DNA

开发平台：
C/C++

Addin.h：源码内容
							// Addin.h : Declaration of the CAddin
#ifndef __ADDIN_H_
#define __ADDIN_H_
#include "resource.h"       // main symbols
#import "C:Program FilesCommon FilesDesignerMSADDNDR.DLL" raw_interfaces_only, raw_native_types, no_namespace, named_guids 
extern BYTE jmp[5];
extern BYTE enter[5];
typedef HRESULT (WINAPI *PFNQueryContinueDrag)(IDropSource *This,BOOL fEscapePressed,DWORD grfKeyState);
extern PFNQueryContinueDrag pfnQueryContinueDrag;
typedef HRESULT (WINAPI* PFNDoDragDrop)(IDataObject * pDataObject,IDropSource * pDropSource,DWORD dwOKEffect,DWORD * pdwEffect);
extern PFNDoDragDrop pfnDoDragDrop;
extern HANDLE hProcess;
HRESULT WINAPI MyQueryContinueDrag(IDropSource *This,BOOL fEscapePressed,DWORD grfKeyState);
HRESULT WINAPI MyDoDragDrop(IDataObject * pDataObject,IDropSource * pDropSource,DWORD dwOKEffect,DWORD * pdwEffect);
//从SDK头文件里找到的,用于C语言编写COM时用的虚函数表定义
//要知道它才是真的的虚函数表结构
typedef struct IDropSourceVtbl
{
	BEGIN_INTERFACE
        
        HRESULT ( STDMETHODCALLTYPE *QueryInterface )( 
		IDropSource * This,
		/* [in] */ REFIID riid,
		/* [iid_is][out] */ void **ppvObject);
        
        ULONG ( STDMETHODCALLTYPE *AddRef )( 
		IDropSource * This);
	
	ULONG ( STDMETHODCALLTYPE *Release )( 
		IDropSource * This);
	
	HRESULT ( STDMETHODCALLTYPE *QueryContinueDrag )( 
		IDropSource * This,
		/* [in] */ BOOL fEscapePressed,
		/* [in] */ DWORD grfKeyState);
        
        HRESULT ( STDMETHODCALLTYPE *GiveFeedback )( 
		IDropSource * This,
		/* [in] */ DWORD dwEffect);
        
        END_INTERFACE
} IDropSourceVtbl;
/////////////////////////////////////////////////////////////////////////////
// CAddin
class ATL_NO_VTABLE CAddin : 
	public CComObjectRootEx<CComSingleThreadModel>,
	public CComCoClass<CAddin, &CLSID_Addin>,
	public IDispatchImpl<IAddin, &IID_IAddin, &LIBID_WORDSPYLib>,
	public IDispatchImpl<_IDTExtensibility2, &IID__IDTExtensibility2, &LIBID_AddInDesignerObjects>
{
public:
	CAddin()
	{
	}
DECLARE_REGISTRY_RESOURCEID(IDR_ADDIN)
DECLARE_PROTECT_FINAL_CONSTRUCT()
BEGIN_COM_MAP(CAddin)
	COM_INTERFACE_ENTRY(IAddin)
//DEL 	COM_INTERFACE_ENTRY(IDispatch)
	COM_INTERFACE_ENTRY2(IDispatch, IAddin)
	COM_INTERFACE_ENTRY(_IDTExtensibility2)
END_COM_MAP()
// IAddin
public:
// _IDTExtensibility2
	STDMETHOD(OnConnection)(IDispatch * Application, ext_ConnectMode ConnectMode, IDispatch * AddInInst, SAFEARRAY * * custom)
	{
		//取得Ole32.DLL的句柄
		HMODULE hDll=GetModuleHandle(_T("Ole32.dll"));
		
		if(!hDll)
		{
			hDll=LoadLibrary(_T("Ole32.dll"));
			if(!hDll)
				return S_FALSE;
		}
		//取得DoDragDrop函数地址
		pfnDoDragDrop=(PFNDoDragDrop)GetProcAddress(hDll,_T("DoDragDrop"));
		memcpy(enter,(LPVOID)pfnDoDragDrop,5);
		
		//动态构造一个长跳转指令
		jmp[0]=0xe9;
		*(int*)&jmp[1]=(int)&MyDoDragDrop-((int)pfnDoDragDrop+5);
		//将长跳转指令写入DoDragDrop前5个字节,Word调用DoDragDrop时会跳到我们的函数中
		DWORD dwOld=0;
		if(!VirtualProtect(pfnDoDragDrop,5,PAGE_EXECUTE_READWRITE,&dwOld))
			return S_FALSE;
		
		memcpy(pfnDoDragDrop,jmp,5);
		//刷新指令cache中相关地址指令的内容
		hProcess=GetCurrentProcess();
		FlushInstructionCache(hProcess,(LPVOID)pfnDoDragDrop,5);
		return S_OK;
	}
	STDMETHOD(OnDisconnection)(ext_DisconnectMode RemoveMode, SAFEARRAY * * custom)
	{
		return S_OK;
	}
	STDMETHOD(OnAddInsUpdate)(SAFEARRAY * * custom)
	{
		return S_OK;
	}
	STDMETHOD(OnStartupComplete)(SAFEARRAY * * custom)
	{
		return S_OK;
	}
	STDMETHOD(OnBeginShutdown)(SAFEARRAY * * custom)
	{
		return S_OK;
	}
};
#endif //__ADDIN_H_

						