Replace Notepad.exe

Prohibit the Clipboard to the specified process

Written by:
Shamray Vladimir
Senior Developer

Contents

1. Introduction
1.1. Task
1.2. Who is this article?
2. About Windows Clipboard
2.1. Overview Clipboard
2.2. How it works?
3. Solution Description
Solutions 3.1. possible task
3.2. Implementation Project
3.2.1. How to find a non-exported function?
3.2.2. Find signatures
3.2.3. Implementation search function
3.2.4. Setting hooks
3.2.5. Hooks implementation
3.3. Construction of the sample
3.4. Supports versions of Windows
4. Conclusions
5. Bibliography

Introduction

This article is based on the true purpose of the project, I participated in, the task was to create software to protect the Windows clipboard data exchange against unauthorized users. Although the clipboard is one of the fundamental elements of the Windows operating system, there is little information on how it works, especially in the low level. In this article, I'll tell you something about the inner workings of the clipboard by showing how you can deny access. I simplified the task as it was possible to give you the opportunity to focus on the most important parts.

Task

Create a program to prevent copying of data via the clipboard to a specific application (WordPad) to another (Notepad). The application names will be hardcoded. There will be no possibility of additional control. Also, no graphical interface is intended.

Who is this article for

The article is written for developers C / C + +, familiar with the Windows API and development of kernel-mode driver and are interested in how to work with the clipboard on the lower level.

The reader is supposed to have knowledge in C programming language, the Windows API (both the user and those kernel-mode) and the system architecture. The reader should not be an expert in driver development, but he / she must know what drivers are and how to write the simplest.

About Windows Clipboard

Overview Clipboard

As you know, the clipboard is a Windows component that enables applications to transfer data. An application places data in the clipboard to cut and copy operations and retrieves data from the clipboard for paste operations. Data in the clipboard can be in different formats. Each format is identified by an unsigned integer value.

An application places data in the clipboard as the clipboard formats as possible, ordered from the clipboard format to the more descriptive the less descriptive. For each format, the application calls the function SetClipboardData, specifying the format identifier and a global memory handle.

SetClipboardData HANDLE (
uFormat UINT,
hMem HANDLE
)

To retrieve data from the clipboard, an application first determines the clipboard format to retrieve. Typically, an application lists the available clipboard formats by using the EnumClipboardFormats and uses the first format it recognizes. Furthermore, an application can use the GetPriorityClipboardFormat. This function identifies the best format to clipboard available depending on the specified priority. An application can determine if a format is available by using the IsClipboardFormatAvailable.

After determining the format to use the clipboard, an application calls the function GetClipboardData. This function returns the handle to a global memory object containing data in the format specified.

.