Hook Technology-keyboard, mouse, and hook instances

1. Create a DLL project to generate a custom DLL file. The DLL file contains two external interfaces: Install the hook function sethook and uninstall the hook function unsethook.

To export these functions, you must declare these functions in the. h file of the project to export them.

//MouseKeyboardHook.h

#ifdef MOUSEKEYBOARDHOOK_EXPORTS#define MOUSEKEYBOARDHOOK_API __declspec(dllexport)#else#define MOUSEKEYBOARDHOOK_API __declspec(dllimport)#endifextern "C" MOUSEKEYBOARDHOOK_API int SetHook( DWORD dwThreadId  );extern "C" MOUSEKEYBOARDHOOK_API int UnSetHook(void);

Here, only the hook function is installed with a parameter, which is the thread ID number. Note that if the function address cannot be found when the DLL is called, you need to add the extern "C, at that time, I had not been depressed for a long time to find this problem. I thought for a moment, it should be that I use the C programming language in the DLL, and my application that calls the DLL is C ++ by default, however, because the function name formats of C and C ++ OBJ are different, the function address cannot be found. The function can be exported according to the format of the DLL header file.

// Mousekeyboardhook. CPP file # include "stdafx. H "# include" mousekeyboardhook. H "# include" stdio. H "// shared memory variable # pragma data_seg (" mousekeyboardhook ") hhook g_hmousehook = NULL; hhook g_hkeyboardhook = NULL; # pragma data_seg () // This is an example of the export variable mousekeyboardhook_api int nmousekeyboardhook = 0; // This is an example of the export function. Int unsethook (void); int fnmousekeyboardhook (void); int sethook (DWORD dwthreadid); // note: the format of the hook function must be lresult callback function name (INT hook type, wparam, lparam); lresult callback mousehookproc (INT ncode, wparam, lparam); // The lresult callback (INT ncode, wparam, lparam); // handle the keyboard hook function hmodule winapi modulefromaddress (pvoid PV); // obtain the dll Memory Address, which can be reused, As the template mousekeyboardhook_api int fnmousekeyboardhook (void) // This is not very useful for project generation {return 42;} lresult callback keyboardhookproc (INT ncode, wparam, lparam) {If (wparam = 'q' & lparam> 0) // The hook function is exited only when the Q key is pressed. Otherwise, the {MessageBox (null, "Uninstall hook... "," Uninstall hook ", mb_ OK); unsethook ();} else return true; Return: callnexthookex (g_hkeyboardhook, ncode, wparam, lparam );} lresult callback mousehookproc (INT ncode, wparam, lparam) // block all mouse messages here {return: callnexthookex (g_hmousehook, ncode, wparam, lparam );} // This is the constructor of the exported class. // For more information about class definition, see mousekeyboardhook. hcmousekeyboardhook: cmousekeyboardhook () {return;} callback int sethook (DWORD dwthreadid) // install the hook function {g_hmousehook =: callback (wh_mouse, mousehookproc, modulefromaddress (mousehookproc ), 0); g_hkeyboardhook =: setwindowshookex (wh_keyboard, keyboardhookproc, modulefromaddress (keyboardhookproc), 0); Return 0;} mousekeyboardhook_api int unsethook (V Oid) // uninstall the hook function, but this example has a problem and cannot be uninstalled. I don't know why {bool b1 =: unhookwindowshookex (g_hmousehook); bool b2 = :: unhookwindowshookex (g_hkeyboardhook); If (b1 = false | b2 = false) MessageBox (null, "failed to uninstall hook! "," ", Mb_ OK); Return 0;} hmodule winapi modulefromaddress (pvoid PV) {memory_basic_information MBI; If (: virtualquery (PV, & MBI, sizeof (MBI ))! = 0) {return (hmodule) MBI. allocationbase;} else {return NULL ;}}

The format of the hook function should be noted here. Otherwise, it should not be a problem. At the same time, because the export function has been declared in the header file, you do not need to declare it again here. Just write it according to the normal function.

But I don't know why my hook failed to be uninstalled!

2. Create an application to load the DLL

Because you need to monitor the entire computer, the parameter passed by the sethook function is 0, which indicates monitoring the entire computer.

In this example, the DLL loading method is dynamic.

The specific process is: load the DLL file --> get the export function address --> call the hook to install the function --> uninstall the hook.

The main source code of the program is as follows:

Bool binstall = false; // used to indicate whether a hook has been installed // The caboutdlg dialog box for the "about" menu item of the application // you need to declare the export function pointer typedef int (* psethook) (DWORD *); // declare the function type typedef int (* punsethook) (void); void ckeymousehookappdlg: onbnclickedbutton1 () // The program dynamically loads the DLL {hmodule =: loadlibrary ("mousekeyboardhook. DLL "); // load the dll library if (hmodule! = NULL) {If (binstall = false) {psethook mpsethook; mpsethook = (psethook): getprocaddress (hmodule, "sethook "); // obtain the export function address if (mpsethook! = NULL) {mpsethook (0); // install the global hook binstall = true; getdlgitem (idc_button1)-> setwindowtext ("Uninstall DLL ");} else MessageBox ("An error occurred while obtaining the function address! ");} Else {punsethook mpunsethook; mpunsethook = (punsethook): getprocaddress (hmodule," unsethook "); If (mpunsethook! = NULL) {mpunsethook (); // uninstall hook binstall = false; getdlgitem (idc_button1)-> setwindowtext ("load DLL");} else MessageBox ("failed to get function address! ");: Freelibrary (hmodule); // release the loaded dll library} else MessageBox (" failed to load DLL! ");}