SetWindowsHookEx - antivirus issue - winapi

The task I have to do is to disable windows docking from keyboard shortcut
(VK_RWIN or VK_LWIN + arrow) in a single application.
To do this, I've decided to compelately block VK_RWIN and VK_LWIN virtual buttons in this app.
I've used SetWindowsHookEx with LowLevelKeyboardProc callback.
I'm checking if my application is activated via WM_ACTIVATEAPP message.
Inside the callback, if the application is active, I'm checking virtual keys and return 1,
when VK_RWIN or VK_LWIN is pressed.
Works perfect, just as expected.
Now, I just wonder if antiviruses may detect such usage as malware?

Yes, definitely. A lot of AV software (maybe most) will flag your application as malware simply because it contains a call to SetWindowsHookEx. For example, I have some code that creates keyboard hooks and I have to exclude that directory from the AV scanner because otherwise it quarantines my app as soon as I build it. That has been true of all three AV products I've used in recent years.
And since every AV product has its own way of whitelisting applications, it will be very difficult for you to figure out in advance what users will have to do to use your application.

Digitally sign your application so that AV software doesn't get triggered on it.

Related

Starting my app when USB device connected

I need to starting my app when our USB device connected.
My first attempt at this is a background application that pays attention to when USB devices are plugged in. When it notices our device connected, it calls ShellExecute( ) and starts our application.
This works nicely except in Windows 8. Supposing we're on the "Start" screen in Windows 8. In that situation, the application starts in the background and the start screen remains in front.
I think this is a "focus" problem since what I'm actually hoping to do is "steal focus" from the Start screen.
http://blogs.msdn.com/b/oldnewthing/archive/2009/02/20/9435239.aspx
Since my background application doesn't have focus (the Start screen has focus; besides, my application doesn't have a UI), it can't give focus away to my foreground application.
Let me say that in general, I hate focus stealing. Starting the app the user wants to use is a great help to our users.
How can I fix this problem? Maybe the answer is to programmatically ask the start screen to start my app but I don't see a way to do that:
http://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/9ed23f32-0708-48a8-9ff7-5fce6dbe123f/windows-8-start-screen-api
Maybe I'm approaching this in the wrong way. Suggestions?
You're going about this the wrong way. Although you can write a program to constantly monitor the USB ports to detect when something is connected, there's no need. The OS is already doing that anyway.
Register an Autoplay handler for your device type and class. This is distinct from the old AutoRun feature, which would automatically execute programs found on an inserted file system.
You can begin with an overview of the feature from the November 2001 issue of MSDN Magazine.
Your handler will be a COM DLL. You can register the DLL as a handler, and register the handler with events you want to handle. You can either perform everything in the DLL, or you can put the bulk of the functionality in your application and just use the DLL as a proxy between the OS and your program.

Setting mailto: protocol handler programmatically in Windows 8

Before Windows 8, the method of adding a mailto: protocol handler was straightforward (as outlined here Register Windows program with the mailto protocol programmatically)
As of Windows 8, the old method no longer works. It would seem that Win8 enforces the following key: HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\URLAssociations\‌​MAILTO\UserChoice.
It also appears the ProgID of the selected app is hashed and can't be forged, at least not that I can tell.
Does anyone have a working method for this, or can point me at a utility class/code that'll outline how to accomplish this programmatically?
For code, any language will do.
Edit
I've been asked from other discussions to specify a use-case, so I think it'd be helpful in the context of this question. Please consider this screenshot https://github.com/shellscape/Gmail-Notifier-Plus/raw/master/Promotional/prefs-account.png and the checkbox allowing the user to specify mailto handling. In this use-case, no one is forcing the user, the user is in control and makes the decision. While windows 8 store apps (metro/modern) have an available app manifest entry that automates the missing process described above, nothing seems to readily exist for desktop apps.
You can set your application to be activated by a custom protocol (like mailto:). When the user installs your app, if there is no other app supporting that protocol, they are not prompted and you are automatically assigned to that protocol.
If, however, the user already has an app that handles that protocol, then they will be prompted with a list of apps who support that protocol with the option to select the default. You cannot force the user to make a specific selection.
Also, if the user clicks on a protocol (like myprotocol:) and they have no app installed that handles that protocol then they will be sent to the store (app) which automatically searches for all apps that support that protocol. The user then installs whatever they want. You cannot force the user to make a specific selection (if any at all).
I wrote an article on protocol activation. It might be interesting to you: http://blog.jerrynixon.com/2012/10/walkthrough-using-windows-8-custom.html
So, I made Desktop Firefox my default mailto handler today in Windows 8 by adding the string value "mailto" to the HKCU\Software\Clients\StartMenuInternet\FIREFOX.EXE\Capabilities\URLAssociations and setting the value of "mailto" equal to the ProgID or "FirefoxURL". I then deleted the keys at HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\URLAssociations\‌​MAILTO\UserChoice to allow me to choose the default client again and this time Firefox was available for me to choose.
The essence of this question seems to be that one cannot take over the default client for any protocol anymore (post Windows 8). The user must choose. However, if you wanted to break the OS convention you could hook the call to create the choose default dialog, which would take research, effort, and be only a temporary kludge and would require "breaking" the OS, or you could send a double click to the dialog to choose for the user, assuming your program has elevated rights so that it can send clicks to Admin windows. That would probably be the easiest way, the user would never know what happened, just a quick flash. Really though, after registering itself as a protocol handler, I don't think any program should go beyond deleting the default protocol handler registry entry, thereby forcing the user to re-choose.
This is how to set mailto protocol manually and simply in Windows 8, 8.1, 2012, 2012R2
Add a new registry branch HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\mailto\UserChoice
Then click any mailto: link in your web browser, say IE
and finally there in a program list for you to choose which was not available before.
Also MAILTO appears in Control Panel\All Control Panel Items\Default Programs now. There is no other option to add/remove a protocol from there.
You can't have your app directly take over file associations anymore in Windows 8. There are guidelines for how to handle this for both Windows Store and desktop applications here: http://msdn.microsoft.com/en-us/library/windows/apps/hh700321.aspx

Windows 8 Layered Windows Over Metro Apps

I have an app that runs on Windows 7 using Microsoft's Layered Window http://msdn.microsoft.com/en-us/library/ms997507.aspx. This app is setup to have a 30% opacity, it's always on top, and it is transparent to events (ie: it forwards all events to windows underneath it). You can think of it as a "screen" you are looking at your desktop through. It is currently being used to be an omnipresent feedback layer for our users.
We've tried running the same app on Windows 8, and notice it works as expected in desktop mode, but nothing overlays the start menu and other metro apps.
Does anyone know if there is an equivalent always on top window mode that works across metro apps and the start menu in Windows 8?
Yes, it is possible. Please take a look at this page:
http://blogs.microsoft.co.il/blogs/pavely/archive/2012/05/16/windows-8-topmost-vs-topmost.aspx
Specifically the second post in the comments section:
The topmost window is also affected by the accessibility settings. If you want a window on top of Metro, you need it to declare accessibility. Here are the key points:
The application must demand uiAccess (app.manifest)
The application must assert “topmost” window positioning (either in Win32/SetWindowPos or WinForms/WPF’s Topmost property, programmatically or otherwise)
Without making changes to the group policy setting, it must be installed to some trusted location [C:\Windows, C:\Program Files, C:\Program Files (x86)].
If you want to be able to run it out of an arbitrary location, you must disable the security setting: “User Account Control: Only elevate UIAccess applications that are installed in secure locations”.
This is the same as setting HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures to 0
Said application cannot be run in the debugger
If it’s a .NET application:
The manifest must be embedded in a post-build step
The application must have “delayed signing” (meaning it cannot be ran from the built-in debugger, although you can build and attach – this is what Microsoft does)
The application must be signed with a trusted certificate.
Said trusted certificate must be installed to the Trusted Root Certificate Authority (this is important! It must not just simply installed)
Run the windows speech recognition. Its a top most window which floats over start menu, desktop etc. So its possible for sure. I am working on a touch simulator for Windows 8 and needed to implement this feature.
Here are the steps to achieve this:
http://www.pixytech.com/rajnish/2013/05/windows-8-topmost-window/
I am almost positive that you can't have any other app overlaying a Metro app. The new Metro environment is meant to run single, full-screen apps (or two, but only if snapped to the side). Further, allowing something to act as a man-in-the-middle is a bit dangerous, since they could capture all sorts of sensitive user data.
That being said, if you can set the "always on top" property of a window, it might stay put over the Start menu and various Metro apps. I know it works with Task Manager, but I have never tried with an arbitrary app. I do not know that it would work well for Metro apps, however, due to their events being different than old-timey winform apps. You'd have to see if your "screen" allows touch events to pass through.

Alternative to SendKeys that does NOT require an unlocked session

Situation:
A GUI app contains functionality (off a menu option) that produces a frequently updated image to a directory.
A logged-in, running instance of the app is the ONLY source for this image (functionality 'reliant' on display device). I have researched this to death - it is a sad fact.
The GUI application offers COM interfaces, but none that generate the image.
GUI code cannot be change in the least (big surprise).
Requirement:
These current images are needed by other processes at various times.
Obvious solution:
A process that creates an instance of the GUI app and uses SendKeys to manipulate the controls to produce the image.
Roadblocks (do I need to elaborate)
Aside from the flakiness of Sendkeys - assuming that Sendkeys WAS reliable....
Sendkeys can't work when console session is locked (locked is production requirement)
SendMessage API can't send key combinations like 'shift/letter' (required to invoke menu option).
Questions
Is there any other way to programatically interact with the app when the session is locked?
Can a windows service unlock/lock the sesion at predetermined times - long enough to allow an image generation to occur.
I know, I know, its crap. ANY high level ideas and MOST opinions are appreciated ;)
Virtual PC.
Lock the host, not the virtual machine.
But to actually answer your question: i don't think you can send keys to a locked computer. Why? What if there are multiple logged in sessions; which one would it send the keys to?

Request suspend on Vista but allow other applications to cancel

My application uses the Win32 SetSuspendState() API to trigger system suspend or hibernation when it has finished doing a lengthy task.
The API accepts a parameter "ForceCritical" which determines whether or not the system suspends immediately or whether it broadcasts PBT_APMQUERYSUSPEND first to allow other apps the chance to cancel the suspend. My app uses this to play nicely with other apps like Media Player, so it doesn't suspend if you're listening to music or something.
For some reason, starting with Vista, MS have changed things so this parameter is ignored so SetSuspendState immediately causes a suspend and other applications have no opportunity to stop it.
Does anyone know how I can get the desired "polite" behaviour back again on Vista?
MSDN says
To prevent the system from transitioning to a low-power state in Windows Vista, an application must call SetThreadExecutionState to inform the system that it is in use
I would guess that WMP does this, but older apps don't. You could probably emulate this by sending the WM_POWERBROADCAST:PBT_APMQUERYSUSPEND message to all top level windows and check their return values (Send the message with a timeout so a hung app does not hang your app)

Resources