windows – 使用IE9嵌入WebBrowser控件时覆盖IE设置

由于似乎无法使IE9使用IDocHostUIHandler :: GetOptionKeyPath()方法,因此我使用SysInternals的工具查看哪些IE9 DLL访问了注册表的相关部分以加载IE9设置.这揭示了唯一的罪魁祸首是“mshtml.dll”和“iertutil.dll”,两者都称为RegOpenKeyExW().

然后计划在初始化WebBrowser控件之前加载这些DLL,然后对它们进行修补,以便将调用重定向到我的代码,在那里我可以使用dbghelp.dll来解释我打开的注册表项.因此,在初始化WebBrowser控件之前,首先要：

if (theApp.GetIEVersion() >= 9.0)
{
  HMODULE advadi = ::LoadLibrary("advapi32.dll");
  HMODULE mshtml = ::LoadLibrary("mshtml.dll");
  HookApiFunction(mshtml,advadi,"advapi32.dll","RegOpenKeyExW",(PROC)HookRegOpenKeyExW);
  HMODULE iertutil = ::LoadLibrary("iertutil.dll");
  HookApiFunction(iertutil,(PROC)HookRegOpenKeyExW);
}

现在,执行扫描DLL的邪恶工作的代码导入地址表,并修补所请求的函数(省略错误处理以保持代码大小)：

void HookApiFunction(HMODULE callingDll,HMODULE calledDll,const char* calledDllName,const char* functionName,PROC newFunction)
{
  // Get the pointer to the 'real' function
  PROC realFunction = ::GetProcAddress(calledDll,functionName);

  // Get the import section of the DLL,using dbghelp.dll's ImageDirectoryEntryToData()
  ULONG sz;
  PIMAGE_IMPORT_DESCRIPTOR import = (PIMAGE_IMPORT_DESCRIPTOR)
    ImageDirectoryEntryToData(callingDll,TRUE,IMAGE_DIRECTORY_ENTRY_IMPORT,&sz);

  // Find the import section matching the named DLL
  while (import->Name)
  {
    PSTR dllName = (PSTR)((PBYTE)callingDll + import->Name);
    {
      if (stricmp(dllName,calledDllName) == 0)
       break;
    }
    import++;
  }
  if (import->Name == NULL)
    return;

  // Scan the IAT for this DLL
  PIMAGE_THUNK_DATA thunk = (PIMAGE_THUNK_DATA)((PBYTE)callingDll + import->FirstThunk);
  while (thunk->u1.Function)
  {
    PROC* function = (PROC*)&(thunk->u1.Function);
    if (*function == realFunction)
    {
      // Make the function pointer writable and hook the function
      MEMORY_BASIC_INFORMATION mbi;
      ::VirtualQuery(function,&mbi,sizeof mbi);
      if (::VirtualProtect(mbi.BaseAddress,mbi.RegionSize,PAGE_READWRITE,&mbi.Protect))
      {
        *function = newFunction;
        DWORD protect;
        ::VirtualProtect(mbi.BaseAddress,mbi.Protect,&protect);
        return;
      }
    }
    thunk++;
  }

最后,我修补了DLL在我的代码中调用的函数,而不是RegOpenKeyExW()：

LONG WINAPI HookRegOpenKeyExW(HKEY hKey,LPCWSTR lpSubKey,DWORD ulOptions,REGSAM samDesired,PHKEY phkResult)
{
  static const wchar_t* ieKey = L"SoftwareMicrosoftInternet Explorer";

  // Never redirect any of the FeatureControl settings
  if (wcsstr(lpSubKey,L"FeatureControl") != NULL)
    return ::RegOpenKeyExW(hKey,lpSubKey,ulOptions,samDesired,phkResult);

  if (wcsnicmp(lpSubKey,ieKey,wcslen(ieKey)) == 0)
  {
    // Redirect the IE settings to our registry key
    CStringW newSubKey(m_registryPath);
    newSubKey.Append(lpSubKey+wcslen(ieKey));
    return ::RegOpenKeyExW(hKey,newSubKey,phkResult);
 }
 else
   return ::RegOpenKeyExW(hKey,phkResult);
}

令人惊讶的是,这个可怕的黑客确实有效.但请微软,如果你正在听,请在IE10中正确解决这个问题.