Ctrl + Alt +删除WM消息号码
有谁知道按Ctrl + Alt + Del键时的Windows程序是什么？ 我询问当您按下这些键时返回的 Windows 过程消息号。我想知道所有可能的 Windows 版本（w7、xp、vista...）的数量。
Any one know what the windows procedure when press the keys Ctrl + Alt + Del?
I ask about the windows procedure message number returned when you press those keys. I would like to know the number on all possible windows versions (w7, xp, vista, ...).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
Winlogon.exe 拦截安全注意序列 (SAS)，即 CTRL-ALT-DEL。它是一个常规热键，通过
RegisterHotKey注册，但由于 Winlogon 首先获取它，因此您无法在任何编程语言中窃取或禁用它。当 Winlogon 收到 SAS 时，它会启动 LogonUI.exe。 LogonUI 是显示“图块”（即您在登录屏幕上看到的那些方块）的过程。每个方块都是一个凭证提供者的实现。
凭据提供者收集您的凭据数据，通常是名称和密码。它将该信息作为不透明的字节数组以及身份验证包的名称发送回Winlogon。
身份验证包知道如何理解该字节数组。我将使用该信息让您登录，可能是通过获取 Kerberos 票证或根据存储的哈希检查您的密码。如果全部检查通过，它将向 Winlogon 提供代表您的用户的安全
TOKEN。快完成了。
Winlogon 创建一个新的Window Station，其桌面命名为“Default”。我将创建由 Userinit 注册表项标识的进程，通常是 userinit.exe（除非您的计算机是僵尸网络的一部分；）。该进程使用身份验证包中的令牌运行。
Userinit 执行一些任务，例如如果这是您第一次登录，则创建您的配置文件。然后它将启动您的 shell，通常是 Explorer.exe，它将读取各种启动参数，例如时钟旁边的所有那些不可读的图标。
我已将主要里程碑以粗体标出。我建议您研究感兴趣的部分，以便我们可以通过回答更具体的问题来更好地帮助您。
Winlogon.exe intercept the Secure Attention Sequence (SAS), wich is CTRL-ALT-DEL. It is a regular hotkey, registered with
RegisterHotKey, but since Winlogon gets it first, you cannot steal it or disable it, in any programming language.When Winlogon receives the SAS, it launches LogonUI.exe. LogonUI is the process that displays the "tiles", those squares you see on the logon screen. Each square is an implementation of a Credential Provider.
The credential provider collects your credential data, often a name and password. It sends back that information to Winlogon as an opaque array of bytes, along with the name of an Authentication Package.
The authentication package knows how to make sense of that array of bytes. I will use that information to log you in, maybe by getting a Kerberos ticket or checking your password againts a stored hash. If all checks out, it will give a security
TOKENrepresenting your user to Winlogon.Almost done.
Winlogon creates a new Window Station, with a Desktop named "Default". I will create the process identified by the Userinit registry key, usually userinit.exe (unless your computer is part of a botnet ;). That process runs with the token from the Authentication package.
Userinit performs some tasks, like creating your profile if this is your first logon ever. It will then launch your shell, usually Explorer.exe which will read various startup parameter, like all those unreadable icons next to the clock.
I've put the major mile stones in bold. I suggest you research the parts that interests so we can better help you by answering a more specific question.
我认为 winlogon 是从原始输入线程调用的，我不记得具体是如何调用的，也许是事件或 LPC。 CAD 的全部要点是普通程序无法拦截它。
您可以尝试使用自定义 GINA 在 Vista 之前的系统上模拟它，该 GINA 调用 WlxSasNotify。
I think winlogon is called from the raw input thread, I don't remember exactly how, maybe a event or LPC. The whole point of C.A.D. is that a normal program cannot intercept it.
You can try to emulate it on pre Vista systems with a custom GINA that calls WlxSasNotify.