HOOK鉤子機(jī)制學(xué)習(xí)筆記(4) - 鉤子函數(shù)說明 收藏
翻譯參考自MaybeHelios的blog: http://blog.csdn.net/maybehelios/???

??? 通過SetWindowsHookEx方法安裝鉤子，該函數(shù)指定處理攔截消息的鉤子函數(shù)（回調(diào)函數(shù)），可在鉤子函數(shù)中自定義消息的處理，可修改消息或屏蔽消息。鉤子函數(shù)的格式是固定為：
LRESULT CALLBACK CallBackProc(?????
????????? Int nCode,
????????? WPARAM wParam,
????????? LPARAM lParam);

??? nCode參數(shù)說明:
??? [in] Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and must return the value returned by CallNextHookEx.

??? 指定鉤子子程是否必須處理該消息。如果nCode是HC_ACTION，鉤子子程就必須處理該消息。如果nCode小于0，鉤子子程就必須將該消息傳遞給CallNextHookEx，自己不對消息進(jìn)行進(jìn)一步的處理，必須返回由CallNextHookEx 方法返回的返回值。

??? 對于不同類型的鉤子，其傳入的參數(shù)也不一樣，以下為各類鉤子的參數(shù)說明：

1、WH_CALLWNDPROC
參數(shù)說明：
??? wParam ：[in] Specifies whether the message was sent by the current thread. If the message was sent by the current thread, it is nonzero; otherwise, it is zero.
??? 指定消息是否由當(dāng)前線程發(fā)出。如果消息是由當(dāng)前線程發(fā)出的，該值就是非0；否則，就是0。

??? lParam ：[in] Pointer to a CWPSTRUCT structure that contains details about the message.
??? 指向CWPSTRUCT結(jié)構(gòu)的指針，該結(jié)構(gòu)含有消息的細(xì)節(jié)信息。

返回值
??? If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.? If nCode is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_CALLWNDPROC hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.
??? 如果nCode小于0，鉤子子程必須返回由CallNextHookE方法返回的返回值。如果nCode大于等于0，強(qiáng)烈要求調(diào)用CallNextHookEx方法，并返回由它返回的返回值；否則，其他已經(jīng)安裝了WH_CALLWNDPROC鉤子的應(yīng)用程序?qū)⑹詹坏姐^子通知，可能導(dǎo)致行為的錯誤。如果鉤子子程沒有調(diào)用CallNextHookEx方法,返回值應(yīng)該為 0。

備注
??? The CallWndProc hook procedure can examine the message, but it cannot modify it. After the hook procedure returns control to the system, the message is passed to the window procedure.
??? CallWndProc鉤子子程能夠檢查消息，但是不能修改消息。當(dāng)鉤子子程將控制權(quán)交還給系統(tǒng)之后，消息被傳遞給窗體程序。

2、WH_ CALLWNDPROCRET
??? 在SendMessage方法被調(diào)用之后，系統(tǒng)調(diào)用CallWndRetProc方法。鉤子子程能夠檢查、但是不能修改消息。

參數(shù)說明
??? wParam ：[in] Specifies whether the message is sent by the current process. If the message is sent by the current process, it is nonzero; otherwise, it is NULL.
??? 指定消息是否由當(dāng)前進(jìn)程發(fā)出。如果消息是由當(dāng)前進(jìn)程發(fā)出的，wParam為非0；否則，為空。

??? lParam ：[in] Pointer to a CWPRETSTRUCT structure that contains details about the message.
??? 指向CWPSTRUCT結(jié)構(gòu)的指針，該結(jié)構(gòu)含有消息的細(xì)節(jié)信息。

返回值
??? If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.? If nCode is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_CALLWNDPROCRET hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.
??? 如果nCode小于0，鉤子子程必須返回由CallNextHookE返回的返回值。如果nCode大于等于0，強(qiáng)烈要求調(diào)用CallNextHookEx方法，并返回由它返回的返回值；否則，其他已經(jīng)安裝了WH_ CALLWNDPROCRET鉤子的程序?qū)⑹詹坏姐^子通知，可能導(dǎo)致行為的錯誤。如果鉤子子程沒有調(diào)用CallNextHookEx方法,返回值應(yīng)該為0。
???
???

3、WH_CBT
??? 系統(tǒng)在下列事件發(fā)生之前調(diào)用該方法：
??? 1.激活、創(chuàng)建、銷毀、最小化、最大化、移動窗體、改變窗體大小；
??? 2.完成系統(tǒng)命令；
??? 3.從系統(tǒng)消息隊列中移除鼠標(biāo)或者鍵盤事件；
??? 4.設(shè)置鍵盤焦點(diǎn)；
??? 5.同步系統(tǒng)消息隊列。
???
??? CBT應(yīng)用程序使用該鉤子子程接收來自系統(tǒng)的有用的通知。

參數(shù)說明:
??? nCode? ：[in] Specifies a code that the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定一個碼值，鉤子子程使用該值來決定如何處理消息。如果nCode小于0，鉤子子程就必須將該消息傳遞給CallNextHookEx方法，自己不對消息做進(jìn)一步的處理，并且應(yīng)該返回由CallNextHookEx方法返回的返回值。該參數(shù)可以是以下值中的一個：
??? 1．HCBT_ACTIVATE? ：The system is about to activate a window.
????? 系統(tǒng)即將創(chuàng)建一個窗體。
??? 2．HCBT_CLICKSKIPPED? ：The system has removed a mouse message from the system message queue. Upon receiving this hook code, a CBT application must install a WH_JOURNALPLAYBACK hook procedure in response to the mouse message.
????? 系統(tǒng)已經(jīng)將一個鼠標(biāo)消息從系統(tǒng)消息隊列中移除。一旦收到該鉤子代碼，CBT應(yīng)用程序必須安裝一個WH_JOURNALPLAYBAC鉤子子程來響應(yīng)鼠標(biāo)消息。
??? 3．HCBT_CREATEWND ： A window is about to be created. The system calls the hook procedure before sending the WM_CREATE or WM_NCCREATE message to the window. If the hook procedure returns a nonzero value, the system destroys the window; the CreateWindow function returns NULL, but the WM_DESTROY message is not sent to the window. If the hook procedure returns zero, the window is created normally.
????? 窗體即將被創(chuàng)建。系統(tǒng)在向窗體發(fā)出WM_CREATE 或者 WM_NCCREATE消息之前，調(diào)用該鉤子子程。如果鉤子子程返回非0值，表示系統(tǒng)銷毀了窗體；CreateWindow方法返回Null，但是WM_DESTROY消息并不發(fā)送給窗體。如果鉤子子程返回0，表示窗體正常被創(chuàng)建。
????? At the time of the HCBT_CREATEWND notification, the window has been created, but its final size and position may not have been determined and its parent window may not have been established. It is possible to send messages to the newly created window, although it has not yet received WM_NCCREATE or WM_CREATE messages. It is also possible to change the position in the z-order of the newly created window by modifying the hwndInsertAfter member of the CBT_CREATEWND structure.
????? 在 HCBT_CREATEWND通知的時候，窗體已經(jīng)被創(chuàng)建了，但是它的最終的大小和位置可能還沒有被確定，它的父窗體也可能沒有被創(chuàng)建起來。雖然一個新創(chuàng)建的窗體可能還沒有接收到WM_NCCREATE或者WM_CREATE消息，但是向它發(fā)送消息是可能的。通過修改CBT_CREATEWND 結(jié)構(gòu)體的hwndInsertAfter成員，改變新創(chuàng)建窗體的在Z軸次序的位置也是可能的。
??? 4．HCBT_DESTROYWND ：A window is about to be destroyed.
????? 窗體即將被銷毀。
??? 5．HCBT_KEYSKIPPED ：The system has removed a keyboard message from the system message queue. Upon receiving this hook code, a CBT application must install a WH_JOURNALPLAYBACK hook procedure in response to the keyboard message.
????? 系統(tǒng)已經(jīng)從系統(tǒng)的消息隊列中移除了一個鍵盤消息。一旦接收到該鉤子代碼，CBT應(yīng)用程序必須安裝一個WH_JOURNALPLAYBAC鉤子來響應(yīng)鍵盤消息。
??? 6．HCBT_MINMAX ：A window is about to be minimized or maximized.
????? 窗體即將被最小化或者最大化。
??? 7．HCBT_MOVESIZE ：A window is about to be moved or sized.
????? 窗體即將被移動或者重置大小。
??? 8．HCBT_QS? ：The system has retrieved a WM_QUEUESYNC message from the system message queue.
????? 系統(tǒng)已經(jīng)收到了一個來自系統(tǒng)消息隊列的WM_QUEUESYNC消息。
??? 9．HCBT_SETFOCUS? ：A window is about to receive the keyboard focus.
????? 窗體即將接收鍵盤焦點(diǎn)。
??? 10．HCBT_SYSCOMMAND ：A system command is about to be carried out. This allows a CBT application to prevent task switching by means of hot keys.
????? 系統(tǒng)命令即將被執(zhí)行。這允許CBT程序阻止通過快捷鍵來進(jìn)行任務(wù)切換。
?????
??? wParam ：[in] Depends on the nCode parameter.
????? 取決于參數(shù) nCode

??? lParam ：[in] Depends on the nCode parameter.
????? 取決于參數(shù) nCode

返回值
??? The value returned by the hook procedure determines whether the system allows or prevents one of these operations. For operations corresponding to the following CBT hook codes, the return value must be 0 to allow the operation, or 1 to prevent it:
??? 鉤子子程的返回值取決于系統(tǒng)允許還是阻止這種操作。對于下列這些操作的CBT鉤子代碼，如果允許則返回值必須是0，如果阻止返回值必須是1。
??? HCBT_ACTIVATE ；HCBT_CREATEWND ；HCBT_DESTROYWND ；HCBT_MINMAX ；HCBT_MOVESIZE ；HCBT_SETFOCUS ；HCBT_SYSCOMMAND
???
??? For operations corresponding to the following CBT hook codes, the return value is ignored:
??? 對于下列這些操作的CBT鉤子代碼，返回值被忽略
??????? HCBT_CLICKSKIPPED ；HCBT_KEYSKIPPED ；HCBT_QS

4、WH_DEBUG
??? The DebugProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function before calling the hook procedures associated with any type of hook. The system passes information about the hook to be called to the DebugProc hook procedure, which examines the information and determines whether to allow the hook to be called.
??? DebugProc鉤子子程是和SetWindowsHookEx方法一起使用的、程序定義的或者庫定義的回調(diào)函數(shù)。系統(tǒng)在調(diào)用和任何類型鉤子相關(guān)聯(lián)的鉤子子程之前調(diào)用該方法。系統(tǒng)將即將被調(diào)用的鉤子的信息傳遞給DebugProc鉤子子程，DebugProc鉤子子程檢查該信息，決定是否允許該鉤子被調(diào)用。

參數(shù)說明：
??? nCode ：[in] Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx.
??? 指定鉤子子程是否必須處理該消息。如果nCode是HC_ACTION，鉤子子程就必須處理該消息。如果nCode小于0，鉤子子程就必須將該消息傳遞給CallNextHookEx方法，自己對消息不做進(jìn)一步處理，并且應(yīng)該返回由CallNextHookEx方法返回的返回值。
???
??? wParam ：[in] Specifies the type of hook about to be called. This parameter can be one of the following values.
??? 指定即將被調(diào)用的鉤子類型。參數(shù)可以是下列之一：
??? 1．WH_CALLWNDPROC ：Installs a hook procedure that monitors messages sent to a window procedure.
?????? 安裝一個鉤子子程來監(jiān)視發(fā)送給窗體程序的消息。
??? 2．WH_CALLWNDPROCRET ：Installs a hook procedure that monitors messages that have just been processed by a window procedure.
?????? 安裝一個鉤子子程來監(jiān)視剛剛被窗體程序處理完的消息。
??? 3．WH_CBT ：Installs a hook procedure that receives notifications useful to a computer-based training (CBT) application.
?????? 安裝一個鉤子子程來接收對CBT應(yīng)用程序有用的通知。
??? 4．WH_DEBUG ：Installs a hook procedure useful for debugging other hook procedures.
?????? 安裝一個有用的鉤子子程來調(diào)試其他鉤子子程。
??? 5．WH_GETMESSAGE ：Installs a hook procedure that monitors messages posted to a message queue.
?????? 安裝一個鉤子子程來監(jiān)視傳遞給消息隊列的消息。
??? 6．WH_JOURNALPLAYBACK ：Installs a hook procedure that posts messages previously recorded by a WH_JOURNALRECORD hook procedure.
?????? 安裝一個鉤子子程來傳遞先前使用WH_JOURNALRECORD鉤子子程記錄的消息。
??? 7．WH_JOURNALRECORD ：Installs a hook procedure that records input messages posted to the system message queue. This hook is useful for recording macros.
?????? 安裝一個鉤子子程來記錄傳遞給系統(tǒng)消息隊列的輸入消息。該鉤子用來記錄宏很有用。
??? 8．WH_KEYBOARD ：Installs a hook procedure that monitors keystroke messages.
?????? 安裝一個鉤子子程來監(jiān)視鍵盤敲擊消息。
??? 9．WH_MOUSE Installs a hook procedure that monitors mouse messages.
?????? 安裝一個鉤子子程來監(jiān)視鼠標(biāo)消息。
??? 10．WH_MSGFILTER ：Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages only for the application that installed the hook procedure.
?????? 安裝一個鉤子子程來監(jiān)視下列輸入事件的結(jié)果而產(chǎn)生的消息：對話框、消息框、菜單、滾動條。該鉤子子程僅僅為安裝該鉤子子程的應(yīng)用程序監(jiān)視這些消息。
??? 11．WH_SHELL ：Installs a hook procedure that receives notifications useful to a Shell application.
?????? 安裝一個鉤子子程來接收對加殼類應(yīng)用程序有用的通知。
??? 12．WH_SYSMSGFILTER ：Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages for all applications in the system.
?????? 安裝一個鉤子子程來監(jiān)視下列輸入事件的結(jié)果而產(chǎn)生的消息：對話框，消息框，菜單，滾動條。該鉤子子程為系統(tǒng)中所有的應(yīng)用程序監(jiān)視這些消息。

??? lParam? ：[in] Pointer to a DEBUGHOOKINFO structure that contains the parameters to be passed to the destination hook procedure.
??? 指向DEBUGHOOKINFO結(jié)構(gòu)的指針，該結(jié)構(gòu)中含有傳遞給目標(biāo)鉤子子程的參數(shù)。

返回值
??? To prevent the system from calling the hook, the hook procedure must return a nonzero value. Otherwise, the hook procedure must call CallNextHookEx.
??? 為了阻止系統(tǒng)調(diào)用該鉤子，鉤子子程必須返回一個非0值。否則，鉤子子程必須調(diào)用CallNextHookEx方法。

5、WH_FOREGROUNDIDLE
??? The ForegroundIdleProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever the foreground thread is about to become idle.
??? ForegroundIdleProc鉤子子程是和SetWindowsHookEx方法一起使用的、程序定義的或者庫定義的回調(diào)函數(shù)。當(dāng)前臺線程即將變成空閑時，系統(tǒng)將調(diào)用該方法。

Parameters 參數(shù)
??? code ：[in] Specifies whether the hook procedure must process the message. If code is HC_ACTION, the hook procedure must process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx.
??? 指定鉤子子程是否必須處理消息。如果nCode是HC_ACTION，鉤子子程就必須處理該消息。如果nCode小于0，鉤子子程就必須將該消息傳遞給CallNextHookEx方法，自己對消息不做進(jìn)一步處理，并且應(yīng)該返回由CallNextHookEx方法返回的返回值。

??? wParam ：This parameter is not used. 未使用

??? lParam? ：This parameter is not used. 未使用

Return Value 返回值
??? If code is less than zero, the hook procedure must return the value returned by CallNextHookEx. If code is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_FOREGROUNDIDLE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.
??? 如果nCode小于0，鉤子子程必須返回由CallNextHookEx返回的返回值。如果nCode大于等于0，強(qiáng)烈要求調(diào)用CallNextHookEx方法，并返回由它返回的返回值；否則，其他已經(jīng)安裝了WH_ CALLWNDPROCRET鉤子的程序?qū)⑹詹坏姐^子通知，可能導(dǎo)致行為的錯誤。如果鉤子子程沒有調(diào)用CallNextHookEx方法,返回值應(yīng)該是0。

6、WH_GETMESSAGE
??? The GetMsgProc function is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever the GetMessage or PeekMessage function has retrieved a message from an application message queue. Before returning the retrieved message to the caller, the system passes the message to the hook procedure.
??? GetMsgProc是和SetWindowsHookEx方法一起使用的、程序定義的或者庫定義的回調(diào)函數(shù)。無論什么時候，當(dāng)GetMessage 或者 PeekMessage方法接收到來自應(yīng)用程序消息隊列的消息時，系統(tǒng)都會調(diào)用該方法。在將收到的消息返回給調(diào)用者之前，系統(tǒng)將消息傳遞給鉤子子程。

Parameters 參數(shù)
??? code? ： [in] Specifies whether the hook procedure must process the message. If code is HC_ACTION, the hook procedure must process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx.
??? 指定鉤子子程是否必須處理消息。如果nCode是HC_ACTION，鉤子子程就必須處理該消息。如果nCode小于0，鉤子子程就必須將該消息傳遞給CallNextHookEx方法，自己對消息不做進(jìn)一步處理，并且應(yīng)該返回由CallNextHookEx方法返回的返回值。

??? wParam? ：[in] Specifies whether the message has been removed from the queue. This parameter can be one of the following values.
??? 指定消息是否已經(jīng)被從隊列中移除了。該參數(shù)可以是下列值中的一個：
????? 1．PM_NOREMOVE ：Specifies that the message has not been removed from the queue. (An application called the function, specifying the PM_NOREMOVE flag.)
????? 指定消息尚未從隊列中移出。(應(yīng)用程序在調(diào)用該方法的同時指定PM_NOREMOVE標(biāo)志)
????? 2．PM_REMOVE Specifies that the message has been removed from the queue. (An application called GetMessage, or it called the PeekMessage function, specifying the PM_REMOVE flag.)
????? 指定消息已經(jīng)被從隊列中移除了。(程序調(diào)用GetMessage 或者PeekMessage方法的同時指定PM_REMOVE標(biāo)志)

??? lParam ：[in] Pointer to an MSG structure that contains details about the message.
??? 指向MSG結(jié)構(gòu)的指針，結(jié)構(gòu)中包含和消息相關(guān)的細(xì)節(jié)。

Return Value 返回值
??? If code is less than zero, the hook procedure must return the value returned by CallNextHookEx. If code is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_GETMESSAGE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.
??? 如果參數(shù)code小于0，鉤子子程必須返回由CallNextHookEx返回的返回值。如果參數(shù)code大于等于0，強(qiáng)烈要求調(diào)用CallNextHookEx方法，并返回由該方法返回的返回值；否則，其他已經(jīng)安裝了WH_GETMESSAGE鉤子的程序?qū)⑹詹坏姐^子通知，可能導(dǎo)致行為的錯誤。如果鉤子子程沒有調(diào)用CallNextHookEx方法,返回值應(yīng)該是0

Remarks 備注
??? The GetMsgProc hook procedure can examine or modify the message. After the hook procedure returns control to the system, the GetMessage or PeekMessage function returns the message, along with any modifications, to the application that originally called it.
??? GetMsgProc鉤子子程能夠檢查或者修改消息。在鉤子子程將控制權(quán)交還給系統(tǒng)之后，GetMessage 或者PeekMessage方法將該消息以及任何修改都一起返回給最初調(diào)用它的應(yīng)用程序。

7、WH_JOURNALPLAYBACK
??? The JournalPlaybackProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. Typically, an application uses this function to play back a series of mouse and keyboard messages recorded previously by the JournalRecordProc hook procedure. As long as a JournalPlaybackProc hook procedure is installed, regular mouse and keyboard input is disabled.
??? JournalPlaybackProc鉤子子程是和SetWindowsHookEx方法一起使用的、程序定義的或者庫定義的回調(diào)函數(shù)。典型的，應(yīng)用程序使用該方法回放前期由JournalRecordProc鉤子子程記錄下來的一系列鼠標(biāo)和鍵盤消息。只要JournalPlaybackProc鉤子子程被安裝，常規(guī)的鼠標(biāo)和鍵盤輸入將被禁用。

Parameters 參數(shù)
??? code ：[in] Specifies a code the hook procedure uses to determine how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定鉤子子程使用的代碼，以決定如何處理該消息。如果參數(shù)code小于0，鉤子子程不對其進(jìn)行任何進(jìn)一步的處理，必須將消息傳遞給CallNextHookEx方法，返回由CallNextHookEx方法返回的返回值。該參數(shù)可以是下列值之一：
??? 1．HC_GETNEXT ：The hook procedure must copy the current mouse or keyboard message to the EVENTMSG structure pointed to by the lParam parameter.
??? 鉤子子程必須將當(dāng)前鼠標(biāo)或者鍵盤消息拷貝給由參數(shù)lParam指向的EVENTMSG結(jié)構(gòu)。
??? 2．HC_NOREMOVE ：An application has called the PeekMessage function with wRemoveMsg set to PM_NOREMOVE, indicating that the message is not removed from the message queue after PeekMessage processing.
??? 應(yīng)用程序已經(jīng)調(diào)用帶有指向PM_NOREMOVE的 wRemoveMsg 集合的PeekMessage方法，指示該消息在PeekMessage處理完畢后，沒有從消息隊列中移除。
??? 3．HC_SKIP? ：The hook procedure must prepare to copy the next mouse or keyboard message to the EVENTMSG structure pointed to by lParam. Upon receiving the HC_GETNEXT code, the hook procedure must copy the message to the structure.
??? 鉤子子程必須準(zhǔn)備拷貝下一個鼠標(biāo)或者鍵盤消息到由lParam 指向的 EVENTMSG結(jié)構(gòu)。一旦接收到HC_GETNEXT代碼，鉤子子程必須將消息拷貝到結(jié)構(gòu)體中。
??? 4．HC_SYSMODALOFF ： A system-modal dialog box has been destroyed. The hook procedure must resume playing back the messages.
??? 系統(tǒng)模式的對話框已經(jīng)被銷毀。鉤子子程應(yīng)該恢復(fù)回放消息。
??? 5．HC_SYSMODALON? ： A system-modal dialog box is being displayed. Until the dialog box is destroyed, the hook procedure must stop playing back messages.
??? 系統(tǒng)模式的對話框正在被顯示。鉤子子程應(yīng)該停止回放消息，直到對話框被銷毀。

??? wParam ：This parameter is not used. 該參數(shù)未使用。

??? lParam? ：[in] Pointer to an EVENTMSG structure that represents a message being processed by the hook procedure. This parameter is valid only when the code parameter is HC_GETNEXT.?
??? 指向EVENTMSG結(jié)構(gòu)的指針，該結(jié)構(gòu)代表正在被鉤子子程處理的消息。只有當(dāng)參數(shù)code是HC_GETNEXT時該參數(shù)才有效。

Return Value返回值
??? To have the system wait before processing the message, the return value must be the amount of time, in clock ticks, that the system should wait. (This value can be computed by calculating the difference between the time members in the current and previous input messages.) To process the message immediately, the return value should be zero. The return value is used only if the hook code is HC_GETNEXT; otherwise, it is ignored.
??? 為了使系統(tǒng)在處理消息之前等待，該返回值應(yīng)該是系統(tǒng)應(yīng)該等待的時間數(shù)量，該值以時鐘嘀嗒為單位（該值可以通過當(dāng)前和前一個輸入消息的time成員的差值來計算）。為了快速的處理該消息，返回值應(yīng)該是0。只有當(dāng)鉤子代碼是HC_GETNEXT時，返回值才有意義；否則，該參數(shù)被忽略。

Remarks 備注
??? A JournalPlaybackProc hook procedure should copy an input message to the lParam parameter. The message must have been previously recorded by using a JournalRecordProc hook procedure, which should not modify the message.
?? JournalPlaybackProc鉤子子程應(yīng)該拷貝一個輸入消息到lparm參數(shù)。消息必須在先前已經(jīng)使用JournalRecordProc鉤子子程被記錄了下來，JournalRecordProc鉤子子程不應(yīng)修改消息。

??? To retrieve the same message over and over, the hook procedure can be called several times with the code parameter set to HC_GETNEXT without an intervening call with code set to HC_SKIP.
??? 為了一遍又一遍的得到同樣的消息，鉤子子程在將code參數(shù)設(shè)置為HC_GETNEXT的情況下，可以被調(diào)用多次，而不涉及將code參數(shù)設(shè)置為HC_SKIP的調(diào)用。

??? If code is HC_GETNEXT and the return value is greater than zero, the system sleeps for the number of milliseconds specified by the return value. When the system continues, it calls the hook procedure again with code set to HC_GETNEXT to retrieve the same message. The return value from this new call to JournalPlaybackProc should be zero; otherwise, the system will go back to sleep for the number of milliseconds specified by the return value, call JournalPlaybackProc again, and so on. The system will appear to be not responding.
??? 如果參數(shù)code 是 HC_GETNEXT，而且返回值大于0，系統(tǒng)將休眠，休眠時間是返回值指定的毫秒數(shù)。當(dāng)系統(tǒng)繼續(xù)的時候，調(diào)用鉤子子程，鉤子子程通過將code設(shè)置為HC_GETNEXT來重新得到同一個的消息。從新的JournalPlaybackProc調(diào)用得到的返回值應(yīng)該是0；否則，系統(tǒng)將回到休眠狀態(tài)，休眠時間是返回值指定的毫秒數(shù)，休眠過后再次調(diào)用JournalPlaybackProc，以此類推。系統(tǒng)看起來像沒有響應(yīng)一樣。

??? Unlike most other global hook procedures, the JournalRecordProc and JournalPlaybackProc hook procedures are always called in the context of the thread that set the hook.
??? 和其他全局的鉤子子程不一樣，JournalRecordProc 和JournalPlaybackProc鉤子子程永遠(yuǎn)在設(shè)置該鉤子的線程的上下文中被調(diào)用。

??? After the hook procedure returns control to the system, the message continues to be processed. If code is HC_SKIP, the hook procedure must prepare to return the next recorded event message on its next call.
??? 在鉤子子程將控制權(quán)交還給系統(tǒng)之后，消息被繼續(xù)處理。如果code參數(shù)是HC_SKIP ,鉤子子程必須準(zhǔn)備在下一次調(diào)用時返回下一條記錄的事件消息。

??? Install the JournalPlaybackProc hook procedure by specifying the WH_JOURNALPLAYBACK hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.
??? 通過指定WH_JOURNALPLAYBACK鉤子類型，以及一個鉤子子程的指針(該子程在SetWindowsHookEx方法中被調(diào)用)來安裝JournalPlaybackProc鉤子子程。

??? If the user presses CTRL+ESC OR CTRL+ALT+DEL during journal playback, the system stops the playback, unhooks the journal playback procedure, and posts a WM_CANCELJOURNAL message to the journaling application.
??? 在回放過程中，如果用戶按下了 CTRL+ESC 或者 CTRL+ALT+DEL組合鍵，系統(tǒng)將停止回放，卸載回放鉤子子程，傳遞一個WM_CANCELJOURNAL消息給記錄應(yīng)用程序。

??? If the hook procedure returns a message in the range WM_KEYFIRST to WM_KEYLAST, the following conditions apply:
??? 如果鉤子子程返回一個在WM_KEYFIRST到WM_KEYLAST范圍內(nèi)的消息，下列條件應(yīng)用：

??? The paramL member of the EVENTMSG structure specifies the virtual key code of the key that was pressed.
??? EVENTMSG結(jié)構(gòu)的paramL成員指定被按下鍵的虛擬鍵碼。

??? The paramH member of the EVENTMSG structure specifies the scan code.
??? EVENTMSG結(jié)構(gòu)的paramL成員指定掃描碼。

??? There's no way to specify a repeat count. The event is always taken to represent one key event.
??? 沒有辦法指定重復(fù)的計數(shù)。事件總是趨于代表一個鍵事件。

8、WH_JOURNALRECORD
??? The JournalRecordProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The function records messages the system removes from the system message queue. Later, an application can use a JournalPlaybackProc hook procedure to play back the messages.
??? JournalRecordProc鉤子子程是與SetWindowsHookEx一起使用的、程序定義的或者庫定義的回調(diào)函數(shù)。該方法記錄系統(tǒng)從系統(tǒng)消息隊列中移除的消息。過后，應(yīng)用程序可以使用JournalPlaybackProc鉤子子程回放這些消息。

Parameters 參數(shù)
??? code? ：[in] Specifies how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定如何處理消息。如果code小于0，鉤子子程不對其進(jìn)行任何進(jìn)一步的處理，必須將消息傳遞給CallNextHookEx方法，并返回由CallNextHookEx方法返回的返回值。該參數(shù)可以是以下值之一：
??? 1．HC_ACTION? ： The lParam parameter is a pointer to an EVENTMSG structure containing information about a message removed from the system queue. The hook procedure must record the contents of the structure by copying them to a buffer or file.
??? 參數(shù)lParam 是一個指向EVENTMSG結(jié)構(gòu)的指針，該結(jié)構(gòu)包含從系統(tǒng)隊列中移除的消息的信息。鉤子子程應(yīng)該通過將消息信息拷貝到緩沖區(qū)中或者文件中來記錄內(nèi)容。
??? 2．HC_SYSMODALOFF ：A system-modal dialog box has been destroyed. The hook procedure must resume recording.
??? 系統(tǒng)模式對話框已經(jīng)被銷毀。鉤子子程必須恢復(fù)紀(jì)錄。
??? 3．HC_SYSMODALON ：A system-modal dialog box is being displayed. Until the dialog box is destroyed, the hook procedure must stop recording.
??? 系統(tǒng)模式對話框正在被顯示。鉤子子程應(yīng)該停止記錄，直到對話框被銷毀。

??? wParam ：This parameter is not used. 該參數(shù)未使用。

??? lParam ：[in] Pointer to an EVENTMSG structure that contains the message to be recorded.
??? 指向EVENTMSG結(jié)構(gòu)的指針，其中包含即將被記錄的消息。

Return Value? 返回值
??? The return value is ignored. 被忽略。

Remarks 備注
??? A JournalRecordProc hook procedure must copy but not modify the messages. After the hook procedure returns control to the system, the message continues to be processed.
??? JournalRecordProc鉤子子程應(yīng)該復(fù)制而不是不修改消息。在鉤子子程將控制全交還給系統(tǒng)后，消息將被繼續(xù)處理。

??? A JournalRecordProc hook procedure does not need to live in a dynamic-link library. A JournalRecordProc hook procedure can live in the application itself.
??? JournalRecordProc鉤子子程沒必要生存在動態(tài)鏈接庫中，可以在應(yīng)用程序自身中生存。

??? Unlike most other global hook procedures, the JournalRecordProc and JournalPlaybackProc hook procedures are always called in the context of the thread that set the hook.
??? 和其它全局鉤子子程不一樣，JournalRecordProca和 JournalPlaybackProc鉤子子程總是在設(shè)置鉤子的線程的上下文中被調(diào)用。

??? An application that has installed a JournalRecordProc hook procedure should watch for the VK_CANCEL virtual key code (which is implemented as the CTRL+BREAK key combination on most keyboards). This virtual key code should be interpreted by the application as a signal that the user wishes to stop journal recording. The application should respond by ending the recording sequence and removing the JournalRecordProc hook procedure. Removal is important. It prevents a journaling application from locking up the system by hanging inside a hook procedure.
??? 安裝有JournalRecordProc鉤子子程的應(yīng)用程序應(yīng)該監(jiān)視VK_CANCEL虛擬鍵碼（在多數(shù)鍵盤上就是像CTRL+BREAK一樣實(shí)現(xiàn)的組合鍵）。虛擬鍵值應(yīng)該被應(yīng)用程序解釋為用戶希望停止日志記錄的信號。應(yīng)用程序應(yīng)該通過結(jié)束記錄隊列或者移除JournalRecordProc鉤子子程來響應(yīng)用戶的信號。可移除性是重要的，可以防止日志應(yīng)用程序由于鉤子子程內(nèi)部的掛起而引起的系統(tǒng)鎖死。

??? This role as a signal to stop journal recording means that a CTRL+BREAK key combination cannot itself be recorded. Since the CTRL+C key combination has no such role as a journaling signal, it can be recorded. There are two other key combinations that cannot be recorded: CTRL+ESC and CTRL+ALT+DEL. Those two key combinations cause the system to stop all journaling activities (record or playback), remove all journaling hooks, and post a WM_CANCELJOURNAL message to the journaling application.
??? CTRL+BREAK組合鍵扮演著停止日志記錄的信號的角色，這意味著CTRL+BREAK組合鍵不能被自我記錄。既然CTRL+C組合鍵沒有扮演這樣的角色，它就可以被記錄。還有其它2種組合鍵不能被記錄： CTRL+ESC 和 CTRL+ALT+DEL。.這2種組合鍵引起系統(tǒng)停止所有日志活動(記錄或者回放)，移除所有日志鉤子，傳遞WM_CANCELJOURNAL消息給日志記錄應(yīng)用程序。

9、WH_KEYBOARD_LL
??? The LowLevelKeyboardProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function every time a new keyboard input event is about to be posted into a thread input queue. The keyboard input can come from the local keyboard driver or from calls to the keybd_event function. If the input comes from a call to keybd_event, the input was "injected". However, the WH_KEYBOARD_LL hook is not injected into another process. Instead, the context switches back to the process that installed the hook and it is called in its original context. Then the context switches back to the application that generated the event.
??? LowLevelKeyboardProc鉤子子程是同SetWindowsHookEx方法一起使用的、應(yīng)用程序定義的或者庫定義的回調(diào)函數(shù)。當(dāng)每次有新的鍵盤輸入事件即將被傳遞給一個線程輸入隊列時，系統(tǒng)會調(diào)用該方法。鍵盤輸入可以來自本地鍵盤驅(qū)動，也可以來自對keybd_event事件的調(diào)用。如果輸入來自對keybd_event事件的調(diào)用，那么輸入是被“注入”的。然而，WH_KEYBOARD_LL鉤子不被注入到其它進(jìn)程中。因?yàn)樯舷挛臅袚Q回安裝鉤子的進(jìn)程，該鉤子就會在原始的上下文中被調(diào)用。然后，上下文切換回生成該事件的應(yīng)用程序中。

Parameters參數(shù)
??? nCode ：[in] Specifies a code the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定鉤子子程使用的代碼，鉤子子程使用該值決定如何處理消息。如果nCode小于0，鉤子子程必須將消息傳遞給CallNextHookEx方法，自己不做進(jìn)一步的處理，并且要返回由方法CallNextHookEx返回的的返回值。該參數(shù)可以是下列值之一。
??? 1．HC_ACTION ：The wParam and lParam parameters contain information about a keyboard message.
??? 參數(shù)wParam和lParam包含有和鍵盤消息相關(guān)的信息。

??? wParam ：[in] Specifies the identifier of the keyboard message. This parameter can be one of the following messages: WM_KEYDOWN, WM_KEYUP, WM_SYSKEYDOWN, or WM_SYSKEYUP.
??? 指定鍵盤消息的標(biāo)識符。該參數(shù)可以是以下參數(shù)之一： WM_KEYDOWN, WM_KEYUP, WM_SYSKEYDOWN, or WM_SYSKEYUP.

??? lParam? ： [in] Pointer to a KBDLLHOOKSTRUCT structure.
??? 指向KBDLLHOOKSTRUCT結(jié)構(gòu)的指針。

Return Value返回值
??? If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx. If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_KEYBOARD_LL hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.
??? 如果nCode小于0，鉤子子程必須返回由方法CallNextHookEx返回的返回值。如果nCode大于等于0，并且鉤子子程還沒有處理消息，強(qiáng)烈建議調(diào)用CallNextHookEx方法，返回有它返回的返回值；否則，其它已經(jīng)安裝了WH_KEYBOARD_LL 鉤子的應(yīng)用程序?qū)⒔邮詹坏姐^子通知，可能導(dǎo)致行為的錯誤。如果鉤子子程已經(jīng)處理了該消息，將返回一個非0值來阻止系統(tǒng)將消息傳遞給鉤子鏈表中的其他鉤子，或者目的窗體程序。

Remarks備注
??? This hook is called in the context of the thread that installed it. The call is made by sending a message to the thread that installed the hook. Therefore, the thread that installed the hook must have a message loop.
??? 鉤子在安裝它的線程的上下文中被調(diào)用。通過發(fā)送消息給安裝該鉤子的線程來實(shí)現(xiàn)調(diào)用。因此，安裝有該鉤子的線程必須有消息循環(huán)。

??? The hook procedure should process a message in less time than the data entry specified in the LowLevelHooksTimeout value in the following registry key:
??? HKEY_CURRENT_USER\Control Panel\Desktop
??? The value is in milliseconds. If the hook procedure does not return during this interval, the system will pass the message to the next hook.
??? Note that debug hooks cannot track this type of hook.
??? 鉤子子程應(yīng)該用比下面時間少的時間來處理消息： 在注冊表的HKEY_CURRENT_USER\Control Panel\Desktop鍵的 LowLevelHooksTimeout值指定的時間，該值是以毫秒為單位的。如果鉤子子程在這個間隔內(nèi)沒有返回，系統(tǒng)將把消息傳遞給下一個鉤子。
??? 注意：調(diào)試鉤子不能跟蹤該類型的鉤子。

10、WH_KEYBOARD
??? The KeyboardProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever an application calls the GetMessage or PeekMessage function and there is a keyboard message (WM_KEYUP or WM_KEYDOWN) to be processed.
??? KeyboardProc鉤子子程是同SetWindowsHookEx方法一起使用的、用戶定義的或者庫定義的回調(diào)函數(shù)。無論什么時候，當(dāng)應(yīng)用程序調(diào)用GetMessage 或者 PeekMessage方法時，系統(tǒng)都調(diào)用該方法，將有一個鍵盤消息(WM_KEYUP或者 WM_KEYDOWN)被處理。
???
Parameters參數(shù)
??? code? ： [in] Specifies a code the hook procedure uses to determine how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定鉤子子程使用的代碼，來決定如何處理該消息。如果code小于0，鉤子子程必須將該消息傳遞給CallNextHookEx方法，自己不進(jìn)行任何進(jìn)一步的處理，并且返回由CallNextHookEx方法返回的返回值。該參數(shù)可以是以下值之一：
??? 1．HC_ACTION ：The wParam and lParam parameters contain information about a keystroke message.
??? 參數(shù) wParam 和 lParam 包含有鍵盤敲擊消息的信息。
??? 2．HC_NOREMOVE ：The wParam and lParam parameters contain information about a keystroke message, and the keystroke message has not been removed from the message queue. (An application called the PeekMessage function, specifying the PM_NOREMOVE flag.)
??? 參數(shù)wParam和lParam包含有鍵盤敲擊消息的信息，鍵盤敲擊消息還沒有被從消息隊列中移除。(應(yīng)用程序調(diào)用PeekMessage方法，同時指定PM_NOREMOVE標(biāo)志。)

??? wParam ：[in] Specifies the virtual-key code of the key that generated the keystroke message.
??? 指定生成鍵盤敲擊消息的鍵的虛擬鍵碼值。

??? lParam ：[in] Specifies the repeat count, scan code, extended-key flag, context code, previous key-state flag, and transition-state flag. This parameter can be one or more of the following values.
??? 指定重復(fù)次數(shù)，掃描代碼，擴(kuò)展鍵標(biāo)志，上下文代碼，前期的鍵狀態(tài)標(biāo)志，轉(zhuǎn)換狀態(tài)標(biāo)志。該參數(shù)可下列的一個或者多個值。
??? 0-15? ： Specifies the repeat count. The value is the number of times the keystroke is repeated as a result of the user's holding down the key.
??? 指定重復(fù)的次數(shù)。該值是，當(dāng)用戶持續(xù)按住一個鍵時，鍵盤敲擊被重復(fù)的次數(shù)。
??? 16-23? ：Specifies the scan code. The value depends on the OEM.
??? 指定掃描代碼。該值依賴于OEM。
??? 24? ：Specifies whether the key is an extended key, such as a function key or a key on the numeric keypad. The value is 1 if the key is an extended key; otherwise, it is 0.
??? 指定該值是否是一個擴(kuò)展鍵，例如功能鍵或者數(shù)字鍵盤上的鍵。如果是擴(kuò)展鍵，該值為1，否則為0。
??? 25-28 ： Reserved.保留
??? 29? ：Specifies the context code. The value is 1 if the ALT key is down; otherwise, it is 0.
??? 指定上下文代碼。如果ALT鍵被按下，該值為1，否則為0。
??? 30? : Specifies the previous key state. The value is 1 if the key is down before the message is sent; it is 0 if the key is up.
??? 指定前面的鍵狀態(tài)。如果在消息發(fā)出之前該鍵被按下，值為1；如果鍵彈起，值為0。
??? 31? ： Specifies the transition state. The value is 0 if the key is being pressed and 1 if it is being released.
??? 指定轉(zhuǎn)換狀態(tài)。如果鍵正在被按下，該值為0，如果正在被釋放，則為1。

Return Value 返回值
??? If code is less than zero, the hook procedure must return the value returned by CallNextHookEx. If code is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_KEYBOARD hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.
??? 如果code小于0，鉤子子程必須返回由CallNextHookEx返回的返回值。如果code大于等于0，表示鉤子子程沒有處理該消息，強(qiáng)烈要求調(diào)用CallNextHookEx方法，并返回由它返回的返回值；否則，其它已經(jīng)安裝有WH_KEYBOARD鉤子的應(yīng)用程序?qū)⑹詹坏姐^子通知，可能導(dǎo)致行為的錯誤。如果鉤子子程處理了該消息，可能返回一個非0值，用來阻止系統(tǒng)將該消息傳遞給鉤子鏈表中的其它鉤子或者目的窗體程序。

11、WH_MOUSE_LL
??? The LowLevelMouseProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system call this function every time a new mouse input event is about to be posted into a thread input queue. The mouse input can come from the local mouse driver or from calls to the mouse_event function. If the input comes from a call to mouse_event, the input was "injected". However, the WH_MOUSE_LL hook is not injected into another process. Instead, the context switches back to the process that installed the hook and it is called in its original context. Then the context switches back to the application that generated the event.
??? LowLevelMouseProc鉤子子程是同SetWindowsHookEx方法一起使用的、應(yīng)用程序定義的或者庫定義的回調(diào)函數(shù)。系統(tǒng)在每次有新的鼠標(biāo)輸入事件即將被傳遞給線程輸入隊列時，調(diào)用該方法。鼠標(biāo)輸入可以來自本地鼠標(biāo)驅(qū)動或者對mouse_event方法的調(diào)用。如果輸入來自對mouse_event的調(diào)用，該輸入就是被“注入”。 然而，WH_MOUSE_LL鉤子不能被注入到其他進(jìn)程。因?yàn)樯舷挛臅袚Q回安裝該鉤子的進(jìn)程，該鉤子會在原始的上下文中被調(diào)用。然后，上下文切換回生成該事件的應(yīng)用程序中。

Parameters 參數(shù)
??? nCode ：[in] Specifies a code the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定鉤子子程使用的代碼，用來決定如何處理消息。如果nCode小于0，鉤子子程必須將消息傳遞給CallNextHookEx方法，自己不進(jìn)行進(jìn)一步的處理，并且應(yīng)該返回由方法CallNextHookEx返回的返回值。參數(shù)可以是下列值之一：
??? 1．HC_ACTION ：The wParam and lParam parameters contain information about a mouse message.
??? wParam 和 lParam 參數(shù)包含有鼠標(biāo)消息的信息。

??? wParam ：[in] Specifies the identifier of the mouse message. This parameter can be one of the following messages: WM_LBUTTONDOWN, WM_LBUTTONUP, WM_MOUSEMOVE, WM_MOUSEWHEEL, WM_RBUTTONDOWN, or WM_RBUTTONUP.
??? 指定鼠標(biāo)消息的標(biāo)識符。參數(shù)可以是以下消息之一： WM_LBUTTONDOWN, WM_LBUTTONUP, WM_MOUSEMOVE, WM_MOUSEWHEEL, WM_RBUTTONDOWN, WM_RBUTTONUP.

??? lParam ：[in] Pointer to an MSLLHOOKSTRUCT structure.
??? 指向MSLLHOOKSTRUCT結(jié)構(gòu)的指針。

Return Value 返回值
??? If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.
??? 如果nCode小于0，鉤子子程必須返回由方法CallNextHookEx返回的返回值。

??? If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_MOUSE_LL hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.
??? 如果nCode大于等于0，而且鉤子子程沒有處理該消息，那么強(qiáng)烈要求調(diào)用方法CallNextHookEx并返回由它返回的返回值；否則，其它已經(jīng)安裝了WH_MOUSE_LL鉤子的應(yīng)用程序?qū)⑹詹坏姐^子通知，可能導(dǎo)致行為的錯誤。如果鉤子子程已經(jīng)處理了該消息，將返回一個非0值，用來阻止系統(tǒng)將消息傳遞給鉤子鏈表中的其它鉤子或者目標(biāo)窗體程序。

Remarks 備注
??? An application installs the hook procedure by specifying the WH_MOUSE_LL hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.
??? 應(yīng)用程序通過下面的方法安裝該鉤子子程：指定WH_MOUSE_LL鉤子類型；指定在調(diào)用SetWindowsHookEx的方法中的指向鉤子子程的指針。

??? This hook is called in the context of the thread that installed it. The call is made by sending a message to the thread that installed the hook. Therefore, the thread that installed the hook must have a message loop.
??? 該鉤子在安裝它的線程的上下文中被調(diào)用。通過發(fā)送消息給安裝鉤子的線程來實(shí)現(xiàn)調(diào)用。因此，安裝鉤子的線程必須有消息循環(huán)。

??? The hook procedure should process a message in less time than the data entry specified in the LowLevelHooksTimeout value in the following registry key:
??? HKEY_CURRENT_USER\Control Panel\Desktop
??? The value is in milliseconds. If the hook procedure does not return during this interval, the system will pass the message to the next hook.
??? Note that debug hooks cannot track this type of hook.
??? 鉤子子程應(yīng)該用比下面時間少的時間來處理消息： 在注冊表的HKEY_CURRENT_USER\Control Panel\Desktop鍵的 LowLevelHooksTimeout值指定的時間。該值是以毫秒為單位的。如果鉤子子程在這個間隔沒有返回，系統(tǒng)將把消息傳遞給下一個鉤子。注意：調(diào)試鉤子不能追蹤該類型的鉤子。

12、WH_MOUSE
??? The MouseProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever an application calls the GetMessage or PeekMessage function and there is a mouse message to be processed.
??? MouseProc鉤子子程是同SetWindowsHookEx方法一起使用的、應(yīng)用程序定義的或者庫定義的回調(diào)函數(shù)。無論什么時候，當(dāng)應(yīng)用程序一調(diào)用GetMessage 或者 PeekMessage方法，有鼠標(biāo)消息即將被處理時，系統(tǒng)調(diào)用該方法。

Parameters 參數(shù)
??? nCode ：[in] Specifies a code the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定鉤子子程使用的用來決定如何處理消息的碼值。如果nCode小于0，鉤子子程必須將消息傳遞給CallNextHookEx方法，自己不進(jìn)行進(jìn)一步的處理，并且要返回由CallNextHookEx方法返回的返回值。該參數(shù)可以是下列值之一：
??? 1．HC_ACTION ：The wParam and lParam parameters contain information about a mouse message.
??? 參數(shù)wParam 和 lParam包含和鼠標(biāo)消息相關(guān)的信息。
??? 2．HC_NOREMOVE ：The wParam and lParam parameters contain information about a mouse message, and the mouse message has not been removed from the message queue. (An application called the PeekMessage function, specifying the PM_NOREMOVE flag.)
??? 參數(shù)wParam 和 lParam包含和鼠標(biāo)消息相關(guān)的信息，鼠標(biāo)消息還沒有從消息隊列中移除。

??? wParam ：[in] Specifies the identifier of the mouse message.
??? 指定鼠標(biāo)消息的標(biāo)識符。
???
??? lParam：[in] Pointer to a MOUSEHOOKSTRUCT structure.
??? 指向MOUSEHOOKSTRUCT結(jié)構(gòu)的指針。

Return Value 返回值
??? If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx. If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_MOUSE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the target window procedure.
??? 如果code小于0，鉤子子程必須返回由CallNextHookEx方法返回的返回值。如果code大于等于0，鉤子子程還沒有處理該消息，強(qiáng)烈要求調(diào)用CallNextHookEx方法并返回由它返回的返回值；否則，其它已經(jīng)安裝了WH_MOUSE鉤子的應(yīng)用程序?qū)⑹詹坏姐^子通知，可能導(dǎo)致行為的錯誤。如果鉤子子程已經(jīng)處理了該消息，應(yīng)該返回非0值，以阻止系統(tǒng)將消息傳遞給鉤子鏈表中剩余的鉤子或者目標(biāo)窗體程序。

Remarks備注
??? An application installs the hook procedure by specifying the WH_MOUSE hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function. The hook procedure must not install a WH_JOURNALPLAYBACK Hook callback function.
??? 應(yīng)用程序通過下面方法來安裝鉤子：指定WH_MOUSE鉤子類型；指定在調(diào)用SetWindowsHookEx的方法中指向鉤子子程的指針。該鉤子子程不應(yīng)安裝WH_JOURNALPLAYBACK鉤子的回調(diào)函數(shù)。

?
?
13、WH_SHELL
??? The ShellProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The function receives notifications of Shell events from the system.
??? The HOOKPROC type defines a pointer to this callback function. ShellProc is a placeholder for the application-defined or library-defined function name.
??? ShellProc鉤子子程是同SetWindowsHookEx一起使用的、應(yīng)用程序定義的或者庫定義的回調(diào)函數(shù)。該方法接收來自系統(tǒng)的加殼事件通知。HOOKPROC類型定義了指向該方法的指針。ShellProc是應(yīng)用程序定義的或者庫定義的方法的名字。

Parameters參數(shù)
??? nCode ：[in] Specifies the hook code. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定鉤子代碼。如果nCode小于0，鉤子子程必須將消息傳遞給CallNextHookEx方法，自己不進(jìn)行進(jìn)一步的處理，并且應(yīng)該返回由CallNextHookEx方法返回的返回值。該參數(shù)可以是下列值：
??? 1．HSHELL_ACCESSIBILITYSTATE
??? Windows 2000/XP: The accessibility state has changed. 可訪問性已經(jīng)改
???
??? 2．HSHELL_ACTIVATESHELLWINDOW
??? The shell should activate its main window. 外殼應(yīng)該激活它的主窗口。
???
??? 3．HSHELL_APPCOMMAND
??? Windows 2000/XP: The user completed an input event (for example, pressed an application command button on the mouse or an application command key on the keyboard), and the application did not handle the WM_APPCOMMAND message generated by that input.
??? 用戶完成一個輸入事件(例如，按下應(yīng)用程序鼠標(biāo)上的命令按鈕或者鍵盤上的命令鍵)，應(yīng)用程序沒有處理由該輸入產(chǎn)生的WM_APPCOMMAND 消息。
??? If the Shell procedure handles the WM_COMMAND message, it should not call CallNextHookEx. See the Return Value section for more information.
??? 如果Shell子程獲得了WM_COMMAND消息的句柄，不應(yīng)該調(diào)用CallNextHookEx 。
???
??? 4．HSHELL_GETMINRECT
??? A window is being minimized or maximized. The system needs the coordinates of the minimized rectangle for the window.
??? 窗口正在被最小化或者最大化。系統(tǒng)需要窗體的最小矩形框的坐標(biāo)。

??? 5．HSHELL_LANGUAGE
??? Keyboard language was changed or a new keyboard layout was loaded.
??? 鍵盤語言被改變了或者新的鍵盤布局被加載了。

??? 6．HSHELL_REDRAW
??? The title of a window in the task bar has been redrawn.
??? 任務(wù)欄中的窗口標(biāo)題被重繪了。

??? 7．HSHELL_TASKMAN
??? The user has selected the task list. A shell application that provides a task list should return TRUE to prevent Microsoft Windows from starting its task list.
??? 用戶選擇了任務(wù)列表。提供了任務(wù)列表的加殼應(yīng)用程序應(yīng)該返回TRUE,來阻止windows啟動任務(wù)列表。

??? 8．HSHELL_WINDOWACTIVATED
??? The activation has changed to a different top-level, unowned window.
??? 激活動作變成了不同的top-level，unowned 的窗口。(即，激活了不同的不明窗口，使其處于最上層。)

??? 9．HSHELL_WINDOWCREATED
??? A top-level, unowned window has been created. The window exists when the system calls this hook.
??? 頂層的、不受控制的窗體已經(jīng)被創(chuàng)建。當(dāng)系統(tǒng)調(diào)用該鉤子時，窗口存在。

??? 10．HSHELL_WINDOWDESTROYED
??? A top-level, unowned window is about to be destroyed. The window still exists when the system calls this hook.
??? 頂層的、不受控制的窗體即將被銷毀。當(dāng)系統(tǒng)調(diào)用該鉤子的時候該窗體依然存在。

??? 11．HSHELL_WINDOWREPLACED
??? Windows XP: A top-level window is being replaced. The window exists when the system calls this hook.
??? 在Windows XP環(huán)境下，頂層的窗體正在被替換掉。當(dāng)系統(tǒng)調(diào)用該鉤子時，窗口存在。

??? wParam [in] The value depends on the value of the nCode parameter, as shown in the following table.
??? 該值取決于參數(shù) nCode ，如下表所示。
?
---------------------------------------------------------------------------------------
| nCode???????????????????????? |wParam????????????????????????????????????????????????????????????????????????????????????????????????????????? |
---------------------------------------------------------------------------------------
| HSHELL_ACCESSIBILITYSTATE???? |Windows 2000/XP: Indicates which accessibility?????? |
|????????????????????????????????????????????????????????????????? |feature has changed state. This value is one???????????? |
|???????????????????????????????????????????????????????????????????? |of the following: ACCESS_FILTERKEYS,???????????????? |
|?????????????????????????????? |ACCESS_MOUSEKEYS, or ACCESS_STICKYKEYS.????????????? |
|?????????????????????????????? |???????????????????????????????????????????????????? |
|?????????????????????????????? |在Windows XP 環(huán)境下：指示哪種訪問特征已經(jīng)被改變????? |
|?????????????????????????????? |了狀態(tài)。值可以是下列之一：ACCESS_FILTERKEYS,???????? |
|?????????????????????????????? |ACCESS_MOUSEKEYS, ACCESS_STICKYKEYS.???????????????? |
---------------------------------------------------------------------------------------
|HSHELL_APPCOMMAND????????????? |Windows 2000/XP: Where the WM_APPCOMMAND???????????? |
|?????????????????????????????? |message was originally sent; for example, the??????? |
|?????????????????????????????? |handle to a window.????????????????????????????????? |
|?????????????????????????????? |???????????????????????????????????????????????????? |
|?????????????????????????????? |是WM_APPCOMMAND消息最初發(fā)出的位置，例如，窗口的????? |
|?????????????????????????????? |句柄。?????????????????????????????????????????????? |
---------------------------------------------------------------------------------------
|HSHELL_GETMINRECT????????????? |Handle to the minimized or maximized window.???????? |
|?????????????????????????????? |最小化或者最大化的窗體的句柄。?????????????????????? |
---------------------------------------------------------------------------------------
|HSHELL_LANGUAGE??????????????? |Handle to the window.窗口句柄。????????????????????? |
---------------------------------------------------------------------------------------
|HSHELL_REDRAW????????????????? |Handle to the redrawn window.重化窗口句柄。????????? |
---------------------------------------------------------------------------------------
|HSHELL_WINDOWACTIVATED???????? |Handle to the activated window.活動窗口句柄。??????? |
---------------------------------------------------------------------------------------
|HSHELL_WINDOWCREATED?????????? |Handle to the created window.被創(chuàng)建的窗口的句柄。??? |
---------------------------------------------------------------------------------------?????????????????????????????????????????????????????????????????????????????? |
|HSHELL_WINDOWDESTROYED???????? |Handle to the destroyed window.被銷毀的窗口的句柄。? |
---------------------------------------------------------------------------------------
|HSHELL_WINDOWREPLACED????????? |Windows XP: Handle to the window being replaced.???? |
|?????????????????????????????? |即將被替換的窗體的句柄。???????????????????????????? |
---------------------------------------------------------------------------------------

??? lParam? [in] The value depends on the value of the nCode parameter, as shown in the following table.
??? 該值取決于參數(shù)nCode。如下表所示。

--------------------------------------------------------------------------------------------------------------???
|nCode????????????????????????? | lParam???????????????????????????????????????????????????????????????????? |
|?????????????????????????????? |??????????????????????????????????????????????????????????????????????????? |
|HSHELL_APPCOMMAND????????????? | Windows 2000/XP:GET_APPCOMMAND_LPARAM(lParam) is the application?????????? |
|?????????????????????????????? | command corresponding to the input event.????????????????????????????????? |
|?????????????????????????????? | GET_APPCOMMAND_LPARAM是對輸入事件做出響應(yīng)的應(yīng)用程序命令。????????????????? |
|?????????????????????????????? |??????????????????????????????????????????????????????????????????????????? |
|?????????????????????????????? | GET_DEVICE_LPARAM(lParam) indicates what generated the input?????????????? |
|?????????????????????????????? | event; for example, the mouse or keyboard.???????????????????????????????? |
|?????????????????????????????? | GET_DEVICE_LPARAM指示是什么生成了輸入事件。例如，鼠標(biāo)或者鍵盤。??????????? |
|?????????????????????????????? |??????????????????????????????????????????????????????????????????????????? |
|?????????????????????????????? | GET_FLAGS_LPARAM(lParam) depends on the value of cmd in??????????????????? |
|?????????????????????????????? | WM_APPCOMMAND. For example, it might indicate which virtual keys?????????? |
|?????????????????????????????? | were held down when the WM_APPCOMMAND message was originally sent.???????? |
|?????????????????????????????? | GET_FLAGS_LPARAM(lParam)依賴于 WM_APPCOMMAND中CMD的值。例如，可以????????? |
|?????????????????????????????? | 指示當(dāng)WM_APPCOMMAND消息被發(fā)出的時候，哪個虛擬鍵被按下。??????????????????? |
--------------------------------------------------------------------------------------------------------------
|HSHELL_GETMINRECT????????????? | Pointer to a RECT structure.??? RECT結(jié)構(gòu)的指針???????????????????????????? |
--------------------------------------------------------------------------------------------------------------
|HSHELL_LANGUAGE??????????????? | Handle to a keyboard layout.?? 鍵盤布局的句柄。??????????????????????????? |
--------------------------------------------------------------------------------------------------------------
|HSHELL_REDRAW????????????????? | The value is TRUE if the window is flashing, or FALSE otherwise.?????????? |
|?????????????????????????????? | 如果窗口正在閃爍（重繪過程中），該值為true，其他為false??????????????????? |
--------------------------------------------------------------------------------------------------------------
|HSHELL_WINDOWACTIVATED???????? | The value is TRUE if the window is in full-screen mode, or FALSE otherwise.|
|?????????????????????????????? | 如果窗體處于全屏模式，該值是true，否則為false。??????????????????????????? |
--------------------------------------------------------------------------------------------------------------
|HSHELL_WINDOWREPLACED????????? | Windows XP: Handle to the new window.新窗體的句柄。??????????????????????? |
--------------------------------------------------------------------------------------------------------------

Return Value返回值
??? The return value should be zero unless the value of nCode is HSHELL_APPCOMMAND and the shell procedure handles the WM_COMMAND message. In this case, the return should be nonzero.
??? 如果nCode的值是HSHELL_APPCOMMAND，shell子程句柄指向WM_COMMAND 消息，在這種情況下，返回值是非0。其他情況下，返回值是0。

Remarks備注
??? Install this hook procedure by specifying the WH_SHELL hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.
??? 通過指定WH_SHELL 鉤子類型以及在SetWindowsHookEx的方法中的指向鉤子子程的指針來安裝該鉤子子程。
???

14、WH_SYSMSGFILTER
??? The SysMsgProc hook procedure is a library-defined callback function used with the SetWindowsHookEx function. The system calls this function after an input event occurs in a dialog box, message box, menu, or scroll bar, but before the message generated by the input event is processed. The function can monitor messages for any dialog box, message box, menu, or scroll bar in the system.
??? SysMsgProc鉤子子程是同SetWindowsHookEx一起使用的在庫中定義的回調(diào)函數(shù)。在對話框、消息框、菜單、滾動條中所屬的輸入事件發(fā)生后，在這些消息被系統(tǒng)處理之前，系統(tǒng)調(diào)用該方法。該方法能夠?yàn)橄到y(tǒng)中任何對話框、消息框、菜單、滾動條監(jiān)視消息。

Parameters參數(shù)
??? nCode [in] Specifies the type of input event that generated the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定生成該消息的輸入事件的類型。如果nCode小于0，鉤子子程必須將消息傳遞給CallNextHookEx方法，自己不進(jìn)行進(jìn)一步的處理，并且應(yīng)該返回由CallNextHookEx方法返回的返回值。。該參數(shù)可以是以下值之一：
??? 1．MSGF_DIALOGBOX ：The input event occurred in a message box or dialog box.?
??? 輸入事件在消息框或者對話框中發(fā)生。
??? 2．MSGF_MENU ：The input event occurred in a menu.
??? 輸入事件在菜單中發(fā)生。
??? 3．MSGF_SCROLLBAR ：The input event occurred in a scroll bar.
??? 輸入事件在滾動條中發(fā)生。

??? wParam ：This parameter is not used. 該參數(shù)未使用。

??? lParam ：[in] Pointer to an MSG message structure.指向MSG消息結(jié)構(gòu)的指針。

Return Value 返回值
??? If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.
??? If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_SYSMSGFILTER hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the target window procedure.
??? 如果nCode小于0，鉤子子程必須返回由CallNextHookEx方法返回的返回值。如果nCode大于等于0，并且鉤子子程還沒有處理該消息，強(qiáng)烈要求調(diào)用CallNextHookEx方法并返回由它返回的返回值。否則，其他已經(jīng)安裝了WH_SYSMSGFILTER鉤子的應(yīng)用程序?qū)⒔邮詹坏姐^子通知，可能導(dǎo)致行為錯誤。如果鉤子子程已經(jīng)處理了該消息，應(yīng)該返回非0 值，來阻止系統(tǒng)將消息傳遞給目標(biāo)窗體程序。

Remarks備注
??? An application installs the hook procedure by specifying the WH_SYSMSGFILTER hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.
??? 應(yīng)用程序安裝該鉤子通過：指定WH_SYSMSGFILTER鉤子類型；指定在調(diào)用SetWindowsHookEx方法的指向鉤子子程的指針。

15、WH_MSGFILTER
??? The MessageProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function after an input event occurs in a dialog box, message box, menu, or scroll bar, but before the message generated by the input event is processed. The hook procedure can monitor messages for a dialog box, message box, menu, or scroll bar created by a particular application or all applications.

??? The HOOKPROC type defines a pointer to this callback function. MessageProc is a placeholder for the application-defined or library-defined function name.

Syntax

LRESULT CALLBACK MessageProc(????????? int code,
??? WPARAM wParam,
??? LPARAM lParam
);
Parameters
??? code
????? [in] Specifies the type of input event that generated the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and return the value returned by CallNextHookEx. This parameter can be one of the following values.
??????? MSGF_DDEMGR
??????????? The input event occurred while the Dynamic Data Exchange Management Library (DDEML) was waiting for a synchronous transaction to finish. For more information about DDEML, see Dynamic Data Exchange Management Library.
??????? MSGF_DIALOGBOX
??????????? The input event occurred in a message box or dialog box.
??????? MSGF_MENU
??????????? The input event occurred in a menu.
??????? MSGF_SCROLLBAR
??????????? The input event occurred in a scroll bar.
??? wParam
??????? This parameter is not used.
??? lParam
??????? [in] Pointer to an MSG structure.
Return Value
??? If code is less than zero, the hook procedure must return the value returned by CallNextHookEx.

??? If code is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_MSGFILTER hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.

Remarks
??? An application installs the hook procedure by specifying the WH_MSGFILTER hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.

??? If an application that uses the DDEML and performs synchronous transactions must process messages before they are dispatched, it must use the WH_MSGFILTER hook.

?

本文來自CSDN博客，轉(zhuǎn)載請標(biāo)明出處：http://blog.csdn.net/jiangxinyu/archive/2010/02/03/5284067.aspx