The principle and application technology of hook Monitoring for Windows keyboard events

Window's message processing mechanism provides the ability to hook up various anti-tune functions (hooks) in order to monitor the various event messages in the system in the application. This hook function (hook) is similar to an extended interrupt driver, which can hook up multiple anti-tune functions to form a chain of hook functions. The various messages generated by the system are first sent to various hook functions, which monitor, modify and control the messages according to their functions, then return control or pass the message to the next hook function so that the window function is finally reached. This kind of anti-tune function hook Method of window system will affect the operation efficiency of the system slightly, but it is very useful in many situations, it can achieve unexpected good effect by using the hook function Monitoring mechanism of keyboard event rationally and effectively.

A method to hook up a monitoring function on a Windows keyboard event

There are 11 types of filter functions that can be hooked up under windows:

Filter function of Wh_callwndproc window function

WH_CBT Computer Training Filter function

Wh_debug Debugging Filter function

Wh_getmessage Get Message Filter function

Wh_hardware Hardware message filtering function

Wh_journalplayback Message playback filter function

Wh_journalrecord Message logging Filter function

Wh_mouse Mouse Filter function

Wh_msgfilter Message filtering function

Wh_sysmsgfilter System Message Filtering function

Wh_keyboard Keyboard Filter function

The keyboard filter function is the most useful filter function type, no matter which type of filter function, its hook basic method is the same.

When the window calls the hooked Anti-tune function, it always calls that function at the top of the hook chain, so the keyboard hook function must be hooked to the function SetWindowsHookEx () to the top of the chain. As to whether the next function of the message is passed to the function chain is determined by the function of each specific function, if the message needs to be traditionally given to the next function, the CallNextHookEx () of the API function can be invoked, if not passed directly back. A hook function can be a global function for monitoring all thread messages, or it can be a local function that monitors a single process individually. If the hook function is a local function, you can put it in one. DLL dynamic link library, you can also place it in a local module, and if the hook function is global, you must place it in one. DLL dynamic-link library. The hook function must be declared in strict accordance with the following format, as an example of a keyboard hook function: