Application Security Testing: An Integral Part of DevOps
I wandered how I can simulate the Windows explorer listview of files. Here is what I found. It might be useful to someone. If you create a simple listview control and populate it with files/folders, you'll notice that you can't:
- Easily detect changes to files (rename, delete, copy/move...etc) while user is viewing the list
- Send To menu is not populated if you try to use the shell's menu for your items
- There doesn't seem to be a way of getting the column names used in shellview (filename, size, owner, times, and many others)
I found that Windows
explorer and File Open dialog expose IShellBrowser, which is
used by IShellFolder/IShellView to create the listview of
files. So, I created a simple app with WTL. Implemented basic
IShellBrowser methods and exposed it to IShellView
through IShellFolder::CreateViewObject. Finally,
to create the listview I called
IShellView::CreateViewWindow. I didn't try to merge the
Things I couldn't get to work:
- Toolbar buttons (they were added to my toolbar, but bitmaps were messed up). They do function however.
- The most important one for me was that I couldn't easily detect when user wanted to open/explore/search the selected folder so I could sync the file tree.
"[ViewFolder("C:\Documents and Settings\leon\Desktop\billing", :428:780, 1)]"
I have no idea what the 428:780 stand for, but action would be
ViewFolder/ExploreFolder/FindFolder. It would be nice if Microsoft
documented this stuff so we could use it correctly. In the MSDN they
state, "You do not implement this interface directly.
implemented by Windows Explorer and by the Windows File Open common dialog box." Why
did they tell us about WM_GETISHELLBROWSER?
Anyway, maybe it would be useful to someone, so here it is.
Some useful points:
- To get drag drop functioning in shellview, call OleInitialize/OleUninitialize
- Make sure you respond properly to WM_GETISHELLBROWSER or CreateView might crash
- Details listview seems to work only with FVM_DETAILS and FWF_SNAPTOGRID combination
- ICommDlgBrowser can be supported to have a simple listview like in common file dialog boxes (without webview)
- Don't name your executable as explorer.exe or unpleasant things will happen
Sample for enumerating/navigating folders/files (comes with PSDK) I have it
C:\Program Files\Microsoft Platform SDK\Samples\WinUI\Shell
Q157247 - PRB: IShellFolder::CreateViewObject() Causes Access Violation
Comments in the Shell Object Header File (shlobj.h) are useful.
Explorer.zip - 14.2K