Hi Guys,
I just joined the forum. I have a pretty strong VB background, but I have
played around with C++ many times. I recently started learning Winlogon and
the Windows logon model and how to modify/customize GINA and the logon
screen. Since this is my first time doing this, I found some tutorials and
examples on other forums for help, but they were very poorly commented and
not at all explained. I understand that a DLL file needs to be created,
which must be copied to %system32% along with its .exp file. And then
information needs to be added to the registry to point to these files. From
these examples, I’ve put together however much I could and managed to
compile the files error-free.
The only thing wrong with my application is that it doesn’t do anything. 
The text file does not get created nor do I get a message box as should
happen. Hopefully there a few people in here that know how Winlogon works.
I’ll post my reg file, my cpp code, and the header file. ANY help at all
would be greated appreciated! Like I said, I’m coming from a VB background,
I made some simple errors, please let me know. Thanks in advance and my
apologies in advance if this post does not belong in this forum.
In my EXPORTS, I have the following:
; newNotif.def : Declares the module parameters for the DLL.
LIBRARY “newNotif”
DESCRIPTION ‘newNotif Windows Dynamic Link Library’
EXPORTS
; Explicit exports can go here
StartProcessAtWinLogon
StopProcessAtWinLogoff
REG FILE:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\newNotif]
“Asynchronous”=dword:00000000
“Impersonate”=dword:00000000
“DllName”=hex(2):6e,00,65,00,77,00,4e,00,6f,00,74,00,69,00,
66,00,2e,00,64,00,\
6c,00,6c,00,00,00
“Logon”=“StartProcessAtWinLogon”
“Logoff”=“StopProcessAtWinLogoff”
CPP FILE:
// newNotif.cpp : Defines the initialization routines for the DLL.
//
#include <windows.h>
#include <winwlx.h>
#include “stdafx.h”
#include “newNotif.h”
#ifdef DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = FILE ;
#endif
typedef DWORD(* PFNMSGECALLBACK )(BOOL bVerbose, LPWSTR lpMessage);
typedef struct WLX_NOTIFICATION_INFO { ULONG Size; ULONG Flags; PWSTR
UserName; PWSTR Domain; PWSTR WindowStation; HANDLE hToken; HDESK hDesktop;
PFNMSGECALLBACK pStatusCallback;
} WLX_NOTIFICATION_INFO, *PWLX_NOTIFICATION_INFO;
/////////////////////////////////////////////////////////////////////////////
// CNewNotifApp
BEGIN_MESSAGE_MAP(CNewNotifApp, CWinApp)
//{{AFX_MSG_MAP(CNewNotifApp)
// NOTE - the ClassWizard will add and remove mapping macros here.
// DO NOT EDIT what you see in these blocks of generated code!
//}}AFX_MSG_MAP
END_MESSAGE_MAP()
/////////////////////////////////////////////////////////////////////////////
// CNewNotifApp construction
CNewNotifApp::CNewNotifApp()
{
// TODO: add construction code here,
// Place all significant initialization in InitInstance
}
/////////////////////////////////////////////////////////////////////////////
// The one and only CNewNotifApp object
CNewNotifApp theApp;
PROCESS_INFORMATION g_pi;
TCHAR g_szPath[] = TEXT(“C:\Windows\Notepad.exe”);
//This function safely terminates a process, allowing
//it to do cleanup (ie. DLL detach)
//It can be found at the Windows Developer’s Journal
//Entrance function for the DLL
BOOL WINAPI LibMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
switch (dwReason)
{
case DLL_PROCESS_ATTACH:
{
DisableThreadLibraryCalls (hInstance);
}
break;
}
return TRUE;
}
//Event handler for the Winlogon Logon event
VOID APIENTRY StartProcessAtWinLogon (PWLX_NOTIFICATION_INFO pInfo)
{
TCHAR szText[MAX_PATH];
STARTUPINFO si;
si.cb = sizeof(STARTUPINFO);
si.lpReserved = NULL;
si.lpTitle = NULL;
si.lpDesktop = TEXT(“WinSta0\Default”);
si.dwX = si.dwY = si.dwXSize = si.dwYSize = 0L;
si.dwFlags = 0;;
si.wShowWindow = SW_SHOW;
si.lpReserved2 = NULL;
si.cbReserved2 = 0;
DWORD dwWritten;
HANDLE hFile = CreateFile(TEXT(“c:\TSP.txt”), GENERIC_ALL, NULL, NULL,
OPEN_ALWAYS, NULL, NULL);
strcpy(szText, TEXT(“StartProcessAtWinLogon \r\n”));
WriteFile(hFile, szText, strlen(szText), &dwWritten, NULL);
CloseHandle(hFile);
CreateProcess(NULL, g_szPath, NULL, NULL, FALSE, CREATE_NEW_CONSOLE,
NULL, NULL, &si, &g_pi);
MessageBox(NULL, “Winlogon Test”, “Winlogon Test”, MB_OK);
}
//Event handler for the Winlogon Logoff event.
VOID APIENTRY StopProcessAtWinLogoff (PWLX_NOTIFICATION_INFO pInfo)
{
//terminates the process
// **************** SafeTerminateProcess(g_pi.hProcess , 0xDEADBEEF);
}
//other event handlers
VOID APIENTRY YOUR_EVENT_HANDLERS (PWLX_NOTIFICATION_INFO pInfo)
{
//code
}
// Here is the event handler for the Winlogon Logon event.
VOID WLEventLogon (PWLX_NOTIFICATION_INFO pInfo)
{
// Print the name of the handler to debug output.
// You can replace this with more useful functionality.
OutputDebugString (TEXT(“NOTIFY: Entering WLEventLogon.\r\n”));
}
// Here is the event handler for the Winlogon Logoff event.
VOID WLEventLogoff (PWLX_NOTIFICATION_INFO pInfo)
{
// Print the name of the handler to debug output.
// You can replace this with more useful functionality.
OutputDebugString (TEXT(“NOTIFY: Entering WLEventLogff.\r\n”));
}
HEADER FILE
// newNotif.h : main header file for the NEWNOTIF DLL
//
#if !defined(AFX_NEWNOTIF_H CEECF57A_5EFB_4B19_A60F_E
05203D4E73C INCLUDED)
#define AFX_NEWNOTIF_H CEECF57A_5EFB_4B19_A60F_E05203D4E7 3C INCLUDED
#if _MSC_VER > 1000
#pragma once
#endif // MSC_VER > 1000
#ifndef AFXWIN_H
#error include ‘stdafx.h’ before including this file for PCH
#endif
#include <windows.h>
#include <winwlx.h>
#include “resource.h” // main symbols
/////////////////////////////////////////////////////////////////////////////
// CNewNotifApp
// See newNotif.cpp for the implementation of this class
//
class CNewNotifApp : public CWinApp
{
public:
CNewNotifApp();
// Overrides
// ClassWizard generated virtual function overrides
//{{AFX_VIRTUAL(CNewNotifApp)
//}}AFX_VIRTUAL
//{{AFX_MSG(CNewNotifApp)
// NOTE - the ClassWizard will add and remove member functions here.
// DO NOT EDIT what you see in these blocks of generated code !
//}}AFX_MSG
DECLARE_MESSAGE_MAP()
};
/////////////////////////////////////////////////////////////////////////////
//{{AFX_INSERT_LOCATION}}
// Microsoft Visual C++ will insert additional declarations immediately
before the previous line.
#endif // !defined(AFX_NEWNOTIF_H CEECF57A_5EFB_4B19_A60F_E
05203D4E73C INCLUDED)</winwlx.h></windows.h></winwlx.h></windows.h>
