Event Recorder

Event Recorder



Initially, I created the event recorder DLL to demonstrate how to integrate mouse and keyboard events capture within a C/C++ application. This solution relies on a neat feature from Microsoft, a "DLL-Application".
A "DLL-Application" is a WIN32 dynamic library that is callable from Rundll32.exe utility.

Event Recorder


RUNDLL32 is a small but powerful command-line utility that is included with Windows OS. It enables you to call exported functions from a 32-bit DLL. These functions must have this prototype:

    void CALLBACK EntryPoint(
    HWND hwnd,        // handle to owner window
    HINSTANCE hinst,  // instance handle for the DLL
    LPTSTR lpCmdLine, // string the DLL will parse
    int nCmdShow      // show state

Windows NT/2000/XP: It is possible to create a Unicode version of the function. Rundll32 first tries to find a function named EntryPointW. If it cannot find this function, it tries EntryPointA, then EntryPoint. To create a DLL that supports ANSI on Windows 95/98/Me and Unicode otherwise, export two functions: EntryPointW and EntryPoint. Even if RUNDLL32 doesn't display other window except the one that is created by your DLL, the signature of the exported function tells us that the first parameter is will be the handle of a window. This could be very useful indeed since when our function is called from this utility, calling GetClassName will return RUNDLL that is the class name of the hidden window.

Stand-Alone Use

You can use this DLL as stand-alone by creating a shortcut on your desktop (or Program menu). Simply create a shortcut with this argument:

%windir%\System32\RunDll32.exe <installed folder>\MacRcrd.dll,PlayFile

<installed folder>: i.e.: "C:\Program Files\EventRecorder"

Linking to MacRcrd.dll

MacRcrd.dll can be called from other application as well. This enables you to record and playback the event recorder file (.evr). The steps involve to using this DLL is quite straightforward. First, you need to include MacRcrdImport.h in your own program. Second, you can call the exported function to start your own event recording and playback. These functions can be called from within your own program.

HRESULT InstallCBT( LONG_PTR lEventObj, LONG_PTR lEventObjInstance, DWORD fdwOptions );
HRESULT UninstallCBT();
HRESULT InstallRecorder( LONG_PTR lEventObj, LONG_PTR lEventObjInstance, DWORD fdwOptions );
HRESULT UninstallRecorder();
HRESULT InstallPlayer( LONG_PTR lEventObj, LONG_PTR lEventObjInstance, DWORD fdwOptions );
HRESULT UninstallPlayer();

InstallRecorder/InstallPlayer installs a journal record and player hook respectively in the system. These API accept a Window handle or a callback as the event object handle.


I recommend to take a look inside of Playfile.cpp and PlayFileDlg.cpp for some examples how to use the API.


Download WTL7

Add Comment