Message Hook Use tutorial

The basic concept hook (hook) is a platform for Windows Messaging mechanisms where applications can set up a subroutine to monitor certain messages in a specified window, and the monitored windows can be created by other processes. When the message arrives, it is processed before the target window processes the function. The hook mechanism allows the application to intercept processing window messages or specific events. The hook is actually a program segment that handles messages, and it is hooked into the system by system calls. Whenever a particular message is sent, the hook program captures the message before it reaches the destination window, which means that the hook function gets control first. The hook function can then process (change) the message, or it can continue to deliver the message without processing, and can force the end of the message to be passed. Operating mechanism 1, hook list and hook process: Each hook has a linked pointer to the table, called a chain of hooks, by the system to maintain. The pointer to this list points to the specified, application-defined callback function called by the Hook subroutine, which is the handle of the hook. When basic concepts

Hooks, a platform for Windows Messaging mechanisms, where applications can set up a subroutine to monitor a message for a specified window, and the monitored window can be created by another process. When the message arrives, it is processed before the target window processes the function. The hook mechanism allows the application to intercept processing window messages or specific events.

The hook is actually a program segment that handles messages, and it is hooked into the system by system calls. Whenever a particular message is sent, the hook program captures the message before it reaches the destination window, which means that the hook function gets control first. The hook function can then process (change) the message, or it can continue to deliver the message without processing, and can force the end of the message to be passed.

Operating mechanism

1, hook list and hook process:

Each hook has a list of pointers associated with it, called hook lists, maintained by the system. The pointer to this list points to the specified, application-defined callback function called by the Hook subroutine, which is the handle of the hook. When the message associated with the specified hook type occurs, the system passes the message to the hook thread. Some hook threads can only monitor messages, or modify messages, or stop messages from passing through to the next hook or Destination window. The recently installed hooks are placed at the beginning of the chain, and the first hooks are placed at the end, which is the first to gain control after joining.

Windows does not require the order of the hooks to be unloaded in the same order as the installation sequence. Whenever a hook is unloaded, Windows releases its memory footprint and updates the entire hook list. If the program has a hook installed, but it finishes before uninstalling the hook, the system will automatically uninstall the hook for it.

A hook subroutine is an application-defined callback function (CALLBACK function) that cannot be defined as a member function of a class, but as a normal C function. Used to monitor a system or a specific type of event, which can be associated with a particular thread, or it can be an event for all threads in the system.

The Hook subroutine must follow the syntax below

: LRESULT CALLBACK HookProc
(
　　int nCode,
　　 　　WPARAM wParam,
　　 　　LPARAM lParam
); HookProc is the name of the application definition.

The ncode parameter is the hook code, which is used by the Hook subroutine to determine the task. The value of this parameter depends on the hook type, and each hook has its own hook code feature character set.

The values of the wparam and lparam parameters depend on the hook code, but their typical values include information about sending or receiving messages.