Ctrl + Alt +删除WM消息号

Question

Any one know what the windows procedure when press the keys Ctrl + Alt + Del ? I ask about the windows procedure message number returned when you press those keys. I would like to know the number on all possible windows versions (w7, xp, vista, ...).

Answer 1

Winlogon.exe intercept the Secure Attention Sequence (SAS), wich is CTRL-ALT-DEL. It is a regular hotkey, registered with RegisterHotKey , but since Winlogon gets it first, you cannot steal it or disable it, in any programming language.

When Winlogon receives the SAS, it launches LogonUI.exe . LogonUI is the process that displays the "tiles", those squares you see on the logon screen. Each square is an implementation of a Credential Provider .

The credential provider collects your credential data, often a name and password. It sends back that information to Winlogon as an opaque array of bytes, along with the name of an Authentication Package .

The authentication package knows how to make sense of that array of bytes. I will use that information to log you in, maybe by getting a Kerberos ticket or checking your password againts a stored hash. If all checks out, it will give a security TOKEN representing your user to Winlogon.

Almost done.

Winlogon creates a new Window Station , with a Desktop named "Default". I will create the process identified by the Userinit registry key, usually userinit.exe (unless your computer is part of a botnet ;). That process runs with the token from the Authentication package.

Userinit performs some tasks, like creating your profile if this is your first logon ever. It will then launch your shell, usually Explorer.exe which will read various startup parameter, like all those unreadable icons next to the clock.

I've put the major mile stones in bold . I suggest you research the parts that interests so we can better help you by answering a more specific question.

Answer 2

I think winlogon is called from the raw input thread, I don't remember exactly how, maybe a event or LPC. The whole point of CAD is that a normal program cannot intercept it.

You can try to emulate it on pre Vista systems with a custom GINA that calls WlxSasNotify .