What function would I need to hook (using easy hook) to prevent minimize of a third party application?

Question

I'm trying to write a simple thing that prevents a third party application from being able to minimize. I'm going to use EasyHook as I think that's the easiest way of doing this.

My code is going to be in C#. I've been looking at the examples in the EasyHook repo, I'm just not sure which windows function I need to replace to achieve this.

Or if there is another way of doing this that would be good too.

Example (not working):

Program.cs

using System;
using System.Text.RegularExpressions;
using EasyHook;

namespace AutoMaximize
{
    internal class Program
    {
        private static void Main(string[] args)
        {
            WindowFinder wf = new WindowFinder();

            PInvoke.HWND hwnd = new PInvoke.HWND();
            wf.FindWindows(
                           new PInvoke.HWND(),
                           new Regex(@"Notepad\+\+"),
                           null,
                           null,
                           delegate(PInvoke.HWND wnd)
                           {
                               hwnd = wnd;
                               return true;
                           });

            uint processId = 0;
            PInvoke.GetWindowThreadProcessId(hwnd, out processId);

            try
            {
                RemoteHooking.Inject((int) processId, InjectionOptions.Default, "AutoMaximizeInject_x86.dll", "AutoMaximizeInject_x64.dll");
            }
            catch (Exception ex)
            {
                Console.WriteLine(ex.Message);
            }
        }
    }
}

AutoMaximizeInject.cs

using System;
using EasyHook;

namespace AutoMaximize
{
    public class AutoMaximizeInject : IEntryPoint
    {
        #region Delegates

        public delegate int DShowWindow(IntPtr hWnd, int nCmdShow);

        #endregion

        public LocalHook ShowWindowHook = null;

        public AutoMaximizeInject(RemoteHooking.IContext inContext, string inChannelName) { }

        public void Run(RemoteHooking.IContext inContext, string inArg)
        {
            try
            {
                ShowWindowHook = LocalHook.Create(LocalHook.GetProcAddress("user32.dll", "ShowWindow"), new DShowWindow(ShowWindowHooked), this);

                /*
                 * Don't forget that all hooks will start deaktivated...
                 * The following ensures that all threads are intercepted:
                 */
                ShowWindowHook.ThreadACL.SetExclusiveACL(new Int32[1]);
            }
            catch (Exception)
            {
            }
        }

        public static int ShowWindowHooked(IntPtr hWnd, int nCmdShow)
        {
            try
            {
                switch (nCmdShow)
                {
                    case PInvoke.SW_FORCEMINIMIZE:
                    case PInvoke.SW_HIDE:
                    case PInvoke.SW_MAXIMIZE:
                    case PInvoke.SW_MINIMIZE:
                    case PInvoke.SW_NORMAL:
                    case PInvoke.SW_RESTORE:
                    case PInvoke.SW_SHOW:
                    case PInvoke.SW_SHOWDEFAULT:
                    case PInvoke.SW_SHOWMINIMIZED:
                    case PInvoke.SW_SHOWMINNOACTIVE:
                    case PInvoke.SW_SHOWNA:
                    case PInvoke.SW_SHOWNOACTIVATE:
                    case PInvoke.SW_SMOOTHSCROLL:
                        nCmdShow = PInvoke.SW_MAXIMIZE;
                        break;
                }
            }
            catch (Exception)
            {
            }

            return PInvoke.ShowWindow(hWnd, nCmdShow);
        }
    }
}

Now the PInvoke stuff I'm not listing I know works I use it in other programs. The current issue is a crash down in the EasyHook.WOW64Bypass.Install() function the process it tries to run "EasyHook64Svc.exe" is crashing out.

I'm not sure if I did something wrong or if this is a EasyHook error. If someone could let know which it is that'd help a lot.

If I recall correctly, you can do this with a CBT hook also. — 500 - Internal Server Error, Jan 13 '15 at 01:36
@500-InternalServerError i'm not familiar with CBT hook what's that? Do you have an example? — TheKrush, Jan 13 '15 at 01:39
Nothing that I can easily extract and post. Take a look at [SetWindowsHookEx](http://msdn.microsoft.com/en-us/library/windows/desktop/ms644990%28v=vs.85%29.aspx) and go from there. — 500 - Internal Server Error, Jan 13 '15 at 01:41
I'll give the ShowWindow() function a go first to see if I can get that working. — TheKrush, Jan 13 '15 at 20:28
An error in the EasyHook64Svc.exe indicates it might be having trouble with the injection rather than the hooking. What version are you using? Does the ProcessMonitor example in the distribution work for you say on Notepad? What is your target application? Have you tried hooking something like notepad? — Justin Stenning, Jan 18 '15 at 13:34

score 1 · Accepted Answer · answered Jan 26 '15 at 19:38

Using Deviare I managed to modify the PrintLogger example to achieve a easy hook.

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Runtime.InteropServices;
using System.Text;
using System.Windows.Forms;
using Nektra.Deviare2;

namespace PrintLogger
{
    public partial class PrintLogger : Form
    {
        private NktSpyMgr _spyMgr;
        private NktProcess _process;

        public PrintLogger()
        {
            InitializeComponent();

            _spyMgr = new NktSpyMgr();
            _spyMgr.Initialize();
            _spyMgr.OnFunctionCalled += new DNktSpyMgrEvents_OnFunctionCalledEventHandler(OnFunctionCalled);

            GetProcess("notepad++.exe");
            if (_process == null)
            {
                MessageBox.Show("Please start \"notepad++.exe\" before!", "Error");
                Environment.Exit(0);
            }
        }

        private void PrintLogger_Load(object sender, EventArgs e)
        {
            NktHook hook = _spyMgr.CreateHook("user32.dll!ShowWindow", (int)(eNktHookFlags.flgOnlyPostCall));
            hook.Hook(true);
            hook.Attach(_process, true);
        }

        private bool GetProcess(string proccessName)
        {
            NktProcessesEnum enumProcess = _spyMgr.Processes();
            NktProcess tempProcess = enumProcess.First();
            while (tempProcess != null)
            {
                if (tempProcess.Name.Equals(proccessName, StringComparison.InvariantCultureIgnoreCase) && tempProcess.PlatformBits > 0 && tempProcess.PlatformBits <= IntPtr.Size * 8)
                {
                    _process = tempProcess;
                    return true;
                }
                tempProcess = enumProcess.Next();
            }

            _process = null;
            return false;
        }

        private void OnFunctionCalled(NktHook hook, NktProcess process, NktHookCallInfo hookCallInfo)
        {
            Output(hook.FunctionName + "( ");
            bool first = true;
            foreach (INktParam param in hookCallInfo.Params())
            {
                if (first)
                    first = false;
                else
                {
                    Output(", ");
                }
                Output(param.Name + " = " + param.Value.ToString());
            }
            Output(" )" + Environment.NewLine);
        }

        public delegate void OutputDelegate(string strOutput);

        private void Output(string strOutput)
        {
            if (InvokeRequired)

                BeginInvoke(new OutputDelegate(Output), strOutput);
            else
                textOutput.AppendText(strOutput);
        }
    }
}

What function would I need to hook (using easy hook) to prevent minimize of a third party application?

1 Answers1