Windows Hook Message Classification

The module instance handle of the DLL that calls SetWindowsHookEx, which can be obtained through the first parameter of the DllMain entry.
Hhook SetWindowsHookEx (int idhook,
HOOKPROC LPFN,
HInstance Hmod,
DWORD dwThreadID);
As for SetWindowsHookEx's fourth parameter, dwThreadID, is the window thread ID you need to get from the window handle.
You can get it by using the following code:
DWORD dwThreadID = GetWindowThreadProcessId (hwnd, NULL);
Select the appropriate message hooks, such as
wh_callwndproc//monitoring the message before the window arrives
wh_callwndprocret//monitoring window after processing the message
wh_debug//monitoring system calls other hooks associated with the hook thread
wh_getmessage//monitoring messages sent to the form message queue
wh_journalplayback//Global hook, can insert message to message queue
wh_journalrecord//Global hook, monitor input events (keyboard, mouse, etc.)
wh_keyboard//Keyboard Hooks
wh_mouse//Mouse Hooks
wh_msgfilter//Monitor menu, scroll bar, message box, dialog box message, and Toggle window key combinations (ALT + TAB, etc.)
wh_shell//important notifications in the receiving system (e.g., Windows being generated, destroyed, etc.)

http://blog.csdn.net/y281252548/article/details/51810260

Windows Hook Message Classification