Skip to content

Instantly share code, notes, and snippets.

@NSG650
Last active June 30, 2024 07:41
Show Gist options
  • Save NSG650/c06d419e2d2a39d36e0597f620bb0e3a to your computer and use it in GitHub Desktop.
Save NSG650/c06d419e2d2a39d36e0597f620bb0e3a to your computer and use it in GitHub Desktop.
Logs which processes have received window focus
#include <stdio.h>
#include <Windows.h>
VOID CALLBACK WinEventProcHook(HWINEVENTHOOK hWinEventHook, DWORD event, HWND hwnd,
LONG idObject, LONG idChild, DWORD idEventThread, DWORD dwmsEventTime) {
DWORD ProcessId = 0;
if (GetWindowThreadProcessId(hwnd, &ProcessId) != 0) {
HANDLE ProcessHandle = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, ProcessId);
if (ProcessHandle != (HANDLE)(-1)) {
char buffer[MAX_PATH] = {0};
GetProcessImageFileNameA(ProcessHandle, buffer, MAX_PATH);
printf("[%u]: %s received focus\n", dwmsEventTime, buffer);
CloseHandle(ProcessHandle);
}
}
}
INT main(VOID) {
CoInitialize(0);
printf("[*] Hello World!\n");
HWINEVENTHOOK HandleWinEventHook = SetWinEventHook(EVENT_OBJECT_FOCUS, EVENT_OBJECT_FOCUS, NULL,
WinEventProcHook, 0, 0, WINEVENT_OUTOFCONTEXT);
if (HandleWinEventHook == 0) {
printf("[!] Failed to setup WinEventHook!\n");
return 1;
}
MSG msg = {0};
while (1) {
GetMessage(&msg, NULL, 0, 0);
TranslateMessage(&msg);
DispatchMessage(&msg);
}
UnhookWinEvent(HandleWinEventHook);
CoUninitialize();
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment