7 replies to this topic

[baldgrapeape]

Sorry if this is the wrong forum.

Is Ctrl-Z a programmed function, or is it a built in windows function?
If it is a Windows function what is it actually doing and how does it do what it is doing.

I ask this from an investigative standpoint on the investigation of a machine after an incident has occurred. Is there a storage in a reg key or somewhere that holds the information from Ctrl-Z.

Maybe there is code written to change this function, I have no idea, figured that you guys are tons smarter than I so you would know the answer or where I can start looking.

Thanks.

[Ancient Dragon]

Ctrl+Z is called a Hot Key -- its not a function. On my system Windows 7 it does nothing at all. The behavior of Ctrl+Z depends on the program you are using. May programs do not define it to do anything.

[Groogy]

*erhm* Actually in a terminal it sends the Interrupt signal if my memory serves me right. Which you can intercept yourself with the standard C library.

signal - C++ Reference
Control-Z - Wikipedia, the free encyclopedia

[Milyardo]

The interrupt is sent by the shell you run the application in. You can use the C Standard Library to catch the interrupt, or configure your shell not to send it at all.

[Ancient Dragon]

He was taking about MS-Windows, not *nix or a terminal program. If you put the mouse somewhere on the MS-Windows desktop and press Ctrl+Z it will do nothing. Another C program running in the background might be able to capture it using a Windows Hook, but I'm not sure about that because I have not tried it.

[baldgrapeape]

Thanks for all replies.

What actually happens in a windows environment (regardless of the program) when you hit ctrl-z?

For most it seems to be an undo function, but what actually is going on, how does it know what to undo, is this a reg key, something in RAM, etc.


Thanks again.

[Alexander]

baldgrapeape said:

but what actually is going on, how does it know what to undo, is this a reg key, something in RAM, etc.

It's stored in memory as a temporary structor(array), such as:

//Do a command
foo.doWork();
history.push(foo);

// Undo
var foo = history.pop();
foo.undoWork();

[julmuri]

What nullw0rm said.
You might want to read on Command pattern - Wikipedia, the free encyclopedia.