远程桌面代码研究（之一：WIN7XP实现模拟发送CTRL+ALT+DEL）

1 首先判断是不是NT家族操作系统系统的版本信息保存在OSVERSIONINFO结构中

BOOL isWinNTFamily()
{
    OSVERSIONINFO versionInfo;
    versionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
    if(!GetVersionEx(&versionInfo))
    {
        return FALSE;
    }
    if(VER_PLATFORM_WIN32_NT != versionInfo.dwPlatformId)
    {
        return FALSE;
    }
    return TRUE;
}

BOOL isVistaOrLater()
{
    OSVERSIONINFO versionInfo;
    versionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
    if(!GetVersionEx(&versionInfo))
    {
        return FALSE;
    }
    if (6 > versionInfo.dwMajorVersion)
    {
        return FALSE;
    }
    return TRUE;
}

项目使用的是select desktop方法

BOOL selectDesktop(char *name)
{
    HDESK desktop;
    if (name)
    {
        desktop = getDesktop(name);
    }
    else
    {
        desktop = getInputDesktop();
    }
    if (NULL == desktop)
    {
        WriteErrorToLog("selectDesktop:selectDesktop: get desktop failed!");
        return FALSE;
    }

    BOOL ret = setDesktopToCurrentThread(desktop);
    closeDesktop(desktop);
    return ret;
}

其中，getDesktop如下

static HDESK getDesktop(char *name)
{
    return OpenDesktopA(name,0,FALSE,DESKTOP_CREATEMENU | DESKTOP_CREATEWINDOW |

DESKTOP_ENUMERATE
        | DESKTOP_HOOKCONTROL | DESKTOP_WRITEOBJECTS | DESKTOP_READOBJECTS |

DESKTOP_SWITCHDESKTOP
        | GENERIC_WRITE);
}

static BOOL setDesktopToCurrentThread(HDESK newDesktop)
{
    return SetThreadDesktop(newDesktop);
}

2 VISTA版本之前

HANDLE hThread=CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)

SimulateCtrlAltDelThreadFn,NULL,0,NULL)

static void WINAPI SimulateCtrlAltDelThreadFn()
{
    if(!selectDesktop("Winlogon"))
    {
        return;
    }

    HWND hWnd = FindWindow(_T("SAS window class"), _T("SAS window"));
    if(NULL == hWnd)
    {
        hWnd = HWND_BROADCAST;
    }

    PostMessage(hWnd, WM_HOTKEY, 0, MAKELONG(MOD_ALT | MOD_CONTROL, VK_DELETE));
}

3 VISTA版本之后
思路：
从system32文件加下的sas.dll厘面得到SendSAS接口
调用此接口sendSas(FALSE)

其中SendAS函数原形如下

VOID WINAPI SendSAS(
  _In_  BOOL AsUser
)

cihanshu

VOID WINAPI SendSAS(
  _In_  BOOL AsUser
)

为了调用SendSAS成功，此函数必然以服务方式运行或有uiAccess属性，如果不是以服务方式运行，那么得把User Account Control打开。
 调用

void runUnderVistaOrLater()
{
    HMODULE hModule = LoadLibrary(_T("Sas.dll"));
    if(NULL == hModule)
    {
        WriteErrorToLog("runUnderVistaOrLater:LoadLibrary failed!");
        return;
    }
    SendSas simSas = (SendSas)GetProcAddress(hModule,"SendSAS");
    if(0 == simSas)
    {
        WriteErrorToLog("runUnderVistaOrLater:SimulateSAS failed!");
        FreeLibrary(hModule);
        return;
    }
    simSas(FALSE);

    FreeLibrary(hModule);
}