波哥写的钩子教程2

钩子技术（五）

来源： 任立波的日志

认识完各种钩子类型之后，接下来了解和钩子如影随形的钩子子程，即相应的回调函数。

了解这些是可以使用钩子的一个开始。

方法1：CallMsgFilter Function

The CallMsgFilter function passes the specified message and hook code to the hook procedures associated with the WH_SYSMSGFILTER and WH_MSGFILTER hooks. A WH_SYSMSGFILTER or WH_MSGFILTER hook procedure is an application-defined callback function that examines and, optionally, modifies messages for a dialog box, message box, menu, or scroll bar.

CallMsgFilter方法传递特定的消息和钩子代码到与WH_SYSMSGFILTER 和 WH_MSGFILTER钩子相关联的钩子子程。 WH_SYSMSGFILTER或者 WH_MSGFILTER钩子子程是应用程序定义的回调函数，该回调函数用来检验、选择、修改传递给对话框、消息框、菜单或者滚动条的消息，

语法：BOOL CallMsgFilter

(      

        LPMSG lpMsg,

    int nCode

);

参数说明 ：

lpMsg ：[in] Pointer to an MSG structure that contains the message to be passed to the hook procedures.指向MSG结构的指针，该结构包含有即将传递给钩子子程的消息。

nCode ：[in] Specifies an application-defined code used by the hook procedure to determine how to process the message. The code must not have the same value as system-defined hook codes (MSGF_ and HC_) associated with the WH_SYSMSGFILTER and WH_MSGFILTER hooks.

指定应用程序定义的代码，钩子子程使用该代码来决定如何处理消息。该代码不能与系统定义的与WH_SYSMSGFILTER 和 WH_MSGFILTER钩子相关的钩子代码 (MSGF_ and HC_)相同。

Return Value：If the application should process the message further, the return value is zero.

If the application should not process the message further, the return value is nonzero.

如果应用程序应该进一步处理该消息，返回值为0；如果不处理，返回非0值。

Remarks

The system calls CallMsgFilter to enable applications to examine and control the flow of messages during internal processing of dialog boxes, message boxes, menus, and scroll bars, or when the user activates a different window by pressing the ALT+TAB key combination.

Install this hook procedure by using the SetWindowsHookEx function.

系统调用CallMsgFilter方法来允许应用程序检查、控制在对话框、消息框、菜单、滚动条内部处理中的消息的流动，或者当用户通过按下ALT+TAB组合键激活不同的窗口时的信息流动。

通过SetWindowsHookEx方法来安装该钩子子程。

方法2 ：CallNextHookEx Function

The CallNextHookEx function passes the hook information to the next hook procedure in the current hook chain. A hook procedure can call this function either before or after processing the hook information.

CallNextHookEx方法将钩子信息传递给当前钩子链表中的下一个钩子子程。钩子子程能够在处理钩子信息之前或者之后调用该方法。

Syntax  ：LRESULT CallNextHookEx(      

                  HHOOK hhk,

    int nCode,

    WPARAM wParam,

    LPARAM lParam

);

Parameters

hhk ：Ignored. 被忽略。

nCode  ：[in] Specifies the hook code passed to the current hook procedure. The next hook procedure uses this code to determine how to process the hook information.

wParam ：[in] Specifies the wParam value passed to the current hook procedure. The meaning of this parameter depends on the type of hook associated with the current hook chain.。

lParam ：[in] Specifies the lParam value passed to the current hook procedure. The meaning of this parameter depends on the type of hook associated with the current hook chain.

wParam  /  lParam ：这两个参数分别指定传递给当前钩子子程的wParam  / lParam值。参数的意义取决于与当前钩子链表相关联的钩子类型。

Return Value:返回值

This value is returned by the next hook procedure in the chain. The current hook procedure must also return this value. The meaning of the return value depends on the hook type.该值由钩子链表中的下一个钩子子程返回。当前钩子子程也必须返回该值。返回值的意义取决于钩子类型。

Remarks 注意

Hook procedures are installed in chains for particular hook types. CallNextHookEx calls the next hook in the chain.

Calling CallNextHookEx is optional, but it is highly recommended; otherwise, other applications that have installed hooks will not receive hook notifications and may behave incorrectly as a result. You should call CallNextHookEx unless you absolutely need to prevent the notification from being seen by other applications.

钩子子程为了特定的钩子类型而被安装。CallNextHookEx方法调用钩子链表中的下一个钩子。调用CallNextHookEx是可选的，但是强烈要求调用该函数；否则，其他已经安装有钩子的应用程序将收不到钩子通知，从而可能导致不正确的行为。除非绝对需要阻止通知被其他应用程序看到，其它情况下都应该调用CallNextHookEx方法

方法3 ：CallWndProc Function

The CallWndProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function.

CallWndProc钩子子程是与SetWindowsHookEx一起使用的、用户定义的或者库定义的回调函数。

The HOOKPROC type defines a pointer to this callback function. CallWndProc is a placeholder for the application-defined or library-defined function name.

HOOKPROC类型定义了指向该回调函数的指针。CallWndProc是程序定义的或者库定义的方法名字。

Syntax ：语法    LRESULT CALLBACK CallWndProc(      

                   Int nCode,

          WPARAM wParam,

          LPARAM lParam

);

Parameters 参数：

nCode  ： [in] Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and must return the value returned by CallNextHookEx.

指定钩子子程是否必须处理该消息。如果nCode是HC_ACTION，钩子子程就必须处理该消息。如果nCode小于0，钩子子程就必须将该消息传递给CallNextHookEx，自己不对消息进行进一步的处理，必须返回由CallNextHookEx 方法返回的返回值。

wParam ：[in] Specifies whether the message was sent by the current thread. If the message was sent by the current thread, it is nonzero; otherwise, it is zero. 指定消息是否由当前线程发出。如果消息是由当前线程发出的，该值就是非0；否则，就是0。

lParam ：[in] Pointer to a CWPSTRUCT structure that contains details about the message.

指向CWPSTRUCT结构的指针，该结构含有消息的细节信息。

Return Value 返回值

If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.  If nCode is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_CALLWNDPROC hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.

如果nCode小于0，钩子子程必须返回由CallNextHookE方法返回的返回值。如果nCode大于等于0，强烈要求调用CallNextHookEx方法，并返回由它返回的返回值；否则，其他已经安装了WH_CALLWNDPROC钩子的应用程序将收不到钩子通知，可能导致行为的错误。如果钩子子程没有调用CallNextHookEx方法,返回值应该为 0。

Remarks 备注

The CallWndProc hook procedure can examine the message, but it cannot modify it. After the hook procedure returns control to the system, the message is passed to the window procedure.

An application installs the hook procedure by specifying the WH_CALLWNDPROC hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.

CallWndProc钩子子程能够检查消息，但是不能修改消息。当钩子子程将控制权交还给系统之后，消息被传递给窗体程序。

应用程序这样安装钩子子程：指定WH_CALLWNDPROC钩子类型，指定一个指向调用SetWindowsHookEx方法的钩子子程的指针。