Hooks -- hook Overview

(The document is sourced from msdn. This article only translates and annotates it. Link: Success .)

Hooks Overview

AHookIs a mechanism by which an application can intercept events, such as messages, mouse actions, and keystrokes. A function that intercepts a participant type of event is known asHook procedure. A hook procedure can act on each event it records es, and then modify or discard the event.

(Hook is a mechanism by which applications intercept events, such as messages, mouse activity, and keyboard buttons. A function that intercepts a specific type of event is called a hook function. A hook function can act on every event it receives and change or discard the event .)

The following some example uses for hooks :( below are some hook usage)

• Monitor messages for debugging purposes (Monitor messages for debugging)
• Provide support for recording and playback of macros (supporting record and macro replay) (unknown)
• Provide support for a help key (F1) (supports function key F1)
• Simulate mouse and keyboard input (simulate mouse and keyboard input)
• Implement a computer-based training (CBT) Application (CBT application)

NoteHooks tend to slow down the system because they increase the amount of processing the system must perform for each message. you shoshould install a hook only when necessary, and remove it as soon as possible. (hooks reduce the speed of the system because more messages must be processed by the system. You should use it only when necessary. Please cancel it immediately when not in use .) (PS: When you think about a virus, the computer will get stuck .)

This section discusses the following :( this chapter discusses the following content)

• Hook chains)
• Hook procedures (hook function)
• Hook types (hook type)
  • Wh_callwndproc and wh_callwndprocret
  • Wh_cbt
  • Wh_debug
  • Wh_foregroundidle
  • Wh_getmessage
  • Wh_journalplayback
  • Wh_journalrecord
  • Wh_keyboard_ll
  • Wh_keyboard
  • Wh_mouse_ll
  • Wh_mouse
  • Wh_msgfilter and wh_sysmsgfilter
  • Wh_shell

Hook chains)

The system supports extends different types of hooks; each type provides access to a different aspect of its message-handling mechanism. for example, an application can use thewh_mouse hook to monitor the message traffic for mouse messages. (The system provides a variety of different types of hooks; each hook provides different access aspects of the message processing mechanism. For example, the program can use the wh_mouse hook to monitor the transmission of mouse messages .)

The system maintains a separate hook chain for each type of hook.Hook chainIs a list of pointers to special, application-defined callback functions calledHook procedures. When a message occurs that is associated with a participates type of Hook, the system passes the message to each hook procedure referenced in the hook chain, one after the other. the action a hook procedure can take depends on the type of hook involved. the hook procedures for some types of hooks can only monitor messages; others can modify messages or stop their progress through the chain, prevent Ing them from reaching the next hook procedure or the destination window. (The system maintains a separate hook chain for different types of hooks .)

Hook procedures (hook function)

To take advantage of a participant type of Hook, the developer provides a hook procedure and usesSetwindowshookexFunction to install it into the chain associated with the hook. A hook procedure must have the following syntax :( to use a hook type, developers need to provide a hook function, and then use the setwindowshookex function to install it to the hook chain of the hook type. The hook function must comply with the following syntax :)

Lresult callback hookproc (INT ncode, // hook type wparam, lparam) {// process event... return callnexthookex (null, ncode, wparam, lparam); // note that callnexthookex is called}

HookprocIs a placeholder for an application-defined name. (place the function name in hookproc .)

TheNcodeParameter is a hook code that the hook procedure uses to determine the action to perform. the value of the hook Code depends on the type of the hook; each type has its own characteristic set of hook codes. the values ofWparamAndLparamParameters depend on the hook code, but they typically contain information about a message that was sent or posted. (The ncode parameter is the code used by the hook function to determine the execution behavior. The value of ncode depends on the hook type. Different hook types have their own unique hook code. The value of the wparam and lparam parameters depends on ncode. However, they usually contain messages sent or delivered .)

TheSetwindowshookexFunction always installa hook procedure at the beginning of a hook chain. when an event occurs that is monitored by a participant type of hook, the system callthe procedure at the beginning of the hook chain associated with the hook. each hook procedure in the chain determines whether to pass the event to the next procedure. A hook procedure passes an event to the next procedure by callingCallnexthookexFunction. (The setwindowshookex function always installs the hook function at the beginning of the hook chain. When an event is detected by a hook type, the system calls the hook function at the starting position of the hook chain. Each hook function on the hook chain determines whether to pass the event to the next hook function. The hook function passes the event to the next hook function by calling the callnexthookex function .)

Note that the hook procedures for some types of hooks can only monitor messages. The system passes messages to each hook procedure, regardless of whether a special procedure cballsCallnexthookex. (Note that the hook function of some types of hooks can only monitor messages. Whether or not the hook function calls the callnexthookex function, the system passes the message to the next hook function .)

AGlobal hookMonitors messages for all threads in the same desktop as the calling thread.Thread-specific hookMonitors messages for only an individual thread. A global hook procedure can be called in the context of any application in the same desktop as the calling thread, so the procedure must be in a separate DLL module. A thread-specific hook procedure is called only in the context of the associated thread. if an application installa hook procedure for one of its own threads, the hook procedure can be In either the same module as the rest of the application's code or in a DLL. if the application installa hook procedure for a thread of a different application, the procedure must be in a DLL. for information, seedynamic-link libraries. (Global hooks are used as call threads to monitor messages of all threads on the same desktop. Hooks of specific threads only monitor specific off-the-shelf messages. The global hook function can be called as a call thread in any program environment on the same desktop. Therefore, the function must be in a separate DLL module. Hook Functions of a specific thread can only be called in the thread environment. If a program installs a hook for its own thread, the hook can be in the same module as other code of the program, or independently in a DLL. If the program installs the hook function for the thread of another program, the hook function must be in the DLL. For more information, see dynamic-link libraries .)

NoteYou shoshould use global hooks only for debugging purposes; otherwise, you shoshould avoid them. global hooks hurt system performance and cause conflicts with other applications that implement the same type of global hook. (You should only use global hooks during debugging; otherwise, you will not use them. Global hooks strongly affect system performance and conflict with other programs that use the same types of hooks .)

Hook types (hook type)

Each type of hook enables an application to monitor a different aspect of the system's message-handling mechanic. the following sections describe the available hooks. (different types of hooks enable the program to monitor different aspects of the Message Processing Mechanism of the system. The following sections describe available hook types .)

• Wh_callwndproc and wh_callwndprocret
• Wh_cbt
• Wh_debug
• Wh_foregroundidle
• Wh_getmessage
• Wh_journalplayback
• Wh_journalrecord
• Wh_keyboard_ll
• Wh_keyboard
• Wh_mouse_ll
• Wh_mouse
• Wh_msgfilter and wh_sysmsgfilter
• Wh_shell

The following incomplete translation can only be used to write part or free translation.
Wh_callwndproc and wh_callwndprocret

TheWh_callwndprocAndWh_callwndprocretHooks enable you to monitor messages sent to window procedures. The system callaWh_callwndprocHook procedure before passing the message to the processing window procedure, and calltheWh_callwndprocretHook procedure after the window procedure has processed the message. (allows monitoring of messages sent to the window process.Wh_callwndproc: Called before being transferred to the window.Wh_callwndprocret: Called after the window process is processed .)

TheWh_callwndprocretHook passes a pointer toCwpretstructStructure to the hook procedure. the structure contains the return value from the window procedure that processed the message, as well as the message parameters associated with the message. subclassing the window does not work for messages set between processes.

For more information, seeCALLWNDPROCAndCallwndretprocCallback functions.

Wh_cbt

The system callaWh_cbtHook procedure before activating, creating, destroying, minimizing, maximizing, moving, or sizing a window; before completing a system command; before removing a mouse or keyboard event from the system message queue; before setting the input focus; or before synchronizing with the system message queue. the value the hook procedure returns determines whether the system allows or prevents one of these operations. theWh_cbtHook is intended primarily for computer-based training (CBT) applications. (generally, this message is only recommended for computer-aided training programs .) (For example, the Excel software .)

For more information, seeCbtprocCallback function.

For information, see winevents.

Wh_debug

The system callaWh_debugHook procedure before calling hook procedures associated with any other hook in the system. you can use this hook to determine whether to allow the system to call hook procedures associated with other types of hooks. (called before calling hook functions of other hooks of the system. You can call this hook to determine whether to allow the system to call hook functions of other types .)

For more information, seeDebugprocCallback function.

Wh_foregroundidle

TheWh_foregroundidleHook enables you to perform low priority tasks during times when its foreground thread is idle. The system callaWh_foregroundidleHook procedure when the application's foreground thread is about to become idle. (You can set it to a lower priority when the foreground thread is idle/will be idle .)

For more information, seeForegroundidleprocCallback function.

Wh_getmessage

TheWh_getmessageHook enables an application to monitor messages about to be returned byGetmessageOrPeekmessageFunction. You can useWh_getmessageHook to monitor mouse and keyboard input and other messages posted to the Message Queue. (allow the program to monitor the messages returned by the getmessage and peekmessage functions. Monitors keyboard, mouse input, and other messages delivered to the Message Queue .)

For more information, seeGetmsgprocCallback function.

Wh_journalplayback

TheWh_journalplaybackHook enables an application to insert messages into the system message queue. you can use this hook to play back a series of mouse and keyboard events recorded earlier by usingwh_journalrecord. regular mouse and keyboard input is disabled as long asWh_journalplaybackHook is installed.Wh_journalplaybackHook is a global hook-it cannot be used as a thread-specific hook. (reproduce previous mouse or Keyboard Events. After installation, regular keyboard and mouse input are unavailable. This is a global hook .)

TheWh_journalplaybackHook returns a time-out value. this value tells the system how does milliseconds to wait before processing the current message from the playback hook. this enables the hook to control the timing of the events it plays back.

For more information, seeJournalplaybackprocCallback function.

Wh_journalrecord

TheWh_journalrecordHook enables you to monitor and record input events. Typically, you use this hook to record a sequence of mouse and keyboard events to play back later by usingwh_journalplayback.Wh_journalrecordHook is a global hook-it cannot be used as a thread-specific hook. (record keyboard and mouse input events)

For more information, seeJournalrecordprocCallback function.

Wh_keyboard_ll

TheWh_keyboard_llHook enables you to monitor keyboard input events about to be posted in a thread input queue. (keyboard input events to be delivered to the thread input queue .) (PS: this is the underlying layer)

For more information, seeLowlevelkeyboardprocCallback function.

Wh_keyboard

TheWh_keyboardHook enables an application to monitor message trafficWm_keydownAndWm_keyupMessages about to be returned byGetmessageOrPeekmessageFunction. You can useWh_keyboardHook to monitor keyboard input posted to a message queue. (monitor the wm_keydown and wm_keyup messages to be returned by the getmessage or peekmessage function. Monitors the keyboard input sent to the Message Queue .)
)

For more information, seeKeyboardprocCallback function.

Wh_mouse_ll

TheWh_mouse_llHook enables you to monitor mouse input events about to be posted in a thread input queue. (The mouse input event to be delivered to the thread input queue .) (PS: this is the underlying layer)

For more information, seeLowlevelmouseprocCallback function.

Wh_mouse

TheWh_mouseHook enables you to monitor mouse messages about to be returned byGetmessageOrPeekmessageFunction. You can useWh_mouseHook to monitor mouse input posted to a message queue. (monitor the mouse message to be returned by the getmessage or peekmessage function. It can be used to monitor the mouse input sent to the Message Queue .)
)

For more information, seeMouseprocCallback function.

(The two below are not translated. I haven't used them yet. I don't want to read them anymore .)

Wh_msgfilter and wh_sysmsgfilter

TheWh_msgfilterAndWh_sysmsgfilterHooks enable you to monitor messages about to be processed by a menu, scroll bar, message box, or dialog box, and to detect when a different window is about to be activated as a result of the user's pressing the Alt + TAB or Alt + ESC key combination. theWh_msgfilterHook can only monitor messages passed to a menu, scroll bar, message box, or dialog box created by the application that installed the hook procedure.Wh_sysmsgfilterHook monitors such messages for all applications .(Wh_msgfilterOnly monitors the menus, scroll bars, message boxes, and dialog boxes of the applications that currently have hook functions installed.Wh_sysmsgfilterMonitor all programs .)

TheWh_msgfilterAndWh_sysmsgfilterHooks enable you to perform message filtering during modal loops that is equivalent to the filtering done in the main message loop. for example, an application often examines a new message in the main loop between the time it retrieves the message from the queue and the time it dispatches the message, specify Ming special processing as appropriate. however, during a modal loop, the system retrieves and dispatches messages without allowing an application the chance to filter the messages in its main message loop. if an application installaWh_msgfilterOrWh_sysmsgfilterHook procedure, the system cballs the procedure during the modal loop.

An application can callWh_msgfilterHook directly by callingCallmsgfilterFunction. By using this function, the application can use the same code to filter messages during modal loops as it uses in the main message loop. To do so, encapsulate the filtering operations inWh_msgfilterHook procedure and callCallmsgfilterBetween the calltoGetmessageAndDispatchmessageFunctions.

while (GetMessage(&msg, (HWND) NULL, 0, 0)) {     if (!CallMsgFilter(&qmsg, 0))         DispatchMessage(&qmsg); } 

The last argumentCallmsgfilterIs simply passed to the hook procedure; you can enter any value. The hook procedure, by defining a constant suchMsgf_mainloop, Can use this value to determine where the procedure was called from.

For more information, seeMessageprocAndSysmsgprocCallback functions.

Wh_shell

A shell application can useWh_shellHook to receive important communications. The system CILSWh_shellHook procedure when the shell application is about to be activated and when a top-level window is created or destroyed.

Note that custom shell applications do not receiveWh_shellMessages. Therefore, any application that registers itself as the default shell must callSystemparametersinfoFunction before it (or any other application) can receiveWh_shellMessages. This function must be calledSpi_setminimizedmetricsAndMinimizedmetricsStructure. SetIarrangeMember of this structureArw_hide.

For more information, seeShellprocCallback function.