Is this do able in VC++? Or is there a better way.

FISH786

I currently have an application, that tracks activity for any changes in an external app. I am using windows enum to keep track of all instances of that application and open windows. In case if any user decides to have a multiple instances running. However I only get the active window first hence my process only goes after the active window, by the time it's done processing the user could have changed to the second window and I would miss any changes that have been made in the second window. What I would like to do, not even sure if it's do able or is it beyond my level of expertise, which practically is a bigginer. My application to be able to open a thread or something for every window thats open for the external app. Message back to my app probably using IPC, Post Window Message or some sort of communication to process the changes based on the window thats opened in the external app. In other words if 10 windows are open, have 10 different threads go after each window. Is this really how I should do it or is there a better way? Please could someone shed some light and tell me if there is a better way to do it. Thanks a Million.

Garth J Lancaster

sounds interesting, but what sort of monitoring are you doing of this 'external app' and why ? it sounds dangerously close to writing 'spy software' - dont get me wrong, you may have a valid reason, but if someone came to me with a request like that I'd sure as heck be asking them to validate why first and then what. Its not 100% clear what changes "any changes in an external app" you're looking for - depending on what you're looking for you could use API hooking, for example, to track when users open files for example - you could look at the Microsoft 'detours' library for what I mean. Its also not hard to track lists of processes, windows etc and relate them - so I think you need to supply more details Ultimately, and Im guessing you dont, but having the source and injecting log/trace points into it would be easier than watching it from the outside in .. some links you may like to see (in addidtion to looking at MS 'Detours') :- Detecting Windows NT/2K process execution[^] API hooking revealed[^] (for example) 'g'

FISH786

Yeah, I hear your valid reason for this. The vendor has decided not to support the application. I have been against using detours or hooking as a long term solution for the sher reason of acting as a spy. The other main reason is, we have different vendors for different applications. Not sure if you can even find out, but if it is trackable that a hook is running, they could end up terminating their services in an anticipation of the hook is hooking into their system.

Garth J Lancaster

FISH786 wrote:

Not sure if you can even find out, but if it is trackable that a hook is running, they could end up terminating their services in an anticipation of the hook is hooking into their system.

ok, surely though, if "The vendor has decided not to support the application " ... that gives you leeway to 'do what you must' sounds like a yuckky situation, sorry I cant help more 'g'

FISH786

However, am I right, a system that has been hooked is dectactable in knowing that a hook is running? I don't want to have problems with the other vendors? Could you at least answer this for me?

Garth J Lancaster

I'd say no, a program wouldnt necessarily know its being hooked - the idea of hooking is to transparently capture (& redirect) API calls for example... so to inject a hook and get it wrong would crash/corrupt the in-memory copy of your program, which is not what you want .. hence the ability for hooks to be considered malicious 'g'

FISH786

Last question, If it's not detactable, if you were in my shoe, would you use the hook over a short period of time and get it over with without worrying about other vendors, or use the threading option and be safe with other vendors? Which option would you choose, I can only see the hook being installed for a week or tops a month?

David Crow

FISH786 wrote:

I currently have an application, that tracks activity for any changes in an external app.

How are you changing it? What changes are being made?

"Old age is like a bank account. You withdraw later in life what you have deposited along the way." - Unknown

"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons

FISH786

Hello David, It's just normal user dataentry, and trying to get screen shots of what the user does in that application.