VNC源码研究（十）XP、Win7实现模拟发送ATL+CTRL+DEL

 

转载请标明是引用于 http://blog.csdn.net/chenyujing1234 

欢迎大家拍砖

 

1、vnc-4.0-winsrc  版本中实现模拟发送ATL+CTRL+DEL

在工程wrfb_win32m中找到模拟发送ATL+CTR_DEL 的代码

 

在Service.h中有

  // -=- Routines used by the SInput Keyboard class to emulate Ctrl-Alt-Del
    //     Returns false under Win9x
    bool emulateCtrlAltDel();

它的实现是：

bool
rfb::win32::emulateCtrlAltDel() {
  if (!osVersion.isPlatformNT)
    return false;

  CADThread* cad_thread = new CADThread();
  vlog.debug("emulate Ctrl-Alt-Del");
  if (cad_thread) {
    cad_thread->start();
    cad_thread->join();
    bool result = cad_thread->result;
    delete cad_thread;
    return result;
  }
  return false;
}

（1）首先判断是不是NT家族的操作系统

OSVersionInfo继续于系统的结构体OSVERSIONINFO(这样的设计是为了考虑到后面要调用系统API：GetVersionEx)

namespace rfb {

  namespace win32 {

    extern struct OSVersionInfo : OSVERSIONINFO {
      OSVersionInfo();

      // Is the OS one of the NT family (NT 3.51, NT4.0, 2K, XP, etc.)?
      bool isPlatformNT;
      // Is one of the Windows family?
      bool isPlatformWindows;

      // Is this OS one of those that blue-screens when grabbing another desktop (NT4 pre SP3)?
      bool cannotSwitchDesktop;

    } osVersion;

  };

};

它的系统信息在OSVersionInfo构造函数时获得：

OSVersionInfo::OSVersionInfo() {
  // Get OS Version Info
  ZeroMemory(static_cast(this), sizeof(this));
  dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
  if (!GetVersionEx(this))
    throw rdr::SystemException("unable to get system version info", GetLastError());

  // Set the special extra flags
  isPlatformNT = dwPlatformId == VER_PLATFORM_WIN32_NT;
  isPlatformWindows = dwPlatformId == VER_PLATFORM_WIN32_WINDOWS;

  cannotSwitchDesktop = isPlatformNT && (dwMajorVersion==4) &&
    ((_tcscmp(szCSDVersion, _T("")) == 0) ||
     (_tcscmp(szCSDVersion, _T("Service Pack 1")) == 0) ||
     (_tcscmp(szCSDVersion, _T("Service Pack 2")) == 0));

}

（2）创建CADThread对象

CADThread* cad_thread = new CADThread();

CADThread类继续自Thread
Thread的设计是值得我们学习的。

class Thread {
  public:
    Thread(const char* name_=0);
    virtual ~Thread();

    virtual void run();

    virtual void start();
    virtual Thread* join();

    const char* getName() const;
    ThreadState getState() const;

    // Determines whether the thread should delete itself when run() returns
    // If you set this, you must NEVER call join()!
    void setDeleteAfterRun() {deleteAfterRun = true;};

    unsigned long getThreadId() const;

    static Thread* self();

    friend class Condition;

  protected:
    Thread(HANDLE thread_, DWORD thread_id_);
    static DWORD WINAPI threadProc(LPVOID lpParameter);

    HANDLE thread;
    DWORD thread_id;
    char* name;
    ThreadState state;
    Condition* sig;
    Mutex mutex;

    HANDLE cond_event;
	  Thread* cond_next;

    bool deleteAfterRun;
  };

CADThread重载了Thread类的run函数，CADThread的run函数先保存原有的桌面，然后切换到Winlogon桌面，然后发送ATL_CTRL_DEL，

最后把桌面还原。

class CADThread : public Thread {
public:
  CADThread() : Thread("CtrlAltDel Emulator"), result(false) {}
  virtual void run() {
	  HDESK old_desktop = GetThreadDesktop(GetCurrentThreadId());

    if (switchToDesktop(OpenDesktop(_T("Winlogon"), 0, FALSE, DESKTOP_CREATEMENU | DESKTOP_CREATEWINDOW |
		  DESKTOP_ENUMERATE | DESKTOP_HOOKCONTROL |
		  DESKTOP_WRITEOBJECTS | DESKTOP_READOBJECTS |
      DESKTOP_SWITCHDESKTOP | GENERIC_WRITE))) {
	    PostMessage(HWND_BROADCAST, WM_HOTKEY, 0, MAKELONG(MOD_ALT | MOD_CONTROL, VK_DELETE));
      switchToDesktop(old_desktop);
      result = true;
    }
  }
  bool result;
};

 

（3）使用（2）得到的对象调用功能

cad_thread->start();
    cad_thread->join();

分别调用了start函数与join函数。有人可能会问，（2）定义的run接口怎么没调用到，其实是有的。

因为在Thread类的构造时就启动了此线程：

Thread::Thread(const char* name_) : sig(0), deleteAfterRun(false) {
  sig = new Condition(mutex);
  cond_event = CreateEvent(NULL, TRUE, FALSE, NULL);
  if (!name_)
    name_ = "Unnamed";
  name = strDup(name_);
  thread = CreateThread(NULL, 0, threadProc, this, CREATE_SUSPENDED, &thread_id);
  state = ThreadCreated;
  logAction(this, "created");
}

 

Thread::threadProc中就会调用到它：

 

2、tightvnc  客户端版本中实现模拟发送ATL+CTRL+DEL

在我的文章《XP、Wn7模拟发送ctrl+alt+delete组合键》中讲到在win7中实现模拟ATL+CTRL+DEL的方法，虽然我已经改在了会话1中发送窗口消息，可是还是没达到效果。

网友建议我去查看VNC代码，由于tightvnc代码是支持Win7 的，于是希望在这里找到解决方法。

在win-system工程中有Environment.h文件定义有类：

#ifndef _ENVIRONMENT_H_
#define _ENVIRONMENT_H_

#include "util/StringStorage.h"

#include 

class Environment
{
public:
  static const int APPLICATION_DATA_SPECIAL_FOLDER = 0x0; 
  static const int COMMON_APPLICATION_DATA_SPECIAL_FOLDER = 0x1;
public:
  Environment();
  ~Environment();

  static void getErrStr(StringStorage *out);

  static void getErrStr(const TCHAR *specification, StringStorage *out);

  static bool getSpecialFolderPath(int specialFolderId, StringStorage *out);

  static bool getCurrentModulePath(StringStorage *out);

  static bool getCurrentModuleFolderPath(StringStorage *out);

  static bool getCurrentUserName(StringStorage *out);

  static bool getComputerName(StringStorage *out);

  static void restoreWallpaper();
  static void disableWallpaper();

  static bool isWinNTFamily();
  static bool isWinXP();
  static bool isWin2003Server();
  static bool isVistaOrLater();

  static void simulateCtrlAltDel();

private:
  static void init();
  static OSVERSIONINFO m_osVerInfo;
};

#endif

其中有 static void simulateCtrlAltDel();接口

void Environment::simulateCtrlAltDel()
{
  if (isWinNTFamily()) {
    CtrlAltDelSimulator cadSim;
    cadSim.wait();
  }
}

与vnc-4.0-winsrc  版本的CADThread类继承于Thread类类似，这里的CtrlAltDelSimulator类也继续Thread。

同样在thread类的构造时就启动了此线程：

Thread::Thread()
: m_terminated(false), m_active(false), m_hDesk(0)
{
  m_hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE) threadProc,
                           (LPVOID) this, CREATE_SUSPENDED, (LPDWORD) &m_threadID);
  m_hDesk = DesktopSelector::getInputDesktop();
}

线程里会去调用execute方法：

DWORD WINAPI Thread::threadProc(LPVOID pThread)
{
  Thread *_this = ((Thread *)pThread);
  try {
    DesktopSelector::setDesktopToCurrentThread(_this->m_hDesk);
    DesktopSelector::closeDesktop(_this->m_hDesk);
    _this->m_hDesk = 0;
    _this->execute();
  } catch (Exception &e) {
    Log::error(_T("Abnormal thread termination.")
               _T(" ThreadId = %x, message = \"%s\" \n"),
               _this->m_threadID, e.getMessage());
  }
  _this->m_active = false;
  return 0;
}

CtrlAltDelSimulator类重载了execute方法：

void CtrlAltDelSimulator::execute()
{
  if (DesktopSelector::selectDesktop(&StringStorage(_T("Winlogon")))) {
    HWND hwndCtrlAltDel = FindWindow(_T("SAS window class"), _T("SAS window"));
    if (hwndCtrlAltDel == NULL) {
      hwndCtrlAltDel = HWND_BROADCAST;
    }
    PostMessage(hwndCtrlAltDel, WM_HOTKEY, 0, MAKELONG(MOD_ALT | MOD_CONTROL, VK_DELETE));
  }
}

 

往窗口发送消息是与VNC4.0版本是类似的，这里只讲selectDesktop的不同。

 

bool DesktopSelector::selectDesktop(const StringStorage *name)
{
  HDESK desktop;
  if (name) {
    desktop = getDesktop(name);
  } else {
    desktop = getInputDesktop();
  }

  bool result = setDesktopToCurrentThread(desktop) != 0;
  closeDesktop(desktop);

  return result;
}

 

HDESK DesktopSelector::getDesktop(const StringStorage *name)
{
  return OpenDesktop(name->getString(), 0, TRUE,
                     DESKTOP_CREATEMENU |
                     DESKTOP_CREATEWINDOW |
                     DESKTOP_ENUMERATE |
                     DESKTOP_HOOKCONTROL |
                     DESKTOP_WRITEOBJECTS |
                     DESKTOP_READOBJECTS |
                     DESKTOP_SWITCHDESKTOP |
                     GENERIC_WRITE);
}

 

bool DesktopSelector::setDesktopToCurrentThread(HDESK newDesktop)
{
  return SetThreadDesktop(newDesktop) != 0;
}

3、VNC服务端发送模拟CTRL+ATL+DEL的方法

3、1 在Vista版本前

 参考我的文章《XP、Wn7模拟发送ctrl+alt+delete组合键》

 

3、2 在Vista版本后

同样是在Environment.h里的class Environment类中有：

  static bool isWinNTFamily();
  static bool isWinXP();
  static bool isWin2003Server();
  static bool isVistaOrLater();

  static void simulateCtrlAltDel();

  static void simulateCtrlAltDelUnderVista();

win7下的函数就是：simulateCtrlAltDelUnderVista

void Environment::simulateCtrlAltDelUnderVista()
{
  Log::info(_T("Requested Ctrl+Alt+Del simulation under Vista or later"));

  try {
    DynamicLibrary sasLib(_T("sas.dll"));
    SendSas sendSas = (SendSas)sasLib.getProcAddress("SendSAS");
    if (sendSas == 0) {
      throw Exception(_T("The SendSAS function has not been found"));
    }
    sendSas(FALSE); 
  } catch (Exception &e) {
    Log::error(_T("The simulateCtrlAltDelUnderVista() function failed: %s"),
               e.getMessage());
  }
}

实现思路：

（1）从system32文件夹下的sas.dll里得到SendSAS接口，

（2）然后调用此接口sendSas(FALSE);

使用注意事项：

（1）

SendSAS function

Simulates a secure attention sequence (SAS).

VOID WINAPI SendSAS(
  _In_  BOOL AsUser
);

 

Parameters

AsUser [in]

TRUE if the caller is running as the current user; otherwise,FALSE.

Remarks

为了调用SendSAS成功，应用必然以服务方式运行或有uiAccess属性（用requestedExceptionLevel函数设置为true）。

如果不是以服务方式运行，那么得把User Account Control打开。

Important  Applications with the uiAccess attribute set to "true" must be signed by usingAuthenticode. In addition, the application must reside in a protected location in the file system. Currently, there are two allowable protected locations:

\Program Files\

\windows\system32\

本地的安全策略必须配置为允许服务和应用程序模拟SAS。

为了配置策略，修改组策略编辑器（GPE）中的设置。

控制 委托的GPE是在下面的位置：

Computer Configuration | Administrative Templates | Windows Components | Windows Logon Options | Disable or enable software Secure Attention Sequence

A service can impersonate the token of another process that calls that service. In this case, a call to theSendSAS function by that service simulates a SAS on the session associated with the impersonated token.

以上策略对应的注册表是：

reg add

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v

SoftwareSASGeneration /t REG_DWORD /d 1 /f

即增加以下注册表：

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"SoftwareSASGeneration"=dword:00000003

 

 

（2）我把它放在Win7类型于GINA的凭证COM里（且是以起一线程的方式调用），发现没有效果。

这是因为SendSAS只能在服务中才起作用，而在凭据中是不能起作用的。

（3） 

 

 那么simulateCtrlAltDelUnderVista在哪里被调用呢？

void SasUserInput::setKeyboardEvent(UINT32 keySym, bool down)
{
  bool delPressed = false;

  if (m_underVista) {
    switch (keySym) {
    case XK_Alt_L:
    case XK_Alt_R:
      m_altPressed = down;
      break;
    case XK_Control_L:
    case XK_Control_R:
      m_ctrlPressed = down;
      break;
    case XK_Delete:
      delPressed = down;
    }
  }

  if (m_ctrlPressed && m_altPressed && delPressed && m_underVista) {
    Environment::simulateCtrlAltDelUnderVista();
  } else {
    m_client->setKeyboardEvent(keySym, down);
  }
}

我们再来看setKeyboardEvent在哪里被调用了：

（1）

void UserInputServer::applyKeyEvent(BlockingGate *backGate)
{
  UINT32 keySym;
  bool down;
  readKeyEvent(&keySym, &down, backGate);
  m_userInput->setKeyboardEvent(keySym, down);
}

applyKeyEvent调用readKeyEvent读出键值和按下或弹上的标志，然后再调用setKeyboardEvent。

applyKeyEvent的实现过程：

void DesktopServerProto::readKeyEvent(UINT32 *keySym, bool *down,
                                      BlockingGate *gate)
{
  *keySym = gate->readUInt32();
  *down = gate->readUInt8() != 0;
}

 

（2）

void RfbClient::onKeyboardEvent(UINT32 keySym, bool down)
{
  m_desktop->setKeyboardEvent(keySym, down);
}

 

（3）

void WinDesktop::setKeyboardEvent(UINT32 keySym, bool down)
{
  Log::info(_T("set keyboard event (keySym = %u, down = %d)"), keySym, (int)down);
  try {
    if (isRemoteInputAllowed()) {
      m_userInput->setKeyboardEvent(keySym, down);
    }
  } catch (Exception &e) {
    Log::error(_T("setKeyboardEvent() crashed: %s"), e.getMessage());
    m_extDeskTermListener->onAbnormalDesktopTerminate();
  }
}

 

（4）