Un ejemplo:
El código anterior debe ir en un modulo y detectaría una notificacion tipo balloon. En este caso, detecta la ventana que muestra el AV Sophos, al detectar un virus...
Saludos!
Código (vb) [Seleccionar]
Option Explicit
Public Declare Function EnumWindows Lib "user32.dll" (ByVal lpEnumFunc As Long, ByVal lParam As Long) As Long
Public Declare Function GetWindowLong Lib "user32" Alias "GetWindowLongA" (ByVal hwnd As Long, ByVal nIndex As Long) As Long
Public Declare Function GetClassName Lib "user32" Alias "GetClassNameA" (ByVal hwnd As Long, ByVal lpClassName As String, ByVal nMaxCount As Long) As Long
Public Const GWL_STYLE = (-16)
Declare Function AccessibleObjectFromWindow Lib "oleacc" (ByVal hwnd As Long, ByVal dwId As Long, riid As tGUID, ppvObject As Object) As Long
'Esta API que sigue se usa para enumerar los objetos IAccessible de los children de la ventana
'Declare Function AccessibleChildren Lib "oleacc" (ByVal paccContainer As IAccessible, ByVal iChildStart As Long, ByVal cChildren As Long, rgvarChildren As Variant, pcObtained As Long) As Long
Type tGUID
lData1 As Long '4 bytes DWORD
nData2 As Integer '2 bytes
nData3 As Integer '2 bytes
abytData4(0 To 7) As Byte '8 bytes (array)
End Type
Type AccObject
objIA As IAccessible 'objeto IAccessible de oleacc.dll
lngChild As Long '4 bytes
End Type
Global Enumerando As Boolean
Global Marcar As Long
Public Function EnumWindowsProc(ByVal hwnd As Long, ByVal lParam As Long) As Long
'Esta funcion es el Callback de la API EnumWindows (Se llama por cada ventana de nivel 1 que encuentre)
'Los BalloonTips del Area de Notificacion estan en el nivel 1!
Dim retval As Long ' return value
Dim accName As String ' guardar el nombre de la propiedad de IAccessible
Dim clsname As String ' guarda nombre de la clase de la ventana
Dim oParent As IAccessible ' objeto IAccessible que se llenara al llamar a IAccessibleFromHwnd
'Room for classname
clsname = Space(200)
'Get classname string
retval = GetClassName(hwnd, clsname, 200)
clsname = Trim(Mid(clsname, 1, retval))
'get style DWORD of window
retval = GetWindowLong(hwnd, GWL_STYLE)
If LCase(clsname) = "tooltips_class32" Then 'if classname is a tooltip
If retval And &HC0 Then 'and the style has the TTS_BALLOON (0x40) and the TTS_CLOSE (0x80) bits set
Set oParent = IAccessibleFromHwnd(hwnd) 'get IAccessible object of window
accName = Trim(oParent.accName) 'get accName property value
If InStr(1, accName, "Threat detected by Sophos.") <> 0 Then 'compare propval with my text
Form1.Label1.Caption = "Sophos Detectado!!!" 'jejeje
End If
End If
End If
EnumWindowsProc = 1 ' return value of 1 means continue enumeration
End Function
Function IAccessibleFromHwnd(hwnd As Long) As IAccessible
'Obtiene objeto IAccessible de una ventana a partir del hwnd de la misma
Dim oIA As IAccessible
Dim tg As tGUID
Dim lReturn As Long
' Define the GUID for the IAccessible object
' {618736E0-3C3D-11CF-810C-00AA00389B71}
With tg
.lData1 = &H618736E0
.nData2 = &H3C3D
.nData3 = &H11CF
.abytData4(0) = &H81
.abytData4(1) = &HC
.abytData4(2) = &H0
.abytData4(3) = &HAA
.abytData4(4) = &H0
.abytData4(5) = &H38
.abytData4(6) = &H9B
.abytData4(7) = &H71
End With
' Retrieve the IAccessible object from the window identified by hwnd
lReturn = AccessibleObjectFromWindow(hwnd, 0, tg, oIA)
' Return Object
Set IAccessibleFromHwnd = oIA
End Function
El código anterior debe ir en un modulo y detectaría una notificacion tipo balloon. En este caso, detecta la ventana que muestra el AV Sophos, al detectar un virus...
Saludos!