My .dll code is as follows:
Code: Select all
library dllhook;
uses
Windows, madRemote, madCodeHook, mmsystem, madStrings, sysutils;
var
waveOutOpenNext : function (lphWaveOut: PHWaveOut; uDeviceID: UINT; lpFormat: PWaveFormatEx; dwCallback, dwInstance, dwFlags: DWORD): MMRESULT; stdcall;
{
winmm.dll:
MMRESULT waveOutOpen(
LPHWAVEOUT phwo,
UINT_PTR uDeviceID,
LPWAVEFORMATEX pwfx,
DWORD_PTR dwCallback,
DWORD_PTR dwCallbackInstance,
DWORD fdwOpen
);
}
function waveOutOpenCallback(lphWaveOut: PHWaveOut; uDeviceID: UINT; lpFormat: PWaveFormatEx; dwCallback, dwInstance, dwFlags: DWORD): MMRESULT; stdcall;
var
pid: dword;
module: cardinal;
arrCh: array[0..MAX_PATH] of Char;
h: HWnd;
begin
{ basically what is to be done here is the following:
if whoever called waveOutOpen(..) is 'npswf32.dll' or 'flash.ocx' then
return some fake error state to prevent sound
if something else, pass on the request
}
{ get calling process }
{ PROBLEM: this can't be used, will be i.e. 'firefox.exe' or
'SAFlashPlayer.e' or 'iexplore.exe' }
pid := ProcessHandleToId(GetCurrentProcess());
{ get calling module }
{ PROBLEM: this will be 'winnt\system32\msacm32.drv' }
module := GetCallingModule();
{ just some quick hack to see calling process and module }
h := FindWindow(nil, 'Untitled - Notepad');
if h<>0 then
begin
ProcessIdToFileName(pid, arrCh);
SetWindowText(h, PChar('pid='+IntToStr(pid)+': '+StrPas(arrCh)+', mod='+IntToStr(module)+': '+GetModuleName(module)));
end;
{ if flash .dll/.ocx then }
result := MMSYSERR_NODRIVER;
{ else }
// result := waveOutOpenNext(lphWaveOut, uDeviceID, lpFormat, dwCallback, dwInstance, dwFlags);
end;
begin
HookAPI('winmm.dll', 'waveOutOpen', @waveOutOpenCallback, @waveOutOpenNext);
end.
Killing sound works quite well, but I am only interested in doing it if those 2 files are calling the WINMM.waveOutOpen() API... But, as illustrated, the calling module is reported to be msacm32.drv, which is the Windows Sound Mapper...
Any clues what I should do here? Neither of the .dll/.ocx'es import msacm32.drv so there's problaby some voodoo being done by Windows..
(Yes, this functionality has been done a few times before, but all of the implementations I've seen are just hacks of the .dll's, something which is a PITA each time a new version of Flash is released since the .dll's need patching again then)