钩钩钩子，HOOK,复制粘贴没整理

SetWindowsHookEx Function
此函数添加了一个程序定义的钩子过程到钩子链中，用这个钩子过程来监视系统中的特定类型的事件，这些事件与指定的线程或所有的线程相关

HHOOK SetWindowsHookEx(
int idHook,
HOOKPROC lpfn,
HINSTANCE hMod,
DWORD dwThreadId
);

参数详解:
idHook:指定钩子过程的类型，取值如下:
WH_CALLWNDPROC:安装一个钩子过程在消息发送到目标窗口前截获消息，调用时机:调用sendmessage时
WH_CALLWNDPROCRET:安装一个钩子过程在消息发送到目标窗口后获得消息，调用时机:调用sendmessage返回时
WH_CBT:
WH_GETMESSAGE :当调用GetMessage或PeekMessage时
WH_KEYBOARD:当调用GetMessage或PeekMessage从消息队列中查询WM_KEYUP时或WM_KEYDOWN消息时
WH_MOUSE : 当调用GetMessage或PeekMessage从消息队列中查询鼠标消息时
WH_HARDWARE : 当调用GetMessage 或 PeekMessage 来从消息队列中查询非鼠标，键盘消息时
WH_MSGFILTER : 当对话框，菜单或滚动条要处理一个消息时，此钩子只能是局部的
WH_SYSMSGFILTER 和WH_MSGFILTER一样，只不过是系统范围的
WH_JOURNALRECORD 当WINDOWS从硬件队列中获得消息时
WH_JOURNALPLAYBACK 当一个事件从系统的硬件输入队列中被请求时
WH_SHELL 当关于WINDOWS外壳事件发生时，如任务条需要重画它的按钮
WH_CBT当基于计算机训练(CBT)事件发生时？？？
WH_FOREGROUNDIDLE 有计算机自己使用，一般的应用程序很少使用
WH_DEBUG用来给钩子函数除错

HOOK钩子机制学习笔记(4) - 钩子函数说明 收藏
翻译参考自MaybeHelios的blog: http://blog.csdn.net/maybehelios/

    通过SetWindowsHookEx方法安装钩子，该函数指定处理拦截消息的钩子函数（回调函数），可在钩子函数中自定义消息的处理，可修改消息或屏蔽消息。钩子函数的格式是固定为：
LRESULT CALLBACK CallBackProc(     
          Int nCode,
          WPARAM wParam,
          LPARAM lParam);

    nCode参数说明:
    [in] Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and must return the value returned by CallNextHookEx.

    指定钩子子程是否必须处理该消息。如果nCode是HC_ACTION，钩子子程就必须处理该消息。如果nCode小于0，钩子子程就必须将该消息传递给CallNextHookEx，自己不对消息进行进一步的处理，必须返回由CallNextHookEx 方法返回的返回值。

    对于不同类型的钩子，其传入的参数也不一样，以下为各类钩子的参数说明：

1、WH_CALLWNDPROC
参数说明：
    wParam ：[in] Specifies whether the message was sent by the current thread. If the message was sent by the current thread, it is nonzero; otherwise, it is zero.
    指定消息是否由当前线程发出。如果消息是由当前线程发出的，该值就是非0；否则，就是0。

    lParam ：[in] Pointer to a CWPSTRUCT structure that contains details about the message.
    指向CWPSTRUCT结构的指针，该结构含有消息的细节信息。

返回值
    If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.  If nCode is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_CALLWNDPROC hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.
    如果nCode小于0，钩子子程必须返回由CallNextHookE方法返回的返回值。如果nCode大于等于0，强烈要求调用CallNextHookEx方法，并返回由它返回的返回值；否则，其他已经安装了WH_CALLWNDPROC钩子的应用程序将收不到钩子通知，可能导致行为的错误。如果钩子子程没有调用CallNextHookEx方法,返回值应该为 0。

备注
    The CallWndProc hook procedure can examine the message, but it cannot modify it. After the hook procedure returns control to the system, the message is passed to the window procedure.
    CallWndProc钩子子程能够检查消息，但是不能修改消息。当钩子子程将控制权交还给系统之后，消息被传递给窗体程序。

2、WH_ CALLWNDPROCRET
    在SendMessage方法被调用之后，系统调用CallWndRetProc方法。钩子子程能够检查、但是不能修改消息。

参数说明
    wParam ：[in] Specifies whether the message is sent by the current process. If the message is sent by the current process, it is nonzero; otherwise, it is NULL.
    指定消息是否由当前进程发出。如果消息是由当前进程发出的，wParam为非0；否则，为空。

    lParam ：[in] Pointer to a CWPRETSTRUCT structure that contains details about the message.
    指向CWPSTRUCT结构的指针，该结构含有消息的细节信息。

返回值
    If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.  If nCode is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_CALLWNDPROCRET hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.
    如果nCode小于0，钩子子程必须返回由CallNextHookE返回的返回值。如果nCode大于等于0，强烈要求调用CallNextHookEx方法，并返回由它返回的返回值；否则，其他已经安装了WH_ CALLWNDPROCRET钩子的程序将收不到钩子通知，可能导致行为的错误。如果钩子子程没有调用CallNextHookEx方法,返回值应该为0。

3、WH_CBT
    系统在下列事件发生之前调用该方法：
    1.激活、创建、销毁、最小化、最大化、移动窗体、改变窗体大小；
    2.完成系统命令；
    3.从系统消息队列中移除鼠标或者键盘事件；
    4.设置键盘焦点；
    5.同步系统消息队列。
    CBT应用程序使用该钩子子程接收来自系统的有用的通知。

参数说明:
    nCode  ：[in] Specifies a code that the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
    指定一个码值，钩子子程使用该值来决定如何处理消息。如果nCode小于0，钩子子程就必须将该消息传递给CallNextHookEx方法，自己不对消息做进一步的处理，并且应该返回由CallNextHookEx方法返回的返回值。该参数可以是以下值中的一个：
    1．HCBT_ACTIVATE  ：The system is about to activate a window.
      系统即将创建一个窗体。
    2．HCBT_CLICKSKIPPED  ：The system has removed a mouse message from the system message queue. Upon receiving this hook code, a CBT application must install a WH_JOURNALPLAYBACK hook procedure in response to the mouse message.
      系统已经将一个鼠标消息从系统消息队列中移除。一旦收到该钩子代码，CBT应用程序必须安装一个WH_JOURNALPLAYBAC钩子子程来响应鼠标消息。
    3．HCBT_CREATEWND ： A window is about to be created. The system calls the hook procedure before sending the WM_CREATE or WM_NCCREATE message to the window. If the hook procedure returns a nonzero value, the system destroys the window; the CreateWindow function returns NULL, but the WM_DESTROY message is not sent to the window. If the hook procedure returns zero, the window is created normally.
      窗体即将被创建。系统在向窗体发出WM_CREATE 或者 WM_NCCREATE消息之前，调用该钩子子程。如果钩子子程返回非0值，表示系统销毁了窗体；CreateWindow方法返回Null，但是WM_DESTROY消息并不发送给窗体。如果钩子子程返回0，表示窗体正常被创建。
      At the time of the HCBT_CREATEWND notification, the window has been created, but its final size and position may not have been determined and its parent window may not have been established. It is possible to send messages to the newly created window, although it has not yet received WM_NCCREATE or WM_CREATE messages. It is also possible to change the position in the z-order of the newly created window by modifying the hwndInsertAfter member of the CBT_CREATEWND structure.
      在 HCBT_CREATEWND通知的时候，窗体已经被创建了，但是它的最终的大小和位置可能还没有被确定，它的父窗体也可能没有被创建起来。虽然一个新创建的窗体可能还没有接收到WM_NCCREATE或者WM_CREATE消息，但是向它发送消息是可能的。通过修改CBT_CREATEWND 结构体的hwndInsertAfter成员，改变新创建窗体的在Z轴次序的位置也是可能的。
    4．HCBT_DESTROYWND ：A window is about to be destroyed.
      窗体即将被销毁。
    5．HCBT_KEYSKIPPED ：The system has removed a keyboard message from the system message queue. Upon receiving this hook code, a CBT application must install a WH_JOURNALPLAYBACK hook procedure in response to the keyboard message.
      系统已经从系统的消息队列中移除了一个键盘消息。一旦接收到该钩子代码，CBT应用程序必须安装一个WH_JOURNALPLAYBAC钩子来响应键盘消息。
    6．HCBT_MINMAX ：A window is about to be minimized or maximized.
      窗体即将被最小化或者最大化。
    7．HCBT_MOVESIZE ：A window is about to be moved or sized.
      窗体即将被移动或者重置大小。
    8．HCBT_QS  ：The system has retrieved a WM_QUEUESYNC message from the system message queue.
      系统已经收到了一个来自系统消息队列的WM_QUEUESYNC消息。
    9．HCBT_SETFOCUS  ：A window is about to receive the keyboard focus.
      窗体即将接收键盘焦点。
    10．HCBT_SYSCOMMAND ：A system command is about to be carried out. This allows a CBT application to prevent task switching by means of hot keys.
      系统命令即将被执行。这允许CBT程序阻止通过快捷键来进行任务切换。
    wParam ：[in] Depends on the nCode parameter.
      取决于参数 nCode

    lParam ：[in] Depends on the nCode parameter.
      取决于参数 nCode

返回值
    The value returned by the hook procedure determines whether the system allows or prevents one of these operations. For operations corresponding to the following CBT hook codes, the return value must be 0 to allow the operation, or 1 to prevent it:
    钩子子程的返回值取决于系统允许还是阻止这种操作。对于下列这些操作的CBT钩子代码，如果允许则返回值必须是0，如果阻止返回值必须是1。
    HCBT_ACTIVATE ；HCBT_CREATEWND ；HCBT_DESTROYWND ；HCBT_MINMAX ；HCBT_MOVESIZE ；HCBT_SETFOCUS ；HCBT_SYSCOMMAND
    For operations corresponding to the following CBT hook codes, the return value is ignored:
    对于下列这些操作的CBT钩子代码，返回值被忽略
        HCBT_CLICKSKIPPED ；HCBT_KEYSKIPPED ；HCBT_QS

4、WH_DEBUG
    The DebugProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function before calling the hook procedures associated with any type of hook. The system passes information about the hook to be called to the DebugProc hook procedure, which examines the information and determines whether to allow the hook to be called.
    DebugProc钩子子程是和SetWindowsHookEx方法一起使用的、程序定义的或者库定义的回调函数。系统在调用和任何类型钩子相关联的钩子子程之前调用该方法。系统将即将被调用的钩子的信息传递给DebugProc钩子子程，DebugProc钩子子程检查该信息，决定是否允许该钩子被调用。

参数说明：
    nCode ：[in] Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx.
    指定钩子子程是否必须处理该消息。如果nCode是HC_ACTION，钩子子程就必须处理该消息。如果nCode小于0，钩子子程就必须将该消息传递给CallNextHookEx方法，自己对消息不做进一步处理，并且应该返回由CallNextHookEx方法返回的返回值。
    wParam ：[in] Specifies the type of hook about to be called. This parameter can be one of the following values.
    指定即将被调用的钩子类型。参数可以是下列之一：
    1．WH_CALLWNDPROC ：Installs a hook procedure that monitors messages sent to a window procedure.
       安装一个钩子子程来监视发送给窗体程序的消息。
    2．WH_CALLWNDPROCRET ：Installs a hook procedure that monitors messages that have just been processed by a window procedure.
       安装一个钩子子程来监视刚刚被窗体程序处理完的消息。
    3．WH_CBT ：Installs a hook procedure that receives notifications useful to a computer-based training (CBT) application.
       安装一个钩子子程来接收对CBT应用程序有用的通知。
    4．WH_DEBUG ：Installs a hook procedure useful for debugging other hook procedures.
       安装一个有用的钩子子程来调试其他钩子子程。
    5．WH_GETMESSAGE ：Installs a hook procedure that monitors messages posted to a message queue.
       安装一个钩子子程来监视传递给消息队列的消息。
    6．WH_JOURNALPLAYBACK ：Installs a hook procedure that posts messages previously recorded by a WH_JOURNALRECORD hook procedure.
       安装一个钩子子程来传递先前使用WH_JOURNALRECORD钩子子程记录的消息。