SetWindowsHookEx 详解（二）

类型： WH_FOREGROUNDIDLE值 11，回调参数如下

ForegroundIdleProc callback function

An application-defined or library-defined callback function used with theSetWindowsHookEx function. The system calls this function whenever the foreground thread is about to become idle.

The HOOKPROC type defines a pointer to this callback function.ForegroundIdleProc is a placeholder for the application-defined or library-defined function name.

Syntax

C++

DWORD CALLBACK ForegroundIdleProc(
  _In_  int code,
  DWORD wParam,
  LONG lParam
);

Parameters

code [in]

Type: int

If code is HC_ACTION, the hook procedure must process the message. Ifcode is less than zero, the hook procedure must pass the message to theCallNextHookEx function without further processing and should return the value returned by CallNextHookEx.

wParam

Type: DWORD

This parameter is not used.

lParam

Type: LONG

This parameter is not used.

Return value

Type:

Type: DWORD

If code is less than zero, the hook procedure must return the value returned byCallNextHookEx.

If code is greater than or equal to zero, it is highly recommended that you callCallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_FOREGROUNDIDLE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.

Remarks

An application installs this hook procedure by specifying theWH_FOREGROUNDIDLE hook type and the pointer to the hook procedure in a call to the SetWindowsHookEx function.

Requirements

Minimum supported client	Windows 2000 Professional [desktop apps only]
Minimum supported server	Windows 2000 Server [desktop apps only]
Header	Winuser.h (include Windows.h)

类型：  WH_GETMESSAGE值 3，回调参数如下

GetMsgProc callback function

An application-defined or library-defined callback function used with theSetWindowsHookEx function. The system calls this function whenever theGetMessage or PeekMessage function has retrieved a message from an application message queue. Before returning the retrieved message to the caller, the system passes the message to the hook procedure.

The HOOKPROC type defines a pointer to this callback function. GetMsgProc is a placeholder for the application-defined or library-defined function name.

Syntax

C++

LRESULT CALLBACK GetMsgProc(
  _In_  int code,
  _In_  WPARAM wParam,
  _In_  LPARAM lParam
);

Parameters

code [in]

Type: int

Specifies whether the hook procedure must process the message. If codeis HC_ACTION, the hook procedure must process the message. If code is less than zero, the hook procedure must pass the message to theCallNextHookEx function without further processing and should return the value returned by CallNextHookEx.

wParam [in]

Type: WPARAM

Specifies whether the message has been removed from the queue. This parameter can be one of the following values.

Value	Meaning
PM_NOREMOVE 0x0000	The message has not been removed from the queue. (An application called the PeekMessagefunction, specifying the PM_NOREMOVE flag.)
PM_REMOVE 0x0001	The message has been removed from the queue. (An application called GetMessage, or it called thePeekMessage function, specifying thePM_REMOVE flag.)

 

lParam [in]

Type: LPARAM

A pointer to an MSG structure that contains details about the message.

Return value

Type:

Type: LRESULT

If code is less than zero, the hook procedure must return the value returned byCallNextHookEx.

If code is greater than or equal to zero, it is highly recommended that you callCallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_GETMESSAGE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not callCallNextHookEx, the return value should be zero.

Remarks

The GetMsgProc hook procedure can examine or modify the message. After the hook procedure returns control to the system, the GetMessage orPeekMessage function returns the message, along with any modifications, to the application that originally called it.

An application installs this hook procedure by specifying the WH_GETMESSAGEhook type and a pointer to the hook procedure in a call to theSetWindowsHookEx function.

Requirements

Minimum supported client	Windows 2000 Professional [desktop apps only]
Minimum supported server	Windows 2000 Server [desktop apps only]
Header	Winuser.h (include Windows.h)

类型：  WH_JOURNALPLAYBACK值1，回调参数如下

JournalPlaybackProc callback function

An application-defined or library-defined callback function used with theSetWindowsHookEx function. Typically, an application uses this function to play back a series of mouse and keyboard messages recorded previously by theJournalRecordProc hook procedure. As long as a JournalPlaybackProc hook procedure is installed, regular mouse and keyboard input is disabled.

The HOOKPROC type defines a pointer to this callback function.JournalPlaybackProc is a placeholder for the application-defined or library-defined function name.

Syntax

C++

LRESULT CALLBACK JournalPlaybackProc(
  _In_  int code,
  WPARAM wParam,
  _In_  LPARAM lParam
);

Parameters

code [in]

Type: int

A code the hook procedure uses to determine how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.

Value	Meaning
HC_GETNEXT 1	The hook procedure must copy the current mouse or keyboard message to theEVENTMSG structure pointed to by thelParam parameter.
HC_NOREMOVE 3	An application has called the PeekMessagefunction with wRemoveMsg set toPM_NOREMOVE, indicating that the message is not removed from the message queue afterPeekMessage processing.
HC_SKIP 2	The hook procedure must prepare to copy the next mouse or keyboard message to theEVENTMSG structure pointed to by lParam. Upon receiving the HC_GETNEXT code, the hook procedure must copy the message to the structure.
HC_SYSMODALOFF 5	A system-modal dialog box has been destroyed. The hook procedure must resume playing back the messages.
HC_SYSMODALON 4	A system-modal dialog box is being displayed. Until the dialog box is destroyed, the hook procedure must stop playing back messages.

 

wParam

Type: WPARAM

This parameter is not used.

lParam [in]

Type: LPARAM

A pointer to an EVENTMSG structure that represents a message being processed by the hook procedure. This parameter is valid only when thecode parameter is HC_GETNEXT.

Return value

Type:

Type: LRESULT

To have the system wait before processing the message, the return value must be the amount of time, in clock ticks, that the system should wait. (This value can be computed by calculating the difference between the time members in the current and previous input messages.) To process the message immediately, the return value should be zero. The return value is used only if the hook code is HC_GETNEXT; otherwise, it is ignored.

Remarks

A JournalPlaybackProc hook procedure should copy an input message to thelParam parameter. The message must have been previously recorded by using a JournalRecordProc hook procedure, which should not modify the message.

To retrieve the same message over and over, the hook procedure can be called several times with the code parameter set to HC_GETNEXT without an intervening call with code set to HC_SKIP.

If code is HC_GETNEXT and the return value is greater than zero, the system sleeps for the number of milliseconds specified by the return value. When the system continues, it calls the hook procedure again with code set toHC_GETNEXT to retrieve the same message. The return value from this new call to JournalPlaybackProc should be zero; otherwise, the system will go back to sleep for the number of milliseconds specified by the return value, callJournalPlaybackProc again, and so on. The system will appear to be not responding.

Unlike most other global hook procedures, the JournalRecordProc andJournalPlaybackProc hook procedures are always called in the context of the thread that set the hook.

After the hook procedure returns control to the system, the message continues to be processed. If code is HC_SKIP, the hook procedure must prepare to return the next recorded event message on its next call.

Install the JournalPlaybackProc hook procedure by specifying theWH_JOURNALPLAYBACK type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.

If the user presses CTRL+ESC OR CTRL+ALT+DEL during journal playback, the system stops the playback, unhooks the journal playback procedure, and posts a WM_CANCELJOURNAL message to the journaling application.

If the hook procedure returns a message in the range WM_KEYFIRST toWM_KEYLAST, the following conditions apply:

• The paramL member of the EVENTMSG structure specifies the virtual key code of the key that was pressed.
• The paramH member of the EVENTMSG structure specifies the scan code.
• There's no way to specify a repeat count. The event is always taken to represent one key event.

Requirements

Minimum supported client	Windows 2000 Professional [desktop apps only]
Minimum supported server	Windows 2000 Server [desktop apps only]
Header	Winuser.h (include Windows.h)

类型：  WH_JOURNALRECORD值0，回调参数如下

JournalRecordProc callback function

An application-defined or library-defined callback function used with theSetWindowsHookEx function. The function records messages the system removes from the system message queue. Later, an application can use aJournalPlaybackProc hook procedure to play back the messages.

The HOOKPROC type defines a pointer to this callback function.JournalRecordProc is a placeholder for the application-defined or library-defined function name.

Syntax

C++

LRESULT CALLBACK JournalRecordProc(
  _In_  int code,
  WPARAM wParam,
  _In_  LPARAM lParam
);

Parameters

code [in]

Type: int

Specifies how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned byCallNextHookEx. This parameter can be one of the following values.

Value	Meaning
HC_ACTION 0	The lParam parameter is a pointer to anEVENTMSG structure containing information about a message removed from the system queue. The hook procedure must record the contents of the structure by copying them to a buffer or file.
HC_SYSMODALOFF 5	A system-modal dialog box has been destroyed. The hook procedure must resume recording.
HC_SYSMODALON 4	A system-modal dialog box is being displayed. Until the dialog box is destroyed, the hook procedure must stop recording.

 

wParam

Type: WPARAM

This parameter is not used.

lParam [in]

Type: LPARAM

A pointer to an EVENTMSG structure that contains the message to be recorded.

Return value

Type:

Type: LRESULT

The return value is ignored.

Remarks

A JournalRecordProc hook procedure must copy but not modify the messages. After the hook procedure returns control to the system, the message continues to be processed.

Install the JournalRecordProc hook procedure by specifying theWH_JOURNALRECORD type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.

A JournalRecordProc hook procedure does not need to live in a dynamic-link library. A JournalRecordProc hook procedure can live in the application itself.

Unlike most other global hook procedures, the JournalRecordProc andJournalPlaybackProc hook procedures are always called in the context of the thread that set the hook.

An application that has installed a JournalRecordProc hook procedure should watch for the VK_CANCEL virtual key code (which is implemented as the CTRL+BREAK key combination on most keyboards). This virtual key code should be interpreted by the application as a signal that the user wishes to stop journal recording. The application should respond by ending the recording sequence and removing the JournalRecordProc hook procedure. Removal is important. It prevents a journaling application from locking up the system by hanging inside a hook procedure.

This role as a signal to stop journal recording means that a CTRL+BREAK key combination cannot itself be recorded. Since the CTRL+C key combination has no such role as a journaling signal, it can be recorded. There are two other key combinations that cannot be recorded: CTRL+ESC and CTRL+ALT+DEL. Those two key combinations cause the system to stop all journaling activities (record or playback), remove all journaling hooks, and post a WM_CANCELJOURNALmessage to the journaling application.

Requirements

Minimum supported client	Windows 2000 Professional [desktop apps only]
Minimum supported server	Windows 2000 Server [desktop apps only]
Header	Winuser.h (include Windows.h)

类型：  WH_KEYBOARD值2，回调参数如下

KeyboardProc callback function

An application-defined or library-defined callback function used with theSetWindowsHookEx function. The system calls this function whenever an application calls the GetMessage or PeekMessage function and there is a keyboard message (WM_KEYUP or WM_KEYDOWN) to be processed.

The HOOKPROC type defines a pointer to this callback function. KeyboardProcis a placeholder for the application-defined or library-defined function name.

Syntax

C++

LRESULT CALLBACK KeyboardProc(
  _In_  int code,
  _In_  WPARAM wParam,
  _In_  LPARAM lParam
);

Parameters

code [in]

Type: int

A code the hook procedure uses to determine how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.

Value	Meaning
HC_ACTION 0	The wParam and lParam parameters contain information about a keystroke message.
HC_NOREMOVE 3	The wParam and lParam parameters contain information about a keystroke message, and the keystroke message has not been removed from the message queue. (An application called thePeekMessage function, specifying thePM_NOREMOVE flag.)

 

wParam [in]

Type: WPARAM

The virtual-key code of the key that generated the keystroke message.

lParam [in]

Type: LPARAM

The repeat count, scan code, extended-key flag, context code, previous key-state flag, and transition-state flag. For more information about thelParam parameter, see Keystroke Message Flags. The following table describes the bits of this value.

Bits	Description
0-15	The repeat count. The value is the number of times the keystroke is repeated as a result of the user's holding down the key.
16-23	The scan code. The value depends on the OEM.
24	Indicates whether the key is an extended key, such as a function key or a key on the numeric keypad. The value is 1 if the key is an extended key; otherwise, it is 0.
25-28	Reserved.
29	The context code. The value is 1 if the ALT key is down; otherwise, it is 0.
30	The previous key state. The value is 1 if the key is down before the message is sent; it is 0 if the key is up.
31	The transition state. The value is 0 if the key is being pressed and 1 if it is being released.

 

Return value

Type:

Type: LRESULT

If code is less than zero, the hook procedure must return the value returned byCallNextHookEx.

If code is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installedWH_KEYBOARD hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.

Remarks

An application installs the hook procedure by specifying the WH_KEYBOARDhook type and a pointer to the hook procedure in a call to theSetWindowsHookEx function.

This hook may be called in the context of the thread that installed it. The call is made by sending a message to the thread that installed the hook. Therefore, the thread that installed the hook must have a message loop.

Requirements

Minimum supported client	Windows 2000 Professional [desktop apps only]
Minimum supported server	Windows 2000 Server [desktop apps only]
Header	Winuser.h (include Windows.h)

类型：  WH_KEYBOARD_LL值13，回调参数如下

LowLevelKeyboardProc callback function

An application-defined or library-defined callback function used with theSetWindowsHookEx function. The system calls this function every time a new keyboard input event is about to be posted into a thread input queue.

The HOOKPROC type defines a pointer to this callback function.LowLevelKeyboardProc is a placeholder for the application-defined or library-defined function name.

Syntax

C++

LRESULT CALLBACK LowLevelKeyboardProc(
  _In_  int nCode,
  _In_  WPARAM wParam,
  _In_  LPARAM lParam
);

Parameters

nCode [in]

Type: int

A code the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.

Value	Meaning
HC_ACTION 0	The wParam and lParam parameters contain information about a keyboard message.

 

wParam [in]

Type: WPARAM

The identifier of the keyboard message. This parameter can be one of the following messages: WM_KEYDOWN, WM_KEYUP, WM_SYSKEYDOWN, or WM_SYSKEYUP.

lParam [in]

Type: LPARAM

A pointer to a KBDLLHOOKSTRUCT structure.

Return value

Type:

Type: LRESULT

If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.

If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookExand return the value it returns; otherwise, other applications that have installedWH_KEYBOARD_LL hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.

Remarks

An application installs the hook procedure by specifying theWH_KEYBOARD_LL hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.

This hook is called in the context of the thread that installed it. The call is made by sending a message to the thread that installed the hook. Therefore, the thread that installed the hook must have a message loop.

The keyboard input can come from the local keyboard driver or from calls to the keybd_event function. If the input comes from a call to keybd_event, the input was "injected". However, the WH_KEYBOARD_LL hook is not injected into another process. Instead, the context switches back to the process that installed the hook and it is called in its original context. Then the context switches back to the application that generated the event.

The hook procedure should process a message in less time than the data entry specified in the LowLevelHooksTimeout value in the following registry key:

HKEY_CURRENT_USER\Control Panel\Desktop

The value is in milliseconds. If the hook procedure times out, the system passes the message to the next hook. However, on Windows 7 and later, the hook is silently removed without being called. There is no way for the application to know whether the hook is removed.

Note  Debug hooks cannot track this type of low level keyboard hooks. If the application must use low level hooks, it should run the hooks on a dedicated thread that passes the work off to a worker thread and then immediately returns. In most cases where the application needs to use low level hooks, it should monitor raw input instead. This is because raw input can asynchronously monitor mouse and keyboard messages that are targeted for other threads more effectively than low level hooks can. For more information on raw input, see Raw Input.

Requirements

Minimum supported client	Windows 2000 Professional [desktop apps only]
Minimum supported server	Windows 2000 Server [desktop apps only]
Header	Winuser.h (include Windows.h)

类型：  WH_KEYBOARD_LL值13，回调参数如下