�URWDWLRQV�DUH�QRW�SOD\HG�EDFN��7KLV�LV�EHFDXVH�WKH�ZKHHO�GHOWD�YDOXH�LV�SODFHG�LQ�WKH�Z3DUDP�PHPEHU�RI�WKH�:0B0286(:+((/�PHVVDJH��ZKLFK�WKLV�KRRN�GRHV�QRW�UHFRUG��7KH�UHVW�RI�WKH�:0B0286(:+((/�PHVVDJH��KRZHYHU��LV�UHFRUGHG�DQG�SOD\HG�EDFN���7KLV�KRRN�FDQQRW�UHFRUG�WKH�&75/�(6&�DQG�&75/�$/7�'(/�NH\�FRPELQDWLRQV��6LPLODUO\��DQ\�NH\�RU�NH\�FRPELQDWLRQ�WKDW�\RX�PLJKW�XVH�WR�JUDFHIXOO\�H[LW�WKH�KRRN�VKRXOG�QRW�EH�UHFRUGHG���

Page 470: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU�����:+B-2851$/3/$<%$&.�&KDSWHU����GLVFXVVHG�WKH�:+B-2851$/5(&25'�KRRN�DQG�KRZ�\RX�FDQ�XVH�LW�WR�UHFRUG�PRXVH�DQG�NH\ERDUG�LQSXW�PHVVDJHV��7KLV�FKDSWHU�ZLOO�FRYHU�WKH�:+B-2851$/3/$<%$&.�KRRN��ZKLFK�LV�WKH�FRXQWHUSDUW�WR�WKH�:+B-2851$/5(&25'�KRRN�WKDW�\RX�FDQ�XVH�WR�SOD\�EDFN�PRXVH�DQG�NH\ERDUG�PHVVDJHV��$IWHU�GLVFXVVLQJ�WKH�:+B-2851$/3/$<%$&.�KRRN��,�ZLOO�GHPRQVWUDWH�KRZ�\RX�FDQ�XVH�WKLV�KRRN�WR�ILQLVK�WKH�PDFUR�UHFRUGHU�H[DPSOH�DSSOLFDWLRQ�WKDW�ZH�EHJDQ�LQ�&KDSWHU������

�����'HVFULSWLRQ�

7KH�:+B-2851$/3/$<%$&.�KRRN�SURYLGHV�D�ZD\�WR�SOD\�EDFN�PHVVDJHV�WR�WKH�:LQGRZV�RSHUDWLQJ�V\VWHP��:KHQ�,�VD\��SOD\�EDFN�PHVVDJHV���,�PHDQ�WR�SRVW�SUHUHFRUGHG�PHVVDJHV�WR�WKH�UDZ�LQSXW�WKUHDG��5,7��PHVVDJH�TXHXH�VR�WKDW�WKH�V\VWHP�FDQ�SURFHVV�WKHP��)URP�WKH�V\VWHPV�SRLQW�RI�YLHZ��PHVVDJHV�SOD\HG�EDFN�LQ�WKLV�PDQQHU�DUH�QR�GLIIHUHQW�IURP�PHVVDJHV�LQSXW�WKURXJK�D�NH\ERDUG�RU�PRXVH���7KLV�KRRN�ZRUNV�GLIIHUHQWO\�WKDQ�WKH�RWKHU�KRRNV�GR��,QVWHDG�RI�LQWHUFHSWLQJ�PHVVDJHV�ZLWKLQ�WKH�PHVVDJH�VWUHDP��WKLV�KRRN�SRVWV�PHVVDJHV�WR�WKH�5,7�PHVVDJH�TXHXH��$IWHU�\RX�LQVWDOO�WKLV�KRRN��WKH�PHVVDJH�ORRS�LQ�WKH�5,7�FHDVHV�WR�UHPRYH�PHVVDJHV�IURP�LWV�PHVVDJH�TXHXH�WKDW�ZHUH�SODFHG�WKHUH�E\�QRUPDO�NH\ERDUG�DQG�PRXVH�LQSXW��DQG�LW�VWDUWV�DFFHSWLQJ�RQO\�PHVVDJHV�IURP�WKH�KRRNV�ILOWHU�IXQFWLRQ��0RUH�VSHFLILFDOO\��LW�UHFHLYHV�WKH�DFWXDO�PHVVDJH�IURP�WKH�ILOWHU�IXQFWLRQV�O3DUDP�DUJXPHQW��7KLV�LV�ZK\�WKH�V\VWHP�VHHPV�DV�WKRXJK�LW�LV�QRW�DFFHSWLQJ�LQSXW�IURP�WKH�NH\ERDUG�RU�PRXVH�ZKLOH�WKH�KRRN�LV�LQVWDOOHG���:KLOH�WKLV�KRRN�LV�LQVWDOOHG��HYHQWV�WKDW�WKH�PRXVH�DQG�NH\ERDUG�SURGXFH�DUH�SODFHG�LQ�WKH�5,7V�PHVVDJH�TXHXH��DV�WKH\�QRUPDOO\�ZRXOG�EH��7KHVH�TXHXHG�PHVVDJHV�DUH�QRW�SDVVHG�RQ�WR�WKH�5,7V�PHVVDJH�ORRS�XQWLO�WKH�:+B-2851$/3/$<%$&.�KRRN�LV�UHPRYHG��$IWHU�WKLV�KRRN�LV�UHPRYHG��WKH�TXHXHG�PHVVDJHV�DUH�VHQW�WR�WKHLU�UHVSHFWLYH�ZLQGRZV��7KH�PHPRU\�VSDFH�WKDW�FDQ�EH�DOORFDWHG�IRU�WKH�PHVVDJH�TXHXH�LV�QRW�LQILQLWH��WKHUHIRUH��PRXVH�RU�NH\ERDUG�HYHQWV�DUH�ORVW�DIWHU�WKLV�TXHXH�LV�ILOOHG���7KH�SURWRW\SH�IRU�WKH�:+B-2851$/3/$<%$&.�KRRN�LV��3XEOLF�)XQFWLRQ�-RXUQDO3OD\EDFN3URF�%\9DO�X&RGH�$V�/RQJ��B�� � � � � %\9DO�Z3DUDP�$V�/RQJ��B�� � � � � O3DUDP�$V�(9(1706*��$V�/RQJ�7KH�V\VWHP�FDQ�VHQG�RQH�RI�VHYHUDO�FRGHV�WR�WKLV�ILOWHU�IXQFWLRQV�X&RGH�DUJXPHQW��7KH�WZR�PRVW�LPSRUWDQW�FRGHV�DUH�+&B*(71(;7�DQG�+&B6.,3��,�ZLOO�GLVFXVV�WKHVH�DQG�WKH�UHPDLQLQJ�FRGHV�LQ�WKH�QH[W�VHFWLRQ���

Page 471: Visual Basic - Subclassing and Hooking with VB & VB NET

7KLV�KRRN�GRHV�QRW�XVH�WKH�Z3DUDP�DUJXPHQW��7KH�O3DUDP�DUJXPHQW�FRQWDLQV�D�SRLQWHU�WR�WKH�(9(1706*�VWUXFWXUH��7KLV�LV�WKH�VDPH�VWUXFWXUH�WKDW�,�GHVFULEHG�LQ�&KDSWHU�����7KH�GLIIHUHQFH�EHWZHHQ�WKH�O3DUDP�DUJXPHQW�RI�WKLV�KRRN�DQG�RI�WKH�:+B-2851$/5(&25'�KRRN�LV�WKDW�IRU�WKLV�KRRN��WKH�GHYHORSHU�PXVW�ILOO�WKH�O3DUDP�DUJXPHQW�ZLWK�D�YDOLG�(9(1706*�VWUXFWXUH��7KH�:+B-2851$/5(&25'�KRRN�SURYLGHV�D�PHVVDJH�VWUXFWXUH�LQ�WKH�O3DUDP�VR�WKDW�WKH�GHYHORSHU�FDQ�PRQLWRU�RU�UHFRUG�WKH�PHVVDJH��7KH�(9(1706*�VWUXFWXUH�LV�WKHQ�FRQYHUWHG�WR�DQ�06*�VWUXFWXUH�DQG�WKH�5,7�GLVSDWFKHV�LW�WR�WKH�DSSURSULDWH�WKUHDG���$Q�LQVWDOOHG�:+B-2851$/3/$<%$&.�KRRN�ZLOO�DFFHSW�PHVVDJHV�WKURXJK�LWV�ILOWHU�IXQFWLRQV�O3DUDP�DUJXPHQW��:KHQ�WKLV�ILOWHU�IXQFWLRQ�UHWXUQV��LW�FDXVHV�WKH�PHVVDJH�WR�EH�SODFHG�DW�WKH�KHDG�RI�WKH�PHVVDJH�TXHXH��7KH�5,7V�PHVVDJH�ORRS�WKHQ�SURFHVVHV�WKLV�PHVVDJH�DQG�VHQGV�LW�WR�WKH�FRUUHFW�ZLQGRZ���7KH�ILOWHU�IXQFWLRQV�UHWXUQ�YDOXH�LV�XVHG�IRU�WLPLQJ�SXUSRVHV��,I�D�GHYHORSHU�VHWV�WKH�UHWXUQ�YDOXH�WR�]HUR��WKHUH�LV�QR�GHOD\�EHWZHHQ�PHVVDJHV�EHLQJ�VHQW�DQG�SURFHVVHG��,I�D�GHYHORSHU�VHWV�WKH�UHWXUQ�YDOXH�WR�DQ\�YDOXH�JUHDWHU�WKDQ�]HUR��D�GHOD\�LV�LQWURGXFHG�EHWZHHQ�WKH�VHQGLQJ�RI�PHVVDJHV��7KH�UHWXUQ�YDOXH�LV�HTXDO�WR�WKH�QXPEHU�RI�FORFN�WLFNV�WKDW�WKH�KRRN�PXVW�ZDLW�EHIRUH�VHQGLQJ�WKH�QH[W�PHVVDJH��7KLV�UHWXUQ�YDOXH�LV�XVHG�RQO\�LI�WKH�X&RGH�DUJXPHQW�LV�HTXDO�WR�+&B*(71(;7��RWKHUZLVH��LW�LV�LJQRUHG���7KLV�KRRN�LV�VLPLODU�WR�WKH�:+B-2851$/5(&25'�KRRN�LQ�WKH�IROORZLQJ�ZD\V���

• %RWK�DUH�V\VWHP�ZLGH�KRRNV�WKDW�\RX�FDQ�SODFH�LQ�DQ�(;(�RU�LQ�D�G\QDPLF�OLQN�OLEUDU\��'//��PRGXOH���

• %RWK�KRRNV�ILOWHU�IXQFWLRQV�DUH�FDOOHG�IURP�ZLWKLQ�WKH�FRQWH[W�RI�WKH�WKUHDG�LQ�ZKLFK�WKH\�UHVLGH���

• <RX�FDQ�VWRS�ERWK�KRRNV�XVLQJ�WKH�&75/�(6&�RU�&75/�$/7�'(/(7(�NH\�FRPELQDWLRQV���

• :KHQ�\RX�VWRS�HLWKHU�KRRN�XVLQJ�WKH�DIRUHPHQWLRQHG�NH\�FRPELQDWLRQV��WKH�:0B&$1&(/-2851$/�PHVVDJH�LV�VHQW�WR�WKH�KRRNLQJ�DSSOLFDWLRQ���

• 0LFURVRIW�UHFRPPHQGV�DGGLQJ�WKH�&75/�%5($.�NH\�FRPELQDWLRQ�WR�DOORZ�WKH�XVHU�WR�JUDFHIXOO\�VWRS�HLWKHU�KRRN���

• <RX�FDQ�LJQRUH�WKH�+&B6<602'$/21�DQG�+&B6<602'$/2))�FRGHV�IRU�HLWKHU�KRRN���

�������([SODQDWLRQ�RI�+RRN�&RGHV�

7KH�ILOWHU�IXQFWLRQV�X&RGH�DUJXPHQW�FDQ�UHFHLYH�DQ\�RI�ILYH�GLIIHUHQW�FRGHV��7KHVH�FRGHV�DUH���HC_GETNEXT

:KHQ�WKH�ILOWHU�IXQFWLRQ�UHFHLYHV�WKLV�FRGH��WKH�IXQFWLRQ�PXVW�SODFH�WKH�QH[W�PHVVDJH�WR�EH�SOD\HG�LQWR�WKH�(9(1706*�VWUXFWXUH��,I�D�PHVVDJH�LV�UHSHDWHG�PDQ\�WLPHV��WKLV�FRGH�ZLOO�EH�VHQW�LQ�VXFFHVVLRQ��RQH�WLPH�IRU�HDFK�UHSHDWHG�PHVVDJH���

Page 472: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�UHWXUQ�YDOXH�IRU�WKH�ILOWHU�IXQFWLRQ�GHWHUPLQHV�KRZ�ORQJ�WR�ZDLW�EHIRUH�VHQGLQJ�WKH�FXUUHQW�PHVVDJH��%HFDXVH�PHVVDJHV�DUH�VHQW�RQO\�IRU�WKH�+&B*(71(;7�FRGH��WKH�UHWXUQ�YDOXH�IRU�WKH�ILOWHU�IXQFWLRQ�ZLOO�FDXVH�WKH�V\VWHP�WR�ZDLW�RQO\�ZKHQ�WKLV�FRGH�LV�UHFHLYHG���7KH�+&B*(71(;7�FRQVWDQW�LV�GHILQHG�DV�IROORZV��&RQVW�+&B*(71(;7� ���

HC_SKIP

:KHQ�WKH�ILOWHU�IXQFWLRQ�UHFHLYHV�WKLV�FRGH��WKH�IXQFWLRQ�PXVW�SUHSDUH�WR�SODFH�WKH�QH[W�PHVVDJH�LQWR�WKH�(9(1706*�VWUXFWXUH��7KLV�PHVVDJH�ZLOO�EH�SOD\HG�WKH�QH[W�WLPH�WKLV�IXQFWLRQ�UHFHLYHV�WKH�+&B*(71(;7�FRGH���7KH�+&B6.,3�FRGH�LV�VHQW�WR�WKH�ILOWHU�IXQFWLRQ�ZKHQ�WKH�5,7V�PHVVDJH�ORRS�KDV�SURFHVVHG�DQG�VHQW�WR�LWV�GHVWLQDWLRQ�WKUHDG�WKH�PHVVDJH�VHQW�RQ�WKH�SUHYLRXV�+&B*(71(;7�FRGH��8VXDOO\��WKH�+&B*(71(;7�DQG�+&B6.,3�FRGHV�DUH�LQWHUODFHG��DV�VKRZQ�KHUH���+&B*(71(;7��������3OD\�PHVVDJH�����+&B6.,3�����������3UHSDUH�WR�SOD\�PHVVDJH�����+&B*(71(;7��������3OD\�PHVVDJH�����+&B6.,3�����������3UHSDUH�WR�SOD\�PHVVDJH�����+&B*(71(;7��������3OD\�PHVVDJH�����+&B6.,3�����������3UHSDUH�WR�SOD\�PHVVDJH�����+&B*(71(;7��������3OD\�PHVVDJH�����+&B6.,3�����������3UHSDUH�WR�SOD\�PHVVDJH�����+&B*(71(;7��������3OD\�PHVVDJH�����

,I�D�PHVVDJH�LV�UHSHDWHG��WKRXJK��+&B*(71(;7�LV�FDOOHG�HDFK�WLPH�WKH�PHVVDJH�LV�UHSHDWHG�ZLWKRXW�DQ�LQWHUODFHG�FDOO�WR�+&B6.,3��DV�VKRZQ�KHUH���+&B*(71(;7��������3OD\�PHVVDJH�����+&B6.,3�����������3UHSDUH�WR�SOD\�PHVVDJH�����+&B*(71(;7��������3OD\�PHVVDJH������)LUVW�WLPH�PHVVDJH����LV�SOD\HG��+&B*(71(;7��������3OD\�PHVVDJH������)LUVW�UHSHDW�RI�PHVVDJH�����+&B*(71(;7��������3OD\�PHVVDJH������6HFRQG�UHSHDW�RI�PHVVDJH�����+&B6.,3�����������3UHSDUH�WR�SOD\�PHVVDJH�����+&B*(71(;7��������3OD\�PHVVDJH�����7KH�+&B6.,3�FRQVWDQW�LV�GHILQHG�DV�IROORZV��&RQVW�+&B6.,3� ���HC_NOREMOVE

,QGLFDWHV�WKDW�D�WKUHDG�KDV�FDOOHG�WKH�3HHN0HVVDJH�IXQFWLRQ�RQ�LWV�PHVVDJH�TXHXH��7KH�3HHN0HVVDJH�IXQFWLRQ�GLG�QRW�UHPRYH�WKH�PHVVDJH�IURP�WKH�TXHXH��7KH�+&B125(029(�FRQVWDQW�LV�GHILQHG�DV�IROORZV���&RQVW�+&B125(029(� ���

HC_SYSMODALON

Page 473: Visual Basic - Subclassing and Hooking with VB & VB NET

,QIRUPV�XV�WKDW�D�V\VWHP�PRGDO�GLDORJ�ER[�KDV�EHHQ�GLVSOD\HG��$Q\�WLPH�D�V\VWHP�PRGDO�GLDORJ�ER[�LV�GLVSOD\HG��ZH�PXVW�SDXVH�WKH�PHVVDJH�UHFRUGLQJ�IXQFWLRQ�XQWLO�WKDW�GLDORJ�ER[�KDV�EHHQ�VKXW�GRZQ��7KH�+&B6<602'$/21�FRQVWDQW�LV�GHILQHG�DV�IROORZV���&RQVW�+&B6<602'$/21� ���

HC_SYSMODALOFF

,QIRUPV�XV�WKDW�WKH�V\VWHP�PRGDO�GLDORJ�ER[�KDV�EHHQ�VKXW�GRZQ��$W�WKLV�WLPH��ZH�FDQ�UHVXPH�RXU�UHFRUGLQJ��2XU�FRGH�FDQ�LJQRUH�ERWK�WKH�+&B6<602'$/21�DQG�+&B6<602'$/2))�FRGHV��7KHVH�DSSO\�WR�WKH�:LQ���HQYLURQPHQW��7KH�+&B6<602'$/2))�FRQVWDQW�LV�GHILQHG�DV�IROORZV���&RQVW�+&B6<602'$/2))� ���

$V�ZLWK�WKH�:+B-2851$/5(&25'�KRRN��ZH�VKRXOG�VNLS�RXU�KRRN�SURFHVVLQJ�DQG�LPPHGLDWHO\�FDOO�&DOO1H[W+RRN([�LI�WKH�X&RGH�DUJXPHQW�LV�OHVV�WKDQ�]HUR���

�������/RFDWLRQ�RI�7KLV�+RRN�LQ�WKH�6\VWHP�

7KLV�KRRN�LV�ORFDWHG�DW�WKH�SRLQW�LQ�WKH�V\VWHP�ZKHUH�PHVVDJHV�DUH�UHWULHYHG�IURP�WKH�5,7V�PHVVDJH�TXHXH��7KH�GLDJUDP�LQ�)LJXUH������LOOXVWUDWHV�WKLV���

)LJXUH�������3RLQW�LQ�WKH�PHVVDJLQJ�V\VWHP�ZKHUH�:+B-2851$/3/$<%$&.�KRRN�UHVLGHV�

Page 474: Visual Basic - Subclassing and Hooking with VB & VB NET

$V�ZLWK�WKH�:+B-2851$/5(&25'��:+B.(<%2$5'B//��DQG�:+B0286(B//�KRRNV��\RX�FDQ�LQVWDOO�WKLV�KRRN�RQO\�DV�D�V\VWHP�ZLGH�KRRN��7R�UHYLHZ��WKHVH�KRRNV�FDQ�UHVLGH�HLWKHU�LQ�DQ�(;(�RU�'//�PRGXOH��7KLV�PHDQV�WKDW�ZH�FDQ�LPSOHPHQW�WKHVH�KRRNV�VROHO\�ZLWKLQ�9LVXDO�%DVLF��9%���7KLV�LV�EHFDXVH�WKHVH�KRRNV�ILOWHU�IXQFWLRQV�DUH�FDOOHG�IURP�ZLWKLQ�WKH�FRQWH[W�RI�WKH�WKUHDG�WKDW�KDV�LQVWDOOHG�WKHP���2UGLQDULO\��ZKHQ�\RX�LQVWDOO�D�KRRN�DV�D�V\VWHP�ZLGH�KRRN��\RX�PXVW�SODFH�LW�LQ�D�'//��7KLV�'//�LV�LQMHFWHG�LQWR�HYHU\�SURFHVV�VR�WKDW�WKH�KRRN�FDQ�RSHUDWH�RQ�DOO�PHVVDJHV�LQ�WKH�V\VWHP��+RZHYHU��LQ�WKH�FDVH�RI�WKHVH�IRXU�KRRNV��WKH�KRRN�FDQ�EH�LQVWDOOHG�IRU�D�VLQJOH�WKUHDG�DQG�VWLOO�UHFHLYH�HYHU\�PHVVDJH�WKDW�WKH�V\VWHP�JHQHUDWHV�EHFDXVH�HYHU\�PHVVDJH�LV�EHLQJ�IXQQHOHG�WKURXJK�D�VLQJOH�PHVVDJH�TXHXH��$V�D�UHVXOW��WKH�KRRN�GRHV�QRW�KDYH�WR�UHVLGH�LQ�D�'//��LW�FDQ�UHVLGH�LQ�DQ�(;(�DV�ZHOO��)RU�D�GHWDLOHG�GLVFXVVLRQ�RI�WKLV��VHH�&KDSWHU������

�����7KH�0DFUR�5HFRUGHU�3OD\EDFN�([DPSOH�

7KLV�H[DPSOH�DSSOLFDWLRQ�ORRNV�DQG�RSHUDWHV�WKH�VDPH�DV�WKH�H[DPSOH�LQ�WKH�SUHYLRXV�FKDSWHU��7KH�RQO\�GLIIHUHQFH�LV�WKDW�ZH�KDYH�DGGHG�WZR�QHZ�EXWWRQV��KRRN�DQG�XQKRRN��WR�WKH�3/$<%$&.�IUDPH��7KH�FRGH�LQ�WKLV�FKDSWHU�ZLOO�FRQFHQWUDWH�RQ�WKHVH�QHZ�EXWWRQV��)LJXUH������SUHVHQWV�D�VFUHHQVKRW�RI�WKLV�H[DPSOH�DSSOLFDWLRQ���

)LJXUH�������6FUHHQVKRW�RI�WKH�0DFUR�5HFRUGHU�3OD\EDFN�H[DPSOH�DSSOLFDWLRQ�

7DEOH������SUHVHQWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��

2EMHFW�7\SH� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�

Page 475: Visual Basic - Subclassing and Hooking with VB & VB NET

)RUP� 1DPH� )RUP��)RUP� &DSWLRQ� �5HFRUGHU�$SSOLFDWLRQ��)RUP� 7RS� ����)RUP� /HIW� ����)RUP� +HLJKW� �����)RUP� :LGWK� �����)UDPH� &DSWLRQ� �5(&25'��)UDPH� 1DPH� )UDPH��)UDPH� 7RS� ����)UDPH� /HIW� ����)UDPH� +HLJKW� �����)UDPH� :LGWK� �����)UDPH� &DSWLRQ� �3/$<%$&.��)UDPH� 1DPH� )UDPH��)UDPH� 7RS� ����)UDPH� /HIW� ����)UDPH� +HLJKW� �����)UDPH� :LGWK� �����)UDPH� &DSWLRQ� �7(67�$5($��)UDPH� 1DPH� )UDPH��)UDPH� 7RS� ����)UDPH� /HIW� �����)UDPH� +HLJKW� �����)UDPH� :LGWK� �����7H[W%R[� 7RS� ����7H[W%R[� /HIW� �����7H[W%R[� +HLJKW� ����7H[W%R[� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH�� FPG+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �KRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����

Page 476: Visual Basic - Subclassing and Hooking with VB & VB NET

&RPPDQG�%XWWRQ�� 1DPH�� FPG8Q+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �XQKRRN��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����&RPPDQG�%XWWRQ�� &DSWLRQ� �06*�%2;��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH�� FPG3OD\EDFN+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �KRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH�� FPG3OD\EDFN8Q+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �XQKRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����&KHFN%R[� &DSWLRQ� �7HVW�&KHFN%R[�&RQWURO��&KHFN%R[� 7RS� ����&KHFN%R[� /HIW� �����&KHFN%R[� +HLJKW� ����&KHFN%R[� :LGWK� �����7KH�KRRN�EXWWRQ�WKDW�ZH�DGG�WR�WKH�3/$<%$&.�IUDPH�LQVWDOOV�WKH�:+B-2851$/3/$<%$&.�KRRN��$IWHU�WKLV�KRRN�LV�LQVWDOOHG��LW�WDNHV�RYHU�DQG�SOD\V�EDFN�WKH�UHFRUGHG�PDFUR��:KLOH�WKH�PDFUR�LV�SOD\LQJ�EDFN��PRXVH�DQG�NH\ERDUG�LQSXW�LV�SODFHG�LQ�WKH�5,7V�PHVVDJH�TXHXH�EXW�QRW�SURFHVVHG���:KHQ�WKH�PDFUR�LV�ILQLVKHG�SOD\LQJ��WKH�KRRN�LV�UHPRYHG�DQG�V\VWHP�FRQWURO�LV�UHWXUQHG�WR�WKH�XVHU��7KH�XVHU�GRHV�QRW�KDYH�WR�FOLFN�WKH�XQKRRN�EXWWRQ�EHIRUH�WDNLQJ�DQ�DFWLRQ�VXFK�DV�UHFRUGLQJ�DQRWKHU�PDFUR�RU�H[LWLQJ�WKH�DSSOLFDWLRQ���

Page 477: Visual Basic - Subclassing and Hooking with VB & VB NET

,I�WKH�XVHU�SUHVVHV�WKH�&75/�(6&�NH\�FRPELQDWLRQ�RU�DQ\�RWKHU�NH\�FRPELQDWLRQ�WKDW�VWRSV�WKH�KRRN��WKH�XVHU�PXVW�FOLFN�WKH�XQKRRN�EXWWRQ�LQ�WKH�3/$<%$&.�IUDPH�WR�UHPRYH�WKH�KRRN��7KLV�LV�EHFDXVH�WKH�,V3%+RRNHG�IODJ�LV�VWLOO�VHW�IRU�WKH�KRRN��&OLFNLQJ�WKH�XQKRRN�EXWWRQ�ZLOO�VHW�WKLV�IODJ�WR�)$/6(�VR�WKDW�WKH�DSSOLFDWLRQ�FDQ�EH�H[LWHG���7R�IL[�WKLV�SUREOHP�ZH�FRXOG�DGG�D�:+B*(70(66$*(�KRRN�WR�RXU�FRGH�WKDW�ZRXOG�ZDWFK�IRU�WKH�:0B&$1&(/-2851$/�PHVVDJH�DQG�VHW�WKH�,V3%+RRNHG�IODJ�WR�)$/6(�DXWRPDWLFDOO\���7R�UHFRUG�DQG�SOD\�EDFN�D�FRPSOHWH�PDFUR��IROORZ�WKHVH�VWHSV��

��� &OLFN�WKH�KRRN�EXWWRQ�LQ�WKH�5(&25'�IUDPH����� 5HFRUG�WKH�PDFUR����� &OLFN�WKH�XQKRRN�EXWWRQ�LQ�WKH�5(&25'�IUDPH����� &OLFN�WKH�KRRN�EXWWRQ�LQ�WKH�3/$<%$&.�IUDPH����� :DWFK�DV�\RXU�PDFUR�LV�SOD\HG�EDFN��

7KLV�FKDSWHU�ZLOO�SUHVHQW�RQO\�WKH�QHZ�FRGH�WKDW�KDV�EHHQ�DGGHG�WR�WKLV�SURMHFW��UDWKHU�WKDQ�UHSHDW�WKH�FRGH�SUHVHQWHG�LQ�&KDSWHU�����2QFH�DJDLQ��,�ZLOO�VWDUW�ZLWK�WKH�QHZ�YDULDEOHV�WKDW�ZH�PXVW�GHFODUH��ZKLFK�DUH�VKRZQ�LQ�EROGIDFH���3ULYDWH�K5HFRUG+RRN�$V�/RQJ�3ULYDWH�K3OD\EDFN+RRN�$V�/RQJ�3ULYDWH�0VJ$UUD\�����$V�/RQJ�3ULYDWH�6WDUW7LPH�$V�/RQJ�3ULYDWH�&XUU06*�$V�/RQJ��3XEOLF�,V+RRNHG�$V�%RROHDQ�3XEOLF�,V3%+RRNHG�$V�%RROHDQ�7KH�K3OD\EDFN+RRN�YDULDEOH�FRQWDLQV�WKH�KDQGOH�WR�WKH�:+B-2851$/3/$<%$&.�KRRN��7KLV�YDULDEOH�RSHUDWHV�OLNH�WKH�K5HFRUG+RRN�YDULDEOH�GRHV���7KH�&XUU06*�YDULDEOH�LQGLFDWHV�ZKLFK�PHVVDJH�LQ�WKH�0VJ$UUD\�DUUD\�LV�WKH�RQH�FXUUHQWO\�EHLQJ�VHQW�WR�WKH�:+B-2851$/3/$<%$&.�ILOWHU�IXQFWLRQ��7KH�ILOWHU�IXQFWLRQ�XVHV�WKLV�YDULDEOH�WR�JHW�WKH�LQIRUPDWLRQ�IURP�WKH�0VJ$UUD\�DUUD\�LQWR�WKH�(9(1706*�VWUXFWXUH���7KH�,V3%+RRNHG�%RROHDQ�YDULDEOH�LV�D�IODJ�LQGLFDWLQJ�ZKHWKHU�WKH�:+B-2851$/3/$<%$&.�KRRN�KDV�EHHQ�LQVWDOOHG��7KLV�YDULDEOH�ZRUNV�VLPLODU�WR�WKH�,V+RRNHG�%RROHDQ�IODJ���([DPSOH������VKRZV�WKH�:+B-2851$/3/$<%$&.�KRRN�ILOWHU�IXQFWLRQ���

([DPSOH�������7KH�-RXUQDO3OD\EDFN3URF�)LOWHU�)XQFWLRQ��

3XEOLF�)XQFWLRQ�-RXUQDO3OD\EDFN3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B�� � � � � O3DUDP�$V�(9(1706*��$V�/RQJ�����,I�X&RGH� �+&B*(71(;7�7KHQ�������<RX�VKRXOG�SOD\�WKH�FXUUHQW�PHVVDJH���������,I�&XUU06*�! �8%RXQG�0VJ$UUD\�����7KHQ�

Page 478: Visual Basic - Subclassing and Hooking with VB & VB NET

������������1R�PRUH�PHVVDJHV�WR�SOD\��UHPRYH�WKH�KRRN�DQG�UHVWRUH�FRQWURO��������������WR�WKH�XVHU�JUDFHIXOO\�������������&DOO�5HPRYH3OD\EDFN+RRN���������(OVH�������������O3DUDP�PHVVDJH� �0VJ$UUD\����&XUU06*��������������O3DUDP�KZQG� �0VJ$UUD\����&XUU06*��������������O3DUDP�SDUDP+� �0VJ$UUD\����&XUU06*��������������O3DUDP�SDUDP/� �0VJ$UUD\����&XUU06*��������������O3DUDP�WLPH� �0VJ$UUD\����&XUU06*����0VJ$UUD\����&XUU06*���������������������-RXUQDO3OD\EDFN3URF� �O3DUDP�WLPH���������(QG�,I�����(OVH,I�X&RGH� �+&B6.,3�7KHQ������<RX�VKRXOG�UHWULHYH�WKH�QH[W�PHVVDJH���������,I�&XUU06*�! �8%RXQG�0VJ$UUD\�����7KHQ�������������1R�PRUH�PHVVDJHV�WR�SOD\��UHPRYH�WKH�KRRN�DQG�UHVWRUH�FRQWURO��������������WR�WKH�XVHU�JUDFHIXOO\�������������&DOO�5HPRYH3OD\EDFN+RRN���������(QG�,I����������������������&XUU06*� �&XUU06*���������(OVH,I�X&RGH� �+&B125(029(�7KHQ���������6NLS�3OD\EDFN���DQ�DSS�KDV�FDOOHG�3HHN0HVVDJH������(OVH,I�X&RGH� �+&B6<602'$/21�7KHQ���������6NLS�SOD\EDFN�����(OVH,I�X&RGH� �+&B6<602'$/2))�7KHQ���������6NLS�SOD\EDFN�����(QG�,I����������-RXUQDO3OD\EDFN3URF� �&DOO1H[W+RRN([�K3OD\EDFN+RRN��X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�7KH�ILOWHU�IXQFWLRQ�IRFXVHV�RQ�WZR�FRGHV��+&B*(71(;7�DQG�+&B6.,3��7KH�RWKHU�FRGHV�DUH�RI�QR�FRQFHUQ�WR�XV��7KH�+&B*(71(;7�FRGH�DOORZV�XV�WR�SDVV�D�PHVVDJH�RQ�WR�WKLV�ILOWHU�IXQFWLRQV�O3DUDP�DUJXPHQW��)LUVW��WKRXJK��ZH�PXVW�GHWHUPLQH�LI�DQ\�PRUH�PHVVDJHV�PXVW�EH�SURFHVVHG��:H�GR�WKLV�E\�FKHFNLQJ�LI�WKH�YDOXH�RI�WKH�&XUU0VJ�YDULDEOH�LV�JUHDWHU�WKDQ�RU�HTXDO�WR�WKH�XSSHU�ERXQGV�RI�WKH�0VJ$UUD\�DUUD\��,I�LW�LV��WKH�KRRN�ZLOO�EH�UHPRYHG��RWKHUZLVH��SURFHVVLQJ�FRQWLQXHV���7KH�QH[W�VHFWLRQ�RI�FRGH�ZLWKLQ�WKH�+&B*(71(;7�FRGH�EORFN�SDVVHV�D�PHVVDJH�LQWR�WKH�(9(1706*�VWUXFWXUH��1RWLFH�WKDW�DOO�HOHPHQWV�RI�WKH�0VJ$UUD\�DUUD\�DUH�SDVVHG�LQ�XQFKDQJHG��H[FHSW�IRU�WKH�WLPH�HOHPHQW���

Page 479: Visual Basic - Subclassing and Hooking with VB & VB NET

:H�XVH�WKH�WLPH�HOHPHQW�WR�V\QFKURQL]H�PHVVDJH�SOD\EDFN��,I�ZH�SDVVHG�EDFN�]HUR�LQVWHDG�RI�WKH�O3DUDP�WLPH�PHPEHU�IURP�WKH�-RXUQDO3OD\EDFN3URF�ILOWHU�IXQFWLRQ��WKHUH�ZRXOG�EH�QR�GHOD\V�EHWZHHQ�PHVVDJHV��7KH�PHVVDJHV�ZRXOG�EH�SOD\HG�EDFN�DW�DQ�H[WUHPHO\�IDVW�SDFH��7KHUH�PLJKW�EH�VRPH�LQVWDQFHV�LQ�ZKLFK�WKH�DFFHOHUDWHG�SOD\EDFN�RI�PHVVDJHV�LV�GHVLUDEOH��7R�PDNH�WKLV�KDSSHQ��VLPSO\�PRGLI\�WKH�OLQH�LQ�WKH�)LOWHU�IXQFWLRQ�IURP���-RXUQDO3OD\EDFN3URF� �O3DUDP�WLPH�WR���-RXUQDO3OD\EDFN3URF� ���,I�LQVWHDG�\RX�ZDQW�WKH�SOD\EDFN�RI�PHVVDJHV�WR�RFFXU�DW�WKH�VDPH�UDWH�DV�WKH�XVHU�UHFRUGHG�WKHP��\RX�QHHG�WR�ILQG�WKH�GLIIHUHQFH�LQ�WLPH�EHWZHHQ�WKH�FXUUHQW�PHVVDJH�DQG�WKH�SUHYLRXV�PHVVDJH��<RX�DFFRPSOLVK�WKLV�WKURXJK�WKLV�OLQH�RI�FRGH���O3DUDP�WLPH� �0VJ$UUD\����&XUU06*����0VJ$UUD\����&XUU06*��������7KH�QXPEHU���LQ�WKH�0VJ$UUD\�DUUD\�UHSUHVHQWV�WKH�ILIWK�PHPEHU�LQ�WKH�(9(1706*�VWUXFWXUH�RU�WKH�WLPH�PHPEHU��7KH�UHVXOW�RI�WKLV�WLPH�GLIIHUHQFH�LV�SODFHG�LQ�WKH�O3DUDP�WLPH�PHPEHU�RI�WKH�(9(1706*�VWUXFWXUH�DQG�WKH�ILOWHU�IXQFWLRQ�UHWXUQV�LW���,QLWLDOO\��WKH�:+B-2851$/5(&25'�KRRN�ILOWHU�IXQFWLRQ�GHWHUPLQHV�WKH�YDOXH�SODFHG�LQ�0VJ$UUD\����Q���HTXLYDOHQW�WR�WKH�WLPH�PHPEHU�RI�WKH�(9(1706*�VWUXFWXUH���/RRNLQJ�EDFN�DW�&KDSWHU�����ZH�FDQ�VHH�WKDW�ZH�VHW�WKH�6WDUW7LPH�YDULDEOH�WR�WKH�FXUUHQW�WLPH�XVLQJ�WKH�*HW7LFN&RXQW�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IXQFWLRQ�DW�WKH�SRLQW�ZKHQ�WKH�:+B-2851$/5(&25'�KRRN�LV�LQVWDOOHG���6WDUW7LPH� �*HW7LFN&RXQW�7KLV�YDULDEOH�JLYHV�XV�RXU�EDVHOLQH��7KH�YDOXH�LQ�6WDUW7LPH�LV�VXEWUDFWHG�IURP�WKH�FXUUHQW�WLPH�HDFK�PHVVDJH�LV�SOD\HG�XVLQJ�WKLV�OLQH�RI�FRGH���0VJ$UUD\����8%RXQG�0VJ$UUD\������ ��O3DUDP�WLPH���6WDUW7LPH��1RZ��WKH�WLPH�PHPEHU�RI�HDFK�PHVVDJH�LQ�0VJ$UUD\�FRQWDLQV�WKH�GLIIHUHQFH�LQ�WLPH�EHWZHHQ�ZKHQ�WKH�:+B-2851$/5(&25'�KRRN�ZDV�ILUVW�LQVWDOOHG�DQG�WKH�PHVVDJH�ZDV�SOD\HG���:KHQ�ZH�SOD\�EDFN�WKH�PHVVDJH�XVLQJ�WKH�:+B-2851$/3/$<%$&.�KRRN��ZH�XVH�WKLV�OLQH�RI�FRGH�WR�JHW�WKH�DPRXQW�RI�WLPH�IRU�WKH�:+B-2851$/3/$<%$&.�KRRN�WR�ZDLW�EHIRUH�VHQGLQJ�WKH�QH[W�PHVVDJH���O3DUDP�WLPH� �0VJ$UUD\����&XUU06*����0VJ$UUD\����&XUU06*��������7KLV�OLQH�WDNHV�WKH�WLPH�LW�WRRN�IRU�WKH�SUHYLRXV�PHVVDJH�WR�EH�UHFRUGHG�DQG�VXEWUDFWV�WKDW�YDOXH�IURP�WKH�WLPH�LW�WRRN�IRU�WKH�FXUUHQW�PHVVDJH�WR�EH�UHFRUGHG��7KH�UHVXOW�LV�WKH�DPRXQW�RI�WLPH�EHWZHHQ�PHVVDJHV���)LJXUH������VKRZV�WKH�WLPH�FDOFXODWLRQ�LQ�JUDSKLFDO�IRUP��7KH�OLQH�LGHQWLILHG�E\�WKH�OHWWHU�$�LV�WKH�WLPH�DW�ZKLFK�PHVVDJH����LV�UHFRUGHG��7KH�OLQH�LGHQWLILHG�E\�WKH�OHWWHU�%�LV�WKH�WLPH�DW�ZKLFK�PHVVDJH����LV�UHFRUGHG��7KHUHIRUH��WKH�GRWWHG�OLQHV�$�DQG�%�ERWK�UHSUHVHQW�WKH�WLPH�WKDW�KDV�ODSVHG�EHWZHHQ�LQVWDOOLQJ�WKH�:+B-2851$/5(&25'�KRRN�DQG�WKH�DFWXDO�PHVVDJH�EHLQJ�VHQW��7R�ILQG�WKH�YDOXH�RI�/LQHV�$�DQG�%��LQ�&38�FORFN�F\FOHV��XVH�WKH�IROORZLQJ�HTXDWLRQ�LQ�WKH�:+B-2851$/5(&25'�KRRN�ILOWHU�IXQFWLRQ���

Page 480: Visual Basic - Subclassing and Hooking with VB & VB NET

�O3DUDP�WLPH���6WDUW7LPH��/LQH�&�LV�WKH�GLIIHUHQFH�EHWZHHQ�WKH�WLPHV�DW�ZKLFK�PHVVDJHV����DQG����ZHUH�UHFRUGHG��7KLV�YDOXH�LV�WKH�WLPH�WKDW�WKH�:+B-2851$/3/$<%$&.�IXQFWLRQ�PXVW�ZDLW�EHWZHHQ�SOD\LQJ�PHVVDJH����DQG�PHVVDJH�����<RX�ILQG�/LQH�&�XVLQJ�WKLV�HTXDWLRQ�LQ�WKH�:+B-2851$/3/$<%$&.�KRRN�ILOWHU�IXQFWLRQ���0VJ$UUD\����&XUU06*����0VJ$UUD\����&XUU06*�������

)LJXUH�������+RZ�WR�JHW�WKH�DPRXQW�RI�WLPH�WR�ZDLW�EHWZHHQ�VHQGLQJ�PHVVDJHV��

$IWHU�WKH�(9(1706*�VWUXFWXUH�LV�ILOOHG�LQ��WKH�ILOWHU�IXQFWLRQ�UHWXUQV�WKH�VDPH�YDOXH�WKDW�ZDV�SODFHG�LQ�WKH�WLPH�PHPEHU�RI�WKH�(9(1706*�VWUXFWXUH��7KLV�FDXVHV�WKH�V\VWHP�WR�ZDLW�WKH�QXPEHU�RI�FORFN�F\FOHV�WKDW�WKLV�IXQFWLRQ�UHWXUQV�EHIRUH�VHQGLQJ�WKH�QH[W�PHVVDJH���,I�DQ�+&B6.,3�FRGH�LV�SDVVHG�LQ�WR�WKH�ILOWHU�IXQFWLRQ��ZH�ILUVW�GHWHUPLQH�LI�WKHUH�DUH�DQ\�PRUH�PHVVDJHV�WR�SOD\�LQ�WKH�0VJ$UUD\�DUUD\��,I�WKHUH�DUH��ZH�VLPSO\�LQFUHPHQW�WKH�&XUU06*�YDULDEOH�E\����1RZ�RXU�ILOWHU�IXQFWLRQ�LV�UHDG\�WR�SOD\�WKH�QH[W�PHVVDJH�LQ�WKH�DUUD\���)LQDOO\��&DOO1H[W+RRN([�LV�FDOOHG�WR�DOORZ�DQ\�RWKHU�LQVWDOOHG�:+B-2851$/3/$<%$&.�KRRNV�LQ�WKH�KRRN�FKDLQ�WR�H[HFXWH���<RX�XVH�WKH�6HW3OD\EDFN+RRN�IXQFWLRQ�VKRZQ�LQ�([DPSOH������WR�LQVWDOO�WKH�:+B-2851$/3/$<%$&.�KRRN��7KHUH�LV�QRWKLQJ�QHZ�KHUH�H[FHSW�WKDW�WKH�&XUU06*�YDULDEOH�LV�LQLWLDOL]HG�LQ�WKH�IXQFWLRQ���

([DPSOH�������,QVWDOOLQJ�WKH�:+B-2851$/3/$<%$&.�+RRN��

3XEOLF�6XE�6HW3OD\EDFN+RRN���������,I�,V3%+RRNHG�2U�,V+RRNHG�7KHQ���������0VJ%R[��'RQW�KRRN�LW�WZLFH�ZLWKRXW�XQKRRNLQJ�RU����B�����������������\RX�ZLOO�EH�XQDEOH�WR�UHPRYH�WKH�KRRN�������(OVH���������6WDUW7LPH� �*HW7LFN&RXQW���������&XUU06*� ������������K3OD\EDFN+RRN� �6HW:LQGRZV+RRN([�:+B-2851$/3/$<%$&.��B�� � � � � � $GGUHVV2I�-RXUQDO3OD\EDFN3URF��B�� � � � � � $SS�K,QVWDQFH������

Page 481: Visual Basic - Subclassing and Hooking with VB & VB NET

��������,V3%+RRNHG� �7UXH�����(QG�,I�(QG�6XE�<RX�XVH�WKH�5HPRYH3OD\EDFN+RRN�IXQFWLRQ��ZKLFK�([DPSOH������LOOXVWUDWHV��WR�UHPRYH�WKH�LQVWDOOHG�:+B-2851$/3/$<%$&.�KRRN���

([DPSOH�������5HPRYLQJ�WKH�:+B-2851$/3/$<%$&.�+RRN��

3XEOLF�6XE�5HPRYH3OD\EDFN+RRN���������'LP�O5HW9DO�$V�/RQJ�����O5HW9DO� �8QKRRN:LQGRZV+RRN([�K3OD\EDFN+RRN������,V3%+RRNHG� �)DOVH�(QG�6XE�)LQDOO\��WKH�FRGH�VKRZQ�LQ�([DPSOH������LV�DGGHG�WR�WKH�IRUP�PRGXOH�WR�HQDEOH�WKH�XVHU�WR�SOD\�EDFN�WKH�SUHYLRXV�UHFRUGHG�PHVVDJH���

([DPSOH�������6RXUFH�&RGH�IRU�WKH�)RUP��IUP�0RGXOH��

������������3/$<%$&.��������������3ULYDWH�6XE�FPG3OD\EDFN+RRNB&OLFN���������&DOO�6HW3OD\EDFN+RRN�(QG�6XE��3ULYDWH�6XE�FPG3OD\EDFN8Q+RRNB&OLFN���������&DOO�5HPRYH3OD\EDFN+RRN�(QG�6XE��������������&/($183�������������3ULYDWH�6XE�)RUPB4XHU\8QORDG�&DQFHO�$V�,QWHJHU��8QORDG0RGH�$V�,QWHJHU������,I�,V+RRNHG�7KHQ���������&DQFHO� �����������0VJ%R[��8QKRRN�WKH�:0B-2851$/5(&25'�KRRN�EHIRUH�FORVLQJ����B�����������������RU�WKH�DSSOLFDWLRQ�PD\�FUDVK�������(QG�,I����������,I�,V3%+RRNHG�7KHQ�

Page 482: Visual Basic - Subclassing and Hooking with VB & VB NET

��������&DQFHO� �����������0VJ%R[��8QKRRN�WKH�:0B-2851$/3/$<%$&.�KRRN�EHIRUH�FORVLQJ�RU����B�����������������WKH�DSSOLFDWLRQ�PD\�FUDVK�������(QG�,I�(QG�6XE��:H�KDYH�DGGHG�WKH�&OLFN�HYHQW�KDQGOHUV�IRU�WKH�KRRN�DQG�XQKRRN�EXWWRQV�LQ�WKH�3/$<%$&.�IUDPH��$OVR��ZH�KDYH�DGGHG�FRGH�WR�WKH�)RUPB4XHU\8QORDG�HYHQW�KDQGOHU�WR�FKHFN�WR�VHH�ZKHWKHU�WKH�:+B-2851$/3/$<%$&.�KRRN�ZDV�UHPRYHG�EHIRUH�WKH�DSSOLFDWLRQ�XQORDGHG��(QGLQJ�WKH�DSSOLFDWLRQ�EHIRUH�XQKRRNLQJ�DQ\�KRRNV�FDQ�FDXVH�D�FUDVK���

�����&DYHDWV�

<RX�PXVW�ZDWFK�VHYHUDO�WKLQJV�FDUHIXOO\�ZKHQ�XVLQJ�WKH�:+B-2851$/3/$<%$&.�KRRN��)LUVW��\RX�PXVW�ZDWFK�IRU�GLIIHUHQW�VFUHHQ�UHVROXWLRQV��$�PDFUR�UHFRUGHG�LQ�RQH�UHVROXWLRQ�PLJKW�QRW�SOD\�EDFN�FRUUHFWO\�LQ�D�GLIIHUHQW�UHVROXWLRQ��$V�D�WHVW��UHFRUG�D�PDFUR�XVLQJ�WKH�DSSOLFDWLRQ�\RX�EXLOW�LQ�WKLV�FKDSWHU�DW�D�UHVROXWLRQ�RI����[�����7KHQ��VZLWFK�WR�D�KLJKHU�UHVROXWLRQ��VXFK�DV�����[�����<RX�ZLOO�QRWLFH�WKDW�WKH�[�DQG�\�FRRUGLQDWHV�RI�WKH�PRXVH�GXULQJ�SOD\EDFN�DW�WKH�KLJKHU�UHVROXWLRQ�DUH�VFDOHG�GRZQ��DV�LI�WKH�V\VWHP�VWLOO�WKLQNV�WKH�UHVROXWLRQ�LV����[������<RX�DOVR�PXVW�ZDWFK�IRU�D�ZLQGRZ�FKDQJLQJ�ORFDWLRQV�ZKHQ�WKH�PDFUR�LV�SOD\HG�EDFN��7KH�SOD\HG�EDFN�PDFUR�VWLOO�DVVXPHV�WKDW�WKH�ZLQGRZ�LV�LQ�LWV�RULJLQDO�SRVLWLRQ�DQG�SOD\V�EDFN�WKH�PDFUR�DFFRUGLQJO\��6LPLODU�SUREOHPV�DULVH�ZLWK�ZLQGRZV�WKDW�EHFRPH�FRYHUHG�E\�DQRWKHU�ZLQGRZ��ZLQGRZV�WKDW�EHFRPH�KLGGHQ��RU�ZLQGRZV�WKDW�EHFRPH�GHVWUR\HG���0DFURV�UHFRUGHG�LQ�RQH�RSHUDWLQJ�V\VWHP��:LQGRZV��[��17��RU�������FDQ�KDYH�SUREOHPV�ZKHQ�SOD\HG�EDFN�LQ�D�GLIIHUHQW�RSHUDWLQJ�V\VWHP��6RPH�FDXVHV�IRU�WKHVH�SUREOHPV�PLJKW�EH���

• 7KH�PHVVDJHV�WKDW�DUH�UHFRUGHG�LQ�RQH�RSHUDWLQJ�V\VWHP�PLJKW�QRW�H[LVW�RQ�WKH�RSHUDWLQJ�V\VWHP�LQ�ZKLFK�WKDW�WKH�PDFUR�LV�EHLQJ�SOD\HG�EDFN���

• 'LIIHUHQW�UHVROXWLRQV��• 'LIIHUHQW�GHVNWRS�OD\RXWV��• 'LIIHUHQW�PRXVH�VHWXSV��H�J���LI�D�VQDS�WR�RU�ZUDSSLQJ�RSWLRQ�LV�VHW�IRU�WKH�PRXVH�LQ�

RQH�RSHUDWLQJ�V\VWHP�DQG�QRW�LQ�WKH�RWKHU����

3UREOHPV�DOVR�FRXOG�DULVH�DIWHU�WKH�PDFUR�KDV�ILQLVKHG�SOD\LQJ��5HPHPEHU�WKDW�PHVVDJHV�DUH�VWLOO�EHLQJ�SODFHG�LQWR�WKH�PHVVDJH�TXHXH��H[FHSW�IRU�:0B0286(029(�PHVVDJHV���HYHQ�WKRXJK�WKH�:+B-2851$/3/$<%$&.�KRRN�LV�LQVWDOOHG��:KHQ�WKH�KRRN�LV�UHPRYHG��WKH�TXHXHG�PHVVDJHV�ZLOO�EH�VHQW�WR�WKHLU�FRUUHVSRQGLQJ�ZLQGRZ�SURFHGXUH�WR�EH�DFWHG�XSRQ���

Page 483: Visual Basic - Subclassing and Hooking with VB & VB NET

<RX�FDQ�UHFRUG�D�PDFUR�WKDW�LQVWDOOV�D�:+B-2851$/3/$<%$&.�KRRN��ZKLFK�LQ�WXUQ�SOD\V�EDFN�D�GLIIHUHQW�PDFUR��DOWKRXJK�GRLQJ�VR�PLJKW�FDXVH�XQSUHGLFWDEOH�UHVXOWV�EHFDXVH�HLWKHU�PDFUR�FDQ�GR�VRPHWKLQJ�WR�DIIHFW�WKH�RWKHU�PDFUR��<RX�FDQ�VLPXODWH�WKLV�E\�UHFRUGLQJ�D�PDFUR�ZLWK�WKH�PDFUR�UHFRUGHU�DSSOLFDWLRQ�\RX�EXLOW�LQ�WKLV�FKDSWHU�DQG�WKHQ�UHFRUGLQJ�D�VHFRQG�PDFUR�WKDW�LQVWDOOV�WKH�:+B-2851$/3/$<%$&.�KRRN��<RX�DFFRPSOLVK�WKLV�E\�FOLFNLQJ�WKH�KRRN�EXWWRQ�LQ�WKH�3/$<%$&.�IUDPH�RQ�WKH�XVHU�LQWHUIDFH�ZKLOH�UHFRUGLQJ�D�PDFUR��<RX�VKRXOG�DOZD\V�YHULI\�WKDW�WKH�:+B-2851$/3/$<%$&.�KRRN�LV�UHPRYHG�EHIRUH�HQGLQJ�WKH�PDFUR���)LQDOO\��SUHVVLQJ�WKH�:LQGRZV�NH\��SUHVHQW�RQ�PDQ\�NH\ERDUGV��KDV�WKH�VDPH�HIIHFW�DV�SUHVVLQJ�WKH�&75/�(6&�NH\�FRPELQDWLRQ����WKH�:LQGRZV�6WDUW�PHQX�LV�GLVSOD\HG�DQG�DQ\�LQVWDOOHG�MRXUQDO�KRRNV�DUH�UHPRYHG��3UHVVLQJ�WKH�:LQGRZV�NH\�RQ�WKH�NH\ERDUG�VHQGV�WKH�&75/�(6&�NH\�FRPELQDWLRQ�WR�WKH�V\VWHP�DW�VRPH�SRLQW��,I�WKLV�NH\�FRPELQDWLRQ�LV�XVHG�RU�LI�WKH�:LQGRZV�NH\�LV�SUHVVHG��WKH�LQVWDOOHG�MRXUQDO�KRRN�ZLOO�EH�UHPRYHG���

Page 484: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU�����:+B'(%8*�7KLV�FKDSWHU�GHDOV�ZLWK�WKH�:+B'(%8*�KRRN��$ORQJ�ZLWK�GHVFULELQJ�KRZ�WKLV�KRRN�RSHUDWHV��,�DOVR�ZLOO�GLVFXVV�KRZ�WR�XVH�LW�WR�DLG�LQ�GHEXJJLQJ�RWKHU�KRRNV�\RX�KDYH�LQVWDOOHG�LQ�\RXU�DSSOLFDWLRQ���

�����'HVFULSWLRQ�

7KH�PDLQ�SXUSRVH�RI�WKH�:+B'(%8*�KRRN��DV�LWV�QDPH�LPSOLHV��LV�IRU�GHEXJJLQJ�RWKHU�KRRNV��:KHQ�\RX�LQVWDOO�WKLV�KRRN��LW�LQWHUFHSWV�WKH�FDOO�WR�DQ�LQVWDOOHG�KRRNV�ILOWHU�IXQFWLRQ�EHIRUH�WKH�FDOO�LV�DFWXDOO\�PDGH��)RU�WKH�VDNH�RI�VLPSOLFLW\��,�ZLOO�UHIHU�WR�WKH�KRRN�WKDW�LV�EHLQJ�GHEXJJHG�DV�WKH�WDUJHW�KRRN��)LJXUH������LOOXVWUDWHV�WKH�UHODWLRQVKLS�RI�WKH�:+B'(%8*�KRRN�WR�WKH�RSHUDWLQJ�V\VWHP�DQG�WKH�WDUJHW�KRRN���

)LJXUH�������7KH�:+B'(%8*�KRRN�LV�FDOOHG�EHIRUH�WKH�WDUJHW�KRRN�

<RX�FDQ�LQVWDOO�WKLV�KRRN�DV�D�WKUHDG�VSHFLILF�KRRN�LQ�D�9LVXDO�%DVLF��9%��DSSOLFDWLRQ��RU�\RX�FDQ�LQVWDOO�LW�DV�D�V\VWHP�ZLGH�KRRN�LQ�D�:LQ���G\QDPLF�OLQN�OLEUDU\��'//���:KHQ�\RX�LQVWDOO�LW�DV�D�WKUHDG�VSHFLILF�KRRN��WKH�V\VWHP�ZLOO�FDOO�LW�EHIRUH�FDOOLQJ�DQ\�LQVWDOOHG�KRRN�ILOWHU�IXQFWLRQV�ZLWKLQ�WKDW�VSHFLILF�WKUHDG��$V�D�QRWH��WKH�:+B'(%8*�KRRN�ZLOO�QRW�LQWHUFHSW�PHVVDJHV�VHQW�WR�WKH�:+B0286(B//�DQG�:+B.(<%2$5'B//�KRRN�ILOWHU�IXQFWLRQV��VLQFH�WKHVH�ORZ�OHYHO�KRRN�ILOWHU�IXQFWLRQV�DUH�FDOOHG�HDUOLHU�LQ�WKH�PHVVDJLQJ�V\VWHP��:KHQ�\RX�LQVWDOO�WKH�:+B'(%8*�KRRN�DV�D�V\VWHP�ZLGH�KRRN��WKH�V\VWHP�ZLOO�FDOO�LW�EHIRUH�FDOOLQJ�DQ\�LQVWDOOHG�KRRN�ILOWHU�IXQFWLRQV�ZLWKLQ�WKH�V\VWHP��RQFH�DJDLQ�H[FOXGLQJ�DOO�:+B0286(B//�DQG�:+B.(<%2$5'B//�KRRNV���$V�\RX�FDQ�VHH��DQ\�LQVWDOOHG�ILOWHU�IXQFWLRQV�IRU�WKH�:+B'(%8*�KRRN�DUH�DOZD\V�FDOOHG�EHIRUH�FDOOLQJ�DQ\�RWKHU�KRRNV�ILOWHU�IXQFWLRQ��,I�VHYHUDO�KRRNV�DUH�LQVWDOOHG�DW�RQH�WLPH�DORQJ�ZLWK�WKH�:+B'(%8*�KRRN��WKH�:+B'(%8*�KRRN�

Page 485: Visual Basic - Subclassing and Hooking with VB & VB NET

ZLOO�EH�IORRGHG�E\�FDOOV�WR�YDULRXV�KRRN�ILOWHU�IXQFWLRQV��'HWHUPLQLQJ�ZKLFK�KRRNV�ILOWHU�IXQFWLRQ�LV�EHLQJ�FDOOHG�FDQ�EHFRPH�TXLWH�FRQIXVLQJ��EXW�E\�XVLQJ�WKH�Z3DUDP�SDUDPHWHU�RI�WKH�:+B'(%8*�KRRN��ZH�FDQ�GHWHUPLQH�WKH�W\SH�RI�KRRN�WKDW�LV�EHLQJ�FDOOHG���:KHQ�\RX�ZDQW�WR�GHEXJ�D�WKUHDG�VSHFLILF�KRRN�ZLWK�WKH�:+B'(%8*�KRRN��\RX�PXVW�LQVWDOO�WKH�:+B'(%8*�KRRN�LQ�WKH�VDPH�WKUHDG�DV�WKH�WKUHDG�VSHFLILF�WDUJHW�KRRN��2WKHUZLVH��\RX�ZLOO�QHYHU�EH�DEOH�WR�LQWHUFHSW�WKH�V\VWHPV�FDOOV�WR�WKH�WDUJHW�KRRN��<RX�FDQ�LQVWDOO�D�V\VWHP�ZLGH�:+B'(%8*�KRRN��EXW�WKHQ�\RX�ZLOO�VHH�DOO�FDOOV�PDGH�WR�HYHU\�LQVWDOOHG�KRRN�LQ�WKH�V\VWHP��7KLV�FDQ�LQWURGXFH�PRUH�QRLVH�WKDQ�LV�KHOSIXO��<RX�VKRXOG�NHHS�WKH�:+B'(%8*�KRRN�WR�D�WKUHDG�VSHFLILF�VFRSH�LI�DW�DOO�SRVVLEOH��$IWHU�DOO��GHEXJJLQJ�FRQVLVWV�RI�IRFXVLQJ�LQ�RQ�WKH�SUREOHP��LQ�PRVW�LQVWDQFHV��LW�ZLOO�EH�KDUGHU�WR�IRFXV�LQ�RQ�D�KRRN�SUREOHP�ZLWK�D�V\VWHP�ZLGH�:+B'(%8*�KRRN���$QRWKHU�LPSRUWDQW�SRLQW�DERXW�WKLV�KRRN�LV�WKDW�LW�ZLOO�FDSWXUH�LQIRUPDWLRQ�DERXW�HDFK�KRRN�LQVWDOOHG�LQ�D�KRRN�FKDLQ��)RU�H[DPSOH��LI�WKUHH�NH\ERDUG�KRRNV�DUH�LQVWDOOHG��WKH�:+B'(%8*�KRRN�ZLOO�EH�FDOOHG�RQFH�IRU�HDFK�NH\ERDUG�KRRN��$OVR�UHPHPEHU�WKDW�WKH�ODVW�KRRN�LQVWDOOHG�LV�WKH�ILUVW�KRRN�WKDW�LV�FDOOHG�LQ�WKH�KRRN�FKDLQ���

�������)LOWHU�)XQFWLRQ�'HILQLWLRQ�

7KH�ILOWHU�IXQFWLRQ�IRU�WKH�:+B'(%8*�KRRN�LV�GHILQHG�DV�IROORZV���3XEOLF�)XQFWLRQ�'HEXJ3URF�%\9DO�X&RGH�$V�/RQJ��B�� � � � %\9DO�Z3DUDP�$V�/RQJ��B�� � � � O3DUDP�$V�'(%8*+22.,1)2��$V�/RQJ�7KH�ILOWHU�IXQFWLRQV�SDUDPHWHUV�DUH��X&RGH

7KH�FRGH�WKH�V\VWHP�VHQGV�WR�WKLV�ILOWHU�IXQFWLRQ��3RVVLEOH�X&RGH�YDOXHV�DUH�GLVFXVVHG�LQ�6HFWLRQ��������ODWHU�LQ�WKLV�FKDSWHU���

Z3DUDP

7KLV�YDOXH�VSHFLILHV�WKH�KRRN�,'��WKDW�LV��WKH�W\SH�RI�KRRN��WKDW�LV�EHLQJ�FDOOHG��+RRN�,'V�FDQ�EH�DQ\�RI�WKH�IROORZLQJ���:+B06*),/7(5� ������:+B-2851$/5(&25'� ���:+B-2851$/3/$<%$&.� ���

Page 486: Visual Basic - Subclassing and Hooking with VB & VB NET

:+B.(<%2$5'� ���:+B*(70(66$*(� ���:+B&$//:1'352&� ���:+B&%7� ���:+B6<606*),/7(5� ���:+B0286(� ���:+B+$5':$5(� ���:+B6+(//� ����:+B)25(*5281','/(� ����:+B&$//:1'352&5(7� ����

O3DUDP

$�SRLQWHU�WR�D�'(%8*+22.,1)2�VWUXFWXUH��7KLV�VWUXFWXUH�JLYHV�WKH�:+B'(%8*�KRRN�DFFHVV�WR�WKH�LQIRUPDWLRQ�WKDW�LV�WR�EH�SDVVHG�WR�WKH�WDUJHW�KRRN�DQG�DLGV�LQ�LGHQWLI\LQJ�WKH�WDUJHW�KRRN��<RX�FDQQRW�PRGLI\�WKLV�LQIRUPDWLRQ���

7KH�'(%8*+22.,1)2�VWUXFWXUH�LV�GHILQHG�DV�IROORZV���3XEOLF�7\SH�'(%8*+22.,1)2���������LG7KUHDG�$V�/RQJ���������LG7KUHDG,QVWDOOHU�$V�/RQJ���������O3DUDP�$V�/RQJ���������Z3DUDP�$V�/RQJ���������FRGH�$V�/RQJ�(QG�7\SH�,WV�PHPEHUV�DUH��LG7KUHDG

+DQGOH�WR�WKH�WKUHDG�FRQWDLQLQJ�WKH�ILOWHU�IXQFWLRQ�RI�WKH�KRRN�WKDW�LV�DERXW�WR�EH�FDOOHG��

LG7KUHDG,QVWDOOHU +DQGOH�WR�WKH�WKUHDG�WKDW�LQVWDOOHG�WKH�:+B'(%8*�KRRN�ILOWHU�IXQFWLRQ��

O3DUDP

9DOXH�RI�WKH�O3DUDP�WKDW�LV�WR�EH�VHQW�WR�WKH�ILOWHU�IXQFWLRQ�RI�WKH�KRRN�WKDW�LV�DERXW�WR�EH�FDOOHG��

Z3DUDP

9DOXH�RI�WKH�Z3DUDP�WKDW�LV�WR�EH�VHQW�WR�WKH�ILOWHU�IXQFWLRQ�RI�WKH�KRRN�WKDW�LV�DERXW�WR�EH�FDOOHG��

FRGH

Page 487: Visual Basic - Subclassing and Hooking with VB & VB NET

9DOXH�RI�WKH�X&RGH�WKDW�LV�WR�EH�VHQW�WR�WKH�ILOWHU�IXQFWLRQ�RI�WKH�KRRN�WKDW�LV�DERXW�WR�EH�FDOOHG��

$V�\RX�FDQ�VHH��WKH�FRGH��O3DUDP��DQG�Z3DUDP�PHPEHUV�FRQWDLQ�WKH�VDPH�LQIRUPDWLRQ�WKDW�LV�VHQW�WR�WKH�WDUJHW�KRRNV�ILOWHU�IXQFWLRQ��$OO�KRRN�ILOWHU�IXQFWLRQV�WDNH�WKHVH�WKUHH�SDUDPHWHUV��7KH�LG7KUHDG�PHPEHU�FRQWDLQV�WKH�KDQGOH�WR�WKH�WKUHDG�ZKHUH�WKH�KRRNV�ILOWHU�IXQFWLRQ�LV�LQVWDOOHG��7KH�LG7KUHDG,QVWDOOHU�PHPEHU�FRQWDLQV�WKH�KDQGOH�WR�WKH�WKUHDG�WKDW�LQVWDOOHG�WKH�KRRN��7KHVH�WZR�KDQGOHV�FDQ�SURYLGH�LQIRUPDWLRQ�RQ�WKH�LQVWDOOHG�KRRNV�VFRSH��,I�WKHVH�WZR�KDQGOHV�FRQWDLQ�GLIIHUHQW�YDOXHV��\RX�FDQ�EH�FHUWDLQ�WKDW�WKLV�LV�D�V\VWHP�ZLGH�KRRN��+RZHYHU��LI�WKH�WZR�KDQGOHV�FRQWDLQ�WKH�VDPH�YDOXH��WKH�WDUJHW�KRRN�FRXOG�KDYH�HLWKHU�WKUHDG�VSHFLILF�RU�V\VWHP�ZLGH�VFRSH��LW�LV�LPSRVVLEOH�WR�GLIIHUHQWLDWH�WKH�VFRSH�XVLQJ�RQO\�WKHVH�WZR�WKUHDG�KDQGOHV��7KLV�LV�EHFDXVH�D�V\VWHP�ZLGH�KRRN�LV�LQVWDOOHG�LQ�HYHU\�SURFHVV�LQ�WKH�V\VWHP��HYHQ�WKH�RQH�WKDW�FDXVHG�WKH�KRRN�WR�EH�LQVWDOOHG�LQ�WKH�ILUVW�SODFH���7KH�UHWXUQ�YDOXH�IRU�WKLV�ILOWHU�IXQFWLRQ�VKRXOG�EH�WKH�UHWXUQ�YDOXH�RI�WKH�&DOO1H[W+RRN([�IXQFWLRQ��,I�WKLV�IXQFWLRQ�LV�QRW�FDOOHG��UHWXUQ�D�]HUR��,�GR�QRW�UHFRPPHQG�VNLSSLQJ�WKH�FDOO�WR�&DOO1H[W+RRN([��WKRXJK��)DLOLQJ�WR�FDOO�LW�SUHYHQWV�RWKHU�ILOWHU�IXQFWLRQV�LQ�WKH�FKDLQ�IURP�EHLQJ�FDOOHG��+RZHYHU��IRUFLQJ�D�QRQ]HUR�QXPEHU�WR�EH�UHWXUQHG�ZLOO�FDXVH�WKH�GHVWLQDWLRQ�KRRNV�ILOWHU�IXQFWLRQ�WR�QRW�EH�FDOOHG���,W�LV�LPSRUWDQW�WR�QRWH�WKDW�:LQGRZV��[�GRHV�QRW�VXSSRUW�WKH�:+B'(%8*�KRRN�DQG�WKH�'(%8*+22.,1)2�VWUXFWXUH��$OWKRXJK�\RX�FDQ�LQVWDOO�DQG�UXQ�LW�LQ�:LQGRZV����6HFRQG�(GLWLRQ��,�XVHG�EXLOG����������$���,�GR�QRW�UHFRPPHQG�GRLQJ�VR��,�ZDV�DEOH�WR�JHW�LW�WR�UXQ��EXW�WKH�LQIRUPDWLRQ�LW�SURGXFHG�ZDV�QRW�UHOLDEOH��,Q�PRVW�LQVWDQFHV��WKH�:+B'(%8*�KRRN�ZDV�EHLQJ�FDOOHG�DW�RGG�WLPHV��VRPHWLPHV�HYHQ�DIWHU�WKH�WDUJHW�KRRN�ILQLVKHG�SURFHVVLQJ���

�������([SODQDWLRQ�RI�+RRN�&RGHV�

7KH�ILOWHU�IXQFWLRQV�X&RGH�SDUDPHWHU�UHFHLYHV�RQO\�RQH�KRRN�FRGH��+&B$&7,21��7KLV�FRGH�LV�GHILQHG�DV�IROORZV���3ULYDWH�&RQVW�+&B$&7,21� ���

Page 488: Visual Basic - Subclassing and Hooking with VB & VB NET

:KHQ�WKLV�FRGH�LV�VHQW�WR�WKH�ILOWHU�IXQFWLRQ��WKH�VHQW�PHVVDJH�FDQ�EH�SURFHVVHG��,I�+&B$&7,21�LV�QRW�SDVVHG�LQ��\RX�VKRXOG�VNLS�PHVVDJH�SURFHVVLQJ�DQG�FDOO�&DOO1H[W+RRN([�LPPHGLDWHO\��

�����$�7KUHDG�6SHFLILF�([DPSOH�

7KLV�H[DPSOH�XVHV�WKH�:+B6+(//�H[DPSOH�WKDW�ZDV�SUHVHQWHG�LQ�&KDSWHU�����)LJXUH������VKRZV�WKH�DSSOLFDWLRQV�XVHU�LQWHUIDFH��$V�\RX�FDQ�VHH��D�FKHFNER[�ODEHOHG�'LVFDUG�0VJ�KDV�EHHQ�DGGHG�WR�WKH�H[DPSOH��:KHQ�FKHFNHG��LW�FDXVHV�WKH�:+B'(%8*�KRRN�WR�UHWXUQ�D�QRQ]HUR�YDOXH��HIIHFWLYHO\�SUHYHQWLQJ�WKH�WDUJHW�KRRN�IURP�EHLQJ�FDOOHG��2WKHUZLVH��DOO�PHVVDJHV�ZLOO�VDIHO\�SDVV�WKURXJK�WKLV�KRRN�WR�WKH�WDUJHW�KRRN���

)LJXUH�������$�VFUHHQVKRW�RI�WKH�:+B6+(//�:+B'(%8*�H[DPSOH�

7DEOH������SUHVHQWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��

2EMHFW� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�)RUP�� 1DPH� )RUP��)RUP�� &DSWLRQ� �:+B6+(//�([DPSOH��)RUP�� 7RS� ����)RUP�� /HIW� ����)RUP�� +HLJKW� �����)RUP�� :LGWK� �����)RUP�� 1DPH� )RUP��

Page 489: Visual Basic - Subclassing and Hooking with VB & VB NET

)RUP�� &DSWLRQ� �1(:�)250��&RPPDQG�%XWWRQ�� 1DPH� FPG+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �KRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� FPG8QKRRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �XQKRRN��&RPPDQG�%XWWRQ�� 7RS� ����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� ����&RPPDQG�%XWWRQ�� 1DPH� FPG&UHDWH:QG�&RPPDQG�%XWWRQ�� &DSWLRQ� �&UHDWH:QG��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH� FPG7DVN%DU7LWOH�&RPPDQG�%XWWRQ�� &DSWLRQ� �7DVN%DU�7LWOH��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH� FPG0VJ%R[�&RPPDQG�%XWWRQ�� &DSWLRQ� �0VJ%R[��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH� FPG'%*+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �KRRN��&RPPDQG�%XWWRQ�� 7RS� �����

Page 490: Visual Basic - Subclassing and Hooking with VB & VB NET

&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����&RPPDQG�%XWWRQ�� 1DPH� FPG'%*8Q+RRN�&RPPDQG�%XWWRQ�� &DSWLRQ� �XQKRRN��&RPPDQG�%XWWRQ�� 7RS� �����&RPPDQG�%XWWRQ�� /HIW� ����&RPPDQG�%XWWRQ�� +HLJKW� ����&RPPDQG�%XWWRQ�� :LGWK� �����&KHFN%R[� 1DPH� FKN'LVFDUG0VJ�&KHFN%R[� &DSWLRQ� �'LVFDUG�0VJ��&KHFN%R[� 7RS� �����&KHFN%R[� /HIW� ����&KHFN%R[� +HLJKW� ����&KHFN%R[� :LGWK� �����7H[W%R[� 1DPH� 7H[W��7H[W%R[� 0XOWL/LQH� 7UXH�7H[W%R[� 7RS� ����7H[W%R[� /HIW� �����7H[W%R[� +HLJKW� �����7H[W%R[� :LGWK� �����7R�XVH�WKLV�DSSOLFDWLRQ��FOLFN�WKH�KRRN�EXWWRQ�IRU�WKH�:+B6+(//�KRRN��DQG�WKHQ�FOLFN�WKH�KRRN�EXWWRQ�IRU�WKH�:+B'(%8*�KRRN��:KHQ�WKH�:+B6+(//�KRRN�LV�FDOOHG��RXWSXW�WR�WKH�WH[W�ER[�ZLOO�DOZD\V�VKRZ�WKDW�WKH�:+B'(%8*�KRRN�LV�FDOOHG�LPPHGLDWHO\�EHIRUH�LW���,I�\RX�FKHFN�WKH�'LVFDUG�0VJ�FKHFNER[��\RX�ZLOO�QRWLFH�WKDW�RQO\�WKH�:+B'(%8*�KRRN�LV�FDOOHG��7KH�:+B6+(//�KRRN�LV�QRW�FDOOHG�EHFDXVH�WKH�:+B'(%8*�KRRN�IXQFWLRQ�UHWXUQV�����,W�LV�LQWHUHVWLQJ�WR�QRWH�WKDW�ZKHQ�WKH�:+B'(%8*�KRRN�LV�LQVWDOOHG�DQG�\RX�GR�QRW�H[SOLFLWO\�LQVWDOO�DQ\�RWKHU�KRRNV��\RX�PLJKW�UHFHLYH�QRWLILFDWLRQV�WKDW�FHUWDLQ�KRRNV�DUH�DERXW�WR�ILUH��)RU�H[DPSOH��LI�\RX�DUH�XVLQJ�D�WKLUG�SDUW\�PRXVH�RU�NH\ERDUG�WKDW�FRQWDLQV�H[WUD�LQSXW�GHYLFHV��\RX�PLJKW�QRWLFH�WKDW�WKH�:+B0286(��WKH�:+B.(<%2$5'��RU�HYHQ�WKH�:+B*(70(66$*(�KRRNV�DUH�EHLQJ�ILUHG��HYHQ�WKRXJK�\RX�GLG�QRW�LQVWDOO�WKHP��:KDW�LV�KDSSHQLQJ�LV�WKDW�WKH�VRIWZDUH�WKDW�\RX�LQVWDOOHG�ZLWK�WKHVH�GHYLFHV�LQVWDOOV�RQH�RU�PRUH�V\VWHP�ZLGH�KRRNV��7KHVH�KRRNV�DUH�XVXDOO\�LQVWDOOHG�DW�ERRW�WLPH��7KLV�ZD\��WKH\�FDQ�DGG�H[WUD�FDSDELOLWLHV�WR�DOO�SURFHVVHV�UXQQLQJ�LQ�WKH�V\VWHP�E\�LQVWDOOLQJ�H[WUD�FRGH����WKH�KRRNV�ILOWHU�IXQFWLRQ����LQWR�HDFK�UXQQLQJ�SURFHVV��)RU�H[DPSOH��LQ�)LJXUH�������\RX�FDQ�VHH�WKH�V\VWHP�ZLGH�KRRNV�EHLQJ�FDOOHG�IURP�ZLWKLQ�WKH�WKUHDG�WKDW�LQVWDOOHG�WKH�:+B'(%8*�KRRN���

Page 491: Visual Basic - Subclassing and Hooking with VB & VB NET

)LJXUH�������,QVWDOOLQJ�RQO\�WKH�:+B'(%8*�KRRN�ZLOO�LQIRUP�\RX�RI�DQ\�V\VWHP�ZLGH�KRRNV�WKDW�DQRWKHU�DSSOLFDWLRQ�PLJKW�KDYH�LQVWDOOHG�LQ�\RXU�V\VWHP�

([DPSOH������SUHVHQWV�WKH�FRGH�EHKLQG�WKH�IRUP��7KH�)RUPB4XHU\8QORDG�IXQFWLRQ�SHUIRUPV�D�ILQDO�FKHFN�WR�GHWHUPLQH�LI�DQ\�KRRNV�DUH�VWLOO�LQVWDOOHG��,I�DQ\�DUH�LQVWDOOHG��DSSOLFDWLRQ�VKXWGRZQ�LV�FDQFHOHG��,I�WKH�DSSOLFDWLRQ�ZHUH�VKXW�GRZQ�EHIRUH�UHPRYLQJ�DOO�KRRNV��WKH�DSSOLFDWLRQ�ZRXOG�VXIIHU�D�*HQHUDO�3URWHFWLRQ�)DXOW��*3)����,QVWDOOLQJ�WKH�:+B'(%8*�KRRN�LV�VLPLODU�WR�LQVWDOOLQJ�DQ\�RWKHU�WKUHDG�VSHFLILF�KRRN��7KH�6HW'HEXJ+RRN�IXQFWLRQ�LQ�([DPSOH������LQVWDOOV�WKH�:+B'(%8*�KRRN���

([DPSOH�������,QVWDOOLQJ�WKH�:+B'(%8*�+RRN��

3ULYDWH�6XE�FPG+RRNB&OLFN���������7H[W��7H[W� ��������&DOO�6HW6KHOO+RRN�(QG�6XE��3ULYDWH�6XE�FPG8QKRRNB&OLFN���������&DOO�5HPRYH6KHOO+RRN�(QG�6XE���3ULYDWH�6XE�FPG'%*+RRNB&OLFN���������&DOO�6HW'HEXJ+RRN�(QG�6XE��3ULYDWH�6XE�FPG'%*8K+RRNB&OLFN���������&DOO�5HPRYH'HEXJ+RRN�

Page 492: Visual Basic - Subclassing and Hooking with VB & VB NET

(QG�6XE���3ULYDWH�6XE�FPG&UHDWH:QGB&OLFN���������)RUP��6KRZ�(QG�6XE���3ULYDWH�6XE�FPG7DVN%DU7LWOHB&OLFN���������,I�0H�&DSWLRQ� ��7LWOH�2I�:LQGRZ�+DV�&KDQJHG��7KHQ���������0H�&DSWLRQ� ��:+B6+(//�([DPSOH������(OVH���������0H�&DSWLRQ� ��7LWOH�2I�:LQGRZ�+DV�&KDQJHG������(QG�,I�(QG�6XE��3ULYDWH�6XE�FPG0VJ%R[B&OLFN���������0VJ%R[��7KH�:+B6+(//�KRRN�GRHV�QRW�DFNQRZOHGJH�WKH�FUHDWLRQ�RI�WKLV�PHVVDJH�ER[���(QG�6XE��������������&/($183�������������3ULYDWH�6XE�)RUPB4XHU\8QORDG�&DQFHO�$V�,QWHJHU��8QORDG0RGH�$V�,QWHJHU������,I�,V+RRNHG�2U�,V'%*+RRNHG�7KHQ���������&DQFHO� �����������0VJ%R[��8QKRRN�EHIRUH�FORVLQJ��RU�WKH�,'(�ZLOO�FUDVK�������(QG�,I�(QG�6XE�

([DPSOH�������,QVWDOOLQJ�WKH�:+B'(%8*�+RRN��

3XEOLF�6XE�6HW'HEXJ+RRN���������,I�,V'%*+RRNHG�7KHQ���������0VJ%R[��'RQW�KRRN�'(%8*�WZLFH�RU�\RX�ZLOO�EH�XQDEOH�WR�XQKRRN�LW�������(OVH���������K+RRN'%*� �6HW:LQGRZV+RRN([�:+B'(%8*��$GGUHVV2I�'HEXJ3URF�����B��������������������$SS�7KUHDG,'����������,V'%*+RRNHG� �7UXH�����(QG�,I�

Page 493: Visual Basic - Subclassing and Hooking with VB & VB NET

(QG�6XE�<RX�UHPRYH�WKH�KRRN�XVLQJ�8QKRRN:LQGRZV+RRN([��7KH�5HPRYH'HEXJ+RRN�IXQFWLRQ�LQ�([DPSOH������VKRZV�KRZ�\RX�UHPRYH�WKLV�KRRN���

([DPSOH�������5HPRYLQJ�WKH�:+B'(%8*�+RRN��

3XEOLF�6XE�5HPRYH'HEXJ+RRN���������'LP�WHPS�$V�/RQJ�����WHPS� �8QKRRN:LQGRZV+RRN([�K+RRN'%*������,V'%*+RRNHG� �)DOVH�(QG�6XE�7KH�'HEXJ3URF�IXQFWLRQ�DFWV�DV�WKH�ILOWHU�IXQFWLRQ�IRU�WKLV�KRRN��DV�([DPSOH������LOOXVWUDWHV��7KLV�IXQFWLRQ�ZULWHV�D�OLQH�RI�WH[W�WR�WKH�7H[W��WH[W�ER[�ZKHQHYHU�HDFK�W\SH�RI�KRRN�LV�FDOOHG��7KLV�FDQ�ZRUN�ILQH�IRU�D�VLPSOH�H[DPSOH�WKDW�GHPRQVWUDWHV�KRZ�WR�XVH�WKH�:+B'(%8*�KRRN��EXW�LQ�D�UHDO�ZRUOG�DSSOLFDWLRQ�LW�PLJKW�FDXVH�SUREOHPV���

([DPSOH�������7KH�:+B'(%8*�)LOWHU�)XQFWLRQ��

3XEOLF�)XQFWLRQ�'HEXJ3URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B���������������������������O3DUDP�$V�'(%8*+22.,1)2��$V�/RQJ����,I�X&RGH�! ���7KHQ�������6HOHFW�&DVH�Z3DUDP����������&DVH�:+B&$//:1'352&5(7�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:+B&$//:1'352&5(7���&2'(����B�������������������O3DUDP�FRGH�������:3$5$0����O3DUDP�Z3DUDP��B������������������������/3$5$0����O3DUDP�O3DUDP��YE1HZ/LQH����������&DVH�:+B&%7�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:+B&%7����&2'(����B�������������������O3DUDP�FRGH������:3$5$0����O3DUDP�Z3DUDP��B������������������������/3$5$0����O3DUDP�O3DUDP��YE1HZ/LQH����������&DVH�:+B)25(*5281','/(�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:+B)25(*5281','/(����&2'(����B�������������������O3DUDP�FRGH�������:3$5$0����O3DUDP�Z3DUDP��B������������������������/3$5$0����O3DUDP�O3DUDP��YE1HZ/LQH����������&DVH�:+B-2851$/3/$<%$&.�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:+B-2851$/3/$<%$&.��&2'(����B�������������������O3DUDP�FRGH�������:3$5$0����O3DUDP�Z3DUDP�������/3$5$0����B�������������������O3DUDP�O3DUDP��YE1HZ/LQH����������&DVH�:+B-2851$/5(&25'�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:+B-2851$/5(&25'���YE1HZ/LQH�

Page 494: Visual Basic - Subclassing and Hooking with VB & VB NET

���������&DVH�:+B6<606*),/7(5�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:+B6<606*),/7(5����&2'(����B�������������������O3DUDP�FRGH�������:3$5$0����O3DUDP�Z3DUDP��B������������������������/3$5$0����O3DUDP�O3DUDP��YE1HZ/LQH����������&DVH�:+B06*),/7(5�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:+B06*),/7(5����&2'(����B�������������������O3DUDP�FRGH�������:3$5$0����O3DUDP�Z3DUDP��B������������������������/3$5$0����O3DUDP�O3DUDP��YE1HZ/LQH����������&DVH�:+B*(70(66$*(�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:+B*(70(66$*(����&2'(����B�������������������O3DUDP�FRGH�������:3$5$0����O3DUDP�Z3DUDP�������/3$5$0���B��������������������O3DUDP�O3DUDP����7,'B&RQWDLQV))����O3DUDP�K0RGXOH+RRN��B���������������������7,'B,QVWDOO))����O3DUDP�5HVHUYHG��E1HZ/LQH����������&DVH�:+B.(<%2$5'�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:+B.(<%2$5'����&2'(����B�������������������O3DUDP�FRGH�������:3$5$0����O3DUDP�Z3DUDP��B������������������������/3$5$0����O3DUDP�O3DUDP��YE1HZ/LQH����������&DVH�:+B0286(����7KLV�ZLOO�ILUH�PDQ\�WLPHV�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:+B0286(����&2'(����B�������������������O3DUDP�FRGH�������:3$5$0����O3DUDP�Z3DUDP��B������������������������/3$5$0����O3DUDP�O3DUDP��YE1HZ/LQH����������&DVH�:+B6+(//�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:+B6+(//����&2'(����B�������������������O3DUDP�FRGH�������:3$5$0����O3DUDP�Z3DUDP��B������������������������/3$5$0����O3DUDP�O3DUDP��YE1HZ/LQH����������&DVH�:+B&$//:1'352&�������������7KLV�RQH�*3)V�VLQFH�HYHU\WLPH�WKH�WH[W�LV�DGGHG�WR�WKH�WH[W�ER[�������������DQRWKHU�PHVVDJH�LV�LQWHUFHSWHG�FUHDWLQJ�DQ�LQILQLWH�ORRS�������������)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:+B&$//:1'352&����&2'(���B���������������������O3DUDP�FRGH�������:3$5$0����O3DUDP�Z3DUDP��B�������������������������/3$5$0����O3DUDP�O3DUDP��YE1HZ/LQH�������(QG�6HOHFW����������������,I�)RUP��FKN'LVFDUG0VJ�9DOXH� ���7KHQ����������7R�SUHYHQW�WKH�V\VWHP�IURP�FDOOLQJ�WKH�KRRN������������WKLV�KRRN�SURFHGXUH�PXVW�UHWXUQ�D�QRQ]HUR�YDOXH����������'HEXJ3URF� ������������([LW�)XQFWLRQ�������(OVH����������'HEXJ3URF� �&DOO1H[W+RRN([�K+RRN'%*��X&RGH��Z3DUDP��O3DUDP��

Page 495: Visual Basic - Subclassing and Hooking with VB & VB NET

������(QG�,I����(QG�,I�(QG�)XQFWLRQ�7KH�ELJJHVW�SUREOHP�ZLWK�WKLV�PHWKRG�RI�GLVSOD\LQJ�LQIRUPDWLRQ�RFFXUV�ZKHQ�WKH�:+B&$//:1'352&�KRRN�LV�FDOOHG��,I�\RX�QRWLFH��,�KDYH�FRPPHQWHG�RXW�WKH�FRGH�WKDW�ZULWHV�WKH�LQIRUPDWLRQ�IRU�WKLV�KRRN�WR�WKH�WH[W�ER[��,QLWLDOO\�ZKHQ�,�OHIW�WKLV�FRGH�XQFRPPHQWHG�DQG�UDQ�WKLV�DSSOLFDWLRQ��LW�LPPHGLDWHO\�FUDVKHG��7KLV�RFFXUUHG�EHFDXVH�D�:+B&$//:1'352&�KRRN�LQVWDOOHG�DV�HLWKHU�D�V\VWHP�ZLGH�RU�WKUHDG�VSHFLILF�KRRN�LV�FDOOHG�ZKHQHYHU�DQ\WKLQJ�LV�ZULWWHQ�WR�WKH�WH[W�ER[��7KLV�FDXVHV�WKH�ILOWHU�IXQFWLRQ�WR�EH�UHHQWHUHG�EHIRUH�LW�FDQ�ILQLVK��7KLV��LQ�WXUQ��FDXVHV�D�VWDFN�RYHUIORZ��DQG�WKH�DSSOLFDWLRQ�FUDVKHV���2QH�ZD\�WR�JHW�DURXQG�WKLV�LV�WR�XVH�WKH�2XWSXW'HEXJ6WULQJ�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IXQFWLRQ�DQG�WKH�'%0RQ�XWLOLW\�WR�PRQLWRU�WKH�:+B'(%8*�KRRN�LQVWHDG�RI�WKH�WH[W�ER[�PHWKRG��7KH�2XWSXW'HEXJ6WULQJ�IXQFWLRQ�LV�GHILQHG�DV�IROORZV���3XEOLF�'HFODUH�6XE�F�/LE��NHUQHO����$OLDV��2XWSXW'HEXJ6WULQJ$��B�� � �%\9DO�OS2XWSXW6WULQJ�$V�6WULQJ��,WV�VLQJOH�SDUDPHWHU�LV��OS2XWSXW6WULQJ

7KH�VWULQJ�WKDW�ZLOO�EH�VHQW�WR�WKH�GHEXJJHU�KRRNHG�XS�WR�WKH�FXUUHQW�DSSOLFDWLRQ��7KLV�VXEURXWLQH�WDNHV�RQH�SDUDPHWHU�DQG�GRHV�QRW�KDYH�D�UHWXUQ�YDOXH��7KH�OS2XWSXW6WULQJ�SDUDPHWHU�LV�GLVSOD\HG�LQ�WKH�GHEXJJHU�IRU�WKH�FXUUHQW�DSSOLFDWLRQ��,I�QR�GHEXJJHU�LV�SUHVHQW��QRWKLQJ�KDSSHQV��:KHQ�\RX�UXQ�WKH�'%0RQ�XWLOLW\�DORQJVLGH�\RXU�DSSOLFDWLRQ��\RX�FDQ�GLVSOD\�RXWSXW�IURP�2XWSXW'HEXJ6WULQJ���7R�PDNH�WKLV�FKDQJH�LQ�WKH�'HEXJ3URF�ILOWHU�IXQFWLRQ��VLPSO\�FKDQJH�HDFK�OLQH�RI�FRGH�WKDW�VHQW�D�OLQH�RI�WH[W�WR�WKH�7H[W��WH[W�ER[�IURP�WKLV���)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���:+B6+(//����&2'(����O3DUDP�FRGH����B������������������������:3$5$0����O3DUDP�Z3DUDP��B�������������������������/3$5$0����O3DUDP�O3DUDP��YE1HZ/LQH�WR�WKLV��2XWSXW'HEXJ6WULQJ��:+B6+(//����&2'(����O3DUDP�FRGH����B�� � ����:3$5$0����O3DUDP�Z3DUDP�������/3$5$0����O3DUDP�O3DUDP��7KLV�PHWKRG�SUHYHQWV�D�VWDFN�RYHUIORZ�FUDVK�IURP�RFFXUULQJ�LQ�\RXU�:+B'(%8*�KRRN���:H�FDQ�PRGLI\�WKLV�DSSOLFDWLRQ�VOLJKWO\�WR�VKRZ�WKH�HIIHFWV�RI�WKH�:+B'(%8*�KRRN�RQ�D�VLQJOH�W\SH�RI�KRRN�LQVWDOOHG�PXOWLSOH�WLPHV��<RX�ZRXOG�PRGLI\�WKH�6HW'HEXJ+RRN�IXQFWLRQ�DV�VKRZQ�LQ�([DPSOH�������7ZR�QHZ�FDOOV�WR�6HW:LQGRZV+RRN([�DUH�DGGHG�WR�WKLV�IXQFWLRQ��1RWLFH�WKDW�WKLV�VHW�RI�FDOOV�LQVWDOOV�WKH�:+B*(70(66$*(�KRRN�WZLFH��7ZR�QHZ�ILOWHU�IXQFWLRQV�DUH�DGGHG�WR�WKH�%$6�PRGXOH�WR�KDQGOH�WKHVH�WZR�KRRNV��DV�([DPSOH������LOOXVWUDWHV���

([DPSOH�������,QVWDOOLQJ�D�+RRN�0XOWLSOH�7LPHV��

Page 496: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�6XE�6HW6KHOO+RRN���������,I�,V+RRNHG�7KHQ���������0VJ%R[��'RQW�KRRN�6+(//�WZLFH�RU�\RX�ZLOO�EH�XQDEOH�WR�XQKRRN�LW�������(OVH���������K+RRN6KHOO� �6HW:LQGRZV+RRN([�:+B6+(//��$GGUHVV2I�6KHOO3URF�����B�����������������������$SS�7KUHDG,'����������K+RRN*HW0VJ�� �6HW:LQGRZV+RRN([�:+B*(70(66$*(��$GGUHVV2I�*03URF�����B������������������������$SS�7KUHDG,'����������K+RRN*HW0VJ�� �6HW:LQGRZV+RRN([�:+B*(70(66$*(��$GGUHVV2I�*03URF������B������������������������$SS�7KUHDG,'�����������,V+RRNHG� �7UXH�����(QG�,I�(QG�6XE�

([DPSOH�������7KH�7ZR�:+B*(70(66$*(�)LOWHU�)XQFWLRQV��

3XEOLF�)XQFWLRQ�*03URF�%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B������������������������%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�����)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���0\�ILUVW�LQVWDOOHG����B�������������������������:+B*(70(66$*(�+RRN�&DOOHG���YE1HZ/LQH�����*03URF� �&DOO1H[W+RRN([�K+RRN*HW0VJ���X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ��3XEOLF�)XQFWLRQ�*03URF��%\9DO�X&RGH�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B������������������������%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�����)RUP��7H[W��7H[W� �)RUP��7H[W��7H[W���0\�VHFRQG�LQVWDOOHG����B�������������������������:+B*(70(66$*(�+RRN�&DOOHG���YE1HZ/LQH�����*03URF�� �&DOO1H[W+RRN([�K+RRN*HW0VJ���X&RGH��Z3DUDP��O3DUDP��(QG�)XQFWLRQ�$V�([DPSOH������VKRZV��WZR�FDOOV�WR�8QKRRN:LQGRZV+RRN([�DUH�DGGHG�WR�WKH�5HPRYH'HEXJ+RRN�IXQFWLRQ�WR�UHPRYH�WKH�KRRNV�DQG�DOORZ�RXU�DSSOLFDWLRQ�WR�VWRS�JUDFHIXOO\���

([DPSOH�������5HPRYLQJ�0XOWLSOH�:+B*(70(66$*(�+RRNV��

3XEOLF�6XE�5HPRYH6KHOO+RRN���������'LP�WHPS�$V�/RQJ�����WHPS� �8QKRRN:LQGRZV+RRN([�K+RRN6KHOO������WHPS� �8QKRRN:LQGRZV+RRN([�K+RRN*HW0VJ�������WHPS� �8QKRRN:LQGRZV+RRN([�K+RRN*HW0VJ���

Page 497: Visual Basic - Subclassing and Hooking with VB & VB NET

����,V+RRNHG� �)DOVH�(QG�6XE�1RZ��UXQ�WKH�DSSOLFDWLRQ�DQG�LQVWDOO�WKH�:+B*(70(66$*(�KRRNV�EXW�QRW�WKH�:+B'(%8*�KRRN��)LJXUH������VKRZV�D�VFUHHQVKRW�RI�WKH�DSSOLFDWLRQ�UXQQLQJ��7KH�RXWSXW�LQ�WKH�7H[W��WH[W�ER[�ORRNV�VLPLODU�WR�WKH�IROORZLQJ���0\�VHFRQG�LQVWDOOHG�:+B*(70(66$*(�+RRN�&DOOHG�0\�ILUVW�LQVWDOOHG�:+B*(70(66$*(�+RRN�&DOOHG�0\�VHFRQG�LQVWDOOHG�:+B*(70(66$*(�+RRN�&DOOHG�0\�ILUVW�LQVWDOOHG�:+B*(70(66$*(�+RRN�&DOOHG�$V�\RX�FDQ�VHH��WKH�ODVW�KRRN�ZH�LQVWDOOHG�LV�JHWWLQJ�FDOOHG�ILUVW��IROORZHG�E\�WKH�ILUVW�KRRN�WKDW�ZH�LQVWDOOHG��7KLV�IROORZV�WKH�FDOOLQJ�SDWWHUQ�WKDW�RFFXUV�LQ�ILOWHU�IXQFWLRQ�FKDLQV���

)LJXUH�������6FUHHQVKRW�RI�WKH�UXQQLQJ�DSSOLFDWLRQ�

1H[W��LQVWDOO�WKH�:+B'(%8*�KRRN��)LJXUH������GLVSOD\V�D�VFUHHQVKRW�RI�WKH�UXQQLQJ�DSSOLFDWLRQ��:KHQ�\RX�LQVWDOO�WKLV�KRRN��WKH�RXWSXW�ORRNV�VLPLODU�WR�WKH�IROORZLQJ���:+B*(70(66*(�&RGH����:3$5$0�����/3$5$0���������0\�VHFRQG�LQVWDOOHG�:+B*(70(66$*(�+RRN�&DOOHG�:+B*(70(66*(�&RGH����:3$5$0�����/3$5$0���������0\�ILUVW�LQVWDOOHG�:+B*(70(66$*(�+RRN�&DOOHG�:+B*(70(66*(�&RGH����:3$5$0�����/3$5$0���������:+B*(70(66*(�&RGH����:3$5$0�����/3$5$0���������0\�VHFRQG�LQVWDOOHG�:+B*(70(66$*(�+RRN�&DOOHG�:+B*(70(66*(�&RGH����:3$5$0�����/3$5$0���������0\�ILUVW�LQVWDOOHG�:+B*(70(66$*(�+RRN�&DOOHG�:+B*(70(66*(�&RGH����:3$5$0�����/3$5$0���������$V�\RX�FDQ�VHH��WKH�RXWSXW�VKRZV�WKDW�WKH�:+B'(%8*�KRRN�LV�FDOOHG�EHIRUH�WKH�ODVW�KRRN�WKDW�ZH�LQVWDOOHG��1H[W��WKH�ODVW�KRRN�ZH�LQVWDOOHG�LV�FDOOHG��2QFH�DJDLQ��WKH�:+B'(%8*�KRRN�

Page 498: Visual Basic - Subclassing and Hooking with VB & VB NET

LV�FDOOHG��WKLV�WLPH�IRU�WKH�ILUVW�KRRN�WKDW�ZH�LQVWDOOHG��$IWHU�WKLV��RXU�ILUVW�KRRN�LV�FDOOHG��1RZ�VRPHWKLQJ�VWUDQJH�KDSSHQV��WKH�:+B'(%8*�KRRN�LV�DJDLQ�FDOOHG�IRU�QR�DSSDUHQW�UHDVRQ���

)LJXUH�������6FUHHQVKRW�RI�WKH�UXQQLQJ�DSSOLFDWLRQ�ZLWK�WKH�:+B'(%8*�KRRN�LQVWDOOHG�

7KH�WKLUG�FDOO�WR�WKH�:+B'(%8*�KRRN�LV�GXH�WR�D�WKLUG�SDUW\�DSSOLFDWLRQ�LQVWDOOLQJ�D�V\VWHP�ZLGH�:+B*(70(66$*(�KRRN�SULRU�WR�RXU�DSSOLFDWLRQ�LQVWDOOLQJ�WKH�RWKHU�WZR�:+B*(70(66$*(�KRRNV��7KH�:+B'(%8*�KRRN�LV�FDOOHG�LQ�WKH�FRQWH[W�RI�WKH�WKUHDG�LQ�ZKLFK�RXU�DSSOLFDWLRQ�LV�UXQQLQJ�EHFDXVH�WKH�V\VWHP�ZLGH�KRRN�DOVR�LV�FDOOHG�IURP�WKLV�WKUHDG��7KLV�PLJKW�QRW�RFFXU�RQ�\RXU�V\VWHP�H[DFWO\�DV�LW�GLG�RQ�P\�PDFKLQH�EHFDXVH�D�WKLUG�SDUW\�DSSOLFDWLRQ�PLJKW�QRW�KDYH�LQVWDOOHG�WKLV�KRRN���

�����6RPH�:+B'(%8*�6FHQDULRV�

,Q�WKLV�VHFWLRQ��ZHOO�H[DPLQH�VRPH�FRPPRQ�SUREOHPV�WKDW�DULVH�ZKHQ�GHEXJJLQJ�KRRNV��DQG�VKRZ�KRZ�\RX�FDQ�XVH�WKH�:+B'(%8*�KRRN�WR�GLDJQRVH�DQG�VROYH�WKHP���

�������3UREOHP��0LVEHKDYLQJ�6\VWHP�:LGH�+RRN�

6RPHWLPHV�D�PLVEHKDYLQJ�V\VWHP�ZLGH�KRRN�FDQ�LQWHUIHUH�ZLWK�\RXU�KRRNV�RSHUDWLRQ��&RQVLGHU�WKH�VLWXDWLRQ�LQ�ZKLFK�\RXU�DSSOLFDWLRQ�LQVWDOOV�D�V\VWHP�ZLGH�NH\ERDUG�KRRN�ZKHQ�WKH�V\VWHP�ILUVW�ERRWV�XS��/DWHU�RQ��D�WKLUG�SDUW\�DSSOLFDWLRQ�LQVWDOOV�D�NH\ERDUG�KRRN��7KLV�NH\ERDUG�KRRN��KRZHYHU��GRHV�QRW�FDOO�WKH�&DOO1H[W+RRN([�IXQFWLRQ�DW�WKH�HQG�RI�LWV�ILOWHU�IXQFWLRQ��DV�D�ZHOO�EHKDYHG�KRRN�VKRXOG��:KHQ�\RXU�DSSOLFDWLRQ�LV�UXQQLQJ��\RX�QRWLFH�WKDW�\RXU�KRRN�GRHV�QRW�ZRUN��RU�ZRUVH��WKDW�LW�ZRUNV�LQWHUPLWWHQWO\���7R�GHWHUPLQH�WKH�FDXVH��\RX�FDQ�LQVWDOO�D�:+B'(%8*�KRRN�RQ�WKH�VDPH�WKUHDG�DV�WKH�WDUJHW�KRRN��DQG�RQO\�ZDWFK�IRU�FDOOV�WR�DQ\�NH\ERDUG�KRRNV��:DWFKLQJ�IRU�WKH�:+B.(<%2$5'�

Page 499: Visual Basic - Subclassing and Hooking with VB & VB NET

FRQVWDQW�LQ�WKH�Z3DUDP�SDUDPHWHU�RI�WKH�:+B'(%8*�KRRN�DOORZV�\RX�WR�ZDWFK�FDOOV�WKDW�DUH�PDGH�WR�WKH�:+B.(<%2$5'�KRRNV�ILOWHU�IXQFWLRQ��7KLV�:+B'(%8*�KRRN�ZLOO�LQWHUFHSW�KRRNV�LQVWDOOHG�ZLWK�V\VWHP�ZLGH�VFRSH��RU�WKRVH�LQVWDOOHG�IURP�WKH�VDPH�WKUHDG�DV�WKH�:+B'(%8*�KRRN���$IWHU�\RX�LQVWDOO�WKH�:+B'(%8*�KRRN��\RX�QRWLFH�WKDW�LW�LV�FDSWXULQJ�LQIRUPDWLRQ�DERXW�D�KRRN�WKDW�KDV�WKH�VDPH�LG7KUHDG�DV�WKH�WKUHDG�WKDW�FRQWDLQV�\RXU�:+B'(%8*�KRRN�DV�ZHOO�DV�\RXU�NH\ERDUG�KRRN��%XW�ZKHQ�\RX�LQVSHFW�WKH�LG7KUHDG,QVWDOOHU�PHPEHU��\RX�QRWLFH�WKDW�LW�LV�GLIIHUHQW�IURP�WKH�LG7KUHDG�YDOXH��7KLV�LQGLFDWHV�WKDW�WKH�QH[W�NH\ERDUG�KRRN�WR�EH�FDOOHG�ZDV�LQVWDOOHG�E\�D�GLIIHUHQW�SURFHVV��EXW�WKH�ILOWHU�IXQFWLRQ����ZKLFK�H[LVWV�LQVLGH�D�'//����KDV�EHHQ�LQMHFWHG�LQWR�\RXU�DSSOLFDWLRQV�SURFHVV���,QYHVWLJDWLQJ�ZLWK�6S\���RU�VRPH�RWKHU�SURFHVV�YLHZHU��\RX�ILQG�WKDW�WKLV�WKUHDG�KDQGOH�EHORQJV�WR�D�WKLUG�SDUW\�DSSOLFDWLRQ��7KH�QH[W�VWHS�LV�WR�SUHYHQW�WKDW�WKLUG�SDUW\�DSSOLFDWLRQ�IURP�LQVWDOOLQJ��,W�LV�DOVR�D�JRRG�LGHD�WR�UHERRW�MXVW�WR�PDNH�VXUH�WKH�V\VWHP�ZLGH�NH\ERDUG�KRRN�WKDW�LW�LQVWDOOHG�LV�UHPRYHG�IURP�DOO�SURFHVVHV��$IWHU�\RX�GR�WKLV��\RX�FDQ�UHVWDUW�\RXU�WHVW�ZLWK�\RXU�DSSOLFDWLRQ��,I�DQRWKHU�V\VWHP�ZLGH�KRRN�LV�LQVWDOOHG��\RX�VKRXOG�UHPRYH�WKLV�RQH�DV�ZHOO��$IWHU�\RX�KDYH�UHPRYHG�DOO�KRRNV��\RX�VKRXOG�VHH�WKH�FDOO�WR�\RXU�LQVWDOOHG�NH\ERDUG�KRRN�DSSHDU�LQVLGH�WKH�:+B'(%8*�KRRNV�ILOWHU�IXQFWLRQ��,I�\RX�GRQW��YHULI\�WKDW�WKH�KRRN�LV�EHLQJ�LQVWDOOHG�SURSHUO\����6HW:LQGRZV+RRN([�VKRXOG�EH�UHWXUQLQJ�D�QRQ]HUR�QXPEHU���

�������3UREOHP��'HWHUPLQLQJ�LI�+RRNV�$UH�,QWHUIHULQJ�ZLWK�(DFK�2WKHU�

2QH�QLFH�IHDWXUH�WKDW�WKH�:+B'(%8*�KRRN�SURYLGHV�LV�WKH�DELOLW\�WR�SUHYHQW�WKH�WDUJHW�KRRN�IURP�EHLQJ�FDOOHG��7R�GR�WKLV��\RX�RQO\�QHHG�WR�UHWXUQ�D�QRQ]HUR�YDOXH�IURP�WKH�:+B'(%8*�KRRNV�ILOWHU�IXQFWLRQ��DQG�WKH�WDUJHW�KRRN�ZLOO�QRW�EH�FDOOHG���3UHYHQWLQJ�WKH�V\VWHP�IURP�FDOOLQJ�WKH�WDUJHW�KRRN�LV�HVSHFLDOO\�XVHIXO�ZKHQ�\RX�DUH�LQVWDOOLQJ�PRUH�WKDQ�RQH�KRRN�DQG�\RX�QHHG�WR�GHWHUPLQH�LI�DQG�ZK\�WKH�KRRNV�DUH�LQWHUIHULQJ�ZLWK�HDFK�RWKHU��)RU�H[DPSOH��D�NH\ERDUG�KRRN�PLJKW�EH�FDXVLQJ�D�PHVVDJH�WR�EH�SRVWHG�WR�D�ZLQGRZ��ZKLFK�LV��LQ�WXUQ��LQWHUFHSWHG�E\�D�*HW0HVVDJH�KRRN��<RX�PLJKW�QRW�EH�H[SHFWLQJ�\RXU�*HW0HVVDJH�KRRN�WR�EH�FDOOHG�DW�WKLV�WLPH��DQG�XQH[SHFWHG�EHKDYLRU�PLJKW�UHVXOW��7KHVH�DUH�KDUG�HUURUV�WR�ILQG��EXW�WKH�:+B'(%8*�KRRN�DOORZV�\RX�WR�WUDFH�WKH�RUGHU�DQG�QXPEHU�RI�WLPHV�D�KRRN�LV�FDOOHG���6LPSO\�LQVWDOO�WKH�:+B'(%8*�KRRN�DQG�ZDWFK�RQO\�IRU�WKHVH�WZR�KRRNV�WR�EH�FDOOHG��,I�DQ\�V\VWHP�ZLGH�KRRNV�DUH�LQVWDOOHG�WKDW�GXSOLFDWH�WKH�KRRNV�WKDW�\RX�ZDQW�WR�GHEXJ��\RX�VKRXOG�IROORZ�WKH�SURFHGXUH�GLVFXVVHG�SUHYLRXVO\�WR�HOLPLQDWH�WKHP���$V�\RX�RSHUDWH�\RXU�DSSOLFDWLRQ��\RX�VKRXOG�ZDWFK�WKH�RUGHU�LQ�ZKLFK�WKH�WZR�KRRNV�DUH�EHLQJ�FDOOHG��,I�WKH�*HW0HVVDJH�KRRN�LV�EHLQJ�FDOOHG�LPPHGLDWHO\�DIWHU�WKH�NH\ERDUG�KRRN�DW�VSHFLILF�WLPHV��\RX�VKRXOG�IRFXV�LQ�RQ�WKH�DFWLRQV�WKH�XVHU�SHUIRUPHG�ZKHQ�WKLV�KDSSHQV���1H[W��\RX�VKRXOG�H[DPLQH�WKH�X&RGH��O3DUDP��DQG�Z3DUDP�SDUDPHWHUV�WKDW�DUH�EHLQJ�VHQW�WR�WKH�WDUJHW�KRRNV��7KH�LQIRUPDWLRQ�WKDW�WKHVH�SDUDPHWHUV�FRQWDLQ�VKRXOG�SURYLGH�VRPH�LQVLJKW�DERXW�ZKHUH�WKH�SUREOHP�OLHV���

Page 500: Visual Basic - Subclassing and Hooking with VB & VB NET

�������3UREOHP��3HUIRUPDQFH�'HJUDGDWLRQ�

$QRWKHU�LQVWDQFH�LQ�ZKLFK�WKH�:+B'(%8*�KRRN�FRPHV�LQ�KDQG\�LV�ZKHQ�DSSOLFDWLRQ�SHUIRUPDQFH�VORZV�ZKHQ�RQH�RU�PRUH�KRRNV�DUH�LQVWDOOHG��7KH�:+B'(%8*�KRRN�FDQ�PRQLWRU�WKH�LQVWDOOHG�KRRNV�DQG�GHWHUPLQH�KRZ�PDQ\�WLPHV�D�KRRN�LV�FDOOHG���,Q�WKLV�FDVH��\RX�PLJKW�ZDQW�WR�VHW�XS�D�FRXQWHU�LQVLGH�WKH�:+B'(%8*�KRRNV�ILOWHU�IXQFWLRQ�WKDW�LQGLFDWHV�WKH�QXPEHU�RI�WLPHV�D�KRRN�LV�FDOOHG��<RX�ZRXOG�DOVR�ZDQW�WR�EH�DEOH�WR�VWDUW�DQG�VWRS�WKLV�FRXQWHU�DW�ZLOO����LQ�RWKHU�ZRUGV��WR�LQVWDOO�DQG�UHPRYH�WKH�:+B'(%8*�KRRN�ZKHQHYHU�\RX�ZDQW��7KLV�ZD\��\RX�FDQ�JDWKHU�LQIRUPDWLRQ�DW�VSHFLILF�SRLQWV�RI�H[HFXWLRQ�LQ�WKH�DSSOLFDWLRQ�DQG�FRPSDUH�WKHP��,I�\RXU�KRRN�LV�EHLQJ�FDOOHG�D�ODUJH�QXPEHU�RI�WLPHV�DW�FHUWDLQ�SRLQWV�LQ�\RXU�DSSOLFDWLRQ��\RX�QHHG�WR�H[DPLQH�\RXU�DSSOLFDWLRQ�WR�VHH�ZKDW�LV�FDXVLQJ�WKH�KRRN�WR�EH�FDOOHG���8QRSWLPL]HG�ILOWHU�IXQFWLRQV�XVHG�LQ�KRRNV�VXFK�DV�:+B0286(��:+B&$//:,1'2:352&��:+B*(70(66$*(��:+B)25(*5281','/(��:+B06*),/7(5��RU�:+B6<606*),/7(5�FDQ�KXUW�DSSOLFDWLRQ�SHUIRUPDQFH�EHFDXVH�WKHVH�W\SHV�RI�KRRNV�FDQ�SRWHQWLDOO\�LQWHUFHSW�D�KXJH�QXPEHU�RI�PHVVDJHV�HYHU\�VHFRQG��7KH�PRUH�WLPH�WKDW�LV�VSHQW�LQ�WKH�ILOWHU�IXQFWLRQ��WKH�OHVV�WLPH�WKH�DSSOLFDWLRQ�KDV�WR�GR�LWV�UHJXODU�SURFHVVLQJ��,Q�WKLV�FDVH��\RX�PLJKW�DOVR�ZDQW�WR�SURILOH�\RXU�ILOWHU�IXQFWLRQ�WR�GHWHUPLQH�KRZ�PXFK�WLPH�LV�VSHQW�LQVLGH�WKH�ILOWHU�IXQFWLRQ���

�����&DYHDWV�

:LWK�HYHU\�RWKHU�KRRN�,�KDYH�GLVFXVVHG�WKXV�IDU��,�KDYH�ZDUQHG�DERXW�VWURQJO\�FRQVLGHULQJ�SHUIRUPDQFH�ZKHQ�ZULWLQJ�WKH�ILOWHU�IXQFWLRQV��<RX�GR�QRW�KDYH�WR�WDNH�SHUIRUPDQFH�LQWR�FRQVLGHUDWLRQ�ZKHQ�XVLQJ�WKLV�KRRN��KRZHYHU��EHFDXVH�WKLV�KRRN�LV�D�WRRO�XVHG�IRU�GHEXJJLQJ�SXUSRVHV��<RX�PRVW�OLNHO\�ZRXOG�QRW�ZDQW�WR�UHOHDVH�GHEXJJLQJ�FRGH�LQ�WKH�ILQDO�UHOHDVH�RI�\RXU�SURGXFW���,P�VXUH�VRPHRQH�RXW�WKHUH�ZLOO�ILQG�D�OHJLWLPDWH�UHDVRQ�IRU�NHHSLQJ�D�:+B'(%8*�KRRN�LQ�WKH�ILQDO�UHOHDVH�RI�\RXU�DSSOLFDWLRQ��,Q�WKLV�FDVH��,�ZRXOG�SODFH�SHUIRUPDQFH�DW�WKH�IRUHIURQW�ZKHQ�GHVLJQLQJ�WKLV�KRRNV�ILOWHU�IXQFWLRQ��EHFDXVH�WKLV�KRRN�LV�FDOOHG�RQFH�IRU�HYHU\�KRRN�WKDW�\RX�LQVWDOO�LQ�\RXU�V\VWHP��SOXV�IRU�HYHU\�V\VWHP�ZLGH�KRRN��,I�\RXU�:+B'(%8*�KRRN�LV�D�V\VWHP�ZLGH�KRRN��\RX�LQWHUFHSW�FDOOV�PDGH�WR�HYHU\�KRRN�LQ�HYHU\�WKUHDG�UXQQLQJ�LQ�WKH�V\VWHP��7KDW�LV�D�JUHDW�GHDO�RI�RYHUKHDG�IRU�DQ�DSSOLFDWLRQ��,Q�FDVHV�VXFK�DV�WKLV��,�ZRXOG�IRUFH�WKH�FRGH�WR�IDOO�WKURXJK�DQG�LPPHGLDWHO\�FDOO�&DOO1H[W+RRN([�ZKHQHYHU�\RX�HQFRXQWHU�D�FDOO�WR�D�WDUJHW�KRRN�ZKLFK�\RX�GR�QRW�FDUH�DERXW���+HUH�DUH�D�FRXSOH�RI�WKLQJV�WR�UHPHPEHU��

• 7KH�:+B'(%8*�KRRN�LV�FDOOHG�RQFH�IRU�HYHU\�ILOWHU�IXQFWLRQ�WKDW�LV�LQVWDOOHG�LQ�D�ILOWHU�IXQFWLRQ�FKDLQ���

Page 501: Visual Basic - Subclassing and Hooking with VB & VB NET

• ,I�\RX�LQVWDOO�D�WKUHDG�VSHFLILF�:+B'(%8*�KRRN�DQG�LW�VWDUWV�SLFNLQJ�XS�FDOOV�WR�KRRNV�WKDW�\RX�KDYH�QRW�LQVWDOOHG��WKHVH�H[WUD�KRRN�FDOOV�DUH�FDXVHG�E\�DQRWKHU�DSSOLFDWLRQ�LQVWDOOLQJ�D�V\VWHP�ZLGH�KRRN���

• 8VLQJ�2XWSXW'HEXJ6WULQJ�DQG�WKH�'%0RQ�XWLOLW\�DUH�IDU�EHWWHU�WKDQ�ZULWLQJ�WUDFH�LQIRUPDWLRQ�WR�D�WH[W�ER[�ZLWKLQ�WKH�KRRNHG�DSSOLFDWLRQ���

• 5HWXUQLQJ�D�QRQ]HUR�YDOXH�IURP�D�:+B'(%8*�KRRN�ILOWHU�IXQFWLRQ�ZLOO�SUHYHQW�WKH�WDUJHW�KRRN�IURP�EHLQJ�FDOOHG���

• <RX�VKRXOG�QRW�XVH�WKLV�KRRN�LQ�:LQGRZ��[��HYHQ�LI�LW�DSSHDUV�WR�EH�ZRUNLQJ��7KH�RXWSXW�LV�QRW�DOZD\V�FRUUHFW���

$OVR�UHPHPEHU�WKDW�WKH�:+B'(%8*�KRRN�GRHV�QRW�LQWHUFHSW�FDOOV�WR�ORZ�OHYHO�KRRNV��VXFK�DV�:+B.(<%2$5'B//�DQG�:+B0286(B//��EHFDXVH�WKHVH�KRRNV�DUH�FDOOHG�HDUO\�RQ�LQ�PHVVDJH�SURFHVVLQJ�DQG�WKH�:+B'(%8*�KRRN�FDQQRW�VHH�WKH�FDOOV�WR�WKHVH�KRRNV���

Page 502: Visual Basic - Subclassing and Hooking with VB & VB NET

3DUW�,9��7KH��1(7�3ODWIRUP�&KDSWHU����DQG�&KDSWHU����ZLOO�H[SODLQ�KRZ�WR�LPSOHPHQW�VXEFODVVLQJ�DQG�KRRNV�XVLQJ�9%�1(7��7KHVH�FKDSWHUV�DVVXPH�D�IDPLOLDULW\�ZLWK�WKH�9%�1(7�ODQJXDJH�DV�ZHOO�DV�ZLWK�WKH�LQIRUPDWLRQ�FRQWDLQHG�LQ�&KDSWHU���DQG�&KDSWHU�����

Page 503: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU�����6XEFODVVLQJ��1(7�:LQ)RUPV�7KLV�LV�WKH�ILUVW�RI�WZR�FKDSWHUV�FRYHULQJ�WKH�WHFKQLTXHV�RI�VXEFODVVLQJ�DQG�KRRNLQJ�DV�WKH\�DSSO\�WR�9%�1(7��7KLV�FKDSWHU�ZLOO�FRYHU�KRZ�WR�VXEFODVV�D�:LQ)RUP��7KH�QH[W�FKDSWHU�ZLOO�H[SODLQ�KRZ�WR�LPSOHPHQW�KRRNV�LQ�9%�1(7���

�����:KDW�,V�D�:LQ)RUP"�

6LPSO\��D�:LQ)RUP�LV�DQDORJRXV�WR�D�9LVXDO�%DVLF��9%�����)50�IRUP�PRGXOH��2Q�WKH�H[WHULRU��ERWK�W\SHV�RI�IRUPV�RSHUDWH�LQ�D�VLPLODU�IDVKLRQ��ORRN�WKH�VDPH��DQG�DUH�XVHG�DV�FRQWDLQHUV�WR�GLVSOD\�FRQWUROV��,QWHUQDOO\��KRZHYHU��WKH\�DUH�YHU\�GLIIHUHQW���<RX�FUHDWH�D�:LQ)RUP�IURP�WKH�)RUP�FODVV�ZLWKLQ�WKH��1(7�IUDPHZRUN��7KLV�FODVV�H[LVWV�LQ�WKH�6\VWHP�:LQ)RUPV�QDPHVSDFH��ZKLFK�LV�FRQWDLQHG�ZLWKLQ�WKH�6\VWHP�:LQIRUPV�'//�ILOH��7KH�)RUP�FODVV�LQKHULWV�IURP�VHYHUDO�RWKHU�FODVVHV��7KH�IROORZLQJ�OLVWLQJ�VKRZV�WKH�FODVV�KLHUDUFK\�IRU�WKH�)RUP�FODVV���Object MarshalByRefObject MarshalByRefComponent Control RichControl ScrollableControl ContainerControl Form

7KH�2EMHFW�FODVV�LV�WKH�XOWLPDWH�EDVH�FODVV�RI�WKH�)RUP�FODVV��DV�ZHOO�DV�DOO�RWKHU�FODVVHV�FRQWDLQHG�LQ�WKH��1(7�IUDPHZRUN��$�EULHI�GHVFULSWLRQ�RI�HDFK�FODVV�IROORZV���Object

7KH�EDVH�FODVV�RI�HYHU\�REMHFW�LQ�WKH��1(7�IUDPHZRUN��MarshalByRefObject

&RQWDLQV�EDVH�LPSOHPHQWDWLRQ�IRU�XVH�E\�REMHFWV�WKDW�QHHG�UHPRWLQJ�DELOLW\���MarshalByRefComponent

&RQWDLQV�EDVH�LPSOHPHQWDWLRQ�IRU�XVH�E\�DOO�FRQWUROV�WKDW�FDQ�EH�VLWHG�RQ�D�IRUP���Control

&RQWDLQV�EDVH�LPSOHPHQWDWLRQ�IRU�XVH�E\�DOO�REMHFWV�WKDW�KDYH�D�XVHU�LQWHUIDFH��7KLV�FODVV�KDQGOHV�NH\ERDUG�DQG�PRXVH�LQSXW��DV�ZHOO�DV�PHVVDJH�URXWLQJ�DQG�VHFXULW\��7KLV�FODVV�LV�FHQWUDO�WR�VXEFODVVLQJ���

RichControl

([WHQGV�WKH�&RQWURO�FODVV�E\�DGGLQJ�WKH�DELOLW\�WR�SDLQW�LWVHOI��WR�FRQWURO�FRQWH[W�PHQXV��DQG�WR�KDQGOH�GRFNLQJ�DQG�DQFKRULQJ�RI�LWV�ZLQGRZ���

ScrollableControl

$GGV�WKH�DELOLW\�IRU�D�ZLQGRZ�WR�GLVSOD\�DQG�KDQGOH�YHUWLFDO�DQG�KRUL]RQWDO�VFUROOEDUV��XVHG�WR�VFUROO�WKH�FOLHQW�DUHD�RI�WKH�ZLQGRZ���

ContainerControl

Page 504: Visual Basic - Subclassing and Hooking with VB & VB NET

$GGV�WKH�DELOLW\�IRU�D�ZLQGRZ�WR�FRQWDLQ�RWKHU�FRQWUROV��DV�ZHOO�DV�WR�KDQGOH�FRQWURO�IRFXV���

Form

8VHG�WR�FUHDWH�D�6LQJOH�'RFXPHQW�,QWHUIDFH��6',��ZLQGRZ��0XOWLSOH�'RFXPHQW�,QWHUIDFH��0',��ZLQGRZ��GLDORJ�ER[��WRRO�ZLQGRZ��ERUGHUOHVV�ZLQGRZ��RU�IORDWLQJ�ZLQGRZ���

<RX�DOVR�FDQ�XVH�PDQ\�RI�WKHVH�FODVVHV�WR�FRQVWUXFW�FRQWUROV��VXFK�DV�EXWWRQV��ODEHOV��DQG�OLVW�ER[HV���7KH�:LQ)RUP�LV�PRUH�UREXVW�DQG�FRQWDLQV�PRUH�IXQFWLRQDOLW\�WKDQ�WKH�IRUPV�LQ�SUHYLRXV�YHUVLRQV�RI�9%��%HIRUH�VXEFODVVLQJ�D�:LQ)RUP�RU�D�FRQWURO��LW�LV�D�JRRG�LGHD�WR�UHVHDUFK�WKH�SUHYLRXV�OLVW�RI�FODVVHV�WR�GHWHUPLQH�LI�WKH�IXQFWLRQDOLW\�\RX�QHHG�LV�DOUHDG\�EXLOW�LQ���

�������8VLQJ�D�:LQ)RUP�

7R�XVH�D�:LQ)RUP�LQ�9%�1(7��\RX�PXVW�ILUVW�LPSRUW�WKH�6\VWHP�:LQIRUPV�QDPHVSDFH�LQWR�\RXU�DSSOLFDWLRQ��<RX�GR�WKLV�E\�XVLQJ�WKH�,PSRUWV�VWDWHPHQW��DV�VKRZQ�KHUH���,PSRUWV�6\VWHP�:LQ)RUPV�<RX�PXVW�SODFH�WKH�,PSRUWV�VWDWHPHQW�EHIRUH�DQ\�RWKHU�FRGH�LQ�WKH��9%�ILOH��<RX�PXVW�LPSRUW�WZR�RWKHU�QDPHVSDFHV�DV�ZHOO��WKH\�DUH���,PSRUWV�6\VWHP�&RPSRQHQW0RGHO�,PSRUWV�6\VWHP�'UDZLQJ�7KH�6\VWHP�&RPSRQHQW0RGHO�QDPHVSDFH�FRQWDLQV�FRUH�FRPSRQHQW�IXQFWLRQDOLW\�VXFK�DV�FRQWDLQPHQW��OLFHQVLQJ��DQG�DWWULEXWH�KDQGOLQJ��DV�ZHOO�DV�PDQ\�RWKHUV��7KH�6\VWHP�'UDZLQJ�QDPHVSDFH�FRQWDLQV�IXQFWLRQDOLW\�WR�SDLQW�REMHFWV�RQ�WKH�VFUHHQ���$IWHU�\RX�LPSRUW�WKLV�QDPHVSDFH�LQWR�WKH�DSSOLFDWLRQ��\RX�QHHG�WR�FUHDWH�D�FODVV�WKDW�LQKHULWV�IURP�WKH�)RUP�FODVV��<RX�DFFRPSOLVK�WKLV�E\�XVLQJ�WKH�IROORZLQJ�FRGH���3XEOLF�&ODVV�)RUP������,QKHULWV�6\VWHP�:LQ)RUPV�)RUP������3ODFH�IRUP�FRGH�KHUH�(QG�&ODVV�7R�DOORZ�\RXU�SURMHFW�WR�XVH�WKLV�IRUP��\RX�PXVW�VSHFLI\�LQ�WKH�SURMHFW�SURSHUWLHV�GLDORJ�ER[�WKDW�WKH�6WDUWXS2EMHFW�SURSHUW\�LV�HTXDO�WR��SURMHFW�QDPH!�)RUP���ZKHUH��SURMHFW�QDPH!�LV�WKH�QDPH�RI�\RXU�SURMHFW��7KLV�ZLOO�FDXVH�)RUP��WR�EH�WKH�VWDUWXS�IRUP�IRU�WKLV�SURMHFW��WKDW�LV��WKH�DSSOLFDWLRQ�ZLOO�FUHDWH�DQG�GLVSOD\�WKLV�IRUP�ILUVW�XSRQ�VWDUWXS���,I�\RX�XVH�WKH�9LVXDO�6WXGLR�1(7��96�1(7��ZL]DUG�WR�FUHDWH�D�9%�1(7�:LQ)RUPV�DSSOLFDWLRQ��LW�ZLOO�VHW�XS�\RXU�SURMHFW�WR�FRQWDLQ�D�VLQJOH��9%�ILOH�FDOOHG�)RUP���,W�DOVR�ZLOO�DXWRPDWLFDOO\�FUHDWH�RWKHU�SURMHFW�ILOHV��EXW�ZH�DUH�QRW�FRQFHUQHG�ZLWK�WKHVH�ILOHV��7KH�FRGH�LQ�WKLV�ILOH�ORRNV�VLPLODU�WR�WKH�FRGH�SUHVHQWHG�LQ�([DPSOH��������

Page 505: Visual Basic - Subclassing and Hooking with VB & VB NET

([DPSOH�������96�1(7�:L]DUG�&UHDWHG�&RGH�IRU�D�:LQ)RUP�$SSOLFDWLRQ��

,PSRUWV�6\VWHP�&RPSRQHQW0RGHO�,PSRUWV�6\VWHP�'UDZLQJ�,PSRUWV�6\VWHP�:LQ)RUPV���3XEOLF�&ODVV�)RUP������,QKHULWV�6\VWHP�:LQ)RUPV�)RUP������3XEOLF�6XE�1HZ�������������0\%DVH�1HZ���������)RUP�� �0H����������7KLV�FDOO�LV�UHTXLUHG�E\�WKH�:LQ�)RUP�'HVLJQHU����������,QLWLDOL]H&RPSRQHQW����������72'2��$GG�DQ\�LQLWLDOL]DWLRQ�DIWHU�WKH�,QLWLDOL]H&RPSRQHQW�����FDOO�����(QG�6XE������)RUP�RYHUULGHV�GLVSRVH�WR�FOHDQ�XS�WKH�FRPSRQHQW�OLVW������2YHUULGHV�3XEOLF�6XE�'LVSRVH�������������0\%DVH�'LVSRVH���������FRPSRQHQWV�'LVSRVH�����(QG�6XE����5HJLRQ���:LQGRZV�)RUP�'HVLJQHU�JHQHUDWHG�FRGH��������5HTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����3ULYDWH�FRPSRQHQWV�$V�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU������'LP�:LWK(YHQWV�)RUP��$V�6\VWHP�:LQ)RUPV�)RUP������127(��7KH�IROORZLQJ�SURFHGXUH�LV�UHTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����,W�FDQ�EH�PRGLILHG�XVLQJ�WKH�:LQGRZV�)RUP�'HVLJQHU��������'R�QRW�PRGLI\�LW�XVLQJ�WKH�FRGH�HGLWRU������3ULYDWH�6XE�,QLWLDOL]H&RPSRQHQW�������������FRPSRQHQWV� �1HZ�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU���������0H�7H[W� ��)RUP�������(QG�6XE�

Page 506: Visual Basic - Subclassing and Hooking with VB & VB NET

��(QG�5HJLRQ��(QG�&ODVV�7KH�6XE�1HZ�VXEURXWLQH�LV�WKH�FRQVWUXFWRU�IRU�WKLV�FODVV��7KH�IRUP�FRQVWUXFWRU�UHSODFHV�WKH�IDPLOLDU�)RUPB/RDG�HYHQW�LQ�SUHYLRXV�YHUVLRQV�RI�9%��7KLV�FRQVWUXFWRU�LQLWLDOO\�FDOOV�WKH�FRQVWUXFWRU�RI�WKH�EDVH�FODVV�DQG�WKHQ�LPPHGLDWHO\�VHWV�WKH�0H�UHIHUHQFH�WR�LWVHOI��7KLV�0H�UHIHUHQFH�RSHUDWHV�VLPLODU�WR�WKH�0H�UHIHUHQFH�LQ�SUHYLRXV�YHUVLRQV�RI�9%��/DVW��WKH�FRQVWUXFWRU�FDOOV�WKH�,QLWLDOL]H&RPSRQHQW�PHWKRG��VKRZQ�DW�WKH�ERWWRP�RI�([DPSOH�������7KH�,QLWLDOL]H&RPSRQHQW�PHWKRG�LQLWLDOL]HV�WKH�IRUP�DV�D�FRQWDLQHU�IRU�FRQWUROV�DQG�VHWV�LWV�FDSWLRQ�WR��)RUP�����7KH�ZL]DUG�DOVR�DGGV�D�'LVSRVH�VXEURXWLQH�WR�DOORZ�WKH�IRUP�WR�FOHDQ�XS�DIWHU�LWVHOI�DQG�WR�IUHH�DQ\�UHVRXUFHV�LW�LV�KROGLQJ�RQWR�LQ�D�WLPHO\�PDQQHU��LQVWHDG�RI�ZDLWLQJ�IRU�WKH�*DUEDJH�&ROOHFWRU�WR�SHUIRUP�WKLV�VWHS�DW�VRPH�XQGHWHUPLQHG�ODWHU�WLPH���7KH�IRUP�GHVLJQHU�ZULWHV�WKH�FRGH�EHWZHHQ�WKH��5HJLRQ������(QG�5HJLRQ�DV�\RX�DGG��UHPRYH��RU�PRGLI\�FRQWUROV�RQ�WKLV�IRUP��7KH��5HJLRQ�SUHSURFHVVRU�GLUHFWLYH�DOORZV�\RX�WR�FROODSVH�WKLV�EORFN�RI�FRGH�VR�WKDW�\RXU�HGLWRU�VFUHHQ�FDQ�UHPDLQ�XQFOXWWHUHG���

�����,QVWDQFH�6XEFODVVLQJ�

6XEFODVVLQJ�D�:LQ)RUP�LV�PXFK�VLPSOHU�DQG�OHVV�HUURU�SURQH�WKDQ�VXEFODVVLQJ�D�9%���RU���IRUP�PRGXOH�EHFDXVH�0LFURVRIW�KDV�ZULWWHQ�DOO�WKH�ORZHU�OHYHO�VXEFODVVLQJ�FRGH�IRU�\RX��1RZ��DOO�\RX�UHDOO\�KDYH�WR�ZRUU\�DERXW�LV�WKH�FRGH�WKDW�\RX�ZLOO�ZULWH�IRU�\RXU�VXEFODVV�ZLQGRZ�SURFHGXUH���7R�XQGHUVWDQG�WKLV�EHWWHU��ZH�QHHG�WR�ORRN�EHKLQG�WKH�VFHQHV�DW�D�ZLQGRZ�EHLQJ�FUHDWHG�LQ�D�:LQ)RUP�DSSOLFDWLRQ��$V�VRRQ�DV�WKLV�ZLQGRZ�LV�FUHDWHG�LQ�PHPRU\��WKH�*HW:LQGRZ/RQJ:�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IXQFWLRQ�LV�FDOOHG�WR�UHSODFH�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�ZLWK�D�QHZ�RQH��7KH�RULJLQDO�ZLQGRZ�SURFHGXUH�LV�VWRUHG�VR�WKDW�LW�FDQ�EH�UHSODFHG�ZKHQ�WKH�ZLQGRZ�LV�GHVWUR\HG��)RU�PRUH�GHWDLO��VHH�6HFWLRQ������ODWHU�LQ�WKLV�FKDSWHU���%HFDXVH�WKH�:LQ)RUP�DXWRPDWLFDOO\�WDNHV�FDUH�RI�VXEFODVVLQJ�DQG�XQVXEFODVVLQJ�LWVHOI����QRW�WR�PHQWLRQ�VWRULQJ�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�IRU�ODWHU�XVH����ZH�KDYH�IHZHU�KHDGDFKHV�WR�ZRUU\�DERXW�ZKHQ�LPSOHPHQWLQJ�VXEFODVVLQJ��2QH�WKLQJ�WKDW�WKH�:LQ)RUP�GRHV�QRW�DXWRPDWLFDOO\�GR��KRZHYHU��LV�ZULWH�WKH�HPSW\�VXEFODVV�SURFHGXUH���(YHQ�WKRXJK�WKH�:LQ)RUP�KDQGOHV�PXFK�RI�WKH�VXEFODVVLQJ�DXWRPDWLFDOO\��\RX�PXVW�VWLOO�IROORZ�WKH�VDPH�UXOHV�DV�\RX�GLG�SUHYLRXVO\�ZKHQ�ZULWLQJ�\RXU�VXEFODVVHG�ZLQGRZ�SURFHGXUH��)RU�H[DPSOH��ORQJ�FRPSOH[�FRGH�LQ�WKH�ZLQGRZ�SURFHGXUH����LQFOXGLQJ�GLVSOD\LQJ�D�PHVVDJH�ER[�RU�GLDORJ�ER[�IRU�XVHU�LQSXW����ZLOO�VHYHUHO\�GHJUDGH�\RXU�DSSOLFDWLRQV�SHUIRUPDQFH��$OVR��

Page 507: Visual Basic - Subclassing and Hooking with VB & VB NET

\RX�PXVW�FDOO�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�RI�WKH�VXEFODVVHG�:LQ)RUP�VR�WKDW�GHIDXOW�ZLQGRZ�SURFHVVLQJ�FDQ�RFFXU�RQ�WKH�PHVVDJH���$�PDMRU�EHQHILW�RI�VXEFODVVLQJ�D�:LQ)RUP�LV�WKDW�\RX�GR�QRW�KDYH�WR�ZRUU\�DERXW�VWRULQJ�WKH�RULJLQDO�ZLQGRZ�SURFHGXUHV�DGGUHVV�DQG�XVLQJ�LW�WR�FDOO�DQG�UHVWRUH�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��:H�ZLOO�VHH�KRZ�WKLV�ZRUNV�LQ�WKH�ILUVW�H[DPSOH�DSSOLFDWLRQ���

�7KLV�PHWKRG�RI�VXEFODVVLQJ�LV�DYDLODEOH�ZKHQ�XVLQJ�DQ\��1(7�ODQJXDJH��VXFK�DV�&��RU�PDQDJHG�&����7KH�RQO\�UHTXLUHPHQW�LV�WKDW�\RX�XVH�WKH�:LQ)RUPV�FODVVHV�ZKHQ�FUHDWLQJ�WKH�ZLQGRZV����

7KH�PHVVDJLQJ�IORZ�LQ�D�:LQ)RUP�IROORZV�WKH�VDPH�SDWK�DV�GR�PHVVDJHV�LQ�D�W\SLFDO�VXEFODVVHG�ZLQGRZ��)LUVW�WKH�PHVVDJH�LV�SODFHG�LQ�WKH�WKUHDGV�PHVVDJH�TXHXH��ZKHUH�WKH�PHVVDJH�ORRS�UHWULHYHV�LW�DQG�VHQGV�LW�RQ�WR�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH��7KLV�VXEFODVVHG�ZLQGRZ�SURFHGXUH�LV�WKH�RQH�WKDW�WKH�:LQ)RUP�DXWRPDWLFDOO\�LQVHUWV�IRU�\RX��1H[W��WKH�PHVVDJH�LV�VHQW�RQ�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�DQG�WKHQ�RQ�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH��7KH�IROORZLQJ�OLVW�VSHFLILHV�WKH�RUGHU�LQ�ZKLFK�WKH�PHVVDJH�LV�KDQGOHG���

��� 7KUHDG�0HVVDJH�4XHXH����� 0HVVDJH�ORRS���� 6XEFODVVHG�ZLQGRZ�SURFHGXUH��LQVHUWHG�E\��1(7����� 2ULJLQDO�ZLQGRZ�SURFHGXUH���� 'HIDXOW:LQ3URF�"�5HWXUQ��

1H[W��,�ZLOO�SUHVHQW�VHYHUDO�H[DPSOHV�VKRZLQJ�KRZ�\RX�FDQ�VXEFODVV�D�:LQ)RUP��,W�LV�LQWHUHVWLQJ�WR�QRWH�WKDW�WKHUH�DUH�WKUHH�ZD\V�WR�VXEFODVV�D�:LQ)RUP�LQ�9%�1(7��,�ZLOO�GHVFULEH�HDFK�WHFKQLTXH�LQ�WKH�QH[W�WKUHH�H[DPSOHV���

�������7HFKQLTXH�����2YHUULGLQJ�WKH�:LQ3URF�0HWKRG�

7KH�ILUVW�WHFKQLTXH�IRU�VXEFODVVLQJ�D�:LQ)RUP�LV�WKH�VLPSOHVW�WR�ZULWH��,W�LQYROYHV�XVLQJ�WKH�REMHFW�RULHQWHG�FDSDELOLWLHV�RI�WKH�:LQ)RUP�FODVVHV�WR�RYHUULGH�WKH�:QG3URF�PHWKRG��7KH�:QG3URF�PHWKRG�LV�WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�IRU�WKH�:LQ)RUP��7KLV�SURFHGXUH�LV�FRQWDLQHG�ZLWKLQ�WKH�&RQWURO�FODVV�IURP�ZKLFK�WKH�)RUP�FODVV�LQKHULWV��7KH�IXQFWLRQ�GHFODUDWLRQ�IRU�:QG3URF�LV�DV�IROORZV���2YHUULGDEOH�3URWHFWHG�6XE�:QG3URF�%\5HI�P�DV�0HVVDJH��7KLV�IXQFWLRQ�LV�PDUNHG�DV�2YHUULGDEOH��ZKLFK�PHDQV�WKDW�FODVVHV�LQKHULWLQJ�IURP�WKH�&RQWURO�FODVV�FDQ�RYHUULGH�WKH�IXQFWLRQDOLW\�LQ�WKH�&RQWURO�:QG3URF�PHWKRG�WR�SURYLGH�WKHLU�RZQ�LPSOHPHQWDWLRQ��7KH�3URWHFWHG�PRGLILHU�LQGLFDWHV�WKDW�WKH�&RQWURO�FODVV��DQG�DQ\�FODVVHV�LQKHULWLQJ�IURP�WKLV�FODVV��FDQ�DFFHVV�RQO\�WKH�:QG3URF�PHWKRG��7KLV�SURWHFWV�WKH�:QG3URF�PHWKRG�IURP�EHLQJ�DFFHVVHG�RXWVLGH�RI�WKH�IRUP���

Page 508: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�:QG3URF�PHWKRG�WDNHV�RQO\�RQH�SDUDPHWHU��P��ZKLFK�LV�RI�W\SH�0HVVDJH��<RX�ZLOO�QRWLFH�WKDW�LW�LV�PDUNHG�DV�%\5HI��ZKLFK�PHDQV�WKDW�WKH�:QG3URF�FDQ�PRGLI\�WKH�PHVVDJH�EHIRUH�LW�LV�SDVVHG�EDFN�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH���,Q�D�9%���DSSOLFDWLRQ��\RX�FDQ�GHFODUH�D�VXEFODVVHG�ZLQGRZ�SURFHGXUH�DV�IROORZV���3XEOLF�)XQFWLRQ�:QG3URF�K:QG�$V�/RQJ��0VJ�$V�/RQJ��Z3DUDP�$V�/RQJ��B�������������������������O3DUDP�$V�/RQJ��DV�/RQJ�7KH�9%�1(7�:QG3URF�PHWKRG�LV�PLVVLQJ�DOO�WKH�SDUDPHWHUV��LQFOXGLQJ�WKH�UHWXUQ�YDOXH��$OO�WKHVH�SDUDPHWHUV�DUH�QRZ�HQFDSVXODWHG�LQ�WKH�0HVVDJH�W\SH��7KH�0HVVDJH�W\SH�LV�D�VWUXFWXUH�WKDW�FRQWDLQV�WKH�IROORZLQJ�ILHOGV�UHODWLQJ�WR�D�ZLQGRZV�PHVVDJH���Public hWnd As Integer

:LQGRZ�KDQGOH�WR�ZKLFK�WKH�PHVVDJH�LV�GLUHFWHG�Public msg As Integer

,'�RI�WKH�PHVVDJH�Public lParam As Integer

0HDQLQJ�LV�GHWHUPLQHG�E\�WKH�PHVVDJH�Public wParam As Integer

0HDQLQJ�LV�GHWHUPLQHG�E\�WKH�PHVVDJH�Public result As Integer

5HWXUQ�YDOXH�RI�WKH�PHVVDJH�DIWHU�WKH�IXQFWLRQ�SURFHVVHV�LW�<RX�FDQQRW�FUHDWH�WKH�0HVVDJH�VWUXFWXUH�VLPSO\�E\�LQVWDQWLDWLQJ�D�QHZ�LQVWDQFH�RI�WKH�0HVVDJH�W\SH��7R�FUHDWH�D�QHZ�LQVWDQFH��WKH�0HVVDJH�VWUXFWXUH�FRQWDLQV�D�SXEOLF�VWDWLF�PHWKRG�FDOOHG�&UHDWH����LQ�9%�1(7��VWDWLF�IXQFWLRQV�DUH�GHFODUHG�DV�6KDUHG��7KH�GHFODUDWLRQ�RI�WKLV�PHWKRG�LV�DV�IROORZV���3XEOLF�6KDUHG�)XQFWLRQ�&UHDWH�%\9DO�K:QG�$V�,QWHJHU��%\9DO�PVJ�$V�,QWHJHU��B���������%\9DO�Z3DUDP�$V�,QWHJHU��%\9DO�O3DUDP�$V�,QWHJHU��$V�0HVVDJH�7KH�UHDVRQ�IRU�WKLV�PHWKRG�FDOO�LQVWHDG�RI�LQVWDQWLDWLQJ�D�QHZ�REMHFW�LV�WKDW�WKH��1(7�IUDPHZRUN�FUHDWHV�D�SRRO�RI�0HVVDJH�VWUXFWXUHV�DYDLODEOH�WR�WKH�GHYHORSHU��7KH�&UHDWH�PHWKRG�UHWXUQV�D�0HVVDJH�VWUXFWXUH�IURP�WKLV�SRRO��WKXV�LPSURYLQJ�WKH�DSSOLFDWLRQV�HIILFLHQF\��:KHQ�D�&UHDWH�PHWKRG�WULHV�WR�UHWXUQ�D�0HVVDJH�VWUXFWXUH�DQG�QRQH�LV�DYDLODEOH��WKH�V\VWHP�ZLOO�FUHDWH�D�QHZ�RQH���7R�RYHUULGH�D�EDVH�FODVVV�IXQFWLRQ�LQ�9%�1(7��\RX�QHHG�WR�XVH�WKH�2YHUULGHV�NH\ZRUG��7KH�IROORZLQJ�FRGH�RYHUULGHV�WKH�&RQWURO�FODVVV�:QG3URF�PHWKRG���3URWHFWHG�2YHUULGHV�6XE�:QG3URF�%\5HI�P�$V�0HVVDJH������6XEFODVVLQJ�FRGH�JRHV�KHUH�����������0\%DVH�:QG3URF�P��(QG�6XE�:KHQ�RYHUULGLQJ�D�PHWKRG����HVSHFLDOO\�WKH�:QG3URF�PHWKRG����\RX�QHHG�WR�FDOO�WKH�RYHUULGGHQ��RU�EDVH��PHWKRG�WR�FRPSOHWH�WKH�SURFHVVLQJ��,Q�9%����ZH�ZRXOG�XVH�WKH�IROORZLQJ�$3,�IXQFWLRQ�WR�UHWXUQ�WKH�PHVVDJH�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH���:QG3URF� �&DOO:LQGRZ3URF�2ULJ:QG3URF��KZQG��X0VJ��Z3DUDP��O3DUDP��

Page 509: Visual Basic - Subclassing and Hooking with VB & VB NET

,Q�WKH�FDVH�RI�WKH�:QG3URF�PHWKRG��\RX�PXVW�FDOO�WKH�EDVH�:QG3URF�PHWKRG�FRQWDLQHG�LQ�WKH�&RQWURO�FODVV��,I�\RX�GRQW��WKH�RULJLQDO�ZLQGRZ�SURFHGXUH�ZLOO�QRW�SURFHVV�WKH�PHVVDJH��7R�FDOO�WKH�EDVH�FODVV�PHWKRG��ZH�QHHG�WR�XVH�WKH�0\%DVH�NH\ZRUG�DV�IROORZV���0\%DVH�:QG3URF�P��7KH�0HVVDJH�VWUXFWXUH��P��LV�VHQW�WR�WKH�RYHUULGGHQ�EDVH�FODVV�WR�FRPSOHWH�LWV�SURFHVVLQJ�E\�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��,I�ZH�OHIW�RXW�WKLV�OLQH�RI�FRGH��ZH�ZRXOG��LQ�HIIHFW��EH�SUHYHQWLQJ�WKH�ZLQGRZ�IURP�ILQLVKLQJ�SURFHVVLQJ�WKH�PHVVDJH���

���������7KH�DSSOLFDWLRQ�

7KH�DSSOLFDWLRQ�\RX�QHHG�WR�FUHDWH�WR�GHPRQVWUDWH�WKLV�WHFKQLTXH�LV�VLPSOH��7KH�RQO\�FRQWURO�RQ�WKH�IRUP�LV�D�WH[W�ER[��DV�)LJXUH������LOOXVWUDWHV��7DEOH������OLVWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�WKH�WH[W�ER[�FRQWURO���

)LJXUH�������7KH�DSSOLFDWLRQ�XVLQJ�WKH�ILUVW�WHFKQLTXH�RI�VXEFODVVLQJ�

7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��

2EMHFW� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�)RUP� &DSWLRQ� �9%�1(7�6XEFODVVLQJ�([DPSOH��)RUP� +HLJKW� ����)RUP� :LGWK� ����7H[W%R[� 0XOWLOLQH� 7UXH�7H[W%R[� 6FUROOEDUV� 7UXH�7H[W%R[� :RUG:UDS� )DOVH�7H[W%R[� 7RS� ���7H[W%R[� /HIW� ��7H[W%R[� +HLJKW� ����7H[W%R[� :LGWK� ����7KH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�IRU�WKLV�DSSOLFDWLRQ�ZDWFKHV�IRU�WKH�ULJKW�PRXVH�EXWWRQ�WR�EH�SUHVVHG�ZKLOH�WKH�PRXVH�LV�RYHU�WKH�IRUPV�FOLHQW�DUHD��:KHQ�WKH�XVHU�FOLFNV�LW��D�PHVVDJH�LV�SODFHG�LQ�WKH�WH[W�ER[�LQGLFDWLQJ�WKDW�WKH�ULJKW�PRXVH�EXWWRQ�ZDV�FOLFNHG�DQG�OLVWLQJ�WKDW�PHVVDJHV�,'��)URP�WKH�VFUHHQVKRW�RI�WKH�DSSOLFDWLRQ�LQ�)LJXUH�������ZH�FDQ�VHH�WKDW�WKH�

Page 510: Visual Basic - Subclassing and Hooking with VB & VB NET

ULJKW�PRXVH�EXWWRQ�ZDV�FOLFNHG�RQ�WKH�IRUP�WZLFH���$V�D�QRWH��WKH�VXEFODVVHG�ZLQGRZ�SURFHGXUH�FDQQRW�VHH�PHVVDJHV�WKDW�DUH�VHQW�WR�QRQFOLHQW�DUHDV�RI�WKH�IRUP����7KH�ILUVW�GLIIHUHQFH�\RX�PLJKW�QRWLFH�EHWZHHQ�WKLV�DSSOLFDWLRQ�DQG�WKH�VXEFODVVLQJ�DSSOLFDWLRQV�LQ�SUHYLRXV�FKDSWHUV�LV�WKDW�WKHUH�DUH�QR�6XEFODVV�DQG�8Q6XEFODVV�EXWWRQV�RQ�WKH�IRUP��:KHQ�RYHUULGLQJ�WKH�:QG3URF�PHWKRG��WKH�:LQ)RUP�LV�VXEFODVVHG�ZKHQ�LW�LV�FUHDWHG��DQG�WKH�VXEFODVVLQJ�FDQQRW�EH�UHPRYHG�XQWLO�WKH�IRUP�LV�GHVWUR\HG��7KH�V\VWHP�UHPRYHV�WKH�VXEFODVVLQJ�LPPHGLDWHO\�EHIRUH�WKH�IRUP�LV�GHVWUR\HG���

���������7KH��9%�ILOH�

([DPSOH������SUHVHQWV�WKH�FRGH�IRU�WKLV�WHFKQLTXH��7KH�FRGH�DGGHG�WR�VXEFODVV�WKH�:LQ)RUP�LV�KLJKOLJKWHG��7KH�FRGH�LQ�WKH�:QG3URF�PHWKRG�ZDWFKHV�IRU�WKH�:0B5%87721'2:1�PHVVDJH�WR�EH�SDVVHG�WR�LW��:KHQ�LW�UHFHLYHV�WKLV�PHVVDJH��VRPH�WH[W�LQGLFDWLQJ�WKDW�WKH�ULJKW�EXWWRQ�ZDV�SUHVVHG�LV�ZULWWHQ�WR�WKH�WH[W�ER[��8SRQ�FRPSOHWLQJ�LWV�WDVN��DOO�PHVVDJHV�DUH�VHQW�WR�WKH�EDVH�:QG3URF�PHWKRG�IRU�GHIDXOW�SURFHVVLQJ���

([DPSOH�������7KH�)RUP��YE�)LOH�8VLQJ�6XEFODVVLQJ�7HFKQLTXH�����

,PSRUWV�6\VWHP�&RPSRQHQW0RGHO�,PSRUWV�6\VWHP�'UDZLQJ�,PSRUWV�6\VWHP�:LQ)RUPV���3XEOLF�&ODVV�)RUP������,QKHULWV�6\VWHP�:LQ)RUPV�)RUP����������3XEOLF�6XE�1HZ�������������0\%DVH�1HZ�������������)RUP�� �0H���������,QLWLDOL]H&RPSRQHQW���������(QG�6XE����������)RUP�RYHUULGHV�GLVSRVH�WR�FOHDQ�XS�WKH�FRPSRQHQW�OLVW������3XEOLF�2YHUULGHV�6XE�'LVSRVH�������������0\%DVH�'LVSRVH�������������FRPSRQHQWV�'LVSRVH���������(QG�6XE�������5HJLRQ���:LQGRZV�)RUP�'HVLJQHU�JHQHUDWHG�FRGH��������

Page 511: Visual Basic - Subclassing and Hooking with VB & VB NET

����5HTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����3ULYDWH�FRPSRQHQWV�$V�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU����������3ULYDWH�:LWK(YHQWV�7H[W%R[��$V�6\VWHP�:LQ)RUPV�7H[W%R[����������'LP�:LWK(YHQWV�)RUP��$V�6\VWHP�:LQ)RUPV�)RUP����������127(��7KH�IROORZLQJ�SURFHGXUH�LV�UHTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����,W�FDQ�EH�PRGLILHG�XVLQJ�WKH�:LQGRZV�)RUP�'HVLJQHU��������'R�QRW�PRGLI\�LW�XVLQJ�WKH�FRGH�HGLWRU������3ULYDWH�6XE�,QLWLDOL]H&RPSRQHQW�������������0H�FRPSRQHQWV� �1HZ�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU�������������0H�7H[W%R[�� �1HZ�6\VWHP�:LQ)RUPV�7H[W%R[����������������������#GHVLJQ�0H�7UD\+HLJKW� �����������#GHVLJQ�0H�7UD\/DUJH,FRQ� �)DOVH���������#GHVLJQ�0H�7UD\$XWR$UUDQJH� �7UXH���������7H[W%R[��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW����������������7H[W%R[��0XOWLOLQH� �7UXH���������7H[W%R[��6FUROO%DUV� �6\VWHP�:LQ)RUPV�6FUROO%DUV�%RWK���������7H[W%R[��:RUG:UDS� �)DOVH���������7H[W%R[��7DE,QGH[� �����������7H[W%R[��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H�������������������0H�7H[W� ��9%�1(7�6XEFODVVLQJ�([DPSOH����������0H�$XWR6FDOH%DVH6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������0H�&OLHQW6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������������������0H�&RQWUROV�$GG�7H[W%R[�������(QG�6XE����������68%&/$66,1*�7(&+1,48(��������3URWHFWHG�2YHUULGHV�6XE�:QG3URF�%\5HI�P�$V�0HVVDJH����������,I�P�PVJ� �PLFURVRIW�:LQ���,QWHURS�ZLQ�:0B5%87721'2:1�7KHQ�������������WH[WER[��7H[W� �WH[WER[��7H[W���7KH�ULJKW�PRXVH�EXWWRQ�ZDV����B����������������SUHVVHG��0HVVDJH,'� �����P�PVJ�7R6WULQJ������FKU������FKU�������������(QG�,I������������������0\%DVH�:QG3URF�P������(QG�6XE��(QG�5HJLRQ�

Page 512: Visual Basic - Subclassing and Hooking with VB & VB NET

(QG�&ODVV�

�������7HFKQLTXH�����%LQGLQJ�WR�D�1DWLYH:LQGRZ�&ODVV�,QVWDQFH�

7KLV�WHFKQLTXH�UHTXLUHV�D�OLWWOH�PRUH�FRGH�WKDQ�WKH�ILUVW�WHFKQLTXH��EXW�\RX�JDLQ�WKH�DELOLW\�WR�WXUQ�VXEFODVVLQJ�RQ�DQG�RII�DW�ZLOO��7KLV�WHFKQLTXH�ZLOO�KHOS�RSWLPL]H�\RXU�DSSOLFDWLRQ�E\�DOORZLQJ�\RX�WR�GHFLGH�ZKHQ�WKH�VXEFODVVLQJ�VKRXOG�EH�SHUIRUPHG���7R�XVH�WKLV�VHFRQG�WHFKQLTXH��ZH�PXVW�ILUVW�FUHDWH�D�FODVV�WKDW�LQKHULWV�IURP�WKH�1DWLYH:LQGRZ�FODVV��7KLV�QHZ�FODVV�ZLOO�FRQWDLQ�WKH�:QG3URF�PHWKRG�DV�ZHOO�DV�DQ�HYHQW�KDQGOHU�WKDW�LV�FDOOHG�ZKHQ�VXEFODVVLQJ�LV�WXUQHG�RQ�DQG�RII���7KH�1DWLYH:LQGRZ�FODVV�LV�D�ZUDSSHU�DURXQG�DQ�K:QG�DQG�D�ZLQGRZ�SURFHGXUH�RI�WKH�:LQ)RUP�WR�ZKLFK�LW�LV�ERXQG��7R�ELQG�D�1DWLYH:LQGRZ�WR�D�:LQ)RUP��ZH�XVH�WKH�1DWLYH:LQGRZ�$VVLJQ+DQGOH�PHWKRG��7KLV�PHWKRG�LV�GHFODUHG�DV�IROORZV���2YHUULGDEOH�3XEOLF�6XE�$VVLJQKDQGOH��KDQGOH�$V�,QWHJHU��7R�ELQG�D�:LQ)RUP�WR�D�1DWLYH:LQGRZ�FODVV��ZH�VHW�WKH�KDQGOH�SDUDPHWHU�RI�WKLV�PHWKRG�HTXDO�WR�WKH�K:QG�RI�WKH�:LQ)RUP�WKDW�ZH�DUH�VXEFODVVLQJ��7KH�:LQ)RUP�FODVV�KDV�D�UHDG�RQO\�SURSHUW\�FDOOHG�+DQGOH��ZKLFK�LV�LQKHULWHG�IURP�WKH�&RQWURO�FODVV��%\�VHWWLQJ�WKH�KDQGOH�SDUDPHWHU�RI�WKH�$VVLJQ+DQGOH�PHWKRG�WR�WKH�:LQ)RUP�+DQGOH�SURSHUW\�YDOXH��ZH�FDQ�ELQG�WKH�:LQ)RUP�WR�WKH�1DWLYH:LQGRZ��7KH�IROORZLQJ�FRGH�IUDJPHQW�SHUIRUPV�WKLV�RSHUDWLRQ���'LP�VF�$V�1HZ�0\6XE&ODVV�����VF�$VVLJQ+DQGOH�)RUP��+DQGOH���,Q�WKLV�FRGH�IUDJPHQW��WKH�0\6XE&ODVV�FODVV�LQKHULWV�IURP�WKH�1DWLYH:LQGRZ�FODVV�DQG�FRQWDLQV�DQ�RYHUULGGHQ�:QG3URF�PHWKRG��7KH�1DWLYH:LQGRZ�REMHFW��VF��LV�FUHDWHG�DQG�LWV�$VVLJQ+DQGOH�PHWKRG�LV�FDOOHG�ZLWK�LWV�KDQGOH�SDUDPHWHU�VHW�WR�WKH�)RUP��IRUPV�+DQGOH�SURSHUW\���$W�WKLV�SRLQW��ZKHQHYHU�WKH�DSSOLFDWLRQV�PHVVDJH�ORRS�UHWULHYHV�D�PHVVDJH�IURP�WKH�PHVVDJH�TXHXH��WKH�PHVVDJH�ORRS�ZLOO�H[DPLQH�WKH�PHVVDJHV�K:QG�YDOXH�DQG�GLUHFW�LW�WR�RXU�LQVWDQFH�RI�WKH�1DWLYH:LQGRZ�FODVV��VF��WKDW�FRQWDLQV�RXU�VXEFODVVHG�ZLQGRZ�SURFHGXUH���7R�UHPRYH�WKH�VXEFODVVLQJ��ZH�QHHG�WR�FDOO�WKH�1DWLYH:LQGRZ�FODVVV�5HOHDVH+DQGOH�PHWKRG��7KLV�IXQFWLRQ�LV�GHFODUHG�DV�IROORZV���2YHUULGDEOH�3XEOLF�6XE�5HOHDVH+DQGOH�����7KLV�PHWKRG�WDNHV�QR�SDUDPHWHUV�DQG�GRHV�QRW�UHWXUQ�D�YDOXH��7R�GHWHUPLQH�LI�WKLV�PHWKRG�H[HFXWHG�VXFFHVVIXOO\��\RX�FDQ�FKHFN�WKH�+DQGOH�SURSHUW\�RI�WKH�REMHFW�WKDW�LQKHULWHG�IURP�WKH�1DWLYH:LQGRZ�FODVV��,I�WKH�+DQGOH�SURSHUW\�LV�VHW�WR�]HUR��WKH�5HOHDVH+DQGOH�PHWKRG�H[HFXWHG�FRUUHFWO\��+RZHYHU��LI�WKH�+DQGOH�SURSHUW\�VWLOO�FRQWDLQV�WKH�K:QG�YDOXH�RI�WKH�:LQ)RUP��WKH�PHWKRG�GLG�QRW�H[HFXWH�FRUUHFWO\��7KH�FRGH�WR�UHPRYH�WKH�VXEFODVVLQJ�DQG�FKHFN�WKH�+DQGOH�YDOXH�LV�DV�IROORZV���VF�5HOHDVH+DQGOH�����,I�VF�+DQGOH� ���7KHQ�����([HFXWHG�&RUUHFWO\�

Page 513: Visual Basic - Subclassing and Hooking with VB & VB NET

(OVH�����'LG�QRW�H[HFXWH�FRUUHFWO\�(QG�,I�<RX�DOVR�FDQ�GHWHUPLQH�ZKHWKHU�D�FDOO�WR�$VVLJQ+DQGOH�RU�5HOHDVH+DQGOH�KDV�VXFFHHGHG�E\�FRGLQJ�WKH�1DWLYH:LQGRZ�REMHFWV�2Q+DQGOH&KDQJH�HYHQW�SURFHGXUH��7KLV�HYHQW�LV�FDOOHG�ZKHQHYHU�WKH�+DQGOH�SURSHUW\�RI�WKH�1DWLYH:LQGRZ�FODVV�LQVWDQFH�LV�PRGLILHG��,Q�WKLV�HYHQW�SURFHGXUH��\RX�FDQ�FKHFN�WKH�YDOXH�RI�WKH�1DWLYH:LQGRZ�+DQGOH�SURSHUW\�WR�GHWHUPLQH�ZKHWKHU�WKH�:LQ)RUP�LV�VXEFODVVHG��,I�WKH�+DQGOH�SURSHUW\�LV�]HUR��WKH�1DWLYH:LQGRZ�LV�QRW�VXEFODVVHG��RWKHUZLVH��LW�LV���7R�VXEFODVV�WKH�:LQ)RUP�LQ�RXU�DSSOLFDWLRQ��ZH�ZLOO�FDOO�WKH�$VVLJQ+DQGOH�PHWKRG�LQ�WKH�6XEFODVV�EXWWRQV�&OLFN�HYHQW��7R�UHPRYH�WKH�VXEFODVVLQJ��ZH�ZLOO�FDOO�WKH�5HOHDVH+DQGOH�PHWKRG�LQ�WKH�8Q6XEFODVV�EXWWRQV�&OLFN�HYHQW���$V�D�QRWH��WKH�1DWLYH:LQGRZ�FODVV�KDV�WZR�PHWKRGV��&UHDWH+DQGOH�DQG�'HVWUR\+DQGOH��WKDW�\RX�VKRXOG�QRW�XVH�ZKHQ�VXEFODVVLQJ��7KH�'HVWUR\+DQGOH�PHWKRG�VHWV�WKH�+DQGOH�SURSHUW\�RI�WKH�1DWLYH:LQGRZ�FODVV�WR�]HUR�DQG�SURFHHGV�ZLWK�VKXWWLQJ�GRZQ�WKH�ZLQGRZ��$IWHU�WKH�ZLQGRZ�LV�VKXW�GRZQ��LW�LV�HOLJLEOH�IRU�JDUEDJH�FROOHFWLRQ��7KH�&UHDWH+DQGOH�PHWKRG�FUHDWHV�D�QHZ�ZLQGRZ�IURP�DQ�H[LVWLQJ�ZLQGRZ�FODVV���,W�LV�LQWHUHVWLQJ�WR�QRWH�WKDW�ZKHQ�\RX�XVH�WKLV�VXEFODVVLQJ�WHFKQLTXH�LQ�WDQGHP�ZLWK�WKH�ILUVW�VXEFODVVLQJ�WHFKQLTXH��WKH\�ZLOO�HDFK�LQWHUFHSW�PHVVDJHV�VHQW�WR�WKH�:LQ)RUP��7KHUHIRUH��\RX�FDQ�RYHUULGH�WKH�)RUP�FODVVV�:QG3URF�PHWKRG�DV�ZHOO�DV�ELQG�WKH�)RUP�WR�D�1DWLYH:LQGRZ�FODVV�DQG�RYHUULGH�LWV�:QG3URF�PHWKRG��7KLV��LQ�HIIHFW��VXEFODVVHV�WKH�:LQ)RUP�WZLFH��,I�\RX�QHHG�WR�VXEFODVV�WKH�:LQ)RUP�WZLFH��WKLV�LV�WKH�ZD\�WR�GR�LW�EHFDXVH�WKH�V\VWHP�DXWRPDWLFDOO\�WDNHV�FDUH�RI�UHPRYLQJ�ERWK�VXEFODVVHG�ZLQGRZ�SURFHGXUHV�DQG�UHSODFLQJ�WKH�:LQ)RUPV�RULJLQDO�ZLQGRZ�SURFHGXUH�EHIRUH�WKH�ZLQGRZ�LV�GHVWUR\HG��7R�VXEFODVV�WKH�:LQ)RUP�WZLFH��DGG�WR�WKH�)RUP��FODVV�WKH�IROORZLQJ�FRGH�IURP�7HFKQLTXH������3URWHFWHG�2YHUULGHV�6XE�:QG3URF�%\5HI�P�$V�0HVVDJH������3ODFH�VXEFODVVLQJ�FRGH�KHUH�������0\%DVH�:QG3URF�P��(QG�6XE�$�UHDOO\�QLFH�VLGH�EHQHILW�RI�XVLQJ�WKLV�WHFKQLTXH�LV�WKDW�LI�\RX�IDLO�WR�XQVXEFODVV�WKH�:LQ)RUP��\RXU�DSSOLFDWLRQ�ZLOO�QRW�FUDVK��)DLOLQJ�WR�XQVXEFODVV�D�IRUP�EHIRUH�LW�ZDV�GHVWUR\HG�LQ�D�SUHYLRXV�YHUVLRQ�RI�9%�ZRXOG�FDXVH�\RXU�DSSOLFDWLRQ�WR�VXIIHU�D�*HQHUDO�3URWHFWLRQ�)DXOW��*3)���7KH�V\VWHP�WDNHV�FDUH�RI�DQ\�FOHDQXS�WKDW�LV�UHTXLUHG�RI�D�VXEFODVVHG�:LQ)RUP�EHIRUH�LW�LV�GHVWUR\HG���

���������7KH�DSSOLFDWLRQ�

Page 514: Visual Basic - Subclassing and Hooking with VB & VB NET

7KLV�DSSOLFDWLRQ�RSHUDWHV�VLPLODUO\�WR�WKH�H[DPSOH�SUHVHQWHG�LQ�WKH�VHFWLRQ�HQWLWOHG��7HFKQLTXH������ZLWK�RQH�H[FHSWLRQ��6XEFODVV�DQG�8Q6XEFODVV�EXWWRQV�DUH�DGGHG�WR�WKH�IRUP��)LJXUH������VKRZV�WKH�DSSOLFDWLRQ���7KLV�DSSOLFDWLRQ�ZLOO�SODFH�WKH�VDPH�PHVVDJH�XVHG�LQ�WKH�7HFKQLTXH����H[DPSOH�LQ�WKH�WH[W�ER[�ZKHQHYHU�WKH�ULJKW�PRXVH�EXWWRQ�LV�FOLFNHG�RQ�WKH�IRUPV�FOLHQW�DUHD��7KH�GLIIHUHQFH�LV�WKDW�\RX�PXVW�FOLFN�WKH�6XEFODVV�EXWWRQ�WR�VXEFODVV�WKH�:LQ)RUP�DQG�LQWHUFHSW�WKH�:0B5%87721'2:1�PHVVDJH��:KHQ�\RX�FOLFN�WKH�8Q6XEFODVV�EXWWRQ��WKH�VXEFODVVLQJ�LV�UHPRYHG�DQG�WKH�:LQ)RUP�ZLOO�QR�ORQJHU�EH�DEOH�WR�LQWHUFHSW�WKH�:0B5%87721'2:1�PHVVDJH���7DEOH������OLVWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���

7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��2EMHFW� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�

)RUP� &DSWLRQ� �9%�1(7�6XEFODVVLQJ�([DPSOH��)RUP� +HLJKW� ����)RUP� :LGWK� ����7H[W%R[� 0XOWLOLQH� 7UXH�7H[W%R[� 6FUROOEDUV� 7UXH�7H[W%R[� :RUG:UDS� )DOVH�7H[W%R[� 7RS� ���7H[W%R[� /HIW� ���7H[W%R[� +HLJKW� ����7H[W%R[� :LGWK� ����%XWWRQ�� &DSWLRQ� �6XE&ODVV��%XWWRQ�� 7RS� ���%XWWRQ�� /HIW� ��%XWWRQ�� +HLJKW� ���%XWWRQ�� :LGWK� ���%XWWRQ�� &DSWLRQ� �8Q6XE&ODVV��%XWWRQ�� 7RS� ���%XWWRQ�� /HIW� ��%XWWRQ�� +HLJKW� ���%XWWRQ�� :LGWK� ���

)LJXUH�������7KH�DSSOLFDWLRQ�XVLQJ�WKH�VHFRQG�WHFKQLTXH�RI�VXEFODVVLQJ�

Page 515: Visual Basic - Subclassing and Hooking with VB & VB NET

���������7KH��9%�ILOH�

([DPSOH������SUHVHQWV�WKH�FRGH�IRU�WKLV�WHFKQLTXH��7KH�FRGH�DGGHG�WR�VXEFODVV�WKH�:LQ)RUP�LV�KLJKOLJKWHG���

([DPSOH�������7KH�)RUP��YE�)LOH�8VLQJ�6XEFODVVLQJ�7HFKQLTXH�����

,PSRUWV�6\VWHP�&RPSRQHQW0RGHO�,PSRUWV�6\VWHP�'UDZLQJ�,PSRUWV�6\VWHP�:LQ)RUPV���3XEOLF�&ODVV�)RUP������,QKHULWV�6\VWHP�:LQ)RUPV�)RUP����������3ULYDWH�'LP�VF�$V�1HZ�0\6XE&ODVV��������������3XEOLF�6XE�1HZ�������������0\%DVH�1HZ�������������)RUP�� �0H���������,QLWLDOL]H&RPSRQHQW����������������������VF�6HW5HI7R)RUP�0H������(QG�6XE����������)RUP�RYHUULGHV�GLVSRVH�WR�FOHDQ�XS�WKH�FRPSRQHQW�OLVW������3XEOLF�2YHUULGHV�6XE�'LVSRVH�������������0\%DVH�'LVSRVH�������������FRPSRQHQWV�'LVSRVH���������(QG�6XE�������5HJLRQ���:LQGRZV�)RUP�'HVLJQHU�JHQHUDWHG�FRGH������������5HTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�

Page 516: Visual Basic - Subclassing and Hooking with VB & VB NET

����3ULYDWH�FRPSRQHQWV�$V�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU����������3ULYDWH�:LWK(YHQWV�7H[W%R[��$V�6\VWHP�:LQ)RUPV�7H[W%R[�����3ULYDWH�:LWK(YHQWV�%XWWRQ��$V�6\VWHP�:LQ)RUPV�%XWWRQ�����3ULYDWH�:LWK(YHQWV�%XWWRQ��$V�6\VWHP�:LQ)RUPV�%XWWRQ����������'LP�:LWK(YHQWV�)RUP��$V�6\VWHP�:LQ)RUPV�)RUP����������127(��7KH�IROORZLQJ�SURFHGXUH�LV�UHTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����,W�FDQ�EH�PRGLILHG�XVLQJ�WKH�:LQGRZV�)RUP�'HVLJQHU��������'R�QRW�PRGLI\�LW�XVLQJ�WKH�FRGH�HGLWRU������3ULYDWH�6XE�,QLWLDOL]H&RPSRQHQW�������������0H�FRPSRQHQWV� �1HZ�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU�������������0H�%XWWRQ�� �1HZ�6\VWHP�:LQ)RUPV�%XWWRQ�������������0H�%XWWRQ�� �1HZ�6\VWHP�:LQ)RUPV�%XWWRQ�������������0H�7H[W%R[�� �1HZ�6\VWHP�:LQ)RUPV�7H[W%R[����������������������#GHVLJQ�0H�7UD\+HLJKW� �����������#GHVLJQ�0H�7UD\/DUJH,FRQ� �)DOVH���������#GHVLJQ�0H�7UD\$XWR$UUDQJH� �7UXH���������%XWWRQ��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW����������������%XWWRQ��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H�����������������%XWWRQ��7DE,QGH[� �����������%XWWRQ��7H[W� ��6XEFODVV�������������������%XWWRQ��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW����������������%XWWRQ��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H�����������������%XWWRQ��7DE,QGH[� �����������%XWWRQ��7H[W� ��8Q6XEFODVV�������������������7H[W%R[��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW�����������������7H[W%R[��0XOWLOLQH� �7UXH���������7H[W%R[��6FUROO%DUV� �6\VWHP�:LQ)RUPV�6FUROO%DUV�%RWK���������7H[W%R[��:RUG:UDS� �)DOVH���������7H[W%R[��7DE,QGH[� �����������7H[W%R[��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������������������0H�7H[W� ��9%�1(7�6XEFODVVLQJ�([DPSOH����������0H�$XWR6FDOH%DVH6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������0H�&OLHQW6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H�����������

Page 517: Visual Basic - Subclassing and Hooking with VB & VB NET

�����������������0H�&RQWUROV�$GG�7H[W%R[�����������0H�&RQWUROV�$GG�%XWWRQ�����������0H�&RQWUROV�$GG�%XWWRQ�������(QG�6XE��(QG�5HJLRQ��������������������68%&/$66�7(&+1,48(��������3URWHFWHG�6XE�%XWWRQ�B&OLFN�%\9DO�VHQGHU�$V�2EMHFW��B���������������������������������%\9DO�H�$V�6\VWHP�(YHQW$UJV����������,I�VF�+DQGOH����� ���7KHQ�������������VF�$VVLJQ+DQGOH�0H�+DQGOH����������(OVH�������������PVJER[��'RQW�WU\�WR�VXEFODVV�WKLV�ZLQGRZ�PRUH�WKDQ�RQFH�����������(QG�,I�����(QG�6XE����������3URWHFWHG�6XE�%XWWRQ�B&OLFN�%\9DO�VHQGHU�$V�2EMHFW��B���������������������������������%\9DO�H�$V�6\VWHP�(YHQW$UJV����������VF�5HOHDVH+DQGOH�������������7KH�VF�+DQGOH�SURSHUW\�UHYHUWV�EDFN�WR�������(QG�6XE���������������3XEOLF�&ODVV�0\6XEFODVV���������,QKHULWV�1DWLYH:LQGRZ������������������'LP�PB0DLQ:LQGRZ�$V�)RUP�������������������3XEOLF�6XE�6HW5HI7R)RUP�%\9DO�0DLQ:LQGRZ�$V�)RUP���������������PB0DLQ:LQGRZ� �0DLQ:LQGRZ���������(QG�6XE������������������3URWHFWHG�2YHUULGHV�6XE�:QG3URF�%\5HI�P�$V�0HVVDJH��������������,I�P�PVJ� �PLFURVRIW�:LQ���,QWHURS�ZLQ�:0B5%87721'2:1�7KHQ�����������������PB0DLQ:LQGRZ�WH[WER[��7H[W� �PB0DLQ:LQGRZ�WH[WER[��7H[W��B��������������������7KH�ULJKW�PRXVH�EXWWRQ�ZDV�SUHVVHG��0HVVDJH,'� �����B�������������������P�PVJ�7R6WULQJ������FKU������FKU�����

Page 518: Visual Basic - Subclassing and Hooking with VB & VB NET

������������(QG�,I��������������������������0\%DVH�:QG3URF�P����������(QG�6XE������������������3URWHFWHG�2YHUULGHV�6XE�2Q+DQGOH&KDQJH�����������������PVJER[��+DQGOH�KDV�FKDQJHG�����������(QG�6XE�����(QG�&ODVV�(QG�&ODVV�7KH�0\6XEFODVV�SXEOLF�FODVV�LV�DGGHG�DW�WKH�ERWWRP�RI�WKLV�H[DPSOH�FRGH�DQG�LQKHULWV�IURP�WKH�1DWLYH:LQGRZ�FODVV��,W�LV�LQVWDQWLDWHG�DV�D�SULYDWH�ILHOG�LQ�WKH�)RUP��FODVV��:KHQ�WKH�)RUP��FODVV�FRQVWUXFWRU�LV�FDOOHG��D�0H�UHIHUHQFH�WR�)RUP��LV�SDVVHG�LQ�WR�WKH�6HW5HI7R)RUP�PHWKRG�LQ�WKH�0\6XEFODVV�FODVV��7KLV�UHIHUHQFH�DOORZV�WH[W�WR�EH�ZULWWHQ�WR�WKH�WH[W�ER[�FRQWDLQHG�LQ�)RUP��IURP�WKH�LQVWDQFH�RI�WKH�0\6XEFODVV�FODVV��8QOLNH�LQ�SUHYLRXV�YHUVLRQV�RI�9%��FRQWUROV�DUH�QRZ�SULYDWH�WR�)RUP�FODVVHV��7KHUHIRUH��\RX�QHHG�D�PHFKDQLVP�VXFK�DV�WKLV�WR�ZULWH�WH[W�WR�D�WH[W�ER[�IURP�RXWVLGH�WKH�)RUP�FODVV���7KH�FRGH�LQ�WKH�RYHUULGGHQ�:QG3URF�PHWKRG�RI�0\6XEFODVV�LV�DOPRVW�LGHQWLFDO�WR�WKH�RYHUULGGHQ�:QG3URF�PHWKRG�LQ�WKH�7HFKQLTXH����H[DPSOH���7KH�SURWHFWHG�RYHUULGGHQ�PHWKRG��2Q+DQGOH&KDQJH��LV�DQ�HYHQW�KDQGOHU�WKDW�LV�ILUHG�ZKHQHYHU�WKH�KDQGOH�WR�WKH�)RUP��ZLQGRZ�LV�PRGLILHG��7KLV�PHWKRG�VLPSO\�GLVSOD\V�D�PHVVDJH�ER[�LQGLFDWLQJ�WKDW�WKH�KDQGOH�KDV�FKDQJHG���:KHQ�WKH�6XEFODVV�EXWWRQ�LV�FOLFNHG��WKH�%XWWRQ�B&OLFN�HYHQW�LV�ILUHG��7KLV�HYHQW�GHWHUPLQHV�ZKHWKHU�D�KDQGOH�KDV�EHHQ�DVVLJQHG�WR�WKH�LQVWDQFH�RI�0\6XEFODVV��LQGLFDWLQJ�WKDW�WKH�IRUP�LV�VXEFODVVHG��,I�D�KDQGOH�KDV�QRW�EHHQ�DVVLJQHG��WKH�$VVLJQ+DQGOH�PHWKRG�RI�WKH�0\6XEFODVV�FODVV�LV�FDOOHG�WR�DVVLJQ�)RUP�V�KDQGOH�WR�WKH�0\6XEFODVV�LQVWDQFH���+RZHYHU��LI�D�KDQGOH�LV�DOUHDG\�DVVLJQHG�DQG�WKH�XVHU�FOLFNV�WKH�6XEFODVV�EXWWRQ�D�VHFRQG�WLPH�EHIRUH�FOLFNLQJ�WKH�8Q6XEFODVV�EXWWRQ��D�PHVVDJH�LV�GLVSOD\HG�LQGLFDWLQJ�WKDW�WKH�)RUP��IRUP�FDQQRW�EH�VXEFODVVHG�D�VHFRQG�WLPH��7U\LQJ�WR�DVVLJQ�D�QHZ�KDQGOH�WR�DQ�LQVWDQFH�RI�WKH�1DWLYH:LQGRZ�FODVV�WKDW�KDV�D�KDQGOH�DVVLJQHG�WR�LW�LV�VLPLODU�WR�WKH�SUREOHP�LQ�9%���RI�VXEFODVVLQJ�D�IRUP�WZLFH��7R�VXEFODVV�D�IRUP�PRUH�WKDQ�RQFH��\RX�PXVW�NHHS�WUDFN�RI�DOO�WKH�SRLQWHUV�WR�WKH�SUHYLRXV�ZLQGRZ�SURFHGXUHV��8QIRUWXQDWHO\��WKH��1(7�IUDPHZRUN�KLGHV�WKH�ZLQGRZ�SURFHGXUH�SRLQWHUV�TXLWH�ZHOO��ZKLFK�PDNHV�LW�GLIILFXOW�DW�EHVW�WR�NHHS�WUDFN�RI�WKH�SUHYLRXV�ZLQGRZ�SURFHGXUH�SRLQWHUV��7KH��1(7�IUDPHZRUN�SUHYHQWV�VXEFODVVLQJ�WKH�IRUP�PRUH�WKDQ�RQFH�E\�WKURZLQJ�D�6\VWHP�([FHSWLRQ�HUURU��LQGLFDWLQJ�WKDW�WKH�FDOO�WR�$VVLJQ+DQGOH�IDLOHG���:KLOH�WKH�:LQ)RUP�LV�VXEFODVVHG��DOO�PHVVDJHV�VHQW�WR�LW�DUH�URXWHG�ILUVW�WKURXJK�WKH�0\6XE&ODVV�REMHFWV�:QG3URF��$IWHU�WKLV�IXQFWLRQ�LV�ILQLVKHG�SURFHVVLQJ�WKH�PHVVDJH��LW�SDVVHV�WKH�PHVVDJH�RQ�WR�WKH�IRUPV�ZLQGRZ�SURFHGXUH�WKURXJK�WKH�XVH�RI�WKH�0\%DVH�NH\ZRUG���

Page 519: Visual Basic - Subclassing and Hooking with VB & VB NET

:KHQ�WKH�XVHU�FOLFNV�WKH�8Q6XEFODVV�EXWWRQ��WKH�%XWWRQ�B&OLFN�HYHQW�LV�ILUHG��7KLV�HYHQW�VLPSO\�FDOOV�WKH�0\6XEFODVV�FODVVV�5HOHDVH+DQGOH�PHWKRG��ZKLFK�UHOHDVHV�WKH�KDQGOH�DVVLJQHG�WR�WKH�0\6XEFODVV�LQVWDQFH�DQG�UHVHWV�LW�EDFN�WR�]HUR���

�������7HFKQLTXH�����7KH�,0HVVDJH)LOWHU�,QWHUIDFH�

$�WKLUG�WHFKQLTXH�WR�VXEFODVV�D�:LQ)RUP�XVHV�WKH�,0HVVDJH)LOWHU�LQWHUIDFH��7KLV�WHFKQLTXH�ZLOO�QRW�DFWXDOO\�FUHDWH�D�VXEFODVV�ZLQGRZ�SURFHGXUH�WKDW�LV�SODFHG�EHIRUH�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��,QVWHDG��LW�DGGV�D�IXQFWLRQ�WR�WKH�PHVVDJH�ORRS��ZKLFK�LQWHUFHSWV�HDFK�PHVVDJH�EHIRUH�LW�LV�GLVSDWFKHG�WR�LWV�GHVWLQDWLRQ�ZLQGRZ�SURFHGXUH��$�VXEFODVV�ZLQGRZ�SURFHGXUH�ZRXOG�LQWHUFHSW�WKH�PHVVDJH�DIWHU�LW�KDV�EHHQ�GLVSDWFKHG�WR�LWV�GHVWLQDWLRQ�ZLQGRZ��EXW�EHIRUH�WKDW�ZLQGRZV�RULJLQDO�ZLQGRZ�SURFHGXUH�KDV�D�FKDQFH�WR�SURFHVV�WKH�PHVVDJH��7KHUHIRUH��E\�XVLQJ�WKLV�WHFKQLTXH��ZH�FDQ�LQWHUFHSW�DOO�PHVVDJHV�VHQW�WR�DOO�ZLQGRZV�WKDW�H[LVW�ZLWKLQ�D�VLQJOH�WKUHDG��7KLV�FDQ�EH�D�SRZHUIXO�WHFKQLTXH��EXW�EH�DZDUH�WKDW�\RX�ZLOO�EH�LQWHUFHSWLQJ�IDU�PRUH�PHVVDJHV�WKDQ�D�VLQJOH�VXEFODVV�ZLQGRZ�SURFHGXUH�ZRXOG��7KLV�FDQ�GHJUDGH�V\VWHP�DQG�DSSOLFDWLRQ�SHUIRUPDQFH�GUDVWLFDOO\��7R�RIIVHW�WKH�SHUIRUPDQFH�KLW�\RX�DUH�WDNLQJ�E\�XVLQJ�WKLV�WHFKQLTXH��\RX�VKRXOG�GR�DV�OLWWOH�ZRUN�DV�SRVVLEOH�LQ�WKH�IXQFWLRQ�WKDW�ZLOO�EH�LQVHUWHG�LQWR�WKH�PHVVDJH�ORRS��DV�ZHOO�DV�H[LW�WKLV�IXQFWLRQ�DV�VRRQ�DV�SRVVLEOH���7KLV�WHFKQLTXH�LV�VLPLODU�LQ�VWUXFWXUH�WR�7HFKQLTXH�����,Q�WKLV�WHFKQLTXH��D�QHZ�FODVV�LV�FUHDWHG�WKDW�LPSOHPHQWV�WKH�,0HVVDJH)LOWHU�LQWHUIDFH��7KLV�FODVV�PXVW�FRQWDLQ�D�PHWKRG�FDOOHG�3UH)LOWHU0HVVDJH��ZKLFK�LV�VLPLODU�WR�D�VXEFODVV�ZLQGRZ�SURFHGXUH��7KLV�LV�WKH�PHWKRG�WKDW�ZLOO�EH�SODFHG�LQVLGH�WKH�PHVVDJH�ORRS�RI�WKH�WKUHDG�LQ�ZKLFK�WKLV�ZLQGRZ�UHVLGHV��7KH�GHFODUDWLRQ�RI�WKH�3UH)LOWHU0HVVDJH�PHWKRG�LV�VLPLODU�WR�WKDW�RI�WKH�:QG3URF�PHWKRG�DQG�LV�DV�IROORZV���>9%@�3XEOLF�)XQFWLRQ�3UH)LOWHU0HVVDJH��%\9DO�P�$V�0HVVDJH��$V�%RROHDQ�B�������������,PSOHPHQWV�6\VWHP�:LQ)RUPV�,0HVVDJH)LOWHU�3UH)LOWHU0HVVDJH�7KH�RQH�GLIIHUHQFH�EHWZHHQ�WKLV�PHWKRG�DQG�WKH�:QG3URF�PHWKRG�LV�WKDW�WKLV�PHWKRG�UHWXUQV�D�%RROHDQ�YDOXH��,I�WKLV�PHWKRG�UHWXUQV�D�)DOVH��WKH�PHVVDJH�LV�VHQW�RQ�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH��+RZHYHU��LI�LW�UHWXUQV�D�7UXH��WKH�PHVVDJH�LV�GLVFDUGHG�DQG�QHYHU�VHQW�RQ�WR�WKH�RULJLQDO�ZLQGRZ�SURFHGXUH���7R�LQWHUFHSW�PHVVDJHV�EHIRUH�WKH\�DUH�GLVSDWFKHG�WR�D�:LQ)RUP�DQG�LWV�FRQWUROV��\RX�PXVW�LQVWDQWLDWH�DQ�LQVWDQFH�RI�WKH�FODVV�WKDW�LPSOHPHQWV�WKH�,0HVVDJH)LOWHU�LQWHUIDFH��7KH�IROORZLQJ�FRGH�IUDJPHQW�GRHV�WKLV���3ULYDWH�0\0VJ)LOWHU�$V�1HZ�7HVW0HVVDJH)LOWHU����1RZ�WKDW�ZH�KDYH�DQ�LQVWDQFH�RI�WKH�0\0VJ)LOWHU�FODVV��ZH�FDQ�SDVV�LW�LQWR�WKH�$GG0HVVDJH)LOWHU�PHWKRG�RI�WKH�$SSOLFDWLRQ�FODVV�WR�VXEFODVV�WKH�:LQ)RUP��7KH�$GG0HVVDJH)LOWHU�PHWKRG�LV�GHFODUHG�DV�IROORZV���3XEOLF�6KDUHG�6XE�$GG0HVVDJH)LOWHU�%\9DO�YDOXH�$6�,0HVVDJH)LOWHU��

Page 520: Visual Basic - Subclassing and Hooking with VB & VB NET

7KLV�PHWKRG�LV�GHFODUHG�DV�VWDWLF��ZKLFK�LQ�9%�1(7�LV�D�6KDUHG�PHWKRG��7KLV�PHWKRG�DOVR�WDNHV�D�SDUDPHWHU�RI�W\SH�,0HVVDJH)LOWHU��7KH�FRGH�WR�FDOO�WKH�$GG0HVVDJH)LOWHU�PHWKRG�LV�DV�IROORZV���$SSOLFDWLRQ�$GG0HVVDJH)LOWHU�0\0VJ)LOWHU���7KHUH�LV�D�FRPSOHPHQWDU\�PHWKRG�WR�$GG0HVVDJH)LOWHU��FDOOHG�5HPRYH0HVVDJH)LOWHU��7KLV�PHWKRG�LV�GHFODUHG�DV�IROORZV���3XEOLF�6KDUHG�6XE�5HPRYH0HVVDJH)LOWHU�%\9DO�YDOXH�$V�,0HVVDJH)LOWHU��7KLV�PHWKRG�DOVR�WDNHV�SDUDPHWHU�RI�W\SH�,0HVVDJH)LOWHU��7R�UHPRYH�RXU�SURFHGXUH�IURP�WKH�PHVVDJH�ORRS��ZH�VLPSO\�FDOO�5HPRYH0HVVDJH)LOWHU�DV�IROORZV���$SSOLFDWLRQ�5HPRYH0HVVDJH)LOWHU�0\0VJ)LOWHU���

���������7KH�DSSOLFDWLRQ�

7KH�DSSOLFDWLRQ�IRU�WKLV�WHFKQLTXH�LV�VLPSOH��7KH�RQO\�FRQWURO�RQ�WKH�IRUP�LV�D�WH[W�ER[��DV�)LJXUH������VKRZV��7DEOH������OLVWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�WKH�WH[W�ER[�FRQWURO���

7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��2EMHFW� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�

)RUP� &DSWLRQ� �&��6XEFODVVLQJ�([DPSOH��)RUP� +HLJKW� ����)RUP� :LGWK� ����7H[W%R[� 0XOWLOLQH� 7UXH�7H[W%R[� 6FUROOEDUV� 7UXH�7H[W%R[� :RUG:UDS� )DOVH�7H[W%R[� 7RS� ��7H[W%R[� /HIW� ��7H[W%R[� +HLJKW� ����7H[W%R[� :LGWK� ����7KH�3UH)LOWHU0HVVDJH�PHWKRG�ZDWFKHV�IRU�WKH�OHIW�PRXVH�EXWWRQ�WR�EH�SUHVVHG�ZKLOH�WKH�PRXVH�LV�RYHU�WKH�FOLHQW�DUHD�RI�WKH�IRUP���$V�ZH�PHQWLRQHG�HDUOLHU��WKLV�PHWKRG�FDQQRW�VHH�PHVVDJHV�WKDW�DUH�VHQW�WR�QRQFOLHQW�DUHDV�RI�WKH�IRUP���:KHQ�WKH�XVHU�FOLFNV�WKH�ULJKW�PRXVH�EXWWRQ�RYHU�WKH�FOLHQW�DUHD�RI�WKH�IRUP�RU�WKH�WH[W�ER[��D�PHVVDJH�LV�SODFHG�LQ�WKH�WH[W�ER[�LQGLFDWLQJ�WKDW�WKH�ULJKW�PRXVH�EXWWRQ�ZDV�FOLFNHG���

)LJXUH�������7KH�&��DSSOLFDWLRQ�XVLQJ�WKH�WKLUG�WHFKQLTXH�RI�VXEFODVVLQJ�

Page 521: Visual Basic - Subclassing and Hooking with VB & VB NET

7KLV�DSSOLFDWLRQ�LV�YHU\�VLPLODU�WR�WKH�RQH�FUHDWHG�LQ�WKH�6HFWLRQ��������VHFWLRQ��:KHQ�WKH�XVHU�FOLFNV�WKH�ULJKW�PRXVH�EXWWRQ�RYHU�WKH�:LQ)RUPV�FOLHQW�DUHD��D�PHVVDJH�LV�ZULWWHQ�WR�WKH�WH[W�ER[�LQGLFDWLQJ�WKDW�WKH�ULJKW�PRXVH�EXWWRQ�ZDV�FOLFNHG��7KH�GLIIHUHQFH�EHWZHHQ�WKLV�H[DPSOH�DQG�([DPSOH������LV�WKDW�ZKHQ�\RX�FOLFN�WKH�ULJKW�PRXVH�EXWWRQ�LQ�WKH�WH[W�ER[�FRQWURO��WKH�3UH)LOWHU0HVVDJH�PHWKRG�ZLOO�LQWHUFHSW�WKDW�PHVVDJH�DV�ZHOO��7KHUHIRUH��XVLQJ�WKH�3UH)LOWHU0HVVDJH�WHFKQLTXH�RI�VXEFODVVLQJ�DOORZV�XV�WR�LQWHUFHSW�PHVVDJHV�IRU�QRW�RQO\�DOO�:LQ)RUPV�ZLWKLQ�D�WKUHDG��EXW�DOVR�DOO�FRQWUROV�RQ�HDFK�:LQ)RUP��2Q�WKH�RWKHU�KDQG��RYHUULGLQJ�WKH�:QG3URF�PHWKRG�RI�D�SDUWLFXODU�:LQ)RUP�RQO\�DOORZV�XV�WR�LQWHUFHSW�PHVVDJHV�GLUHFWHG�WR�WKDW�:LQ)RUP���

���������7KH��9%�ILOH�

([DPSOH������SUHVHQWV�WKH�9%�FRGH�IRU�WKLV�WHFKQLTXH��7KH�FRGH�DGGHG�WR�VXEFODVV�WKH�:LQ)RUP�DSSHDUV�LQ�EROGIDFH���

([DPSOH�������7KH�)RUP��YE�)LOH�8VLQJ�6XEFODVVLQJ�7HFKQLTXH�����

,PSRUWV�6\VWHP�,PSRUWV�6\VWHP�&RPSRQHQW0RGHO�,PSRUWV�6\VWHP�'UDZLQJ�,PSRUWV�6\VWHP�:LQ)RUPV��3XEOLF�&ODVV�)RUP������,QKHULWV�6\VWHP�:LQ)RUPV�)RUP����������3ULYDWH�P\0VJ)LOWHU�$V�1HZ�7HVW0HVVDJH)LOWHU��������������3XEOLF�6XE�1HZ�������������0\%DVH�1HZ�������������)RUP�� �0H���������,QLWLDOL]H&RPSRQHQW����������������������P\0VJ)LOWHU�6HW5HI7R7H[W%R[�0H�������������������68%&/$66,1*�7(&+1,48(������������6\VWHP�:LQ)RUPV�$SSOLFDWLRQ�$GG0HVVDJH)LOWHU�P\0VJ)LOWHU��

Page 522: Visual Basic - Subclassing and Hooking with VB & VB NET

����(QG�6XE����������3XEOLF�6XE�:ULWH7R7H[W%R[�%\9DO�0HVVDJH�$V�6WULQJ����������7H[W%R[��7H[W�� �0HVVDJH���FKU�������FKU���������(QG�6XE����������)RUP�RYHUULGHV�GLVSRVH�WR�FOHDQ�XS�WKH�FRPSRQHQW�OLVW������3XEOLF�2YHUULGHV�6XE�'LVSRVH�������������0\%DVH�'LVSRVH�������������FRPSRQHQWV�'LVSRVH���������(QG�6XE�������5HJLRQ���:LQGRZV�)RUP�'HVLJQHU�JHQHUDWHG�FRGH������������5HTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����3ULYDWH�FRPSRQHQWV�$V�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU�����3ULYDWH�:LWK(YHQWV�7H[W%R[��$V�6\VWHP�:LQ)RUPV�7H[W%R[����������'LP�:LWK(YHQWV�)RUP��$V�6\VWHP�:LQ)RUPV�)RUP����������127(��7KH�IROORZLQJ�SURFHGXUH�LV�UHTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����,W�FDQ�EH�PRGLILHG�XVLQJ�WKH�:LQGRZV�)RUP�'HVLJQHU��������'R�QRW�PRGLI\�LW�XVLQJ�WKH�FRGH�HGLWRU������3ULYDWH�6XE�,QLWLDOL]H&RPSRQHQW�������������0H�FRPSRQHQWV� �1HZ�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU�������������0H�7H[W%R[�� �1HZ�6\VWHP�:LQ)RUPV�7H[W%R[����������������������#GHVLJQ�0H�7UD\+HLJKW� �����������#GHVLJQ�0H�7UD\/DUJH,FRQ� �)DOVH���������#GHVLJQ�0H�7UD\$XWR$UUDQJH� �7UXH���������7H[W%R[��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW���������������7H[W%R[��0XOWLOLQH� �7UXH���������7H[W%R[��6FUROO%DUV� �6\VWHP�:LQ)RUPV�6FUROO%DUV�%RWK���������7H[W%R[��:RUG:UDS� �)DOVH���������7H[W%R[��7DE,QGH[� �����������7H[W%R[��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H�������������������0H�7H[W� ��9%�1(7�6XEFODVVLQJ�([DPSOH����������0H�$XWR6FDOH%DVH6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������0H�&OLHQW6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H��������������������

Page 523: Visual Basic - Subclassing and Hooking with VB & VB NET

��������0H�&RQWUROV�$GG�7H[W%R[�������(QG�6XE��(QG�5HJLRQ�(QG�&ODVV��68%&/$66,1*�7(&+1,48(�����&217,18('��3XEOLF�&ODVV�7HVW0HVVDJH)LOWHU�����,PSOHPHQWV�6\VWHP�:LQ)RUPV�,0HVVDJH)LOWHU����������'LP�PB0DLQ:LQGRZ�$V�)RUP�����������3XEOLF�6XE�6HW5HI7R7H[W%R[�%\9DO�0DLQ:LQGRZ�$V�)RUP�����������PB0DLQ:LQGRZ� �0DLQ:LQGRZ�����(QG�6XE����������3XEOLF�&RQVW�:0B5%87721'2:1� �+�������������)XQFWLRQ�3UH)LOWHU0HVVDJH�%\5HI�P�$V�6\VWHP�:LQ)RUPV�0HVVDJH��$V�%RROHDQ�B�������,PSOHPHQWV�6\VWHP�:LQ)RUPV�,0HVVDJH)LOWHU�3UH)LOWHU0HVVDJH���������,I�P�PVJ� �:0B5%87721'2:1�7KHQ�������������PB0DLQ:LQGRZ�:ULWH7R7H[W%R[��3UH)LOWHU0HVVDJH��5%87721'2:1�����������(QG�,I������������������3UH)LOWHU0HVVDJH� �)DOVH�����(QG�)XQFWLRQ�(QG�&ODVV�7KH�0\0VJ)LOWHU�YDULDEOH�LV�GHFODUHG�DV�D�SULYDWH�ILHOG�WR�WKH�)RUP��:LQ)RUP��7KLV�YDULDEOH�LV�RI�W\SH�7HVW0HVVDJH)LOWHU��D�FODVV�GHFODUHG�DW�WKH�ERWWRP�RI�WKH�FRGH�H[DPSOH��,Q�WKH�FRQVWUXFWRU�RI�)RUP���D�QHZ�LQVWDQFH�RI�0\0VJ)LOWHU�LV�FUHDWHG�DQG�D�0H�SRLQWHU�LV�VHQW�WR�LWV�FRQVWUXFWRU��0\0VJ)LOWHU�VWRUHV�WKH�0H�SRLQWHU�DV�D�UHIHUHQFH�EDFN�WR�WKH�)RUP��:LQ)RUP�VR�WKDW�LW�FDQ�ZULWH�WH[W�LQWR�WKH�WH[W�ER[�WKDW�UHVLGHV�RQ�)RUP����$IWHU�WKH�0\0VJ)LOWHU�LQVWDQFH�LV�FUHDWHG�LQ�WKH�FRQVWUXFWRU��WKH�VKDUHG�$SSOLFDWLRQ�$GG0HVVDJH)LOWHU�PHWKRG�LV�FDOOHG�WR�SODFH�WKH�0\0VJ)LOWHU�3UH)LOWHU0HVVDJH�PHWKRG�LQ�WKH�PHVVDJH�ORRS��ULJKW�EHIRUH�WKH�PHVVDJH�LV�GLVSDWFKHG���7KH�3UH)LOWHU0HVVDJH�PHWKRG�LQ�WKH�7HVW0HVVDJH)LOWHU�FODVV�FRQWDLQV�FRGH�WKDW�ZDWFKHV�IRU�WKH�:0B5%87721'2:1�PHVVDJH�LQ�WKH�PHVVDJH�ORRS��:KHQ�LW�ILQGV�WKLV�PHVVDJH��LW�GLVSOD\V�D�PHVVDJH�LQ�WKH�WH[W�ER[�RQ�)RUP��ZLWK�WKH�IROORZLQJ�WH[W���3UH)LOWHU0HVVDJH��5%87721'2:1���7KH�UHWXUQ�YDOXH�RI�WKLV�PHWKRG�LV�)DOVH��DOORZLQJ�WKH�PHVVDJH�ORRS�WR�GLVSDWFK�WKH�PHVVDJH��,I�WKH�UHWXUQ�YDOXH�ZHUH�VHW�WR�7UXH��WKH�PHVVDJH�ZRXOG�QRW�EH�GLVSDWFKHG���

Page 524: Visual Basic - Subclassing and Hooking with VB & VB NET

�����6XEFODVVLQJ�D�&RQWURO�

/LNH�:LQ)RUP�VXEFODVVLQJ��FRQWURO�VXEFODVVLQJ�LV�PXFK�HDVLHU�LQ�9%�1(7��,Q�IDFW��WR�VXEFODVV�D�FRQWURO��ZH�FDQ�WDNH�WKH�H[DPSOH�DSSOLFDWLRQ�SUHVHQWHG�LQ�WKH�6HFWLRQ��������VHFWLRQ�DQG�FKDQJH�RQH�OLQH�RI�FRGH��7R�VXEFODVV�D�FRQWURO��DOO�\RX�KDYH�WR�GR�LV�DVVLJQ�LWV�+DQGOH�SURSHUW\�YDOXH�WR�D�FODVV�WKDW�LQKHULWV�IURP�WKH�1DWLYH:LQGRZ�FODVV��7KLV�VXEFODVV�ZLOO�FRQWDLQ�DQ�RYHUULGGHQ�LPSOHPHQWDWLRQ�RI�WKH�:QG3URF�PHWKRG��ZKLFK�FRQWDLQV�WKH�DFWXDO�VXEFODVVLQJ�FRGH���

�������7KH�DSSOLFDWLRQ�

7KH�DSSOLFDWLRQ�SUHVHQWHG�LQ�WKLV�VHFWLRQ�LV�H[DFWO\�WKH�VDPH�DV�WKH�RQH�SUHVHQWHG�LQ�WKH�6HFWLRQ��������VHFWLRQ��7KH�RQO\�GLIIHUHQFHV�DUH�WKDW�WKH�ZLQGRZ�FDSWLRQ�KDV�FKDQJHG�WR��9%�1(7�&RQWURO�6XEFODVVLQJ�([DPSOH���DQG�RQH�OLQH�RI�FRGH�DOVR�KDV�FKDQJHG��,�ZLOO�GLVFXVV�WKH�FRGH�PRGLILFDWLRQ�VKRUWO\��)LJXUH������SUHVHQWV�D�VFUHHQVKRW�RI�WKLV�DSSOLFDWLRQ���

)LJXUH�������6XEFODVVLQJ�D�WH[W�ER[�FRQWURO�

���������7KH��9%�ILOH�

([DPSOH������SUHVHQWV�WKH�FRGH�IRU�WKLV�WHFKQLTXH��7KH�PRGLILHG�FRGH�DSSHDUV�LQ�EROGIDFH���

([DPSOH�������7KH�)RUP��YE�)LOH�8VLQJ�WKH�&RQWURO�6XEFODVVLQJ�7HFKQLTXH��

,PSRUWV�6\VWHP�&RPSRQHQW0RGHO�,PSRUWV�6\VWHP�'UDZLQJ�,PSRUWV�6\VWHP�:LQ)RUPV���3XEOLF�&ODVV�)RUP������,QKHULWV�6\VWHP�:LQ)RUPV�)RUP����������'LP�VF�$V�1HZ�0\6XE&ODVV�����

Page 525: Visual Basic - Subclassing and Hooking with VB & VB NET

���������3XEOLF�6XE�1HZ�������������0\%DVH�1HZ�������������)RUP�� �0H���������,QLWLDOL]H&RPSRQHQW����������������������VF�6HW5HI7R7H[W%R[�0H������(QG�6XE����������)RUP�RYHUULGHV�GLVSRVH�WR�FOHDQ�XS�WKH�FRPSRQHQW�OLVW������3XEOLF�2YHUULGHV�6XE�'LVSRVH�������������0\%DVH�'LVSRVH�������������FRPSRQHQWV�'LVSRVH���������(QG�6XE�������5HJLRQ���:LQGRZV�)RUP�'HVLJQHU�JHQHUDWHG�FRGH������������5HTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����3ULYDWH�FRPSRQHQWV�$V�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU����������3ULYDWH�:LWK(YHQWV�7H[W%R[��$V�6\VWHP�:LQ)RUPV�7H[W%R[�����3ULYDWH�:LWK(YHQWV�%XWWRQ��$V�6\VWHP�:LQ)RUPV�%XWWRQ�����3ULYDWH�:LWK(YHQWV�%XWWRQ��$V�6\VWHP�:LQ)RUPV�%XWWRQ����������'LP�:LWK(YHQWV�)RUP��$V�6\VWHP�:LQ)RUPV�)RUP����������127(��7KH�IROORZLQJ�SURFHGXUH�LV�UHTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����,W�FDQ�EH�PRGLILHG�XVLQJ�WKH�:LQGRZV�)RUP�'HVLJQHU��������'R�QRW�PRGLI\�LW�XVLQJ�WKH�FRGH�HGLWRU������3ULYDWH�6XE�,QLWLDOL]H&RPSRQHQW�������������0H�FRPSRQHQWV� �1HZ�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU�������������0H�%XWWRQ�� �1HZ�6\VWHP�:LQ)RUPV�%XWWRQ�������������0H�%XWWRQ�� �1HZ�6\VWHP�:LQ)RUPV�%XWWRQ�������������0H�7H[W%R[�� �1HZ�6\VWHP�:LQ)RUPV�7H[W%R[����������������������#GHVLJQ�0H�7UD\+HLJKW� �����������#GHVLJQ�0H�7UD\/DUJH,FRQ� �)DOVH���������#GHVLJQ�0H�7UD\$XWR$UUDQJH� �7UXH���������%XWWRQ��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW����������������%XWWRQ��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H���������

Page 526: Visual Basic - Subclassing and Hooking with VB & VB NET

��������%XWWRQ��7DE,QGH[� �����������%XWWRQ��7H[W� ��6XEFODVV�������������������%XWWRQ��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW����������������%XWWRQ��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H�����������������%XWWRQ��7DE,QGH[� �����������%XWWRQ��7H[W� ��8Q6XEFODVV�������������������7H[W%R[��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW�����������������7H[W%R[��0XOWLOLQH� �7UXH���������7H[W%R[��6FUROO%DUV� �6\VWHP�:LQ)RUPV�6FUROO%DUV�%RWK���������7H[W%R[��:RUG:UDS� �)DOVH���������7H[W%R[��7DE,QGH[� �����������7H[W%R[��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������������������0H�7H[W� ��9%�1(7�&RQWURO�6XEFODVVLQJ�([DPSOH����������0H�$XWR6FDOH%DVH6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������0H�&OLHQW6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������������������0H�&RQWUROV�$GG�7H[W%R[�����������0H�&RQWUROV�$GG�%XWWRQ�����������0H�&RQWUROV�$GG�%XWWRQ�������(QG�6XE��(QG�5HJLRQ�����������3URWHFWHG�6XE�%XWWRQ�B&OLFN�%\9DO�VHQGHU�$V�2EMHFW��%\9DO�H�$V�6\VWHP�(YHQW$UJV����������,I�VF�+DQGOH����� ���7KHQ�������������VF�$VVLJQ+DQGOH�7H[W%R[��+DQGOH����������(OVH�������������PVJER[��'RQW�WU\�WR�VXEFODVV�WKLV�FRQWURO�PRUH�WKDQ�RQFH�����������(QG�,I�����(QG�6XE����������3URWHFWHG�6XE�%XWWRQ�B&OLFN�%\9DO�VHQGHU�$V�2EMHFW��%\9DO�H�$V�6\VWHP�(YHQW$UJV����������VF�5HOHDVH+DQGOH���������(QG�6XE���������������3XEOLF�&ODVV�0\6XEFODVV�

Page 527: Visual Basic - Subclassing and Hooking with VB & VB NET

��������,QKHULWV�1DWLYH:LQGRZ������������������'LP�PB0DLQ:LQGRZ�$V�)RUP�������������������3XEOLF�6XE�6HW5HI7R7H[W%R[�%\9DO�0DLQ:LQGRZ�$V�)RUP���������������PB0DLQ:LQGRZ� �0DLQ:LQGRZ���������(QG�6XE������������������3URWHFWHG�2YHUULGHV�6XE�:QG3URF�%\5HI�P�$V�0HVVDJH��������������,I�P�PVJ� �PLFURVRIW�:LQ���,QWHURS�ZLQ�:0B5%87721'2:1�7KHQ�����������������PB0DLQ:LQGRZ�WH[WER[��7H[W� �PB0DLQ:LQGRZ�WH[WER[��7H[W��B��������������������7KH�ULJKW�PRXVH�EXWWRQ�ZDV�SUHVVHG��0HVVDJH,'� �����B�������������������P�PVJ�7R6WULQJ������FKU������FKU�����������������(QG�,I��������������������������0\%DVH�:QG3URF�P����������(QG�6XE������������������3URWHFWHG�2YHUULGHV�6XE�2Q+DQGOH&KDQJH�����������������PVJER[��&RQWURO�+DQGOH�KDV�FKDQJHG�����������(QG�6XE�����(QG�&ODVV�(QG�&ODVV�7KH�ILUVW�FRGH�PRGLILFDWLRQ�FKDQJHV�WKH�:LQ)RUP�FDSWLRQ��7KH�VHFRQG�PRGLILFDWLRQ��ZKLFK�LV�ZKDW�ZH�DUH�UHDOO\�LQWHUHVWHG�LQ��LV�WKH�IROORZLQJ�OLQH�RI�FRGH���VF�$VVLJQ+DQGOH�7H[W%R[��+DQGOH��%DVLFDOO\��WKLV�OLQH�XVHV�D�KDQGOH�WR�ELQG�WKH�7H[W%R[��FRQWURO�WR�WKH�LQVWDQFH�RI�WKH�0\6XEFODVV�FODVV��ZKLFK�LQKHULWV�IURP�WKH�1DWLYH:LQGRZ�FODVV��1RZ��ZKHQHYHU�D�PHVVDJH�LV�VHQW�WR�WKH�7H[W%R[��FRQWURO��WKH�RYHUULGGHQ�:QG3URF�PHWKRG�LQ�WKH�0\6XEFODVV�FODVV�LQVWDQFH�LQWHUFHSWV�LW��,Q�WKH�:QG3URF�PHWKRG��ZH�ZDWFK�IRU�WKH�:0B5%87721'2:1�PHVVDJH��:KHQHYHU�WKLV�PHVVDJH�LV�LQWHUFHSWHG��ZH�GLVSOD\�VRPH�WH[W�LQ�WKH�7H[W%R[��WH[W�ER[�LQGLFDWLQJ�WKDW�WKLV�DFWLRQ�KDV�RFFXUUHG���

�����6XSHUFODVVLQJ�

6XSHUFODVVLQJ�ZDV�LQWURGXFHG�LQ�&KDSWHU����%DVLFDOO\��VXSHUFODVVLQJ�LQYROYHV�FUHDWLQJ�D�QHZ�EDVH�FODVV����RU�VXSHUFODVV����WKDW�ZH�WKHQ�XVH�WR�FUHDWH�RQH�RU�PRUH�QHZ�VXSHUFODVVHG�

Page 528: Visual Basic - Subclassing and Hooking with VB & VB NET

ZLQGRZV��(DFK�VXSHUFODVVHG�ZLQGRZ�UHWDLQV�WKH�EDVH�FODVVV�SURSHUWLHV�DQG�ZLQGRZ�SURFHGXUH��7KLV�DOORZV�XV�WR�HDVLO\�FUHDWH�PDQ\�ZLQGRZV�WKDW�ORRN�DQG�RSHUDWH�VLPLODUO\���'XH�WR�WKH�REMHFW�RULHQWHG�QDWXUH�RI�:LQ)RUPV��ZH�FDQ�HDVLO\�SHUIRUP�VXSHUFODVVLQJ�XVLQJ�9%�1(7�RU��IRU�WKDW�PDWWHU��DQ\�RWKHU��1(7�ODQJXDJH��7KH�ILUVW�VWHS�LV�WR�FUHDWH�D�ZLQGRZ�WKDW�ZLOO�DFW�DV�RXU�VXSHUFODVV��DV�([DPSOH������VKRZV��:H�ZLOO�XVH�WKLV�VXSHUFODVV�ZLQGRZ�WR�LQKHULW�IURP�DQG�FUHDWH�RXU�RZQ�ZLQGRZ��DV�([DPSOH������VKRZV��,W�LV�MXVW�WKDW�VLPSOH����PRUH�VR�WKDQ�LPSOHPHQWLQJ�VXSHUFODVVLQJ�LQ�D�SUHYLRXV�YHUVLRQ�RI�9%���

�������7KH�DSSOLFDWLRQ�

7KH�DSSOLFDWLRQ�WKDW�ZH�ZLOO�EXLOG�WR�LPSOHPHQW�VXSHUFODVVLQJ�FRQWDLQV�WZR�:LQ)RUPV��7KH�ILUVW�:LQ)RUP��FDOOHG�)RUP���LV�WKH�EDVH��RU�VXSHUFODVV��:LQ)RUP��7KH�VHFRQG�:LQ)RUP��FDOOHG�6XSHUFODVVB([��LQKHULWV�IURP�)RUP����7KH�FRGH�IRU�)RUP��LV�WDNHQ�IURP�WKH�DSSOLFDWLRQ�LQ�([DPSOH�������7R�WKLV�FRGH�,�KDYH�DGGHG�D�EXWWRQ�WKDW�KDV�WKH�FDSWLRQ��&UHDWH�:QG���:H�ZLOO�XVH�WKLV�EXWWRQ�WR�FUHDWH�QHZ�ZLQGRZV�IURP�WKH�6XSHUFODVVB([�:LQ)RUP���7DEOH������OLVWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�VXSHUFODVV�IRUP�DQG�LWV�FRQWUROV��7DEOH������OLVWV�WKH�QRQGHIDXOW�SURSHUWLHV�IRU�WKH�6XSHUFODVVB([�:LQ)RUP��7KLV�IRUP�GRHV�QRW�FRQWDLQ�DQ\�FRQWUROV��DOO�FRQWUROV�DUH�LQKHULWHG�IURP�)RUP����

7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP��:LQ)IRUP�DQG�,WV�&RQWUROV��2EMHFW� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�

)RUP� &DSWLRQ� �9%�1(7�6XEFODVVLQJ�([DPSOH��)RUP� +HLJKW� ����)RUP� :LGWK� ����7H[W%R[� 0XOWLOLQH� 7UXH�7H[W%R[� 6FUROOEDUV� 7UXH�7H[W%R[� :RUG:UDS� )DOVH�7H[W%R[� 7RS� ���7H[W%R[� /HIW� ���7H[W%R[� +HLJKW� ����7H[W%R[� :LGWK� ����%XWWRQ�� &DSWLRQ� �6XE&ODVV��%XWWRQ�� 7RS� ���%XWWRQ�� /HIW� ��%XWWRQ�� +HLJKW� ���%XWWRQ�� :LGWK� ���

Page 529: Visual Basic - Subclassing and Hooking with VB & VB NET

%XWWRQ�� &DSWLRQ� �8Q6XE&ODVV��%XWWRQ�� 7RS� ���%XWWRQ�� /HIW� ��%XWWRQ�� +HLJKW� ���%XWWRQ�� :LGWK� ���%XWWRQ�� &DSWLRQ� �&UHDWH�:QG��%XWWRQ�� 7RS� ����%XWWRQ�� /HIW� ��%XWWRQ�� +HLJKW� ���%XWWRQ�� :LGWK� ���

7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�6XSHUFODVVB([�:LQ)IRUP�DQG�,WV�&RQWUROV��,WHP� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�

)RUP� &DSWLRQ� �6XSHUFODVVB([��)RUP� &RORU� �%LVTXH��7R�XVH�WKLV�DSSOLFDWLRQ��VLPSO\�FOLFN�WKH�&UHDWH�:QG�EXWWRQ�VHYHUDO�WLPHV��7KLV�DFWLRQ�ZLOO�FDXVH�RQH�6XSHUFODVVB([�IRUP�WR�EH�FUHDWHG�DQG�GLVSOD\HG�IRU�HDFK�EXWWRQ�FOLFN��)LJXUH������VKRZV�WKH�DSSOLFDWLRQ�ZLWK�WKUHH�6XSHUFODVVB([�ZLQGRZV���

)LJXUH�������7KH�VXSHUFODVVLQJ�H[DPSOH�DSSOLFDWLRQ�

1RWLFH�WKDW�HDFK�6XSHUFODVVB([�:LQ)RUP�WDNHV�RQ�WKH�FKDUDFWHULVWLFV�RI�LWV�VXSHUFODVV�:LQ)RUP��)RUP���,Q�WKH�6XSHUFODVVB([�:LQ)RUP��WKH�EDFNJURXQG�FRORU�KDV�EHHQ�RYHUULGGHQ�WR�GLVSOD\�DV�%LVTXH��7KH�6XEFODVV�DQG�8Q6XEFODVV�EXWWRQV�ZRUN�LQGHSHQGHQWO\�RI�HDFK�RWKHU��7KDW�LV��\RX�FDQ�FOLFN�WKH�6XEFODVV�EXWWRQ�RI�RQH�:LQ)RUP�DQG�RQO\�WKDW�:LQ)RUP�LV�VXEFODVVHG��$OO�RWKHU�:LQ)RUPV�UHPDLQ�LQ�WKHLU�SUHYLRXV�VWDWH��$OVR��LI�\RX�FORVH�WKH�)RUP��

Page 530: Visual Basic - Subclassing and Hooking with VB & VB NET

:LQ)RUP��ZKLFK�LV�WKH�VXSHUFODVV�:LQ)RUP��DOO�RWKHU�IRUPV�WKDW�LQKHULW�IURP�WKDW�IRUP�DOVR�ZLOO�EH�FORVHG���

���������7KH��9%�ILOH�

([DPSOH������SUHVHQWV�WKH�FRGH�IRU�WKLV�WHFKQLTXH��7KH�FRGH�DGGHG�WR�VXEFODVV�WKH�:LQ)RUP�DSSHDUV�LQ�EROGIDFH��7KLV�FRGH�VKRXOG�EH�IDPLOLDU�WR�\RX�IURP�WKH�FRGH�LQ�6HFWLRQ���������$�&OLFN�HYHQW�KDV�EHHQ�DGGHG�IRU�WKH�%XWWRQ��FRQWURO��ZKLFK�LV�WKH�EXWWRQ�ODEHOHG��&UHDWH�:QG���7KLV�FRGH�VLPSO\�FUHDWHV�D�QHZ�LQVWDQFH�RI�WKH�6XSHUFODVVB([�:LQ)RUP�DQG�FDOOV�LWV�6KRZ�PHWKRG�VR�WKDW�LW�ZLOO�GLVSOD\�LWVHOI���

([DPSOH�������7KH�)RUP��YE�)LOH�WKDW�$FWV�DV�WKH�6XSHUFODVV�:LQ)RUP��

LPSRUWV�6\VWHP�&RPSRQHQW0RGHO�,PSRUWV�6\VWHP�'UDZLQJ�,PSRUWV�6\VWHP�:LQ)RUPV���3XEOLF�&ODVV�)RUP������,QKHULWV�6\VWHP�:LQ)RUPV�)RUP����������'LP�VF�$V�0\6XE&ODVV����������3XEOLF�6XE�1HZ�������������0\%DVH�1HZ�������������)RUP�� �0H���������,QLWLDOL]H&RPSRQHQW����������������������VF� �1HZ�0\6XE&ODVV���������(QG�6XE����������)RUP�RYHUULGHV�GLVSRVH�WR�FOHDQ�XS�WKH�FRPSRQHQW�OLVW������3XEOLF�2YHUULGHV�6XE�'LVSRVH�������������0\%DVH�'LVSRVH�������������FRPSRQHQWV�'LVSRVH���������(QG�6XE�������5HJLRQ���:LQGRZV�)RUP�'HVLJQHU�JHQHUDWHG�FRGH������������5HTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�

Page 531: Visual Basic - Subclassing and Hooking with VB & VB NET

����3ULYDWH�FRPSRQHQWV�$V�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU���������3ULYDWH�:LWK(YHQWV�%XWWRQ��$V�6\VWHP�:LQ)RUPV�%XWWRQ����������3ULYDWH�:LWK(YHQWV�7H[W%R[��$V�6\VWHP�:LQ)RUPV�7H[W%R[�����3ULYDWH�:LWK(YHQWV�%XWWRQ��$V�6\VWHP�:LQ)RUPV�%XWWRQ�����3ULYDWH�:LWK(YHQWV�%XWWRQ��$V�6\VWHP�:LQ)RUPV�%XWWRQ����������'LP�:LWK(YHQWV�)RUP��$V�6\VWHP�:LQ)RUPV�)RUP����������127(��7KH�IROORZLQJ�SURFHGXUH�LV�UHTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����,W�FDQ�EH�PRGLILHG�XVLQJ�WKH�:LQGRZV�)RUP�'HVLJQHU��������'R�QRW�PRGLI\�LW�XVLQJ�WKH�FRGH�HGLWRU������3ULYDWH�6XE�,QLWLDOL]H&RPSRQHQW������������������0H�FRPSRQHQWV� �1HZ�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU�������������0H�%XWWRQ�� �1HZ�6\VWHP�:LQ)RUPV�%XWWRQ�������������0H�%XWWRQ�� �1HZ�6\VWHP�:LQ)RUPV�%XWWRQ�������������0H�%XWWRQ�� �1HZ�6\VWHP�:LQ)RUPV�%XWWRQ�������������0H�7H[W%R[�� �1HZ�6\VWHP�:LQ)RUPV�7H[W%R[������������������#GHVLJQ�0H�7UD\+HLJKW� ���������������#GHVLJQ�0H�7UD\/DUJH,FRQ� �)DOVH�������������#GHVLJQ�0H�7UD\$XWR$UUDQJH� �7UXH�������������%XWWRQ��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW��������������������%XWWRQ��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H���������������������%XWWRQ��7DE,QGH[� ���������������%XWWRQ��7H[W� ��6XEFODVV�������������������%XWWRQ��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW��������������������%XWWRQ��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H���������������������%XWWRQ��7DE,QGH[� ���������������%XWWRQ��7H[W� ��8Q6XEFODVV�������������������%XWWRQ��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW���������������������%XWWRQ��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H���������������������%XWWRQ��7DE,QGH[� ���������������%XWWRQ��7H[W� ��&UHDWH�:QG�������������������7H[W%R[��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW���������������������7H[W%R[��0XOWLOLQH� �7UXH�������������7H[W%R[��6FUROO%DUV� �6\VWHP�:LQ)RUPV�6FUROO%DUV�%RWK�

Page 532: Visual Basic - Subclassing and Hooking with VB & VB NET

������������7H[W%R[��:RUG:UDS� �)DOVH�������������7H[W%R[��7DE,QGH[� ���������������7H[W%R[��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H�����������������������0H�7H[W� ��9%�1(7�6XEFODVVLQJ�([DPSOH��������������0H�$XWR6FDOH%DVH6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H��������������������0H�&OLHQW6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������������������0H�&RQWUROV�$GG�%XWWRQ���������������0H�&RQWUROV�$GG�7H[W%R[���������������0H�&RQWUROV�$GG�%XWWRQ���������������0H�&RQWUROV�$GG�%XWWRQ�����������(QG�6XE��(QG�5HJLRQ����������3URWHFWHG�6XE�%XWWRQ�B&OLFN�%\9DO�VHQGHU�$V�2EMHFW��%\9DO�H�$V�6\VWHP�(YHQW$UJV����������'LP�[�$V�1HZ�6XSHUFODVVB([�������������[�6KRZ���������(QG�6XE���������������68%&/$66�7(&+1,48(��������3URWHFWHG�6XE�%XWWRQ�B&OLFN�%\9DO�VHQGHU�$V�2EMHFW��%\9DO�H�$V�6\VWHP�(YHQW$UJV����������,I�VF�+DQGOH����� ���7KHQ�������������VF�$VVLJQ+DQGOH�0H�+DQGOH����������(OVH�������������PVJER[��'RQW�WU\�WR�VXEFODVV�WKLV�ZLQGRZ�PRUH�WKDQ�RQFH�����������(QG�,I�����(QG�6XE����������3URWHFWHG�6XE�%XWWRQ�B&OLFN�%\9DO�VHQGHU�$V�2EMHFW��%\9DO�H�$V�6\VWHP�(YHQW$UJV����������VF�5HOHDVH+DQGOH���������(QG�6XE���������������3XEOLF�&ODVV�0\6XEFODVV���������,QKHULWV�1DWLYH:LQGRZ������������������3URWHFWHG�2YHUULGHV�6XE�:QG3URF�%\5HI�P�$V�0HVVDJH��������������,I�P�PVJ� �PLFURVRIW�:LQ���,QWHURS�ZLQ�:0B5%87721'2:1�7KHQ�����������������PVJER[�P�PVJ�7R6WULQJ������

Page 533: Visual Basic - Subclassing and Hooking with VB & VB NET

������������(QG�,I��������������������������0\%DVH�:QG3URF�P����������(QG�6XE������������������3URWHFWHG�2YHUULGHV�6XE�2Q+DQGOH&KDQJH�����������������PVJER[��+DQGOH�KDV�FKDQJHG�����������(QG�6XE�����(QG�&ODVV�(QG�&ODVV�([DPSOH������SUHVHQWV�WKH�FRGH�IRU�WKH�6XEFODVVB([�:LQ)RUP��7KLV�FRGH�LV�PXFK�VKRUWHU�WKDQ�WKH�ILUVW��VLPSO\�EHFDXVH�WKH�6XEFODVVB([�:LQ)RUP�LQKHULWV�PRVW�RI�LWV�IXQFWLRQDOLW\�IURP�WKH�)RUP��:LQ)RUP�FODVV��7KH�KLJKOLJKWHG�OLQH�RI�FRGH�RYHUULGHV�WKH�RULJLQDO�EDFNJURXQG�FRORU�RI�WKH�)RUP��:LQ)RUP��7KLV�DOORZV�XV�WR�PRUH�HDVLO\�GLVWLQJXLVK�WKH�VXSHUFODVV�DQG�VXEFODVV�ZLQGRZV�RQ�WKH�VFUHHQ���

([DPSOH�������7KH�6XSHUFODVVB([�YE�)LOH�8VLQJ�WKH�6XSHUFODVVLQJ�7HFKQLTXH��

,PSRUWV�6\VWHP�'UDZLQJ�,PSRUWV�6\VWHP�:LQ)RUPV�,PSRUWV�6\VWHP�&RPSRQHQW0RGHO���3XEOLF�&ODVV�6XSHUFODVVB([�����,QKHULWV�)RUP�������3XEOLF�6XE�1HZ�������������0\%DVH�1HZ���������6XSHUFODVVB([� �0H���������,QLWLDOL]H&RPSRQHQW��������������72'2��$GG�DQ\�LQLWLDOL]DWLRQ�DIWHU�WKH�,QLWLDOL]H&RPSRQHQW�����FDOO���������0H�%DFN&RORU� �6\VWHP�'UDZLQJ�&RORU�%LVTXH���������(QG�6XE������)RUP�RYHUULGHV�GLVSRVH�WR�FOHDQ�XS�WKH�FRPSRQHQW�OLVW������2YHUULGHV�3XEOLF�6XE�'LVSRVH�������������0\%DVH�'LVSRVH���������FRPSRQHQWV�'LVSRVH�����(QG�6XE��

Page 534: Visual Basic - Subclassing and Hooking with VB & VB NET

��5HJLRQ���:LQGRZV�)RUP�'HVLJQHU�JHQHUDWHG�FRGH�������3ULYDWH�FRPSRQHQWV�$V�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU������'LP�:LWK(YHQWV�6XSHUFODVVB([�$V�6\VWHP�:LQ)RUPV�)RUP������3ULYDWH�6XE�,QLWLDOL]H&RPSRQHQW�������������FRPSRQHQWV� �1HZ�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU���������0H�7H[W� ��6XSHUFODVVB([������(QG�6XE��(QG�5HJLRQ��(QG�&ODVV�7KH�PDLQ�WKLQJ�WR�QRWLFH�LQ�WKLV�FRGH�H[DPSOH�LV�WKDW�6XSHUFODVVB([�LQKHULWV�IURP�)RUP���7KLV�LV�ZKDW�DOORZV�XV�WR�SHUIRUP�VXSHUFODVVLQJ�VR�HDVLO\���

�����6XSHUFODVVLQJ�D�&RQWURO�

6XSHUFODVVLQJ�D�FRQWURO�LV�VLPLODU�WR�VXSHUFODVVLQJ�D�:LQ)RUP��)LUVW��\RX�ZULWH�D�QHZ�FODVV�WKDW�LQKHULWV�IURP�WKH�FRQWURO�WKDW�\RX�ZDQW�WR�VXSHUFODVV��IRU�WKH�IROORZLQJ�H[DPSOH��LW�ZLOO�EH�D�EXWWRQ�FRQWURO��1H[W��\RX�RYHUULGH�WKH�:QG3URF�IRU�WKH�FRQWURO�DQG�DGG�\RXU�RZQ�IXQFWLRQDOLW\���

�������7KH�DSSOLFDWLRQ�

7KLV�H[DPSOH�DSSOLFDWLRQ�FRQWDLQV�D�WH[W�ER[�DQG�D�VXSHUFODVVHG�EXWWRQ�FRQWURO�RQ�WKH�:LQ)RUP��7DEOH������OLVWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV��)LJXUH������SUHVHQWV�D�VFUHHQVKRW�RI�WKH�DSSOLFDWLRQ��:KHQ�\RX�ULJKW�FOLFN�WKH�VXSHUFODVVHG�EXWWRQ��D�PHVVDJH�ER[�LV�GLVSOD\HG�LQGLFDWLQJ�WKDW�WKH�EXWWRQ�ZDV��LQ�IDFW��ULJKW�FOLFNHG���

7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP�DQG�,WV�&RQWUROV��2EMHFW� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�

)RUP� &DSWLRQ� �9%�1(7�&RQWURO�6XSHUFODVVLQJ�([DPSOH��)RUP� +HLJKW� ����)RUP� :LGWK� ����6&%XWWRQ� &DSWLRQ� �6&��6&%XWWRQ� 7RS� ����6&%XWWRQ� /HIW� ��

Page 535: Visual Basic - Subclassing and Hooking with VB & VB NET

6&%XWWRQ� +HLJKW� ���6&%XWWRQ� :LGWK� ���

)LJXUH�������7KH�DSSOLFDWLRQ�FRQWDLQLQJ�WKH�VXSHUFODVVHG�EXWWRQ�FRQWURO�

���������7KH��9%�ILOH�

([DPSOH������SUHVHQWV�WKH�FRGH�IRU�WKLV�WHFKQLTXH��7KH�LPSRUWDQW�PRGLILFDWLRQV�WR�WKH�FRGH�DUH�LQ�EROGIDFH���

([DPSOH�������7KH�)RUP��YE�)LOH�IRU�6XSHUFODVVLQJ�D�%XWWRQ�&RQWURO��

,PSRUWV�6\VWHP�&RPSRQHQW0RGHO�,PSRUWV�6\VWHP�'UDZLQJ�,PSRUWV�6\VWHP�:LQ)RUPV���3XEOLF�&ODVV�)RUP������,QKHULWV�6\VWHP�:LQ)RUPV�)RUP����������3XEOLF�6XE�1HZ�������������0\%DVH�1HZ�������������)RUP�� �0H���������,QLWLDOL]H&RPSRQHQW���������(QG�6XE����������)RUP�RYHUULGHV�GLVSRVH�WR�FOHDQ�XS�WKH�FRPSRQHQW�OLVW������3XEOLF�2YHUULGHV�6XE�'LVSRVH�������������0\%DVH�'LVSRVH�������������FRPSRQHQWV�'LVSRVH���������(QG�6XE������

Page 536: Visual Basic - Subclassing and Hooking with VB & VB NET

�5HJLRQ���:LQGRZV�)RUP�'HVLJQHU�JHQHUDWHG�FRGH������������5HTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����3ULYDWH�FRPSRQHQWV�$V�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU����������3ULYDWH�:LWK(YHQWV�VF%XWWRQ�$V�6XE&%XWWRQ����������'LP�:LWK(YHQWV�)RUP��$V�6\VWHP�:LQ)RUPV�)RUP����������127(��7KH�IROORZLQJ�SURFHGXUH�LV�UHTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����,W�FDQ�EH�PRGLILHG�XVLQJ�WKH�:LQGRZV�)RUP�'HVLJQHU��������'R�QRW�PRGLI\�LW�XVLQJ�WKH�FRGH�HGLWRU������3ULYDWH�6XE�,QLWLDOL]H&RPSRQHQW�������������0H�FRPSRQHQWV� �1HZ�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU�������������0H�VF%XWWRQ� �1HZ�6XSHU%XWWRQ����������������������#GHVLJQ�0H�7UD\+HLJKW� �����������#GHVLJQ�0H�7UD\/DUJH,FRQ� �)DOVH���������#GHVLJQ�0H�7UD\$XWR$UUDQJH� �7UXH���������VF%XWWRQ�/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW�����������������VF%XWWRQ�6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H�����������������VF%XWWRQ�7H[W� ��6&�������������������0H�7H[W� ��9%�1(7�&RQWURO�6XSHUFODVVLQJ�([DPSOH����������0H�$XWR6FDOH%DVH6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������0H�&OLHQW6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������������������0H�&RQWUROV�$GG�VF%XWWRQ������(QG�6XE��(QG�5HJLRQ�(QG�&ODVV��3XEOLF�&ODVV�6XSHU%XWWRQ�����,QKHULWV�6\VWHP�:LQ)RUPV�%XWWRQ����������3URWHFWHG�2YHUULGHV�6XE�:QG3URF�%\5HI�P�$V�0HVVDJH����������,I�P�PVJ� �PLFURVRIW�:LQ���,QWHURS�ZLQ�:0B5%87721'2:1�7KHQ�������������0HVVDJH%R[�6KRZ��7KH�ULJKW�PRXVH�EXWWRQ�ZDV�SUHVVHG��0HVVDJH,'� ����B������������������������������P�PVJ�7R6WULQJ��������������(QG�,I�

Page 537: Visual Basic - Subclassing and Hooking with VB & VB NET

�����������������0\%DVH�:QG3URF�P������(QG�6XE�(QG�&ODVV�$�QHZ�FODVV�LV�FUHDWHG��FDOOHG�6XSHU%XWWRQ��ZKLFK�FRQWDLQV�WKH�RYHUULGGHQ�:QG3URF�PHWKRG��,W�LV�LQ�WKLV�:QG3URF�PHWKRG�WKDW�ZH�SODFH�RXU�VXSHUFODVVLQJ�FRGH��7KLV�FRGH�VLPSO\�ZDWFKHV�IRU�WKH�:0B5%87721'2:1�PHVVDJH�DQG�WKHQ�GLVSOD\V�D�PHVVDJH�ER[�LQGLFDWLQJ�WKDW�WKLV�PHVVDJH�ZDV�LQWHUFHSWHG���7R�LQVWDQWLDWH�DQG�XVH�WKLV�VXSHUFODVVHG�EXWWRQ�FRQWURO��ZH�PXVW�DGG�VRPH�H[WUD�FRGH�WR�WKH�FRGH�EORFN�EHWZHHQ�WKH��5HJLRQ����(QG�5HJLRQ�SUHSURFHVVRU�GLUHFWLYHV��)LUVW�ZH�DGG�WKH�IROORZLQJ�FRGH�WR�KRRN�XS�WKH�HYHQWV�IRU�WKLV�FRQWURO���3ULYDWH�:LWK(YHQWV�VF%XWWRQ�$V�6XE&%XWWRQ�1H[W��ZH�LQVWDQWLDWH�WKH�EXWWRQ�FRQWURO�DQG�VHW�LWV�SURSHUWLHV�LQ�WKH�,QLWLDOL]H&RPSRQHQW�PHWKRG���0H�VF%XWWRQ� �1HZ�6XSHU%XWWRQ������VF%XWWRQ�/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW���������VF%XWWRQ�6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H���������VF%XWWRQ�7H[W� ��6&��7KH�/RFDWLRQ�SURSHUW\�VHWV�WKH�7RS�DQG�/HIW�FRRUGLQDWHV��DQG�WKH�6L]H�SURSHUW\�VHWV�WKH�+HLJKW�DQG�:LGWK�YDOXHV��7KH�7H[W�SURSHUW\�VHWV�WKH�EXWWRQV�FDSWLRQ���)LQDOO\��ZH�DGG�WKH�FRQWURO�WR�WKH�:LQ)RUPV�FRQWURO�DUUD\�WKURXJK�WKH�IROORZLQJ�OLQH�RI�FRGH���0H�&RQWUROV�$GG�VF%XWWRQ��7KDW�LV�DOO�WKHUH�LV�WR�LW���

�����,QWHUFHSWLQJ�.H\VWURNHV�LQ�D�:LQ)RUP�

,�ZDQW�WR�FRYHU�RQH�ILQDO�PHWKRG�RI�LQWHUFHSWLQJ�PHVVDJHV�LQ�D�:LQ)RUP��7KHUH�DUH�QLQH�EXLOW�LQ�PHWKRGV�LQ�WKH�&RQWURO�FODVV�WKDW�\RX�FDQ�RYHUULGH�WR�FDSWXUH�NH\VWURNH�PHVVDJHV��,I�\RX�QHHG�WR�FDSWXUH�RQO\�NH\ERDUG�PHVVDJHV��XVLQJ�RQH�RU�PRUH�RI�WKHVH�PHWKRGV�ZLOO�DOORZ�\RX�WR�LQWHUFHSW�WKH�PHVVDJHV�ZLWKRXW�KDYLQJ�WR�VXEFODVV�WKH�:LQ)RUP���7KH�PHVVDJHV�WKDW�\RX�FDQ�LQWHUFHSW�DUH���:0B&+$5

:0B.(<'2:1

:0B.(<83

:0B6<6.(<'2:1

:0B6<6.(<83

7KH�QLQH�PHWKRGV�WKDW�\RX�FDQ�RYHUULGH�DUH���

Page 538: Visual Basic - Subclassing and Hooking with VB & VB NET

ProcessKeyPreview

$�FKLOG�FRQWURO�FDOOV�WKLV�PHWKRG�EHIRUH�SURFHVVLQJ�D�NH\ERDUG�PHVVDJH��,I�WKH�FKLOG�FRQWURO�GRHV�QRW�SURFHVV�WKH�PHVVDJH��LW�LV�VHQW�RQ�WR�WKH�SDUHQW�FRQWURO��,I�QR�SDUHQW�FRQWURO�H[LVWV��WKLV�PHWKRG�UHWXUQV�7UXH��LQGLFDWLQJ�WKDW�WKLV�PHVVDJH�LV�QRW�WR�EH�SURFHVVHG�DQ\�ORQJHU���

PreProcessMessage

7KLV�PHWKRG�LV�FDOOHG�IURP�WKH�WKUHDGV�PHVVDJH�ORRS��EHIRUH�WKH�PHVVDJH�LV�GLVSDWFKHG��7KH�SURFHVVLQJ�WKDW�WKLV�PHWKRG�SHUIRUPV�GHSHQGV�RQ�WKH�PHVVDJH�UHFHLYHG���

WM_KEYDOWN and WM_SYSKEYDOWN

3URFHVV&PG.H\�LV�ILUVW�FDOOHG�WR�GHWHUPLQH�LI�WKH�NH\ERDUG�PHVVDJH�LV�DQ�DFFHOHUDWRU�RU�PHQX�VKRUWFXW��,I�3URFHVV&PG.H\�UHWXUQV�)DOVH��,V,QSXW.H\�LV�FDOOHG�WR�GHWHUPLQH�LI�WKH�NH\ERDUG�PHVVDJH�LV�EHLQJ�VHQW�DV�LQSXW�WR�WKH�FRQWURO��VXFK�DV�FKDUDFWHUV�EHLQJ�W\SHG�LQWR�D�WH[W�ER[�FRQWURO��)LQDOO\��LI�,V,QSXW.H\�UHWXUQV�)DOVH��WKH�NH\ERDUG�PHVVDJH�LV�VHQW�WR�3URFHVV'LDORJ.H\��3URFHVV'LDORJ.H\�GHWHUPLQHV�LI�WKH�NH\�LV�D�GLDORJ�W\SH�NH\�VXFK�DV�D�7$%��DQ�DUURZ��RU�PQHPRQLFV���

WM_CHAR

,V,QSXW&KDU�LV�ILUVW�FDOOHG�WR�GHWHUPLQH�LI�WKH�NH\ERDUG�PHVVDJH�LV�EHLQJ�VHQW�DV�LQSXW�WR�WKH�FRQWURO��VXFK�DV�FKDUDFWHUV�EHLQJ�W\SHG�LQWR�D�WH[W�ER[�FRQWURO��,I�,V,QSXW&KDU�UHWXUQV�)DOVH��3URFHVV'LDORJ&KDU�LV�FDOOHG��3URFHVV'LDORJ&KDU�SURFHVVHV�GLDORJ�FKDUDFWHUV��VXFK�DV�D�7$%��DQ�DUURZ��RU�PQHPRQLFV���

WM_SYSCHAR

3URFHVV'LDORJ&KDU�LV�FDOOHG�WR�GHWHUPLQH�LI�WKH�NH\�LV�D�GLDORJ�W\SH�NH\�VXFK�DV�D�7$%��DQ�DUURZ��RU�PQHPRQLFV���

WM_KEYUP and WM_SYSKEYUP

1R�SURFHVVLQJ�LV�SHUIRUPHG�RQ�WKHVH�PHVVDJHV��,I�WKLV�PHWKRG�UHWXUQV�7UXH��WKH�NH\ERDUG�PHVVDJH�LV�QRW�GLVSDWFKHG��RWKHUZLVH��LW�LV�GLVSDWFKHG���IsInputChar

'HWHUPLQHV�LI�WKH�NH\ERDUG�PHVVDJH�LV�RQH�WKDW�WKH�FRQWURO�LV�ORRNLQJ�IRU��VXFK�DV�D�PQHPRQLF��,I�WKLV�PHWKRG�UHWXUQV�7UXH��WKH�PHVVDJH�LV�VHQW�GLUHFWO\�WR�WKH�FRQWURO��RWKHUZLVH��LW�LV�GLVSDWFKHG�WR�WKH�GHVWLQDWLRQ�ZLQGRZ�SURFHGXUH���

IsInputKey

'HWHUPLQHV�ZKHWKHU�WKH�NH\ERDUG�PHVVDJH�VKRXOG�EH�SUHSURFHVVHG�RU�VHQW�GLUHFWO\�WR�WKH�FRQWURO��7KLV�PHWKRG�ORRNV�IRU�WKH�7$%��DUURZ��(6&��DQG�5(7851�NH\V��,I�WKLV�PHWKRG�UHWXUQV�7UXH��WKH�PHVVDJH�LV�VHQW�GLUHFWO\�WR�WKH�FRQWURO��RWKHUZLVH��LW�LV�GLVSDWFKHG�WR�WKH�GHVWLQDWLRQ�ZLQGRZ�SURFHGXUH���

ProcessCmdKey

$OORZV�SURFHVVLQJ�RI�FRPPDQG�NH\V�VXFK�DV�DFFHOHUDWRUV�DQG�PHQX�VKRUWFXWV��,I�WKLV�PHWKRG�UHWXUQV�7UXH��WKH�PHVVDJH�LV�GLVFDUGHG��RWKHUZLVH��WKH�PHVVDJH�FRQWLQXHV�WR�EH�SUHSURFHVVHG���

ProcessDialogChar

Page 539: Visual Basic - Subclassing and Hooking with VB & VB NET

3URFHVVHV�GLDORJ�ER[�FKDUDFWHUV�VXFK�DV�PQHPRQLFV��,I�WKLV�PHWKRG�UHWXUQV�7UXH��WKH�PHVVDJH�LV�GLVFDUGHG��RWKHUZLVH��WKH�PHVVDJH�FRQWLQXHV�WR�EH�SUHSURFHVVHG���

ProcessDialogKey

3URFHVVHV�GLDORJ�ER[�NH\V��VXFK�DV�WKH�7$%��DUURZ��(6&��DQG�5(7851�NH\V��,I�WKLV�PHWKRG�UHWXUQV�7UXH��WKH�PHVVDJH�LV�GLVFDUGHG��RWKHUZLVH��WKH�PHVVDJH�FRQWLQXHV�WR�EH�SUHSURFHVVHG���

ProcessKeyEventArgs

3URFHVVHV�PHVVDJHV�VHQW�WR�FRQWUROV��7KLV�PHWKRG�FDOOV�WKH�FRQWUROV�2Q.H\'RZQ��2Q.H\3UHVV��DQG�2Q.H\8S�HYHQWV��,Q�DGGLWLRQ�WR�WKH�SUHYLRXVO\�PHQWLRQHG�NH\ERDUG�PHVVDJHV��WKLV�PHWKRG�DOVR�SURFHVVHV�WKH�:0B,0(&+$5�PHVVDJH��,I�WKLV�PHWKRG�UHWXUQV�7UXH��WKH�PHVVDJH�LV�GLVFDUGHG��RWKHUZLVH��WKH�PHVVDJH�FRQWLQXHV�WR�EH�SUHSURFHVVHG���

ProcessMnemonic

7KLV�PHWKRG�SURFHVVHV�D�PQHPRQLF�FKDUDFWHU�IRU�D�FRQWURO��,I�LW�ILQGV�D�PQHPRQLF��WKLV�PHWKRG�VKRXOG�SHUIRUP�WKH�DFWLRQ�IRU�WKH�PQHPRQLF�DQG�UHWXUQ�D�YDOXH�RI�7UXH��,I�WKLV�PHWKRG�UHWXUQV�7UXH��WKH�PHVVDJH�LV�GLVFDUGHG��RWKHUZLVH��WKH�PHVVDJH�FRQWLQXHV�WR�EH�SUHSURFHVVHG���

�������7KH�DSSOLFDWLRQ�

7KLV�DSSOLFDWLRQ�DOORZV�\RX�WR�ZDWFK�HDFK�RYHUULGGHQ�PHWKRG�DV�LW�LV�FDOOHG�ZKHQ�\RX�SUHVV�DQG�UHOHDVH�NH\V�LQGLYLGXDOO\�RU�LQ�FRPELQDWLRQ��(DFK�RYHUULGGHQ�PHWKRG�ZULWHV�D�EULHI�PHVVDJH�LQGLFDWLQJ�WKDW�LW�KDV�EHHQ�FDOOHG�WR�D�UHDG�RQO\�WH[W�ER[��ZKLFK�LV�SURYLGHG�WR�SUHYHQW�FRQIXVLQJ�RXWSXW�ZKHQ�WKH�XVHU�WULHV�WR�W\SH�D�FKDUDFWHU�LQWR�D�WH[W�ER[���7DEOH������OLVWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�VXSHUFODVV�IRUP�DQG�LWV�FRQWUROV��)LJXUH������SUHVHQWV�D�VFUHHQVKRW�RI�WKH�H[DPSOH�DSSOLFDWLRQ���

7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�)RUP��:LQ)IRUP�DQG�,WV�&RQWUROV��2EMHFW� 3URSHUW\�1DPH� 3URSHUW\�9DOXH�

)RUP� &DSWLRQ� �9%�1(7�3URFHVV�.H\V�([DPSOH��)RUP� +HLJKW� ����)RUP� :LGWK� ����7H[W%R[�� 0XOWLOLQH� 7UXH�7H[W%R[�� 6FUROOEDUV� 7UXH�7H[W%R[�� :RUG:UDS� )DOVH�7H[W%R[�� 7RS� ���7H[W%R[�� /HIW� ���7H[W%R[�� +HLJKW� ����7H[W%R[�� :LGWK� ����

Page 540: Visual Basic - Subclassing and Hooking with VB & VB NET

7H[W%R[�� 7RS� ���7H[W%R[�� /HIW� ��7H[W%R[�� +HLJKW� ���7H[W%R[�� :LGWK� ���%XWWRQ�� &DSWLRQ� �&OHDU��%XWWRQ�� 7RS� ���%XWWRQ�� /HIW� ��%XWWRQ�� +HLJKW� ���%XWWRQ�� :LGWK� ���

)LJXUH�������7KH�SURFHVV�NH\V�DSSOLFDWLRQ�

7KLV�H[DPSOH�DSSOLFDWLRQ�RYHUULGHV�HDFK�RI�WKH�QLQH�PHWKRGV�WKDW�LQWHUFHSW�NH\ERDUG�PHVVDJHV��:KHQHYHU�D�NH\�LV�SUHVVHG��HDFK�RYHUULGGHQ�PHWKRG�ZLOO�RXWSXW�VRPH�WH[W�WR�D�UHDG�RQO\�WH[W�ER[����WKH�WH[W�RXWSXW�GHSHQGV�RQ�WKH�PHWKRG�WKDW�ZDV�FDOOHG��7KH�&OHDU�EXWWRQ�LV�SURYLGHG�WR�DOORZ�\RX�WR�FOHDU�WKH�WH[W�ER[��$�VPDOOHU�WH[W�ER[�LV�SURYLGHG�WR�DOORZ�\RX�WR�HQWHU�FKDUDFWHUV�WR�VHH�KRZ�WKH�V\VWHP�SURFHVVHV�HDFK�FKDUDFWHU���,Q�WKH�VFUHHQVKRW�LQ�)LJXUH�������WKH��D��NH\�ZDV�SUHVVHG�ZKLOH�WKH�IRFXV�ZDV�LQ�WKH�VPDOO�WH[W�ER[��,I�ZH�SUHVV�WKH��D��NH\�ZKLOH�WKH�IRFXV�LV�RQ�WKH�&OHDU�EXWWRQ��ZH�JHW�WKH�IROORZLQJ�WH[W�RXWSXW�WR�WKH�WH[W�ER[���352&(66&0'.(<��PVJ� ����

352&(66',$/2*.(<��.H\'DWD� ���

.H\&RGH�������

352&(66.(<35(9,(:��PVJ� ����

352&(66',$/2*&+$5��&KDU&RGH� �D

352&(6601(021,&��&KDU&RGH� �D

352&(66.(<35(9,(:��PVJ� ����

352&(66.(<35(9,(:��PVJ� ����

7KH�3URFHVV'LDORJ&KDU�DQG�3URFHVV0QHPRQLF�PHWKRGV�ZHUH�FDOOHG��LQ�DGGLWLRQ�WR�WKH�PHWKRGV�WKDW�ZHUH�FDOOHG�ZKHQ�WKH�IRFXV�ZDV�RQ�WKH�WH[W�ER[��7KLV�LV�EHFDXVH�D�EXWWRQ�FRQWURO�FDQ�KDYH�D�PQHPRQLF�FKDUDFWHU�DQG�D�WH[W�ER[�FRQWURO�FDQQRW���

Page 541: Visual Basic - Subclassing and Hooking with VB & VB NET

���������7KH��9%�ILOH�

([DPSOH������SUHVHQWV�WKH�FRGH�IRU�WKLV�VDPSOH�DSSOLFDWLRQ��7KH�FRGH�IRU�WKH�RYHUULGGHQ�PHWKRGV�DSSHDUV�LQ�EROGIDFH���

([DPSOH�������7KH�)RUP��FV�)LOH�IRU�6XSHUFODVVLQJ�D�%XWWRQ�&RQWURO��

,PSRUWV�6\VWHP�&RPSRQHQW0RGHO�,PSRUWV�6\VWHP�'UDZLQJ�,PSRUWV�6\VWHP�:LQ)RUPV���3XEOLF�&ODVV�)RUP������,QKHULWV�6\VWHP�:LQ)RUPV�)RUP����������3XEOLF�6XE�1HZ�������������0\%DVH�1HZ�������������)RUP�� �0H���������,QLWLDOL]H&RPSRQHQW���������(QG�6XE����������)RUP�RYHUULGHV�GLVSRVH�WR�FOHDQ�XS�WKH�FRPSRQHQW�OLVW������3XEOLF�2YHUULGHV�6XE�'LVSRVH�������������0\%DVH�'LVSRVH�������������FRPSRQHQWV�'LVSRVH���������(QG�6XE�������5HJLRQ���:LQGRZV�)RUP�'HVLJQHU�JHQHUDWHG�FRGH������������5HTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����3ULYDWH�FRPSRQHQWV�$V�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU�����3ULYDWH�:LWK(YHQWV�7H[W%R[��$V�6\VWHP�:LQ)RUPV�7H[W%R[�����3ULYDWH�:LWK(YHQWV�%XWWRQ��$V�6\VWHP�:LQ)RUPV�%XWWRQ����������3ULYDWH�:LWK(YHQWV�7H[W%R[��$V�6\VWHP�:LQ)RUPV�7H[W%R[����������'LP�:LWK(YHQWV�)RUP��$V�6\VWHP�:LQ)RUPV�)RUP����������127(��7KH�IROORZLQJ�SURFHGXUH�LV�UHTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����,W�FDQ�EH�PRGLILHG�XVLQJ�WKH�:LQGRZV�)RUP�'HVLJQHU����

Page 542: Visual Basic - Subclassing and Hooking with VB & VB NET

����'R�QRW�PRGLI\�LW�XVLQJ�WKH�FRGH�HGLWRU������3ULYDWH�6XE�,QLWLDOL]H&RPSRQHQW�������������0H�FRPSRQHQWV� �1HZ�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU�������������0H�%XWWRQ�� �1HZ�6\VWHP�:LQ)RUPV�%XWWRQ�������������0H�7H[W%R[�� �1HZ�6\VWHP�:LQ)RUPV�7H[W%R[�������������0H�7H[W%R[�� �1HZ�6\VWHP�:LQ)RUPV�7H[W%R[����������������������#GHVLJQ�0H�7UD\+HLJKW� �����������#GHVLJQ�0H�7UD\/DUJH,FRQ� �)DOVH���������#GHVLJQ�0H�7UD\$XWR$UUDQJH� �7UXH���������%XWWRQ��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW����������������%XWWRQ��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H�����������������%XWWRQ��7DE,QGH[� �����������%XWWRQ��7DE6WRS� �)DOVH���������%XWWRQ��7H[W� ��&OHDU�������������������7H[W%R[��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW����������������7H[W%R[��7DE,QGH[� �����������7H[W%R[��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H��������������������������7H[W%R[��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW�����������������7H[W%R[��5HDG2QO\� �7UXH���������7H[W%R[��0XOWLOLQH� �7UXH���������7H[W%R[��6FUROO%DUV� �6\VWHP�:LQ)RUPV�6FUROO%DUV�%RWK���������7H[W%R[��:RUG:UDS� �)DOVH���������7H[W%R[��7DE,QGH[� �����������7H[W%R[��7DE6WRS� �)DOVH���������7H[W%R[��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������������������0H�7H[W� ��9%�1(7�6XEFODVVLQJ�([DPSOH����������0H�$XWR6FDOH%DVH6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������0H�&OLHQW6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������������������0H�&RQWUROV�$GG�7H[W%R[�����������0H�&RQWUROV�$GG�%XWWRQ�����������0H�&RQWUROV�$GG�7H[W%R[�������(QG�6XE����������3URWHFWHG�2YHUULGHV�)XQFWLRQ�3URFHVV.H\3UHYLHZ�%\5HI�P�$V�0HVVDJH��$V�%RROHDQ���������WH[WER[��7H[W� �WH[WER[��7H[W���352&(66.(<35(9,(:��PVJ� ����B�

Page 543: Visual Basic - Subclassing and Hooking with VB & VB NET

����������P�PVJ�7R6WULQJ������FKU������FKU�������������3URFHVV.H\3UHYLHZ� �0\%DVH�3URFHVV.H\3UHYLHZ�P������(QG�)XQFWLRQ����������3XEOLF�2YHUULGHV�)XQFWLRQ�3UH3URFHVV0HVVDJH�%\9DO�PVJ�$V�B������������0LFURVRIW�:LQ���,QWHURS�06*��$V�%RROHDQ�������$V�%RROHDQ���������WH[WER[��7H[W� �WH[WER[��7H[W���35(352&(660(66$*(��PVJ� ����B�����������PVJ�PHVVDJH�7R6WULQJ������FKU������FKU�������������3UH3URFHVV0HVVDJH� �0\%DVH�3UH3URFHVV0HVVDJH�PVJ������(QG�)XQFWLRQ����������3URWHFWHG�2YHUULGHV�)XQFWLRQ�,V,QSXW&KDU�%\9DO�&KDU&RGH�$V�&KDU��$V�%RROHDQ���������WH[WER[��7H[W� �WH[WER[��7H[W���,6,1387&+$5��&KDU&RGH� ����B�����������&KDU&RGH�7R6WULQJ������FKU������FKU�������������,V,QSXW&KDU� �0\%DVH�,V,QSXW&KDU�&KDU&RGH������(QG�)XQFWLRQ����������3URWHFWHG�2YHUULGHV�)XQFWLRQ�,V,QSXW.H\�%\9DO�.H\'DWD�$V�.H\V��$V�%RROHDQ���������WH[WER[��7H[W� �WH[WER[��7H[W���,6,1387.(<��.H\'DWD� ����B�����������.H\'DWD�7R6WULQJ������FKU������FKU�������������WH[WER[��7H[W� �WH[WER[��7H[W������.H\&RGH�����.H\'DWD�.H\&RGH�7R6WULQJ�����B��������������������������FKU������FKU�������������,V,QSXW.H\� �0\%DVH�,V,QSXW.H\�.H\GDWD������(QG�)XQFWLRQ����������3URWHFWHG�2YHUULGHV�)XQFWLRQ�3URFHVV&PG.H\�%\9DO�PVJ�$V�B���������������0LFURVRIW�:LQ���,QWHURS�06*��%\9DO�.H\'DWD�$V�.H\V��$V�%RROHDQ�������%\9DO�.H\'DWD�$V�.H\V��$V�%RROHDQ���������WH[WER[��7H[W� �WH[WER[��7H[W���352&(66&0'.(<��PVJ� ����B�����������PVJ�PHVVDJH�7R6WULQJ������FKU������FKU�������������3URFHVV&PG.H\� �0\%DVH�3URFHVV&PG.H\�PVJ��.H\'DWD������(QG�)XQFWLRQ����������3URWHFWHG�2YHUULGHV�)XQFWLRQ�3URFHVV'LDORJ&KDU�%\9DO�&KDU&RGH�$V�&KDU��$V�%RROHDQ���������WH[WER[��7H[W� �WH[WER[��7H[W���352&(66',$/2*&+$5��&KDU&RGH� ����B�����������&KDU&RGH�7R6WULQJ������FKU������FKU�������������3URFHVV'LDORJ&KDU� �0\%DVH�3URFHVV'LDORJ&KDU�&KDU&RGH������(QG�)XQFWLRQ������

Page 544: Visual Basic - Subclassing and Hooking with VB & VB NET

����3URWHFWHG�2YHUULGHV�)XQFWLRQ�3URFHVV'LDORJ.H\�%\9DO�.H\'DWD�$V�.H\V��$V�%RROHDQ���������WH[WER[��7H[W� �WH[WER[��7H[W���352&(66',$/2*.(<��.H\'DWD� ����B�����������.H\'DWD�7R6WULQJ������FKU������FKU�������������WH[WER[��7H[W� �WH[WER[��7H[W������.H\&RGH�����.H\'DWD�.H\&RGH�7R6WULQJ�����B��������������������������FKU������FKU�������������3URFHVV'LDORJ.H\� �0\%DVH�3URFHVV'LDORJ.H\�.H\'DWD������(QG�)XQFWLRQ����������3URWHFWHG�2YHUULGHV�)XQFWLRQ�3URFHVV.H\(YHQW$UJV�%\5HI�P�$V�0HVVDJH��$V�%RROHDQ���������WH[WER[��7H[W� �WH[WER[��7H[W���352&(66.(<(9(17$5*6��PVJ� ����B�����������P�PVJ�7R6WULQJ������FKU������FKU�������������3URFHVV.H\(YHQW$UJV� �0\%DVH�3URFHVV.H\(YHQW$UJV�P������(QG�)XQFWLRQ����������3URWHFWHG�2YHUULGHV�)XQFWLRQ�3URFHVV0QHPRQLF�%\9DO�&KDU&RGH�$V�&KDU��$V�%RROHDQ���������WH[WER[��7H[W� �WH[WER[��7H[W���352&(6601(021,&��&KDU&RGH� ����B�����������&KDU&RGH�7R6WULQJ������FKU������FKU�������������3URFHVV0QHPRQLF� �0\%DVH�3URFHVV0QHPRQLF�&KDU&RGH������(QG�)XQFWLRQ��(QG�5HJLRQ����������3URWHFWHG�6XE�%XWWRQ�B&OLFN�%\9DO�VHQGHU�$V�2EMHFW��%\9DO�H�$V�6\VWHP�(YHQW$UJV����������WH[WER[��7H[W� ��������(QG�6XE�(QG�&ODVV�1RWH�WKDW�WKH�RYHUULGGHQ�PHWKRGV�EDVH�FODVV�LV�FDOOHG�DW�WKH�HQG�RI�HDFK�RYHUULGGHQ�PHWKRG��7KHVH�RYHUULGGHQ�PHWKRGV�DOVR�UHWXUQ�WKH�YDOXH�WKDW�WKH�EDVH�FODVV�PHWKRG�UHWXUQV���

�����%HKLQG�WKH�6FHQHV�ZLWK�6S\���

7R�XQGHUVWDQG�PRUH�RI�ZKDW�LV�KDSSHQLQJ�ZKHQ�ZH�VXEFODVV�D�:LQ)RUP��ZH�ZLOO�XVH�WKH�6S\���XWLOLW\�WR�VHH�ZKDW�LV�KDSSHQLQJ�WR�RXU�DSSOLFDWLRQ�EHIRUH��GXULQJ��DQG�DIWHU�ZH�VXEFODVV�DQ�DSSOLFDWLRQ���7R�VWDUW��ZH�ZLOO�UXQ�WKH�H[DPSOH�DSSOLFDWLRQ�WKDW�ZH�FUHDWHG�LQ�6HFWLRQ���������$IWHU�VWDUWLQJ�6S\���DQG�ILQGLQJ�WKH�DSSOLFDWLRQ��ZH�LPPHGLDWHO\�QRWLFH�VHYHUDO�WKLQJV��DV�)LJXUH������LOOXVWUDWHV���

Page 545: Visual Basic - Subclassing and Hooking with VB & VB NET

)LJXUH�������8VLQJ�6S\���WR�H[DPLQH�RXU�9%�1(7�VXEFODVVLQJ�DSSOLFDWLRQ�FUHDWHG�XVLQJ�7HFKQLTXH����

7KH�ILUVW�WKLQJ�RI�LQWHUHVW�LV�WKDW�VL[�WKUHDGV�DUH�DXWRPDWLFDOO\�FUHDWHG�ZKHQ�D�9%�1(7�DSSOLFDWLRQ�VWDUWV��2XU�DSSOLFDWLRQ�FRGH�UXQV�LQ�WKUHDG����ZKLFK�KDV�D�KDQGOH�RI�+�)��LQ�)LJXUH�������8VLQJ�WKH�7KUHDGLQJ�FODVVHV�LQ�WKH��1(7�IUDPHZRUN��\RX�FDQ�FUHDWH�HYHQ�PRUH�WKUHDGV��7KH�H[DPSOHV�SUHVHQWHG�KHUH�GR�QRW�FUHDWH�PXOWLSOH�WKUHDGV��+RZHYHU��LI�\RX�FUHDWH�PRUH�WKUHDGV�XVLQJ�WKH�7KUHDGLQJ�FODVVHV��\RX�VKRXOG�EH�DZDUH�WKDW�WKH�VXEFODVVLQJ�WHFKQLTXHV�GHVFULEHG�LQ�WKLV�FKDSWHU�ZRUN�RQO\�ZLWKLQ�WKH�WKUHDG�WKDW�XVHV�WKHVH�WHFKQLTXHV���7KH�RWKHU�LWHP�RI�LQWHUHVW�LV�WKH�FODVV�QDPHV�RI�WKH�:LQ)RUP�DQG�LWV�FRQWUROV��*RQH�DUH�WKH�IDPLOLDU�7KXQGHU �FODVVHV��HYHQ�WKH�VWDQGDUG�ZLQGRZV�FODVVHV��VXFK�DV�%87721�DQG�(',7��DUH�JRQH��/DQJXDJHV�WKDW�UXQ�XQGHU�WKH��1(7�IUDPHZRUN��VXFK�DV�9%�1(7�DQG�&���XVH�FODVVHV�VXFK�DV�:LQ)RUPV���:LQGRZ���DSS���IRU�D�:LQ)RUP��:LQ)RUPV���%87721�DSS���IRU�EXWWRQ�FRQWUROV��DQG�:LQ)RUPV���(',7�DSS���IRU�HGLW�FRQWUROV��(DFK�:LQ)RUP�FRQWURO�LQ�WKH��1(7�IUDPHZRUN�KDV�D�QHZ�ZLQGRZ�FODVV�QDPH��$V�D�QRWH��WKHVH�FODVV�QDPHV�PLJKW�FKDQJH�DIWHU�%HWD�����,I�ZH�GRXEOH�FOLFN�RXU�DSSOLFDWLRQV�:LQ)RUP��WKH�:LQ)RUP�LWHP�KDV�D�KDQGOH�RI�+�����&���WKH�:LQGRZ�3URSHUWLHV�GLDORJ�ER[�LV�GLVSOD\HG��DV�)LJXUH������VKRZV��1RWH�WKDW�WKH�:LQGRZ�3URF�ILHOG�RQ�WKLV�GLDORJ�ER[�LV�VHW�WR�+�E�)�(��1RZ�FOLFN�WKH�&ODVV�WDE�DQG�ORRN�DW�WKH�:LQGRZ�3URF�ILHOG�YDOXH��ZKLFK�)LJXUH������VKRZV��7KLV�WDE�UHSRUWV�WKDW�WKH�FODVV�ZLQGRZ�SURFHGXUH�LV�VHW�WR�+�%�'((��ZKLFK�LV�QRW�WKH�VDPH�DV�WKH�:LQ)RUPV�ZLQGRZ�SURFHGXUH��7KLV�PHDQV�WKDW�WKH�V\VWHP�VXEFODVVHG�WKH�ZLQGRZ�DXWRPDWLFDOO\��,Q�IDFW��6HW:LQGRZ/RQJ:�LV�FDOOHG�ZKHQ�WKH�:LQ)RUP�LV�ILUVW�FUHDWHG�WR�VXEFODVV�LWV�RULJLQDO�ZLQGRZ�SURFHGXUH��:KHQ�WKH�:LQ)RUP�LV�FORVHG��WKH�V\VWHP�DXWRPDWLFDOO\�UHSODFHV�LWV�RULJLQDO�ZLQGRZ�SURFHGXUH��ZKLFK�DOORZV�WKH�:LQ)RUP�WR�VKXW�GRZQ�JUDFHIXOO\��7KLV�LV�D�ELJ�KHOS�IRU�XV�ZKHQ�ZH�DUH�VXEFODVVLQJ�D�:LQ)RUP��7KH�V\VWHP�VXEFODVVHV�WKH�:LQ)RUP��NHHSV�WUDFN�RI�LWV�RULJLQDO�ZLQGRZ�SURFHGXUH��DQG�WKHQ�UHSODFHV�LW�EHIRUH�LW�LV�FRPSOHWHO\�VKXW�GRZQ���

Page 546: Visual Basic - Subclassing and Hooking with VB & VB NET

)LJXUH�������7KH�&ODVV�WDE�SURSHUWLHV�IRU�RXU�9%�1(7�VXEFODVVLQJ�DSSOLFDWLRQ�FUHDWHG�XVLQJ�7HFKQLTXH����

:LQ)RUPV�DUH�QRW�WKH�RQO\�ZLQGRZV�WKDW�DUH�VXEFODVVHG�LQ�WKLV�PDQQHU��DOO��1(7�FRQWUROV����DW�OHDVW�WKH�RQHV�WKDW�,�KDYH�FKHFNHG�RXW����DUH�VXEFODVVHG�LQ�WKLV�PDQQHU��<RX�FDQ�FKHFN�WKLV�RXW�IRU�\RXUVHOI�E\�FRPSDULQJ�WKH�:LQGRZ�3URF�ILHOGV�RQ�WKH�*HQHUDO�DQG�&ODVV�WDEV�RI�WKH�:LQGRZ�3URSHUWLHV�GLDORJ�ER[��DV�ZH�GLG�LQ�)LJXUH������DQG�)LJXUH�������,I�WKH�YDOXHV�DUH�GLIIHUHQW��WKH�FRQWURO�KDV�EHHQ�VXEFODVVHG��RWKHUZLVH��LW�KDV�QRW��<RX�VKRXOG�QRWH�WKDW�LI�\RX�SODFH�DQ�XQPDQDJHG�$FWLYH;�FRQWURO�RQ�D�:LQ)RUP��LW�LV�QRW�DXWRPDWLFDOO\�VXEFODVVHG���&RQWLQXLQJ�RQ��ZH�ZLOO�H[DPLQH�WKH�DSSOLFDWLRQ�WKDW�ZH�FUHDWHG�LQ�6HFWLRQ��������LQ�WKH�VDPH�PDQQHU��$IWHU�VWDUWLQJ�WKH�DSSOLFDWLRQ�DQG�6S\����ZH�QRWLFH�WKDW�WKH�:LQ)RUP�DQG�LWV�FRQWUROV�KDYH�EHHQ�VXEFODVVHG�LQ�WKH�VDPH�PDQQHU�DV�ZH�VDZ�ZLWK�WKH�SUHYLRXV�DSSOLFDWLRQ��,I�\RX�QRWLFH�LQ�)LJXUH�������DQG�)LJXUH��������WKH�:LQGRZ�3URF�ILHOGV�RI�WKH�*HQHUDO�DQG�&ODVV�WDEV�DUH�GLIIHUHQW���

)LJXUH��������8VLQJ�6S\���WR�H[DPLQH�RXU�9%�1(7�VXEFODVVLQJ�DSSOLFDWLRQ�FUHDWHG�XVLQJ�7HFKQLTXH����

Page 547: Visual Basic - Subclassing and Hooking with VB & VB NET

)LJXUH��������7KH�&ODVV�WDE�SURSHUWLHV�IRU�RXU�9%�1(7�VXEFODVVLQJ�DSSOLFDWLRQ�FUHDWHG�XVLQJ�7HFKQLTXH����

7KLV�DSSOLFDWLRQ�XVHV�D�GLIIHUHQW�WHFKQLTXH�WR�VXEFODVV�D�:LQ)RUP�WKDQ�WKH�ILUVW�DSSOLFDWLRQ�GRHV��7KLV�DSSOLFDWLRQ�VXEFODVVHV�WKH�:LQ)RUP�RQO\�ZKHQ�ZH�FOLFN�WKH�6XEFODVV�EXWWRQ��,I�ZH�SURFHHG�WR�FOLFN�WKH�6XEFODVV�EXWWRQ��ZH�QRWLFH�WKDW�WKH�:LQGRZ�3URF�ILHOG�RQ�WKH�*HQHUDO�WDE�KDV�EHHQ�PRGLILHG��DV�)LJXUH�������VKRZV���

)LJXUH��������7KH�&ODVV�WDE�SURSHUWLHV�IRU�RXU�9%�1(7�VXEFODVVLQJ�DSSOLFDWLRQ�DIWHU�FOLFNLQJ�WKH�6XEFODVV�EXWWRQ�

1RZ�WKH�:LQ)RUP�LV�HIIHFWLYHO\�VXEFODVVHG�WZLFH��RQFH�E\�WKH�V\VWHP�DQG�RQFH�E\�RXU�FRGH�FDOOLQJ�WKH�$VVLJQ+DQGOH�PHWKRG�RQ�WKH�1DWLYH:LQGRZ�FODVV�LQ�RXU�SURMHFW��,I�\RX�UHPHPEHU��WKH�FRGH�LQ�WKH�6XEFODVV�EXWWRQ�&OLFN�HYHQW�ORRNV�OLNH�WKLV���3URWHFWHG�6XE�%XWWRQ�B&OLFN�%\9DO�VHQGHU�$V�2EMHFW��%\9DO�H�$V�6\VWHP�(YHQW$UJV������,I�VF�+DQGOH����� ���7KHQ���������VF�$VVLJQ+DQGOH�0H�+DQGOH������(OVH���������PVJER[��'RQW�WU\�WR�VXEFODVV�WKLV�ZLQGRZ�PRUH�WKDQ�RQFH�������(QG�,I�

Page 548: Visual Basic - Subclassing and Hooking with VB & VB NET

(QG�6XE�:KHQ�WKH�8Q6XEFODVV�EXWWRQ�LV�FOLFNHG��WKH�VXEFODVVLQJ�LV�UHPRYHG��,I�\RX�ORRN�EDFN�DW�WKH�:LQGRZ�3URF�ILHOG�RQ�WKH�*HQHUDO�WDE��\RX�ZLOO�QRWLFH�WKDW�LW�UHYHUWV�EDFN�WR�LWV�SUHYLRXV�YDOXH��7KH�FRGH�EHKLQG�WKH�&OLFN�HYHQW�RI�WKH�8Q6XEFODVV�EXWWRQ�ORRNV�OLNH�WKLV���3URWHFWHG�6XE�%XWWRQ�B&OLFN�%\9DO�VHQGHU�$V�2EMHFW��%\9DO�H�$V�6\VWHP�(YHQW$UJV������VF�5HOHDVH+DQGOH�����(QG�6XE�)URP�WKLV�LQIRUPDWLRQ��ZH�FDQ�SODLQO\�VHH�WKDW�WKH�V\VWHP�WDNHV�FDUH�RI�D�ORW�RI�WKH�GHWDLOV�RI�VXEFODVVLQJ�IRU�XV��7KLV�LV�ZK\�D�:LQ)RUP�ZLOO�QRW�FUDVK�ZKHQ�ZH�VKXW�LW�GRZQ�ZLWKRXW�UHPRYLQJ�WKH�VXEFODVV�SURFHGXUH��$V�ZH�ZLOO�VHH�LQ�&KDSWHU�����WKH�V\VWHP�GRHV�QRW�KHOS�XV�RXW�ZKHQ�LPSOHPHQWLQJ�KRRNV�DV�PXFK�DV�LW�GRHV�ZLWK�VXEFODVVLQJ�DQG�VXSHUFODVVLQJ���

Page 549: Visual Basic - Subclassing and Hooking with VB & VB NET

&KDSWHU�����,PSOHPHQWLQJ�+RRNV�LQ�9%�1(7�7KLV�FKDSWHU�FRYHUV�WKH�LPSOHPHQWDWLRQ�RI�:LQGRZV�KRRNV�ZLWKLQ�D�9%�1(7�DSSOLFDWLRQ��,W�LV�DVVXPHG�WKDW�\RX�KDYH�UHDG�DQG�XQGHUVWDQG�WKH�FRQFHSWV�ODLG�RXW�LQ�&KDSWHU���DQG�&KDSWHU����,W�DOVR�LV�DVVXPHG�WKDW�\RX�KDYH�D�ZRUNLQJ�NQRZOHGJH�RI�KRZ�WR�ZULWH�9%�1(7�FRGH���

�����+RRNV�DQG�9%�1(7�

8QOLNH�VXEFODVVLQJ�DQG�VXSHUFODVVLQJ��9%�1(7�GRHV�QRW�UHDGLO\�VXSSRUW�WKH�XVH�RI�WKH�VWDQGDUG�:LQGRZV�KRRNV�ZLWKLQ�WKH�ODQJXDJH���

�1RQH�RI�WKH��1(7�ODQJXDJHV�PDNH�DQ\�VSHFLDO�FRQFHVVLRQV�WR�HDVLO\�LPSOHPHQW�:LQGRZV�KRRNV��7R�LPSOHPHQW�KRRNV�ZLWKLQ�RWKHU��1(7�ODQJXDJHV��VXFK�DV�&���IROORZ�WKH�VDPH�VWHSV�DV�DUH�RXWOLQHG�LQ�WKLV�FKDSWHU����

$FWXDOO\��PRUH�FRGH�LV�LQYROYHG�ZLWK�LPSOHPHQWLQJ�KRRNV�LQ�9%�1(7�WKDQ�LQ�WKH�SUHYLRXV�YHUVLRQV�RI�9LVXDO�%DVLF��9%���7KLV�LV�EHFDXVH�ZH�PXVW�XVH�GHOHJDWHV�WR�LPSOHPHQW�WKH�ILOWHU�IXQFWLRQ�FDOOEDFN�PHFKDQLVP�WKDW�KRRNV�UHO\�RQ��,�GLVFXVV�GHOHJDWHV�LQ�PRUH�GHWDLO�LQ�WKH�QH[W�VHFWLRQ���7KH�H[DPSOH�DSSOLFDWLRQV�WKDW�ZH�ZLOO�FUHDWH�LQ�WKLV�FKDSWHU�ZLOO�LQVWDOO�WKUHDG�VSHFLILF�KRRNV��8QIRUWXQDWHO\��DV�ZLWK�9%���G\QDPLF�OLQN�OLEUDULHV��'//V���\RX�FDQQRW�XVH�9%�1(7�'//V�WR�LQVWDOO�V\VWHP�ZLGH�KRRNV��7R�LQVWDOO�D�V\VWHP�ZLGH�KRRN��\RX�PXVW�SODFH�WKH�FRGH�WR�LQVWDOO�DQG�UHPRYH�WKH�KRRN��DV�ZHOO�DV�WKH�ILOWHU�IXQFWLRQ�LWVHOI��ZLWKLQ�D�:LQ���'//��<RX�FDQ�ZULWH�WKLV�'//�XVLQJ�9LVXDO�&�����RU�9LVXDO�&���1(7��1RWH�WKDW�LI�\RX�DUH�XVLQJ�9LVXDO�&���1(7��\RX�PXVW�ZULWH�WKH�'//�DV�XQPDQDJHG�FRGH���$V�D�QRWH��WKH�IROORZLQJ�IXQFWLRQV�ZLOO�EH�UHPRYHG�DIWHU�%HWD�����Microsoft.Win32.Interop.Windows.SetWindowsHookEx Microsoft.Win32.Interop.Windows.UnhookWindowsHookEx Microsoft.Win32.Interop.Windows.CallNextHookEx

,QVWHDG�RI�XVLQJ�WKHVH�IXQFWLRQV��\RX�VKRXOG�XVH�WKH�QRUPDO�PHWKRG�RI�GHFODULQJ�DSSOLFDWLRQ�SURJUDPPLQJ�LQWHUIDFH��$3,��IXQFWLRQV�WKDW�\RX�KDYH�EHFRPH�DFFXVWRPHG�WR�LQ�9%����<RX�VKRXOG�XVH�WKH�IROORZLQJ�GHFODUDWLRQV���3XEOLF�'HFODUH�)XQFWLRQ�6HW:LQGRZV+RRN([�/LE��XVHU����$OLDV��6HW:LQGRZV+RRN([$��B���������%\9DO�+RRN,'�$V�,QWHJHU��%\9DO�OSIQ�$V�+RRN&DOOEDFN��B��������%\9DO�K0RGXOH�$V�,QWHJHU��%\9DO�7KUHDG,G�$V�,QWHJHU��$V�,QWHJHU��

Page 550: Visual Basic - Subclassing and Hooking with VB & VB NET

����3XEOLF�'HFODUH�)XQFWLRQ�8QKRRN:LQGRZV+RRN([�/LE��XVHU����B��������$OLDV��8QKRRN:LQGRZV+RRN([��B���������%\9DO�K+RRN�$V�,QWHJHU��$V�,QWHJHU������3XEOLF�'HFODUH�)XQFWLRQ�&DOO1H[W+RRN([�/LE��XVHU����$OLDV��&DOO1H[W+RRN([��B���������%\9DO�K+RRN�$V�,QWHJHU��%\9DO�&RGH�$V�,QWHJHU��%\9DO�Z3DUDP�$V�,QWHJHU��B���������%\9DO�O3DUDP�$V�,QWHJHU��$V�,QWHJHU�'DWDW\SHV�KDYH�DOVR�FKDQJHG�IURP�9%���WR�9%�1(7��7KH�/RQJ�W\SH�LQ�9%���ZDV�FKDQJHG�WR�DQ�,QWHJHU�LQ�9%�1(7��$OVR��WKH�$Q\�W\SH�WKDW�LV�VRPHWLPHV�XVHG�LQ�$3,�GHFODUDWLRQV�LV�QRZ�JRQH��DV�DUH�9DULDQWV��,QVWHDG�RI�XVLQJ�WKH�$Q\�RU�9DULDQW�GDWDW\SHV��\RX�VKRXOG�GHFODUH�WKH�VSHFLILF�W\SH�WKDW�\RX�ZLOO�EH�XVLQJ��,Q�PRVW�LQVWDQFHV��\RX�ZLOO�EH�ZRUNLQJ�ZLWK�SRLQWHUV��WKHUHIRUH��\RX�VKRXOG�XVH�WKH�,QWHJHU�GDWDW\SH���

�����'HOHJDWHV�

'HOHJDWHV�DUH�RQH�RI�WKH�ODWHVW�DGGLWLRQV�WR�WKH�9%�1(7�ODQJXDJH��'HOHJDWHV�DUH�FODVVHV�WKDW�LQKHULW�IURP�HLWKHU�6\VWHP�'HOHJDWH�RU�6\VWHP�0XOWLFDVW'HOHJDWH��,Q�9%�1(7��GHOHJDWHV�E\�GHIDXOW�LQKHULW�IURP�6\VWHP�0XOWLFDVW'HOHJDWH��$�GHOHJDWH�LV�D�FODVV�WKDW�DFWV�DV�D�ZUDSSHU�DURXQG�D�IXQFWLRQ�SRLQWHU��7KLV�DOORZV�IXQFWLRQ�SRLQWHUV��RU�GHOHJDWHV��WR�EH�REMHFW�RULHQWHG��W\SHVDIH��DQG�VHFXUH���$�GHOHJDWH�FDQ�SRLQW�WR�ERWK�D�VKDUHG�IXQFWLRQ�DQG�RQH�WKDW�LV�DVVRFLDWHG�ZLWK�DQ�LQVWDQFH�RI�D�FODVV��$�GHOHJDWH�WKDW�LQKHULWV�IURP�WKH�6\VWHP�'HOHJDWH�FODVV�FDQ�RQO\�SRLQW�WR�D�VLQJOH�IXQFWLRQ�DW�DQ\�RQH�WLPH��7KH�GHOHJDWH�WKDW�LQKHULWV�IURP�WKH�6\VWHP�0XOWLFDVW'HOHJDWH�FODVV��KRZHYHU��FDQ�SRLQW�WR�D�OLVW�RI�IXQFWLRQV��DOO�RI�ZKLFK�DUH�FDOOHG�LQ�VXFFHVVLRQ�ZKHQ�WKLV�W\SH�RI�GHOHJDWH�LV�XVHG��7KH�WKLQJ�WR�ZDWFK�RXW�IRU�ZKHQ�XVLQJ�PXOWLFDVW�GHOHJDWHV�LV�WKDW��LI�WKH�IXQFWLRQV�WKH�GHOHJDWH�SRLQWV�WR�KDYH�D�UHWXUQ�YDOXH��WKH�GHOHJDWHV�ILQDO�UHWXUQ�YDOXH�LV�WKH�UHWXUQ�YDOXH�RI�WKH�ODVW�IXQFWLRQ�WKH�GHOHJDWH�FDOOV��)RU�WKLV�UHDVRQ��\RX�VKRXOG�XVH�GHOHJDWHV�WKDW�SRLQW�WR�D�VLQJOH�IXQFWLRQ�ZKHQ�LPSOHPHQWLQJ�KRRNV���

�������$�6LPSOH�([DPSOH�8VLQJ�'HOHJDWHV�

7R�EHWWHU�XQGHUVWDQG�GHOHJDWHV��OHWV�H[DPLQH�D�VLPSOH�H[DPSOH�WKDW�VKRZV�KRZ�WR�VHW�XS�DQG�XVH�ERWK�WKH�GHOHJDWH�DQG�PXOWLFDVW�GHOHJDWH��)LJXUH������SUHVHQWV�D�VFUHHQVKRW�RI�WKLV�H[DPSOH�DSSOLFDWLRQ��7DEOH������SUHVHQWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV���

)LJXUH�������6FUHHQVKRW�RI�WKH�GHOHJDWH�H[DPSOH�DSSOLFDWLRQ�

Page 551: Visual Basic - Subclassing and Hooking with VB & VB NET

7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�([DPSOH�$SSOLFDWLRQV�)RUP�DQG�,WV�&RQWUROV��&RQWURO� 3URSHUW\�1DPH� 9DOXH�

)RUP�� &DSWLRQ� �'HOHJDWH�([DPSOH��)RUP�� +HLJKW� ����)RUP�� :LGWK� ����%XWWRQ�� &DSWLRQ� �6LQJOH��%XWWRQ�� 7RS� ��%XWWRQ�� /HIW� ��%XWWRQ�� +HLJKW� ���%XWWRQ�� :LGWK� ���%XWWRQ�� &DSWLRQ� �&RPELQH��%XWWRQ�� 7RS� ���%XWWRQ�� /HIW� ��%XWWRQ�� +HLJKW� ���%XWWRQ�� :LGWK� ���7H[W%R[� 0XOWL/LQH� 7UXH�7H[W%R[� :RUG:UDS� )DOVH�7H[W%R[� 6FUROO%DUV� %RWK�7H[W%R[� 7RS� ��7H[W%R[� /HIW� ���7H[W%R[� +HLJKW� ����7H[W%R[� :LGWK� ����7KLV�DSSOLFDWLRQ�FRQWDLQV�WZR�EXWWRQV�DQG�D�WH[W�ER[��ZKLFK�GLVSOD\V�WKH�RXWSXW�IURP�WKH�GHOHJDWH�FDOOV��7KH�6LQJOH�EXWWRQ�FUHDWHV�D�GHOHJDWH��ELQGV�LW�WR�D�VLQJOH�IXQFWLRQ��DQG�WKHQ�FDOOV�WKLV�GHOHJDWH��7KLV�FDOOEDFN�IXQFWLRQ�ZULWHV�WKH�IROORZLQJ�WH[W�WR�WKH�WH[W�ER[���&DOOEDFN�IXQFWLRQ�&%��FDOOHG�����1DPH� �'HEXJ�:LWKLQ�WKLV�VDPH�FDOO��WKH�GHOHJDWH�LV�VHW�WR�SRLQW�WR�D�GLIIHUHQW�IXQFWLRQ�DQG�WKH�GHOHJDWH�LV�RQFH�DJDLQ�FDOOHG��7KLV�VHFRQG�FDOOEDFN�IXQFWLRQ�ZULWHV�WKH�IROORZLQJ�WH[W�WR�WKH�WH[W�ER[���&DOOEDFN�IXQFWLRQ�&%��FDOOHG�����1DPH� �5HOHDVH�

Page 552: Visual Basic - Subclassing and Hooking with VB & VB NET

:KHQ�\RX�FOLFN�WKH�&RPELQH�EXWWRQ��LW�FUHDWHV�WZR�GHOHJDWHV�DQG�WKHQ�FRPELQHV�WKHP�WR�IRUP�D�WKLUG�PXOWLFDVW�GHOHJDWH��ZKLFK�LW�WKHQ�FDOOV��7KH�IROORZLQJ�WH[W�LV�ZULWWHQ�WR�WKH�WH[W�ER[�ZKHQ�WKH�PXOWLFDVW�GHOHJDWH�LV�FDOOHG���&DOOEDFN�IXQFWLRQ�&%��FDOOHG��1DPH� �0XOWL�)LUH�'HOHJDWH�&DOOEDFN�IXQFWLRQ�&%��FDOOHG��1DPH� �0XOWL�)LUH�'HOHJDWH�([DPSOH������SUHVHQWV�WKH�FRGH�WR�SHUIRUP�WKHVH�WDVNV��7KH�FRGH�LQ�EROGIDFH�VKRZV�KRZ�\RX�VHW�XS�DQG�XVH�WKH�GHOHJDWHV���

([DPSOH�������&RGH�LQ�WKH�)RUP��YE�)LOH�IRU�WKH�'HOHJDWH�([DPSOH�$SSOLFDWLRQ��

,PSRUWV�6\VWHP�&RPSRQHQW0RGHO�,PSRUWV�6\VWHP�'UDZLQJ�,PSRUWV�6\VWHP�:LQ)RUPV���3XEOLF�&ODVV�)RUP������,QKHULWV�6\VWHP�:LQ)RUPV�)RUP������3XEOLF�6XE�1HZ�������������0\%DVH�1HZ���������)RUP�� �0H���������7KLV�FDOO�LV�UHTXLUHG�E\�WKH�:LQ�)RUP�'HVLJQHU����������,QLWLDOL]H&RPSRQHQW�����(QG�6XE������)RUP�RYHUULGHV�GLVSRVH�WR�FOHDQ�XS�WKH�FRPSRQHQW�OLVW������2YHUULGHV�3XEOLF�6XE�'LVSRVH�������������0\%DVH�'LVSRVH���������FRPSRQHQWV�'LVSRVH�����(QG�6XE����5HJLRQ���:LQGRZV�)RUP�'HVLJQHU�JHQHUDWHG�FRGH��������5HTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����3ULYDWH�FRPSRQHQWV�$V�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU�����3ULYDWH�:LWK(YHQWV�%XWWRQ��$V�6\VWHP�:LQ)RUPV�%XWWRQ�����3ULYDWH�:LWK(YHQWV�%XWWRQ��$V�6\VWHP�:LQ)RUPV�%XWWRQ�����3ULYDWH�:LWK(YHQWV�7H[W%R[��$V�6\VWHP�:LQ)RUPV�7H[W%R[�

Page 553: Visual Basic - Subclassing and Hooking with VB & VB NET

���������'LP�:LWK(YHQWV�)RUP��$V�6\VWHP�:LQ)RUPV�)RUP������127(��7KH�IROORZLQJ�SURFHGXUH�LV�UHTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����,W�FDQ�EH�PRGLILHG�XVLQJ�WKH�:LQGRZV�)RUP�'HVLJQHU��������'R�QRW�PRGLI\�LW�XVLQJ�WKH�FRGH�HGLWRU������3ULYDWH�6XE�,QLWLDOL]H&RPSRQHQW�������������0H�FRPSRQHQWV� �1HZ�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU�������������0H�%XWWRQ�� �1HZ�6\VWHP�:LQ)RUPV�%XWWRQ�������������0H�%XWWRQ�� �1HZ�6\VWHP�:LQ)RUPV�%XWWRQ�������������0H�7H[W%R[�� �1HZ�6\VWHP�:LQ)RUPV�7H[W%R[����������������������#GHVLJQ�0H�7UD\+HLJKW� �����������#GHVLJQ�0H�7UD\/DUJH,FRQ� �)DOVH���������#GHVLJQ�0H�7UD\$XWR$UUDQJH� �7UXH���������%XWWRQ��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW���������������%XWWRQ��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H�����������������%XWWRQ��7DE,QGH[� �����������%XWWRQ��7H[W� ��6LQJOH�������������������%XWWRQ��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW����������������%XWWRQ��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H�����������������%XWWRQ��7DE,QGH[� �����������%XWWRQ��7H[W� ��&RPELQH�������������������7H[W%R[��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW����������������7H[W%R[��0XOWLOLQH� �7UXH���������7H[W%R[��6FUROO%DUV� �6\VWHP�:LQ)RUPV�6FUROO%DUV�%RWK���������7H[W%R[��:RUG:UDS� �)DOVH���������7H[W%R[��7DE,QGH[� �����������7H[W%R[��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������������������0H�7H[W� ��'HOHJDWH�([DPSOH����������0H�$XWR6FDOH%DVH6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������0H�&OLHQW6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������������������0H�&RQWUROV�$GG�%XWWRQ�����������0H�&RQWUROV�$GG�%XWWRQ�����������0H�&RQWUROV�$GG�7H[W%R[�������(QG�6XE�

Page 554: Visual Basic - Subclassing and Hooking with VB & VB NET

������(QG�5HJLRQ����������&UHDWH�WKH�GHOHJDWH�����'HOHJDWH�6XE�0\&DOO%DFN�%\9DO�1DPH�$V�6WULQJ�����������&DOOEDFN�IXQFWLRQ��������3XEOLF�6XE�&%��%\9DO�1DPH�$V�6WULQJ����������7H[WER[��7H[W�� ��&DOOEDFN�IXQFWLRQ�&%��FDOOHG����FKU������FKU�������������7H[WER[��7H[W�� ������1DPH� ����1DPH��FKU������FKU���������(QG�6XE����������&DOOEDFN�IXQFWLRQ��������3XEOLF�6XE�&%��%\9DO�1DPH�$V�6WULQJ����������7H[WER[��7H[W�� ��&DOOEDFN�IXQFWLRQ�&%��FDOOHG���FKU������FKU�������������7H[WER[��7H[W�� ������1DPH� ����1DPH��FKU������FKU���������(QG�6XE����������&DOO�GHOHJDWH�����3URWHFWHG�6XE�%XWWRQ�B&OLFN�%\9DO�VHQGHU�$V�2EMHFW��%\9DO�H�$V�6\VWHP�(YHQW$UJV����������'LP�0\'HOHJDWH�$V�0\&DOO%DFN������������������3RLQW�WKH�GHOHJDWH�WR�IXQFWLRQ�&%��DQG�FDOO�LW���������0\'HOHJDWH� �$GGUHVV2I�&%����������0\'HOHJDWH��'HEXJ��������������������1RZ��SRLQW�WKH�GHOHJDWH�WR�IXQFWLRQ�&%��DQG�FDOO�LW���������0\'HOHJDWH� �$GGUHVV2I�&%����������0\'HOHJDWH��5HOHDVH�������(QG�6XE����������3URWHFWHG�6XE�%XWWRQ�B&OLFN�%\9DO�VHQGHU�$V�2EMHFW��%\9DO�H�$V�6\VWHP�(YHQW$UJV����������'LP�0\'HOHJDWH��$V�0\&DOO%DFN���������'LP�0\'HOHJDWH��$V�0\&DOO%DFN���������'LP�0\'HOHJDWH��$V�0\&DOO%DFN������������������3RLQW�GHOHJDWHV�WR�WKHLU�UHVSHFWLYH�IXQFWLRQ���������0\'HOHJDWH�� �$GGUHVV2I�&%����������0\'HOHJDWH�� �$GGUHVV2I�&%�����������

Page 555: Visual Basic - Subclassing and Hooking with VB & VB NET

��������&UHDWH�D�GHOHJDWH�WKDW�FRPELQHV�WKH�ILUVW�WZR�GHOHJDWHV�DQG�FDOO�LW���������0\'HOHJDWH�� �&7\SH�6\VWHP�'HOHJDWH�&RPELQH�0\'HOHJDWH���0\'HOHJDWH����B������������������������0\&DOOEDFN����������0\'HOHJDWH���0XOWL�)LUH�'HOHJDWH�������(QG�6XE�(QG�&ODVV�:H�DUH�PRVW�LQWHUHVWHG�LQ�WKH�FRGH�DW�WKH�ERWWRP�RI�([DPSOH�������LQ�ZKLFK�D�GHOHJDWH�QDPHG�0\&DOOEDFN�LV�FUHDWHG��7KH�IROORZLQJ�OLQH�RI�FRGH�FUHDWHV�WKLV�GHOHJDWH���'HOHJDWH�6XE�0\&DOO%DFN�%\9DO�1DPH�$V�6WULQJ��

�7KH�,/��RU�LQWHUPHGLDWH�ODQJXDJH��FRGH�WKDW�WKH�OLQH�RI�FRGH�WKDW�FUHDWHV�WKH�GHOHJDWH�JHQHUDWHV�LV�DV�IROORZV���

�FODVV�DXWR�DQVL�VHDOHG�QHVWHG�SXEOLF�)RUP��0\&DOO%DFN��H[WHQGV�>PVFRUOLE@6\VWHP�0XOWLFDVW'HOHJDWH�^��`����HQG�RI�FODVV�)RUP��0\&DOO%DFN�As we see here, a delegate is truly a class that inherits from System.MulticastDelegate. ��

1H[W��WZR�VXEURXWLQHV��&%��DQG�&%���DUH�GHFODUHG�WKDW�PDWFK�WKH�GHOHJDWHV�SDUDPHWHUV��1RWLFH�WKDW�ERWK�IXQFWLRQV�DOVR�DUH�GHFODUHG�DV�6XEV��H[DFWO\�DV�WKH�GHOHJDWH�ZDV�SUHYLRXVO\�GHFODUHG���,Q�WKH�%XWWRQ�B&OLFN�HYHQW��DQ�LQVWDQFH�RI�WKH�GHOHJDWH�LV�FUHDWHG�DV�IROORZV���'LP�0\'HOHJDWH�$V�0\&DOO%DFN�7KH�0\'HOHJDWH�UHIHUHQFH�WR�WKH�0\&DOO%DFN�GHOHJDWH�LV�ERXQG�WR�WKH�&%��IXQFWLRQ�E\�XVLQJ�WKH�$GGUHVV2I�NH\ZRUG��7KH�FRGH�WR�SHUIRUP�WKLV�LV�DV�IROORZV���0\'HOHJDWH� �$GGUHVV2I�&%��$IWHU�WKH�GHOHJDWH�LV�ERXQG�WR�WKH�IXQFWLRQ��ZH�FDQ�FDOO�WKH�IXQFWLRQ�WKURXJK�WKH�UHIHUHQFH�WR�RXU�GHOHJDWH�REMHFW��7KH�FRGH�WR�SHUIRUP�WKLV�LV�DV�IROORZV���0\'HOHJDWH��'HEXJ���,Q�WKH�%XWWRQ�B&OLFN�HYHQW��WKUHH�GHOHJDWHV�DUH�GHFODUHG��7KH�ILUVW�DQG�VHFRQG�GHOHJDWHV�DUH�ERXQG�WR�IXQFWLRQV�&%��DQG�&%���UHVSHFWLYHO\��7KH�WKLUG�GHOHJDWH��KRZHYHU��XVHV�WKH�&RPELQH�PHWKRG�WR�DGG�WKH�ILUVW�WZR�GHOHJDWHV�WR�WKH�OLVW�RI�GHOHJDWHV�WKDW�LW�PXVW�FDOO��7KH�FRGH�WR�SHUIRUP�WKLV�LV�DV�IROORZV���0\'HOHJDWH�� �&7\SH�6\VWHP�'HOHJDWH�&RPELQH�0\'HOHJDWH���0\'HOHJDWH����0\&DOOEDFN��

Page 556: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�&RPELQH�PHWKRG�WDNHV�WZR�GHOHJDWHV�DV�SDUDPHWHUV��FRPELQHV�WKHP�LQWR�D�VLQJOH�PXOWLFDVW�GHOHJDWH��DQG�UHWXUQV�WKLV�PXOWLFDVW�GHOHJDWH��7KH�&7\SH�IXQFWLRQ�FRQYHUWV�WKH�UHWXUQHG�GHOHJDWH�YDOXH�IURP�WKH�&RPELQH�PHWKRG�LQWR�D�0\&DOO%DFN�GDWDW\SH���1RZ��ZKHQ�\RX�XVH�WKH�0\'HOHJDWH��GHOHJDWH��WKH�IXQFWLRQV�WKDW�0\'HOHJDWH��DQG�0\'HOHJDWH��SRLQW�WR�DUH�FDOOHG�VXFFHVVLYHO\���

�����,PSOHPHQWLQJ�WKH�:+B.(<%2$5'�+RRN�

:KHQ�LPSOHPHQWLQJ�DQ\�W\SH�RI�KRRN�LQ�9%�1(7��\RX�VKRXOG�IROORZ�WKH�UXOHV�VWDWHG�LQ�&KDSWHU���IRU�VHWWLQJ�XS�DQG�XVLQJ�KRRNV��,�QRWLFHG�WKDW�LI�D�KRRN�LV�QRW�UHPRYHG�EHIRUH�WKH�DSSOLFDWLRQ�HQGV����XVLQJ�WKH�8Q+RRN:LQGRZV+RRN([�$3,�IXQFWLRQ����WKH�DSSOLFDWLRQ�GRHV�QRW�FUDVK��DV�LW�QRUPDOO\�ZRXOG�LQ�D�SUHYLRXV�YHUVLRQ�RI�9%��+RZHYHU��,�DOZD\V�LQFRUSRUDWH�FRGH�WR�UHPRYH�D�KRRN�DIWHU�LW�LV�LQVWDOOHG���5HPHPEHU��\RX�FDQ�LQVWDOO�KRRNV�RQ�RQH�WKUHDG�DW�D�WLPH��RU�RQ�HYHU\�WKUHDG�LQ�WKH�V\VWHP��7KHUHIRUH��LI�\RX�FUHDWH�PXOWLSOH�WKUHDGV�LQ�\RXU�DSSOLFDWLRQ�DQG�\RX�LQVWDOO�D�WKUHDG�VSHFLILF�KRRN��WKH�KRRN�ZLOO�FDSWXUH�LQIRUPDWLRQ�RQO\�IRU�WKDW�VSHFLILF�WKUHDG��,I�\RX�ZDQW�WR�FDSWXUH�LQIRUPDWLRQ�IRU�PRUH�WKDQ�RQH�WKUHDG�LQ�\RXU�DSSOLFDWLRQ��\RX�PXVW�LQVWDOO�WKH�KRRN�RQ�HDFK�WKUHDG��5HPHPEHU�WR�UHPRYH�WKH�KRRN�IURP�HDFK�WKUHDG�EHIRUH�WKH�WKUHDG�LV�GHVWUR\HG���

�������7KH�$SSOLFDWLRQ�

)LJXUH������SUHVHQWV�WKH�:+B.(<%2$5'�KRRN�DSSOLFDWLRQV�XVHU�LQWHUIDFH��8,���7DEOH������SUHVHQWV�WKH�QRQGHIDXOW�SURSHUWLHV�RI�WKH�IRUP�DQG�LWV�FRQWUROV��7KLV�DSSOLFDWLRQ�LV�IDLUO\�VLPSOH��7KHUH�DUH�WZR�EXWWRQV�DQG�D�WH[W�ER[�RQ�WKH�IRUP��7KH�+RRN�EXWWRQ�FDOOV�6HW:LQGRZV+RRN([�WR�LQVWDOO�WKH�:+B.(<%2$5'�KRRN��DQG�WKH�8Q+RRN�EXWWRQ�FDOOV�8QKRRN:LQGRZV+RRN([�WR�UHPRYH�WKH�KRRN��7KH�WH[WER[�GLVSOD\V�WKH�WKUHH�SDUDPHWHUV�RI�WKH�KRRNV�ILOWHU�IXQFWLRQ��&RGH��O3DUDP��DQG�Z3DUDP���

)LJXUH�������7KH�:+B.(<%2$5'�KRRN�H[DPSOH�DSSOLFDWLRQ�VFUHHQVKRW�

7DEOH�������1RQGHIDXOW�3URSHUWLHV�RI�WKH�([DPSOH�$SSOLFDWLRQV�)RUP�DQG�,WV&RQWUROV��&RQWURO� 3URSHUW\�1DPH� 9DOXH�

)RUP�� &DSWLRQ� �9%�1(7�+RRNLQJ�([DPSOH��

Page 557: Visual Basic - Subclassing and Hooking with VB & VB NET

)RUP�� +HLJKW� ����)RUP�� :LGWK� ����%XWWRQ�� &DSWLRQ� �+RRN��%XWWRQ�� 7RS� ��%XWWRQ�� /HIW� ��%XWWRQ�� +HLJKW� ���%XWWRQ�� :LGWK� ���%XWWRQ�� &DSWLRQ� �8Q+RRN��%XWWRQ�� 7RS� ���%XWWRQ�� /HIW� ��%XWWRQ�� +HLJKW� ���%XWWRQ�� :LGWK� ���7H[W%R[� 0XOWL/LQH� 7UXH�7H[W%R[� :RUG:UDS� )DOVH�7H[W%R[� 6FUROO%DUV� %RWK�7H[W%R[� 7RS� ��7H[W%R[� /HIW� ���7H[W%R[� +HLJKW� ����7H[W%R[� :LGWK� ����7R�XVH�WKH�DSSOLFDWLRQ��FOLFN�WKH�+RRN�EXWWRQ��1H[W��W\SH�LQ�VRPH�WH[W��PDNLQJ�VXUH�WKDW�WKH�WH[W�ER[�GRHV�QRW�KDYH�WKH�IRFXV��,I�WKH�WH[W�ER[�KDV�WKH�IRFXV��WKH�WH[W�ZLOO�RYHUZULWH�LWVHOI�DV�\RX�W\SH��PDNLQJ�IRU�D�YHU\�PHVV\�GLVSOD\��+RZHYHU��LI�\RX�VLPSO\�FOLFN�WKH�+RRN�EXWWRQ�DQG�LPPHGLDWHO\�VWDUW�WR�W\SH��\RX�ZLOO�VHH�WKH�ILOWHU�IXQFWLRQV�SDUDPHWHUV�GLVSOD\HG��:KHQ�\RX�DUH�GRQH��FOLFN�WKH�8Q+RRN�EXWWRQ�DQG�FORVH�WKH�DSSOLFDWLRQ���

�)RU�PRUH�LQIRUPDWLRQ�RQ�KRZ�WKH�:+B.(<%2$5'�KRRN�ZRUNV��VHH�&KDSWHU�������

�������7KH��9%�)LOH�

([DPSOH������SUHVHQWV�WKH�FRGH�FRQWDLQHG�LQ�WKH�)RUP��YE�ILOH���

([DPSOH�������7KH�&RGH�&RQWDLQHG�LQ�WKH�)RUP��YE�)LOH�IRU�WKH�:+B.(<%2$5'�+RRN�([DPSOH�$SSOLFDWLRQ��

,PSRUWV�6\VWHP�&RPSRQHQW0RGHO�

Page 558: Visual Basic - Subclassing and Hooking with VB & VB NET

,PSRUWV�6\VWHP�'UDZLQJ�,PSRUWV�6\VWHP�:LQ)RUPV�,PSRUWV�6\VWHP�5XQWLPH�,QWHURS6HUYLFHV��� �02'8/(�6(&7,21� �3XEOLF�0RGXOH�PRG������GHFODUH�GHOHJDWH�REMHFW�����'HOHJDWH�)XQFWLRQ�+RRN&DOOEDFN�%\9DO�&RGH�$V�,QWHJHU��%\9DO�Z3DUDP�$V�,QWHJHU��B�������%\9DO�O3DUDP�$V�,QWHJHU��$V�,QWHJHU����������GHFODUH�$3,V�����3XEOLF�'HFODUH�)XQFWLRQ�6HW:LQGRZV+RRN([�/LE��XVHU����B��������$OLDV��6HW:LQGRZV+RRN([$��B���������%\9DO�+RRN,'�$V�,QWHJHU��%\9DO�OSIQ�$V�+RRN&DOOEDFN��B��������%\9DO�K0RGXOH�$V�,QWHJHU��%\9DO�7KUHDG,G�$V�,QWHJHU��$V�,QWHJHU�����3XEOLF�'HFODUH�)XQFWLRQ�8QKRRN:LQGRZV+RRN([�/LE��XVHU����B���������$OLDV��8QKRRN:LQGRZV+RRN([��B���������%\9DO�K+RRN�$V�,QWHJHU��$V�,QWHJHU�����3XEOLF�'HFODUH�)XQFWLRQ�&DOO1H[W+RRN([�/LE��XVHU����$OLDV��&DOO1H[W+RRN([��B���������%\9DO�K+RRN�$V�,QWHJHU��%\9DO�&RGH�$V�,QWHJHU��%\9DO�Z3DUDP�$V�,QWHJHU��B��������%\9DO�O3DUDP�$V�,QWHJHU��$V�,QWHJHU����������*OREDO�FRQVWDQWV���������3XEOLF�&RQVW�:+B.(<%2$5'�$V�,QWHJHU� ������������3ULYDWH�PBK+RRN�$V�,QWHJHU����������3URSHUW\�WR�DFFHVV�KRRN�KDQGOH�����3URSHUW\�K+RRN�����$V�,QWHJHU���������6HW�������������,I�PBK+RRN��!���$QG�9DOXH��!���7KHQ�����������������'RQW�RYHUZULWH�WKH�KDQGOH��������������������8QOHVV�LW�LV�EHLQJ�UHVHW�WR���������������(OVH�����������������PBK+RRN� �9DOXH�������������(QG�,I���������(QG�6HW�

Page 559: Visual Basic - Subclassing and Hooking with VB & VB NET

�����������������*HW�������������K+RRN� �PBK+RRN���������(QG�*HW�����(QG�3URSHUW\�(QG�0RGXOH��� �)250�6(&7,21� �3XEOLF�&ODVV�)RUP������,QKHULWV�6\VWHP�:LQ)RUPV�)RUP����������GHFODUH�QHVWHG�FODVV�YDU�����3XEOLF�KN�$V�+RRN����������GHFODUH�GHOHJDWH�REMHFW�����3XEOLF�FE�$V�+RRN&DOOEDFN����������� �����1(67('�&/$66�FRQWDLQLQJ�WKH�FDOOEDFN�+RRN3URF����� �����3XEOLF�&ODVV�+RRN���������UHIHUHQFH�EDFN�WR�WKH�IRUP���������3ULYDWH�7KH:LQ�$V�)RUP�������������������FWRU���XVHG�WR�JHW�D�UHIHUHQFH�WR�WKH�PDLQ�ZLQGRZ����������������LQ�RUGHU�WR�ZULWH�LQIR�WR�WKH�WH[WER[��WH[W�ER[���������3XEOLF�6XE�1HZ�%\9DO�0DLQ:QG�$V�)RUP���������������7KH:LQ� �0DLQ:QG���������(QG�6XE������������������+22.�352&���������3XEOLF�)XQFWLRQ�+RRN3URF�%\9DO�&RGH�$V�,QWHJHU��%\9DO�Z3DUDP�$V�,QWHJHU��B�����������%\9DO�O3DUDP�$V�,QWHJHU��$V�,QWHJHU�������������7KH:LQ�3ULQW7[W��&RGH�����&RGH������������Z3DUDP�����Z3DUDP��B��������������������������O3DUDP�����O3DUDP��������������+RRN3URF� �&DOO1H[W+RRN([�K+RRN��&RGH��Z3DUDP��O3DUDP��

Page 560: Visual Basic - Subclassing and Hooking with VB & VB NET

��������(QG�)XQFWLRQ�����(QG�&ODVV�����������67$57�+(5(���GHIDXOW�FWRU�IRU�)RUP��FODVV�����3XEOLF�6XE�1HZ�������������0\%DVH�1HZ�������������)RUP�� �0H���������7KLV�FDOO�LV�UHTXLUHG�E\�WKH�:LQ�)RUP�'HVLJQHU����������,QLWLDOL]H&RPSRQHQW����������������������LQVWDQWLDWH�D�QHZ�QHVWHG�+RRN�FODVV�DQG�SDVV�LQ�D�UHIHUHQFH�WR�WKLV�IRUP���������KN� �1HZ�+RRN�0H�������������������LQVWDQWLDWH�D�QHZ�GHOHJDWH�REMHFW�SRLQWLQJ�WR�WKH�+RRN3URF�IXQFWLRQ�������������LQ�WKH�QHVWHG�FODVV���������FE� �1HZ�+RRN&DOOEDFN�$GGUHVV2I�KN�+RRN3URF������(QG�6XE����������XVHG�E\�)RUP��WR�DGG�WH[W�WR�WKH�WH[WER[��WH[W�ER[��FDOOHG�E\�+RRN3URF�����3XEOLF�6XE�3ULQW7[W�%\9DO�VWU2XWSXW�$V�6WULQJ����������W[W2XWSXW�7H[W� �W[W2XWSXW�7H[W��VWU2XWSXW��FKU������FKU���������(QG�6XE����������)RUP�RYHUULGHV�GLVSRVH�WR�FOHDQ�XS�WKH�FRPSRQHQW�OLVW������3XEOLF�2YHUULGHV�6XE�'LVSRVH�������������0\%DVH�'LVSRVH�������������FRPSRQHQWV�'LVSRVH���������(QG�6XE����������� �����5(*8/$5�:,1'2:6��1(7�678))����� ��5HJLRQ���:LQGRZV�)RUP�'HVLJQHU�JHQHUDWHG�FRGH�������5HTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����3ULYDWH�FRPSRQHQWV�$V�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU�����3ULYDWH�:LWK(YHQWV�EWQ8Q+RRN�$V�6\VWHP�:LQ)RUPV�%XWWRQ�����3ULYDWH�:LWK(YHQWV�EWQ+RRN�$V�6\VWHP�:LQ)RUPV�%XWWRQ�����3ULYDWH�:LWK(YHQWV�W[W2XWSXW�$V�6\VWHP�:LQ)RUPV�7H[W%R[�

Page 561: Visual Basic - Subclassing and Hooking with VB & VB NET

���������'LP�:LWK(YHQWV�)RUP��$V�6\VWHP�:LQ)RUPV�)RUP����������127(��7KH�IROORZLQJ�SURFHGXUH�LV�UHTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����,W�FDQ�EH�PRGLILHG�XVLQJ�WKH�:LQGRZV�)RUP�'HVLJQHU��������'R�QRW�PRGLI\�LW�XVLQJ�WKH�FRGH�HGLWRU������3ULYDWH�6XE�,QLWLDOL]H&RPSRQHQW�������������0H�FRPSRQHQWV� �1HZ�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU�������������0H�W[W2XWSXW� �1HZ�6\VWHP�:LQ)RUPV�7H[W%R[�������������0H�EWQ8Q+RRN� �1HZ�6\VWHP�:LQ)RUPV�%XWWRQ�������������0H�EWQ+RRN� �1HZ�6\VWHP�:LQ)RUPV�%XWWRQ����������������������#GHVLJQ�0H�7UD\+HLJKW� �����������#GHVLJQ�0H�7UD\/DUJH,FRQ� �)DOVH���������#GHVLJQ�0H�7UD\$XWR$UUDQJH� �7UXH���������W[W2XWSXW�/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW����������������W[W2XWSXW�0XOWLOLQH� �7UXH���������W[W2XWSXW�6FUROO%DUV� �6\VWHP�:LQ)RUPV�6FUROO%DUV�%RWK���������W[W2XWSXW�7DE,QGH[� �����������W[W2XWSXW�6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������������������EWQ8Q+RRN�/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW����������������EWQ8Q+RRN�6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H�����������������EWQ8Q+RRN�7DE,QGH[� �����������EWQ8Q+RRN�7H[W� ��8Q+RRN�������������������EWQ+RRN�/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW���������������EWQ+RRN�6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H�����������������EWQ+RRN�7DE,QGH[� �����������EWQ+RRN�7H[W� ��+RRN����������0H�7H[W� ��9%�1(7�+RRNLQJ�([DPSOH����������0H�$XWR6FDOH%DVH6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������0H�&OLHQW6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������������������0H�&RQWUROV�$GG�EWQ8Q+RRN����������0H�&RQWUROV�$GG�EWQ+RRN����������0H�&RQWUROV�$GG�W[W2XWSXW������(QG�6XE��(QG�5HJLRQ������

Page 562: Visual Basic - Subclassing and Hooking with VB & VB NET

���� �����(9(17�+$1'/(56�)25�%87721�&21752/6����� �����3URWHFWHG�6XE�EWQ8Q+RRNB&OLFN�%\9DO�VHQGHU�$V�2EMHFW��B�����������������������������������%\9DO�H�$V�6\VWHP�(YHQW$UJV����������,QVWDOO�KRRN���������PVJER[��8QKRRN:LQGRZV+RRN([�UHWXUQHG�����8QKRRN:LQGRZV+RRN([�K+RRN�����������K+RRN� �������(QG�6XE����������3URWHFWHG�6XE�EWQ+RRNB&OLFN�%\9DO�VHQGHU�$V�2EMHFW��%\9DO�H�$V�6\VWHP�(YHQW$UJV����������5HPRYH�KRRN���������K+RRN� �6HW:LQGRZV+RRN([�:+B.(<%2$5'��FE�����DSSGRPDLQ�*HW&XUUHQW7KUHDG,G����������PVJER[��6HW:LQGRZV+RRN([�UHWXUQHG�����K+RRN������(QG�6XE�(QG�&ODVV�7KUHH�FODVVHV�DUH�LQFOXGHG�ZLWK�WKH�FRGH�IRU�WKLV�H[DPSOH��7KH�ILUVW�LV�D�SXEOLF�PRGXOH�FDOOHG�PRG���7KLV�PRGXOH�FRQWDLQV�WKH�GHOHJDWH�GHFODUDWLRQ��WKH�:LQ���$3,�IXQFWLRQ�GHFODUDWLRQV��WKH�:+B.(<%2$5'�KRRN�FRQVWDQW��WKH�KRRN�KDQGOH�YDULDEOH��PBK+RRN���DQG�D�SURSHUW\�XVHG�WR�DFFHVV�WKH�KRRN�KDQGOH��K+RRN����

�7KH�FRPSLOHU�DFWXDOO\�FRQYHUWV�PRGXOH�W\SHV�GHFODUHG�LQ�9%�1(7�DSSOLFDWLRQV�WR�VLPSOH�SXEOLF�FODVV�W\SHV��7KH�PRG��PRGXOH�W\SH�LV�FRQYHUWHG�WR�WKH�IROORZLQJ�,/���

�FODVV�SXEOLF�DXWR�DQVL�PRG���H[WHQGV�>PVFRUOLE@6\VWHP�2EMHFW�^���FXVWRP�LQVWDQFH�YRLG�>0LFURVRIW�9LVXDO%DVLF@0LFURVRIW�9LVXDO%DVLF�*OREDOV�*OREDOV�6WDQGDUG0RGXOH$WWULEXWH���FWRU���� �������������������`����HQG�RI�FODVV�PRG���

0RGXOH�W\SHV�LQKHULW�IURP�6\VWHP�2EMHFW��DQG�\RX�XVXDOO\�XVH�WKHP�WR�GHFODUH�JOREDO�W\SHV���7KH�VHFRQG�FODVV�GHFODUHG�LV�)RUP���)RUP��LQKHULWV�IURP�WKH�6\VWHP�:LQ)RUPV�)RUP�FODVV�DQG�LV�WKH�RQO\�ZLQGRZ�LQ�RXU�DSSOLFDWLRQ��7KLV�FODVV�FRQWDLQV�WKH�FRGH�WKDW�WKH�9%�1(7�DSSOLFDWLRQ�ZL]DUG�DXWRPDWLFDOO\�FUHDWHV�IRU�\RX��WKH�HYHQW�KDQGOHUV�IRU�HDFK�EXWWRQ�FRQWURO��DQG�D�QHVWHG�FODVV�QDPHG�+RRN��7KLV�FODVV�LV�LQVWDQWLDWHG�E\�)RUP�V�FRQVWUXFWRU��<RX�XVH�

Page 563: Visual Basic - Subclassing and Hooking with VB & VB NET

WKLV�FODVV�PDLQO\�WR�FRQWDLQ�WKH�ILOWHU�IXQFWLRQ�IRU�\RXU�:+B.(<%2$5'�KRRN�IXQFWLRQ��+RRN3URF����:KHQ�\RX�VWDUW�WKLV�DSSOLFDWLRQ��WKH�FRQVWUXFWRU�RI�WKH�)RUP��FODVV�LV�FDOOHG��7KLV�FRQVWUXFWRU�FUHDWHV�D�QHZ�LQVWDQFH�RI�WKH�+RRN�FODVV�DQG�SDVVHV�LW�D�UHIHUHQFH�WR�WKH�)RUP��FODVV��0H���1H[W��WKH�FRQVWUXFWRU�FUHDWHV�D�QHZ�LQVWDQFH�RI�WKH�+RRN&DOOEDFN�GHOHJDWH�DQG�ELQGV�LW�WR�WKH�+RRN3URF�ILOWHU�IXQFWLRQ�FRQWDLQHG�LQ�WKH�+RRN�FODVV��7KLV�FRGH�LV�SUHVHQWHG�KHUH���LQVWDQWLDWH�D�QHZ�QHVWHG�+RRN�FODVV�DQG�SDVV�LQ�D�UHIHUHQFH�WR�WKLV�IRUP�KN� �1HZ�+RRN�0H�����������LQVWDQWLDWH�D�QHZ�GHOHJDWH�REMHFW�SRLQWLQJ�WR�WKH�+RRN3URF�IXQFWLRQ�LQ�WKH�QHVWHG�FODVV�FE� �1HZ�+RRN&DOOEDFN�$GGUHVV2I�KN�+RRN3URF��7KH�UHIHUHQFH�WR�WKH�+RRN�REMHFW��KN��LV�GHFODUHG�DV�D�SXEOLF�PHPEHU�YDULDEOH�RI�WKH�)RUP��FODVV��7KH�UHIHUHQFH�WR�WKH�GHOHJDWH�REMHFW��FE��DOVR�LV�GHFODUHG�DV�D�SXEOLF�PHPEHU�YDULDEOH�RI�WKH�)RUP��FODVV���:KHQ�WKH�UHIHUHQFH�WR�WKH�+RRN�REMHFW��KN��LV�FUHDWHG�LQ�WKH�FRQVWUXFWRU�RI�WKH�)RUP��FODVV��WKH�FRQVWUXFWRU�RI�WKH�+RRN�FODVV�LV�LPPHGLDWHO\�FDOOHG�ZLWK�D�UHIHUHQFH�WR�WKH�)RUP��REMHFW�DV�D�SDUDPHWHU��7KH�UHIHUHQFH�WR�WKH�)RUP��REMHFW�LV�SDVVHG�WR�WKH�+RRN�REMHFW�VR�WKDW�WKH�ILOWHU�IXQFWLRQ�FRQWDLQHG�ZLWKLQ�WKH�+RRN�FODVV�FDQ�ZULWH�WH[W�RXW�WR�WKH�WH[W�ER[�FRQWDLQHG�LQ�WKH�)RUP��REMHFW��$OO�FRQWUROV�ZLWKLQ�D�)RUP�REMHFW�DUH�VHW�WR�3ULYDWH�DFFHVV��WKHUHIRUH��QR�FODVV��QHVWHG�RU�RWKHUZLVH��FDQ�DFFHVV�WKHVH�FRQWUROV��,Q�SUHYLRXV�YHUVLRQV�RI�9%��WKH�IRUP�FRQWUROV�KDG�SXEOLF�DFFHVV��DQG�ZH�GLG�QRW�KDYH�WKLV�SUREOHP���$IWHU�WKH�)RUP��IRUP�LV�GLVSOD\HG��WKH�XVHU�FDQ�FOLFN�WKH�+RRN�EXWWRQ��7KLV�ILUHV�WKH�EWQ+RRNB&OLFN�HYHQW��ZKLFK�FDOOV�6HW:LQGRZV+RRN([�WR�LQVWDOO�WKH�:+B.(<%2$5'V�ILOWHU�IXQFWLRQ��$�PHVVDJH�ER[�LV�GLVSOD\HG�IROORZLQJ�WKLV�FDOO�WR�GLVSOD\�WKH�KDQGOH�WR�WKH�KRRN��$�KRRN�YDOXH�RWKHU�WKDQ�]HUR�PHDQV�WKDW�WKH�KRRN�KDV�VXFFHVVIXOO\�EHHQ�LQVWDOOHG���$W�WKLV�SRLQW��ZKHQHYHU�WKH�XVHU�SUHVVHV�D�NH\�RQ�WKH�NH\ERDUG��WKH�+RRN3URF�ILOWHU�IXQFWLRQ�LV�FDOOHG��7KLV�IXQFWLRQ�FDOOV�WKH�3ULQW7[W�PHWKRG�LQ�WKH�)RUP��REMHFW��ZKLFK�GLVSOD\V�VRPH�WH[W�LQ�WKH�WH[W�ER[�RQ�WKH�IRUP��7KH�WH[W�GLVSOD\HG�LQFOXGHV�WKH�SDUDPHWHUV�WR�WKH�ILOWHU�IXQFWLRQ���:KHQ�WKH�XVHU�FOLFNV�WKH�8Q+RRN�EXWWRQ��WKH�%WQ+RRNB&OLFN�HYHQW�LV�ILUHG��7KLV�HYHQW�FDXVHV�8QKRRN:LQGRZV+RRN([�WR�EH�FDOOHG��UHPRYLQJ�WKH�:+B.(<%2$5'�ILOWHU�IXQFWLRQ��$�PHVVDJH�ER[�LV�GLVSOD\HG�VKRZLQJ�WKH�UHWXUQ�YDOXH�RI�WKLV�IXQFWLRQ�FDOO��D�YDOXH�RWKHU�WKDQ�]HUR�PHDQV�WKDW�WKH�KRRN�KDV�VXFFHVVIXOO\�EHHQ�UHPRYHG���

�����,PSOHPHQWLQJ�WKH�:+B0286(�+RRN�

Page 564: Visual Basic - Subclassing and Hooking with VB & VB NET

,�DOVR�FKRVH�WR�LQFOXGH�D�:+B0286(�KRRN�H[DPSOH�EHFDXVH�LW�UHTXLUHV�WKH�XVH�RI�D�XVHU�GHILQHG�W\SH��,Q�9%�1(7��XVHU�GHILQHG�W\SHV�DUH�JRQH�DQG�DUH�UHSODFHG�E\�VWUXFWXUHV��7KH�H[DPSOH�SUHVHQWHG�KHUH�ZLOO�H[SODLQ�KRZ�WR�XVH�D�VWUXFWXUH�LQ�SODFH�RI�D�XVHU�GHILQHG�W\SH���

�,I�\RX�DUH�JRLQJ�WR�SRUW�DQ\�RI�WKLV�FRGH�WR�&���\RX�PXVW�DGG�DQ�DWWULEXWH�WR�WKH�VWUXFWXUH�GHILQLWLRQ��7KH�IROORZLQJ�LV�DQ�H[DPSOH�RI�WKLV��

>6WUXFW/D\RXW�/D\RXW.LQG�6HTXHQWLDO�@�SXEOLF�VWUXFW�0286(+22.6758&7�^���SXEOLF�SW�$V�32,17$3,���SXEOLF�KZQG�$V�,QWHJHU���SXEOLF�Z+LW7HVW&RGH�$V�,QWHJHU���SXEOLF�GZ([WUD,QIR�$V�,QWHJHU�`�([DPLQLQJ�WKH�,/�WKDW�WKH�9%�1(7�DSSOLFDWLRQ�JHQHUDWHG��ZH�VHH�WKH�IROORZLQJ��FODVV�YDOXH�VHTXHQWLDO�DQVL�VHDOHG�QHVWHG�SXEOLF�PRGO�32,17$3,��H[WHQGV�>PVFRUOLE@6\VWHP�9DOXH7\SH�^��`����HQG�RI�FODVV�PRG��32,17$3,�7KH�VWUXFWXUH�LV�DFWXDOO\�FUHDWHG�DV�D�FODVV�WKDW�LQKHULWV�IURP�WKH�6\VWHP�9DOXH�7\SH�FODVV����WKH�ZRUG�H[WHQGV�LQ�WKH�SUHYLRXV�,/�FRGH�LPSOLHV��LQKHULWV�IURP���9%�1(7�DXWRPDWLFDOO\�PDUNV�WKLV�FODVV�DV�VHTXHQWLDO����

�������7KH�$SSOLFDWLRQ�

7KLV�DSSOLFDWLRQV�8,�LV�ODLG�RXW�H[DFWO\�DV�LQ�WKH�SUHYLRXV�H[DPSOH�RI�WKH�:+B.(<%2$5'�KRRN��ZKLFK�)LJXUH������VKRZV��7KH�+RRN�EXWWRQ�LQVWDOOV�WKH�:+B0286(�KRRN��DQG�WKH�8Q+RRN�EXWWRQ�UHPRYHV�WKLV�KRRN���7KH�ILOWHU�IXQFWLRQ�YDOXHV�DUH�SULQWHG�WR�WKH�WH[W�ER[�RQ�WKH�IRUP�ZKHQHYHU�WKLV�KRRN�LV�FDOOHG��7R�VHH�PHVVDJHV�ZULWWHQ�RXW�WR�WKLV�WH[W�ER[��PRYH�WKH�PRXVH�RU�FOLFN�RQH�RI�LWV�EXWWRQV���

Page 565: Visual Basic - Subclassing and Hooking with VB & VB NET

�������7KH��9%�)LOH�

([DPSOH������SUHVHQWV�WKH�FRGH�FRQWDLQHG�LQ�WKH�)RUP��YE�ILOH��WKH�PRGLILFDWLRQV�QHHGHG�WR�XVH�VWUXFWXUHV�ZLWK�WKH�0+B0286(�KRRN�DSSHDU�LQ�EROGIDFH���

([DPSOH�������7KH�&RGH�&RQWDLQHG�LQ�WKH�)RUP��YE�)LOH�IRU�WKH�:+B0286(�+RRN�([DPSOH�$SSOLFDWLRQ��

,PSRUWV�6\VWHP�'UDZLQJ�,PSRUWV�6\VWHP�:LQ)RUPV�,PSRUWV�6\VWHP�5XQWLPH�,QWHURS6HUYLFHV�,PSRUWV�6\VWHP�&RPSRQHQW0RGHO��� �02'8/(�6(&7,21� �3XEOLF�0RGXOH�PRG�����GHFODUH�GHOHJDWH�REMHFW����'HOHJDWH�)XQFWLRQ�+RRN&DOOEDFN�%\9DO�&RGH�$V�,QWHJHU��%\9DO�Z3DUDP�$V�,QWHJHU��B�������%\9DO�O3DUDP�$V�,QWHJHU��$V�,QWHJHU�����GHFODUH�$3,V����3XEOLF�'HFODUH�)XQFWLRQ�6HW:LQGRZV+RRN([�/LE��XVHU����$OLDV��6HW:LQGRZV+RRN([$��B��������%\9DO�+RRN,'�$V�,QWHJHU��%\9DO�OSIQ�$V�+RRN&DOOEDFN��B�������%\9DO�K0RGXOH�$V�,QWHJHU��%\9DO�7KUHDG,G�$V�,QWHJHU��$V�,QWHJHU����3XEOLF�'HFODUH�)XQFWLRQ�8QKRRN:LQGRZV+RRN([�/LE��XVHU����B�������$OLDV��8QKRRN:LQGRZV+RRN([��B��������%\9DO�K+RRN�$V�,QWHJHU��$V�,QWHJHU����3XEOLF�'HFODUH�)XQFWLRQ�&DOO1H[W+RRN([�/LE��XVHU����$OLDV��&DOO1H[W+RRN([��B��������%\9DO�K+RRN�$V�,QWHJHU��%\9DO�&RGH�$V�,QWHJHU��%\9DO�Z3DUDP�$V�,QWHJHU��B�������%\9DO�O3DUDP�$V�,QWHJHU��$V�,QWHJHU����3XEOLF�'HFODUH�6XE�&RS\0HPRU\�/LE��NHUQHO����$OLDV��5WO0RYH0HPRU\��B��������%\5HI�'HVWLQDWLRQ�$V�PRG��0286(+22.6758&7��%\9DO�6RXUFH�$V�,QWHJHU��B�������%\9DO�/HQJWK�$V�,QWHJHU�������*OREDO�FRQVWDQWV�����3XEOLF�&RQVW�:+B0286(�$V�,QWHJHU� ��������6WUXFWXUH�32,17$3,�

Page 566: Visual Basic - Subclassing and Hooking with VB & VB NET

��������3XEOLF�[�$V�,QWHJHU���������3XEOLF�\�$V�,QWHJHU�����(QG�6WUXFWXUH������6WUXFWXUH�0286(+22.6758&7���������3XEOLF�SW�$V�32,17$3,���������3XEOLF�KZQG�$V�,QWHJHU���������3XEOLF�Z+LW7HVW&RGH�$V�,QWHJHU���������3XEOLF�GZ([WUD,QIR�$V�,QWHJHU�����(QG�6WUXFWXUH������3ULYDWH�PBK+RRN�$V�,QWHJHU������3URSHUW\�WR�DFFHVV�KRRN�KDQGOH�����3URSHUW\�K+RRN�����$V�,QWHJHU���������6HW�������������,I�PBK+RRN��!���$QG�9DOXH��!���7KHQ�����������������'RQW�RYHUZULWH�WKH�KDQGOH��������������������8QOHVV�LW�LV�EHLQJ�UHVHW�WR���������������(OVH�����������������PBK+RRN� �9DOXH�������������(QG�,I���������(QG�6HW����������*HW�������������K+RRN� �PBK+RRN���������(QG�*HW�����(QG�3URSHUW\�(QG�0RGXOH��� �)250�6(&7,21� �3XEOLF�&ODVV�IUP+RRN�����,QKHULWV�6\VWHP�:LQ)RUPV�)RUP������GHFODUH�QHVWHG�FODVV�YDU�����3XEOLF�KN�$V�+RRN��

Page 567: Visual Basic - Subclassing and Hooking with VB & VB NET

����GHFODUH�GHOHJDWH�REMHFW�����3XEOLF�FE�$V�+RRN&DOOEDFN������� �����1(67('�&/$66�FRQWDLQLQJ�WKH�FDOOEDFN�+RRN3URF����� �����3XEOLF�&ODVV�+RRN���������UHIHUHQFH�EDFN�WR�WKH�IRUP���������3ULYDWH�7KH:LQ�$V�IUP+RRN����������FWRU���XVHG�WR�JHW�D�UHIHUHQFH�WR�WKH�PDLQ�ZLQGRZ����������������LQ�RUGHU�WR�ZULWH�LQIR�WR�WKH�WH[WER[��WH[W�ER[���������3XEOLF�6XE�1HZ�%\9DO�0DLQ:QG�$V�IUP+RRN��������������7KH:LQ� �0DLQ:QG���������(QG�6XE����������+22.�352&���������3XEOLF�)XQFWLRQ�+RRN3URF�%\9DO�&RGH�$V�,QWHJHU��%\9DO�Z3DUDP�$V�,QWHJHU��B�����������%\9DO�O3DUDP�$V�,QWHJHU��$V�,QWHJHU�������������'LP�'HVW�$V�1HZ�PRG��0286(+22.6758&7������������������&RS\0HPRU\�'HVW��O3DUDP��VL]HRI�'HVW���������������7KH:LQ�3ULQW7[W�'HVW�KZQG���������'HVW�SW�[���������'HVW�SW�\��B����������������������'HVW�Z+LW7HVW&RGH���������������+RRN3URF� �&DOO1H[W+RRN([�K+RRN��&RGH��Z3DUDP��O3DUDP����������(QG�)XQFWLRQ�(QG�&ODVV������67$57�+(5(���GHIDXOW�FWRU�IRU�)RUP��FODVV�����3XEOLF�6XE�1HZ�������������0\%DVH�1HZ�������������IUP+RRN� �0H���������,QLWLDOL]H&RPSRQHQW��������������LQVWDQWLDWH�D�QHZ�QHVWHG�+RRN�FODVV�SDVVLQJ�LQ�D�UHIHUHQFH�WR�WKLV�IRUP���������KN� �1HZ�+RRN�0H�����������LQVWDQWLDWH�D�QHZ�GHOHJDWH�REMHFW�SRLQWLQJ�WR�WKH�+RRN3URF�IXQFWLRQ�

Page 568: Visual Basic - Subclassing and Hooking with VB & VB NET

�����������LQ�WKH�QHVWHG�FODVV���������FE� �1HZ�+RRN&DOOEDFN�$GGUHVV2I�KN�+RRN3URF������(QG�6XE������XVHG�E\�)RUP��WR�DGG�WH[W�WR�WKH�WH[WER[��WH[W�ER[��FDOOHG�E\�+RRN3URF�����3XEOLF�6XE�3ULQW7[W�%\9DO�LS�$V�6WULQJ����������WH[W%R[��7H[W� �7H[W%R[��7H[W��LS��FKU������FKU���������(QG�6XE������� �����5(*8/$5�:,1'2:6��1(7�678))����� ��5HJLRQ���:LQGRZV�)RUP�'HVLJQHU�JHQHUDWHG�FRGH��������5HTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����3ULYDWH�FRPSRQHQWV�$V�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU�����3ULYDWH�:LWK(YHQWV�%XWWRQ��$V�6\VWHP�:LQ)RUPV�%XWWRQ�����3ULYDWH�:LWK(YHQWV�%XWWRQ��$V�6\VWHP�:LQ)RUPV�%XWWRQ�����3ULYDWH�:LWK(YHQWV�7H[W%R[��$V�6\VWHP�:LQ)RUPV�7H[W%R[������'LP�:LWK(YHQWV�+RRNB7U\��$V�6\VWHP�:LQ)RUPV�)RUP������127(��7KH�IROORZLQJ�SURFHGXUH�LV�UHTXLUHG�E\�WKH�:LQGRZV�)RUP�'HVLJQHU�����,W�FDQ�EH�PRGLILHG�XVLQJ�WKH�:LQGRZV�)RUP�'HVLJQHU������'R�QRW�PRGLI\�LW�XVLQJ�WKH�FRGH�HGLWRU������3ULYDWH�6XE�,QLWLDOL]H&RPSRQHQW�������������0H�FRPSRQHQWV� �1HZ�6\VWHP�&RPSRQHQW0RGHO�&RQWDLQHU�������������0H�%XWWRQ�� �1HZ�6\VWHP�:LQ)RUPV�%XWWRQ�������������0H�%XWWRQ�� �1HZ�6\VWHP�:LQ)RUPV�%XWWRQ�������������0H�7H[W%R[�� �1HZ�6\VWHP�:LQ)RUPV�7H[W%R[��������������#GHVLJQ�0H�7UD\+HLJKW� �����������#GHVLJQ�0H�7UD\/DUJH,FRQ� �)DOVH���������#GHVLJQ�0H�7UD\$XWR$UUDQJH� �7UXH���������%XWWRQ��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW���������������%XWWRQ��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H�����������������%XWWRQ��7DE,QGH[� �����������%XWWRQ��7H[W� ��+RRN���

Page 569: Visual Basic - Subclassing and Hooking with VB & VB NET

��������%XWWRQ��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW����������������%XWWRQ��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H�����������������%XWWRQ��7DE,QGH[� �����������%XWWRQ��7H[W� ��8Q+RRN�����������7H[W%R[��/RFDWLRQ� �1HZ�6\VWHP�'UDZLQJ�3RLQW����������������7H[W%R[��0XOWLOLQH� �7UXH���������7H[W%R[��6FUROO%DUV� �6\VWHP�:LQ)RUPV�6FUROO%DUV�%RWK���������7H[W%R[��7DE,QGH[� �����������7H[W%R[��6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H��������������������0H�7H[W� ��9%�1(7�+RRNLQJ�([DPSOH����������0H�$XWR6FDOH%DVH6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H����������������0H�&OLHQW6L]H� �1HZ�6\VWHP�'UDZLQJ�6L]H��������������������0H�&RQWUROV�$GG�%XWWRQ�����������0H�&RQWUROV�$GG�%XWWRQ�����������0H�&RQWUROV�$GG�7H[W%R[�������(QG�6XE���(QG�5HJLRQ������)RUP�RYHUULGHV�GLVSRVH�WR�FOHDQ�XS�WKH�FRPSRQHQW�OLVW������3XEOLF�2YHUULGHV�6XE�'LVSRVH�������������0\%DVH�'LVSRVH�������������FRPSRQHQWV�'LVSRVH���������(QG�6XE����� ����(9(17�+$1'/(56�)25�%87721�&21752/6���� ����3URWHFWHG�6XE�%XWWRQ�B&OLFN�%\9DO�VHQGHU�$V�2EMHFW��%\9DO�H�$V�6\VWHP�(YHQW$UJV����������,QVWDOO�KRRN���������K+RRN� �6HW:LQGRZV+RRN([�:+B0286(��FE�����DSSGRPDLQ�*HW&XUUHQW7KUHDG,G����������PVJER[�K+RRN������(QG�6XE�����3URWHFWHG�6XE�%XWWRQ�B&OLFN�%\9DO�VHQGHU�$V�2EMHFW��%\9DO�H�$V�6\VWHP�(YHQW$UJV����������5HOHDVH�KRRN���������PVJER[�8QKRRN:LQGRZV+RRN([�K+RRN�����������K+RRN� ���

Page 570: Visual Basic - Subclassing and Hooking with VB & VB NET

����(QG�6XE�(QG�&ODVV�8VLQJ�VWUXFWXUHV�LQ�SODFH�RI�XVHU�GHILQHG�W\SHV�LV�DFWXDOO\�QRW�D�PDMRU�FKDQJH��7KH�PDLQ�WKLQJ�WKDW�\RX�PXVW�GR�LV�LQVWDQWLDWH�WKH�VWUXFWXUH��ZKLFK�\RX�GLG�QRW�KDYH�WR�GR�ZKHQ�XVLQJ�XVHU�GHILQHG�W\SHV��7KH�0286(+22.6758&7�VWUXFWXUH�IRU�WKH�:+B0286(�KRRN�LV�LQVWDQWLDWHG�LQ�WKH�+RRN3URF�IXQFWLRQ���7KH�ILUVW�PRGLILFDWLRQ�WKDW�ZH�QHHG�WR�PDNH�WR�WKH�SUHYLRXV�:+B.(<%2$5'�KRRN�FRGH�WR�FRQYHUW�LW�WR�XVH�WKH�:+B0286(�KRRN�LV�ORFDWHG�LQ�WKH�PRG��PRGXOH��:H�QHHG�WR�GHFODUH�WKH�IDPLOLDU�&RS\0HPRU\�$3,�IXQFWLRQ��2QFH�DJDLQ��WKLV�IXQFWLRQ�LV�XVHG�WR�REWDLQ�D�VWUXFWXUH�IURP�D�SRLQWHU�WKDW�WKH�ILOWHU�IXQFWLRQ�UHWXUQV��:H�ZLOO�VHH�PRUH�RI�WKLV�LQ�D�PRPHQW��1H[W��WKH�:+B0286(�FRQVWDQW�LV�GHFODUHG��DORQJ�ZLWK�WKH�32,17$3,�DQG�0286(+22.6758&7�VWUXFWXUHV���7KH�QH[W�PRGLILFDWLRQ�LV�LQ�WKH�+RRN3URF�ILOWHU�IXQFWLRQ��7KH�IROORZLQJ�WZR�OLQHV�RI�FRGH�DUH�XVHG�WR�JHW�D�VWUXFWXUH�IURP�D�SRLQWHU�FRQWDLQHG�LQ�WKH�O3DUDP�SDUDPHWHU����'LP�'HVW�$V�1HZ�PRG��0286(+22.6758&7�����&RS\0HPRU\�'HVW��O3DUDP��VL]HRI�'HVW���7KH�ILUVW�OLQH�FUHDWHV�D�QHZ�LQVWDQFH�RI�WKH�0286(+22.6758&7�VWUXFWXUH�GHILQHG�LQ�WKH�PRG��PRGXOH��1RZ�WKDW�WKH�'HVW�VWUXFWXUH�LV�FUHDWHG�LQ�PHPRU\��ZH�FDQ�XVH�WKH�&RS\0HPRU\�IXQFWLRQ�WR�FRS\�LQWR�WKH�'HVW�VWUXFWXUH�WKH�EORFN�RI�PHPRU\�WKDW�WKH�O3DUDP�SDUDPHWHU�SRLQWV�WR��$W�WKLV�SRLQW��ZH�FDQ�XVH�WKH�'HVW�VWUXFWXUH�WR�DFFHVV�LWV�PHPEHUV��DV�LQ�WKH�IROORZLQJ�OLQH�RI�FRGH����7KH:LQ�3ULQW7[W�'HVW�KZQG���������'HVW�SW�[���������'HVW�SW�\���������B�����������������'HVW�Z+LW7HVW&RGH��$IWHU�WKH�'HVW�VWUXFWXUH�JRHV�RXW�RI�VFRSH��LW�LV�PDUNHG�IRU�JDUEDJH�FROOHFWLRQ��7KH�PHPRU\�IRU�WKH�'HVW�VWUXFWXUH�LV�DXWRPDWLFDOO\�IUHHG�DW�D�ODWHU�WLPH��ZKHQ�WKH�*DUEDJH�&ROOHFWRU�UXQV���:H�PDNH�RXU�ILQDO�PRGLILFDWLRQ�WR�WKH�ILUVW�SDUDPHWHU�LQ�WKH�FDOO�WR�6HW:LQGRZV+RRN([�ZLWKLQ�WKH�%XWWRQ�B&OLFN�HYHQW��7KH�:+B0286(�FRQVWDQW�LV�VXEVWLWXWHG�IRU�WKH�:+B.(<%2$5'�FRQVWDQW���$V�\RX�FDQ�VHH��WKHUH�LV�VRPH�PRUH�ZRUN�LQYROYHG�ZLWK�XVLQJ�KRRNV�LQ�9%�1(7��7KH�PDMRULW\�RI�WKLV�ZRUN�LV�LQ�ZULWLQJ�WKH�GHOHJDWH�WKDW�FRQWDLQV�WKH�SRLQWHU�WR�WKH�ILOWHU�IXQFWLRQ��6RPH�H[WUD�ZRUN�DOVR�LV�QHHGHG�ZKHQ�WKH�ILOWHU�IXQFWLRQ�FRQWDLQV�D�SRLQWHU�WR�D�VWUXFWXUH�LQ�RQH�RU�PRUH�RI�LWV�SDUDPHWHUV���+RRNV�FDQ�EH�MXVW�DV�SRZHUIXO�DV�WKH\�ZHUH�LQ�SUHYLRXV�YHUVLRQV�RI�9%��,W�LV�LPSHUDWLYH�WKDW�\RX�EH�DZDUH�RI�WKH�SLWIDOOV�RI�KRRNV����ZKLFK�DUH�RXWOLQHG�LQ�&KDSWHU������EHIRUH�\RX�VWDUW�LPSOHPHQWLQJ�KRRNV�LQ�\RXU�RZQ�DSSOLFDWLRQV��)DLOLQJ�WR�KHHG�WKHVH�ZDUQLQJV�FDQ�FDXVH�\RXU�DSSOLFDWLRQ�WR�IDLO�RU��DW�EHVW��RSHUDWH�LQHIILFLHQWO\���

Page 571: Visual Basic - Subclassing and Hooking with VB & VB NET

3DUW�9��$SSHQGL[HV�7KLV�VHFWLRQ�FRQWDLQV�WKUHH�DSSHQGL[HV�WKDW�OLVW�:LQGRZV�PHVVDJHV�WKDW�\RXUH�OLNHO\�WR�HQFRXQWHU�DQG�ZDQW�WR�KDQGOH�LQ�\RXU�RZQ�VXEFODVVLQJ�DQG�KRRNLQJ�DSSOLFDWLRQV��:LQ���$3,�FDOOV�XVHG�LQ�WKLV�ERRN��DQG�FRQVWDQWV�DQG�VWUXFWXUHV�XVHG�LQ�WKHVH�$3,�FDOOV��+HQFH��WKHVH�DSSHQGL[HV�VHUYH�DV�D�KDQG\�UHIHUHQFH�WKDW�\RX�FDQ�XVH�WR�ORRN�XS�GHWDLOV�ZKLOH�\RXUH�ZULWLQJ�FRGH�WR�SHUIRUP�VXEFODVVLQJ�RU�KRRNLQJ���

Page 572: Visual Basic - Subclassing and Hooking with VB & VB NET

$SSHQGL[�$��0HVVDJHV�7KLV�DSSHQGL[�OLVWV�WKH�PHVVDJHV�XVHG�LQ�WKLV�ERRN��

$���:LQGRZ�0HVVDJHV�

Public Const WM_NULL = &H0 � �

� �Z3DUDP

8QXVHG��O3DUDP

8QXVHG��Description

7KLV�PHVVDJH�GRHV�QRW�DIIHFW�WKH�V\VWHP��Return Value

1RW�XVHG��

Public Const WM_CREATE = &H1 � �

� �Z3DUDP

8QXVHG��O3DUDP

3RLQWHU�WR�D�&5($7(6758&7�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

6HQW�LQ�UHVSRQVH�WR�D�FDOO�WR�HLWKHU�WKH�&UHDWH:LQGRZ([�RU�&UHDWH:LQGRZ�$3,�IXQFWLRQ��GHILQHG�LQ�$SSHQGL[�%��

Return Value

�WR�FRQWLQXH�ZLQGRZ�FUHDWLRQ�����WR�FDQFHO�ZLQGRZ�FUHDWLRQ�VR�WKDW�&UHDWH:LQGRZ([�UHWXUQV�D�18//��

Public Const WM_DESTROY = &H2 � �

� �Z3DUDP

Page 573: Visual Basic - Subclassing and Hooking with VB & VB NET

8QXVHG��O3DUDP

8QXVHG��Description

6HQW�WR�D�ZLQGRZ�ZKHQ�LW�LV�EHLQJ�GHVWUR\HG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_MOVE = &H3 � �

� �Z3DUDP

8QXVHG��O3DUDP

/RZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�WRS�RI�WKH�ZLQGRZ��KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�WRS�RI�WKH�ZLQGRZ��

Description

6HQW�DIWHU�WKH�ZLQGRZ�LV�PRYHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_SIZE = &H5 � �

� �Z3DUDP

6SHFLILHV�WKH�W\SH�RI�UHVL]LQJ��O3DUDP

/RZ�RUGHU�ZRUG�FRQWDLQV�WKH�ILQDO�ZLGWK�RI�WKH�ZLQGRZ��KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�ILQDO�KHLJKW�RI�WKH�ZLQGRZ��

Description

6HQW�DIWHU�WKH�ZLQGRZ�LV�UHVL]HG��FDQ�EH�DQ\�RQH�RI�WKH�IROORZLQJ�FRQVWDQWV��GHILQHG�LQ�$SSHQGL[�&��6,=(B0$;+,'(

6,=(B0$;,0,=('

6,=(B0$;6+2:

6,=(B0,1,0,=('

6,=(B5(6725(' Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_ACTIVATE = &H6 � �

Page 574: Visual Basic - Subclassing and Hooking with VB & VB NET

� �Z3DUDP

/RZ�RUGHU�ZRUG�FDQ�EH�RQH�RI�WKH�IROORZLQJ�FRQVWDQWV��GHILQHG�LQ�$SSHQGL[�&��:$B$&7,9(

:$B&/,&.$&7,9(

:$B,1$&7,9(

7KH�KLJK�RUGHU�ZRUG�FRQWDLQV�D�LI�WKH�ZLQGRZ�LV�PLQLPL]HG��D�QRQ]HUR�YDOXH�RWKHUZLVH��

O3DUDP

K:QG�RI�WKH�ZLQGRZ�EHLQJ�DFWLYDWHG�RU�GHDFWLYDWHG��Description

6HQW�WR�WKH�ZLQGRZ�EHLQJ�GHDFWLYDWHG�DQG�WKHQ�WR�WKH�ZLQGRZ�EHLQJ�DFWLYDWHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_SETFOCUS = &H7 � �

� �Z3DUDP

K:QG�RI�WKH�ZLQGRZ�WKDW�ORVW�WKH�NH\ERDUG�IRFXV��O3DUDP

8QXVHG��Description

6HQW�WR�D�ZLQGRZ�WKDW�JDLQHG�WKH�NH\ERDUG�IRFXV��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_KILLFOCUS = &H8 � �

� �Z3DUDP

K:QG�RI�WKH�ZLQGRZ�WKDW�UHFHLYHG�WKH�NH\ERDUG�IRFXV��O3DUDP

8QXVHG��Description

6HQW�WR�D�ZLQGRZ�EHIRUH�ORVLQJ�WKH�NH\ERDUG�IRFXV��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Page 575: Visual Basic - Subclassing and Hooking with VB & VB NET

Public Const WM_SETTEXT = &HC � �

� �Z3DUDP

8QXVHG��O3DUDP

3RLQWHU�WR�D�QXOO�WHUPLQDWHG�VWULQJ�FRQWDLQLQJ�WKH�ZLQGRZV�WH[W��Description

)RUFHV�WKH�ZLQGRZV�WH[W�WR�EH�GUDZQ�RQ�WKH�ZLQGRZV�FDSWLRQ��Return Value

7UXH�ZKHQ�WKH�WH[W�LV�VXFFHVVIXOO\�GUDZQ��)DOVH�RWKHUZLVH��

Public Const WM_PAINT = &HF � �

� �Z3DUDP

8QXVHG��O3DUDP

8QXVHG��Description

6HQW�WR�LQIRUP�WKH�ZLQGRZ�WR�UHSDLQW�DOO�RU�SDUW�RI�LWVHOI��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_QUIT = &H12 � �

� �Z3DUDP

&RQWDLQV�DQ�H[LW�FRGH�WKDW�KH�3RVW4XLW0HVVDJH�$3,�IXQFWLRQ�SURYLGHV��ZKLFK�LV�GHILQHG�LQ�$SSHQGL[�%��

O3DUDP

8QXVHG��Description

&DXVHV�DQ�DSSOLFDWLRQ�WR�VKXW�GRZQ��VHQW�LQ�UHVSRQVH�WR�D�FDOO�WR�WKH�3RVW4XLW0HVVDJH�$3,�IXQFWLRQ��

Return Value

8QXVHG��

Public Const WM_ERASEBKGND = &H14 � �

Page 576: Visual Basic - Subclassing and Hooking with VB & VB NET

� �Z3DUDP

7KH�ZLQGRZV�GHYLFH�FRQWH[W�KDQGOH��O3DUDP

8QXVHG��Description

6HQW�WR�LQGLFDWH�WKDW�WKH�ZLQGRZV�EDFNJURXQG�VKRXOG�EH�HUDVHG��Return Value

1RQ]HUR�LI�WKH�EDFNJURXQG�LV�HUDVHG��RWKHUZLVH�D�]HUR�LV�UHWXUQHG��

Public Const WM_SHOWWINDOW = &H18 � �

� �Z3DUDP

7UXH�LI�WKH�ZLQGRZ�LV�EHLQJ�VKRZQ��)DOVH�RWKHUZLVH��O3DUDP

6WDWXV�RI�WKH�ZLQGRZ�WKDW�LV�VKRZQ��FDQ�EH�RQH�RI�WKH�IROORZLQJ�YDOXHV��GHILQHG�LQ�$SSHQGL[�&��6:B27+(581=220

6:B27+(5=220

6:B3$5(17&/26,1*

6:B3$5(1723(1,1* Description

6HQW�WR�D�ZLQGRZ�EHIRUH�LW�LV�VKRZQ�RU�KLGGHQ��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_SETCURSOR = &H20 � �

� �Z3DUDP

K:QG�RI�WKH�ZLQGRZ�WKDW�WKH�PRXVH�FXUVRU�LV�RYHU��O3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�KLW�WHVW�FRGH��WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�PHVVDJH�,'��

Description

6HQW�ZKHQ�D�PRXVH�PRYHV�RYHU�D�ZLQGRZ�WKDW�FXUUHQWO\�GRHV�QRW�KDYH�WKH�PRXVH�FDSWXUH��

Return Value

Page 577: Visual Basic - Subclassing and Hooking with VB & VB NET

7UXH�RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��)DOVH�RWKHUZLVH��

Public Const WM_QUEUESYNC = &H23 � �

� �Z3DUDP

8QXVHG��O3DUDP

8QXVHG��Description

6HQW�E\�DQ�DSSOLFDWLRQ�LPSOHPHQWLQJ�D�:+B&%7�KRRN�WR�GLVWLQJXLVK�EHWZHHQ�XVHU�LQSXW�DQG�LQSXW�SOD\HG�EDFN�IURP�D�:+B-2851$/3/$<%$&.�KRRN��

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_GETMINMAXINFO = &H24 � �

� �Z3DUDP

8QXVHG��O3DUDP

3RLQWHU�WR�D�0,10$;,1)2�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

6HQW�WR�D�ZLQGRZ�EHIRUH�LWV�ORFDWLRQ�RU�VL]H�FKDQJHV��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_WINDOWPOSCHANGING = &H46 � �

� �Z3DUDP

8QXVHG��O3DUDP

3RLQWHU�WR�D�:,1'2:326�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

6HQW�WR�D�ZLQGRZ�EHIRUH�LWV�ORFDWLRQ��VL]H��RU�SRVLWLRQ�LQ�WKH�=�RUGHU�FKDQJHV��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_WINDOWPOSCHANGED = &H47 � �

Page 578: Visual Basic - Subclassing and Hooking with VB & VB NET

� �Z3DUDP

8QXVHG��O3DUDP

3RLQWHU�WR�D�:,1'2:326�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

6HQW�WR�D�ZLQGRZ�DIWHU�LWV�ORFDWLRQ��VL]H��RU�SRVLWLRQ�LQ�WKH�=�RUGHU�FKDQJHV��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_CANCELJOURNAL = &H4B � �

� �Z3DUDP

8QXVHG��O3DUDP

8QXVHG��Description

3RVWHG�WR�DQ�DSSOLFDWLRQ�ZKHQ�WKH�XVHU�FDQFHOV�D�MRXUQDOLQJ�KRRN��Return Value

8QXVHG��

Public Const WM_NCCREATE = &H81 � �

� �Z3DUDP

8QXVHG��O3DUDP

3RLQWHU�WR�D�&5($7(6758&7�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

6HQW�ZKHQ�WKH�QRQFOLHQW�DUHD�RI�D�ZLQGRZ�LV�FUHDWHG��Return Value

7UXH�WR�FRQWLQXH�WKH�ZLQGRZ�FUHDWLRQ��)DOVH�RWKHUZLVH��

Public Const WM_NCDESTROY = &H82 � �

� �Z3DUDP

Page 579: Visual Basic - Subclassing and Hooking with VB & VB NET

8QXVHG��O3DUDP

8QXVHG��Description

,QIRUPV�WKH�ZLQGRZ�WKDW�LWV�QRQFOLHQW�DUHD�LV�EHLQJ�GHVWUR\HG��6HQW�E\�WKH�'HVWUR\:LQGRZ�$3,�IXQFWLRQ��ZKLFK�LV�GHILQHG�LQ�$SSHQGL[�%��

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_NCCALCSIZE = &H83 � �

� �Z3DUDP

,I�7UXH��WKH�ZLQGRZ�QHHGV�WR�GHILQH�WKH�DUHD�WKDW�GRHV�QRW�QHHG�UHSDLQWLQJ��,I�)DOVH��WKH�HQWLUH�ZLQGRZ�LV�UHSDLQWHG��

O3DUDP

,I�Z3DUDP�LV�7UXH��WKLV�SDUDPHWHU�FRQWDLQV�D�SRLQWHU�WR�DQ�1&&$/&6,=(B3$5$06�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��,I�Z3DUDP�LV�)DOVH��WKLV�SDUDPHWHU�FRQWDLQV�D�SRLQWHU�WR�D�5(&7�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��

Description

,QGLFDWHV�WKDW�WKH�FOLHQW�DUHD�PXVW�EH�UHVL]HG��Return Value

,I�Z3DUDP�LV�7UXH��WKH�UHWXUQ�YDOXH�LV�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��:95B$/,*1723

:95B$/,*1/()7

:95B$/,*1%27720

:95B+5('5$:

:95B95('5$:

:95B5('5$:

:95B9$/,'5(&76

,I�Z3DUDP�LV�)DOVH��WKH�UHWXUQ�YDOXH�LV����

Public Const WM_NCHITTEST = &H84 � �

� �Z3DUDP

8QXVHG��O3DUDP

Page 580: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��7KH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��

Description

6HQW�ZKHQHYHU�WKH�PRXVH�SRLQWHU�LV�PRYHG�RU�D�PRXVH�EXWWRQ�LV�SUHVVHG�ZKLOH�RYHU�D�ZLQGRZ��

Return Value

,QGLFDWHV�WKH�JHQHUDO�ORFDWLRQ�RI�WKH�PRXVH�SRLQWHU�ZKLOH�RYHU�D�ZLQGRZ��LW�FDQ�EH�RQH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��

+7%25'(5

+7%27720

+7%27720/()7

+7%277205,*+7

+7&$737,21

+7&/,(17

+7&/26(

+7(5525

+7*52:%2;

+7�+(/3

+7+6&52//

+7/()7

+70(18

+70$;%87721

+70,1%87721

+712:+(5(

+75('8&(

+75,*+7

+76,=(

+76<60(18

177723

+7723/()7

+77235,*+7

+775$163$5(17

+796&52//

+7=220

Public Const WM_NCPAINT = &H85 � �

� �Z3DUDP

+DQGOH�WR�D�GHYLFH�FRQWH[W�IRU�WKH�ZLQGRZV�QRQFOLHQW�DUHD��

Page 581: Visual Basic - Subclassing and Hooking with VB & VB NET

O3DUDP

8QXVHG��Description

,QGLFDWHV�WKDW�WKH�ZLQGRZV�QRQFOLHQW�DUHD�PXVW�EH�UHSDLQWHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_NCACTIVATE = &H86 � �

� �Z3DUDP

,I�7UXH��WKH�QRQFOLHQW�DUHD�RI�D�ZLQGRZ�VKRXOG�EH�UHSDLQWHG�WR�LQGLFDWH�DQ�DFWLYH�ZLQGRZ��,I�)DOVH��WKH�QRQFOLHQW�DUHD�VKRXOG�EH�UHSDLQWHG�WR�LQGLFDWH�DQ�LQDFWLYH�VWDWH��

O3DUDP

8QXVHG��Description

,QGLFDWHV�WKDW�WKH�QRQFOLHQW�DUHD�RI�D�ZLQGRZ�VKRXOG�EH�UHSDLQWHG�WR�VKRZ�DQ�DFWLYH�RU�LQDFWLYH�VWDWH��

Return Value

,I�Z3DUDP�LV�7UXH��WKH�UHWXUQ�YDOXH�LV�QRW�XVHG��,I�Z3DUDP�LV�)DOVH��WKH�UHWXUQ�YDOXH�VKRXOG�EH�7UXH�LI�WKH�ZLQGRZ�VKRXOG�FRQWLQXH�WR�FKDQJH�VWDWH��RWKHUZLVH��D�)DOVH�VKRXOG�EH�UHWXUQHG�WR�VWRS�WKH�ZLQGRZ�IURP�FKDQJLQJ�VWDWH��

Public Const WM_GETDLGCODE = &H87 � �

� �Z3DUDP

8QXVHG��O3DUDP

3RLQWHU�WR�DQ�06*�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

,QGLFDWHV�ZKLFK�PHVVDJHV�D�FRQWURO�ZDQWV�WR�SURFHVV�LWVHOI�LQVWHDG�RI�KDYLQJ�WKH�V\VWHP�SURFHVV�WKHP��7KLV�PHVVDJH�LV�XVHG�RQO\�IRU�FRQWUROV�RQ�D�GLDORJ�ER[��

Return Value

,QGLFDWHV�WKH�W\SH�RI�LQSXW�PHVVDJHV�WKH�FRQWUROV�ZLQGRZ�SURFHGXUH�VKRXOG�SURFHVV��FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��'/*&B%87721

'/*&B'()386+%87721

'/*&B+$66(76(/

'/*&B5$',2%87721

Page 582: Visual Basic - Subclassing and Hooking with VB & VB NET

'/*&B67$7,&

'/*&B81'()386+%87721

'/*&B:$17$//.(<6

'/*&B:$17$552:6

'/*&B:$17&+$56

'/*&B:$170(66$*(

'/*&B:$177$%

Public Const WM_NCMOUSEMOVE = &HA0 � �

� �Z3DUDP

&RQWDLQV�D�KLW�WHVW�YDOXH��IRU�D�OLVW�RI�KLW�WHVW�YDOXHV�VHH�WKH�:0B1&+,77(67�PHVVDJH��

O3DUDP

3RLQWV�WR�D�32,176�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

3RVWHG�WR�D�ZLQGRZ�WR�LQGLFDWH�WKDW�WKH�PRXVH�LV�PRYLQJ�RYHU�WKH�ZLQGRZV�QRQFOLHQW�DUHD��

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_NCLBUTTONDOWN = &HA1 � �

� �Z3DUDP

&RQWDLQV�D�KLW�WHVW�YDOXH��IRU�D�OLVW�RI�KLW�WHVW�YDOXHV��VHH�WKH�:0B1&+,77(67�PHVVDJH��

O3DUDP

3RLQWV�WR�D�32,176�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

,QGLFDWHV�WKDW�WKH�OHIW�PRXVH�EXWWRQ�LV�SUHVVHG�ZKLOH�WKH�PRXVH�SRLQWHU�LV�RYHU�WKH�QRQFOLHQW�SRUWLRQ�RI�D�ZLQGRZ��

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_NCLBUTTONUP = &HA2 � �

� �

Page 583: Visual Basic - Subclassing and Hooking with VB & VB NET

Z3DUDP

&RQWDLQV�D�KLW�WHVW�YDOXH��IRU�D�OLVW�RI�KLW�WHVW�YDOXHV��VHH�WKH�:0B1&+,77(67�PHVVDJH��

O3DUDP

3RLQWV�WR�D�32,176�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

,QGLFDWHV�WKDW�WKH�OHIW�PRXVH�EXWWRQ�LV�UHOHDVHG�ZKLOH�WKH�PRXVH�SRLQWHU�LV�RYHU�WKH�QRQFOLHQW�SRUWLRQ�RI�D�ZLQGRZ��

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_NCLBUTTONDBLCLK = &HA3 � �

� �Z3DUDP

&RQWDLQV�D�KLW�WHVW�YDOXH��IRU�D�OLVW�RI�KLW�WHVW�YDOXHV��VHH�WKH�:0B1&+,77(67�PHVVDJH��

O3DUDP

3RLQWV�WR�D�32,176�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

,QGLFDWHV�WKDW�WKH�OHIW�PRXVH�EXWWRQ�LV�GRXEOH�FOLFNHG�ZKLOH�WKH�PRXVH�SRLQWHU�LV�RYHU�WKH�QRQFOLHQW�SRUWLRQ�RI�D�ZLQGRZ��

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_NCRBUTTONDOWN = &HA4 � �

� �Z3DUDP

&RQWDLQV�D�KLW�WHVW�YDOXH��IRU�D�OLVW�RI�KLW�WHVW�YDOXHV��VHH�WKH�:0B1&+,77(67�PHVVDJH��

O3DUDP

3RLQWV�WR�D�32,176�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

,QGLFDWHV�WKDW�WKH�ULJKW�PRXVH�EXWWRQ�LV�SUHVVHG�ZKLOH�WKH�PRXVH�SRLQWHU�LV�RYHU�WKH�QRQFOLHQW�SRUWLRQ�RI�D�ZLQGRZ��

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_NCRBUTTONUP = &HA5 � �

Page 584: Visual Basic - Subclassing and Hooking with VB & VB NET

� �Z3DUDP

&RQWDLQV�D�KLW�WHVW�YDOXH��IRU�D�OLVW�RI�KLW�WHVW�YDOXHV��VHH�WKH�:0B1&+,77(67�PHVVDJH��

O3DUDP

3RLQWV�WR�D�32,176�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

,QGLFDWHV�WKDW�WKH�ULJKW�PRXVH�EXWWRQ�LV�UHOHDVHG�ZKLOH�WKH�PRXVH�SRLQWHU�LV�RYHU�WKH�QRQFOLHQW�SRUWLRQ�RI�D�ZLQGRZ��

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_NCRBUTTONDBLCLK = &HA6 � �

� �Z3DUDP

&RQWDLQV�D�KLW�WHVW�YDOXH��IRU�D�OLVW�RI�KLW�WHVW�YDOXHV��VHH�WKH�:0B1&+,77(67�PHVVDJH��

O3DUDP

3RLQWV�WR�D�32,176�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

,QGLFDWHV�WKDW�WKH�ULJKW�PRXVH�EXWWRQ�LV�GRXEOH�FOLFNHG�ZKLOH�WKH�PRXVH�SRLQWHU�LV�RYHU�WKH�QRQFOLHQW�SRUWLRQ�RI�D�ZLQGRZ��

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_NCMBUTTONDOWN = &HA7 � �

� �Z3DUDP

&RQWDLQV�D�KLW�WHVW�YDOXH��IRU�D�OLVW�RI�KLW�WHVW�YDOXHV��VHH�WKH�:0B1&+,77(67�PHVVDJH��

O3DUDP

3RLQWV�WR�D�32,176�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

,QGLFDWHV�WKDW�WKH�PLGGOH�PRXVH�EXWWRQ�LV�SUHVVHG�ZKLOH�WKH�PRXVH�SRLQWHU�LV�RYHU�WKH�QRQFOLHQW�SRUWLRQ�RI�D�ZLQGRZ��

Return Value

Page 585: Visual Basic - Subclassing and Hooking with VB & VB NET

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_NCMBUTTONUP = &HA8 � �

� �Z3DUDP

&RQWDLQV�D�KLW�WHVW�YDOXH��IRU�D�OLVW�RI�KLW�WHVW�YDOXHV��VHH�WKH�:0B1&+,77(67�PHVVDJH��

O3DUDP

3RLQWV�WR�D�32,176�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

,QGLFDWHV�WKDW�WKH�PLGGOH�PRXVH�EXWWRQ�LV�UHOHDVHG�ZKLOH�WKH�PRXVH�SRLQWHU�LV�RYHU�WKH�QRQFOLHQW�SRUWLRQ�RI�D�ZLQGRZ��

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_NCMBUTTONDBLCLK = &HA9 � �

� �Z3DUDP

&RQWDLQV�D�KLW�WHVW�YDOXH��IRU�D�OLVW�RI�KLW�WHVW�YDOXHV��VHH�WKH�:0B1&+,77(67�PHVVDJH��

O3DUDP

3RLQWV�WR�D�32,176�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

,QGLFDWHV�WKDW�WKH�PLGGOH�PRXVH�EXWWRQ�LV�GRXEOH�FOLFNHG�ZKLOH�WKH�PRXVH�SRLQWHU�LV�RYHU�WKH�QRQFOLHQW�SRUWLRQ�RI�D�ZLQGRZ��

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_NCXBUTTONDOWN = &HAB � �

� �Z3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�D�KLW�WHVW�YDOXH��IRU�D�OLVW�RI�KLW�WHVW�YDOXHV��VHH�WKH�:0B1&+,77(67�PHVVDJH��7KH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�PRXVH�EXWWRQ�WKDW�ZDV�SUHVVHG��LW�FDQ�EH�RQH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��;%87721�

;%87721�

Page 586: Visual Basic - Subclassing and Hooking with VB & VB NET

O3DUDP

3RLQWV�WR�D�32,176�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

,QGLFDWHV�WKDW�HLWKHU�WKH�ILUVW�RU�VHFRQG�[�EXWWRQ�RQ�WKH�PRXVH�LV�SUHVVHG�ZKLOH�WKH�PRXVH�SRLQWHU�LV�RYHU�WKH�QRQFOLHQW�SRUWLRQ�RI�D�ZLQGRZ��

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_NCXBUTTONUP = &HAC � �

� �Z3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�D�KLW�WHVW�YDOXH��IRU�D�OLVW�RI�KLW�WHVW�YDOXHV��VHH�WKH�:0B1&+,77(67�PHVVDJH��7KH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�PRXVH�EXWWRQ�WKDW�ZDV�SUHVVHG��LW�FDQ�EH�RQH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��;%87721�

;%87721�

O3DUDP

3RLQWV�WR�D�32,176�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

,QGLFDWHV�WKDW�HLWKHU�WKH�ILUVW�RU�VHFRQG�[�EXWWRQ�RQ�WKH�PRXVH�LV�UHOHDVHG�ZKLOH�WKH�PRXVH�SRLQWHU�LV�RYHU�WKH�QRQFOLHQW�SRUWLRQ�RI�D�ZLQGRZ��

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_NCXBUTTONDBLCLK = &HAD � �

� �Z3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�D�KLW�WHVW�YDOXH��IRU�D�OLVW�RI�KLW�WHVW�YDOXHV��VHH�WKH�:0B1&+,77(67�PHVVDJH��7KH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�PRXVH�EXWWRQ�WKDW�ZDV�SUHVVHG��LW�FDQ�EH�RQH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��;%87721�

;%87721�

O3DUDP

3RLQWV�WR�D�32,176�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

,QGLFDWHV�WKDW�HLWKHU�WKH�ILUVW�RU�VHFRQG�[�EXWWRQ�RQ�WKH�PRXVH�LV�GRXEOH�FOLFNHG�ZKLOH�WKH�PRXVH�SRLQWHU�LV�RYHU�WKH�QRQFOLHQW�SRUWLRQ�RI�D�ZLQGRZ��

Return Value

Page 587: Visual Basic - Subclassing and Hooking with VB & VB NET

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_KEYDOWN = &H100 � �

� �Z3DUDP

&RQWDLQV�WKH�YLUWXDO�NH\�FRGH�RI�WKH�NH\�SUHVVHG��O3DUDP

&RQWDLQV�ELW�IODJV�IRU�WKH�NH\�SUHVVHG��7KH�ELW�IODJV�DUH�GHILQHG�DV�IROORZV��0-15

1XPEHU�RI�WLPHV�WKH�NH\�LV�UHSHDWHG�16-23

6FDQ�FRGH�24

,QGLFDWHV�LI�WKH�NH\�SUHVVHG�LV�DQ�H[WHQGHG�NH\�25-28

5HVHUYHG�29

$OZD\V���IRU�:0B.(<'2:1�PHVVDJHV�30

7KH�SUHYLRXV�NH\�VWDWH����LI�WKH�NH\�ZDV�DOUHDG\�SUHVVHG�EHIRUH�WKLV�PHVVDJH�ZDV�SRVWHG��RWKHUZLVH�

31

$OZD\V���IRU�:0B.(<'2:1�PHVVDJHV�Description

3RVWHG�WR�D�ZLQGRZ�LQGLFDWLQJ�WKDW�D�QRQ�V\VWHP�NH\�ZDV�SUHVVHG��D�QRQV\VWHP�NH\�LV�RQH�WKDW�LV�SUHVVHG�ZKLOH�WKH�$/7�NH\�LV�QRW�EHLQJ�SUHVVHG���

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_KEYUP = &H101 � �

� �Z3DUDP

&RQWDLQV�WKH�YLUWXDO�NH\�FRGH�RI�WKH�NH\�UHOHDVHG��O3DUDP

&RQWDLQV�ELW�IODJV�IRU�WKH�NH\�UHOHDVHG��7KH�ELW�IODJV�DUH�GHILQHG�DV�IROORZV��0-15

1XPEHU�RI�WLPHV�WKH�NH\�LV�UHSHDWHG�16-23

6FDQ�FRGH�24

,QGLFDWHV�LI�WKH�NH\�SUHVVHG�LV�DQ�H[WHQGHG�NH\�

Page 588: Visual Basic - Subclassing and Hooking with VB & VB NET

25-28

5HVHUYHG�29

$OZD\V���IRU�:0B.(<83�PHVVDJHV�30

$OZD\V���IRU�:0B.(<83�PHVVDJHV�31

$OZD\V���IRU�:0B.(<83�PHVVDJHV�Description

3RVWHG�WR�D�ZLQGRZ�WR�LQGLFDWH�WKDW�D�QRQV\VWHP�NH\�ZDV�SUHVVHG��D�QRQV\VWHP�NH\�LV�RQH�WKDW�LV�SUHVVHG�ZKLOH�WKH�$/7�NH\�LV�QRW�EHLQJ�SUHVVHG���

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_CHAR = &H102 � �

� �Z3DUDP

&RQWDLQV�WKH�YLUWXDO�NH\�FRGH�RI�WKH�NH\�SUHVVHG��O3DUDP

&RQWDLQV�ELW�IODJV�IRU�WKH�NH\�SUHVVHG��7KH�ELW�IODJV�DUH�DV�IROORZV��0-15

1XPEHU�RI�WLPHV�WKH�NH\�LV�UHSHDWHG�16-23

6FDQ�FRGH�24

,QGLFDWHV�LI�WKH�NH\�SUHVVHG�LV�DQ�H[WHQGHG�NH\�25-28

5HVHUYHG�29

��LI�WKH�$/7�NH\�LV�SUHVVHG�DORQJ�ZLWK�WKLV�NH\����RWKHUZLVH�30

7KH�SUHYLRXV�NH\�VWDWH����LI�WKH�NH\�ZDV�DOUHDG\�SUHVVHG�EHIRUH�WKLV�PHVVDJH�ZDV�SRVWHG����RWKHUZLVH�31

��LI�WKH�NH\�LV�UHOHDVHG����RWKHUZLVH�Description

3RVWHG�WR�D�ZLQGRZ�WR�LQGLFDWH�WKDW�D�QRQV\VWHP�NH\�ZDV�SUHVVHG��D�QRQV\VWHP�NH\�LV�RQH�WKDW�LV�SUHVVHG�ZKLOH�WKH�$/7�NH\�LV�QRW�EHLQJ�SUHVVHG���

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_SYSKEYDOWN = &H104 � �

Page 589: Visual Basic - Subclassing and Hooking with VB & VB NET

� �Z3DUDP

&RQWDLQV�WKH�YLUWXDO�NH\�FRGH�RI�WKH�NH\�SUHVVHG��O3DUDP

&RQWDLQV�ELW�IODJV�IRU�WKH�NH\�SUHVVHG��7KH�ELW�IODJV�DUH�DV�IROORZV��0-15

1XPEHU�RI�WLPHV�WKH�NH\�LV�UHSHDWHG�16-23

6FDQ�FRGH�24

,QGLFDWHV�LI�WKH�NH\�SUHVVHG�LV�DQ�H[WHQGHG�NH\�25-28

5HVHUYHG�29

$OZD\V���IRU�:0B6<6.(<'2:1�PHVVDJHV�30

7KH�SUHYLRXV�NH\�VWDWH����LI�WKH�NH\�ZDV�DOUHDG\�SUHVVHG�EHIRUH�WKLV�PHVVDJH�ZDV�SRVWHG����RWKHUZLVH�31

$OZD\V���IRU�:0B6<6.(<'2:1�PHVVDJHV�Description

3RVWHG�WR�D�ZLQGRZ�LQGLFDWLQJ�WKDW�D�V\VWHP�NH\�ZDV�SUHVVHG��D�V\VWHP�NH\�LV�WKH�)���NH\�RU�RQH�WKDW�LV�SUHVVHG�ZKLOH�WKH�$/7�NH\�LV�EHLQJ�SUHVVHG���

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_SYSKEYUP = &H105 � �

� �Z3DUDP

&RQWDLQV�WKH�YLUWXDO�NH\�FRGH�RI�WKH�NH\�UHOHDVHG��O3DUDP

&RQWDLQV�ELW�IODJV�IRU�WKH�NH\�UHOHDVHG��7KH�ELW�IODJV�DUH�GHILQHG�DV�IROORZV��0-15

1XPEHU�RI�WLPHV�WKH�NH\�LV�UHSHDWHG�16-23

6FDQ�FRGH�24

,QGLFDWHV�LI�WKH�NH\�SUHVVHG�LV�DQ�H[WHQGHG�NH\�25-28

5HVHUYHG�29

$OZD\V���IRU�:0B6<6.(<83�PHVVDJHV�

Page 590: Visual Basic - Subclassing and Hooking with VB & VB NET

30

$OZD\V���IRU�:0B6<6.(<83�PHVVDJHV�31

$OZD\V���IRU�:0B6<6.(<83�PHVVDJHV�Description

3RVWHG�WR�D�ZLQGRZ�WR�LQGLFDWH�WKDW�D�V\VWHP�NH\�ZDV�UHOHDVHG��D�V\VWHP�NH\�LV�WKH�)���NH\�RU�RQH�WKDW�LV�SUHVVHG�ZKLOH�WKH�$/7�NH\�LV�EHLQJ�SUHVVHG���

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_SYSCHAR = &H106 � �

� �Z3DUDP

&RQWDLQV�WKH�YLUWXDO�NH\�FRGH�RI�WKH�NH\�SUHVVHG��O3DUDP

&RQWDLQV�ELW�IODJV�IRU�WKH�NH\�SUHVVHG��7KH�ELW�IODJV�DUH�DV�IROORZV��0-15

1XPEHU�RI�WLPHV�WKH�NH\�LV�UHSHDWHG�16-23

6FDQ�FRGH�24

,QGLFDWHV�LI�WKH�NH\�SUHVVHG�LV�DQ�H[WHQGHG�NH\�25-28

5HVHUYHG�29

��LI�WKH�$/7�NH\�LV�SUHVVHG�DORQJ�ZLWK�WKLV�NH\����RWKHUZLVH�30

7KH�SUHYLRXV�NH\�VWDWH����LI�WKH�NH\�ZDV�DOUHDG\�SUHVVHG�EHIRUH�WKLV�PHVVDJH�ZDV�SRVWHG����RWKHUZLVH�31

��LI�WKH�NH\�LV�UHOHDVHG����RWKHUZLVH�Description

3RVWHG�WR�D�ZLQGRZ�WR�LQGLFDWH�WKDW�D�V\VWHP�NH\�ZDV�SUHVVHG��D�V\VWHP�NH\�LV�WKH�)���NH\�RU�RQH�WKDW�LV�SUHVVHG�ZKLOH�WKH�$/7�NH\�LV�EHLQJ�SUHVVHG���

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_INITDIALOG = &H110 � �

� �Z3DUDP

K:QG�RI�WKH�FRQWURO�WKDW�VKRXOG�UHFHLYH�WKH�LQLWLDO�IRFXV��

Page 591: Visual Basic - Subclassing and Hooking with VB & VB NET

O3DUDP

&RQWDLQV�DGGLWLRQDO�LQIRUPDWLRQ��Description

6HQW�WR�WKH�GLDORJ�ER[�EHIRUH�LW�LV�GLVSOD\HG��Return Value

7UXH�LI�WKH�IRFXV�VKRXOG�EH�VHW�WR�WKH�FRQWURO�VSHFLILHG�LQ�Z3DUDP��RWKHUZLVH��D�)DOVH�VKRXOG�EH�UHWXUQHG��

Public Const WM_COMMAND = &H111 � �

� �Z3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�PHQX�LWHP��DFFHOHUDWRU�NH\��RU�FRQWURO�,'��7KH�KLJK�RUGHU�ZRUG�LQGLFDWHV�ZKHWKHU�WKH�QRWLILFDWLRQ�PHVVDJH�LV�IURP�DQ�DFFHOHUDWRU�NH\��FRQWURO��RU�PHQX�LWHP��

O3DUDP

K:QG�RI�WKH�FRQWURO�VHQGLQJ�WKH�QRWLILFDWLRQ�PHVVDJH��Description

6HQW�LI�DQ�DFFHOHUDWRU�NH\�LV�SUHVVHG��D�FRPPDQG�PHQX�LWHP�LV�VHOHFWHG��RU�D�FRQWURO�VHQGV�D�QRWLILFDWLRQ�PHVVDJH�WR�LWV�SDUHQW��

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_SYSCOMMAND = &H112 � �

� �Z3DUDP

,QGLFDWHV�WKH�DFWLRQ�LQLWLDWHG�E\�WKH�XVHU��FDQ�EH�RQH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��6&B&/26(

6&B&217(;7+(/3

6&B'()$8/7

6&B+27.(<

6&B+6&52//

6&B.(<0(18

6&B0$;,0,=(

6&B0,1,0,=(

6&B021,72532:(5

6&B0286(0(18

6&B029(

Page 592: Visual Basic - Subclassing and Hooking with VB & VB NET

6&B1(;7:,1'2:

6&B35(9:,1'2:

6&B5(6725(

6&B6&5((16$9(

6&B6,=(

6&B7$6./,67

6&B96&52//

O3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU�LI�D�PHQX�LWHP�LV�VHOHFWHG��RWKHUZLVH��LW�LV�QRW�XVHG��7KH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU�LI�D�PHQX�LWHP�LV�VHOHFWHG�E\�WKH�PRXVH��LW�LV����LI�DQ�DFFHOHUDWRU�LV�XVHG�WR�DFFHVV�WKH�PHQX�LWHP��RU�LW�LV�LI�D�PQHPRQLF�LV�XVHG�WR�DFFHVV�WKH�PHQX�LWHP��

Description

6HQW�ZKHQ�D�PHQX�LWHP�LV�VHOHFWHG�IURP�WKH�:LQGRZ�PHQX��WKH�0LQLPL]H�EXWWRQ�LV�FOLFNHG��WKH�0D[LPL]H�EXWWRQ�LV�FOLFNHG��WKH�5HVWRUH�EXWWRQ�LV�FOLFNHG��RU�WKH�&ORVH�EXWWRQ�LV�FOLFNHG��

Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_ENTERIDLE = &H121 � �

� �Z3DUDP

,QGLFDWHV�ZKHWKHU�WKH�ZLQGRZ�LV�HQWHULQJ�WKH�LGOH�VWDWH�GXH�WR�D�PHQX�LWHP�RU�GLDORJ�ER[�EHLQJ�GLVSOD\HG��FDQ�EH�RQH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��06*)B',$/2*%2;

06*)B0(18

O3DUDP

K:QG�WR�WKH�GLDORJ�ER[�RU�PHQX��Description

6HQW�WR�D�ZLQGRZ�WKDW�LV�HQWHULQJ�WKH�LGOH�VWDWH��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_CTLCOLOREDIT = &H133 � �

� �Z3DUDP

7KH�HGLW�FRQWUROV�GHYLFH�FRQWH[W�KDQGOH��O3DUDP

Page 593: Visual Basic - Subclassing and Hooking with VB & VB NET

K:QG�RI�WKH�HGLW�FRQWURO��Description

6HQW�WR�WKH�SDUHQW�ZLQGRZ�RI�D�FRQWURO�WR�LQGLFDWH�WKDW�LW�LV�JRLQJ�WR�UHSDLQW�LWVHOI��Return Value

7KH�EUXVK�KDQGOH��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_CTLCOLORLISTBOX = &H134 � �

� �Z3DUDP

7KH�OLVW�ER[V�GHYLFH�FRQWH[W�KDQGOH��O3DUDP

K:QG�RI�OLVW�ER[�FRQWURO��Description

6HQW�WR�WKH�SDUHQW�ZLQGRZ�RI�D�FRQWURO�WR�LQGLFDWH�WKDW�WKH�FRQWURO�LV�JRLQJ�WR�UHSDLQW�LWVHOI��

Return Value

7KH�EUXVK�KDQGOH��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_CTLCOLORBTN = &H135 � �

� �Z3DUDP

7KH�EXWWRQV�GHYLFH�FRQWH[W�KDQGOH��O3DUDP

K:QG�RI�WKH�EXWWRQ�FRQWURO��Description

6HQW�WR�WKH�SDUHQW�ZLQGRZ�RI�D�FRQWURO�WR�LQGLFDWH�WKDW�LW�LV�JRLQJ�WR�UHSDLQW�LWVHOI��Return Value

7KH�EUXVK�KDQGOH��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_CTLCOLORDLG = &H136 � �

� �Z3DUDP

7KH�GLDORJ�ER[V�GHYLFH�FRQWH[W�KDQGOH��O3DUDP

K:QG�RI�WKH�GLDORJ�ER[��Description

6HQW�WR�WKH�GLDORJ�ER[�WR�LQGLFDWH�WKDW�LW�LV�JRLQJ�WR�UHSDLQW�LWVHOI��Return Value

Page 594: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�EUXVK�KDQGOH��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_CTLCOLORSCROLLBAR = &H137 � �

� �Z3DUDP

7KH�VFUROOEDUV�GHYLFH�FRQWH[W�KDQGOH��O3DUDP

K:QG�RI�WKH�VFUROOEDU�FRQWURO��Description

6HQW�WR�WKH�SDUHQW�ZLQGRZ�RI�D�FRQWURO�WR�LQGLFDWH�WKDW�LW�LV�JRLQJ�WR�UHSDLQW�LWVHOI��Return Value

7KH�EUXVK�KDQGOH��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_CTLCOLORSTATIC = &H138 � �

� �Z3DUDP

$�VWDWLF�FRQWUROV�GHYLFH�FRQWH[W�KDQGOH��O3DUDP

K:QG�RI�D�VWDWLF�FRQWURO��Description

6HQW�WR�WKH�SDUHQW�ZLQGRZ�RI�D�FRQWURO�WR�LQGLFDWH�WKDW�LW�LV�JRLQJ�WR�UHSDLQW�LWVHOI��Return Value

7KH�EUXVK�KDQGOH��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_MOUSEMOVE = &H200 � �

� �Z3DUDP

&RQWDLQV�WKH�YLUWXDO�NH\V�SUHVVHG�ZKHQ�WKLV�PHVVDJH�LV�SRVWHG��FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��0.B&21752/

0.B/%87721

0.B5%87721

0.B0%87721

0.B6+,)7

0.B;%87721�

0.B;%87721�

Page 595: Visual Basic - Subclassing and Hooking with VB & VB NET

O3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��

Description

3RVWHG�WR�WKH�ZLQGRZ�RYHU�ZKLFK�WKH�PRXVH�PRYHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_LBUTTONDOWN = &H201 � �

� �Z3DUDP

&RQWDLQV�WKH�YLUWXDO�NH\V�SUHVVHG�ZKHQ�WKLV�PHVVDJH�LV�SRVWHG��FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��0.B&21752/

0.B/%87721

0.B5%87721

0.B0%87721

0.B6+,)7

0.B;%87721�

0.B;%87721�

O3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��

Description

3RVWHG�WR�WKH�ZLQGRZ�RYHU�ZKLFK�WKH�OHIW�PRXVH�EXWWRQ�LV�SUHVVHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_LBUTTONUP = &H202 � �

� �Z3DUDP

&RQWDLQV�WKH�YLUWXDO�NH\V�SUHVVHG�ZKHQ�WKLV�PHVVDJH�LV�SRVWHG��FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��0.B&21752/

0.B/%87721

0.B5%87721

0.B0%87721

0.B6+,)7

Page 596: Visual Basic - Subclassing and Hooking with VB & VB NET

0.B;%87721�

0.B;%87721�

O3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��

Description

3RVWHG�WR�WKH�ZLQGRZ�RYHU�ZKLFK�WKH�OHIW�PRXVH�EXWWRQ�LV�UHOHDVHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_LBUTTONDBLCLK = &H203 � �

� �Z3DUDP

&RQWDLQV�WKH�YLUWXDO�NH\V�SUHVVHG�ZKHQ�WKLV�PHVVDJH�LV�SRVWHG��FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��0.B&21752/

0.B/%87721

0.B5%87721

0.B0%87721

0.B6+,)7

0.B;%87721�

0.B;%87721�

O3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��

Description

3RVWHG�WR�WKH�ZLQGRZ�RYHU�ZKLFK�WKH�OHIW�PRXVH�EXWWRQ�LV�GRXEOH�FOLFNHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_RBUTTONDOWN = &H204 � �

� �Z3DUDP

&RQWDLQV�WKH�YLUWXDO�NH\V�SUHVVHG�ZKHQ�WKLV�PHVVDJH�LV�SRVWHG��FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��0.B&21752/

0.B/%87721

0.B5%87721

Page 597: Visual Basic - Subclassing and Hooking with VB & VB NET

0.B0%87721

0.B6+,)7

0.B;%87721�

0.B;%87721�

O3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��

Description

3RVWHG�WR�WKH�ZLQGRZ�RYHU�ZKLFK�WKH�ULJKW�PRXVH�EXWWRQ�LV�SUHVVHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_RBUTTONUP = &H205 � �

� �Z3DUDP

&RQWDLQV�WKH�YLUWXDO�NH\V�SUHVVHG�ZKHQ�WKLV�PHVVDJH�LV�SRVWHG��FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��0.B&21752/

0.B/%87721

0.B5%87721

0.B0%87721

0.B6+,)7

0.B;%87721�

0.B;%87721�

O3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��

Description

3RVWHG�WR�WKH�ZLQGRZ�RYHU�ZKLFK�WKH�ULJKW�PRXVH�EXWWRQ�LV�UHOHDVHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_RBUTTONDBLCLK = &H206 � �

� �Z3DUDP

&RQWDLQV�WKH�YLUWXDO�NH\V�SUHVVHG�ZKHQ�WKLV�PHVVDJH�LV�SRVWHG��FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��0.B&21752/

Page 598: Visual Basic - Subclassing and Hooking with VB & VB NET

0.B/%87721

0.B5%87721

0.B0%87721

0.B6+,)7

0.B;%87721�

0.B;%87721�

O3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��

Description

3RVWHG�WR�WKH�ZLQGRZ�RYHU�ZKLFK�WKH�ULJKW�PRXVH�EXWWRQ�LV�GRXEOH�FOLFNHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_MBUTTONDOWN = &H207 � �

� �Z3DUDP

&RQWDLQV�WKH�YLUWXDO�NH\V�SUHVVHG�ZKHQ�WKLV�PHVVDJH�LV�SRVWHG��FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��0.B&21752/

0.B/%87721

0.B5%87721

0.B0%87721

0.B6+,)7

0.B;%87721�

0.B;%87721�

O3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��

Description

3RVWHG�WR�WKH�ZLQGRZ�RYHU�ZKLFK�WKH�PLGGOH�PRXVH�EXWWRQ�LV�SUHVVHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_MBUTTONUP = &H208 � �

� �Z3DUDP

Page 599: Visual Basic - Subclassing and Hooking with VB & VB NET

&RQWDLQV�WKH�YLUWXDO�NH\V�SUHVVHG�ZKHQ�WKLV�PHVVDJH�LV�SRVWHG��FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��0.B&21752/

0.B/%87721

0.B5%87721

0.B0%87721

0.B6+,)7

0.B;%87721�

0.B;%87721�

O3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��

Description

3RVWHG�WR�WKH�ZLQGRZ�RYHU�ZKLFK�WKH�PLGGOH�PRXVH�EXWWRQ�LV�UHOHDVHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_MBUTTONDBLCLK = &H209 � �

� �Z3DUDP

&RQWDLQV�WKH�YLUWXDO�NH\V�SUHVVHG�ZKHQ�WKLV�PHVVDJH�LV�SRVWHG��FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��0.B&21752/

0.B/%87721

0.B5%87721

0.B0%87721

0.B6+,)7

0.B;%87721�

0.B;%87721�

O3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��

Description

3RVWHG�WR�WKH�ZLQGRZ�RYHU�ZKLFK�WKH�PLGGOH�PRXVH�EXWWRQ�LV�GRXEOH�FOLFNHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_XBUTTONDOWN = &H20B � �

Page 600: Visual Basic - Subclassing and Hooking with VB & VB NET

� �Z3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�YLUWXDO�NH\V�SUHVVHG�ZKHQ�WKLV�PHVVDJH�LV�SRVWHG��LW�FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��0.B&21752/

0.B/%87721

0.B5%87721

0.B0%87721

0.B6+,)7

0.B;%87721�

0.B;%87721�

7KH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�[�EXWWRQ�WKDW�ZDV�SUHVVHG��LW�FDQ�EH�RQH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��;%87721�

;%87721�

O3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��

Description

3RVWHG�WR�WKH�ZLQGRZ�RYHU�ZKLFK�WKH�PRXVHV�[�EXWWRQ�LV�SUHVVHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_XBUTTONUP = &H20C � �

� �Z3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�YLUWXDO�NH\V�SUHVVHG�ZKHQ�WKLV�PHVVDJH�LV�SRVWHG��FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��0.B&21752/

0.B/%87721

0.B5%87721

0.B0%87721

0.B6+,)7

0.B;%87721�

0.B;%87721�

7KH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�[�EXWWRQ�WKDW�ZDV�UHOHDVHG��LW�FDQ�EH�RQH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��

Page 601: Visual Basic - Subclassing and Hooking with VB & VB NET

;%87721�

;%87721�

O3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��

Description

3RVWHG�WR�WKH�ZLQGRZ�RYHU�ZKLFK�WKH�PRXVHV�[�EXWWRQ�LV�UHOHDVHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_XBUTTONDBLCLK = &H20D � �

� �Z3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�YLUWXDO�NH\V�SUHVVHG�ZKHQ�WKLV�PHVVDJH�LV�SRVWHG��LW�FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��0.B&21752/

0.B/%87721

0.B5%87721

0.B0%87721

0.B6+,)7

0.B;%87721�

0.B;%87721�

7KH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�[�EXWWRQ�WKDW�ZDV�GRXEOH�FOLFNHG��LW�FDQ�EH�RQH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��;%87721�

;%87721�

O3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�[�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�\�FRRUGLQDWH�RI�WKH�PRXVH�SRLQWHU��

Description

3RVWHG�WR�WKH�ZLQGRZ�RYHU�ZKLFK�WKH�PRXVHV�[�EXWWRQ�LV�GRXEOH�FOLFNHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_PARENTNOTIFY = &H210 � �

� �Z3DUDP

Page 602: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�DFWLRQ�IRU�ZKLFK�WKH�SDUHQW�LV�EHLQJ�QRWLILHG��LW�FDQ�EH�RQH�RI�WKH�IROORZLQJ��:0B&5($7(

:0B'(6752<

:0B/%87721'2:1

:0B0%87721'2:1

:0B5%87721'2:1

:0B;%87721'2:1

7KH�KLJK�RUGHU�ZRUG�FRQWDLQV�D�YDOXH�WKDW�GHSHQGV�RQ�WKH�ORZ�RUGHU�ZRUG�RI�Z3DUDP��LW�FDQ�EH�RQH�RI�WKH�IROORZLQJ��:0B&5($7(

:0B'(6752<

:0B/%87721'2:1

:0B0%87721'2:1

:0B5%87721'2:1

:0B;%87721'2:1

O3DUDP

9DOXH�GHSHQGV�RQ�WKH�ORZ�RUGHU�ZRUG�RI�Z3DUDP��LW�FDQ�EH�RQH�RI�WKH�IROORZLQJ��:0B&5($7(

:0B'(6752<

:0B/%87721'2:1

:0B0%87721'2:1

:0B5%87721'2:1

:0B;%87721'2:1 Description

1RWLILHV�WKH�SDUHQW�RI�DQ�DFWLRQ�RFFXUULQJ�LQ�D�FKLOG�FRQWURO��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_ENTERMENULOOP = &H211 � �

� �Z3DUDP

7UXH�LI�WKH�PHQX�ZDV�DFWLYDWHG�XVLQJ�WKH�7UDFN3RSXS0HQX�$3,�IXQFWLRQ��GHILQHG�LQ�$SSHQGL[�%��

O3DUDP

8QXVHG��Description

,QGLFDWHV�WKDW�D�PHQX�PRGDO�ORRS�KDV�EHHQ�HQWHUHG��Return Value

Page 603: Visual Basic - Subclassing and Hooking with VB & VB NET

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_EXITMENULOOP = &H212 � �

� �Z3DUDP

7UXH�LI�D�VKRUWFXW�PHQX�ZDV�DFWLYDWHG��)DOVH�RWKHUZLVH��O3DUDP

8QXVHG��Description

,QGLFDWHV�WKDW�D�PHQX�PRGDO�ORRS�KDV�EHHQ�H[LWHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_SIZING = &H214 � �

� �Z3DUDP

,QGLFDWHV�WKH�ZLQGRZ�HGJH�WKDW�LV�EHLQJ�VL]HG��FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��:06=B%27720

:06=B%27720/()7

:06=B%277205,*+7

:06=B/()7

:06=B5,*+7

:06=B723

:06=B723/()7

:06=B7235,*+7

O3DUDP

3RLQWHU�WR�D�5(&7�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

6HQW�WR�D�ZLQGRZ�FXUUHQWO\�EHLQJ�UHVL]HG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_CAPTURECHANGED = &H215 � �

� �Z3DUDP

Page 604: Visual Basic - Subclassing and Hooking with VB & VB NET

8QXVHG��O3DUDP

K:QG�RI�WKH�ZLQGRZ�JDLQLQJ�WKH�PRXVH�FDSWXUH��Description

6HQW�WR�D�ZLQGRZ�WKDW�ORVW�WKH�PRXVH�FDSWXUH��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_MOVING = &H216 � �

� �Z3DUDP

,QGLFDWHV�WKH�ZLQGRZ�HGJH�WKDW�LV�EHLQJ�PRYHG��LW�FDQ�EH�RQH�RU�PRUH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��:06=B%27720

:06=B%27720/()7

:06=B%277205,*+7

:06=B/()7

:06=B5,*+7

:06=B723

:06=B723/()7

:06=B7235,*+7

O3DUDP

3RLQWHU�WR�D�5(&7�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

6HQW�WR�D�ZLQGRZ�FXUUHQWO\�EHLQJ�PRYHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_ENTERSIZEMOVE = &H231 � �

� �Z3DUDP

8QXVHG��O3DUDP

8QXVHG��Description

,QGLFDWHV�WKDW�D�VL]LQJ�PRGDO�ORRS�KDV�EHHQ�HQWHUHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Page 605: Visual Basic - Subclassing and Hooking with VB & VB NET

Public Const WM_EXITSIZEMOVE = &H232 � �

� �Z3DUDP

8QXVHG��O3DUDP

8QXVHG��Description

,QGLFDWHV�WKDW�D�VL]LQJ�PRGDO�ORRS�KDV�EHHQ�H[LWHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

Public Const WM_HOTKEY = &H312 � �

� �Z3DUDP

,QGLFDWHV�WKH�KRW�NH\�,'�WKDW�JHQHUDWHG�WKH�PHVVDJH��FDQ�EH�RQH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��,'+27B61$3'(6.723

,'+27B61$3:,1'2:

O3DUDP

7KH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�KRW�NH\V�YLUWXDO�NH\�FRGH��7KH�ORZ�RUGHU�ZRUG�LQGLFDWHV�WKH�NH\V�SUHVVHG�LQ�FRPELQDWLRQ�ZLWK�WKH�KRW�NH\��,W�FDQ�EH�RQH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��02'B$/7

02'B&21752/

02'B6+,)7

02'B:,1 Description

3RVWHG�ZKHQ�D�KRW�NH\�LV�SUHVVHG��Return Value

��RQO\�LI�WKH�DSSOLFDWLRQ�SURFHVVHV�WKLV�PHVVDJH��

$���%XWWRQ�&RQWURO�6SHFLILF�0HVVDJHV�

Public Const BM_GETCHECK = &HF0 � �

Page 606: Visual Basic - Subclassing and Hooking with VB & VB NET

� �Z3DUDP

8QXVHG��O3DUDP

8QXVHG��Description

*HWV�WKH�VWDWH�RI�WKH�FKHFNER[�RU�UDGLR�EXWWRQ��FKHFNHG�RU�XQFKHFNHG���Return Value

,QGLFDWHV�WKH�VWDWH�RI�WKH�FRQWURO��FDQ�EH�RQH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��%67B&+(&.('

%67B,1'(7(50,1$7(

%67B81&+(&.('

Public Const BM_SETCHECK = &HF1 � �

� �Z3DUDP

6HWV�WKH�VWDWH�RI�WKH�FKHFNER[�RU�UDGLR�EXWWRQ��FDQ�EH�RQH�RI�WKH�IROORZLQJ��GHILQHG�LQ�$SSHQGL[�&��%67B&+(&.('

%67B,1'(7(50,1$7(

%67B81&+(&.('

O3DUDP

8QXVHG��Description

6HWV�WKH�VWDWH�RI�WKH�FRQWURO��Return Value

$OZD\V����

Public Const BM_CLICK = &HF5 � �

� �Z3DUDP

8QXVHG��O3DUDP

8QXVHG��Description

Page 607: Visual Basic - Subclassing and Hooking with VB & VB NET

)RUFHV�D�EXWWRQ�WR�EH�FOLFNHG��Return Value

8QXVHG��

$���&RPER�%R[�6SHFLILF�0HVVDJHV�

Public Const CB_ADDSTRING = &H143 � �

� �Z3DUDP

8QXVHG��O3DUDP

3RLQWHU�WR�D�QXOO�WHUPLQDWHG�VWULQJ��Description

3ODFHV�D�VWULQJ�LQ�WKH�WH[W�ER[�SRUWLRQ�RI�D�FRPER�ER[��Return Value

$���EDVHG�LQGH[�WR�WKH�VWULQJ�WR�DGG�WR�WKH�FRPER�ER[��

Public Const CB_DELETESTRING = &H144 � �

� �Z3DUDP

$���EDVHG�LQGH[�WR�WKH�FRPER�ER[�LWHP�WR�GHOHWH��O3DUDP

8QXVHG��Description

5HPRYHV�DQ�LWHP�IURP�D�FRPER�ER[��Return Value

1XPEHU�RI�LWHPV�OHIW�LQ�WKH�FRPER�ER[�DIWHU�WKLV�LWHP�LV�GHOHWHG��

Public Const CB_GETCOUNT = &H146 � �

� �Z3DUDP

8QXVHG��O3DUDP

8QXVHG��Description

Page 608: Visual Basic - Subclassing and Hooking with VB & VB NET

5HWULHYHV�WKH�QXPEHU�RI�LWHPV�LQ�D�FRPER�ER[��Return Value

7KH�QXPEHU�RI�LWHPV�LQ�D�FRPER�ER[��

Public Const CB_GETCURSEL = &H147 � �

� �Z3DUDP

8QXVHG��O3DUDP

8QXVHG��Description

5HWULHYHV�WKH�FXUUHQWO\�VHOHFWHG�LWHP�LQ�D�FRPER�ER[��Return Value

7KH���EDVHG�LQGH[�RI�WKH�VHOHFWHG�LWHP��

$���(GLW�&RQWURO�6SHFLILF�0HVVDJHV�

Public Const EM_GETLINE = &HC4 � �

� �Z3DUDP

7KH���EDVHG�LQGH[�RI�WKH�OLQH�WR�UHWULHYH�IURP�WKH�WH[W�ER[��O3DUDP

3RLQWHU�WR�D�EXIIHU�WKDW�ZLOO�UHFHLYH�WKH�VWULQJ��Description

5HWULHYHV�D�VWULQJ�IURP�D�SDUWLFXODU�OLQH�LQ�D�WH[W�ER[��Return Value

1XPEHU�RI�FKDUDFWHUV�UHWXUQHG��

Public Const EM_CANUNDO = &HC6 � �

� �Z3DUDP

8QXVHG��O3DUDP

8QXVHG��Description

Page 609: Visual Basic - Subclassing and Hooking with VB & VB NET

'HWHUPLQHV�ZKHWKHU�DQ\�DFWLRQV�FDQ�EH�XQGRQH�LQ�D�WH[W�ER[��Return Value

��LI�QR�DFWLRQV�FDQ�EH�XQGRQH��QRQ]HUR�RWKHUZLVH��

Public Const EM_UNDO = &HC7 � �

� �Z3DUDP

8QXVHG��O3DUDP

8QXVHG��Description

8QGRHV�WKH�ODVW�DFWLRQ�LQ�D�WH[W�FRQWURO��Return Value

$�VLQJOH�OLQH�WH[W�ER[�DOZD\V�UHWXUQV�7UXH��$�PXOWLOLQH�WH[W�ER[�UHWXUQV�7UXH�LI�WKH�ODVW�DFWLRQ�ZDV�XQGRQH��RWKHUZLVH��LW�UHWXUQV�)DOVH��

$���/LVWER[�6SHFLILF�0HVVDJHV�

Public Const LB_ADDSTRING = &H180 � �

� �Z3DUDP

8QXVHG��O3DUDP

3RLQWHU�WR�D�QXOO�WHUPLQDWHG�VWULQJ�WR�DGG�WR�WKH�OLVW�ER[��Description

$GGV�D�VWULQJ�WR�D�OLVW�ER[��Return Value

��EDVHG�LQGH[�RI�WKH�SRVLWLRQ�WKDW�WKH�VWULQJ�LV�DGGHG�WR�WKH�OLVW�ER[��

Public Const LB_DELETESTRING = &H182 � �

� �Z3DUDP

��EDVHG�LQGH[�RI�WKH�SRVLWLRQ�LQ�WKH�OLVW�ER[�WR�GHOHWH�WKH�VWULQJ��O3DUDP

Page 610: Visual Basic - Subclassing and Hooking with VB & VB NET

8QXVHG��Description

5HPRYHV�D�VWULQJ�IURP�D�OLVW�ER[��Return Value

1XPEHU�RI�LWHPV�UHPDLQLQJ�LQ�WKH�OLVW�ER[��

Public Const LB_SETSEL = &H185 � �

� �Z3DUDP

7UXH�WR�KLJKOLJKW�DQ�LWHP��)DOVH�WR�UHPRYH�WKH�KLJKOLJKWLQJ��O3DUDP

��EDVHG�LQGH[�RI�WKH�LWHP�WR�VHOHFW��Description

6HOHFWV�DQ�LWHP�LQ�D�OLVW�ER[��Return Value

8QXVHG��XQOHVV�DQ�HUURU�RFFXUV��LQ�ZKLFK�FDVH�/%B(55�LV�UHWXUQHG��

Public Const LB_GETSEL = &H187 � �

� �Z3DUDP

��EDVHG�LQGH[�RI�WKH�LWHP�WR�VHOHFW��O3DUDP

8QXVHG��Description

*HWV�WKH�LWHP�WKDW�LV�VHOHFWHG�LQ�D�OLVW�ER[��Return Value

�LI�DQ�LWHP�LV�QRW�VHOHFWHG��QRQ]HUR�RWKHUZLVH��

$���6FUROO�%DU�6SHFLILF�0HVVDJHV�

Public Const SBM_SETPOS = &HE0 � �

� �Z3DUDP

7KH�QHZ�SRVLWLRQ�RI�WKH�VFUROOER[��O3DUDP

Page 611: Visual Basic - Subclassing and Hooking with VB & VB NET

7UXH�WR�UHGUDZ�WKH�FRQWURO��)DOVH�WR�SUHYHQW�WKH�FRQWURO�IURP�UHGUDZLQJ��Description

6HWV�WKH�SRVLWLRQ�RI�WKH�VFUROOER[�LQ�D�VFUROOEDU�FRQWURO��Return Value

7KH�SUHYLRXV�SRVLWLRQ�RI�WKH�VFUROOER[��LI�WKH�VFUROOER[�GLG�QRW�PRYH��

Public Const SBM_GETPOS = &HE1 � �

� �Z3DUDP

8QXVHG��O3DUDP

8QXVHG��Description

5HWULHYHV�WKH�FXUUHQW�SRVLWLRQ�RI�WKH�VFUROOER[�LQ�D�VFUROOEDU�FRQWURO��Return Value

3RVLWLRQ�RI�WKH�VFUROOER[��

Public Const SBM_SETRANGE = &HE2 � �

� �Z3DUDP

7KH�PLQLPXP�VFUROO�UDQJH��O3DUDP

7KH�PD[LPXP�VFUROO�UDQJH��Description

6HWV�WKH�PD[LPXP�DQG�PLQLPXP�VFUROO�UDQJHV�RI�WKH�VFUROOEDU�FRQWURO��Return Value

7KH�SUHYLRXV�SRVLWLRQ�RI�WKH�VFUROOER[��LI�WKH�VFUROOER[�GLG�QRW�PRYH��

Public Const SBM_GETRANGE = &HE3 � �

� �Z3DUDP

3RLQWHU�WR�D�EXIIHU�WKDW�JHWV�WKH�PLQLPXP�VFUROO�UDQJH��O3DUDP

3RLQWHU�WR�D�EXIIHU�WKDW�JHWV�WKH�PD[LPXP�VFUROO�UDQJH��Description

*HWV�WKH�PD[LPXP�DQG�PLQLPXP�VFUROO�UDQJHV�RI�WKH�VFUROOEDU�FRQWURO��Return Value

8QXVHG��

Page 612: Visual Basic - Subclassing and Hooking with VB & VB NET

$���0HVVDJHV�6SHFLILF�WR�WKH�&RPPRQ'LDORJ�%R[HV�

Public Const CDM_GETFILEPATH = (CDM_FIRST + &H1) � �

� �Z3DUDP

6L]H�RI�WKH�EXIIHU�SRLQWHG�WR�E\�O3DUDP��O3DUDP

3RLQWHU�WR�D�EXIIHU��ZKLFK�JHWV�WKH�SDWK�DQG�ILOHQDPH��Description

*HWV�WKH�SDWK�DQG�ILOHQDPH�VHOHFWHG�LQ�DQ�2SHQ�RU�6DYH�$V�FRPPRQ�GLDORJ�ER[��Return Value

$�QHJDWLYH�QXPEHU�LQGLFDWHV�IDLOXUH��RWKHUZLVH��WKH�QXPEHU�LQGLFDWHV�WKH�OHQJWK�RI�WKH�SDWK��ILOHQDPH��DQG�D�WHUPLQDWLQJ�QXOO�FKDUDFWHU��

Public Const CDM_GETFOLDERPATH = (CDM_FIRST + &H2) � �

� �Z3DUDP

6L]H�RI�WKH�EXIIHU�SRLQWHG�WR�E\�O3DUDP��O3DUDP

3RLQWHU�WR�D�EXIIHU��ZKLFK�JHWV�WKH�SDWK�DQG�ILOHQDPH��Description

*HWV�WKH�SDWK�RI�WKH�RSHQHG�IROGHU�LQ�DQ�2SHQ�RU�6DYH�$V�FRPPRQ�GLDORJ�ER[��Return Value

$�QHJDWLYH�QXPEHU�LQGLFDWHV�IDLOXUH��RWKHUZLVH��WKH�QXPEHU�LQGLFDWHV�WKH�OHQJWK�RI�WKH�SDWK��ILOHQDPH��DQG�WHUPLQDWLQJ�QXOO�FKDUDFWHU��

Public Const CDM_GETSPEC = (CDM_FIRST + &H0) � �

� �Z3DUDP

6L]H�RI�WKH�EXIIHU�SRLQWHG�WR�E\�O3DUDP��O3DUDP

3RLQWHU�WR�D�EXIIHU��ZKLFK�JHWV�WKH�SDWK�DQG�ILOHQDPH��Description

Page 613: Visual Basic - Subclassing and Hooking with VB & VB NET

*HWV�RQO\�WKH�ILOHQDPH�RI�WKH�VHOHFWHG�ILOH�LQ�DQ�2SHQ�RU�6DYH�$V�FRPPRQ�GLDORJ�ER[��Return Value

$�QHJDWLYH�QXPEHU�LQGLFDWHV�IDLOXUH��RWKHUZLVH��WKH�QXPEHU�LQGLFDWHV�WKH�OHQJWK�RI�WKH�SDWK��ILOHQDPH��DQG�D�WHUPLQDWLQJ�QXOO�FKDUDFWHU��

Public Const CDM_HIDECONTROL = (CDM_FIRST + &H5) � �

� �Z3DUDP

&RQWURO�,'��O3DUDP

8QXVHG��Description

+LGHV�D�FRQWURO�LQ�DQ�2SHQ�RU�6DYH�$V�FRPPRQ�GLDORJ�ER[��Return Value

8QXVHG��Public Const CDM_SETCONTROLTEXT = (CDM_FIRST + &H4) � �

� �Z3DUDP

&RQWURO�,'��O3DUDP

3RLQWHU�WR�D�QXOO�WHUPLQDWHG�VWULQJ�FRQWDLQLQJ�WKH�WH[W�IRU�WKH�FRQWURO��Description

6HWV�WKH�WH[W�RI�D�FRQWURO�VSHFLILHG�LQ�Z3DUDP��Return Value

8QXVHG��

Public Const CDM_SETDEFEXT = (CDM_FIRST + &H6) � �

� �Z3DUDP

8QXVHG��O3DUDP

3RLQWHU�WR�D�QXOO�WHUPLQDWHG�VWULQJ�FRQWDLQLQJ�WKH�ILOHQDPH�H[WHQVLRQ�Description

6HWV�WKH�GHIDXOW�ILOHQDPH�H[WHQVLRQ�IRU�DQ�2SHQ�RU�6DYH�$V�FRPPRQ�GLDORJ�ER[��Return Value

8QXVHG��

Page 614: Visual Basic - Subclassing and Hooking with VB & VB NET

$���0HVVDJHV�6SHFLILF�WR�WKH�)RQW�&RPPRQ�'LDORJ�%R[�

Public Const WM_CHOOSEFONT_GETLOGFONT = _USER + 1) � �

� �Z3DUDP

8QXVHG��O3DUDP

3RLQWHU�WR�D�/2*)217�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

*HWV�LQIRUPDWLRQ�RQ�WKH�FXUUHQW�IRQW�VHOHFWLRQ�LQ�WKH�)RQW�FRPPRQ�GLDORJ�ER[��Return Value

8QXVHG��Public Const WM_CHOOSEFONT_SETLOGFONT = (WM_USER + 101) � �

� �Z3DUDP

8QXVHG��O3DUDP

3RLQWHU�WR�D�/2*)217�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

6HWV�WKH�FXUUHQW�IRQW�LQ�D�)RQW�FRPPRQ�GLDORJ�ER[��Return Value

8QXVHG��Public Const WM_CHOOSEFONT_SETFLAGS = (WM_USER + 102) � �

� �Z3DUDP

8QXVHG��O3DUDP

3RLQWHU�WR�D�&+226()217�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

Page 615: Visual Basic - Subclassing and Hooking with VB & VB NET

6HWV�WKH�IODJV�WR�VSHFLI\�KRZ�WKH�)RQW�FRPPRQ�GLDORJ�ER[�LV�GLVSOD\HG��Return Value

8QXVHG��

$���0HVVDJHV�6SHFLILF�WR�WKH�3DJH�6HWXS�&RPPRQ�'LDORJ�%R[�

1RWH��LI�WKH�36'B(1$%/(3$*(3$,17+22.�IODJ�LV�VHW�LQ�WKH�3$*(6(783'/*�IODJV�PHPEHU��\RX�FDQ�LPSOHPHQW�D�VHFRQG�KRRN�IXQFWLRQ��7KLV�KRRN�IXQFWLRQ�LQWHUFHSWV�WKH�IROORZLQJ�PHVVDJHV��ZKLFK�PRGLI\�WKH�ORRN�RI�WKH�VDPSOH�SDJH�LPDJH�DW�WKH�WRS�RI�WKLV�FRPPRQ�GLDORJ�ER[��

Public Const WM_PSD_PAGESETUPDLG = (WM_USER) � �

� �Z3DUDP

7KH�ORZ�RUGHU�ZRUG�FRQWDLQV�WKH�SDSHU�VL]H��WKH�KLJK�RUGHU�ZRUG�FRQWDLQV�WKH�RULHQWDWLRQ�RI�WKH�SDSHU�DQG�ZKHWKHU�WKH�SULQWHU�LV�D�GRW�PDWUL[�RU�D�+HZOHWW�3DFNDUG�3ULQWHU�&RQWURO�/DQJXDJH�GHYLFH��

O3DUDP

3RLQWHU�WR�D�3$*(6(783'/*�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

1RWLILHV�WKH�3DJH�6HWXS�FRPPRQ�GLDORJ�ER[�3DJH3DLQW+RRN�KRRN�SURFHGXUH�WKDW�WKH�VDPSOH�SDJH�FRQWHQWV�DUH�DERXW�WR�EH�GUDZQ�RQ�WKH�VFUHHQ��

Return Value

7UXH�LI�WKH�LPDJH�LV�WR�EH�GUDZQ�RQ�WKH�VFUHHQ��)DOVH�RWKHUZLVH��

Public Const WM_PSD_FULLPAGERECT = (WM_USER+1) � �

� �Z3DUDP

'HYLFH�FRQWH[W�KDQGOH�WR�WKH�VDPSOH�SDJH�LPDJH��O3DUDP

3RLQWHU�WR�D�5(&7�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

1RWLILHV�WKH�3DJH�6HWXS�FRPPRQ�GLDORJ�ER[�KRRN�3DJH3DLQW+RRN�SURFHGXUH�WKDW�WKH�UHWXUQ�DGGUHVV�UHFWDQJOH�LV�DERXW�WR�EH�GUDZQ�RQ�WKH�VFUHHQ��

Return Value

7UXH�LI�WKH�LPDJH�LV�WR�EH�GUDZQ�RQ�WKH�VFUHHQ��)DOVH�RWKHUZLVH��

Page 616: Visual Basic - Subclassing and Hooking with VB & VB NET

Public Const WM_PSD_MINMARGINRECT = (WM_USER+2) � �

� �Z3DUDP

'HYLFH�FRQWH[W�KDQGOH�WR�WKH�VDPSOH�SDJH�LPDJH��O3DUDP

3RLQWHU�WR�D�5(&7�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

1RWLILHV�WKH�3DJH�6HWXS�FRPPRQ�GLDORJ�ER[�3DJH3DLQW+RRN�KRRN�SURFHGXUH�WKDW�WKH�VDPSOH�SDJH�LV�DERXW�WR�EH�GUDZQ�RQ�WKH�VFUHHQ��

Return Value

7UXH�LI�WKH�LPDJH�LV�WR�EH�GUDZQ�RQ�WKH�VFUHHQ��)DOVH�RWKHUZLVH��

Public Const WM_PSD_MARGINRECT = (WM_USER+3) � �

� �Z3DUDP

'HYLFH�FRQWH[W�KDQGOH�WR�WKH�VDPSOH�SDJH�LPDJH��O3DUDP

3RLQWHU�WR�D�5(&7�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

1RWLILHV�WKH�3DJH�6HWXS�FRPPRQ�GLDORJ�ER[�KRRN�3DJH3DLQW+RRN�SURFHGXUH�WKDW�WKH�PDUJLQ�UHFWDQJOH�LV�DERXW�WR�EH�GUDZQ�RQ�WKH�VFUHHQ��

Return Value

7UXH�LI�WKH�LPDJH�LV�WR�EH�GUDZQ�RQ�WKH�VFUHHQ��)DOVH�RWKHUZLVH��

Public Const WM_PSD_ENVSTAMPRECT = (WM_USER+5) � �

� �Z3DUDP

'HYLFH�FRQWH[W�KDQGOH�WR�WKH�VDPSOH�SDJH�LPDJH��O3DUDP

3RLQWHU�WR�D�5(&7�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

1RWLILHV�WKH�3DJH�6HWXS�FRPPRQ�GLDORJ�ER[�KRRN�3DJH3DLQW+RRN�SURFHGXUH�WKDW�WKH�HQYHORSH�VWDPS�UHFWDQJOH�LV�DERXW�WR�EH�GUDZQ�RQ�WKH�VFUHHQ��

Return Value

7UXH�LI�WKH�LPDJH�LV�WR�EH�GUDZQ�RQ�WKH�VFUHHQ��)DOVH�RWKHUZLVH��

Page 617: Visual Basic - Subclassing and Hooking with VB & VB NET

Public Const WM_PSD_FULLPAGERECT = (WM_USER+6) � �

� �Z3DUDP

'HYLFH�FRQWH[W�KDQGOH�WR�WKH�VDPSOH�SDJH�LPDJH��O3DUDP

3RLQWHU�WR�D�5(&7�VWUXFWXUH��GHILQHG�LQ�$SSHQGL[�&��Description

1RWLILHV�WKH�3DJH�6HWXS�FRPPRQ�GLDORJ�ER[�KRRN�3DJH3DLQW+RRN�SURFHGXUH�WKDW�WKH�VDPSOH�SDJH�UHFWDQJOH�LV�DERXW�WR�EH�GUDZQ�RQ�WKH�VFUHHQ��

Return Value

7UXH�LI�WKH�LPDJH�LV�WR�EH�GUDZQ�RQ�WKH�VFUHHQ��)DOVH�RWKHUZLVH��

$SSHQGL[�%��$3,�)XQFWLRQV�7KLV�DSSHQGL[�OLVWV�WKH�:LQGRZV�$3,�IXQFWLRQV�XVHG�LQ�WKLV�ERRN��DORQJ�ZLWK�WKHLU�V\QWD[�DQG�D�GHVFULSWLRQ�RI�WKHLU�SDUDPHWHUV���

AttachThreadInput � �

� �)RUFHV�PXOWLSOH�WKUHDGV�WR�UHFHLYH�PHVVDJHV�IURP�D�VLQJOH�PHVVDJH�TXHXH���3ULYDWH�'HFODUH�)XQFWLRQ�$WWDFK7KUHDG,QSXW�/LE��XVHU����B����������$OLDV��$WWDFK7KUHDG,QSXW��B�� � �%\9DO�LG$WWDFK�$V�/RQJ��B�� � %\9DO�LG$WWDFK7R�$V�/RQJ��B?�� � %\9DO�I$WWDFK�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

LG$WWDFK

7KH�WKUHDG�,'�RI�WKH�WKUHDG�WR�EH�DWWDFKHG�WR�DQRWKHU�WKUHDGV�PHVVDJH�TXHXH���LG$WWDFK7R

7KH�WKUHDG�,'�RI�WKH�WKUHDG�FRQWDLQLQJ�WKH�PHVVDJH�TXHXH�WR�ZKLFK�WKH�WKUHDG�VSHFLILHG�E\�LG$WWDFK�LV�DWWDFKHG���

I$WWDFK

7UXH�VSHFLILHV�WR�DWWDFK�WKH�WZR�WKUHDGV��)DOVH�VSHFLILHV�WR�GHWDFK�WKH�WZR�WKUHDGV���

Page 618: Visual Basic - Subclassing and Hooking with VB & VB NET

5HWXUQ�9DOXH�

��LQGLFDWHV�WKDW�WKH�IXQFWLRQ�IDLOHG��DQ\�RWKHU�YDOXH�LQGLFDWHV�VXFFHVV���

BroadcastSystemMessage � �

� �6HQGV�D�PHVVDJH�WR�PXOWLSOH�UHFLSLHQWV��7KH�UHFLSLHQWV�DUH�VSHFLILHG�LQ�WKH�SGZ�SDUDPHWHU�RI�WKLV�IXQFWLRQ���3XEOLF�'HFODUH�)XQFWLRQ�%URDGFDVW6\VWHP0HVVDJH�/LE��XVHU����B������$OLDV��%URDGFDVW6\VWHP0HVVDJH��B�� �%\9DO�GZ�$V�/RQJ��SGZ�$V�/RQJ��%\9DO�XQ�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B�� %\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

GZ

6SHFLILHV�RQH�RU�PRUH�RI�WKH�IROORZLQJ�EURDGFDVWLQJ�IODJV��BSF_ALLOWSFW

(QDEOHV�WKH�IRUHJURXQG�ZLQGRZ�WR�EH�VHW�E\�WKH�UHFLSLHQW�LQ�WKH�:LQGRZV������V\VWHP���BSF_FLUSHDISK

)OXVKHV�WKH�GLVN�DIWHU�HDFK�VHQW�PHVVDJH�LV�SURFHVVHG��BSF_FORCEIFHUNG

0HVVDJH�LV�VHQW�HYHQ�LI�RQH�RU�PRUH�UHFLSLHQWV�DUH�KXQJ��BSF_IGNORECURRENTTASK

3UHYHQWV�WKH�VHQGLQJ�DSSOLFDWLRQ�IURP�UHFHLYLQJ�LWV�RZQ�PHVVDJH��BSF_NOHANG

6WRSV�EURDGFDVWLQJ�PHVVDJHV�LI�RQH�UHFLSLHQW�LV�KXQJ��BSF_NOTIMEOUTIFNOTHUNG

'RHV�QRW�WLPH�RXW�XQOHVV�D�UHFLSLHQW�LV�KXQJ��BSF_POSTMESSAGE

3RVWV�WKH�PHVVDJH�LQVWHDG�RI�VHQGLQJ�LW��BSF_QUERY

(DFK�UHFLSLHQW�PXVW�UHVSRQG�ZLWK�D�7UXH�YDOXH�IRU�WKH�PHVVDJH�WR�EH�VHQW�WR�WKH�QH[W�UHFLSLHQW���BSF_SENDNOTIFYMESSAGE

8VHV�WKH�6HQG1RWLI\0HVVDJH�IXQFWLRQ�WR�VHQG�WKH�PHVVDJH�LQ�WKH�:LQGRZV������V\VWHP���

SGZ

6SHFLILHV�RQH�RU�PRUH�RI�WKH�IROORZLQJ�IODJV�WKDW�GHWHUPLQHV�WKH�UHFLSLHQWV�RI�WKH�PHVVDJH���BSM_ALLCOMPONENTS

Page 619: Visual Basic - Subclassing and Hooking with VB & VB NET

%URDGFDVWV�WR�DOO�FRPSRQHQWV�LQ�WKH�V\VWHP�BSM_ALLDESKTOPS

%URDGFDVWV�WR�DOO�GHVNWRSV�LQ�:LQGRZV�17������V\VWHPV�BSM_APPLICATIONS

%URDGFDVWV�WR�DOO�DSSOLFDWLRQV�BSM_INSTALLABLEDRIVERS

%URDGFDVWV�WR�LQVWDOODEOH�GULYHUV�LQ�:LQGRZV��[�V\VWHPV�BSM_NETDRIVER

%URDGFDVWV�WR�QHWZRUN�GULYHUV�LQ�:LQGRZV��[�V\VWHPV�BSM_VXDS

%URDGFDVWV�WR�DOO�V\VWHP�OHYHO�GHYLFH�GULYHUV�LQ�:LQGRZV��[�V\VWHPV�XQ

0HVVDJH�LGHQWLILHU�Z3DUDP

$GGLWLRQDO�LQIRUPDWLRQ�IRU�WKH�PHVVDJH�VSHFLILHG�LQ�XQ��O3DUDP

$GGLWLRQDO�LQIRUPDWLRQ�IRU�WKH�PHVVDJH�VSHFLILHG�LQ�XQ��

5HWXUQ�9DOXH�

5HWXUQV�D�SRVLWLYH�YDOXH�LI�WKH�PHVVDJH�LV�VXFFHVVIXOO\�VHQW�WR�LWV�UHFLSLHQWV��5HWXUQV�D����LI�WKH�IXQFWLRQ�ZDV�XQDEOH�WR�VHQG�WKH�PHVVDJH��0HVVDJHV�DUH�VHQW�WR�UHFLSLHQWV�GHWHUPLQHG�E\�WKH�SGZ�SDUDPHWHU���

CallNextHookEx � �

� �8VHG�LQ�D�KRRNV�ILOWHU�IXQFWLRQ�WR�VHQG�LQIRUPDWLRQ�RQ�WR�WKH�QH[W�KRRN�LQ�WKH�FKDLQ���3ULYDWH�'HFODUH�)XQFWLRQ�&DOO1H[W+RRN([�/LE��XVHU���B�� � �%\9DO�K+RRN�$V�/RQJ��B�� � %\9DO�QFRGH�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��B�� � O3DUDP�$V�$Q\��$V�/RQJ�

3DUDPHWHUV�

K+RRN

7KH�KDQGOH�WR�WKH�KRRN��7KH�6HW:LQGRZ+RRN([�IXQFWLRQ�UHWXUQV�WKLV�KRRN�KDQGOH���QFRGH

$�FRQVWDQW�LGHQWLI\LQJ�WKH�KRRN�FRGH��Z3DUDP

Page 620: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�Z3DUDP�DUJXPHQW�SDVVHG�LQ�WR�WKH�KRRN�ILOWHU�IXQFWLRQ��7KH�YDOXH�RI�WKLV�DUJXPHQW�GHSHQGV�RQ�WKH�PHVVDJH�WKDW�LW�LV�DVVRFLDWHG�ZLWK���

O3DUDP

7KH�O3DUDP�DUJXPHQW�SDVVHG�LQ�WR�WKH�KRRN�ILOWHU�IXQFWLRQ��7KH�YDOXH�RI�WKLV�DUJXPHQW�GHSHQGV�RQ�WKH�PHVVDJH�WKDW�LW�LV�DVVRFLDWHG�ZLWK���

5HWXUQ�9DOXH�

7KH�UHWXUQ�YDOXH�GHSHQGV�RQ�WKH�W\SH�RI�KRRN�WKDW�LV�LQVWDOOHG���

CallWindowProc � �

� �8VHG�WR�FDOO�D�IXQFWLRQ�VSHFLILHG�E\�WKH�OS3UHY:QG)XQF�IXQFWLRQ�SRLQWHU���3XEOLF�'HFODUH�)XQFWLRQ�&DOO:LQGRZ3URF�/LE��XVHU����$OLDV��&DOO:LQGRZ3URF$��B�� � �%\9DO�OS3UHY:QG)XQF�$V�/RQJ��B�� � %\9DO�K:QG�$V�/RQJ��B�� � %\9DO�0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��B�� � %\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

O3UHY:QG)XQF

$�SRLQWHU�WR�WKH�ZLQGRZ�SURFHGXUH�WR�EH�FDOOHG�K:QG

7KH�KDQGOH�RI�D�ZLQGRZ�0VJ

7KH�PHVVDJH�WR�VHQG�WR�WKH�WDUJHW�ZLQGRZ�SURFHGXUH�Z3DUDP

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH�O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH�

5HWXUQ�9DOXH�

7KLV�IXQFWLRQV�UHWXUQ�YDOXH�GHSHQGV�RQ�WKH�W\SH�RI�PHVVDJH��LGHQWLILHG�E\�WKH�0VJ�DUJXPHQW��SURFHVVHG���

ChooseColor � �

Page 621: Visual Basic - Subclassing and Hooking with VB & VB NET

� �'LVSOD\V�WKH�&RORU�FRPPRQ�GLDORJ�ER[���3XEOLF�'HFODUH�)XQFWLRQ�&KRRVH&RORU�/LE��FRPGOJ���GOO��$OLDV��&KRRVH&RORU$��B�� � �S&KRRVHFRORU�$V�&+226(&2/25��$V�/RQJ��

3DUDPHWHUV�

S&KRRVHFRORU $�SRLQWHU�WR�D�&+226(&2/25�VWUXFWXUH�

5HWXUQ�9DOXH�

5HWXUQV���LI�WKHUH�LV�DQ�HUURU��WKH�&ORVH�EXWWRQ�RQ�WKH�WLWOH�EDU�ZDV�FOLFNHG��RU�WKH�&DQFHO�EXWWRQ�ZDV�FOLFNHG��2WKHUZLVH��UHWXUQV�D�QRQ]HUR�YDOXH���

ChooseFont � �

� �'LVSOD\V�WKH�)RQW�FRPPRQ�GLDORJ�ER[���3XEOLF�'HFODUH�)XQFWLRQ�&KRRVH)RQW�/LE��FRPGOJ���GOO��$OLDV��&KRRVH)RQW$��B�� � �S&KRRVHIRQW�$V�&+226()217��$V�/RQJ�

3DUDPHWHUV�

S&KRRVHIRQW $�SRLQWHU�WR�D�&+226()217�VWUXFWXUH�

5HWXUQ�9DOXH�

5HWXUQV���LI�WKHUH�LV�DQ�HUURU��WKH�&ORVH�EXWWRQ�RQ�WKH�WLWOH�EDU�ZDV�FOLFNHG��RU�WKH�&DQFHO�EXWWRQ�ZDV�FOLFNHG��2WKHUZLVH��UHWXUQV�D�QRQ]HUR�YDOXH���

CopyMemory � �

� �&RSLHV�WKH�FRQWHQWV�RI�RQH�PHPRU\�ORFDWLRQ�WR�DQRWKHU�PHPRU\�ORFDWLRQ���3XEOLF�'HFODUH�6XE�&RS\0HPRU\�/LE��NHUQHO����$OLDV��5WO0RYH0HPRU\��B�� � �'HVWLQDWLRQ�$V�$Q\��6RXUFH�$V�$Q\��%\9DO�/HQJWK�$V�/RQJ��

Page 622: Visual Basic - Subclassing and Hooking with VB & VB NET

3DUDPHWHUV�

'HVWLQDWLRQ

7KH�GHVWLQDWLRQ�DGGUHVV�WR�ZKLFK�WKH�LQIRUPDWLRQ�LV�WR�EH�FRSLHG�6RXUFH

7KH�VRXUFH�DGGUHVV�IURP�ZKLFK�WKH�LQIRUPDWLRQ�LV�WR�EH�FRSLHG�/HQJWK

7KH�OHQJWK�LQ�E\WHV�RI�WKH�LQIRUPDWLRQ�WR�EH�FRSLHG�

5HWXUQ�9DOXH�

1RQH�

CreateWindowEx � �

� �&UHDWHV�D�ZLQGRZ���3XEOLF�'HFODUH�)XQFWLRQ�&UHDWH:LQGRZ([�/LE��XVHU����$OLDV��&UHDWH:LQGRZ([$��B�� � �%\9DO�GZ([6W\OH�$V�/RQJ��%\9DO�OS&ODVV1DPH�$V�6WULQJ��B�� � %\9DO�OS:LQGRZ1DPH�$V�6WULQJ��%\9DO�GZ6W\OH�$V�/RQJ��B�� � %\9DO�[�$V�/RQJ��%\9DO�\�$V�/RQJ��%\9DO�Q:LGWK�$V�/RQJ��B�� � %\9DO�Q+HLJKW�$V�/RQJ��%\9DO�K:QG3DUHQW�$V�/RQJ��B�� � %\9DO�K0HQX�$V�/RQJ��%\9DO�K,QVWDQFH�$V�/RQJ��OS3DUDP�$V�$Q\��$V�/RQJ�GZ([6W\OH

2QH�RU�PRUH�H[WHQGHG�VW\OHV�RI�WKH�ZLQGRZ�25HG�WRJHWKHU��WS_EX_APPWINDOW

$�WRS�OHYHO�ZLQGRZ�LV�SODFHG�RQ�WKH�WDVNEDU�ZKHQ�WKH�ZLQGRZ�LV�YLVLEOH���WS_EX_CLIENTEDGE

6SHFLILHV�D�ZLQGRZ�ZLWK�D�ERUGHU�DQG�D�VXQNHQ�HGJH��WS_EX_DLGMODALFRAME

6SHFLILHV�D�ZLQGRZ�ZLWK�D�GRXEOH�ERUGHU��WS_EX_NOACTIVATE

8VHG�LQ�:LQGRZV������WR�VSHFLI\�D�ZLQGRZ�WKDW�D�XVHU�FDQQRW�PDNH�WKH�IRUHJURXQG�ZLQGRZ���WS_EX_NOPARENTNOTIFY

6SHFLILHV�D�FKLOG�ZLQGRZ�WKDW�GRHV�QRW�VHQG�WKH�:0B3$5(17127,)<�PHVVDJH�WR�LWV�SDUHQW�ZLQGRZ���WS_EX_OVERLAPPEDWINDOW

(TXLYDOHQW�WR��:6B(;B&/,(17('*(�25�:6B(;B:,1'2:('*(����WS_EX_STATICEDGE

6SHFLILHV�D�ZLQGRZ�WKDW�KDV�D�WKUHH�GLPHQVLRQDO�ERUGHU�EXW�GRHV�QRW�WDNH�XVHU�LQSXW���

Page 623: Visual Basic - Subclassing and Hooking with VB & VB NET

WS_EX_TOPMOST

6SHFLILHV�D�ZLQGRZ�WKDW�VKRXOG�DOZD\V�EH�SODFHG�RQ�WRS�RI�RWKHU�ZLQGRZV�WKDW�DUH�VHW�WR�EH�WRS�PRVW�ZLQGRZV���WS_EX_WINDOWEDGE

6SHFLILHV�D�ZLQGRZ�ZLWK�D�ERUGHU�DQG�D�UDLVHG�HGJH��OS&ODVV1DPH

$�VWULQJ�FRQWDLQLQJ�WKH�QDPH�RI�WKH�FODVV�IURP�ZKLFK�WKLV�ZLQGRZ�LQKHULWV��OS:LQGRZ1DPH

$�VWULQJ�GLVSOD\HG�LQ�WKH�WLWOH�EDU�RI�WKH�ZLQGRZ�GZ6W\OH

2QH�RU�PRUH�ZLQGRZ�VW\OHV�RU�FRQWURO�VW\OHV�25HG�WRJHWKHU��WS_BORDER

6SHFLILHV�D�ZLQGRZ�ZLWK�D�WKLQ�OLQH�ERUGHU��WS_CAPTION

6SHFLILHV�D�ZLQGRZ�ZLWK�D�WLWOH�EDU��WS_CLIPCHILDREN

6SHFLILHV�D�ZLQGRZ�WKDW�GRHV�QRW�SDLQW�WKH�DUHD�WKDW�FRQWDLQV�D�FKLOG�ZLQGRZ���WS_CLIPSIBLINGS

6SHFLILHV�D�ZLQGRZ�WKDW�GRHV�QRW�SDLQW�DOO�RYHUODSSLQJ�FKLOG�ZLQGRZV�RXWVLGH�WKH�UHJLRQ�RI�WKH�FKLOG�ZLQGRZV�FOLHQW�DUHD���WS_DLGFRAME

6SHFLILHV�D�ZLQGRZ�ZLWK�D�GLDORJ�ER[�ERUGHU�DQG�QR�FDSWLRQ��WS_MINIMIZE

7KH�ZLQGRZ�LV�FUHDWHG�LQ�D�PLQLPL]HG�VWDWH��WS_MINIMIZEBOX

6SHFLILHV�D�ZLQGRZ�ZLWK�D�PLQLPL]H�EXWWRQ�LQ�WKH�WLWOH�EDU��WS_MAXIMIZE

7KH�ZLQGRZ�LV�FUHDWHG�LQ�D�PD[LPL]HG�VWDWH��WS_MAXIMIZEBOX

6SHFLILHV�D�ZLQGRZ�ZLWK�D�PD[LPL]HG�EXWWRQ�LQ�WKH�WLWOH�EDU��WS_OVERLAPPED

6SHFLILHV�D�ZLQGRZ�ZLWK�D�WLWOH�EDU�DQG�D�ERUGHU��WS_OVERLAPPEDWINDOW

(TXLYDOHQW�WR��:6B29(5/$33('�25�:6B&$37,21�25�:6B6<60(18�25�:6B7+,&.)5$0(�25�:6B0,1,0,=(%2;�25�:6B0$;,0,=(%2;����WS_POPUP

6SHFLILHV�D�SRS�XS�ZLQGRZ��WS_POPUPWINDOW

6SHFLILHV�D�SRS�XS�ZLQGRZ�ZLWK�WKHVH�SURSHUWLHV��:6B%25'(5�25�:6B32383�25�:6B6<60(18�25�:6B&$37,21����WS_SYSMENU

6SHFLILHV�D�ZLQGRZ�FRQWDLQLQJ�D�ZLQGRZ�PHQX�RQ�LWV�WLWOH�EDU��WS_THICKFRAME

6SHFLILHV�D�ZLQGRZ�ZLWK�D�VL]LQJ�ERUGHU��WS_TILED

6DPH�DV�:6B29(5/$33('��

Page 624: Visual Basic - Subclassing and Hooking with VB & VB NET

WS_TILEDWINDOW

6DPH�DV�:6B29(5/$33(':,1'2:��WS_VISIBLE

6SHFLILHV�D�ZLQGRZ�WKDW�LV�LQLWLDOO\�YLVLEOH��[

7KH�SRVLWLRQ�RI�WKH�ZLQGRZ�ZLWK�UHVSHFW�WR�WKH�OHIW�VLGH�RI�WKH�VFUHHQ�\

7KH�SRVLWLRQ�RI�WKH�ZLQGRZ�ZLWK�UHVSHFW�WR�WKH�WRS�RI�WKH�VFUHHQ�Q:LGWK

7KH�ZLGWK�RI�WKH�ZLQGRZ�Q+HLJKW

7KH�KHLJKW�RI�WKH�ZLQGRZ�K:QG3DUHQW

+DQGOH�WR�WKH�SDUHQW�RU�RZQHU�ZLQGRZ�WR�WKLV�ZLQGRZ�K0HQX

+DQGOH�WR�WKH�PHQX�WKDW�LV�XVHG�E\�WKLV�ZLQGRZ�K,QVWDQFH

+DQGOH�RI�WKH�PRGXOH�LQVWDQFH�WR�EH�DVVRFLDWHG�ZLWK�WKLV�ZLQGRZ�OS3DUDP

3RLQWHU�WR�D�YDOXH�WKDW�FDQ�EH�SDVVHG�LQ�WR�WKH�ZLQGRZ�WKURXJK�WKH�&5($7(6758&7�VWUXFWXUH��

5HWXUQ�9DOXH�

,I�WKLV�IXQFWLRQ�VXFFHHGV�LQ�FUHDWLQJ�WKH�ZLQGRZ��D�KDQGOH�WR�WKDW�ZLQGRZ�LV�SDVVHG�EDFN��RWKHUZLVH��D���LV�UHWXUQHG���

DefWindowProc � �

� �3DVVHV�D�PHVVDJH�WR�WKH�GHIDXOW�ZLQGRZ�SURFHGXUH�IRU�GHIDXOW�SURFHVVLQJ���3XEOLF�'HFODUH�)XQFWLRQ�'HI:LQGRZ3URF�/LE��XVHU����B�� � $OLDV��'HI:LQGRZ3URF$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Z0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�WR�ZKLFK�WKH�PHVVDJH�LV�GLUHFWHG��

Page 625: Visual Basic - Subclassing and Hooking with VB & VB NET

X0VJ

$�FRQVWDQW�WKDW�LGHQWLILHV�WKH�PHVVDJH�EHLQJ�VHQW��Z3DUDP

([WUD�LQIRUPDWLRQ�WKDW�WKH�PHVVDJH�FDQ�FRQWDLQ��7KLV�YDOXH�LV�GHWHUPLQHG�E\�WKH�PHVVDJH���

O3DUDP

([WUD�LQIRUPDWLRQ�WKDW�WKH�PHVVDJH�FDQ�FRQWDLQ��7KLV�YDOXH�LV�GHWHUPLQHG�E\�WKH�PHVVDJH���

5HWXUQ�9DOXH�

7KH�UHWXUQ�YDOXH�GHSHQGV�RQ�WKH�PHVVDJH���

EnumChildWindows � �

� �(QXPHUDWHV�WKH�FKLOG�ZLQGRZV�EHORQJLQJ�WR�D�VSHFLILF�SDUHQW�ZLQGRZ���3XEOLF�'HFODUH�)XQFWLRQ�(QXP&KLOG:LQGRZV�/LE��XVHU����$OLDV��(QXP&KLOG:LQGRZV��B�� � �%\9DO�K:QG3DUHQW�$V�/RQJ��%\9DO�OS(QXP)XQF�$V�/RQJ��B�� � %\9DO�O3DUDP�$V�/RQJ��$V�/RQJ��

3DUDPHWHUV�

K:QG3DUHQW 7KH�KDQGOH�WR�WKH�SDUHQW�ZLQGRZ�ZKRVH�FKLOG�ZLQGRZV�ZH�ZDQW�WR�HQXPHUDWH��

OS(QXP)XQF

$�SRLQWHU�WR�D�FDOOEDFN�IXQFWLRQ�O3DUDP

$Q\�RWKHU�GDWD�WKDW�QHHGV�WR�EH�VHQW�WR�WKH�FDOOEDFN�IXQFWLRQ�

5HWXUQ�9DOXH�

5HWXUQV���LI�WKH�IXQFWLRQ�IDLOV��DQ\�RWKHU�YDOXH�LQGLFDWHV�VXFFHVV��

FindText � �

� �'LVSOD\V�WKH�)LQG�FRPPRQ�GLDORJ�ER[���3XEOLF�'HFODUH�)XQFWLRQ�)LQG7H[W�/LE��FRPGOJ���GOO��$OLDV��)LQG7H[W$���B�

Page 626: Visual Basic - Subclassing and Hooking with VB & VB NET

� � �S)LQGUHSODFH�$V�),1'5(3/$&(��$V�/RQJ�

3DUDPHWHUV�

S)LQGUHSODFH

$�SRLQWHU�WR�D�),1'5(3/$&(�VWUXFWXUH�

5HWXUQ�9DOXH�

5HWXUQV���LI�WKHUH�LV�DQ�HUURU��WKH�&ORVH�EXWWRQ�RQ�WKH�WLWOH�EDU�ZDV�FOLFNHG��RU�WKH�&DQFHO�EXWWRQ�ZDV�FOLFNHG��2WKHUZLVH��UHWXUQV�D�QRQ]HUR�YDOXH���

FindWindow � �

� �6HDUFKHV�IRU�WKH�VSHFLILHG�WRS�OHYHO�ZLQGRZ���3XEOLF�'HFODUH�)XQFWLRQ�)LQG:LQGRZ�/LE��XVHU����$OLDV��)LQG:LQGRZ$��B�� � �%\9DO�OS&ODVV1DPH�$V�6WULQJ��%\9DO�OS:LQGRZ1DPH�$V�6WULQJ��$V�/RQJ�

3DUDPHWHUV�

OS&ODVV1DPH

$�VWULQJ�WKDW�FRQWDLQV�WKH�ZLQGRZ�FODVV�QDPH�RI�WKH�ZLQGRZ�EHLQJ�VHDUFKHG�IRU��OS:LQGRZ1DPH

$�VWULQJ�WKDW�FRQWDLQV�WKH�ZLQGRZ�QDPH�RI�WKH�ZLQGRZ�EHLQJ�VHDUFKHG�IRU��

5HWXUQ�9DOXH�

5HWXUQV�WKH�K:QG�RI�WKH�ILUVW�WRS�OHYHO�ZLQGRZ�WKDW�PDWFKHV�WKH�FULWHULD��5HWXUQV�LI�QR�ZLQGRZV�PDWFK�WKH�VSHFLILHG�FULWHULD��,I�PRUH�WKDQ�RQH�ZLQGRZ�LV�IRXQG��LW�UHWXUQV�WKH�ZLQGRZ�KLJKHVW�LQ�WKH�=�RUGHU���

FindWindowEx � �

� �6HDUFKHV�IRU�D�VSHFLILHG�FKLOG�ZLQGRZ���3ULYDWH�'HFODUH�)XQFWLRQ�)LQG:LQGRZ([�/LE��XVHU����$OLDV��)LQG:LQGRZ([$��B�� � �%\9DO�K:QG��$V�/RQJ��%\9DO�K:QG��$V�/RQJ��B�

Page 627: Visual Basic - Subclassing and Hooking with VB & VB NET

� � %\9DO�OSV]��$V�6WULQJ��%\9DO�OSV]��$V�6WULQJ��$V�/RQJ�

3DUDPHWHUV�

K:QG�

7KH�K:QG�RI�WKH�SDUHQW�ZLQGRZ�WR�WKH�ZLQGRZ�WKDW�\RX�ZDQW�WR�ILQG��7KH�IXQFWLRQ�XVHV�WKLV�SDUDPHWHU�DV�D�VWDUWLQJ�SRLQW�IRU�VHDUFKLQJ�IRU�WKH�WDUJHW�ZLQGRZ��,I�1XOO��WKH�IXQFWLRQ�XVHV�WKH�GHVNWRS�DV�WKH�SDUHQW�ZLQGRZ���

K:QG�

7KH�K:QG�RI�DQ\�FKLOG�ZLQGRZV�WR�WKH�ZLQGRZ�VSHFLILHG�E\�WKH�K:QG��SDUDPHWHU��,I�D�YDOLG�FKLOG�ZLQGRZ�KDQGOH�LV�SURYLGHG��WKLV�IXQFWLRQ�VWDUWV�VHDUFKLQJ�WKURXJK�DOO�WKH�ZLQGRZV�WKDW�DUH�FKLOGUHQ�WR�WKH�ZLQGRZ�VSHFLILHG�E\�WKLV�SDUDPHWHU���

OSV]�

7KH�FODVV�QDPH�RU�FODVV�DWRP�RI�WKH�ZLQGRZ�WKDW�ZH�DUH�VHDUFKLQJ�IRU��OSV]�

7KH�FDSWLRQ�RI�WKH�ZLQGRZ�WKDW�ZH�DUH�VHDUFKLQJ�IRU���

5HWXUQ�9DOXH�

,I�WKLV�IXQFWLRQ�VXFFHHGV��WKH�K:QG�RI�WKH�ZLQGRZ�LV�UHWXUQHG��RWKHUZLVH��LW�UHWXUQV�D����LQGLFDWLQJ�IDLOXUH���

GetClassInfoEx � �

� �5HWXUQV�LQIRUPDWLRQ�DERXW�WKH�VSHFLILHG�FODVV���3XEOLF�'HFODUH�)XQFWLRQ�*HW&ODVV,QIR([�/LE��XVHU����$OLDV��*HW&ODVV,QIR([$��B�� � �%\9DO�K,QVWDQFH�$V�/RQJ��%\9DO�OS&ODVV1DPH�$V�6WULQJ��B�� � OS:QG&ODVV�$V�:1'&/$66(;��$V�/RQJ�

3DUDPHWHUV�

K,QVWDQFH

+DQGOH�WR�WKH�DSSOLFDWLRQ�LQVWDQFH�WKDW�FUHDWHG�WKH�FODVV��7KLV�DUJXPHQW�LV�18//�LI�WKH�V\VWHP�FUHDWHG�WKH�FODVV��V\VWHP�ZLGH�FODVV����

OS&ODVV1DPH

7KH�QDPH�RU�FODVV�DWRP�RI�D�UHJLVWHUHG�FODVV���OS:QG&ODVV

3RLQWHU�WR�D�:1'&/$66(;�VWUXFWXUH��ZKLFK�LV�SDVVHG�EDFN�WR�WKH�FDOOLQJ�IXQFWLRQ���

Page 628: Visual Basic - Subclassing and Hooking with VB & VB NET

5HWXUQ�9DOXH�

5HWXUQV�D�QRQ]HUR�YDOXH�LI�LW�VXFFHVVIXOO\�UHWXUQV�D�ZLQGRZ�FODVV�VWUXFWXUH��5HWXUQV���LI�WKH�IXQFWLRQ�IDLOV���

GetDeskTopWindow � �

� �5HWXUQV�DQ�K:QG�WR�WKH�GHVNWRS�ZLQGRZ���3XEOLF�'HFODUH�)XQFWLRQ�*HW'HVNWRS:LQGRZ�/LE��XVHU����B�� � $OLDV��*HW'HVNWRS:LQGRZ�������$V�/RQJ�

3DUDPHWHUV�

7KLV�IXQFWLRQ�WDNHV�QR�DUJXPHQWV��

5HWXUQ�9DOXH�

5HWXUQV�WKH�GHVNWRS�ZLQGRZ�KDQGOH��

GetDlgItem � �

� �5HWXUQV�D�KDQGOH�WR�D�VSHFLILHG�FRQWURO�LQ�D�GLDORJ�ER[���3XEOLF�'HFODUH�)XQFWLRQ�*HW'OJ,WHP�/LE��XVHU����$OLDV��*HW'OJ,WHP��B�� � �%\9DO�K'OJ�$V�/RQJ��%\9DO�Q,''OJ,WHP�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

K'OJ

7KH�KDQGOH�WR�WKH�GLDORJ�ER[�ZKHUH�WKH�FRQWURO�LV�ORFDWHG��7KLV�FDQ�EH�HLWKHU�WKH�GHIDXOW�FRPPRQ�GLDORJ�ER[�RU�WKH�FKLOG�GLDORJ�ER[���

Q,''OJ,WHP

7KH�,'�RI�WKH�FRQWURO�LQ�WKH�UHVRXUFH�ILOH���

5HWXUQ�9DOXH�

5HWXUQV�WKH�KDQGOH�RI�WKH�FRQWURO�WKDW�\RX�VSHFLI\��2WKHUZLVH��UHWXUQV�D�����

Page 629: Visual Basic - Subclassing and Hooking with VB & VB NET

GetMessage � �

� �5HWULHYHV�D�VLQJOH�PHVVDJH�IURP�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�LQ�ZKLFK�WKLV�IXQFWLRQ�ZDV�FDOOHG���3XEOLF�'HFODUH�)XQFWLRQ�*HW0HVVDJH�/LE��XVHU����$OLDV��*HW0HVVDJH$��B����������OS0VJ�$V�06*��%\9DO�KZQG�$V�/RQJ��%\9DO�Z0VJ)LOWHU0LQ�$V�/RQJ�����������%\9DO�Z0VJ)LOWHU0D[�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

OS0VJ

$�/RQJ�SRLQWHU�WR�DQ�06*�VWUXFWXUH�WKDW�UHFHLYHV�WKH�PHVVDJH���KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�ZKRVH�PHVVDJHV�DUH�WR�EH�UHDG�IURP�WKH�TXHXH��,I�WKLV�LV�]HUR��DOO�PHVVDJHV�ZLOO�EH�UHDG���

Z0VJ)LOWHU0LQ

7KH�PLQLPXP�PHVVDJH�YDOXH�WKDW�LV�UHDG�IURP�WKH�PHVVDJH�TXHXH��Z0VJ)LOWHU0D[

7KH�PD[LPXP�PHVVDJH�YDOXH�WKDW�LV�UHWULHYHG�IURP�WKH�PHVVDJH�TXHXH��,I�WKLV�YDOXH�LV�]HUR��DOO�PHVVDJHV�VWDUWLQJ�ZLWK�WKH�Z0VJ)LOWHU0LQ�YDOXH�DUH�UHDG�IURP�WKH�PHVVDJH�TXHXH���

5HWXUQ�9DOXH�

,I�DQ�HUURU�RFFXUV��WKLV�IXQFWLRQ�ZLOO�UHWXUQ�D�����,I�WKLV�IXQFWLRQ�SURFHVVHV�D�:0B48,7�PHVVDJH��LW�ZLOO�UHWXUQ�D����2WKHUZLVH��LW�ZLOO�UHWXUQ�D�QRQ]HUR�YDOXH���

GetParent � �

� �5HWXUQV�DQ�K:QG�RI�WKH�SDUHQW�ZLQGRZ�WR�WKH�VSHFLILHG�ZLQGRZ���3XEOLF�'HFODUH�)XQFWLRQ�*HW3DUHQW�/LE��XVHU����$OLDV��*HW3DUHQW��B�� � �%\9DO�KZQG�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

KZQG

Page 630: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�KDQGOH�RI�WKH�FKLOG�ZLQGRZ�

5HWXUQ�9DOXH�

7KH�KDQGOH�RI�WKDW�FKLOGV�SDUHQW�ZLQGRZ�

GetSaveFileName � �

� �'LVSOD\V�WKH�6DYH�$V�FRPPRQ�GLDORJ�ER[���3ULYDWH�'HFODUH�)XQFWLRQ�*HW6DYH)LOH1DPH�/LE��FRPGOJ���GOO��B�� $OLDV��*HW6DYH)LOH1DPH$���S6DYHILOHQDPH�$V�23(1),/(1$0(��$V�/RQJ�

3DUDPHWHUV�

S6DYH)LOHQDPH

$�SRLQWHU�WR�DQ�23(1),/(1$0(�VWUXFWXUH�

5HWXUQ�9DOXH�

5HWXUQV���LI�WKHUH�LV�DQ�HUURU��WKH�&ORVH�EXWWRQ�RQ�WKH�WLWOH�EDU�ZDV�FOLFNHG��RU�WKH�&DQFHO�EXWWRQ�ZDV�FOLFNHG��2WKHUZLVH��UHWXUQV�D�QRQ]HUR�YDOXH���

GetWindow � �

� �%\�ILUVW�XVLQJ�WKH�*HW'HVNWRS:LQGRZ�RU�WKH�)LQG:LQGRZ�IXQFWLRQV��\RX�FDQ�REWDLQ�D�KDQGOH�WKDW�WKH�*HW:LQGRZ�IXQFWLRQ�FDQ�XVH�WR�ILQG�D�UHODWHG�ZLQGRZ���3XEOLF�'HFODUH�)XQFWLRQ�*HW:LQGRZ�/LE��XVHU����$OLDV��*HW:LQGRZ��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Z&PG�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

KZQG

7KH�KDQGOH�RI�D�ZLQGRZ�XVHG�DV�D�VWDUWLQJ�SRLQW���Z&PG

'HILQHV�WKH�UHODWLRQVKLS�EHWZHHQ�WKH�ZLQGRZ�SURYLGHG�E\�WKH�KZQG�DUJXPHQW�DQG�WKH�ZLQGRZ�KDQGOH�WR�EH�UHWXUQHG�E\�WKLV�IXQFWLRQ��3RVVLEOH�YDOXHV�RI�WKH�Z&PG�

Page 631: Visual Basic - Subclassing and Hooking with VB & VB NET

SDUDPHWHU�DUH�GHVFULEHG�LQ�JUHDWHU�GHWDLO�EHORZ��7KH�Z&PG�DUJXPHQW�FDQ�FRQWDLQ�DQ\�RI�WKH�IROORZLQJ�YDOXHV���GW_CHILD (5)

7KH�UHWXUQHG�ZLQGRZ�KDQGOH�LV�WKH�ILUVW�FKLOG�ZLQGRZ�IRXQG�LQ�WKH�=�RUGHU���GW_ENABLEDPOPUP (6)

7KH�UHWXUQHG�ZLQGRZ�KDQGOH�LV�D�SRS�XS�ZLQGRZ�RZQHG�E\�WKH�ZLQGRZ�UHSUHVHQWHG�E\�WKH�KZQG�DUJXPHQW��)RU�:LQGRZV������RQO\���GW_HWNDFIRST (0)

7KH�UHWXUQHG�ZLQGRZ�KDQGOH�LV�WKH�ILUVW�LQ�WKH�=�RUGHU�ZLWK�WKH�VDPH�ZLQGRZ�W\SH��WRSPRVW��WRS�OHYHO��RU�FKLOG��DV�WKH�ZLQGRZ�UHSUHVHQWHG�E\�WKH�KZQG�DUJXPHQW���GW_HWNDLAST (1)

7KH�UHWXUQHG�ZLQGRZ�KDQGOH�LV�WKH�ODVW�LQ�WKH�=�RUGHU�ZLWK�WKH�VDPH�ZLQGRZ�W\SH��WRSPRVW��WRS�OHYHO��RU�FKLOG��DV�WKH�ZLQGRZ�UHSUHVHQWHG�E\�WKH�KZQG�DUJXPHQW���GW_HWNDNEXT (2)

7KH�UHWXUQHG�ZLQGRZ�KDQGOH�LV�QH[W�LQ�WKH�=�RUGHU�ZLWK�WKH�VDPH�ZLQGRZ�W\SH��WRSPRVW��WRS�OHYHO��RU�FKLOG��DV�WKH�ZLQGRZ�UHSUHVHQWHG�E\�WKH�KZQG�DUJXPHQW���GW_HWNDPREV (3)

7KH�UHWXUQHG�ZLQGRZ�KDQGOH�LV�SUHYLRXV�LQ�WKH�=�RUGHU�ZLWK�WKH�VDPH�ZLQGRZ�W\SH��WRSPRVW��WRS�OHYHO��RU�FKLOG��DV�WKH�ZLQGRZ�UHSUHVHQWHG�E\�WKH�KZQG�DUJXPHQW���GW_OWNER (4)

7KH�UHWXUQHG�ZLQGRZ�KDQGOH�LV�WKH�RZQHU�RI�WKH�ZLQGRZ�UHSUHVHQWHG�E\�WKH�KZQG�DUJXPHQW���

5HWXUQ�9DOXH�

$�ZLQGRZ�KDQGOH�LV�UHWXUQHG�EDVHG�RQ�LWV�UHODWLRQVKLS�ZLWK�WKH�ZLQGRZ�SURYLGHG�LQ�WKH�KZQG�DUJXPHQW��7KH�Z&PG�FRQVWDQW�GHWHUPLQHV�WKLV�UHODWLRQVKLS��LI�QR�ZLQGRZ�PHHWV�WKH�FULWHULRQ�GHILQHG�E\�Z&PG��WKH�IXQFWLRQ�UHWXUQV�HLWKHU���RU�KZQG���

GetWindowLong � �

� �5HWXUQV�WKH�VSHFLILHG�LQIRUPDWLRQ�DERXW�D�ZLQGRZ���3XEOLF�'HFODUH�)XQFWLRQ�*HW:LQGRZ/RQJ�/LE��XVHU����B�� � $OLDV��*HW:LQGRZ/RQJ$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Q,QGH[�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

KZQG

$�ZLQGRZ�KDQGOH��Q,QGH[

Page 632: Visual Basic - Subclassing and Hooking with VB & VB NET

$�FRQVWDQW�WKDW�GHWHUPLQHV�WKH�W\SH�RI�YDOXH�WKDW�WKLV�IXQFWLRQ�ZLOO�UHWXUQ��7KH�*:/B+,167$1&(�FRQVWDQW��RU�����PXVW�EH�SURYLGHG�WR�WKH�Q,QGH[�SDUDPHWHU�WR�UHWXUQ�WKH�DSSOLFDWLRQV�LQVWDQFH�KDQGOH���

5HWXUQ�9DOXH�

,I�VXFFHVVIXO��UHWXUQV�WKH�YDOXH�UHTXHVWHG��2WKHUZLVH��UHWXUQV�D�]HUR���

GetWindowRect � �

� �5HWXUQV�WKH�WRS��OHIW��KHLJKW��DQG�ZLGWK�RI�WKH�VSHFLILHG�ZLQGRZV�ERXQGLQJ�UHFWDQJOH���3ULYDWH�'HFODUH�)XQFWLRQ�*HW:LQGRZ5HFW�/LE��XVHU����B�� � �%\9DO�KZQG�$V�/RQJ��OS5HFW�$V�5(&7��$V�/RQJ�

3DUDPHWHUV�

KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�OS5HFW

$�SRLQWHU�WR�D�5(&7�VWUXFWXUH�

5HWXUQ�9DOXH�

,I�VXFFHVVIXO��UHWXUQV�D�QRQ]HUR�YDOXH��2WKHUZLVH��UHWXUQV�D�]HUR���

OutputDebugStringA � �

� �'LVSOD\V�WKH�VSHFLILHG�VWULQJ�LQ�D�GHEXJJLQJ�ZLQGRZ���3XEOLF�'HFODUH�6XE�2XWSXW'HEXJ6WULQJ$�/LE��NHUQHO����$OLDV��2XWSXW'HEXJ6WULQJ$��B�� � �%\9DO�OS2XWSXW6WULQJ�$V�6WULQJ��

3DUDPHWHUV�

OS2XWSXW6WULQJ

7KH�VWULQJ�WKDW�ZLOO�EH�VHQW�WR�WKH�GHEXJJHU�KRRNHG�XS�WR�WKH�FXUUHQW�DSSOLFDWLRQ��

5HWXUQ�9DOXH�

Page 633: Visual Basic - Subclassing and Hooking with VB & VB NET

1RQH�

PageSetupDlg � �

� �'LVSOD\V�D�3DJH�6HWXS�FRPPRQ�GLDORJ�ER[���3XEOLF�'HFODUH�)XQFWLRQ�3DJH6HWXS'OJ�/LE��FRPGOJ���GOO��$OLDV��3DJH6HWXS'OJ$��B�� � �S3DJHVHWXSGOJ�$V�3$*(6(783'/*��$V�/RQJ�

3DUDPHWHUV�

S3DJHVHWXSGOJ

$�SRLQWHU�WR�D�3$*(6(783'/)�VWUXFWXUH�

5HWXUQ�9DOXH�

5HWXUQV�LI�WKHUH�LV�DQ�HUURU��WKH�&ORVH�EXWWRQ�RQ�WKH�WLWOH�EDU�ZDV�FOLFNHG��RU�WKH�&DQFHO�EXWWRQ�ZDV�FOLFNHG��2WKHUZLVH��UHWXUQV�D�QRQ]HUR�YDOXH���

PeekMessage � �

� �3HHN0HVVDJH�LV�VLPLODU�WR�*HW0HVVDJH�LQ�WKDW�LW�JHWV�D�PHVVDJH�IURP�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�WKDW�FDOOV�WKLV��7KH�PDLQ�GLIIHUHQFH�LV�WKDW�3HHN0HVVDJH�GRHV�QRW�DXWRPDWLFDOO\�UHPRYH�WKH�PHVVDJH�IURP�WKH�PHVVDJH�TXHXH��DQG�*HW0HVVDJH�GRHV���3XEOLF�'HFODUH�)XQFWLRQ�3HHN0HVVDJH�/LE��XVHU����$OLDV��3HHN0HVVDJH$��B�� � �OS0VJ�$V�06*��%\9DO�KZQG�$V�/RQJ��%\9DO�Z0VJ)LOWHU0LQ�$V�/RQJ��B�� � %\9DO�Z0VJ)LOWHU0D[�$V�/RQJ��%\9DO�Z5HPRYH0VJ�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

OS0VJ

$�/RQJ�SRLQWHU�WR�DQ�06*�VWUXFWXUH��KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�ZKRVH�PHVVDJHV�DUH�WR�EH�UHDG�IURP�WKH�TXHXH��,I�WKLV�LV�]HUR��DOO�PHVVDJHV�ZLOO�EH�UHDG���

Z0VJ)LOWHU0LQ

7KH�PLQLPXP�PHVVDJH�YDOXH�WKDW�LV�UHDG�IURP�WKH�PHVVDJH�TXHXH��Z0VJ)LOWHU0D[

Page 634: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�PD[LPXP�PHVVDJH�YDOXH�WKDW�LV�UHWULHYHG�IURP�WKH�PHVVDJH�TXHXH��,I�WKLV�YDOXH�LV�]HUR��DOO�PHVVDJHV�VWDUWLQJ�ZLWK�WKH�Z0VJ)LOWHU0LQ�YDOXH�DUH�UHDG�IURP�WKH�PHVVDJH�TXHXH���

Z5HPRYH0VJ

,I�WKLV�LV�VHW�WR����WKH�PHVVDJH�LV�UHDG�DQG�WKHQ�UHPRYHG�IURP�WKH�TXHXH��,I�WKLV�LV�VHW�WR����WKH�PHVVDJH�LV�UHDG�EXW�OHIW�RQ�WKH�TXHXH���

5HWXUQ�9DOXH�

,I�WKHUH�DUH�QR�PHVVDJHV�RQ�WKH�TXHXH��WKH�UHWXUQ�YDOXH�IRU�WKLV�IXQFWLRQ�LV�]HUR��$�QRQ]HUR�UHWXUQ�YDOXH�PHDQV�WKDW�D�PHVVDJH�KDV�EHHQ�UHDG�IURP�WKH�TXHXH���

PostMessage � �

� �7KLV�IXQFWLRQ�VLPSO\�SRVWV�D�PHVVDJH�WR�WKH�PHVVDJH�TXHXH�RI�RQH�RU�PRUH�WKUHDGV��$IWHU�SRVWLQJ�WKH�PHVVDJH��WKH�3RVW0HVVDJH�IXQFWLRQ�UHWXUQV��LW�GRHV�QRW�ZDLW�IRU�D�UHVSRQVH�WR�WKH�SRVWHG�PHVVDJH��DV�GRHV�6HQG0HVVDJH���3XEOLF�'HFODUH�)XQFWLRQ�3RVW0HVVDJH�/LE��XVHU����$OLDV��3RVW0HVVDJH$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Z0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

KZQG

7KH�ZLQGRZ�KDQGOH�WKDW�WKH�PHVVDJH�LV�GLUHFWHG�WR��,I�WKLV�SDUDPHWHU�LV�VHW�WR�+:1'B%52$'&$67��WKH�PHVVDJH�LV�SRVWHG�WR�DOO�WRS�OHYHO�ZLQGRZV�LQ�WKH�V\VWHP��,I�WKLV�SDUDPHWHU�LV�VHW�WR�18//��WKH�PHVVDJH�LV�SRVWHG�WR�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�LQ�ZKLFK�WKLV�IXQFWLRQ�ZDV�FDOOHG���

X0VJ

7KH�PHVVDJH�LGHQWLILHU��O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH��Z3DUDP

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH��

5HWXUQ�9DOXH�

7KH�UHWXUQ�YDOXH�LV�QRQ]HUR�LI�WKH�IXQFWLRQ�VXFFHHGHG�LQ�SRVWLQJ�WKH�PHVVDJH��RWKHUZLVH��UHWXUQV�D�]HUR�YDOXH���

Page 635: Visual Basic - Subclassing and Hooking with VB & VB NET

PostQuitMessage � �

� �3RVWV�D�:0B48,7�PHVVDJH�WR�WKH�PHVVDJH�TXHXH�RI�WKH�WKUHDG�WKDW�FDOOHG�WKLV�IXQFWLRQ���3XEOLF�'HFODUH�6XE�3RVW4XLW0HVVDJH�/LE��XVHU����$OLDV��3RVW4XLW0HVVDJH��B�� � �%\9DO�Q([LW&RGH�$V�/RQJ��

3DUDPHWHUV�

Q([LW&RGH

$�FRGH�WKDW�LV�VHQW�WR�WKH�Z3DUDP�SDUDPHWHU�RI�WKH�:0B48,7�PHVVDJH��

5HWXUQ�9DOXH�

1RQH�

PostThreadMessage � �

� �7KLV�IXQFWLRQ�XVHV�WKH�DFWXDO�WKUHDG�,'�WR�GHWHUPLQH�ZKLFK�PHVVDJH�TXHXH�LV�WR�UHFHLYH�WKH�PHVVDJH��7KLV�IXQFWLRQ�DOVR�GRHV�QRW�ZDLW�IRU�D�UHVSRQVH�WR�WKH�SRVWHG�PHVVDJH��7KLV�IXQFWLRQ�LV�GHILQHG�DV�IROORZV���3XEOLF�'HFODUH�)XQFWLRQ�3RVW7KUHDG0HVVDJH�/LE��XVHU����B����������$OLDV��3RVW7KUHDG0HVVDJH$��B�� � �%\9DO�LG7KUHDG�$V�/RQJ��%\9DO�PVJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

LG7KUHDG

7KH�WKUHDG�LGHQWLILHU�WKDW�WKH�PHVVDJH�LV�SRVWHG�WR��<RX�FDQ�GHWHUPLQH�WKLV�YDOXH�XVLQJ�WKH�9LVXDO�%DVLF�$SS�7KUHDG,'�PHWKRG��RU�E\�XVLQJ�HLWKHU�RI�WKH�*HW&XUUHQW7KUHDG,'�RU�*HW:LQGRZ7KUHDG3URFHVV,G�$3,�IXQFWLRQV���

X0VJ

7KH�PHVVDJH�LGHQWLILHU��O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH��Z3DUDP

Page 636: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH��

5HWXUQ�9DOXH�

7KH�UHWXUQ�YDOXH�LV�QRQ]HUR�LI�WKH�IXQFWLRQ�VXFFHHGHG�LQ�SRVWLQJ�WKH�PHVVDJH��RWKHUZLVH��UHWXUQV�D�]HUR�YDOXH���

PrintDlg � �

� �'LVSOD\V�WKH�3ULQW�FRPPRQ�GLDORJ�ER[���3XEOLF�'HFODUH�)XQFWLRQ�3ULQW'OJ�/LE��FRPGOJ���GOO��$OLDV��3ULQW'OJ$��B�� � �S3ULQWGOJ�$V�35,17'/*��$V�/RQJ�

3DUDPHWHUV�

S3ULQWGOJ

$�SRLQWHU�WR�D�35,17'/*�VWUXFWXUH�

5HWXUQ�9DOXH�

5HWXUQV���LI�WKHUH�LV�DQ�HUURU��WKH�&ORVH�EXWWRQ�RQ�WKH�WLWOH�EDU�ZDV�FOLFNHG��RU�WKH�&DQFHO�EXWWRQ�ZDV�FOLFNHG��2WKHUZLVH��UHWXUQV�D�QRQ]HUR�YDOXH���

PrintDlgEx � �

� �'LVSOD\V�WKH�3ULQW�3URSHUW\�6KHHW�FRPPRQ�GLDORJ�ER[���3XEOLF�'HFODUH�)XQFWLRQ�3ULQW'OJ([�/LE��FRPGOJ���GOO��$OLDV��3ULQW'OJ$��B�� � �S3ULQWGOJ�$V�35,17'/*(;��$V�/RQJ�

3DUDPHWHUV�

S3ULQJGOJ

$�SRLQWHU�WR�D�35,17'/*(;�VWUXFWXUH�

5HWXUQ�9DOXH�

5HWXUQV���LI�WKHUH�LV�DQ�HUURU��WKH�&ORVH�EXWWRQ�RQ�WKH�WLWOH�EDU�ZDV�FOLFNHG��RU�WKH�&DQFHO�EXWWRQ�ZDV�FOLFNHG��2WKHUZLVH��UHWXUQV�D�QRQ]HUR�YDOXH���

Page 637: Visual Basic - Subclassing and Hooking with VB & VB NET

RegisterClassEx � �

� �5HJLVWHUV�D�QHZ�ZLQGRZV�FODVV�VR�WKDW�LW�FDQ�EH�XVHG�LQ�VXEVHTXHQW�ZLQGRZ�FUHDWLRQ���3XEOLF�'HFODUH�)XQFWLRQ�5HJLVWHU&ODVV([�/LE��XVHU����B�� � $OLDV��5HJLVWHU&ODVV([$��B�� � �SF:QG&ODVV([�$V�:1'&/$66(;��$V�,QWHJHU�

3DUDPHWHUV�

SF:QG&ODVV([

$�SRLQWHU�WR�WKH�:1'&/$66(;�VWUXFWXUH�

5HWXUQ�9DOXH�

5HWXUQV�D�FODVV�DWRP��ZKLFK�LV�D�XQLTXH�LGHQWLILHU�WR�WKH�QHZO\�UHJLVWHUHG�FODVV��$�UHWXUQ�YDOXH�RI�LQGLFDWHV�IDLOXUH���

RegisterWindowMessage � �

� �5HJLVWHUV�D�QHZ�PHVVDJH�WKDW�WKH�V\VWHP�FDQ�XVH���3XEOLF�'HFODUH�)XQFWLRQ�5HJLVWHU:LQGRZ0HVVDJH�/LE��XVHU����B�����$OLDV��5HJLVWHU:LQGRZ0HVVDJH$��B������%\9DO�OS6WULQJ�$V�6WULQJ��$V�/RQJ�

3DUDPHWHUV�

OS6WULQJ

$�QXOO�WHUPLQDWHG�VWULQJ�WKDW�LGHQWLILHV�WKH�QHZ�PHVVDJH�

5HWXUQ�9DOXH�

5HWXUQV�D�XQLTXH�QXPEHU�LGHQWLI\LQJ�WKH�PHVVDJH�LQ�WKH�UDQJH�RI�+&����WR�+))))��0HVVDJHV�LQ�WKLV�UDQJH�DUH�JOREDO�WR�WKH�V\VWHP��WKHUHIRUH��DIWHU�D�PHVVDJH�LV�UHJLVWHUHG��DQ\�DSSOLFDWLRQ�FDQ�XVH�LW��,I�D�LV�UHWXUQHG��WKH�PHVVDJH�IDLOHG�WR�UHJLVWHU���

ReleaseCapture � �

Page 638: Visual Basic - Subclassing and Hooking with VB & VB NET

� �5HOHDVHV�WKH�PRXVH�FDSWXUH�IRU�D�ZLQGRZ���3ULYDWH�'HFODUH�)XQFWLRQ�5HOHDVH&DSWXUH�/LE��XVHU����B���������$OLDV��5HOHDVH&DSWXUH�������$V�/RQJ�

3DUDPHWHUV�

7KLV�IXQFWLRQ�WDNHV�QR�SDUDPHWHUV��

5HWXUQ�9DOXH�

5HWXUQV�D�QRQ]HUR�YDOXH�LI�WKH�IXQFWLRQ�VXFFHHGV�LQ�UHOHDVLQJ�WKH�PRXVH�FDSWXUH�RQ�WKH�ZLQGRZ��RU�D�LI�WKH�IXQFWLRQ�IDLOHG���

ReplaceText � �

� �'LVSOD\V�WKH�5HSODFH�FRPPRQ�GLDORJ�ER[���3XEOLF�'HFODUH�)XQFWLRQ�5HSODFH7H[W�/LE��FRPGOJ���GOO��$OLDV��5HSODFH7H[W$��B�� � �S)LQGUHSODFH�$V�),1'5(3/$&(��$V�/RQJ�

3DUDPHWHUV�

S)LQGUHSODFH

$�SRLQWHU�WR�D�),1'5(3/$&(�VWUXFWXUH�

5HWXUQ�9DOXH�

5HWXUQV���LI�WKHUH�LV�DQ�HUURU��WKH�&ORVH�EXWWRQ�RQ�WKH�WLWOH�EDU�ZDV�FOLFNHG��RU�WKH�&DQFHO�EXWWRQ�ZDV�FOLFNHG��2WKHUZLVH��UHWXUQV�D�QRQ]HUR�YDOXH���

SendDlgItemMessage � �

� �6HQG'OJ,WHP0HVVDJH�RSHUDWHV�VLPLODUO\�WR�6HQG0HVVDJH��%RWK�IXQFWLRQV�DUH�V\QFKURQRXV��DQG�ERWK�UHWXUQ�D�YDOXH�WKDW�GHSHQGV�RQ�WKH�PHVVDJH�VHQW��7KH�PDLQ�GLIIHUHQFH�EHWZHHQ�WKHVH�WZR�IXQFWLRQV�LV�WKDW�\RX�FDQ�VSHFLI\�D�FRQWURO�,'�LQ�6HQG'OJ,WHP0HVVDJH��7KLV�DOORZV�D�PHVVDJH�WR�EH�VHQW�WR�D�FRQWURO�ZKHQ�\RX�NQRZ�LWV�,'�EXW�QRW�LWV�KZQG���

Page 639: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�'HFODUH�)XQFWLRQ�6HQG'OJ,WHP0HVVDJH�/LE��XVHU����B����������$OLDV��6HQG'OJ,WHP0HVVDJH$��B�� � �%\9DO�K'OJ�$V�/RQJ��%\9DO�Q,''OJ,WHP�$V�/RQJ��B�� � %\9DO�Z0VJ�$V�/RQJ��%\9DO�Z3DUDP�$V�/RQJ��B�� � %\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

K'OJ

7KH�KDQGOH�RI�WKH�WDUJHW�GLDORJ�ER[��Q,''OJ,WHP

7KH�,'�RI�WKH�FRQWURO�RQ�WKH�GLDORJ�ER[�VSHFLILHG�E\�WKH�K'OJ�KDQGOH��<RX�FDQ�ILQG�WKH�FRQWURO�,'�E\�XVLQJ�6S\�����

Z0VJ

7KH�PHVVDJH�WR�VHQG�WR�WKH�WDUJHW�ZLQGRZ��Z3DUDP

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH��O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH��

5HWXUQ�9DOXH�

7KH�UHWXUQ�YDOXH�GHSHQGV�RQ�WKH�PHVVDJH�VHQW��

SendMessage � �

� �6HQGV�D�PHVVDJH�WR�WKH�VSHFLILHG�WDUJHW�ZLQGRZ���3XEOLF�'HFODUH�)XQFWLRQ�6HQG0HVVDJH�/LE��XVHU����$OLDV��6HQG0HVVDJH$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Z0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��O3DUDP�$V�$Q\��$V�/RQJ�

3DUDPHWHUV�

KZQG

7KH�KDQGOH�RI�WKH�WDUJHW�ZLQGRZ��RU�+:1'B%52$'&$67�LI�WKH�PHVVDJH�LV�WR�EH�VHQW�WR�DOO�WRS�OHYHO�ZLQGRZV�LQ�WKH�V\VWHP��

Z0VJ

7KH�PHVVDJH�WR�VHQG�WR�WKH�WDUJHW�ZLQGRZ�Z3DUDP

Page 640: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH�O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH�

5HWXUQ�9DOXH�

7KH�UHWXUQ�YDOXH�GHSHQGV�RQ�WKH�PHVVDJH�VHQW���

SendMessageCallback � �

� �6HQGV�D�PHVVDJH�WR�D�ZLQGRZ�DQG�UHWXUQV�LPPHGLDWHO\���3XEOLF�'HFODUH�)XQFWLRQ�6HQG0HVVDJH&DOOEDFN�/LE��XVHU����B����������$OLDV��6HQG0HVVDJH&DOOEDFN$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��B�� � %\9DO�OS5HVXOW&DOO%DFN�$V�/RQJ��%\9DO�GZ'DWD�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

KZQG

7KH�KDQGOH�RI�WKH�WDUJHW�ZLQGRZ��RU�+:1'B%52$'&$67�LI�WKH�PHVVDJH�LV�WR�EH�VHQW�WR�DOO�WRS�OHYHO�ZLQGRZV�LQ�WKH�V\VWHP��

Z0VJ

7KH�PHVVDJH�WR�VHQG�WR�WKH�WDUJHW�ZLQGRZ�Z3DUDP

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH�O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH�OS5HVXOW&DOO%DFN

7KH�FDOOEDFN�IXQFWLRQ�DGGUHVV�GZ'DWD

'DWD�WR�EH�SDVVHG�LQWR�WKH�FDOOEDFN�IXQFWLRQ�

5HWXUQ�9DOXH�

7KH�UHWXUQ�YDOXH�LV�D�VXFFHVV�RU�IDLOXUH��D�]HUR�RU�D�QRQ]HUR�YDOXH��UHVSHFWLYHO\���+RZHYHU��WKLV�IXQFWLRQ�XVHV�D�FDOOEDFN�IXQFWLRQ�WR�UHWULHYH�WKH�PHVVDJH�GHSHQGHQW�UHWXUQ�YDOXH���

SendMessageTimeout � �

Page 641: Visual Basic - Subclassing and Hooking with VB & VB NET

� �6HQGV�WKH�PHVVDJH�WR�WKH�WDUJHW�ZLQGRZ�DQG�WKHQ�ZDLWV�WKH�QXPEHU�RI�PLOOLVHFRQGV�VSHFLILHG�LQ�WKH�X7LPHRXW�SDUDPHWHU���3XEOLF�'HFODUH�)XQFWLRQ�6HQG0HVVDJH7LPHRXW�/LE��XVHU����B����������$OLDV��6HQG0HVVDJH7LPHRXW$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��B�� � %\9DO�IX)ODJV�$V�/RQJ��%\9DO�X7LPHRXW�$V�/RQJ��B�� � OSGZ5HVXOW�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

KZQG

7KH�KDQGOH�RI�WKH�WDUJHW�ZLQGRZ��RU�+:1'B%52$'&$67�LI�WKH�PHVVDJH�LV�WR�EH�VHQW�WR�DOO�WRS�OHYHO�ZLQGRZV�LQ�WKH�V\VWHP���

0VJ

7KH�PHVVDJH�WR�VHQG�WR�WKH�WDUJHW�ZLQGRZ��Z3DUDP

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH��O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH��IX)ODJV

'HWHUPLQHV�KRZ�WKH�PHVVDJH�LV�VHQW��9DOLG�YDOXHV�DUH�DV�IROORZV��SMTO_NORMAL (&H0 )

'RHV�QRW�EORFN�FDOOLQJ�WKUHDG�XQWLO�IXQFWLRQ�UHWXUQV�SMTO_BLOCK (&H1 )

%ORFNV�FDOOLQJ�WKUHDG�XQWLO�IXQFWLRQ�UHWXUQV�SMTO_ABORTIFHUNG (&H2 )

5HWXUQV�LI�WKH�DSSOLFDWLRQ�LV�KXQJ�SMTO_NOTIMEOUTIFNOTHUNG (&H10 )

�:LQ�����RQO\��'RHV�QRW�UHWXUQ�IURP�WKH�IXQFWLRQ�LI�WKH�DSSOLFDWLRQ�LV�QRW�KXQJ��HYHQ�WKRXJK�WKH�WLPHRXW�SHULRG�PLJKW�EH�H[SLUHG��

X7LPHRXW 7KH�WLPHRXW�YDOXH�LQ�PLOOLVHFRQGV�EHIRUH�WKH�IXQFWLRQ�WLPHV�RXW�DQG�UHWXUQV���

OSGZ5HVXOW 7KH�UHVXOW�RI�SURFHVVLQJ�WKH�PHVVDJH��

5HWXUQ�9DOXH�

5HWXUQV���LI�WKH�IXQFWLRQ�VXFFHHGHG��DQG�QRQ]HUR�LI�LW�WLPHG�RXW�RU�IDLOHG���

Page 642: Visual Basic - Subclassing and Hooking with VB & VB NET

SendNotifyMessage � �

� �,I�WKLV�IXQFWLRQ�LV�XVHG�WR�VHQG�D�PHVVDJH�WR�D�ZLQGRZ�LQ�WKH�VDPH�WKUHDG��WKH�FDOOLQJ�IXQFWLRQ�KDOWV�SURFHVVLQJ�XQWLO�WKH�6HQG1RWLI\0HVVDJH�IXQFWLRQ�UHWXUQV��VLPLODU�WR�WKH�6HQG0HVVDJH�IXQFWLRQ��,I�WKH�PHVVDJH�LV�VHQW�WR�D�ZLQGRZ�LQ�D�GLIIHUHQW�WKUHDG��WKH�IXQFWLRQ�UHWXUQV�LPPHGLDWHO\���3XEOLF�'HFODUH�)XQFWLRQ�6HQG1RWLI\0HVVDJH�/LE��XVHU����B����������$OLDV��6HQG1RWLI\0HVVDJH$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�0VJ�$V�/RQJ��B�� � %\9DO�Z3DUDP�$V�/RQJ��%\9DO�O3DUDP�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

KZQG

7KH�KDQGOH�RI�WKH�WDUJHW�ZLQGRZ��RU�+:1'B%52$'&$67�LI�WKH�PHVVDJH�LV�WR�EH�VHQW�WR�DOO�WRS�OHYHO�ZLQGRZV�LQ�WKH�V\VWHP��

Z0VJ

7KH�PHVVDJH�WR�VHQG�WR�WKH�WDUJHW�ZLQGRZ�Z3DUDP

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH�O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH�

5HWXUQ�9DOXH�

7KLV�IXQFWLRQ�UHWXUQV�RQO\�DQ�HUURU�VWDWXV��]HUR�RQ�IDLOXUH��QRQ]HUR�RQ�VXFFHVV��DQG�QR�RWKHU�LQIRUPDWLRQ���

SetCapture � �

� �6HWV�WKH�PRXVH�FDSWXUH�IRU�D�ZLQGRZ���3ULYDWH�'HFODUH�)XQFWLRQ�6HW&DSWXUH�/LE��XVHU����$OLDV��6HW&DSWXUH��B�� � �%\9DO�KZQG�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

Page 643: Visual Basic - Subclassing and Hooking with VB & VB NET

KZQG

7KH�ZLQGRZ�KDQGOH�RI�WKH�ZLQGRZ�WKDW�VKRXOG�UHFHLYH�DOO�PRXVH�LQSXW�

5HWXUQ�9DOXH�

5HWXUQV�WKH�ZLQGRZ�KDQGOH�RI�WKH�ZLQGRZ�WKDW�SUHYLRXVO\�KDG�WKH�PRXVH�FDSWXUH��,I�QR�ZLQGRZ�KDG�WKH�PRXVH�FDSWXUH��UHWXUQV�D�18//���

SetClassLongPtr � �

� �5HSODFHV�WKH�VSHFLILHG�PHPEHU�RI�WKH�:1'&/$66(;�VWUXFWXUH�RI�D�ZLQGRZ���3XEOLF�'HFODUH�)XQFWLRQ�6HW&ODVV/RQJ3WU�/LE��XVHU����$OLDV��6HW&ODVV/RQJ$��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Q,QGH[�$V�/RQJ��B�� � %\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

KZQG

7KH�KDQGOH�WR�D�ZLQGRZ�WKDW�ZDV�FUHDWHG�XVLQJ�WKH�FODVV�ZH�ZDQW�WR�PRGLI\��<RX�FDQ�REWDLQ�LW�E\�UHWULHYLQJ�WKH�YDOXH�RI�D�IRUP�RU�FRQWUROV�K:QG�SURSHUW\���

Q,QGH[

$�/RQJ�LQGLFDWLQJ�WKH�ZLQGRZ�DWWULEXWH�WR�EH�PRGLILHG��$�QXPEHU�RI�YDOXHV�DUH�SRVVLEOH��WKRXJK�WKH�YDOXH�XVHG�WR�PRGLI\�WKH�ZLQGRZ�SURFHGXUH�LV�*&/3B:1'352&��RU�������

GZ1HZ/RQJ

7KH�UHSODFHPHQW�YDOXH��)RU�D�VXEFODVVHG�ZLQGRZ��WKLV�SDUDPHWHU�UHSUHVHQWV�WKH�DGGUHVV�RI�WKH�QHZ�ZLQGRZ�SURFHGXUH��<RX�FDQ�JHW�WKH�DGGUHVV�RI�\RXU�QHZ�ZLQGRZ�SURFHGXUH�E\�SDVVLQJ�LWV�QDPH�DV�DQ�DUJXPHQW�WR�WKH�$GGUHVV2I�RSHUDWRU���

5HWXUQ�9DOXH�

7KH�UHWXUQ�YDOXH�RI�WKLV�IXQFWLRQ�ZLOO�EH�WKH�RULJLQDO�YDOXH�LQ�WKH�FODVV�VWUXFWXUH�WKDW�ZDV�UHSODFHG�ZLWK�WKH�YDOXH�LQ�WKH�GZ1HZ/RQJ�DUJXPHQW��)RU�RXU�SXUSRVHV��WKLV�IXQFWLRQ�ZLOO�UHWXUQ�D�]HUR�LI�DQ�HUURU�RFFXUUHG��RU�WKH�DGGUHVV�RI�WKH�RULJLQDO�FODVV�ZLQGRZ�SURFHGXUH�LI�LW�ZDV�VXFFHVVIXO���

SetWindowLongPtr � �

Page 644: Visual Basic - Subclassing and Hooking with VB & VB NET

� �0RGLILHV�WKH�SURSHUWLHV�RI�D�ZLQGRZ���'HFODUH�)XQFWLRQ�6HW:LQGRZ/RQJ3WU�/LE��XVHU����$OLDV��6HW:LQGRZ/RQJ$��B�� � � �%\9DO�KZQG�$V�/RQJ��B�� � � %\9DO�Q,QGH[�$V�/RQJ��B�� � � %\9DO�GZ1HZ/RQJ�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�ZKRVH�DWWULEXWH�LV�WR�EH�PRGLILHG��<RX�FDQ�REWDLQ�LW�E\�UHWULHYLQJ�WKH�YDOXH�RI�D�IRUP�RU�FRQWUROV�K:QG�SURSHUW\���

Q,QGH[

$�/RQJ�LQGLFDWLQJ�WKH�ZLQGRZ�DWWULEXWH�WR�EH�PRGLILHG��$�QXPEHU�RI�YDOXHV�DUH�SRVVLEOH��WKRXJK�WKH�YDOXH�XVHG�WR�UHSODFH�D�ZLQGRZ�SURFHGXUH�LV�*:/3B:1'352&��RU������

GZ1HZ/RQJ

7KH�UHSODFHPHQW�YDOXH��)RU�D�VXEFODVVHG�ZLQGRZ��WKLV�SDUDPHWHU�UHSUHVHQWV�WKH�DGGUHVV�RI�WKH�QHZ�ZLQGRZ�SURFHGXUH��<RX�FDQ�JHW�WKH�DGGUHVV�RI�\RXU�QHZ�ZLQGRZ�SURFHGXUH�E\�SDVVLQJ�LWV�QDPH�DV�DQ�DUJXPHQW�WR�WKH�$GGUHVV2I�RSHUDWRU���

5HWXUQ�9DOXH�

,I�VXFFHVVIXO��WKH�IXQFWLRQ�UHWXUQV�WKH�RULJLQDO�YDOXH�EHIRUH�UHSODFHPHQW��LQ�WKLV�FDVH��WKH�RULJLQDO�DGGUHVV�RI�WKH�ZLQGRZ�SURFHGXUH���,I�LW�IDLOV��LW�UHWXUQV�����

SetWindowPos � �

� �$OORZV�D�ZLQGRZV�VL]H��SRVLWLRQ��RU�ORFDWLRQ�LQ�WKH�ZLQGRZ�=�RUGHU�WR�EH�PRGLILHG���3XEOLF�'HFODUH�)XQFWLRQ�6HW:LQGRZ3RV�/LE��XVHU����$OLDV��6HW:LQGRZ3RV��B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�K:QG,QVHUW$IWHU�$V�/RQJ��B�� � %\9DO�[�$V�/RQJ��%\9DO�\�$V�/RQJ��%\9DO�F[�$V�/RQJ��B�� � %\9DO�F\�$V�/RQJ��%\9DO�Z)ODJV�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�EHLQJ�PRGLILHG��

Page 645: Visual Basic - Subclassing and Hooking with VB & VB NET

K:QG,QVHUW$IWHU 7KH�KDQGOH�RI�WKH�ZLQGRZ�WKDW�FRPHV�EHIRUH�WKLV�ZLQGRZ�LQ�WKH�=�RUGHU��7KLV�DUJXPHQW�DOVR�FDQ�WDNH�WKH�IROORZLQJ�FRQVWDQWV���HWND_BOTTOM (1)

3ODFHV�WKH�ZLQGRZ�DW�WKH�ERWWRP�RI�WKH�=�RUGHU��HWND_NOTOPMOST (-2)

)RU�WRSPRVW�ZLQGRZV��SODFHV�WKH�ZLQGRZ�DERYH�DOO�QRQ�WRSPRVW�ZLQGRZV��WKDW�LV��EHKLQG�DOO�WRSPRVW�ZLQGRZV���)RU�QRQ�WRSPRVW�ZLQGRZV��WKH�IODJ�KDV�QR�HIIHFW���HWND_TOP (0)

3ODFHV�WKH�ZLQGRZ�DW�WKH�WRS�RI�WKH�=�RUGHU��HWND_TOPMOST (-1)

3ODFHV�WKH�ZLQGRZ�DERYH�DOO�QRQ�WRSPRVW�ZLQGRZV�DQG�PDLQWDLQV�WKH�ZLQGRZV�WRSPRVW�SRVLWLRQ��HYHQ�LI�LW�ORVHV�WKH�IRFXV��DQ�RSWLRQ�W\SLFDOO\�LQGLFDWHG�RQ�PHQXV�DV��DOZD\V�RQ�WRS�����

[

(TXLYDOHQW�WR�WKH�/HIW�SURSHUW\�LQ�9LVXDO�%DVLF��\

(TXLYDOHQW�WR�WKH�7RS�SURSHUW\�LQ�9LVXDO�%DVLF��F[

(TXLYDOHQW�WR�WKH�:LGWK�SURSHUW\�LQ�9LVXDO�%DVLF��F\

(TXLYDOHQW�WR�WKH�+HLJKW�SURSHUW\�LQ�9LVXDO�%DVLF��Z)ODJV

)ODJV�WKDW�VSHFLI\�WKH�VL]LQJ�DQG�SRVLWLRQLQJ�DWWULEXWHV��,I�PXOWLSOH�IODJV�DUH�SUHVHQW��\RX�FDQ�ORJLFDOO\�2U�WKHP�WRJHWKHU��6RPH�RI�WKH�SRVVLEOH�IODJV�DUH���SWP_DRAWFRAME (32)

'UDZV�D�IUDPH�DURXQG�WKH�ZLQGRZ��SWP_HIDEWINDOW (128)

+LGHV�WKH�ZLQGRZ��SWP_NOACTIVATE (16)

'RHV�QRW�DFWLYDWH�WKH�ZLQGRZ��2WKHUZLVH��6HW:LQGRZ3RV�E\�GHIDXOW�DFWLYDWHV�WKH�ZLQGRZ���SWP_NOMOVE (2)

5HWDLQV�WKH�ZLQGRZV�FXUUHQW�SRVLWLRQ��L�H���LJQRUHV�WKH�[�DQG�\�SDUDPHWHUV����SWP_NOOWNERZORDER (512)

/HDYHV�WKH�RZQHU�ZLQGRZV�SRVLWLRQ�LQ�WKH�=�RUGHU�XQFKDQJHG��SWP_NOREPOSITION (512)

7KH�VDPH�DV�WKH�6:3B122:1(5=25'(5�IODJ��SWP_NOSIZE (1)

5HWDLQV�WKH�FXUUHQW�ZLQGRZ�VL]H��LJQRUHV�WKH�F[�DQG�F\�SDUDPHWHUV����SWP_NOZORDER (4)

5HWDLQV�WKH�FXUUHQW�=�RUGHU��LJQRUHV�WKH�K:QG,QVHUW$IWHU�SDUDPHWHU����SWP_SHOWWINDOW (64)

'LVSOD\V�WKH�ZLQGRZ��

Page 646: Visual Basic - Subclassing and Hooking with VB & VB NET

5HWXUQ�9DOXH�

$�UHWXUQ�YDOXH�RI�QRQ]HUR�LQGLFDWHV�VXFFHVV��D�UHWXUQ�YDOXH�RI�]HUR�LQGLFDWHV�IDLOXUH���

SetWindowsHookEx � �

� �,QVWDOOV�WKH�VSHFLILHG�ZLQGRZV�KRRN���3XEOLF�'HFODUH�)XQFWLRQ�6HW:LQGRZV+RRN([�/LE��XVHU����B�� � $OLDV��6HW:LQGRZV+RRN([$��B�� � �%\9DO�LG+RRN�$V�/RQJ��%\9DO�OSIQ�$V�/RQJ��B�� � %\9DO�KPRG�$V�/RQJ��%\9DO�GZ7KUHDG,G�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

LG+RRN

7KLV�LV�WKH�LGHQWLILHU�RI�WKH�W\SH�RI�KRRN�WKDW�LV�EHLQJ�LQVWDOOHG��OSIQ

)XQFWLRQ�SRLQWHU�WKDW�SRLQWV�WR�WKH�KRRN�FDOOEDFN�IXQFWLRQ���KPRG

7KH�KDQGOH�RI�WKH�'//�FRQWDLQLQJ�WKH�KRRN�FDOOEDFN�IXQFWLRQ��,I�WKLV�LV�18//��WKH�KRRN�FDOOEDFN�IXQFWLRQ�LV�QRW�FRQWDLQHG�ZLWKLQ�D�'//��,QVWHDG��LW�LV�FRQWDLQHG�LQ�WKH�DSSOLFDWLRQV��(;(V��FRGH���

GZ7KUHDG,G

7KH�DSSOLFDWLRQV�WKUHDG�WKDW�FRQWDLQV�WKH�KRRN�FDOOEDFN�IXQFWLRQ��,I�WKLV�LV�18//��WKH�KRRN�FDOOEDFN�IXQFWLRQ�LV�FRQWDLQHG�ZLWKLQ�D�'//��VHH�KPRG����

5HWXUQ�9DOXH�

5HWXUQV�WKH�KDQGOH�WR�WKH�QHZO\�FUHDWHG�KRRN��$�UHWXUQ�YDOXH�RI�]HUR�LQGLFDWHV�IDLOXUH���

ShowWindow � �

� �'HWHUPLQHV�KRZ�WKH�ZLQGRZ�LV�GLVSOD\HG���3XEOLF�'HFODUH�)XQFWLRQ�6KRZ:LQGRZ�/LE��XVHU����B�� � �%\9DO�KZQG�$V�/RQJ��%\9DO�Q&PG6KRZ�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

Page 647: Visual Basic - Subclassing and Hooking with VB & VB NET

KZQG

:LQGRZ�KDQGOH�Q&PG6KRZ

6SHFLILHV�KRZ�WKH�ZLQGRZ�LV�GLVSOD\HG��SW_FORCEMINIMIZE

'LVSOD\V�D�PLQLPL]HG�ZLQGRZ�HYHQ�LI�WKH�WKUHDG�WKDW�RZQV�WKH�ZLQGRZ�LV�KXQJ���SW_HIDE

+LGHV�WKH�ZLQGRZ�DQG�DFWLYDWHV�DQRWKHU�ZLQGRZ��SW_MAXIMIZE

'LVSOD\V�D�PD[LPL]HG�ZLQGRZ��SW_MINIMIZE

'LVSOD\V�D�PLQLPL]HG�ZLQGRZ��SW_RESTORE

'LVSOD\V�D�ZLQGRZ�LQ�LWV�UHVWRUHG�VWDWH��SW_SHOW

$FWLYDWHV�D�ZLQGRZ��SW_SHOWMAXIMIZED

$FWLYDWHV�DQG�PD[LPL]HV�WKH�ZLQGRZ��SW_SHOWMINIMIZED

$FWLYDWHV�DQG�PLQLPL]HV�WKH�ZLQGRZ��SW_SHOWMINNOACTIVE

'LVSOD\V�D�PLQLPL]HG�ZLQGRZ��EXW�GRHV�QRW�DFWLYDWH�LW��SW_SHOWNA

'LVSOD\V�D�ZLQGRZ��EXW�GRHV�QRW�DFWLYDWH�LW��SW_SHOWNORMAL

$FWLYDWHV�DQG�GLVSOD\V�D�ZLQGRZ��,I�WKH�ZLQGRZ�LV�PLQLPL]HG�RU�PD[LPL]HG��LW�LV�ILUVW�UHVWRUHG���SW_SHOWNOACTIVATE

6DPH�DV�6:B6+2:1250$/��EXW�WKH�ZLQGRZ�LV�QRW�DFWLYDWHG���

5HWXUQ�9DOXH�

5HWXUQV�LI�WKH�ZLQGRZ�ZDV�SUHYLRXVO\�KLGGHQ��5HWXUQV�QRQ]HUR�LI�WKH�ZLQGRZ�ZDV�SUHYLRXVO\�YLVLEOH���

UnhookWindowsHookEx � �

� �5HPRYHV�WKH�VSHFLILHG�ZLQGRZV�KRRN���3ULYDWH�'HFODUH�)XQFWLRQ�8QKRRN:LQGRZV+RRN([�/LE��XVHU����B���������������������������%\9DO�K+RRN�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

Page 648: Visual Basic - Subclassing and Hooking with VB & VB NET

K+RRN

7KH�KDQGOH�WR�WKH�KRRN��7KH�6HW:LQGRZ+RRN([�IXQFWLRQ�UHWXUQV�WKLV�KRRN�KDQGOH���

5HWXUQ�9DOXH�

$�UHWXUQ�YDOXH�RI�]HUR�LQGLFDWHV�IDLOXUH��RWKHUZLVH��WKH�KRRN�LV�UHPRYHG���

UnregisterClass � �

� �5HPRYHV�WKH�FODVV�WKDW�WKH�5HJLVWHU&ODVV([�$3,�IXQFWLRQ�FUHDWHG�IURP�PHPRU\���3XEOLF�'HFODUH�)XQFWLRQ�8QUHJLVWHU&ODVV�/LE��XVHU����$OLDV��8QUHJLVWHU&ODVV$��B�� � �%\9DO�OS&ODVV1DPH�$V�6WULQJ��%\9DO�K,QVWDQFH�$V�/RQJ��$V�/RQJ�

3DUDPHWHUV�

OS&ODVV1DPH

1DPH�RI�WKH�FODVV�K,QVWDQFH

0RGXOH�KDQGOH�IRU�WKH�FODVV�

5HWXUQ�9DOXH�

$�UHWXUQ�YDOXH�RI�]HUR�LQGLFDWHV�IDLOXUH��RWKHUZLVH��WKH�FODVV�LV�XQUHJLVWHUHG�DQG�LWV�PHPRU\�LV�IUHHG���

Page 649: Visual Basic - Subclassing and Hooking with VB & VB NET

$SSHQGL[�&��6WUXFWXUHV�DQG�&RQVWDQWV�7KLV�DSSHQGL[�ILUVW�OLVWV�WKH�VWUXFWXUHV�XVHG�LQ�WKLV�ERRN��DQG�WKHQ�ILQLVKHV�E\�OLVWLQJ�WKH�FRQVWDQWV�XVHG�LQ�WKLV�ERRN��

CBT_CREATEWND � �

� �&RQWDLQV�LQIRUPDWLRQ�XVHG�E\�WKH�:+B&%7�KRRN�ZKHQ�D�ZLQGRZ�LV�FUHDWHG��3XEOLF�7\SH�&%7B&5($7(:1'�� OSFV�$V�&5($7(6758&7�� K:QG,QVHUW$IWHU�$V�/RQJ�(QG�7\SH�

6WUXFWXUH�0HPEHUV�

OSFV

3RLQWHU�WR�D�&5($7(6758&7�VWUXFWXUH��ZKLFK�LV�GHILQHG�DV�IROORZV��3XEOLF�7\SH�&5($7(6758&7�OS&UHDWH3DUDPV�$V�/RQJ�K,QVWDQFH�$V�/RQJ�K0HQX�$V�/RQJ�K:QG3DUHQW�$V�/RQJ�F\�$V�/RQJ�F[�$V�/RQJ�\�$V�/RQJ�[�$V�/RQJ�VW\OH�$V�/RQJ�OSV]1DPH�$V�6WULQJ�OSV]&ODVV�$V�6WULQJ�([6W\OH�$V�/RQJ�(QG�7\SH�

K:QG,QVHUW$IWHU K:QG�RI�WKH�ZLQGRZ�ZKRVH�SRVLWLRQ�LQ�WKH�=�RUGHU�LV�WR�SUHFHGH�WKH�ZLQGRZ�EHLQJ�FUHDWHG��<RX�FDQ�PRGLI\�K:QG,QVHUW$IWHU�WR�FKDQJH�WKH�SRVLWLRQ�LQ�WKH�=�RUGHU�RI�WKH�ZLQGRZ�WKDW�LV�EHLQJ�FUHDWHG��

CBTACTIVATESTRUCT � �

Page 650: Visual Basic - Subclassing and Hooking with VB & VB NET

� �&RQWDLQV�LQIRUPDWLRQ�XVHG�E\�WKH�:+B&%7�KRRN�ZKHQ�D�ZLQGRZ�LV�DFWLYDWHG��3XEOLF�7\SH�&%7$&7,9$7(6758&7�� I0RXVH�$V�/RQJ�� K:QG$FWLYH�$V�/RQJ�(QG�7\SH�

6WUXFWXUH�0HPEHUV�

I0RXVH

7UXH�LI�WKH�ZLQGRZ�ZDV�DFWLYDWHG�E\�D�PRXVH�FOLFN��RWKHUZLVH�)DOVH��LQGLFDWLQJ�WKDW�WKH�ZLQGRZ�ZDV�DFWLYDWHG�E\�VRPH�RWKHU�PHDQV��VXFK�DV�DQ�$/7�7$%�NH\�FRPELQDWLRQ��

K:QG$FWLYH

7KH�K:QG�RI�WKH�DFWLYH�ZLQGRZ��

CHOOSECOLOR � �

� �8VHG�WR�GHILQH�WKH�&RORU�FRPPRQ�GLDORJ�ER[�ZKHQ�LW�LV�FUHDWHG��3XEOLF�7\SH�&+226(&2/25���������O6WUXFW6L]H�$V�/RQJ����������������KZQG2ZQHU�$V�/RQJ�����������������������K,QVWDQFH�$V�/RQJ�����������������������UJE5HVXOW�$V�/RQJ�����������������������OS&XVW&RORUV�$V�/RQJ����������������IODJV�$V�/RQJ������������������������O&XVW'DWD�$V�/RQJ������������������������OSIQ+RRN�$V�/RQJ�����������������������OS7HPSODWH1DPH�$V�ORQJ��������(QG�7\SH�

6WUXFWXUH�0HPEHUV�

O6WUXFW6L]H

6L]H�RI�WKLV�VWUXFWXUH��KZQG2ZQHU

2ZQLQJ�ZLQGRZ��

Page 651: Visual Basic - Subclassing and Hooking with VB & VB NET

K,QVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�REMHFW�WKDW�FRQWDLQV�WKH�GLDORJ�UHVRXUFH��<RX�XVXDOO\�VHW�WKLV�HTXDO�WR�WKH�$SS�K,QVWDQFH�SURSHUW\��

UJE5HVXOW 8VHU�VHOHFWHG�FRORU�UHWXUQHG�WR�WKH�DSSOLFDWLRQ��

OS&XVW&RORUV

3RLQWHU�WR�DUUD\�RI�&2/255()�VWUXFWXUHV��flags

)ODJV�GHVFULELQJ�WKLV�FRPPRQ�GLDORJ�ER[��<RX�PXVW�VHW�WKH�&&B(1$%/(7(03/$7(�DQG�&&B(1$%/(+22.�IODJV�WR�XVH�D�PRGLILHG�WHPSODWH�DQG�D�GLDORJ�KRRN�IXQFWLRQ��

lCustData

$SSOLFDWLRQ�GHILQHG�GDWD�SDVVHG�LQ�WR�WKH�KRRN��OSIQ+RRN

$�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��OS7HPSODWH1DPH

7KH�,'�RI�WKH�PRGLILHG�GLDORJ�UHVRXUFH��

CHOOSEFONT � �

� �8VHG�WR�GHILQH�WKH�)RQW�FRPPRQ�GLDORJ�ER[�ZKHQ�LW�LV�FUHDWHG��3XEOLF�7\SH�&+226()217���������O6WUXFW6L]H�$V�/RQJ�����������������������KZQG2ZQHU�$V�/RQJ��������������������������KGF�$V�/RQJ��������������������������������OS/RJ)RQW�$V�/RQJ������������������������������L3RLQW6L]H�$V�/RQJ�������������������������IODJV�$V�/RQJ����������������������� ����UJE&RORUV�$V�/RQJ��������������������������O&XVW'DWD�$V�/RQJ��������������������������OSIQ+RRN�$V�/RQJ����������������������������OS7HPSODWH1DPH�$V�6WULQJ���������������������K,QVWDQFH�$V�/RQJ��������������������������OSV]6W\OH�$V�6WULQJ��������������������������Q)RQW7\SH�$V�,QWHJHU���������������������������0,66,1*B$/,*10(17�$V�,QWHJHU������������������Q6L]H0LQ�$V�/RQJ����������������������������Q6L]H0D[�$V�/RQJ�������������������(QG�7\SH�

Page 652: Visual Basic - Subclassing and Hooking with VB & VB NET

6WUXFWXUH�0HPEHUV�

O6WUXFW6L]H

6L]H�RI�WKLV�VWUXFWXUH��KZQG2ZQHU

&DOOLQJ�ZLQGRZV�KDQGOH��KGF

3ULQWHU�'&�,&��OS/RJ)RQW

3RLQWHU�WR�WKH�/2*)217�VWUXFWXUH��L3RLQW6L]H

��� �VL]H�LQ�SRLQWV�RI�VHOHFWHG�IRQW��IODJV

)ODJV�GHVFULELQJ�WKLV�FRPPRQ�GLDORJ�ER[��<RX�PXVW�VHW�WKH�&)B(1$%/(7(03/$7(�DQG�&)B(1$%/(+22.�IODJV�PXVW�EH�VHW�WR�XVH�D�PRGLILHG�WHPSODWH�DQG�D�GLDORJ�KRRN�IXQFWLRQ��

UJE&RORUV

5HWXUQHG�WH[W�FRORU��O&XVW'DWD

$SSOLFDWLRQ�GHILQHG�GDWD�SDVVHG�LQ�WR�WKH�KRRN��OSIQ+RRN

$�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��OS7HPSODWH1DPH

7KH�,'�RI�WKH�PRGLILHG�GLDORJ�UHVRXUFH��K,QVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�REMHFW�WKDW�FRQWDLQV�WKH�GLDORJ�UHVRXUFH��7KLV�LV�XVXDOO\�VHW�HTXDO�WR�WKH�$SS�K,QVWDQFH�SURSHUW\��

OSV]6W\OH

6W\OH�ILHOG�KHUH�PXVW�EH�/)B)$&(6,=(�RU�ODUJHU��Q)RQW7\SH

6DPH�YDOXH�UHSRUWHG�WR�WKH�(QXP)RQWV�FDOOEDFN�ZLWK�WKH�H[WUD�)2177<3(�ELWV�DGGHG��

Q6L]H0LQ

0LQLPXP�SRLQW�VL]H�DOORZHG��Q6L]H0D[

0D[LPXP�SRLQW�VL]H�DOORZHG��

CWPRETSTRUCT � �

Page 653: Visual Basic - Subclassing and Hooking with VB & VB NET

� �&RQWDLQV�LQIRUPDWLRQ�WKDW�WKH�:+B&$//:1'352&5(7�KRRN�XVHV��7KLV�VWUXFWXUH�LV�VLPLODU�WR�WKH�&:36758&7�VWUXFWXUH�WKDW�WKH�:+B&$//:1'352&�KRRN�XVHV��H[FHSW�WKDW�WKLV�VWUXFWXUH�FRQWDLQV�DQ�H[WUD�PHPEHU��O5HVXOW��3XEOLF�7\SH�&:35(76758&7���������O5HVXOW�$V�/RQJ���������O3DUDP�$V�/RQJ���������Z3DUDP�$V�/RQJ���������PHVVDJH�$V�/RQJ���������KZQG�$V�/RQJ�(QG�7\SH�

6WUXFWXUH�0HPEHUV�

O5HVXOW 7KH�UHWXUQ�YDOXH�RI�WKH�ZLQGRZ�SURFHGXUH�DIWHU�SURFHVVLQJ�WKH�PHVVDJH�

O3DUDP

7KH�VHFRQG�SDUDPHWHU�RI�WKH�PHVVDJH�Z3DUDP

7KH�ILUVW�SDUDPHWHU�RI�WKH�PHVVDJH�PHVVDJH

7KH�PHVVDJH�LGHQWLILHU�KZQG

7KH�ZLQGRZ�KDQGOH�WKDW�WKH�PHVVDJH�LV�GLUHFWHG�WR�

CWPSTRUCT � �

� �&RQWDLQV�LQIRUPDWLRQ�XVHG�E\�WKH�:+B&$//:1'352&�KRRN��3XEOLF�7\SH�&:36758&7���������O3DUDP�$V�/RQJ���������Z3DUDP�$V�/RQJ���������PHVVDJH�$V�/RQJ���������KZQG�$V�/RQJ�(QG�7\SH�

6WUXFWXUH�0HPEHUV�

O3DUDP

Page 654: Visual Basic - Subclassing and Hooking with VB & VB NET

7KH�O3DUDP�SDUDPHWHU�IRU�WKLV�PHVVDJH�Z3DUDP

7KH�Z3DUDP�SDUDPHWHU�IRU�WKLV�PHVVDJH�PHVVDJH

7KH�PHVVDJH�LGHQWLILHU�RI�WKH�LQWHUFHSWHG�PHVVDJH�KZQG

7KH�ZLQGRZ�KDQGOH�WKDW�WKLV�PHVVDJH�LV�GLUHFWHG�WR�

DEBUGHOOKINFO � �

� �&RQWDLQV�LQIRUPDWLRQ�XVHG�ZLWK�WKH�:+B'(%8*�KRRN��3XEOLF�7\SH�'(%8*+22.,1)2���������LG7KUHDG�$V�/RQJ���������LG7KUHDG,QVWDOOHU�$V�/RQJ���������O3DUDP�$V�/RQJ���������Z3DUDP�$V�/RQJ���������FRGH�$V�/RQJ�(QG�7\SH�

6WUXFWXUH�0HPEHUV�

LG7KUHDG

+DQGOH�WR�WKH�WKUHDG�FRQWDLQLQJ�WKH�ILOWHU�IXQFWLRQ�RI�WKH�KRRN�WKDW�LV�DERXW�WR�EH�FDOOHG�LG7KUHDG,QVWDOOHU

+DQGOH�WR�WKH�WKUHDG�WKDW�LQVWDOOHG�WKH�:+B'(%8*�KRRN�ILOWHU�IXQFWLRQ��O3DUDP

9DOXH�RI�WKH�O3DUDP�WKDW�LV�WR�EH�VHQW�WR�WKH�ILOWHU�IXQFWLRQ�RI�WKH�KRRN�WKDW�LV�DERXW�WR�EH�FDOOHG�

Z3DUDP

9DOXH�RI�WKH�Z3DUDP�WKDW�LV�WR�EH�VHQW�WR�WKH�ILOWHU�IXQFWLRQ�RI�WKH�KRRN�WKDW�LV�DERXW�WR�EH�FDOOHG�

FRGH

9DOXH�RI�WKH�X&RGH�WKDW�LV�WR�EH�VHQW�WR�WKH�ILOWHU�IXQFWLRQ�RI�WKH�KRRN�WKDW�LV�DERXW�WR�EH�FDOOHG�

EVENTMSG � �

� �

Page 655: Visual Basic - Subclassing and Hooking with VB & VB NET

&RQWDLQV�LQIRUPDWLRQ�XVHG�ZLWK�WKH�:+B-2851$/5(&25'�KRRN��3ULYDWH�7\SH�(9(1706*���������PHVVDJH�$V�/RQJ���������SDUDP/�$V�/RQJ���������SDUDP+�$V�/RQJ���������WLPH�$V�/RQJ���������KZQG�$V�/RQJ�(QG�7\SH�

6WUXFWXUH�0HPEHUV�

PHVVDJH

7KH�PHVVDJH�LGHQWLILHU��SDUDP/

$�PHVVDJH�SDUDPHWHU��7KH�PHVVDJH�W\SH�GHILQHV�WKH�PHDQLQJ�IRU�WKLV�PHPEHU��SDUDP+

$�PHVVDJH�SDUDPHWHU��7KH�PHVVDJH�W\SH�GHILQHV�WKH�PHDQLQJ�IRU�WKLV�PHPEHU��WLPH

7KH�WLPH�WKDW�WKLV�PHVVDJH�ZDV�SRVWHG��KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�WR�ZKLFK�WKLV�PHVVDJH�LV�WR�EH�VHQW��

FINDREPLACE � �

� �8VHG�WR�GHILQH�WKH�)LQG�DQG�5HSODFH�FRPPRQ�GLDORJ�ER[HV�ZKHQ�WKH\�DUH�FUHDWHG��3XEOLF�7\SH�),1'5(3/$&(���������O6WUXFW6L]H�$V�/RQJ�������������������������KZQG2ZQHU�$V�/RQJ��������������������������K,QVWDQFH�$V�/RQJ��������������������������IODJV�$V�/RQJ������������������������������OSVWU)LQG:KDW�$V�6WULQJ����������������������OSVWU5HSODFH:LWK�$V�6WULQJ�������������������Z)LQG:KDW/HQ�$V�,QWHJHU������������������������Z5HSODFH:LWK/HQ�$V�,QWHJHU��������������������O&XVW'DWD�$V�/RQJ��������������������������OSIQ+RRN�$V�/RQJ����������������������������OS7HPSODWH1DPH�$V�/RQJ��������������������(QG�7\SH�

Page 656: Visual Basic - Subclassing and Hooking with VB & VB NET

6WUXFWXUH�0HPEHUV�

O6WUXFW6L]H

6L]H�RI�WKLV�VWUXFWXUH��KZQG2ZQHU

&DOOLQJ�ZLQGRZV�KDQGOH��KLQVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�REMHFW�WKDW�FRQWDLQV�WKH�GLDORJ�UHVRXUFH��7KLV�LV�XVXDOO\�VHW�HTXDO�WR�WKH�$SS�K,QVWDQFH�SURSHUW\��

IODJV

)ODJV�GHVFULELQJ�WKLV�FRPPRQ�GLDORJ�ER[��<RX�PXVW�VHW�WKH�)5B(1$%/(7(03/$7(�DQG�)5B(1$%/(+22.�IODJV�WR�XVH�D�PRGLILHG�WHPSODWH�DQG�D�GLDORJ�KRRN�IXQFWLRQ��

OSVWU)LQG:KDW 3RLQWHU�WR�VHDUFK�VWULQJ��

OSVWU5HSODFH:LWK

3RLQWHU�WR�UHSODFH�VWULQJ��Z)LQG:KDW/HQ

6L]H�RI�ILQG�EXIIHU��Z5HSODFH:LWK/HQ

6L]H�RI�UHSODFH�EXIIHU��O&XVW'DWD

&XVWRP�GDWD�SDVVHG�WR�WKLV�KRRN�IXQFWLRQ��OSIQ+RRN

7KH�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��OS7HPSODWH1DPH

7KH�,'�RI�WKH�PRGLILHG�GLDORJ�UHVRXUFH��

KBDLLHOOKSTRUCT � �

� �&RQWDLQV�LQIRUPDWLRQ�XVHG�E\�WKH�:+B.(<%2$5'B//�KRRN��3ULYDWH�7\SH�.%'//+22.6758&7�� YN&RGH�DV�/RQJ�� VFDQ&RGH�DV�/RQJ�� IODJV�DV�/RQJ�� WLPH�DV�/RQJ�� GZ([WUD,QIR�DV�/RQJ�(QG�7\SH�

Page 657: Visual Basic - Subclassing and Hooking with VB & VB NET

6WUXFWXUH�0HPEHUV�

YN&RGH

7KH�YLUWXDO�NH\�FRGH��VFDQ&RGH

7KH�VFDQ�FRGH��IODJV

7KLV�PHPEHU�FRQWDLQV�IODJV�IRU�WKH�NH\�SUHVVHG��7KH�IODJV�LQFOXGH�H[WHQGHG�NH\��LQMHFWHG�PHVVDJH��FRQWH[W�FRGH��DQG�WUDQVLWLRQ�VWDWH��

WLPH

7KH�WLPH�WKLV�PHVVDJH�ZDV�SRVWHG��GZ([WUD,QIR

$�SRLQWHU�WR�H[WUD�GHYHORSHU�GHILQHG�LQIRUPDWLRQ��

MOUSEHOOKSTRUCT � �

� �&RQWDLQV�LQIRUPDWLRQ�XVHG�E\�WKH�:+B0286(�KRRN��3XEOLF�7\SH�0286(+22.6758&7���������SW�$V�32,17$3,���������KZQG�$V�/RQJ���������Z+LW7HVW&RGH�$V�/RQJ���������GZ([WUD,QIR�$V�/RQJ�(QG�7\SH�

6WUXFWXUH�0HPEHUV�

SW 7KH�[�DQG�\�FRRUGLQDWHV�RI�WKH�PRXVH�SRLQWHU�

KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�WKDW�WKH�PRXVH�SRLQWHU�ZDV�RYHU�ZKHQ�WKH�PRXVH�PHVVDJH�ZDV�ILUHG�

Z+LW7H[W&RGH

7KH�KLW�WHVW�FRGH�GHWDLOLQJ�WKH�QRQFOLHQW�DUHD�RI�WKH�ZLQGRZ�WKDW�WKH�PRXVH�FXUVRU�LV�RYHU�

GZ([WUD,QIR

([WUD�LQIRUPDWLRQ�

MOUSEHOOKSTRUCTEX � �

Page 658: Visual Basic - Subclassing and Hooking with VB & VB NET

� �&RQWDLQV�LQIRUPDWLRQ�XVHG�E\�WKH�:+B0286(�KRRN��7KLV�VWUXFWXUH�FRQWDLQV�H[WUD�LQIRUPDWLRQ�WKDW�WKH�0286(+22.6758&7�GRHV�QRW�FRQWDLQ��3XEOLF�7\SH�0286(+22.6758&7(;�����VWUXFW0RXVH+RRN�$V�0286(+22.6758&7�����PRXVHGDWD�$V�/RQJ�(QG�7\SH�

6WUXFWXUH�0HPEHUV�

VWUXFW0RXVH+RRN

$�SRLQWHU�WR�WKH�0286(+22.6758&7�VWUXFWXUH��PRXVHGDWD

$�/RQJ�LQWHJHU�WKDW�FRQWDLQV�PRXVH�ZKHHO�DQG�;%XWWRQ�LQIRUPDWLRQ�LQ�WKH�KLJK�RUGHU�ZRUG��7KH�ORZ�RUGHU�ZRUG�LV�UHVHUYHG�IRU�V\VWHP�XVH��

MSG � �

� �&RQWDLQV�DOO�LQIRUPDWLRQ�WKDW�GHILQHV�D�:LQGRZV�PHVVDJH��3XEOLF�7\SH�06*�����KZQG�$V�/RQJ�����PHVVDJH�$V�/RQJ�����Z3DUDP�$V�/RQJ�����O3DUDP�$V�/RQJ�����WLPH�$V�/RQJ�����SW�$V�32,17$3,�(QG�7\SH�

6WUXFWXUH�0HPEHUV�

KZQG

7KH�KDQGOH�RI�WKH�ZLQGRZ�WR�ZKLFK�WKH�PHVVDJH�LV�GLUHFWHG��PHVVDJH

7KH�PHVVDJH�WR�EH�SDVVHG�WR�WKLV�ZLQGRZ��$OO�ZLQGRZ�PHVVDJHV�DUH�FRQVWDQWV�DQG�DUH�GHILQHG�LQ�WKH�:LQ���6RIWZDUH�'HYHORSPHQW�.LW��6'.��KHDGHU�ILOHV��7KH�KHDGHU�ILOHV�:,186(5�+�DQG�:,1$%/(�+�FRQWDLQ�PRVW�RI�WKHVH�FRQVWDQWV��

Z3DUDP and O3DUDP

Page 659: Visual Basic - Subclassing and Hooking with VB & VB NET

0DQ\�PHVVDJHV�XVH�WKH�Z3DUDP�DQG�O3DUDP�HOHPHQWV�WR�SDVV�H[WUD�LQIRUPDWLRQ�WR�WKH�UHFHLYLQJ�ZLQGRZ�SURFHGXUH��7KLV�H[WUD�LQIRUPDWLRQ�GHSHQGV�RQ�WKH�PHVVDJH��)RU�H[DPSOH��LW�FRXOG�LQGLFDWH�ZKLFK�PRXVH�EXWWRQ�ZDV�SUHVVHG��RU�LI�WKH�&WUO�NH\�ZDV�SUHVVHG�LQ�FRPELQDWLRQ�ZLWK�WKH�FXUUHQWO\�SUHVVHG�NH\��6RPH�PHVVDJHV�QHHG�WR�SDVV�PXFK�PRUH�LQIRUPDWLRQ�WKDQ�LV�SRVVLEOH�ZLWK�WKH�Z3DUDP�DQG�O3DUDP�DUJXPHQWV��7R�JHW�DURXQG�WKLV�OLPLWDWLRQ��VRPH�PHVVDJHV�KDYH�VSHFLDO�VWUXFWXUHV�DVVRFLDWHG�ZLWK�WKHP��3RLQWHUV�WR�WKHVH�VWUXFWXUHV�DUH�SDVVHG�LQ�HLWKHU�WKH�O3DUDP�RU�WKH�Z3DUDP�HOHPHQWV��(DFK�PHVVDJH�KDV�LWV�RZQ�LGHQWLW\����WKDW�LV��WKH�ZD\�RQH�PHVVDJH�ILOOV�LQ�WKH�06*�VWUXFWXUH�LV�QRW�WKH�ZD\�HYHU\�PHVVDJH�ZLOO�ILOO�LW�LQ��0RVW�PHVVDJHV�KDYH�WKHLU�RZQ�LQIRUPDWLRQ�WKDW�PXVW�EH�SDVVHG�RQ�WR�WKH�UHFHLYLQJ�ZLQGRZ��7KHUHIRUH��EHFRPH�IDPLOLDU�ZLWK�WKH�PHVVDJH�WKDW�\RX�DUH�JRLQJ�WR�EH�WUDSSLQJ�EHIRUH�\RX�ZULWH�WKH�FRGH�RU�\RX�PLJKW�EH�LQ�IRU�D�VXUSULVH��

WLPH

5HSUHVHQWV�ZKHQ�WKH�PHVVDJH�ZDV�SRVWHG��WLPH�LV�HTXDO�WR�WKH�QXPEHU�RI�FORFN�WLFNV�VLQFH�WKH�FRPSXWHU�KDV�EHHQ�UXQQLQJ��6R��WR�ILQG�WKH�DPRXQW�RI�WLPH�WKDW�KDV�HODSVHG�EHWZHHQ�PHVVDJHV��MXVW�VXEWUDFW�WKH�SUHYLRXV�PHVVDJHV�WLPH�PHPEHU�IURP�WKH�FXUUHQW�PHVVDJHV�WLPH�PHPEHU��7KH�WLPH�PHPEHU�SOD\V�DQ�LPSRUWDQW�UROH�ZKHQ�XVLQJ�MRXUQDO�KRRNV��

SW $�SRLQWHU�WR�D�32,17�VWUXFWXUH��7KH�SW�PHPEHU�SRLQWV�WR�D�VWUXFWXUH�FRQWDLQLQJ�WKH�PRXVH�FXUVRU�FRRUGLQDWHV�ZKHQ�WKLV�PHVVDJH�ZDV�JHQHUDWHG��

MSLLHOOKSTRUCT � �

� �&RQWDLQV�LQIRUPDWLRQ�XVHG�E\�WKH�:+B0286(B//�KRRN��3XEOLF�7\SH�06//+22.6758&7���������SW�$V�32,17$3,���������PRXVHGDWD�$V�/RQJ���������IODJV�$V�/RQJ�� ����WLPH�$V�/RQJ���������GZ([WUD,QIR�$V�/RQJ�(QG�7\SH�

6WUXFWXUH�0HPEHUV�

SW 7KH�[�DQG�\�FRRUGLQDWHV�RI�WKH�PRXVH�SRLQWHU��

Page 660: Visual Basic - Subclassing and Hooking with VB & VB NET

PRXVHGDWD

,I�WKH�Z3DUDP�SDUDPHWHU�VSHFLILHV�WKH�:0B0286(:+((/�PHVVDJH��WKH�KLJK�RUGHU�ZRUG�RI�WKLV�PHPEHU�FRQWDLQV�WKH�PRXVH�ZKHHO�GHOWD��D�SRVLWLYH�YDOXH�PHDQV�WKDW�WKH�PRXVH�ZKHHO�ZDV�UROOHG�IRUZDUG��D�QHJDWLYH�YDOXH�PHDQV�WKDW�LW�ZDV�UROOHG�EDFNZDUG���,I�WKH�Z3DUDP�SDUDPHWHU�VSHFLILHV�WKDW�DQ�;%XWWRQ�ZDV�FOLFNHG��WKH�KLJK�RUGHU�ZRUG�RI�WKLV�PHPEHU�GHWHUPLQHV�ZKHWKHU�WKH�ILUVW�RU�VHFRQG�;%XWWRQ�ZDV�SUHVVHG��7KH�ORZ�RUGHU�ZRUG�LV�UHVHUYHG�E\�WKH�V\VWHP�LQ�ERWK�FDVHV��

IODJV

'HWHUPLQHV�ZKHWKHU�WKH�PHVVDJH�ZDV�LQMHFWHG��,I�$1'LQJ�WKLV�IODJ�ZLWK���UHVXOWV�LQ�D���RU�7UXH��WKLV�PHVVDJH�ZDV�LQMHFWHG��RWKHUZLVH��WKH�PHVVDJH�ZDV�QRW�LQMHFWHG��<RX�FDQ�LQMHFW�D�PRXVH�PHVVDJH�LQWR�WKH�PHVVDJLQJ�V\VWHP�E\�XVLQJ�WKH�6HQG,QSXW�IXQFWLRQ�GHILQHG�LQ�&KDSWHU�����

WLPH

7KH�WLPH�WKDW�WKLV�PHVVDJH�ZDV�SRVWHG�WR�WKH�PHVVDJH�TXHXH��GZ([WUD,QIR

([WUD�LQIRUPDWLRQ��

NMHDR � �

� �&RQWDLQV�LQIRUPDWLRQ�XVHG�E\�QRWLILFDWLRQ�PHVVDJHV��3ULYDWH�7\SH�10+'5�����KZQG)URP�$V�/RQJ�����LGIURP�$V�/RQJ�����FRGH�$V�/RQJ�(QG�7\SH�

6WUXFWXUH�0HPEHUV�

KZQG)URP

7KH�KDQGOH�WR�WKH�FRQWURO�VHQGLQJ�WKLV�QRWLILFDWLRQ�PHVVDJH�LG)URP

7KH�LGHQWLILHU�RI�WKH�FRQWURO�VHQGLQJ�WKLV�QRWLILFDWLRQ�PHVVDJH�FRGH

$�FRGH�LGHQWLI\LQJ�WKH�W\SH�RI�QRWLILFDWLRQ�

OPENFILENAME � �

� �

Page 661: Visual Basic - Subclassing and Hooking with VB & VB NET

'HILQHV�WKH�2SHQ�DQG�6DYH�$V�FRPPRQ�GLDORJ�ER[HV��3ULYDWH�7\SH�23(1),/(1$0(�����O6WUXFW6L]H�$V�/RQJ�����KZQG2ZQHU�$V�/RQJ�����K,QVWDQFH�$V�/RQJ�����OSVWU)LOWHU�$V�6WULQJ�����OSVWU&XVWRP)LOWHU�$V�6WULQJ�����Q0D[&XVW)LOWHU�$V�/RQJ�����Q)LOWHU,QGH[�$V�/RQJ�����OSVWU)LOH�$V�6WULQJ�����Q0D[)LOH�$V�/RQJ�����OSVWU)LOH7LWOH�$V�6WULQJ�����Q0D[)LOH7LWOH�$V�/RQJ�����OSVWU,QLWLDO'LU�$V�6WULQJ�����OSVWU7LWOH�$V�6WULQJ�����IODJV�$V�/RQJ�����Q)LOH2IIVHW�$V�,QWHJHU�����Q)LOH([WHQVLRQ�$V�,QWHJHU�����OSVWU'HI([W�$V�6WULQJ�����O&XVW'DWD�$V�/RQJ�����OSIQ+RRN�$V�/RQJ�����OS7HPSODWH1DPH�$V�6WULQJ�����SY5HVHUYHG�$V�/RQJ�����GZ5HVHUYHG�$V�/RQJ�����)ODJV([�$V�/RQJ�(QG�7\SH�

6WUXFWXUH�0HPEHUV�

O6WUXFW6L]H

6L]H�RI�WKLV�VWUXFWXUH��<RX�VKRXOG�VHW�LW�WR�/HQ�23(1),/(1$0(���KZQG2ZQHU

7KH�KDQGOH�RI�WKH�GLDORJV�RZQLQJ�ZLQGRZ��&DQ�EH�LI�QR�ZLQGRZ�RZQV�WKLV�GLDORJ��K,QVWDQFH

7KH�KDQGOH�WR�WKH�REMHFW�WKDW�FRQWDLQV�WKH�GLDORJ�WHPSODWH�UHVRXUFH��,I�WKH�GLDORJ�WHPSODWH�UHVRXUFH�UHVLGHV�LQ�D�'//��XVH�WKH�/RDG/LEUDU\�$3,�IXQFWLRQ��7KH�IXQFWLRQ�WDNHV�RQH�SDUDPHWHU��WKH�SDWK�DQG�ILOHQDPH�RI�WKH�'//��/RDG/LEUDU\�UHWXUQV�WKH�KDQGOH�WR�WKH�'//��

OSVWU)LOWHU

Page 662: Visual Basic - Subclassing and Hooking with VB & VB NET

$�VWULQJ�GHILQLQJ�WKH�ILOWHUV��LI�DQ\��XVHG�LQ�WKH�GLDORJ�ER[V�6DYH�$V�7\SH�GURS�GRZQ�OLVW��7KH�ILOWHU�LV�LQ�WKH�IRUPDW�^ILOWHU�QDPH`_^ILOWHU`��7KH�ILOWHU�QDPH�LV�D�QDPH�IRU�WKH�ILOWHU�VXFK�DV��$OO�)LOHV���7KH�ILOWHU�LV�DQ�H[SUHVVLRQ�XVHG�WR�GHVFULEH�WKH�ILOWHU��VXFK�DV�� � ���7KHUHIRUH��WKH�FRGH�WR�GHVFULEH�WKLV�ILOWHU�ZRXOG�ORRN�OLNH�WKH�IROORZLQJ��

23(1),/(1$0(�OSVWU)LOWHU� ��$OO)LOHV�_� � ��OSVWU&XVWRP)LOWHU

&RQWDLQV�WKH�ODVW�ILOWHU�FKRVHQ�E\�WKH�XVHU��Q0D[&XVW)LOWHU

&RQWDLQV�WKH�VL]H�RI�OSVWU&XVWRP)LOWHU��Q)LOWHU,QGH[

&RQWDLQV�WKH�LQGH[�RI�WKH�FKRVHQ�ILOWHU��OSVWU)LOH

:KHQ�LQLWLDOL]LQJ�WKH�GLDORJ��WKLV�PHPEHU�FRQWDLQV�WKH�GHIDXOW�WH[W�IRU�WKH�)LOH�1DPH�HGLW�FRQWURO��:KHQ�WKH�XVHU�VHOHFWV�D�ILOH�DQG�H[LWV�WKH�GLDORJ�ER[��WKLV�PHPEHU�FRQWDLQV�WKH�FRPSOHWH�SDWK�IRU�WKH�VHOHFWHG�ILOH��

Q0D[)LOH

&RQWDLQV�WKH�VL]H�RI�OSVWU)LOH��OSVWU)LOH7LWOH

7KH�ILOHQDPH�DQG�H[WHQVLRQ�RQO\�RI�WKH�UHWXUQHG�ILOH��Q0D[)LOH7LWOH

&RQWDLQV�WKH�VL]H�RI�OSVWU)LOH7LWOH��OSVWU,QLWLDO'LU

&RQWDLQV�WKH�GHIDXOW�SDWK�IRU�WKH�GLDORJ�ER[�ZKHQ�LW�LV�LQLWLDOL]HG��OSVWU7LWOH

7KH�WLWOH�RI�WKH�GLDORJ�ER[��IODJV

9DULRXV�IODJV�XVHG�WR�LQLWLDOL]H�WKH�GLDORJ�ER[��7KHVH�DUH�VRPH�RI�WKH�PRUH�FRPPRQO\�XVHG�IODJV��OFN_ALLOWMULTISELECT

$OORZV�WKH�XVHU�WR�VHOHFW�PRUH�WKDQ�RQH�ILOH��OFN_EXPLORER

&UHDWH�D�QHZ�H[SORUHU�VW\OH�FRPPRQ�GLDORJ�ER[��OFN_FILEMUSTEXIST

7R�RSHQ�D�ILOH��WKH�ILOH�PXVW�H[LVW�RU�DQ�HUURU�LV�UDLVHG��OFN_HIDEREADONLY

7KH�5HDG�2QO\�FKHFNER[�RQ�WKH�GLDORJ�LV�KLGGHQ��OFN_NOVALIDATE

7KH�ILOH�DQG�SDWK�DUH�QRW�YDOLGDWHG�GXULQJ�SURFHVVLQJ�E\�WKH�GLDORJ��OFN_PATHMUSTEXIST

7KH�SDWK�FKRVHQ�LQ�WKH�GLDORJ�PXVW�H[LVW�RU�DQ�HUURU�LV�UDLVHG��OFN_SHOWHELP

7KH�+HOS�EXWWRQ�LV�GLVSOD\HG��

Page 663: Visual Basic - Subclassing and Hooking with VB & VB NET

OFN_ENABLEHOOK

8VHG�IRU�VXEFODVVLQJ��HQDEOHV�WKH�XVH�RI�D�GLDORJ�KRRN�SURFHGXUH��OFN_ENABLETEMPLATE

8VHG�IRU�VXEFODVVLQJ��HQDEOHV�WKH�XVH�RI�D�UHVRXUFH�LQ�HLWKHU�D��5(6�RU��'//�IRUPDW��OFN_ENABLETEMPLATEHANDLE

8VHG�IRU�VXEFODVVLQJ��HQDEOHV�WKH�XVH�RI�D�UHVRXUFH�VWRUHG�LQ�PHPRU\��OFN_ENABLEINCLUDENOTIFY

8VHG�IRU�VXEFODVVLQJ��HQDEOHV�WKH�GLDORJ�WR�VHQG�WKH�&'1B,1&/8'(,7(0�QRWLILFDWLRQ��

Q)LOH2IIVHW &RQWDLQV�WKH�SRVLWLRQ�RI�WKH�ILUVW�FKDUDFWHU�RI�WKH�ILOHQDPH�LQ�OSVWU)LOH��7KLV�PHPEHU�LV�]HUR�EDVHG��

Q)LOH([WHQVLRQ

&RQWDLQV�WKH�SRVLWLRQ�RI�WKH�ILUVW�FKDUDFWHU�RI�WKH�ILOHQDPH�H[WHQVLRQ�LQ�OSVWU)LOH��7KLV�PHPEHU�LV�]HUR�EDVHG��

OSVWU'HI([W 7KH�ILOH�H[WHQVLRQ�DSSHQGHG�WR�WKH�ILOHQDPH�LI�RQH�LV�QRW�SURYLGHG��

O&XVW'DWD

([WUD�GDWD�WKDW�FDQ�EH�VHQW�WR�WKH�GLDORJ�KRRN�SURFHGXUH�YLD�WKH�:0B,1,7',$/2*�PHVVDJH��:KHQ�WKLV�PHVVDJH�LV�VHQW�WR�WKH�KRRN�SURFHGXUH��LW�FRQWDLQV�D�SRLQWHU�WR�WKLV�VWUXFWXUH�LQ�WKH�O3DUDP�SDUDPHWHU�RI�WKLV�PHVVDJH��

OSIQ+RRN

7KH�SRLQWHU�WR�RXU�GLDORJ�KRRN�SURFHGXUH��OS7HPSODWH1DPH

7KH�GLDORJ�WHPSODWH�UHVRXUFH�,'��SY5HVHUYHG

5HVHUYHG�E\�WKH�V\VWHP��GZ5HVHUYHG

5HVHUYHG�E\�WKH�V\VWHP��)ODJV([

6HWWLQJ�WKLV�IODJ�WR�]HUR�DOORZV�WKH�3ODFHV�%DU�WR�EH�GLVSOD\HG�RQ�WKH�FRPPRQ�GLDORJ�ER[��VHWWLQJ�WKLV�IODJ�WR�DQ\�RWKHU�QXPEHU�SUHYHQWV�WKLV�EDU�IURP�GLVSOD\LQJ��7KH�3ODFHV�%DU�LV�ORFDWHG�RQ�WKH�OHIWKDQG�VLGH�RI�WKH�2SHQ�DQG�6DYH�$V�FRPPRQ�GLDORJ�ER[HV�XQGHU�:LQGRZV�������7KLV�EDU�FRQWDLQV�VKRUWFXWV�WR�FRPPRQO\�XVHG�IROGHUV��VXFK�DV�'HVNWRS��+LVWRU\��0\�'RFXPHQWV��0\�&RPSXWHU��DQG�0\�1HWZRUN�3ODFHV��

PAGESETUPDLG � �

� �'HILQHV�WKH�3DJH�6HWXS�FRPPRQ�GLDORJ�ER[��

Page 664: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�7\SH�3$*(6(783'/*���������O6WUXFW6L]H�$V�/RQJ���������KZQG2ZQHU�$V�/RQJ�����������K'HY0RGH�$V�/RQJ����������K'HY1DPHV�$V�/RQJ����������������������� ����IODJV�$V�/RQJ������������������������������SW3DSHU6L]H�$V�32,17$3,�����������������������UW0LQ0DUJLQ�$V�5HFW�����������������������UW0DUJLQ�$V�5HFW������������������������������K,QVWDQFH�$V�/RQJ������������������������������O&XVW'DWD�$V�/RQJ������������������������������OSIQ3DJH6HWXS+RRN�$V�/RQJ�����������������������OSIQ3DJH3DLQW+RRN�$V�/RQJ�����������������������OS3DJH6HWXS7HPSODWH1DPH�$V�6WULQJ����������������K3DJH6HWXS7HPSODWH�$V�/RQJ��������(QG�7\SH�

6WUXFWXUH�0HPEHUV�

O6WUXFW6L]H

6L]H�RI�WKLV�VWUXFWXUH��KZQG2ZQHU

+DQGOH�RI�WKH�RZQLQJ�ZLQGRZ��K'HY0RGH

3RLQWHU�WR�D�'(902'(�VWUXFWXUH��K'HY1DPHV

3RLQWHU�WR�D�'(91$0(6�VWUXFWXUH��IODJV

)ODJV�GHVFULELQJ�WKLV�FRPPRQ�GLDORJ�ER[��<RX�PXVW�VHW�WKH�36'B(1$%/(3$*(6(7837(03/$7(�IODJ�WR�XVH�D�PRGLILHG�WHPSODWH��<RX�PXVW�VHW�WKH�36'B(1$%/(3$*(6(783+22.�IODJ�WR�XVH�WKH�SDJH�VHWXS�KRRN�WKDW�WKH�OSIQ3DJH6HWXS+RRN�IXQFWLRQ�SRLQWHU�SRLQWV�WR��<RX�PXVW�VHW�WKH�36'B(1$%/(3$*(3$,17+22.�IODJ�WR�XVH�WKH�SDJH�VHWXS�KRRN�WKDW�WKH�OSIQ3DJH3DLQW+RRN�IXQFWLRQ�SRLQWHU�SRLQWV�WR�

SW3DSHU6L]H

3RLQWHU�WR�D�32,17$3,�VWUXFWXUH��UW0LQ0DUJLQ

0LQLPXP�VL]HV�RI�WKH�PDUJLQV��UW0DUJLQ

$FWXDO�VL]HV�RI�WKH�PDUJLQV��

Page 665: Visual Basic - Subclassing and Hooking with VB & VB NET

K,QVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�REMHFW�WKDW�FRQWDLQV�WKH�GLDORJ�UHVRXUFH��7KLV�LV�XVXDOO\�VHW�HTXDO�WR�WKH�$SS�K,QVWDQFH�SURSHUW\��

O&XVW'DWD

$SSOLFDWLRQ�GHILQHG�GDWD�SDVVHG�LQ�WR�WKH�KRRN��OSIQ3DJH6HWXS+RRN

$�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��OSIQ3DJH3DLQW+RRN

$�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��ZKLFK�VSHFLILFDOO\�LQWHUFHSWV�WKH�SDLQWLQJ�PHVVDJHV�IRU�WKH�VDPSOH�SDJH�REMHFW�RQ�WKLV�GLDORJ�ER[��

OS3DJH6HWXS7HPSODWH1DPH

3DJH�VHWXS�WHPSODWH�QDPH��K3DJH6HWXS7HPSODWH

+DQGOH�WR�WKH�SDJH�VHWXS�WHPSODWH��

POINTAPI � �

� �'HILQHV�D�SRLQW�RQ�DQ�[�DQG�\�FRRUGLQDWH�SODQH��3XEOLF�7\SH�32,17$3,���������[�$V�/RQJ���������\�$V�/RQJ�(QG�7\SH�

6WUXFWXUH�0HPEHUV�

[

[�FRRUGLQDWH�RI�D�SRLQW�\

\�FRRUGLQDWH�RI�D�SRLQW�

PRINTDLG � �

� �'HILQHV�WKH�3ULQW�FRPPRQ�GLDORJ�ER[��3XEOLF�7\SH�35,17'/*���������O6WUXFW6L]H�$V�/RQJ�����������������������KZQG2ZQHU�$V�/RQJ������������������������������K'HY0RGH�$V�/RQJ����������������������

Page 666: Visual Basic - Subclassing and Hooking with VB & VB NET

��������K'HY1DPHV�$V�/RQJ������������������������������KGF�$V�/RQJ������������������������������IODJV�$V�/RQJ������������������������������Q)URP3DJH�$V�,QWHJHU�����������������������Q7R3DJH�$V�,QWHJHU�����������������������Q0LQ3DJH�$V�,QWHJHU�����������������������Q0D[3DJH�$V�,QWHJHU�����������������������Q&RSLHV�$V�,QWHJHU�����������������������K,QVWDQFH�$V�/RQJ������������������������������O&XVW'DWD�$V�/RQJ������������������������������OSIQ3ULQW+RRN�$V�/RQJ�����������������������OSIQ6HWXS+RRN�$V�/RQJ�����������������������OS3ULQW7HPSODWH1DPH�$V�6WULQJ����������������OS6HWXS7HPSODWH1DPH�$V�6WULQJ����������������K3ULQW7HPSODWH�$V�/RQJ�����������������������K6HWXS7HPSODWH�$V�/RQJ���������������(QG�7\SH�

6WUXFWXUH�0HPEHUV�

O6WUXFW6L]H

6L]H�RI�WKLV�VWUXFWXUH��KZQG2ZQHU

+DQGOH�RI�WKH�RZQLQJ�ZLQGRZ��K'HY0RGH

3RLQWHU�WR�D�'(902'(�VWUXFWXUH��K'HY1DPHV

3RLQWHU�WR�D�'(91$0(6�VWUXFWXUH��KGF

+DQGOH�WR�D�GHYLFH�FRQWH[W��IODJV

)ODJV�GHVFULELQJ�WKLV�FRPPRQ�GLDORJ�ER[��<RX�PXVW�VHW�WKH�3'B(1$%/(35,177(03/$7(�IODJ�WR�XVH�D�PRGLILHG�WHPSODWH�IRU�WKH�3ULQW�GLDORJ�ER[��<RX�PXVW�VHW�WKH�3'B(1$%/(6(7837(03/$7(�IODJ�WR�XVH�D�PRGLILHG�WHPSODWH�IRU�WKH�3ULQW�6HWXS�GLDORJ�ER[��

Q)URP3DJH

6WDUWLQJ�SDJH��Q7R3DJH

(QGLQJ�SDJH��Q0LQ3DJH

Page 667: Visual Basic - Subclassing and Hooking with VB & VB NET

0LQLPXP�VWDUWLQJ�SDJH�QXPEHU��Q0D[3DJH

0D[LPXP�HQGLQJ�SDJH�QXPEHU��Q&RSLHV

1XPEHU�RI�FRSLHV��K,QVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�REMHFW�WKDW�FRQWDLQV�WKH�GLDORJ�UHVRXUFH��7KLV�LV�XVXDOO\�VHW�HTXDO�WR�WKH�$SS�K,QVWDQFH�SURSHUW\��

O&XVW'DWD

$SSOLFDWLRQ�GHILQHG�GDWD�SDVVHG�LQ�WR�WKH�KRRN��OSIQ3ULQW+RRN

$�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��OSIQ6HWXS+RRN

$�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�3ULQW�6HWXS�GLDORJ�KRRN�IXQFWLRQ��OS3ULQW7HPSODWH1DPH

7KH�,'�RI�WKH�PRGLILHG�3ULQW�GLDORJ�UHVRXUFH��OS6HWXS7HPSODWH

7KH�,'�RI�WKH�PRGLILHG�3ULQW�6HWXS�GLDORJ�UHVRXUFH��K3ULQW7HPSODWH

3ULQW�WHPSODWH�QDPH��LQ�PHPRU\�REMHFW���K6HWXS7HPSODWH

6HWXS�WHPSODWH�QDPH��LQ�PHPRU\�REMHFW���

PRINTDLGEX � �

� �'HILQHV�D�3ULQW�3URSHUW\�6KHHW�FRPPRQ�GLDORJ�ER[��3XEOLF�7\SH�35,17'/*(;�� ����O6WUXFW6L]H�$V�/RQJ�����������������������KZQG2ZQHU�$V�/RQJ������������������������������K'HY0RGH�$V�/RQJ������������������������������K'HY1DPHV�$V�/RQJ������������������������������KGF�$V�/RQJ������������������������������IODJV�$V�/RQJ����������������������� ����IODJV��$V�/RQJ����������������������� ����([FOXVLRQIODJV�$V�/RQJ�����������������������Q3DJH5DQJHV�$V�/RQJ�����������������������Q0D[3DJH5DQJHV�$V�/RQJ���������������� ����OS3DJH5DQJHV�$V�/RQJ���������������

Page 668: Visual Basic - Subclassing and Hooking with VB & VB NET

� ����Q0LQ3DJH�$V�/RQJ�����������������������Q0D[3DJH�$V�/RQJ�����������������������Q&RSLHV�$V�/RQJ�����������������������K,QVWDQFH�$V�/RQJ����������������������� ����OS3ULQW7HPSODWH1DPH�$V�/RQJ��������� ����OS&DOOEDFN�$V�/RQJ������������������������������Q3URSHUW\3DJHV�$V�/RQJ���������������� ����OSK3URSHUW\3DJHV$V�6WULQJ�����������������������QQ6WDUW3DJH�$V�/RQJ�����������������������GZ5HVXOW$FWLRQ�$V�/RQJ���������������(QG�7\SH�

6WUXFWXUH�0HPEHUV�

O6WUXFW6L]H

6L]H�RI�WKLV�VWUXFWXUH��KZQG2ZQHU

+DQGOH�RI�WKH�RZQLQJ�ZLQGRZ��K'HY0RGH

3RLQWHU�WR�D�'(902'(�VWUXFWXUH��K'HY1DPHV

3RLQWHU�WR�D�'(91$0(6�VWUXFWXUH��KGF

+DQGOH�WR�D�GHYLFH�FRQWH[W��IODJV

)ODJV�GHVFULELQJ�WKLV�FRPPRQ�GLDORJ�ER[��<RX�PXVW�VHW�WKH�3'B(1$%/(35,177(03/$7(�IODJ�WR�XVH�D�PRGLILHG�GLDORJ�WHPSODWH�IRU�WKH�*HQHUDO�WDE��

IODJV�

0XVW�EH�VHW�WR�]HUR��([FOXVLRQIODJV

([FOXGHV�FRQWUROV�IURP�WKH�3ULQW�'ULYHU�3URSHUW\�SDJH��Q3DJH5DQJHV

1XPEHU�RI�SDJH�UDQJHV��Q0D[3DJH5DQJHV

6L]H�RI�OS3DJH5DQJHV��OS3DJH5DQJHV

3RLQWHU�WR�DUUD\�RI�35,173$*(5$1*(�VWUXFWXUHV��Q0LQ3DJH

0LQLPXP�VWDUWLQJ�SDJH�QXPEHU��

Page 669: Visual Basic - Subclassing and Hooking with VB & VB NET

Q0D[3DJH

0D[LPXP�HQGLQJ�SDJH�QXPEHU��Q&RSLHV

1XPEHU�RI�FRSLHV��K,QVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�REMHFW�WKDW�FRQWDLQV�WKH�GLDORJ�UHVRXUFH��7KLV�LV�XVXDOO\�VHW�HTXDO�WR�WKH�$SS�K,QVWDQFH�SURSHUW\��

OS3ULQW7HPSODWH1DPH

7KH�,'�RI�WKH�PRGLILHG�GLDORJ�UHVRXUFH�IRU�WKH�*HQHUDO�WDE��OS&DOOEDFN

$�SRLQWHU�WR�WKH�GHYHORSHU�GHILQHG�GLDORJ�KRRN�IXQFWLRQ��Q3URSHUW\3DJHV

1XPEHU�RI�SURSHUW\�SDJH�KDQGOHV��OSK3URSHUW\3DJHV$V

3RLQWHU�WR�DUUD\�RI�SURSHUW\�SDJH�KDQGOHV��QQ6WDUW3DJH

3URSHUW\�SDJH�LQLWLDOO\�GLVSOD\HG��GZ5HVXOW$FWLRQ

&RQWDLQV�WKH�UHVXOWV�RI�DFWLRQV�SHUIRUPHG�LQ�WKLV�GLDORJ�

RECT � �

� �'HILQHV�WKH�ERXQGDULHV�RI�D�UHFWDQJXODU�VKDSH��3XEOLF�7\SH�5(&7���������/HIW�$V�/RQJ����������������7RS�$V�/RQJ����������������5LJKW�$V�/RQJ����������������%RWWRP�$V�/RQJ��������(QG�7\SH�

6WUXFWXUH�0HPEHUV�

/HIW (TXDO�WR�WKH�/HIW�SURSHUW\�RI�D�IRUP�

7RS

(TXDO�WR�WKH�7RS�SURSHUW\�RI�D�IRUP�5LJKW

(TXDO�WR�WKH�:LGWK�SURSHUW\�RI�D�IRUP�

Page 670: Visual Basic - Subclassing and Hooking with VB & VB NET

%RWWRP

(TXDO�WR�WKH�+HLJKW�SURSHUW\�RI�D�IRUP�

WNDCLASSEX � �

� �'HILQHV�D�ZLQGRZV�FODVV��3XEOLF�7\SH�:1'&/$66(;�����FE6L]H�$V�/RQJ�����VW\OH�$V�/RQJ�����OSIQ:QG3URF�$V�/RQJ�����FE&OV([WUD�$V�/RQJ�����FE:QG([WUD�$V�/RQJ�����K,QVWDQFH�$V�/RQJ�����K,FRQ�$V�/RQJ�����K&XUVRU�$V�/RQJ�����KEU%DFNJURXQG�$V�/RQJ�����OSV]0HQX1DPH�$V�6WULQJ�����OSV]&ODVV1DPH�$V�6WULQJ�����K,FRQ6P�$V�/RQJ�(QG�7\SH�

6WUXFWXUH�0HPEHUV�

FE6L]H

7KH�VL]H�RI�WKLV�VWUXFWXUH��<RX�VKRXOG�VHW�LW�WR�/HQ�:1'&/$66(;���VW\OH

$�FRPELQDWLRQ�RI�FODVV�VW\OH�FRQVWDQWV�25HG�WRJHWKHU��7KHVH�VW\OHV�GHWHUPLQH�WKH�IXQGDPHQWDO�ORRN�DQG�RSHUDWLRQ�RI�D�ZLQGRZ�FUHDWHG�IURP�WKLV�FODVV��)RU�H[DPSOH��WKH�&6B12&/26(�FRQVWDQW�GLVDEOHV�WKH�&ORVH�RSWLRQ�RQ�WKH�FODVVV�ZLQGRZ�PHQX��ZKLOH�WKH�&6B+5('5$:�FRQVWDQW�IRUFHV�D�UHGUDZ�RI�WKH�ZLQGRZ�ZKHQHYHU�WKH�ZLGWK�RI�LWV�FOLHQW�DUHD�FKDQJHV��

OSIQ:QG3URF

7KH�IXQFWLRQ�SRLQWHU�WR�WKH�ZLQGRZ�SURFHGXUH�IRU�WKLV�FODVV��FE&OV([WUD

$PRXQW�RI�H[WUD�VSDFH�WR�DGG�WR�WKH�HQG�RI�WKH�FODVV�VWUXFWXUH��7KH�GHYHORSHU�XVHV�WKLV�WR�VWRUH�FODVV�UHODWHG�LQIRUPDWLRQ��

FE:QG([WUD

Page 671: Visual Basic - Subclassing and Hooking with VB & VB NET

$PRXQW�RI�H[WUD�VSDFH�WR�DGG�WR�WKH�HQG�RI�WKH�ZLQGRZ�VWUXFWXUH��7KH�GHYHORSHU�XVHV�WKLV�WR�VWRUH�ZLQGRZ�UHODWHG�LQIRUPDWLRQ��

K,QVWDQFH

7KH�LQVWDQFH�KDQGOH�RI�WKH�PRGXOH�WKDW�FRQWDLQV�WKH�ZLQGRZ�SURFHGXUH�IRU�WKLV�FODVV��K,FRQ

+DQGOH�WR�DQ�LFRQ�UHVRXUFH��K&XUVRU

+DQGOH�WR�D�FXUVRU�UHVRXUFH��KEU%DFN*URXQG

7KH�KDQGOH�WR�D�EUXVK�RU�D�FRORU�YDOXH�XVHG�WR�SDLQW�WKH�EDFNJURXQG�RI�WKH�ZLQGRZ�FUHDWHG�IURP�WKLV�FODVV��

OSV]0HQX1DPH

7KH�QXOO�WHUPLQDWHG�VWULQJ�WKDW�GHILQHV�WKH�PHQX�UHVRXUFH��OSV]&ODVV1DPH

7KH�QXOO�WHUPLQDWHG�VWULQJ�RU�FODVV�DWRP�GHILQLQJ�WKH�QDPH�RI�WKH�FODVV��7KLV�YDOXH�PXVW�EH�XQLTXH��

K,FRQ6P

+DQGOH�WR�WKH�VPDOO�LFRQ�UHVRXUFH��

Message (.NET Structure) � �

� �'HILQHV�D�:LQGRZV�PHVVDJH��3XEOLF�6WUXFWXUH�0HVVDJH�

3XEOLF�6KDUHG�0HWKRGV�

&UHDWH

&UHDWHV�D�QHZ�0HVVDJH�VWUXFWXUH��

3XEOLF�,QVWDQFH�)LHOGV�

KZQG

7KH�KDQGOH�WR�ZKLFK�WKLV�PHVVDJH�LV�VHQW��PVJ

7KH�LGHQWLILHU�IRU�WKLV�PHVVDJH��O3DUDP

'HILQLWLRQ�GHSHQGV�RQ�PHVVDJH��Z3DUDP

Page 672: Visual Basic - Subclassing and Hooking with VB & VB NET

'HILQLWLRQ�GHSHQGV�RQ�PHVVDJH��UHVXOW

5HWXUQ�YDOXH�IRU�WKLV�PHVVDJH��

3XEOLF�,QVWDQFH�0HWKRGV�

(TXDOV

'HWHUPLQHV�LI�WKLV�0HVVDJH�VWUXFWXUH�LV�HTXDO�WR�DQRWKHU�REMHFW��*HW+DVK&RGH

5HWXUQV�D�KDVK�FRGH�YDOXH�IRU�WKH�LQVWDQFH�RI�WKLV�VWUXFWXUH��*HW/3DUDP

&DVWV�WKH�O3DUDP�ILHOG�WR�DQ�2EMHFW�W\SH��*HW7\SH

5HWXUQV�WKLV�VWUXFWXUHV�W\SH��7R6WULQJ

5HWXUQV�WKH�QDPH�RI�WKLV�VWUXFWXUH��

3URWHFWHG�,QVWDQFH�0HWKRGV�

)LQDOL]H

7KH�GHVWUXFWRU�IRU�WKLV�FODVV��0HPEHUZLVH&ORQH

5HWXUQV�D�VKDOORZ�FRS\�RI�WKLV�VWUXFWXUHV�LQVWDQFH��

&���&RQVWDQWV�

&�����%URDGFDVW6\VWHP0HVVDJH�)XQFWLRQ�0DVNV�

3XEOLF�&RQVW�%60B$//&20321(176� �+��3XEOLF�&RQVW�%60B9;'6� �+��3XEOLF�&RQVW�%60B1(7'5,9(5� �+��3XEOLF�&RQVW�%60B,167$//$%/('5,9(56� �+��3XEOLF�&RQVW�%60B$33/,&$7,216� �+��3XEOLF�&RQVW�%60B$//'(6.7236� �+��� �

&�����&RPPRQ�'LDORJ�%R[�(UURU�0HVVDJHV�

3ULYDWH�&RQVW�&'(55B',$/2*)$,/85(� �+))))�3ULYDWH�&RQVW�&'(55B),1'5(6)$,/85(� �+��

Page 673: Visual Basic - Subclassing and Hooking with VB & VB NET

3ULYDWH�&RQVW�&'(55B*(1(5$/&2'(6� �+��3ULYDWH�&RQVW�&'(55B,1,7,$/,=$7,21� �+��3ULYDWH�&RQVW�&'(55B/2$'5(6)$,/85(� �+��3ULYDWH�&RQVW�&'(55B/2$'675)$,/85(� �+��3ULYDWH�&RQVW�&'(55B/2&.5(6)$,/85(� �+��3ULYDWH�&RQVW�&'(55B0(0$//2&)$,/85(� �+��3ULYDWH�&RQVW�&'(55B0(0/2&.)$,/85(� �+$�3ULYDWH�&RQVW�&'(55B12+,167$1&(� �+��3ULYDWH�&RQVW�&'(55B12+22.� �+%�3ULYDWH�&RQVW�&'(55B127(03/$7(� �+��3ULYDWH�&RQVW�&'(55B5(*,67(506*)$,/� �+&�3ULYDWH�&RQVW�&'(55B6758&76,=(� �+��

&�����&RPPRQ�'LDORJ�%R[�1RWLILFDWLRQ�0HVVDJHV��

3XEOLF�&RQVW�&'1B,1,7'21(� ������3XEOLF�&RQVW�&'1B6(/&+$1*(� ������3XEOLF�&RQVW�&'1B)2/'(5&+$1*(� ������3XEOLF�&RQVW�&'1B6+$5(9,2/$7,21� ������3XEOLF�&RQVW�&'1B+(/3� ������3XEOLF�&RQVW�&'1B),/(2.� ������3XEOLF�&RQVW�&'1B7<3(&+$1*(� ������3XEOLF�&RQVW�&'1B,1&/8'(,7(0� ������

&�����&ODVV�6W\OHV�

3XEOLF�&RQVW�&6B95('5$:� �+��3XEOLF�&RQVW�&6B+5('5$:� �+��3XEOLF�&RQVW�&6B.(<&97:,1'2:� �+��3XEOLF�&RQVW�&6B'%/&/.6� �+��3XEOLF�&RQVW�&6B2:1'&� �+���3XEOLF�&RQVW�&6B&/$66'&� �+���3XEOLF�&RQVW�&6B3$5(17'&� �+���3XEOLF�&RQVW�&6B12.(<&97� �+����3XEOLF�&RQVW�&6B12&/26(� �+����3XEOLF�&RQVW�&6B6$9(%,76� �+����3XEOLF�&RQVW�&6B%<7($/,*1&/,(17� �+�����3XEOLF�&RQVW�&6B%<7($/,*1:,1'2:� �+�����3XEOLF�&RQVW�&6B38%/,&&/$66� �+�����

Page 674: Visual Basic - Subclassing and Hooking with VB & VB NET

&�����(GLW�&RQWURO�1RWLILFDWLRQ�&RGHV�

3XEOLF�&RQVW�(1B6(7)2&86� �+����3XEOLF�&RQVW�(1B.,//)2&86� �+�����3XEOLF�&RQVW�(1B&+$1*(� �+����3XEOLF�&RQVW�(1B83'$7(� �+����3XEOLF�&RQVW�(1B(5563$&(� �+����3XEOLF�&RQVW�(1B0$;7(;7� �+����3XEOLF�&RQVW�(1B+6&52//� �+����3XEOLF�&RQVW�(1B96&52//� �+����3XEOLF�&RQVW�(1B$/,*1B/75B(&� �+����3XEOLF�&RQVW�(1B$/,*1B57/B(&� �+����

&�����([WHQGHG�:LQGRZ�6W\OHV�

3XEOLF�&RQVW�:6B(;B'/*02'$/)5$0(� �+��3XEOLF�&RQVW�:6B(;B123$5(17127,)<� �+��3XEOLF�&RQVW�:6B(;B7230267� �+��3XEOLF�&RQVW�:6B(;B$&&(37),/(6� �+���3XEOLF�&RQVW�:6B(;B75$163$5(17� �+���

&�����*HW&ODVV/RQJ3WU�)XQFWLRQ�&RQVWDQWV�

3XEOLF�&RQVW�*&/3B0(181$0(� ������3XEOLF�&RQVW�*&/3B+%5%$&.*5281'� �������3XEOLF�&RQVW�*&/3B+&85625� �������3XEOLF�&RQVW�*&/3B+,&2160� �������3XEOLF�&RQVW�*&/3B+02'8/(� �������3XEOLF�&RQVW�*&/3B:1'352&� �������

&�����*HW:LQGRZ�$3,�)XQFWLRQ�&RQVWDQWV�

3XEOLF�&RQVW�*:B+:1'),567� ���3XEOLF�&RQVW�*:B+:1'/$67� ���3XEOLF�&RQVW�*:B+:1'1(;7� ���3XEOLF�&RQVW�*:B+:1'35(9� ���3XEOLF�&RQVW�*:B2:1(5� ���3XEOLF�&RQVW�*:B&+,/'� ���

&�����*HW:LQGRZ/RQJ3WU�)XQFWLRQ�&RQVWDQWV�

Page 675: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�&RQVW�*:/3B+,167$1&(� ������3XEOLF�&RQVW�*:/3B:1'352&� ������3XEOLF�&RQVW�*:/3B86(5'$7$� �������3XEOLF�&RQVW�*:/3B+:1'3$5(17� ������

&������+RRN�&RGHV�

&��������*HQHUDO�

3XEOLF�&RQVW�+&B$&7,21� ���3XEOLF�&RQVW�+&B*(71(;7� ���3XEOLF�&RQVW�+&B6.,3� ���3XEOLF�&RQVW�+&B125(029(� ���3XEOLF�&RQVW�+&B125(0� �+&B125(029(�3XEOLF�&RQVW�+&B6<602'$/21� ���3XEOLF�&RQVW�+&B6<602'$/2))� ����

&��������&RPSXWHU�EDVHG�WUDLQLQJ��&%7��KRRN�FRGHV�

3XEOLF�&RQVW�+&%7B029(6,=(� ���3XEOLF�&RQVW�+&%7B0,10$;� ���3XEOLF�&RQVW�+&%7B46� ���3XEOLF�&RQVW�+&%7B&5($7(:1'� ���3XEOLF�&RQVW�+&%7B'(6752<:1'� ���3XEOLF�&RQVW�+&%7B$&7,9$7(� ���3XEOLF�&RQVW�+&%7B&/,&.6.,33('� ���3XEOLF�&RQVW�+&%7B.(<6.,33('� ���3XEOLF�&RQVW�+&%7B6<6&200$1'� ���3XEOLF�&RQVW�+&%7B6(7)2&86� ���

&��������:+B06*),/7(5�KRRN�FRGHV�

3XEOLF�&RQVW�06*)B',$/2*%2;� ���3XEOLF�&RQVW�06*)B0(66$*(%2;� ���3XEOLF�&RQVW�06*)B0(18� ���3XEOLF�&RQVW�06*)B029(� ���3XEOLF�&RQVW�06*)B6,=(� ���3XEOLF�&RQVW�06*)B6&52//%$5� ���3XEOLF�&RQVW�06*)B1(;7:,1'2:� ���3XEOLF�&RQVW�06*)B0$,1/223� ���

Page 676: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�&RQVW�06*)B0$;� ���3XEOLF�&RQVW�06*)B86(5� ������

&��������:+B6+(//�KRRN�FRGHV�

3XEOLF�&RQVW�+6+(//B:,1'2:&5($7('� ���3XEOLF�&RQVW�+6+(//B:,1'2:'(6752<('� ���3XEOLF�&RQVW�+6+(//B$&7,9$7(6+(//:,1'2:� ���3XEOLF�&RQVW�+6+(//B:,1'2:$&7,9$7('� ���3XEOLF�&RQVW�+6+(//B*(70,15(&7� ���3XEOLF�&RQVW�+6+(//B5('5$:� ��3XEOLF�&RQVW�+6+(//B7$6.0$1� ���3XEOLF�&RQVW�+6+(//B/$1*8$*(� ���3XEOLF�&RQVW�+6+(//B$&&(66,%,/,7<67$7(� ����3XEOLF�&RQVW�+6+(//B$33&200$1'� ����

&������+6+(//B$&&(66,%,/,7<67$7(�&RQVWDQWV�

3XEOLF�&RQVW�$&&(66B67,&.<.(<6� �+��3XEOLF�&RQVW�$&&(66B),/7(5.(<6� �+��3XEOLF�&RQVW�$&&(66B0286(.(<6� �+��

&������.H\�6WDWH�0DVNV�IRU�0RXVH�0HVVDJHV��

3XEOLF�&RQVW�0.B/%87721� �+��3XEOLF�&RQVW�0.B5%87721� �+��3XEOLF�&RQVW�0.B6+,)7� �+��3XEOLF�&RQVW�0.B&21752/� �+��3XEOLF�&RQVW�0.B0%87721� �+���3XEOLF�&RQVW�0.B;%87721�� �+���3XEOLF�&RQVW�0.B;%87721�� �+���

&������/RZ�/HYHO�+RRN�&RQVWDQWV��

3XEOLF�&RQVW�.)B(;7(1'('� �+����3XEOLF�&RQVW�.)B$/7'2:1� �+�����3XEOLF�&RQVW�.)B83� �+�����3XEOLF�&RQVW�//.+)B(;7(1'('� ��.)B(;7(1'('�!!����3XEOLF�&RQVW�//.+)B,1-(&7('� �+���3XEOLF�&RQVW�//.+)B$/7'2:1� ��.)B$/7'2:1�!!����3XEOLF�&RQVW�//.+)B83� ��.)B83�!!����

Page 677: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�&RQVW�//0+)B,1-(&7('� �+��

&������0RXVH�:KHHO�&RQVWDQW�

3XEOLF�&RQVW�:+((/B'(/7$� �����

&������2SHQ�DQG�6DYH�$V�&RPPRQ�'LDORJ�%R[1RWLILFDWLRQ�&RGHV��

3XEOLF�&RQVW�2)1B$//2:08/7,6(/(&7� �+����3XEOLF�&RQVW�2)1B&5($7(352037� �+�����3XEOLF�&RQVW�2)1B(1$%/(+22.� �+���3XEOLF�&RQVW�2)1B(1$%/(7(03/$7(� �+���3XEOLF�&RQVW�2)1B(1$%/(7(03/$7(+$1'/(� �+���3XEOLF�&RQVW�2)1B(;3/25(5� �+������3XEOLF�&RQVW�2)1B(;7(16,21',))(5(17� �+����3XEOLF�&RQVW�2)1B),/(0867(;,67� �+�����3XEOLF�&RQVW�2)1B+,'(5($'21/<� �+��3XEOLF�&RQVW�2)1B/21*1$0(6� �+�������3XEOLF�&RQVW�2)1B12&+$1*(',5� �+��3XEOLF�&RQVW�2)1B12'(5()(5(1&(/,1.6� �+�������3XEOLF�&RQVW�2)1B12/21*1$0(6� �+������3XEOLF�&RQVW�2)1B121(7:25.%87721� �+������3XEOLF�&RQVW�2)1B125($'21/<5(7851� �+�����3XEOLF�&RQVW�2)1B127(67),/(&5($7(� �+������3XEOLF�&RQVW�2)1B129$/,'$7(� �+����3XEOLF�&RQVW�2)1B29(5:5,7(352037� �+��3XEOLF�&RQVW�2)1B3$7+0867(;,67� �+����3XEOLF�&RQVW�2)1B5($'21/<� �+��3XEOLF�&RQVW�2)1B6+$5($:$5(� �+�����3XEOLF�&RQVW�2)1B6+$5()$//7+528*+� ���3XEOLF�&RQVW�2)1B6+$5(12:$51� ���3XEOLF�&RQVW�2)1B6+$5(:$51� ���3XEOLF�&RQVW�2)1B6+2:+(/3� �+���3XEOLF�&RQVW�2)1B(1$%/(,1&/8'(127,)<� �+���������

&������3HHN0HVVDJH�)XQFWLRQ�2SWLRQV��

3XEOLF�&RQVW�30B125(029(� �+��

Page 678: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�&RQVW�30B5(029(� �+��3XEOLF�&RQVW�30B12<,(/'� �+��

&������3RVW0HVVDJH�DQG�6HQG0HVVDJH�)XQFWLRQ�&RQVWDQWV��

3XEOLF�&RQVW�+:1'B%52$'&$67� �+))))�3XEOLF�&RQVW�+:1'B'(6.723� ���

&������3UHGHILQHG�&RQWURO�,'�9DOXHV�IRU�WKH�2SHQ�DQG6DYH�$V�&RPPRQ�'LDORJ�%R[HV�

3XEOLF�&RQVW�FK[�� �+������������������3XEOLF�&RQVW�FPE�� �+������������������3XEOLF�&RQVW�FPE�� �+������������������3XEOLF�&RQVW�FPE��� �+��&��������3XEOLF�&RQVW�HGW�� �+�������������������3XEOLF�&RQVW�OVW�� �+������������������3XEOLF�&RQVW�VWF�� �+������������������3XEOLF�&RQVW�VWF�� �+������������������3XEOLF�&RQVW�VWF�� �+������������������3XEOLF�&RQVW�VWF�� �+������������������3XEOLF�&RQVW�,'2.� �����������������3XEOLF�&RQVW�,'&$1&(/� �����������������3XEOLF�&RQVW�,'$%257� ���3XEOLF�&RQVW�,'5(75<� ���3XEOLF�&RQVW�,'<(6� ���3XEOLF�&RQVW�,'12� ���3XEOLF�&RQVW�,'&/26(� ���3XEOLF�&RQVW�,'+(/3� ���3XEOLF�&RQVW�SVK+HOS� �SVK���

&������6HQG0HVVDJH7LPHRXW�$3,�)XQFWLRQ�&RQVWDQWV�

3XEOLF�&RQVW�6072B1250$/� �+��3XEOLF�&RQVW�6072B%/2&.� �+��3XEOLF�&RQVW�6072B$%257,)+81*� �+��3XEOLF�&RQVW�6072B127,0(287,)127+81*� �+��

&������6HW:LQGRZ/RQJ3WU�*HW:LQGRZ/RQJ3WU�)XQFWLRQ�&RQVWDQWV�

Page 679: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�&RQVW�':/3B06*5(68/7� ���3XEOLF�&RQVW�':/3B'/*352&� ���3XEOLF�&RQVW�':/3B86(5� ���

&������6HW:LQGRZ3RV�)XQFWLRQ�&RQVWDQWV�

3XEOLF�&RQVW�6:3B126,=(� �+��3XEOLF�&RQVW�6:3B12029(� �+��3XEOLF�&RQVW�6:3B12=25'(5� �+��3XEOLF�&RQVW�6:3B125('5$:� �+��3XEOLF�&RQVW�6:3B12$&7,9$7(� �+���3XEOLF�&RQVW�6:3B)5$0(&+$1*('� �+�����������3XEOLF�&RQVW�6:3B6+2::,1'2:� �+���3XEOLF�&RQVW�6:3B+,'(:,1'2:� �+���3XEOLF�&RQVW�6:3B12&23<%,76� �+����3XEOLF�&RQVW�6:3B122:1(5=25'(5� �+����������3XEOLF�&RQVW�6:3B'5$:)5$0(� �6:3B)5$0(&+$1*('�3XEOLF�&RQVW�6:3B125(326,7,21� �6:3B122:1(5=25'(5�3XEOLF�&RQVW�+:1'B723� ���3XEOLF�&RQVW�+:1'B%27720� ���3XEOLF�&RQVW�+:1'B7230267� ����3XEOLF�&RQVW�+:1'B127230267� ����3XEOLF�&RQVW�'/*:,1'2:(;75$� ����

&������6KRZ:LQGRZ�)XQFWLRQ�&RQVWDQWV�

3XEOLF�&RQVW�6:B0$;,0,=(� �����������3XEOLF�&RQVW�6:B0,1,0,=(� �����������3XEOLF�&RQVW�6:B6+2:0$;,0,=('� ������3XEOLF�&RQVW�6:B6+2:0,1,0,=('� ������3XEOLF�&RQVW�6:B6+2:0,112$&7,9(� ���

&������8VHU�%XWWRQ�1RWLILFDWLRQ�&RGHV�

3XEOLF�&RQVW�%1B&/,&.('� ���3XEOLF�&RQVW�%1B3$,17� ���3XEOLF�&RQVW�%1B+,/,7(� ���3XEOLF�&RQVW�%1B81+,/,7(� ���3XEOLF�&RQVW�%1B',6$%/(� ���3XEOLF�&RQVW�%1B'28%/(&/,&.('� ���

Page 680: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�&RQVW�%1B386+('� �%1B+,/,7(�3XEOLF�&RQVW�%1B81386+('� �%1B81+,/,7(�3XEOLF�&RQVW�%1B'%/&/.� �%1B'28%/(&/,&.('�3XEOLF�&RQVW�%1B6(7)2&86� ���3XEOLF�&RQVW�%1B.,//)2&86� ���

&������9LUWXDO�.H\�&RGHV��

3XEOLF�&RQVW�9.B/%87721� �+��3XEOLF�&RQVW�9.B5%87721� �+��3XEOLF�&RQVW�9.B&$1&(/� �+��3XEOLF�&RQVW�9.B0%87721� �+��3XEOLF�&RQVW�9.B;%87721�� �+��3XEOLF�&RQVW�9.B;%87721�� �+��3XEOLF�&RQVW�9.B%$&.� �+��3XEOLF�&RQVW�9.B7$%� �+��3XEOLF�&RQVW�9.B&/($5� �+&�3XEOLF�&RQVW�9.B5(7851� �+'�3XEOLF�&RQVW�9.B6+,)7� �+���3XEOLF�&RQVW�9.B&21752/� �+���3XEOLF�&RQVW�9.B0(18� �+���3XEOLF�&RQVW�9.B3$86(� �+���3XEOLF�&RQVW�9.B&$3,7$/� �+���3XEOLF�&RQVW�9.B(6&$3(� �+�%�3XEOLF�&RQVW�9.B63$&(� �+���3XEOLF�&RQVW�9.B35,25� �+���3XEOLF�&RQVW�9.B1(;7� �+���3XEOLF�&RQVW�9.B(1'� �+���3XEOLF�&RQVW�9.B+20(� �+���3XEOLF�&RQVW�9.B/()7� �+���3XEOLF�&RQVW�9.B83� �+���3XEOLF�&RQVW�9.B5,*+7� �+���3XEOLF�&RQVW�9.B'2:1� �+���3XEOLF�&RQVW�9.B6(/(&7� �+���3XEOLF�&RQVW�9.B35,17� �+�$�3XEOLF�&RQVW�9.B(;(&87(� �+�%�3XEOLF�&RQVW�9.B61$36+27� �+�&�3XEOLF�&RQVW�9.B,16(57� �+�'�3XEOLF�&RQVW�9.B'(/(7(� �+�(�3XEOLF�&RQVW�9.B+(/3� �+�)�

Page 681: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�&RQVW�9.B1803$'�� �+���3XEOLF�&RQVW�9.B1803$'�� �+���3XEOLF�&RQVW�9.B1803$'�� �+���3XEOLF�&RQVW�9.B1803$'�� �+���3XEOLF�&RQVW�9.B1803$'�� �+���3XEOLF�&RQVW�9.B1803$'�� �+���3XEOLF�&RQVW�9.B1803$'�� �+���3XEOLF�&RQVW�9.B1803$'�� �+���3XEOLF�&RQVW�9.B1803$'�� �+���3XEOLF�&RQVW�9.B1803$'�� �+���3XEOLF�&RQVW�9.B08/7,3/<� �+�$�3XEOLF�&RQVW�9.B$''� �+�%�3XEOLF�&RQVW�9.B6(3$5$725� �+�&�3XEOLF�&RQVW�9.B68%75$&7� �+�'�3XEOLF�&RQVW�9.B'(&,0$/� �+�(�3XEOLF�&RQVW�9.B',9,'(� �+�)�3XEOLF�&RQVW�9.B)�� �+���3XEOLF�&RQVW�9.B)�� �+���3XEOLF�&RQVW�9.B)�� �+���3XEOLF�&RQVW�9.B)�� �+���3XEOLF�&RQVW�9.B)�� �+���3XEOLF�&RQVW�9.B)�� �+���3XEOLF�&RQVW�9.B)�� �+���3XEOLF�&RQVW�9.B)�� �+���3XEOLF�&RQVW�9.B)�� �+���3XEOLF�&RQVW�9.B)��� �+���3XEOLF�&RQVW�9.B)��� �+�$�3XEOLF�&RQVW�9.B)��� �+�%�3XEOLF�&RQVW�9.B)��� �+�&�3XEOLF�&RQVW�9.B)��� �+�'�3XEOLF�&RQVW�9.B)��� �+�(�3XEOLF�&RQVW�9.B)��� �+�)�3XEOLF�&RQVW�9.B)��� �+���3XEOLF�&RQVW�9.B)��� �+���3XEOLF�&RQVW�9.B)��� �+���3XEOLF�&RQVW�9.B)��� �+���3XEOLF�&RQVW�9.B)��� �+���3XEOLF�&RQVW�9.B)��� �+���3XEOLF�&RQVW�9.B)��� �+���3XEOLF�&RQVW�9.B)��� �+���

Page 682: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�&RQVW�9.B180/2&.� �+���3XEOLF�&RQVW�9.B6&52//� �+���3XEOLF�&RQVW�9.B/6+,)7� �+$��3XEOLF�&RQVW�9.B56+,)7� �+$��3XEOLF�&RQVW�9.B/&21752/� �+$��3XEOLF�&RQVW�9.B5&21752/� �+$��3XEOLF�&RQVW�9.B/0(18� �+$��3XEOLF�&RQVW�9.B50(18� �+$��3XEOLF�&RQVW�9.B$771� �+)��3XEOLF�&RQVW�9.B&56(/� �+)��3XEOLF�&RQVW�9.B(;6(/� �+)��3XEOLF�&RQVW�9.B(5(2)� �+)��3XEOLF�&RQVW�9.B3/$<� �+)$�3XEOLF�&RQVW�9.B=220� �+)%�3XEOLF�&RQVW�9.B121$0(� �+)&�3XEOLF�&RQVW�9.B3$�� �+)'�3XEOLF�&RQVW�9.B2(0B&/($5� �+)(��9.B$�WKUX�9.B=�DUH�WKH�VDPH�DV�WKHLU�$6&,,�HTXLYDOHQWV��$�WKUX�=�9.B��WKUX�9.B��DUH�WKH�VDPH�DV�WKHLU�$6&,,�HTXLYDOHQWV����WKUX����

&������:LQGRZ�+RRN�&RQVWDQWV��

3XEOLF�&RQVW�:+B0,1� ������3XEOLF�&RQVW�:+B06*),/7(5� ������3XEOLF�&RQVW�:+B-2851$/5(&25'� ���3XEOLF�&RQVW�:+B-2851$/3/$<%$&.� ���3XEOLF�&RQVW�:+B.(<%2$5'� ���3XEOLF�&RQVW�:+B*(70(66$*(� ���3XEOLF�&RQVW�:+B&$//:1'352&� ���3XEOLF�&RQVW�:+B&%7� ���3XEOLF�&RQVW�:+B6<606*),/7(5� ���3XEOLF�&RQVW�:+B0286(� ���3XEOLF�&RQVW�:+B+$5':$5(� ���3XEOLF�&RQVW�:+B'(%8*� ���3XEOLF�&RQVW�:+B6+(//� ����3XEOLF�&RQVW�:+B)25(*5281','/(� ����3XEOLF�&RQVW�:+B0$;� ����

Page 683: Visual Basic - Subclassing and Hooking with VB & VB NET

&������:LQGRZ�6W\OHV��

3XEOLF�&RQVW�:6B29(5/$33('� �+��3XEOLF�&RQVW�:6B32383� �+���������3XEOLF�&RQVW�:6B&+,/'� �+���������3XEOLF�&RQVW�:6B0,1,0,=(� �+���������3XEOLF�&RQVW�:6B9,6,%/(� �+���������3XEOLF�&RQVW�:6B',6$%/('� �+��������3XEOLF�&RQVW�:6B&/,36,%/,1*6� �+��������3XEOLF�&RQVW�:6B&/,3&+,/'5(1� �+��������3XEOLF�&RQVW�:6B0$;,0,=(� �+��������3XEOLF�&RQVW�:6B&$37,21� �+&������������������������3XEOLF�&RQVW�:6B%25'(5� �+�������3XEOLF�&RQVW�:6B'/*)5$0(� �+�������3XEOLF�&RQVW�:6B96&52//� �+�������3XEOLF�&RQVW�:6B+6&52//� �+�������3XEOLF�&RQVW�:6B6<60(18� �+������3XEOLF�&RQVW�:6B7+,&.)5$0(� �+������3XEOLF�&RQVW�:6B*5283� �+������3XEOLF�&RQVW�:6B7$%6723� �+������3XEOLF�&RQVW�:6B0,1,0,=(%2;� �+������3XEOLF�&RQVW�:6B0$;,0,=(%2;� �+������3XEOLF�&RQVW�:6B7,/('� �:6B29(5/$33('�3XEOLF�&RQVW�:6B,&21,&� �:6B0,1,0,=(�3XEOLF�&RQVW�:6B6,=(%2;� �:6B7+,&.)5$0(�3XEOLF�&RQVW�:6B7,/(':,1'2:� �:6B29(5/$33(':,1'2:�3XEOLF�&RQVW�:6B32383:,1'2:� ��:6B32383�2U�:6B%25'(5�2U�:6B6<60(18��3XEOLF�&RQVW�:6B&+,/':,1'2:� ��:6B&+,/'��3XEOLF�&RQVW�:6B29(5/$33(':,1'2:� ��:6B29(5/$33('�2U�:6B&$37,21�2U�:6B6<60(18�2U�������������������������������������:6B7+,&.)5$0(�2U�:6B0,1,0,=(%2;������������������������������������2U�:6B0$;,0,=(%2;���

&������:0B.(<83��:0B'2:1��DQG:0B&+$5�O3DUDP�+,:25'�)ODJV�

3XEOLF�&RQVW�.)B(;7(1'('� �+����3XEOLF�&RQVW�.)B'/*02'(� �+����3XEOLF�&RQVW�.)B0(1802'(� �+�����3XEOLF�&RQVW�.)B$/7'2:1� �+�����

Page 684: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�&RQVW�.)B5(3($7� �+�����3XEOLF�&RQVW�.)B83� �+�����

&������:0B1&+,77(67�&RGHV��

3XEOLF�&RQVW�+7(5525� ������3XEOLF�&RQVW�+775$163$5(17� ������3XEOLF�&RQVW�+712:+(5(� ���3XEOLF�&RQVW�+7&/,(17� ���3XEOLF�&RQVW�+7&$37,21� ���3XEOLF�&RQVW�+76<60(18� ���3XEOLF�&RQVW�+7*52:%2;� ���3XEOLF�&RQVW�+76,=(� �+7*52:%2;�3XEOLF�&RQVW�+70(18� ���3XEOLF�&RQVW�+7+6&52//� ���3XEOLF�&RQVW�+796&52//� ���3XEOLF�&RQVW�+70,1%87721� ���3XEOLF�&RQVW�+70$;%87721� ���3XEOLF�&RQVW�+7/()7� ����3XEOLF�&RQVW�+75,*+7� ����3XEOLF�&RQVW�+7723� ����3XEOLF�&RQVW�+7723/()7� ����3XEOLF�&RQVW�+77235,*+7� ����3XEOLF�&RQVW�+7%27720� ����3XEOLF�&RQVW�+7%27720/()7� ����3XEOLF�&RQVW�+7%277205,*+7� ����3XEOLF�&RQVW�+7%25'(5� ����3XEOLF�&RQVW�+75('8&(� �+70,1%87721�3XEOLF�&RQVW�+7=220� �+70$;%87721�3XEOLF�&RQVW�+76,=(),567� �+7/()7�3XEOLF�&RQVW�+76,=(/$67� �+7%277205,*+7�

&������:+B6+(//�&RGHV�IRU�WKH�+6+(//B$33&200$1'�+RRN�&RGH��

3XEOLF�&RQVW�$33&200$1'B%$66B%2267� �����3XEOLF�&RQVW�$33&200$1'B%$66B'2:1� �����3XEOLF�&RQVW�$33&200$1'B%$66B83� �����3XEOLF�&RQVW�$33&200$1'B%52:6(5B%$&.:$5'� ����3XEOLF�&RQVW�$33&200$1'B%52:6(5B)$925,7(6� ����3XEOLF�&RQVW�$33&200$1'B%52:6(5B)25:$5'� ����

Page 685: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�&RQVW�$33&200$1'B%52:6(5B+20(� ����3XEOLF�&RQVW�$33&200$1'B%52:6(5B5()5(6+� ����3XEOLF�&RQVW�$33&200$1'B%52:6(5B6($5&+� ����3XEOLF�&RQVW�$33&200$1'B%52:6(5B6723� ����3XEOLF�&RQVW�$33&200$1'B/$81&+B$33�� �����3XEOLF�&RQVW�$33&200$1'B/$81&+B$33�� �����3XEOLF�&RQVW�$33&200$1'B/$81&+B0$,/� �����3XEOLF�&RQVW�$33&200$1'B0(',$B1(;775$&.� �����3XEOLF�&RQVW�$33&200$1'B0(',$B3/$<B3$86(� �����3XEOLF�&RQVW�$33&200$1'B0(',$B35(9,28675$&.� �����3XEOLF�&RQVW�$33&200$1'B0(',$B6723� ����3XEOLF�&RQVW�$33&200$1'B75(%/(B'2:1� �����3XEOLF�&RQVW�$33&200$1'B75(%/(B83� �����3XEOLF�&RQVW�$33&200$1'B92/80(B'2:1� ����3XEOLF�&RQVW�$33&200$1'B92/80(B087(� ����3XEOLF�&RQVW�$33&200$1'B92/80(B83� ����3XEOLF�&RQVW�)$33&200$1'B.(<� �+���3XEOLF�&RQVW�)$33&200$1'B0286(� �+������3XEOLF�&RQVW�)$33&200$1'B2(0� �+�����

&������:0B6,=(�0HVVDJH�Z3DUDP�9DOXHV�

3XEOLF�&RQVW�6,=(B5(6725('� ���3XEOLF�&RQVW�6,=(B0,1,0,=('� ���3XEOLF�&RQVW�6,=(B0$;,0,=('� ���3XEOLF�&RQVW�6,=(B0$;6+2:� ���3XEOLF�&RQVW�6,=(B0$;+,'(� ���

&������:0B6<6&200$1'�0HVVDJH�Z3DUDP�&RQVWDQWV�

3XEOLF�&RQVW�6&B0,1,0,=(� �+)����3XEOLF�&RQVW�6&B&/26(� �+)����������3XEOLF�&RQVW�6&B+27.(<� �+)���������3XEOLF�&RQVW�6&B+6&52//� �+)��������3XEOLF�&RQVW�6&B.(<0(18� �+)��������3XEOLF�&RQVW�6&B021,72532:(5� �+�����3XEOLF�&RQVW�6&B0$;,0,=(� �+)�������3XEOLF�&RQVW�6&B0,1,0,=(� �+)�������3XEOLF�&RQVW�6&B0286(0(18� �+)������3XEOLF�&RQVW�6&B029(� �+)�����������

Page 686: Visual Basic - Subclassing and Hooking with VB & VB NET

3XEOLF�&RQVW�6&B1(;7:,1'2:� �+)�����3XEOLF�&RQVW�6&B35(9:,1'2:� �+)�����3XEOLF�&RQVW�6&B5(6725(� �+)��������3XEOLF�&RQVW�6&B6&5((16$9(� �+)�����3XEOLF�&RQVW�6&B6,=(� �+)�����������3XEOLF�&RQVW�6&B7$6./,67� �+)�������3XEOLF�&RQVW�6&B96&52//� �+)��������3XEOLF�&RQVW�6&B,&21� �6&B0,1,0,=(����3XEOLF�&RQVW�6&B=220� �6&B0$;,0,=(�

&������;%XWWRQ�&RQVWDQWV��

3XEOLF�&RQVW�;%87721��������[�����3XEOLF�&RQVW�;%87721��������[�����

Page 687: Visual Basic - Subclassing and Hooking with VB & VB NET

&RORSKRQ�2XU�ORRN�LV�WKH�UHVXOW�RI�UHDGHU�FRPPHQWV��RXU�RZQ�H[SHULPHQWDWLRQ��DQG�IHHGEDFN�IURP�GLVWULEXWLRQ�FKDQQHOV��'LVWLQFWLYH�FRYHUV�FRPSOHPHQW�RXU�GLVWLQFWLYH�DSSURDFK�WR�WHFKQLFDO�WRSLFV��EUHDWKLQJ�SHUVRQDOLW\�DQG�OLIH�LQWR�SRWHQWLDOO\�GU\�VXEMHFWV��7KH�DQLPDOV�RQ�WKH�FRYHU�RI�6XEFODVVLQJ�DQG�+RRNLQJ�ZLWK�9LVXDO�%DVLF�DUH�FRPPRQ�EUXVKWDLO�SRVVXPV��7ULFKRVXUXV�YXOSHFXOD���7KHVH�VPDOO�$XVWUDOLDQ�PDUVXSLDOV�DUH�DERXW�RQH�VL[WK�WKH�VL]H�RI�D�KRXVHFDW��7KH\�KDYH�ELJ�HDUV��ORQJ�ZKLVNHUV��DQG�D�SRLQW\�VQRXW�WLSSHG�ZLWK�D�SLQN�QRVH��WKHLU�IXU�FRORU�UDQJHV�IURP�OLJKW�JUD\�WR�GDUN�EURZQ��$�EUXVKWDLO�SRVVXP�SUHJQDQF\�ODVWV�RQO\�DERXW����GD\V��EXW��DIWHU�ELUWK��WKH�VLQJOH�LQIDQW�VSHQGV�XS�WR���PRQWKV�LQ�KLV�PRWKHUV�SRXFK�DQG�WKHQ�LV�GHSHQGHQW�RQ�PRP�IRU�DQRWKHU���WR���PRQWKV�ORQJHU��2UGLQDULO\��EUXVKWDLO�SRVVXPV�DUH�WUHH�GZHOOHUV��WKHLU�ORQJ��SUHKHQVLOH�WDLOV�DQG�RSSRVDEOH�GLJLWV�DUH�LGHDO�IRU�JUDVSLQJ�WUHH�EUDQFKHV��7KH\�GLQH�RQ�OHDYHV��IUXLWV��DQG�IORZHUV�DQG�ZHUH�RQFH�FRPPRQ�DOO�RYHU�$XVWUDOLD��%XW�QRZ�WKH\UH�ODUJHO\�DEVHQW�IURP�WKH�LQWHULRU�RI�WKH�FRXQWU\��DQG�WKH\�FDQ�WRR�RIWHQ�EH�IRXQG�OLYLQJ�LQ�WKH�HDYHV�DQG�DWWLFV�RI�VXEXUEDQ�KRXVHV��UDLGLQJ�WUDVK�FDQV�IRU�WKHLU�GLQQHUV��,QWURGXFHG�WR�1HZ�=HDODQG�LQ�������WKH\UH�D�PDMRU�SHVW�VSHFLHV�LQ�WKDW�FRXQWU\�DV�ZHOO��DQG�SRSXODWLRQ�FRQWURO�HIIRUWV�LQFOXGH�DWWHPSWV�WR�SRSXODUL]H�SRVVXP�IXU�JDUPHQWV��/HDQQH�6R\OHPH]�DQG�0DWW�+XWFKLQVRQ�ZHUH�WKH�SURGXFWLRQ�HGLWRUV�IRU�6XEFODVVLQJ�DQG�+RRNLQJ�ZLWK�9LVXDO�%DVLF��/HDQQH�6R\OHPH]�ZDV�WKH�SURRIUHDGHU��$XGUH\�'R\OH�ZDV�WKH�FRS\HGLWRU��/LQOH\�'ROE\�SURYLGHG�TXDOLW\�FRQWURO��-RKQQD�9DQ+RRVH�'LQVH�DQG�%UHQGD�0LOOHU�ZURWH�WKH�LQGH[��(OOLH�9ROFNKDXVHQ�GHVLJQHG�WKH�FRYHU�RI�WKLV�ERRN��EDVHG�RQ�D�VHULHV�GHVLJQ�E\�(GLH�)UHHGPDQ��7KH�FRYHU�LPDJH�LV�IURP�7KH�,OOXVWUDWHG�1DWXUDO�+LVWRU\��0DPPDOLD��(PPD�&ROE\�SURGXFHG�WKH�FRYHU�OD\RXW�ZLWK�4XDUN ;3UHVV�����XVLQJ�$GREHV�,7&�*DUDPRQG�IRQW��'DYLG�)XWDWR�GHVLJQHG�WKH�LQWHULRU�OD\RXW�EDVHG�RQ�D�VHULHV�GHVLJQ�E\�1DQF\�3ULHVW��$QQH�0DULH�9DGXYD�FRQYHUWHG�WKH�ILOHV�IURP�0LFURVRIW�:RUG�WR�)UDPH0DNHU�������XVLQJ�WRROV�FUHDWHG�E\�0LNH�6LHUUD��7KH�WH[W�DQG�KHDGLQJ�IRQWV�DUH�,7&�*DUDPRQG�/LJKW�DQG�*DUDPRQG�%RRN��WKH�FRGH�IRQW�LV�&RQVWDQW�:LOOLVRQ��7KH�LOOXVWUDWLRQV�WKDW�DSSHDU�LQ�WKH�ERRN�ZHUH�SURGXFHG�E\�5REHUW�5RPDQR�DQG�-HVVDP\Q�5HDG�XVLQJ�0DFURPHGLD�)UHH+DQG���DQG�$GREH�3KRWRVKRS����7KLV�FRORSKRQ�ZDV�ZULWWHQ�E\�/HDQQH�6R\OHPH]��


Recommended