🚀 go-pugleaf

Hi mike,

your ideas sounds very good. but i have no idea how to start. i have already
developed a WH_SHELL hook. but know i do not know if i need this, or how to
check now whether a application is trying to start. if have never work with
COM before.

could you help

dermold

"Mike Collins" <mikec@kr8.co.uk> schrieb im Newsbeitrag
news:3ed53e63$1@newsgroups.borland.com...
> Not 100% sure if I understand you so correct me if I'm wrong:
>
> You want to determine if a SPECIFIC application can be executed, based on
> the existence of a secondary special file?  So you're not trying to catch
/
> filter the execution of all files executed by the user / system!
>
> There are a few ways to achieve this, however, I'm no expert and most of
the
> following is based on research as opposed to actual hard code :-)
>
> The first system, which should work perfectly for you, is to implement a
> IShellExecuteHook COM interface - I'll probably be suitably corrected
here,
> but this is basically a COM object which can be used to filter / marshal
> what ShellExecute (and ShellExecuteEx) can execute.  When a user tries to
> execute an application or file, explorer.exe (the desktop for all
intensive
> purposes) calls ShellExecute / Ex and passes along the required
application
> / file.  ShellExecute, in turn, determines how to handle the app / file
and
> (I assume) somewhere down the line calls CreateProcess.  Now it is
possible
> to hook into ShellExecute/Ex using the IShellExecuteHook interface.  For
> this you need to create the COM object
> (http://www.codeguru.com/shell/ShellLogging.html) and then register it
> (detailed in the article above).  Now every time ShellExecute is fired
(from
> with explorer.exe or any other application) your hook is instantiated and
> you can validate what goes on i.e. check the application that is being
> launched and check for the existence of the file.
>
> However, there are a few limitations to this method.  Primarily the
problem
> with this system is that it does NOT hook or catch CreateProcess.  From
the
> tests that I've done, it is possible to launch application from a command
> prompt which I can only assume is because cmd.exe uses CreateProcess to
> execute application / executables.  Because of this, it would also be
> possible for a third-party to by-pass this check by creating an
application
> that called CreateProcess on the Specific application directly.
>
> After much research, the only way that I could find to enforce a system
wide
> hooking mechanise to marshal the execution of application both from the
> shell and the command, was to used a kind of DLL-injection system using
> SetWindowsHookEx to get my DLL into the launched application memory space
> and then patch the IAT import table, to re-direct all calls to
ShellExecute
> / Ex, CreateProcess A / W, LoadLibrary and GetProcAddress.  Still have a
few
> problems with THIS method :-)
>
> Hope this help a bit, e-mail with any question but as I said, most of this
> is un-tested!
>
> "Dermold" <dermold@gmxx.com> wrote in message
> news:3ed51019@newsgroups.borland.com...
> > hi,
> >
> > i have to create a system which decide (if a special file exists)
whether
> a
>
>