CEF加载FLASH插件时弹出CMD命令行窗口的问题

梦里梦外; 2022-07-17 04:23 174阅读 0赞

## 问题 ##

这个是flash插件的一个bug，CEF（chromium系列浏览器）关闭sandbox第一次加载flash插件就会跳出这样的一个提示，在Google官方也看到了chromium的issue:

[地址][Link 1]

![这里写图片描述][20160831151229655]

## 解决方案 ##

官方暂时未解决这问题，只能是自己修改代码，通过hook命令行启动函数来实现不让命令行启动，hook库有
    微软的牛逼 Detours 但是要票票的，Esayhook 就是个不错的选择，32和64位都支持，开放源码使用简单。
    MHOOK据说小而好用但不研究了。

## 代码 ##

// HookFlash.cpp : 定义 DLL 应用程序的导出函数。
    //
    
    
    
    #include "stdafx.h"
    
    using namespace std;
    
    HOOK_TRACE_INFO hAHookTrackInfo = { NULL }; // keep track of our hook
    HOOK_TRACE_INFO hWHookTrackInfo = { NULL }; // keep track of our hook
    
    //注意调用约定 WINAPI，否则会出现堆栈异常
    
    typedef BOOL(WINAPI *realCreateProcessWPtr)(LPCWSTR lpApplicationName, LPWSTR lpCommandLine,
        LPSECURITY_ATTRIBUTES lpProcessAttributes,
        LPSECURITY_ATTRIBUTES lpThreadAttributes,
        BOOL bInheritHandles,
        DWORD dwCreationFlags,
        LPVOID lpEnvironment,
        LPCWSTR lpCurrentDirectory,
        LPSTARTUPINFOW lpStartupInfo,
        LPPROCESS_INFORMATION lpProcessInformation
        );
    
    
    typedef BOOL(WINAPI *realCreateProcessAPtr)(LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment,
        LPCSTR lpCurrentDirectory, \
        LPSTARTUPINFOA lpStartupInfo, \
        LPPROCESS_INFORMATION lpProcessInformation);
    
    
    realCreateProcessAPtr prealCreateProcessA;
    realCreateProcessWPtr prealCreateProcessW;
    
    
    BOOL WINAPI MYCreateProcessW(LPCWSTR lpApplicationName, LPWSTR lpCommandLine,
        LPSECURITY_ATTRIBUTES lpProcessAttributes,
        LPSECURITY_ATTRIBUTES lpThreadAttributes,
        BOOL bInheritHandles,
        DWORD dwCreationFlags,
        LPVOID lpEnvironment,
        LPCWSTR lpCurrentDirectory,
        LPSTARTUPINFOW lpStartupInfo,
        LPPROCESS_INFORMATION lpProcessInformation
    )
    {
        std::wstring strCommandLine(lpCommandLine);
    
        //MessageBoxW(GetActiveWindow(), strCommandLine.c_str(), L"createproceW", MB_OK);
    
        if (string::npos != strCommandLine.find(L"echo NOT SANDBOXED"))
        {
            //MessageBoxW(GetActiveWindow(), strCommandLine.c_str(), L"createproceW", MB_OK);
            return TRUE;
        }
        else
        {
            return (prealCreateProcessW)(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation);
        }
    
    }
    
    BOOL WINAPI MYCreateProcessA(
        LPCSTR lpApplicationName,
        LPSTR lpCommandLine,
        LPSECURITY_ATTRIBUTES lpProcessAttributes,
        LPSECURITY_ATTRIBUTES lpThreadAttributes,
        BOOL bInheritHandles,
        DWORD dwCreationFlags,
        LPVOID lpEnvironment,
        LPCSTR lpCurrentDirectory,
        LPSTARTUPINFOA lpStartupInfo,
        LPPROCESS_INFORMATION lpProcessInformation
    )
    {
        std::string strCommandLine = lpCommandLine;
    
        if (string::npos != strCommandLine.find("echo NOT SANDBOXED"))
        {
            //MessageBoxA(GetActiveWindow(), strCommandLine.c_str(), "createprocesA", MB_OK);
            return TRUE;
        }
        else
        {
            return (prealCreateProcessA)(lpApplicationName, lpCommandLine, lpProcessAttributes, lpThreadAttributes, bInheritHandles, dwCreationFlags, lpEnvironment, lpCurrentDirectory, lpStartupInfo, lpProcessInformation);
        }
    
    }
    
    
    
    
    void DoHook()
    {
    
        HMODULE hKernel32 = LoadLibrary(L"kernel32.dll");
    
        if (!(prealCreateProcessA = (realCreateProcessAPtr)GetProcAddress(hKernel32, "CreateProcessA")))
        {
            MessageBoxW(GetDesktopWindow(), L"GetProcAddress Err", L"CreateProcessA", MB_OK);
            return;
        }
    
        if (!(prealCreateProcessW = (realCreateProcessWPtr)GetProcAddress(hKernel32, "CreateProcessW")))
        {
            MessageBoxW(GetDesktopWindow(), L"GetProcAddress Err", L"CreateProcessW", MB_OK);
            return;
        }
    
    
        NTSTATUS resultA = LhInstallHook(prealCreateProcessA, MYCreateProcessA, NULL, &hAHookTrackInfo);
        NTSTATUS resultW = LhInstallHook(prealCreateProcessW, MYCreateProcessW, NULL, &hWHookTrackInfo);
    
    
        if (FAILED(resultA) || (FAILED(resultW)))
        {
            MessageBox(GetForegroundWindow(), _T("Hook Failed"), _T("Error"), MB_OK);
        }
    
    
        ULONG ACLEntriesA[1] = { 0 };
        ULONG ACLEntriesW[1] = { 0 };
    
        // If the threadId in the ACL is set to “ 0 ”,
        // then internally EasyHook uses GetCurrentThreadId()
        // Disable the hook for the provided threadIds, enable for all others
        LhSetExclusiveACL(ACLEntriesA, 0, &hAHookTrackInfo);
        LhSetExclusiveACL(ACLEntriesW, 0, &hWHookTrackInfo);
    
    }
    
    
    void UnHook()
    {
    
        // this will also invalidate "hHook", because it is a traced handle... 
        LhUninstallAllHooks();
    
        // this will do nothing because the hook is already removed... 
        LhUninstallHook(&hAHookTrackInfo);
        LhUninstallHook(&hWHookTrackInfo);
    
        // even if the hook is removed, we need to wait for memory release 
        LhWaitForPendingRemovals();
    
    }

## 源码下载 ##

[源码github地址][github]

## 参考文章 ##

> [http://blog.csdn.net/baggiowangyu/article/details/7675098][http_blog.csdn.net_baggiowangyu_article_details_7675098]  
> [http://easyhook.github.io/tutorials/nativehook.html][http_easyhook.github.io_tutorials_nativehook.html]  
> [http://blog.csdn.net/x356982611/article/details/52385394][http_blog.csdn.net_x356982611_article_details_52385394]

[Link 1]: https://bugs.chromium.org/p/chromium/issues/detail?id=508002
[20160831151229655]: /images/20220717/df726c1e813748f7917ff39b5e90b7c3.png
[github]: https://github.com/CodeBees/CEFWebkitBrowser/tree/master/HookFlash
[http_blog.csdn.net_baggiowangyu_article_details_7675098]: http://blog.csdn.net/baggiowangyu/article/details/7675098
[http_easyhook.github.io_tutorials_nativehook.html]: http://easyhook.github.io/tutorials/nativehook.html
[http_blog.csdn.net_x356982611_article_details_52385394]: http://blog.csdn.net/x356982611/article/details/52385394