微信公众号搜"智元新知"关注
微信扫一扫可直接关注哦!

CEF加载FLASH插件时弹出CMD命令行窗口的问题

问题

这个是flash插件一个bug,CEF(chromium系列浏览器)关闭sandBox第一次加载flash插件就会跳出这样的一个提示,在Google官方也看到了chromium的issue:

地址

这里写图片描述

解决方

官方暂时未解决这问题,只能是自己修改代码,通过hook命令行启动函数来实现不让命令行启动,hook库有
微软的牛逼 Detours 但是要票票的,Esayhook 就是个不错的选择,32和64位都支持,开放源码使用简单。
MHOOK据说小而好用但不研究了。

代码

// HookFlash.cpp : 定义 DLL 应用程序的导出函数
//



#include "stdafx.h"

using namespace std;

HOOK_TRACE_INFO hAHookTrackInfo = { NULL }; // keep track of our hook
HOOK_TRACE_INFO hWHookTrackInfo = { NULL }; // keep track of our hook

//注意调用约定 WINAPI,否则会出现堆栈异常

typedef BOOL(WINAPI *realCreateProcessWPtr)(LPCWSTR lpApplicationName,LPWSTR lpCommandLine,LPSecurity_ATTRIBUTES lpProcessAttributes,LPSecurity_ATTRIBUTES lpThreadAttributes,BOOL bInheritHandles,DWORD dwCreationFlags,LPVOID lpEnvironment,LPCWSTR lpCurrentDirectory,LPSTARTUPINFOW lpStartupInfo,LPPROCESS_informatION lpProcessinformation
    );


typedef BOOL(WINAPI *realCreateProcessAPtr)(LPCSTR lpApplicationName,LPSTR lpCommandLine,LPCSTR lpCurrentDirectory,\
    LPSTARTUPINFOA lpStartupInfo,\
    LPPROCESS_informatION lpProcessinformation);


realCreateProcessAPtr prealCreateProcessA;
realCreateProcessWPtr prealCreateProcessW;


BOOL WINAPI MYCreateProcessW(LPCWSTR lpApplicationName,LPPROCESS_informatION lpProcessinformation
)
{
    std::wstring strCommandLine(lpCommandLine);

    //MessageBoxW(GetActiveWindow(),strCommandLine.c_str(),L"createproceW",MB_OK);

    if (string::npos != strCommandLine.find(L"echo NOT SANDBoxED"))
    {
        //MessageBoxW(GetActiveWindow(),MB_OK);
        return TRUE;
    }
    else
    {
        return (prealCreateProcessW)(lpApplicationName,lpCommandLine,lpProcessAttributes,lpThreadAttributes,bInheritHandles,dwCreationFlags,lpEnvironment,lpCurrentDirectory,lpStartupInfo,lpProcessinformation);
    }

}

BOOL WINAPI MYCreateProcessA(
    LPCSTR lpApplicationName,LPSTARTUPINFOA lpStartupInfo,LPPROCESS_informatION lpProcessinformation
)
{
    std::string strCommandLine = lpCommandLine;

    if (string::npos != strCommandLine.find("echo NOT SANDBoxED"))
    {
        //MessageBoxA(GetActiveWindow(),"createprocesA",MB_OK);
        return TRUE;
    }
    else
    {
        return (prealCreateProcessA)(lpApplicationName,lpProcessinformation);
    }

}




void DoHook()
{

    HMODULE hKernel32 = LoadLibrary(L"kernel32.dll");

    if (!(prealCreateProcessA = (realCreateProcessAPtr)GetProcAddress(hKernel32,"CreateProcessA")))
    {
        MessageBoxW(GetDesktopWindow(),L"GetProcAddress Err",L"CreateProcessA",MB_OK);
        return;
    }

    if (!(prealCreateProcessW = (realCreateProcessWPtr)GetProcAddress(hKernel32,"CreateProcessW")))
    {
        MessageBoxW(GetDesktopWindow(),L"CreateProcessW",MB_OK);
        return;
    }


    NTSTATUS resultA = LhInstallHook(prealCreateProcessA,MYCreateProcessA,NULL,&hAHookTrackInfo);
    NTSTATUS resultW = LhInstallHook(prealCreateProcessW,MYCreateProcessW,&hWHookTrackInfo);


    if (Failed(resultA) || (Failed(resultW)))
    {
        MessageBox(GetForegroundWindow(),_T("Hook Failed"),_T("Error"),MB_OK);
    }


    ULONG ACLEntriesA[1] = { 0 };
    ULONG ACLEntriesW[1] = { 0 };

    // If the threadId in the ACL is set to “ 0 ”,
    // then internally EasyHook uses GetCurrentThreadId()
    // disable the hook for the provided threadIds,enable for all others
    LhSetExclusiveACL(ACLEntriesA,0,&hAHookTrackInfo);
    LhSetExclusiveACL(ACLEntriesW,&hWHookTrackInfo);

}


void UnHook()
{

    // this will also invalidate "hHook",because it is a traced handle... 
    LhUninstallAllHooks();

    // this will do nothing because the hook is already removed... 
    LhUninstallHook(&hAHookTrackInfo);
    LhUninstallHook(&hWHookTrackInfo);

    // even if the hook is removed,we need to wait for memory release 
    LhWaitForPendingRemovals();

}

源码下载

源码github地址

参考文章

http://www.voidcn.com/article/p-tqkvqcfd-or.html
http://easyhook.github.io/tutorials/nativehook.html

版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。

相关推荐