C # Hooks

1.setWindowsHookex explanation

http://blog.csdn.net/mmllkkjj/article/details/6627188

function Function: This function installs an application-defined hook process into the hook chain, and you can monitor certain types of events on the system by installing a hook processing process that is related to all events in a particular thread or system.

function Prototype: Hhook SetWindowsHookEx (int idhook, HOOKPROC lpfn,hinstance hmod,dword dwthreadid);

Parameters:

Idhook: indicates the type of hook process to be installed, this parameter can be one of the following values:

Wh_callwndproc (4): installs a hook processing process that monitors the message before it is sent to the target window processing, as detailed in the Callwndproc hook process.

Wh_callwndprocret: installs a hook processing process that monitors messages that have been processed by the target window processing, as detailed in the Callwndretproc hook process.

WH_CBT (5): installs a hook processing process that accepts messages that are useful to the CBT application, as detailed in the Cbtproc hook processing process.

Wh_debug (9): Install a hook processing process to debug other hook processing procedures, see the Debugproc hook process for details.

Wh_foregroundidle (one): installs a hook processing process that is called when the foreground thread of an application is about to enter an idle state, which helps to perform low-priority tasks in idle time.

Wh_getmessage (3): installs a hook processing process to monitor messages that are sent to the message queue, see the Getmsgproc hook process for details.

Wh_journalplayback (1): installs a hook processing process to send messages that were previously recorded by the Wh_journalrecord hook processing process. See Journalplaybackproc hook processing for details.

Wh_journalrecord (0): installs a hook processing process that records the input messages sent to the system message queue. See the Journalrecordproc hook process for details.

Wh_keyboard (2): installs a hook processing process to monitor keystroke messages. See the Keyboardproc hook process for details.

wh_keyboard_ll: This hook can only be installed in Windows NT and is used to monitor the underlying keyboard input events. See the LowLevelKeyboardProc hook process for details.

Wh_mouse (7): installs a hook processing process to monitor mouse messages. See the Mouseproc hook process for details.

wh_mouse_ll: This hook can only be installed in Windows NT and is used to monitor underlying mouse input events. See the Lowlevelmouseproc hook process for details.

Wh_msgfilter ( -1): installs a hook processing process to monitor messages that are raised by input events in dialog boxes, message boxes, menu pieces, or scrollbars. See the MessageProc hook process for details.

Wh_shell: Install a hook processing procedure to accept notifications that are useful to the shell application, see the Shellproc hook process for details.

Wh_sysmsgfilter (6): installs a hook processing process to monitor messages raised by input events in dialog boxes, message boxes, menu bars, or scrollbars. This hook processing process monitors all applications in the system for such messages. See Also Sysmsgproc hook processing process.

LPFN: points to the corresponding hook processing. If the parameter dwThreadID is 0 or indicates a thread identifier created by another process, the parameter lpfn must point to a hook process in a dynamic link. Otherwise, The parameter lpfn can point to a hook process defined in the code that is related to the current process.

Hmod: indicates a handle to a dynamically linked library that contains the hook processing that the parameter lpfn points to. If the thread indicated by the parameter dwthreadid is created by the current process, and the corresponding hook process is defined in the code associated with the current process, The parameter hmod must be set to null (0).

dwThreadID: indicates a thread identifier, and the hook process is thread-dependent. If this parameter value is 0, the hook process is related to all existing threads.

return Value: If this function succeeds, the return value is the handle to the hook process, and if this function fails, the return value is null (0). To get more error messages, call the Getlaserror function.

Note: If the parameter hmod is null, and the parameter dwthreadld is 0 or indicates a thread identifier created by another process, an error is generated.

Call the following link to the function CallNextHookEx the next hook processing procedure is optional, but is also recommended otherwise, other applications that have this hook installed will not be able to get this hook notification, which could lead to incorrect behavior. Unless you really want to prevent other applications from seeing this hook notification, You should call the function CallNextHookEx.

Before terminating an application, you must call the function UnhookWindowsHookEx to release the system resources associated with this hook.

The scope of the hook depends on the type of hook. Some hooks can only be set to the system scope, and other hooks (shown below) may also be set to the scope of a particular thread:

Wh_callwndproc thread or System

Wh_callwndprocret Thread or System

WH_CBT Thread or System

Wh_debug Thread or System

Wh_foregroundidle Thread or System

Wh_getmessage Thread or System

Wh_journalplayback system

Wh_journalrecord system

Wh_keyboard Thread or System

WH_KEYBOARD_LL Thread or System

Wh_mouse Thread or System

WH_MOUSE_LL Thread or System

Wh_msgfilter Thread or System

Wh_shell Thread or System

Wh_sysmsgfilter system

For a particular hook type, the off-the-shelf hooks are called first and then the system hooks are called.

A system hook is used as a shared resource and is installed once to affect the application being used. All system hook functions must be in the library. System hooks should be limited to applications that are special-purpose or as auxiliary tools for debugging applications. Libraries that no longer need hooks should remove the corresponding hook processing.

Quick check: Windows nt:3.1 and above, windows:95 and above, Windows CE does not support, header files Winuser.h, library files: User-defined, Unicode, Unicode and ANSI versions implemented on Windows NT .

Shellproc

function function: hook processing is a callback function defined in an application or library that is used in conjunction with the function SetWindowsHookEx. This function accepts the shell (shell) from the system Notification. Type HookProc defines a pointer to such a callback function. Shellproc the location identifier of the corresponding callback defined in the application or library.

function Prototype: LRESULT CALLBACK shellproc (int nCode, WPARAM wparam,lparam LPARAM);

Parameters:

NCode: Indicates the hook type, which can be one of the following values:

hshell_accessibilitystate: valid for Windows NT5.0 or later, indicating that accessibility has been changed.

Hshell_activateshellwindow: The shell should activate its main window.

Hshell_getminrect: Windows only: A window is being minimized or maximized, and the system needs the rectangle coordinates when the window is minimized.

Hshell_language: Windows only: The keyboard language is changed or a new keyboard layout is loaded.

Source: (http://blog.sina.com.cn/s/blog_626a27090100f0m3.html)-hook function Daquan _ old code _ Sina Blog

Hshell_redraw: Windows only: A window with a caption on the task bar has been redrawn.

Hshell_taskman: Windows only: The user has selected their task list. A shell application that provides a list of tasks when returned true to prevent Windows from starting (executing) its task list.

hshell_windowactivated: Windows only: The activation state has been transferred to a different top-level no-property main window.

hshell_windowcreated: A top-level, no-property main window has been created. When the system calls a Sheproc function, the window exists.

hshell_windowdestroyed: A top-level, no-property main window is about to be destroyed. When the system calls the Sheproc function. The window still exists.

If the value of ncode is less than 0, the hook process must pass the message to the function CallNextHookEx and return its return value.

WParam: The value of this parameter depends on the parameter ncode, and its dependencies are as follows:

hshell_accessibilitystate: indicates which can access the feature has been changed state, can be one of the following values:

Access_filterkys,access_mousekeys,access_stickkeys.

hshell_getminrect: The window handle that is minimized or maximized. Hshell_language: The handle to the window.

Hshell_redraw: handle to the window being redrawn. Hshell_windowactivated: The handle of the window being activated.

hshell_windowcreated: The handle of the window being created. Hshell_windowdestroyed: The handle of the window being destroyed.

LParam: The value of this parameter depends on the parameter ncode, and its dependencies are as follows:

hshell_getminrect: A pointer to the RECT structure. hshell_language: handle to the keyboard layout.

Hshell_redraw: If the window is flashing, its value is true, otherwise false.

hshell_windowactivated: If the window is full-screen mode, its value is true, otherwise false. Return value: The return value should be 0.

Note: This hook processing procedure is installed by calling the function SetWindowsHookEx, specifying the WH_SHLL hook type and its corresponding hook handling process first address.

Quick check: Windows nt:3.1 and above versions, windows:95 and above, Windows CE does not support, header files Winuser.h, library files, user customizations.

Sysmsgproc

function function: hook processing is a callback function defined in an application or library that is used in conjunction with the function SetWindowsHookEx. When an input event occurs in a dialog box, message box, menu bar, or ScrollBar, and the resulting message has not been processed, The system calls this hook process. This function monitors all dialog boxes, message boxes, menu pieces, or scroll bar messages in the system.

Type HookProc defines a pointer to such a callback function. Sysmsgproc is the positional identifier for the corresponding callback function name in the library.

function Prototype: LRESULT CALLBACK sysmsgproc (int ncode,wparam wparam,lparam LPARAM);

Parameters:

NCode: indicates the type of input event that generated this message. This parameter can be one of the following values:

Msgf_dialogbox: The input event is generated by a message box or dialog box.

Msgf_menu: The input event is generated by a menu bar.

Msgf_scrollbar: The input event is generated by a scroll bar.

Msgf_nextwindow: The input event occurs because the user has pressed the key combination <Alt+Tab> to activate another window.

If the value of ncode is less than 0, the hook process must pass the message to the function CallNextHookEx and return its return value.

WParam: is null (0).

LParam: pointer to the MSG structure.

return Value: If the value of ncode is less than 0, then this hook processing must return the return value of CallNextHookEx. If the value of ncode is greater than or equal to 0, and this hook process does not process the message, the function is called CallNextHookEx and returns its return value is recommended. Otherwise, other applications that have the Wh_sysmsgfilter hook installed will not be able to receive this hook notification and may result in an incorrect behavior. If this hook process processes this message, It should return a non-0 value to prevent the system from transmitting this message to the target window process.

Note: An application installs this hook by calling the function SetWindowsHookEx to specify the Wh_sysmsgfilter hook type and the first address of the corresponding hook processing process.

Quick check: Windows nt:3.1 and above versions, windows:95 and above, Windows CE does not support, header files Winuser.h, library files, user customizations.

UnhookWindowsHookEx

function Function: This function removes a hook process from the hook chain that is installed by SetWindowsHookEx.

function Prototype: BOOL UnhookWindowsHookEx (Hhook hhk);

Parameters:

HHK: The handle of the removed hook. This parameter is a hook handle that is the return value of the previous function SetWindowsHookEx.

return value: The function performed successfully returns a value other than 0, and failure returns 0.

Note: even after the UnhookWindowsHookEx function returns, the hook process may be in a state called by another thread. If the hook process is not currently called, the UnhookWindowsHookEx The hook process is immediately deleted before the function returns.

Delhookproc: This function is obsolete and is only intended to be compatible with the 16-bit version of Windows. Function CallNextHookEx should be used in 32-bit Windows systems.

Setwindowshook: This function is obsolete and is only intended to be compatible with the 16-bit version of Windows. Function SetWindowsHookEx should be used in 32-bit Windows systems.

Unhookwindowshook: This function is obsolete and is only intended to be compatible with the 16-bit version of Windows. Function UnhookWindowsHookEx should be used in 32-bit Windows systems.

Callmsgfilter

function Function: This function sends a specific message and hook code to the hook process associated with hooks Wh_sysmsgfilter and wh_msgfilter, a wh_sysmsgfilter or wh_ Msgfilter hook processing refers to application-defined callback functions that are responsible for checking and optionally modifying messages about dialog boxes, message boxes, menu bars, and scroll bars.

function Prototype: BOOL Callmsgfilter (lpmsg lpmsg, int nCode);

Parameters:

lpmsg: points to a MSG structure that contains messages sent to the hook processing process.

NCode: Specifies the application-defined code that the hook process needs to use to determine how the message is processed, and the code should not use the hook codes associated with the system predefined Wh_sysmsgfilter and Wh_msgfilter hooks (msgf_ and HC_) the same value.

return Value: If the application can further process the message, the return value is 0, and if the application cannot further process the message, the return value is a value other than 0.

Note: The system calls the Callmsgfilter to enable the application to check and control the internal processing of dialog boxes, message boxes, menu pieces, scroll bars, or the user presses <Alt+Tab> A message flow that is generated when a key is combined to activate a different window.

You can install this hook process by calling the function SetWindowsHookEx.

Quick check: Windows nt:3.1 and above, windows:95 and above, Windows CE does not support, header files: winuser.h, library files: user32.lib,unicode: In Windows Unicode and ANSI versions are implemented on NT.

C # Hooks