波哥写的钩子教程3

方法4 ：CallWndRetProc Function

The CallWndRetProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function after the SendMessage function is called. The hook procedure can examine the message; it cannot modify it.

CallWndRetProc钩子子程是与SetWindowsHookEx一起使用的、用户定义的或者库定义的回调函数。在SendMessage方法被调用之后，系统调用CallWndRetProc方法。钩子子程能够检查、但是不能修改消息。

The HOOKPROC type defines a pointer to this callback function. CallWndRetProc is a placeholder for the application-defined or library-defined function name.

HOOKPROC类型定义了指向该回调函数的指针。CallWndRetProc是程序定义的或者库定义的方法名字。

Syntax 语法

LRESULT CALLBACK CallWndRetProc(      

        int nCode,

    WPARAM wParam,

    LPARAM lParam

);

Parameters 参数

nCode ：[in] Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx.

指定钩子子程是否必须处理消息。如果nCode是HC_ACTION，钩子子程必须处理该消息。如果nCode小于0，钩子子程就必须将该消息传递给CallNextHookEx方法，自己不对消息进行进一步的处理，必须返回由CallNextHookEx 方法返回的返回值。

wParam ：[in] Specifies whether the message is sent by the current process. If the message is sent by the current process, it is nonzero; otherwise, it is NULL. 指定消息是否由当前进程发出。如果消息是由当前进程发出的，wParam为非0；否则，为空。

lParam ：[in] Pointer to a CWPRETSTRUCT structure that contains details about the message. 指向CWPSTRUCT结构的指针，该结构含有消息的细节信息。

Return Value 返回值

If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.  If nCode is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_CALLWNDPROCRET hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.

如果nCode小于0，钩子子程必须返回由CallNextHookE返回的返回值。如果nCode大于等于0，强烈要求调用CallNextHookEx方法，并返回由它返回的返回值；否则，其他已经安装了WH_ CALLWNDPROCRET钩子的程序将收不到钩子通知，可能导致行为的错误。如果钩子子程没有调用CallNextHookEx方法,返回值应该为0。

Remarks 备注

An application installs the hook procedure by specifying the WH_CALLWNDPROCRET hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.

应用程序这样安装钩子子程：指定WH_ CALLWNDPROCRET钩子类型，指定一个指向调用SetWindowsHookEx方法的钩子子程的指针。

方法6  :  DebugProc Function

The DebugProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function before calling the hook procedures associated with any type of hook. The system passes information about the hook to be called to the DebugProc hook procedure, which examines the information and determines whether to allow the hook to be called.

DebugProc钩子子程是和SetWindowsHookEx方法一起使用的、程序定义的或者库定义的回调函数。系统在调用和任何类型钩子相关联的钩子子程之前调用该方法。系统将即将被调用的钩子的信息传递给DebugProc钩子子程，DebugProc钩子子程检查该信息，决定是否允许该钩子被调用。

The HOOKPROC type defines a pointer to this callback function. DebugProc is a placeholder for the application-defined or library-defined function name. HOOKPROC类型定义了指向该回调函数的指针。DebugProc是程序定义的或者库定义的方法名字。

Syntax 语法

LRESULT CALLBACK DebugProc(      

    int nCode,

    WPARAM wParam,

    LPARAM lParam

);

Parameters参数

nCode ：[in] Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx.

指定钩子子程是否必须处理该消息。如果nCode是HC_ACTION，钩子子程就必须处理该消息。如果nCode小于0，钩子子程就必须将该消息传递给CallNextHookEx方法，自己对消息不做进一步处理，并且应该返回由CallNextHookEx方法返回的返回值。

wParam ：[in] Specifies the type of hook about to be called. This parameter can be one of the following values. 指定即将被调用的钩子类型。参数可以是下列之一：

1．WH_CALLWNDPROC ：Installs a hook procedure that monitors messages sent to a window procedure. 安装一个钩子子程来监视发送给窗体程序的消息。

2．WH_CALLWNDPROCRET ：Installs a hook procedure that monitors messages that have just been processed by a window procedure. 安装一个钩子子程来监视刚刚被窗体程序处理完的消息。

3．WH_CBT ：Installs a hook procedure that receives notifications useful to a computer-based training (CBT) application. 安装一个钩子子程来接收对CBT应用程序有用的通知。

4．WH_DEBUG ：Installs a hook procedure useful for debugging other hook procedures. 安装一个有用的钩子子程来调试其他钩子子程。

5．WH_GETMESSAGE ：Installs a hook procedure that monitors messages posted to a message queue. 安装一个钩子子程来监视传递给消息队列的消息。

6．WH_JOURNALPLAYBACK ：Installs a hook procedure that posts messages previously recorded by a WH_JOURNALRECORD hook procedure. 安装一个钩子子程来传递先前使用WH_JOURNALRECORD钩子子程记录的消息。

7．WH_JOURNALRECORD ：Installs a hook procedure that records input messages posted to the system message queue. This hook is useful for recording macros. 安装一个钩子子程来记录传递给系统消息队列的输入消息。该钩子用来记录宏很有用。

8．WH_KEYBOARD ：Installs a hook procedure that monitors keystroke messages. 安装一个钩子子程来监视键盘敲击消息。

9．WH_MOUSE Installs a hook procedure that monitors mouse messages. 安装一个钩子子程来监视鼠标消息。

10．WH_MSGFILTER ：Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages only for the application that installed the hook procedure. 安装一个钩子子程来监视下列输入事件的结果而产生的消息：对话框、消息框、菜单、滚动条。该钩子子程仅仅为安装该钩子子程的应用程序监视这些消息。

11．WH_SHELL ：Installs a hook procedure that receives notifications useful to a Shell application. 安装一个钩子子程来接收对加壳类应用程序有用的通知。

12．WH_SYSMSGFILTER ：Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages for all applications in the system. 安装一个钩子子程来监视下列输入事件的结果而产生的消息：对话框，消息框，菜单，滚动条。该钩子子程为系统中所有的应用程序监视这些消息。

lParam  ：[in] Pointer to a DEBUGHOOKINFO structure that contains the parameters to be passed to the destination hook procedure. 指向DEBUGHOOKINFO结构的指针，该结构中含有传递给目标钩子子程的参数。

Return Value返回值

To prevent the system from calling the hook, the hook procedure must return a nonzero value. Otherwise, the hook procedure must call CallNextHookEx.

为了阻止系统调用该钩子，钩子子程必须返回一个非0值。否则，钩子子程必须调用CallNextHookEx方法。

Remarks备注

An application installs this hook procedure by specifying the WH_DEBUG hook type and the pointer to the hook procedure in a call to the SetWindowsHookEx function.

应用程序通过下面方式安装该钩子子程：指定WH_DEBUG钩子类型；在调用SetWindowsHookEx方法的函数中指向钩子子程的指针。