Is there any way for a Windows application to get notified when another application reads from the clipboard? I would like to emphasize -- not when the clipboard content changes, but when any another application reads it.
Use Delayed Rendering. You'll receive a WM_RenderFormat when an application pastes the data into itself. (Update: But you don't know if any OTHER apps have pasted that same data. Once WM_RenderFormat has been satisfied, there are no further notifications if other apps paste that same data, using the same format. e.g. CF_TEXT).
Of course, this applies to ANY application, so you'll be notified when clipboard mangers, virtual machines, remote desktop, etc., sync the clipboard between workspaces.
See: http://msdn.microsoft.com/en-us/library/windows/desktop/ms649014(v=vs.85).aspx#_win32_Delayed_Rendering
Update: After clarification from the OP that he needs to know about clipboard reads when his app is neither the provider or consumer, then the answer for that situation is NO. It is not possible for a "neutral 3rd-party observer app" to know which specific apps have pasted data.
Related
I have a sandbox system redirecting file modifications by hooking Ntxxx file system APIs. An interesting thing is, if i move files in Notepad->File/Open dialog in my sandbox, e.g. from desktop\a.txt to desktop\b\a.txt, the a.txt file on real desktop just disappears, and it comes back after i refresh real desktop by pressing F5. actually there is no change in desktop folder at all, because all changes are directed. I know that most apps use API like ReadDirectoryChanges to monitor changes, but apparently explorer is doing something different. I tried tools like https://directorymonitor.com/, they did not observe any changes on desktop. I guess SHFileOperation internally interact with explorer somehow, but who knows details and how can i prevent this notification? It is really strange for users to see a file disappearing while it is actually still there.
windows calls windows_storage!SHChangeNotify instead of that one in shell32. Why does Windows have two copies of same API, are they different?
I am developing a solution to monitor security events on Windows.
Two of the events to monitor are:
an attachment from an email (Outlook) has been clicked to run or downloaded to the disk
a link from an email has been clicked
Does anyone have experience in how to achieving these two things?
There are at least two ways I can think of to do this.
Outlook Extension
The easiest is to write a script. The MailItem.BeforeAttachmentRead lets you see what the user is going to open/save, and even allows you to cancel it if you find it suspect. You can also use several other related event hooks to customize the experience (check the docs). No hardcore kernel-level programming is required.
Kernel Hook
You could also implement a generic file hook that runs in the background and reports activity from the Outlook executable, but this is probably more cumbersome than it needs to be. The Windows API allows you to monitor when files are created, but you wouldn't be able to see specifically when an attachment is previewed (as far as I could determine from the docs).
Either way, you can then deploy your package through a Group Policy Object so that it can be invisibly installed without the user's knowledge. Once installed, you can choose to log those attachments through the usual channels, such as an Event Log that can be viewed in the Event Viewer.
Situation:
A GUI app contains functionality (off a menu option) that produces a frequently updated image to a directory.
A logged-in, running instance of the app is the ONLY source for this image (functionality 'reliant' on display device). I have researched this to death - it is a sad fact.
The GUI application offers COM interfaces, but none that generate the image.
GUI code cannot be change in the least (big surprise).
Requirement:
These current images are needed by other processes at various times.
Obvious solution:
A process that creates an instance of the GUI app and uses SendKeys to manipulate the controls to produce the image.
Roadblocks (do I need to elaborate)
Aside from the flakiness of Sendkeys - assuming that Sendkeys WAS reliable....
Sendkeys can't work when console session is locked (locked is production requirement)
SendMessage API can't send key combinations like 'shift/letter' (required to invoke menu option).
Questions
Is there any other way to programatically interact with the app when the session is locked?
Can a windows service unlock/lock the sesion at predetermined times - long enough to allow an image generation to occur.
I know, I know, its crap. ANY high level ideas and MOST opinions are appreciated ;)
Virtual PC.
Lock the host, not the virtual machine.
But to actually answer your question: i don't think you can send keys to a locked computer. Why? What if there are multiple logged in sessions; which one would it send the keys to?
I have a code that triggers PASTING to any 3rd party application by sending ctrl+v (see below), but this does not seem to work with CITRIX. is there any other method to trigger ctrl+v than keyb simulation?
keybd_event(VK_CONTROL, Lo(MapVirtualKey(VK_CONTROL,0)), 0,0);
keybd_event(86, Lo(MapVirtualKey(86,0)), 0,0);
keybd_event(86, Lo(MapVirtualKey(86,0)), KEYEVENTF_KEYUP,0);
Maybe, you can send a WM_PASTE message to the application?
Ah, the nice problems with Citrix!
I would 1st check on the receiving application side that you actually have something in the clipboard. Try to paste manually there. If it's empty, it's not an automation/keyboard hook problem.
If the clipboard content is indeed available, I would then try different ways to communicate with the receiving application: sending windows messages (WM_PASTE, but also others in case of failure to see if any can go through), but also look if you can do DDE.
You can try PostKeyEx32
I Wrote a article in Portuguese, but you can read the code, it is simple.
http://www.cesarromero.com.br/simulando-keypress-com-postkeyex32/
You can send CTRL + Vm like this:
PostKeyEx32(Ord('V'), [ssCtrl], False);
I think the critical statement here is -- with CITRIX.
My experience with inter-communication with citrix applications is that many things which work fine on a normal desktop, fail when run in a citrix environment. I would first try to send a WM_PASTE message as Gamecat suggested, and if that fails you might want to make sure that your clients are running your application thru a citrix desktop, NOT by running the applications directly from a shortcut on their desktop. When a citrix application is launched from an external shortcut, it gets a different session than when it is launched from an internal shortcut on the citrix desktop.
I have an applescript studio application that I use for imaging hard drives. Right now it runs a shell script (diskutil list -plist) to get information about the drives attached to the computer, it then presents this information to the user, and the proper drive to image is selected.
Ideally I would like my application to be able to detect when new devices are plugged in, and prompt the user to image that drive.
I was thinking about running the shell script in a loop and comparing the results to detect if a new device is available, but that seems like that would waste a lot of CPU. Is there someway for applescript to listen to some sort of event and detect that a new device is available?
AppleScript (Studio) is not able to register to any system notification, notifications can only be accomplished in Objective-C.
By the way DiskArbitration.framework is much faster than diskutil.
An alternative could be a folder action or a launchd agent which observes /Volumes.
But it's quite circuitous to pass the information to the main application
Hope this helps