Source: https://www.cnblogs.com/grenet/archive/2010/12/07/1898840.html
1, KEYBOARD hook function is divided into two kinds, wh_keyboard_ll and wh_keyboard. We generally use the first, global keyboard hooks, which can intercept all the keyboard keys of the message.
2, online Some people say that the global hook to be placed in a separate DLL in order to use. I tried, do not put in a separate DLL, under XP+VS2005, debugging and operation are no problem, in xp+vs2008, debugging will be error, but can run after compiling, under win7+vs2010, debugging will be error, compile can run. This aspect has the research netizen, hoped the generous enlighten.
3, Wh_keyboard_ll and Wh_keyboard, this is two different hooks, although the last is the Keyboardhookproc function to deal with the interception of the message, but the specific meaning of each parameter is completely different.
Wh_keyboard Hooks. Each parameter of the KEYBOARDHOOKPROC function has the following meanings:
Types of NCode messages, sub-hc_action and Hc_noremove
Virtual key code for WParam keys
LParam key parameter information, including the repetition time, the state of the key (press or bounce), etc.
wh_keyboard_ll Hooks. Each parameter of the KEYBOARDHOOKPROC function has the following meanings:
NCode type of message, with Hc_action
WParam the state of the button (pressed or bounced) wm_keydown, Wm_keyup, Wm_syskeydown, Wm_syskeyup
The LParam pointer to the KEYBOARDHOOKSTRUCT structure that contains the details of the key.
As can be seen, the parameters of the two hooks are defined in a completely different way. In the previous code: Dim mykeyboardhookstruct as Keyboardhookstruct = DirectCast (Marshal.PtrToStructure (LParam, GetType ( keyboardhookstruct), keyboardhookstruct) is the copy that the pointer points to in the specified structure.
Keyboard Hook API function parameter description