🚀 go-pugleaf

Not 100% sure if I understand you so correct me if I'm wrong:

You want to determine if a SPECIFIC application can be executed, based on
the existence of a secondary special file?  So you're not trying to catch /
filter the execution of all files executed by the user / system!

There are a few ways to achieve this, however, I'm no expert and most of the
following is based on research as opposed to actual hard code :-)

The first system, which should work perfectly for you, is to implement a
IShellExecuteHook COM interface - I'll probably be suitably corrected here,
but this is basically a COM object which can be used to filter / marshal
what ShellExecute (and ShellExecuteEx) can execute.  When a user tries to
execute an application or file, explorer.exe (the desktop for all intensive
purposes) calls ShellExecute / Ex and passes along the required application
/ file.  ShellExecute, in turn, determines how to handle the app / file and
(I assume) somewhere down the line calls CreateProcess.  Now it is possible
to hook into ShellExecute/Ex using the IShellExecuteHook interface.  For
this you need to create the COM object
(http://www.codeguru.com/shell/ShellLogging.html) and then register it
(detailed in the article above).  Now every time ShellExecute is fired (from
with explorer.exe or any other application) your hook is instantiated and
you can validate what goes on i.e. check the application that is being
launched and check for the existence of the file.

However, there are a few limitations to this method.  Primarily the problem
with this system is that it does NOT hook or catch CreateProcess.  From the
tests that I've done, it is possible to launch application from a command
prompt which I can only assume is because cmd.exe uses CreateProcess to
execute application / executables.  Because of this, it would also be
possible for a third-party to by-pass this check by creating an application
that called CreateProcess on the Specific application directly.

After much research, the only way that I could find to enforce a system wide
hooking mechanise to marshal the execution of application both from the
shell and the command, was to used a kind of DLL-injection system using
SetWindowsHookEx to get my DLL into the launched application memory space
and then patch the IAT import table, to re-direct all calls to ShellExecute
/ Ex, CreateProcess A / W, LoadLibrary and GetProcAddress.  Still have a few
problems with THIS method :-)

Hope this help a bit, e-mail with any question but as I said, most of this
is un-tested!

"Dermold" <dermold@gmxx.com> wrote in message
news:3ed51019@newsgroups.borland.com...
> hi,
>
> i have to create a system which decide (if a special file exists) whether
a