Detailed usage of VB hook (Hook) Super invincible

Hook is a message processing mechanism provided by windows. It allows programmers to use sub-processes to monitor system messages and process messages before they reach the target.
The following describes winndows hooks and how to use it in a Windows program.

About hooks
Using Hook will reduce the system efficiency because it increases the workload for the system to process messages. We recommend that you use the hook only when necessary and immediately remove the hook after message processing is complete.

Hook chain
Windows provides several different types of hooks. Different hooks can process different messages. For example, the wh_mouse hook is used to monitor mouse messages.
Windows maintains their respective hooks for these hooks. A hook chain is a callback function queue defined by an application. When a message of a type occurs, Windows sends the message to the first function of the hook chain, after the first function completes processing the message, the function transmits the message to the next function in the linked list, in turn down. If a function in the chain does not send the message downward, the function following the chain table will not receive the message. (For some types of hooks, no matter whether or not the functions in the hook chain send messages downward, all hook functions associated with this type will receive messages sent by the system)

Hook Process
To intercept specific messages, you can use the setwindowshookex function to install your own hook function in this type of hook chain. The function syntax is as follows:
Public Function myhook (ncode, wparam, iparam) as long
'Add code
End Function
Myhook can be named at will, and others cannot be changed. This function must be placed in the module section. Ncode specifies the hook type. The value of wparam and iparam varies with ncode. It represents a specific action of a certain type of hook.
Setwindowshookex always places your hook function at the top of the hook chain. You can use the callnexthookex function to pass system messages to the next function in the hook chain.
[Comment] for some types of hooks, the system will send messages to all hook functions of the class. In this case, the callnexthookex statement in the hook function will be ignored.
The global hook function can intercept a specific message from all threads in the system (in this case, the hook function must be placed in the DLL ), the local hook function can intercept a specific message of a specified Thread (this hook function can be placed in DLL or application module segment ).
[Note] we recommend that you use the global hook function only during debugging. The global hook function reduces system efficiency and conflicts with other applications that use this type of hook.

Hook type
Wh_callwndproc and wh_callwndprocret hook
Wh_c allwndproc and wh_callwndprocret Hook can monitor the messages sent by sendmessage. The system calls wh_callwndproc before sending a message to the form process. After processing the message, the system calls wh_callwndprocret.
The wh_callwndprocret hook transmits a cwpretstruct structure address to the hook process. This structure contains some information after the form process processes system messages.
Wh_cbt hook
The system is activating, creating, destroying, minimizing, maximizing, moving, and changing the form. Before completing a system command, move the mouse or keyboard event from the system message queue; the wh_cbt hook is called before setting the input focus or before synchronizing the system message queue. You can intercept this type of hook during your hook process and return a value to tell the system whether to continue the above operation.
Wh_debug hook
The system will call wh_debug before calling the hook process associated with a certain hook type. The application can use this hook to determine whether to allow the system to execute a certain type of hook.
Wh_foregroundidle hook
The system calls this hook when idle, and executes applications with lower priority in the background.
Wh_getmessage hook
Wh_getmessage hook allows the application to intercept messages of getmessage or peekmessage. The application uses the wh_getmessage hook to monitor the mouse, keyboard input, and other messages sent to the queue.
Wh_journalrecord hook
Wh_journalrecord hook enables applications to monitor input events. Typically, applications use this hook to record mouse and keyboard input events for future playback. The hook is a global hook and cannot be used in a specified thread.
Wh_journalplayback hook
The 'wh_journalplayback hook enables applications to insert messages to the system message queue. This Hook can play back previous mouse and keyboard input events recorded by the wh_journalrecord hook. When the wh_journalplayback hook is installed on the system, the mouse and keyboard input events are blocked. The hook is also a global hook and cannot be used in the specified thread.
The wh_journalplayback hook returns a pause time value, which tells the system that the system waits for several percent of the message to be played back. This allows the hook to control the time events during playback.
Wh_keyboard hook
Wh_keyboard hook enables applications to monitor wm_keydown and wm_keyup messages returned by getmessage and peekmessage. The application uses this hook to monitor the keyboard input sent to the message queue.
Wh_mouse hook
Wh_mouse hook allows the application to monitor messages returned by getmessage and peekmessage. The application uses this hook to monitor mouse input sent to the message queue.
Wh_msgfilter and wh_sysmsgfilter hooks
Wh_msgfilter and wh_sysmsgfilter hooks allow applications to monitor menus, scroll bars, message boxes, and dialog boxes. When you use Alt + TAB or Alt + ESC to switch the form, the hook can also intercept messages. Wh_msgfilter only monitors the menu, scroll bar, message box, and dialog box in the application, while wh_sysmsgfilter can monitor these events in all applications in the system.
Wh_shell hook
A shell program can use the wh_shell hook to receive important information. When a shell program is activated or the current form is created or destroyed, the system calls the wh_shell hook process.
Use hook
Installation and destruction of hook Processes
Monitor System Events

Installation and destruction of hook Processes
Use the setwindowshookex function to specify the hook type, whether the hook process is global or local, and the entry point of the hook process, you can easily install your own hook process.

Declare function setwindowshookex lib "USER32" alias "setwindowshookexa "_
(Byval idhook as long ,_
Byval lpfn as long ,_
Byval hmod as long ,_
Byval dwthreadid as long) as long

Which of the following types of hooks is an idhook?
Public const wh_callwndproc = 4
Public const wh_callwndprocret = 12
Public const wh_cbt = 5
Public const wh_debug = 9
Public const wh_foregroundidle = 11
Public const wh_getmessage = 3
Public const wh_hardware = 8
Public const wh_journalplayback = 1
Public const wh_journalrecord = 0
Public const wh_keyboard = 2
Public const wh_mouse = 7
Public const wh_msgfilter = (-1)
Public const wh_shell = 10
Public const wh_sysmsgfilter = 6

Lpfn represents the address of the hook function, which is a callback fucnction. When a hook is attached, we need to define a function to process its function when it is generated as a message, the hook function has a certain parameter format.

Private function hookfunc (byval ncode as long ,_
Byval wparam as long ,_
Byval lparam as long) as long

Ncode indicates what kind of hooks are generated under different conditions. different sets of possible values vary with the hooks.
The value returned by wparam lparam varies with the type of the hook and the value of ncode.
Because this parameter is the address of a function, we will put the hook function in. Bas and pass it in as addressof hookfunc. The name of the hook function can be arbitrarily specified, not necessarily hookfunc.

Hmod stands. DLL hinstance. If it is a local Hook, the value can be null (0 can be passed in VB). If it is a remote Hook, you can use getmodulehandle (". DLL name.

Dwthreadid indicates the threadid for executing the hook. If it is not set to the thread, 0 is passed (so in general, the remote hook is passed to 0), while the local hook of VB is generally passed to the app. threadid.

Value return value if setwindowshookex () is successful, it returns a value representing the current hook handle, which must be recorded.

Because program a can have a system hook (Remote hook), such as a keyboard hook, and program B also sets a remote keyboard Hook, who intercepts the keyboard information? The answer is, the last one is intercepted. That is to say, a performs keyboard hook first, and B does later. Then the message is intercepted by B. What about? It depends on how the hook function of B is implemented. If B wants a's hook function to get the same message, B needs to call callnexthookex () to pass the message to A, and thus generate a line of hook. If B does not want to pass this message to a, do not call callnexthookex ().

Declare function callnexthookex lib "USER32" alias "callnexthookex "_
(Byval hhook as long ,_
Byval ncode as long ,_
Byval wparam as long ,_
Lparam as any) as long

The hhook value is the return value of setwindowshookex (). ncode, wparam, and lparam are three parameters in hook procedure.

Finally, remove the hook. Please call unhook?whookex ()

Declare function unhookwindowshookex lib "USER32" alias "unhookwindowshookex "_
(Byval hhook as long) as long

Hhook is the return value of setwindowshookex. In this case, if program B ends the hook, A can directly intercept the message.

Example of keyboard hook

Three arguments of the hook function

Ncode wparam lparam Return Value
========================================================== ======================================
Hc_action table keys: Virtual key and wm_keydown. if the message is to be processed, 0 is passed.
Or vice versa: 1
Hc_noremove

Public hhook as long

Public sub unhookkbd ()
If hnexthookproc <> 0 then
Unhookwindowshookex hhook
Hhook = 0
End if
End sub

Public Function enablekbdhook ()
If hhook <> 0 then
Exit Function
End if
Hhook = setwindowshookex (wh_keyboard, addressof _
Mykbhfunc, app. hinstance, app. threadid)
End Function

Public Function mykbhfunc (byval icode as long ,_
Byval wparam as long, byval lparam as long) as long
Mykbhfunc = 0' indicates the message to be processed

If wparam = vbkeysnapshot then' detects whether the printscreen key is pressed
Mykbhfunc = 1' the hook will eat this message
End if
Call callnexthookex (hhook, icode, wparam, lparam) 'to pass to the next hook
End Function