Hello
       I am a newbie programmer , i have just completed the iczlion's
tutorials and find it great. But one of the things i miss is that how to
create a tsr like program in win32. the program which doesnt have any
interface but sits in the background monitoring for a trigger. for example i
would like to code a program which runs in the background and prevents
execution of file sol.exe.

    i only know how to program GUI's in win32.
    i think it may be done by threads. can anyone give me an idea how to
accomplish this.
or i can use a simple while loop in the whole program which checks for
process and terminates immediately sol.exe.
i think that would eat up whole lot of system resources.


--
Madhur
India

Any fool can write code that a computer can understand. Good programmers
write code that humans can understand.

In comp.lang.asm.x86 Tim Robinson <tim.at.gaat.freeserve.co.uk@invalid.com> wrote:
....

: BTW: Win32 doesn't have TSRs (when a Windows program Terminates, it
: Terminates -- it can't Stay Resident), but there's nothing stopping you from
: writing an invisible program which doesn't display any user interface.

 Hmmm -- then what about DLL programs, which do stay resident?

: -- 
: Tim Robinson (MVP, Windows SDK)
: http://www.themobius.co.uk/

:>
:>
:>

Read up Jeffrey Richter's Win32 programming book and read his section on 
hooking DLL calls. He has this neato method involving using the message 
hook api, which happens to be typically used by keyloggers and is also 
typically used by those windows SPY programs, like the one that comes 
with MS VC++. Iczelion's site also has a cool tutorial involving message 
hooks.

Heck, Jeffrey Richter also describes other DLL call interception 
methods. You'll want to hook WinExec, CreateProcess, CreateProcessEx and 
some others I may have forgotten.

This guy also has some awesome low level stuff. One of his articles is a 
very very comprehensive article on API interception:
http://www.internals.com/

Madhur wrote:
> Hello
>        I am a newbie programmer , i have just completed the iczlion's
> tutorials and find it great. But one of the things i miss is that how to
> create a tsr like program in win32. the program which doesnt have any
> interface but sits in the background monitoring for a trigger. for example i
> would like to code a program which runs in the background and prevents
> execution of file sol.exe.
> 
>     i only know how to program GUI's in win32.
>     i think it may be done by threads. can anyone give me an idea how to
> accomplish this.
> or i can use a simple while loop in the whole program which checks for
> process and terminates immediately sol.exe.
> i think that would eat up whole lot of system resources.
> 
> 
> --
> Madhur
> India
> 
> Any fool can write code that a computer can understand. Good programmers
> write code that humans can understand.
> 
> 
> 
> 
> 

Madhur wrote:

>Hello
>       I am a newbie programmer , i have just completed the iczlion's
>tutorials and find it great. But one of the things i miss is that how to
>create a tsr like program in win32. the program which doesnt have any
>interface but sits in the background monitoring for a trigger. for example i
>would like to code a program which runs in the background and prevents
>execution of file sol.exe.
>
>    i only know how to program GUI's in win32.
>    i think it may be done by threads. can anyone give me an idea how to
>accomplish this.
>or i can use a simple while loop in the whole program which checks for
>process and terminates immediately sol.exe.
>i think that would eat up whole lot of system resources.
>

Your "TSRs" are called "Hooks" in Windows (Google ->
"programming+hooks"). Should be described in the API
documentation...

<http://www.experts-exchange.com/Programming/Programming_Platforms/Win_Prog/Q_10010614.html>


Greetings from Augsburg

Bernhard Schornak

"Scott J. McCaughrin" <sjmccaug@bluestem.prairienet.org> wrote in message
news:be08be$o7d$1@wildfire.prairienet.org...
> : BTW: Win32 doesn't have TSRs (when a Windows program Terminates, it
> : Terminates -- it can't Stay Resident), but there's nothing stopping you
from
> : writing an invisible program which doesn't display any user interface.
>
>  Hmmm -- then what about DLL programs, which do stay resident?


There's no such thing as a DLL program. DLLs get loaded inside a process and
are unloaded when that process exits. There's no analogue in Win32 to a DOS
TSR, which hands back control to COMMAND.COM even though it's still loaded
into memory. You could say that all Windows programs are TSRs because you
can still interact with other program even when they're loaded.

-- 
Tim Robinson (MVP, Windows SDK)
http://www.themobius.co.uk/

> Your "TSRs" are called "Hooks" in Windows. Should be described in
> the API documentation...

http://tinyurl.com/fx95

Tim Robinson wrote:
> The short answer is: you can't.

Yes you can. Use hooks.


-Andre


  You can prevent users from running specified
> applications from an icon in Explorer, but it would be quite difficult to
> completely prevent the computer from running a certain executable.
> 
> On the other hand, you could write a program which sat in the background and
> periodically checked whether a program called SOL.EXE was running, and, if
> so, attempted to exit it. The key word here, however, is "attempt".
> 
> BTW: Win32 doesn't have TSRs (when a Windows program Terminates, it
> Terminates -- it can't Stay Resident), but there's nothing stopping you from
> writing an invisible program which doesn't display any user interface.
> 

"Andre" <food_crazy@hotmail.com> wrote in message
news:3F042C44.5090900@hotmail.com...
> > The short answer is: you can't.
>
> Yes you can. Use hooks.

And hook what? There's nothing in SetWindowsHook[Ex] that will tell you when
something is calling CreateProcess.

-- 
Tim Robinson (MVP, Windows SDK)
http://www.themobius.co.uk/

"Dufflepod" <dufflepod@hotmail.com> wrote in message
news:2n09gv01bt88m89emd0h3qh8lbsft9l2ub@4ax.com...
> >The short answer is: you can't.
>
> Why not a device driver, either new Win32 style or old VxD style?
> They can register for notification messages on program launch, file
> open, whatever.
>
> Or a Win32 service with event notification?

That would be the long answer :).

-- 
Tim Robinson (MVP, Windows SDK)
http://www.themobius.co.uk/

Top posting makes it difficult to reply properly, Al.

"Al Leitch" <opcodeac@3*&hotmail.com> wrote in message
news:be1ssj$62f$1@slb6.atl.mindspring.net...
> If you're hard core and you're willing to be less practical, you could
> always patch up kernel32.dll so that when the DLL is loaded, your code
> first runs, saves all the entries (pointers) in the Export Address Table
> for the APIs you wanna intercept and replaces those entries with
> pointers to your own intercepting routines. Then whenever somebody tries
> to call those API's, your code runs, does whatever it wants and then
> calls the original kernel32.dll code by using the saved pointer.

>
> Madhur wrote:
> > Hello
> >        I am a newbie programmer ,
=== snipped

Also see http://research.microsoft.com/sn/detours/ for pre-written support
code & http://www.internals.com which also has a bunch of links on how to do
this properly without getting the equivalent of first degree programming
burns. Al's advice has several missing steps. My advice to the original
poster Madhur; get some experience writing straightforward apps first. Then
progress onto the difficult stuff. This is not a good place to start.

-- 
Regards
Alex McDonald

My bad...

Well, I was being very brief and summarizing. There's quite a bit to the 
process, like knowing the PE file format, knowing how DLL's work, etc.

Alex McDonald wrote:
> Top posting makes it difficult to reply properly, Al.
> 
> Also see http://research.microsoft.com/sn/detours/ for pre-written support
> code & http://www.internals.com which also has a bunch of links on how to do
> this properly without getting the equivalent of first degree programming
> burns. Al's advice has several missing steps. My advice to the original
> poster Madhur; get some experience writing straightforward apps first. Then
> progress onto the difficult stuff. This is not a good place to start.
> 

"Madhur" <uja_madhur@vsnl.net> wrote:
> Hello
>        I am a newbie programmer , i have just completed the iczlion's
> tutorials and find it great. But one of the things i miss is that how to
> create a tsr like program in win32. the program which doesnt have any
> interface but sits in the background monitoring for a trigger. for example
i
> would like to code a program which runs in the background and prevents
> execution of file sol.exe.

Not what you had in mind, but when your program starts:
ren  c:\...\sol.exe  c:\...\sol.exe.RenamedBySolKiller.txt
and rename it back when your program terminates.

This could cause problems if windows crashes, but we all know that windows
doesn't crash.  It's just a bad rumour started by those horrible linux users
;P

regards,
-Brent
doomsday AT optusnet DOT com DOT au

"Tim Robinson" <tim.at.gaat.freeserve.co.uk@invalid.com> wrote in message news:<bdvhda$11di9o$1@ID-103400.news.dfncis.de>...
> The short answer is: you can't. <snip>

Rubbish! How do you think Norton Internet Security works? How do you
think *anything* in the system tray works? To the OP: Get on codeguru
and search for system tray. You'll find a ton of stuff you can crib.

Al

Norton Internet security definitely makes use of VxD's or WDM (Windows 
Driver Model, the newer device driver format). It would have to in order 
to pull off its low level stuff.

Al Newton wrote:
> "Tim Robinson" <tim.at.gaat.freeserve.co.uk@invalid.com> wrote in message news:<bdvhda$11di9o$1@ID-103400.news.dfncis.de>...
> 
>>The short answer is: you can't. <snip>
> 
> 
> Rubbish! How do you think Norton Internet Security works? How do you
> think *anything* in the system tray works? To the OP: Get on codeguru
> and search for system tray. You'll find a ton of stuff you can crib.
> 
> Al
> 

"Al Newton" <alnewton1@hotmail.com> wrote in message
news:4e1067aa.0307050906.4e211414@posting.google.com...
> > The short answer is: you can't. <snip>
>
> Rubbish! How do you think Norton Internet Security works?

Hey! I never said what the long answer was.

The (presumed) short question is: "what function can I use to stop people
running certain processes?" The (less) short answer is, "you can stop
Explorer from running certain applications, but there's no easy way of doing
this"

The long question is: "how can I use VxDs/NT drivers/IAT patching to stop
certain processes from running?"

> How do you
> think *anything* in the system tray works? To the OP: Get on codeguru
> and search for system tray. You'll find a ton of stuff you can crib.

It works via Shell_NotifyIcon, but that's got nothing to do with stopping
processes from running.

-- 
Tim Robinson (MVP, Windows SDK)
http://www.themobius.co.uk/

hi Tim:

> The short answer is: you can't. You can prevent users from running
specified
> applications from an icon in Explorer, but it would be quite difficult to
> completely prevent the computer from running a certain executable.

hmm... what is stopping Madhur from renaming the executable, moving it to
another directory, and giving it a hidden attribute? for more security he
could encrypt it using PKZIP. in the original directory he can replace the
file with his own executable named "sol.exe" that, when run, pops up a
messagebox that reads: "it told you not to run this file, you bastard!"...
or he could get his webcam to photograph the culprit and sent it to his
e-mail addy... or using a port he could have a trap door beneath their chair
open to a 100 foot drop into a vat of hot acid... an mp3 of Queen's "another
one bites the dust" would start playing for the ride down. now *that's*
security!

regards,
phil

"sinewave" <none@nowhere.com> wrote in message
news:vgmauah7cgtvbb@corp.supernews.com...
> hi Tim:
>
> > The short answer is: you can't. You can prevent users from running
> specified
> > applications from an icon in Explorer, but it would be quite difficult
to
> > completely prevent the computer from running a certain executable.
>
> hmm... what is stopping Madhur from renaming the executable, moving it to
> another directory, and giving it a hidden attribute? for more security he
> could encrypt it using PKZIP. in the original directory he can replace the
> file with his own executable named "sol.exe" that, when run, pops up a
> messagebox that reads: "it told you not to run this file, you bastard!"...
> or he could get his webcam to photograph the culprit and sent it to his
> e-mail addy... or using a port he could have a trap door beneath their
chair
> open to a 100 foot drop into a vat of hot acid... an mp3 of Queen's
"another
> one bites the dust" would start playing for the ride down. now *that's*
> security!

This is not alt.... legal   but i would say that wouldn't be legal actions.
;)

- Sten

"sinewave" wrote in message...
> hi Tim:
>
> > The short answer is: you can't. You can prevent users from running
> specified
> > applications from an icon in Explorer, but it would be quite difficult
to
> > completely prevent the computer from running a certain executable.
>
Umm, Group Policy on Win2K/XP/2K3 allows this to occur (ie stop certain
executables from being run). You just have to dig deep enough to find it...
Alternatively, use file permissions of NTFS... Simple "deny" read-execute
access to the files...

Chewy509...

Errmmmm, I didn't write that.

Jakor wrote:
> Al Leitch <opcodeac@3*&hotmail.com> wrote:
>  > Not what you had in mind, but when your program starts:
>  > ren  c:\...\sol.exe  c:\...\sol.exe.RenamedBySolKiller.txt
>  > and rename it back when your program terminates.
>  > 
> Well, if he wanted to do that, and he *knows* about tsr's. He must
> know assembly beyond ICZTUTES and then he could look up the aaoc and
> get the tsr info. or he could write an addin for sol.exe........
> 
> but really, his point was he wanted a tsr replacement. not kill sol
> cause then he could just del sol.exe to keep it from running. but for
> his sake vxd's and tsr's are the same *ENOUGH* to do what he wants,
> and they are about the same level of programming skill to look into.
> 
> Hope that helps (and i just had to pick on you cause you use linux ;)
> )
> Jakor
> 

> Errmmmm, I didn't write that.

LOL... you have a point Al.

regards,
phil

Scott J. McCaughrin wrote:
> Tim Robinson wrote:
> : BTW: Win32 doesn't have TSRs (when a Windows program Terminates,
it
> : Terminates -- it can't Stay Resident), but there's nothing
stopping you from
> : writing an invisible program which doesn't display any user
interface.
>
>  Hmmm -- then what about DLL programs, which do stay resident?

Actually, they _don't_ stay resident...well, logically they
don't...even if physically they do...ummm...

That is, when a program loads, it's DLLs are loaded with it...when the
program terminates, the DLLs are _always_ unloaded...but WIN32 does
try to share DLLs between processes when possible, to save on memory
usage (i.e. only one copy of KERNEL32.DLL need be loaded and then this
DLL is merely mapped to each process's address space as if it was a
separate DLL for each process...the sharing being done
"transparently", as, no doubt, MS would like to term it :)...

So, in fact, were _every_ process that used KERNEL32.DLL to terminate,
then KERNEL32.DLL would NOT "stay resident"...it would be unloaded
with the last EXE program that was using it...

In practice, of course, _every_ process uses KERNEL32.DLL in some way
(you need it in order to terminate via "ExitProcess", after all
:)...and then the Windows desktop will be running programs that'll be
using the main system DLLs like USER32.DLL and GDI32.DLL, anyway...

So, yes, in practice, if you look at a list of DLLs then these DLLs
don't disappear when processes terminate...but they aren't logically
"staying resident"...they are being "unloaded" when the process
terminates...but as DLLs can be shared between processes, "unloading"
is a bit like "unlinking" a file on UNIX to "logically" delete the
file...the file won't be deleted until all links are unlinked...well,
similarly, the DLL won't be taken out of memory until all processes
terminate (which, in fact, never happens right up until "shutdown"
:)...

Tim's absolutely right that there simply aren't TSRs on WIN32...but,
in a sense, this is so because they simply aren't needed...an
"invisible" program does effectively the same job as a TSR...

Note that DOS only employs TSR programs because it's a
_single-tasking_ OS...Windows doesn't need TSRs because it's
multi-tasking and there's logically absolutely no need for them...if
you like, all programs are TSRs under a multi-tasking OS (or none of
them are...it's all a matter of perspective :)...

As Tim notes, DLLs aren't "programs", really...they are, as their name
suggests, libraries which are dynamically linked to...an EXE is given
its own address space and DLLs are just loaded into that address space
as needed...the "program" is the EXE...the DLL is merely an
"extension" to the program - or process - that's resident in a
separate file for "modularity" reasons...

Beth :)

Al Newton wrote:
> Rubbish! How do you think Norton Internet Security works?

It doesn't terminate processes, it merely denies them their "open
socket" requests so that they can't access the internet without
permission...this is presumably done with a hook or notification...

> How do you think *anything* in the system tray works?

These aren't TSRs; They are ordinary programs that simply interface
with the taskbar (which is just an "application desktop toolbar" that
the shell itself creates) using notifications and callbacks...

> To the OP: Get on codeguru
> and search for system tray. You'll find a ton of stuff you can crib.

Well, agreed; If you want to create a system tray application then
that's the thing to be doing...but it doesn't make the program a
"TSR"...such a thing doesn't exist under WIN32 at all...

Anyway, if you want to stop SOL.EXE from ever running, wouldn't it be
easier to just delete that file...or, at least, rename it and replace
it with a "harmless" SOL.EXE that does nothing, if some program is
insisting on trying to interface with it? Just create a SOL.EXE
"replacement" that's entirely "harmless" :)

Beth :)

hi Beth:

> Ah! Someone else who takes the more pragmatic approach...

:D

> So, remember, if your HAL 9000 is playing up then, just like Dave

love that movie, but my version would have been different...

*HAL9000 bluescreens, introducing ex-lax into Daves happy meal*
*Dave drops his plastic fork, making a mad dash for the toilet*

Dave Bowman: "Open the bathroom bay door Hal!"
HAL9000:     "I'm sorry Dave, I can't do that"

2001: A Memory Leak Odyssey, coming to a Windows box near you...

regards,
phil

"Jakor" <jakorsf@yahoo.com> wrote in message
news:1eeb959d.0307101443.f5c5581@posting.google.com...
> Al Leitch <opcodeac@3*&hotmail.com> wrote:

As he pointed out, Al didn't write what you quoted.

>  > Not what you had in mind, but when your program starts:
>  > ren  c:\...\sol.exe  c:\...\sol.exe.RenamedBySolKiller.txt
>  > and rename it back when your program terminates.
>  >
> Well, if he wanted to do that, and he *knows* about tsr's. He must
> know assembly beyond ICZTUTES and then he could look up the aaoc and
> get the tsr info. or he could write an addin for sol.exe........
>
> but really, his point was he wanted a tsr replacement. not kill sol
> cause then he could just del sol.exe to keep it from running. but for
> his sake vxd's and tsr's are the same *ENOUGH* to do what he wants,
> and they are about the same level of programming skill to look into.

Brent's rules for computer use #1: Achieve the task employing the simplest,
viable method possible.
In this case I wouln't make the effort to: write, debug, etc. a VXD when a
4-5 line batch file will achieve the same goal.

That aside, I agree that TSRs and VXDs are of similar programming
complexity, and think they also both share a particular potential for bad
side-effects if they're badly written.  So, I couldn't recomend either to
someone who doesn't have a firm grasp of the environment in which their code
will operate.  Asking for a "TSR in [a multi-tasking OS]" leads me to
believe that the OP didn't have the requisite understanding of "how windows
programs work".

Without knowing what OP wants to achieve, I'm leaning towards the opinion
that a VXD is also probably overkill.  Just to "sit in the background", all
_any_ windows program has to do is not terminate, and if one really doesn't
want the program to appear in the task list, it's easy enough to use to tell
windows that your program is a 'service'.

regards,
-Brent
doomsday AT optusnet DOT com DOT au

Until you migrate to NT, then the technique that makes your program a 
service under 9x won't work here. What's the technique on NT by the way?

Brent wrote:
> "Jakor" <jakorsf@yahoo.com> wrote in message
> news:1eeb959d.0307101443.f5c5581@posting.google.com...
> 
>>Al Leitch <opcodeac@3*&hotmail.com> wrote:
> 
> 
> As he pointed out, Al didn't write what you quoted.
> 
> 
>> > Not what you had in mind, but when your program starts:
>> > ren  c:\...\sol.exe  c:\...\sol.exe.RenamedBySolKiller.txt
>> > and rename it back when your program terminates.
>> >
>>Well, if he wanted to do that, and he *knows* about tsr's. He must
>>know assembly beyond ICZTUTES and then he could look up the aaoc and
>>get the tsr info. or he could write an addin for sol.exe........
>>
>>but really, his point was he wanted a tsr replacement. not kill sol
>>cause then he could just del sol.exe to keep it from running. but for
>>his sake vxd's and tsr's are the same *ENOUGH* to do what he wants,
>>and they are about the same level of programming skill to look into.
> 
> 
> Brent's rules for computer use #1: Achieve the task employing the simplest,
> viable method possible.
> In this case I wouln't make the effort to: write, debug, etc. a VXD when a
> 4-5 line batch file will achieve the same goal.
> 
> That aside, I agree that TSRs and VXDs are of similar programming
> complexity, and think they also both share a particular potential for bad
> side-effects if they're badly written.  So, I couldn't recomend either to
> someone who doesn't have a firm grasp of the environment in which their code
> will operate.  Asking for a "TSR in [a multi-tasking OS]" leads me to
> believe that the OP didn't have the requisite understanding of "how windows
> programs work".
> 
> Without knowing what OP wants to achieve, I'm leaning towards the opinion
> that a VXD is also probably overkill.  Just to "sit in the background", all
> _any_ windows program has to do is not terminate, and if one really doesn't
> want the program to appear in the task list, it's easy enough to use to tell
> windows that your program is a 'service'.
> 
> regards,
> -Brent
> doomsday AT optusnet DOT com DOT au
> 
> 
> 

My bad! I was real tired when I wrote that sentence. I meant to say 
"once you migrate to NT"

Al Leitch wrote:
> Until you migrate to NT, then the technique that makes your program a 
> service under 9x won't work here. What's the technique on NT by the way?
> 
> Brent wrote:
> 
>> "Jakor" <jakorsf@yahoo.com> wrote in message
>

Well, CreateServices() API is a good point to start
investigating REAL Services.

-Sten
"Al Leitch" <opcodeac@3*&hotmail.com> wrote in message
news:bes8oa$ic7$1@slb3.atl.mindspring.net...
> Until you migrate to NT, then the technique that makes your program a
> service under 9x won't work here. What's the technique on NT by the way?
>
> Brent wrote:
> > "Jakor" <jakorsf@yahoo.com> wrote in message
> > news:1eeb959d.0307101443.f5c5581@posting.google.com...
> >
> >>Al Leitch <opcodeac@3*&hotmail.com> wrote:
> >
> >
> > As he pointed out, Al didn't write what you quoted.
> >
> >
> >> > Not what you had in mind, but when your program starts:
> >> > ren  c:\...\sol.exe  c:\...\sol.exe.RenamedBySolKiller.txt
> >> > and rename it back when your program terminates.
> >> >
> >>Well, if he wanted to do that, and he *knows* about tsr's. He must
> >>know assembly beyond ICZTUTES and then he could look up the aaoc and
> >>get the tsr info. or he could write an addin for sol.exe........
> >>
> >>but really, his point was he wanted a tsr replacement. not kill sol
> >>cause then he could just del sol.exe to keep it from running. but for
> >>his sake vxd's and tsr's are the same *ENOUGH* to do what he wants,
> >>and they are about the same level of programming skill to look into.
> >
> >
> > Brent's rules for computer use #1: Achieve the task employing the
simplest,
> > viable method possible.
> > In this case I wouln't make the effort to: write, debug, etc. a VXD when
a
> > 4-5 line batch file will achieve the same goal.
> >
> > That aside, I agree that TSRs and VXDs are of similar programming
> > complexity, and think they also both share a particular potential for
bad
> > side-effects if they're badly written.  So, I couldn't recomend either
to
> > someone who doesn't have a firm grasp of the environment in which their
code
> > will operate.  Asking for a "TSR in [a multi-tasking OS]" leads me to
> > believe that the OP didn't have the requisite understanding of "how
windows
> > programs work".
> >
> > Without knowing what OP wants to achieve, I'm leaning towards the
opinion
> > that a VXD is also probably overkill.  Just to "sit in the background",
all
> > _any_ windows program has to do is not terminate, and if one really
doesn't
> > want the program to appear in the task list, it's easy enough to use to
tell
> > windows that your program is a 'service'.
> >
> > regards,
> > -Brent
> > doomsday AT optusnet DOT com DOT au
> >
> >
> >
>
>