Windows message Hooks

1, the concept of message hooks:

The Windows application is message-driven, and no matter what thread just the form class will have a message queue for receiving user input messages and system messages. To intercept messages,Windows presents the concept of hooks. Hooks are a monitoring point in the Windows message processing mechanism, and the hooks provide a callback function. When a hook is installed in a program, it monitors the program's message, and the hook captures the message before the specified message arrives, so that the message is filtered or the window message is monitored in real time

The message is divided into local hooks and global hooks, the local hooks intercept only the specified messages in the specified process, and the global hooks intercept the specified messages for all processes in the system.

The following steps are implemented to intercept a specified message using hook technology:

(1) Set the hook callback function (the function that is called after intercepting the message)

(2) Install hooks using SetWindowsHookEx function

(3) Unload hooks using UnhookWindowsHookEx function

Use of message hooks to achieve special effects interface, synchronization messages, monitoring messages, self-booting and other functions

2. Virus technology

Virus technology uses message hooks to implement two functions:

(1) Monitoring user keys, misappropriation of user information

(2) Since the start of the virus to put the hook callback function in a DLL file, and then install a global message hook (easy trigger message such as WH_CBT wh_getmessage), so that the message of the process will be actively loaded into the virus DLL, the virus also follow their own initiative to carry out

Windows message Hooks