检查CTRL + ALT + DEL屏幕是否可见的另一种方法

Question

目前，我正在使用以下代码来测试CTRL+ ALT+ DEL屏幕是否可见以及是否按预期工作。问题是，轮询此信息会消耗CPU，并且我正在寻找基于事件的选项。有谁知道另一种方法来检测此屏幕是否可见？

我只需要知道何时关闭此屏幕。我不在乎它何时打开。只是它已经打开，现在已关闭。

老实说，我找到了这段代码，但我不确定它是如何具体针对我所指的屏幕的。它似乎在寻找任何进程创建和删除事件。这意味着该屏幕必须打开一个新进程。知道该进程名称也将有所帮助。

var interval = new TimeSpan(0, 0, 3);
const string isWin32Process = "TargetInstance isa \"Win32_Process\"";

// Listen for started processes.
WqlEventQuery startQuery = new WqlEventQuery("__InstanceCreationEvent", interval, isWin32Process);
var _startWatcher = new ManagementEventWatcher(startQuery);
_startWatcher.Start();
_startWatcher.EventArrived += OnStartEventArrived;

// Listen for closed processes.
WqlEventQuery stopQuery = new WqlEventQuery("__InstanceDeletionEvent", interval, isWin32Process);
var _stopWatcher = new ManagementEventWatcher(stopQuery);
_stopWatcher.Start();
_stopWatcher.EventArrived += OnStopEventArrived;

该屏幕的名称是什么？以及如何检测这种类型的窗口？似乎与登录窗口的类型相同。

Answer 1

当您按下CTRL+ ALT+ DEL，Windows切换到另一种特殊的虚拟桌面^一个是主机winlogon，负责用户进程登录/注销/锁定等操作。通过将WinAPI函数SetWinEventHook与EVENT_SYSTEM_DESKTOPSWITCH参数一起使用，您可以设置一个回调函数，该回调函数在发生此类桌面切换时被调用：

//Store the callback in a variable so that it is not GC'd private static 
private static readonly WinEventDelegate callback = EventCallback;
static void StartListeningForDesktopSwitch()
{
    SetWinEventHook(EVENT_SYSTEM_DESKTOPSWITCH, EVENT_SYSTEM_DESKTOPSWITCH,
        IntPtr.Zero, callback, 0, 0, WINEVENT_OUTOFCONTEXT | WINEVENT_SKIPOWNTHREAD);
}

static void EventCallback(IntPtr hWinEventHook, uint eventType,
       IntPtr hwnd, int idObject, int idChild, uint dwEventThread, uint dwmsEventTime)
{
    Console.WriteLine("Desktop switched");
}

注意：如果要在控制台应用程序中使用此功能，则必须通过添加一个hidden来添加消息循环Form：

static void Main(string[] args)
{        
    StartListeningForDesktopSwitch(); 

    // Run message loop
    Application.Run(new HiddenForm());
}

private class HiddenForm : Form
{
    public HiddenForm()
    {
        this.FormBorderStyle = FormBorderStyle.None;
        this.WindowState = FormWindowState.Minimized;
        this.ShowInTaskbar = false;
    }
}

delegate void WinEventDelegate(IntPtr hWinEventHook, uint eventType,
    IntPtr hwnd, int idObject, int idChild, uint dwEventThread,
    uint dwmsEventTime);

[DllImport("user32.dll")]
static extern IntPtr SetWinEventHook(uint eventMin, uint eventMax, IntPtr
    hmodWinEventProc, WinEventDelegate lpfnWinEventProc, uint idProcess,
    uint idThread, uint dwFlags);

const uint WINEVENT_OUTOFCONTEXT = 0x0000;
const uint WINEVENT_SKIPOWNTHREAD = 0x0001;
const uint EVENT_SYSTEM_DESKTOPSWITCH = 0x0020;

进一步：当用户按下Win+ L或弹出UAC窗口时，也会发生桌面切换。因此，我们需要一种检测其他情况的方法。UAC的情况相当琐碎，足以consent.exe在回调函数期间检查进程是否正在运行：

var processes = Process.GetProcessesByName("consent");
if (processes.Length == 0)
    Console.WriteLine("This is not a UAC prompt");

不幸的是，另一种情况更为复杂。我只是设法检测出用户从锁定屏幕返回的信息，但是没有检测到用户是否输入了锁定信息（如您所说，这与您无关，但无论如何我都想提一下）。

可以通过侦听SystemEvents.SessionSwitch我们的事件来检测会话是否被锁定 HiddenForm。该SessionSwitchEventArgs.Reason属性设置为SessionSwitchReason.SessionLock如果这是一个锁事件，并且SessionSwitchReason.SessionUnlock如果用户解锁。当我们切换回默认桌面时，我们只能说出桌面切换是否不是锁定屏幕桌面，因为切换桌面事件回调在会话锁定之前和会话解锁之后被调用。这导致示例控制台应用程序的以下代码：

private static readonly WinEventDelegate callback = EventCallback;
static void Main(string[] args)
{
    SetWinEventHook(EVENT_SYSTEM_DESKTOPSWITCH,
        EVENT_SYSTEM_DESKTOPSWITCH, IntPtr.Zero, callback, 0, 0,
        WINEVENT_OUTOFCONTEXT | WINEVENT_SKIPOWNTHREAD);

    Application.Run(new HiddenForm());
}

private class HiddenForm : Form
{
    public HiddenForm()
    {
        this.FormBorderStyle = FormBorderStyle.None;
        this.WindowState = FormWindowState.Minimized;
        this.ShowInTaskbar = false;
        SystemEvents.SessionSwitch += SystemEvents_SessionSwitch;
    }

    private void SystemEvents_SessionSwitch(object sender, SessionSwitchEventArgs e)
    {
        if (e.Reason == SessionSwitchReason.SessionUnlock)
            wasUnlocked = true;
    }
}

static bool wasUnlocked = false;
static bool wasOpened = false;

static void EventCallback(IntPtr hWinEventHook, uint eventType,
    IntPtr hwnd, int idObject, int idChild, uint dwEventThread, uint dwmsEventTime)
{
    // Check if UAC dialog is being shown
    var processes = Process.GetProcessesByName("consent");
    if (processes.Length == 0)
    {
        if (wasOpened)
        {
            if (!wasUnlocked)
                Console.WriteLine("Exited from CTRL+ALT+DEL");
            wasUnlocked = false;
            wasOpened = false;
        }
        else
            wasOpened = true;
    }
}

delegate void WinEventDelegate(IntPtr hWinEventHook, uint eventType,
    IntPtr hwnd, int idObject, int idChild, uint dwEventThread,
    uint dwmsEventTime);

[DllImport("user32.dll")]
static extern IntPtr SetWinEventHook(uint eventMin, uint eventMax, IntPtr
    hmodWinEventProc, WinEventDelegate lpfnWinEventProc, uint idProcess,
    uint idThread, uint dwFlags);

const uint WINEVENT_OUTOFCONTEXT = 0x0000;
const uint WINEVENT_SKIPOWNTHREAD = 0x0001;
const uint EVENT_SYSTEM_DESKTOPSWITCH = 0x0020;

^a这种类型的虚拟桌面与Windows 10中新引入的“虚拟桌面”功能无关