HOOK鉤子機制學習筆記(4) - 鉤子函數說明 收藏
翻譯參考自MaybeHelios的blog: http://blog.csdn.net/maybehelios/???
??? 通過SetWindowsHookEx方法安裝鉤子，該函數指定處理攔截消息的鉤子函數（回調函數），可在鉤子函數中自定義消息的處理，可修改消息或屏蔽消息。鉤子函數的格式是固定為：
LRESULT CALLBACK CallBackProc(?????
????????? Int nCode,
????????? WPARAM wParam,
????????? LPARAM lParam);
??? nCode參數說明:
??? [in] Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and must return the value returned by CallNextHookEx.
??? 指定鉤子子程是否必須處理該消息。如果nCode是HC_ACTION，鉤子子程就必須處理該消息。如果nCode小于0，鉤子子程就必須將該消息傳遞給CallNextHookEx，自己不對消息進行進一步的處理，必須返回由CallNextHookEx 方法返回的返回值。
??? 對于不同類型的鉤子，其傳入的參數也不一樣，以下為各類鉤子的參數說明：
1、WH_CALLWNDPROC
參數說明：
??? wParam ：[in] Specifies whether the message was sent by the current thread. If the message was sent by the current thread, it is nonzero; otherwise, it is zero.
??? 指定消息是否由當前線程發出。如果消息是由當前線程發出的，該值就是非0；否則，就是0。
??? lParam ：[in] Pointer to a CWPSTRUCT structure that contains details about the message.
??? 指向CWPSTRUCT結構的指針，該結構含有消息的細節信息。
返回值
??? If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.? If nCode is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_CALLWNDPROC hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.
??? 如果nCode小于0，鉤子子程必須返回由CallNextHookE方法返回的返回值。如果nCode大于等于0，強烈要求調用CallNextHookEx方法，并返回由它返回的返回值；否則，其他已經安裝了WH_CALLWNDPROC鉤子的應用程序將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程沒有調用CallNextHookEx方法,返回值應該為 0。
備注
??? The CallWndProc hook procedure can examine the message, but it cannot modify it. After the hook procedure returns control to the system, the message is passed to the window procedure.
??? CallWndProc鉤子子程能夠檢查消息，但是不能修改消息。當鉤子子程將控制權交還給系統之后，消息被傳遞給窗體程序。
2、WH_ CALLWNDPROCRET
??? 在SendMessage方法被調用之后，系統調用CallWndRetProc方法。鉤子子程能夠檢查、但是不能修改消息。
參數說明
??? wParam ：[in] Specifies whether the message is sent by the current process. If the message is sent by the current process, it is nonzero; otherwise, it is NULL.
??? 指定消息是否由當前進程發出。如果消息是由當前進程發出的，wParam為非0；否則，為空。
??? lParam ：[in] Pointer to a CWPRETSTRUCT structure that contains details about the message.
??? 指向CWPSTRUCT結構的指針，該結構含有消息的細節信息。
返回值
??? If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.? If nCode is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_CALLWNDPROCRET hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.
??? 如果nCode小于0，鉤子子程必須返回由CallNextHookE返回的返回值。如果nCode大于等于0，強烈要求調用CallNextHookEx方法，并返回由它返回的返回值；否則，其他已經安裝了WH_ CALLWNDPROCRET鉤子的程序將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程沒有調用CallNextHookEx方法,返回值應該為0。
???
???
3、WH_CBT
??? 系統在下列事件發生之前調用該方法：
??? 1.激活、創建、銷毀、最小化、最大化、移動窗體、改變窗體大??；
??? 2.完成系統命令；
??? 3.從系統消息隊列中移除鼠標或者鍵盤事件；
??? 4.設置鍵盤焦點；
??? 5.同步系統消息隊列。
???
??? CBT應用程序使用該鉤子子程接收來自系統的有用的通知。
參數說明:
??? nCode? ：[in] Specifies a code that the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定一個碼值，鉤子子程使用該值來決定如何處理消息。如果nCode小于0，鉤子子程就必須將該消息傳遞給CallNextHookEx方法，自己不對消息做進一步的處理，并且應該返回由CallNextHookEx方法返回的返回值。該參數可以是以下值中的一個：
??? 1．HCBT_ACTIVATE? ：The system is about to activate a window.
????? 系統即將創建一個窗體。
??? 2．HCBT_CLICKSKIPPED? ：The system has removed a mouse message from the system message queue. Upon receiving this hook code, a CBT application must install a WH_JOURNALPLAYBACK hook procedure in response to the mouse message.
????? 系統已經將一個鼠標消息從系統消息隊列中移除。一旦收到該鉤子代碼，CBT應用程序必須安裝一個WH_JOURNALPLAYBAC鉤子子程來響應鼠標消息。
??? 3．HCBT_CREATEWND ： A window is about to be created. The system calls the hook procedure before sending the WM_CREATE or WM_NCCREATE message to the window. If the hook procedure returns a nonzero value, the system destroys the window; the CreateWindow function returns NULL, but the WM_DESTROY message is not sent to the window. If the hook procedure returns zero, the window is created normally.
????? 窗體即將被創建。系統在向窗體發出WM_CREATE 或者 WM_NCCREATE消息之前，調用該鉤子子程。如果鉤子子程返回非0值，表示系統銷毀了窗體；CreateWindow方法返回Null，但是WM_DESTROY消息并不發送給窗體。如果鉤子子程返回0，表示窗體正常被創建。
????? At the time of the HCBT_CREATEWND notification, the window has been created, but its final size and position may not have been determined and its parent window may not have been established. It is possible to send messages to the newly created window, although it has not yet received WM_NCCREATE or WM_CREATE messages. It is also possible to change the position in the z-order of the newly created window by modifying the hwndInsertAfter member of the CBT_CREATEWND structure.
????? 在 HCBT_CREATEWND通知的時候，窗體已經被創建了，但是它的最終的大小和位置可能還沒有被確定，它的父窗體也可能沒有被創建起來。雖然一個新創建的窗體可能還沒有接收到WM_NCCREATE或者WM_CREATE消息，但是向它發送消息是可能的。通過修改CBT_CREATEWND 結構體的hwndInsertAfter成員，改變新創建窗體的在Z軸次序的位置也是可能的。
??? 4．HCBT_DESTROYWND ：A window is about to be destroyed.
????? 窗體即將被銷毀。
??? 5．HCBT_KEYSKIPPED ：The system has removed a keyboard message from the system message queue. Upon receiving this hook code, a CBT application must install a WH_JOURNALPLAYBACK hook procedure in response to the keyboard message.
????? 系統已經從系統的消息隊列中移除了一個鍵盤消息。一旦接收到該鉤子代碼，CBT應用程序必須安裝一個WH_JOURNALPLAYBAC鉤子來響應鍵盤消息。
??? 6．HCBT_MINMAX ：A window is about to be minimized or maximized.
????? 窗體即將被最小化或者最大化。
??? 7．HCBT_MOVESIZE ：A window is about to be moved or sized.
????? 窗體即將被移動或者重置大小。
??? 8．HCBT_QS? ：The system has retrieved a WM_QUEUESYNC message from the system message queue.
????? 系統已經收到了一個來自系統消息隊列的WM_QUEUESYNC消息。
??? 9．HCBT_SETFOCUS? ：A window is about to receive the keyboard focus.
????? 窗體即將接收鍵盤焦點。
??? 10．HCBT_SYSCOMMAND ：A system command is about to be carried out. This allows a CBT application to prevent task switching by means of hot keys.
????? 系統命令即將被執行。這允許CBT程序阻止通過快捷鍵來進行任務切換。
?????
??? wParam ：[in] Depends on the nCode parameter.
????? 取決于參數 nCode
??? lParam ：[in] Depends on the nCode parameter.
????? 取決于參數 nCode
返回值
??? The value returned by the hook procedure determines whether the system allows or prevents one of these operations. For operations corresponding to the following CBT hook codes, the return value must be 0 to allow the operation, or 1 to prevent it:
??? 鉤子子程的返回值取決于系統允許還是阻止這種操作。對于下列這些操作的CBT鉤子代碼，如果允許則返回值必須是0，如果阻止返回值必須是1。
??? HCBT_ACTIVATE ；HCBT_CREATEWND ；HCBT_DESTROYWND ；HCBT_MINMAX ；HCBT_MOVESIZE ；HCBT_SETFOCUS ；HCBT_SYSCOMMAND
???
??? For operations corresponding to the following CBT hook codes, the return value is ignored:
??? 對于下列這些操作的CBT鉤子代碼，返回值被忽略
??????? HCBT_CLICKSKIPPED ；HCBT_KEYSKIPPED ；HCBT_QS
4、WH_DEBUG
??? The DebugProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function before calling the hook procedures associated with any type of hook. The system passes information about the hook to be called to the DebugProc hook procedure, which examines the information and determines whether to allow the hook to be called.
??? DebugProc鉤子子程是和SetWindowsHookEx方法一起使用的、程序定義的或者庫定義的回調函數。系統在調用和任何類型鉤子相關聯的鉤子子程之前調用該方法。系統將即將被調用的鉤子的信息傳遞給DebugProc鉤子子程，DebugProc鉤子子程檢查該信息，決定是否允許該鉤子被調用。
參數說明：
??? nCode ：[in] Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx.
??? 指定鉤子子程是否必須處理該消息。如果nCode是HC_ACTION，鉤子子程就必須處理該消息。如果nCode小于0，鉤子子程就必須將該消息傳遞給CallNextHookEx方法，自己對消息不做進一步處理，并且應該返回由CallNextHookEx方法返回的返回值。
???
??? wParam ：[in] Specifies the type of hook about to be called. This parameter can be one of the following values.
??? 指定即將被調用的鉤子類型。參數可以是下列之一：
??? 1．WH_CALLWNDPROC ：Installs a hook procedure that monitors messages sent to a window procedure.
?????? 安裝一個鉤子子程來監視發送給窗體程序的消息。
??? 2．WH_CALLWNDPROCRET ：Installs a hook procedure that monitors messages that have just been processed by a window procedure.
?????? 安裝一個鉤子子程來監視剛剛被窗體程序處理完的消息。
??? 3．WH_CBT ：Installs a hook procedure that receives notifications useful to a computer-based training (CBT) application.
?????? 安裝一個鉤子子程來接收對CBT應用程序有用的通知。
??? 4．WH_DEBUG ：Installs a hook procedure useful for debugging other hook procedures.
?????? 安裝一個有用的鉤子子程來調試其他鉤子子程。
??? 5．WH_GETMESSAGE ：Installs a hook procedure that monitors messages posted to a message queue.
?????? 安裝一個鉤子子程來監視傳遞給消息隊列的消息。
??? 6．WH_JOURNALPLAYBACK ：Installs a hook procedure that posts messages previously recorded by a WH_JOURNALRECORD hook procedure.
?????? 安裝一個鉤子子程來傳遞先前使用WH_JOURNALRECORD鉤子子程記錄的消息。
??? 7．WH_JOURNALRECORD ：Installs a hook procedure that records input messages posted to the system message queue. This hook is useful for recording macros.
?????? 安裝一個鉤子子程來記錄傳遞給系統消息隊列的輸入消息。該鉤子用來記錄宏很有用。
??? 8．WH_KEYBOARD ：Installs a hook procedure that monitors keystroke messages.
?????? 安裝一個鉤子子程來監視鍵盤敲擊消息。
??? 9．WH_MOUSE Installs a hook procedure that monitors mouse messages.
?????? 安裝一個鉤子子程來監視鼠標消息。
??? 10．WH_MSGFILTER ：Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages only for the application that installed the hook procedure.
?????? 安裝一個鉤子子程來監視下列輸入事件的結果而產生的消息：對話框、消息框、菜單、滾動條。該鉤子子程僅僅為安裝該鉤子子程的應用程序監視這些消息。
??? 11．WH_SHELL ：Installs a hook procedure that receives notifications useful to a Shell application.
?????? 安裝一個鉤子子程來接收對加殼類應用程序有用的通知。
??? 12．WH_SYSMSGFILTER ：Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages for all applications in the system.
?????? 安裝一個鉤子子程來監視下列輸入事件的結果而產生的消息：對話框，消息框，菜單，滾動條。該鉤子子程為系統中所有的應用程序監視這些消息。
??? lParam? ：[in] Pointer to a DEBUGHOOKINFO structure that contains the parameters to be passed to the destination hook procedure.
??? 指向DEBUGHOOKINFO結構的指針，該結構中含有傳遞給目標鉤子子程的參數。
返回值
??? To prevent the system from calling the hook, the hook procedure must return a nonzero value. Otherwise, the hook procedure must call CallNextHookEx.
??? 為了阻止系統調用該鉤子，鉤子子程必須返回一個非0值。否則，鉤子子程必須調用CallNextHookEx方法。
5、WH_FOREGROUNDIDLE
??? The ForegroundIdleProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever the foreground thread is about to become idle.
??? ForegroundIdleProc鉤子子程是和SetWindowsHookEx方法一起使用的、程序定義的或者庫定義的回調函數。當前臺線程即將變成空閑時，系統將調用該方法。
Parameters 參數
??? code ：[in] Specifies whether the hook procedure must process the message. If code is HC_ACTION, the hook procedure must process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx.
??? 指定鉤子子程是否必須處理消息。如果nCode是HC_ACTION，鉤子子程就必須處理該消息。如果nCode小于0，鉤子子程就必須將該消息傳遞給CallNextHookEx方法，自己對消息不做進一步處理，并且應該返回由CallNextHookEx方法返回的返回值。
??? wParam ：This parameter is not used. 未使用
??? lParam? ：This parameter is not used. 未使用
Return Value 返回值
??? If code is less than zero, the hook procedure must return the value returned by CallNextHookEx. If code is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_FOREGROUNDIDLE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.
??? 如果nCode小于0，鉤子子程必須返回由CallNextHookEx返回的返回值。如果nCode大于等于0，強烈要求調用CallNextHookEx方法，并返回由它返回的返回值；否則，其他已經安裝了WH_ CALLWNDPROCRET鉤子的程序將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程沒有調用CallNextHookEx方法,返回值應該是0。
6、WH_GETMESSAGE
??? The GetMsgProc function is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever the GetMessage or PeekMessage function has retrieved a message from an application message queue. Before returning the retrieved message to the caller, the system passes the message to the hook procedure.
??? GetMsgProc是和SetWindowsHookEx方法一起使用的、程序定義的或者庫定義的回調函數。無論什么時候，當GetMessage 或者 PeekMessage方法接收到來自應用程序消息隊列的消息時，系統都會調用該方法。在將收到的消息返回給調用者之前，系統將消息傳遞給鉤子子程。
Parameters 參數
??? code? ： [in] Specifies whether the hook procedure must process the message. If code is HC_ACTION, the hook procedure must process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx.
??? 指定鉤子子程是否必須處理消息。如果nCode是HC_ACTION，鉤子子程就必須處理該消息。如果nCode小于0，鉤子子程就必須將該消息傳遞給CallNextHookEx方法，自己對消息不做進一步處理，并且應該返回由CallNextHookEx方法返回的返回值。
??? wParam? ：[in] Specifies whether the message has been removed from the queue. This parameter can be one of the following values.
??? 指定消息是否已經被從隊列中移除了。該參數可以是下列值中的一個：
????? 1．PM_NOREMOVE ：Specifies that the message has not been removed from the queue. (An application called the function, specifying the PM_NOREMOVE flag.)
????? 指定消息尚未從隊列中移出。(應用程序在調用該方法的同時指定PM_NOREMOVE標志)
????? 2．PM_REMOVE Specifies that the message has been removed from the queue. (An application called GetMessage, or it called the PeekMessage function, specifying the PM_REMOVE flag.)
????? 指定消息已經被從隊列中移除了。(程序調用GetMessage 或者PeekMessage方法的同時指定PM_REMOVE標志)
??? lParam ：[in] Pointer to an MSG structure that contains details about the message.
??? 指向MSG結構的指針，結構中包含和消息相關的細節。
Return Value 返回值
??? If code is less than zero, the hook procedure must return the value returned by CallNextHookEx. If code is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_GETMESSAGE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero.
??? 如果參數code小于0，鉤子子程必須返回由CallNextHookEx返回的返回值。如果參數code大于等于0，強烈要求調用CallNextHookEx方法，并返回由該方法返回的返回值；否則，其他已經安裝了WH_GETMESSAGE鉤子的程序將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程沒有調用CallNextHookEx方法,返回值應該是0
Remarks 備注
??? The GetMsgProc hook procedure can examine or modify the message. After the hook procedure returns control to the system, the GetMessage or PeekMessage function returns the message, along with any modifications, to the application that originally called it.
??? GetMsgProc鉤子子程能夠檢查或者修改消息。在鉤子子程將控制權交還給系統之后，GetMessage 或者PeekMessage方法將該消息以及任何修改都一起返回給最初調用它的應用程序。
7、WH_JOURNALPLAYBACK
??? The JournalPlaybackProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. Typically, an application uses this function to play back a series of mouse and keyboard messages recorded previously by the JournalRecordProc hook procedure. As long as a JournalPlaybackProc hook procedure is installed, regular mouse and keyboard input is disabled.
??? JournalPlaybackProc鉤子子程是和SetWindowsHookEx方法一起使用的、程序定義的或者庫定義的回調函數。典型的，應用程序使用該方法回放前期由JournalRecordProc鉤子子程記錄下來的一系列鼠標和鍵盤消息。只要JournalPlaybackProc鉤子子程被安裝，常規的鼠標和鍵盤輸入將被禁用。
Parameters 參數
??? code ：[in] Specifies a code the hook procedure uses to determine how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定鉤子子程使用的代碼，以決定如何處理該消息。如果參數code小于0，鉤子子程不對其進行任何進一步的處理，必須將消息傳遞給CallNextHookEx方法，返回由CallNextHookEx方法返回的返回值。該參數可以是下列值之一：
??? 1．HC_GETNEXT ：The hook procedure must copy the current mouse or keyboard message to the EVENTMSG structure pointed to by the lParam parameter.
??? 鉤子子程必須將當前鼠標或者鍵盤消息拷貝給由參數lParam指向的EVENTMSG結構。
??? 2．HC_NOREMOVE ：An application has called the PeekMessage function with wRemoveMsg set to PM_NOREMOVE, indicating that the message is not removed from the message queue after PeekMessage processing.
??? 應用程序已經調用帶有指向PM_NOREMOVE的 wRemoveMsg 集合的PeekMessage方法，指示該消息在PeekMessage處理完畢后，沒有從消息隊列中移除。
??? 3．HC_SKIP? ：The hook procedure must prepare to copy the next mouse or keyboard message to the EVENTMSG structure pointed to by lParam. Upon receiving the HC_GETNEXT code, the hook procedure must copy the message to the structure.
??? 鉤子子程必須準備拷貝下一個鼠標或者鍵盤消息到由lParam 指向的 EVENTMSG結構。一旦接收到HC_GETNEXT代碼，鉤子子程必須將消息拷貝到結構體中。
??? 4．HC_SYSMODALOFF ： A system-modal dialog box has been destroyed. The hook procedure must resume playing back the messages.
??? 系統模式的對話框已經被銷毀。鉤子子程應該恢復回放消息。
??? 5．HC_SYSMODALON? ： A system-modal dialog box is being displayed. Until the dialog box is destroyed, the hook procedure must stop playing back messages.
??? 系統模式的對話框正在被顯示。鉤子子程應該停止回放消息，直到對話框被銷毀。
??? wParam ：This parameter is not used. 該參數未使用。
??? lParam? ：[in] Pointer to an EVENTMSG structure that represents a message being processed by the hook procedure. This parameter is valid only when the code parameter is HC_GETNEXT.?
??? 指向EVENTMSG結構的指針，該結構代表正在被鉤子子程處理的消息。只有當參數code是HC_GETNEXT時該參數才有效。
Return Value返回值
??? To have the system wait before processing the message, the return value must be the amount of time, in clock ticks, that the system should wait. (This value can be computed by calculating the difference between the time members in the current and previous input messages.) To process the message immediately, the return value should be zero. The return value is used only if the hook code is HC_GETNEXT; otherwise, it is ignored.
??? 為了使系統在處理消息之前等待，該返回值應該是系統應該等待的時間數量，該值以時鐘嘀嗒為單位（該值可以通過當前和前一個輸入消息的time成員的差值來計算）。為了快速的處理該消息，返回值應該是0。只有當鉤子代碼是HC_GETNEXT時，返回值才有意義；否則，該參數被忽略。
Remarks 備注
??? A JournalPlaybackProc hook procedure should copy an input message to the lParam parameter. The message must have been previously recorded by using a JournalRecordProc hook procedure, which should not modify the message.
?? JournalPlaybackProc鉤子子程應該拷貝一個輸入消息到lparm參數。消息必須在先前已經使用JournalRecordProc鉤子子程被記錄了下來，JournalRecordProc鉤子子程不應修改消息。
??? To retrieve the same message over and over, the hook procedure can be called several times with the code parameter set to HC_GETNEXT without an intervening call with code set to HC_SKIP.
??? 為了一遍又一遍的得到同樣的消息，鉤子子程在將code參數設置為HC_GETNEXT的情況下，可以被調用多次，而不涉及將code參數設置為HC_SKIP的調用。
??? If code is HC_GETNEXT and the return value is greater than zero, the system sleeps for the number of milliseconds specified by the return value. When the system continues, it calls the hook procedure again with code set to HC_GETNEXT to retrieve the same message. The return value from this new call to JournalPlaybackProc should be zero; otherwise, the system will go back to sleep for the number of milliseconds specified by the return value, call JournalPlaybackProc again, and so on. The system will appear to be not responding.
??? 如果參數code 是 HC_GETNEXT，而且返回值大于0，系統將休眠，休眠時間是返回值指定的毫秒數。當系統繼續的時候，調用鉤子子程，鉤子子程通過將code設置為HC_GETNEXT來重新得到同一個的消息。從新的JournalPlaybackProc調用得到的返回值應該是0；否則，系統將回到休眠狀態，休眠時間是返回值指定的毫秒數，休眠過后再次調用JournalPlaybackProc，以此類推。系統看起來像沒有響應一樣。
??? Unlike most other global hook procedures, the JournalRecordProc and JournalPlaybackProc hook procedures are always called in the context of the thread that set the hook.
??? 和其他全局的鉤子子程不一樣，JournalRecordProc 和JournalPlaybackProc鉤子子程永遠在設置該鉤子的線程的上下文中被調用。
??? After the hook procedure returns control to the system, the message continues to be processed. If code is HC_SKIP, the hook procedure must prepare to return the next recorded event message on its next call.
??? 在鉤子子程將控制權交還給系統之后，消息被繼續處理。如果code參數是HC_SKIP ,鉤子子程必須準備在下一次調用時返回下一條記錄的事件消息。
??? Install the JournalPlaybackProc hook procedure by specifying the WH_JOURNALPLAYBACK hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.
??? 通過指定WH_JOURNALPLAYBACK鉤子類型，以及一個鉤子子程的指針(該子程在SetWindowsHookEx方法中被調用)來安裝JournalPlaybackProc鉤子子程。
??? If the user presses CTRL+ESC OR CTRL+ALT+DEL during journal playback, the system stops the playback, unhooks the journal playback procedure, and posts a WM_CANCELJOURNAL message to the journaling application.
??? 在回放過程中，如果用戶按下了 CTRL+ESC 或者 CTRL+ALT+DEL組合鍵，系統將停止回放，卸載回放鉤子子程，傳遞一個WM_CANCELJOURNAL消息給記錄應用程序。
??? If the hook procedure returns a message in the range WM_KEYFIRST to WM_KEYLAST, the following conditions apply:
??? 如果鉤子子程返回一個在WM_KEYFIRST到WM_KEYLAST范圍內的消息，下列條件應用：
??? The paramL member of the EVENTMSG structure specifies the virtual key code of the key that was pressed.
??? EVENTMSG結構的paramL成員指定被按下鍵的虛擬鍵碼。
??? The paramH member of the EVENTMSG structure specifies the scan code.
??? EVENTMSG結構的paramL成員指定掃描碼。
??? There's no way to specify a repeat count. The event is always taken to represent one key event.
??? 沒有辦法指定重復的計數。事件總是趨于代表一個鍵事件。
8、WH_JOURNALRECORD
??? The JournalRecordProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The function records messages the system removes from the system message queue. Later, an application can use a JournalPlaybackProc hook procedure to play back the messages.
??? JournalRecordProc鉤子子程是與SetWindowsHookEx一起使用的、程序定義的或者庫定義的回調函數。該方法記錄系統從系統消息隊列中移除的消息。過后，應用程序可以使用JournalPlaybackProc鉤子子程回放這些消息。
Parameters 參數
??? code? ：[in] Specifies how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定如何處理消息。如果code小于0，鉤子子程不對其進行任何進一步的處理，必須將消息傳遞給CallNextHookEx方法，并返回由CallNextHookEx方法返回的返回值。該參數可以是以下值之一：
??? 1．HC_ACTION? ： The lParam parameter is a pointer to an EVENTMSG structure containing information about a message removed from the system queue. The hook procedure must record the contents of the structure by copying them to a buffer or file.
??? 參數lParam 是一個指向EVENTMSG結構的指針，該結構包含從系統隊列中移除的消息的信息。鉤子子程應該通過將消息信息拷貝到緩沖區中或者文件中來記錄內容。
??? 2．HC_SYSMODALOFF ：A system-modal dialog box has been destroyed. The hook procedure must resume recording.
??? 系統模式對話框已經被銷毀。鉤子子程必須恢復紀錄。
??? 3．HC_SYSMODALON ：A system-modal dialog box is being displayed. Until the dialog box is destroyed, the hook procedure must stop recording.
??? 系統模式對話框正在被顯示。鉤子子程應該停止記錄，直到對話框被銷毀。
??? wParam ：This parameter is not used. 該參數未使用。
??? lParam ：[in] Pointer to an EVENTMSG structure that contains the message to be recorded.
??? 指向EVENTMSG結構的指針，其中包含即將被記錄的消息。
Return Value? 返回值
??? The return value is ignored. 被忽略。
Remarks 備注
??? A JournalRecordProc hook procedure must copy but not modify the messages. After the hook procedure returns control to the system, the message continues to be processed.
??? JournalRecordProc鉤子子程應該復制而不是不修改消息。在鉤子子程將控制全交還給系統后，消息將被繼續處理。
??? A JournalRecordProc hook procedure does not need to live in a dynamic-link library. A JournalRecordProc hook procedure can live in the application itself.
??? JournalRecordProc鉤子子程沒必要生存在動態鏈接庫中，可以在應用程序自身中生存。
??? Unlike most other global hook procedures, the JournalRecordProc and JournalPlaybackProc hook procedures are always called in the context of the thread that set the hook.
??? 和其它全局鉤子子程不一樣，JournalRecordProca和 JournalPlaybackProc鉤子子程總是在設置鉤子的線程的上下文中被調用。
??? An application that has installed a JournalRecordProc hook procedure should watch for the VK_CANCEL virtual key code (which is implemented as the CTRL+BREAK key combination on most keyboards). This virtual key code should be interpreted by the application as a signal that the user wishes to stop journal recording. The application should respond by ending the recording sequence and removing the JournalRecordProc hook procedure. Removal is important. It prevents a journaling application from locking up the system by hanging inside a hook procedure.
??? 安裝有JournalRecordProc鉤子子程的應用程序應該監視VK_CANCEL虛擬鍵碼（在多數鍵盤上就是像CTRL+BREAK一樣實現的組合鍵）。虛擬鍵值應該被應用程序解釋為用戶希望停止日志記錄的信號。應用程序應該通過結束記錄隊列或者移除JournalRecordProc鉤子子程來響應用戶的信號?？梢瞥允侵匾?，可以防止日志應用程序由于鉤子子程內部的掛起而引起的系統鎖死。
??? This role as a signal to stop journal recording means that a CTRL+BREAK key combination cannot itself be recorded. Since the CTRL+C key combination has no such role as a journaling signal, it can be recorded. There are two other key combinations that cannot be recorded: CTRL+ESC and CTRL+ALT+DEL. Those two key combinations cause the system to stop all journaling activities (record or playback), remove all journaling hooks, and post a WM_CANCELJOURNAL message to the journaling application.
??? CTRL+BREAK組合鍵扮演著停止日志記錄的信號的角色，這意味著CTRL+BREAK組合鍵不能被自我記錄。既然CTRL+C組合鍵沒有扮演這樣的角色，它就可以被記錄。還有其它2種組合鍵不能被記錄： CTRL+ESC 和 CTRL+ALT+DEL。.這2種組合鍵引起系統停止所有日志活動(記錄或者回放)，移除所有日志鉤子，傳遞WM_CANCELJOURNAL消息給日志記錄應用程序。
9、WH_KEYBOARD_LL
??? The LowLevelKeyboardProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function every time a new keyboard input event is about to be posted into a thread input queue. The keyboard input can come from the local keyboard driver or from calls to the keybd_event function. If the input comes from a call to keybd_event, the input was "injected". However, the WH_KEYBOARD_LL hook is not injected into another process. Instead, the context switches back to the process that installed the hook and it is called in its original context. Then the context switches back to the application that generated the event.
??? LowLevelKeyboardProc鉤子子程是同SetWindowsHookEx方法一起使用的、應用程序定義的或者庫定義的回調函數。當每次有新的鍵盤輸入事件即將被傳遞給一個線程輸入隊列時，系統會調用該方法。鍵盤輸入可以來自本地鍵盤驅動，也可以來自對keybd_event事件的調用。如果輸入來自對keybd_event事件的調用，那么輸入是被“注入”的。然而，WH_KEYBOARD_LL鉤子不被注入到其它進程中。因為上下文會切換回安裝鉤子的進程，該鉤子就會在原始的上下文中被調用。然后，上下文切換回生成該事件的應用程序中。
Parameters參數
??? nCode ：[in] Specifies a code the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定鉤子子程使用的代碼，鉤子子程使用該值決定如何處理消息。如果nCode小于0，鉤子子程必須將消息傳遞給CallNextHookEx方法，自己不做進一步的處理，并且要返回由方法CallNextHookEx返回的的返回值。該參數可以是下列值之一。
??? 1．HC_ACTION ：The wParam and lParam parameters contain information about a keyboard message.
??? 參數wParam和lParam包含有和鍵盤消息相關的信息。
??? wParam ：[in] Specifies the identifier of the keyboard message. This parameter can be one of the following messages: WM_KEYDOWN, WM_KEYUP, WM_SYSKEYDOWN, or WM_SYSKEYUP.
??? 指定鍵盤消息的標識符。該參數可以是以下參數之一： WM_KEYDOWN, WM_KEYUP, WM_SYSKEYDOWN, or WM_SYSKEYUP.
??? lParam? ： [in] Pointer to a KBDLLHOOKSTRUCT structure.
??? 指向KBDLLHOOKSTRUCT結構的指針。
Return Value返回值
??? If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx. If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_KEYBOARD_LL hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.
??? 如果nCode小于0，鉤子子程必須返回由方法CallNextHookEx返回的返回值。如果nCode大于等于0，并且鉤子子程還沒有處理消息，強烈建議調用CallNextHookEx方法，返回有它返回的返回值；否則，其它已經安裝了WH_KEYBOARD_LL 鉤子的應用程序將接收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程已經處理了該消息，將返回一個非0值來阻止系統將消息傳遞給鉤子鏈表中的其他鉤子，或者目的窗體程序。
Remarks備注
??? This hook is called in the context of the thread that installed it. The call is made by sending a message to the thread that installed the hook. Therefore, the thread that installed the hook must have a message loop.
??? 鉤子在安裝它的線程的上下文中被調用。通過發送消息給安裝該鉤子的線程來實現調用。因此，安裝有該鉤子的線程必須有消息循環。
??? The hook procedure should process a message in less time than the data entry specified in the LowLevelHooksTimeout value in the following registry key:
??? HKEY_CURRENT_USER\Control Panel\Desktop
??? The value is in milliseconds. If the hook procedure does not return during this interval, the system will pass the message to the next hook.
??? Note that debug hooks cannot track this type of hook.
??? 鉤子子程應該用比下面時間少的時間來處理消息： 在注冊表的HKEY_CURRENT_USER\Control Panel\Desktop鍵的 LowLevelHooksTimeout值指定的時間，該值是以毫秒為單位的。如果鉤子子程在這個間隔內沒有返回，系統將把消息傳遞給下一個鉤子。
??? 注意：調試鉤子不能跟蹤該類型的鉤子。
10、WH_KEYBOARD
??? The KeyboardProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever an application calls the GetMessage or PeekMessage function and there is a keyboard message (WM_KEYUP or WM_KEYDOWN) to be processed.
??? KeyboardProc鉤子子程是同SetWindowsHookEx方法一起使用的、用戶定義的或者庫定義的回調函數。無論什么時候，當應用程序調用GetMessage 或者 PeekMessage方法時，系統都調用該方法，將有一個鍵盤消息(WM_KEYUP或者 WM_KEYDOWN)被處理。
???
Parameters參數
??? code? ： [in] Specifies a code the hook procedure uses to determine how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定鉤子子程使用的代碼，來決定如何處理該消息。如果code小于0，鉤子子程必須將該消息傳遞給CallNextHookEx方法，自己不進行任何進一步的處理，并且返回由CallNextHookEx方法返回的返回值。該參數可以是以下值之一：
??? 1．HC_ACTION ：The wParam and lParam parameters contain information about a keystroke message.
??? 參數 wParam 和 lParam 包含有鍵盤敲擊消息的信息。
??? 2．HC_NOREMOVE ：The wParam and lParam parameters contain information about a keystroke message, and the keystroke message has not been removed from the message queue. (An application called the PeekMessage function, specifying the PM_NOREMOVE flag.)
??? 參數wParam和lParam包含有鍵盤敲擊消息的信息，鍵盤敲擊消息還沒有被從消息隊列中移除。(應用程序調用PeekMessage方法，同時指定PM_NOREMOVE標志。)
??? wParam ：[in] Specifies the virtual-key code of the key that generated the keystroke message.
??? 指定生成鍵盤敲擊消息的鍵的虛擬鍵碼值。
??? lParam ：[in] Specifies the repeat count, scan code, extended-key flag, context code, previous key-state flag, and transition-state flag. This parameter can be one or more of the following values.
??? 指定重復次數，掃描代碼，擴展鍵標志，上下文代碼，前期的鍵狀態標志，轉換狀態標志。該參數可下列的一個或者多個值。
??? 0-15? ： Specifies the repeat count. The value is the number of times the keystroke is repeated as a result of the user's holding down the key.
??? 指定重復的次數。該值是，當用戶持續按住一個鍵時，鍵盤敲擊被重復的次數。
??? 16-23? ：Specifies the scan code. The value depends on the OEM.
??? 指定掃描代碼。該值依賴于OEM。
??? 24? ：Specifies whether the key is an extended key, such as a function key or a key on the numeric keypad. The value is 1 if the key is an extended key; otherwise, it is 0.
??? 指定該值是否是一個擴展鍵，例如功能鍵或者數字鍵盤上的鍵。如果是擴展鍵，該值為1，否則為0。
??? 25-28 ： Reserved.保留
??? 29? ：Specifies the context code. The value is 1 if the ALT key is down; otherwise, it is 0.
??? 指定上下文代碼。如果ALT鍵被按下，該值為1，否則為0。
??? 30? : Specifies the previous key state. The value is 1 if the key is down before the message is sent; it is 0 if the key is up.
??? 指定前面的鍵狀態。如果在消息發出之前該鍵被按下，值為1；如果鍵彈起，值為0。
??? 31? ： Specifies the transition state. The value is 0 if the key is being pressed and 1 if it is being released.
??? 指定轉換狀態。如果鍵正在被按下，該值為0，如果正在被釋放，則為1。
Return Value 返回值
??? If code is less than zero, the hook procedure must return the value returned by CallNextHookEx. If code is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_KEYBOARD hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.
??? 如果code小于0，鉤子子程必須返回由CallNextHookEx返回的返回值。如果code大于等于0，表示鉤子子程沒有處理該消息，強烈要求調用CallNextHookEx方法，并返回由它返回的返回值；否則，其它已經安裝有WH_KEYBOARD鉤子的應用程序將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程處理了該消息，可能返回一個非0值，用來阻止系統將該消息傳遞給鉤子鏈表中的其它鉤子或者目的窗體程序。
11、WH_MOUSE_LL
??? The LowLevelMouseProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system call this function every time a new mouse input event is about to be posted into a thread input queue. The mouse input can come from the local mouse driver or from calls to the mouse_event function. If the input comes from a call to mouse_event, the input was "injected". However, the WH_MOUSE_LL hook is not injected into another process. Instead, the context switches back to the process that installed the hook and it is called in its original context. Then the context switches back to the application that generated the event.
??? LowLevelMouseProc鉤子子程是同SetWindowsHookEx方法一起使用的、應用程序定義的或者庫定義的回調函數。系統在每次有新的鼠標輸入事件即將被傳遞給線程輸入隊列時，調用該方法。鼠標輸入可以來自本地鼠標驅動或者對mouse_event方法的調用。如果輸入來自對mouse_event的調用，該輸入就是被“注入”。 然而，WH_MOUSE_LL鉤子不能被注入到其他進程。因為上下文會切換回安裝該鉤子的進程，該鉤子會在原始的上下文中被調用。然后，上下文切換回生成該事件的應用程序中。
Parameters 參數
??? nCode ：[in] Specifies a code the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定鉤子子程使用的代碼，用來決定如何處理消息。如果nCode小于0，鉤子子程必須將消息傳遞給CallNextHookEx方法，自己不進行進一步的處理，并且應該返回由方法CallNextHookEx返回的返回值。參數可以是下列值之一：
??? 1．HC_ACTION ：The wParam and lParam parameters contain information about a mouse message.
??? wParam 和 lParam 參數包含有鼠標消息的信息。
??? wParam ：[in] Specifies the identifier of the mouse message. This parameter can be one of the following messages: WM_LBUTTONDOWN, WM_LBUTTONUP, WM_MOUSEMOVE, WM_MOUSEWHEEL, WM_RBUTTONDOWN, or WM_RBUTTONUP.
??? 指定鼠標消息的標識符。參數可以是以下消息之一： WM_LBUTTONDOWN, WM_LBUTTONUP, WM_MOUSEMOVE, WM_MOUSEWHEEL, WM_RBUTTONDOWN, WM_RBUTTONUP.
??? lParam ：[in] Pointer to an MSLLHOOKSTRUCT structure.
??? 指向MSLLHOOKSTRUCT結構的指針。
Return Value 返回值
??? If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.
??? 如果nCode小于0，鉤子子程必須返回由方法CallNextHookEx返回的返回值。
??? If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_MOUSE_LL hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.
??? 如果nCode大于等于0，而且鉤子子程沒有處理該消息，那么強烈要求調用方法CallNextHookEx并返回由它返回的返回值；否則，其它已經安裝了WH_MOUSE_LL鉤子的應用程序將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程已經處理了該消息，將返回一個非0值，用來阻止系統將消息傳遞給鉤子鏈表中的其它鉤子或者目標窗體程序。
Remarks 備注
??? An application installs the hook procedure by specifying the WH_MOUSE_LL hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.
??? 應用程序通過下面的方法安裝該鉤子子程：指定WH_MOUSE_LL鉤子類型；指定在調用SetWindowsHookEx的方法中的指向鉤子子程的指針。
??? This hook is called in the context of the thread that installed it. The call is made by sending a message to the thread that installed the hook. Therefore, the thread that installed the hook must have a message loop.
??? 該鉤子在安裝它的線程的上下文中被調用。通過發送消息給安裝鉤子的線程來實現調用。因此，安裝鉤子的線程必須有消息循環。
??? The hook procedure should process a message in less time than the data entry specified in the LowLevelHooksTimeout value in the following registry key:
??? HKEY_CURRENT_USER\Control Panel\Desktop
??? The value is in milliseconds. If the hook procedure does not return during this interval, the system will pass the message to the next hook.
??? Note that debug hooks cannot track this type of hook.
??? 鉤子子程應該用比下面時間少的時間來處理消息： 在注冊表的HKEY_CURRENT_USER\Control Panel\Desktop鍵的 LowLevelHooksTimeout值指定的時間。該值是以毫秒為單位的。如果鉤子子程在這個間隔沒有返回，系統將把消息傳遞給下一個鉤子。注意：調試鉤子不能追蹤該類型的鉤子。
12、WH_MOUSE
??? The MouseProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever an application calls the GetMessage or PeekMessage function and there is a mouse message to be processed.
??? MouseProc鉤子子程是同SetWindowsHookEx方法一起使用的、應用程序定義的或者庫定義的回調函數。無論什么時候，當應用程序一調用GetMessage 或者 PeekMessage方法，有鼠標消息即將被處理時，系統調用該方法。
Parameters 參數
??? nCode ：[in] Specifies a code the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定鉤子子程使用的用來決定如何處理消息的碼值。如果nCode小于0，鉤子子程必須將消息傳遞給CallNextHookEx方法，自己不進行進一步的處理，并且要返回由CallNextHookEx方法返回的返回值。該參數可以是下列值之一：
??? 1．HC_ACTION ：The wParam and lParam parameters contain information about a mouse message.
??? 參數wParam 和 lParam包含和鼠標消息相關的信息。
??? 2．HC_NOREMOVE ：The wParam and lParam parameters contain information about a mouse message, and the mouse message has not been removed from the message queue. (An application called the PeekMessage function, specifying the PM_NOREMOVE flag.)
??? 參數wParam 和 lParam包含和鼠標消息相關的信息，鼠標消息還沒有從消息隊列中移除。
??? wParam ：[in] Specifies the identifier of the mouse message.
??? 指定鼠標消息的標識符。
???
??? lParam：[in] Pointer to a MOUSEHOOKSTRUCT structure.
??? 指向MOUSEHOOKSTRUCT結構的指針。
Return Value 返回值
??? If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx. If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_MOUSE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the target window procedure.
??? 如果code小于0，鉤子子程必須返回由CallNextHookEx方法返回的返回值。如果code大于等于0，鉤子子程還沒有處理該消息，強烈要求調用CallNextHookEx方法并返回由它返回的返回值；否則，其它已經安裝了WH_MOUSE鉤子的應用程序將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程已經處理了該消息，應該返回非0值，以阻止系統將消息傳遞給鉤子鏈表中剩余的鉤子或者目標窗體程序。
Remarks備注
??? An application installs the hook procedure by specifying the WH_MOUSE hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function. The hook procedure must not install a WH_JOURNALPLAYBACK Hook callback function.
??? 應用程序通過下面方法來安裝鉤子：指定WH_MOUSE鉤子類型；指定在調用SetWindowsHookEx的方法中指向鉤子子程的指針。該鉤子子程不應安裝WH_JOURNALPLAYBACK鉤子的回調函數。
?
?
13、WH_SHELL
??? The ShellProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The function receives notifications of Shell events from the system.
??? The HOOKPROC type defines a pointer to this callback function. ShellProc is a placeholder for the application-defined or library-defined function name.
??? ShellProc鉤子子程是同SetWindowsHookEx一起使用的、應用程序定義的或者庫定義的回調函數。該方法接收來自系統的加殼事件通知。HOOKPROC類型定義了指向該方法的指針。ShellProc是應用程序定義的或者庫定義的方法的名字。
Parameters參數
??? nCode ：[in] Specifies the hook code. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定鉤子代碼。如果nCode小于0，鉤子子程必須將消息傳遞給CallNextHookEx方法，自己不進行進一步的處理，并且應該返回由CallNextHookEx方法返回的返回值。該參數可以是下列值：
??? 1．HSHELL_ACCESSIBILITYSTATE
??? Windows 2000/XP: The accessibility state has changed. 可訪問性已經改
???
??? 2．HSHELL_ACTIVATESHELLWINDOW
??? The shell should activate its main window. 外殼應該激活它的主窗口。
???
??? 3．HSHELL_APPCOMMAND
??? Windows 2000/XP: The user completed an input event (for example, pressed an application command button on the mouse or an application command key on the keyboard), and the application did not handle the WM_APPCOMMAND message generated by that input.
??? 用戶完成一個輸入事件(例如，按下應用程序鼠標上的命令按鈕或者鍵盤上的命令鍵)，應用程序沒有處理由該輸入產生的WM_APPCOMMAND 消息。
??? If the Shell procedure handles the WM_COMMAND message, it should not call CallNextHookEx. See the Return Value section for more information.
??? 如果Shell子程獲得了WM_COMMAND消息的句柄，不應該調用CallNextHookEx 。
???
??? 4．HSHELL_GETMINRECT
??? A window is being minimized or maximized. The system needs the coordinates of the minimized rectangle for the window.
??? 窗口正在被最小化或者最大化。系統需要窗體的最小矩形框的坐標。
??? 5．HSHELL_LANGUAGE
??? Keyboard language was changed or a new keyboard layout was loaded.
??? 鍵盤語言被改變了或者新的鍵盤布局被加載了。
??? 6．HSHELL_REDRAW
??? The title of a window in the task bar has been redrawn.
??? 任務欄中的窗口標題被重繪了。
??? 7．HSHELL_TASKMAN
??? The user has selected the task list. A shell application that provides a task list should return TRUE to prevent Microsoft Windows from starting its task list.
??? 用戶選擇了任務列表。提供了任務列表的加殼應用程序應該返回TRUE,來阻止windows啟動任務列表。
??? 8．HSHELL_WINDOWACTIVATED
??? The activation has changed to a different top-level, unowned window.
??? 激活動作變成了不同的top-level，unowned 的窗口。(即，激活了不同的不明窗口，使其處于最上層。)
??? 9．HSHELL_WINDOWCREATED
??? A top-level, unowned window has been created. The window exists when the system calls this hook.
??? 頂層的、不受控制的窗體已經被創建。當系統調用該鉤子時，窗口存在。
??? 10．HSHELL_WINDOWDESTROYED
??? A top-level, unowned window is about to be destroyed. The window still exists when the system calls this hook.
??? 頂層的、不受控制的窗體即將被銷毀。當系統調用該鉤子的時候該窗體依然存在。
??? 11．HSHELL_WINDOWREPLACED
??? Windows XP: A top-level window is being replaced. The window exists when the system calls this hook.
??? 在Windows XP環境下，頂層的窗體正在被替換掉。當系統調用該鉤子時，窗口存在。
??? wParam [in] The value depends on the value of the nCode parameter, as shown in the following table.
??? 該值取決于參數 nCode ，如下表所示。
?
---------------------------------------------------------------------------------------
| nCode???????????????????????? |wParam????????????????????????????????????????????????????????????????????????????????????????????????????????? |
---------------------------------------------------------------------------------------
| HSHELL_ACCESSIBILITYSTATE???? |Windows 2000/XP: Indicates which accessibility?????? |
|????????????????????????????????????????????????????????????????? |feature has changed state. This value is one???????????? |
|???????????????????????????????????????????????????????????????????? |of the following: ACCESS_FILTERKEYS,???????????????? |
|?????????????????????????????? |ACCESS_MOUSEKEYS, or ACCESS_STICKYKEYS.????????????? |
|?????????????????????????????? |???????????????????????????????????????????????????? |
|?????????????????????????????? |在Windows XP 環境下：指示哪種訪問特征已經被改變????? |
|?????????????????????????????? |了狀態。值可以是下列之一：ACCESS_FILTERKEYS,???????? |
|?????????????????????????????? |ACCESS_MOUSEKEYS, ACCESS_STICKYKEYS.???????????????? |
---------------------------------------------------------------------------------------
|HSHELL_APPCOMMAND????????????? |Windows 2000/XP: Where the WM_APPCOMMAND???????????? |
|?????????????????????????????? |message was originally sent; for example, the??????? |
|?????????????????????????????? |handle to a window.????????????????????????????????? |
|?????????????????????????????? |???????????????????????????????????????????????????? |
|?????????????????????????????? |是WM_APPCOMMAND消息最初發出的位置，例如，窗口的????? |
|?????????????????????????????? |句柄。?????????????????????????????????????????????? |
---------------------------------------------------------------------------------------
|HSHELL_GETMINRECT????????????? |Handle to the minimized or maximized window.???????? |
|?????????????????????????????? |最小化或者最大化的窗體的句柄。?????????????????????? |
---------------------------------------------------------------------------------------
|HSHELL_LANGUAGE??????????????? |Handle to the window.窗口句柄。????????????????????? |
---------------------------------------------------------------------------------------
|HSHELL_REDRAW????????????????? |Handle to the redrawn window.重化窗口句柄。????????? |
---------------------------------------------------------------------------------------
|HSHELL_WINDOWACTIVATED???????? |Handle to the activated window.活動窗口句柄。??????? |
---------------------------------------------------------------------------------------
|HSHELL_WINDOWCREATED?????????? |Handle to the created window.被創建的窗口的句柄。??? |
---------------------------------------------------------------------------------------?????????????????????????????????????????????????????????????????????????????? |
|HSHELL_WINDOWDESTROYED???????? |Handle to the destroyed window.被銷毀的窗口的句柄。? |
---------------------------------------------------------------------------------------
|HSHELL_WINDOWREPLACED????????? |Windows XP: Handle to the window being replaced.???? |
|?????????????????????????????? |即將被替換的窗體的句柄。???????????????????????????? |
---------------------------------------------------------------------------------------
??? lParam? [in] The value depends on the value of the nCode parameter, as shown in the following table.
??? 該值取決于參數nCode。如下表所示。
--------------------------------------------------------------------------------------------------------------???
|nCode????????????????????????? | lParam???????????????????????????????????????????????????????????????????? |
|?????????????????????????????? |??????????????????????????????????????????????????????????????????????????? |
|HSHELL_APPCOMMAND????????????? | Windows 2000/XP:GET_APPCOMMAND_LPARAM(lParam) is the application?????????? |
|?????????????????????????????? | command corresponding to the input event.????????????????????????????????? |
|?????????????????????????????? | GET_APPCOMMAND_LPARAM是對輸入事件做出響應的應用程序命令。????????????????? |
|?????????????????????????????? |??????????????????????????????????????????????????????????????????????????? |
|?????????????????????????????? | GET_DEVICE_LPARAM(lParam) indicates what generated the input?????????????? |
|?????????????????????????????? | event; for example, the mouse or keyboard.???????????????????????????????? |
|?????????????????????????????? | GET_DEVICE_LPARAM指示是什么生成了輸入事件。例如，鼠標或者鍵盤。??????????? |
|?????????????????????????????? |??????????????????????????????????????????????????????????????????????????? |
|?????????????????????????????? | GET_FLAGS_LPARAM(lParam) depends on the value of cmd in??????????????????? |
|?????????????????????????????? | WM_APPCOMMAND. For example, it might indicate which virtual keys?????????? |
|?????????????????????????????? | were held down when the WM_APPCOMMAND message was originally sent.???????? |
|?????????????????????????????? | GET_FLAGS_LPARAM(lParam)依賴于 WM_APPCOMMAND中CMD的值。例如，可以????????? |
|?????????????????????????????? | 指示當WM_APPCOMMAND消息被發出的時候，哪個虛擬鍵被按下。??????????????????? |
--------------------------------------------------------------------------------------------------------------
|HSHELL_GETMINRECT????????????? | Pointer to a RECT structure.??? RECT結構的指針???????????????????????????? |
--------------------------------------------------------------------------------------------------------------
|HSHELL_LANGUAGE??????????????? | Handle to a keyboard layout.?? 鍵盤布局的句柄。??????????????????????????? |
--------------------------------------------------------------------------------------------------------------
|HSHELL_REDRAW????????????????? | The value is TRUE if the window is flashing, or FALSE otherwise.?????????? |
|?????????????????????????????? | 如果窗口正在閃爍（重繪過程中），該值為true，其他為false??????????????????? |
--------------------------------------------------------------------------------------------------------------
|HSHELL_WINDOWACTIVATED???????? | The value is TRUE if the window is in full-screen mode, or FALSE otherwise.|
|?????????????????????????????? | 如果窗體處于全屏模式，該值是true，否則為false。??????????????????????????? |
--------------------------------------------------------------------------------------------------------------
|HSHELL_WINDOWREPLACED????????? | Windows XP: Handle to the new window.新窗體的句柄。??????????????????????? |
--------------------------------------------------------------------------------------------------------------
Return Value返回值
??? The return value should be zero unless the value of nCode is HSHELL_APPCOMMAND and the shell procedure handles the WM_COMMAND message. In this case, the return should be nonzero.
??? 如果nCode的值是HSHELL_APPCOMMAND，shell子程句柄指向WM_COMMAND 消息，在這種情況下，返回值是非0。其他情況下，返回值是0。
Remarks備注
??? Install this hook procedure by specifying the WH_SHELL hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.
??? 通過指定WH_SHELL 鉤子類型以及在SetWindowsHookEx的方法中的指向鉤子子程的指針來安裝該鉤子子程。
???
14、WH_SYSMSGFILTER
??? The SysMsgProc hook procedure is a library-defined callback function used with the SetWindowsHookEx function. The system calls this function after an input event occurs in a dialog box, message box, menu, or scroll bar, but before the message generated by the input event is processed. The function can monitor messages for any dialog box, message box, menu, or scroll bar in the system.
??? SysMsgProc鉤子子程是同SetWindowsHookEx一起使用的在庫中定義的回調函數。在對話框、消息框、菜單、滾動條中所屬的輸入事件發生后，在這些消息被系統處理之前，系統調用該方法。該方法能夠為系統中任何對話框、消息框、菜單、滾動條監視消息。
Parameters參數
??? nCode [in] Specifies the type of input event that generated the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
??? 指定生成該消息的輸入事件的類型。如果nCode小于0，鉤子子程必須將消息傳遞給CallNextHookEx方法，自己不進行進一步的處理，并且應該返回由CallNextHookEx方法返回的返回值。。該參數可以是以下值之一：
??? 1．MSGF_DIALOGBOX ：The input event occurred in a message box or dialog box.?
??? 輸入事件在消息框或者對話框中發生。
??? 2．MSGF_MENU ：The input event occurred in a menu.
??? 輸入事件在菜單中發生。
??? 3．MSGF_SCROLLBAR ：The input event occurred in a scroll bar.
??? 輸入事件在滾動條中發生。
??? wParam ：This parameter is not used. 該參數未使用。
??? lParam ：[in] Pointer to an MSG message structure.指向MSG消息結構的指針。
Return Value 返回值
??? If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.
??? If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_SYSMSGFILTER hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the target window procedure.
??? 如果nCode小于0，鉤子子程必須返回由CallNextHookEx方法返回的返回值。如果nCode大于等于0，并且鉤子子程還沒有處理該消息，強烈要求調用CallNextHookEx方法并返回由它返回的返回值。否則，其他已經安裝了WH_SYSMSGFILTER鉤子的應用程序將接收不到鉤子通知，可能導致行為錯誤。如果鉤子子程已經處理了該消息，應該返回非0 值，來阻止系統將消息傳遞給目標窗體程序。
Remarks備注
??? An application installs the hook procedure by specifying the WH_SYSMSGFILTER hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.
??? 應用程序安裝該鉤子通過：指定WH_SYSMSGFILTER鉤子類型；指定在調用SetWindowsHookEx方法的指向鉤子子程的指針。
15、WH_MSGFILTER
??? The MessageProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function after an input event occurs in a dialog box, message box, menu, or scroll bar, but before the message generated by the input event is processed. The hook procedure can monitor messages for a dialog box, message box, menu, or scroll bar created by a particular application or all applications.
??? The HOOKPROC type defines a pointer to this callback function. MessageProc is a placeholder for the application-defined or library-defined function name.
Syntax
LRESULT CALLBACK MessageProc(????????? int code,
??? WPARAM wParam,
??? LPARAM lParam
);
Parameters
??? code
????? [in] Specifies the type of input event that generated the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and return the value returned by CallNextHookEx. This parameter can be one of the following values.
??????? MSGF_DDEMGR
??????????? The input event occurred while the Dynamic Data Exchange Management Library (DDEML) was waiting for a synchronous transaction to finish. For more information about DDEML, see Dynamic Data Exchange Management Library.
??????? MSGF_DIALOGBOX
??????????? The input event occurred in a message box or dialog box.
??????? MSGF_MENU
??????????? The input event occurred in a menu.
??????? MSGF_SCROLLBAR
??????????? The input event occurred in a scroll bar.
??? wParam
??????? This parameter is not used.
??? lParam
??????? [in] Pointer to an MSG structure.
Return Value
??? If code is less than zero, the hook procedure must return the value returned by CallNextHookEx.
??? If code is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_MSGFILTER hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.
Remarks
??? An application installs the hook procedure by specifying the WH_MSGFILTER hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.
??? If an application that uses the DDEML and performs synchronous transactions must process messages before they are dispatched, it must use the WH_MSGFILTER hook.
?
本文來自CSDN博客，轉載請標明出處：http://blog.csdn.net/jiangxinyu/archive/2010/02/03/5284067.aspx