利用未公开函数实现Shell操作监视
利用未公开函数实现Shell操作监视 wwwa.applevb.com
在Windows下有一个未公开函数SHChangeNotifyRegister可以吧你的窗口添加到系统的系统消息监视链中，该函数在Delphi
中的定义如下：
Function SHChangeNotifyRegister(hWnd,uFlags,dwEventID,uMSG,cItems:LongWord;
lpps:PIDLSTRUCT):integer;stdcall;external Shell32.dll index 2;
其中参数hWnd定义了监视系统操作的窗口得句柄，参数uFlags dwEventID定义监视操作参数，参数uMsg定义操作消息，参数cItems
定义附加参数，参数lpps指定一个PIDLSTRUCT结构，该结构指定监视的目录。
当函数调用成功之后，函数会返回一个监视操作句柄，同时系统就会将hWnd指定的窗口加入到操作监视链中，当有文件操作发生
时，系统会向hWnd发送uMsg指定的消息，我们只要在程序中加入该消息的处理函数就可以实现对系统操作的监视了。
如果要退出程序监视，就要调用另外一个未公开得函数SHChangeNotifyDeregister来取消程序监视。
下面是使用Delphi编写的具体程序实现范例，首先建立一个新的工程文件，然后在Form1中加入一个Button控件和一个Memo控件，
程序的代码如下：unit Unit1;
inte易做图ce
uses
Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,
StdCtrls,shlobj,Activex;const
SHCNE_RENAMEITEM = $1;
SHCNE_CREATE = $2;
SHCNE_DELETE = $4;
SHCNE_MKDIR = $8;
SHCNE_RMDIR = $10;
SHCNE_MEDIAINSERTED = $20;
SHCNE_MEDIAREMOVED = $40;
SHCNE_DRIVEREMOVED = $80;
SHCNE_DRIVEADD = $100;
SHCNE_NETSHARE = $200;
SHCNE_NETUNSHARE = $400;
SHCNE_ATTRIBUTES = $800;
SHCNE_UPDATEDIR = $1000;
SHCNE_UPDATEITEM = $2000;
SHCNE_SERVERDISCONNECT = $4000;
SHCNE_UPDATEIMAGE = $8000;
SHCNE_DRIVEADDGUI = $10000;
SHCNE_RENAMEFOLDER = $20000;
SHCNE_FREESPACE = $40000;
SHCNE_ASSOCCHANGED = $8000000;
SHCNE_DISKEVENTS = $2381F;
SHCNE_GLOBALEVENTS = $C0581E0;
SHCNE_ALLEVENTS = $7FFFFFFF;
SHCNE_INTERRUPT = $80000000;SHCNF_IDLIST = 0; // LPITEMIDLIST
SHCNF_PATHA = $1; // path name
SHCNF_PRINTERA = $2; // printer friendly name
SHCNF_DWORD = $3; // DWORD
SHCNF_PATHW = $5; // path name
SHCNF_PRINTERW = $6; // printer friendly name
SHCNF_TYPE = $FF;SHCNF_FLUSH = $1000;
SHCNF_FLUSHNOWAIT = $2000;
SHCNF_PATH = SHCNF_PATHW;
SHCNF_PRINTER = SHCNF_PRINTERW;WM_SHNOTIFY = $401;
NOERROR = 0;type
TForm1 = class(TForm)
Button1: TButton;
Memo1: TMemo;
procedure FormClose(Sender: TObject; var Action: TCloseAction);
procedure Button1Click(Sender: TObject);
procedure FormCreate(Sender: TObject);
private
{ Private declarations }
procedure WMShellReg(var Message:TMessage);message WM_SHNOTIFY;
public
{ Public declarations }
end;type PSHNOTIFYSTRUCT=^SHNOTIFYSTRUCT;
SHNOTIFYSTRUCT = record
dwItem1 : PItemIDList;
dwItem2 : PItemIDList;
end;Type PSHFileInfoByte=^SHFileInfoByte;
_SHFileInfoByte = record
hIcon :Integer;
iIcon :Integer;
dwAttributes : Integer;
szDisplayName : array [0..259] of char;
szTypeName : array [0..79] of char;
end;
SHFileInfoByte=_SHFileInfoByte;Type PIDLSTRUCT = ^IDLSTRUCT;
_IDLSTRUCT = record
pidl : PItemIDList;
bWatchSubFolders : Integer;
end;
IDLSTRUCT =_IDLSTRUCT;
function SHNotify_Register(hWnd : Integer) : Bool;
function SHNotify_UnRegister:Bool;
function SHEventName(strPath1,strPath2:string;lParam:Integer):string;Function SHChangeNotifyDeregister(hNotify:integer):integer;stdcall;
external Shell32.dll index 4;
Function SHChangeNotifyRegister(hWnd,uFlags,dwEventID,uMSG,cItems:LongWord;
lpps:PIDLSTRUCT):integer;stdcall;external Shell32.dll index 2;
Function SHGetFileInfoPidl(pidl : PItemIDList;
dwFileAttributes : Integer;
psfib : PSHFILEINFOBYTE;
cbFileInfo : Integer;
uFlags : Integer):Integer;stdcall;
external Shell32.dll name SHGetFileInfoA;var
Form1: TForm1;
m_hSHNotify:Integer;
m_pidlDesktop : PItemIDList;implementation
{$R *.DFM}
function SHEventName(strPath1,strPath2:string;lParam:Integer):string;
var
sEvent:String;
begin
case lParam of file://根据参数设置提示消息
SHCNE_RENAMEITEM: sEvent := 重命名文件+strPath1+为+strpath2;
SHCNE_CREATE: sEvent := 建立文件 文件名：+strPath1;
SHCNE_DELETE: sEvent := 删除文件 文件名：+strPath1;
SHCNE_MKDIR: sEvent := 新建目录 目录名：+strPath1;
SHCNE_RMDIR: sEvent := 删除目录 目录名：+strPath1;
SHCNE_MEDIAINSERTED: sEvent := strPath1+中插入可移动存储介质;
SHCNE_MEDIAREMOVED: sEvent := strPath1+中移去可移动存储介质+strPath1+ +strpath2;
SHCNE_DRIVEREMOVED: sEvent := 移去驱动器+strPath1;
SHCNE_DRIVEADD: sEvent := 添加驱动器+strPath1;
SHCNE_NETSHARE: sEvent := 改变目录+strPath1+的共享属性;SHCNE_ATTRIBUTES: sEvent := 改变文件目录属性 文件名+strPath1;
SHCNE_UPDATEDIR: sEvent := 更新目录+strPath1;
SHCNE_UPDATEITEM: sEvent := 更新文件 文件名：+strPath1;
SHCNE_SERVERDISCONNECT: sEvent := 断开与服务器的连接+strPath1+ +strpath2;
SHCNE_UPDATEIMAGE: sEvent := SHCNE_UPDATEIMAGE;
SHCNE_DRIVEADDGUI: sEvent := SHCNE_DRIVEADDGUI;
SHCNE_RENAMEFOLDER: sEvent := 重命名文件夹+strPath1+为+strpath2;
SHCNE_FREESPACE: sEvent := 磁盘空间大小改变;
SHCNE_ASSOCCHANGED: sEvent := 改变文件关联;
else
sEvent:=未知操作+IntToStr(lParam);
end;
Result:=sEvent;
end;function SHNotify_Register(hWnd : Integer) : Bool;
var
ps:PIDLSTRUCT;
begin
{$R-}
Result:=False;
If m_hSHNotify = 0 then begin
file://获取桌面文件夹的Pidl
if SHGetSpecialFolderLocation(0, CSIDL_DESKTOP,
m_pidlDesktop)<> NOERROR then
Form1.close;
if Boolean(m_pidlDesktop)
补充：软件开发 , Delphi ,
