转个问答:
q:
what is the difference between the working of two ? For WH_KEYBOARD_LL
i read that it Installs a hook procedure that monitors low-level keyboard input events. What is meant bylow-level keyboard events ?
a:
Meh, don't focus too much on the term, it doesn't clarify anything. There's a huge difference between the two. WH_KEYBOARD_LL installs a hook that requires the callback to be implemented in your own program. And you must pump a message loop so that Windows can make the callback whenever it is about to dispatch a keyboard message. Which makes it really easy to get going.
WH_KEYBOARD works very differently, it requires a DLL that can be safely injected into hooked processes. Which makes it notoriously difficult to get going, injecting DLLs without affecting a process isn't easy. Particularly on a 64-bit operating system. Nor is taking care of the inter-process communication you might need if some other process needs to know about the keystroke. Like a key logger.
The advantage of WH_KEYBOARD is that it has access to the keyboard state. Which is a per-process property in Windows. State like the active keyboard layout and the state of the modifier and dead keys matter a great deal when you want to use the hook to translate virtual keys to typing keys yourself. You can't reliably call ToUnicodeEx() from an external process.
You can't swing a cat without running into example code, google will give you plenty. So be sure to use something known-to-work if you have never written such a hook before, it will avoid a lot of grief.
WH_KEYBOARD 一般还是在系统处理后处理,注入式键盘挂钩(注入dll到目标进程估计没人会喜欢),所以像Ctrl+alt+del 系统会先处理掉,WH_KEYBOARD没法截获
WH_KEYBOARD_LL是在系统处理前处理的,所以很容易引起挂起之类的问题,不过操作系统通过LowLevelHooksTimeout控制超时,如果这个时间后HOOK函数还没返回,就直接被忽略了
所以要监视键盘,还是用WH_KEYBOARD_LL吧