SetWindowsHookEx 详解（一）

SetWindowsHookEx function

Installs an application-defined hook procedure into a hook chain. You would install a hook procedure to monitor the system for certain types of events. These events are associated either with a specific thread or with all threads in the same desktop as the calling thread.

Syntax

C++

HHOOK WINAPI SetWindowsHookEx(  _In_  int idHook,  _In_  HOOKPROC lpfn,  _In_  HINSTANCE hMod,  _In_  DWORD dwThreadId);

Parameters

idHook [in]

Type: int

The type of hook procedure to be installed. This parameter can be one of the following values.

ValueMeaning

WH_CALLWNDPROC

4

Installs a hook procedure that monitors messages before the system sends them to the destination window procedure. For more information, see the CallWndProc hook procedure.

WH_CALLWNDPROCRET

12

Installs a hook procedure that monitors messages after they have been processed by the destination window procedure. For more information, see the CallWndRetProc hook procedure.

WH_CBT

5

Installs a hook procedure that receives notifications useful to a CBT application. For more information, see the CBTProc hook procedure.

WH_DEBUG

9

Installs a hook procedure useful for debugging other hook procedures. For more information, see the DebugProc hook procedure.

WH_FOREGROUNDIDLE

11

Installs a hook procedure that will be called when the application's foreground thread is about to become idle. This hook is useful for performing low priority tasks during idle time. For more information, see the ForegroundIdleProc hook procedure.

WH_GETMESSAGE

3

Installs a hook procedure that monitors messages posted to a message queue. For more information, see the GetMsgProc hook procedure.

WH_JOURNALPLAYBACK

1

Installs a hook procedure that posts messages previously recorded by aWH_JOURNALRECORD hook procedure. For more information, see theJournalPlaybackProc hook procedure.

WH_JOURNALRECORD

0

Installs a hook procedure that records input messages posted to the system message queue. This hook is useful for recording macros. For more information, see the JournalRecordProc hook procedure.

WH_KEYBOARD

2

Installs a hook procedure that monitors keystroke messages. For more information, see the KeyboardProc hook procedure.

WH_KEYBOARD_LL

13

Installs a hook procedure that monitors low-level keyboard input events. For more information, see the LowLevelKeyboardProc hook procedure.

WH_MOUSE

7

Installs a hook procedure that monitors mouse messages. For more information, see the MouseProc hook procedure.

WH_MOUSE_LL

14

Installs a hook procedure that monitors low-level mouse input events. For more information, see the LowLevelMouseProc hook procedure.

WH_MSGFILTER

-1

Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. For more information, see the MessageProc hook procedure.

WH_SHELL

10

Installs a hook procedure that receives notifications useful to shell applications. For more information, see the ShellProc hook procedure.

WH_SYSMSGFILTER

6

Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages for all applications in the same desktop as the calling thread. For more information, see the SysMsgProchook procedure.

 

lpfn [in]

Type: HOOKPROC

A pointer to the hook procedure. If the dwThreadId parameter is zero or specifies the identifier of a thread created by a different process, the lpfn parameter must point to a hook procedure in a DLL. Otherwise,lpfn can point to a hook procedure in the code associated with the current process.

hMod [in]

Type: HINSTANCE

A handle to the DLL containing the hook procedure pointed to by the lpfn parameter. The hModparameter must be set to NULL if the dwThreadId parameter specifies a thread created by the current process and if the hook procedure is within the code associated with the current process.

dwThreadId [in]

Type: DWORD

The identifier of the thread with which the hook procedure is to be associated. For desktop apps, if this parameter is zero, the hook procedure is associated with all existing threads running in the same desktop as the calling thread. For Windows Store apps, see the Remarks section.

Return value

Type:

Type: HHOOK

If the function succeeds, the return value is the handle to the hook procedure.

If the function fails, the return value is NULL. To get extended error information, call GetLastError.

Remarks

SetWindowsHookEx can be used to inject a DLL into another process. A 32-bit DLL cannot be injected into a 64-bit process, and a 64-bit DLL cannot be injected into a 32-bit process. If an application requires the use of hooks in other processes, it is required that a 32-bit application call SetWindowsHookEx to inject a 32-bit DLL into 32-bit processes, and a 64-bit application call SetWindowsHookEx to inject a 64-bit DLL into 64-bit processes. The 32-bit and 64-bit DLLs must have different names.

Because hooks run in the context of an application, they must match the "bitness" of the application. If a 32-bit application installs a global hook on 64-bit Windows, the 32-bit hook is injected into each 32-bit process (the usual security boundaries apply). In a 64-bit process, the threads are still marked as "hooked." However, because a 32-bit application must run the hook code, the system executes the hook in the hooking app's context; specifically, on the thread that called SetWindowsHookEx. This means that the hooking application must continue to pump messages or it might block the normal functioning of the 64-bit processes.

If a 64-bit application installs a global hook on 64-bit Windows, the 64-bit hook is injected into each 64-bit process, while all 32-bit processes use a callback to the hooking application.

To hook all applications on the desktop of a 64-bit Windows installation, install a 32-bit global hook and a 64-bit global hook, each from appropriate processes, and be sure to keep pumping messages in the hooking application to avoid blocking normal functioning. If you already have a 32-bit global hooking application and it doesn't need to run in each application's context, you may not need to create a 64-bit version.

An error may occur if the hMod parameter is NULL and the dwThreadId parameter is zero or specifies the identifier of a thread created by another process.

Calling the CallNextHookEx function to chain to the next hook procedure is optional, but it is highly recommended; otherwise, other applications that have installed hooks will not receive hook notifications and may behave incorrectly as a result. You should call CallNextHookEx unless you absolutely need to prevent the notification from being seen by other applications.

Before terminating, an application must call the UnhookWindowsHookEx function to free system resources associated with the hook.

The scope of a hook depends on the hook type. Some hooks can be set only with global scope; others can also be set for only a specific thread, as shown in the following table.

HookScopeWH_CALLWNDPROCThread or globalWH_CALLWNDPROCRETThread or globalWH_CBTThread or globalWH_DEBUGThread or globalWH_FOREGROUNDIDLEThread or globalWH_GETMESSAGEThread or globalWH_JOURNALPLAYBACKGlobal onlyWH_JOURNALRECORDGlobal onlyWH_KEYBOARDThread or globalWH_KEYBOARD_LLGlobal onlyWH_MOUSEThread or globalWH_MOUSE_LLGlobal onlyWH_MSGFILTERThread or globalWH_SHELLThread or globalWH_SYSMSGFILTERGlobal only

 

For a specified hook type, thread hooks are called first, then global hooks. Be aware that the WH_MOUSE, WH_KEYBOARD, WH_JOURNAL*, WH_SHELL, and low-level hooks can be called on the thread that installed the hook rather than the thread processing the hook. For these hooks, it is possible that both the 32-bit and 64-bit hooks will be called if a 32-bit hook is ahead of a 64-bit hook in the hook chain.

The global hooks are a shared resource, and installing one affects all applications in the same desktop as the calling thread. All global hook functions must be in libraries. Global hooks should be restricted to special-purpose applications or to use as a development aid during application debugging. Libraries that no longer need a hook should remove its hook procedure.

Windows Store app development If dwThreadId is zero, then window hook DLLs are not loaded in-process for the Windows Store app processes and the Windows Runtime broker process unless they are installed by either UIAccess processes (accessibility tools). The notification is delivered on the installer's thread for these hooks:

• WH_JOURNALPLAYBACK
• WH_JOURNALRECORD
• WH_KEYBOARD
• WH_KEYBOARD_LL
• WH_MOUSE
• WH_MOUSE_LL

This behavior is similar to what happens when there is an architecture mismatch between the hook DLL and the target application process, for example, when the hook DLL is 32-bit and the application process 64-bit.

Examples

For an example, see Installing and Releasing Hook Procedures.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header

Winuser.h (include Windows.h)

Library

User32.lib

DLL

User32.dll

Unicode and ANSI names

SetWindowsHookExW (Unicode) and SetWindowsHookExA (ANSI)
参考地址：

http://msdn.microsoft.com/en-us/library/windows/desktop/ms644990(v=vs.85).aspx

类型： WH_CALLWNDPROC 值 4，回调参数如下

CallWndProc callback function

An application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function before calling the window procedure to process a message sent to the thread.

The HOOKPROC type defines a pointer to this callback function. CallWndProc is a placeholder for the application-defined or library-defined function name.

Syntax

C++

LRESULT CALLBACK CallWndProc(  _In_  int nCode,  _In_  WPARAM wParam,  _In_  LPARAM lParam);

Parameters

nCode [in]

Type: int

Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and must return the value returned by CallNextHookEx.

wParam [in]

Type: WPARAM

Specifies whether the message was sent by the current thread. If the message was sent by the current thread, it is nonzero; otherwise, it is zero.

lParam [in]

Type: LPARAM

A pointer to a CWPSTRUCT structure that contains details about the message.

Return value

Type:

Type: LRESULT

If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.

If nCode is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_CALLWNDPROC hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.

Remarks

The CallWndProc hook procedure can examine the message, but it cannot modify it. After the hook procedure returns control to the system, the message is passed to the window procedure.

An application installs the hook procedure by specifying the WH_CALLWNDPROC hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header

Winuser.h (include Windows.h)

类型： WH_CALLWNDPROCRET值 12，回调参数如下

CallWndRetProc callback function

An application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function after the SendMessage function is called. The hook procedure can examine the message; it cannot modify it.

The HOOKPROC type defines a pointer to this callback function. CallWndRetProc is a placeholder for the application-defined or library-defined function name.

Syntax

C++

LRESULT CALLBACK CallWndRetProc(  _In_  int nCode,  _In_  WPARAM wParam,  _In_  LPARAM lParam);

Parameters

nCode [in]

Type: int

Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx.

wParam [in]

Type: WPARAM

Specifies whether the message is sent by the current process. If the message is sent by the current process, it is nonzero; otherwise, it is NULL.

lParam [in]

Type: LPARAM

A pointer to a CWPRETSTRUCT structure that contains details about the message.

Return value

Type:

Type: LRESULT

If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.

If nCode is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_CALLWNDPROCRET hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.

Remarks

An application installs the hook procedure by specifying the WH_CALLWNDPROCRET hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header

Winuser.h (include Windows.h)

类型： WH_CBT值 5，回调参数如下

CBTProc callback function

An application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function before activating, creating, destroying, minimizing, maximizing, moving, or sizing a window; before completing a system command; before removing a mouse or keyboard event from the system message queue; before setting the keyboard focus; or before synchronizing with the system message queue. A computer-based training (CBT) application uses this hook procedure to receive useful notifications from the system.

The HOOKPROC type defines a pointer to this callback function. CBTProc is a placeholder for the application-defined or library-defined function name.

Syntax

C++

LRESULT CALLBACK CBTProc(  _In_  int nCode,  _In_  WPARAM wParam,  _In_  LPARAM lParam);

Parameters

nCode [in]

Type: int

The code that the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.

ValueMeaning

HCBT_ACTIVATE

5

The system is about to activate a window.

HCBT_CLICKSKIPPED

6

The system has removed a mouse message from the system message queue. Upon receiving this hook code, a CBT application must install aWH_JOURNALPLAYBACK hook procedure in response to the mouse message.

HCBT_CREATEWND

3

A window is about to be created. The system calls the hook procedure before sending the WM_CREATE or WM_NCCREATE message to the window. If the hook procedure returns a nonzero value, the system destroys the window; the CreateWindow function returns NULL, but the WM_DESTROY message is not sent to the window. If the hook procedure returns zero, the window is created normally.

At the time of the HCBT_CREATEWND notification, the window has been created, but its final size and position may not have been determined and its parent window may not have been established. It is possible to send messages to the newly created window, although it has not yet receivedWM_NCCREATE or WM_CREATE messages. It is also possible to change the position in the z-order of the newly created window by modifying thehwndInsertAfter member of the CBT_CREATEWND structure.

HCBT_DESTROYWND

4

A window is about to be destroyed.

HCBT_KEYSKIPPED

7

The system has removed a keyboard message from the system message queue. Upon receiving this hook code, a CBT application must install aWH_JOURNALPLAYBACK hook procedure in response to the keyboard message.

HCBT_MINMAX

1

A window is about to be minimized or maximized.

HCBT_MOVESIZE

0

A window is about to be moved or sized.

HCBT_QS

2

The system has retrieved a WM_QUEUESYNC message from the system message queue.

HCBT_SETFOCUS

9

A window is about to receive the keyboard focus.

HCBT_SYSCOMMAND

8

A system command is about to be carried out. This allows a CBT application to prevent task switching by means of hot keys.

 

wParam [in]

Type: WPARAM

Depends on the nCode parameter. For details, see the following Remarks section.

lParam [in]

Type: LPARAM

Depends on the nCode parameter. For details, see the following Remarks section.

Return value

Type:

Type: LRESULT

The value returned by the hook procedure determines whether the system allows or prevents one of these operations. For operations corresponding to the following CBT hook codes, the return value must be 0 to allow the operation, or 1 to prevent it.

• HCBT_ACTIVATE
• HCBT_CREATEWND
• HCBT_DESTROYWND
• HCBT_MINMAX
• HCBT_MOVESIZE
• HCBT_SETFOCUS
• HCBT_SYSCOMMAND

For operations corresponding to the following CBT hook codes, the return value is ignored.

• HCBT_CLICKSKIPPED
• HCBT_KEYSKIPPED
• HCBT_QS

Remarks

The hook procedure should not install a WH_JOURNALPLAYBACK hook procedure except in the situations described in the preceding list of hook codes.

An application installs the hook procedure by specifying the WH_CBT hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.

The following table describes the wParam and lParam parameters for each HCBT_ hook code.

ValuewParamlParamHCBT_ACTIVATESpecifies the handle to the window about to be activated.Specifies a long pointer to a CBTACTIVATESTRUCTstructure containing the handle to the active window and specifies whether the activation is changing because of a mouse click.HCBT_CLICKSKIPPEDSpecifies the mouse message removed from the system message queue.Specifies a long pointer to a MOUSEHOOKSTRUCTstructure containing the hit-test code and the handle to the window for which the mouse message is intended.

The HCBT_CLICKSKIPPED value is sent to a CBTProchook procedure only if a WH_MOUSE hook is installed. For a list of hit-test codes, seeWM_NCHITTEST.

HCBT_CREATEWNDSpecifies the handle to the new window.Specifies a long pointer to a CBT_CREATEWNDstructure containing initialization parameters for the window. The parameters include the coordinates and dimensions of the window. By changing these parameters, a CBTProc hook procedure can set the initial size and position of the window.HCBT_DESTROYWNDSpecifies the handle to the window about to be destroyed.Is undefined and must be set to zero.HCBT_KEYSKIPPEDSpecifies the virtual-key code.Specifies the repeat count, scan code, key-transition code, previous key state, and context code. TheHCBT_KEYSKIPPED value is sent to a CBTProc hook procedure only if a WH_KEYBOARD hook is installed. For more information, see WM_KEYUP orWM_KEYDOWN.HCBT_MINMAXSpecifies the handle to the window being minimized or maximized.Specifies, in the low-order word, a show-window value (SW_) specifying the operation. For a list of show-window values, see the ShowWindow. The high-order word is undefined.HCBT_MOVESIZESpecifies the handle to the window to be moved or sized.Specifies a long pointer to a RECT structure containing the coordinates of the window. By changing the values in the structure, a CBTProc hook procedure can set the final coordinates of the window.HCBT_QSIs undefined and must be zero.Is undefined and must be zero.HCBT_SETFOCUSSpecifies the handle to the window gaining the keyboard focus.Specifies the handle to the window losing the keyboard focus.HCBT_SYSCOMMANDSpecifies a system-command value (SC_) specifying the system command. For more information about system-command values, see WM_SYSCOMMAND.Contains the same data as the lParam value of aWM_SYSCOMMAND message: If a system menu command is chosen with the mouse, the low-order word contains the x-coordinate of the cursor, in screen coordinates, and the high-order word contains the y-coordinate; otherwise, the parameter is not used.

 

For information, see WinEvents.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header

Winuser.h (include Windows.h)

类型： WH_DEBUG值 9，回调参数如下

DebugProc function

An application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function before calling the hook procedures associated with any type of hook. The system passes information about the hook to be called to the DebugProc hook procedure, which examines the information and determines whether to allow the hook to be called.

The HOOKPROC type defines a pointer to this callback function. DebugProc is a placeholder for the application-defined or library-defined function name.

Syntax

C++

LRESULT CALLBACK DebugProc(  _In_  int nCode,  _In_  WPARAM wParam,  _In_  LPARAM lParam);

Parameters

nCode [in]

Type: int

Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx.

wParam [in]

Type: WPARAM

The type of hook about to be called. This parameter can be one of the following values.

ValueMeaning

WH_CALLWNDPROC

4

Installs a hook procedure that monitors messages sent to a window procedure. For more information, see the description of the CallWndProchook procedure.

WH_CALLWNDPROCRET

12

Installs a hook procedure that monitors messages that have just been processed by a window procedure. For more information, see the description of the CallWndRetProc hook procedure.

WH_CBT

5

Installs a hook procedure that receives notifications useful to a CBT application. For more information, see the description of the CBTProchook procedure.

WH_DEBUG

9

Installs a hook procedure useful for debugging other hook procedures. For more information, see the description of the DebugProc hook procedure.

WH_GETMESSAGE

3

Installs a hook procedure that monitors messages posted to a message queue. For more information, see the description of the GetMsgProchook procedure.

WH_JOURNALPLAYBACK

1

Installs a hook procedure that posts messages previously recorded by aWH_JOURNALRECORD hook procedure. For more information, see the description of the JournalPlaybackProc hook procedure.

WH_JOURNALRECORD

0

Installs a hook procedure that records input messages posted to the system message queue. This hook is useful for recording macros. For more information, see the description of the JournalRecordProc hook procedure.

WH_KEYBOARD

2

Installs a hook procedure that monitors keystroke messages. For more information, see the description of the KeyboardProc hook procedure.

WH_MOUSE

7

Installs a hook procedure that monitors mouse messages. For more information, see the description of the MouseProc hook procedure.

WH_MSGFILTER

-1

Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages only for the application that installed the hook procedure. For more information, see the description of the MessageProc hook procedure.

WH_SHELL

10

Installs a hook procedure that receives notifications useful to a Shell application. For more information, see the description of the ShellProchook procedure and the WH_SHELL hook section.

WH_SYSMSGFILTER

6

Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages for all applications in the system. For more information, see the description of the SysMsgProchook procedure.

 

lParam [in]

Type: LPARAM

A pointer to a DEBUGHOOKINFO structure that contains the parameters to be passed to the destination hook procedure.

Return value

Type:

Type: LRESULT

To prevent the system from calling the hook, the hook procedure must return a nonzero value. Otherwise, the hook procedure must call CallNextHookEx.

Remarks

An application installs this hook procedure by specifying the WH_DEBUG hook type and the pointer to the hook procedure in a call to the SetWindowsHookEx function.

Requirements

Minimum supported client

Windows 2000 Professional [desktop apps only]

Minimum supported server

Windows 2000 Server [desktop apps only]

Header

Winuser.h (include Windows.h)