SetWindowsHookEx 详解（四）所有结构体

最新推荐文章于 2021-03-05 17:32:38 发布
最新推荐文章于 2021-03-05 17:32:38 发布
阅读量1.5k 收藏 1
点赞数
分类专栏： C/C++

MOUSEHOOKSTRUCT structure

Contains information about a mouse event passed to a WH_MOUSE hook procedure, MouseProc.

Syntax

C++
Copy 
typedef struct tagMOUSEHOOKSTRUCT {
  POINT     pt;
  HWND      hwnd;
  UINT      wHitTestCode;
  ULONG_PTR dwExtraInfo;
} MOUSEHOOKSTRUCT, *PMOUSEHOOKSTRUCT, *LPMOUSEHOOKSTRUCT;

Members

pt

Type: POINT

The x- and y-coordinates of the cursor, in screen coordinates.

hwnd

Type: HWND

A handle to the window that will receive the mouse message corresponding to the mouse event.

wHitTestCode

Type: UINT

The hit-test value. For a list of hit-test values, see the description of the WM_NCHITTEST message.

dwExtraInfo

Type: ULONG_PTR

Additional information associated with the message.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header
Winuser.h (include Windows.h)

MSLLHOOKSTRUCT structure

Contains information about a low-level mouse input event.

Syntax

C++
Copy 
typedef struct tagMSLLHOOKSTRUCT {
  POINT     pt;
  DWORD     mouseData;
  DWORD     flags;
  DWORD     time;
  ULONG_PTR dwExtraInfo;
} MSLLHOOKSTRUCT, *PMSLLHOOKSTRUCT, *LPMSLLHOOKSTRUCT;

Members

pt

Type: POINT

The x- and y-coordinates of the cursor, in screen coordinates.

mouseData

Type: DWORD

If the message is WM_MOUSEWHEEL, the high-order word of this member is the wheel delta. The low-order word is reserved. A positive value indicates that the wheel was rotated forward, away from the user; a negative value indicates that the wheel was rotated backward, toward the user. One wheel click is defined as WHEEL_DELTA, which is 120.

If the message is WM_XBUTTONDOWN, WM_XBUTTONUP, WM_XBUTTONDBLCLK,WM_NCXBUTTONDOWN, WM_NCXBUTTONUP, or WM_NCXBUTTONDBLCLK, the high-order word specifies which X button was pressed or released, and the low-order word is reserved. This value can be one or more of the following values. Otherwise, mouseData is not used.

ValueMeaning
XBUTTON1 0x0001

The first X button was pressed or released.

XBUTTON2 0x0002

The second X button was pressed or released.

 

flags

Type: DWORD

The event-injected flags. An application can use the following values to test the flags. Testing LLMHF_INJECTED (bit 0) will tell you whether the event was injected. If it was, then testing LLMHF_LOWER_IL_INJECTED (bit 1) will tell you whether or not the event was injected from a process running at lower integrity level.

ValueMeaning
LLMHF_INJECTED 0x00000001

Test the event-injected (from any process) flag.

LLMHF_LOWER_IL_INJECTED 0x00000002

Test the event-injected (from a process running at lower integrity level) flag.

 

time

Type: DWORD

The time stamp for this message.

dwExtraInfo

Type: ULONG_PTR

Additional information associated with the message.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header
Winuser.h (include Windows.h)

MSG structure

Contains message information from a thread's message queue.

Syntax

C++
Copy 
typedef struct tagMSG {
  HWND   hwnd;
  UINT   message;
  WPARAM wParam;
  LPARAM lParam;
  DWORD  time;
  POINT  pt;
} MSG, *PMSG, *LPMSG;

Members

hwnd

Type: HWND

A handle to the window whose window procedure receives the message. This member is NULL when the message is a thread message.

message

Type: UINT

The message identifier. Applications can only use the low word; the high word is reserved by the system.

wParam

Type: WPARAM

Additional information about the message. The exact meaning depends on the value of the messagemember.

lParam

Type: LPARAM

Additional information about the message. The exact meaning depends on the value of the messagemember.

time

Type: DWORD

The time at which the message was posted.

pt

Type: POINT

The cursor position, in screen coordinates, when the message was posted.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps | Windows Store apps]

Minimum supported server

Windows 2000 Server [desktop apps | Windows Store apps]

Header
Winuser.h (include Windows.h)

RECT structure

The RECT structure defines the coordinates of the upper-left and lower-right corners of a rectangle.

Syntax

C++
Copy 
typedef struct _RECT {
  LONG left;
  LONG top;
  LONG right;
  LONG bottom;
} RECT, *PRECT;

Members

left

The x-coordinate of the upper-left corner of the rectangle.

top

The y-coordinate of the upper-left corner of the rectangle.

right

The x-coordinate of the lower-right corner of the rectangle.

bottom

The y-coordinate of the lower-right corner of the rectangle.

Remarks

By convention, the right and bottom edges of the rectangle are normally considered exclusive. In other words, the pixel whose coordinates are ( right, bottom ) lies immediately outside of the rectangle. For example, whenRECT is passed to the FillRect function, the rectangle is filled up to, but not including, the right column and bottom row of pixels. This structure is identical to the RECTL structure.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header
Windef.h (include Windows.h)

EVENTMSG structure

Contains information about a hardware message sent to the system message queue. This structure is used to store message information for the JournalPlaybackProc callback function.

Syntax

C++
Copy 
typedef struct tagEVENTMSG {
  UINT  message;
  UINT  paramL;
  UINT  paramH;
  DWORD time;
  HWND  hwnd;
} EVENTMSG, *PEVENTMSG, *LPEVENTMSG;

Members

message

Type: UINT

The message.

paramL

Type: UINT

Additional information about the message. The exact meaning depends on the message value.

paramH

Type: UINT

Additional information about the message. The exact meaning depends on the message value.

time

Type: DWORD

The time at which the message was posted.

hwnd

Type: HWND

A handle to the window to which the message was posted.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header
Winuser.h (include Windows.h)

KBDLLHOOKSTRUCT structure

Contains information about a low-level keyboard input event.

Syntax

C++
Copy 
typedef struct tagKBDLLHOOKSTRUCT {
  DWORD     vkCode;
  DWORD     scanCode;
  DWORD     flags;
  DWORD     time;
  ULONG_PTR dwExtraInfo;
} KBDLLHOOKSTRUCT, *PKBDLLHOOKSTRUCT, *LPKBDLLHOOKSTRUCT;

Members

vkCode

Type: DWORD

A virtual-key code. The code must be a value in the range 1 to 254.

scanCode

Type: DWORD

A hardware scan code for the key.

flags

Type: DWORD

The extended-key flag, event-injected flags, context code, and transition-state flag. This member is specified as follows. An application can use the following values to test the keystroke flags. Testing LLKHF_INJECTED (bit 4) will tell you whether the event was injected. If it was, then testing LLKHF_LOWER_IL_INJECTED (bit 1) will tell you whether or not the event was injected from a process running at lower integrity level.

ValueMeaning
LLKHF_EXTENDED (KF_EXTENDED >> 8)

Test the extended-key flag.

LLKHF_LOWER_IL_INJECTED 0x00000002

Test the event-injected (from a process running at lower integrity level) flag.

LLKHF_INJECTED 0x00000010

Test the event-injected (from any process) flag.

LLKHF_ALTDOWN (KF_ALTDOWN >> 8)

Test the context code.

LLKHF_UP (KF_UP >> 8)

Test the transition-state flag.

 

The following table describes the layout of this value.

BitsDescription
0Specifies whether the key is an extended key, such as a function key or a key on the numeric keypad. The value is 1 if the key is an extended key; otherwise, it is 0.
1Specifies whether the event was injected from a process running at lower integrity level. The value is 1 if that is the case; otherwise, it is 0. Note that bit 4 is also set whenever bit 1 is set.
2-3Reserved.
4Specifies whether the event was injected. The value is 1 if that is the case; otherwise, it is 0. Note that bit 1 is not necessarily set when bit 4 is set.
5The context code. The value is 1 if the ALT key is pressed; otherwise, it is 0.
6Reserved.
7The transition state. The value is 0 if the key is pressed and 1 if it is being released.

 

time

Type: DWORD

The time stamp for this message, equivalent to what GetMessageTime would return for this message.

dwExtraInfo

Type: ULONG_PTR

Additional information associated with the message.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header
Winuser.h (include Windows.h)

CWPSTRUCT structure

Defines the message parameters passed to a WH_CALLWNDPROC hook procedure, CallWndProc.

Syntax

C++
Copy 
typedef struct tagCWPSTRUCT {
  LPARAM lParam;
  WPARAM wParam;
  UINT   message;
  HWND   hwnd;
} CWPSTRUCT, *PCWPSTRUCT, *LPCWPSTRUCT;

Members

lParam

Type: LPARAM

Additional information about the message. The exact meaning depends on the message value.

wParam

Type: WPARAM

Additional information about the message. The exact meaning depends on the message value.

message

Type: UINT

The message.

hwnd

Type: HWND

A handle to the window to receive the message.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header
Winuser.h (include Windows.h)

CWPRETSTRUCT structure

Defines the message parameters passed to a WH_CALLWNDPROCRET hook procedure, CallWndRetProc.

Syntax

C++
Copy 
typedef struct tagCWPRETSTRUCT {
  LRESULT lResult;
  LPARAM  lParam;
  WPARAM  wParam;
  UINT    message;
  HWND    hwnd;
} CWPRETSTRUCT, *PCWPRETSTRUCT, *LPCWPRETSTRUCT;

Members

lResult

Type: LRESULT

The return value of the window procedure that processed the message specified by the message value.

lParam

Type: LPARAM

Additional information about the message. The exact meaning depends on the message value.

wParam

Type: WPARAM

Additional information about the message. The exact meaning depends on the message value.

message

Type: UINT

The message.

hwnd

Type: HWND

A handle to the window that processed the message specified by the message value.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header
Winuser.h (include Windows.h)

CBT_CREATEWND structure

Contains information passed to a WH_CBT hook procedure, CBTProc, before a window is created.

Syntax

C++
Copy 
typedef struct tagCBT_CREATEWND {
  LPCREATESTRUCT lpcs;
  HWND           hwndInsertAfter;
} CBT_CREATEWND, *LPCBT_CREATEWND;

Members

lpcs

Type: LPCREATESTRUCT

A pointer to a CREATESTRUCT structure that contains initialization parameters for the window about to be created.

hwndInsertAfter

Type: HWND

A handle to the window whose position in the Z order precedes that of the window being created. This member can also be NULL.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header
Winuser.h (include Windows.h)

Unicode and ANSI names

CBT_CREATEWNDW (Unicode) and CBT_CREATEWNDA (ANSI)

CBTACTIVATESTRUCT structure

Contains information passed to a WH_CBT hook procedure, CBTProc, before a window is activated.

Syntax

C++
Copy 
typedef struct tagCBTACTIVATESTRUCT {
  BOOL fMouse;
  HWND hWndActive;
} CBTACTIVATESTRUCT, *LPCBTACTIVATESTRUCT;

Members

fMouse

Type: BOOL

This member is TRUE if a mouse click is causing the activation or FALSE if it is not.

hWndActive

Type: HWND

A handle to the active window.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header
Winuser.h (include Windows.h)

CBT_CREATEWND structure

Contains information passed to a WH_CBT hook procedure, CBTProc, before a window is created.

Syntax

C++
Copy 
typedef struct tagCBT_CREATEWND {
  LPCREATESTRUCT lpcs;
  HWND           hwndInsertAfter;
} CBT_CREATEWND, *LPCBT_CREATEWND;

Members

lpcs

Type: LPCREATESTRUCT

A pointer to a CREATESTRUCT structure that contains initialization parameters for the window about to be created.

hwndInsertAfter

Type: HWND

A handle to the window whose position in the Z order precedes that of the window being created. This member can also be NULL.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header
Winuser.h (include Windows.h)

Unicode and ANSI names

CBT_CREATEWNDW (Unicode) and CBT_CREATEWNDA (ANSI)

DEBUGHOOKINFO structure

Contains debugging information passed to a WH_DEBUG hook procedure, DebugProc.

Syntax

C++
Copy 
typedef struct tagDEBUGHOOKINFO {
  DWORD  idThread;
  DWORD  idThreadInstaller;
  LPARAM lParam;
  WPARAM wParam;
  int    code;
} DEBUGHOOKINFO, *PDEBUGHOOKINFO, *LPDEBUGHOOKINFO;

Members

idThread

Type: DWORD

A handle to the thread containing the filter function.

idThreadInstaller

Type: DWORD

A handle to the thread that installed the debugging filter function.

lParam

Type: LPARAM

The value to be passed to the hook in the lParam parameter of the DebugProc callback function.

wParam

Type: WPARAM

The value to be passed to the hook in the wParam parameter of the DebugProc callback function.

code

Type: int

The value to be passed to the hook in the nCode parameter of the DebugProc callback function.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header
Winuser.h (include Windows.h)
Louis_815
关注
  • 0
    点赞
  • 踩
  • 1
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
hook_keyboard.zip_SetWindowsHookEx
09-21
简单的键盘记录器，利用HOOK技术，通过API函数SetWindowsHookEx完成的一款键盘记录器，可执行文件是控制台编写
进程间传递钩子消息时无法收到参数的问题
Louis_815的博客
09-27 673
MOUSEHOOKSTRUCT structure Contains information about a mouse event passed to a WH_MOUSE hook procedure, MouseProc. Syntax C++ Copy typedef struct tagMOUSEHOOKSTRUCT { POINT   
利用debug钩子拦截全局钩子，经典反黑客技术
热门推荐
尹成的技术博客
04-14 1万+
// 键盘钩子消息处理过程LRESULT CALLBACK DebugProc ( int nCode, WPARAM wParam, LPARAM lParam ){ if ( nCode == HC_ACTION ) {  PDEBUGHOOKINFO pDebugHookInfo = (PDEBUGHOOKINFO)lParam ;  switch ( wParam )  {  case W
【windows核心编程】一个HOOK的例子
chiaozu5312的博客
12-01 120
一、应用场景 封装一个OCX控件，该控件的作用是来播放一个视频文件，需要在一个进程中放置四个控件实例。 由于控件是提供给别人用的，因此需要考虑很多东西。 二、考虑因素 1、控件的父窗口resize时需要控件也随之resize 子窗体不能知道父窗口的resize情况，...
使用调试钩子屏蔽全局钩子
huobengle
09-06 307
WH_DEBUG为调试钩子,用来给钩子函数除错。在系统调用系统中与其他Hook关联的Hook钩子例程之前，系统会调用WH_DEBUG Hook钩子例程。你可以使用这个Hook来决定是否允许系统调用与其他Hook关联的Hook钩子例程。WH_DEBUG调用DebugProc钩子例程。 DebugProc语法：LRESULT CALLBACK DebugProc( int nCode, ...
利用debug钩子拦截全局钩子 经典反黑客技术
fdgugfv的博客
11-04 228
分享一下我老师大神的人工智能教程！零基础，通俗易懂！http://blog.csdn.net/jiangjunshow也欢迎大家转载本篇文章。分享知识，造福人民，实现我们中华民族伟大复兴！                // 键盘钩子消息处理
windows hook SetWindowsHookEx 捕获键盘组合键 钩子
07-04
windows hook SetWindowsHookEx 捕获键盘组合键 QT ,调出主界面。 组合键配置在./conf/Assist.ini 文件中，目前是M+N 按键。钩子捕获按键.在qt 5.7.0 下编译运行没有问题。
SetWindowsHookEx Hook demo
03-21
SetWindowsHookEx 64位，或32位，不同，需要编译各自的库、SetWindowsHookEx 64位，或32位，不同，需要编译各自的库、
SetWindowsHookEx实现DLL注入
06-05
SetWindowsHookEx实现DLL注入
DllInjection_SetWindowsHookEx
04-30
DllInjection_SetWindowsHookEx 参考ReverseCore 在Windows 7 32bit上成功运行 用法： injection.exe ProcessName DataDestinationPath 除非要将DLL注入系统程序，否则请不要以管理员身份运行。
c# SetWindowsHookEx 钩子
06-19
c# SetWindowsHookEx 钩子 demo
SetWindowsHookEx进程dll注入
10-01
SetWindowsHookEx进程dll注入
HOOK之SetWindowsHookEx
07-05
HOOK之SetWindowsHookEx教程，HOOK之SetWindowsHookEx教程，HOOK之SetWindowsHookEx教程，HOOK之SetWindowsHookEx教程，HOOK之SetWindowsHookEx教程，讲解的不错，有兴趣可以看看！！！！！
Windows的钩子机制详解
12-31
了解windows程序设计的人都知道，Windows系统程序的运行是建立在消息传递机制的基础之上的，几乎所有的程序活动都由消息来驱动。钩子机制可以看作是一个消息的中转站，控制系统发出消息的处理和传递。利用钩子，我们...
SetWindowsHookEx： 全局钩子实现键盘记录器 Hook Steam
最新发布
12-31
SetWindowsHookEx 钩子(Hook)，是Windows消息处理机制的一个平台，应用程序可以在上面设置子程以监视指定窗口的某种消息，而且所监视的窗口可以是其他进程所创建的。当消息到达后，在目标窗口处理函数之前处理它。...
Hook技术:奇妙的调试Hook技术详解(附源码)
weixin_43742894的博客
05-08 2596
为什么叫做奇妙的调试Hook呢？因为在学习《逆向工程核心原理》的过程中，发现hook的方式千变万化，越觉得欣喜，相较于其他的Address Hook、Inline Hook，调试Hook让我觉得独特。 调试Hook什么是调试Hook？实现原理实现流程实战练习优缺点源码示例 什么是调试Hook？ 调试Hook是通过调试方式进行的API钩取函数。 在这之前我们先了解一点调试器的知识。 调试器用来确认被调试者是否正确运行，发现未知的错误。调试器能够逐一执行被调试者的指令，拥有对调试器与内存的所有访问权限。 每当被
C++ Hook 键盘记录器
LYSM
08-08 5855
之前写外挂做过指定进程的 Hook，但是没有尝试过全局 Hook，所以今天就来试试。全局 Hook 的用途我第一个就想到了键盘记录器（貌似我也就想到了这个 哈哈），那就写一个吧。 步伐逐渐鬼畜… 先上效果图（没图没真相，我看别人的博客都喜欢上来先看图，木哈哈 ~） U•ェ•*U 然后就是代码，我代码有点多，但是都有注释（注释就是艺术！） 其实也不多，就是 switch case 占了很大的比例...
钩子教程 - 原理(二十九) : 结构体 -- KBDLLHOOKSTRUCT
weixin_30662011的博客
05-17 1005
原文地址 :http://www.zdexe.com/program/201004/603.html 结构7：KBDLLHOOKSTRUCT Structure TheKBDLLHOOKSTRUCTstructure contains information about a low-level keyboard input event. 　　该结构包含有低层键盘输入事件的信息。 Sy...
键盘钩子里区分按键
lovehuanhuan1314的专栏
03-05 553
在做一个键盘测试demo时需要区分一些复合键。比如在数字键区当Num按下和按上时按键是不一样的，但是它们和其它区的按键是相同的，比如Ins,Del,上，下左右或者是翻页。通过测试发现KBDLLHOOKSTRUCT里有一个flags标记，它可以区分按键。上代码， std::map<int, int> idlist = { {VK_END,VK_NUMPAD1}, {VK_RETURN,313}, {VK_UP,VK_NUMPAD8}, {VK_DOWN,VK_NUMPAD2}, {V
SetWindowsHookEx
06-11
`SetWindowsHookEx`是一个Windows API函数，用于安装一个全局的或局部的钩子函数。该函数可以用于截获和处理系统和应用程序的消息和事件，比如键盘、鼠标、消息等。使用钩子函数可以实现一些高级的功能，如键盘记录、鼠标跟踪、窗口监控等。 `SetWindowsHookEx`的函数原型如下： ```c++ HHOOK SetWindowsHookEx( int idHook, HOOKPROC lpfn, HINSTANCE hMod, DWORD dwThreadId ); ``` 其中，参数含义如下： - `idHook`：指定需要安装的钩子类型，可以使用以下常量中的一个或多个来指定钩子类型： - `WH_KEYBOARD`：键盘钩子。 - `WH_MOUSE`：鼠标钩子。 - `WH_CALLWNDPROC`：消息钩子。 - `WH_CBT`：窗口钩子。 - `WH_GETMESSAGE`：获取消息钩子。 - `WH_JOURNALRECORD`：记录钩子。 - `WH_KEYBOARD_LL`：低级键盘钩子。 - `WH_MOUSE_LL`：低级鼠标钩子。 - `lpfn`：指定钩子函数的地址，该函数的原型为`LRESULT CALLBACK HookProc(int nCode, WPARAM wParam, LPARAM lParam)`，其中`nCode`表示钩子类型，`wParam`和`lParam`表示传递给钩子函数的消息和事件参数。钩子函数必须返回一个值，具体取决于钩子类型。 - `hMod`：指定包含钩子函数的模块的句柄，通常可以设置为NULL。 - `dwThreadId`：指定需要安装钩子的线程ID，如果为0，则表示钩子函数将被安装到系统的所有线程中，为全局钩子。 例如，以下代码安装一个键盘钩子： ```c++ HHOOK hHook = SetWindowsHookEx(WH_KEYBOARD, HookProc, NULL, 0); ``` 需要注意的是，安装钩子函数需要有足够的权限，并且需要谨慎使用，不当的使用可能会对系统和应用程序的稳定性产生不良影响。同时，安装钩子函数后，需要在使用完毕后及时卸载，否则可能会导致钩子函数一直运行，耗费系统资源。

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值