托盘图标的任意隐藏.docxVIP

托盘图标的任意隐藏 1、 用 FindWindow 函数获取 ToolbarWindow32 的句柄。lngTemp = FindWindow(Shell_TrayWnd, vbNullString) lngTemp = FindWindowEx(lngTemp, 0, TrayNotifyWnd, vbNullString) lngTemp = FindWindowEx(lngTemp, 0, SysPager, vbNullString) lngTray = FindWindowEx(lngTemp, 0, ToolbarWindow32, vbNullString) 2、用 GetWindowThreadProcessId 获取 ToolbarWindow32 进程 ID GetWindowThreadProcessId(lngTray, lngPID) lngPID 返回进程 ID 3、用 OpenProcess 打开一个已存在的进程对象 hProcess = OpenProcess(PROCESS_ALL_ACCESS Or PROCESS_VM_OPERATION Or PROCESS_VM_READ Or PROCESS_VM_WRITE, 0, lngPID) 4、用 VirtualAllocEx 申请内存空间 lngAddress = VirtualAllocEx(hProcess, ByVal 0, ByVal 4096, MEM_COMMIT, PAGE_READWRITE) 5、用 SendMessage 发送 TB_BUTTONCOUNT 消息到 ToolbarWindow32，返回图标数。 lngButtons = SendMessage(lngTray, TB_BUTTONCOUNT, 0, 0) 6、用 ReadProcessMemory 从进程内存空间读取数据：图标标题、图标句柄、图标进程 ID（注意，要有足够的权限） For i = 0 To lngButtons - 1 ret = SendMessage(lngTray, TB_GETBUTTON, ByVal i, ByVal lngAddress) ret = ReadProcessMemory(hProcess, ByVal lngAddress + 16, ByVal VarPtr(lngTextAdr), ByVal 4, ByVal 0) If lngTextAdr -1 Then ret = ReadProcessMemory(hProcess, ByVal lngTextAdr, ByVal VarPtr(strBuff(0)), ByVal 1024, ByVal 0) ret = ReadProcessMemory(hProcess, ByVal lngAddress + 12, ByVal VarPtr(lngHwndAdr), ByVal 4, ByVal 0) ret = ReadProcessMemory(hProcess, ByVal lngHwndAdr, ByVal VarPtr(lngHwnd), ByVal 4, ByVal 0) ret = ReadProcessMemory(hProcess, ByVal lngAddress + 4, ByVal VarPtr(lngButtonID), ByVal 4, ByVal 0) 获取进程 ID Call GetWindowThreadProcessId(lngHwnd, lngTbID) strText = ConverNull(strBuff) lngHwnd 所属窗口 handle strText 托盘图标文字 List1.AddItem lngHwnd - strText - 进程 ID： lngTbID End If Next i 7、获取图标所在进程的完整路径名称 Private Declare Function GetWindowThreadProcessId Lib user32 (ByVal hWnd As Long, _ lpdwProcessId As Long) As Long Private Declare Function CloseHandle Lib Kernel32.dll (ByVal Handle As Long) As Long Private Declare Function OpenProcess Lib Kernel32.dll (ByVal dwDesiredAccessas As Long, _ ByVal bInheritHandle As Long, ByVal dwPro