方法14 :MessageProc Function
The MessageProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function after an input event occurs in a dialog box, message box, menu, or scroll bar, but before the message generated by the input event is processed. The hook procedure can monitor messages for a dialog box, message box, menu, or scroll bar created by a particular application or all applications. MessageProc鉤子子程是同SetWindowsHookEx方法一起使用的、應用程序或者庫定義的回調方法。在對話框，消息框，菜單，滾動條的輸入事件發生后、在這些輸入事件生成的消息被處理之前，系統調用該方法。鉤子子程可以監視特定的程序或者所有程序生成的對話框，消息框，菜單或者滾動條的消息。
The HOOKPROC type defines a pointer to this callback function. MessageProc is a placeholder for the application-defined or library-defined function name. HOOKPROC類型定義了指向該回調函數的指針。MessageProc是程序定義的或者庫定義的方法名字。
Syntax語法
LRESULT CALLBACK MessageProc(
int code,
WPARAM wParam,
LPARAM lParam
);
Parameters參數
code ：[in] Specifies the type of input event that generated the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and return the value returned by CallNextHookEx. This parameter can be one of the following values. 指定生成消息的輸入事件的類型。如果code小于0，鉤子子程必須將消息傳遞給CallNextHookEx方法，自己不進行任何進一步處理，并且要返回由方法CallNextHookEx返回的返回值。該參數可以時下列方法之一。
1．MSGF_DDEMGR ：The input event occurred while the Dynamic Data Exchange Management Library (DDEML) was waiting for a synchronous transaction to finish. 當DDEML正在等待同步傳輸結束時，該輸入事件發生。
2．MSGF_DIALOGBOX ：The input event occurred in a message box or dialog box. 輸入事件在消息框或者對話框中發生。
3．MSGF_MENU ：The input event occurred in a menu. 輸入事件在菜單中發生。
4．MSGF_SCROLLBAR ：The input event occurred in a scroll bar.輸入事件在滾動條中發生。
wParam ：This parameter is not used. 該參數未被使用。
lParam ：[in] Pointer to an MSG structure. 指向MSG結構的指針。
Return Value返回值
If code is less than zero, the hook procedure must return the value returned by CallNextHookEx.
If code is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_MSGFILTER hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.
如果code小于0，鉤子子程必須返回由方法CallNextHookEx返回的返回值。如果code大于等于0，而且鉤子子程還沒有處理該消息，強烈要求調用CallNextHookEx方法并返回由它返回的返回值；否則，其它已經安裝了WH_MSGFILTER鉤子的應用程序將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程已經處理了該消息，應該返回非0值，以組織系統將消息傳遞給鉤子鏈表中剩下的鉤子或者目標窗口子程。
Remarks備注
An application installs the hook procedure by specifying the WH_MSGFILTER hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.
If an application that uses the DDEML and performs synchronous transactions must process messages before they are dispatched, it must use the WH_MSGFILTER hook.
應用程序通過下面方法來安裝鉤子：指定WH_MSGFILTER鉤子類型；指定在調用SetWindowsHookEx的方法中指向鉤子子程的指針。
使用DDEML、執行同步傳遞的應用程序應該在消息被分發前進行處理，必須使用WH_MSGFILTER鉤子。
方法15 :MouseProc Function
The MouseProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever an application calls the GetMessage or PeekMessage function and there is a mouse message to be processed. MouseProc鉤子子程是同SetWindowsHookEx方法一起使用的、應用程序定義的或者庫定義的回調函數。無論什么時候，當應用程序一調用GetMessage 或者 PeekMessage方法，有鼠標消息即將被處理時，系統調用該方法。
The HOOKPROC type defines a pointer to this callback function. MouseProc is a placeholder for the application-defined or library-defined function name. HOOKPROC類型定義了指向回調函數的指針。MouseProc是應用程序定義的或者庫定義的方法名稱。
Syntax：語法
LRESULT CALLBACK MouseProc(
int nCode,
WPARAM wParam,
LPARAM lParam
);
Parameters 參數
nCode ：[in] Specifies a code the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values. 指定鉤子子程使用的用來決定如何處理消息的碼值。如果nCode小于0，鉤子子程必須將消息傳遞給CallNextHookEx方法，自己不進行進一步的處理，并且要返回由CallNextHookEx方法返回的返回值。該參數可以是下列值之一：
1．HC_ACTION ：The wParam and lParam parameters contain information about a mouse message. 參數wParam 和 lParam包含和鼠標消息相關的信息。
2．HC_NOREMOVE ：The wParam and lParam parameters contain information about a mouse message, and the mouse message has not been removed from the message queue. (An application called the PeekMessage function, specifying the PM_NOREMOVE flag.)
參數wParam 和 lParam包含和鼠標消息相關的信息，鼠標消息還沒有從消息隊列中移除。
wParam ：[in] Specifies the identifier of the mouse message. 指定鼠標消息的標識符。
lParam：[in] Pointer to a MOUSEHOOKSTRUCT structure. 指向MOUSEHOOKSTRUCT結構的指針。
Return Value 返回值
If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx. If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_MOUSE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the target window procedure.
如果code小于0，鉤子子程必須返回由CallNextHookEx方法返回的返回值。如果code大于等于0，鉤子子程還沒有處理該消息，強烈要求調用CallNextHookEx方法并返回由它返回的返回值；否則，其它已經安裝了WH_MOUSE鉤子的應用程序將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程已經處理了該消息，應該返回非0值，以阻止系統將消息傳遞給鉤子鏈表中剩余的鉤子或者目標窗體程序。
Remarks備注
An application installs the hook procedure by specifying the WH_MOUSE hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function. The hook procedure must not install a WH_JOURNALPLAYBACK Hook callback function.
應用程序通過下面方法來安裝鉤子：指定WH_MOUSE鉤子類型；指定在調用SetWindowsHookEx的方法中指向鉤子子程的指針。該鉤子子程不應安裝WH_JOURNALPLAYBACK鉤子的回調函數。
方法15 :MouseProc Function
The MouseProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever an application calls the GetMessage or PeekMessage function and there is a mouse message to be processed. MouseProc鉤子子程是同SetWindowsHookEx方法一起使用的、應用程序定義的或者庫定義的回調函數。無論什么時候，當應用程序一調用GetMessage 或者 PeekMessage方法，有鼠標消息即將被處理時，系統調用該方法。
The HOOKPROC type defines a pointer to this callback function. MouseProc is a placeholder for the application-defined or library-defined function name. HOOKPROC類型定義了指向回調函數的指針。MouseProc是應用程序定義的或者庫定義的方法名稱。
Syntax：語法
LRESULT CALLBACK MouseProc(
int nCode,
WPARAM wParam,
LPARAM lParam
);
Parameters 參數
nCode ：[in] Specifies a code the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values. 指定鉤子子程使用的用來決定如何處理消息的碼值。如果nCode小于0，鉤子子程必須將消息傳遞給CallNextHookEx方法，自己不進行進一步的處理，并且要返回由CallNextHookEx方法返回的返回值。該參數可以是下列值之一：
1．HC_ACTION ：The wParam and lParam parameters contain information about a mouse message. 參數wParam 和 lParam包含和鼠標消息相關的信息。
2．HC_NOREMOVE ：The wParam and lParam parameters contain information about a mouse message, and the mouse message has not been removed from the message queue. (An application called the PeekMessage function, specifying the PM_NOREMOVE flag.)
參數wParam 和 lParam包含和鼠標消息相關的信息，鼠標消息還沒有從消息隊列中移除。
wParam ：[in] Specifies the identifier of the mouse message. 指定鼠標消息的標識符。
lParam：[in] Pointer to a MOUSEHOOKSTRUCT structure. 指向MOUSEHOOKSTRUCT結構的指針。
Return Value 返回值
If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx. If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_MOUSE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the target window procedure.
如果code小于0，鉤子子程必須返回由CallNextHookEx方法返回的返回值。如果code大于等于0，鉤子子程還沒有處理該消息，強烈要求調用CallNextHookEx方法并返回由它返回的返回值；否則，其它已經安裝了WH_MOUSE鉤子的應用程序將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程已經處理了該消息，應該返回非0值，以阻止系統將消息傳遞給鉤子鏈表中剩余的鉤子或者目標窗體程序。
Remarks備注
An application installs the hook procedure by specifying the WH_MOUSE hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function. The hook procedure must not install a WH_JOURNALPLAYBACK Hook callback function.
應用程序通過下面方法來安裝鉤子：指定WH_MOUSE鉤子類型；指定在調用SetWindowsHookEx的方法中指向鉤子子程的指針。該鉤子子程不應安裝WH_JOURNALPLAYBACK鉤子的回調函數。
方法16 :SetWindowsHookEx Function
The SetWindowsHookEx function installs an application-defined hook procedure into a hook chain. You would install a hook procedure to monitor the system for certain types of events. These events are associated either with a specific thread or with all threads in the same desktop as the calling thread.
SetWindowsHookEx方法安裝一個應用程序定義的鉤子子程到鉤子鏈表中。你可能安裝鉤子子程來監視系統的一些類型的事件。這些事件可以同下面的線程一起使用：指定的線程或者同一桌面下做為調用線程的所有線程。
Syntax 語法
HHOOK SetWindowsHookEx(
int idHook,
HOOKPROC lpfn,
HINSTANCE hMod,
DWORD dwThreadId
);
Parameters參數
idHook ：[in] Specifies the type of hook procedure to be installed. This parameter can be one of the following values. 指定即將被安裝的鉤子子程的類型。該參數可以是下列值之一：
1．WH_CALLWNDPROC ：Installs a hook procedure that monitors messages before the system sends them to the destination window procedure. 安裝一個鉤子子程，用來在系統將消息發送給目的窗體程序之前監視消息。
2． WH_CALLWNDPROCRET ：Installs a hook procedure that monitors messages after they have been processed by the destination window procedure. 安裝一個鉤子子程，用來在消息被目標窗體程序處理之后來監視消息。
3．WH_CBT ：Installs a hook procedure that receives notifications useful to a computer-based training (CBT) application.安裝一個鉤子子程，用來接收對CBT程序有用的通知。
4．WH_DEBUG ：Installs a hook procedure useful for debugging other hook procedures.安裝一個對調試其它鉤子子程有用的鉤子子程。
5．WH_FOREGROUNDIDLE ：Installs a hook procedure that will be called when the application's foreground thread is about to become idle. This hook is useful for performing low priority tasks during idle time.安裝一個鉤子子程，當應用程序的前臺線程即將空閑時，該子程被調用。該鉤子在空閑時間里來執行低權限任務時很有用。
5．WH_GETMESSAGE ：Installs a hook procedure that monitors messages posted to a message queue.安裝一個鉤子子程用來監視傳遞給消息隊列的消息。
6．WH_JOURNALPLAYBACK ：Installs a hook procedure that posts messages previously recorded by a WH_JOURNALRECORD hook procedure.安裝一個鉤子子程用來傳遞前期由WH_JOURNALRECORD鉤子子程記錄的消息。
7．WH_JOURNALRECORD ：Installs a hook procedure that records input messages posted to the system message queue. This hook is useful for recording macros. 安裝一個鉤子子程來記錄傳遞給系統消息隊列的輸入消息。該鉤子對記錄宏很有用。
8．WH_KEYBOARD ：Installs a hook procedure that monitors keystroke messages.安裝一個鉤子子程用來監視鍵盤消息。
9．WH_KEYBOARD_LL ：Windows NT/2000/XP: Installs a hook procedure that monitors low-level keyboard input events.在Windows NT/2000/XP環境下:安裝一個鉤子子程用來監視低層鍵盤輸入事件。
10．WH_MOUSE ：Installs a hook procedure that monitors mouse messages.安裝一個鉤子子程用來監視鼠標消息。
11．WH_MOUSE_LL ：: Installs a hook procedure that monitors low-level mouse input events. 在 Windows NT/2000/XP環境下，安裝一個鉤子子程用來監視低層鼠標輸入事件。
12．WH_MSGFILTER ：Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar.安裝一個鉤子子程用來監視下列對象的輸入事件產生的消息：對話框、消息框、菜單、滾動條。
13．WH_SHELL ：Installs a hook procedure that receives notifications useful to shell applications.安裝一個鉤子子程用來接收對加殼程序有用的通知。
14．WH_SYSMSGFILTER ：Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages for all applications in the same desktop as the calling thread.安裝一個鉤子子程用來監視下列對象的輸入事件產生的消息：對話框、消息框、菜單、滾動條。鉤子子程為同一桌面下做為調用線程的所有線程監視這些消息。
lpfn ：[in] Pointer to the hook procedure. If the dwThreadId parameter is zero or specifies the identifier of a thread created by a different process, the lpfn parameter must point to a hook procedure in a dynamic-link library (DLL). Otherwise, lpfn can point to a hook procedure in the code associated with the current process.
鉤子子程的指針。如果參數dwThreadId為0或者指定由不同進程創建的線程的標識符，lpfn參數必須指向動態鏈接庫里的鉤子子程。否則，lpfn可以指向與當前進程相關的代碼中的鉤子子程。
hMod ：[in] Handle to the DLL containing the hook procedure pointed to by the lpfn parameter. The hMod parameter must be set to NULL if the dwThreadId parameter specifies a thread created by the current process and if the hook procedure is within the code associated with the current process.
由lpfn參數指向的含有鉤子子程的DLL的句柄。如果參數dwThreadId指定了由當前進程創建的線程，或者如果鉤子子程處在與當前進程相關的代碼中，hMod參數必須設置為Null。
dwThreadId ：[in] Specifies the identifier of the thread with which the hook procedure is to be associated. If this parameter is zero, the hook procedure is associated with all existing threads running in the same desktop as the calling thread. 指定鉤子子程即將關聯的線程的標識符。如果該參數是0，鉤子子程與在同一桌面環境下運行的做為調用線程的所有存在的線程相關聯。
Return Value返回值
If the function succeeds, the return value is the handle to the hook procedure. If the function fails, the return value is NULL.
如果方法執行成功，返回鉤子子程的句柄。如果失敗，返回空。
Remarks備注
SetWindowsHookEx can be used to inject a DLL into another process. A 32-bit DLL cannot be injected into a 64-bit process, and a 64-bit DLL cannot be injected into a 32-bit process. If an application requires the use of hooks in other processes, it is required that a 32-bit application call SetWindowsHookEx to inject a 32-bit DLL into 32-bit processes, and a 64-bit application call SetWindowsHookEx to inject a 64-bit DLL into 64-bit processes. The 32-bit and 64-bit DLLs must have different names.
SetWindowsHookEx可以被注入到DLL中，進而被映射到另外進程中。32位的DLL不能被注入到64位的進程中，同樣，64位的DLL也不能被注入到32位的進程中。如果應用程序請求在其它的進程中使用鉤子，要求，32位的應用程序調用SetWindowsHookEx將32位的DLL注入到32位的進程中，64位的應用程序調用SetWindowsHookEx將64位的DLL注入到64位的進程中。32位的DLL和64位的DLL必須具有不同的名稱。
An error may occur if the hMod parameter is NULL and the dwThreadId parameter is zero or specifies the identifier of a thread created by another process. 如果參數hMod為空，參數dwThreadId為0，或者指定了由另外進程創建的線程的標識符，會產生錯誤。
Calling the CallNextHookEx function to chain to the next hook procedure is optional, but it is highly recommended; otherwise, other applications that have installed hooks will not receive hook notifications and may behave incorrectly as a result. You should call CallNextHookEx unless you absolutely need to prevent the notification from being seen by other applications. 雖然調用CallNextHookEx方法鏈接到下一個鉤子子程是可選的，但是強烈建議使用；否則，其它已經安裝了鉤子的應用程序將不接收鉤子通知，可能導致行為錯誤。除非絕對需要阻止通知被其它應用程序看見，其他時候都應該調用CallNextHookEx方法。
Before terminating, an application must call the UnhookWindowsHookEx function to free system resources associated with the hook. 在結束前，應用程序必須調用UnhookWindowsHookEx方法來釋放與該鉤子相關的系統資源。
The scope of a hook depends on the hook type. Some hooks can be set only with global scope; others can also be set for only a specific thread, as shown in the following table. 鉤子的作用域取決于鉤子的類型。一些鉤子只能在全局范圍使用，其它一些僅僅能在指定的線程中使用。如下表所示：
Hook
Scope
WH_CALLWNDPROC
Thread or global線程/全局
WH_CALLWNDPROCRET
Thread or global線程/全局
WH_CBT
Thread or global線程/全局
WH_DEBUG
Thread or global線程/全局
WH_FOREGROUNDIDLE
Thread or global線程/全局
WH_GETMESSAGE
Thread or global線程/全局
WH_JOURNALPLAYBACK
Global only全局
WH_JOURNALRECORD
Global only全局
WH_KEYBOARD
Thread or global線程/全局
WH_KEYBOARD_LL
Global only全局
WH_MOUSE
Thread or global線程/全局
WH_MOUSE_LL
Global only全局
WH_MSGFILTER
Thread or global線程/全局
WH_SHELL
Thread or global線程/全局
WH_SYSMSGFILTER
Global only全局
For a specified hook type, thread hooks are called first, then global hooks.
對于指定的鉤子類型，線程鉤子先被調用，然后是全局鉤子。
The global hooks are a shared resource, and installing one affects all applications in the same desktop as the calling thread. All global hook functions must be in libraries. Global hooks should be restricted to special-purpose applications or to use as a development aid during application debugging. Libraries that no longer need a hook should remove its hook procedure.
全局鉤子是共享資源，安裝一個鉤子會影響同一桌面環境下做為調用線程的所有應用程序。所有的全局鉤子函數都應該在庫中。全局鉤子應該被分發到特定目的的應用程序中，或者在程序調試中間，來輔助開發。不再需要鉤子的庫應該移除鉤子子程。
posted on 2010-06-26 20:38
小果子 閱讀(449)
評論(0) 編輯 收藏 引用 所屬分類:
學習筆記