delphi – 调用postmessage返回“访问被拒绝”

When a message is blocked by UIPI the last error,retrieved with GetLastError,is set to 5 (access denied).

What is User Interface Privilege Isolation (UIPI) on Vista

This is also known as UI Privilege Level Isolation (UIPI).

As part of the secure initiatuve in Vista,applications with UI will run in three different levels of privilege. Application windows can interact with others windows of the same or lower levels,but cannot interact with applications at higher level/permission.

Lower privilege modes can send messages to higher privileged applications only if explicitly allowed by the higher privilege application with a message calling ChangeWindowMessageFilter(). Also lower privileged applications can only read a HWND owned by a higher privileged application.

Internet Explorer is an example process that runs at the lowest privilege level.

Windows Integrity Mechanism Design

User Interface Privilege Isolation (UIPI) implements restrictions in the windows subsystem that prevents lower-privilege applications from sending window messages or installing hooks in higher-privilege processes. Higher-privilege applications are permitted to send window messages to lower-privilege processes. The restrictions are implemented in the SendMessage and related window message functions. Not all window messages that are sent from a lower-privilege process to a higher-privilege process are blocked. Generally,“read” type messages,for example WM_GETTEXT,can be sent from a lower-privilege to a higher-privilege window. However,write type messages,such as WM_SETTEXT,are blocked.

…

UIPI does not interfere with or change the behavior of window messaging between applications at the same privilege (or integrity) level. UIPI prevents lower-privilege processes from accessing higher-privilege processes by blocking the following behavior. A lower-privilege process cannot:

• Perform a window handle validation of a process running with higher rights.
• Use SendMessage or PostMessage to application windows running with higher rights. These APIs return success but silently drop the window message.
• Use thread hooks to attach to a process running with higher rights.
• Use journal hooks to monitor a process running with higher rights.
• Perform dynamic link library (DLL) injection to a process running with higher rights.

很明显,当发生错误时,您发布的HWND属于以比发布消息的进程更高的完整性/权限级别运行的进程.您可以使用SysInternals’ Process Explorer进行检查.

您说您的应用程序的第二个实例由虚拟打印机驱动程序运行,因此驱动程序可能运行的完整性级别低于用户启动的应用程序实例.

ChangeWidowMessageFilter / Ex()对非系统消息ID没有任何限制(某些系统消息无法过滤).它肯定不会在用户定义的消息ID上崩溃.如果您没有权限更改给定HWND / MsgID的消息过滤器,则该函数将简单地返回FALSE,并且GetLastError()将告诉您原因.

如果您遇到崩溃,则与代码中的其他内容有关.

此外,Form的OnCreate事件不是调用ChangeWindowMessageFilterEx()的最佳位置.在程序的生命周期中,表单可能必须动态地重建其HWND,甚至可能不止一次.每次创建新的HWND时,都必须再次调用ChangeWindowMessageFilterEx().解决这个问题的最佳方法是覆盖Form的虚拟CreateWnd()方法,例如：

type
  TMyForm = class(TForm)
  protected
    procedure CreateWnd; override;
  end;

procedure TMyForm.CreateWnd;
begin
  inherited;
  ChangeWindowMessageFilterEx(Handle,MSGFLT_ALLOW,nil);
end;