手机版sqlite下载:HOOK钩子机制学习笔记

来源：百度文库编辑：偶看新闻时间：2024/05/07 23:06:00

HOOK钩子机制学习笔记(1)

2011-04-23 10:34:06| 分类： c#——qq |字号订阅

一、什么是钩子(hook)
    Windows系统是建立在事件驱动的机制上的，说穿了就是整个系统都是通过消息的传递来实现的。钩子(hook)是一种特殊的消息处理机制，钩子可以监视系统或进程中的各种事件消息，截获发往目标窗口的消息并进行处理。这样，我们就可以在系统中安装自定义的钩子，监视系统中特定事件的发生，完成特定的功能，比如截获键盘、鼠标的输入，屏幕取词，日志监视等等。
    钩子的种类很多，每种钩子可以截获并处理相应的消息，如键盘钩子可以截获键盘消息，外壳钩子可以截取、启动和关闭应用程序的消息等。钩子可以分为线程钩子和系统钩子, 线程钩子监视指定线程的事件消息, 系统钩子监视系统中的所有线程的事件消息。因为系统钩子会影响系统中所有的应用程序，所以钩子函数必须放在独立的动态链接库(DLL) 中。
    按照我的理解，钩子(hook)就是一个Windows消息的拦截机制，你可以单个进程的消息(线程钩子)，也可以拦截所有进程的消息(系统钩子)，对拦截的消息进行自定义的处理。Windows消息带了一些程序有用的信息，比如Mouse类信息，就带有鼠标所在窗体句柄、鼠标位置等信息（具体可参考相应的消息定义文档），拦截了这些消息，就可以做出例如金山词霸一类的屏幕取词功能。

二、钩子的工作原理
在正确使用钩子函数前，我们先讲解钩子函数的工作原理。当您创建一个钩子时，WINDOWS会先在内存中创建一个数据结构，该数据结构包含了钩子的相关信息，然后把该结构体加到已经存在的钩子链表中去。新的钩子将加到老的前面。当一个事件发生时，如果您安装的是一个进程钩子，您进程中的钩子函数将被调用。如果是一个系统钩子，系统就必须把钩子函数插入到其它进程的地址空间，要做到这一点要求钩子函数必须在一个动态链接库中，所以如果您想要使用系统钩子，就必须把该钩子函数放到动态链接库中去。当然有两个例外：工作日志钩子和工作日志回放钩子。这两个钩子的钩子函数必须在安装钩子的线程中。原因是：这两个钩子是用来监控比较底层的硬件事件的，既然是记录和回放，所有的事件就当然都是有先后次序的。所以如果把回调函数放在DLL中，输入的事件被放在几个线程中记录，所以我们无法保证得到正确的次序。故解决的办法是：把钩子函数放到单个的线程中，譬如安装钩子的线程。
几点需要说明的地方：
　　（1）如果对于同一事件（如鼠标消息）既安装了线程钩子又安装了系统钩子，那么系统会自动先调用线程钩子，然后调用系统钩子。
　　（2）对同一事件消息可安装多个钩子处理过程，这些钩子处理过程形成了钩子链。当前钩子处理结束后应把钩子信息传递给下一个钩子函数。而且最近安装的钩子放在链的开始，而最早安装的钩子放在最后，也就是后加入的先获得控制权。
　　（3）钩子特别是系统钩子会消耗消息处理时间，降低系统性能。只有在必要的时候才安装钩子，在使用完毕后要及时卸载。

三、相关函数说明
1、钩子函数
   钩子函数指钩子在拦截了消息后，进行对应消息处理的函数，可以通过返回TRUE直接抛弃消息，其原型为：
   LRESULT CALLBACK HookProcName(int nCode ,WPARAM wParam,LPARAM lParam)
   参数说明：
   nCode -- 包含有关消息本身的信息，比如是否从消息队列中移出(未具体了解，有兴趣可查资料).
   wParam -- 消息标示，用于判断该消息是那种消息，如WM_MOUSEMOVE，WM_NCMOUSEMOVE.
   lParam -- 包含所钩消息的信息指针，比如鼠标位置、状态，键盘按键等。

2、创建钩子函数
   创建新的钩子函数加入到钩子链中，一般在钩子程序初始化时使用.
   HHOOK SetWindowsHookEx( int idHook,HOOKPROC lpfn, INSTANCE hMod,DWORD dwThreadId)
   返回值：
   HHOOK -- 钩子句柄，需要保留，等不使用钩子时通过UnhookWindowsHookEx函数卸载钩子
   参数说明：
   idHook -- 钩子的拦截消息类型，选择钩子程序的拦截范围，具体值参考文章结尾的消息类型
   lpfn -- 消息的回调函数地址，一般是填函数名
   hMod -- 钩子函数所在的实例的句柄。对于线程钩子，该参数为NULL；对于系统钩子，该参数为钩子函数所在的DLL句柄。在dll中可通过AfxInitExtensionModule(MousehookDLL, hInstance)获得DLL句柄。
   dwThreadId -- 钩子所监视的线程的线程号，可通过GetCurrentThreadId()获得线程号。对于全局钩子，该参数为NULL(或0)。

3、CallNextHookEx
   在钩子函数中使用，将钩子信息传递给钩子链的下一个钩子函数。原型如下：
   LRESULT CallNextHookEx( HHOOK hhk, int nCode, WPARAM wParam, LPARAM lParam )
   参数说明：
   hhk -- 钩子句柄。
   nCode、wParam和lParam 是钩子函数对应的入参。

4、卸载钩子函数
当不再使用钩子时，必须及时卸载。简单地调用函数 BOOL UnhookWindowsHookEx( HHOOK hhk)即可。

四、关于DLL的相关知识的介绍
    由于系统钩子要用到dll，所以先介绍下win32 dll的特点：
    Win32 DLL与 Win16 DLL有很大的区别，这主要是由操作系统的设计思想决定的。一方面，在Win16 DLL中程序入口点函数和出口点函数（LibMain和WEP）是分别实现的；而在Win32 DLL中却由同一函数DLLMain来实现。无论何时，当一个进程或线程载入和卸载DLL时，都要调用该函数，它的原型是BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved);
    其中，第一个参数表示DLL的实例句柄；第三个参数系统保留；这里主要介绍一下第二个参数，它有四个可能的值：DLL_PROCESS_ATTACH（进程载入），DLL_THREAD_ATTACH（线程载入），DLL_THREAD_DETACH（线程卸载），DLL_PROCESS_DETACH（进程卸载），在DLLMain函数中可以对传递进来的这个参数的值进行判别，并根据不同的参数值对DLL进行必要的初始化或清理工作。举个例子来说，当有一个进程载入一个DLL时，系统分派给DLL的第二个参数为DLL_PROCESS_ATTACH，这时，你可以根据这个参数初始化特定的数据。另一方面，在Win16环境下，所有应用程序都在同一地址空间；而在Win32环境下，所有应用程序都有自己的私有空间，每个进程的空间都是相互独立的，这减少了应用程序间的相互影响，但同时也增加了编程的难度。大家知道，在Win16环境中，DLL的全局数据对每个载入它的进程来说都是相同的；而在Win32环境中，情况却发生了变化，当进程在载入DLL时，系统自动把DLL地址映射到该进程的私有空间，而且也复制该DLL的全局数据的一份拷贝到该进程空间，也就是说每个进程所拥有的相同的DLL的全局数据其值却并不一定是相同的。因此，在Win32环境下要想在多个进程中共享数据，就必须进行必要的设置。亦即把这些需要共享的数据分离出来，放置在一个独立的数据段里，并把该段的属性设置为共享。
    在VC6中有三种形式的MFC DLL（在该DLL中可以使用和继承已有的MFC类)可供选择，即Regular statically linked to MFC DLL（标准静态链接MFC DLL）和Regular using the shared MFC DLL（标准动态链接MFC DLL）以及Extension MFC DLL（扩展MFC DLL）。第一种DLL的特点是，在编译时把使用的MFC代码加入到DLL中，因此，在使用该程序时不需要其他MFC动态链接类库的存在，但占用磁盘空间比较大；第二种DLL的特点是，在运行时，动态链接到MFC类库，因此减少了空间的占用，但是在运行时却依赖于MFC动态链接类库；这两种DLL既可以被 MFC程序使用也可以被Win32程序使用。第三种DLL的特点类似于第二种，做为MFC类库的扩展，只能被MFC程序使用。
    下面说说在VC6中全局共享数据的实现
　　在主文件中，用#pragma data_seg建立一个新的数据段并定义共享数据，其具体格式为：
    #pragma data_seg （"shareddata")
    HWND sharedwnd=NULL;//共享数据
    #pragma data_seg()
　　仅定义一个数据段还不能达到共享数据的目的，还要告诉编译器该段的属性，有两种方法可以实现该目的（其效果是相同的），一种方法是在.DEF文件中加入如下语句：
    SETCTIONS shareddata READ WRITE SHARED
　　另一种方法是在项目设置链接选项中加入如下语句：
　　/SECTION:shareddata,rws

五、建立钩子程序的一般步骤
   1、建立钩子函数，函数中通过CallNextHookEx传递消息
   2、调用SetWindowsHookEx创建钩子
   3、通过UnhookWindowsHookEx卸载钩子

六、程序实例
   1、创建线程钩子(其实也可以放在DLL中)
   用钩子跟踪当前窗口鼠标移动的位置变化信息。并输出到窗口
   (1)在VC＋＋6.0中利用MFC APPWizard（EXE）生成一个不使用文档/视结构的单文档应用mousehook。打开childview.cpp文件，加入全局变量：
HHOOK hHook;//鼠标钩子句柄
CPoint point;//鼠标位置信息
CChildView *pView; // 鼠标钩子函数用到的输出窗口指针

在CChildView::OnPaint()添加如下代码：
CPaintDC dc(this);
char str[256];
sprintf(str,"x=%d,y=%d",point.x,point.y); //构造字符串
dc.TextOut(0,0,str); //显示字符串

　(2)childview.cpp文件中定义全局的鼠标钩子函数。
LRESULT CALLBACK MouseProc(int nCode, WPARAM wParam, LPARAM lParam)
{ //是鼠标移动消息
     if(wParam==WM_MOUSEMOVE||wParam==WM_NCMOUSEMOVE)
     {
        point=((MOUSEHOOKSTRUCT *)lParam)－>pt; //取鼠标信息
        pView－>Invalidate(); //窗口重画
      }
      return CallNextHookEx(hHook,nCode,wParam,lParam); //传递钩子信息
   }

   (3)CChildView类的构造函数中安装钩子。
   CChildView::CChildView()
   {
      pView=this;//获得输出窗口指针
      hHook=SetWindowsHookEx(WH_MOUSE,MouseProc,0,GetCurrentThreadId()); //由于是线程钩子imod填0
   }

(4)CChildView类的析构函数中卸载钩子。
CChildView::～CChildView()
{
if(hHook)
UnhookWindowsHookEx(hHook);
}

2、创建全局钩子
1)建立钩子Mousehook.DLL
    (1)选择MFC AppWizard(DLL)创建项目Mousehook；
    (2)选择MFC Extension DLL（共享MFC拷贝）类型；
    (3)由于VC5没有现成的钩子类，所以要在项目目录中创建Mousehook.h文件，在其中建立钩子类：
    class AFX_EXT_CLASS Cmousehook:public CObject
    {
      public:
        Cmousehook(); //钩子类的构造函数
        ~Cmousehook(); //钩子类的析构函数
      BOOL starthook(HWND hWnd); //安装钩子函数
      BOOL stophook(); //卸载钩子函数
    };

    (4)在Mousehook.app文件的顶部加入#include"Mousehook.h"语句；
    (5)加入全局共享数据变量：
    #pragma data_seg("mydata") //如果使用了这个全局共享数据变量，则会导致当启动第二个程序的时候，第一个程序失效
    HWND glhPrevTarWnd=NULL; //上次鼠标所指的窗口句柄
    HWND glhDisplayWnd=NULL; //显示目标窗口标题编辑框的句柄
    HHOOK glhHook=NULL; //安装的鼠标钩子句柄
    HINSTANCE glhInstance=NULL; //DLL实例句柄
    #pragma data_seg()

　　(6)在DEF文件中定义段属性：
SECTIONS
mydata READ WRITE SHARED

    (7)在主文件Mousehook.cpp的DllMain函数中加入保存DLL实例句柄的语句：
    DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
    {
       //如果使用lpReserved参数则删除下面这行
       UNREFERENCED_PARAMETER(lpReserved);
       if (dwReason == DLL_PROCESS_ATTACH)
       {
          TRACE0("MOUSEHOOK.DLL Initializing!\n"); //扩展DLL仅初始化一次
          if (!AfxInitExtensionModule(MousehookDLL, hInstance))
          return 0;
          new CDynLinkLibrary(MousehookDLL); //把DLL加入动态MFC类库中
          glhInstance=hInstance; //插入保存DLL实例句柄
       }
       else if (dwReason == DLL_PROCESS_DETACH)
       {
          TRACE0("MOUSEHOOK.DLL Terminating!\n"); //终止这个链接库前调用它
          AfxTermExtensionModule(MousehookDLL);
       }
       return 1;
    }

　　(8)类Cmousehook的成员函数的具体实现：
    Cmousehook::Cmousehook() //类构造函数
    {
    }

    Cmousehook::~Cmousehook() //类析构函数
    {
       stophook();
    }

    BOOL Cmousehook::starthook(HWND hWnd) //安装钩子并设定接收显示窗口句柄
    {
       BOOL bResult=FALSE;
       glhHook=SetWindowsHookEx(WH_MOUSE,MouseProc,glhInstance,0);
       if(glhHook!=NULL)
          bResult=TRUE;
       glhDisplayWnd=hWnd; //设置显示目标窗口标题编辑框的句柄
       return bResult;
    }

    BOOL Cmousehook::stophook() //卸载钩子
    {
      BOOL bResult=FALSE;
      if(glhHook)
      {
         bResult= UnhookWindowsHookEx(glhHook);
         if(bResult)
         {
            glhPrevTarWnd=NULL;
            glhDisplayWnd=NULL;//清变量
            glhHook=NULL;
         }
      }
      return bResult;
    }

　　(9)钩子函数的实现：
    LRESULT WINAPI MouseProc(int nCode,WPARAM wparam,LPARAM lparam)
    {
       LPMOUSEHOOKSTRUCT pMouseHook=(MOUSEHOOKSTRUCT FAR *) lparam;
       if (nCode>=0)
       {
         HWND glhTargetWnd=pMouseHook->hwnd; //取目标窗口句柄
         HWND ParentWnd=glhTargetWnd;
         while (ParentWnd !=NULL)
         {
            glhTargetWnd=ParentWnd;
            ParentWnd=GetParent(glhTargetWnd); //取应用程序主窗口句柄
         }
         if(glhTargetWnd!=glhPrevTarWnd)
         {
           char szCaption[100];
           GetWindowText(glhTargetWnd,szCaption,100); //取目标窗口标题
           if(IsWindow(glhDisplayWnd))
           SendMessage(glhDisplayWnd,WM_SETTEXT,0,(LPARAM)(LPCTSTR)szCaption);
           glhPrevTarWnd=glhTargetWnd; //保存目标窗口
         }
      }
      return CallNextHookEx(glhHook,nCode,wparam,lparam); //继续传递消息
    }

　　(10)编译项目生成mousehook.dll。

　　2)创建钩子可执行程序
　　(1)用MFC的AppWizard(EXE)创建项目Mouse；
　　(2)选择“基于对话应用”并按下“完成”键；
　　(3)编辑对话框，删除其中原有的两个按钮，加入静态文本框和编辑框，用鼠标右键点击静态文本框，在弹出的菜单中选择“属性”，设置其标题为“鼠标所在的窗口标题”；
　　(4)在Mouse.h中加入对Mousehook.h的包含语句#include "..\Mousehook\Mousehook.h"；
　　(5)在CMouseDlg.h的CMouseDlg类定义中添加私有数据成员：
CMouseHook m_hook;//加入钩子类作为数据成员

　　(6)修改CmouseDlg::OnInitDialog()函数：
    BOOL CMouseDlg::OnInitDialog()
    {
      CDialog::OnInitDialog();
      ASSERT((IDM_ABOUTBOX & 0xFFF0) == IDM_ABOUTBOX);
      ASSERT(IDM_ABOUTBOX <0xF000);
      CMenu* pSysMenu = GetSystemMenu(FALSE);
      if (pSysMenu != NULL)
      {
        CString strAboutMenu;
        strAboutMenu.LoadString(IDS_ABOUTBOX);
        if (!strAboutMenu.IsEmpty())
        {
            pSysMenu->AppendMenu(MF_SEPARATOR);
            pSysMenu->AppendMenu(MF_STRING, IDM_ABOUTBOX, strAboutMenu);
        }
      }
      SetIcon(m_hIcon, TRUE);//Set big icon
      SetIcon(m_hIcon, FALSE);//Set small icon
      //TODO: Add extra initialization here
      CWnd * pwnd=GetDlgItem(IDC_EDIT1); //取得编辑框的类指针
      m_hook.starthook(pwnd->GetSafeHwnd()); //取得编辑框的窗口句柄并安装钩子
      return TRUE;
      //return TRUE unless you set the focus to a control
    }

　　(7)链接DLL库，即把..\Mousehook\debug\Mousehook.lib加入到项目设置链接标签中；
　　(8)编译项目生成可执行文件；
　　(9)把Mousehook.DLL拷贝到..\mouse\debug目录中；
　　(10)先运行几个可执行程序，然后运行Mouse.exe程序，把鼠标在不同窗口中移动，在Mouse.exe程序窗口中的编辑框内将显示出鼠标所在的应用程序主窗口的标题。

附：钩子拦截消息类型
     WH_CALLWNDPROC ：拦截系统发向目标窗体的消息，在目标窗体处理消息前
     WH_CALLWNDPROCRET ：在目标窗体处理完系统发送的消息后，拦截该消息，消息中包含处理返回结果
     WH_CBT ：在以下事件之前，系统都会调用WH_CBT Hook子程，这些事件包括：
           1. 激活，建立，销毁，最小化，最大化，移动，改变尺寸等窗口事件；
           2. 完成系统指令；
           3. 来自系统消息队列中的移动鼠标，键盘事件；
           4. 设置输入焦点事件；
           5. 同步系统消息队列事件。
        钩子函数的返回值确定系统是否允许或者防止这些操作中的一个。
     WH_DEBUG ：在系统调用系统中与其他Hook关联的Hook子程之前，系统会调用WH_DEBUG Hook子程。你可以使用这个Hook来决定是否允许系统调用与其他Hook关联的Hook子程。
     WH_FOREGROUNDIDLE ：当应用程序的前台线程处于空闲状态时，可以使用WH_FOREGROUNDIDLE Hook执行低优先级的任务。当应用程序的前台线程大概要变成空闲状态时，系统就会调用WH_FOREGROUNDIDLE Hook子程。
     WH_GETMESSAGE ：应用程序使用WH_GETMESSAGE Hook来监视从GetMessage or PeekMessage函数返回的消息。你可以使用WH_GETMESSAGE Hook去监视鼠标和键盘输入，以及其他发送到消息队列中的消息。
     WH_JOURNALPLAYBACK ：使应用程序可以插入消息到系统消息队列。可以使用这个Hook回放通过使用WH_JOURNALRECORD Hook记录下来的连续的鼠标和键盘事件。只要WH_JOURNALPLAYBACK Hook已经安装，正常的鼠标和键盘事件就是无效的。WH_JOURNALPLAYBACK Hook是全局Hook，它不能象线程特定Hook一样使用。WH_JOURNALPLAYBACK Hook返回超时值，这个值告诉系统在处理来自回放Hook当前消息之前需要等待多长时间（毫秒）。这就使Hook可以控制实时事件的回放。 WH_JOURNALPLAYBACK是system-wide local hooks，它們不會被注射到任何行程位址空間。（估计按键精灵是用这个hook做的）
    WH_JOURNALRECORD ： WH_JOURNALRECORD Hook用来监视和记录输入事件。典型的，可以使用这个Hook记录连续的鼠标和键盘事件，然后通过使用WH_JOURNALPLAYBACK Hook来回放。WH_JOURNALRECORD Hook是全局Hook，它不能象线程特定Hook一样使用。WH_JOURNALRECORD是system-wide local hooks，它們不會被注射到任何行程位址空間。
    WH_KEYBOARD ：在应用程序中，WH_KEYBOARD Hook用来监视WM_KEYDOWN and WM_KEYUP消息，这些消息通过GetMessage or PeekMessage function返回。可以使用这个Hook来监视输入到消息队列中的键盘消息。
    WH_KEYBOARD_LL ：WH_KEYBOARD_LL Hook监视输入到线程消息队列中的键盘消息。
    WH_MOUSE :WH_MOUSE Hook监视从GetMessage 或者 PeekMessage 函数返回的鼠标消息。使用这个Hook监视输入到消息队列中的鼠标消息。
    WH_MOUSE_LL ：WH_MOUSE_LL Hook监视输入到线程消息队列中的鼠标消息。
    WH_MSGFILTER 和 WH_SYSMSGFILTER Hooks ：WH_MSGFILTER 和 WH_SYSMSGFILTER Hooks使我们可以监视菜单，滚动条，消息框，对话框消息并且发现用户使用ALT+TAB or ALT+ESC 组合键切换窗口。WH_MSGFILTER Hook只能监视传递到菜单，滚动条，消息框的消息，以及传递到通过安装了Hook子程的应用程序建立的对话框的消息。WH_SYSMSGFILTER Hook监视所有应用程序消息。WH_MSGFILTER 和 WH_SYSMSGFILTER Hooks使我们可以在模式循环期间过滤消息，这等价于在主消息循环中过滤消息。通过调用CallMsgFilter function可以直接的调用WH_MSGFILTER Hook。通过使用这个函数，应用程序能够在模式循环期间使用相同的代码去过滤消息，如同在主消息循环里一样。
    WH_SHELL ：外壳应用程序可以使用WH_SHELL Hook去接收重要的通知。当外壳应用程序是激活的并且当顶层窗口建立或者销毁时，系统调用WH_SHELL Hook子程。WH_SHELL 共有５钟情況：
          1. 只要有个top-level、unowned 窗口被产生、起作用、或是被摧毁；
          2. 当Taskbar需要重画某个按钮；
          3. 当系统需要显示关于Taskbar的一个程序的最小化形式；
          4. 当目前的键盘布局状态改变；
          5. 当使用者按Ctrl+Esc去执行Task Manager（或相同级别的程序）。
     按照惯例，外壳应用程序都不接收WH_SHELL消息。所以，在应用程序能够接收WH_SHELL消息之前，应用程序必须调用SystemParametersInfo function注册它自己。

HOOK钩子机制学习笔记(2) - 钩子类型MSDN翻译整理

2011-04-23 10:34:53| 分类： c#——qq |字号订阅

从现在开始，介绍全部钩子类型，一共有15种。由于本人现在使用C#，所以将原文中的Function都翻译为了“方法”，实际上翻译为“函数”可能更准确。原文中的”callback function”翻译为“回调函数”。

Each type of hook enables an application to monitor a different aspect of the system's message-handling mechanism.

每种类型的钩子使应用程序能够监视系统的消息处理机制的不同方面。

钩子类型1-2：WH_CALLWNDPROC and WH_CALLWNDPROCRET Hooks

The WH_CALLWNDPROC and WH_CALLWNDPROCRET hooks enable you to monitor messages sent to window procedures. The system calls a WH_CALLWNDPROC hook procedure before passing the message to the receiving window procedure, and calls the WH_CALLWNDPROCRET hook procedure after the window procedure has processed the message.

WH_CALLWNDPROC 和 WH_CALLWNDPROCRET钩子使你能够监视发送到window程序的消息。系统在将消息传递给正在接收的window程序之前，调用 WH_CALLWNDPROC钩子子程；在window程序处理完消息之后，调用WH_CALLWNDPROCRET钩子子程。

The WH_CALLWNDPROCRET hook passes a pointer to a CWPRETSTRUCT structure to the hook procedure. The structure contains the return value from the window procedure that processed the message, as well as the message parameters associated with the message. Subclassing the window does not work for messages set between processes.

WH_CALLWNDPROCRET钩子将一个指向CWPRETSTRUCT结构的的指针传递给钩子子程。该结构包含有来自处理该消息的window程序的返回值，以及消息中的参数。子类窗体不能处理进程间的消息集。

钩子类型3：WH_CBT Hook

The system calls a WH_CBT hook procedure before activating, creating, destroying, minimizing, maximizing, moving, or sizing a window; before completing a system command; before removing a mouse or keyboard event from the system message queue; before setting the input focus; or before synchronizing with the system message queue. The value the hook procedure returns determines whether the system allows or prevents one of these operations. The WH_CBT hook is intended primarily for computer-based training (CBT) applications.

在以下事件发生之前，系统会调用WH_CBT 钩子子程：

1、窗台被激活、创建、销毁、最小化、最大化、移动或者改变大小；

2、执行完系统命令；

3、从系统消息队列中移除鼠标或者键盘事件；

4、设置输入焦点；

5、同步系统消息队列；

钩子子程的返回值决定了系统是允许了还是阻止了这些操作中的一个。WH_CBT钩子主要是用在基于计算机的练习(CBT) 程序中。

钩子类型4：WH_DEBUG Hook

The system calls a WH_DEBUG hook procedure before calling hook procedures associated with any other hook in the system. You can use this hook to determine whether to allow the system to call hook procedures associated with other types of hooks.

在调用与系统中任何其他钩子关联的钩子子程之前，系统会调用WH_DEBUG 钩子子程。使用该钩子来决定是否允许系统调用与其他类型的钩子相关联的钩子子程。

钩子类型5：WH_FOREGROUNDIDLE Hook

The WH_FOREGROUNDIDLE hook enables you to perform low priority tasks during times when its foreground thread is idle. The system calls a WH_FOREGROUNDIDLE hook procedure when the application's foreground thread is about to become idle.

WH_FOREGROUNDIDLE 钩子允许当前台线程空闲时，执行低权限的任务。系统在应用程序的前台线程即将空闲时，调用WH_FOREGROUNDIDLE钩子子程。

钩子类型6：WH_GETMESSAGE Hook

The WH_GETMESSAGE hook enables an application to monitor messages about to be returned by the GetMessage or PeekMessage function. You can use the WH_GETMESSAGE hook to monitor mouse and keyboard input and other messages posted to the message queue.

WH_GETMESSAGE程序允许应用程序监视即将由方法GetMessage 或者PeekMessage返回的消息。可以使用WH_GETMESSAGE钩子监视鼠标和键盘输入，以及其他传递给消息队列的消息。

钩子类型7：WH_JOURNALPLAYBACK Hook

The WH_JOURNALPLAYBACK hook enables an application to insert messages into the system message queue. You can use this hook to play back a series of mouse and keyboard events recorded earlier by using the WH_JOURNALRECORD Hook. Regular mouse and keyboard input is disabled as long as a WH_JOURNALPLAYBACK hook is installed. A WH_JOURNALPLAYBACK hook is a global hook — it cannot be used as a thread-specific hook.

The WH_JOURNALPLAYBACK hook returns a time-out value. This value tells the system how many milliseconds to wait before processing the current message from the playback hook. This enables the hook to control the timing of the events it plays back.

WH_JOURNALPLAYBACK钩子允许应用程序将消息插入到系统消息队列中。使用该钩子回放先前使用WH_JOURNALRECORD 钩子记录的一系列鼠标和键盘事件。在WH_JOURNALPLAYBACK被安装后，常规的鼠标和键盘输入被禁用。WH_JOURNALPLAYBACK 钩子是全局钩子，不能被用作线程钩子。WH_JOURNALPLAYBACK钩子返回一个超时值。该值告诉系统在处理来自回放钩子的当前消息之前等待了多少毫秒。这允许该钩子控制回放事件的速度。

钩子类型8：WH_JOURNALRECORD Hook

The WH_JOURNALRECORD hook enables you to monitor and record input events. Typically, you use this hook to record a sequence of mouse and keyboard events to play back later by using the WH_JOURNALPLAYBACK Hook. The WH_JOURNALRECORD hook is a global hook — it cannot be used as a thread-specific hook.

WH_JOURNALRECORD钩子允许监视并且记录输入事件。典型的，使用该钩子来记录顺序的的鼠标和键盘事件，以后可以使用WH_JOURNALPLAYBACK.钩子进行回放。该钩子是全局钩子，不能被用作进程钩子。

钩子类型9：WH_KEYBOARD_LL Hook

The WH_KEYBOARD_LL hook enables you to monitor keyboard input events about to be posted in a thread input queue.

WH_KEYBOARD_LL钩子监视在线程输入队列中，即将被传递的键盘输入事件。

钩子类型10：WH_KEYBOARD Hook

The WH_KEYBOARD hook enables an application to monitor message traffic for WM_KEYDOWN and WM_KEYUP messages about to be returned by the GetMessage or PeekMessage function. You can use the WH_KEYBOARD hook to monitor keyboard input posted to a message queue.

WH_KEYBOARD钩子允许应用程序监视即将被GetMessage 或者 PeekMessage方法返回的WM_KEYDOWN 或者 WM_KEYUP消息。使用WH_KEYBOARD钩子可以监视传递到消息队列中的键盘输入。

钩子类型11：WH_MOUSE_LL Hook

The WH_MOUSE_LL hook enables you to monitor mouse input events about to be posted in a thread input queue.

WH_MOUSE_LL钩子监视在线程输入队列中，即将被传递的鼠标输入事件。

钩子类型12：WH_MOUSE Hook

The WH_MOUSE hook enables you to monitor mouse messages about to be returned by the GetMessage or PeekMessage function. You can use the WH_MOUSE hook to monitor mouse input posted to a message queue.

WH_MOUSE钩子允许监视即将被GetMessage或者 PeekMessage方法返回的鼠标消息。使用该钩子监视传递到线程输入队列的鼠标输入。

HOOK钩子机制学习笔记(3) -

2011-04-23 10:35:35| 分类： c#——qq |字号订阅

下面是应用Hook时会用到的各种结构。

结构1：CBT_CREATEWND Structure

The CBT_CREATEWND structure contains information passed to a WH_CBT hook procedure, CBTProc, before a window is created.

该结构包含有：在一个窗口被创建之前传递给WH_CBT钩子子程，即CBTProc，的信息。

typedef struct {

LPCREATESTRUCT lpcs;

HWND hwndInsertAfter;

} CBT_CREATEWND, *LPCBT_CREATEWND;

Members成员

lpcs

Pointer to a CREATESTRUCT structure that contains initialization parameters for the window about to be created.

一个指向CREATESTRUCT结构的指针，该结构包含即将被创建的窗体的初始化参数。

hwndInsertAfter

Handle to the window whose position in the Z order precedes that of the window being created.

窗体的句柄，该窗体的Z轴位置在正在被创建的窗体的Z轴位置之前。

结构2：CBTACTIVATESTRUCT Structure

The CBTACTIVATESTRUCT structure contains information passed to a WH_CBT hook procedure, CBTProc, before a window is activated.

CBTACTIVATESTRUCT 结构包含在窗体被激活之前，传递给WH_CBT钩子子程CBTProc 的信息。

typedef struct {

BOOL fMouse;

HWND hWndActive;

} CBTACTIVATESTRUCT, *LPCBTACTIVATESTRUCT;

Members 成员

fMouse

Specifies whether the window is being activated as a result of a mouse click. This value is TRUE if a mouse click is causing the activation or FALSE if it is not.

指定窗体是否是由于鼠标的点击而导致被激活.如果是因为鼠标的点击而引发了窗体的激活，返回true，否则返回false。

hWndActive

Handle to the active window.

活动窗口的句柄。

结构3：CWPRETSTRUCT Structure

The CWPRETSTRUCT structure defines the message parameters passed to a WH_CALLWNDPROCRET hook procedure, CallWndRetProc.

CWPRETSTRUCT结构定义了传递给WH_CALLWNDPROCRET钩子子程CallWndRetProc的消息参数。

typedef struct {

LRESULT lResult;

LPARAM lParam;

WPARAM wParam;

UINT message;

HWND hwnd;

} CWPRETSTRUCT, *PCWPRETSTRUCT;

Members成员

lResult

Specifies the return value of the window procedure that processed the message specified by the message value.

指定了窗体程序的返回值，该窗体程序处理由 message 值指定的消息。

lParam / wParam

Specifies additional information about the message. The exact meaning depends on the message value.

指定消息的附加信息。附加的意义取决于message的值。

message

Specifies the message.

指定消息。

hwnd

Handle to the window that processed the message specified by the message value.

处理由message的值指定的消息的窗体的窗体句柄。

结构4：CWPSTRUCT Structure

The CWPSTRUCT structure defines the message parameters passed to a WH_CALLWNDPROC hook procedure, CallWndProc.

CWPSTRUCT 结构定义了传递给WH_CALLWNDPROC钩子子程CallWndProc的消息参数。

typedef struct {

LPARAM lParam;

WPARAM wParam;

UINT message;

HWND hwnd;

} CWPSTRUCT, *PCWPSTRUCT;

Members

lParam / wParam

Specifies additional information about the message. The exact meaning depends on the message value.

指定消息的附加信息。附加的意义取决于message的值。

message

Specifies the message.

指定消息

hwnd

Handle to the window to receive the message.

接收消息的窗体的句柄。

结构5：DEBUGHOOKINFO Structure

The DEBUGHOOKINFO structure contains debugging information passed to a WH_DEBUG hook procedure, DebugProc.

DEBUGHOOKINFO结构包含有传递给WH_DEBUG钩子子程DebugProc的调试信息。

typedef struct {

DWORD idThread;

DWORD idThreadInstaller;

LPARAM lParam;

WPARAM wParam;

int code;

} DEBUGHOOKINFO, *PDEBUGHOOKINFO;

Members成员

idThread

Handle to the thread containing the filter function.

包含过滤方法的线程的句柄。

idThreadInstaller

Handle to the thread that installed the debugging filter function.

安装调试过滤方法的线程的句柄。

lParam / wParam

Specifies the value to be passed to the hook in the lParam parameter of the DebugProc callback function.

指定在DebugProc回调函数的lParam/ wParam 参数中，要传递给钩子的值。

code

Specifies the value to be passed to the hook in the nCode parameter of the DebugProc callback function.

指定在DebugProc回调函数的nCode 参数中，要传递给钩子的值。

结构6：EVENTMSG Structure

The EVENTMSG structure contains information about a hardware message sent to the system message queue. This structure is used to store message information for the JournalPlaybackProc callback function.

该结构包含有关于硬件的消息，该消息被发送给系统的消息队列。该结构用来为JournalPlaybackProc回调函数存储消息的信息。

typedef struct {

UINT message;

UINT paramL;

UINT paramH;

DWORD time;

HWND hwnd;

} EVENTMSG, *PEVENTMSG;

Members成员

message

Specifies the message.

指定消息。

paramH / paramH

Specifies additional information about the message. The exact meaning depends on the message value.

指定消息的附加信息。附加的意义取决于message的值。

time

Specifies the time at which the message was posted.

消息被传递时的时间。

hwnd

Handle to the window to which the message was posted.

消息被传给的窗口的句柄。

结构7：KBDLLHOOKSTRUCT Structure

The KBDLLHOOKSTRUCT structure contains information about a low-level keyboard input event.

该结构包含有低层键盘输入事件的信息。

typedef struct {

DWORD vkCode;

DWORD scanCode;

DWORD flags;

DWORD time;

ULONG_PTR dwExtraInfo;

} KBDLLHOOKSTRUCT, *PKBDLLHOOKSTRUCT;

Members成员

vkCode

Specifies a virtual-key code. The code must be a value in the range 1 to 254.

指定虚拟键值。该值必须在1到254的范围内。

scanCode

Specifies a hardware scan code for the key.

指定键的硬件扫描码。

flags

Specifies the extended-key flag, event-injected flag, context code, and transition-state flag. This member is specified as follows. An application can use the following values to test the keystroke flags.

指定扩展键标志，事件注入标志，上下文代码，转换状态码。成员如下所示。应用程序可以使用下列值来检查键盘敲击标志。

Value值 Purpose目的

LLKHF_EXTENDED Test the extended-key flag. 测试扩展键标志。

LLKHF_INJECTED Test the event-injected flag. 测试事件注入标志。

LLKHF_ALTDOWN Test the context code. 测试上下文代码。

LLKHF_UP Test the transition-state flag. 测试转换状态码。

0 ：Specifies whether the key is an extended key, such as a function key or a key on the numeric keypad. The value is 1 if the key is an extended key; otherwise, it is 0.

指定该键是否是扩展键，例如：功能键、数字键盘上的键。是扩展键为1，否则为0。

1-3 ：Reserved. 保留。

4 ：Specifies whether the event was injected. The value is 1 if the event was injected; otherwise, it is 0.

指定事件是否被注入。被注入为1，否则为0。

5 ：Specifies the context code. The value is 1 if the ALT key is pressed; otherwise, it is 0.

指定上下文代码。如果按下了ALT，该值为1，否则为0

6 ：Reserved. 保留。

7 ：Specifies the transition state. The value is 0 if the key is pressed and 1 if it is being released.

指定转换状态。如果该键被按下该值为1，如果被释放为0。

time

Specifies the time stamp for this message, equivalent to what GetMessageTime would return for this message.

指定消息的时间戳，相当于GetMessageTime返回的值。

dwExtraInfo

Specifies extra information associated with the message.

指定和该消息相关联的扩展信息。

结构8 ：MOUSEHOOKSTRUCT Structure

T he MOUSEHOOKSTRUCT structure contains information about a mouse event passed to a WH_MOUSE hook procedure, MouseProc.

MOUSEHOOKSTRUCT结构包含有传递给WH_MOUSE钩子子程MouseProc的，关于鼠标事件的信息。

typedef struct {

POINT pt;

HWND hwnd;

UINT wHitTestCode;

ULONG_PTR dwExtraInfo;

} MOUSEHOOKSTRUCT, *PMOUSEHOOKSTRUCT;

Members成员

Specifies a POINT structure that contains the x- and y-coordinates of the cursor, in screen coordinates.

指定在屏幕坐标系下，包含有光标x、y坐标的POINT结构。

hwnd

Handle to the window that will receive the mouse message corresponding to the mouse event.

希望对鼠标事件做出响应、接收鼠标消息的窗体的句柄。

wHitTestCode

Specifies the hit-test value. For a list of hit-test values, see the description of the WM_NCHITTEST message.

指定点击测试值。查看WM_NCHITTEST消息可以得到值的列表。

dwExtraInfo

Specifies extra information associated with the message.

指定和该消息相关联的附加信息。

结构9：MOUSEHOOKSTRUCTEX Structure

The MOUSEHOOKSTRUCTEX structure contains information about a mouse event passed to a WH_MOUSE hook procedure, MouseProc.

MOUSEHOOKSTRUCTEX结构包含有传递给WH_MOUSE钩子子程MouseProc的关于鼠标事件的信息。

This is an extension of the MOUSEHOOKSTRUCT structure that includes information about wheel movement or the use of the X button.

这是对MOUSEHOOKSTRUCT的扩展。包含有滚轮的活动和X键的使用。

typedef struct {

MOUSEHOOKSTRUCT MOUSEHOOKSTRUCT;

DWORD mouseData;

} MOUSEHOOKSTRUCTEX, *PMOUSEHOOKSTRUCTEX;

Members成员

MOUSEHOOKSTRUCT

The members of a MOUSEHOOKSTRUCT structure make up the first part of this structure.

MOUSEHOOKSTRUCT结构的成员构成了该结构的前面部分。

mouseData

If the message is WM_MOUSEWHEEL, the HIWORD of this member is the wheel delta. The LOWORD is undefined and reserved. A positive value indicates that the wheel was rotated forward, away from the user; a negative value indicates that the wheel was rotated backward, toward the user. One wheel click is defined as WHEEL_DELTA, which is 120.

如果消息是WM_MOUSEWHEEL，该成员的HIWORD就是wheel delta。LOWORD做为保留未定义。正值表示滚轮向前旋转，即远离用户的方向；负值表示滚轮向后旋转，即朝向用户的方向。滚轮的点击被定义为 WHEEL_DELTA, 具体值为120。

If the message is WM_XBUTTONDOWN, WM_XBUTTONUP, WM_XBUTTONDBLCLK, WM_NCXBUTTONDOWN, WM_NCXBUTTONUP, or WM_NCXBUTTONDBLCLK, the HIWORD of mouseData specifies which X button was pressed or released, and the LOWORD is undefined and reserved. This member can be one or more of the following values. Otherwise, mouseData is not used.

如果消息是WM_XBUTTONDOWN, WM_XBUTTONUP, WM_XBUTTONDBLCLK, WM_NCXBUTTONDOWN, WM_NCXBUTTONUP, 或者 WM_NCXBUTTONDBLCLK, mouseData 的HIWORD值指定哪个X键被按下或者释放，LOWORD做为保留未定义。该成员可以是以下值中的一个或者多个。否则，mouseData未使用。

1．XBUTTON1 ：The first X button was pressed or released. 第一个X键被按下或者释放。

2．XBUTTON2 ：The second X button was pressed or released.第二个X键被按下或者释放。

结构9：MSLLHOOKSTRUCT Structure

The MSLLHOOKSTRUCT structure contains information about a low-level keyboard input event. （msdn错误）

该MSLLHOOKSTRUCT结构包含有低层键盘输入事件的信息。

typedef struct {

POINT pt;

DWORD mouseData;

DWORD flags;

DWORD time;

ULONG_PTR dwExtraInfo;

} MSLLHOOKSTRUCT, *PMSLLHOOKSTRUCT;

Members成员

Specifies a POINT structure that contains the x- and y-coordinates of the cursor, in screen coordinates.

指定在屏幕坐标系下，包含有光标x、y坐标的POINT结构。

mouseData

1．XBUTTON1：The first X button was pressed or released. 第一个X键被按下或者释放。

2．XBUTTON2 ：The second X button was pressed or released.第二个X键被按下或者释放。

flags

Specifies the event-injected flag. An application can use the following value to test the mouse flags.

指定事件注入标志。应用程序可以使用下列值来测试鼠标标志。

Value Purpose

LLMHF_INJECTED Test the event-injected flag.测试事件注入标志。

Specifies whether the event was injected. The value is 1 if the event was injected; otherwise, it is 0. 事件是否被注入。如果被注入，为 1，否则为0

1-15 ：Reserved.保留

time

Specifies the time stamp for this message.

消息的时间戳。

dwExtraInfo

Specifies extra information associated with the message.

消息的扩展信息。

HOOK钩子机制学习笔记(4) - 钩子函数说明

2011-04-23 10:38:52| 分类： c#——qq |字号订阅

通过SetWindowsHookEx方法安装钩子，该函数指定处理拦截消息的钩子函数（回调函数），可在钩子函数中自定义消息的处理，可修改消息或屏蔽消息。钩子函数的格式是固定为：

LRESULT CALLBACK CallBackProc(

Int nCode,

WPARAM wParam,

LPARAM lParam);

nCode参数说明:

[in] Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and must return the value returned by CallNextHookEx.

指定钩子子程是否必须处理该消息。如果nCode是HC_ACTION，钩子子程就必须处理该消息。如果nCode小于0，钩子子程就必须将该消息传递给 CallNextHookEx，自己不对消息进行进一步的处理，必须返回由CallNextHookEx 方法返回的返回值。

对于不同类型的钩子，其传入的参数也不一样，以下为各类钩子的参数说明：

1、WH_CALLWNDPROC

参数说明：

wParam ：[in] Specifies whether the message was sent by the current thread. If the message was sent by the current thread, it is nonzero; otherwise, it is zero.

指定消息是否由当前线程发出。如果消息是由当前线程发出的，该值就是非0；否则，就是0。

lParam ：[in] Pointer to a CWPSTRUCT structure that contains details about the message.

指向CWPSTRUCT结构的指针，该结构含有消息的细节信息。

返回值

If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx. If nCode is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_CALLWNDPROC hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.

如果nCode小于0，钩子子程必须返回由CallNextHookE方法返回的返回值。如果nCode大于等于0，强烈要求调用 CallNextHookEx方法，并返回由它返回的返回值；否则，其他已经安装了WH_CALLWNDPROC钩子的应用程序将收不到钩子通知，可能导致行为的错误。如果钩子子程没有调用CallNextHookEx方法,返回值应该为 0。

备注

The CallWndProc hook procedure can examine the message, but it cannot modify it. After the hook procedure returns control to the system, the message is passed to the window procedure.

CallWndProc钩子子程能够检查消息，但是不能修改消息。当钩子子程将控制权交还给系统之后，消息被传递给窗体程序。

2、WH_ CALLWNDPROCRET

在SendMessage方法被调用之后，系统调用CallWndRetProc方法。钩子子程能够检查、但是不能修改消息。

参数说明

wParam ：[in] Specifies whether the message is sent by the current process. If the message is sent by the current process, it is nonzero; otherwise, it is NULL.

指定消息是否由当前进程发出。如果消息是由当前进程发出的，wParam为非0；否则，为空。

lParam ：[in] Pointer to a CWPRETSTRUCT structure that contains details about the message.

指向CWPSTRUCT结构的指针，该结构含有消息的细节信息。

返回值

If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx. If nCode is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_CALLWNDPROCRET hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.

如果nCode小于0，钩子子程必须返回由CallNextHookE返回的返回值。如果nCode大于等于0，强烈要求调用 CallNextHookEx方法，并返回由它返回的返回值；否则，其他已经安装了WH_ CALLWNDPROCRET钩子的程序将收不到钩子通知，可能导致行为的错误。如果钩子子程没有调用CallNextHookEx方法,返回值应该为 0。

3、WH_CBT

系统在下列事件发生之前调用该方法：

1.激活、创建、销毁、最小化、最大化、移动窗体、改变窗体大小；

2.完成系统命令；

3.从系统消息队列中移除鼠标或者键盘事件；

4.设置键盘焦点；

5.同步系统消息队列。

CBT应用程序使用该钩子子程接收来自系统的有用的通知。

参数说明:

nCode ：[in] Specifies a code that the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.

指定一个码值，钩子子程使用该值来决定如何处理消息。如果nCode小于0，钩子子程就必须将该消息传递给CallNextHookEx方法，自己不对消息做进一步的处理，并且应该返回由CallNextHookEx方法返回的返回值。该参数可以是以下值中的一个：

1．HCBT_ACTIVATE ：The system is about to activate a window.

系统即将创建一个窗体。

2．HCBT_CLICKSKIPPED ：The system has removed a mouse message from the system message queue. Upon receiving this hook code, a CBT application must install a WH_JOURNALPLAYBACK hook procedure in response to the mouse message.

系统已经将一个鼠标消息从系统消息队列中移除。一旦收到该钩子代码，CBT应用程序必须安装一个WH_JOURNALPLAYBAC钩子子程来响应鼠标消息。

3．HCBT_CREATEWND ： A window is about to be created. The system calls the hook procedure before sending the WM_CREATE or WM_NCCREATE message to the window. If the hook procedure returns a nonzero value, the system destroys the window; the CreateWindow function returns NULL, but the WM_DESTROY message is not sent to the window. If the hook procedure returns zero, the window is created normally.

窗体即将被创建。系统在向窗体发出WM_CREATE 或者 WM_NCCREATE消息之前，调用该钩子子程。如果钩子子程返回非0值，表示系统销毁了窗体；CreateWindow方法返回Null，但是 WM_DESTROY消息并不发送给窗体。如果钩子子程返回0，表示窗体正常被创建。

At the time of the HCBT_CREATEWND notification, the window has been created, but its final size and position may not have been determined and its parent window may not have been established. It is possible to send messages to the newly created window, although it has not yet received WM_NCCREATE or WM_CREATE messages. It is also possible to change the position in the z-order of the newly created window by modifying the hwndInsertAfter member of the CBT_CREATEWND structure.

在 HCBT_CREATEWND通知的时候，窗体已经被创建了，但是它的最终的大小和位置可能还没有被确定，它的父窗体也可能没有被创建起来。虽然一个新创建的窗体可能还没有接收到WM_NCCREATE或者WM_CREATE消息，但是向它发送消息是可能的。通过修改CBT_CREATEWND 结构体的hwndInsertAfter成员，改变新创建窗体的在Z轴次序的位置也是可能的。

4．HCBT_DESTROYWND ：A window is about to be destroyed.

窗体即将被销毁。

5．HCBT_KEYSKIPPED ：The system has removed a keyboard message from the system message queue. Upon receiving this hook code, a CBT application must install a WH_JOURNALPLAYBACK hook procedure in response to the keyboard message.

系统已经从系统的消息队列中移除了一个键盘消息。一旦接收到该钩子代码，CBT应用程序必须安装一个WH_JOURNALPLAYBAC钩子来响应键盘消息。

6．HCBT_MINMAX ：A window is about to be minimized or maximized.

窗体即将被最小化或者最大化。

7．HCBT_MOVESIZE ：A window is about to be moved or sized.

窗体即将被移动或者重置大小。

8．HCBT_QS ：The system has retrieved a WM_QUEUESYNC message from the system message queue.

系统已经收到了一个来自系统消息队列的WM_QUEUESYNC消息。

9．HCBT_SETFOCUS ：A window is about to receive the keyboard focus.

窗体即将接收键盘焦点。

10．HCBT_SYSCOMMAND ：A system command is about to be carried out. This allows a CBT application to prevent task switching by means of hot keys.

系统命令即将被执行。这允许CBT程序阻止通过快捷键来进行任务切换。

wParam ：[in] Depends on the nCode parameter.

取决于参数 nCode

lParam ：[in] Depends on the nCode parameter.

取决于参数 nCode

返回值

The value returned by the hook procedure determines whether the system allows or prevents one of these operations. For operations corresponding to the following CBT hook codes, the return value must be 0 to allow the operation, or 1 to prevent it:

钩子子程的返回值取决于系统允许还是阻止这种操作。对于下列这些操作的CBT钩子代码，如果允许则返回值必须是0，如果阻止返回值必须是1。

HCBT_ACTIVATE ；HCBT_CREATEWND ；HCBT_DESTROYWND ；HCBT_MINMAX ；HCBT_MOVESIZE ；HCBT_SETFOCUS ；HCBT_SYSCOMMAND

For operations corresponding to the following CBT hook codes, the return value is ignored:

对于下列这些操作的CBT钩子代码，返回值被忽略

HCBT_CLICKSKIPPED ；HCBT_KEYSKIPPED ；HCBT_QS

4、WH_DEBUG

The DebugProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function before calling the hook procedures associated with any type of hook. The system passes information about the hook to be called to the DebugProc hook procedure, which examines the information and determines whether to allow the hook to be called.

DebugProc钩子子程是和SetWindowsHookEx方法一起使用的、程序定义的或者库定义的回调函数。系统在调用和任何类型钩子相关联的钩子子程之前调用该方法。系统将即将被调用的钩子的信息传递给DebugProc钩子子程，DebugProc钩子子程检查该信息，决定是否允许该钩子被调用。

参数说明：

nCode ：[in] Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx.

指定钩子子程是否必须处理该消息。如果nCode是HC_ACTION，钩子子程就必须处理该消息。如果nCode小于0，钩子子程就必须将该消息传递给 CallNextHookEx方法，自己对消息不做进一步处理，并且应该返回由CallNextHookEx方法返回的返回值。

wParam ：[in] Specifies the type of hook about to be called. This parameter can be one of the following values.

指定即将被调用的钩子类型。参数可以是下列之一：

1．WH_CALLWNDPROC ：Installs a hook procedure that monitors messages sent to a window procedure.

安装一个钩子子程来监视发送给窗体程序的消息。

2．WH_CALLWNDPROCRET ：Installs a hook procedure that monitors messages that have just been processed by a window procedure.

安装一个钩子子程来监视刚刚被窗体程序处理完的消息。

3．WH_CBT ：Installs a hook procedure that receives notifications useful to a computer-based training (CBT) application.

安装一个钩子子程来接收对CBT应用程序有用的通知。

4．WH_DEBUG ：Installs a hook procedure useful for debugging other hook procedures.

安装一个有用的钩子子程来调试其他钩子子程。

5．WH_GETMESSAGE ：Installs a hook procedure that monitors messages posted to a message queue.

安装一个钩子子程来监视传递给消息队列的消息。

6．WH_JOURNALPLAYBACK ：Installs a hook procedure that posts messages previously recorded by a WH_JOURNALRECORD hook procedure.

安装一个钩子子程来传递先前使用WH_JOURNALRECORD钩子子程记录的消息。

7．WH_JOURNALRECORD ：Installs a hook procedure that records input messages posted to the system message queue. This hook is useful for recording macros.

安装一个钩子子程来记录传递给系统消息队列的输入消息。该钩子用来记录宏很有用。

8．WH_KEYBOARD ：Installs a hook procedure that monitors keystroke messages.

安装一个钩子子程来监视键盘敲击消息。

9．WH_MOUSE Installs a hook procedure that monitors mouse messages.

安装一个钩子子程来监视鼠标消息。

10．WH_MSGFILTER ：Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages only for the application that installed the hook procedure.

安装一个钩子子程来监视下列输入事件的结果而产生的消息：对话框、消息框、菜单、滚动条。该钩子子程仅仅为安装该钩子子程的应用程序监视这些消息。

11．WH_SHELL ：Installs a hook procedure that receives notifications useful to a Shell application.

安装一个钩子子程来接收对加壳类应用程序有用的通知。

12．WH_SYSMSGFILTER ：Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages for all applications in the system.

安装一个钩子子程来监视下列输入事件的结果而产生的消息：对话框，消息框，菜单，滚动条。该钩子子程为系统中所有的应用程序监视这些消息。

lParam ：[in] Pointer to a DEBUGHOOKINFO structure that contains the parameters to be passed to the destination hook procedure.

指向DEBUGHOOKINFO结构的指针，该结构中含有传递给目标钩子子程的参数。

返回值

To prevent the system from calling the hook, the hook procedure must return a nonzero value. Otherwise, the hook procedure must call CallNextHookEx.

为了阻止系统调用该钩子，钩子子程必须返回一个非0值。否则，钩子子程必须调用CallNextHookEx方法。

5、WH_FOREGROUNDIDLE

The ForegroundIdleProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever the foreground thread is about to become idle.

ForegroundIdleProc钩子子程是和SetWindowsHookEx方法一起使用的、程序定义的或者库定义的回调函数。当前台线程即将变成空闲时，系统将调用该方法。

Parameters 参数

code ：[in] Specifies whether the hook procedure must process the message. If code is HC_ACTION, the hook procedure must process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx.

指定钩子子程是否必须处理消息。如果nCode是HC_ACTION，钩子子程就必须处理该消息。如果nCode小于0，钩子子程就必须将该消息传递给 CallNextHookEx方法，自己对消息不做进一步处理，并且应该返回由CallNextHookEx方法返回的返回值。

wParam ：This parameter is not used. 未使用

lParam ：This parameter is not used. 未使用

Return Value 返回值

If code is less than zero, the hook procedure must return the value returned by CallNextHookEx. If code is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_FOREGROUNDIDLE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.

如果nCode小于0，钩子子程必须返回由CallNextHookEx返回的返回值。如果nCode大于等于0，强烈要求调用 CallNextHookEx方法，并返回由它返回的返回值；否则，其他已经安装了WH_ CALLWNDPROCRET钩子的程序将收不到钩子通知，可能导致行为的错误。如果钩子子程没有调用CallNextHookEx方法,返回值应该是 0。

6、WH_GETMESSAGE

The GetMsgProc function is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever the GetMessage or PeekMessage function has retrieved a message from an application message queue. Before returning the retrieved message to the caller, the system passes the message to the hook procedure.

GetMsgProc是和SetWindowsHookEx方法一起使用的、程序定义的或者库定义的回调函数。无论什么时候，当GetMessage 或者 PeekMessage方法接收到来自应用程序消息队列的消息时，系统都会调用该方法。在将收到的消息返回给调用者之前，系统将消息传递给钩子子程。

Parameters 参数

code ： [in] Specifies whether the hook procedure must process the message. If code is HC_ACTION, the hook procedure must process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx.

wParam ：[in] Specifies whether the message has been removed from the queue. This parameter can be one of the following values.

指定消息是否已经被从队列中移除了。该参数可以是下列值中的一个：

1．PM_NOREMOVE ：Specifies that the message has not been removed from the queue. (An application called the function, specifying the PM_NOREMOVE flag.)

指定消息尚未从队列中移出。(应用程序在调用该方法的同时指定PM_NOREMOVE标志)

2．PM_REMOVE Specifies that the message has been removed from the queue. (An application called GetMessage, or it called the PeekMessage function, specifying the PM_REMOVE flag.)

指定消息已经被从队列中移除了。(程序调用GetMessage 或者PeekMessage方法的同时指定PM_REMOVE标志)

lParam ：[in] Pointer to an MSG structure that contains details about the message.

指向MSG结构的指针，结构中包含和消息相关的细节。

Return Value 返回值

If code is less than zero, the hook procedure must return the value returned by CallNextHookEx. If code is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_GETMESSAGE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.

如果参数code小于0，钩子子程必须返回由CallNextHookEx返回的返回值。如果参数code大于等于0，强烈要求调用 CallNextHookEx方法，并返回由该方法返回的返回值；否则，其他已经安装了WH_GETMESSAGE钩子的程序将收不到钩子通知，可能导致行为的错误。如果钩子子程没有调用CallNextHookEx方法,返回值应该是0

Remarks 备注

The GetMsgProc hook procedure can examine or modify the message. After the hook procedure returns control to the system, the GetMessage or PeekMessage function returns the message, along with any modifications, to the application that originally called it.

GetMsgProc钩子子程能够检查或者修改消息。在钩子子程将控制权交还给系统之后，GetMessage 或者PeekMessage方法将该消息以及任何修改都一起返回给最初调用它的应用程序。

7、WH_JOURNALPLAYBACK

The JournalPlaybackProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. Typically, an application uses this function to play back a series of mouse and keyboard messages recorded previously by the JournalRecordProc hook procedure. As long as a JournalPlaybackProc hook procedure is installed, regular mouse and keyboard input is disabled.

JournalPlaybackProc钩子子程是和SetWindowsHookEx方法一起使用的、程序定义的或者库定义的回调函数。典型的，应用程序使用该方法回放前期由JournalRecordProc钩子子程记录下来的一系列鼠标和键盘消息。只要JournalPlaybackProc钩子子程被安装，常规的鼠标和键盘输入将被禁用。

Parameters 参数

code ：[in] Specifies a code the hook procedure uses to determine how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.

指定钩子子程使用的代码，以决定如何处理该消息。如果参数code小于0，钩子子程不对其进行任何进一步的处理，必须将消息传递给CallNextHookEx方法，返回由CallNextHookEx方法返回的返回值。该参数可以是下列值之一：

1．HC_GETNEXT ：The hook procedure must copy the current mouse or keyboard message to the EVENTMSG structure pointed to by the lParam parameter.

钩子子程必须将当前鼠标或者键盘消息拷贝给由参数lParam指向的EVENTMSG结构。

2．HC_NOREMOVE ：An application has called the PeekMessage function with wRemoveMsg set to PM_NOREMOVE, indicating that the message is not removed from the message queue after PeekMessage processing.

应用程序已经调用带有指向PM_NOREMOVE的 wRemoveMsg 集合的PeekMessage方法，指示该消息在PeekMessage处理完毕后，没有从消息队列中移除。

3．HC_SKIP ：The hook procedure must prepare to copy the next mouse or keyboard message to the EVENTMSG structure pointed to by lParam. Upon receiving the HC_GETNEXT code, the hook procedure must copy the message to the structure.

钩子子程必须准备拷贝下一个鼠标或者键盘消息到由lParam 指向的 EVENTMSG结构。一旦接收到HC_GETNEXT代码，钩子子程必须将消息拷贝到结构体中。

4．HC_SYSMODALOFF ： A system-modal dialog box has been destroyed. The hook procedure must resume playing back the messages.

系统模式的对话框已经被销毁。钩子子程应该恢复回放消息。

5．HC_SYSMODALON ： A system-modal dialog box is being displayed. Until the dialog box is destroyed, the hook procedure must stop playing back messages.

系统模式的对话框正在被显示。钩子子程应该停止回放消息，直到对话框被销毁。

wParam ：This parameter is not used. 该参数未使用。

lParam ：[in] Pointer to an EVENTMSG structure that represents a message being processed by the hook procedure. This parameter is valid only when the code parameter is HC_GETNEXT.

指向EVENTMSG结构的指针，该结构代表正在被钩子子程处理的消息。只有当参数code是HC_GETNEXT时该参数才有效。

Return Value返回值

To have the system wait before processing the message, the return value must be the amount of time, in clock ticks, that the system should wait. (This value can be computed by calculating the difference between the time members in the current and previous input messages.) To process the message immediately, the return value should be zero. The return value is used only if the hook code is HC_GETNEXT; otherwise, it is ignored.

为了使系统在处理消息之前等待，该返回值应该是系统应该等待的时间数量，该值以时钟嘀嗒为单位（该值可以通过当前和前一个输入消息的time成员的差值来计算）。为了快速的处理该消息，返回值应该是0。只有当钩子代码是HC_GETNEXT时，返回值才有意义；否则，该参数被忽略。

Remarks 备注

A JournalPlaybackProc hook procedure should copy an input message to the lParam parameter. The message must have been previously recorded by using a JournalRecordProc hook procedure, which should not modify the message.

JournalPlaybackProc钩子子程应该拷贝一个输入消息到lparm参数。消息必须在先前已经使用JournalRecordProc钩子子程被记录了下来，JournalRecordProc钩子子程不应修改消息。

To retrieve the same message over and over, the hook procedure can be called several times with the code parameter set to HC_GETNEXT without an intervening call with code set to HC_SKIP.

为了一遍又一遍的得到同样的消息，钩子子程在将code参数设置为HC_GETNEXT的情况下，可以被调用多次，而不涉及将code参数设置为HC_SKIP的调用。

If code is HC_GETNEXT and the return value is greater than zero, the system sleeps for the number of milliseconds specified by the return value. When the system continues, it calls the hook procedure again with code set to HC_GETNEXT to retrieve the same message. The return value from this new call to JournalPlaybackProc should be zero; otherwise, the system will go back to sleep for the number of milliseconds specified by the return value, call JournalPlaybackProc again, and so on. The system will appear to be not responding.

如果参数code 是 HC_GETNEXT，而且返回值大于0，系统将休眠，休眠时间是返回值指定的毫秒数。当系统继续的时候，调用钩子子程，钩子子程通过将code设置为 HC_GETNEXT来重新得到同一个的消息。从新的JournalPlaybackProc调用得到的返回值应该是0；否则，系统将回到休眠状态，休眠时间是返回值指定的毫秒数，休眠过后再次调用JournalPlaybackProc，以此类推。系统看起来像没有响应一样。

Unlike most other global hook procedures, the JournalRecordProc and JournalPlaybackProc hook procedures are always called in the context of the thread that set the hook.

和其他全局的钩子子程不一样，JournalRecordProc 和JournalPlaybackProc钩子子程永远在设置该钩子的线程的上下文中被调用。

After the hook procedure returns control to the system, the message continues to be processed. If code is HC_SKIP, the hook procedure must prepare to return the next recorded event message on its next call.

在钩子子程将控制权交还给系统之后，消息被继续处理。如果code参数是HC_SKIP ,钩子子程必须准备在下一次调用时返回下一条记录的事件消息。

Install the JournalPlaybackProc hook procedure by specifying the WH_JOURNALPLAYBACK hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.

通过指定WH_JOURNALPLAYBACK钩子类型，以及一个钩子子程的指针(该子程在SetWindowsHookEx方法中被调用)来安装JournalPlaybackProc钩子子程。

If the user presses CTRL+ESC OR CTRL+ALT+DEL during journal playback, the system stops the playback, unhooks the journal playback procedure, and posts a WM_CANCELJOURNAL message to the journaling application.

在回放过程中，如果用户按下了 CTRL+ESC 或者 CTRL+ALT+DEL组合键，系统将停止回放，卸载回放钩子子程，传递一个WM_CANCELJOURNAL消息给记录应用程序。

If the hook procedure returns a message in the range WM_KEYFIRST to WM_KEYLAST, the following conditions apply:

如果钩子子程返回一个在WM_KEYFIRST到WM_KEYLAST范围内的消息，下列条件应用：

The paramL member of the EVENTMSG structure specifies the virtual key code of the key that was pressed.

EVENTMSG结构的paramL成员指定被按下键的虚拟键码。

The paramH member of the EVENTMSG structure specifies the scan code.

EVENTMSG结构的paramL成员指定扫描码。

There's no way to specify a repeat count. The event is always taken to represent one key event.

没有办法指定重复的计数。事件总是趋于代表一个键事件。

8、WH_JOURNALRECORD

The JournalRecordProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The function records messages the system removes from the system message queue. Later, an application can use a JournalPlaybackProc hook procedure to play back the messages.

JournalRecordProc钩子子程是与SetWindowsHookEx一起使用的、程序定义的或者库定义的回调函数。该方法记录系统从系统消息队列中移除的消息。过后，应用程序可以使用JournalPlaybackProc钩子子程回放这些消息。

Parameters 参数

code ：[in] Specifies how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.

指定如何处理消息。如果code小于0，钩子子程不对其进行任何进一步的处理，必须将消息传递给CallNextHookEx方法，并返回由CallNextHookEx方法返回的返回值。该参数可以是以下值之一：

1．HC_ACTION ： The lParam parameter is a pointer to an EVENTMSG structure containing information about a message removed from the system queue. The hook procedure must record the contents of the structure by copying them to a buffer or file.

参数lParam 是一个指向EVENTMSG结构的指针，该结构包含从系统队列中移除的消息的信息。钩子子程应该通过将消息信息拷贝到缓冲区中或者文件中来记录内容。

2．HC_SYSMODALOFF ：A system-modal dialog box has been destroyed. The hook procedure must resume recording.

系统模式对话框已经被销毁。钩子子程必须恢复纪录。

3．HC_SYSMODALON ：A system-modal dialog box is being displayed. Until the dialog box is destroyed, the hook procedure must stop recording.

系统模式对话框正在被显示。钩子子程应该停止记录，直到对话框被销毁。

wParam ：This parameter is not used. 该参数未使用。

lParam ：[in] Pointer to an EVENTMSG structure that contains the message to be recorded.

指向EVENTMSG结构的指针，其中包含即将被记录的消息。

Return Value 返回值

The return value is ignored. 被忽略。

Remarks 备注

A JournalRecordProc hook procedure must copy but not modify the messages. After the hook procedure returns control to the system, the message continues to be processed.

JournalRecordProc钩子子程应该复制而不是不修改消息。在钩子子程将控制全交还给系统后，消息将被继续处理。

A JournalRecordProc hook procedure does not need to live in a dynamic-link library. A JournalRecordProc hook procedure can live in the application itself.

JournalRecordProc钩子子程没必要生存在动态链接库中，可以在应用程序自身中生存。

Unlike most other global hook procedures, the JournalRecordProc and JournalPlaybackProc hook procedures are always called in the context of the thread that set the hook.

和其它全局钩子子程不一样，JournalRecordProca和 JournalPlaybackProc钩子子程总是在设置钩子的线程的上下文中被调用。

An application that has installed a JournalRecordProc hook procedure should watch for the VK_CANCEL virtual key code (which is implemented as the CTRL+BREAK key combination on most keyboards). This virtual key code should be interpreted by the application as a signal that the user wishes to stop journal recording. The application should respond by ending the recording sequence and removing the JournalRecordProc hook procedure. Removal is important. It prevents a journaling application from locking up the system by hanging inside a hook procedure.

安装有JournalRecordProc钩子子程的应用程序应该监视VK_CANCEL虚拟键码（在多数键盘上就是像CTRL+BREAK一样实现的组合键）。虚拟键值应该被应用程序解释为用户希望停止日志记录的信号。应用程序应该通过结束记录队列或者移除JournalRecordProc钩子子程来响应用户的信号。可移除性是重要的，可以防止日志应用程序由于钩子子程内部的挂起而引起的系统锁死。

This role as a signal to stop journal recording means that a CTRL+BREAK key combination cannot itself be recorded. Since the CTRL+C key combination has no such role as a journaling signal, it can be recorded. There are two other key combinations that cannot be recorded: CTRL+ESC and CTRL+ALT+DEL. Those two key combinations cause the system to stop all journaling activities (record or playback), remove all journaling hooks, and post a WM_CANCELJOURNAL message to the journaling application.

CTRL+BREAK组合键扮演着停止日志记录的信号的角色，这意味着CTRL+BREAK组合键不能被自我记录。既然CTRL+C组合键没有扮演这样的角色，它就可以被记录。还有其它2种组合键不能被记录： CTRL+ESC 和 CTRL+ALT+DEL。.这2种组合键引起系统停止所有日志活动(记录或者回放)，移除所有日志钩子，传递WM_CANCELJOURNAL消息给日志记录应用程序。

HOOK钩子机制学习笔记(4) - 钩子函数说明2

2011-04-23 10:39:34| 分类： c#——qq |字号订阅

9、WH_KEYBOARD_LL

The LowLevelKeyboardProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function every time a new keyboard input event is about to be posted into a thread input queue. The keyboard input can come from the local keyboard driver or from calls to the keybd_event function. If the input comes from a call to keybd_event, the input was "injected". However, the WH_KEYBOARD_LL hook is not injected into another process. Instead, the context switches back to the process that installed the hook and it is called in its original context. Then the context switches back to the application that generated the event.

LowLevelKeyboardProc钩子子程是同SetWindowsHookEx方法一起使用的、应用程序定义的或者库定义的回调函数。当每次有新的键盘输入事件即将被传递给一个线程输入队列时，系统会调用该方法。键盘输入可以来自本地键盘驱动，也可以来自对keybd_event事件的调用。如果输入来自对keybd_event事件的调用，那么输入是被“注入”的。然而，WH_KEYBOARD_LL钩子不被注入到其它进程中。因为上下文会切换回安装钩子的进程，该钩子就会在原始的上下文中被调用。然后，上下文切换回生成该事件的应用程序中。

Parameters参数

nCode ：[in] Specifies a code the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.

指定钩子子程使用的代码，钩子子程使用该值决定如何处理消息。如果nCode小于0，钩子子程必须将消息传递给CallNextHookEx方法，自己不做进一步的处理，并且要返回由方法CallNextHookEx返回的的返回值。该参数可以是下列值之一。

1．HC_ACTION ：The wParam and lParam parameters contain information about a keyboard message.

参数wParam和lParam包含有和键盘消息相关的信息。

wParam ：[in] Specifies the identifier of the keyboard message. This parameter can be one of the following messages: WM_KEYDOWN, WM_KEYUP, WM_SYSKEYDOWN, or WM_SYSKEYUP.

指定键盘消息的标识符。该参数可以是以下参数之一： WM_KEYDOWN, WM_KEYUP, WM_SYSKEYDOWN, or WM_SYSKEYUP.

lParam ： [in] Pointer to a KBDLLHOOKSTRUCT structure.

指向KBDLLHOOKSTRUCT结构的指针。

Return Value返回值

If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx. If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_KEYBOARD_LL hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.

如果nCode小于0，钩子子程必须返回由方法CallNextHookEx返回的返回值。如果nCode大于等于0，并且钩子子程还没有处理消息，强烈建议调用CallNextHookEx方法，返回有它返回的返回值；否则，其它已经安装了WH_KEYBOARD_LL 钩子的应用程序将接收不到钩子通知，可能导致行为的错误。如果钩子子程已经处理了该消息，将返回一个非0值来阻止系统将消息传递给钩子链表中的其他钩子，或者目的窗体程序。

Remarks备注

This hook is called in the context of the thread that installed it. The call is made by sending a message to the thread that installed the hook. Therefore, the thread that installed the hook must have a message loop.

钩子在安装它的线程的上下文中被调用。通过发送消息给安装该钩子的线程来实现调用。因此，安装有该钩子的线程必须有消息循环。

The hook procedure should process a message in less time than the data entry specified in the LowLevelHooksTimeout value in the following registry key:

HKEY_CURRENT_USER\Control Panel\Desktop

The value is in milliseconds. If the hook procedure does not return during this interval, the system will pass the message to the next hook.

Note that debug hooks cannot track this type of hook.

钩子子程应该用比下面时间少的时间来处理消息：在注册表的HKEY_CURRENT_USER\Control Panel\Desktop键的 LowLevelHooksTimeout值指定的时间，该值是以毫秒为单位的。如果钩子子程在这个间隔内没有返回，系统将把消息传递给下一个钩子。

注意：调试钩子不能跟踪该类型的钩子。

10、WH_KEYBOARD

The KeyboardProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever an application calls the GetMessage or PeekMessage function and there is a keyboard message (WM_KEYUP or WM_KEYDOWN) to be processed.

KeyboardProc钩子子程是同SetWindowsHookEx方法一起使用的、用户定义的或者库定义的回调函数。无论什么时候，当应用程序调用 GetMessage 或者 PeekMessage方法时，系统都调用该方法，将有一个键盘消息(WM_KEYUP或者 WM_KEYDOWN)被处理。

Parameters参数

code ： [in] Specifies a code the hook procedure uses to determine how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.

指定钩子子程使用的代码，来决定如何处理该消息。如果code小于0，钩子子程必须将该消息传递给CallNextHookEx方法，自己不进行任何进一步的处理，并且返回由CallNextHookEx方法返回的返回值。该参数可以是以下值之一：

1．HC_ACTION ：The wParam and lParam parameters contain information about a keystroke message.

参数 wParam 和 lParam 包含有键盘敲击消息的信息。

2．HC_NOREMOVE ：The wParam and lParam parameters contain information about a keystroke message, and the keystroke message has not been removed from the message queue. (An application called the PeekMessage function, specifying the PM_NOREMOVE flag.)

参数wParam和lParam包含有键盘敲击消息的信息，键盘敲击消息还没有被从消息队列中移除。(应用程序调用PeekMessage方法，同时指定PM_NOREMOVE标志。)

wParam ：[in] Specifies the virtual-key code of the key that generated the keystroke message.

指定生成键盘敲击消息的键的虚拟键码值。

lParam ：[in] Specifies the repeat count, scan code, extended-key flag, context code, previous key-state flag, and transition-state flag. This parameter can be one or more of the following values.

指定重复次数，扫描代码，扩展键标志，上下文代码，前期的键状态标志，转换状态标志。该参数可下列的一个或者多个值。

0-15 ： Specifies the repeat count. The value is the number of times the keystroke is repeated as a result of the user's holding down the key.

指定重复的次数。该值是，当用户持续按住一个键时，键盘敲击被重复的次数。

16-23 ：Specifies the scan code. The value depends on the OEM.

指定扫描代码。该值依赖于OEM。

24 ：Specifies whether the key is an extended key, such as a function key or a key on the numeric keypad. The value is 1 if the key is an extended key; otherwise, it is 0.

指定该值是否是一个扩展键，例如功能键或者数字键盘上的键。如果是扩展键，该值为1，否则为0。

25-28 ： Reserved.保留

29 ：Specifies the context code. The value is 1 if the ALT key is down; otherwise, it is 0.

指定上下文代码。如果ALT键被按下，该值为1，否则为0。

30 : Specifies the previous key state. The value is 1 if the key is down before the message is sent; it is 0 if the key is up.

指定前面的键状态。如果在消息发出之前该键被按下，值为1；如果键弹起，值为0。

31 ： Specifies the transition state. The value is 0 if the key is being pressed and 1 if it is being released.

指定转换状态。如果键正在被按下，该值为0，如果正在被释放，则为1。

Return Value 返回值

If code is less than zero, the hook procedure must return the value returned by CallNextHookEx. If code is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_KEYBOARD hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.

如果code小于0，钩子子程必须返回由CallNextHookEx返回的返回值。如果code大于等于0，表示钩子子程没有处理该消息，强烈要求调用 CallNextHookEx方法，并返回由它返回的返回值；否则，其它已经安装有WH_KEYBOARD钩子的应用程序将收不到钩子通知，可能导致行为的错误。如果钩子子程处理了该消息，可能返回一个非0值，用来阻止系统将该消息传递给钩子链表中的其它钩子或者目的窗体程序。

11、WH_MOUSE_LL

The LowLevelMouseProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system call this function every time a new mouse input event is about to be posted into a thread input queue. The mouse input can come from the local mouse driver or from calls to the mouse_event function. If the input comes from a call to mouse_event, the input was "injected". However, the WH_MOUSE_LL hook is not injected into another process. Instead, the context switches back to the process that installed the hook and it is called in its original context. Then the context switches back to the application that generated the event.

LowLevelMouseProc钩子子程是同SetWindowsHookEx方法一起使用的、应用程序定义的或者库定义的回调函数。系统在每次有新的鼠标输入事件即将被传递给线程输入队列时，调用该方法。鼠标输入可以来自本地鼠标驱动或者对mouse_event方法的调用。如果输入来自对 mouse_event的调用，该输入就是被“注入”。然而，WH_MOUSE_LL钩子不能被注入到其他进程。因为上下文会切换回安装该钩子的进程，该钩子会在原始的上下文中被调用。然后，上下文切换回生成该事件的应用程序中。

Parameters 参数

指定钩子子程使用的代码，用来决定如何处理消息。如果nCode小于0，钩子子程必须将消息传递给CallNextHookEx方法，自己不进行进一步的处理，并且应该返回由方法CallNextHookEx返回的返回值。参数可以是下列值之一：

1．HC_ACTION ：The wParam and lParam parameters contain information about a mouse message.

wParam 和 lParam 参数包含有鼠标消息的信息。

wParam ：[in] Specifies the identifier of the mouse message. This parameter can be one of the following messages: WM_LBUTTONDOWN, WM_LBUTTONUP, WM_MOUSEMOVE, WM_MOUSEWHEEL, WM_RBUTTONDOWN, or WM_RBUTTONUP.

指定鼠标消息的标识符。参数可以是以下消息之一： WM_LBUTTONDOWN, WM_LBUTTONUP, WM_MOUSEMOVE, WM_MOUSEWHEEL, WM_RBUTTONDOWN, WM_RBUTTONUP.

lParam ：[in] Pointer to an MSLLHOOKSTRUCT structure.

指向MSLLHOOKSTRUCT结构的指针。

Return Value 返回值

If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.

如果nCode小于0，钩子子程必须返回由方法CallNextHookEx返回的返回值。

If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_MOUSE_LL hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.

如果nCode大于等于0，而且钩子子程没有处理该消息，那么强烈要求调用方法CallNextHookEx并返回由它返回的返回值；否则，其它已经安装了WH_MOUSE_LL钩子的应用程序将收不到钩子通知，可能导致行为的错误。如果钩子子程已经处理了该消息，将返回一个非0值，用来阻止系统将消息传递给钩子链表中的其它钩子或者目标窗体程序。

Remarks 备注

An application installs the hook procedure by specifying the WH_MOUSE_LL hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.

应用程序通过下面的方法安装该钩子子程：指定WH_MOUSE_LL钩子类型；指定在调用SetWindowsHookEx的方法中的指向钩子子程的指针。

该钩子在安装它的线程的上下文中被调用。通过发送消息给安装钩子的线程来实现调用。因此，安装钩子的线程必须有消息循环。

The hook procedure should process a message in less time than the data entry specified in the LowLevelHooksTimeout value in the following registry key:

HKEY_CURRENT_USER\Control Panel\Desktop

The value is in milliseconds. If the hook procedure does not return during this interval, the system will pass the message to the next hook.

Note that debug hooks cannot track this type of hook.

钩子子程应该用比下面时间少的时间来处理消息：在注册表的HKEY_CURRENT_USER\Control Panel\Desktop键的 LowLevelHooksTimeout值指定的时间。该值是以毫秒为单位的。如果钩子子程在这个间隔没有返回，系统将把消息传递给下一个钩子。注意：调试钩子不能追踪该类型的钩子。

12、WH_MOUSE

The MouseProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever an application calls the GetMessage or PeekMessage function and there is a mouse message to be processed.

MouseProc钩子子程是同SetWindowsHookEx方法一起使用的、应用程序定义的或者库定义的回调函数。无论什么时候，当应用程序一调用GetMessage 或者 PeekMessage方法，有鼠标消息即将被处理时，系统调用该方法。

Parameters 参数

指定钩子子程使用的用来决定如何处理消息的码值。如果nCode小于0，钩子子程必须将消息传递给CallNextHookEx方法，自己不进行进一步的处理，并且要返回由CallNextHookEx方法返回的返回值。该参数可以是下列值之一：

1．HC_ACTION ：The wParam and lParam parameters contain information about a mouse message.

参数wParam 和 lParam包含和鼠标消息相关的信息。

2．HC_NOREMOVE ：The wParam and lParam parameters contain information about a mouse message, and the mouse message has not been removed from the message queue. (An application called the PeekMessage function, specifying the PM_NOREMOVE flag.)

参数wParam 和 lParam包含和鼠标消息相关的信息，鼠标消息还没有从消息队列中移除。

wParam ：[in] Specifies the identifier of the mouse message.

指定鼠标消息的标识符。

lParam：[in] Pointer to a MOUSEHOOKSTRUCT structure.

指向MOUSEHOOKSTRUCT结构的指针。

Return Value 返回值

If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx. If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_MOUSE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the target window procedure.

如果code小于0，钩子子程必须返回由CallNextHookEx方法返回的返回值。如果code大于等于0，钩子子程还没有处理该消息，强烈要求调用CallNextHookEx方法并返回由它返回的返回值；否则，其它已经安装了WH_MOUSE钩子的应用程序将收不到钩子通知，可能导致行为的错误。如果钩子子程已经处理了该消息，应该返回非0值，以阻止系统将消息传递给钩子链表中剩余的钩子或者目标窗体程序。

Remarks备注

An application installs the hook procedure by specifying the WH_MOUSE hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function. The hook procedure must not install a WH_JOURNALPLAYBACK Hook callback function.

应用程序通过下面方法来安装钩子：指定WH_MOUSE钩子类型；指定在调用SetWindowsHookEx的方法中指向钩子子程的指针。该钩子子程不应安装WH_JOURNALPLAYBACK钩子的回调函数。

13、WH_SHELL

The ShellProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The function receives notifications of Shell events from the system.

The HOOKPROC type defines a pointer to this callback function. ShellProc is a placeholder for the application-defined or library-defined function name.

ShellProc钩子子程是同SetWindowsHookEx一起使用的、应用程序定义的或者库定义的回调函数。该方法接收来自系统的加壳事件通知。HOOKPROC类型定义了指向该方法的指针。ShellProc是应用程序定义的或者库定义的方法的名字。

Parameters参数

nCode ：[in] Specifies the hook code. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.

指定钩子代码。如果nCode小于0，钩子子程必须将消息传递给CallNextHookEx方法，自己不进行进一步的处理，并且应该返回由CallNextHookEx方法返回的返回值。该参数可以是下列值：

1．HSHELL_ACCESSIBILITYSTATE

Windows 2000/XP: The accessibility state has changed. 可访问性已经改

2．HSHELL_ACTIVATESHELLWINDOW

The shell should activate its main window. 外壳应该激活它的主窗口。

3．HSHELL_APPCOMMAND

Windows 2000/XP: The user completed an input event (for example, pressed an application command button on the mouse or an application command key on the keyboard), and the application did not handle the WM_APPCOMMAND message generated by that input.

用户完成一个输入事件(例如，按下应用程序鼠标上的命令按钮或者键盘上的命令键)，应用程序没有处理由该输入产生的WM_APPCOMMAND 消息。

If the Shell procedure handles the WM_COMMAND message, it should not call CallNextHookEx. See the Return Value section for more information.

如果Shell子程获得了WM_COMMAND消息的句柄，不应该调用CallNextHookEx 。

4．HSHELL_GETMINRECT

A window is being minimized or maximized. The system needs the coordinates of the minimized rectangle for the window.

窗口正在被最小化或者最大化。系统需要窗体的最小矩形框的坐标。

5．HSHELL_LANGUAGE

Keyboard language was changed or a new keyboard layout was loaded.

键盘语言被改变了或者新的键盘布局被加载了。

6．HSHELL_REDRAW

The title of a window in the task bar has been redrawn.

任务栏中的窗口标题被重绘了。

7．HSHELL_TASKMAN

The user has selected the task list. A shell application that provides a task list should return TRUE to prevent Microsoft Windows from starting its task list.

用户选择了任务列表。提供了任务列表的加壳应用程序应该返回TRUE,来阻止windows启动任务列表。

8．HSHELL_WINDOWACTIVATED

The activation has changed to a different top-level, unowned window.

激活动作变成了不同的top-level，unowned 的窗口。(即，激活了不同的不明窗口，使其处于最上层。)

9．HSHELL_WINDOWCREATED

A top-level, unowned window has been created. The window exists when the system calls this hook.

顶层的、不受控制的窗体已经被创建。当系统调用该钩子时，窗口存在。

10．HSHELL_WINDOWDESTROYED

A top-level, unowned window is about to be destroyed. The window still exists when the system calls this hook.

顶层的、不受控制的窗体即将被销毁。当系统调用该钩子的时候该窗体依然存在。

11．HSHELL_WINDOWREPLACED

Windows XP: A top-level window is being replaced. The window exists when the system calls this hook.

在Windows XP环境下，顶层的窗体正在被替换掉。当系统调用该钩子时，窗口存在。

wParam [in] The value depends on the value of the nCode parameter, as shown in the following table.

该值取决于参数 nCode ，如下表所示。

---------------------------------------------------------------------------------------

| nCode |wParam |

---------------------------------------------------------------------------------------

| HSHELL_ACCESSIBILITYSTATE |Windows 2000/XP: Indicates which accessibility |

| |feature has changed state. This value is one |

| |of the following: ACCESS_FILTERKEYS, |

| |ACCESS_MOUSEKEYS, or ACCESS_STICKYKEYS. |

| | |

| |在Windows XP 环境下：指示哪种访问特征已经被改变 |

| |了状态。值可以是下列之一：ACCESS_FILTERKEYS, |

| |ACCESS_MOUSEKEYS, ACCESS_STICKYKEYS. |

---------------------------------------------------------------------------------------

|HSHELL_APPCOMMAND |Windows 2000/XP: Where the WM_APPCOMMAND |

| |message was originally sent; for example, the |

| |handle to a window. |

| | |

| |是WM_APPCOMMAND消息最初发出的位置，例如，窗口的 |

| |句柄。 |

---------------------------------------------------------------------------------------

|HSHELL_GETMINRECT |Handle to the minimized or maximized window. |

| |最小化或者最大化的窗体的句柄。 |

---------------------------------------------------------------------------------------

|HSHELL_LANGUAGE |Handle to the window.窗口句柄。 |

---------------------------------------------------------------------------------------

|HSHELL_REDRAW |Handle to the redrawn window.重化窗口句柄。 |

---------------------------------------------------------------------------------------

|HSHELL_WINDOWACTIVATED |Handle to the activated window.活动窗口句柄。 |

---------------------------------------------------------------------------------------

|HSHELL_WINDOWCREATED |Handle to the created window.被创建的窗口的句柄。 |

--------------------------------------------------------------------------------------- |

|HSHELL_WINDOWDESTROYED |Handle to the destroyed window.被销毁的窗口的句柄。 |

---------------------------------------------------------------------------------------

|HSHELL_WINDOWREPLACED |Windows XP: Handle to the window being replaced. |

| |即将被替换的窗体的句柄。 |

---------------------------------------------------------------------------------------

lParam [in] The value depends on the value of the nCode parameter, as shown in the following table.

该值取决于参数nCode。如下表所示。

--------------------------------------------------------------------------------------------------------------

|nCode | lParam |

| | |

|HSHELL_APPCOMMAND | Windows 2000/XP:GET_APPCOMMAND_LPARAM(lParam) is the application |

| | command corresponding to the input event. |

| | GET_APPCOMMAND_LPARAM是对输入事件做出响应的应用程序命令。 |

| | |

| | GET_DEVICE_LPARAM(lParam) indicates what generated the input |

| | event; for example, the mouse or keyboard. |

| | GET_DEVICE_LPARAM指示是什么生成了输入事件。例如，鼠标或者键盘。 |

| | |

| | GET_FLAGS_LPARAM(lParam) depends on the value of cmd in |

| | WM_APPCOMMAND. For example, it might indicate which virtual keys |

| | were held down when the WM_APPCOMMAND message was originally sent. |

| | GET_FLAGS_LPARAM(lParam)依赖于 WM_APPCOMMAND中CMD的值。例如，可以 |

| | 指示当WM_APPCOMMAND消息被发出的时候，哪个虚拟键被按下。 |

--------------------------------------------------------------------------------------------------------------

|HSHELL_GETMINRECT | Pointer to a RECT structure. RECT结构的指针 |

--------------------------------------------------------------------------------------------------------------

|HSHELL_LANGUAGE | Handle to a keyboard layout. 键盘布局的句柄。 |

--------------------------------------------------------------------------------------------------------------

|HSHELL_REDRAW | The value is TRUE if the window is flashing, or FALSE otherwise. |

| | 如果窗口正在闪烁（重绘过程中），该值为true，其他为false |

--------------------------------------------------------------------------------------------------------------

|HSHELL_WINDOWACTIVATED | The value is TRUE if the window is in full-screen mode, or FALSE otherwise.|

| | 如果窗体处于全屏模式，该值是true，否则为false。 |

--------------------------------------------------------------------------------------------------------------

|HSHELL_WINDOWREPLACED | Windows XP: Handle to the new window.新窗体的句柄。 |

--------------------------------------------------------------------------------------------------------------

Return Value返回值

The return value should be zero unless the value of nCode is HSHELL_APPCOMMAND and the shell procedure handles the WM_COMMAND message. In this case, the return should be nonzero.

如果nCode的值是HSHELL_APPCOMMAND，shell子程句柄指向WM_COMMAND 消息，在这种情况下，返回值是非0。其他情况下，返回值是0。

Remarks备注

Install this hook procedure by specifying the WH_SHELL hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.

通过指定WH_SHELL 钩子类型以及在SetWindowsHookEx的方法中的指向钩子子程的指针来安装该钩子子程。

14、WH_SYSMSGFILTER

The SysMsgProc hook procedure is a library-defined callback function used with the SetWindowsHookEx function. The system calls this function after an input event occurs in a dialog box, message box, menu, or scroll bar, but before the message generated by the input event is processed. The function can monitor messages for any dialog box, message box, menu, or scroll bar in the system.

SysMsgProc钩子子程是同SetWindowsHookEx一起使用的在库中定义的回调函数。在对话框、消息框、菜单、滚动条中所属的输入事件发生后，在这些消息被系统处理之前，系统调用该方法。该方法能够为系统中任何对话框、消息框、菜单、滚动条监视消息。

Parameters参数

nCode [in] Specifies the type of input event that generated the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.

指定生成该消息的输入事件的类型。如果nCode小于0，钩子子程必须将消息传递给CallNextHookEx方法，自己不进行进一步的处理，并且应该返回由CallNextHookEx方法返回的返回值。。该参数可以是以下值之一：

1．MSGF_DIALOGBOX ：The input event occurred in a message box or dialog box.

输入事件在消息框或者对话框中发生。

2．MSGF_MENU ：The input event occurred in a menu.

输入事件在菜单中发生。

3．MSGF_SCROLLBAR ：The input event occurred in a scroll bar.

输入事件在滚动条中发生。

wParam ：This parameter is not used. 该参数未使用。

lParam ：[in] Pointer to an MSG message structure.指向MSG消息结构的指针。

Return Value 返回值

If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.

If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_SYSMSGFILTER hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the target window procedure.

如果nCode小于0，钩子子程必须返回由CallNextHookEx方法返回的返回值。如果nCode大于等于0，并且钩子子程还没有处理该消息，强烈要求调用CallNextHookEx方法并返回由它返回的返回值。否则，其他已经安装了WH_SYSMSGFILTER钩子的应用程序将接收不到钩子通知，可能导致行为错误。如果钩子子程已经处理了该消息，应该返回非0 值，来阻止系统将消息传递给目标窗体程序。

Remarks备注

An application installs the hook procedure by specifying the WH_SYSMSGFILTER hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.

应用程序安装该钩子通过：指定WH_SYSMSGFILTER钩子类型；指定在调用SetWindowsHookEx方法的指向钩子子程的指针。

15、WH_MSGFILTER

The MessageProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function after an input event occurs in a dialog box, message box, menu, or scroll bar, but before the message generated by the input event is processed. The hook procedure can monitor messages for a dialog box, message box, menu, or scroll bar created by a particular application or all applications.

The HOOKPROC type defines a pointer to this callback function. MessageProc is a placeholder for the application-defined or library-defined function name.

Syntax

LRESULT CALLBACK MessageProc( int code,

WPARAM wParam,

LPARAM lParam

);

Parameters

code

[in] Specifies the type of input event that generated the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and return the value returned by CallNextHookEx. This parameter can be one of the following values.

MSGF_DDEMGR

The input event occurred while the Dynamic Data Exchange Management Library (DDEML) was waiting for a synchronous transaction to finish. For more information about DDEML, see Dynamic Data Exchange Management Library.

MSGF_DIALOGBOX

The input event occurred in a message box or dialog box.

MSGF_MENU

The input event occurred in a menu.

MSGF_SCROLLBAR

The input event occurred in a scroll bar.

wParam

This parameter is not used.

lParam

[in] Pointer to an MSG structure.

Return Value

If code is less than zero, the hook procedure must return the value returned by CallNextHookEx.

If code is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_MSGFILTER hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.

Remarks

An application installs the hook procedure by specifying the WH_MSGFILTER hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.

If an application that uses the DDEML and performs synchronous transactions must process messages before they are dispatched, it must use the WH_MSGFILTER hook.

hook的基础学习,需要什么软件. VB里有钩子函数吗，VB钩子函数就是API吗。VB钩子函数哪里学习它如何做学习笔记司法鉴定学习笔记范文学习型班组学习笔记查找先进性教育的学习笔记牛津9A学习笔记 PRO-E的学习笔记怎么写团章学习笔记？求一学习笔记软件哪里有英语学习笔记？ PRO-E的学习笔记高中怎样做学习笔记 [Delphi]学习HOOK中遇到的问题,提示：内存不能为Read，请高手赐教求中级物流师的学习笔记有机化学学习笔记这本书有吗？钩子是什么? 线程钩子试论企业团体学习平台和机制的构建有学习好笔记写得好的重点高中学生我要买高二高三的英语课堂笔记党员开展先进性教育的学习笔记及心得的网址 Internet IntraWeb开发学习笔记（三）b.htm 哪里有PowerPoint格式的学习笔记下载? 用于学习笔记/反思日记的管理有那些？