wince上能够使用的hook是有限的

最近在研究如果阻止来电通知消息的弹出，尝试了几种方法都不好用：
（1）使用TAPI截获来电，隐藏来电提示框
（2）使用RIL接口截获来电，隐藏来电提示框
（3）使用State and notification broker，隐藏来电提示框
结果：提示框总是要显示一下再隐藏。
今天又调研了一下SetWindowsHookEx 来设置“消息钩子”，这种钩子能够钩住各种消息，它在pc平台上应用的挺多的，在wince上也能使用但没有相关文档。今天发现在wince上似乎只能捕获一些键盘事件，比如VK_TTALK、VK_HOME等等。
wince下只能用三种钩子
#define WH_JOURNALRECORD 0
#define WH_JOURNALPLAYBACK 1
#define WH_KEYBOARD_LL 20

参考自：

http://www.winbile.net/bbs/forums/threads/1007800.aspx

转自：http://topic.youkuaiyun.com/t/20020731/09/912352.html
Here is an article from Windows CE Developers FAQ from CEGadgers.com. It
could answer your question.

10.9 SetWindowsHookEx really does work, sort of.

If you believe the Microsoft documentation, SetWindowsHookEx does not work
under Windows CE. However, if you have read this FAQ you know that
SetWindowsHookEx can be found in coredll (2.11 PSPC and HPC Pro versions
only). The question is, what does it do, and is it a full implementation.

I have been wanting to write an ATL control that passes messages (like
WM_HIBERNATE) to VBCE. One way to do this is to create an ATL control,
implement a connection point, and install a windows hook that monitors the
message queue, and whenever a relevant message appears, fires an event off
to VB. Unfortunately, every combination of

gHook = SetWindowsHookEx(WH_CALLWNDPROC, (HOOKPROC) MyWndProc, gInstance,
0);

returned an error 87 (incorrect parameter). Further searching through the PB
header files reveals only three hook-related defines:

#define WH_JOURNALRECORD 0
#define WH_JOURNALPLAYBACK 1
#define WH_KEYBOARD_LL 20

So I stopped using WH_CALLWNDPROC and tried WH_KEYBOARD_LL, and found that
it worked quite well. I actually implemented a hook callback that watched
for VK_OFF, and when detected, waited 2 seconds before returning. Whenever I
pressed the power button the device would indeed wait before turning off. I
also attempted to abort the power off by returning a non-zero number from
the hook callback. While this does prevent the power button from powering
off the device, it also causes the device to crash. Besides, VK_OFF is only
generated when the off button is pressed, and not when a device time-out
occurs, so the code was of marginal use. However, if you need to trap other
low-level keyboard commands (ctrl-esc, etc) SetWindowsHookEx might be for
you.

While I imagine journal record and playback are implemented as well, I have
not tried them.

因此，我不能使用这种消息hook来阻止来电提示。那么只能考虑API Hook技术看看。而现在关键是不知道系统是调用什么API来弹出来电提示的。或许cprog.exe仅仅是监听并截获了RIL_NOTIFY_RING消息，然后把Phone - Incoming显示出来？又或者是他调用了某一个API，这个API能够弹出Phone-Incoming对话框。
再试试吧！加油！

本文来自优快云博客，转载请标明出处：http://blog.youkuaiyun.com/TracyZhongcf/archive/2008/11/19/3326363.aspx